@substrat-run/adapter-cloudflare 0.130.1 → 0.132.1

package/dist/scope-do.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope-do.d.ts","sourceRoot":"","sources":["../src/scope-do.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAcL,KAAK,WAAW,EAqCjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAmCL,KAAK,SAAS,EAmBd,KAAK,kBAAkB,EAEvB,KAAK,gBAAgB,EAuEtB,MAAM,sBAAsB,CAAC;AAsF9B;;;;;;;;;;;;;GAaG;AAEH,MAAM,WAAW,UAAU;IACzB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,sBAAsB,CAAC;IACvC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAwbD;;;GAGG;AACH,MAAM,MAAM,yBAAyB,CAAC,CAAC,IAAI;IAAE,KAAK,EAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,WAAW,CAAA;CAAE,CAAC;AAgDxG;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,GAAG,SAAS,CAOxD;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAwDxD;AAED,wBAAgB,aAAa,CAC3B,OAAO,EAAE,kBAAkB,EAAE,EAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,GACxD,KAAK,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,UAAU,KAAK,aAAa,CAi/JjE"}
+{"version":3,"file":"scope-do.d.ts","sourceRoot":"","sources":["../src/scope-do.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAcL,KAAK,WAAW,EAsCjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAoCL,KAAK,SAAS,EAmBd,KAAK,kBAAkB,EAEvB,KAAK,gBAAgB,EAuEtB,MAAM,sBAAsB,CAAC;AAsF9B;;;;;;;;;;;;;GAaG;AAEH,MAAM,WAAW,UAAU;IACzB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,sBAAsB,CAAC;IACvC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AA0bD;;;GAGG;AACH,MAAM,MAAM,yBAAyB,CAAC,CAAC,IAAI;IAAE,KAAK,EAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,WAAW,CAAA;CAAE,CAAC;AAgDxG;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,GAAG,SAAS,CAOxD;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAwDxD;AAED,wBAAgB,aAAa,CAC3B,OAAO,EAAE,kBAAkB,EAAE,EAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,GACxD,KAAK,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,UAAU,KAAK,aAAa,CAklKjE"}

package/dist/scope-do.js

@@ -1,7 +1,7 @@
 import { REWIND_REFUSED } from './rewind-refusal.js';
 import { DurableObject } from 'cloudflare:workers';
 import { ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, domainEvent, domainEventInput, eventId, instant, objectRef, entityObjectRef, assertModuleEmittableType, assertKernelAuthoredType, toWireFailure, grantRefFromProof, principalId, scopeId as scopeIdOf, tenantId as tenantIdOf, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, MAX_PENDING_SWEEP_RUNS, SWEEP_RUNS_KIND, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, listLimitOf, requestFingerprint, substratError, assertReplayableDump, REDRAIN_BATCH, } from '@substrat-run/contracts';
-import { ulid, DO_SQL_LIMITS, createUlid, assertAllowed, ConnectionSealingKeyUnavailableError, noSealingKeyMessage, sealTo, assertReadOnlyQuery, entitlementDenial, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, JOB_RUN_PATCH_SQL, JOB_STEP_RECORD_SQL, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, effectiveRoleGrantQuery, switchRecordedOff, switchSystemSchedules, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, denialListQuery, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, PermissionDenied, assertImpersonationWrites, assertModuleEnqueueableKind, impersonationStampOf, createAtomic, NotSearchable, isSearchIndexTable, searchIndexDdl, searchIndexPlans, NotListable, listIndexPlans, moduleMigrations, listQuery, cursorOf, searchLimit, searchMatchExpression, searchQuery, IDEMPOTENCY_DDL, REFUSALS_DDL, refusalInsert, refusedTransitionOf, assertIdempotencyKey, assertPermissionKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, exportedSinceQuery, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, jobRunListLimit, } from '@substrat-run/kernel';
+import { ulid, DO_SQL_LIMITS, unknownRoleError, createUlid, assertAllowed, ConnectionSealingKeyUnavailableError, noSealingKeyMessage, sealTo, assertReadOnlyQuery, entitlementDenial, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, JOB_RUN_PATCH_SQL, JOB_STEP_RECORD_SQL, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, effectiveRoleGrantQuery, switchRecordedOff, switchSystemSchedules, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, denialListQuery, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, PermissionDenied, assertImpersonationWrites, assertModuleEnqueueableKind, impersonationStampOf, createAtomic, NotSearchable, isSearchIndexTable, searchIndexDdl, searchIndexPlans, NotListable, listIndexPlans, moduleMigrations, listQuery, cursorOf, searchLimit, searchMatchExpression, searchQuery, IDEMPOTENCY_DDL, REFUSALS_DDL, refusalInsert, refusedTransitionOf, assertIdempotencyKey, assertPermissionKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, exportedSinceQuery, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, jobRunListLimit, } from '@substrat-run/kernel';
 import { isUpgradeRequest, readSubscription, LIVE_FANOUT_LIMIT, LIVE_MODE_HEADER, LIVE_PRINCIPAL_HEADER, LIVE_SCOPE_HEADER, LIVE_SUBSCRIBE_PATH, LIVE_TENANT_HEADER, } from './live-reads.js';
 import { OperationQueue } from './serialization.js';
 import { doScopedSql, doBuiltColumnsOf, doSpineSql } from './sql.js';
@@ -160,6 +160,8 @@ const KERNEL_DDL = `
     module_id TEXT NOT NULL,
     version TEXT NOT NULL,
     applied_at TEXT NOT NULL,
+    duration_ms INTEGER,
+    rows_changed INTEGER,
     PRIMARY KEY (module_id, version)
   );
   -- #286: the PITR bookmark taken immediately BEFORE a migration pass runs on a
@@ -833,13 +835,15 @@ export function defineScopeDO(modules, bareOps) {
          */
         appliedMigrations(limit = 100) {
             return this.sql
-                .exec(`SELECT module_id, version, applied_at FROM _substrat_migrations
+                .exec(`SELECT module_id, version, applied_at, duration_ms, rows_changed FROM _substrat_migrations
             ORDER BY applied_at DESC, module_id, version LIMIT ?`, limit)
                 .toArray()
                 .map((r) => ({
                 moduleId: r.module_id,
                 version: r.version,
                 appliedAt: r.applied_at ?? null,
+                durationMs: r.duration_ms ?? null,
+                rowsChanged: r.rows_changed ?? null,
             }));
         }
         /**
@@ -2201,6 +2205,28 @@ export function defineScopeDO(modules, bareOps) {
             }
             return record;
         }
+        /** Authorize a job's read as its registered module, never as a person. */
+        async systemAttachmentAuthorize(attachmentId, moduleId, tenantId, scopeId) {
+            await this.ensureMigrations();
+            if (!this.modules.has(moduleId)) {
+                throw toRpcError(substratError('not_found', `module not registered in this scope: ${moduleId}`));
+            }
+            const record = this.attachmentRow(attachmentId);
+            if (!record)
+                return null;
+            const gate = this.attachmentGate(record.entity.entityType);
+            try {
+                const ctx = this.operationContext(this.systemPrincipal, tenantId, scopeId, undefined, undefined, moduleId, undefined, undefined, 'attachments.open');
+                assertAllowed(await ctx.check(gate.read, record.entity));
+            }
+            catch (err) {
+                if (err instanceof PermissionDenied) {
+                    this.recordDenial({ kind: 'system', id: moduleId }, tenantId, 'attachments.open', err, null);
+                }
+                throw toRpcError(err);
+            }
+            return record;
+        }
         /** Remove an attachment's metadata fact: write gate + delete + `attachment.removed`. */
         async attachmentRemove(attachmentId, principal, tenantId, scopeId, connectionId) {
             await this.ensureMigrations();
@@ -2402,6 +2428,40 @@ export function defineScopeDO(modules, bareOps) {
                 return permissions.map((permission) => ({ permission, held: !missing.has(permission) }));
             });
         }
+        /**
+         * `ctx.canAssign`'s bound for a principal the host names (#1931), queued like `peerCovers`
+         * so no invoke's open transaction is read half-done. `null` when the tenant defines no such
+         * role: a typed error thrown here would reach the host flattened, so the host types it.
+         */
+        async canAssignFor(tenantId, scopeId, principal, roleKey) {
+            await this.ensureMigrations();
+            return this.queue.enqueue(() => this.assignmentBound({ kind: 'principal', id: principal }, tenantId, scopeId, roleKey));
+        }
+        /** Check and grant in one serialized scope task; a refusal never writes a tuple. */
+        async assignScopeRoleBoundedFor(tenantId, scopeId, caller, assignee, roleKey) {
+            await this.ensureMigrations();
+            return this.queue.enqueue(async () => {
+                const bound = await this.assignmentBound({ kind: 'principal', id: caller }, tenantId, scopeId, roleKey);
+                if (bound?.covered) {
+                    this.sql.exec(`INSERT OR REPLACE INTO _substrat_tuples (subject, relation, object, expires_at)
+             VALUES (?, ?, ?, NULL)`, `principal:${assignee}`, `role:${roleKey}`, `scope:${scopeId}`);
+                }
+                return bound;
+            });
+        }
+        /**
+         * §5.1's assignment bound, resolved against the SAME role table the checker
+         * expands — the tenant's projected role, not a vertical's compile-time `ROLES`
+         * array, because the projected role is what assignment would actually confer.
+         * The one resolution both `ctx.canAssign` and `canAssignFor` answer from; `null`
+         * when the tenant defines no such role.
+         */
+        async assignmentBound(subject, tenantId, scopeId, roleKey) {
+            const role = await this.controlPlaneReader().getRole(tenantId, roleKey);
+            if (!role)
+                return null;
+            return this.checker.covers(subject, role.permissions, { tenantId, scopeId });
+        }
         /**
          * Every module this scope holds or has held system authority for, and where each
          * stands (#1674) — the kernel's `systemGrantsStatus`, over this DO's own storage. A
@@ -2933,13 +2993,16 @@ export function defineScopeDO(modules, bareOps) {
                                 .exec('SELECT 1 FROM _substrat_migrations WHERE module_id = ? AND version = ?', moduleId, migration.version)
                                 .toArray()[0];
                             if (!already) {
+                                const started = performance.now();
+                                const before = this.sql.exec('SELECT total_changes() AS n').toArray()[0].n;
                                 // #1898: a migration runs on this DO's own handle, not `ctx.sql`, so the
                                 // spine guard's REFERENCES rule is applied here.
                                 assertNoSpineReference(migration.sql, `migration ${key}`);
                                 for (const stmt of splitSqlStatements(migration.sql)) {
                                     this.sql.exec(stmt);
                                 }
-                                this.sql.exec('INSERT INTO _substrat_migrations (module_id, version, applied_at) VALUES (?, ?, ?)', moduleId, migration.version, new Date().toISOString());
+                                const after = this.sql.exec('SELECT total_changes() AS n').toArray()[0].n;
+                                this.sql.exec('INSERT INTO _substrat_migrations (module_id, version, applied_at, duration_ms, rows_changed) VALUES (?, ?, ?, ?, ?)', moduleId, migration.version, new Date().toISOString(), Math.max(0, Math.round(performance.now() - started)), after - before);
                             }
                         });
                     }
@@ -3349,6 +3412,9 @@ export function defineScopeDO(modules, bareOps) {
             // have added it bare already, and then this ALTER is skipped as a duplicate (#1883).
             // `lint:spine-ddl` refuses one that is not.
             for (const alter of [
+                // #1763: rows written before these fields keep NULL, meaning unrecorded.
+                'ALTER TABLE _substrat_migrations ADD COLUMN duration_ms INTEGER',
+                'ALTER TABLE _substrat_migrations ADD COLUMN rows_changed INTEGER',
                 'ALTER TABLE _substrat_tuples ADD COLUMN revoked_at TEXT',
                 // Executor retry state (#100). The defaults read as "terminal", which is
                 // right for every row already there: each is a completed delivery or a
@@ -3991,17 +4057,12 @@ export function defineScopeDO(modules, bareOps) {
                 }
                 return decision;
             };
-            /**
-             * §5.1's assignment bound, resolved against the SAME role table the checker
-             * expands — the tenant's projected role, not a vertical's compile-time `ROLES`
-             * array, because the projected role is what assignment would actually confer.
-             */
             const runCanAssign = async (roleKey) => {
-                const role = await this.controlPlaneReader().getRole(tenantId, roleKey);
-                if (!role) {
-                    throw substratError('not_found', `no such role in this tenant: ${roleKey}`);
+                const bound = await this.assignmentBound(subject, tenantId, scopeId, roleKey);
+                if (!bound) {
+                    throw unknownRoleError(roleKey);
                 }
-                return checker.covers(subject, role.permissions, { tenantId, scopeId });
+                return bound;
             };
             // ctx.emit's writer, and the kernel's own events' (#1864): one path to the outbox, with the
             // reserved-type refusal applied to module code only. Never handed to module code as-is.