@substrat-run/adapter-cloudflare 0.133.0 → 0.135.0

package/dist/host.js

@@ -1,7 +1,7 @@
 import { isRewindRefusal, REWIND_REFUSED } from './rewind-refusal.js';
-import { delegatedReadParams, fromWireFailure, exportReadInput, exportedBatch, importBatch, importResult, importState, importsOfManifestJson, exportsOfManifestJson, importCursorMove, importCursorMoveAt, importCursorMoved, accessLogEntry, adminLogEntry, opsFailureEntry, opsFailureFingerprint, issueEntry, sweepRunEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunsPayload, modelUsageEntry, attachmentRecord, createTenantInput, identityLink, identityPool, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, registerVerticalInput, vertical as verticalSchema, verticalServingState, verticalChannel, verticalVersion, connection, capabilityExchange, capabilityGrant, principalId, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchOutcome, systemScheduleEntry, systemSwitchRecord, entitlementGrant, entitlementGrantInput, instant, meterReading, subjectRef, createConnectionInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, org as orgSchema, orgMembership, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, delegatedReadRecord, ownerTransferAudit, subjectShredReceipt, connectorDispatchKind, callsOfManifestJson, outboundOfManifestJson, substratError, redrainEventsInput, coverage, peerCoverage, peerGrantsEntry, peerSwitch, peerSwitchOutcome, verticalCaller, verticalResolution, verticalSlug, entityObjectRef, } from '@substrat-run/contracts';
+import { delegatedReadParams, fromWireFailure, exportReadInput, exportedBatch, importBatch, importResult, importState, importsOfManifestJson, exportsOfManifestJson, importCursorMove, importCursorMoveAt, importCursorMoved, accessLogEntry, adminLogEntry, opsFailureEntry, opsFailureFingerprint, issueEntry, sweepRunEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunsPayload, modelUsageEntry, attachmentRecord, createTenantInput, identityLink, identityPool, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, registerVerticalInput, vertical as verticalSchema, verticalServingState, verticalChannel, verticalVersion, connection, capabilityExchange, capabilityGrant, principalId, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchOutcome, systemScheduleEntry, systemSwitchRecord, entitlementGrant, entitlementGrantInput, capabilityFilter, instant, meterReading, subjectRef, createConnectionInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, org as orgSchema, orgMembership, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, delegatedReadRecord, ownerTransferAudit, subjectShredReceipt, connectorDispatchKind, callsOfManifestJson, outboundOfManifestJson, substratError, redrainEventsInput, coverage, peerCoverage, peerGrantsEntry, peerSwitch, peerSwitchOutcome, verticalCaller, verticalResolution, verticalSlug, entityObjectRef, } from '@substrat-run/contracts';
 import { normalizeHostname, toRouteTarget } from './route-resolver.js';
-import { attachmentBlobKey, entitlementDenial, foldMeterReading, parseValidationRecords, resolveScopeRecord, ulid, capabilityTokenHash, checkBecomeInput, plausibleSessionToken, foldModelUsage, backoffAt, resolveRetryPolicy, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, openSealed, ImpersonationRefused, assertSessionUsable, impersonationRowValues, mapImpersonationRow, newImpersonationSession, jobRunOf, runDueJobRuns, startJobRun, globalFetch, assertRedrainWindow, platformRequestOf, undrainedEventsOf, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, withRecorded, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, CrossVerticalRegistry, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, bindExportBreaksOf, bindExportBreakRefusal, collectPeers, peerSeats, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, splitManifestMigrations, unknownRoleError, } from '@substrat-run/kernel';
+import { attachmentBlobKey, attachmentSha256, entitlementDenial, requiredEntitlementFor, foldMeterReading, parseValidationRecords, resolveScopeRecord, ulid, capabilityTokenHash, checkBecomeInput, plausibleSessionToken, foldModelUsage, backoffAt, resolveRetryPolicy, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, openSealed, ImpersonationRefused, assertSessionUsable, impersonationRowValues, mapImpersonationRow, newImpersonationSession, jobRunOf, runDueJobRuns, startJobRun, attachmentTextJob, assertAttachmentExtractors, assertJobRegistrable, isAttachmentTextRun, searchLimit, searchMatchExpression, globalFetch, assertRedrainWindow, platformRequestOf, undrainedEventsOf, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, withRecorded, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, CrossVerticalRegistry, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, bindExportBreaksOf, bindExportBreakRefusal, collectPeers, peerSeats, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, splitManifestMigrations, unknownRoleError, assertRowLimit, assertRowOffset, } from '@substrat-run/kernel';
 import { attributedHost } from '@substrat-run/kernel';
 import { isOrangeToOrange, isUpgradeRequest, LIVE_MODE_HEADER, LIVE_PRINCIPAL_HEADER, LIVE_SCOPE_HEADER, LIVE_SUBSCRIBE_PATH, LIVE_TENANT_HEADER, } from './live-reads.js';
 import { tenantStoreDatabaseName } from './d1.js';
@@ -147,6 +147,8 @@ export class CloudflareScopeHost {
     blobStores;
     /** Worker-side attachment-bucket resolver (#473); undefined ⇒ attachments() refuses. */
     attachmentBuckets;
+    /** The parsers attachment text is extracted with (K-43); the host's own, never imported here. */
+    attachmentExtractors;
     executors = new Map();
     /**
      * `<moduleId>/<job>` → the pass body and its default step policy (#1577). Host
@@ -169,6 +171,8 @@ export class CloudflareScopeHost {
      */
     onBehalfOf = null;
     withdrawn = new Map(); // operation → module
+    /** Operation → who binds it (module, SKU flag, its declared schedules) — the §4.3 gate's
+     *  input, resolved per invoke by the kernel's `requiredEntitlementFor` (#1654). */
     operationEntitlement = new Map();
     /** #574: remote connector write-back for scopes served by another deployment. */
     connectorDelegation;
@@ -208,6 +212,8 @@ export class CloudflareScopeHost {
         this.tenantStores = options.tenantStores;
         this.blobStores = options.blobStores;
         this.attachmentBuckets = options.attachmentBuckets;
+        assertAttachmentExtractors(options.attachmentExtractors ?? []);
+        this.attachmentExtractors = options.attachmentExtractors ?? [];
         this.fetchImpl = options.fetch ?? globalFetch;
         this.connectorCalls = options.connectorCalls ?? noopConnectorCallRecorder;
         this.scopeLocalPermissions = options.scopeLocalPermissions ?? false;
@@ -418,6 +424,8 @@ export class CloudflareScopeHost {
         return this.drainExecutors(tenantId, scopeId, null);
     }
     registerJob(moduleId, name, handler, retry) {
+        // #1575: the kernel's own jobs are dispatched before this registry is read.
+        assertJobRegistrable(moduleId, name);
         const key = `${moduleId}/${name}`;
         if (this.jobs.has(key))
             throw new Error(`job '${key}' is already registered`);
@@ -448,6 +456,23 @@ export class CloudflareScopeHost {
             recordStep: (runId, name, result, attempts, lastError, at) => stub.jobStepRecord(runId, name, result, attempts, lastError, at),
         };
     }
+    /**
+     * The extraction job's adapter half (#1575). The record and the outcome are RPCs to the
+     * scope DO; the bytes are read here, where the per-tenant bucket is bound — the DO never
+     * holds them. No permission gate on any of it: extraction is the kernel's own derivation,
+     * and the person-facing gate is at search.
+     */
+    attachmentTextHandler(tenantId, scopeId) {
+        const stub = this.scopeStub(scopeId);
+        return attachmentTextJob({
+            record: (attachmentId) => stub.attachmentTextSource(attachmentId),
+            bytes: async (record) => (await (await this.resolveAttachmentStore(tenantId)).get(attachmentBlobKey(scopeId, record.id)))?.body ??
+                null,
+            write: (attachmentId, outcome) => stub.attachmentTextRecord(attachmentId, outcome),
+        }, 
+        // K-43: the host's parsers, handed in — this adapter imports none.
+        this.attachmentExtractors);
+    }
     async startJobRun(tenantId, scopeId, input) {
         await this.validateScopeAccess(tenantId, scopeId);
         await this.migrateAndRecord(scopeId);
@@ -458,9 +483,12 @@ export class CloudflareScopeHost {
         // advance, and an archived one's never move again.
         await this.validateScopeAccess(tenantId, scopeId);
         await this.migrateAndRecord(scopeId);
+        // #1575: the kernel's extraction job is this host's own, bound to this scope — no
+        // deployment registers it, and none can shadow it.
+        const attachmentText = { handler: this.attachmentTextHandler(tenantId, scopeId) };
         return runDueJobRuns({
             store: this.jobStore(scopeId),
-            handlerFor: (run) => this.jobs.get(`${run.module_id}/${run.job}`),
+            handlerFor: (run) => isAttachmentTextRun(run) ? attachmentText : this.jobs.get(`${run.module_id}/${run.job}`),
             now: () => new Date().toISOString(),
             openScope: (run) => this.getSystemScope(run.module_id, tenantId, scopeId),
             maxPasses: options?.maxPasses,
@@ -605,6 +633,15 @@ export class CloudflareScopeHost {
     async summarizeDenialsLocal(scopeId, filter) {
         return this.scopeStub(scopeId).summarizeDenials(filter);
     }
+    /**
+     * The operator's capability read's CP-less path (#1686) — the denial log's trust line: the
+     * directory rows live in the scope's own DO, in the vertical's deployment, reachable only
+     * through its platform-gated `/internal/capabilities`; the K-3 check and the K-24 entry are
+     * the control plane's, made before it calls. Records only — the DO's query selects no hash.
+     */
+    async listCapabilitiesLocal(scopeId, filter) {
+        return this.scopeStub(scopeId).listCapabilities(filter);
+    }
     /**
      * Copy one scope's data into a fresh scope DO, entirely within THIS deployment —
      * the data half of an orchestrated snapshot (preview-and-snapshots.md §9). Like the
@@ -819,9 +856,14 @@ export class CloudflareScopeHost {
             throw new Error(`${manifest.id} declares operationInputs for unbound operation(s): ` +
                 `${unboundInputs.sort().join(', ')} — a schema on nothing reads as a parse that is not there`);
         }
+        const binding = {
+            moduleId: manifest.id,
+            entitlementKey: manifest.entitlementKey,
+            scheduledOperations: new Set((manifest.schedules ?? []).map((sch) => sch.operation)),
+        };
         for (const name of Object.keys(registration.operations ?? {})) {
             this.bindOperation(name);
-            this.operationEntitlement.set(name, manifest.entitlementKey);
+            this.operationEntitlement.set(name, binding);
         }
     }
     defineOperation(name, _handler) {
@@ -1088,6 +1130,8 @@ export class CloudflareScopeHost {
                 }),
                 list: notDelegated('list'),
                 remove: notDelegated('remove'),
+                // #1575: undelegated for `list`'s reason — a connector picks a document by id.
+                search: notDelegated('search'),
             };
         }
         await this.migrateAndRecord(scopeId);
@@ -1136,6 +1180,12 @@ export class CloudflareScopeHost {
                 remove: async (attachmentId) => unwrapCapabilityReply(await stub.capabilityAttachmentRefuseWrite(hash, tenantId, scopeId, 'attachments.remove', {
                     attachmentId,
                 })),
+                search: async (term, options) => {
+                    // Judged here too, so a short term reaches the caller as `SearchTermTooShort`
+                    // rather than as a message that crossed the RPC boundary. The DO judges again.
+                    searchMatchExpression(term, 'prefix');
+                    return unwrapCapabilityReply(await stub.capabilityAttachmentSearch(term, searchLimit(options?.limit), hash, tenantId, scopeId));
+                },
             };
         }
         const connectionId = 'connectionId' in subject ? subject.connectionId : undefined;
@@ -1156,7 +1206,7 @@ export class CloudflareScopeHost {
                     filename: input.filename,
                     contentType: input.contentType,
                     size: input.body.byteLength,
-                    sha256: await sha256Hex(input.body),
+                    sha256: await attachmentSha256(input.body),
                     visibility: input.visibility,
                     createdBy,
                     createdAt: new Date().toISOString(),
@@ -1183,6 +1233,14 @@ export class CloudflareScopeHost {
                     await store.delete(attachmentBlobKey(scopeId, removed.id)).catch(() => { });
                 return removed;
             },
+            search: async (term, options) => {
+                if (forEvent) {
+                    // The delivery-admitted surface reads the ONE attachment its delivery names.
+                    throw new Error('attachments.search is not available on a delivery-scoped surface');
+                }
+                searchMatchExpression(term, 'prefix');
+                return unwrapCapabilityReply(await stub.attachmentSearch(term, searchLimit(options?.limit), asPrincipalId, tenantId, scopeId, connectionId));
+            },
         };
     }
     /**
@@ -1196,7 +1254,7 @@ export class CloudflareScopeHost {
             throw new Error(`attachment ${record.id}: bytes missing from the blob store — the metadata row ` +
                 `survived something the object did not (rewind/reap); see the #473 integrity notes`);
         }
-        if ((await sha256Hex(obj.body)) !== record.sha256) {
+        if ((await attachmentSha256(obj.body)) !== record.sha256) {
             throw new Error(`attachment ${record.id}: bytes do not match the recorded sha256`);
         }
         return { record, body: obj.body, contentType: obj.contentType ?? record.contentType };
@@ -1806,7 +1864,13 @@ export class CloudflareScopeHost {
                 // (`cp.tenantHoldsEntitlement`); for a hosted/CP-less scope that call is a trusting
                 // no-op, so the SAME `requiredKey` is passed to the DO, which fails closed against
                 // its PROJECTED entitlements (#304). One or the other enforces, never neither.
-                const requiredKey = operationEntitlement.get(operation);
+                //
+                // EXCEPTION (#1654): a module's own declared schedule, through this system door,
+                // demands no SKU — its `system:<moduleId>` grant is the switch, as it already is for
+                // permissions (#383). `requiredEntitlementFor` holds the whole rule and why; it
+                // answers `undefined` there, so neither the coordinator nor the DO asks. Every other
+                // door passes no `systemModuleId` and is gated exactly as before.
+                const requiredKey = requiredEntitlementFor(operation, operationEntitlement.get(operation), systemModuleId);
                 if (requiredKey && !(await cp.tenantHoldsEntitlement(tenantId, requiredKey))) {
                     // Required AND held (#691) — a second CP read, but only on the denial path.
                     const now = new Date().toISOString();
@@ -2040,7 +2104,7 @@ export class CloudflareScopeHost {
             // lets a LISTED vertical's builder still preview their own new code (marketplace-publish.md
             // §2; issue #509 ask (d)). Every other scope kind keeps the refusal.
             if (v.admission !== 'admitted' && scope.kind !== 'preview') {
-                throw new Error(`version ${versionId} is ${v.admission}, not admitted — it cannot be bound to a scope`);
+                throw substratError('conflict', `version ${versionId} is ${v.admission}, not admitted — it cannot be bound to a scope`);
             }
             return { v, scope };
         };
@@ -2831,7 +2895,7 @@ export class CloudflareScopeHost {
                         return;
                     }
                     if (existing.owner_tenant !== parsed.ownerTenant) {
-                        throw new Error(`vertical '${parsed.slug}' is owned by ${existing.owner_tenant ?? 'the platform'}, not ${parsed.ownerTenant ?? 'the platform'}`);
+                        throw substratError('conflict', `vertical '${parsed.slug}' is owned by ${existing.owner_tenant ?? 'the platform'}, not ${parsed.ownerTenant ?? 'the platform'}`);
                     }
                     throw new Error(`vertical '${parsed.slug}' is already registered as ${existing.source}`);
                 }
@@ -2898,7 +2962,7 @@ export class CloudflareScopeHost {
                     const prod = await this.cp.readChannel(slug, 'prod');
                     const prodVersion = prod ? await this.cp.readVersion(prod.version_id) : undefined;
                     if (prodVersion?.admission_note === AUTO_ADMISSION_NOTE) {
-                        throw new Error(`vertical '${slug}' prod version ${prodVersion.id} is auto-admitted (private self-serve) — ` +
+                        throw substratError('conflict', `vertical '${slug}' prod version ${prodVersion.id} is auto-admitted (private self-serve) — ` +
                             `a staff admit must vouch for it before listing`);
                     }
                 }
@@ -2990,7 +3054,7 @@ export class CloudflareScopeHost {
                 if (!v)
                     throw substratError('not_found', `unknown version ${versionId}`);
                 if (v.admission === 'admitted') {
-                    throw new Error(`version ${versionId} is already admitted — it may be bound`);
+                    throw substratError('conflict', `version ${versionId} is already admitted — it may be bound`);
                 }
                 if (v.admission === 'rejected')
                     return;
@@ -3002,10 +3066,10 @@ export class CloudflareScopeHost {
                 if (!incoming)
                     throw substratError('not_found', `unknown version ${versionId}`);
                 if (incoming.vertical_slug !== verticalSlug) {
-                    throw new Error(`version ${versionId} belongs to '${incoming.vertical_slug}'`);
+                    throw substratError('conflict', `version ${versionId} belongs to '${incoming.vertical_slug}'`);
                 }
                 if (incoming.admission !== 'admitted') {
-                    throw new Error(`version ${versionId} is ${incoming.admission}, not admitted — it cannot be promoted`);
+                    throw substratError('conflict', `version ${versionId} is ${incoming.admission}, not admitted — it cannot be promoted`);
                 }
                 const current = await this.cp.readChannel(verticalSlug, channel);
                 const outgoing = current ? await this.cp.readVersion(current.version_id) : undefined;
@@ -3441,7 +3505,7 @@ export class CloudflareScopeHost {
             moveImportCursor: async (actor, tenantId, scopeId, raw) => this.moveImportCursorAt(actor, tenantId, scopeId, raw),
             readUndrainedEvents: async (actor, tenantId, scopeId, limit) => {
                 const record = await this.scopeRecordForRead(tenantId, scopeId);
-                const bounded = Math.min(Math.max(limit ?? 200, 1), 1000);
+                const bounded = Math.min(assertRowLimit('limit', limit ?? 200), 1000);
                 // #1334: on the shared control plane the scope's outbox is in its vertical's
                 // deployment, and this host's own namespace is the module-less placeholder —
                 // reading it would construct an empty DO and answer "nothing to ship". The
@@ -3602,6 +3666,9 @@ export class CloudflareScopeHost {
             },
             readScopeTable: async (actor, tenantId, scopeId, input) => {
                 await this.scopeRecordForRead(tenantId, scopeId);
+                // Checked here as well as in the ScopeDO, so the refusal keeps its code across the hop.
+                assertRowLimit('limit', input.limit);
+                assertRowOffset('offset', input.offset);
                 const page = await this.scopeStub(scopeId).introspectTable(input.table, input.limit, input.offset);
                 await this.recordAccess(actor, 'readScopeTable', { tenantId, scopeId }, { table: input.table, limit: page.limit, offset: page.offset }, page.rows.length);
                 return page;
@@ -3615,6 +3682,26 @@ export class CloudflareScopeHost {
                 await this.recordAccess(actor, 'listDenials', { tenantId, scopeId }, filter ?? null, rows.length);
                 return rows;
             },
+            // #1686: the operator's capability read. K-3 on the directory before the DO, like the
+            // denial log. On the shared control plane a scope a vertical's own deployment serves
+            // holds its storage THERE, and this namespace holds a placeholder: the control-plane
+            // API asks the vertical (`listCapabilitiesLocal`), so this branch is the co-located one.
+            listCapabilities: async (actor, tenantId, scopeId, filter) => {
+                // Parsed here too: a typed refusal thrown inside the DO arrives as a bare message.
+                const parsed = capabilityFilter.parse(filter ?? {});
+                const rec = await this.scopeRecordForRead(tenantId, scopeId);
+                this.assertServedHere(rec, scopeId, 'listCapabilities');
+                const page = await this.scopeStub(scopeId).listCapabilities(parsed);
+                await this.recordAccess(actor, 'listCapabilities', { tenantId, scopeId }, filter ?? null, page.entries.length);
+                return page;
+            },
+            listRefusals: async (actor, tenantId, scopeId, filter) => {
+                // #1745: the denial log's discipline — K-3 on the directory before the DO is reached.
+                await this.scopeRecordForRead(tenantId, scopeId);
+                const rows = await this.scopeStub(scopeId).listRefusals(filter);
+                await this.recordAccess(actor, 'listRefusals', { tenantId, scopeId }, filter ?? null, rows.length);
+                return rows;
+            },
             summarizeDenials: async (actor, tenantId, scopeId, filter) => {
                 await this.scopeRecordForRead(tenantId, scopeId);
                 const summary = await this.scopeStub(scopeId).summarizeDenials(filter);
@@ -3783,7 +3870,20 @@ export class CloudflareScopeHost {
                         `_substrat_job_runs or _substrat_job_steps — erasing now would destroy the subject ` +
                         `key while leaving their data in the job-run tables. Redeploy the vertical and re-run.`);
                 }
-                const { events: eventsRedacted, intents: intentsRedacted, jobRuns: jobRunsRedacted } = redacted;
+                // A DO from before the free-text half (#1632): it never looked at the idempotency
+                // ledger or a queued sweep record, and cannot name the intents the directory's drain
+                // failures quote. Refused before the key, for the reason above.
+                if (!('idempotencyResults' in redacted) ||
+                    typeof redacted.idempotencyResults !== 'number' ||
+                    !Array.isArray(redacted.intentIds)) {
+                    throw substratError('unavailable', `scope ${scopeId} runs a ScopeDO whose redaction does not reach _substrat_idempotency ` +
+                        `or a queued sweep-runs intent — erasing now would destroy the subject key while ` +
+                        `leaving their data in those rows. Redeploy the vertical and re-run.`);
+                }
+                const { events: eventsRedacted, intents: intentsRedacted, jobRuns: jobRunsRedacted, idempotencyResults, intentIds, } = redacted;
+                // The directory's failure text (#1632) — a drain failure quoting one of those intents,
+                // an issue's exemplar, a sweep record's error. Still before the key.
+                await this.cp.redactSubjectText({ tenantId, scopeId, subjectId, intentIds });
                 const at = new Date().toISOString();
                 const { existed } = await this.subjectKeysFor(tenantId, scopeId).destroy(subjectId, at);
                 const receipt = subjectShredReceipt.parse({
@@ -3800,7 +3900,7 @@ export class CloudflareScopeHost {
                 await this.recordAdmin(actor, 'shredSubject', { tenantId, scopeId }, null, receipt);
                 // BOTH counts: the access log's number is "how much evidence this destroyed", and
                 // an intent payload is a whole event's worth of it.
-                await this.recordAccess(actor, 'shredSubject', { tenantId, scopeId }, { subjectId }, eventsRedacted + intentsRedacted + jobRunsRedacted);
+                await this.recordAccess(actor, 'shredSubject', { tenantId, scopeId }, { subjectId }, eventsRedacted + intentsRedacted + jobRunsRedacted + idempotencyResults);
                 return receipt;
             },
             // -- impersonation (K-42, #868) ----------------------------------------
@@ -4195,7 +4295,8 @@ export class CloudflareScopeHost {
                 return drained;
             },
             pruneAccessLog: async (actor, limit) => {
-                const pruned = await this.cp.pruneAccessLog(limit);
+                // Checked here as well as in the directory, so the refusal keeps its code across the hop.
+                const pruned = await this.cp.pruneAccessLog(assertRowLimit('limit', limit));
                 if (pruned > 0) {
                     // The payload is the APPLIED state, so it belongs in `after` (contracts'
                     // adminLogEntry: before = prior state, after = the applied payload) — the
@@ -4308,6 +4409,8 @@ export class CloudflareScopeHost {
                 await this.recordAccess(actor, 'listSweepRuns', { tenantId: filter?.tenantId ?? null, scopeId: filter?.scopeId ?? null }, filter, rows.length);
                 return rows.map((r) => sweepRunEntry.parse(r));
             },
+            // Checked here as well as in the directory, so the refusal keeps its code across the hop.
+            pruneTelemetry: async (_actor, limit) => this.cp.pruneTelemetry(assertRowLimit('limit', limit)),
             listIssues: async (actor, filter) => {
                 const rows = await this.cp.listIssues({
                     status: filter?.status,
@@ -5534,11 +5637,6 @@ export class CloudflareScopeHost {
         return importsOfManifestJson(v.manifest_json);
     }
 }
-/** SHA-256 hex of an attachment's bytes — what `AttachmentRecord.sha256` holds. */
-async function sha256Hex(body) {
-    const digest = await crypto.subtle.digest('SHA-256', body);
-    return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, '0')).join('');
-}
 /** A ledger row -> the wire entry, the attribution re-nested (#1054). */
 function modelUsageEntryOf(r) {
     return modelUsageEntry.parse({