@substrat-run/adapter-cloudflare 0.138.0 → 0.139.0

package/dist/host.js

@@ -1,10 +1,10 @@
 import { env as ambientEnv } from 'cloudflare:workers';
 import { isRewindRefusal, REWIND_REFUSED } from './rewind-refusal.js';
 import { isSystemDoorMoved, SYSTEM_DOOR_MOVED, SYSTEM_DOOR_REGATES } from './system-door.js';
-import { delegatedReadParams, operationSeriesCount, fromWireFailure, exportReadInput, exportedBatch, importBatch, importResult, importState, importsOfManifestJson, exportsOfManifestJson, importCursorMove, importCursorMoveAt, importCursorMoved, accessLogEntry, adminLogEntry, opsFailureEntry, opsFailureFingerprint, issueEntry, sweepRunEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunsPayload, modelUsageEntry, attachmentRecord, createTenantInput, identityLink, identityPool, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, registerVerticalInput, vertical as verticalSchema, verticalServingState, verticalChannel, verticalVersion, connection, capabilityExchange, mintedCapability, capabilityGrant, principalId, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchOutcome, systemScheduleEntry, systemSwitchRecord, entitlementGrant, entitlementGrantInput, capabilityFilter, instant, meterReading, subjectRef, createConnectionInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, org as orgSchema, orgMembership, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, delegatedReadRecord, ownerTransferAudit, copyMarkAudit, subjectShredReceipt, connectorDispatchKind, callsOfManifestJson, outboundOfManifestJson, SCOPE_GATE_REASONS, substratError, redrainEventsInput, coverage, peerCoverage, peerGrantsEntry, peerSwitch, peerSwitchOutcome, verticalCaller, verticalResolution, verticalSlug, entityObjectRef, ATTACHMENT_BLOB_BINDING, blobStoreBindingName, lifecycleDelivery, scopeLifecycle, } from '@substrat-run/contracts';
+import { delegatedReadParams, operationSeriesCount, fromWireFailure, exportReadInput, exportedBatch, importBatch, importResult, importState, importsOfManifestJson, exportsOfManifestJson, importCursorMove, importCursorMoveAt, importCursorMoved, accessLogEntry, adminLogEntry, opsFailureEntry, opsFailureFingerprint, issueEntry, findingEntry, findingRuleEntry, sweepRunEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunsPayload, modelUsageEntry, attachmentRecord, createTenantInput, identityLink, identityPool, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, registerVerticalInput, vertical as verticalSchema, verticalServingState, verticalChannel, verticalVersion, connection, capabilityExchange, mintedCapability, capabilityGrant, principalId, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchOutcome, systemScheduleEntry, systemSwitchRecord, entitlementGrant, entitlementGrantInput, capabilityFilter, instant, meterReading, subjectRef, createConnectionInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, org as orgSchema, orgMembership, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, delegatedReadRecord, ownerTransferAudit, memberChangeAudit, copyMarkAudit, subjectShredReceipt, connectorDispatchKind, callsOfManifestJson, outboundOfManifestJson, SCOPE_GATE_REASONS, substratError, redrainEventsInput, coverage, peerCoverage, peerGrantsEntry, peerSwitch, peerSwitchOutcome, verticalCaller, verticalResolution, verticalSlug, entityObjectRef, ATTACHMENT_BLOB_BINDING, blobStoreBindingName, lifecycleDelivery, scopeLifecycle, } from '@substrat-run/contracts';
 import { normalizeHostname, toRouteTarget } from './route-resolver.js';
-import { attachmentBlobKey, attachmentSha256, entitlementDenial, requiredEntitlementFor, foldMeterReading, parseValidationRecords, resolveScopeRecord, ulid, KEPT_COPY_REFUSAL, capabilityTokenHash, checkBecomeInput, plausibleSessionToken, foldModelUsage, backoffAt, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, openSealed, ImpersonationRefused, assertSessionUsable, impersonationRowValues, mapImpersonationRow, newImpersonationSession, jobRunOf, assertLeaseMs, runDueJobRuns, SYSTEM_DOOR_WAIT, startJobRun, attachmentTextJob, assertAttachmentExtractors, assertJobRegistrable, isAttachmentTextRun, searchLimit, searchMatchExpression, globalFetch, assertRedrainWindow, platformRequestOf, undrainedEventsOf, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, recordedOffFromWire, peerSubjectRef, SWITCH_KINDS, reassertActionOf, reassertEntry, reassertOffRow, reassertOnRow, switchActionOf, switchAuditSubject, switchNotFoundMessage, recordWriteSuperseded, switchSubjectOf, switchSupersededMessage, withRecorded, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, CrossVerticalRegistry, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, bindExportBreaksOf, bindExportBreakRefusal, collectPeers, peerSeats, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, splitManifestMigrations, unknownRoleError, assertRowLimit, assertRowOffset, emptyImportResult, INERT_SCOPE_REASON, lifecycleReceipt, lifecycleRefusal, isPrimaryScope, isPrimaryScopeRow, asyncInvocationId, asyncLinePass, } from '@substrat-run/kernel';
-import { attributedHost } from '@substrat-run/kernel';
+import { attachmentBlobKey, attachmentSha256, entitlementDenial, requiredEntitlementFor, foldMeterReading, parseValidationRecords, resolveScopeRecord, ulid, KEPT_COPY_REFUSAL, capabilityTokenHash, checkBecomeInput, plausibleSessionToken, foldModelUsage, backoffAt, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, openSealed, ImpersonationRefused, assertSessionUsable, impersonationRowValues, mapImpersonationRow, newImpersonationSession, jobRunOf, assertLeaseMs, runDueJobRuns, SYSTEM_DOOR_WAIT, startJobRun, attachmentTextJob, assertAttachmentExtractors, resolveAttachmentTextBounds, assertJobRegistrable, ATTACHMENT_TEXT_BACKFILL_JOB, ATTACHMENT_TEXT_JOB, kernelJobFor, attachmentTextBackfillJob, searchLimit, searchMatchExpression, globalFetch, assertRedrainWindow, platformRequestOf, undrainedEventsOf, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, recordedOffFromWire, peerSubjectRef, SWITCH_KINDS, reassertActionOf, reassertEntry, reassertOffRow, reassertOnRow, switchActionOf, switchAuditSubject, switchNotFoundMessage, recordWriteSuperseded, switchSubjectOf, switchSupersededMessage, withRecorded, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, CrossVerticalRegistry, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, bindExportBreaksOf, bindExportBreakRefusal, collectPeers, peerSeats, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, splitManifestMigrations, unknownRoleError, assertRowLimit, assertRowOffset, emptyImportResult, INERT_SCOPE_REASON, lifecycleReceipt, lifecycleRefusal, isPrimaryScope, isPrimaryScopeRow, asyncInvocationId, asyncLinePass, memberAddedAudit, } from '@substrat-run/kernel';
+import { attributedView } from '@substrat-run/kernel';
 import { isOrangeToOrange, isUpgradeRequest, LIVE_MODE_HEADER, LIVE_PRINCIPAL_HEADER, LIVE_SCOPE_HEADER, LIVE_SUBSCRIBE_PATH, LIVE_TENANT_HEADER, LIVE_WITHIN_HEADER, encodeLiveWithin, liveWithinOf, } from './live-reads.js';
 import { tenantStoreDatabaseName } from './d1.js';
 import { blobStoreBucketName, r2TenantBlobStore } from './r2.js';
@@ -275,6 +275,7 @@ export class CloudflareScopeHost {
     attachmentBuckets;
     /** The parsers attachment text is extracted with (K-43); the host's own, never imported here. */
     attachmentExtractors;
+    attachmentTextBounds;
     executors = new Map();
     /**
      * `<moduleId>/<job>` → the pass body and its default step policy (#1577). Host
@@ -285,10 +286,10 @@ export class CloudflareScopeHost {
      */
     jobs = new Map();
     /**
-     * The event currently being effected, stamped onto admin rows the executor writes.
-     * Ambient rather than threaded through every HostAdmin signature: set and cleared
-     * around one await, with executors running sequentially, so there is no window
-     * where it belongs to a different event.
+     * The event an executor is effecting, stamped onto the admin rows it writes (K-22). Like
+     * `onBehalfOf`, only ever set on a VIEW (`causedByView`, or `attributed` with a
+     * `causedBy`), never on the host: a field set around the handler's `await` stamped every
+     * admin call the host served meanwhile — a staff call included — with that event (#2055).
      */
     causedBy = null;
     /**
@@ -342,6 +343,7 @@ export class CloudflareScopeHost {
         this.attachmentBuckets = options.attachmentBuckets ?? ambientAttachmentBucket;
         assertAttachmentExtractors(options.attachmentExtractors ?? []);
         this.attachmentExtractors = options.attachmentExtractors ?? [];
+        this.attachmentTextBounds = resolveAttachmentTextBounds(options.attachmentTextBounds);
         this.fetchImpl = options.fetch ?? globalFetch;
         this.connectorCalls = options.connectorCalls ?? noopConnectorCallRecorder;
         this.scopeLocalPermissions = options.scopeLocalPermissions ?? false;
@@ -571,7 +573,8 @@ export class CloudflareScopeHost {
                     lines.write({ ...unitOf(event.id, attempt), startedAt, outcome: 'inert' });
                     continue;
                 }
-                this.causedBy = event.id;
+                // #2055: the handler writes through a view bound to its event, never through the host.
+                const caused = this.causedByView(event.id);
                 try {
                     if (executor.kind === 'connector' && this.cpLess) {
                         // #574 phase 3: this host cannot run a connector — no connection
@@ -589,14 +592,14 @@ export class CloudflareScopeHost {
                         lines.write({ ...unitOf(event.id, 1), startedAt, outcome: 'routed' });
                     }
                     else if (executor.kind === 'connector') {
-                        await executor.handler(await this.connectorContext(tenantId, scopeId, executor.timeoutMs, event.id), event);
+                        await executor.handler(await caused.connectorContext(tenantId, scopeId, executor.timeoutMs, event.id), event);
                         const attempt = await stub.recordExecutorAttempt(event.id, deliveryId, null, null, invocationId);
                         report.delivered += 1;
                         outcomeOf(event, 'delivered');
                         lines.write({ ...unitOf(event.id, attempt), startedAt, outcome: 'delivered' });
                     }
                     else {
-                        const result = await executor.handler(this.admin, event, scope);
+                        const result = await executor.handler(caused.admin, event, scope);
                         // #1184: a refusal is the handler's own terminal decision — journaled with its
                         // reason, no next attempt, listed by `executorDeadLetters` beside an exhausted one.
                         const refused = isDeliveryRefusal(result) ? result : null;
@@ -634,9 +637,6 @@ export class CloudflareScopeHost {
                         error: err,
                     });
                 }
-                finally {
-                    this.causedBy = null;
-                }
             }
         }
     }
@@ -701,7 +701,7 @@ export class CloudflareScopeHost {
             write: (attachmentId, outcome) => stub.attachmentTextRecord(attachmentId, outcome),
         }, 
         // K-43: the host's parsers, handed in — this adapter imports none.
-        this.attachmentExtractors);
+        this.attachmentExtractors, this.attachmentTextBounds);
     }
     async startJobRun(tenantId, scopeId, input) {
         await this.assertLive(tenantId, scopeId);
@@ -713,12 +713,18 @@ export class CloudflareScopeHost {
         // advance, and an archived one's never move again.
         await this.assertLive(tenantId, scopeId);
         await this.migrateAndRecord(scopeId);
-        // #1575: the kernel's extraction job is this host's own, bound to this scope — no
-        // deployment registers it, and none can shadow it.
-        const attachmentText = { handler: this.attachmentTextHandler(tenantId, scopeId) };
+        // #1575: the kernel's extraction jobs are this host's own, bound to this scope — no
+        // deployment registers them, and none can shadow them. The backfill starts here, on
+        // the drive, so a scope's first request never pays for attachments that predate it.
+        const stub = this.scopeStub(scopeId);
+        await stub.attachmentTextBackfillStart();
+        const kernelJobs = {
+            [ATTACHMENT_TEXT_JOB]: this.attachmentTextHandler(tenantId, scopeId),
+            [ATTACHMENT_TEXT_BACKFILL_JOB]: attachmentTextBackfillJob({ queueBatch: (after) => stub.attachmentTextBackfillBatch(after) }),
+        };
         return runDueJobRuns({
             store: this.jobStore(scopeId),
-            handlerFor: (run) => isAttachmentTextRun(run) ? attachmentText : this.jobs.get(`${run.module_id}/${run.job}`),
+            handlerFor: (run) => kernelJobFor(run, kernelJobs) ?? this.jobs.get(`${run.module_id}/${run.job}`),
             now: () => new Date().toISOString(),
             // #1834: the door is opened FOR this pass, so its "not now" is tied to this pass alone.
             openScope: async (run, pass) => this.buildStub(tenantId, scopeId, undefined, undefined, await this.openSystemDoor(run.module_id, tenantId, scopeId, undefined, pass)),
@@ -740,13 +746,9 @@ export class CloudflareScopeHost {
         // ran it. On a CP-less host `connectorContext` throws from the null control plane:
         // fail closed, exactly the hole routing exists to avoid.
         await this.assertLive(tenantId, scopeId);
-        this.causedBy = event.id;
-        try {
-            await handler(await this.connectorContext(tenantId, scopeId, options?.timeoutMs ?? 30_000, event.id), event);
-        }
-        finally {
-            this.causedBy = null;
-        }
+        // Built on a view bound to the event, so its admin rows carry it and nothing else the
+        // host serves does (#2055).
+        await handler(await this.causedByView(event.id).connectorContext(tenantId, scopeId, options?.timeoutMs ?? 30_000, event.id), event);
     }
     async executorDeadLetters(tenantId, scopeId) {
         await this.validateScopeAccess(tenantId, scopeId);
@@ -2167,6 +2169,32 @@ export class CloudflareScopeHost {
             throw unknownRoleError(roleKey);
         return coverage.parse(bound);
     }
+    async listScopeRoleHolders(tenantId, scopeId, principal) {
+        await this.scopeRoleGate(tenantId, scopeId, 'listScopeRoleHolders');
+        return this.scopeStub(scopeId).scopeRoleHoldersFor(scopeId, principal === undefined ? undefined : principalId.parse(principal));
+    }
+    async changeScopeRoleBounded(tenantId, scopeId, caller, principal, from, to) {
+        await this.scopeRoleGate(tenantId, scopeId, 'changeScopeRoleBounded');
+        const target = principalId.parse(principal);
+        const bound = await this.scopeStub(scopeId).changeScopeRoleBoundedFor(tenantId, scopeId, principalId.parse(caller), target, from, to);
+        if (bound === 'not-held')
+            throw substratError('conflict', `${target} does not hold '${from}' at this scope`);
+        if (bound === 'unknown-to')
+            throw unknownRoleError(to);
+        return coverage.parse(bound);
+    }
+    async revokeScopeRolesBounded(tenantId, scopeId, caller, principal) {
+        await this.scopeRoleGate(tenantId, scopeId, 'revokeScopeRolesBounded');
+        const result = await this.scopeStub(scopeId).revokeScopeRolesBoundedFor(tenantId, scopeId, principalId.parse(caller), principalId.parse(principal));
+        return { coverage: coverage.parse(result.coverage), revoked: result.revoked };
+    }
+    /** The (tenant, scope) gate the scope-role verbs share — `assignScopeRoleBounded`'s two checks. */
+    async scopeRoleGate(tenantId, scopeId, verb) {
+        if (this.cpLess && !(await this.scopeStub(scopeId).servesTenant(tenantId))) {
+            throw unknownScopeForTenant(tenantId, scopeId);
+        }
+        await this.peerScopeGate(tenantId, scopeId, verb);
+    }
     /**
      * Where a peer verb (#1706) may reach a scope: its own ScopeDO, after the ordinary pair and
      * lifecycle gate. Refused, loudly, on the SHARED control plane for a scope bound to a
@@ -2651,8 +2679,12 @@ export class CloudflareScopeHost {
     }
     // -- admin surface --------------------------------------------------------
     /** #977: this host, with every admin row it writes naming who the actor acted for. */
-    attributed(onBehalfOf) {
-        return attributedHost(this, onBehalfOf, this.buildAdmin);
+    attributed(onBehalfOf, options) {
+        return attributedView(this, { onBehalfOf, causedBy: options?.causedBy }, this.buildAdmin);
+    }
+    /** #2055: this host, with every admin row it writes naming `eventId` as its cause. */
+    causedByView(eventId) {
+        return attributedView(this, { causedBy: eventId }, this.buildAdmin);
     }
     buildAdmin() {
         // The directory row → the `scope` contract. Parsed, not cast: the columns are
@@ -4156,21 +4188,25 @@ export class CloudflareScopeHost {
                 await this.recordAccess(actor, 'getOrg', { tenantId }, { orgId }, r ? 1 : 0);
                 return r ? mapOrg(r) : undefined;
             },
-            addMember: async (actor, tenantId, principal, orgId) => {
+            addMember: async (actor, tenantId, principal, orgId, opts) => {
                 await requireOrg(tenantId, orgId);
-                await this.cp.writeTenantTuple(tenantId, `principal:${principal}`, 'member', `org:${orgId}`, null);
-                await this.recordAdmin(actor, 'addMember', { tenantId }, null, { principal, orgId });
+                const expiresAt = opts?.expiresAt ?? null;
+                await this.cp.writeTenantTuple(tenantId, `principal:${principal}`, 'member', `org:${orgId}`, expiresAt);
+                await this.recordAdmin(actor, 'addMember', { tenantId }, null, memberAddedAudit(principal, orgId, expiresAt));
                 await this.fanOut(tenantId); // membership is a tenant-level tuple
             },
             applyMembership: async (actor, change) => {
                 // The row is minted here, where attribution and `causedBy` live, and written by the
                 // ControlPlaneDO in the same synchronous method as the fence, the bound and the tuple
                 // (#1184): one DO unit, so nothing lands between the check and the write.
-                const { tenantId, principal, roleKey, op } = change;
+                const { tenantId, principal, roleKey, op, orgId } = change;
                 const assignment = { principalId: principal, roleKey, node: { tenantId, scopeId: null } };
                 const result = await this.cp.applyMembership(change, op === 'add'
                     ? this.adminEntry(actor, 'assignRole', { tenantId, scopeId: null }, null, assignment)
-                    : this.adminEntry(actor, 'unassignRole', { tenantId, scopeId: null }, assignment, null));
+                    : this.adminEntry(actor, 'unassignRole', { tenantId, scopeId: null }, assignment, null), 
+                // #2047: the org's own row, when the change joins or leaves one. The unit fills in its
+                // `before`/`after` and writes it only for what it does — a join's carries the expiry.
+                orgId ? this.adminEntry(actor, op === 'add' ? 'addMember' : 'removeMember', { tenantId }, null, null) : undefined);
                 // The tenant-level tuple, or its tombstone, reaches the projections.
                 if (result.applied && (op === 'add' || result.changed))
                     await this.fanOut(tenantId);
@@ -4192,6 +4228,7 @@ export class CloudflareScopeHost {
                     principal: r.subject.slice('principal:'.length),
                     orgId,
                     revokedAt: r.revoked_at,
+                    expiresAt: r.expires_at,
                 }));
             },
             createTenant: async (actor, input) => {
@@ -5085,6 +5122,11 @@ export class CloudflareScopeHost {
                 const { tenantId, scopeId, ...after } = ownerTransferAudit.parse(entry);
                 await this.recordAdmin(actor, 'transferOwner', { tenantId, scopeId }, null, after);
             },
+            /** #1150: one phase of a dashboard member change, written around the vertical's own. */
+            recordMemberChange: async (actor, entry) => {
+                const { tenantId, scopeId, ...after } = memberChangeAudit.parse(entry);
+                await this.recordAdmin(actor, 'manageScopeMember', { tenantId, scopeId }, null, after);
+            },
             /** #2005: one change to a scope's copy marker, written around the vertical's own change. */
             recordCopyMark: async (actor, entry) => {
                 const { tenantId, scopeId, action, ...after } = copyMarkAudit.parse(entry);
@@ -5241,6 +5283,8 @@ export class CloudflareScopeHost {
             },
             // Checked here as well as in the directory, so the refusal keeps its code across the hop.
             pruneTelemetry: async (_actor, limit) => this.cp.pruneTelemetry(assertRowLimit('limit', limit)),
+            // #1748: the DO writes each stale resolution's audit row in the same unit, from this one.
+            pruneFindings: async (actor, limit) => this.cp.pruneFindings(assertRowLimit('limit', limit), this.adminEntry(actor, 'resolveStaleFinding', { tenantId: null }, null, null)),
             listIssues: async (actor, filter) => {
                 const rows = await this.cp.listIssues({
                     status: filter?.status,
@@ -5262,6 +5306,33 @@ export class CloudflareScopeHost {
                 await this.recordAdmin(actor, 'setIssueStatus', { tenantId: null, vertical: after.lastVertical }, { fingerprint, status: before.status }, { fingerprint, status: after.status });
                 return after;
             },
+            listFindings: async (actor, filter) => {
+                const rows = await this.cp.listFindings({ ...filter });
+                await this.recordAccess(actor, 'listFindings', { tenantId: filter?.tenantId ?? null }, filter, rows.length);
+                return rows.map((r) => findingEntry.parse(r));
+            },
+            // #1748: each findings mutation writes its audit row in the DO's own unit, from the row
+            // minted here (actor, attribution) — so a failed audit write rolls the mutation back.
+            setFindingStatus: async (actor, tenantId, id, status) => {
+                const audit = this.adminEntry(actor, 'setFindingStatus', { tenantId }, null, null);
+                const change = await this.cp.setFindingStatus(tenantId, id, status, new Date().toISOString(), audit);
+                return change ? findingEntry.parse(change.after) : undefined;
+            },
+            createFindingRule: async (actor, tenantId, input) => {
+                const audit = this.adminEntry(actor, 'createFindingRule', { tenantId }, null, null);
+                const created = await this.directory('createFindingRule', tenantId, input, actor, new Date().toISOString(), audit);
+                return { rule: findingRuleEntry.parse(created.rule), suppressed: created.suppressed.length };
+            },
+            revokeFindingRule: async (actor, tenantId, ruleId) => {
+                const audit = this.adminEntry(actor, 'revokeFindingRule', { tenantId }, null, null);
+                const change = await this.cp.revokeFindingRule(tenantId, ruleId, new Date().toISOString(), audit);
+                return change ? findingRuleEntry.parse(change.after) : undefined;
+            },
+            listFindingRules: async (actor, tenantId, filter) => {
+                const rows = await this.cp.listFindingRules(tenantId, filter?.active ? new Date().toISOString() : undefined, filter?.limit);
+                await this.recordAccess(actor, 'listFindingRules', { tenantId }, filter, rows.length);
+                return rows.map((r) => findingRuleEntry.parse(r));
+            },
             recordModelUsage: async (input) => {
                 const l = input.line;
                 return this.cp.recordModelUsage({