void 0.7.13 → 0.8.0

package/dist/runtime/migration-handler.mjs

@@ -1,5 +1,7 @@
+import { t as canonicalJson } from "../canonical-json-CEyQaVDa.mjs";
 //#region src/runtime/migration-handler.ts
-function createMigrationHandler(env, migrations, _dialect, runAuthMigrations) {
+const SUPPORTED_CLASSIFIER_VERSION = 1;
+function createMigrationHandler(env, migrations, _dialect, runAuthMigrations, planBundle) {
 	return async (request) => {
 		const token = request.headers.get("x-void-internal");
 		if (!token || token !== env.__VOID_PROXY_TOKEN) return Response.json({
@@ -7,6 +9,7 @@ function createMigrationHandler(env, migrations, _dialect, runAuthMigrations) {
 			error: "unauthorized",
 			migrations: []
 		}, { status: 401 });
+		const url = new URL(request.url);
 		try {
 			const db = env.DB;
 			if (!db) return Response.json({
@@ -14,8 +17,57 @@ function createMigrationHandler(env, migrations, _dialect, runAuthMigrations) {
 				error: "no D1 binding found",
 				migrations: []
 			}, { status: 500 });
-			const result = await runD1Migrations(db, migrations ?? []);
-			if (result.ok && runAuthMigrations) await runAuthMigrations();
+			if (request.method === "GET" && url.pathname === "/__void/migrate/capabilities") {
+				const verified = await verifyPlanBundle(migrations ?? [], planBundle);
+				return Response.json({
+					classifierVersion: verified.classifierVersion,
+					destructiveValidation: verified.destructiveValidation,
+					dialect: "sqlite",
+					endpoints: {
+						app: "/__void/migrate/app",
+						auth: runAuthMigrations ? "/__void/migrate/auth" : void 0,
+						reconcile: "/__void/migrate/app/attempt/:attemptId"
+					},
+					migrationListHash: verified.migrationListHash,
+					protocolVersion: 2
+				});
+			}
+			if (request.method === "POST" && url.pathname === "/__void/migrate/app") {
+				const body = await request.json().catch(() => ({}));
+				if (!body.attemptId) return Response.json({
+					ok: false,
+					protocolVersion: 2,
+					error: "attemptId required",
+					migrations: []
+				}, { status: 400 });
+				const result = await runD1AppMigrations(db, migrations ?? [], planBundle, {
+					attemptId: body.attemptId,
+					deploymentId: body.deploymentId
+				});
+				const status = result.ok ? 200 : result.error?.startsWith("migration already in progress") ? 409 : 500;
+				return Response.json(result, { status });
+			}
+			if (request.method === "GET" && url.pathname.startsWith("/__void/migrate/app/attempt/")) {
+				const result = await reconcileAttempt(db, decodeURIComponent(url.pathname.split("/").pop() ?? ""));
+				return Response.json(result, { status: result.ok ? 200 : 409 });
+			}
+			if (request.method === "POST" && url.pathname === "/__void/migrate/auth") {
+				if (runAuthMigrations) await runAuthMigrations();
+				return Response.json({
+					ok: true,
+					protocolVersion: 2
+				});
+			}
+			const result = await runD1LegacyMigrations(db, migrations ?? []);
+			if (result.ok && runAuthMigrations) try {
+				await runAuthMigrations();
+			} catch (err) {
+				return Response.json({
+					...result,
+					ok: false,
+					error: err instanceof Error ? err.message : String(err)
+				}, { status: 500 });
+			}
 			return Response.json(result);
 		} catch (err) {
 			return Response.json({
@@ -26,10 +78,29 @@ function createMigrationHandler(env, migrations, _dialect, runAuthMigrations) {
 		}
 	};
 }
-/**
-* One-time migration: rename legacy `_migrations` table to `_void_migrations`.
-* Copies all rows from the old table to the new one, then drops the old table.
-*/
+async function createTrackingTable(db) {
+	await db.prepare(`CREATE TABLE IF NOT EXISTS _void_migrations (
+      name TEXT PRIMARY KEY,
+      applied_at TEXT NOT NULL
+    )`).run();
+}
+async function createAttemptTables(db) {
+	await db.batch([db.prepare(`CREATE TABLE IF NOT EXISTS _void_migration_attempts (
+        attempt_id TEXT PRIMARY KEY,
+        deployment_id TEXT,
+        migration_list_hash TEXT NOT NULL,
+        planned_names_json TEXT NOT NULL,
+        plan_hashes_json TEXT NOT NULL,
+        status TEXT NOT NULL CHECK (status IN ('running', 'completed', 'failed', 'unknown')),
+        started_at TEXT NOT NULL,
+        completed_at TEXT,
+        error TEXT
+      )`), db.prepare(`CREATE TABLE IF NOT EXISTS _void_migration_lock (
+        name TEXT PRIMARY KEY,
+        attempt_id TEXT NOT NULL,
+        acquired_at TEXT NOT NULL
+      )`)]);
+}
 async function upgradeTrackingTable(db) {
 	const { results } = await db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='_migrations'").all();
 	if (!results || results.length === 0) return;
@@ -42,19 +113,257 @@ async function upgradeTrackingTable(db) {
 		db.prepare(`DROP TABLE _migrations`)
 	]);
 }
-async function runD1Migrations(db, migrations) {
-	await db.prepare(`CREATE TABLE IF NOT EXISTS _void_migrations (
-      name TEXT PRIMARY KEY,
-      applied_at TEXT NOT NULL
-    )`).run();
-	await upgradeTrackingTable(db);
+async function readAppliedSet(db) {
 	const { results } = await db.prepare("SELECT name FROM _void_migrations").all();
-	const applied = new Set((results ?? []).map((r) => r.name));
+	return new Set((results ?? []).map((row) => row.name));
+}
+async function runD1AppMigrations(db, migrations, planBundle, attempt) {
+	const verified = await verifyPlanBundle(migrations, planBundle);
+	await createAttemptTables(db);
+	const now = (/* @__PURE__ */ new Date()).toISOString();
+	const lock = await acquireAttemptLock(db, attempt.attemptId, now);
+	if (lock !== "acquired") return lock;
+	const plannedNames = migrations.map((migration) => migration.name);
+	const planHashes = verified.plans.map((plan) => plan.planHash);
+	try {
+		await db.prepare(`INSERT INTO _void_migration_attempts
+          (attempt_id, deployment_id, migration_list_hash, planned_names_json, plan_hashes_json, status, started_at)
+         VALUES (?, ?, ?, ?, ?, 'running', ?)`).bind(attempt.attemptId, attempt.deploymentId ?? null, verified.migrationListHash, JSON.stringify(plannedNames), JSON.stringify(planHashes), now).run();
+	} catch {
+		await releaseAttemptLock(db, attempt.attemptId);
+		return reconcileAttempt(db, attempt.attemptId);
+	}
+	const migrationResults = [];
+	const confirmedApplied = [];
+	const confirmedSkipped = [];
+	const warnings = verified.plans.flatMap((plan) => plan.warnings ?? []);
+	let stability = "stable";
+	try {
+		await createTrackingTable(db);
+		await upgradeTrackingTable(db);
+		const applied = await readAppliedSet(db);
+		for (let index = 0; index < migrations.length; index++) {
+			const migration = migrations[index];
+			const plan = verified.plans[index];
+			if (plan.stability === "legacy") stability = "legacy";
+			if (applied.has(migration.name)) {
+				confirmedSkipped.push(migration.name);
+				migrationResults.push({
+					applied: false,
+					durationMs: 0,
+					name: migration.name,
+					stability: plan.stability,
+					status: "skipped"
+				});
+				continue;
+			}
+			const start = Date.now();
+			try {
+				await executeMigrationPlan(db, migration, plan);
+				applied.add(migration.name);
+				confirmedApplied.push(migration.name);
+				migrationResults.push({
+					applied: true,
+					durationMs: Date.now() - start,
+					name: migration.name,
+					stability: plan.stability,
+					status: "applied"
+				});
+			} catch (err) {
+				const error = err instanceof Error ? err.message : String(err);
+				migrationResults.push({
+					applied: false,
+					durationMs: Date.now() - start,
+					error,
+					name: migration.name,
+					stability: plan.stability,
+					status: "failed"
+				});
+				await markAttempt(db, attempt.attemptId, "failed", error);
+				await releaseAttemptLock(db, attempt.attemptId);
+				return {
+					ok: false,
+					protocolVersion: 2,
+					attemptId: attempt.attemptId,
+					confirmedApplied,
+					confirmedSkipped,
+					error: `migration ${migration.name} failed`,
+					migrations: migrationResults,
+					stability,
+					warnings
+				};
+			}
+		}
+		await markAttempt(db, attempt.attemptId, "completed");
+		await releaseAttemptLock(db, attempt.attemptId);
+		return {
+			ok: true,
+			protocolVersion: 2,
+			attemptId: attempt.attemptId,
+			confirmedApplied,
+			confirmedSkipped,
+			migrations: migrationResults,
+			stability,
+			warnings
+		};
+	} catch (err) {
+		const error = err instanceof Error ? err.message : String(err);
+		await markAttempt(db, attempt.attemptId, "failed", error).catch(() => {});
+		await releaseAttemptLock(db, attempt.attemptId).catch(() => {});
+		return {
+			ok: false,
+			protocolVersion: 2,
+			attemptId: attempt.attemptId,
+			confirmedApplied,
+			confirmedSkipped,
+			error,
+			migrations: migrationResults,
+			stability,
+			warnings
+		};
+	}
+}
+async function acquireAttemptLock(db, attemptId, acquiredAt) {
+	for (let tries = 0; tries < 2; tries++) try {
+		await db.prepare("INSERT INTO _void_migration_lock (name, attempt_id, acquired_at) VALUES (?, ?, ?)").bind("app", attemptId, acquiredAt).run();
+		return "acquired";
+	} catch {
+		const existing = await db.prepare("SELECT attempt_id FROM _void_migration_lock WHERE name = ?").bind("app").first();
+		if (existing?.attempt_id === attemptId) return reconcileAttempt(db, attemptId);
+		if (existing?.attempt_id) {
+			const row = await readAttempt(db, existing.attempt_id);
+			if (!row || row.status === "completed" || row.status === "failed" || row.status === "unknown") {
+				await releaseAttemptLock(db, existing.attempt_id).catch(() => {});
+				continue;
+			}
+		}
+		return {
+			ok: false,
+			protocolVersion: 2,
+			attemptId,
+			migrations: [],
+			error: `migration already in progress for attempt ${existing?.attempt_id ?? "unknown"}`
+		};
+	}
+	return {
+		ok: false,
+		protocolVersion: 2,
+		attemptId,
+		migrations: [],
+		error: "migration lock could not be acquired"
+	};
+}
+async function executeMigrationPlan(db, migration, plan) {
+	const appliedAt = (/* @__PURE__ */ new Date()).toISOString();
+	if (plan.kind === "single-statement") {
+		await db.batch([db.prepare(migration.sql), db.prepare("INSERT INTO _void_migrations (name, applied_at) VALUES (?, ?)").bind(migration.name, appliedAt)]);
+		return;
+	}
+	if (plan.kind === "breakpoint-framed") {
+		await db.batch([...plan.statements.map((statement) => db.prepare(statement)), db.prepare("INSERT INTO _void_migrations (name, applied_at) VALUES (?, ?)").bind(migration.name, appliedAt)]);
+		return;
+	}
+	await db.exec(migration.sql);
+	await db.prepare("INSERT OR IGNORE INTO _void_migrations (name, applied_at) VALUES (?, ?)").bind(migration.name, appliedAt).run();
+}
+async function markAttempt(db, attemptId, status, error) {
+	await db.prepare(`UPDATE _void_migration_attempts
+       SET status = ?, completed_at = ?, error = ?
+       WHERE attempt_id = ?`).bind(status, (/* @__PURE__ */ new Date()).toISOString(), error ?? null, attemptId).run();
+}
+async function releaseAttemptLock(db, attemptId) {
+	await db.prepare("DELETE FROM _void_migration_lock WHERE name = ? AND attempt_id = ?").bind("app", attemptId).run();
+}
+async function readAttempt(db, attemptId) {
+	return db.prepare("SELECT * FROM _void_migration_attempts WHERE attempt_id = ?").bind(attemptId).first();
+}
+async function reconcileAttempt(db, attemptId) {
+	await createAttemptTables(db);
+	await createTrackingTable(db);
+	const row = await readAttempt(db, attemptId);
+	if (!row) {
+		await releaseAttemptLock(db, attemptId).catch(() => {});
+		return {
+			ok: false,
+			protocolVersion: 2,
+			attemptId,
+			migrations: [],
+			error: "migration attempt not found"
+		};
+	}
+	const plannedNames = JSON.parse(row.planned_names_json);
+	const applied = await readAppliedSet(db);
+	const confirmed = plannedNames.filter((name) => applied.has(name));
+	const complete = confirmed.length === plannedNames.length;
+	if (complete && row.status !== "completed") await markAttempt(db, attemptId, "completed").catch(() => {});
+	if (!complete && row.status === "running") await markAttempt(db, attemptId, "unknown", row.error ?? "migration outcome unknown").catch(() => {});
+	await releaseAttemptLock(db, attemptId).catch(() => {});
+	return {
+		ok: complete,
+		protocolVersion: 2,
+		attemptId,
+		confirmedApplied: [],
+		confirmedSkipped: confirmed,
+		migrations: plannedNames.map((name) => ({
+			applied: false,
+			durationMs: 0,
+			name,
+			status: applied.has(name) ? "skipped" : "failed"
+		})),
+		error: complete ? void 0 : row.error ?? "migration outcome unknown",
+		stability: "stable"
+	};
+}
+async function verifyPlanBundle(migrations, planBundle) {
+	if (!planBundle || planBundle.protocolVersion !== 2) throw new Error("migration protocol v2 execution plans are missing");
+	if (planBundle.classifierVersion !== SUPPORTED_CLASSIFIER_VERSION || planBundle.destructiveValidation !== "passed") throw new Error("unsupported migration execution plan metadata");
+	if (planBundle.plans.length !== migrations.length) throw new Error("migration execution plan count does not match bundled migrations");
+	for (let index = 0; index < migrations.length; index++) {
+		const migration = migrations[index];
+		const plan = planBundle.plans[index];
+		if (plan.name !== migration.name || plan.dialect !== "sqlite" || plan.classifierVersion !== SUPPORTED_CLASSIFIER_VERSION) throw new Error(`invalid migration execution plan for ${migration.name}`);
+		const sqlHash = await sha256Hex(canonicalSql(migration.sql));
+		if (plan.sqlHash !== sqlHash) throw new Error(`migration SQL hash mismatch for ${migration.name}`);
+		const planHash = await hashPlan(plan);
+		if (plan.planHash !== planHash) throw new Error(`migration plan hash mismatch for ${migration.name}`);
+	}
+	const migrationListHash = await sha256Hex(canonicalJson(planBundle.plans.map((plan) => [
+		plan.name,
+		plan.sqlHash,
+		plan.planHash
+	])));
+	if (planBundle.migrationListHash !== migrationListHash) throw new Error("migration list hash mismatch");
+	return planBundle;
+}
+function canonicalSql(sql) {
+	return (sql.charCodeAt(0) === 65279 ? sql.slice(1) : sql).replace(/\r\n?/g, "\n");
+}
+async function sha256Hex(value) {
+	const bytes = new TextEncoder().encode(value);
+	const hash = await crypto.subtle.digest("SHA-256", bytes);
+	return `sha256:${[...new Uint8Array(hash)].map((byte) => byte.toString(16).padStart(2, "0")).join("")}`;
+}
+async function hashPlan(plan) {
+	const hashInput = {
+		classifierVersion: plan.classifierVersion,
+		dialect: plan.dialect,
+		kind: plan.kind,
+		name: plan.name,
+		sqlHash: plan.sqlHash,
+		stability: plan.stability
+	};
+	if (plan.kind === "breakpoint-framed") hashInput.statements = plan.statements;
+	return sha256Hex(canonicalJson(hashInput));
+}
+async function runD1LegacyMigrations(db, migrations) {
+	await createTrackingTable(db);
+	await upgradeTrackingTable(db);
+	const applied = await readAppliedSet(db);
 	const migrationResults = [];
-	for (const m of migrations) {
-		if (applied.has(m.name)) {
+	for (const migration of migrations) {
+		if (applied.has(migration.name)) {
 			migrationResults.push({
-				name: m.name,
+				name: migration.name,
 				applied: false,
 				durationMs: 0
 			});
@@ -62,19 +371,19 @@ async function runD1Migrations(db, migrations) {
 		}
 		const start = Date.now();
 		try {
-			const statements = splitMigrationSql(m.sql);
+			const statements = splitMigrationSql(migration.sql);
 			if (statements.length === 1) if (isSingleSqlStatement(statements[0])) await db.prepare(statements[0]).run();
-			else await db.exec(m.sql);
+			else await db.exec(migration.sql);
 			else for (const statement of statements) await db.prepare(statement).run();
-			await db.prepare("INSERT OR IGNORE INTO _void_migrations (name, applied_at) VALUES (?, ?)").bind(m.name, (/* @__PURE__ */ new Date()).toISOString()).run();
+			await db.prepare("INSERT OR IGNORE INTO _void_migrations (name, applied_at) VALUES (?, ?)").bind(migration.name, (/* @__PURE__ */ new Date()).toISOString()).run();
 			migrationResults.push({
-				name: m.name,
+				name: migration.name,
 				applied: true,
 				durationMs: Date.now() - start
 			});
 		} catch (err) {
 			migrationResults.push({
-				name: m.name,
+				name: migration.name,
 				applied: false,
 				durationMs: Date.now() - start,
 				error: err instanceof Error ? err.message : String(err)
@@ -82,7 +391,7 @@ async function runD1Migrations(db, migrations) {
 			return {
 				ok: false,
 				migrations: migrationResults,
-				error: `migration ${m.name} failed`
+				error: `migration ${migration.name} failed`
 			};
 		}
 	}
@@ -176,7 +485,6 @@ function isSingleSqlStatement(sql) {
 		if (character === ";") {
 			if (inStatement) {
 				statements++;
-				if (statements > 1) return false;
 				inStatement = false;
 			}
 			index++;

package/dist/runtime/remote/index.mjs

@@ -1,4 +1,4 @@
-import { t as cfAccessHeaders } from "../../cf-access-BW8K93Fm.mjs";
+import { t as cfAccessHeaders } from "../../cf-access-DKDsgwOU.mjs";
 //#region src/runtime/remote/client.ts
 /**
 * HTTP client for the remote bindings proxy (proxy.void.cloud).

package/dist/runtime/sandbox.d.mts

@@ -4,14 +4,84 @@ import { Sandbox, SandboxOptions } from "@cloudflare/sandbox";
 //#region src/runtime/sandbox.d.ts
 declare const DEFAULT_SANDBOX_ID = "default";
 declare const DEFAULT_SANDBOX_BINDING = "SANDBOX";
-type VoidSandbox = Sandbox;
+declare const SANDBOX_USAGE_QUEUE_BINDING = "USAGE_EVENTS_QUEUE";
+declare const SANDBOX_GATE_BINDING = "__VOID_PROXY";
+declare const HEARTBEAT_MS: number;
 type VoidSandboxOptions = SandboxOptions & {
   binding?: string;
 };
+type SandboxUsageEvent = Readonly<{
+  requests: 0;
+  responseBytes: 0;
+  userId?: string;
+  projectId?: string;
+  slug?: string;
+  sandboxRuntimeSeconds: number;
+  sandboxInstanceId: string;
+}>;
+/**
+* Thrown by `getSandbox()` when the platform gate denies a new acquire because
+* the user has hit a concurrency or runtime budget cap. Surface this to the
+* caller so they can render a friendly error; do not retry transparently.
+*/
+declare class SandboxLimitError extends Error {
+  override readonly name = "SandboxLimitError";
+  readonly reason: "concurrency" | "runtime_budget";
+  constructor(reason: "concurrency" | "runtime_budget", message?: string);
+}
 declare function __setSandboxBindingName(bindingName: string): void;
-declare function getSandbox<T extends Sandbox = Sandbox>(id?: string, options?: VoidSandboxOptions): T;
+/**
+* Sandbox variant that participates in Void platform metering: it records
+* container runtime seconds into DO storage, emits periodic heartbeats to
+* the usage queue, and notifies the gate when the container stops.
+*
+* Generated code from `void inference` wires user `Sandbox` subclasses to
+* extend this class on platform deploys so per-tenant accounting works
+* without user opt-in. On local dev (no usage-queue / gate bindings), all
+* overrides degrade to no-ops and the sandbox behaves like the upstream
+* `Sandbox` class.
+*/
+declare class VoidPlatformSandbox<Env = unknown> extends Sandbox<Env> {
+  override onStart(): Promise<void>;
+  override alarm(alarmProps?: {
+    isRetry: boolean;
+    retryCount: number;
+  }): Promise<void>;
+  override onStop(): Promise<void>;
+  override onActivityExpired(): Promise<void>;
+  private flushFinal;
+}
+/**
+* Resolve the platform-provided sandbox stub for the given id, optionally
+* coordinating with the platform gate to enforce per-user concurrency and
+* runtime budgets.
+*
+* When the gate binding (`__VOID_PROXY` by default) is present AND the
+* platform's `__PROJECT_ID` + `__VOID_PROXY_TOKEN` identity vars are
+* available, we POST to `https://gate/sandbox/acquire` with the HMAC-signed
+* body the shared proxy auth middleware expects. A `409` response means the
+* user has exceeded a budget — we throw `SandboxLimitError` so the caller
+* can render a clear message. Any other non-OK status (or a thrown transport
+* error from the service binding) is treated as "gate unavailable" and we
+* fall through to returning the stub so a broken gate doesn't break sandbox
+* access entirely.
+*
+* When the gate binding is absent (local dev) or the identity vars are
+* missing (partial deploy), the gate check is skipped entirely and we
+* return the stub directly.
+*
+* The stub is constructed BEFORE calling the gate so we can derive the
+* normalized DO name (`stub.id.name`) and pass it to the gate as the
+* `sandboxId`. This keeps acquire and release using the same key — without
+* it, mixed-case caller ids (e.g. `MyProject-123`) would acquire a lease
+* under the raw id but release it under the normalized lowercase form that
+* `ctx.id.name` reports inside the DO, leaking the lease until TTL.
+* Constructing the stub does NOT start a container — that only happens on
+* the first method call against the stub.
+*/
+declare function getSandbox<T extends Sandbox = Sandbox>(id?: string, options?: VoidSandboxOptions): Promise<T>;
 declare const sandbox: {
   get: typeof getSandbox;
 };
 //#endregion
-export { DEFAULT_SANDBOX_BINDING, DEFAULT_SANDBOX_ID, Sandbox, type SandboxOptions, VoidSandbox, VoidSandboxOptions, __setSandboxBindingName, getSandbox, sandbox };
+export { DEFAULT_SANDBOX_BINDING, DEFAULT_SANDBOX_ID, HEARTBEAT_MS, SANDBOX_GATE_BINDING, SANDBOX_USAGE_QUEUE_BINDING, Sandbox, SandboxLimitError, type SandboxOptions, SandboxUsageEvent, VoidPlatformSandbox, VoidSandboxOptions, __setSandboxBindingName, getSandbox, sandbox };