velocious 1.0.666 → 1.0.668

package/build/database/drivers/mssql/table.js

@@ -3,7 +3,7 @@
 import BaseTable from "../base-table.js"
 import Column from "./column.js"
 import ColumnsIndex from "./columns-index.js"
-import {digg} from "diggerize"
+import { digg } from "diggerize"
 import ForeignKey from "./foreign-key.js"
 import { normalizeIndexMetadataRow } from "../index-metadata.js"
 
@@ -67,10 +67,24 @@ export default class VelociousDatabaseDriversMssqlTable extends BaseTable {
     return await this.getDriver()._cachedTableSchemaMetadata(this.getName(), "columns", async () => {
       const result = await this.driver.query(`
         SELECT
-          *,
-          COLUMNPROPERTY(object_id(TABLE_SCHEMA + '.' + TABLE_NAME), COLUMN_NAME, 'IsIdentity') AS isIdentity
-        FROM [INFORMATION_SCHEMA].[COLUMNS]
-        WHERE [TABLE_NAME] = ${this.driver.quote(this.getName())}
+          columns.*,
+          COLUMNPROPERTY(object_id(columns.TABLE_SCHEMA + '.' + columns.TABLE_NAME), columns.COLUMN_NAME, 'IsIdentity') AS isIdentity,
+          CASE WHEN keyColumnUsage.COLUMN_NAME IS NOT NULL THEN 1 ELSE 0 END AS isPrimaryKey
+        FROM [INFORMATION_SCHEMA].[COLUMNS] AS columns
+        LEFT JOIN [INFORMATION_SCHEMA].[TABLE_CONSTRAINTS] AS tableConstraints ON
+          tableConstraints.CONSTRAINT_TYPE = 'PRIMARY KEY' AND
+          tableConstraints.TABLE_CATALOG = columns.TABLE_CATALOG AND
+          tableConstraints.TABLE_SCHEMA = columns.TABLE_SCHEMA AND
+          tableConstraints.TABLE_NAME = columns.TABLE_NAME
+        LEFT JOIN [INFORMATION_SCHEMA].[KEY_COLUMN_USAGE] AS keyColumnUsage ON
+          keyColumnUsage.CONSTRAINT_CATALOG = tableConstraints.CONSTRAINT_CATALOG AND
+          keyColumnUsage.CONSTRAINT_SCHEMA = tableConstraints.CONSTRAINT_SCHEMA AND
+          keyColumnUsage.CONSTRAINT_NAME = tableConstraints.CONSTRAINT_NAME AND
+          keyColumnUsage.TABLE_CATALOG = columns.TABLE_CATALOG AND
+          keyColumnUsage.TABLE_SCHEMA = columns.TABLE_SCHEMA AND
+          keyColumnUsage.TABLE_NAME = columns.TABLE_NAME AND
+          keyColumnUsage.COLUMN_NAME = columns.COLUMN_NAME
+        WHERE columns.TABLE_NAME = ${this.driver.quote(this.getName())}
       `)
       const columns = []
 

package/build/database/pool/async-tracked-multi-connection.js

@@ -998,7 +998,8 @@ export default class VelociousDatabasePoolAsyncTrackedMultiConnection extends Ba
 
     if (!actualCallback) throw new Error("withConnection requires a callback")
 
-    const testSharedConnection = this.activeTestSharedConnection()
+    const connectionContextSuppressed = this.asyncLocalStorage.getStore() === SUPPRESSED_CONNECTION_CONTEXT
+    const testSharedConnection = connectionContextSuppressed ? undefined : this.activeTestSharedConnection()
     if (testSharedConnection && this.connectionMatchesCurrentConfiguration(testSharedConnection)) {
       return await this.asyncLocalStorage.run(testSharedConnection.getIdSeq(), async () => {
         return await actualCallback(testSharedConnection)

package/build/database/query/alter-table-base.js

@@ -33,6 +33,7 @@ export default class VelociousDatabaseQueryAlterTableBase extends QueryBase {
     let sql = `ALTER TABLE ${options.quoteTableName(tableData.getName())} `
     let actionCount = 0
     let previousActionWasMssqlColumnAdd = false
+    let previousActionWasMssqlColumnDrop = false
 
     for (const column of tableData.getColumns()) {
       if (actionCount > 0) sql += ", "
@@ -46,6 +47,7 @@ export default class VelociousDatabaseQueryAlterTableBase extends QueryBase {
 
         sql += column.getSQL({driver: this.getDriver(), forAlterTable: false})
         previousActionWasMssqlColumnAdd = databaseType == "mssql"
+        previousActionWasMssqlColumnDrop = false
       } else if (column.getNewName()) {
         const newColumnName = column.getNewName()
 
@@ -53,9 +55,13 @@ export default class VelociousDatabaseQueryAlterTableBase extends QueryBase {
 
         sql += `RENAME COLUMN ${options.quoteColumnName(column.getName())} TO ${options.quoteColumnName(newColumnName)}`
         previousActionWasMssqlColumnAdd = false
+        previousActionWasMssqlColumnDrop = false
       } else if (column.getDropColumn()) {
-        sql += `DROP COLUMN ${options.quoteColumnName(column.getName())}`
+        if (databaseType != "mssql" || !previousActionWasMssqlColumnDrop) sql += "DROP COLUMN "
+
+        sql += options.quoteColumnName(column.getName())
         previousActionWasMssqlColumnAdd = false
+        previousActionWasMssqlColumnDrop = databaseType == "mssql"
       } else {
         if (databaseType == "mssql" || databaseType == "pgsql") {
           sql += "ALTER COLUMN "
@@ -65,6 +71,7 @@ export default class VelociousDatabaseQueryAlterTableBase extends QueryBase {
 
         sql += column.getSQL({driver: this.getDriver(), forAlterTable: true})
         previousActionWasMssqlColumnAdd = false
+        previousActionWasMssqlColumnDrop = false
       }
 
 

package/build/database/record/attachments/store.js

@@ -1,10 +1,10 @@
 // @ts-check
 
-import {createHash} from "node:crypto"
 import UUID from "pure-uuid"
 import TableData from "../../table-data/index.js"
 import TableIndex from "../../table-data/table-index.js"
 import {modelPrimaryKeyCacheKey} from "../../../utils/model-primary-key.js"
+import sha256Hex from "../../../utils/sha256-hex.js"
 import normalizeRecordAttachmentInput from "./normalize-input.js"
 
 /**
@@ -44,7 +44,7 @@ function attachmentRecordId(model) {
  * @returns {string} - SHA-256 digest.
  */
 function attachmentRecordIdDigest(recordId) {
-  return createHash("sha256").update(recordId).digest("hex")
+  return sha256Hex(recordId)
 }
 
 /**

package/build/environment-handlers/node/cli/commands/test/timing-manifest/merge.js

@@ -1,8 +1,8 @@
 // @ts-check
 
 import BaseCommand from "../../../../../../cli/base-command.js"
+import { parseTimingManifestMergeArguments as parsePackageTimingManifestMergeArguments } from "@velocious/testing/node"
 import fs from "node:fs/promises"
-import path from "node:path"
 import { writeTimingManifest } from "../../../../../../testing/test-profile-output.js"
 import { mergeTestProfileTimingManifests } from "../../../../../../testing/timing-manifest.js"
 
@@ -51,24 +51,6 @@ export default class TestTimingManifestMerge extends BaseCommand {
   }
 }
 
-/**
- * Recognizes one output option spelling.
- * @param {string} argument - Current argument.
- * @param {string | undefined} nextArgument - Following argument.
- * @returns {{matched: boolean, skipNext: boolean, value: string | undefined}} - Parsed output option.
- */
-function timingManifestOutputArgument(argument, nextArgument) {
-  if (argument === "--output") {
-    return {matched: true, skipNext: true, value: nextArgument}
-  }
-
-  if (argument.startsWith("--output=")) {
-    return {matched: true, skipNext: false, value: argument.slice("--output=".length)}
-  }
-
-  return {matched: false, skipNext: false, value: undefined}
-}
-
 /**
  * Parses strict merge arguments and resolves their paths.
  * @param {string[]} processArgs - Raw CLI arguments, including command name.
@@ -76,33 +58,5 @@ function timingManifestOutputArgument(argument, nextArgument) {
  * @returns {TimingManifestMergeArguments} - Validated resolved paths.
  */
 export function parseTimingManifestMergeArguments(processArgs, cwd) {
-  const commandName = processArgs[0] || "test:timing-manifest:merge"
-  const inputPaths = []
-  let outputPath
-
-  for (let index = 1; index < processArgs.length; index++) {
-    const argument = processArgs[index]
-    const outputArgument = timingManifestOutputArgument(argument, processArgs[index + 1])
-
-    if (outputArgument.matched) {
-      if (!outputArgument.value || outputArgument.value.startsWith("-")) throw new Error("Missing value for --output")
-      if (outputPath) throw new Error("--output may only be provided once")
-      outputPath = path.resolve(cwd, outputArgument.value)
-      if (outputArgument.skipNext) index++
-      continue
-    }
-
-    if (argument.startsWith("-")) throw new Error(`Unknown argument for ${commandName}: ${argument}`)
-    inputPaths.push(path.resolve(cwd, argument))
-  }
-
-  if (!outputPath) throw new Error("--output is required")
-  if (inputPaths.length === 0) throw new Error("At least one rich test profile input is required")
-
-  const uniqueInputPaths = new Set(inputPaths)
-
-  if (uniqueInputPaths.size !== inputPaths.length) throw new Error("Each rich test profile input must be provided once")
-  if (uniqueInputPaths.has(outputPath)) throw new Error("Timing manifest output must not overwrite an input profile")
-
-  return {inputPaths, outputPath}
+  return parsePackageTimingManifestMergeArguments(processArgs.slice(1), {cwd})
 }

package/build/environment-handlers/node/cli/commands/test.js

@@ -1,19 +1,22 @@
 // @ts-check
 
 import BaseCommand from "../../../../cli/base-command.js"
-import fs from "fs/promises"
 import path from "node:path"
 import picocolors from "picocolors"
 import TestFilesFinder from "../../../../testing/test-files-finder.js"
 import TestProfiler from "../../../../testing/test-profiler.js"
-import { formatTestProfileSummary, writeTestProfileOutputs } from "../../../../testing/test-profile-output.js"
+import {
+  formatTestProfileSummary,
+  loadTimingManifest,
+  resolveTestProfileOptions,
+  writeTestProfileOutputs
+} from "../../../../testing/test-profile-output.js"
 import TestRunner from "../../../../testing/test-runner.js"
 import TestSuiteSplitter from "../../../../testing/test-suite-splitter.js"
 import { normalizeExamplePatterns, parseFilters } from "../../../../testing/test-filter-parser.js"
 import {
   canonicalTimingManifestPath,
-  timingManifestFileSetHash,
-  validateTimingManifest
+  timingManifestFileSetHash
 } from "../../../../testing/timing-manifest.js"
 import { prepareSourcePeerPackage } from "../../source-peer-package.js"
 
@@ -44,8 +47,11 @@ export default class VelociousCliCommandsTest extends BaseCommand {
       groupNumber,
       profile,
       profileJsonPath,
+      retries,
+      setupFiles,
       timingManifestPath,
-      timingManifestOutputPath
+      timingManifestOutputPath,
+      timeoutMs
     } = parseFilters(this.processArgs || [])
     const profileOptions = resolveTestProfileOptions({
       cwd: process.cwd(),
@@ -70,7 +76,7 @@ export default class VelociousCliCommandsTest extends BaseCommand {
 
     /**
      * Finalizes requested outputs once for every command outcome.
-     * @param {string} status - Run status.
+     * @param {import("@velocious/testing/node").TestProfileStatus} status - Run status.
      * @returns {Promise<void>} - Resolves after requested outputs are written.
      */
     const finalizeProfile = async (status) => {
@@ -157,7 +163,10 @@ export default class VelociousCliCommandsTest extends BaseCommand {
         testFiles,
         lineFilters: testFilesFinder.getLineFiltersByFile(),
         examplePatterns: normalizeExamplePatterns(examplePatterns),
-        profiler
+        profiler,
+        retries,
+        setupFiles: setupFiles.map((setupFile) => path.resolve(process.cwd(), setupFile)),
+        timeoutMs
       })
       const activeTestRunner = testRunner
       let signalHandled = false
@@ -272,68 +281,7 @@ export default class VelociousCliCommandsTest extends BaseCommand {
   }
 }
 
-/**
- * Resolves and validates profiling paths before test discovery starts.
- * @param {object} args - Raw profiling options.
- * @param {string} args.cwd - Command working directory.
- * @param {boolean} args.profile - Whether console profiling was requested.
- * @param {string} [args.profileJsonPath] - Rich profile output path.
- * @param {string} [args.timingManifestPath] - Timing manifest input path.
- * @param {string} [args.timingManifestOutputPath] - Timing manifest output path.
- * @returns {{profile: boolean, profileJsonPath: string | undefined, timingManifestPath: string | undefined, timingManifestOutputPath: string | undefined}} - Resolved profiling options.
- */
-export function resolveTestProfileOptions({cwd, profile, profileJsonPath, timingManifestPath, timingManifestOutputPath}) {
-  const resolvedProfileJsonPath = profileJsonPath ? path.resolve(cwd, profileJsonPath) : undefined
-  const resolvedTimingManifestPath = timingManifestPath ? path.resolve(cwd, timingManifestPath) : undefined
-  const resolvedTimingManifestOutputPath = timingManifestOutputPath
-    ? path.resolve(cwd, timingManifestOutputPath)
-    : undefined
-
-  if (resolvedProfileJsonPath && resolvedTimingManifestOutputPath && resolvedProfileJsonPath === resolvedTimingManifestOutputPath) {
-    throw new Error("Test profiling output paths must be different")
-  }
-
-  if (resolvedTimingManifestPath && (
-    resolvedProfileJsonPath === resolvedTimingManifestPath ||
-    resolvedTimingManifestOutputPath === resolvedTimingManifestPath
-  )) {
-    throw new Error("Test profiling outputs must not overwrite --timing-manifest input")
-  }
-
-  return {
-    profile: profile || Boolean(resolvedProfileJsonPath || resolvedTimingManifestOutputPath),
-    profileJsonPath: resolvedProfileJsonPath,
-    timingManifestPath: resolvedTimingManifestPath,
-    timingManifestOutputPath: resolvedTimingManifestOutputPath
-  }
-}
-
-/**
- * Loads and validates an explicitly supplied plain JSON timing manifest.
- * @param {string | undefined} timingManifestPath - Timing manifest path.
- * @returns {Promise<Record<string, number> | undefined>} - Canonical manifest, or undefined when not requested.
- */
-export async function loadTimingManifest(timingManifestPath) {
-  if (!timingManifestPath) return undefined
-
-  let content
-
-  try {
-    content = await fs.readFile(timingManifestPath, "utf8")
-  } catch (error) {
-    throw new Error(`Failed to read timing manifest: ${timingManifestPath}`, {cause: error})
-  }
-
-  let parsed
-
-  try {
-    parsed = JSON.parse(content)
-  } catch (error) {
-    throw new Error(`Failed to parse timing manifest: ${timingManifestPath}`, {cause: error})
-  }
-
-  return validateTimingManifest(parsed, {source: `Timing manifest ${timingManifestPath}`})
-}
+export { loadTimingManifest, resolveTestProfileOptions }
 
 /**
  * Resolves how many slowest tests to report from the `VELOCIOUS_SLOW_TEST_COUNT`

package/build/frontend-model-controller.js

@@ -4456,16 +4456,36 @@ export default class FrontendModelController extends Controller {
 
       try {
         let indexPayload = {}
+        let hasLegacyAuthenticationToken = false
+        let legacyAuthenticationToken
 
         if (commandType === "index") {
+          let indexPayloadInput = payload
+
+          if (isPlainObject(payload) && Object.hasOwn(payload, "authenticationToken")) {
+            const {authenticationToken, ...payloadWithoutAuthenticationToken} = payload
+
+            hasLegacyAuthenticationToken = true
+            legacyAuthenticationToken = authenticationToken
+            indexPayloadInput = payloadWithoutAuthenticationToken
+          }
+
           try {
-            indexPayload = assertFrontendModelIndexPayload(payload)
+            indexPayload = assertFrontendModelIndexPayload(indexPayloadInput)
           } catch (error) {
             throwFrontendModelQueryErrorForParserError(error)
           }
         }
 
-        const requestContext = captureFrontendModelRemoteRequestContext(requestEntry?.requestContext)
+        let requestContext = captureFrontendModelRemoteRequestContext(requestEntry?.requestContext)
+
+        if (hasLegacyAuthenticationToken && !Object.hasOwn(requestContext, "authenticationToken")) {
+          requestContext = captureFrontendModelRemoteRequestContext({
+            ...requestContext,
+            authenticationToken: legacyAuthenticationToken
+          })
+        }
+
         let responsePayload
 
         if (isBuiltInCommand) {

package/build/frontend-models/websocket-channel.js

@@ -389,6 +389,24 @@ export default class FrontendModelWebsocketChannel extends VelociousWebsocketCha
     return broadcastParams?.model === this._modelName()
   }
 
+  /**
+   * Drops the server-only destroy-authorization snapshot before replay
+   * persistence. The snapshot is what makes replayed destroy events
+   * require a client resync, and the pre-delete row it captures must
+   * never be stored.
+   * @param {Record<string, import("./query.js").FrontendModelTransportValue> | null | undefined} broadcastParams - Params from `broadcastToChannel`.
+   * @returns {Record<string, import("./query.js").FrontendModelTransportValue> | null} - Persistable routing params.
+   */
+  static replayableBroadcastParams(broadcastParams) {
+    if (!broadcastParams) return null
+
+    const replayableParams = {...broadcastParams}
+
+    delete replayableParams.destroyAuthorizationRecord
+
+    return replayableParams
+  }
+
   /**
    * Runs debug snapshot.
    * @returns {Record<string, ReturnType<typeof JSON.parse>>} Debug-safe subscription details.

package/build/http-server/client/websocket-session.js

@@ -1843,8 +1843,13 @@ export default class VelociousHttpServerClientWebsocketSession {
 
   /**
    * Replays missed events from the persistent event-log store for a
-   * channel subscription that provided `lastEventId`. Sends each
-   * missed event as a `channel-message` with `replayed: true`.
+   * channel subscription that provided `lastEventId`. Delivery is
+   * stream-scoped: each persisted event's broadcast params are
+   * re-applied through the subscription's `matches()` — the same routing
+   * decision live delivery uses — so the subscription only replays events
+   * from its own stream of the channel. A checkpoint that belongs to a
+   * different stream (or is no longer retained) yields
+   * `channel-replay-gap` instead of cross-stream replay.
    * @param {object} args - Options.
    * @param {string} args.channelType - Channel type name (event-log key).
    * @param {string} args.lastEventId - Client's last-seen event id.
@@ -1858,7 +1863,7 @@ export default class VelociousHttpServerClientWebsocketSession {
 
     const checkpoint = await store.getEventById({channel: channelType, id: lastEventId})
 
-    if (!checkpoint) {
+    if (!checkpoint || !this._replayEventMatchesSubscription({channelType, event: checkpoint, subscription})) {
       this.sendJson({
         type: "channel-replay-gap",
         subscriptionId: subscription.subscriptionId,
@@ -1880,6 +1885,8 @@ export default class VelociousHttpServerClientWebsocketSession {
     for (const event of events) {
       if (subscription.isClosed()) break
 
+      if (!this._replayEventMatchesSubscription({channelType, event, subscription})) continue
+
       if (await subscription._requiresReplayGap(event.payload)) {
         this.sendJson({
           type: "channel-replay-gap",
@@ -1891,11 +1898,41 @@ export default class VelociousHttpServerClientWebsocketSession {
 
       await subscription.deliverBroadcast(
         /** @type {import("../websocket-channel.js").WebsocketJsonValue} */ (event.payload),
-        {eventId: event.id}
+        {
+          ...(event.params !== null ? {broadcastParams: event.params} : {}),
+          eventId: event.id
+        }
       )
     }
   }
 
+  /**
+   * Whether a persisted replay event belongs to this subscription's
+   * stream. A `matches()` failure means the stream membership cannot be
+   * proven, so the event is treated as not matching — the same isolation
+   * live delivery applies to a broken `matches()`.
+   * @param {object} args - Options.
+   * @param {string} args.channelType - Channel type name.
+   * @param {{params: Record<string, ReturnType<typeof JSON.parse>> | null}} args.event - Persisted replay event.
+   * @param {import("../websocket-channel.js").default} args.subscription - Live subscription.
+   * @returns {boolean} - Whether the event belongs to the subscription's stream.
+   */
+  _replayEventMatchesSubscription({channelType, event, subscription}) {
+    try {
+      return Boolean(subscription.matches(event.params || {}))
+    } catch (caughtError) {
+      const error = this._reportUnexpectedDispatchError(caughtError, {
+        channelType,
+        stage: "websocket-channel-replay",
+        subscriptionId: subscription.subscriptionId
+      })
+
+      this.logger.error(() => [`Websocket replay subscription ${subscription.subscriptionId} matches() threw`, error])
+
+      return false
+    }
+  }
+
   /**
    * Handles `{type: "channel-unsubscribe"}` from the client — calls
    * `unsubscribed()` and sends `channel-unsubscribed`.

package/build/http-server/websocket-channel.js

@@ -94,6 +94,20 @@ export default class VelociousWebsocketChannel {
    */
   matches(..._broadcastArgs) { return true }
 
+  /**
+   * Returns the broadcast params that may be persisted for replay.
+   * Persisted params are re-applied through `matches(broadcastParams)`
+   * when replaying missed events, so they must be JSON-serializable and
+   * safe to store. Override when `broadcastParams` carries server-only
+   * values that must never reach the event log (e.g. authorization
+   * snapshots).
+   * @param {WebsocketParams | null | undefined} broadcastParams - Params passed to `broadcastToChannel`.
+   * @returns {WebsocketParams | null} - Params to persist, or null to store none.
+   */
+  static replayableBroadcastParams(broadcastParams) {
+    return broadcastParams ?? null
+  }
+
   /**
    * Whether replaying a persisted broadcast would require a client resync.
    * Subclasses override this when replay storage deliberately omits metadata