@substrat-run/adapter-cloudflare 0.107.0 → 0.109.0

package/dist/host.js

@@ -497,15 +497,23 @@ export class CloudflareScopeHost {
     async exportScopeLocal(scopeId) {
         return this.scopeStub(scopeId).exportDump();
     }
+    /** Facet this host's own scope's outbox (#1239) — the vertical-host read. */
+    async facetEventsLocal(scopeId, input) {
+        return this.scopeStub(scopeId).facetEvents(input);
+    }
+    /** One record's event history (#1235) on this host's own scope — the vertical-host read. */
+    async entityHistoryLocal(scopeId, input) {
+        return this.scopeStub(scopeId).entityHistory(input);
+    }
+    /** When this host's own scope applied each migration (#1236) — the vertical-host read. */
+    async appliedMigrationsLocal(scopeId) {
+        return this.scopeStub(scopeId).appliedMigrations();
+    }
     /**
      * The PITR bookmarks one scope recorded before its migration passes (#286) — the
      * rewind points a backout UI offers. Behind the vertical's platform-gated
      * `/internal/bookmarks`; the control plane is the gate and the auditor.
      */
-    /** When this host's own scope applied each migration (#1236) — the vertical-host read. */
-    async appliedMigrationsLocal(scopeId) {
-        return this.scopeStub(scopeId).appliedMigrations();
-    }
     async migrationBookmarksLocal(scopeId) {
         return this.scopeStub(scopeId).migrationBookmarks();
     }
@@ -2234,17 +2242,51 @@ export class CloudflareScopeHost {
             listScopeTables: async (actor, tenantId, scopeId) => {
                 // K-3 cross-check on the shared directory BEFORE reaching the scope DO: a pair
                 // that does not resolve is unreachable, never another tenant's database.
-                const row = await this.cp.getScopeRecord(tenantId, scopeId);
-                if (!row)
-                    throw new Error(`unknown scope for tenant: (${tenantId}, ${scopeId})`);
+                await this.scopeRecordForRead(tenantId, scopeId);
                 const tables = await this.scopeStub(scopeId).introspectTables();
                 await this.recordAccess(actor, 'listScopeTables', { tenantId, scopeId }, null, tables.length);
                 return tables;
             },
+            readUndrainedEvents: async (actor, tenantId, scopeId, limit) => {
+                await this.scopeRecordForRead(tenantId, scopeId);
+                const events = await this.scopeStub(scopeId).undrainedEvents(Math.min(Math.max(limit ?? 200, 1), 1000));
+                await this.recordAccess(actor, 'readUndrainedEvents', { tenantId, scopeId }, { limit }, events.length);
+                return events;
+            },
+            markEventsDrained: async (actor, tenantId, scopeId, eventIds) => {
+                // The same refusal the reads carry: a reaped scope's storage is gone, and
+                // addressing its DO would construct an empty one to stamp nothing in.
+                await this.scopeRecordForRead(tenantId, scopeId);
+                if (eventIds.length === 0)
+                    return 0;
+                const drainedAt = new Date().toISOString();
+                const drained = await this.scopeStub(scopeId).markEventsDrained(eventIds, drainedAt);
+                // K-24's rule, one tier down (#1334): declaring domain payloads shipped is an
+                // EGRESS, and the admin log is where "these events left the platform, at this
+                // time, on this actor's say-so" is recorded. `drainAccessLog` audits the same
+                // act for the smaller class of data; this one carries the larger. Only a
+                // NONZERO change is recorded, so a retried pass that re-marks a batch it
+                // already shipped writes no row claiming an egress that never happened.
+                if (drained > 0) {
+                    await this.recordAdmin(actor, 'drainEvents', { tenantId, scopeId }, null, { drained, requested: eventIds.length, drainedAt });
+                }
+                return drained;
+            },
+            facetEvents: async (actor, tenantId, scopeId, input) => {
+                await this.scopeRecordForRead(tenantId, scopeId);
+                const result = await this.scopeStub(scopeId).facetEvents(input);
+                await this.recordAccess(actor, 'facetEvents', { tenantId, scopeId }, input, result.buckets.length);
+                return result;
+            },
+            entityHistory: async (actor, tenantId, scopeId, input) => {
+                // K-3 cross-check on the directory BEFORE the scope DO, like every read here.
+                await this.scopeRecordForRead(tenantId, scopeId);
+                const page = await this.scopeStub(scopeId).entityHistory(input);
+                await this.recordAccess(actor, 'entityHistory', { tenantId, scopeId }, { entityType: input.entityType, entityId: input.entityId }, page.entries.length);
+                return page;
+            },
             readScopeTable: async (actor, tenantId, scopeId, input) => {
-                const row = await this.cp.getScopeRecord(tenantId, scopeId);
-                if (!row)
-                    throw new Error(`unknown scope for tenant: (${tenantId}, ${scopeId})`);
+                await this.scopeRecordForRead(tenantId, scopeId);
                 const page = await this.scopeStub(scopeId).introspectTable(input.table, input.limit, input.offset);
                 await this.recordAccess(actor, 'readScopeTable', { tenantId, scopeId }, { table: input.table, limit: page.limit, offset: page.offset }, page.rows.length);
                 return page;
@@ -2253,25 +2295,19 @@ export class CloudflareScopeHost {
                 // K-3 cross-check on the shared directory BEFORE reaching the scope DO, as
                 // every read here does: an unresolved pair is unreachable, never another
                 // tenant's log.
-                const row = await this.cp.getScopeRecord(tenantId, scopeId);
-                if (!row)
-                    throw new Error(`unknown scope for tenant: (${tenantId}, ${scopeId})`);
+                await this.scopeRecordForRead(tenantId, scopeId);
                 const rows = await this.scopeStub(scopeId).listDenials(filter);
                 await this.recordAccess(actor, 'listDenials', { tenantId, scopeId }, filter ?? null, rows.length);
                 return rows;
             },
             summarizeDenials: async (actor, tenantId, scopeId, filter) => {
-                const row = await this.cp.getScopeRecord(tenantId, scopeId);
-                if (!row)
-                    throw new Error(`unknown scope for tenant: (${tenantId}, ${scopeId})`);
+                await this.scopeRecordForRead(tenantId, scopeId);
                 const summary = await this.scopeStub(scopeId).summarizeDenials(filter);
                 await this.recordAccess(actor, 'summarizeDenials', { tenantId, scopeId }, filter ?? null, summary.buckets.length);
                 return summary;
             },
             queryScope: async (actor, tenantId, scopeId, input) => {
-                const row = await this.cp.getScopeRecord(tenantId, scopeId);
-                if (!row)
-                    throw new Error(`unknown scope for tenant: (${tenantId}, ${scopeId})`);
+                await this.scopeRecordForRead(tenantId, scopeId);
                 const result = await this.scopeStub(scopeId).introspectQuery(input.sql);
                 // The statement is the logged argument: the access log is the evidence trail,
                 // and for a console read the SQL is the whole story.
@@ -2283,9 +2319,7 @@ export class CloudflareScopeHost {
                 // as the introspection reads: an unresolved pair is unreachable, never another
                 // tenant's database. The DO returns the tables; the coordinator, which knows the
                 // scope's identity, stamps the dump.
-                const row = await this.cp.getScopeRecord(tenantId, scopeId);
-                if (!row)
-                    throw new Error(`unknown scope for tenant: (${tenantId}, ${scopeId})`);
+                await this.scopeRecordForRead(tenantId, scopeId);
                 const tables = await this.scopeStub(scopeId).exportDump();
                 await this.recordAccess(actor, 'exportScope', { tenantId, scopeId }, null, tables.length);
                 return { tenantId, scopeId, capturedAt: new Date().toISOString(), tables };
@@ -2931,6 +2965,24 @@ export class CloudflareScopeHost {
         if (!rec)
             throw new Error(`unknown scope for tenant: (${tenantId}, ${scopeId})`);
     }
+    /**
+     * The same K-3 cross-check, for a read that then opens the scope's STORAGE — every
+     * introspection verb below. It adds one refusal the bare existence check cannot make:
+     * a REAPED scope keeps its directory row as a tombstone (§4.4) while its storage is
+     * gone, so the row resolves and the read looks legal. Addressing the DO anyway
+     * CONSTRUCTS an empty one, and the answer comes back as a scope with no tables, no
+     * events and no denials rather than as a scope that no longer exists — the read
+     * quietly contradicting the reap that was meant to be irreversible. `archived` still
+     * reads: its bytes are there, which is the whole distinction between the two states.
+     */
+    async scopeRecordForRead(tenantId, scopeId) {
+        const row = await this.cp.getScopeRecord(tenantId, scopeId);
+        if (!row)
+            throw new Error(`unknown scope for tenant: (${tenantId}, ${scopeId})`);
+        if (row.status === 'reaped') {
+            throw new Error(`scope ${scopeId} is reaped — its storage is gone and cannot be read`);
+        }
+    }
     /**
      * This scope's per-subject keys (#37). The crypto lives in the kernel
      * (`createSubjectKeys`); the adapter supplies only the three row operations, which here
@@ -3020,8 +3072,8 @@ export class CloudflareScopeHost {
      * The connection's CURRENT public sealing key, minted on first ask (#687).
      *
      * Mint-on-read rather than mint-only-at-connect, because the fleet already holds
-     * live connections older than this feature — Egeryds' Scrive credential carries
-     * years of real contracts, and "reconnect to acquire a keypair" is not a
+     * live connections older than this feature — a Scrive credential in the fleet
+     * carries years of real contracts, and "reconnect to acquire a keypair" is not a
      * migration anyone should have to run against production. Asking IS the
      * back-fill, and it is idempotent: the DO's insert loses silently against the
      * partial-unique index and re-reads the winner, so a race yields one key.
@@ -3152,7 +3204,32 @@ export class CloudflareScopeHost {
         if (!this.scopeLocalPermissions)
             return;
         const { roles, tuples, entitlements, identities } = await this.tenantProjection(tenantId);
-        const scopes = await this.cp.listScopes({ tenantId });
+        // Only scopes that can still EVALUATE a permission. Unfiltered, this projected
+        // into `archived` and `reaped` rows too — and a reaped scope's storage was
+        // deliberately `deleteAll()`d ("the bytes are gone, so there is no restore",
+        // tenancy.ts), so writing a projection into its DO recreated storage for a scope
+        // the platform believes dead. Silent, unbounded in the number of apps a tenant
+        // has ever archived, and paid for on every membership change.
+        //
+        // `provisioning` is included: a scope mid-provision pulls the projection itself
+        // at creation, and including it costs one idempotent write while excluding it
+        // could race that pull. `suspended` is included because suspension is reversible
+        // and a suspended scope must not come back with a stale projection.
+        // Only scopes that can still EVALUATE a permission. Unfiltered, this projected
+        // into `archived` and `reaped` rows too — and a reaped scope's storage was
+        // deliberately `deleteAll()`d ("the bytes are gone, so there is no restore",
+        // tenancy.ts), so writing a projection into its DO recreated storage for a scope
+        // the platform believes dead. Silent, unbounded in the number of apps a tenant
+        // has ever archived, and paid for on every membership change.
+        //
+        // `provisioning` is included: a scope mid-provision pulls the projection itself
+        // at creation, and including it costs one idempotent write while excluding it
+        // could race that pull. `suspended` is included because suspension is reversible
+        // and a suspended scope must not come back with a stale projection.
+        const scopes = await this.cp.listScopes({
+            tenantId,
+            status: ['provisioning', 'active', 'suspended'],
+        });
         // #687: connection keys are per (tenant, vertical), so they are resolved per scope
         // rather than once for the tenant — memoized, because a fan-out over twenty scopes
         // of one vertical must not mint or re-read twenty times.