@fabrika/app 0.8.2 → 0.9.0-cloudflare.2

package/src/implement/workload.ts

@@ -16,6 +16,7 @@ import {
 } from '@fabrika/auth-core'
 import type { TokenVerifier } from '@fabrika/jwks'
 import { z } from 'zod/v4'
+import { deadline } from './bounded'
 
 export type WorkloadKindOf = OwnWorkloadKind
 
@@ -39,20 +40,30 @@ export function issuerWorkloadTokens(
 ): WorkloadTokenSource {
 	return {
 		async exchange(input) {
-			const response = await fetcher(
-				new Request(new URL(WORKLOAD_TOKEN_PATH, issuer), {
-					method: 'POST',
-					headers: { authorization: `Bearer ${input.key}`, 'content-type': 'application/json' },
-					body: JSON.stringify({ app: input.app }),
-					redirect: 'manual',
-					signal: AbortSignal.timeout(EXCHANGE_TIMEOUT_MS),
-				}),
-			)
-			const parsed = response.status === 200 ? mintResultSchema.safeParse(await response.json()) : null
-			if (parsed === null || !parsed.success) {
-				throw new Error(`IAM answered the workload token exchange with ${response.status}`)
+			const timer = deadline(EXCHANGE_TIMEOUT_MS)
+			try {
+				const response = await fetcher(
+					new Request(new URL(WORKLOAD_TOKEN_PATH, issuer), {
+						method: 'POST',
+						headers: { authorization: `Bearer ${input.key}`, 'content-type': 'application/json' },
+						body: JSON.stringify({ app: input.app }),
+						redirect: 'manual',
+						signal: timer.signal,
+					}),
+				)
+				if (response.status !== 200) {
+					// Nothing reads a refusal's body, and once the deadline is cleared nothing else would end its stream.
+					await response.body?.cancel().catch(() => {})
+					throw new Error(`IAM answered the workload token exchange with ${response.status}`)
+				}
+				const parsed = mintResultSchema.safeParse(await response.json())
+				if (!parsed.success) {
+					throw new Error(`IAM answered the workload token exchange with ${response.status}`)
+				}
+				return parsed.data
+			} finally {
+				timer.clear()
 			}
-			return parsed.data
 		},
 	}
 }

package/src/jobs/report.ts

@@ -3,6 +3,7 @@
 // groups a framework report by its fingerprint and raises its new-issue and regression alerts, so each kind of
 // failure becomes one issue. What was thrown travels scrubbed as the report's cause chain (ADR-0059).
 
+import { deadline } from '../implement/bounded'
 import { exceptionChain, type ReportedException } from './exception'
 import type { Scrubber } from './scrub'
 
@@ -136,6 +137,7 @@ export function crashEnvelope(kind: CrashKind, error: unknown, options: Envelope
 
 async function deliver(options: OperationsReporterOptions, body: string): Promise<void> {
 	const send = options.fetch ?? ((request: Request) => fetch(request))
+	const timer = deadline(DELIVERY_TIMEOUT_MS)
 	const request = new Request(options.target.envelopeUrl, {
 		method: 'POST',
 		headers: {
@@ -143,7 +145,7 @@ async function deliver(options: OperationsReporterOptions, body: string): Promis
 			'x-sentry-auth': `Sentry sentry_version=7, sentry_key=${options.target.publicKey}`,
 		},
 		body,
-		signal: AbortSignal.timeout(DELIVERY_TIMEOUT_MS),
+		signal: timer.signal,
 	})
 	try {
 		const response = await send(request)
@@ -154,6 +156,8 @@ async function deliver(options: OperationsReporterOptions, body: string): Promis
 	} catch {
 		// The error may quote the ingest URL with its key.
 		console.error('fabrika: a report to Operations could not be delivered')
+	} finally {
+		timer.clear()
 	}
 }
 

package/src/jobs/runner.ts

@@ -10,6 +10,7 @@ import { type ContractArtifact, JOB_SITE_PREFIX, type JobArtifact, type JobMaile
 import type { CapabilityAuthority } from '@fabrika/db/capability'
 import { type DataAccess, type FrameworkTables, type JobLeases, type LeaseFence, LeaseLostError, type Session } from '@fabrika/db/framework'
 import { EmailDeliveryError, type EmailSenderCapabilities, mayRetryDelivery } from '@fabrika/email'
+import { uuidv7 } from '@fabrika/platform'
 import { NotFoundError } from '../errors'
 import { FileWork, type StoredFileKinds, storedFilesHandle } from '../files/kinds'
 import {
@@ -21,7 +22,7 @@ import {
 	runInRequest,
 	type Within,
 } from '../implement/capability'
-import { runAsSite } from '../implement/egress'
+import { type PublicEgressRules, runAsSite, siteEgress } from '../implement/egress'
 import { failureCode, type FailureReason, failureReason } from '../implement/failures'
 import { ServerFault } from '../implement/faults'
 import type { ContractDatabase } from '../implement/implement'
@@ -117,6 +118,8 @@ export interface FrameworkJob {
 export interface ContractJobs {
 	/** The contract's `c.cron` jobs; `run` also takes the name of a framework job the contract needs. */
 	readonly names: readonly string[]
+	/** Every job bound to run, the framework's included, with its schedule: what a minute tick runs when due. */
+	readonly scheduled: readonly { readonly name: string; readonly schedule: CronSchedule }[]
 	run(name: string, options?: JobRunOptions): Promise<JobRunResult>
 	/**
 	 * Registers every job (its first-seen time), reports a run that crashed and a job that has not succeeded within
@@ -185,6 +188,8 @@ interface RunnerContext {
 	/** The environment's signed tokens: `ctx.tokens` of a job that declares `signs`. */
 	readonly tokens: SignedTokens | null
 	readonly url: AppUrl
+	/** What a job that declares `egress: 'public'` reaches; such a job reaches nothing without it. */
+	readonly publicEgress: PublicEgressRules | null
 }
 
 /** Where `fabrika app dev` shows what a handler threw, on the developer's own machine; nothing else sets one. */
@@ -224,6 +229,8 @@ export interface JobBindingInput {
 	readonly tokens?: SignedTokens
 	/** `ctx.url`: absolute links to the application's own procedures; without it every link is refused. */
 	readonly url?: AppUrl
+	/** The rules of public egress, which `boot` reads from the environment; without them a public job reaches nothing. */
+	readonly publicEgress?: PublicEgressRules
 }
 
 interface BoundFrameworkJob {
@@ -323,11 +330,13 @@ export function bindJobs(input: JobBindingInput, problems: string[]): BoundJobs
 		mail: input.mail,
 		tokens: input.tokens ?? null,
 		url: input.url ?? appUrl(input.artifact, null),
+		publicEgress: input.publicEgress ?? null,
 		// A job's kicks run only after the job is bound, so `kick` below is defined by then.
 		kick: (name: string) => kick(name),
 	})
 	const jobs: ContractJobs = Object.freeze({
 		names,
+		scheduled: Object.freeze([...bound.values(), ...frameworkJobs.values()].map(({ name, schedule }) => ({ name, schedule }))),
 		run(name: string, options: JobRunOptions = {}): Promise<JobRunResult> {
 			const own = frameworkJobs.get(name)
 			if (own !== undefined && framework !== null) {
@@ -432,7 +441,7 @@ function jobLinks(where: string, site: string, declaration: SiteDeclaration | nu
 	return { name, prefix: mount.prefix, dimension: mount.dimension, issuedBy: mount.issuedBy }
 }
 
-const attemptId = (): string => Bun.randomUUIDv7()
+const attemptId = (): string => uuidv7()
 
 /** Exponential from one second, capped at five minutes, with half of it jittered. */
 function backoffMs(attempt: number, random: number): number {
@@ -694,7 +703,7 @@ async function attemptOnce(
 			if (site === null) {
 				await job.handler({ ctx })
 			} else {
-				await runAsSite(`job '${job.name}'`, site.egress, async () => await job.handler({ ctx }))
+				await runAsSite(`job '${job.name}'`, siteEgress(site.egress, context.publicEgress), async () => await job.handler({ ctx }))
 			}
 			kicked.push(...kicks.kicked())
 		}).then(() => null, (error: unknown) => {
@@ -898,25 +907,37 @@ function kitJobContext(
 		db: siteData(reads, (action) => reads.app(app(action))),
 		sql: site.sql === null ? undeclaredSql(job, 'job') : jobSqlOutsideTransaction(job),
 		files: putAndOpen(boundTo(frame, () => false, 'ctx.files')),
-		transaction: async <R>(work: (tx: object) => Promise<R>): Promise<R> => {
+		transaction: async <R>(body: (tx: object) => Promise<R>): Promise<R> => {
 			// Outside its attempt there is no lease to fence the transaction with, so it never opens.
 			boundTo(frame, () => false)()
-			return data.transaction(async (session) => {
-				let open = true
-				const writes = jobHandles(frame, data, site, principal, 'mutation', async () => session, () => !open, undefined, binding)
-				try {
-					const sql = site.sql === null ? undeclaredSql(job, 'job', 'tx.sql') : jobSql(frame, data, site.sql, session, () => !open)
-					// Located in this transaction, so an object it wrote is found before the commit.
-					const located = (action: string, dimension: string, id: string) => {
-						boundTo(frame, () => !open, 'tx.ref')()
-						return ref(action, dimension, id, session)
+			// Its own files: a rollback releases only what this transaction staged, never a file of a concurrent one.
+			const own = new FileWork(frame, frame.id)
+			let rolledBack = false
+			try {
+				return await data.transaction(async (session) => {
+					let open = true
+					const writes = jobHandles(frame, data, site, principal, 'mutation', async () => session, () => !open, undefined, binding)
+					try {
+						const sql = site.sql === null ? undeclaredSql(job, 'job', 'tx.sql') : jobSql(frame, data, site.sql, session, () => !open)
+						// Located in this transaction, so an object it wrote is found before the commit.
+						const located = (action: string, dimension: string, id: string) => {
+							boundTo(frame, () => !open, 'tx.ref')()
+							return ref(action, dimension, id, session)
+						}
+						const files = storedFilesHandle(kinds, own, { where: job, check: boundTo(frame, () => !open, 'tx.files'), writes: true })
+						return await body(Object.freeze({ db: siteData(writes, (action) => writes.app(app(action))), sql, files, ref: located }))
+					} catch (error) {
+						rolledBack = true
+						throw error
+					} finally {
+						open = false
 					}
-					const files = putAndOpen(boundTo(frame, () => !open, 'tx.files'))
-					return await work(Object.freeze({ db: siteData(writes, (action) => writes.app(app(action))), sql, files, ref: located }))
-				} finally {
-					open = false
-				}
-			})
+				})
+			} catch (error) {
+				// A transaction the work threw out of is a known rollback; a failed commit is not, and the sweep decides.
+				if (rolledBack) await kinds?.release(own)
+				throw error
+			}
 		},
 	}
 }

package/src/jobs/schedule.ts

@@ -1,5 +1,6 @@
 // The five-field cron expressions of `c.cron`, read in UTC: which minutes a job is due, so the runner can tell how
-// long ago it should last have succeeded. The crontab, not this module, triggers a run.
+// long ago it should last have succeeded. On Bun the crontab triggers a run; on Cloudflare the application's object
+// runs, at each minute tick, the jobs `isDueAt` that minute.
 
 interface Field {
 	readonly min: number
@@ -96,6 +97,11 @@ function dayMatches(schedule: CronSchedule, day: Date): boolean {
 	return schedule.eitherDay ? byMonth || byWeek : byMonth && byWeek
 }
 
+/** Whether the schedule is due in the UTC minute that holds `at`: what a Worker's minute tick runs (ADR-0065). */
+export function isDueAt(schedule: CronSchedule, at: Date): boolean {
+	return schedule.minutes.has(at.getUTCMinutes()) && schedule.hours.has(at.getUTCHours()) && dayMatches(schedule, at)
+}
+
 const descending = (values: ReadonlySet<number>): number[] => [...values].sort((left, right) => right - left)
 
 /** The latest `count` due minutes at or before `at`, newest first; fewer when the schedule is that rare. */

package/src/jobs/scrub.ts

@@ -1,7 +1,16 @@
 // What an error report must not carry (ADR-0059): the values of the application's secrets, and anything shaped like a
 // credential — a JWT, an `Authorization` scheme or header, a URL's userinfo, a sensitive query parameter.
 
-import { FABRIKA_CONTRACT_DIGEST, FABRIKA_IAM_APP_ID, FABRIKA_IAM_ISSUER, PLATFORM_RECEIVERS, platformTransportVariables } from '@fabrika/auth-core'
+import {
+	FABRIKA_APPLICATION_OBJECT,
+	FABRIKA_APPLICATION_OBJECTS,
+	FABRIKA_CONTRACT_DIGEST,
+	FABRIKA_IAM_APP_ID,
+	FABRIKA_IAM_ISSUER,
+	FABRIKA_OPS_KEY_DIGESTS,
+	PLATFORM_RECEIVERS,
+	platformTransportVariables,
+} from '@fabrika/auth-core'
 import type { CapturedEnvironment } from '../implement/environment'
 
 export const REDACTED = '[redacted]'
@@ -21,6 +30,10 @@ const PUBLIC_FRAMEWORK_VARIABLES: ReadonlySet<string> = new Set([
 	FABRIKA_CONTRACT_DIGEST,
 	FABRIKA_IAM_APP_ID,
 	FABRIKA_IAM_ISSUER,
+	// Digests of the ops keys, which are no credential; the object names are words (`application`) a message carries.
+	FABRIKA_OPS_KEY_DIGESTS,
+	FABRIKA_APPLICATION_OBJECT,
+	FABRIKA_APPLICATION_OBJECTS,
 	...PLATFORM_RECEIVERS.map((receiver) => platformTransportVariables(receiver).url),
 ])
 

package/src/spa-fallback.ts

@@ -0,0 +1,12 @@
+// Which request an SPA mount answers with its `index.html` when it names no file: a route of the page, not a missing
+// asset. Both asset servers apply it (`diskAssets`, `bindingAssets`), so a missing script stays a 404 and never arrives
+// as an HTML page with a 200.
+
+import { rawRequestTarget } from '@fabrika/auth-core'
+
+/** A GET or HEAD whose last path segment has no extension, or one that asks for HTML (a navigation to `/notes/v1.2`). */
+export function isPageRoute(request: Request): boolean {
+	if (request.method !== 'GET' && request.method !== 'HEAD') return false
+	const last = rawRequestTarget(request.url).pathname.split('/').pop() ?? ''
+	return !last.includes('.') || (request.headers.get('Accept') ?? '').includes('text/html')
+}