sporades 0.8.6 → 0.8.7

package/CHANGES.md

@@ -1,103 +1,32 @@
 # Changes
 
-## Unreleased - 2026-08-17
+## Unreleased - 2026-08-18
 
-Changes since v0.8.5.
+Changes since v0.8.6.
 
 ### 🚀 Features
 
-- Migrate additive unique constraints atomically (2cf8381).
-- Add conflict-targeted idempotent table inserts (bd2aeaa).
-- Expose privileged Team inspections (16d784a).
-- Declare unique Capsule table constraints (f638b36).
-- Expose exact Team membership counts (6893db7).
+- Add transaction-bound trusted reads (9d23493).
 
 ### 🐛 Bug Fixes
 
-- Shut down rejected runtime candidates (5ec8198).
-- Preserve candidate on activation degradation (302268c).
-- Activate replacement jobs after teardown (ee4db9f).
-- Serialize job lease recovery (09dca55).
-- Refresh job leases after dev handoff (5961f77).
-- Recover jobs across runtime handoff (6d2b344).
-- Gate jobs on successful runtime initialization (3082aad).
-- Validate all schedule cursors (bf3dea0).
-- Arm schedule recovery after commit (da43e54).
-- Persist schedule upgrade lineage (54d664e).
-- Close schedule handoff and root reentry races (281029a).
-- Serialize legacy schedule upgrades (9e87fb1).
-- Publish schedule incarnations atomically (78da563).
-- Make schedule generations authoritative (9005b1e).
-- Bind schedules to declaration generations (b478ae7).
-- Make schedule claims transactional (960f2c6).
-- Seal retained job and libsql lifecycle (c5dc235).
-- Recover future leases and schedules safely (fa08688).
-- Bound job lifecycle time domains (89149c7).
-- Close pre-handler job shutdown races (ffdca81).
-- Make runtime shutdown failure atomic (1958f3b).
-- Harden transactional lifecycle cleanup (e408f2d).
-- Defer transactional job cancellation (2d3cf3e).
-- Linearize team reads and job claims (1aa5391).
-- Wake retained jobs on startup (0a66d61).
-- Settle transactional log writes (43e1b2b).
-- Revoke settled transaction adapters (bef9821).
-- Abort jobs through the root runtime (5a43040).
-- Settle jobs before lifecycle shutdown (51d1d9d).
-- Settle job shutdown safely (9d38300).
-- Await runtime closure during shutdown (ff688f1).
-- Settle scheduled Jobs before runtime shutdown (7e7204e).
-- Scope unique migration error translation (9af3b24).
-- Preserve non-unique migration errors (2cfb207).
-- Fix chained transaction release and async insert type (386ea84).
-- Fix async insertOrIgnore documentation (a41f2ac).
-- Guard privileged join-link reads (dea4ebc).
-- Close privileged Team inspection races (d53136c).
-- Redact privileged Team join metadata (ad77482).
-- Defer existing table unique changes (e49477d).
-
-### 🔧 Improvements
-
-- Ignore Macos fluff files (d4ae934).
+- Keep admission logs in transaction (5a9d012).
+- Revoke trusted reads at settlement (dca0fea).
+- Reject trusted reads from snapshots (9abe441).
+- Bind Join cancellation to commit (e37058d).
+- Close Team admission boundary races (b12dbde).
+- Trust Team Join admission reads (32b65ee).
+- Close trusted-read review gaps (da0c453).
 
 ### 📝 Documentation
 
-- Pin final platform contract evidence (65250af).
-- Align platform contracts after swarm amendments (8f64c4f).
-- Record swarm cleanup (7233572).
-- Close combined platform contract swarm (a1862c8).
-- Record final combined contract package proof (4c44bf8).
-- Record combined contract proof evidence (ac1c48c).
-- Record accepted unique migration contract (6c5e484).
-- Record accepted idempotent insert contract (19e7b63).
-- Align shipped Job lifecycle reference (9b7820f).
-- Document atomic Job enqueue lifecycle (9dbeb8a).
-- Reject nested database transaction scopes (3cc98b6).
-- Record accepted platform contract tickets (6ef6d1c).
-- Close unique constraint contract gaps (20baabb).
-- Prove unique constraint boundaries across adapters (f6d3517).
-- Cover immutable unique schema boundary (4fb81d9).
-- Initialize platform contracts swarm ledger (61816a1).
-- Add Team subscription platform tickets (494a086).
+- Complete trusted Join admission ticket (0347c0e).
+- Complete trusted-read foundation ticket (2a24b7b).
 
 ### 🧪 Tests
 
-- Reset native schedule clock before init (1153643).
-- Prove atomic Team Job enqueue failures (09265ab).
-- Preserve PostgreSQL quoting recorder transactions (85d2266).
-- Cover unrelated rebuild constraint failures (4605ec5).
-- Isolate Node 24 SQLite server tests (8542eb9).
-- Harden failed mutation cleanup (d43a5ab).
-- Bound transaction handler context lifetime (67dccb4).
-- Defer runtime Job dispatch until commit (0a04afb).
-- Persist Jobs inside handler transactions (b59004f).
-- Reject captured transaction reentry and drop rolled-back jobs (952309e).
-- Replace async-local transaction ownership (95cbb85).
-- Gate transaction connections and track mutation writes (20cda07).
-- Serialize shared database connection transactions (425e4f0).
-- Isolate composite unique conformance (75ace57).
-- Cover Team count membership lifecycle (80d6cd7).
-- Accept cross-realm query arrays (55b87a6).
-- Reject query argument array subclasses (2171b61).
+- Restore PostgreSQL SQL quoting audit (c1fcf7c).
+- Tidy up test (f643360).
 
 ## 0.8.5 - 2026-08-15
 

package/README.md

@@ -54,6 +54,8 @@ sporades host push --restart
 - **Built-in collaboration, explicitly authorized**: runtime-owned Teams,
   email-bound Join links, membership application roles, and explicit Team ACL
   decisions—without a hidden current Team or automatic data partitioning.
+  Trusted `teams.admitJoin` policies may make atomic seat decisions from
+  read-only app state hidden by the joining user's ordinary row ACLs.
 - **Realtime everything**: configuration free - automatic notifications, even for Postgress and AWS-S3
 
 ## Documentation

package/bin/sporades-host-helper.js

@@ -253,6 +253,7 @@ var nodeCryptoModule2 = process.getBuiltinModule("node:crypto");
 var TEAM_JOIN_LINK_DEFAULT_TTL_SECONDS = 60 * 60 * 24;
 var TEAM_JOIN_LINK_MIN_TTL_SECONDS = 5 * 60;
 var TEAM_JOIN_LINK_MAX_TTL_SECONDS = 60 * 60 * 24 * 7;
+var transactionBeforeCommitChecks = Symbol.for("sporades.database.transactionBeforeCommitChecks");
 
 // src/auth-runtime.ts
 var nodeCryptoModule3 = process.getBuiltinModule("node:crypto");
@@ -265,8 +266,10 @@ var PASSWORD_RESET_MAX_TTL_MS = 24 * 60 * 60 * 1e3;
 var nodeCryptoModule4 = process.getBuiltinModule("node:crypto");
 var nodeFsModule = process.getBuiltinModule("node:fs");
 var transactionOperations = Symbol.for("sporades.database.transactionOperations");
+var transactionBeforeCommitChecks2 = Symbol.for("sporades.database.transactionBeforeCommitChecks");
 
 // src/server-runtime-source.ts
+var trustedReadTransactionAdapter = Symbol("sporades.trustedReadTransactionAdapter");
 function logPayloadMaxBytes(config = {}) {
   const configured = Number(config.logs?.payloadMaxBytes ?? config.logging?.payloadMaxBytes);
   return Number.isInteger(configured) && configured > 0 ? configured : 4096;
@@ -422,7 +425,7 @@ function writeEnvelope(result, failed = false) {
 }
 
 // src/cli/cli-version.ts
-var CLI_VERSION = "0.8.6";
+var CLI_VERSION = "0.8.7";
 
 // src/cli/schedule-inspection-envelope.ts
 function sanitizeScheduleInspectionEnvelope(envelope, invalid) {

package/bin/sporades.js

@@ -8842,6 +8842,7 @@ var TEAM_JOIN_LINK_MAX_OUTSTANDING = 20;
 var TEAM_JOIN_LINK_CREATION_MAX_PER_HOUR = 10;
 var TEAM_JOIN_LINK_PRUNE_LIMIT = 100;
 var TEAM_JOIN_LINK_SECRET_ID = "v1";
+var transactionBeforeCommitChecks = Symbol.for("sporades.database.transactionBeforeCommitChecks");
 var TEAM_APPLICATION_ROLE_MAX = 32;
 var TEAM_APPLICATION_ROLE_PATCH_MAX = 16;
 var TEAM_APPLICATION_ROLE_PATTERN = /^[a-z][a-z0-9-]{0,31}$/;
@@ -9195,8 +9196,11 @@ async function validateTeamJoinLink(database, auth, code) {
 async function joinCurrentUserTeam(database, auth, code, eventContext) {
   let joined;
   let deniedTeamId = null;
+  let auditUserId = null;
   try {
     requireAuth({ auth }, { linked: true });
+    const joiningUserId = String(auth.userId);
+    auditUserId = joiningUserId;
     const parsed = parseTeamJoinCode(code);
     if (!parsed) throw invalidTeamJoinLink();
     joined = await withTeamTransaction(database, async (tx) => {
@@ -9226,7 +9230,7 @@ async function joinCurrentUserTeam(database, auth, code, eventContext) {
       if (!team) throw invalidTeamJoinLink();
       const attachedEmails = await tx.prepare(sql(
         "SELECT [email] FROM [sporades_auth_email_credentials] WHERE [userId] = ? UNION ALL SELECT [email] FROM [sporades_auth_identities] WHERE [userId] = ? AND [email] IS NOT NULL"
-      )).all(auth.userId, auth.userId);
+      )).all(joiningUserId, joiningUserId);
       const targetEmail = normalizeTeamJoinIdentityEmail(row.email);
       if (!attachedEmails.some((identity) => normalizeTeamJoinIdentityEmail(identity.email) === targetEmail)) {
         deniedTeamId = String(team.id);
@@ -9236,12 +9240,12 @@ async function joinCurrentUserTeam(database, auth, code, eventContext) {
         "SELECT [userId] FROM [sporades_team_join_link_redemptions] WHERE [joinLinkId] = ?"
       )).get(row.id);
       if (row.consumedAt) {
-        if (redemption?.userId !== auth.userId) throw invalidTeamJoinLink();
+        if (redemption?.userId !== joiningUserId) throw invalidTeamJoinLink();
         const membership2 = await tx.prepare(sql(
           "SELECT [role] FROM [sporades_team_memberships] WHERE [teamId] = ? AND [userId] = ?"
-        )).get(row.teamId, auth.userId);
+        )).get(row.teamId, joiningUserId);
         if (!membership2) throw invalidTeamJoinLink();
-        await ensureInitialTeamOnAdapter(tx, auth.userId);
+        await ensureInitialTeamOnAdapter(tx, joiningUserId);
         const count2 = await tx.prepare(sql("SELECT COUNT(*) AS [count] FROM [sporades_team_memberships] WHERE [teamId] = ?")).get(row.teamId);
         return teamSummary({ id: team.id, name: team.name, role: membership2.role, memberCount: Number(count2?.count ?? 0) });
       }
@@ -9252,23 +9256,24 @@ async function joinCurrentUserTeam(database, auth, code, eventContext) {
       if (Number(consumed?.changes ?? 0) !== 1) throw invalidTeamJoinLink();
       await tx.prepare(sql(
         "INSERT INTO [sporades_team_join_link_redemptions] ([joinLinkId], [teamId], [userId], [createdAt]) VALUES (?, ?, ?, ?)"
-      )).run(row.id, row.teamId, auth.userId, now);
-      await ensureInitialTeamOnAdapter(tx, auth.userId);
+      )).run(row.id, row.teamId, joiningUserId, now);
+      await ensureInitialTeamOnAdapter(tx, joiningUserId);
       let membership = await tx.prepare(sql(
         "SELECT [role] FROM [sporades_team_memberships] WHERE [teamId] = ? AND [userId] = ?"
-      )).get(row.teamId, auth.userId);
+      )).get(row.teamId, joiningUserId);
       if (!membership) {
-        await enforceTeamJoinAdmission(database, tx, auth, String(row.teamId));
-        await ensureMembershipCounterOnAdapter(tx, auth.userId);
+        await enforceTeamJoinAdmission(database, tx, auth, joiningUserId, String(row.teamId), eventContext?.signal);
+        registerTeamJoinCancellationBeforeCommit(tx, eventContext?.signal);
+        await ensureMembershipCounterOnAdapter(tx, joiningUserId);
         const claim = await tx.prepare(sql(
           "UPDATE [sporades_team_membership_counters] SET [membershipCount] = [membershipCount] + 1 WHERE [userId] = ? AND [membershipCount] < ?"
-        )).run(auth.userId, TEAM_MEMBERSHIP_MAX);
+        )).run(joiningUserId, TEAM_MEMBERSHIP_MAX);
         if (Number(claim?.changes ?? 0) !== 1) {
           throw commandError2("Team limit reached.", `A user can belong to at most ${TEAM_MEMBERSHIP_MAX} Teams.`, "TEAM_LIMIT_REACHED");
         }
         await tx.prepare(sql(
           "INSERT INTO [sporades_team_memberships] ([teamId], [userId], [role], [createdAt]) VALUES (?, ?, 'member', ?)"
-        )).run(row.teamId, auth.userId, now);
+        )).run(row.teamId, joiningUserId, now);
         membership = { role: "member" };
       }
       await releaseTeamJoinLinkCapacity(tx, String(row.teamId));
@@ -9276,29 +9281,40 @@ async function joinCurrentUserTeam(database, auth, code, eventContext) {
       return teamSummary({ id: team.id, name: team.name, role: membership.role, memberCount: Number(count?.count ?? 0) });
     });
   } catch (error) {
-    emitTeamSecurityEvent(database, eventContext, "teams.joinLink.join", auth?.userId, deniedTeamId, "denied", String(error?.code ?? "INVALID_JOIN_LINK"));
+    emitTeamSecurityEvent(database, eventContext, "teams.joinLink.join", auditUserId ?? auth?.userId, deniedTeamId, "denied", String(error?.code ?? "INVALID_JOIN_LINK"));
     throw error;
   }
-  emitTeamSecurityEvent(database, eventContext, "teams.joined", auth.userId, joined.id, "succeeded", "TEAM_JOINED");
+  emitTeamSecurityEvent(database, eventContext, "teams.joined", auditUserId, joined.id, "succeeded", "TEAM_JOINED");
   return { team: joined };
 }
-async function enforceTeamJoinAdmission(database, tx, auth, teamId) {
-  if (typeof database.teamJoinAdmission !== "function") return;
+async function enforceTeamJoinAdmission(database, tx, auth, joiningUserId, teamId, signal) {
+  if (typeof database.runTeamJoinAdmission !== "function") return;
   const count = await tx.prepare(tx.dialect.sql(
     "SELECT COUNT(*) AS [count] FROM [sporades_team_memberships] WHERE [teamId] = ?"
   )).get(teamId);
   try {
-    const context = database.createTeamJoinAdmissionContext(tx, auth);
-    const decision = await database.teamJoinAdmission(context, {
+    const decision = await database.runTeamJoinAdmission(tx, auth, {
       teamId,
-      userId: auth.userId,
+      userId: joiningUserId,
       currentMemberCount: Number(count?.count ?? 0)
-    });
+    }, signal);
     if (decision?.allow !== true) throw teamJoinDenied();
   } catch {
     throw teamJoinDenied();
   }
 }
+function throwIfTeamJoinCancelled(signal) {
+  if (signal?.aborted) throw teamJoinDenied();
+}
+function registerTeamJoinCancellationBeforeCommit(transactionAdapter, signal) {
+  if (!signal) return;
+  let checks = transactionAdapter[transactionBeforeCommitChecks];
+  if (!Object.prototype.hasOwnProperty.call(transactionAdapter, transactionBeforeCommitChecks)) {
+    checks = [];
+    Object.defineProperty(transactionAdapter, transactionBeforeCommitChecks, { value: checks });
+  }
+  checks.push(() => throwIfTeamJoinCancelled(signal));
+}
 function normalizeTeamJoinEmail(email) {
   const normalized = String(email ?? "").trim().toLowerCase();
   if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(normalized)) {
@@ -13282,8 +13298,14 @@ async function rejectNestedTransactionScope() {
     "Keep mutation work inside a single Sporades mutation transaction."
   );
 }
-var transactionScopeRevokers = /* @__PURE__ */ new WeakMap();
-function createTransactionScopedAdapter(adapter, operations = {}) {
+var transactionScopes = /* @__PURE__ */ new WeakMap();
+function isActiveTransactionScopedAdapter(value, owner) {
+  const scope = value && typeof value === "object" ? transactionScopes.get(value) : void 0;
+  return Boolean(
+    scope && scope.kind === "transaction" && (owner === void 0 || scope.owner === owner)
+  );
+}
+function createTransactionScopedAdapter(adapter, operations, owner, kind) {
   let active = true;
   const assertActive = () => {
     if (!active) throw commandError2(
@@ -13317,16 +13339,24 @@ function createTransactionScopedAdapter(adapter, operations = {}) {
     withTransaction: rejectNestedTransactionScope,
     withReadOnlySnapshot: rejectNestedTransactionScope
   });
-  transactionScopeRevokers.set(scopedAdapter, () => {
-    active = false;
+  transactionScopes.set(scopedAdapter, {
+    revoke: () => {
+      active = false;
+    },
+    owner,
+    kind
   });
   return scopedAdapter;
 }
 function revokeTransactionScopedAdapter(adapter) {
-  transactionScopeRevokers.get(adapter)?.();
-  transactionScopeRevokers.delete(adapter);
+  transactionScopes.get(adapter)?.revoke();
+  transactionScopes.delete(adapter);
 }
 var transactionOperations = Symbol.for("sporades.database.transactionOperations");
+var transactionBeforeCommitChecks2 = Symbol.for("sporades.database.transactionBeforeCommitChecks");
+async function runTransactionBeforeCommitChecks(transactionAdapter) {
+  for (const check of transactionAdapter[transactionBeforeCommitChecks2] ?? []) await check();
+}
 async function createRuntimeDatabaseAdapter(databasePath, serverEnv = {}, config = {}) {
   if (config.services?.database?.engine === "libsql" && serverEnv.SPORADES_SERVICE_DATABASE_ENGINE === "libsql" && serverEnv.SPORADES_SERVICE_DATABASE_URL) {
     return await createLibsqlDatabaseAdapter({
@@ -14106,13 +14136,14 @@ async function createSqliteDatabaseAdapter(databasePath, options = {}) {
     async withTransaction(fn) {
       return await connectionGate.runTransaction(async () => {
         const ownerOperations = typeof this[transactionOperations] === "function" ? this[transactionOperations]() : { exec: this.exec.bind(this), prepare: this.prepare.bind(this) };
-        const transactionAdapter = createTransactionScopedAdapter(this, ownerOperations);
+        const transactionAdapter = createTransactionScopedAdapter(this, ownerOperations, this, "transaction");
         const transactionExec = ownerOperations.exec;
         await transactionExec("BEGIN");
         try {
           let result;
           try {
             result = await fn(transactionAdapter);
+            await runTransactionBeforeCommitChecks(transactionAdapter);
           } finally {
             revokeTransactionScopedAdapter(transactionAdapter);
           }
@@ -14127,7 +14158,7 @@ async function createSqliteDatabaseAdapter(databasePath, options = {}) {
     async withReadOnlySnapshot(fn) {
       return await connectionGate.runTransaction(async () => {
         const ownerOperations = typeof this[transactionOperations] === "function" ? this[transactionOperations]() : { exec: this.exec.bind(this), prepare: this.prepare.bind(this) };
-        const ownerAdapter = createTransactionScopedAdapter(this, ownerOperations);
+        const ownerAdapter = createTransactionScopedAdapter(this, ownerOperations, this, "snapshot");
         const transactionExec = ownerOperations.exec;
         await transactionExec("BEGIN");
         await transactionExec("PRAGMA query_only = ON");
@@ -14250,10 +14281,11 @@ async function createPostgresDatabaseAdapter(options) {
       return await connectionGate.runTransaction(async () => {
         await rawQuery("BEGIN");
         try {
-          const transactionAdapter = createTransactionScopedAdapter(adapter, createOperations(runDirectly));
+          const transactionAdapter = createTransactionScopedAdapter(adapter, createOperations(runDirectly), adapter, "transaction");
           let result;
           try {
             result = await fn(transactionAdapter);
+            await runTransactionBeforeCommitChecks(transactionAdapter);
           } finally {
             revokeTransactionScopedAdapter(transactionAdapter);
           }
@@ -14270,7 +14302,7 @@ async function createPostgresDatabaseAdapter(options) {
     },
     async withReadOnlySnapshot(fn) {
       return await connectionGate.runTransaction(async () => {
-        const transactionAdapter = createTransactionScopedAdapter(adapter, createOperations(runDirectly));
+        const transactionAdapter = createTransactionScopedAdapter(adapter, createOperations(runDirectly), adapter, "snapshot");
         await rawQuery("BEGIN TRANSACTION READ ONLY");
         try {
           let result;
@@ -14758,13 +14790,14 @@ async function createLibsqlDatabaseAdapter(options) {
         const transactionAdapter = createTransactionScopedAdapter({
           ...adapter,
           ...createOperations(transaction, runDirectly)
-        });
+        }, {}, adapter, "transaction");
         activeTransactions.add(transaction);
         try {
           await libsqlExecute({ endpoint, authToken, transaction, sql: "BEGIN", params: [], close: false });
           let result;
           try {
             result = await fn(transactionAdapter);
+            await runTransactionBeforeCommitChecks(transactionAdapter);
           } finally {
             revokeTransactionScopedAdapter(transactionAdapter);
           }
@@ -14786,7 +14819,7 @@ async function createLibsqlDatabaseAdapter(options) {
       return await connectionGate.runTransaction(async () => {
         assertLibsqlOpen(closed);
         const transaction = { baton: null, baseUrl: endpoint };
-        const snapshotAdapter = createTransactionScopedAdapter({ ...adapter, ...createOperations(transaction, runDirectly) });
+        const snapshotAdapter = createTransactionScopedAdapter({ ...adapter, ...createOperations(transaction, runDirectly) }, {}, adapter, "snapshot");
         activeTransactions.add(transaction);
         try {
           await libsqlExecute({ endpoint, authToken, transaction, sql: "BEGIN", params: [], close: false });
@@ -15257,6 +15290,8 @@ function quoteIdentifier(identifier) {
 
 // src/server-runtime-source.ts
 var mutationResultsWithWrites = /* @__PURE__ */ new WeakSet();
+var trustedReadPurposes = /* @__PURE__ */ new Set(["teams.join-admission"]);
+var trustedReadTransactionAdapter = Symbol("sporades.trustedReadTransactionAdapter");
 async function shutdownAndCloseDatabase(database) {
   let shutdownError;
   let closeError;
@@ -15487,10 +15522,24 @@ async function openDevDatabase(databasePath, serverSource, serverEnv = {}, confi
     passwordResetConfig: resolvePasswordResetConfig(config),
     teamJoinLinkConfig: resolveTeamJoinLinkConfig(config),
     teamApplicationRoles,
-    teamJoinAdmission: capsuleDefinition?.teams?.admitJoin,
-    createTeamJoinAdmissionContext(transactionAdapter, auth) {
-      return createTeamJoinAdmissionContext(createTransactionDatabase(database, transactionAdapter), auth);
-    },
+    runTeamJoinAdmission: typeof capsuleDefinition?.teams?.admitJoin === "function" ? async function(transactionAdapter, auth, input, signal) {
+      const rootDatabase = this.__rootDatabase ?? this;
+      const trustedTransaction = this[trustedReadTransactionAdapter] ?? transactionAdapter;
+      const admissionDatabase = createTransactionDatabase(rootDatabase, trustedTransaction);
+      try {
+        return await withTrustedRead(rootDatabase, {
+          transaction: trustedTransaction,
+          purpose: "teams.join-admission",
+          subject: { teamId: input.teamId, userId: input.userId },
+          signal
+        }, (trustedDb) => capsuleDefinition.teams.admitJoin(
+          createTeamJoinAdmissionContext(admissionDatabase, auth, trustedDb),
+          input
+        ));
+      } finally {
+        await drainPendingLogWrites(admissionDatabase);
+      }
+    } : void 0,
     fileAcl,
     securityPolicy: resolveRuntimeSecurityPolicy(config),
     fileStorage,
@@ -17381,6 +17430,7 @@ function createTransactionDatabase(database, transactionAdapter, writeState) {
     adapter,
     sqlite: adapter,
     __transactionActive: true,
+    [trustedReadTransactionAdapter]: transactionAdapter,
     __rootDatabase: database.__rootDatabase ?? database,
     __pendingLogWrites: pendingLogWrites
   };
@@ -17569,32 +17619,104 @@ function createEndpointDatabaseApi(database, contextGetter = null) {
     database.schema.tables.map((table) => [table.name, createEndpointTableApi(database, table, {}, contextGetter)])
   );
 }
-function createEndpointReadOnlyDatabaseApi(database, contextGetter = null) {
+function createEndpointReadOnlyDatabaseApi(database, contextGetter = null, assertActive = () => {
+}) {
   return Object.fromEntries(
     database.schema.tables.map((table) => [
       table.name,
-      readOnlyEndpointTableApi(createEndpointTableApi(database, table, {}, contextGetter))
+      readOnlyEndpointTableApi(createEndpointTableApi(database, table, {}, contextGetter), assertActive)
     ])
   );
 }
-function readOnlyEndpointTableApi(tableApi) {
+function readOnlyEndpointTableApi(tableApi, assertActive) {
   return {
     where(fieldName, value) {
-      return readOnlyEndpointTableApi(tableApi.where(fieldName, value));
+      assertActive();
+      return readOnlyEndpointTableApi(tableApi.where(fieldName, value), assertActive);
     },
     orderBy(fieldName, direction = "asc") {
-      return readOnlyEndpointTableApi(tableApi.orderBy(fieldName, direction));
+      assertActive();
+      return readOnlyEndpointTableApi(tableApi.orderBy(fieldName, direction), assertActive);
     },
     limit(count) {
-      return readOnlyEndpointTableApi(tableApi.limit(count));
+      assertActive();
+      return readOnlyEndpointTableApi(tableApi.limit(count), assertActive);
     },
     get() {
-      return tableApi.get();
+      assertActive();
+      return trustedReadResult(tableApi.get(), assertActive);
     },
     all() {
-      return tableApi.all();
+      assertActive();
+      return trustedReadResult(tableApi.all(), assertActive);
+    }
+  };
+}
+function trustedReadResult(value, assertActive) {
+  return Promise.resolve(value).then((result) => {
+    assertActive();
+    return result;
+  });
+}
+async function withTrustedRead(database, options, callback) {
+  if (!isActiveTransactionScopedAdapter(options?.transaction, database?.adapter)) {
+    throw commandError2(
+      "Trusted app-database reads require an active transaction.",
+      "Start the trusted policy from the runtime-owned transition transaction.",
+      "TRUSTED_READ_TRANSACTION_REQUIRED"
+    );
+  }
+  if (!trustedReadPurposes.has(options?.purpose)) {
+    throw commandError2(
+      "Trusted app-database read purpose is invalid.",
+      "Use a runtime-owned trusted policy purpose.",
+      "INVALID_TRUSTED_READ_PURPOSE"
+    );
+  }
+  const signal = options?.signal;
+  const abortError = () => commandError2(
+    "Trusted app-database read was aborted.",
+    "Retry the runtime-owned trusted policy if cancellation was not intended.",
+    "TRUSTED_READ_ABORTED"
+  );
+  if (signal?.aborted) throw abortError();
+  const transactionDatabase = createTransactionDatabase(database, options.transaction);
+  let active = true;
+  const assertActive = () => {
+    if (!active) {
+      throw commandError2(
+        "Trusted app-database read access is no longer active.",
+        "Start a new runtime-owned trusted policy callback before reading app data.",
+        "TRUSTED_READ_ACCESS_INACTIVE"
+      );
     }
+    if (signal?.aborted) throw abortError();
   };
+  const context = {
+    subject: options.subject,
+    purpose: options.purpose,
+    signal
+  };
+  grantPrivilegedDbAccess(context);
+  const holder = createContextHolder(context);
+  const db = createEndpointReadOnlyDatabaseApi(transactionDatabase, () => holder.current, assertActive);
+  try {
+    try {
+      const result = await callback(db);
+      assertActive();
+      return result;
+    } catch {
+      if (signal?.aborted) throw abortError();
+      throw commandError2(
+        "Trusted app-database read failed.",
+        "The runtime-owned trusted policy could not be evaluated.",
+        "TRUSTED_READ_FAILED"
+      );
+    }
+  } finally {
+    active = false;
+    revokePrivilegedDbAccess(context);
+  }
 }
 function createEndpointTableApi(database, table, query = {}, contextGetter = null) {
   return {
@@ -19376,14 +19498,13 @@ function createMutationContext(database, auth) {
   };
   return context;
 }
-function createTeamJoinAdmissionContext(database, auth) {
+function createTeamJoinAdmissionContext(database, auth, trustedDb) {
   const context = {
-    auth,
+    auth: Object.freeze({ ...auth }),
     env: database.serverEnv,
-    log: createEndpointLogger(database)
+    log: createEndpointLogger(database),
+    db: trustedDb
   };
-  const holder = createContextHolder(context);
-  context.db = createEndpointReadOnlyDatabaseApi(database, () => holder.current);
   return context;
 }
 function deferOrScheduleJobDispatch(database, queueDatabase, context = void 0) {
@@ -25655,7 +25776,7 @@ jobs:
 }
 
 // src/cli/cli-version.ts
-var CLI_VERSION = "0.8.6";
+var CLI_VERSION = "0.8.7";
 
 // src/cli/sporades.ts
 var SUPPORTED_TEMPLATES = new Set(CLIENT_TEMPLATES);

package/dist/cli/cli-version.d.ts

@@ -1,2 +1,2 @@
-export declare const CLI_VERSION = "0.8.6";
+export declare const CLI_VERSION = "0.8.7";
 //# sourceMappingURL=cli-version.d.ts.map

package/dist/cli/cli-version.js

@@ -1,3 +1,3 @@
 // Generated by `npm run build` from package.json. Do not edit by hand.
-export const CLI_VERSION = "0.8.6";
+export const CLI_VERSION = "0.8.7";
 //# sourceMappingURL=cli-version.js.map

package/dist/database-runtime.d.ts

@@ -2,6 +2,7 @@ import type { PathLike } from "node:fs";
 type LooseRecord = Record<string, any>;
 type RuntimeConfig = LooseRecord;
 type RuntimeEnv = Record<string, string | undefined>;
+export declare function isActiveTransactionScopedAdapter(value: any, owner?: any): boolean;
 export declare function createRuntimeDatabaseAdapter(databasePath: any, serverEnv?: RuntimeEnv, config?: RuntimeConfig): Promise<LooseRecord>;
 export declare function createRuntimeInspectionAdapter(databasePath: any, serverEnv?: RuntimeEnv, config?: RuntimeConfig): Promise<LooseRecord | null>;
 export declare function createDatabaseDialect(spec: LooseRecord): LooseRecord;

package/dist/database-runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"database-runtime.d.ts","sourceRoot":"","sources":["../src/database-runtime.ts"],"names":[],"mappings":"AAiKA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAuBxC,KAAK,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AACvC,KAAK,aAAa,GAAG,WAAW,CAAC;AACjC,KAAK,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AA0GrD,wBAAsB,4BAA4B,CAAC,YAAY,EAAE,GAAG,EAAE,SAAS,GAAE,UAAe,EAAE,MAAM,GAAE,aAAkB,GAAG,OAAO,CAAC,WAAW,CAAC,CAqBlJ;AAED,wBAAsB,8BAA8B,CAAC,YAAY,EAAE,GAAG,EAAE,SAAS,GAAE,UAAe,EAAE,MAAM,GAAE,aAAkB,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAS3J;AAkBD,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,WAAW,GAAG,WAAW,CAyBpE;AA2BD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,WAAW,GAAG,WAAW,CAa1E;AAMD,wBAAgB,sBAAsB,gBAMrC;AAED,wBAAgB,wBAAwB,gBAgBvC;AAED,wBAAgB,sBAAsB,gBASrC;AAGD,wBAAgB,qBAAqB,gBAoCpC;AAED,wBAAgB,uBAAuB,gBAmDtC;AAKD,wBAAgB,kCAAkC,CAAC,OAAO,EAAE,WAAW,GAAG,WAAW,CA0qBpF;AAED,wBAAsB,2BAA2B,CAAC,YAAY,EAAE,QAAQ,EAAE,OAAO,GAAE,WAAgB,wBAqFlG;AAED,wBAAsB,6BAA6B,CAAC,OAAO,EAAE;IAAE,GAAG,EAAE,GAAG,CAAC;CAAE,wBA4HzE;AAED,wBAAsB,wBAAwB,CAAC,GAAG,EAAE,GAAG;;eA+FxC,MAAM;;;;;;GAyEpB;AAyMD,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,GAAE,GAAG,EAAO,UA2E/D;AAMD,wBAAsB,2BAA2B,CAAC,OAAO,EAAE;IAAE,GAAG,EAAE,GAAG,CAAC;IAAC,SAAS,EAAE,GAAG,CAAC;CAAE;;;;wBAiF1D,CAAC,kBAAkB,EAAE,WAAW,KAAK,GAAG;6BA2BnC,CAAC,OAAO,EAAE,WAAW,KAAK,GAAG;;cAnFlD,MAAM;iBAUH,MAAM;uBAGA,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE;uBAQtB,SAAS,EAAE;uBAGX,MAAM,EAAE;;;GAoG9B;AA4VD,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,MAAa,OAM7F;AAyED,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE;IAAE,OAAO,EAAE,GAAG,CAAC;IAAC,MAAM,EAAE,GAAG,CAAC;CAAE,gBAEhF;AAED,wBAAsB,YAAY,CAAC,QAAQ,EAAE;IAAE,OAAO,EAAE,GAAG,CAAC;IAAC,MAAM,EAAE,GAAG,CAAC;CAAE,gBAE1E;AAED,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE;IAAE,OAAO,EAAE,GAAG,CAAC;IAAC,MAAM,EAAE,GAAG,CAAC;CAAE,EAAE,GAAG,EAAE,GAAG,gBAExF;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,GAAG,YAuE1C;AAED,wBAAgB,eAAe,CAAC,UAAU,EAAE,GAAG,UAE9C"}
+{"version":3,"file":"database-runtime.d.ts","sourceRoot":"","sources":["../src/database-runtime.ts"],"names":[],"mappings":"AAiKA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAuBxC,KAAK,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AACvC,KAAK,aAAa,GAAG,WAAW,CAAC;AACjC,KAAK,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AAkErD,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,GAAG,WAOvE;AAqDD,wBAAsB,4BAA4B,CAAC,YAAY,EAAE,GAAG,EAAE,SAAS,GAAE,UAAe,EAAE,MAAM,GAAE,aAAkB,GAAG,OAAO,CAAC,WAAW,CAAC,CAqBlJ;AAED,wBAAsB,8BAA8B,CAAC,YAAY,EAAE,GAAG,EAAE,SAAS,GAAE,UAAe,EAAE,MAAM,GAAE,aAAkB,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAS3J;AAkBD,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,WAAW,GAAG,WAAW,CAyBpE;AA2BD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,WAAW,GAAG,WAAW,CAa1E;AAMD,wBAAgB,sBAAsB,gBAMrC;AAED,wBAAgB,wBAAwB,gBAgBvC;AAED,wBAAgB,sBAAsB,gBASrC;AAGD,wBAAgB,qBAAqB,gBAoCpC;AAED,wBAAgB,uBAAuB,gBAmDtC;AAKD,wBAAgB,kCAAkC,CAAC,OAAO,EAAE,WAAW,GAAG,WAAW,CA0qBpF;AAED,wBAAsB,2BAA2B,CAAC,YAAY,EAAE,QAAQ,EAAE,OAAO,GAAE,WAAgB,wBAwFlG;AAED,wBAAsB,6BAA6B,CAAC,OAAO,EAAE;IAAE,GAAG,EAAE,GAAG,CAAC;CAAE,wBA+HzE;AAED,wBAAsB,wBAAwB,CAAC,GAAG,EAAE,GAAG;;eA+FxC,MAAM;;;;;;GAyEpB;AAyMD,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,GAAE,GAAG,EAAO,UA2E/D;AAMD,wBAAsB,2BAA2B,CAAC,OAAO,EAAE;IAAE,GAAG,EAAE,GAAG,CAAC;IAAC,SAAS,EAAE,GAAG,CAAC;CAAE;;;;wBAiF1D,CAAC,kBAAkB,EAAE,WAAW,KAAK,GAAG;6BA8BnC,CAAC,OAAO,EAAE,WAAW,KAAK,GAAG;;cAtFlD,MAAM;iBAUH,MAAM;uBAGA,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE;uBAQtB,SAAS,EAAE;uBAGX,MAAM,EAAE;;;GAuG9B;AA4VD,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,MAAa,OAM7F;AAyED,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE;IAAE,OAAO,EAAE,GAAG,CAAC;IAAC,MAAM,EAAE,GAAG,CAAC;CAAE,gBAEhF;AAED,wBAAsB,YAAY,CAAC,QAAQ,EAAE;IAAE,OAAO,EAAE,GAAG,CAAC;IAAC,MAAM,EAAE,GAAG,CAAC;CAAE,gBAE1E;AAED,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE;IAAE,OAAO,EAAE,GAAG,CAAC;IAAC,MAAM,EAAE,GAAG,CAAC;CAAE,EAAE,GAAG,EAAE,GAAG,gBAExF;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,GAAG,YAuE1C;AAED,wBAAgB,eAAe,CAAC,UAAU,EAAE,GAAG,UAE9C"}