@feltdb/core 0.7.3 → 0.8.0

package/dist/create/server-source/crates/feltdb-server/src/managed_diagnostics.rs

@@ -122,10 +122,7 @@ pub struct DiagnosticsCollector {
 
 impl DiagnosticsCollector {
     /// Creates a new diagnostics collector.
-    pub fn new(
-        server_commit: String,
-        environment: Environment,
-    ) -> Self {
+    pub fn new(server_commit: String, environment: Environment) -> Self {
         Self {
             engine_version: ENGINE_VERSION.to_string(),
             server_commit,
@@ -137,10 +134,7 @@ impl DiagnosticsCollector {
     }
 
     /// Generates a diagnostics report.
-    pub fn collect_report(
-        &self,
-        recovery_status: RecoveryStatus,
-    ) -> DiagnosticsReport {
+    pub fn collect_report(&self, recovery_status: RecoveryStatus) -> DiagnosticsReport {
         let uptime = now() - self.start_time;
         let overall_status = if recovery_status.status.is_healthy() {
             HealthStatus::Healthy
@@ -289,10 +283,7 @@ mod tests {
 
     #[test]
     fn create_diagnostics_collector() {
-        let collector = DiagnosticsCollector::new(
-            "abc123def456".to_string(),
-            Environment::Prod,
-        );
+        let collector = DiagnosticsCollector::new("abc123def456".to_string(), Environment::Prod);
 
         assert_eq!(collector.engine_version, ENGINE_VERSION);
         assert_eq!(collector.protocol_version, PROTOCOL_VERSION);
@@ -302,10 +293,7 @@ mod tests {
 
     #[test]
     fn collect_report_includes_uptime() {
-        let collector = DiagnosticsCollector::new(
-            "abc123def456".to_string(),
-            Environment::Staging,
-        );
+        let collector = DiagnosticsCollector::new("abc123def456".to_string(), Environment::Staging);
 
         let recovery_status = RecoveryStatus::default();
         let report = collector.collect_report(recovery_status);
@@ -327,7 +315,9 @@ mod tests {
         assert_eq!(recovery.durable_operations, HealthStatus::Degraded);
         assert_eq!(recovery.status, HealthStatus::Degraded);
         assert_eq!(recovery.pending_recovery_count, 5);
-        assert!(recovery.issues.contains(&"durable operations slow".to_string()));
+        assert!(recovery
+            .issues
+            .contains(&"durable operations slow".to_string()));
     }
 
     #[test]
@@ -341,11 +331,7 @@ mod tests {
 
     #[test]
     fn environment_serialization() {
-        let envs = vec![
-            Environment::Dev,
-            Environment::Staging,
-            Environment::Prod,
-        ];
+        let envs = vec![Environment::Dev, Environment::Staging, Environment::Prod];
 
         for env in envs {
             let json = serde_json::to_string(&env).expect("serialize failed");
@@ -357,10 +343,7 @@ mod tests {
 
     #[test]
     fn diagnostics_report_serialization() {
-        let collector = DiagnosticsCollector::new(
-            "abc123def456".to_string(),
-            Environment::Prod,
-        );
+        let collector = DiagnosticsCollector::new("abc123def456".to_string(), Environment::Prod);
 
         let recovery_status = RecoveryStatusBuilder::new()
             .with_pending_recovery_count(3)
@@ -378,10 +361,7 @@ mod tests {
 
     #[test]
     fn add_subsystem_metrics() {
-        let collector = DiagnosticsCollector::new(
-            "abc123def456".to_string(),
-            Environment::Dev,
-        );
+        let collector = DiagnosticsCollector::new("abc123def456".to_string(), Environment::Dev);
 
         let mut report = collector.collect_report(RecoveryStatus::default());
         let mut details = HashMap::new();

package/dist/create/server-source/crates/feltdb-server/src/membership_policy.rs

@@ -153,7 +153,9 @@ impl MembershipVerifier {
     ) -> MembershipDecision {
         let policy = match self.store.get(policy_name) {
             Some(p) => p,
-            None => return MembershipDecision::Denied(format!("policy not found: {}", policy_name)),
+            None => {
+                return MembershipDecision::Denied(format!("policy not found: {}", policy_name))
+            }
         };
 
         // Verify actor field
@@ -203,7 +205,10 @@ impl MembershipVerifier {
                     ));
                 }
             } else {
-                return MembershipDecision::Denied(format!("required role not found: {}", required));
+                return MembershipDecision::Denied(format!(
+                    "required role not found: {}",
+                    required
+                ));
             }
         }
 
@@ -221,7 +226,9 @@ impl MembershipVerifier {
         // Find matching membership record
         let policy = match self.store.get(policy_name) {
             Some(p) => p,
-            None => return MembershipDecision::Denied(format!("policy not found: {}", policy_name)),
+            None => {
+                return MembershipDecision::Denied(format!("policy not found: {}", policy_name))
+            }
         };
 
         for record in records {
@@ -260,7 +267,8 @@ impl MembershipVerifier {
             let record_actor = self.extract_string(&policy.actor_field, record);
             let record_tenant = self.extract_string(&policy.tenant_field, record);
 
-            if record_actor.as_deref() == Some(actor_id) && record_tenant.as_deref() == Some(tenant_id)
+            if record_actor.as_deref() == Some(actor_id)
+                && record_tenant.as_deref() == Some(tenant_id)
             {
                 // Check status
                 if let Some(status_field) = &policy.status_field {

package/dist/create/server-source/crates/feltdb-server/src/request_telemetry.rs

@@ -1,6 +1,6 @@
+use serde::{Deserialize, Serialize};
 use std::sync::{Arc, Mutex};
 use std::time::{Duration, Instant, SystemTime};
-use serde::{Deserialize, Serialize};
 use uuid::Uuid;
 
 /// Request lifecycle telemetry: captures all timing and context for every /v1/ request.
@@ -101,10 +101,7 @@ impl RequestTelemetryStore {
     }
 
     pub fn all(&self) -> Vec<RequestTelemetry> {
-        self.records
-            .lock()
-            .map(|r| r.clone())
-            .unwrap_or_default()
+        self.records.lock().map(|r| r.clone()).unwrap_or_default()
     }
 
     pub fn recent(&self, count: usize) -> Vec<RequestTelemetry> {
@@ -120,7 +117,12 @@ impl RequestTelemetryStore {
     pub fn by_transaction_id(&self, tx_id: &str) -> Vec<RequestTelemetry> {
         self.records
             .lock()
-            .map(|r| r.iter().filter(|t| t.transaction_id.as_deref() == Some(tx_id)).cloned().collect())
+            .map(|r| {
+                r.iter()
+                    .filter(|t| t.transaction_id.as_deref() == Some(tx_id))
+                    .cloned()
+                    .collect()
+            })
             .unwrap_or_default()
     }
 

package/dist/create/server-source/crates/feltdb-server/src/snapshot_cursor.rs

@@ -62,8 +62,7 @@ impl CursorCodec {
         let bytes = base64::engine::general_purpose::STANDARD
             .decode(encoded)
             .map_err(|e| format!("invalid cursor encoding: {e}"))?;
-        let json = String::from_utf8(bytes)
-            .map_err(|e| format!("cursor not valid UTF-8: {e}"))?;
+        let json = String::from_utf8(bytes).map_err(|e| format!("cursor not valid UTF-8: {e}"))?;
         serde_json::from_str(&json).map_err(|e| format!("invalid cursor JSON: {e}"))
     }
 }
@@ -100,10 +99,7 @@ impl SnapshotCursorManager {
         };
 
         let checksum = self.compute_checksum(&cursor)?;
-        let cursor_with_checksum = SnapshotCursor {
-            checksum,
-            ..cursor
-        };
+        let cursor_with_checksum = SnapshotCursor { checksum, ..cursor };
 
         CursorCodec::encode(&cursor_with_checksum)
     }
@@ -144,9 +140,7 @@ impl SnapshotCursorManager {
 
         // Verify authorization context hasn't changed
         if cursor.auth_context_hash != current_auth_context_hash {
-            return Err(
-                "authorization context changed since cursor creation".into(),
-            );
+            return Err("authorization context changed since cursor creation".into());
         }
 
         // Verify checksum
@@ -166,7 +160,11 @@ impl SnapshotCursorManager {
     }
 
     /// Computes hash of authorization context.
-    pub fn hash_auth_context(actor_id: &str, tenant_id: &str, required_role: Option<&str>) -> String {
+    pub fn hash_auth_context(
+        actor_id: &str,
+        tenant_id: &str,
+        required_role: Option<&str>,
+    ) -> String {
         let mut hasher = Sha256::new();
         hasher.update(actor_id.as_bytes());
         hasher.update(tenant_id.as_bytes());
@@ -289,10 +287,8 @@ mod tests {
     #[test]
     fn reject_cursor_when_auth_context_changes() {
         let manager = SnapshotCursorManager::new("release_jobs".into());
-        let auth_hash1 =
-            SnapshotCursorManager::hash_auth_context("user_123", "tenant_prod", None);
-        let auth_hash2 =
-            SnapshotCursorManager::hash_auth_context("user_123", "tenant_other", None);
+        let auth_hash1 = SnapshotCursorManager::hash_auth_context("user_123", "tenant_prod", None);
+        let auth_hash2 = SnapshotCursorManager::hash_auth_context("user_123", "tenant_other", None);
 
         let encoded = manager
             .create_cursor("snap_123".into(), 5, 0, auth_hash1)

package/dist/create/server-source/crates/feltdb-server/src/tenancy.rs

@@ -67,6 +67,16 @@ pub struct PlatformUser {
     pub status: MembershipStatus,
     pub created_at: u64,
 }
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ApplicationServicePrincipal {
+    pub service_id: String,
+    pub tenant_id: String,
+    pub application_id: String,
+    pub capabilities: Vec<String>,
+    pub status: MembershipStatus,
+    pub created_by: String,
+    pub created_at: u64,
+}
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
 #[serde(rename_all = "snake_case")]
 pub enum MembershipStatus {
@@ -104,6 +114,8 @@ struct PlatformRecords {
     applications: Vec<Application>,
     tenant_memberships: Vec<TenantMembership>,
     application_memberships: Vec<ApplicationMembership>,
+    #[serde(default)]
+    application_service_principals: Vec<ApplicationServicePrincipal>,
     invitations: Vec<Invitation>,
     audit: Vec<PlatformAuditEvent>,
 }
@@ -151,7 +163,16 @@ fn platform_owner_user(user_id: &str) -> bool {
         .split(',')
         .map(|owner| owner.trim().to_lowercase())
         .filter(|owner| !owner.is_empty())
-        .map(|owner| format!("user_{}", URL_SAFE_NO_PAD.encode(owner).chars().take(18).collect::<String>()))
+        .map(|owner| {
+            format!(
+                "user_{}",
+                URL_SAFE_NO_PAD
+                    .encode(owner)
+                    .chars()
+                    .take(18)
+                    .collect::<String>()
+            )
+        })
         .any(|owner_id| owner_id == user_id)
 }
 
@@ -241,6 +262,19 @@ pub fn application_role_grants() -> Vec<RoleGrant> {
                 "deployment:execute".into(),
             ],
         },
+        RoleGrant {
+            role: "actor".into(),
+            capabilities: vec![
+                "application:read".into(),
+                "application:revision:read".into(),
+                "state:read".into(),
+                "state:write".into(),
+                "events:read".into(),
+                "workflows:run".into(),
+                "agents:run".into(),
+                "capabilities:run".into(),
+            ],
+        },
         RoleGrant {
             role: "viewer".into(),
             capabilities: vec![
@@ -271,6 +305,90 @@ impl TenancyStore {
             records: Arc::new(RwLock::new(records)),
         })
     }
+    pub fn register_application_actor(
+        &self,
+        user_id: &str,
+        application_id: &str,
+    ) -> Result<(), String> {
+        let mut records = self
+            .records
+            .write()
+            .map_err(|_| "tenancy store lock poisoned")?;
+        if !records
+            .applications
+            .iter()
+            .any(|application| application.id == application_id && application.status == "active")
+        {
+            return Err("application not found".into());
+        }
+        if !records.application_memberships.iter().any(|membership| {
+            membership.application_id == application_id
+                && membership.user_id == user_id
+                && membership.status == MembershipStatus::Active
+        }) {
+            let timestamp = now();
+            records.application_memberships.push(ApplicationMembership {
+                application_id: application_id.into(),
+                user_id: user_id.into(),
+                role: "actor".into(),
+                status: MembershipStatus::Active,
+                created_at: timestamp,
+                updated_at: timestamp,
+            });
+            self.persist(&records)?;
+        }
+        Ok(())
+    }
+    pub fn register_application_service(
+        &self,
+        actor: &str,
+        service_id: &str,
+        application_id: &str,
+        capabilities: Vec<String>,
+    ) -> Result<(), String> {
+        let tenant_id = self
+            .application_tenant(application_id)
+            .ok_or_else(|| "application not found".to_string())?;
+        if !self.authorize_application(actor, &tenant_id, application_id, "members:write") {
+            return Err("forbidden".into());
+        }
+        if capabilities.is_empty() {
+            return Err("service capabilities are required".into());
+        }
+        let mut records = self
+            .records
+            .write()
+            .map_err(|_| "tenancy store lock poisoned")?;
+        if records
+            .application_service_principals
+            .iter()
+            .any(|principal| {
+                principal.service_id == service_id && principal.status == MembershipStatus::Active
+            })
+        {
+            return Err("service principal already exists".into());
+        }
+        records
+            .application_service_principals
+            .push(ApplicationServicePrincipal {
+                service_id: service_id.into(),
+                tenant_id: tenant_id.clone(),
+                application_id: application_id.into(),
+                capabilities,
+                status: MembershipStatus::Active,
+                created_by: actor.into(),
+                created_at: now(),
+            });
+        Self::audit(
+            &mut records,
+            "application.service.created",
+            actor,
+            &tenant_id,
+            Some(application_id),
+            service_id,
+        );
+        self.persist(&records)
+    }
     fn persist(&self, records: &PlatformRecords) -> Result<(), String> {
         if let Some(parent) = self.path.parent() {
             fs::create_dir_all(parent).map_err(|error| error.to_string())?;
@@ -325,13 +443,16 @@ impl TenancyStore {
     }
     pub fn platform_inventory(
         &self,
-    ) -> Result<(
-        Vec<PlatformUser>,
-        Vec<Tenant>,
-        Vec<Application>,
-        Vec<TenantMembership>,
-        Vec<ApplicationMembership>,
-    ), String> {
+    ) -> Result<
+        (
+            Vec<PlatformUser>,
+            Vec<Tenant>,
+            Vec<Application>,
+            Vec<TenantMembership>,
+            Vec<ApplicationMembership>,
+        ),
+        String,
+    > {
         let records = self
             .records
             .read()
@@ -382,7 +503,14 @@ impl TenancyStore {
             .ok_or("platform user not found")?;
         user.status = status;
         let updated = user.clone();
-        Self::audit(&mut records, "platform.user.updated", actor, "platform", None, user_id);
+        Self::audit(
+            &mut records,
+            "platform.user.updated",
+            actor,
+            "platform",
+            None,
+            user_id,
+        );
         self.persist(&records)?;
         Ok(updated)
     }
@@ -616,13 +744,18 @@ impl TenancyStore {
         records
             .application_memberships
             .retain(|membership| !application_ids.contains(&membership.application_id));
+        records
+            .application_service_principals
+            .retain(|principal| !application_ids.contains(&principal.application_id));
         records
             .tenant_memberships
             .retain(|membership| membership.tenant_id != tenant_id);
         records
             .invitations
             .retain(|invitation| invitation.tenant_id != tenant_id);
-        records.tenants.retain(|candidate| candidate.id != tenant_id);
+        records
+            .tenants
+            .retain(|candidate| candidate.id != tenant_id);
         self.persist(&records)?;
         Ok(tenant_id)
     }
@@ -708,6 +841,9 @@ impl TenancyStore {
         records
             .application_memberships
             .retain(|membership| membership.application_id != application_id);
+        records
+            .application_service_principals
+            .retain(|principal| principal.application_id != application_id);
         self.persist(&records)
     }
 
@@ -852,9 +988,6 @@ impl TenancyStore {
         application_id: &str,
         capability: &str,
     ) -> bool {
-        if !self.platform_user_active(user_id) {
-            return false;
-        }
         let records = match self.records.read() {
             Ok(records) => records,
             Err(_) => return false,
@@ -866,6 +999,30 @@ impl TenancyStore {
         {
             return false;
         }
+        if records
+            .application_service_principals
+            .iter()
+            .any(|principal| {
+                principal.service_id == user_id
+                    && principal.tenant_id == tenant_id
+                    && principal.application_id == application_id
+                    && principal.status == MembershipStatus::Active
+                    && principal
+                        .capabilities
+                        .iter()
+                        .any(|allowed| allowed == "*" || allowed == capability)
+            })
+        {
+            return true;
+        }
+        if records
+            .users
+            .iter()
+            .find(|user| user.user_id == user_id)
+            .is_some_and(|user| user.status != MembershipStatus::Active)
+        {
+            return false;
+        }
         if platform_owner_user(user_id) {
             return true;
         }
@@ -1143,4 +1300,29 @@ mod tests {
             "application:revision:promote"
         ));
     }
+
+    #[test]
+    fn application_service_is_bound_to_one_application_and_explicit_capabilities() {
+        let store = store("application-service");
+        let tenant = store.create_tenant("owner", "Acme").unwrap();
+        let app = store
+            .create_application("owner", &tenant.id, "Runtime")
+            .unwrap();
+        let other = store
+            .create_application("owner", &tenant.id, "Other")
+            .unwrap();
+
+        store
+            .register_application_service(
+                "owner",
+                "key_runtime",
+                &app.id,
+                vec!["application:read".into(), "state:read".into()],
+            )
+            .unwrap();
+
+        assert!(store.authorize_application("key_runtime", &tenant.id, &app.id, "state:read"));
+        assert!(!store.authorize_application("key_runtime", &tenant.id, &app.id, "state:write"));
+        assert!(!store.authorize_application("key_runtime", &tenant.id, &other.id, "state:read"));
+    }
 }

package/dist/create/server-source/crates/feltdb-server/src/tenant_policies.rs

@@ -159,10 +159,7 @@ impl PolicyEvaluator {
         };
 
         if !policy.operations.read {
-            return PolicyDecision::Denied(format!(
-                "read operation not allowed on {}",
-                resource
-            ));
+            return PolicyDecision::Denied(format!("read operation not allowed on {}", resource));
         }
 
         self.check_tenant_access(context, &policy, record)
@@ -181,10 +178,7 @@ impl PolicyEvaluator {
         };
 
         if !policy.operations.write {
-            return PolicyDecision::Denied(format!(
-                "write operation not allowed on {}",
-                resource
-            ));
+            return PolicyDecision::Denied(format!("write operation not allowed on {}", resource));
         }
 
         // Check that new record has correct tenant_id
@@ -206,20 +200,19 @@ impl PolicyEvaluator {
         };
 
         if !policy.operations.write {
-            return PolicyDecision::Denied(format!(
-                "write operation not allowed on {}",
-                resource
-            ));
+            return PolicyDecision::Denied(format!("write operation not allowed on {}", resource));
         }
 
         // Must authorize existing record
-        if let PolicyDecision::Denied(msg) = self.check_tenant_access(context, &policy, existing_record)
+        if let PolicyDecision::Denied(msg) =
+            self.check_tenant_access(context, &policy, existing_record)
         {
             return PolicyDecision::Denied(format!("cannot update: {}", msg));
         }
 
         // Must authorize new record state
-        if let PolicyDecision::Denied(msg) = self.check_tenant_access(context, &policy, new_record) {
+        if let PolicyDecision::Denied(msg) = self.check_tenant_access(context, &policy, new_record)
+        {
             return PolicyDecision::Denied(format!("update would result in: {}", msg));
         }
 
@@ -257,10 +250,7 @@ impl PolicyEvaluator {
         };
 
         if !policy.operations.delete {
-            return PolicyDecision::Denied(format!(
-                "delete operation not allowed on {}",
-                resource
-            ));
+            return PolicyDecision::Denied(format!("delete operation not allowed on {}", resource));
         }
 
         self.check_tenant_access(context, &policy, record)
@@ -297,9 +287,7 @@ impl PolicyEvaluator {
         let record_tenant = self.extract_tenant_id(policy, record);
 
         if record_tenant != Some(context.tenant_id.clone()) {
-            return PolicyDecision::Denied(format!(
-                "record belongs to different tenant"
-            ));
+            return PolicyDecision::Denied(format!("record belongs to different tenant"));
         }
 
         // Check owner field if policy specifies one

package/dist/create/server-source/crates/feltdb-server/src/transaction_idempotency.rs

@@ -1,7 +1,7 @@
-use std::collections::HashMap;
-use std::sync::{Arc, Mutex};
 use serde::{Deserialize, Serialize};
 use sha2::{Digest, Sha256};
+use std::collections::HashMap;
+use std::sync::{Arc, Mutex};
 
 /// Durable transaction idempotency: prevents re-execution of already-committed transactions.
 /// Every committed transaction is stored with its result. If the client retries with the
@@ -148,7 +148,9 @@ impl TransactionIdempotencyStore {
                 let total_entries = store.values().map(|v| v.len()).sum();
                 let replay_protected = store
                     .values()
-                    .filter(|entries| !entries.is_empty() && entries[0].status == TransactionStatus::Committed)
+                    .filter(|entries| {
+                        !entries.is_empty() && entries[0].status == TransactionStatus::Committed
+                    })
                     .count();
 
                 IdempotencyStatistics {

package/dist/create/server-source/crates/feltdb-server/src/transaction_recovery.rs

@@ -227,7 +227,8 @@ impl TransactionRecoveryStore {
             Some(r) => {
                 // Same payload = safe to retry
                 if r.payload_hash == payload_hash {
-                    Ok(r.status == TransactionStatus::Committed || r.status == TransactionStatus::Unknown)
+                    Ok(r.status == TransactionStatus::Committed
+                        || r.status == TransactionStatus::Unknown)
                 } else {
                     // Different payload = conflict
                     Ok(false)
@@ -323,7 +324,9 @@ mod tests {
             .record_committed("txn_123".into(), hash1, 42)
             .expect("record failed");
 
-        let is_safe = store.is_retry_safe("txn_123", &hash2).expect("check failed");
+        let is_safe = store
+            .is_retry_safe("txn_123", &hash2)
+            .expect("check failed");
         assert!(!is_safe);
     }
 
@@ -332,7 +335,9 @@ mod tests {
         let store = TransactionRecoveryStore::new();
         let hash = test_payload_hash();
 
-        let is_safe = store.is_retry_safe("txn_unknown", &hash).expect("check failed");
+        let is_safe = store
+            .is_retry_safe("txn_unknown", &hash)
+            .expect("check failed");
         assert!(is_safe);
     }
 
@@ -381,11 +386,7 @@ mod tests {
         let hash = test_payload_hash();
 
         store
-            .record_rejected(
-                "txn_123".into(),
-                hash,
-                "required field missing".into(),
-            )
+            .record_rejected("txn_123".into(), hash, "required field missing".into())
             .expect("record failed");
 
         let status = store.get_status("txn_123").expect("get failed");

package/dist/create/server-source/crates/feltdb-server/tests/revision_recovery_integration_test.rs

@@ -124,10 +124,7 @@ mod revision_recovery_tests {
         });
 
         // Both requests should have the same recovery_id
-        assert_eq!(
-            request1.get("recoveryId"),
-            request2.get("recoveryId")
-        );
+        assert_eq!(request1.get("recoveryId"), request2.get("recoveryId"));
     }
 
     /// Test environment parameter handling