@substrat-run/adapter-cloudflare 0.164.0 → 0.166.0

package/dist/control-plane-do.js

@@ -1,10 +1,11 @@
 import { DurableObject } from 'cloudflare:workers';
-import { membershipFencesBackfillSql, MEMBERSHIP_FENCES_DDL, MEMBERSHIP_FENCES_TABLE, membershipFencesTableExists, MEMBERSHIP_FENCE_SINCE_SQL, RAISE_MEMBERSHIP_FENCE_SQL, memberAddedAudit, orgChangeBound, reservedRoleDefinitionRefusal, reservedRoleRefusal, TENANT_SEATED_ROLES_SQL, tenantCoverage, IMPERSONATION_COLUMNS, IMPERSONATION_DDL, impersonationByIdQuery, impersonationListQuery, impersonationRowValues, ISSUE_RETENTION_DAYS, telemetryRetentionStatements, FINDINGS_DDL, SCOPE_STORAGE_DDL, forgetScopeStorage, retireScopeStorage, listScopeStorageAttemptRows, listScopeStorageRows, listScopeAttachmentStorageRows, listScopeStoreStorageRows, pruneScopeStorageRows, recordScopeStorageRows, REQUEST_ROLLUP_DDL, listRequestDayRows, listRequestRollupDayRows, pruneRequestDayRows, recordRequestDayRows, METER_DAYS_DDL, VERTICAL_OWNERS_BACKFILL, VERTICAL_OWNERS_DDL, closeVerticalOwnerRow, listVerticalOwnerRows, openVerticalOwnerRow, verticalOwnerNow, listMeterDayRows, listMeterDayTakeRows, pruneMeterDayRows, recordMeterDayRows, CONNECT_LINKS_DDL, consumeConnectLinkRow, insertConnectLink as insertConnectLinkRow, listConnectLinks as listConnectLinkRows, readConnectLink as readConnectLinkRow, restoreConnectLinkRow, revokeConnectLinkRow, createFindingRule, findingOfOpsFailure, findingOfSweepRun, pruneFindings, listFindingRules, listFindings, observeFinding, revokeFindingRule, setFindingStatus, assertRowLimit, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, SWEEP_RUNS_INTENT_INDEX, sweepRunsIntentHasKind, PEER_SWITCHES_DDL, PEER_BINDINGS_DDL, SWITCH_OWED_DDL, clearSwitchOwed, markSwitchOwed, scopeOwesSwitch, switchesOwedOf, SWITCH_KINDS, SYSTEM_SWITCHES_DDL, forgetSwitchesOf, listSystemSwitchRecords, recordSwitchedOff, recordSwitchedOn, recordWriteSuperseded, restoreSwitchRecord, scopesSwitchedOffFor, switchRecordStatesOf, switchRecordsOf, switchesBackfillSqlOf, switchesDdlOf, switchesTableExists, switchesTableOf, tenantHeldOf, VERSION_MIGRATIONS_DDL, VERTICAL_SCOPE_STORES_DDL, DEPLOYMENT_WIRE_AUTH_DDL, deploymentWireAuthOf, forgetVerticalWireAuth, writeDeploymentWireAuth, STORE_DRIVER_RELEASES_DDL, legacyStoreDriverConflict, legacyStoreDriverRenames, beginStoreDriverRolloutIn, finishStoreDriverRolloutIn, holdStoreDriverIn, advanceStoreDriverRebuildIn, claimStoreDriverRebuildIn, storeDriverRebuildIn, driverDeclarationsOf, recordStoreDriverReleaseIn, releaseStoreDriverHoldIn, storeDriverReleaseIn, storeDriverStateIn, storeDriverRolloutPendingIn, storeDriverRolloutWalkedIn, forgetVerticalScopeStores, indexVersionScopeStores, verticalScopeStoresOf, splitVersionMigrationsBatch, versionMigrationsOf, versionsAwaitSplit, versionsAwaitDigest, deriveMigrationDigestsBatch, deriveVersionMigrationDigest, writeVersionMigrations, MODEL_USAGE_RETENTION_DAYS, DO_SQL_LIMITS, ulid, isPrimaryScopeRow, samePeerVertical, peerVerticalSpellings, resolveVerticalInstanceFrom, resolvePeerInstanceFrom, LEGACY_SCOPE_ROWS_BACKFILL, loadDirectoryDump, redactSubjectDirectoryText, ISSUE_EXEMPLAR_OWNER_BACKFILL_SQL, issueExemplarOwner, SETTLE_INTENT_SQL, SETTLE_OUTCOME_SQL, settleOutcomeParamsOf, unknownOutcomeOf, ADMIN_LOG_INDEX_DDL, ADMIN_LOG_INDEXES_SQL, readAuditedOperations, } from '@substrat-run/kernel';
+import { membershipFencesBackfillSql, MEMBERSHIP_FENCES_DDL, MEMBERSHIP_FENCES_TABLE, membershipFencesTableExists, MEMBERSHIP_FENCE_SINCE_SQL, RAISE_MEMBERSHIP_FENCE_SQL, memberAddedAudit, orgChangeBound, reservedRoleDefinitionRefusal, reservedRoleRefusal, TENANT_SEATED_ROLES_SQL, tenantCoverage, IMPERSONATION_COLUMNS, IMPERSONATION_DDL, impersonationByIdQuery, impersonationListQuery, impersonationRowValues, ISSUE_RETENTION_DAYS, telemetryRetentionStatements, FINDINGS_DDL, SCOPE_STORAGE_DDL, forgetScopeStorage, retireScopeStorage, listScopeStorageAttemptRows, listScopeStorageRows, listScopeAttachmentStorageRows, listScopeStoreStorageRows, pruneScopeStorageRows, recordScopeStorageRows, readBoundedTenantStorageGauge, REQUEST_ROLLUP_DDL, listRequestDayRows, listRequestRollupDayRows, pruneRequestDayRows, recordRequestDayRows, readTenantRequestMeterRows, readRequestMeterDayRows, METER_DAYS_DDL, VERTICAL_OWNERS_BACKFILL, VERTICAL_OWNERS_DDL, closeVerticalOwnerRow, listVerticalOwnerRows, openVerticalOwnerRow, verticalOwnerNow, listMeterDayRows, listMeterDayTakeRows, pruneMeterDayRows, recordMeterDayRows, CONNECT_LINKS_DDL, consumeConnectLinkRow, insertConnectLink as insertConnectLinkRow, listConnectLinks as listConnectLinkRows, readConnectLink as readConnectLinkRow, restoreConnectLinkRow, revokeConnectLinkRow, createFindingRule, findingOfOpsFailure, findingOfSweepRun, pruneFindings, listFindingRules, listFindings, observeFinding, revokeFindingRule, setFindingStatus, assertRowLimit, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, SWEEP_RUNS_INTENT_INDEX, sweepRunsIntentHasKind, PEER_SWITCHES_DDL, PEER_BINDINGS_DDL, SWITCH_OWED_DDL, clearSwitchOwed, markSwitchOwed, scopeOwesSwitch, switchesOwedOf, SWITCH_KINDS, SYSTEM_SWITCHES_DDL, forgetSwitchesOf, listSystemSwitchRecords, recordSwitchedOff, recordSwitchedOn, recordWriteSuperseded, restoreSwitchRecord, scopesSwitchedOffFor, switchRecordStatesOf, switchRecordsOf, switchesBackfillSqlOf, switchesDdlOf, switchesTableExists, switchesTableOf, tenantHeldOf, VERSION_MIGRATIONS_DDL, VERTICAL_SCOPE_STORES_DDL, DEPLOYMENT_WIRE_AUTH_DDL, deploymentWireAuthOf, forgetVerticalWireAuth, writeDeploymentWireAuth, STORE_DRIVER_RELEASES_DDL, approveStoreDriverReleaseIn, legacyStoreDriverConflict, legacyStoreDriverRenames, beginStoreDriverRolloutIn, finishStoreDriverRolloutIn, holdStoreDriverIn, advanceStoreDriverRebuildIn, claimStoreDriverRebuildIn, storeDriverRebuildIn, driverDeclarationsOf, recordStoreDriverReleaseIn, recordStoreDriverRevokeWalkIn, releaseStoreDriverHoldIn, revokeStoreDriverReleaseIn, liveStoreDriverApprovalIn, storeDriverApprovalsIn, storeDriverRevokeWalkIn, storeDriverReleaseIn, storeDriverStateIn, storeDriverRolloutPendingIn, storeDriverRolloutWalkedIn, forgetVerticalScopeStores, indexVersionScopeStores, verticalScopeStoresOf, splitVersionMigrationsBatch, versionMigrationsOf, versionsAwaitSplit, versionsAwaitDigest, deriveMigrationDigestsBatch, deriveVersionMigrationDigest, writeVersionMigrations, MODEL_USAGE_RETENTION_DAYS, DO_SQL_LIMITS, ulid, isPrimaryScopeRow, samePeerVertical, peerVerticalSpellings, resolveVerticalInstanceFrom, resolvePeerInstanceFrom, LEGACY_SCOPE_ROWS_BACKFILL, loadDirectoryDump, redactSubjectDirectoryText, ISSUE_EXEMPLAR_OWNER_BACKFILL_SQL, issueExemplarOwner, SETTLE_INTENT_SQL, SETTLE_OUTCOME_SQL, settleOutcomeParamsOf, unknownOutcomeOf, ADMIN_LOG_INDEX_DDL, ADMIN_LOG_INDEXES_SQL, readAuditedOperations, } from '@substrat-run/kernel';
 import { replyOf } from './do-reply.js';
 import { switchSqlOver } from './scope-do.js';
 import { blankSqlComments, boundShapesColumn, executableSqlStatements, installsReconciledOf, PROVISIONED_VERSIONS_SQL, provisionedVersionsParams, } from '@substrat-run/kernel';
 import { COPY_BACKFILL_SCOPE_SQL, COPY_BACKFILL_SQL, COPY_BACKFILL_SUPERSEDE_SQL, COPY_CLAIM_SQL, COPY_EXPIRED_SQL, COPY_MOVE_RENEW_SQL, copyMoveRenewParams, PENDING_COPY_KEEP_ALIVE_SQL, pendingCopyKeepAliveParams, copyBackfillParams, copyBackfillRefusal, SUBJECT_ERASURE_CLAIM_SQL, subjectErasureClaimParams, COPY_MOVE_CONFIRM_SQL, COPY_MOVE_LIVE_PREDICATE, SCOPE_COPY_LEASE_MS, SERVES_NOW_CONDITION, SERVES_NOW_PREDICATE, servesNowParams, servesAsFrom, SCOPE_SCRIPT_COPY_COLUMNS, copyMoveConfirmParams, copyMoveLiveParams, } from '@substrat-run/kernel';
 import { autoAdmittedProdRefusal, listedPromoteRefusal, opsFailureReferenceWhere } from '@substrat-run/kernel';
+import { canonicalInstant } from '@substrat-run/kernel';
 import { doBuiltColumnsOf, doRedactionSql } from './sql.js';
 import { assertReplayableDump, AUTO_ADMISSION_NOTE, instant, opsFailureFingerprint, ROUTE_SCOPE_HOSTNAMES_MAX, SCOPE_GATE_REASONS, substratError } from '@substrat-run/contracts';
 /**
@@ -652,6 +653,7 @@ const DIRECTORY_DDL = `
     elapsed_ms INTEGER NOT NULL
   );
   CREATE INDEX IF NOT EXISTS _substrat_model_usage_tenant ON _substrat_model_usage (tenant_id, at);
+  CREATE INDEX IF NOT EXISTS _substrat_model_usage_tenant_page ON _substrat_model_usage (tenant_id, at, id);
   CREATE INDEX IF NOT EXISTS _substrat_model_usage_at ON _substrat_model_usage (at);
   -- #1524: the stored storage gauge — one row per (scope, UTC day), kernel-owned DDL.
   ${SCOPE_STORAGE_DDL}
@@ -797,6 +799,9 @@ export const REPLIED_METHODS = [
     // #2300: a store driver's release, rollout and hold writes refuse with conflict, not_found,
     // validation_failed or unavailable.
     'recordStoreDriverRelease',
+    'approveStoreDriverReleaseAndAudit',
+    'recordStoreDriverRevokeWalk',
+    'revokeStoreDriverReleaseAndAudit',
     'storeDriverDeclarations',
     // #2312: a rollout page refuses a limit that is not positive, and an unknown rollout.
     'storeDriverRolloutPending',
@@ -842,6 +847,25 @@ export const REPLIED_METHODS = [
     'deleteHostname',
     'grantEntitlement',
     'revokeEntitlement',
+    // #2479: these names are new even where the bare method above already exists. A DO from
+    // before the audit unit must refuse the name, not drop a trailing audit argument and commit.
+    'putTenantStoreAndAudit',
+    'putBlobStoreAndAudit',
+    'recordStoreDriverReleaseAndAudit',
+    'beginStoreDriverRolloutAndAudit',
+    'finishStoreDriverRolloutAndAudit',
+    'importDumpAndAudit',
+    'registerIdentityPoolAndAudit',
+    'insertConnectionAndAudit',
+    'updateConnectionSecretAndAudit',
+    'revokeConnectionAndAudit',
+    'linkIdentityAndAudit',
+    'unlinkIdentityAndAudit',
+    'markAccessLogDrainedAndAudit',
+    'pruneAccessLogAndAudit',
+    'writeImpersonationAndAudit',
+    'endImpersonationAndAudit',
+    'setIssueStatusAndAudit',
 ];
 export class ControlPlaneDO extends DurableObject {
     sql;
@@ -1287,7 +1311,7 @@ export class ControlPlaneDO extends DurableObject {
      * are filled in afterwards, inside the same transaction. A refusal anywhere in it leaves the
      * directory as it was.
      */
-    async importDump(tables) {
+    async importDump(tables, audit) {
         // Same untrusted dump, same two holes as the scope path (#1143): names reaching SQL as
         // identifiers, and a `ddl` that is never executed here but is still held to one CREATE
         // TABLE. Pure input validation, so it runs before the first DROP: a refused dump touches
@@ -1326,6 +1350,10 @@ export class ControlPlaneDO extends DurableObject {
             // A dump never carries one (`exportDump`); a hand-made dump that does is outranked too.
             // Every deployment then takes this history's deliveries, whatever its counters say.
             this.sql.exec("INSERT OR REPLACE INTO lifecycle_revisions (subject, revision) VALUES ('directory:epoch', ?)", Math.max(epochBefore + 1, this.lifecycleEpoch() + 1, Date.now()));
+            // Append the restore's own row after the dump rows have landed in the rebuilt
+            // admin table, inside this same import transaction.
+            if (audit)
+                this.recordAdmin(audit);
         });
         // A restore is a new #1764 backfill episode. It replaced the data the old failure count and
         // backoff were about, so neither may delay or silence it: the count is cleared and the next
@@ -1494,21 +1522,26 @@ export class ControlPlaneDO extends DurableObject {
      * callers converge on one canonical row and the loser can tear its orphan mint down.
      * Fails closed on an unknown/non-active tenant, exactly as provisionScope does.
      */
-    putTenantStore(row) {
-        const tenantRow = this.sql
-            .exec('SELECT status FROM tenants WHERE tenant_id = ?', row.tenantId)
-            .toArray()[0];
-        if (!tenantRow) {
-            throw substratError('not_found', `cannot provision tenant store under unknown tenant: ${row.tenantId}`);
-        }
-        if (tenantRow.status !== 'active') {
-            throw substratError('conflict', `cannot provision tenant store under non-active tenant (status: ${tenantRow.status}): ${row.tenantId}`);
-        }
-        this.sql.exec(`INSERT OR IGNORE INTO tenant_stores (tenant_id, vertical, binding, kind, ref, created_at)
-       VALUES (?, ?, ?, ?, ?, ?)`, row.tenantId, row.vertical, row.binding, row.kind, row.ref, row.createdAt);
-        const stored = this.getTenantStore(row.tenantId, row.vertical, row.binding);
-        if (!stored)
-            throw new Error(`tenant store write did not land for tenant ${row.tenantId}`);
+    putTenantStore(row, audit) {
+        let stored;
+        this.writeAndAudit(() => {
+            const tenantRow = this.sql
+                .exec('SELECT status FROM tenants WHERE tenant_id = ?', row.tenantId)
+                .toArray()[0];
+            if (!tenantRow) {
+                throw substratError('not_found', `cannot provision tenant store under unknown tenant: ${row.tenantId}`);
+            }
+            if (tenantRow.status !== 'active') {
+                throw substratError('conflict', `cannot provision tenant store under non-active tenant (status: ${tenantRow.status}): ${row.tenantId}`);
+            }
+            const inserted = this.sql.exec(`INSERT OR IGNORE INTO tenant_stores (tenant_id, vertical, binding, kind, ref, created_at)
+       VALUES (?, ?, ?, ?, ?, ?)`, row.tenantId, row.vertical, row.binding, row.kind, row.ref, row.createdAt).rowsWritten > 0;
+            const found = this.getTenantStore(row.tenantId, row.vertical, row.binding);
+            if (!found)
+                throw new Error(`tenant store write did not land for tenant ${row.tenantId}`);
+            stored = found;
+            return inserted;
+        }, audit);
         return stored;
     }
     listTenantStores(filter) {
@@ -1538,21 +1571,26 @@ export class ControlPlaneDO extends DurableObject {
     }
     /** Record a minted blob store — FIRST WRITER WINS, same race protocol as
      *  putTenantStore: INSERT OR IGNORE then read back; the loser tears its orphan down. */
-    putBlobStore(row) {
-        const tenantRow = this.sql
-            .exec('SELECT status FROM tenants WHERE tenant_id = ?', row.tenantId)
-            .toArray()[0];
-        if (!tenantRow) {
-            throw substratError('not_found', `cannot provision blob store under unknown tenant: ${row.tenantId}`);
-        }
-        if (tenantRow.status !== 'active') {
-            throw substratError('conflict', `cannot provision blob store under non-active tenant (status: ${tenantRow.status}): ${row.tenantId}`);
-        }
-        this.sql.exec(`INSERT OR IGNORE INTO blob_stores (tenant_id, vertical, binding, kind, ref, created_at)
-       VALUES (?, ?, ?, ?, ?, ?)`, row.tenantId, row.vertical, row.binding, row.kind, row.ref, row.createdAt);
-        const stored = this.getBlobStore(row.tenantId, row.vertical, row.binding);
-        if (!stored)
-            throw new Error(`blob store write did not land for tenant ${row.tenantId}`);
+    putBlobStore(row, audit) {
+        let stored;
+        this.writeAndAudit(() => {
+            const tenantRow = this.sql
+                .exec('SELECT status FROM tenants WHERE tenant_id = ?', row.tenantId)
+                .toArray()[0];
+            if (!tenantRow) {
+                throw substratError('not_found', `cannot provision blob store under unknown tenant: ${row.tenantId}`);
+            }
+            if (tenantRow.status !== 'active') {
+                throw substratError('conflict', `cannot provision blob store under non-active tenant (status: ${tenantRow.status}): ${row.tenantId}`);
+            }
+            const inserted = this.sql.exec(`INSERT OR IGNORE INTO blob_stores (tenant_id, vertical, binding, kind, ref, created_at)
+       VALUES (?, ?, ?, ?, ?, ?)`, row.tenantId, row.vertical, row.binding, row.kind, row.ref, row.createdAt).rowsWritten > 0;
+            const found = this.getBlobStore(row.tenantId, row.vertical, row.binding);
+            if (!found)
+                throw new Error(`blob store write did not land for tenant ${row.tenantId}`);
+            stored = found;
+            return inserted;
+        }, audit);
         return stored;
     }
     listBlobStores(filter) {
@@ -1575,12 +1613,47 @@ export class ControlPlaneDO extends DurableObject {
     // -- store-driver releases, rollouts and holds (D-63, #2300) ---------------------
     // Kernel code over the directory (store-driver-releases.ts), shared with the SQLite host. Each
     // call is one transaction, and the object runs one at a time, so a hold is taken atomically.
-    recordStoreDriverRelease(input) {
-        return this.ctx.storage.transactionSync(() => recordStoreDriverReleaseIn(this.kernelSql, input));
+    recordStoreDriverRelease(input, audit) {
+        let result;
+        this.writeAndAudit(() => {
+            result = recordStoreDriverReleaseIn(this.kernelSql, input);
+            return result.created;
+        }, audit ? () => ({ ...audit, after: result.record }) : undefined);
+        return result;
     }
     getStoreDriverRelease(driver, sha256) {
         return storeDriverReleaseIn(this.kernelSql, driver, sha256);
     }
+    storeDriverApprovals(driver) {
+        return storeDriverApprovalsIn(this.kernelSql, driver);
+    }
+    liveStoreDriverApproval(driver, sha256) {
+        return liveStoreDriverApprovalIn(this.kernelSql, driver, sha256);
+    }
+    approveStoreDriverReleaseAndAudit(input, audit) {
+        let record;
+        this.writeAndAudit(() => {
+            record = approveStoreDriverReleaseIn(this.kernelSql, { ...input, approvalId: ulid() });
+            return true;
+        }, () => ({ ...audit, after: record }));
+        return record;
+    }
+    storeDriverRevokeWalk(approvalId) {
+        return storeDriverRevokeWalkIn(this.kernelSql, approvalId);
+    }
+    recordStoreDriverRevokeWalk(input) {
+        return this.ctx.storage.transactionSync(() => recordStoreDriverRevokeWalkIn(this.kernelSql, { ...input, nowMs: Date.now() }));
+    }
+    revokeStoreDriverReleaseAndAudit(input, audit) {
+        let before = null;
+        let record;
+        this.writeAndAudit(() => {
+            before = liveStoreDriverApprovalIn(this.kernelSql, input.driver, input.sha256) ?? null;
+            record = revokeStoreDriverReleaseIn(this.kernelSql, { ...input, nowMs: Date.now() });
+            return true;
+        }, () => ({ ...audit, before, after: record }));
+        return record;
+    }
     storeDriverState(driver) {
         return this.ctx.storage.transactionSync(() => storeDriverStateIn(this.kernelSql, driver, Date.now()));
     }
@@ -1599,11 +1672,21 @@ export class ControlPlaneDO extends DurableObject {
     releaseStoreDriverHold(input) {
         releaseStoreDriverHoldIn(this.kernelSql, input);
     }
-    beginStoreDriverRollout(input) {
-        return this.ctx.storage.transactionSync(() => beginStoreDriverRolloutIn(this.kernelSql, { ...input, nowMs: Date.now() }));
+    beginStoreDriverRollout(input, audit) {
+        let row;
+        this.writeAndAudit(() => {
+            row = beginStoreDriverRolloutIn(this.kernelSql, { ...input, nowMs: Date.now() });
+            return true;
+        }, audit ? () => ({ ...audit, after: row }) : undefined);
+        return row;
     }
-    finishStoreDriverRollout(input) {
-        return this.ctx.storage.transactionSync(() => finishStoreDriverRolloutIn(this.kernelSql, { ...input, nowMs: Date.now() }));
+    finishStoreDriverRollout(input, audit) {
+        let row;
+        this.writeAndAudit(() => {
+            row = finishStoreDriverRolloutIn(this.kernelSql, { ...input, nowMs: Date.now() });
+            return true;
+        }, audit ? () => ({ ...audit, action: row.action === 'rollback' ? 'rollBackStoreDriver' : 'rollOutStoreDriver', after: row }) : undefined);
+        return row;
     }
     storeDriverRebuild(driver) {
         return storeDriverRebuildIn(this.kernelSql, driver);
@@ -2730,6 +2813,62 @@ export class ControlPlaneDO extends DurableObject {
             return changed;
         });
     }
+    /**
+     * The coordinator calls these new RPC names for directory-only audited writes. The old names
+     * remain callable by an older coordinator, which records its own row afterwards. An older DO
+     * knows none of these names and refuses before the state write instead of dropping the row.
+     */
+    putTenantStoreAndAudit(...args) {
+        return this.putTenantStore(...args);
+    }
+    putBlobStoreAndAudit(...args) {
+        return this.putBlobStore(...args);
+    }
+    recordStoreDriverReleaseAndAudit(...args) {
+        return this.recordStoreDriverRelease(...args);
+    }
+    beginStoreDriverRolloutAndAudit(...args) {
+        return this.beginStoreDriverRollout(...args);
+    }
+    finishStoreDriverRolloutAndAudit(...args) {
+        return this.finishStoreDriverRollout(...args);
+    }
+    importDumpAndAudit(...args) {
+        return this.importDump(...args);
+    }
+    registerIdentityPoolAndAudit(...args) {
+        return this.registerIdentityPool(...args);
+    }
+    insertConnectionAndAudit(...args) {
+        return this.insertConnection(...args);
+    }
+    updateConnectionSecretAndAudit(...args) {
+        return this.updateConnectionSecret(...args);
+    }
+    revokeConnectionAndAudit(...args) {
+        return this.revokeConnection(...args);
+    }
+    linkIdentityAndAudit(...args) {
+        return this.linkIdentity(...args);
+    }
+    unlinkIdentityAndAudit(...args) {
+        return this.unlinkIdentity(...args);
+    }
+    markAccessLogDrainedAndAudit(...args) {
+        return this.markAccessLogDrained(...args);
+    }
+    pruneAccessLogAndAudit(...args) {
+        return this.pruneAccessLog(...args);
+    }
+    writeImpersonationAndAudit(...args) {
+        return this.writeImpersonation(...args);
+    }
+    endImpersonationAndAudit(...args) {
+        return this.endImpersonation(...args);
+    }
+    setIssueStatusAndAudit(...args) {
+        return this.setIssueStatus(...args);
+    }
     scopeErasureEpoch(tenantId, scopeId) {
         // NULL on every row from before the column (#1722): the same 0 every CAS compares against.
         const row = this.sql.exec('SELECT COALESCE(erasure_epoch, 0) AS erasure_epoch FROM scopes WHERE tenant_id = ? AND scope_id = ?', tenantId, scopeId)
@@ -3265,6 +3404,9 @@ export class ControlPlaneDO extends DurableObject {
             attachmentStorage: listScopeAttachmentStorageRows(doRedactionSql(this.sql), tenantId),
         };
     }
+    readTenantStorageGauge(tenantId, limit) {
+        return readBoundedTenantStorageGauge(doRedactionSql(this.sql), tenantId, limit);
+    }
     // -- the stored storage gauge (#1524) — kernel `storage-gauge.ts` --------------
     recordScopeStorage(readings) {
         return { recorded: this.ctx.storage.transactionSync(() => recordScopeStorageRows(doRedactionSql(this.sql), readings)) };
@@ -3288,6 +3430,12 @@ export class ControlPlaneDO extends DurableObject {
     listRequestRollupDays(filter) {
         return listRequestRollupDayRows(doRedactionSql(this.sql), filter);
     }
+    listTenantRequestMeter(tenantId, since, until, limit) {
+        return readTenantRequestMeterRows(doRedactionSql(this.sql), tenantId, since, until, limit);
+    }
+    listRequestMeterDays(since, until) {
+        return readRequestMeterDayRows(doRedactionSql(this.sql), since, until);
+    }
     pruneRequestDays(limit, retentionMonths) {
         return this.ctx.storage.transactionSync(() => pruneRequestDayRows(doRedactionSql(this.sql), Date.now(), limit, retentionMonths));
     }
@@ -3312,16 +3460,18 @@ export class ControlPlaneDO extends DurableObject {
             .toArray()[0];
     }
     /** Returns false when an identical registration already exists; throws on a conflicting one. */
-    registerIdentityPool(provider, topology, tenantId, createdAt) {
-        const existing = this.readPool(provider);
-        if (existing) {
-            if (existing.topology === topology && existing.tenant_id === tenantId)
-                return false;
-            throw substratError('conflict', `identity pool '${provider}' is already registered as ${existing.topology}` +
-                `${existing.tenant_id ? ` for tenant ${existing.tenant_id}` : ''}`);
-        }
-        this.sql.exec('INSERT INTO _substrat_identity_pools (provider, topology, tenant_id, created_at) VALUES (?, ?, ?, ?)', provider, topology, tenantId, createdAt);
-        return true;
+    registerIdentityPool(provider, topology, tenantId, createdAt, audit) {
+        return this.writeAndAudit(() => {
+            const existing = this.readPool(provider);
+            if (existing) {
+                if (existing.topology === topology && existing.tenant_id === tenantId)
+                    return false;
+                throw substratError('conflict', `identity pool '${provider}' is already registered as ${existing.topology}` +
+                    `${existing.tenant_id ? ` for tenant ${existing.tenant_id}` : ''}`);
+            }
+            this.sql.exec('INSERT INTO _substrat_identity_pools (provider, topology, tenant_id, created_at) VALUES (?, ?, ?, ?)', provider, topology, tenantId, createdAt);
+            return true;
+        }, audit);
     }
     identityTenants(provider, externalId) {
         return this.sql
@@ -3389,27 +3539,30 @@ export class ControlPlaneDO extends DurableObject {
     // The DO owns the rows; the coordinator owns the SecretBox, so ciphertext
     // arrives already sealed and leaves still sealed. This DO has never seen a
     // plaintext credential and cannot.
-    insertConnection(row) {
-        // Live-uniqueness is per ACCOUNT (COALESCEd like the index): a provider
-        // without account refs stays a singleton; a multi-namespace provider may
-        // hold one live connection per external account.
-        const live = this.sql
-            .exec(`SELECT id FROM _substrat_connections
+    insertConnection(row, audit) {
+        this.writeAndAudit(() => {
+            // Live-uniqueness is per ACCOUNT (COALESCEd like the index): a provider
+            // without account refs stays a singleton; a multi-namespace provider may
+            // hold one live connection per external account.
+            const live = this.sql
+                .exec(`SELECT id FROM _substrat_connections
          WHERE tenant_id = ? AND vertical = ? AND provider = ?
            AND COALESCE(external_account_ref, '') = COALESCE(?, '') AND revoked_at IS NULL`, row.tenantId, row.vertical, row.provider, row.externalAccountRef)
-            .toArray()[0];
-        if (live) {
-            const account = row.externalAccountRef ? ` under account '${row.externalAccountRef}'` : '';
-            throw new Error(`tenant ${row.tenantId} already has a live '${row.provider}' connection ` +
-                `for vertical '${row.vertical}'${account} — revoke it before connecting another`);
-        }
-        this.sql.exec(`INSERT INTO _substrat_connections
+                .toArray()[0];
+            if (live) {
+                const account = row.externalAccountRef ? ` under account '${row.externalAccountRef}'` : '';
+                throw new Error(`tenant ${row.tenantId} already has a live '${row.provider}' connection ` +
+                    `for vertical '${row.vertical}'${account} — revoke it before connecting another`);
+            }
+            this.sql.exec(`INSERT INTO _substrat_connections
          (id, tenant_id, vertical, provider, label, status, external_account_ref,
           scopes, expires_at, last_ok_at, last_error, last_error_at,
           created_by, created_at, revoked_at)
        VALUES (?, ?, ?, ?, ?, 'active', ?, ?, ?, NULL, NULL, NULL, ?, ?, NULL)`, row.id, row.tenantId, row.vertical, row.provider, row.label, row.externalAccountRef, row.scopes, row.expiresAt, row.createdBy, row.createdAt);
-        this.sql.exec(`INSERT INTO _substrat_connection_secrets (connection_id, key_id, ciphertext, updated_at)
+            this.sql.exec(`INSERT INTO _substrat_connection_secrets (connection_id, key_id, ciphertext, updated_at)
        VALUES (?, ?, ?, ?)`, row.id, row.keyId, row.ciphertext, row.createdAt);
+            return true;
+        }, audit);
     }
     /** This connection's key rows — every one, current and retired (#687). */
     readConnectionKeys(connectionId) {
@@ -3478,12 +3631,15 @@ export class ControlPlaneDO extends DurableObject {
         }
         return rows[0];
     }
-    updateConnectionSecret(id, keyId, ciphertext, expiresAt, at) {
-        this.sql.exec(`UPDATE _substrat_connection_secrets
+    updateConnectionSecret(id, keyId, ciphertext, expiresAt, at, audit) {
+        this.writeAndAudit(() => {
+            this.sql.exec(`UPDATE _substrat_connection_secrets
        SET key_id = ?, ciphertext = ?, updated_at = ? WHERE connection_id = ?`, keyId, ciphertext, at, id);
-        this.sql.exec(`UPDATE _substrat_connections
+            this.sql.exec(`UPDATE _substrat_connections
        SET status = 'active', expires_at = ?, last_error = NULL, last_error_at = NULL
        WHERE id = ?`, expiresAt, id);
+            return true;
+        }, audit);
     }
     /**
      * Tombstone the connection and DELETE the sealed blob.
@@ -3492,21 +3648,23 @@ export class ControlPlaneDO extends DurableObject {
      * only be a liability. Returns false when already revoked, so the caller can
      * skip an audit row for a no-op.
      */
-    revokeConnection(id, at) {
-        const row = this.readConnection(id);
-        if (!row)
-            throw new Error(`connection not found: ${id}`);
-        if (row.revoked_at)
-            return false;
-        this.sql.exec(`UPDATE _substrat_connections SET status = 'revoked', revoked_at = ? WHERE id = ?`, at, id);
-        this.sql.exec('DELETE FROM _substrat_connection_secrets WHERE connection_id = ?', id);
-        // Connector state dies with the connection — its private bookkeeping.
-        this.sql.exec('DELETE FROM _substrat_connector_state WHERE connection_id = ?', id);
-        // #592: its grants tombstone (K-21 — evidence, not roster). Absent from the
-        // next gather, so no later provision/reconcile delivers them again.
-        this.sql.exec(`UPDATE _substrat_connection_grants SET revoked_at = ?
+    revokeConnection(id, at, audit) {
+        return this.writeAndAudit(() => {
+            const row = this.readConnection(id);
+            if (!row)
+                throw new Error(`connection not found: ${id}`);
+            if (row.revoked_at)
+                return false;
+            this.sql.exec(`UPDATE _substrat_connections SET status = 'revoked', revoked_at = ? WHERE id = ?`, at, id);
+            this.sql.exec('DELETE FROM _substrat_connection_secrets WHERE connection_id = ?', id);
+            // Connector state dies with the connection — its private bookkeeping.
+            this.sql.exec('DELETE FROM _substrat_connector_state WHERE connection_id = ?', id);
+            // #592: its grants tombstone (K-21 — evidence, not roster). Absent from the
+            // next gather, so no later provision/reconcile delivers them again.
+            this.sql.exec(`UPDATE _substrat_connection_grants SET revoked_at = ?
        WHERE connection_id = ? AND revoked_at IS NULL`, at, id);
-        return true;
+            return true;
+        }, audit);
     }
     // -- a vertical's mailed connect links (connections.md §3.5.4) ------------------
     // The kernel's statements (`connect-links.ts`), shared with the pure adapter. Each
@@ -3715,31 +3873,35 @@ export class ControlPlaneDO extends DurableObject {
             .filter((r) => !prefix || r.state_key.startsWith(prefix))
             .map((r) => ({ key: r.state_key, value: r.value }));
     }
-    linkIdentity(provider, externalId, principal, tenantId, scopeId, createdAt) {
-        const existing = this.sql
-            .exec(`SELECT principal_id FROM _substrat_identities
+    linkIdentity(provider, externalId, principal, tenantId, scopeId, createdAt, audit) {
+        return this.writeAndAudit(() => {
+            const existing = this.sql
+                .exec(`SELECT principal_id FROM _substrat_identities
          WHERE tenant_id = ? AND provider = ? AND external_id = ?`, tenantId, provider, externalId)
-            .toArray()[0];
-        if (existing) {
-            if (existing.principal_id === principal)
-                return false;
-            throw substratError('conflict', `identity ${provider}:${externalId} in tenant ${tenantId} is already bound to ${existing.principal_id}`);
-        }
-        this.sql.exec(`INSERT INTO _substrat_identities
+                .toArray()[0];
+            if (existing) {
+                if (existing.principal_id === principal)
+                    return false;
+                throw substratError('conflict', `identity ${provider}:${externalId} in tenant ${tenantId} is already bound to ${existing.principal_id}`);
+            }
+            this.sql.exec(`INSERT INTO _substrat_identities
          (provider, external_id, principal_id, tenant_id, scope_id, created_at)
        VALUES (?, ?, ?, ?, ?, ?)`, provider, externalId, principal, tenantId, scopeId, createdAt);
-        return true;
+            return true;
+        }, audit);
     }
     /** Remove a principal's identity link(s) in a tenant. Returns whether a row was
      *  deleted so a no-op stays silent (idempotent). */
-    unlinkIdentity(tenantId, principal) {
-        const before = this.sql
-            .exec(`SELECT 1 FROM _substrat_identities WHERE tenant_id = ? AND principal_id = ?`, tenantId, principal)
-            .toArray();
-        if (before.length === 0)
-            return false;
-        this.sql.exec(`DELETE FROM _substrat_identities WHERE tenant_id = ? AND principal_id = ?`, tenantId, principal);
-        return true;
+    unlinkIdentity(tenantId, principal, audit) {
+        return this.writeAndAudit(() => {
+            const before = this.sql
+                .exec(`SELECT 1 FROM _substrat_identities WHERE tenant_id = ? AND principal_id = ?`, tenantId, principal)
+                .toArray();
+            if (before.length === 0)
+                return false;
+            this.sql.exec(`DELETE FROM _substrat_identities WHERE tenant_id = ? AND principal_id = ?`, tenantId, principal);
+            return true;
+        }, audit);
     }
     resolveIdentity(tenantId, provider, externalId) {
         const row = this.sql
@@ -3802,25 +3964,35 @@ export class ControlPlaneDO extends DurableObject {
      * Stamp `drained_at` on undrained rows up to `upToId`. The `IS NULL` guard makes a
      * retried shipment idempotent — it re-stamps nothing and returns 0 (K-24).
      */
-    markAccessLogDrained(upToId, drainedAt) {
-        const doomed = this.sql
-            .exec('SELECT id FROM _substrat_access_log WHERE id <= ? AND drained_at IS NULL', upToId)
-            .toArray().map((r) => r.id);
-        for (const id of doomed) {
-            this.sql.exec('UPDATE _substrat_access_log SET drained_at = ? WHERE id = ?', drainedAt, id);
-        }
-        return doomed.length;
+    markAccessLogDrained(upToId, drainedAt, audit) {
+        let drained = 0;
+        this.writeAndAudit(() => {
+            const doomed = this.sql
+                .exec('SELECT id FROM _substrat_access_log WHERE id <= ? AND drained_at IS NULL', upToId)
+                .toArray().map((r) => r.id);
+            for (const id of doomed) {
+                this.sql.exec('UPDATE _substrat_access_log SET drained_at = ? WHERE id = ?', drainedAt, id);
+            }
+            drained = doomed.length;
+            return drained > 0;
+        }, audit ? () => ({ ...audit, after: { drained, upToId, drainedAt } }) : undefined);
+        return drained;
     }
     /** ONLY drained rows. Age alone is not a licence to delete evidence (K-24). */
-    pruneAccessLog(limit) {
-        assertRowLimit('limit', limit);
-        const doomed = this.sql
-            .exec('SELECT id FROM _substrat_access_log WHERE drained_at IS NOT NULL ORDER BY id LIMIT ?', limit)
-            .toArray().map((r) => r.id);
-        for (const id of doomed) {
-            this.sql.exec('DELETE FROM _substrat_access_log WHERE id = ?', id);
-        }
-        return doomed.length;
+    pruneAccessLog(limit, audit) {
+        let pruned = 0;
+        this.writeAndAudit(() => {
+            assertRowLimit('limit', limit);
+            const doomed = this.sql
+                .exec('SELECT id FROM _substrat_access_log WHERE drained_at IS NOT NULL ORDER BY id LIMIT ?', limit)
+                .toArray().map((r) => r.id);
+            for (const id of doomed) {
+                this.sql.exec('DELETE FROM _substrat_access_log WHERE id = ?', id);
+            }
+            pruned = doomed.length;
+            return pruned > 0;
+        }, audit ? () => ({ ...audit, after: { pruned } }) : undefined);
+        return pruned;
     }
     // -- per-subject keys (#37) -------------------------------------------------
     // The three row operations `createSubjectKeys` needs. The crypto is the kernel's; what
@@ -3873,9 +4045,9 @@ export class ControlPlaneDO extends DurableObject {
     // never reads these — the coordinator resolves the session and hands the DO the
     // two actors, which keeps the DO's invoke free of a directory round-trip.
     /** Insert a session the coordinator minted. Returns nothing; the caller holds it. */
-    writeImpersonation(values) {
-        this.sql.exec(`INSERT INTO _substrat_impersonations (${IMPERSONATION_COLUMNS})
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, ...values);
+    writeImpersonation(values, audit) {
+        this.writeAndAudit(() => this.sql.exec(`INSERT INTO _substrat_impersonations (${IMPERSONATION_COLUMNS})
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, ...values).rowsWritten > 0, audit);
     }
     /** One session by id, or undefined. The door's lookup and every invoke's re-read. */
     readImpersonation(id) {
@@ -3883,8 +4055,8 @@ export class ControlPlaneDO extends DurableObject {
         return this.sql.exec(q.sql, ...q.params).toArray()[0];
     }
     /** Close a session. Idempotent — a row already ended keeps its first `ended_at`. */
-    endImpersonation(id, endedAt) {
-        this.sql.exec('UPDATE _substrat_impersonations SET ended_at = ? WHERE id = ? AND ended_at IS NULL', endedAt, id);
+    endImpersonation(id, endedAt, audit) {
+        this.writeAndAudit(() => this.sql.exec('UPDATE _substrat_impersonations SET ended_at = ? WHERE id = ? AND ended_at IS NULL', endedAt, id).rowsWritten > 0, audit);
     }
     listImpersonations(filter, now) {
         const q = impersonationListQuery(filter, now);
@@ -4415,22 +4587,27 @@ export class ControlPlaneDO extends DurableObject {
         return rows.map((r) => issueOf(r));
     }
     /** The lifecycle write (#1233). Returns before/after for the caller's audit, or undefined. */
-    setIssueStatus(fingerprint, status, at) {
-        const rows = this.sql
-            .exec('SELECT * FROM _substrat_issues WHERE fingerprint = ?', fingerprint)
-            .toArray();
-        const existing = rows[0];
-        if (!existing)
-            return undefined;
-        const resolvedAt = status === 'resolved' ? at : null;
-        // "Resolved under X": freeze the newest version at the verdict, so a later
-        // regression can name the pair. A reopen or ignore clears it with the timestamp.
-        const resolvedVersion = status === 'resolved' ? existing.last_version : null;
-        this.sql.exec('UPDATE _substrat_issues SET status = ?, resolved_at = ?, resolved_version = ? WHERE fingerprint = ?', status, resolvedAt, resolvedVersion, fingerprint);
-        return {
-            before: issueOf(existing),
-            after: issueOf({ ...existing, status, resolved_at: resolvedAt, resolved_version: resolvedVersion }),
-        };
+    setIssueStatus(fingerprint, status, at, audit) {
+        let existing;
+        let after;
+        this.writeAndAudit(() => {
+            const rows = this.sql
+                .exec('SELECT * FROM _substrat_issues WHERE fingerprint = ?', fingerprint)
+                .toArray();
+            existing = rows[0];
+            if (!existing)
+                return false;
+            const resolvedAt = status === 'resolved' ? at : null;
+            // "Resolved under X": freeze the newest version at the verdict, so a later
+            // regression can name the pair. A reopen or ignore clears it with the timestamp.
+            const resolvedVersion = status === 'resolved' ? existing.last_version : null;
+            this.sql.exec('UPDATE _substrat_issues SET status = ?, resolved_at = ?, resolved_version = ? WHERE fingerprint = ?', status, resolvedAt, resolvedVersion, fingerprint);
+            after = { ...existing, status, resolved_at: resolvedAt, resolved_version: resolvedVersion };
+            return true;
+        }, audit ? () => ({ ...audit, vertical: after.last_vertical,
+            before: { fingerprint, status: existing.status },
+            after: { fingerprint, status: after.status } }) : undefined);
+        return existing && after ? { before: issueOf(existing), after: issueOf(after) } : undefined;
     }
     /** #1054: idempotent on request_id — a replayed intent writes nothing. */
     recordModelUsage(row) {
@@ -4484,5 +4661,20 @@ export class ControlPlaneDO extends DurableObject {
         }
         return this.sql.exec(sql, ...params).toArray();
     }
+    listTenantModelUsageMeter(query) {
+        const cursor = query.cursor;
+        const since = canonicalInstant(query.since);
+        const until = canonicalInstant(query.until);
+        const rows = this.sql.exec(`SELECT id, at, substr(vertical, 1, 64) AS vertical, substr(model, 1, 128) AS model,
+              CASE WHEN length(vertical) > 64 OR length(model) > 128 THEN 1 ELSE 0 END AS label_truncated,
+              reported, input_tokens, output_tokens
+         FROM _substrat_model_usage
+        WHERE tenant_id = ? AND at >= ? AND at < ?
+          ${cursor ? 'AND (at < ? OR (at = ? AND id < ?))' : ''}
+        ORDER BY at DESC, id DESC LIMIT ?`, query.tenantId, since, until, ...(cursor ? [cursor.at, cursor.at, cursor.id] : []), Math.min(assertRowLimit('limit', query.limit), 501)).toArray();
+        return rows.map((row) => ({ id: row.id, at: row.at, vertical: row.vertical, model: row.model,
+            labelTruncated: row.label_truncated !== 0, reported: row.reported !== 0,
+            inputTokens: row.input_tokens, outputTokens: row.output_tokens }));
+    }
 }
 //# sourceMappingURL=control-plane-do.js.map