sporades 0.9.23 → 0.9.26

package/CHANGES.md

@@ -1,21 +1,159 @@
 # Changes
 
-## Unreleased - 2026-09-17
+## Unreleased - 2026-09-21
 
-Changes since v0.9.22.
+Changes since v0.9.25.
 
 ### 🚀 Features
 
-- Add user-scoped server file deletion (#46) (5629928f).
+- Add durable notification intents (#75) (8885992b).
+- Add PostgreSQL resource transaction locks (f52eb67e).
+- Add outer resource watchdog regression coverage (447f186f).
+- Implement SQLite Job resource transactions and durable replay receipts (d2553b24).
 
 ### 🐛 Bug Fixes
 
-- Fix stale runtime connection-token recovery (#48) (51193284).
-- Normalize subject whitespace (f7f2f6d9).
+- Preserve URL health route contract (#88) (10db3e3d).
+- Harden request target rejection (#84) (d7514796).
+- Fix HTTP failure logging liveness (#82) (fa53a5d8).
+- Fix issue #77 suite baseline failures (#78) (2f52fd41).
+- Fix File URL locking and resource acquisition deadlines (4571679e).
+- Fix postgres resource callback lock waits (f3f5374f).
+- Fence ACL and resource schema races (16200025).
+- Fix ACL Promise combinator tracking (4da46e89).
+- Reject unsafe resource table identity (c9d6bda0).
+- Harden ACL lineage and resource readiness (602a968e).
+- Harden ACL promise settlement and reject rewrite rules (901f34ba).
+- Reject all resource table triggers (e7546547).
+- Lock resource ACL dependencies and reject mutating triggers (fbdb4b53).
+- Support async postgres ACL helpers (cfa01f1f).
+- Close four findings in PostgreSQL resource handling (b353f1cf).
+- Retain lazy reconnect after an unknown COMMIT outcome (08188c67).
+- Deny a missing locked anchor before authorization (010a1785).
+- Isolate postgres resource error boundaries (91684477).
+- Redact PostgreSQL outer resource storage errors (619e0ab5).
+- Fix postgres resource failure settlement (6a049ac7).
+- Harden PostgreSQL resource authorization (d2dc57cb).
+- Make PostgreSQL Job claim locks nowait (0fdfea3d).
+- Publish PostgreSQL resource bootstrap atomically (d4f2b435).
+- Bound PostgreSQL resource bootstrap lock (cdcc950f).
+- Serialize PostgreSQL resource bootstrap (d5afdd21).
+- Fix PostgreSQL resource identifier casing (d2bcd317).
+- Harden resource transaction adapter seam (be2fe86d).
+- Lock PostgreSQL resource authorization (b5f45cfb).
+- Settle cancelled PostgreSQL resource Jobs (d4810820).
+- Correct PostgreSQL Job loss capability assertion (2958562d).
+- Fix outer resource logging settlement (4afe9504).
+- Fix outer watchdog mutation race regression (2f849575).
+- Fix authentication provider labels and migrate corrupted user rows (63d2f16a).
+- Fix stale page-token recovery and bound unstable reconnects (b601a9ab).
+- Repair resource constructor typing and regenerate shipped CLI fixes (98e22936).
+- Fix SQLite resource review findings and document invocation boundaries (b1c0fe4b).
+- Correct ticket 06 dependency metadata for resource swarm (cdba60a9).
+
+### 🔧 Improvements
+
+- Reconcile monolith HTTP import census (#87) (9c897f7a).
+- Reconcile HTTP runtime module census (#85) (a9a66a68).
+- Keep ACL race and any fail closed (84a8fc8e).
+- Clarify PostgreSQL resource evidence boundaries (abcc32e3).
+- Fail closed for noneligible resource adapters (c25db850).
+- Race outer resource hooks with deadline (43a99c76).
+- Guard endpoint files after resource binding (bb42a116).
+- Mark ticket 02 done: merged as e31b4dfe (#61) (fa640cd1).
 
 ### 📝 Documentation
 
-- Support additional deployment files with preserve and replace policies (#45) (9cc5bdef).
+- Track request admission research (#90) (1d5f27a1).
+- Reconcile HTTP re-export census (#89) (1220e9f9).
+- Complete HTTP runtime caller census (#86) (0955f7c3).
+- Book ticket 07 completion (32759b21).
+- Verify amended Grant workflow boundaries (#76) (14eda541).
+- Book ticket 06 complete (f0d905e5).
+- Book ticket 05 complete (PR #74) (45258174).
+- Fail closed for libSQL resource scopes (#74) (d9f036d5).
+- Unblock fence tickets 05/06 after 02/04 merged (687f58d1).
+- Reject partitioned PostgreSQL resource tables (f198d2de).
+- Reject unexpected resource indexes (fa474fd6).
+- Await Team ACL helpers (82d8b4ef).
+- Configure engineering skills for GitHub issues (831fc4bf).
+- Prove PostgreSQL endpoint receipt recovery (be719200).
+- Complete PostgreSQL resource receipt recovery (675120bd).
+- Mark ticket 03 merged and update resource fence frontier (9229ea96).
+- Reconcile outer resource commits and publish logs (d033d108).
+- Regenerate resource API reference (be2c0dba).
+- Document outer resource transaction joining (9851aba0).
+- Track unsupported notification attempts through resource rollback (8b094c59).
+- Map resource connection acquisition errors and retain durable planning links (869bb009).
+- Align Stripe dependency and pinned API version on 22.6.2 (2b5cc9c6).
+- Expose auth.sessionToken() for same-origin public endpoints (#62) (0a87a800).
+- Carry approved M1 resource transaction plan from decision PR 57 (28e95c2e).
+
+### 🧪 Tests
+
+- Preserve literal HTTP request-target semantics (#83) (9b4eb84b).
+- Quarantine Postgres backend on deadline cancellation (61162981).
+- Bound PostgreSQL cancellation delivery (1d97423f).
+- Fence cancelled Postgres queries and nested ACL promises (70f09f18).
+- Bind File deletion authorization to locked metadata (d1b497ca).
+- Bound PostgreSQL resource callback lock waits (709d14f2).
+- Normalize PostgreSQL ACL lock contention (6c8ed5f8).
+- Bound PostgreSQL ACL dependency locks (59005492).
+- Bound Job resource authorization contention (1d0a407c).
+- Preserve resource callback SQLSTATE errors (6cdb5476).
+- Reject generated Postgres resource columns (098753ad).
+- Reject unsafe Postgres resource schemas (568c50e2).
+- Prove PostgreSQL resource schema publication (91ce4717).
+- Census carried resource and billing modules (85285957).
+- Prove resource transaction seam boundary (656bddf3).
+- Cover PostgreSQL Job claim conflicts (6cd34a7f).
+- Prove PostgreSQL paused-owner recovery (ec9a17e0).
+- Prove PostgreSQL resource process death recovery (846fb131).
+- Reset PostgreSQL commit-loss fixture (67ed81b3).
+- Prove PostgreSQL commit acknowledgement loss (6d6f0c31).
+- Assert revoked PostgreSQL Job scope handles (1e543513).
+- Fence PostgreSQL Job claims through commit admission (951c1fd6).
+- Cover PostgreSQL Job resource receipts (bb614495).
+- Prove PostgreSQL resource lock contention and backend loss (c50007ab).
+- Harden outer resource admission and failures (205df5da).
+- Prove outer resource dispatch causally (a9c750ff).
+- Poison admitted outer resource failures (4b0c7a71).
+- Quarantine SQLite root after uncertain outer commit (81322daa).
+- Redact postcommit resource log publication failures (76a11538).
+- Keep outer cleanup watchdog coverage runtime-owned (7fbc2e19).
+- Prove outer notification rejection settlement (a246cb65).
+- Fence outer resource settlement and parent logging (11ab4cfe).
+- Cover outer resource uncertainty across endpoints (181ad213).
+- Prove outer resource commit uncertainty outcomes (fd8af841).
+- Classify outer resource commit uncertainty (c5990fa3).
+- Quarantine uncertain outer resource connections (a21fa98d).
+- Fence outer resource middleware and commit deadline (b07bfe1e).
+- Track nested resource table operations (a6285359).
+- Prove watchdog reaches pending log cleanup (177d08a4).
+- Make outer hook watchdog proof self-contained (e79596a2).
+- Cover watchdog during resource cleanup (5de7d131).
+- Assert Grant state inside protected Jobs (56342516).
+- Prove joined Grant mutations across runtimes (464e69fe).
+- Cover real multipart endpoint resource file guards (ab61e05a).
+- Cover endpoint resource file guards (e3c71ed0).
+- Cover outer resource hook deadline (0cbe976e).
+- Exercise the token route in Journey reconnect integration tests (5884446a).
+- Abort outer cleanup after resource deadline (8fbcab4d).
+- Cover outer resource log transactions (260a9270).
+- Poison caught outer resource failures (6d00d514).
+- Prove membership ACL ordering across runtimes (2da4cddd).
+- Prove Grant resource ordering across workers (cda02216).
+- Cover endpoint resource deadline parity (62160e8e).
+- Prove outer resource transaction ordering (b7c9d4e4).
+- Keep outer resource deadline through transaction settlement (7ae38c07).
+- WIP: fence outer resource transaction deadline (34da2523).
+- WIP: join mutation and endpoint resource scopes (1092d072).
+- Reconcile resource cancellation from independent runtimes (93a1442b).
+- Preserve cancelled Job settlement for resource abort errors (fa2b08c3).
+
+### 📦 Packaging
+
+- Bound PostgreSQL quarantine lock release (bff3a21c).
 
 ## v0.9.11 - 2026-09-02
 
@@ -114,3 +252,4 @@ generated artifacts, and documentation.
 
 
 
+

package/bin/sporades-host-helper.js

@@ -26829,6 +26829,28 @@ function validatePublicTreeFileSet(files) {
   return { ok: true, fileCount: files.length, totalBytes };
 }
 
+// src/resource-runtime.ts
+var RESOURCE_ADAPTER_SUPPORT = Object.freeze({
+  sqlite: "supported",
+  postgres: "supported",
+  libsql: "unsupported"
+});
+var resourceAbort = Symbol("resourceAbort");
+function resourceError(code) {
+  return Object.assign(new Error(code === "RESOURCE_BUSY" ? "Resource transaction is busy." : "Resource operation could not complete."), {
+    code,
+    ...code === "RESOURCE_BUSY" ? { retryable: true } : {}
+  });
+}
+var unsupportedResources = Object.freeze({
+  async run() {
+    throw resourceError("RESOURCE_CONTEXT_UNSUPPORTED");
+  },
+  async status() {
+    throw resourceError("RESOURCE_CONTEXT_UNSUPPORTED");
+  }
+});
+
 // src/log-envelope.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
 function uncappedLogEnvelope(input) {
@@ -26900,6 +26922,9 @@ function isSensitiveLogKey(key) {
   return /(^|[-_])(?:password|passwd|token|secret|authorization|cookie|client[-_]?secret|api[-_]?token|private[-_]?key|authorized[-_]?keys?|request[-_]?body|raw[-_]?body|stack(?:trace)?)([-_]|$)/i.test(String(key)) || /(?:password|passwd|token|secret|authorization|cookie|clientSecret|apiToken|privateKey|authorizedKeys|requestBody|rawRequestBody|stackTrace)/i.test(String(key));
 }
 
+// src/promise-coordinator.ts
+var nodePromiseHooks = process.getBuiltinModule("node:v8")?.promiseHooks;
+
 // src/acl-runtime.ts
 var PRIVILEGED_AUDIT_SCHEMA = "sporades.privileged-audit.v1";
 var PRIVILEGED_AUDIT_ACTOR_KINDS = /* @__PURE__ */ new Set(["privileged-server-role", "captured-user", "platform", "unknown"]);
@@ -26975,7 +27000,6 @@ var ACL_HELPER_STATE = Symbol("sporades.aclHelperState");
 
 // src/file-storage-runtime.ts
 var nodeCryptoModule2 = process.getBuiltinModule("node:crypto");
-var nodePromiseHooks = process.getBuiltinModule("node:v8")?.promiseHooks;
 
 // src/file-ingress-runtime.ts
 var import_pdf_lib = __toESM(require_cjs(), 1);
@@ -42853,6 +42877,11 @@ var nodeCryptoModule4 = process.getBuiltinModule("node:crypto");
 var nodeFsModule = process.getBuiltinModule("node:fs");
 var transactionOperations = Symbol.for("sporades.database.transactionOperations");
 var transactionBeforeCommitChecks2 = Symbol.for("sporades.database.transactionBeforeCommitChecks");
+var resourceTransactionMechanics = Symbol.for("sporades.database.resourceTransactionMechanics");
+var resourceBootstrapMechanics = Symbol.for("sporades.database.resourceBootstrapMechanics");
+var resourceConsumptionMechanics = Symbol.for("sporades.database.resourceConsumptionMechanics");
+var resourceSchemaPublished = Symbol.for("sporades.database.resourceSchemaPublished");
+var resourceCancelActiveQuery = Symbol.for("sporades.database.resourceCancelActiveQuery");
 
 // src/server-runtime-source.ts
 var trustedReadTransactionAdapter = Symbol("sporades.trustedReadTransactionAdapter");
@@ -42956,7 +42985,7 @@ var MutationExecutionStorage = process.getBuiltinModule("node:async_hooks").Asyn
 var mutationExecution = new MutationExecutionStorage();
 
 // src/cli/cli-version.ts
-var CLI_VERSION = "0.9.23";
+var CLI_VERSION = "0.9.26";
 
 // src/cli/schedule-inspection-envelope.ts
 var SCHEDULE_DIAGNOSTIC_FIELDS = /* @__PURE__ */ new Set([
@@ -43033,6 +43062,8 @@ function sanitizeScheduleInspectionEnvelope(envelope, invalid) {
 
 // src/cli/host-helper-archive.ts
 import { spawnSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { gunzipSync } from "node:zlib";
 
 // src/cli/host-helper-release-files.ts
 function expectedReleaseFiles(release) {
@@ -43122,27 +43153,75 @@ function validateReleaseArchive(request, archivePath = request.release.remoteArc
   };
 }
 function listArchiveEntries(archivePath) {
+  const literalMetadataEntries = inspectLiteralArchiveMetadata(archivePath);
+  if (literalMetadataEntries.length > 0) {
+    validateArchiveBounds(literalMetadataEntries);
+    throw helperError(
+      "Hosted Capsule release archive contains unsupported metadata.",
+      "Push again without __MACOSX or AppleDouble metadata entries."
+    );
+  }
   const namesResult = spawnSync("tar", ["-tzf", archivePath], { encoding: "utf8" });
   const verboseResult = spawnSync("tar", ["-tvzf", archivePath], { encoding: "utf8" });
+  const names = namesResult.stdout.trim().split("\n").filter(Boolean);
+  const verboseLines = verboseResult.stdout.trim().split("\n").filter(Boolean);
+  const entries = names.length === verboseLines.length ? names.map((name2, index) => ({
+    name: name2,
+    type: verboseLines[index]?.[0],
+    size: archiveEntrySize(verboseLines[index] ?? "")
+  })) : [];
   if (namesResult.error || namesResult.status !== 0 || verboseResult.error || verboseResult.status !== 0) {
+    if (entries.some((entry) => isDiscardableArchiveMetadata(entry.name))) {
+      validateArchiveBounds(entries);
+      throw helperError(
+        "Hosted Capsule release archive contains unsupported metadata.",
+        "Push again without __MACOSX or AppleDouble metadata entries."
+      );
+    }
     throw helperError(
       "Failed to inspect Hosted Capsule release archive.",
       "Upload the release again with `sporades host push` and check that tar is installed on the Host server."
     );
   }
-  const names = namesResult.stdout.trim().split("\n").filter(Boolean);
-  const verboseLines = verboseResult.stdout.trim().split("\n").filter(Boolean);
   if (names.length !== verboseLines.length) {
     throw helperError(
       "Hosted Capsule release archive could not be validated.",
       "Push again so Sporades can package a clean runtime archive."
     );
   }
-  return names.map((name2, index) => ({
-    name: name2,
-    type: verboseLines[index]?.[0],
-    size: archiveEntrySize(verboseLines[index] ?? "")
-  }));
+  return entries;
+}
+function inspectLiteralArchiveMetadata(archivePath) {
+  let archive;
+  try {
+    archive = gunzipSync(readFileSync(archivePath), {
+      maxOutputLength: HOST_RELEASE_ARCHIVE_LIMITS.totalBytes + (HOST_RELEASE_ARCHIVE_LIMITS.entries + 1) * 1024
+    });
+  } catch (error) {
+    if (error?.code === "ERR_BUFFER_TOO_LARGE") {
+      throw helperError("Hosted Capsule release archive exceeds bounds.", "Reduce total release bytes and push again.");
+    }
+    return [];
+  }
+  const entries = [];
+  let offset2 = 0;
+  while (offset2 + 512 <= archive.length) {
+    const header = archive.subarray(offset2, offset2 + 512);
+    if (header.every((byte) => byte === 0)) break;
+    const name2 = tarHeaderText(header, 0, 100);
+    const prefix = tarHeaderText(header, 345, 155);
+    const sizeText = tarHeaderText(header, 124, 12).trim();
+    if (!/^[0-7]+$/.test(sizeText)) return [];
+    const size = Number.parseInt(sizeText, 8);
+    if (!Number.isSafeInteger(size) || size < 0) return [];
+    entries.push({ name: prefix ? `${prefix}/${name2}` : name2, type: String.fromCharCode(header[156] || 48) === "0" ? "-" : String.fromCharCode(header[156]) || "-", size });
+    offset2 += 512 + Math.ceil(size / 512) * 512;
+  }
+  return entries.some((entry) => isDiscardableArchiveMetadata(entry.name)) ? entries : [];
+}
+function tarHeaderText(header, offset2, length) {
+  const end = header.indexOf(0, offset2);
+  return header.toString("utf8", offset2, end >= offset2 && end < offset2 + length ? end : offset2 + length);
 }
 function archiveEntrySize(line) {
   const bsd = line.match(/^\S+\s+\d+\s+\S+\s+\S+\s+(\d+)\s+/);