velocious 1.0.571 → 1.0.573

package/README.md

@@ -15,6 +15,7 @@
 * Declarative client sync scopes with per-scope cursors, automatic mutation tracking, realtime delivery, and `sync`/`pull` progress reporting for "X of Y" import screens (see [docs/sync-client.md](docs/sync-client.md))
 * Reactive `useLiveQuery(Model.where(...))` queries that stay current from committed local model changes across local writes, pulls, and realtime (see [docs/live-queries.md](docs/live-queries.md))
 * Server-side sync envelope replay orchestration for app-owned sync receivers (see [docs/sync-envelope-replay-service.md](docs/sync-envelope-replay-service.md))
+* AwesomeTasks-shaped offline sync proof using routed resources, domain commands, signed offline grants, and peer-forwarded mutations (see [docs/awesome-tasks-offline-sync-proof.md](docs/awesome-tasks-offline-sync-proof.md))
 * SQLite web persistence that automatically prefers OPFS, then IndexedDB, and migrates legacy persisted bytes when possible (see [docs/sqlite-web-persistence.md](docs/sqlite-web-persistence.md))
 * Expo / Metro compatibility guidance and a real Expo export check (see [docs/expo-metro-compatibility.md](docs/expo-metro-compatibility.md))
 * Gap-less positional lists with automatic reordering via `actsAsList`, including models with numeric, string, or UUID primary keys (see [docs/acts-as-list.md](docs/acts-as-list.md))
@@ -29,6 +30,7 @@
 * Default-on buffered HTTP response compression with Brotli/gzip content negotiation, global and per-response opt-outs, and HEAD-correct representation headers (see [docs/http-server.md](docs/http-server.md#response-compression))
 * Background jobs with failure events for production reporting and authorized database-scoped dashboard count snapshots/deltas (see [docs/background-jobs.md](docs/background-jobs.md) and [docs/background-jobs-dashboard.md](docs/background-jobs-dashboard.md))
 * Durable one-off background-job scheduling with exact epoch timestamps (see [docs/scheduled-background-job-enqueue.md](docs/scheduled-background-job-enqueue.md))
+* Mountable authenticated callable deployment API with allowlisted projects/stages, immutable-revision validation, idempotent runs, duplicate-safe interruption reconciliation, and adapter-owned execution for integrations like Rampway (see [docs/deployment-api.md](docs/deployment-api.md))
 * Rails-style request and database query logging (see [docs/logging.md](docs/logging.md))
 * EJS-backed mailers with delivery, queueing, and payload rendering support (see [docs/mailers.md](docs/mailers.md))
 * Trusted reverse proxy handling for `request.remoteAddress()` (see [docs/trusted-proxies.md](docs/trusted-proxies.md))

package/build/background-jobs/web/authorization.js

@@ -1,37 +1,6 @@
 // @ts-check
 
-import crypto from "node:crypto"
-
-/**
- * Constant-time comparison so token checks don't leak length/contents through
- * timing. Returns false for differing lengths before the timing-safe compare.
- * @param {string} a - First value.
- * @param {string} b - Second value.
- * @returns {boolean} - Whether the values are equal.
- */
-function safeEqual(a, b) {
-  const bufferA = Buffer.from(String(a))
-  const bufferB = Buffer.from(String(b))
-
-  if (bufferA.length !== bufferB.length) return false
-
-  return crypto.timingSafeEqual(bufferA, bufferB)
-}
-
-/**
- * Runs bearer token.
- * @param {import("../../http-server/client/request.js").default | import("../../http-server/client/websocket-request.js").default} request - Request object.
- * @returns {string | null} - Bearer token from the Authorization header, if any.
- */
-function bearerToken(request) {
-  const header = request.header("authorization")
-
-  if (typeof header !== "string") return null
-
-  const match = header.match(/^Bearer\s+(.+)$/i)
-
-  return match ? match[1].trim() : null
-}
+import {bearerToken, constantTimeEqual} from "../../utils/bearer-token.js"
 
 /**
  * Runs is loopback.
@@ -72,7 +41,7 @@ export async function authorizeJobsRequest({ability, configuration, options, req
 
   if (accessTokens.length > 0 && token) {
     for (const accessToken of accessTokens) {
-      if (safeEqual(token, accessToken)) return true
+      if (constantTimeEqual(token, accessToken)) return true
     }
   }
 

package/build/background-jobs/web/path-matcher.js

@@ -1,28 +1,13 @@
 // @ts-check
 
+import {mountSubPath, normalizeMountPrefix} from "../../utils/mount-prefix.js"
+
 /**
  * @typedef {object} JobsApiMatch
  * @property {string} action - Controller action to run.
  * @property {Record<string, string>} params - Extra params extracted from the path.
  */
-
-/**
- * Normalizes a mount prefix: ensures a leading slash and strips any trailing
- * slash so `/velocious/jobs/` and `/velocious/jobs` behave identically.
- * @param {string} at - Raw mount prefix.
- * @returns {string} - Normalized prefix.
- */
-export function normalizeMountPrefix(at) {
-  if (typeof at !== "string" || !at.startsWith("/")) {
-    throw new Error(`mount requires an 'at' path starting with '/', got: ${String(at)}`)
-  }
-
-  if (at.length > 1 && at.endsWith("/")) {
-    return at.slice(0, -1)
-  }
-
-  return at
-}
+export {normalizeMountPrefix}
 
 /**
  * Matches an incoming request against the read-only jobs API routes that live
@@ -35,19 +20,9 @@ export function normalizeMountPrefix(at) {
  * @returns {JobsApiMatch | null} - Matched action or null.
  */
 export function matchJobsApiPath({prefix, path, method}) {
-  /** @type {string} */
-  let subPath
+  const subPath = mountSubPath({prefix, path})
 
-  if (prefix === "/") {
-    // Root mount: the whole path is the sub-path (avoid building a "//" guard).
-    subPath = path
-  } else if (path === prefix) {
-    subPath = "/"
-  } else if (path.startsWith(`${prefix}/`)) {
-    subPath = path.slice(prefix.length)
-  } else {
-    return null
-  }
+  if (subPath === null) return null
 
   if (method === "GET" && subPath === "/api/health") return {action: "health", params: {}}
   if (method === "GET" && subPath === "/api/stats") return {action: "stats", params: {}}

package/build/database/drivers/base.js

@@ -961,6 +961,23 @@ export default class VelociousDatabaseDriversBase {
    */
   supportsDefaultPrimaryKeyUUID() { return false }
 
+  /**
+   * Executes an insert that carries an explicit primary-key value
+   * (client-generated offline-sync ids). Drivers whose auto-increment columns
+   * reject explicit values (MSSQL IDENTITY) override this to run the insert
+   * with identity insert enabled in a single request.
+   * @param {object} args - Options object.
+   * @param {QueryOptions} args.options - Query options for the standard query path.
+   * @param {string} args.sql - Generated insert SQL.
+   * @param {string} args.tableName - Table being inserted into.
+   * @returns {Promise<QueryResultType>} - Insert result.
+   */
+  async insertWithExplicitPrimaryKey({options, sql, tableName}) {
+    void tableName
+
+    return await this.query(sql, options)
+  }
+
   /**
    * Runs supports insert into returning.
    * @abstract

package/build/database/drivers/mssql/index.js

@@ -362,6 +362,36 @@ export default class VelociousDatabaseDriversMssql extends Base{
   shouldSetAutoIncrementWhenPrimaryKey() { return true }
   supportsDefaultPrimaryKeyUUID() { return true }
 
+  /**
+   * Runs an explicit primary-key insert as one batch request: SQL Server scopes
+   * IDENTITY_INSERT to the session, and node-mssql pool-backed requests may use
+   * a different physical session per query, so enabling it in a separate query
+   * can leave the actual INSERT on another session. A single batch keeps the
+   * whole sequence on one session by construction: enable, insert, disable on
+   * success, and a CATCH that disables and rethrows the original error.
+   * @param {object} args - Options object.
+   * @param {import("../base.js").QueryOptions} args.options - Query options for the standard query path.
+   * @param {string} args.sql - Generated insert SQL.
+   * @param {string} args.tableName - Table being inserted into.
+   * @returns {Promise<import("../base.js").QueryResultType>} - Insert result.
+   */
+  async insertWithExplicitPrimaryKey({options, sql, tableName}) {
+    const quotedTable = this.quoteTable(tableName)
+    const batch = [
+      `SET IDENTITY_INSERT ${quotedTable} ON;`,
+      "BEGIN TRY",
+      `${sql};`,
+      `SET IDENTITY_INSERT ${quotedTable} OFF;`,
+      "END TRY",
+      "BEGIN CATCH",
+      `SET IDENTITY_INSERT ${quotedTable} OFF;`,
+      "THROW;",
+      "END CATCH"
+    ].join("\n")
+
+    return await this.query(batch, options)
+  }
+
   /**
    * Runs escape.
    * @param {?} value - Value to use.

package/build/database/record/index.js

@@ -4248,15 +4248,21 @@ class VelociousDatabaseRecord {
    * @returns {Promise<void>} - Resolves when complete.
    */
   async _createNewRecord() {
-    if (!this.getModelClass().connection()["insertSql"]) {
-      throw new Error(`No insertSql on ${this.getModelClass().connection().constructor.name}`)
+    // Resolve the connection once and pin the whole insert path to it: a pool
+    // can resolve a different current connection across the awaits below, and
+    // the identity-insert wrapper is only effective on the exact session that
+    // ran SET IDENTITY_INSERT.
+    const connection = this._connection()
+
+    if (!connection["insertSql"]) {
+      throw new Error(`No insertSql on ${connection.constructor.name}`)
     }
 
     const data = Object.assign({}, this._belongsToChanges(), this.rawAttributes())
     const primaryKey = this.getModelClass().primaryKey()
     const primaryKeyColumn = this.getModelClass().getColumns().find((column) => column.getName() == primaryKey)
     const primaryKeyType = primaryKeyColumn?.getType()?.toLowerCase()
-    const driverSupportsDefaultUUID = typeof this._connection().supportsDefaultPrimaryKeyUUID == "function" && this._connection().supportsDefaultPrimaryKeyUUID()
+    const driverSupportsDefaultUUID = typeof connection.supportsDefaultPrimaryKeyUUID == "function" && connection.supportsDefaultPrimaryKeyUUID()
     const isUUIDPrimaryKey = primaryKeyType?.includes("uuid")
     const shouldAssignUUIDPrimaryKey = isUUIDPrimaryKey && !driverSupportsDefaultUUID
     this._setDefaultTimestampValues(data)
@@ -4270,14 +4276,20 @@ class VelociousDatabaseRecord {
 
     this._normalizeDateValuesForWrite(data)
 
-    const sql = this._connection().insertSql({
+    const sql = connection.insertSql({
       returnLastInsertedColumnNames: columnNames,
       tableName: this._tableName(),
       data
     })
-    const insertResult = await this._connection().query(sql, {logName: `${this.getModelClass().name} Create`})
-
-    await this._applyInsertResult({data, insertResult, primaryKey})
+    const insertOptions = {logName: `${this.getModelClass().name} Create`}
+    // Explicit primary-key inserts into auto-increment columns go through the
+    // driver's explicit-primary-key insert (MSSQL wraps it in IDENTITY_INSERT);
+    // everything else uses the plain query path.
+    const insertResult = hasUserProvidedPrimaryKey && primaryKeyColumn?.getAutoIncrement() === true
+      ? await connection.insertWithExplicitPrimaryKey({options: insertOptions, sql, tableName: this._tableName()})
+      : await connection.query(sql, insertOptions)
+
+    await this._applyInsertResult({connection, data, insertResult, primaryKey})
     this.setIsNewRecord(false)
 
     this._markLoadedRelationshipsPreloadedAfterCreate()
@@ -4303,10 +4315,10 @@ class VelociousDatabaseRecord {
 
   /**
    * Applies the database insert response to this record.
-   * @param {{data: Record<string, string | number | boolean | Date | null | undefined>, insertResult: Array<Record<string, string | number | boolean | Date | null | undefined>> | null | undefined, primaryKey: string}} options - Inserted data, connection result, and primary key column name.
+   * @param {{connection: import("../drivers/base.js").default, data: Record<string, string | number | boolean | Date | null | undefined>, insertResult: Array<Record<string, string | number | boolean | Date | null | undefined>> | null | undefined, primaryKey: string}} options - Pinned insert connection, inserted data, connection result, and primary key column name.
    * @returns {Promise<void>} - Resolves when complete.
    */
-  async _applyInsertResult({data, insertResult, primaryKey}) {
+  async _applyInsertResult({connection, data, insertResult, primaryKey}) {
     if (Array.isArray(insertResult) && insertResult[0] && insertResult[0][primaryKey]) {
       this._attributes = insertResult[0]
       this._changes = {}
@@ -4322,7 +4334,7 @@ class VelociousDatabaseRecord {
         return
       }
 
-      const id = await this._connection().lastInsertID()
+      const id = await connection.lastInsertID()
 
       await this._reloadWithId(id)
     }