toiljs 0.0.120 → 0.0.121

package/build/devserver/db/database.js

@@ -20,6 +20,16 @@ function readKey(ref, ptr, len) {
         throw new Error('data: key too long');
     return readCopy(ref, ptr, len);
 }
+function checkValueSize(length, name = 'value') {
+    if (length > MAX_VALUE)
+        throw new Error(`data: encoded ${name} is ${String(length)} bytes; maximum is ${String(MAX_VALUE)} bytes (2 MiB). ` +
+            'Split large files across records or store their content outside ToilDB.');
+}
+function checkKeyValueSize(keyLength, valueLength, name = 'value') {
+    if (keyLength > MAX_KEY)
+        throw new Error('data: key too long');
+    checkValueSize(valueLength, name);
+}
 function storeKey(collection, key) {
     return collection + '\0' + key.toString('latin1');
 }
@@ -123,6 +133,8 @@ var DbOp;
     DbOp[DbOp["ViewPublish"] = 26] = "ViewPublish";
     DbOp[DbOp["CapacitySetTotal"] = 27] = "CapacitySetTotal";
     DbOp[DbOp["EventsSince"] = 28] = "EventsSince";
+    DbOp[DbOp["EventsGet"] = 29] = "EventsGet";
+    DbOp[DbOp["EventsLast"] = 30] = "EventsLast";
 })(DbOp || (DbOp = {}));
 var UpsertResult;
 (function (UpsertResult) {
@@ -141,6 +153,8 @@ function isReadOp(op) {
         op === DbOp.UniqueLookup ||
         op === DbOp.Latest ||
         op === DbOp.EventsSince ||
+        op === DbOp.EventsGet ||
+        op === DbOp.EventsLast ||
         op === DbOp.CapacityAvailable);
 }
 function isScanOp(op) {
@@ -191,6 +205,7 @@ export class DevDatabase {
     events = new Map();
     deriveCheckpoints = new Map();
     eventDedup = new Map();
+    eventPositions = new Map();
     capacity = new Map();
     versions = new Map();
     eventVersions = new Map();
@@ -267,6 +282,7 @@ export class DevDatabase {
             counterIdem: {},
             events: {},
             eventDedup: {},
+            eventPositions: {},
             deriveCheckpoints: {},
             capacity: {},
         };
@@ -297,6 +313,8 @@ export class DevDatabase {
             const ver = this.eventVersions.get(k) ?? [];
             snap.events[k] = log.map((b, i) => ({ v: b.toString('base64'), sv: ver[i] ?? 0 }));
         }
+        for (const [k, positions] of this.eventPositions)
+            snap.eventPositions[k] = [...positions];
         for (const [k, s] of this.eventDedup)
             snap.eventDedup[k] = [...s];
         for (const [k, v] of this.deriveCheckpoints)
@@ -366,6 +384,8 @@ export class DevDatabase {
             this.events.set(k, log.map((e) => Buffer.from(e.v, 'base64')));
             this.eventVersions.set(k, log.map((e) => e.sv));
         }
+        for (const [k, positions] of Object.entries(snap.eventPositions ?? {}))
+            this.eventPositions.set(k, new Map(positions));
         for (const [k, ids] of Object.entries(snap.eventDedup ?? {}))
             this.eventDedup.set(k, new Set(ids));
         for (const [k, v] of Object.entries(snap.deriveCheckpoints ?? {}))
@@ -398,6 +418,7 @@ export class DevDatabase {
         this.eventVersions.clear();
         this.events.clear();
         this.eventDedup.clear();
+        this.eventPositions.clear();
         this.deriveCheckpoints.clear();
         this.capacity.clear();
     }
@@ -470,15 +491,20 @@ export class DevDatabase {
         return v.length;
     }
     getMany(ref, db, handle, keysPtr, keysLen) {
-        const coll = collForOp(db, handle, DbOp.GetMany, CollectionFamily.Record, CollectionFamily.View);
+        const coll = collForOp(db, handle, DbOp.GetMany, CollectionFamily.Record, CollectionFamily.View, CollectionFamily.Unique);
         if (typeof coll === 'number')
             return coll;
         if (keysLen > MAX_VALUE)
-            throw new Error('data: keys blob too large');
+            throw new Error(`data: encoded keys blob is ${String(keysLen)} bytes; maximum is ${String(MAX_VALUE)} bytes (2 MiB). Use smaller getMany batches.`);
         const table = coll.family === CollectionFamily.View ? this.views : this.store;
         const r = new DataReader(readCopy(ref, keysPtr, keysLen));
         const count = r.readU32();
-        if (count > 1024)
+        const maxKeys = db.functionKind === DbFunctionKind.Query
+            ? 32
+            : db.functionKind === DbFunctionKind.Action
+                ? 64
+                : 1024;
+        if (count > maxKeys)
             return TOO_MANY_KEYS;
         const w = new DataWriter();
         w.writeU32(count);
@@ -575,8 +601,7 @@ export class DevDatabase {
         const coll = collForOp(db, handle, DbOp.Create, CollectionFamily.Record);
         if (typeof coll === 'number')
             return coll;
-        if (keyLen > MAX_KEY || valLen > MAX_VALUE)
-            throw new Error('data: key/value too large');
+        checkKeyValueSize(keyLen, valLen);
         const key = readKey(ref, keyPtr, keyLen);
         const value = readCopy(ref, valPtr, valLen);
         const idem = readIdem(ref, idemPtr);
@@ -600,8 +625,7 @@ export class DevDatabase {
         const coll = collForOp(db, handle, DbOp.Patch, CollectionFamily.Record);
         if (typeof coll === 'number')
             return coll;
-        if (keyLen > MAX_KEY || patchLen > MAX_VALUE)
-            throw new Error('data: key/patch too large');
+        checkKeyValueSize(keyLen, patchLen, 'patch');
         const key = readKey(ref, keyPtr, keyLen);
         const v = readCopy(ref, patchPtr, patchLen);
         const idem = readIdem(ref, idemPtr);
@@ -627,8 +651,7 @@ export class DevDatabase {
         const coll = collForOp(db, handle, DbOp.Upsert, CollectionFamily.Record);
         if (typeof coll === 'number')
             return coll;
-        if (keyLen > MAX_KEY || valLen > MAX_VALUE)
-            throw new Error('data: key/value too large');
+        checkKeyValueSize(keyLen, valLen);
         const key = readKey(ref, keyPtr, keyLen);
         const value = readCopy(ref, valPtr, valLen);
         const sk = storeKey(coll.name, key);
@@ -699,8 +722,7 @@ export class DevDatabase {
         const coll = collForOp(db, handle, DbOp.UniqueClaim, CollectionFamily.Unique);
         if (typeof coll === 'number')
             return coll;
-        if (keyLen > MAX_KEY || valLen > MAX_VALUE)
-            throw new Error('data: key/value too large');
+        checkKeyValueSize(keyLen, valLen);
         const sk = storeKey(coll.name, readKey(ref, keyPtr, keyLen));
         const owner = readCopy(ref, valPtr, valLen);
         const idem = readIdem(ref, idemPtr)?.toString('hex') ?? '';
@@ -745,8 +767,7 @@ export class DevDatabase {
         const coll = collForOp(db, handle, DbOp.MembershipAdd, CollectionFamily.Membership);
         if (typeof coll === 'number')
             return coll;
-        if (setLen > MAX_KEY || memberLen > MAX_VALUE)
-            throw new Error('data: set/member too large');
+        checkKeyValueSize(setLen, memberLen, 'member');
         const sk = storeKey(coll.name, readKey(ref, setPtr, setLen));
         const member = readCopy(ref, memberPtr, memberLen);
         let set = this.members.get(sk);
@@ -782,7 +803,11 @@ export class DevDatabase {
         const set = this.members.get(sk);
         const mv = this.memberVersions.get(sk);
         const n = Math.max(0, Math.min(limit, 0xffff));
-        const members = set === undefined ? [] : Array.from(set.values()).sort((a, b) => Buffer.compare(a, b)).slice(0, n);
+        const members = set === undefined
+            ? []
+            : Array.from(set.values())
+                .sort((a, b) => Buffer.compare(a, b))
+                .slice(0, n);
         const w = new DataWriter();
         w.writeU32(members.length);
         for (const m of members) {
@@ -807,8 +832,7 @@ export class DevDatabase {
         const coll = collForOp(db, handle, DbOp.ViewPublish, CollectionFamily.View);
         if (typeof coll === 'number')
             return coll;
-        if (keyLen > MAX_KEY || valLen > MAX_VALUE)
-            throw new Error('data: key/view too large');
+        checkKeyValueSize(keyLen, valLen, 'view');
         const sk = storeKey(coll.name, readKey(ref, keyPtr, keyLen));
         this.views.set(sk, readCopy(ref, valPtr, valLen));
         this.stampVersion(coll, sk);
@@ -852,8 +876,7 @@ export class DevDatabase {
         const coll = collForOp(db, handle, DbOp.Append, CollectionFamily.Events);
         if (typeof coll === 'number')
             return coll;
-        if (keyLen > MAX_KEY || evLen > MAX_VALUE)
-            throw new Error('data: key/event too large');
+        checkKeyValueSize(keyLen, evLen, 'event');
         const key = readKey(ref, keyPtr, keyLen);
         const sk = storeKey(coll.name, key);
         const idem = readIdem(ref, idemPtr);
@@ -888,8 +911,7 @@ export class DevDatabase {
         const coll = collForOp(db, handle, DbOp.AppendOnce, CollectionFamily.Events);
         if (typeof coll === 'number')
             return coll;
-        if (keyLen > MAX_KEY || evLen > MAX_VALUE)
-            throw new Error('data: key/event too large');
+        checkKeyValueSize(keyLen, evLen, 'event');
         const sk = storeKey(coll.name, readKey(ref, keyPtr, keyLen));
         const evid = readCopy(ref, evidPtr, evidLen).toString('latin1');
         let seen = this.eventDedup.get(sk);
@@ -902,6 +924,7 @@ export class DevDatabase {
         const ev = readCopy(ref, evPtr, evLen);
         const sv = this.currentSchemaVersion(coll);
         const log = this.events.get(sk);
+        const position = log?.length ?? 0;
         if (log === undefined) {
             this.events.set(sk, [ev]);
             this.eventVersions.set(sk, [sv]);
@@ -912,16 +935,73 @@ export class DevDatabase {
             versions.push(sv);
             this.eventVersions.set(sk, versions);
         }
+        let positions = this.eventPositions.get(sk);
+        if (positions === undefined) {
+            positions = new Map();
+            this.eventPositions.set(sk, positions);
+        }
+        positions.set(evid, position);
         seen.add(evid);
         this.recordWrite(db, coll);
         return 1;
     }
+    eventsGet(ref, db, handle, keyPtr, keyLen, evidPtr, evidLen) {
+        const coll = collForOp(db, handle, DbOp.EventsGet, CollectionFamily.Events);
+        if (typeof coll === 'number')
+            return coll;
+        if (evidLen > MAX_KEY)
+            throw new Error('data: event ID too large');
+        const sk = storeKey(coll.name, readKey(ref, keyPtr, keyLen));
+        const id = readCopy(ref, evidPtr, evidLen).toString('latin1');
+        const position = this.eventPositions.get(sk)?.get(id);
+        if (position === undefined && this.eventDedup.get(sk)?.has(id))
+            return UNAVAILABLE;
+        return this.eventResult(db, sk, position);
+    }
+    eventsLast(ref, db, handle, keyPtr, keyLen) {
+        const coll = collForOp(db, handle, DbOp.EventsLast, CollectionFamily.Events);
+        if (typeof coll === 'number')
+            return coll;
+        const sk = storeKey(coll.name, readKey(ref, keyPtr, keyLen));
+        return this.eventResult(db, sk, (this.events.get(sk)?.length ?? 0) - 1);
+    }
+    eventResult(db, sk, position) {
+        const value = position === undefined ? undefined : this.events.get(sk)?.[position];
+        db.lastResult = value === undefined ? null : Buffer.from(value);
+        db.lastResultVersion =
+            value === undefined || position === undefined
+                ? -1
+                : (this.eventVersions.get(sk)?.[position] ?? 0);
+        return value === undefined ? ABSENT : value.length;
+    }
+    compareExchange(ref, db, handle, keyPtr, keyLen, expectedPtr, expectedLen, valuePtr, valueLen) {
+        const coll = collForOp(db, handle, DbOp.Patch, CollectionFamily.Record);
+        if (typeof coll === 'number')
+            return coll;
+        checkKeyValueSize(keyLen, valueLen);
+        checkValueSize(expectedLen, 'expected value');
+        if (expectedLen < -1)
+            throw new Error('data: invalid CAS expected length');
+        const key = readKey(ref, keyPtr, keyLen);
+        const value = readCopy(ref, valuePtr, valueLen);
+        if (this.uniqueValuesOf(coll, value).length > 0)
+            throw new Error('CAS does not support @unique fields');
+        const sk = storeKey(coll.name, key);
+        const prior = this.store.get(sk);
+        if (expectedLen === -1
+            ? prior !== undefined
+            : prior === undefined || !prior.equals(readCopy(ref, expectedPtr, expectedLen)))
+            return 0;
+        this.store.set(sk, value);
+        this.stampVersion(coll, sk);
+        this.recordWrite(db, coll);
+        return 1;
+    }
     enqueue(ref, db, handle, keyPtr, keyLen, valPtr, valLen, idemPtr) {
         const coll = collForOp(db, handle, DbOp.Enqueue, CollectionFamily.Record);
         if (typeof coll === 'number')
             return coll;
-        if (keyLen > MAX_KEY || valLen > MAX_VALUE)
-            throw new Error('data: key/value too large');
+        checkKeyValueSize(keyLen, valLen);
         const key = readKey(ref, keyPtr, keyLen);
         const value = readCopy(ref, valPtr, valLen);
         const idem = readIdem(ref, idemPtr);
@@ -964,7 +1044,7 @@ export class DevDatabase {
         if (typeof coll === 'number')
             return coll;
         const sk = storeKey(coll.name, readKey(ref, keyPtr, keyLen));
-        const ckKey = `${db.deriveId}${sk}`;
+        const ckKey = `${db.deriveId}\0${sk}`;
         const log = this.events.get(sk) ?? [];
         const vers = this.eventVersions.get(sk) ?? [];
         const cursor = db.pendingCheckpoints.get(ckKey) ?? this.deriveCheckpoints.get(ckKey) ?? 0;
@@ -1160,8 +1240,12 @@ export function buildDatabaseImports(ref, db) {
         'data.counter_add': (handle, keyPtr, keyLen, delta, idemPtr) => devDb.counterAdd(ref, db, handle, keyPtr, keyLen, delta, idemPtr),
         'data.append': (handle, keyPtr, keyLen, evPtr, evLen, idemPtr) => devDb.append(ref, db, handle, keyPtr, keyLen, evPtr, evLen, idemPtr),
         'data.append_once': (handle, keyPtr, keyLen, evidPtr, evidLen, evPtr, evLen) => devDb.appendOnce(ref, db, handle, keyPtr, keyLen, evidPtr, evidLen, evPtr, evLen),
+        'data.get_current': (handle, kp, kl) => devDb.get(ref, db, handle, kp, kl),
+        'data.compare_exchange': (handle, kp, kl, ep, el, vp, vl) => devDb.compareExchange(ref, db, handle, kp, kl, ep, el, vp, vl),
         'data.enqueue': (handle, keyPtr, keyLen, valPtr, valLen, idemPtr) => devDb.enqueue(ref, db, handle, keyPtr, keyLen, valPtr, valLen, idemPtr),
         'data.latest': (handle, keyPtr, keyLen, limit) => devDb.latest(ref, db, handle, keyPtr, keyLen, limit),
+        'data.events_get': (handle, keyPtr, keyLen, evidPtr, evidLen) => devDb.eventsGet(ref, db, handle, keyPtr, keyLen, evidPtr, evidLen),
+        'data.events_last': (handle, keyPtr, keyLen) => devDb.eventsLast(ref, db, handle, keyPtr, keyLen),
         'data.events_since': (handle, keyPtr, keyLen, limit) => devDb.since(ref, db, handle, keyPtr, keyLen, limit),
         'data.capacity_set_total': (handle, keyPtr, keyLen, total, _idemPtr) => devDb.capacitySetTotal(ref, db, handle, keyPtr, keyLen, total),
         'data.capacity_available': (handle, keyPtr, keyLen) => devDb.capacityAvailable(ref, db, handle, keyPtr, keyLen),

package/build/devserver/db/types.d.ts

@@ -85,6 +85,7 @@ export interface DbSnapshot {
         sv: number;
     }[]>;
     eventDedup: Record<string, string[]>;
+    eventPositions?: Record<string, [string, number][]>;
     deriveCheckpoints?: Record<string, number>;
     capacity: Record<string, {
         total: string;

package/build/devserver/db/types.js

@@ -34,7 +34,7 @@ export const MAX_RESERVATIONS = 4096;
 export const MAX_RESERVATION_TTL_MS = 86_400_000;
 export const MAX_NAME = 512;
 export const MAX_KEY = 4096;
-export const MAX_VALUE = 256 * 1024;
+export const MAX_VALUE = 2 * 1024 * 1024;
 export const DEFAULT_FILL_WAIT_MS = 50;
 export const MAX_FILL_WAIT_MS = 60_000;
 const I64_MIN = -(2n ** 63n);

package/build/devserver/runtime/module.js

@@ -77,8 +77,12 @@ const PROVIDED_IMPORTS = new Set([
     'data.append',
     'data.append_once',
     'data.enqueue',
+    'data.compare_exchange',
+    'data.get_current',
     'data.latest',
     'data.events_since',
+    'data.events_get',
+    'data.events_last',
     'data.capacity_set_total',
     'data.capacity_available',
     'data.capacity_reserve',
@@ -141,7 +145,10 @@ export class WasmServerModule {
         state.clientIp = req.clientIp ?? '';
         const rpcPath = req.path.split('?')[0] ?? req.path;
         const rpcMethod = req.method.toUpperCase();
-        const rpcMutating = rpcMethod === 'POST' || rpcMethod === 'PUT' || rpcMethod === 'PATCH' || rpcMethod === 'DELETE';
+        const rpcMutating = rpcMethod === 'POST' ||
+            rpcMethod === 'PUT' ||
+            rpcMethod === 'PATCH' ||
+            rpcMethod === 'DELETE';
         if (rpcPath === '/__toil_rpc' && rpcMutating) {
             const idHeader = req.headers.find(([n]) => n.toLowerCase() === 'dacely-rpc')?.[1];
             const id = idHeader !== undefined && /^\d+$/.test(idHeader) ? Number(idHeader) : NaN;

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "toiljs",
     "type": "module",
-    "version": "0.0.120",
+    "version": "0.0.121",
     "author": "Dacely",
     "description": "The modern React framework: a file-based React frontend and a ToilScript-compiled WebAssembly backend.",
     "repository": {
@@ -101,6 +101,7 @@
         "tag": "latest"
     },
     "scripts": {
+        "prepare": "npm run build",
         "watch": "tsc -p tsconfig.json --watch",
         "prepublishOnly": "npm run build",
         "gen:docs": "node scripts/gen-toil-docs.mjs",
@@ -141,7 +142,7 @@
         "picocolors": "^1.1.1",
         "semver": "^7.8.5",
         "sharp": "^0.35.4",
-        "toilscript": ">=0.1.60",
+        "toilscript": ">=0.1.63",
         "vite": "^8.3.0",
         "vite-imagetools": "^12.0.1",
         "vite-plugin-node-polyfills": "^0.28.0"
@@ -150,7 +151,7 @@
         "prettier": ">=3.0.0",
         "react": "^19.3.0",
         "react-dom": "^19.3.0",
-        "toilscript": ">=0.1.60",
+        "toilscript": ">=0.1.63",
         "typescript": ">=7.0.2 <8.0.0"
     },
     "overrides": {

package/server/auth/AuthReads.ts

@@ -0,0 +1,15 @@
+/** An unavailable security record must never be mistaken for an absent restriction. */
+export class AuthReads {
+    public static document<K, V>(collection: Documents<K, V>, key: K): V | null {
+        const value = collection.get(key);
+        if (value == null && Db.lastError() != DbError.None)
+            throw new Error('Authentication state temporarily unavailable (status ' + (-1000 - <i32>Db.lastError()).toString() + ')');
+        return value;
+    }
+    public static owner<K, V>(collection: Unique<K, V>, key: K): V | null {
+        const value = collection.lookup(key);
+        if (value == null && Db.lastError() != DbError.None)
+            throw new Error('Authentication state temporarily unavailable (status ' + (-1000 - <i32>Db.lastError()).toString() + ')');
+        return value;
+    }
+}

package/server/auth/AuthStateDb.ts

@@ -0,0 +1,51 @@
+@data
+export class SessionUserKey {
+    id: string = '';
+    constructor(id: string = '') { this.id = id; }
+}
+@data
+export class SessionEpochKey {
+    id: string = '';
+    revision: u64 = 0;
+    constructor(id: string = '', revision: u64 = 0) { this.id = id; this.revision = revision; }
+}
+@data
+export class SessionEpoch {
+    revision: u64 = 0;
+}
+@data
+export class FactorKey {
+    host: string = '';
+    username: string = '';
+    constructor(host: string = '', username: string = '') { this.host = host; this.username = username; }
+}
+@data
+export class FactorRevision {
+    host: string = '';
+    username: string = '';
+    revision: u64 = 0;
+    constructor(host: string = '', username: string = '', revision: u64 = 0) { this.host = host; this.username = username; this.revision = revision; }
+}
+@data
+export class FactorSettings {
+    method: u8 = 0;
+    revision: u64 = 0;
+}
+@data
+export class SessionDigest {
+    digest: string = '';
+    constructor(digest: string = '') { this.digest = digest; }
+}
+@data
+export class RevokedSession {
+    revoked: bool = true;
+}
+/** Tenant-scoped security state; separate collections, one database namespace. */
+@database
+export class AuthStateDb {
+    @collection static revokedSessions: Unique<SessionDigest, RevokedSession>;
+    @collection static epochHeads: Documents<SessionUserKey, SessionEpoch>;
+    @collection static epochRevisions: Unique<SessionEpochKey, SessionEpoch>;
+    @collection static factorHeads: Documents<FactorKey, FactorSettings>;
+    @collection static factorRevisions: Unique<FactorRevision, FactorSettings>;
+}

package/server/auth/FactorSettings.ts

@@ -1,32 +1,11 @@
-@data
-class FactorKey {
-    host: string = '';
-    username: string = '';
-    constructor(host: string = '', username: string = '') { this.host = host; this.username = username; }
-}
-@data
-class FactorRevision {
-    host: string = '';
-    username: string = '';
-    revision: u64 = 0;
-    constructor(host: string = '', username: string = '', revision: u64 = 0) { this.host = host; this.username = username; this.revision = revision; }
-}
-@data
-export class FactorSettings {
-    method: u8 = 0;
-    revision: u64 = 0;
-}
-@database
-class FactorDb {
-    @collection static heads: Documents<FactorKey, FactorSettings>;
-    @collection static revisions: Unique<FactorRevision, FactorSettings>;
-}
+import { AuthReads } from 'toiljs/server/auth/AuthReads';
+import { AuthStateDb, FactorKey, FactorRevision, FactorSettings } from './AuthStateDb';
 export class FactorRepository {
     public static read(host: string, username: string, legacy: u8): FactorSettings {
-        let settings = FactorDb.heads.get(new FactorKey(host, username));
+        let settings = AuthReads.document(AuthStateDb.factorHeads, new FactorKey(host, username));
         if (settings == null) { settings = new FactorSettings(); settings.method = legacy; }
         for (let i: i32 = 0; i < 64; i++) {
-            const next = FactorDb.revisions.lookup(new FactorRevision(host, username, settings.revision + 1));
+            const next = AuthReads.owner(AuthStateDb.factorRevisions, new FactorRevision(host, username, settings.revision + 1));
             if (next == null) return settings;
             settings = next;
         }
@@ -34,8 +13,8 @@ export class FactorRepository {
     }
     public static save(host: string, username: string, method: u8, expected: u64): bool {
         const settings = new FactorSettings(); settings.method = method; settings.revision = expected + 1;
-        if (!FactorDb.revisions.claim(new FactorRevision(host, username, settings.revision), settings).claimed) return false;
-        FactorDb.heads.upsert(new FactorKey(host, username), settings);
+        if (!AuthStateDb.factorRevisions.claim(new FactorRevision(host, username, settings.revision), settings).claimed) return false;
+        AuthStateDb.factorHeads.upsert(new FactorKey(host, username), settings);
         return true;
     }
 }

package/server/auth/SessionEpochs.ts

@@ -1,24 +1,6 @@
+import { AuthReads } from 'toiljs/server/auth/AuthReads';
 import { DataReader } from 'data';
-@data
-class SessionUserKey {
-    id: string = '';
-    constructor(id: string = '') { this.id = id; }
-}
-@data
-class SessionEpochKey {
-    id: string = '';
-    revision: u64 = 0;
-    constructor(id: string = '', revision: u64 = 0) { this.id = id; this.revision = revision; }
-}
-@data
-class SessionEpoch {
-    revision: u64 = 0;
-}
-@database
-class SessionEpochDb {
-    @collection static heads: Documents<SessionUserKey, SessionEpoch>;
-    @collection static revisions: Unique<SessionEpochKey, SessionEpoch>;
-}
+import { AuthStateDb, SessionUserKey, SessionEpochKey, SessionEpoch } from './AuthStateDb';
 /** Immutable per-user generations fence sessions and in-flight login challenges without clock assumptions. */
 export class SessionEpochs {
     private static key(userData: Uint8Array): string {
@@ -29,10 +11,10 @@ export class SessionEpochs {
         return crypto.toHex(id);
     }
     private static read(id: string): SessionEpoch {
-        let epoch = SessionEpochDb.heads.get(new SessionUserKey(id));
+        let epoch = AuthReads.document(AuthStateDb.epochHeads, new SessionUserKey(id));
         if (epoch == null) epoch = new SessionEpoch();
         for (let i: i32 = 0; i < 64; i++) {
-            const next = SessionEpochDb.revisions.lookup(new SessionEpochKey(id, epoch.revision + 1));
+            const next = AuthReads.owner(AuthStateDb.epochRevisions, new SessionEpochKey(id, epoch.revision + 1));
             if (next == null) return epoch;
             epoch = next;
         }
@@ -49,8 +31,8 @@ export class SessionEpochs {
         for (let i: i32 = 0; i < 3; i++) {
             const epoch = SessionEpochs.read(id);
             epoch.revision += 1;
-            if (!SessionEpochDb.revisions.claim(new SessionEpochKey(id, epoch.revision), epoch).claimed) continue;
-            SessionEpochDb.heads.upsert(new SessionUserKey(id), epoch);
+            if (!AuthStateDb.epochRevisions.claim(new SessionEpochKey(id, epoch.revision), epoch).claimed) continue;
+            AuthStateDb.epochHeads.upsert(new SessionUserKey(id), epoch);
             return;
         }
         throw new Error('Session revocation conflicted; retry');

package/server/globals/auth.ts

@@ -1,3 +1,4 @@
+import { AuthReads } from 'toiljs/server/auth/AuthReads';
 // AuthService: the server half of the post-quantum auth primitive, available
 // as a no-import global (registered via the toilscript `--lib` mechanism, the
 // same way `crypto` is a global). The client derives an ML-DSA-44 keypair from
@@ -11,11 +12,12 @@
 
 import { DataWriter, DataReader } from 'data';
 import { SessionEpochs } from 'toiljs/server/auth/SessionEpochs';
-import { SessionRevocations, SessionDigest, RevokedSession } from 'toiljs/server/auth/SessionRevocations';
+import { AuthStateDb, SessionDigest, RevokedSession } from 'toiljs/server/auth/AuthStateDb';
 import { HmacImportParams, HmacParams, ALG_SHA_256, FMT_RAW, USAGE_SIGN, USAGE_VERIFY } from 'crypto';
 
 import {
     Server,
+    Request,
     SecureCookies,
     Cookie,
     SameSite,
@@ -274,6 +276,7 @@ export namespace AuthService {
      * the env value for the current request; keep it out of any client bundle.
      */
     export function setSecret(secret: Uint8Array): void {
+        invalidateSession();
         __sessionSecret = secret;
     }
 
@@ -286,13 +289,33 @@ export namespace AuthService {
     export function getSessionBytes(): Uint8Array | null {
         const req = Server.currentRequest;
         if (req == null) return null;
+        if (!req.__authChecked) {
+            // Publish only after verification completes. A host fault must never
+            // turn into a cached anonymous result if the application handles it.
+            req.__authBytes = verifySession(req);
+            req.__authChecked = true;
+        }
+        if (Time.nowSeconds() >= req.__authExpires) return null;
+        const bytes = req.__authBytes;
+        // Callers may decode/mutate their copy without changing later auth checks.
+        return bytes == null ? null : bytes.slice();
+    }
+
+    function invalidateSession(): void {
+        const req = Server.currentRequest;
+        if (req == null) return;
+        req.__authChecked = false;
+        req.__authBytes = null;
+        req.__authExpires = 0;
+    }
 
+    function verifySession(req: Request): Uint8Array | null {
         const sealed = SecureCookies.signed(__resolveSessionSecret()).open(
             req.cookies(),
             sessionCookieName(__reqIsSecure()),
         );
         if (sealed == null) return null;
-        if (SessionRevocations.sessions.lookup(new SessionDigest(crypto.toHex(crypto.sha256Text(sealed)))) != null) return null;
+        if (AuthReads.owner(AuthStateDb.revokedSessions, new SessionDigest(crypto.toHex(crypto.sha256Text(sealed)))) != null) return null;
 
         const payload = base64UrlDecode(sealed);
         if (payload == null) return null;
@@ -310,6 +333,7 @@ export namespace AuthService {
         if (Time.nowSeconds() >= exp) return null;       // expired
         if (!SessionEpochs.allowed(userBytes, generation)) return null;
 
+        req.__authExpires = exp;
         return userBytes;
     }
 
@@ -397,6 +421,7 @@ export namespace AuthService {
 
     /** Invalidate all browser sessions authorized under the prior session generation. */
     export function revokeUserSessions(userData: Uint8Array): void {
+        invalidateSession();
         SessionEpochs.revoke(userData);
     }
 
@@ -406,7 +431,8 @@ export namespace AuthService {
         const req = Server.currentRequest!;
         const sealed = SecureCookies.signed(__resolveSessionSecret()).open(req.cookies(), sessionCookieName(__reqIsSecure()));
         if (sealed == null) return;
-        SessionRevocations.sessions.claim(new SessionDigest(crypto.toHex(crypto.sha256Text(sealed))), new RevokedSession());
+        invalidateSession();
+        AuthStateDb.revokedSessions.claim(new SessionDigest(crypto.toHex(crypto.sha256Text(sealed))), new RevokedSession());
     }
 
     /** A `Set-Cookie` that immediately clears the session (logout). */

package/server/runtime/request.ts

@@ -33,6 +33,12 @@ export class Request {
     headers: Array<Header>;
     body: Uint8Array;
 
+    // Auth verification belongs to this request object, never a process/tenant cache.
+    // Internal AuthService state; cleared before local revocations or secret changes.
+    __authChecked: bool = false;
+    __authBytes: Uint8Array | null = null;
+    __authExpires: u64 = 0;
+
     // Lazily parsed `Cookie` header, cached for the life of the request.
     private _cookies: CookieMap | null = null;
 

package/server/auth/SessionRevocations.ts

@@ -1,13 +0,0 @@
-@data
-export class SessionDigest {
-    digest: string = '';
-    constructor(digest: string = '') { this.digest = digest; }
-}
-@data
-export class RevokedSession {
-    revoked: bool = true;
-}
-@database
-export class SessionRevocations {
-    @collection static sessions: Unique<SessionDigest, RevokedSession>;
-}