@substrat-run/adapter-cloudflare 0.132.1 → 0.134.0

package/dist/host.js

@@ -1,7 +1,7 @@
 import { isRewindRefusal, REWIND_REFUSED } from './rewind-refusal.js';
 import { delegatedReadParams, fromWireFailure, exportReadInput, exportedBatch, importBatch, importResult, importState, importsOfManifestJson, exportsOfManifestJson, importCursorMove, importCursorMoveAt, importCursorMoved, accessLogEntry, adminLogEntry, opsFailureEntry, opsFailureFingerprint, issueEntry, sweepRunEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunsPayload, modelUsageEntry, attachmentRecord, createTenantInput, identityLink, identityPool, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, registerVerticalInput, vertical as verticalSchema, verticalServingState, verticalChannel, verticalVersion, connection, capabilityExchange, capabilityGrant, principalId, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchOutcome, systemScheduleEntry, systemSwitchRecord, entitlementGrant, entitlementGrantInput, instant, meterReading, subjectRef, createConnectionInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, org as orgSchema, orgMembership, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, delegatedReadRecord, ownerTransferAudit, subjectShredReceipt, connectorDispatchKind, callsOfManifestJson, outboundOfManifestJson, substratError, redrainEventsInput, coverage, peerCoverage, peerGrantsEntry, peerSwitch, peerSwitchOutcome, verticalCaller, verticalResolution, verticalSlug, entityObjectRef, } from '@substrat-run/contracts';
 import { normalizeHostname, toRouteTarget } from './route-resolver.js';
-import { attachmentBlobKey, entitlementDenial, foldMeterReading, parseValidationRecords, resolveScopeRecord, ulid, capabilityTokenHash, checkBecomeInput, plausibleSessionToken, foldModelUsage, backoffAt, resolveRetryPolicy, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, openSealed, ImpersonationRefused, assertSessionUsable, impersonationRowValues, mapImpersonationRow, newImpersonationSession, jobRunOf, runDueJobRuns, startJobRun, globalFetch, assertRedrainWindow, platformRequestOf, undrainedEventsOf, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, withRecorded, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, CrossVerticalRegistry, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, bindExportBreaksOf, bindExportBreakRefusal, collectPeers, peerSeats, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, splitManifestMigrations, unknownRoleError, } from '@substrat-run/kernel';
+import { attachmentBlobKey, attachmentSha256, entitlementDenial, foldMeterReading, parseValidationRecords, resolveScopeRecord, ulid, capabilityTokenHash, checkBecomeInput, plausibleSessionToken, foldModelUsage, backoffAt, resolveRetryPolicy, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, openSealed, ImpersonationRefused, assertSessionUsable, impersonationRowValues, mapImpersonationRow, newImpersonationSession, jobRunOf, runDueJobRuns, startJobRun, attachmentTextJob, assertAttachmentExtractors, assertJobRegistrable, isAttachmentTextRun, searchLimit, searchMatchExpression, globalFetch, assertRedrainWindow, platformRequestOf, undrainedEventsOf, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, withRecorded, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, CrossVerticalRegistry, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, bindExportBreaksOf, bindExportBreakRefusal, collectPeers, peerSeats, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, splitManifestMigrations, unknownRoleError, assertRowLimit, assertRowOffset, } from '@substrat-run/kernel';
 import { attributedHost } from '@substrat-run/kernel';
 import { isOrangeToOrange, isUpgradeRequest, LIVE_MODE_HEADER, LIVE_PRINCIPAL_HEADER, LIVE_SCOPE_HEADER, LIVE_SUBSCRIBE_PATH, LIVE_TENANT_HEADER, } from './live-reads.js';
 import { tenantStoreDatabaseName } from './d1.js';
@@ -110,6 +110,7 @@ export class CloudflareScopeHost {
     admin;
     scopeNs;
     cp;
+    servicePrincipals;
     /** No control plane bound — `this.cp` is the throwing null object (Phase 3, CP-less). */
     cpLess;
     /** Project + evaluate permissions scope-locally (scope-local-permissions.md). */
@@ -146,6 +147,8 @@ export class CloudflareScopeHost {
     blobStores;
     /** Worker-side attachment-bucket resolver (#473); undefined ⇒ attachments() refuses. */
     attachmentBuckets;
+    /** The parsers attachment text is extracted with (K-43); the host's own, never imported here. */
+    attachmentExtractors;
     executors = new Map();
     /**
      * `<moduleId>/<job>` → the pass body and its default step policy (#1577). Host
@@ -202,10 +205,13 @@ export class CloudflareScopeHost {
      * request after that returned 1101 in production.
      */
     constructor(options) {
+        this.servicePrincipals = options.servicePrincipals;
         this.secretBox = options.secretBox ?? unconfiguredSecretBox;
         this.tenantStores = options.tenantStores;
         this.blobStores = options.blobStores;
         this.attachmentBuckets = options.attachmentBuckets;
+        assertAttachmentExtractors(options.attachmentExtractors ?? []);
+        this.attachmentExtractors = options.attachmentExtractors ?? [];
         this.fetchImpl = options.fetch ?? globalFetch;
         this.connectorCalls = options.connectorCalls ?? noopConnectorCallRecorder;
         this.scopeLocalPermissions = options.scopeLocalPermissions ?? false;
@@ -416,6 +422,8 @@ export class CloudflareScopeHost {
         return this.drainExecutors(tenantId, scopeId, null);
     }
     registerJob(moduleId, name, handler, retry) {
+        // #1575: the kernel's own jobs are dispatched before this registry is read.
+        assertJobRegistrable(moduleId, name);
         const key = `${moduleId}/${name}`;
         if (this.jobs.has(key))
             throw new Error(`job '${key}' is already registered`);
@@ -446,6 +454,23 @@ export class CloudflareScopeHost {
             recordStep: (runId, name, result, attempts, lastError, at) => stub.jobStepRecord(runId, name, result, attempts, lastError, at),
         };
     }
+    /**
+     * The extraction job's adapter half (#1575). The record and the outcome are RPCs to the
+     * scope DO; the bytes are read here, where the per-tenant bucket is bound — the DO never
+     * holds them. No permission gate on any of it: extraction is the kernel's own derivation,
+     * and the person-facing gate is at search.
+     */
+    attachmentTextHandler(tenantId, scopeId) {
+        const stub = this.scopeStub(scopeId);
+        return attachmentTextJob({
+            record: (attachmentId) => stub.attachmentTextSource(attachmentId),
+            bytes: async (record) => (await (await this.resolveAttachmentStore(tenantId)).get(attachmentBlobKey(scopeId, record.id)))?.body ??
+                null,
+            write: (attachmentId, outcome) => stub.attachmentTextRecord(attachmentId, outcome),
+        }, 
+        // K-43: the host's parsers, handed in — this adapter imports none.
+        this.attachmentExtractors);
+    }
     async startJobRun(tenantId, scopeId, input) {
         await this.validateScopeAccess(tenantId, scopeId);
         await this.migrateAndRecord(scopeId);
@@ -456,9 +481,12 @@ export class CloudflareScopeHost {
         // advance, and an archived one's never move again.
         await this.validateScopeAccess(tenantId, scopeId);
         await this.migrateAndRecord(scopeId);
+        // #1575: the kernel's extraction job is this host's own, bound to this scope — no
+        // deployment registers it, and none can shadow it.
+        const attachmentText = { handler: this.attachmentTextHandler(tenantId, scopeId) };
         return runDueJobRuns({
             store: this.jobStore(scopeId),
-            handlerFor: (run) => this.jobs.get(`${run.module_id}/${run.job}`),
+            handlerFor: (run) => isAttachmentTextRun(run) ? attachmentText : this.jobs.get(`${run.module_id}/${run.job}`),
             now: () => new Date().toISOString(),
             openScope: (run) => this.getSystemScope(run.module_id, tenantId, scopeId),
             maxPasses: options?.maxPasses,
@@ -1086,6 +1114,8 @@ export class CloudflareScopeHost {
                 }),
                 list: notDelegated('list'),
                 remove: notDelegated('remove'),
+                // #1575: undelegated for `list`'s reason — a connector picks a document by id.
+                search: notDelegated('search'),
             };
         }
         await this.migrateAndRecord(scopeId);
@@ -1134,6 +1164,12 @@ export class CloudflareScopeHost {
                 remove: async (attachmentId) => unwrapCapabilityReply(await stub.capabilityAttachmentRefuseWrite(hash, tenantId, scopeId, 'attachments.remove', {
                     attachmentId,
                 })),
+                search: async (term, options) => {
+                    // Judged here too, so a short term reaches the caller as `SearchTermTooShort`
+                    // rather than as a message that crossed the RPC boundary. The DO judges again.
+                    searchMatchExpression(term, 'prefix');
+                    return unwrapCapabilityReply(await stub.capabilityAttachmentSearch(term, searchLimit(options?.limit), hash, tenantId, scopeId));
+                },
             };
         }
         const connectionId = 'connectionId' in subject ? subject.connectionId : undefined;
@@ -1154,7 +1190,7 @@ export class CloudflareScopeHost {
                     filename: input.filename,
                     contentType: input.contentType,
                     size: input.body.byteLength,
-                    sha256: await sha256Hex(input.body),
+                    sha256: await attachmentSha256(input.body),
                     visibility: input.visibility,
                     createdBy,
                     createdAt: new Date().toISOString(),
@@ -1181,6 +1217,14 @@ export class CloudflareScopeHost {
                     await store.delete(attachmentBlobKey(scopeId, removed.id)).catch(() => { });
                 return removed;
             },
+            search: async (term, options) => {
+                if (forEvent) {
+                    // The delivery-admitted surface reads the ONE attachment its delivery names.
+                    throw new Error('attachments.search is not available on a delivery-scoped surface');
+                }
+                searchMatchExpression(term, 'prefix');
+                return unwrapCapabilityReply(await stub.attachmentSearch(term, searchLimit(options?.limit), asPrincipalId, tenantId, scopeId, connectionId));
+            },
         };
     }
     /**
@@ -1194,7 +1238,7 @@ export class CloudflareScopeHost {
             throw new Error(`attachment ${record.id}: bytes missing from the blob store — the metadata row ` +
                 `survived something the object did not (rewind/reap); see the #473 integrity notes`);
         }
-        if ((await sha256Hex(obj.body)) !== record.sha256) {
+        if ((await attachmentSha256(obj.body)) !== record.sha256) {
             throw new Error(`attachment ${record.id}: bytes do not match the recorded sha256`);
         }
         return { record, body: obj.body, contentType: obj.contentType ?? record.contentType };
@@ -2038,7 +2082,7 @@ export class CloudflareScopeHost {
             // lets a LISTED vertical's builder still preview their own new code (marketplace-publish.md
             // §2; issue #509 ask (d)). Every other scope kind keeps the refusal.
             if (v.admission !== 'admitted' && scope.kind !== 'preview') {
-                throw new Error(`version ${versionId} is ${v.admission}, not admitted — it cannot be bound to a scope`);
+                throw substratError('conflict', `version ${versionId} is ${v.admission}, not admitted — it cannot be bound to a scope`);
             }
             return { v, scope };
         };
@@ -2829,7 +2873,7 @@ export class CloudflareScopeHost {
                         return;
                     }
                     if (existing.owner_tenant !== parsed.ownerTenant) {
-                        throw new Error(`vertical '${parsed.slug}' is owned by ${existing.owner_tenant ?? 'the platform'}, not ${parsed.ownerTenant ?? 'the platform'}`);
+                        throw substratError('conflict', `vertical '${parsed.slug}' is owned by ${existing.owner_tenant ?? 'the platform'}, not ${parsed.ownerTenant ?? 'the platform'}`);
                     }
                     throw new Error(`vertical '${parsed.slug}' is already registered as ${existing.source}`);
                 }
@@ -2896,7 +2940,7 @@ export class CloudflareScopeHost {
                     const prod = await this.cp.readChannel(slug, 'prod');
                     const prodVersion = prod ? await this.cp.readVersion(prod.version_id) : undefined;
                     if (prodVersion?.admission_note === AUTO_ADMISSION_NOTE) {
-                        throw new Error(`vertical '${slug}' prod version ${prodVersion.id} is auto-admitted (private self-serve) — ` +
+                        throw substratError('conflict', `vertical '${slug}' prod version ${prodVersion.id} is auto-admitted (private self-serve) — ` +
                             `a staff admit must vouch for it before listing`);
                     }
                 }
@@ -3003,7 +3047,7 @@ export class CloudflareScopeHost {
                     throw new Error(`version ${versionId} belongs to '${incoming.vertical_slug}'`);
                 }
                 if (incoming.admission !== 'admitted') {
-                    throw new Error(`version ${versionId} is ${incoming.admission}, not admitted — it cannot be promoted`);
+                    throw substratError('conflict', `version ${versionId} is ${incoming.admission}, not admitted — it cannot be promoted`);
                 }
                 const current = await this.cp.readChannel(verticalSlug, channel);
                 const outgoing = current ? await this.cp.readVersion(current.version_id) : undefined;
@@ -3114,6 +3158,9 @@ export class CloudflareScopeHost {
             },
             bindScopeVersion: async (actor, tenantId, scopeId, versionId, opts) => {
                 const { v, scope } = await bindTarget(tenantId, scopeId, versionId);
+                if (opts?.expectedVersionId !== undefined && scope.vertical_version_id !== opts.expectedVersionId) {
+                    throw substratError('precondition_failed', 'scope binding changed; reload the scope and retry');
+                }
                 const ack = bindAcknowledgement.parse(opts?.acknowledge ?? {});
                 // #1756: an export an app in this tenant imports, dropped or re-versioned by what this
                 // scope would run. Before the snapshot, so a refused bind leaves nothing behind.
@@ -3130,9 +3177,10 @@ export class CloudflareScopeHost {
                         await this.snapshotScope(actor, tenantId, scopeId);
                     }
                 }
-                await this.cp.bindScopeVersion(scopeId, versionId, v.vertical_slug);
+                await this.cp.bindScopeVersion(scopeId, versionId, v.vertical_slug, opts?.expectedVersionId);
                 await this.recordAdmin(actor, 'bindScopeVersion', { tenantId, scopeId }, null, {
                     versionId, vertical: v.vertical_slug, version: v.version,
+                    ...(opts?.expectedVersionId !== undefined ? { expectedVersionId: opts.expectedVersionId } : {}),
                     ...(ack.exportBreak ? { acknowledged: ack } : {}),
                 });
             },
@@ -3435,7 +3483,7 @@ export class CloudflareScopeHost {
             moveImportCursor: async (actor, tenantId, scopeId, raw) => this.moveImportCursorAt(actor, tenantId, scopeId, raw),
             readUndrainedEvents: async (actor, tenantId, scopeId, limit) => {
                 const record = await this.scopeRecordForRead(tenantId, scopeId);
-                const bounded = Math.min(Math.max(limit ?? 200, 1), 1000);
+                const bounded = Math.min(assertRowLimit('limit', limit ?? 200), 1000);
                 // #1334: on the shared control plane the scope's outbox is in its vertical's
                 // deployment, and this host's own namespace is the module-less placeholder —
                 // reading it would construct an empty DO and answer "nothing to ship". The
@@ -3596,6 +3644,9 @@ export class CloudflareScopeHost {
             },
             readScopeTable: async (actor, tenantId, scopeId, input) => {
                 await this.scopeRecordForRead(tenantId, scopeId);
+                // Checked here as well as in the ScopeDO, so the refusal keeps its code across the hop.
+                assertRowLimit('limit', input.limit);
+                assertRowOffset('offset', input.offset);
                 const page = await this.scopeStub(scopeId).introspectTable(input.table, input.limit, input.offset);
                 await this.recordAccess(actor, 'readScopeTable', { tenantId, scopeId }, { table: input.table, limit: page.limit, offset: page.offset }, page.rows.length);
                 return page;
@@ -3777,7 +3828,20 @@ export class CloudflareScopeHost {
                         `_substrat_job_runs or _substrat_job_steps — erasing now would destroy the subject ` +
                         `key while leaving their data in the job-run tables. Redeploy the vertical and re-run.`);
                 }
-                const { events: eventsRedacted, intents: intentsRedacted, jobRuns: jobRunsRedacted } = redacted;
+                // A DO from before the free-text half (#1632): it never looked at the idempotency
+                // ledger or a queued sweep record, and cannot name the intents the directory's drain
+                // failures quote. Refused before the key, for the reason above.
+                if (!('idempotencyResults' in redacted) ||
+                    typeof redacted.idempotencyResults !== 'number' ||
+                    !Array.isArray(redacted.intentIds)) {
+                    throw substratError('unavailable', `scope ${scopeId} runs a ScopeDO whose redaction does not reach _substrat_idempotency ` +
+                        `or a queued sweep-runs intent — erasing now would destroy the subject key while ` +
+                        `leaving their data in those rows. Redeploy the vertical and re-run.`);
+                }
+                const { events: eventsRedacted, intents: intentsRedacted, jobRuns: jobRunsRedacted, idempotencyResults, intentIds, } = redacted;
+                // The directory's failure text (#1632) — a drain failure quoting one of those intents,
+                // an issue's exemplar, a sweep record's error. Still before the key.
+                await this.cp.redactSubjectText({ tenantId, scopeId, subjectId, intentIds });
                 const at = new Date().toISOString();
                 const { existed } = await this.subjectKeysFor(tenantId, scopeId).destroy(subjectId, at);
                 const receipt = subjectShredReceipt.parse({
@@ -3794,7 +3858,7 @@ export class CloudflareScopeHost {
                 await this.recordAdmin(actor, 'shredSubject', { tenantId, scopeId }, null, receipt);
                 // BOTH counts: the access log's number is "how much evidence this destroyed", and
                 // an intent payload is a whole event's worth of it.
-                await this.recordAccess(actor, 'shredSubject', { tenantId, scopeId }, { subjectId }, eventsRedacted + intentsRedacted + jobRunsRedacted);
+                await this.recordAccess(actor, 'shredSubject', { tenantId, scopeId }, { subjectId }, eventsRedacted + intentsRedacted + jobRunsRedacted + idempotencyResults);
                 return receipt;
             },
             // -- impersonation (K-42, #868) ----------------------------------------
@@ -4189,7 +4253,8 @@ export class CloudflareScopeHost {
                 return drained;
             },
             pruneAccessLog: async (actor, limit) => {
-                const pruned = await this.cp.pruneAccessLog(limit);
+                // Checked here as well as in the directory, so the refusal keeps its code across the hop.
+                const pruned = await this.cp.pruneAccessLog(assertRowLimit('limit', limit));
                 if (pruned > 0) {
                     // The payload is the APPLIED state, so it belongs in `after` (contracts'
                     // adminLogEntry: before = prior state, after = the applied payload) — the
@@ -4302,6 +4367,8 @@ export class CloudflareScopeHost {
                 await this.recordAccess(actor, 'listSweepRuns', { tenantId: filter?.tenantId ?? null, scopeId: filter?.scopeId ?? null }, filter, rows.length);
                 return rows.map((r) => sweepRunEntry.parse(r));
             },
+            // Checked here as well as in the directory, so the refusal keeps its code across the hop.
+            pruneTelemetry: async (_actor, limit) => this.cp.pruneTelemetry(assertRowLimit('limit', limit)),
             listIssues: async (actor, filter) => {
                 const rows = await this.cp.listIssues({
                     status: filter?.status,
@@ -5067,6 +5134,7 @@ export class CloudflareScopeHost {
      * from its own storage. No tenant-level tuples, no control plane.
      */
     async provisionScopeLocal(input) {
+        const services = await this.servicePrincipals?.(input.tenantId, input.scopeId);
         const stub = this.scopeStub(input.scopeId);
         await this.migrateAndRecord(input.scopeId); // create the module tables (setMigrationState no-ops on a null CP)
         const switchedOff = await stub.applyProjection(input.tenantId, input.roles.map((r) => ({ role_key: r.key, permissions: JSON.stringify(r.permissions), source: r.source })), [], // no tenant-level tuples — a CP-less vertical grants at scope level only
@@ -5163,7 +5231,7 @@ export class CloudflareScopeHost {
         // scope this call provisions — the one the seat's tuples name.
         input.switchedOff
             ? { scopeId: input.scopeId, moduleIds: input.switchedOff, at: new Date().toISOString() }
-            : undefined);
+            : undefined, services?.map((id) => `principal:${id}`));
         return input.switchedOff ? { switchedOff } : {};
     }
     /**
@@ -5527,11 +5595,6 @@ export class CloudflareScopeHost {
         return importsOfManifestJson(v.manifest_json);
     }
 }
-/** SHA-256 hex of an attachment's bytes — what `AttachmentRecord.sha256` holds. */
-async function sha256Hex(body) {
-    const digest = await crypto.subtle.digest('SHA-256', body);
-    return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, '0')).join('');
-}
 /** A ledger row -> the wire entry, the attribution re-nested (#1054). */
 function modelUsageEntryOf(r) {
     return modelUsageEntry.parse({