@harperfast/harper 5.2.13 → 5.3.0-beta.1

package/server/serverHelpers/contentTypes.ts

@@ -10,6 +10,10 @@ import * as envMgr from '../../utility/environment/environmentManager.ts';
 import { CONFIG_PARAMS } from '../../utility/hdbTerms.ts';
 import * as YAML from 'yaml';
 import { logger } from '../../utility/logging/logger.ts';
+import {
+	errorToString as harperErrorToString,
+	errorForLog as harperErrorForLog,
+} from '../../utility/logging/harper_logger.ts';
 import { Blob } from '../../resources/blob.ts';
 // TODO: Only load this if fastify is loaded
 import fp from 'fastify-plugin';
@@ -17,6 +21,36 @@ import { parseMultipartRequest } from './multipartParser.ts';
 const SERIALIZATION_BIGINT = envMgr.get(CONFIG_PARAMS.SERIALIZATION_BIGINT) !== false;
 const JSONStringify = SERIALIZATION_BIGINT ? stringify : JSON.stringify;
 const JSONParse = SERIALIZATION_BIGINT ? parse : JSON.parse;
+const streamStartup = Symbol('streamStartup');
+const serializedStreamError = Symbol('serializedStreamError');
+
+type StreamStartup = {
+	result: Promise<{ failed?: true; error?: unknown }>;
+	abort: () => void;
+	start: () => void;
+	cancel?: () => void;
+};
+
+function streamErrorRecord(error: any) {
+	let name = 'Error';
+	let message;
+	try {
+		const code = error?.code;
+		if (typeof code === 'string' || typeof code === 'number') name = String(code);
+		else if (typeof error?.constructor?.name === 'string') name = error.constructor.name;
+		else if (typeof error?.name === 'string') name = error.name;
+	} catch {}
+	try {
+		if (typeof error?.message === 'string') message = error.message;
+	} catch {}
+	message ??= harperErrorToString(error);
+	const record: { error: string; message: string; status?: number } = { error: name, message };
+	try {
+		const status = error?.statusCode ?? error?.status;
+		if (typeof status === 'number') record.status = status;
+	} catch {}
+	return record;
+}
 
 const PUBLIC_ENCODE_OPTIONS = {
 	useRecords: false,
@@ -103,9 +137,14 @@ mediaTypes.set('text/yaml', {
 });
 
 const ndjsonHandler = {
-	serializeStream(data: any) {
+	serializeStream(data: any, _response?: Response, request?: any) {
 		if (data?.[Symbol.iterator] || data?.[Symbol.asyncIterator]) {
-			return Readable.from(transformIterable(data, (msg: any) => JSONStringify(msg) + '\n'));
+			return errorFrameStream(
+				data,
+				(msg: any) => JSONStringify(msg) + '\n',
+				(error) => JSONStringify({ $harperStreamError: streamErrorRecord(error) }) + '\n',
+				request?.method === 'GET'
+			);
 		}
 		return JSONStringify(data) + '\n';
 	},
@@ -125,11 +164,21 @@ const ndjsonHandler = {
 mediaTypes.set('application/x-ndjson', ndjsonHandler);
 mediaTypes.set('application/ndjson', ndjsonHandler);
 
+function serializeSSEData(data: any) {
+	if (typeof data === 'object') return 'data: ' + JSONStringify(data) + '\n';
+	return 'data: ' + String(data).replace(/\r\n|\r|\n/g, '\ndata: ') + '\n';
+}
+
 mediaTypes.set('text/event-stream', {
 	// Server-Sent Events (SSE)
-	serializeStream: function (iterable) {
+	serializeStream: function (iterable, _response?: Response, request?: any) {
 		// create a readable stream that we use to stream out events from our subscription
-		return Readable.from(transformIterable(iterable, this.serialize));
+		return errorFrameStream(
+			iterable,
+			this.serialize,
+			(error) => this.serialize({ event: 'harper-error', data: streamErrorRecord(error) }),
+			request?.method === 'GET'
+		);
 	},
 	serialize: function (message) {
 		if (message.acknowledge) message.acknowledge();
@@ -141,20 +190,20 @@ mediaTypes.set('text/event-stream', {
 				id: message.timestamp,
 			};
 		}
-		if (message.data || message.event) {
+		// A non-null top-level `data` or truthy `event` is an SSE envelope, even with sibling fields.
+		// `id`/`retry` alone do not open it: `id` is too common a literal-payload field name (e.g. a
+		// database record) to safely treat as an SSE-envelope signal.
+		if (message.data != null || message.event) {
 			let serialized = '';
 			if (message.event) serialized += 'event: ' + message.event + '\n';
-			if (message.data) {
-				let data = message.data;
-				if (typeof data === 'object') data = JSONStringify(data);
-				serialized += 'data: ' + data + '\n';
+			if (message.data != null) {
+				serialized += serializeSSEData(message.data);
 			}
-			if (message.id) serialized += 'id: ' + message.id + '\n';
-			if (message.retry) serialized += 'retry: ' + message.retry + '\n';
+			if (message.id != null) serialized += 'id: ' + message.id + '\n';
+			if (message.retry != null) serialized += 'retry: ' + message.retry + '\n';
 			return serialized + '\n';
 		} else {
-			if (typeof message === 'object') return `data: ${JSONStringify(message)}\n\n`;
-			return `data: ${message}\n\n`;
+			return serializeSSEData(message) + '\n';
 		}
 	},
 	compressible: false,
@@ -391,7 +440,12 @@ export function serialize(responseData, request, responseObject) {
 			(responseData[Symbol.iterator] || responseData[Symbol.asyncIterator]) &&
 			serializer.serializer.serializeStream
 		) {
-			if (responseData.mapError) {
+			if (
+				responseData.mapError &&
+				serializer.type !== 'application/x-ndjson' &&
+				serializer.type !== 'application/ndjson' &&
+				serializer.type !== 'text/event-stream'
+			) {
 				// indicate that we want iterator errors to be returned so we can serialize them in a meaningful way, if possible
 				const getColumns = responseData.getColumns;
 				responseData = responseData.mapError((error) => {
@@ -402,9 +456,10 @@ export function serialize(responseData, request, responseObject) {
 				});
 				responseData.getColumns = getColumns;
 			}
-			let stream = serializer.serializer.serializeStream(responseData, responseObject);
+			let stream = serializer.serializer.serializeStream(responseData, responseObject, request);
 			if (canCompress) {
 				responseObject.headers.set('Content-Encoding', 'br');
+				const uncompressedStream = stream;
 				stream = stream.pipe(
 					createBrotliCompress({
 						params: {
@@ -416,6 +471,7 @@ export function serialize(responseData, request, responseObject) {
 						},
 					})
 				);
+				if (uncompressedStream[streamStartup]) stream[streamStartup] = uncompressedStream[streamStartup];
 			}
 			return stream;
 		}
@@ -436,6 +492,20 @@ export function serialize(responseData, request, responseObject) {
 }
 
 let asyncSerializations: Promise<void>[];
+/**
+ * Get the message serializer for a request's negotiated content type, memoized on the request.
+ * The returned function is the registered per-content-type serializer, so its identity keys the
+ * content type. Caching serialized output across requests under that key is only valid because the
+ * built-in serializers are pure functions of their argument — a component registering a serializer
+ * into `server.contentTypes` whose output depends on anything else would not be shareable.
+ * @param request
+ */
+export function getMessageSerializer(request?: Request): (message: any) => Buffer | string {
+	if (!request) return JSONStringify;
+	let serialize = (request as any).serialize;
+	if (!serialize) serialize = (request as any).serialize = findBestSerializer(request).serializer.serialize;
+	return serialize;
+}
 /**
  * Serialize a message, may be use multiple times (like with WebSockets)
  * @param message
@@ -450,18 +520,7 @@ export function serializeMessage(
 	if (message?.contentType != null && message.data != null) return message.data;
 	asyncSerializations = inAsyncContinuation ? undefined : [];
 	try {
-		let serialized: Buffer | string;
-		if (request) {
-			let serialize = (request as any).serialize;
-			if (serialize) serialized = serialize(message);
-			else {
-				const serializer = findBestSerializer(request);
-				serialize = (request as any).serialize = serializer.serializer.serialize;
-				serialized = serialize(message);
-			}
-		} else {
-			serialized = JSONStringify(message);
-		}
+		const serialized: Buffer | string = getMessageSerializer(request)(message);
 		if (asyncSerializations?.length > 0)
 			// if there were any serialization attempts that must wait for async work to be done, we wait now and then retry the serialization
 			return (asyncSerializations.length === 1 ? asyncSerializations[0] : Promise.all(asyncSerializations)).then(() =>
@@ -615,24 +674,146 @@ function deserializerUnknownType(contentType: ContentType): Deserialize {
 	}
 }
 
-function transformIterable(iterable, transform) {
+function errorFrameStream(iterable, transform, serializeError, eager: boolean) {
+	const transformed = transformIterable(iterable, transform, serializeError, eager);
+	const readable = Readable.from(transformed);
+	const startup: StreamStartup = transformed[streamStartup];
+	startup.cancel = () => readable.destroy();
+	readable[streamStartup] = startup;
+	return readable;
+}
+
+export function discardSerializedStream(stream) {
+	stream?.[streamStartup]?.cancel?.();
+	stream?.destroy?.();
+}
+
+export function waitForStreamStartup(stream) {
+	const startup: StreamStartup | undefined = stream?.[streamStartup];
+	if (!startup) return;
+	startup.start();
+	return startup.result.then((result) => {
+		if (result.failed) {
+			startup.abort();
+			discardSerializedStream(stream);
+			throw result.error;
+		}
+	});
+}
+
+function transformIterable(iterable, transform, serializeError, eager) {
+	let iterator;
+	let terminal = false;
+	let first = true;
+	let started = false;
+	let firstStep;
+	let startupSettled = false;
+	const startupResult = Promise.withResolvers<{ failed?: true; error?: unknown }>();
+	const errorDecision = Promise.withResolvers<boolean>();
+	let startupTimer;
+
+	const commit = () => {
+		if (startupTimer) clearImmediate(startupTimer);
+		if (!startupSettled) {
+			startupSettled = true;
+			startupResult.resolve({});
+		}
+		errorDecision.resolve(true);
+	};
+	const abort = () => {
+		if (startupTimer) clearImmediate(startupTimer);
+		errorDecision.resolve(false);
+	};
+	const handleError = async (error) => {
+		terminal = true;
+		try {
+			const returned = iterator.return?.();
+			returned?.catch?.(() => {});
+		} catch {}
+		if (!startupSettled) startupResult.resolve({ failed: true, error });
+		if (!startupSettled && !(await errorDecision.promise)) return { done: true };
+		logger.warn?.('Error serializing in stream', harperErrorForLog(error));
+		return { value: serializeError(error), done: false, [serializedStreamError]: true };
+	};
+	const transformStep = (step) => {
+		if (step?.[serializedStreamError]) return step;
+		if (terminal) return { done: true };
+		if (step.done) return step;
+		try {
+			return { value: transform(step.value), done: false };
+		} catch (error) {
+			return handleError(error);
+		}
+	};
+	const getRawNext = () => {
+		if (terminal) return { done: true };
+		let step;
+		try {
+			step = iterator.next();
+		} catch (error) {
+			return handleError(error);
+		}
+		if (step.then) return step.then(undefined, handleError);
+		return step;
+	};
+	const getNext = () => {
+		if (terminal) return { done: true };
+		let step;
+		try {
+			step = iterator.next();
+		} catch (error) {
+			return handleError(error);
+		}
+		if (step.then) return step.then(transformStep, handleError);
+		return transformStep(step);
+	};
+	const start = () => {
+		if (started) return;
+		started = true;
+		iterator = iterable[Symbol.asyncIterator] ? iterable[Symbol.asyncIterator]() : iterable[Symbol.iterator]();
+		firstStep = getRawNext();
+		Promise.resolve(firstStep).then(
+			() => {
+				if (!terminal) commit();
+			},
+			() => {}
+		);
+		// After this turn, the HTTP status can no longer wait for a first item without delaying long-lived streams.
+		startupTimer = setImmediate(commit);
+	};
+	if (eager) start();
+
 	return {
+		[streamStartup]: {
+			result: startupResult.promise,
+			abort,
+			start,
+		},
 		[Symbol.asyncIterator]() {
-			const iterator = iterable[Symbol.asyncIterator] ? iterable[Symbol.asyncIterator]() : iterable[Symbol.iterator]();
 			return {
 				next() {
-					const step = iterator.next();
-					if (step.then) {
-						// don't transform the terminal sentinel step, whose value is undefined
-						return step.then((result) => (result.done ? result : { value: transform(result.value), done: false }));
+					if (terminal) return { done: true };
+					if (first) {
+						first = false;
+						start();
+						const step = firstStep;
+						firstStep = undefined;
+						if (step.then) return step.then(transformStep);
+						return transformStep(step);
 					}
-					return step.done ? step : { value: transform(step.value), done: false };
+					return getNext();
 				},
 				return(value) {
-					return iterator.return(value);
+					terminal = true;
+					started = true;
+					if (!iterator)
+						iterator = iterable[Symbol.asyncIterator]
+							? iterable[Symbol.asyncIterator]()
+							: iterable[Symbol.iterator]?.();
+					return iterator?.return?.(value) ?? { value, done: true };
 				},
 				throw(error) {
-					return iterator.throw(error);
+					return iterator?.throw?.(error) ?? Promise.reject(error);
 				},
 			};
 		},

package/server/serverHelpers/deployValidationState.ts

@@ -1,25 +1,36 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+
+import type { ComponentStatus } from '../../components/status/ComponentStatus.ts';
+
 // Deploy pre-flight validation loads throwaway candidate component code purely to surface load-time
 // errors — its top-level `server.registerOperation` / `server.setMcpQuotaHandler` calls mutate
 // process-wide state (the operation map, its cross-thread announcement, the quota handler) that is
 // NOT owned by a Scope, so a failed/rolled-back deploy would otherwise leak the candidate's
-// registrations onto the live worker. Those registration methods no-op while this guard is active.
+// registrations onto the live worker. Those registration methods no-op while this guard is active,
+// and the candidate's component-status writes are diverted into the throwaway sink below.
 //
-// Depth-counted so overlapping validations both keep the guard raised until the last one finishes.
-// Caveat: while a validation is in flight, a legitimate registration from an interleaving real load
-// is also skipped (it re-registers on its next load); that window is narrow, and the alternative —
-// leaking a candidate's registration live — is worse.
-let validationDepth = 0;
+// Context-scoped rather than a process-wide depth counter, because the live component KEEPS SERVING on
+// this worker throughout the window and writes to both of those same places: it registers on its own
+// reload, and `statusForComponent()` is a public API its runtime code may call at any time. A counter
+// cannot tell the two writers apart, so it suppressed the live component's registration and reverted its
+// status report. An async context can: only work descending from the validation load itself is diverted.
+interface DeployValidationContext {
+	// Where the candidate's own status writes land instead of the live registry. Discarded with the context.
+	statusSink: Map<string, ComponentStatus>;
+}
+
+const deployValidation = new AsyncLocalStorage<DeployValidationContext>();
 
 export function isDeployValidating(): boolean {
-	return validationDepth > 0;
+	return deployValidation.getStore() !== undefined;
+}
+
+/** The throwaway map a candidate's status writes belong in, or `undefined` outside a validation load. */
+export function deployValidationStatusSink(): Map<string, ComponentStatus> | undefined {
+	return deployValidation.getStore()?.statusSink;
 }
 
 /** Run `fn` (the throwaway validation load) with the guard raised, lowering it even if `fn` throws. */
 export async function runWithDeployValidationGuard<T>(fn: () => Promise<T>): Promise<T> {
-	validationDepth++;
-	try {
-		return await fn();
-	} finally {
-		validationDepth--;
-	}
+	return deployValidation.run({ statusSink: new Map() }, fn);
 }

package/server/serverHelpers/operationAuthorizationState.ts

@@ -1,11 +1,42 @@
 import { AsyncLocalStorage } from 'node:async_hooks';
 
-const operationAuthorizationState = new AsyncLocalStorage<boolean>();
+interface OperationAuthorizationState {
+	bypassAuth: boolean;
+	apiOperation?: string;
+}
+
+const operationAuthorizationState = new AsyncLocalStorage<OperationAuthorizationState>();
+
+// Shared, for the common case of no carrier to preserve.
+const BYPASSED: OperationAuthorizationState = Object.freeze({ bypassAuth: true });
+const ENFORCED: OperationAuthorizationState = Object.freeze({ bypassAuth: false });
 
 export function runWithOperationAuthorizationBypass<T>(bypassAuth: boolean, callback: () => T): T {
-	return operationAuthorizationState.run(bypassAuth === true, callback);
+	// An existing carrier survives: the enforced branch is not a bypass, and a job handler dispatching
+	// a nested authorized operation must not lose its own operation identity.
+	const apiOperation = operationAuthorizationState.getStore()?.apiOperation;
+	if (apiOperation === undefined) {
+		return operationAuthorizationState.run(bypassAuth === true ? BYPASSED : ENFORCED, callback);
+	}
+	return operationAuthorizationState.run(Object.freeze({ bypassAuth: bypassAuth === true, apiOperation }), callback);
+}
+
+/**
+ * `apiOperation` MUST come from the same value that selected the code now running, so it cannot name
+ * an operation other than the one executing. That is the entire basis for trusting it: a request
+ * property would be forgeable, and on the direct-SQL path this check is the only gate.
+ */
+export function runWithDispatchedOperation<T>(apiOperation: string, callback: () => T): T {
+	return operationAuthorizationState.run(
+		Object.freeze({ bypassAuth: operationAuthorizationState.getStore()?.bypassAuth === true, apiOperation }),
+		callback
+	);
+}
+
+export function getOperationAuthorizationState(): OperationAuthorizationState | undefined {
+	return operationAuthorizationState.getStore();
 }
 
 export function isOperationAuthorizationBypassed(): boolean {
-	return operationAuthorizationState.getStore() === true;
+	return operationAuthorizationState.getStore()?.bypassAuth === true;
 }

package/server/serverHelpers/registeredOperations.ts

@@ -11,7 +11,7 @@
  * so a request is sent to exactly ONE registering worker (never broadcast-first-wins).
  *
  *  - Worker: `registerOperation()` announces the name (OPERATION_REGISTERED) to all threads;
- *    only the main thread records it, as name -> Set<threadId>.
+ *    only the main thread records it, as name -> Set<threadId>, plus `grantable`.
  *  - Main: on an OPERATION_FUNCTION_MAP miss, `getRemoteOperationFunction()` supplies a forwarding
  *    function that sends the request body (OPERATION_EXECUTE_REQUEST) to one live registering
  *    worker and awaits the correlated OPERATION_EXECUTE_RESPONSE.
@@ -26,7 +26,11 @@ import * as env from '../../utility/environment/environmentManager.ts';
 import harperLogger from '../../utility/logging/harper_logger.ts';
 import { ServerError } from '../../utility/errors/hdbError.ts';
 import { sendItcEvent } from '../threads/itc.js';
-import { onMessageByType, onThreadExit } from '../threads/manageThreads.js';
+import { hasThreadExited, onMessageByType, onThreadExit } from '../threads/manageThreads.js';
+import {
+	registerWorkerGrantableOperation,
+	unregisterWorkerGrantableOperation,
+} from '../../utility/operationPermissions.ts';
 import { runWithOperationAuthorizationBypass } from './operationAuthorizationState.ts';
 
 const operationLog = harperLogger.loggerWithTag('operation');
@@ -59,6 +63,9 @@ export function setLocalOperationDispatch(dispatch: typeof localDispatch) {
 
 /** name -> threadIds of workers that registered it (main thread only) */
 const registeredByWorker = new Map<string, Set<number>>();
+// Per originator, not per name: a rolling deploy whose new generation drops `requiresSuperUser`
+// must keep routing the name while retracting grantability, which a name-level flag cannot express.
+const grantableByWorker = new Map<string, Set<number>>();
 const pendingExecutions = new Map<
 	number,
 	{ targetThreadId: number; resolve: (result: any) => void; reject: (error: Error) => void }
@@ -71,27 +78,82 @@ let mainListenersAttached = false;
  * a lost announcement just means the op stays unreachable (the pre-#1736 status quo), and the
  * broadcast has its own ack timeout.
  */
-export function announceRegisteredOperation(name: string) {
+export function announceRegisteredOperation(name: string, grantable = false) {
 	if (isMainThread) return;
 	sendItcEvent({
 		type: terms.ITC_EVENT_TYPES.OPERATION_REGISTERED,
-		message: { name },
+		message: { name, grantable },
 	}).catch((error) => operationLog.error(`Failed to announce registered operation '${name}'`, error));
 }
 
 /**
  * ITC handler (all threads receive the broadcast; only main records it).
  */
-export function operationRegisteredHandler(event: { message: { name: string; originator: number } }) {
+export function operationRegisteredHandler(event: {
+	message?: { name?: string; grantable?: boolean; originator?: number };
+}) {
 	if (!isMainThread) return;
-	const { name, originator } = event.message;
+	const { name, grantable, originator } = event?.message ?? {};
 	if (typeof name !== 'string' || typeof originator !== 'number') return;
+	// An announcement can lose the race with its own thread's exit, and exit notification fires once
+	// per thread, so without this the entry would never be cleaned up. Reads manageThreads' tombstone
+	// rather than keeping a second one: job threads are one-shot workers, so a duplicate here would
+	// grow per completed job, not per worker restart.
+	if (hasThreadExited(originator)) {
+		operationLog.debug(`Ignoring operation '${name}' announced by exited worker thread ${originator}`);
+		return;
+	}
 	let workerIds = registeredByWorker.get(name);
 	if (!workerIds) registeredByWorker.set(name, (workerIds = new Set()));
 	workerIds.add(originator);
+	// Mirroring only widens what an allowlist may name; enforcement stays on the worker's
+	// chooseOperation. A re-announcement that drops the permission retracts this thread's claim.
+	setWorkerGrantable(name, originator, grantable === true);
 	operationLog.debug(`Registered operation '${name}' announced by worker thread ${originator}`);
 }
 
+/**
+ * A worker that dies mid-execution can never respond, so fail its in-flight forwards rather than
+ * waiting out the timeout, and forget its registrations (a replacement re-registers on load).
+ */
+function handleThreadExit(deadThreadId: number) {
+	for (const [name, workerIds] of registeredByWorker) {
+		if (!workerIds.delete(deadThreadId)) continue;
+		// A surviving worker that never declared a permission must not keep the name admissible.
+		if (workerIds.size === 0) dropRegistration(name);
+		else setWorkerGrantable(name, deadThreadId, false);
+	}
+	for (const [requestId, pending] of pendingExecutions) {
+		if (pending.targetThreadId === deadThreadId) {
+			pendingExecutions.delete(requestId);
+			pending.reject(new ServerError('The worker thread executing this operation exited', 503));
+		}
+	}
+}
+
+function setWorkerGrantable(name: string, threadId: number, grantable: boolean) {
+	let grantableIds = grantableByWorker.get(name);
+	if (grantable) {
+		if (!grantableIds) grantableByWorker.set(name, (grantableIds = new Set()));
+		grantableIds.add(threadId);
+		registerWorkerGrantableOperation(name);
+	} else if (grantableIds?.delete(threadId) && grantableIds.size === 0) {
+		grantableByWorker.delete(name);
+		unregisterWorkerGrantableOperation(name);
+	}
+}
+
+/**
+ * Forget an operation no live worker offers any more. Both prune paths — thread exit, and a failed
+ * send discovering a dead port — route through here so a name can never keep a route without an
+ * owner. Grantability is dropped per owner instead, in `setWorkerGrantable`.
+ */
+function dropRegistration(name: string) {
+	registeredByWorker.delete(name);
+	grantableByWorker.delete(name);
+	unregisterWorkerGrantableOperation(name);
+}
+
 let rotation = 0;
 /**
  * Main-thread dispatch fallback: if a worker registered `name`, return a forwarding operation
@@ -122,23 +184,15 @@ function attachMainListeners() {
 		if (error) pending.reject(new ServerError(error.message, error.statusCode || 500));
 		else pending.resolve(result);
 	});
-	// A worker that dies mid-execution can never respond; fail its in-flight forwards rather
-	// than waiting out the timeout, and forget its registrations (a replacement worker
-	// re-registers on component load).
-	onThreadExit((deadThreadId: number) => {
-		for (const [name, workerIds] of registeredByWorker) {
-			workerIds.delete(deadThreadId);
-			if (workerIds.size === 0) registeredByWorker.delete(name);
-		}
-		for (const [requestId, pending] of pendingExecutions) {
-			if (pending.targetThreadId === deadThreadId) {
-				pendingExecutions.delete(requestId);
-				pending.reject(new ServerError('The worker thread executing this operation exited', 503));
-			}
-		}
-	});
+	onThreadExit(handleThreadExit);
 }
 
+// Armed at load rather than on first use: serverUtilities imports this module during its own load,
+// before any worker exists. Thread-exit notification fires once per thread and is dropped outright
+// if no listener is attached yet, so a worker dying before its first announcement is processed
+// would otherwise leave a registration nothing could ever clean up.
+if (isMainThread) attachMainListeners();
+
 async function executeRemoteOperation(name: string, body: any, bypassAuth: boolean): Promise<any> {
 	attachMainListeners();
 	const workerIds = registeredByWorker.get(name);
@@ -168,7 +222,10 @@ async function executeRemoteOperation(name: string, body: any, bypassAuth: boole
 			);
 		}
 		if (!sent) {
+			// The port is gone, so this thread's claims go with it — grantability included, which
+			// handleThreadExit would otherwise not retract while other workers still route the name.
 			workerIds.delete(targetThreadId);
+			setWorkerGrantable(name, targetThreadId, false);
 			continue;
 		}
 		return new Promise((promiseResolve, promiseReject) => {
@@ -190,7 +247,7 @@ async function executeRemoteOperation(name: string, body: any, bypassAuth: boole
 			});
 		});
 	}
-	if (registeredByWorker.get(name)?.size === 0) registeredByWorker.delete(name);
+	if (registeredByWorker.get(name)?.size === 0) dropRegistration(name);
 	throw new ServerError(
 		`Operation '${name}' is registered by a component but no worker thread is available to run it`,
 		503

package/server/serverHelpers/requestSanitization.ts

@@ -0,0 +1,15 @@
+/**
+ * `evaluateSQL` honors a supplied `parsed_sql_object` verbatim and skips parsing, so one carrying
+ * `permissions_checked: true` executes an AST that no authorization check ever saw. Neither position
+ * is ever legitimately client-supplied: dispatch parses the statement itself, and the job worker
+ * re-parses from the `sql` string dispatch authorized.
+ *
+ * Both positions, because the two entry points differ: `chooseOperation` overwrites the top-level
+ * object with its own parse, but only inside its SQL branch, so a non-SQL job (`export_local` with a
+ * `search_by_value` search) can still carry a client-supplied one through to the persisted row.
+ */
+export function stripSuppliedParsedSqlObject(request: any): void {
+	if (!request) return;
+	delete request.parsed_sql_object;
+	delete request.search_operation?.parsed_sql_object;
+}

package/server/serverHelpers/serverHandlers.js

@@ -41,6 +41,9 @@ const NO_AUTH_OPERATIONS = [
 	terms.OPERATIONS_ENUM.CREATE_AUTHENTICATION_TOKENS,
 	terms.OPERATIONS_ENUM.LOGIN,
 	terms.OPERATIONS_ENUM.LOGOUT,
+	// The OIDC exchange *is* the authentication (#2171): the caller proves identity with a token
+	// from a trusted issuer, not with Harper credentials it does not have.
+	terms.OPERATIONS_ENUM.EXCHANGE_OIDC_TOKEN,
 ];
 
 const UNSAFE_REQUEST_BODY_PROPERTIES = ['__proto__', 'constructor', 'prototype'];
@@ -111,10 +114,10 @@ function authHandler(req, resp, done) {
 	const isAuthOperation = !NO_AUTH_OPERATIONS.includes(req.body.operation);
 	if (
 		isAuthOperation ||
-		// If create token is called without username/password in the body it needs to be authorized
+		// Create token needs to be authorized when called without username/password in the body, or
+		// with an inline role object (scoped-token minting is gated on the authenticated requester)
 		(req.body.operation === terms.OPERATIONS_ENUM.CREATE_AUTHENTICATION_TOKENS &&
-			!req.body.username &&
-			!req.body.password)
+			((!req.body.username && !req.body.password) || (req.body.role && typeof req.body.role === 'object')))
 	) {
 		pAuthorize(req, resp)
 			.then(async (userData) => {