@substrat-run/adapter-cloudflare 0.165.0 → 0.166.0

package/dist/host.js

@@ -3,7 +3,7 @@ import { isRewindRefusal, REWIND_REFUSED } from './rewind-refusal.js';
 import { isSystemDoorMoved, SYSTEM_DOOR_MOVED, SYSTEM_DOOR_REGATES } from './system-door.js';
 import { delegatedReadParams, operationSeriesCount, fromWireFailure, isSubstratError, exportReadInput, exportedBatch, importBatch, importResult, importState, importsOfManifestJson, connectionLandingsOfManifestJson, connectorsOfManifestJson, exportsOfManifestJson, assertNoBindingShapeBreak, importCursorMove, importCursorMoveAt, importCursorMoved, accessLogEntry, adminLogEntry, opsFailureEntry, opsFailureFingerprint, issueEntry, findingEntry, findingRuleEntry, sweepRunEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunsPayload, modelUsageEntry, createTenantInput, identityLink, identityPool, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, registerVerticalInput, vertical as verticalSchema, verticalServingState, deploymentWireAuth, verticalChannel, verticalVersion, connection, capabilityExchange, mintedCapability, boundedBecomeMint, boundedBecomeRevoke, boundedUnbind, entityRef, becomeLinkState, principalBecomeCapabilityInput, capabilityGrant, principalId, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchOutcome, systemScheduleEntry, systemSwitchRecord, entitlementGrant, entitlementGrantInput, capabilityFilter, instant, meterReading, scopeStorageSample, requestDay, requestRollupDay, meterDay, meterDayTake, verticalOwnerPeriod, subjectRef, createConnectionInput, connectLinkFilter, connectLinkKey, consumeConnectLinkInput, mintConnectLinkInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, org as orgSchema, orgMembership, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, delegatedReadRecord, ownerTransferAudit, memberChangeAudit, peerBindingAudit, connectionBindingAudit, copyMarkAudit, orphanSweepAudit, subjectShredReceipt, connectorDispatchKind, callsOfManifestJson, outboundOfManifestJson, SCOPE_GATE_REASONS, substratError, errorCodeOf, redrainEventsInput, coverage, peerCoverage, peerGrantsEntry, peerSwitch, peerSwitchOutcome, verticalCaller, verticalResolution, peerInstanceResolution, peerBinding as peerBindingSchema, verticalSlug, entityObjectRef, ATTACHMENT_BLOB_BINDING, blobStoreBindingName, lifecycleDelivery, scopeLifecycle, } from '@substrat-run/contracts';
 import { normalizeHostname, toRouteTarget } from './route-resolver.js';
-import { attachmentBlobKey, normalizeUploadMediaType, redeemOrReplayUploadLink, attachmentSha256, bytesStream, isSizedByteStream, openAttachmentByteStream, putAttachmentBytes, entitlementDenial, requiredEntitlementFor, foldMeterReading, parseValidationRecords, readableScopes, resolveScopeRecord, ulid, withheldOpsFailure, KEPT_COPY_REFUSAL, capabilityTokenHash, checkBecomeInput, assertBecomeLinkStateIds, plausibleSessionToken, foldModelUsage, backoffAt, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, openSealed, ImpersonationRefused, assertSessionUsable, impersonationRowValues, mapImpersonationRow, newImpersonationSession, jobRunOf, assertLeaseMs, runDueJobRuns, SYSTEM_DOOR_WAIT, startJobRun, attachmentTextJob, assertAttachmentExtractors, resolveAttachmentTextBounds, assertJobRegistrable, ATTACHMENT_TEXT_BACKFILL_JOB, ATTACHMENT_TEXT_JOB, kernelJobFor, attachmentTextBackfillJob, searchLimit, searchMatchExpression, globalFetch, fetchLikeOf, deadlineFetch, assertRedrainWindow, platformRequestOf, undrainedEventsOf, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, recordedOffFromWire, peerSubjectRef, SWITCH_KINDS, reassertActionOf, reassertEntry, reassertOffRow, reassertOnRow, switchActionOf, switchAuditSubject, recordAuditOutcome, auditedCapabilityRevoke, auditWarningOf, switchNotFoundMessage, recordWriteSuperseded, switchSubjectOf, switchSupersededMessage, withRecorded, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, CrossVerticalRegistry, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, assertPromoteReviewCurrent, promoteRaceRefusal, servingRaceRefusal, migratesFrom, servedFromRow, rebindRaceRefusal, bindExportBreaksOf, bindExportBreakRefusal, scopeMoveOf, runningVersionOf, strandJudgmentsOf, boundShapesOfColumn, installReconciled, collectPeers, peerCallerAt, peerSeats, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, splitManifestMigrations, publishedMigrationDigest, migrationChangeRefusal, unknownRoleError, assertRowLimit, assertRowOffset, emptyImportResult, INERT_SCOPE_REASON, lifecycleReceipt, lifecycleRefusal, scopeNotHeldRefusal, isPrimaryScope, isPrimaryScopeRow, asyncInvocationId, asyncLinePass, assertNoCallerPurge, purgeReportOf, purgeStillDue, assertBoundOperations, registerTrashTargets, assertModuleDeclared, noteDeclaredKeys, noteReservedKeys, reservedGrantRefusal, reservedRoleRefusal, reservedRoleSetRefusal, reservedShapeRefusal, SEAT_HOLDING_SCOPE_STATUSES, dumpRoleRefusal, dumpRoleState, memberAddedAudit, shapeTopUpBatch, verticalOwnerNow, } from '@substrat-run/kernel';
+import { attachmentBlobKey, normalizeUploadMediaType, redeemOrReplayUploadLink, attachmentSha256, bytesStream, isSizedByteStream, openAttachmentByteStream, putAttachmentBytes, entitlementDenial, requiredEntitlementFor, foldMeterReading, parseValidationRecords, readableScopes, resolveScopeRecord, ulid, withheldOpsFailure, KEPT_COPY_REFUSAL, capabilityTokenHash, checkBecomeInput, assertBecomeLinkStateIds, plausibleSessionToken, foldModelUsage, backoffAt, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, openSealed, ImpersonationRefused, assertSessionUsable, impersonationRowValues, mapImpersonationRow, newImpersonationSession, jobRunOf, assertLeaseMs, runDueJobRuns, SYSTEM_DOOR_WAIT, startJobRun, attachmentTextJob, assertAttachmentExtractors, resolveAttachmentTextBounds, assertJobRegistrable, ATTACHMENT_TEXT_BACKFILL_JOB, ATTACHMENT_TEXT_JOB, kernelJobFor, attachmentTextBackfillJob, searchLimit, searchMatchExpression, globalFetch, fetchLikeOf, deadlineFetch, assertRedrainWindow, platformRequestOf, undrainedEventsOf, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, recordedOffFromWire, peerSubjectRef, SWITCH_KINDS, reassertActionOf, reassertEntry, reassertOffRow, reassertOnRow, switchActionOf, switchAuditSubject, recordAuditOutcome, auditedCapabilityRevoke, auditedScopePermissionWrite, auditWarningOf, switchNotFoundMessage, recordWriteSuperseded, switchSubjectOf, switchSupersededMessage, withRecorded, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, CrossVerticalRegistry, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, assertPromoteReviewCurrent, promoteRaceRefusal, servingRaceRefusal, migratesFrom, servedFromRow, rebindRaceRefusal, bindExportBreaksOf, bindExportBreakRefusal, scopeMoveOf, runningVersionOf, strandJudgmentsOf, boundShapesOfColumn, installReconciled, collectPeers, peerCallerAt, peerSeats, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, splitManifestMigrations, publishedMigrationDigest, migrationChangeRefusal, unknownRoleError, assertRowLimit, assertRowOffset, emptyImportResult, INERT_SCOPE_REASON, lifecycleReceipt, lifecycleRefusal, scopeNotHeldRefusal, isPrimaryScope, isPrimaryScopeRow, asyncInvocationId, asyncLinePass, assertNoCallerPurge, purgeReportOf, purgeStillDue, assertBoundOperations, registerTrashTargets, assertModuleDeclared, noteDeclaredKeys, noteReservedKeys, reservedGrantRefusal, reservedRoleRefusal, reservedRoleSetRefusal, reservedShapeRefusal, SEAT_HOLDING_SCOPE_STATUSES, dumpRoleRefusal, dumpRoleState, memberAddedAudit, shapeTopUpBatch, verticalOwnerNow, } from '@substrat-run/kernel';
 import { fenceAttachmentSweep, missingAttachmentStore, sweepOrphanAttachments, unsettledCopyRefusal } from '@substrat-run/kernel';
 import { assertWireAuthFilter, wireAuthAccessTarget, COPY_RESTORE_FENCE_LAPSED, scopeScriptCopyOf } from '@substrat-run/kernel';
 import { attributedView, isModuleErasureCounts, moduleErasurePlan, moduleRowsErased, callReservedStoreOperation, callScopeStore, observeStoreCall, replayStoreErasures, scopeStoreLifecycleOf, scopeStoreRunnersOf } from '@substrat-run/kernel';
@@ -3244,11 +3244,14 @@ export class CloudflareScopeHost {
      * configured; the mint has no such reach and no caller needing one, since an owner claim link
      * is minted by the deployment itself behind `/internal/owner-claim`.
      */
-    async capabilityScopeStub(rec, scopeId, verb) {
+    assertCapabilityScopeReach(rec, scopeId, verb) {
         if (this.servesScopesElsewhereNow && rec.vertical !== null) {
             throw substratError('unavailable', `${verb} cannot reach scope ${scopeId}: it is served by the '${rec.vertical}' ` +
                 'deployment, and this host has no reach into it');
         }
+    }
+    async capabilityScopeStub(rec, scopeId, verb) {
+        this.assertCapabilityScopeReach(rec, scopeId, verb);
         await this.migrateAndRecord(scopeId);
         return this.scopeStub(scopeId);
     }
@@ -3876,13 +3879,18 @@ export class CloudflareScopeHost {
             // #1713: after the directory moved and the move was audited, never before or instead.
             await this.deliverLifecycles(actor, { scopeId });
         };
-        const writeGrant = async (subject, permission, node, entity, expiresAt) => {
+        const writeGrant = async (subject, permission, node, entity, expiresAt, audited = false) => {
+            const writeTuple = async (scopeId, object) => {
+                if (audited)
+                    unwrapReply(await this.scopeStub(scopeId).writeTupleAndAuditIntent(subject, `granted:${permission}`, object, expiresAt ?? null));
+                else
+                    await this.writeScopeTuple(scopeId, subject, `granted:${permission}`, object, expiresAt ?? null);
+            };
             if (entity) {
-                await this.writeScopeTuple(node.scopeId, subject, `granted:${permission}`, entityObjectRef(entity, 'HostAdmin'), // #1856: grant and grantToOrg both land here
-                expiresAt ?? null);
+                await writeTuple(node.scopeId, entityObjectRef(entity, 'HostAdmin')); // #1856
             }
             else if (node.scopeId) {
-                await this.writeScopeTuple(node.scopeId, subject, `granted:${permission}`, `scope:${node.scopeId}`, expiresAt ?? null);
+                await writeTuple(node.scopeId, `scope:${node.scopeId}`);
             }
             else {
                 // #2526: a tenant-level grant is a directory tuple, written by the ControlPlaneDO in the
@@ -4459,15 +4467,33 @@ export class CloudflareScopeHost {
                     await this.fanOut(tenantId);
                     return;
                 }
-                const refusal = await this.scopeStub(scopeId).reservedRoleRefusalFor(tenantId, assignment.roleKey, 'platform');
+                if (await this.scopePermissionUsesLegacyPlaceholder(tenantId, scopeId)) {
+                    const refusal = await this.scopeStub(scopeId).reservedRoleRefusalFor(tenantId, assignment.roleKey, 'platform');
+                    if (refusal)
+                        throw substratError('forbidden', refusal);
+                    await this.writeScopeTuple(scopeId, `principal:${assignment.principalId}`, `role:${assignment.roleKey}`, `scope:${scopeId}`, null);
+                    await this.recordAdmin(actor, 'assignRole', { tenantId, scopeId }, null, assignment);
+                    return;
+                }
+                const refusal = await auditedScopePermissionWrite({
+                    action: 'assignRole', request: { ...assignment },
+                    record: (after) => this.recordAdmin(actor, 'assignRole', { tenantId, scopeId }, null, after),
+                    write: async () => {
+                        const refusal = await this.scopeStub(scopeId).reservedRoleRefusalFor(tenantId, assignment.roleKey, 'platform');
+                        if (refusal)
+                            return refusal;
+                        unwrapReply(await this.scopeStub(scopeId).writeTupleAndAuditIntent(`principal:${assignment.principalId}`, `role:${assignment.roleKey}`, `scope:${scopeId}`, null));
+                        return null;
+                    },
+                    outcome: (refusal) => ({ phase: refusal ? 'refused' : 'applied', details: { changed: !refusal } }),
+                    logError: (message, fields) => console.error(message, fields),
+                });
                 if (refusal)
                     throw substratError('forbidden', refusal);
-                await this.writeScopeTuple(scopeId, `principal:${assignment.principalId}`, `role:${assignment.roleKey}`, `scope:${scopeId}`, null);
-                await this.recordAdmin(actor, 'assignRole', { tenantId, scopeId }, null, assignment);
             },
             unassignRole: async (actor, assignment) => {
                 // Tombstone (K-21) — the checker skips revoked rows. A no-op returns false so
-                // a repeat unassign stays silent (no second audit row, no needless fan-out).
+                // a repeat unassign is a refused no-op at a scope node, with no needless fan-out.
                 const relation = `role:${assignment.roleKey}`;
                 const { tenantId, scopeId } = assignment.node;
                 if (!scopeId) {
@@ -4479,17 +4505,27 @@ export class CloudflareScopeHost {
                         await this.fanOut(tenantId);
                     return;
                 }
-                const changed = await this.scopeStub(scopeId).revokeTuple(`principal:${assignment.principalId}`, relation, `scope:${scopeId}`, new Date().toISOString());
-                if (!changed)
+                if (await this.scopePermissionUsesLegacyPlaceholder(tenantId, scopeId)) {
+                    const changed = await this.scopeStub(scopeId).revokeTuple(`principal:${assignment.principalId}`, relation, `scope:${scopeId}`, new Date().toISOString());
+                    if (changed)
+                        await this.recordAdmin(actor, 'unassignRole', { tenantId, scopeId }, assignment, null);
                     return;
-                await this.recordAdmin(actor, 'unassignRole', { tenantId, scopeId }, assignment, null);
+                }
+                await auditedScopePermissionWrite({
+                    action: 'unassignRole', request: { ...assignment },
+                    record: (after) => this.recordAdmin(actor, 'unassignRole', { tenantId, scopeId }, assignment, after),
+                    write: () => this.scopeStub(scopeId).revokeTupleAndAuditIntent(`principal:${assignment.principalId}`, relation, `scope:${scopeId}`, new Date().toISOString()),
+                    outcome: (changed) => ({ phase: changed ? 'applied' : 'refused', details: { changed } }),
+                    logError: (message, fields) => console.error(message, fields),
+                });
             },
             grant: async (actor, raw) => {
                 // Parsed like its `grantToConnection`/`grantToSystem` siblings, not taken on
                 // trust: the parse is where an `expiresAt` carrying a UTC offset is normalised
                 // to Z text (#963), and liveness here is a lexicographic `expires_at > ?`.
                 const grant = capabilityGrant.parse(raw);
-                await this.refuseReservedGrant([grant.permission], grant.node.scopeId); // #2430
+                const legacy = !!grant.node.scopeId && await this.scopePermissionUsesLegacyPlaceholder(grant.node.tenantId, grant.node.scopeId);
+                await this.refuseReservedGrant([grant.permission], legacy ? grant.node.scopeId : null); // #2430
                 const subject = `principal:${grant.principalId}`;
                 const target = { tenantId: grant.node.tenantId, scopeId: grant.node.scopeId };
                 if (!grant.node.scopeId && !grant.entity) {
@@ -4500,12 +4536,49 @@ export class CloudflareScopeHost {
                     return;
                 }
                 // Scope-level and entity grants write scope tuples (already local): no fan-out.
-                await writeGrant(subject, grant.permission, grant.node, grant.entity, grant.expiresAt);
-                await this.recordAdmin(actor, 'grant', target, null, grant);
+                if (legacy) {
+                    await writeGrant(subject, grant.permission, grant.node, grant.entity, grant.expiresAt);
+                    await this.recordAdmin(actor, 'grant', target, null, grant);
+                    return;
+                }
+                const refusal = await auditedScopePermissionWrite({
+                    action: 'grant', request: { ...grant },
+                    record: (after) => this.recordAdmin(actor, 'grant', target, null, after),
+                    write: async () => {
+                        const refusal = await this.scopeStub(grant.node.scopeId).reservedGrantRefusalFor([grant.permission]);
+                        if (refusal)
+                            return refusal;
+                        await writeGrant(subject, grant.permission, grant.node, grant.entity, grant.expiresAt, true);
+                        return null;
+                    },
+                    outcome: (refusal) => ({ phase: refusal ? 'refused' : 'applied', details: { changed: !refusal } }),
+                    logError: (message, fields) => console.error(message, fields),
+                });
+                if (refusal)
+                    throw substratError('forbidden', refusal);
             },
             grantEntityShape: async (actor, grant) => {
-                await this.grantEntityShapeLocal(grant.node.scopeId, grant.principalId, grant.entity, grant.permissions);
-                await this.recordAdmin(actor, 'grantEntityShape', grant.node, null, grant);
+                if (await this.scopePermissionUsesLegacyPlaceholder(grant.node.tenantId, grant.node.scopeId)) {
+                    await this.grantEntityShapeLocal(grant.node.scopeId, grant.principalId, grant.entity, grant.permissions);
+                    await this.recordAdmin(actor, 'grantEntityShape', grant.node, null, grant);
+                    return;
+                }
+                await this.refuseReservedGrant(grant.permissions, null);
+                const refusal = await auditedScopePermissionWrite({
+                    action: 'grantEntityShape', request: { ...grant },
+                    record: (after) => this.recordAdmin(actor, 'grantEntityShape', grant.node, null, after),
+                    write: async () => {
+                        const refusal = await this.scopeStub(grant.node.scopeId).reservedGrantRefusalFor([...grant.permissions]);
+                        if (refusal)
+                            return refusal;
+                        await this.scopeStub(grant.node.scopeId).grantEntityShapeAndAuditIntent(grant.principalId, grant.entity, grant.permissions);
+                        return null;
+                    },
+                    outcome: (refusal) => ({ phase: refusal ? 'refused' : 'applied', details: { changed: !refusal } }),
+                    logError: (message, fields) => console.error(message, fields),
+                });
+                if (refusal)
+                    throw substratError('forbidden', refusal);
             },
             reconcileEntityGrantShapes: async (actor, node, shapes, opts) => {
                 // #2184: the bound types are the reconcile route's answer to the platform, not part of this
@@ -4597,13 +4670,25 @@ export class CloudflareScopeHost {
                 const target = { tenantId: grant.node.tenantId, scopeId: grant.node.scopeId };
                 const after = { moduleId: grant.moduleId, permission: grant.permission, node: grant.node };
                 if (grant.node.scopeId) {
+                    if (await this.scopePermissionUsesLegacyPlaceholder(grant.node.tenantId, grant.node.scopeId)) {
+                        const written = await this.scopeStub(grant.node.scopeId).writeSystemGrant(grant.moduleId, `granted:${grant.permission}`, `scope:${grant.node.scopeId}`, grant.expiresAt ?? null);
+                        if (!written)
+                            throw substratError('conflict', systemSwitchedOffMessage(grant.moduleId, grant.node.scopeId));
+                        await this.recordAdmin(actor, 'grantToSystem', target, null, after);
+                        return;
+                    }
                     // #1666: refused while the module is switched off on this scope — checked and
                     // written in one DO unit. Restore is the lever; a grant is not.
-                    const written = await this.scopeStub(grant.node.scopeId).writeSystemGrant(grant.moduleId, `granted:${grant.permission}`, `scope:${grant.node.scopeId}`, grant.expiresAt ?? null);
+                    const written = await auditedScopePermissionWrite({
+                        action: 'grantToSystem', request: { ...after, expiresAt: grant.expiresAt ?? null, grantedBy: grant.grantedBy },
+                        record: (row) => this.recordAdmin(actor, 'grantToSystem', target, null, row),
+                        write: () => this.scopeStub(grant.node.scopeId).writeSystemGrantAndAuditIntent(grant.moduleId, `granted:${grant.permission}`, `scope:${grant.node.scopeId}`, grant.expiresAt ?? null),
+                        outcome: (written) => ({ phase: written ? 'applied' : 'refused', details: { changed: written } }),
+                        logError: (message, fields) => console.error(message, fields),
+                    });
                     if (!written) {
                         throw substratError('conflict', systemSwitchedOffMessage(grant.moduleId, grant.node.scopeId));
                     }
-                    await this.recordAdmin(actor, 'grantToSystem', target, null, after);
                     return;
                 }
                 // #1743: refused while the record holds the module off on any scope — checked and
@@ -4647,10 +4732,8 @@ export class CloudflareScopeHost {
                 return { switchedOffPeers, tenantHeldPeers, fences };
             },
             reassertSystemSwitches: reassertSystemSwitchesOf,
-            // #1672 — the platform's two capability verbs. Audited AFTER the write, on both, and
-            // the failure each leaves is the safe one: a mint whose audit row did not land never
-            // returned its secret, so nobody can ever exchange it; a revoke whose row did not land
-            // has still revoked. Neither the secret nor its hash is ever in before/after.
+            // #1672 — the platform's two capability verbs. An intent precedes the scope write and
+            // the outcome follows it. Neither the secret nor its hash is ever in before/after.
             mintCapability: async (actor, tenantId, scopeId, input) => {
                 // Checked HERE as well as in the DO: a typed refusal thrown across the RPC arrives as
                 // a bare message, and the caller would lose `validation_failed`. One function, so the
@@ -4658,17 +4741,22 @@ export class CloudflareScopeHost {
                 checkBecomeInput(input, new Date().toISOString());
                 await this.validateScopeAccess(tenantId, scopeId);
                 const rec = await this.capabilityScopeRecord(tenantId, scopeId);
-                const stub = await this.capabilityScopeStub(rec, scopeId, 'mintCapability');
-                const minted = await stub.mintBecomeCapability(input, actor);
-                await this.recordAdmin(actor, 'mintCapability', { tenantId, scopeId, vertical: rec.vertical }, null, {
-                    capabilityId: minted.id,
-                    mode: 'become',
-                    principal: input.principal,
-                    expiresAt: input.expiresAt,
-                    maxUses: input.maxUses,
-                    label: input.label ?? null,
+                // A hosted refusal precedes intent; the local migrate happens inside the audited write.
+                this.assertCapabilityScopeReach(rec, scopeId, 'mintCapability');
+                return auditedScopePermissionWrite({
+                    action: 'mintCapability', request: {
+                        mode: 'become',
+                        principal: input.principal,
+                        expiresAt: input.expiresAt,
+                        maxUses: input.maxUses,
+                        label: input.label ?? null,
+                    },
+                    record: (after) => this.recordAdmin(actor, 'mintCapability', { tenantId, scopeId, vertical: rec.vertical }, null, after),
+                    write: async () => (await this.capabilityScopeStub(rec, scopeId, 'mintCapability')).mintBecomeCapabilityAndAuditIntent(input, actor),
+                    outcome: (minted) => ({ phase: 'applied', details: { capabilityId: minted.id } }),
+                    onUnrecordedOutcome: (minted, error) => ({ ...minted, auditWarning: auditWarningOf('the capability mint', error) }),
+                    logError: (message, fields) => console.error(message, fields),
                 });
-                return minted;
             },
             revokeCapability: async (actor, tenantId, scopeId, capabilityId) => {
                 // #1686: a hosted scope's directory is in the deployment serving it, reached through the
@@ -4700,7 +4788,8 @@ export class CloudflareScopeHost {
                 // The org must exist in the node's tenant. A grant to a phantom org looks
                 // applied, resolves for nobody, and still shows up in the permission diff.
                 await requireOrg(node.tenantId, orgId);
-                await this.refuseReservedGrant([permission], node.scopeId); // #2430: an org's members are people
+                const legacy = !!node.scopeId && await this.scopePermissionUsesLegacyPlaceholder(node.tenantId, node.scopeId);
+                await this.refuseReservedGrant([permission], legacy ? node.scopeId : null); // #2430: an org's members are people
                 const target = { tenantId: node.tenantId, scopeId: node.scopeId };
                 const after = { orgId, permission, node, entity };
                 if (!node.scopeId && !entity) {
@@ -4709,8 +4798,26 @@ export class CloudflareScopeHost {
                     await this.fanOut(node.tenantId);
                     return;
                 }
-                await writeGrant(`org:${orgId}`, permission, node, entity);
-                await this.recordAdmin(actor, 'grantToOrg', target, null, after);
+                if (legacy) {
+                    await writeGrant(`org:${orgId}`, permission, node, entity);
+                    await this.recordAdmin(actor, 'grantToOrg', target, null, after);
+                    return;
+                }
+                const refusal = await auditedScopePermissionWrite({
+                    action: 'grantToOrg', request: after,
+                    record: (row) => this.recordAdmin(actor, 'grantToOrg', target, null, row),
+                    write: async () => {
+                        const refusal = await this.scopeStub(node.scopeId).reservedGrantRefusalFor([permission]);
+                        if (refusal)
+                            return refusal;
+                        await writeGrant(`org:${orgId}`, permission, node, entity, undefined, true);
+                        return null;
+                    },
+                    outcome: (refusal) => ({ phase: refusal ? 'refused' : 'applied', details: { changed: !refusal } }),
+                    logError: (message, fields) => console.error(message, fields),
+                });
+                if (refusal)
+                    throw substratError('forbidden', refusal);
             },
             // -- vertical + version registry (#31) ---------------------------------
             // -- the hostname map (K-26) -------------------------------------------
@@ -5516,6 +5623,24 @@ export class CloudflareScopeHost {
                 await this.recordAccess(actor, 'getStoreDriverRelease', { tenantId: null }, { driver, sha256 }, record ? 1 : 0);
                 return record;
             },
+            storeDriverApprovals: async (actor, driver) => {
+                const records = await this.cp.storeDriverApprovals(driver);
+                await this.recordAccess(actor, 'storeDriverApprovals', { tenantId: null }, { driver }, records.length);
+                return records;
+            },
+            liveStoreDriverApproval: async (actor, driver, sha256) => {
+                const record = await this.cp.liveStoreDriverApproval(driver, sha256);
+                await this.recordAccess(actor, 'liveStoreDriverApproval', { tenantId: null }, { driver, sha256 }, record ? 1 : 0);
+                return record;
+            },
+            approveStoreDriverRelease: async (actor, input) => this.directory('approveStoreDriverReleaseAndAudit', { ...input, actor, at: new Date().toISOString() }, this.adminEntry(actor, 'approveStoreDriverRelease', { tenantId: null }, null, null)),
+            storeDriverRevokeWalk: async (actor, approvalId) => {
+                const record = await this.cp.storeDriverRevokeWalk(approvalId);
+                await this.recordAccess(actor, 'storeDriverRevokeWalk', { tenantId: null }, { approvalId }, record ? 1 : 0);
+                return record;
+            },
+            recordStoreDriverRevokeWalk: async (actor, input) => this.directory('recordStoreDriverRevokeWalk', { ...input, actor }),
+            revokeStoreDriverRelease: async (actor, input) => this.directory('revokeStoreDriverReleaseAndAudit', { ...input, actor, at: new Date().toISOString() }, this.adminEntry(actor, 'revokeStoreDriverRelease', { tenantId: null }, null, null)),
             storeDriverState: async (actor, driver) => {
                 const state = await this.cp.storeDriverState(driver);
                 await this.recordAccess(actor, 'storeDriverState', { tenantId: null }, { driver }, state.rollouts.length);
@@ -6167,6 +6292,11 @@ export class CloudflareScopeHost {
                 await this.recordAccess(actor, 'readMeters', { tenantId: only ?? null }, filter ?? null, reading.perTenant.length);
                 return meterReading.parse(reading);
             },
+            readTenantStorageGauge: async (actor, tenantId, limit) => {
+                const result = await this.cp.readTenantStorageGauge(tenantId, limit);
+                await this.recordAccess(actor, 'readTenantStorageGauge', { tenantId }, { limit }, result.gauge.sampled);
+                return result;
+            },
             registerIdentityPool: async (actor, input) => {
                 const parsed = identityPool.parse(input);
                 const created = await this.directory('registerIdentityPoolAndAudit', parsed.provider, parsed.topology, parsed.tenantId, new Date().toISOString(), this.adminEntry(actor, 'registerIdentityPool', { tenantId: parsed.tenantId }, null, parsed));
@@ -6703,6 +6833,16 @@ export class CloudflareScopeHost {
                 await this.recordAccess(actor, 'listRequestRollupDays', { tenantId: null }, filter ?? null, rows.length);
                 return rows;
             },
+            listTenantRequestMeter: async (actor, tenantId, since, until, limit) => {
+                const rows = await this.cp.listTenantRequestMeter(tenantId, since, until, limit);
+                await this.recordAccess(actor, 'listTenantRequestMeter', { tenantId }, { since, until, limit }, rows.length);
+                return rows;
+            },
+            listRequestMeterDays: async (actor, since, until) => {
+                const rows = await this.cp.listRequestMeterDays(since, until);
+                await this.recordAccess(actor, 'listRequestMeterDays', { tenantId: null }, { since, until }, rows.length);
+                return rows;
+            },
             pruneRequestDays: async (_actor, limit, retentionMonths) => this.cp.pruneRequestDays(assertRowLimit('limit', limit), retentionMonths),
             recordMeterDay: async (_actor, input) => this.cp.recordMeterDay(input),
             listMeterDays: async (actor, filter) => {
@@ -6744,6 +6884,11 @@ export class CloudflareScopeHost {
                 await this.recordAccess(actor, 'listModelUsage', { tenantId: filter?.tenantId ?? null, scopeId: filter?.scopeId ?? null }, filter, rows.length);
                 return rows.map(modelUsageEntryOf);
             },
+            listTenantModelUsageMeter: async (actor, filter) => {
+                const rows = await this.cp.listTenantModelUsageMeter(filter);
+                await this.recordAccess(actor, 'listTenantModelUsageMeter', { tenantId: filter.tenantId }, { since: filter.since, until: filter.until, limit: filter.limit }, rows.length);
+                return rows;
+            },
             summarizeModelUsage: async (actor, window, marginPercent) => {
                 const rows = await this.cp.listModelUsage({ ...window, order: 'asc' });
                 await this.recordAccess(actor, 'summarizeModelUsage', { tenantId: window.tenantId ?? null }, window, rows.length);
@@ -7185,6 +7330,13 @@ export class CloudflareScopeHost {
         // via newUniqueId (K-7) and stores the mapping in the directory — deferred.
         return this.scopeNs.get(this.scopeNs.idFromName(scopeId));
     }
+    /** The shared coordinator has only a placeholder ScopeDO for a scope served by another deployment.
+     * Until a permission delegation seam exists, preserve its existing write and single-row audit path. */
+    async scopePermissionUsesLegacyPlaceholder(tenantId, scopeId) {
+        if (!this.servesScopesElsewhereNow)
+            return false;
+        return (await this.cp.getScopeRecord(tenantId, scopeId))?.vertical != null;
+    }
     // -- the rewind hold (#1819) ------------------------------------------------
     // A PITR rewind to a bookmark from before a schedule kill switch was pulled brings the
     // module's `system:` grants back live, and nothing in the rewound storage says otherwise.