@substrat-run/adapter-cloudflare 0.2.0

package/dist/checker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checker.d.ts","sourceRoot":"","sources":["../src/checker.ts"],"names":[],"mappings":"AAAA,OAAO,EAQL,KAAK,cAAc,EACpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAmB9D,UAAU,QAAQ;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,kFAAkF;AAClF,MAAM,WAAW,kBAAkB;IACjC,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC7F,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;CAC7E;AAED,MAAM,WAAW,aAAa;IAC5B,wEAAwE;IACxE,QAAQ,EAAE,UAAU,CAAC;IACrB,8DAA8D;IAC9D,YAAY,EAAE,kBAAkB,CAAC;CAClC;AAQD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,aAAa,GAAG,iBAAiB,CA2I3E"}

package/dist/checker.js

@@ -0,0 +1,128 @@
+import { objectRef, } from '@substrat-run/contracts';
+/**
+ * The built-in constrained relationship-tuple evaluator (design doc §4.2, plan
+ * D-23), ported to the Durable-Object split. Identical four-rule algebra to the
+ * pure adapter's `createTupleChecker` — role expansion, tenancy-tree
+ * inheritance, declared entity parent edges (depth ≤ 4), membership — no
+ * negation, no configurable rewrites. Every allow carries its tuple proof.
+ *
+ * Tuple placement mirrors the pure adapter, split across DOs: scope-level and
+ * entity tuples live in THIS ScopeDO's SQLite (`_substrat_tuples`, read
+ * synchronously); tenant-level assignments/grants, roles, and org membership
+ * live in the ControlPlaneDO and are reached over RPC (async). The whole
+ * evaluation still runs inside the ScopeDO's serialization domain, so
+ * check-after-write consistency holds — the "no zookies" property.
+ */
+const ENTITY_WALK_DEPTH = 4;
+const t = (subject, relation, object) => ({
+    subject: objectRef.parse(subject),
+    relation,
+    object: objectRef.parse(object),
+});
+export function createDoTupleChecker(deps) {
+    const scopeTuples = (subject, relationPrefix) => deps.scopeSql
+        .exec(`SELECT subject, relation, object, expires_at FROM _substrat_tuples
+         WHERE subject = ? AND relation LIKE ?`, subject, `${relationPrefix}%`)
+        .toArray();
+    const live = (row, now) => row.expires_at === null || row.expires_at > now;
+    return {
+        async check(principal, permission, node, entity) {
+            const now = new Date().toISOString();
+            const deny = { allowed: false, checked: permission, node };
+            const cp = deps.controlPlane;
+            // Rule 4 — membership: the subject set is the principal plus its orgs.
+            const subjects = [{ ref: `principal:${principal}` }];
+            for (const m of await cp.tenantTuples(node.tenantId, `principal:${principal}`, 'member')) {
+                if (m.relation === 'member' && live(m, now)) {
+                    subjects.push({ ref: m.object, via: t(m.subject, m.relation, m.object) });
+                }
+            }
+            // Inheritance (rule 2): a scope check also consults tenant-level tuples.
+            const nodeObjects = node.scopeId
+                ? [
+                    { obj: `scope:${node.scopeId}`, scoped: true },
+                    { obj: `tenant:${node.tenantId}`, scoped: false },
+                ]
+                : [{ obj: `tenant:${node.tenantId}`, scoped: false }];
+            const tuplesFor = async (subject, prefix, scoped) => scoped ? scopeTuples(subject, prefix) : cp.tenantTuples(node.tenantId, subject, prefix);
+            for (const nodeObj of nodeObjects) {
+                for (const subject of subjects) {
+                    // Rule 1 — role expansion.
+                    for (const row of await tuplesFor(subject.ref, 'role:', nodeObj.scoped)) {
+                        if (row.object !== nodeObj.obj || !live(row, now))
+                            continue;
+                        const roleKey = row.relation.slice('role:'.length);
+                        const role = await cp.getRole(node.tenantId, roleKey);
+                        if (role?.permissions.includes(permission)) {
+                            return {
+                                allowed: true,
+                                proof: [
+                                    ...(subject.via ? [subject.via] : []),
+                                    t(row.subject, row.relation, row.object),
+                                    t(`role:${roleKey}`, `granted:${permission}`, nodeObj.obj),
+                                ],
+                            };
+                        }
+                    }
+                    // Direct grants at the node.
+                    for (const row of await tuplesFor(subject.ref, `granted:${permission}`, nodeObj.scoped)) {
+                        if (row.object === nodeObj.obj &&
+                            row.relation === `granted:${permission}` &&
+                            live(row, now)) {
+                            return {
+                                allowed: true,
+                                proof: [
+                                    ...(subject.via ? [subject.via] : []),
+                                    t(row.subject, row.relation, row.object),
+                                ],
+                            };
+                        }
+                    }
+                }
+            }
+            // Rule 3 — entity walk along declared parent edges (entity grants are
+            // scope-local by construction).
+            if (entity) {
+                let frontier = [{ ref: `${entity.entityType}:${entity.entityId}`, chain: [] }];
+                for (let depth = 0; depth <= ENTITY_WALK_DEPTH && frontier.length > 0; depth++) {
+                    // grant lookup at current frontier objects
+                    for (const candidate of frontier) {
+                        for (const subject of subjects) {
+                            const grant = deps.scopeSql
+                                .exec(`SELECT subject, relation, object, expires_at FROM _substrat_tuples
+                   WHERE subject = ? AND relation = ? AND object = ?`, subject.ref, `granted:${permission}`, candidate.ref)
+                                .toArray()[0];
+                            if (grant && live(grant, now)) {
+                                return {
+                                    allowed: true,
+                                    proof: [
+                                        ...(subject.via ? [subject.via] : []),
+                                        ...candidate.chain,
+                                        t(grant.subject, grant.relation, grant.object),
+                                    ],
+                                };
+                            }
+                        }
+                    }
+                    // expand one level of parents
+                    const next = [];
+                    for (const candidate of frontier) {
+                        const parents = deps.scopeSql
+                            .exec(`SELECT subject, relation, object, expires_at FROM _substrat_tuples
+                 WHERE subject = ? AND relation = 'parent'`, candidate.ref)
+                            .toArray();
+                        for (const p of parents) {
+                            next.push({
+                                ref: p.object,
+                                chain: [...candidate.chain, t(p.subject, 'parent', p.object)],
+                            });
+                        }
+                    }
+                    frontier = next;
+                }
+            }
+            return deny;
+        },
+    };
+}
+//# sourceMappingURL=checker.js.map

package/dist/checker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checker.js","sourceRoot":"","sources":["../src/checker.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,GAQV,MAAM,yBAAyB,CAAC;AAGjC;;;;;;;;;;;;;GAaG;AAEH,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAsB5B,MAAM,CAAC,GAAG,CAAC,OAAe,EAAE,QAAgB,EAAE,MAAc,EAAiB,EAAE,CAAC,CAAC;IAC/E,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC;IACjC,QAAQ;IACR,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC;CAChC,CAAC,CAAC;AAEH,MAAM,UAAU,oBAAoB,CAAC,IAAmB;IACtD,MAAM,WAAW,GAAG,CAAC,OAAe,EAAE,cAAsB,EAAc,EAAE,CAC1E,IAAI,CAAC,QAAQ;SACV,IAAI,CACH;+CACuC,EACvC,OAAO,EACP,GAAG,cAAc,GAAG,CACrB;SACA,OAAO,EAA2B,CAAC;IAExC,MAAM,IAAI,GAAG,CAAC,GAAa,EAAE,GAAW,EAAW,EAAE,CACnD,GAAG,CAAC,UAAU,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;IAElD,OAAO;QACL,KAAK,CAAC,KAAK,CACT,SAAsB,EACtB,UAAyB,EACzB,IAAU,EACV,MAAkB;YAElB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACrC,MAAM,IAAI,GAAa,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;YACrE,MAAM,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC;YAE7B,uEAAuE;YACvE,MAAM,QAAQ,GAA2C,CAAC,EAAE,GAAG,EAAE,aAAa,SAAS,EAAE,EAAE,CAAC,CAAC;YAC7F,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,SAAS,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACzF,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;oBAC5C,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC5E,CAAC;YACH,CAAC;YAED,yEAAyE;YACzE,MAAM,WAAW,GAAuC,IAAI,CAAC,OAAO;gBAClE,CAAC,CAAC;oBACE,EAAE,GAAG,EAAE,SAAS,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;oBAC9C,EAAE,GAAG,EAAE,UAAU,IAAI,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;iBAClD;gBACH,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,IAAI,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAExD,MAAM,SAAS,GAAG,KAAK,EACrB,OAAe,EACf,MAAc,EACd,MAAe,EACM,EAAE,CACvB,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YAE1F,KAAK,MAAM,OAAO,IAAI,WAAW,EAAE,CAAC;gBAClC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;oBAC/B,2BAA2B;oBAC3B,KAAK,MAAM,GAAG,IAAI,MAAM,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;wBACxE,IAAI,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC;4BAAE,SAAS;wBAC5D,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;wBACnD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;wBACtD,IAAI,IAAI,EAAE,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;4BAC3C,OAAO;gCACL,OAAO,EAAE,IAAI;gCACb,KAAK,EAAE;oCACL,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oCACrC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC;oCACxC,CAAC,CAAC,QAAQ,OAAO,EAAE,EAAE,WAAW,UAAU,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC;iCAC3D;6BACF,CAAC;wBACJ,CAAC;oBACH,CAAC;oBACD,6BAA6B;oBAC7B,KAAK,MAAM,GAAG,IAAI,MAAM,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,UAAU,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;wBACxF,IACE,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC,GAAG;4BAC1B,GAAG,CAAC,QAAQ,KAAK,WAAW,UAAU,EAAE;4BACxC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,EACd,CAAC;4BACD,OAAO;gCACL,OAAO,EAAE,IAAI;gCACb,KAAK,EAAE;oCACL,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oCACrC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC;iCACzC;6BACF,CAAC;wBACJ,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YAED,sEAAsE;YACtE,gCAAgC;YAChC,IAAI,MAAM,EAAE,CAAC;gBAEX,IAAI,QAAQ,GAAe,CAAC,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;gBAC3F,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,iBAAiB,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;oBAC/E,2CAA2C;oBAC3C,KAAK,MAAM,SAAS,IAAI,QAAQ,EAAE,CAAC;wBACjC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;4BAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ;iCACxB,IAAI,CACH;qEACmD,EACnD,OAAO,CAAC,GAAG,EACX,WAAW,UAAU,EAAE,EACvB,SAAS,CAAC,GAAG,CACd;iCACA,OAAO,EAAE,CAAC,CAAC,CAAoC,CAAC;4BACnD,IAAI,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;gCAC9B,OAAO;oCACL,OAAO,EAAE,IAAI;oCACb,KAAK,EAAE;wCACL,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;wCACrC,GAAG,SAAS,CAAC,KAAK;wCAClB,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC;qCAC/C;iCACF,CAAC;4BACJ,CAAC;wBACH,CAAC;oBACH,CAAC;oBACD,8BAA8B;oBAC9B,MAAM,IAAI,GAAe,EAAE,CAAC;oBAC5B,KAAK,MAAM,SAAS,IAAI,QAAQ,EAAE,CAAC;wBACjC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ;6BAC1B,IAAI,CACH;2DAC2C,EAC3C,SAAS,CAAC,GAAG,CACd;6BACA,OAAO,EAA2B,CAAC;wBACtC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;4BACxB,IAAI,CAAC,IAAI,CAAC;gCACR,GAAG,EAAE,CAAC,CAAC,MAAM;gCACb,KAAK,EAAE,CAAC,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;6BAC9D,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;oBACD,QAAQ,GAAG,IAAI,CAAC;gBAClB,CAAC;YACH,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/control-plane-do.d.ts

@@ -0,0 +1,90 @@
+import { DurableObject } from 'cloudflare:workers';
+import type { AdminLogEntry, RoleDefinition, ScopeStatus, Tenant, TenantStatus } from '@substrat-run/contracts';
+/**
+ * The durable directory (control-plane.md §4). One singleton DO, backed by its
+ * own SQLite, is the WHOLE directory: the tenant registry, scope lifecycle,
+ * roles, tenant-level relation tuples, entitlements, identities, and the admin
+ * audit log. The coordinator (`CloudflareScopeHost`) is a stateless async router
+ * that `await`s RPCs to here — nothing directory-shaped lives in the Worker
+ * isolate anymore. A ScopeDO's permission checker reads `getRole`/`tenantTuples`
+ * from here for the tenant-level rows it cannot reach locally.
+ *
+ * Every method is synchronous DO SQL; the RPC layer makes them awaitable. The
+ * fail-closed cases THROW plain `Error`s (never a ZodError — the coordinator does
+ * all the Zod parsing before calling in), so the message survives the RPC hop.
+ * Effect methods return what the coordinator needs for the audit entry to spare
+ * it a read round-trip.
+ *
+ * Tuple placement follows the pure adapter's checker verbatim (§4.2): scope +
+ * entity tuples in the ScopeDO, tenant tuples + roles here.
+ */
+interface TupleRow {
+    subject: string;
+    relation: string;
+    object: string;
+    expires_at: string | null;
+}
+/** The shape the coordinator hands `recordAdmin`; before/after are arbitrary JSON. */
+export interface AdminEntryInput {
+    id: string;
+    actor: string;
+    action: string;
+    tenantId: string;
+    scopeId: string | null;
+    vertical: string | null;
+    before: unknown;
+    after: unknown;
+    at: string;
+}
+export declare class ControlPlaneDO extends DurableObject {
+    private readonly sql;
+    constructor(ctx: DurableObjectState, env: unknown);
+    private mapTenant;
+    private readTenant;
+    /** INSERT OR IGNORE; return the new tenant, or null if it already existed. */
+    createTenant(id: string, slug: string, name: string, createdAt: string): Tenant | null;
+    /** Throw if absent; else UPDATE and return the previous status. */
+    setTenantStatus(tenantId: string, status: TenantStatus): string;
+    getTenant(tenantId: string): Tenant | undefined;
+    listTenants(): Tenant[];
+    /**
+     * Mandatory active tenant: a scope with no tenant record is the "tenant is an
+     * FK string" hole the registry closes — fail closed. INSERT OR IGNORE the
+     * scope with status 'active'; return whether it was newly created.
+     */
+    provisionScope(tenantId: string, scopeId: string, storageShape: string, jurisdiction: string | null, createdAt: string): boolean;
+    /**
+     * The getScope gate (control-plane.md §4.1/§4.2): validate the scope belongs
+     * to the tenant and both records are active, or throw the fail-closed reason.
+     */
+    validateScopeAccess(tenantId: string, scopeId: string): void;
+    /**
+     * Validate ownership, enforce the legal transition graph (fail closed on an
+     * illegal one), flip the status. Returns the previous status for the audit.
+     * `action` rides along only to name the illegal-transition message.
+     */
+    transitionScope(tenantId: string, scopeId: string, from: string[], to: ScopeStatus, action: string): string;
+    /** INSERT OR REPLACE; return the previous role (for the audit `before`) or null. */
+    defineRole(tenantId: string, role: RoleDefinition): RoleDefinition | null;
+    getRole(tenantId: string, key: string): RoleDefinition | undefined;
+    writeTenantTuple(tenantId: string, subject: string, relation: string, object: string, expiresAt: string | null): void;
+    tenantTuples(tenantId: string, subject: string, relationPrefix: string): TupleRow[];
+    /** INSERT OR IGNORE; return whether it changed (idempotent). */
+    grantEntitlement(tenantId: string, key: string): boolean;
+    /** DELETE; return whether it changed (idempotent). */
+    revokeEntitlement(tenantId: string, key: string): boolean;
+    tenantHoldsEntitlement(tenantId: string, key: string): boolean;
+    listEntitlements(tenantId: string): string[];
+    /** INSERT OR IGNORE; return whether it changed (idempotent). */
+    linkIdentity(provider: string, externalId: string, principal: string, tenantId: string, scopeId: string | null, createdAt: string): boolean;
+    resolveIdentity(provider: string, externalId: string): {
+        principal: string;
+        tenantId: string;
+        scopeId: string | null;
+    } | undefined;
+    /** Append one audit row. before/after are arbitrary JSON, stringified here. */
+    recordAdmin(entry: AdminEntryInput): void;
+    auditLog(tenantId: string | null): AdminLogEntry[];
+}
+export {};
+//# sourceMappingURL=control-plane-do.d.ts.map

package/dist/control-plane-do.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"control-plane-do.d.ts","sourceRoot":"","sources":["../src/control-plane-do.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,KAAK,EACV,aAAa,EACb,cAAc,EACd,WAAW,EACX,MAAM,EACN,YAAY,EACb,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;;;;;;;;;GAiBG;AAEH,UAAU,QAAQ;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAsBD,sFAAsF;AACtF,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,EAAE,EAAE,MAAM,CAAC;CACZ;AA6DD,qBAAa,cAAe,SAAQ,aAAa;IAC/C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;gBAErB,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,OAAO;IAWjD,OAAO,CAAC,SAAS;IAUjB,OAAO,CAAC,UAAU;IAOlB,8EAA8E;IAC9E,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAatF,mEAAmE;IACnE,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,MAAM;IAO/D,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAI/C,WAAW,IAAI,MAAM,EAAE;IAQvB;;;;OAIG;IACH,cAAc,CACZ,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,GAAG,IAAI,EAC3B,SAAS,EAAE,MAAM,GAChB,OAAO;IA4BV;;;OAGG;IACH,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI;IAqB5D;;;;OAIG;IACH,eAAe,CACb,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,EAAE,EAAE,WAAW,EACf,MAAM,EAAE,MAAM,GACb,MAAM;IAmBT,oFAAoF;IACpF,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,cAAc,GAAG,IAAI;IAazE,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAkBlE,gBAAgB,CACd,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAAG,IAAI,GACvB,IAAI;IAaP,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,QAAQ,EAAE;IAcnF,gEAAgE;IAChE,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO;IAWxD,sDAAsD;IACtD,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO;IAUzD,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO;IAY9D,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE;IAa5C,gEAAgE;IAChE,YAAY,CACV,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GAAG,IAAI,EACtB,SAAS,EAAE,MAAM,GAChB,OAAO;IAwBV,eAAe,CACb,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GACjB;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,SAAS;IAiB9E,+EAA+E;IAC/E,WAAW,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI;IAiBzC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,aAAa,EAAE;CAwBnD"}

package/dist/control-plane-do.js

@@ -0,0 +1,279 @@
+import { DurableObject } from 'cloudflare:workers';
+const DIRECTORY_DDL = `
+  CREATE TABLE IF NOT EXISTS tenants (
+    tenant_id TEXT PRIMARY KEY,
+    slug TEXT NOT NULL,
+    name TEXT NOT NULL,
+    status TEXT NOT NULL DEFAULT 'active',
+    created_at TEXT NOT NULL
+  );
+  CREATE TABLE IF NOT EXISTS scopes (
+    scope_id TEXT PRIMARY KEY,
+    tenant_id TEXT NOT NULL,
+    storage_shape TEXT NOT NULL DEFAULT 'A',
+    jurisdiction TEXT,
+    status TEXT NOT NULL DEFAULT 'active',
+    schema_version TEXT NOT NULL DEFAULT '0',
+    created_at TEXT NOT NULL
+  );
+  CREATE TABLE IF NOT EXISTS _substrat_tenant_tuples (
+    tenant_id TEXT NOT NULL,
+    subject TEXT NOT NULL,
+    relation TEXT NOT NULL,
+    object TEXT NOT NULL,
+    expires_at TEXT,
+    PRIMARY KEY (tenant_id, subject, relation, object)
+  );
+  CREATE TABLE IF NOT EXISTS _substrat_roles (
+    tenant_id TEXT NOT NULL,
+    role_key TEXT NOT NULL,
+    permissions TEXT NOT NULL,
+    source TEXT NOT NULL,
+    PRIMARY KEY (tenant_id, role_key)
+  );
+  CREATE TABLE IF NOT EXISTS _substrat_entitlements (
+    tenant_id TEXT NOT NULL,
+    entitlement_key TEXT NOT NULL,
+    PRIMARY KEY (tenant_id, entitlement_key)
+  );
+  CREATE TABLE IF NOT EXISTS _substrat_identities (
+    provider     TEXT NOT NULL,
+    external_id  TEXT NOT NULL,
+    principal_id TEXT NOT NULL,
+    tenant_id    TEXT NOT NULL,
+    scope_id     TEXT,
+    created_at   TEXT NOT NULL,
+    PRIMARY KEY (provider, external_id)
+  );
+  CREATE TABLE IF NOT EXISTS _substrat_admin_log (
+    id TEXT PRIMARY KEY,
+    actor TEXT NOT NULL,
+    action TEXT NOT NULL,
+    tenant_id TEXT NOT NULL,
+    scope_id TEXT,
+    vertical TEXT,
+    before TEXT,
+    after TEXT,
+    at TEXT NOT NULL
+  );
+`;
+export class ControlPlaneDO extends DurableObject {
+    sql;
+    constructor(ctx, env) {
+        super(ctx, env);
+        this.sql = ctx.storage.sql;
+        for (const stmt of DIRECTORY_DDL.split(';')) {
+            const s = stmt.trim();
+            if (s)
+                this.sql.exec(s);
+        }
+    }
+    // -- tenant registry (control-plane.md §4.1) --------------------------------
+    mapTenant(r) {
+        return {
+            id: r.tenant_id,
+            slug: r.slug,
+            name: r.name,
+            status: r.status,
+            createdAt: r.created_at,
+        };
+    }
+    readTenant(tenantId) {
+        const row = this.sql
+            .exec('SELECT * FROM tenants WHERE tenant_id = ?', tenantId)
+            .toArray()[0];
+        return row ? this.mapTenant(row) : undefined;
+    }
+    /** INSERT OR IGNORE; return the new tenant, or null if it already existed. */
+    createTenant(id, slug, name, createdAt) {
+        if (this.readTenant(id))
+            return null; // idempotent — nothing created
+        this.sql.exec(`INSERT OR IGNORE INTO tenants (tenant_id, slug, name, status, created_at)
+       VALUES (?, ?, ?, 'active', ?)`, id, slug, name, createdAt);
+        return this.readTenant(id) ?? null;
+    }
+    /** Throw if absent; else UPDATE and return the previous status. */
+    setTenantStatus(tenantId, status) {
+        const before = this.readTenant(tenantId);
+        if (!before)
+            throw new Error(`unknown tenant: ${tenantId}`);
+        this.sql.exec('UPDATE tenants SET status = ? WHERE tenant_id = ?', status, tenantId);
+        return before.status;
+    }
+    getTenant(tenantId) {
+        return this.readTenant(tenantId);
+    }
+    listTenants() {
+        return this.sql.exec('SELECT * FROM tenants ORDER BY tenant_id').toArray().map((r) => this.mapTenant(r));
+    }
+    // -- scope lifecycle (control-plane.md §4.1/§4.2) ---------------------------
+    /**
+     * Mandatory active tenant: a scope with no tenant record is the "tenant is an
+     * FK string" hole the registry closes — fail closed. INSERT OR IGNORE the
+     * scope with status 'active'; return whether it was newly created.
+     */
+    provisionScope(tenantId, scopeId, storageShape, jurisdiction, createdAt) {
+        const tenantRow = this.sql
+            .exec('SELECT status FROM tenants WHERE tenant_id = ?', tenantId)
+            .toArray()[0];
+        if (!tenantRow) {
+            throw new Error(`cannot provision scope under unknown tenant: ${tenantId}`);
+        }
+        if (tenantRow.status !== 'active') {
+            throw new Error(`cannot provision scope under non-active tenant (status: ${tenantRow.status}): ${tenantId}`);
+        }
+        const existed = this.sql.exec('SELECT 1 FROM scopes WHERE scope_id = ?', scopeId).toArray()[0] !== undefined;
+        if (!existed) {
+            this.sql.exec(`INSERT OR IGNORE INTO scopes (scope_id, tenant_id, storage_shape, jurisdiction, status, created_at)
+         VALUES (?, ?, ?, ?, 'active', ?)`, scopeId, tenantId, storageShape, jurisdiction, createdAt);
+        }
+        return !existed;
+    }
+    /**
+     * The getScope gate (control-plane.md §4.1/§4.2): validate the scope belongs
+     * to the tenant and both records are active, or throw the fail-closed reason.
+     */
+    validateScopeAccess(tenantId, scopeId) {
+        const row = this.sql
+            .exec('SELECT tenant_id, status FROM scopes WHERE scope_id = ?', scopeId)
+            .toArray()[0];
+        if (!row || row.tenant_id !== tenantId) {
+            throw new Error(`unknown scope for tenant: (${tenantId}, ${scopeId})`);
+        }
+        const tenantRow = this.sql
+            .exec('SELECT status FROM tenants WHERE tenant_id = ?', tenantId)
+            .toArray()[0];
+        if (!tenantRow) {
+            throw new Error(`scope has no tenant record: (${tenantId}, ${scopeId})`);
+        }
+        if (tenantRow.status !== 'active') {
+            throw new Error(`tenant not active (status: ${tenantRow.status}): ${tenantId}`);
+        }
+        if (row.status !== 'active') {
+            throw new Error(`scope not active (status: ${row.status}): ${scopeId}`);
+        }
+    }
+    /**
+     * Validate ownership, enforce the legal transition graph (fail closed on an
+     * illegal one), flip the status. Returns the previous status for the audit.
+     * `action` rides along only to name the illegal-transition message.
+     */
+    transitionScope(tenantId, scopeId, from, to, action) {
+        const row = this.sql
+            .exec('SELECT tenant_id, status FROM scopes WHERE scope_id = ?', scopeId)
+            .toArray()[0];
+        if (!row || row.tenant_id !== tenantId) {
+            throw new Error(`unknown scope for tenant: (${tenantId}, ${scopeId})`);
+        }
+        if (!from.includes(row.status)) {
+            throw new Error(`illegal scope transition for ${action}: ${row.status} → ${to} ` +
+                `(allowed from: ${from.join('|')})`);
+        }
+        this.sql.exec('UPDATE scopes SET status = ? WHERE scope_id = ?', to, scopeId);
+        return row.status;
+    }
+    // -- roles (checker rule 1) -------------------------------------------------
+    /** INSERT OR REPLACE; return the previous role (for the audit `before`) or null. */
+    defineRole(tenantId, role) {
+        const before = this.getRole(tenantId, role.key) ?? null;
+        this.sql.exec(`INSERT OR REPLACE INTO _substrat_roles (tenant_id, role_key, permissions, source)
+       VALUES (?, ?, ?, ?)`, tenantId, role.key, JSON.stringify(role.permissions), String(role.source));
+        return before;
+    }
+    getRole(tenantId, key) {
+        const row = this.sql
+            .exec('SELECT role_key, permissions, source FROM _substrat_roles WHERE tenant_id = ? AND role_key = ?', tenantId, key)
+            .toArray()[0];
+        if (!row)
+            return undefined;
+        return {
+            key: row.role_key,
+            permissions: JSON.parse(row.permissions),
+            source: row.source,
+        };
+    }
+    // -- tenant-level tuples (checker rules 1, 2, 4) ----------------------------
+    writeTenantTuple(tenantId, subject, relation, object, expiresAt) {
+        this.sql.exec(`INSERT OR REPLACE INTO _substrat_tenant_tuples
+         (tenant_id, subject, relation, object, expires_at)
+       VALUES (?, ?, ?, ?, ?)`, tenantId, subject, relation, object, expiresAt);
+    }
+    tenantTuples(tenantId, subject, relationPrefix) {
+        return this.sql
+            .exec(`SELECT subject, relation, object, expires_at FROM _substrat_tenant_tuples
+         WHERE tenant_id = ? AND subject = ? AND relation LIKE ?`, tenantId, subject, `${relationPrefix}%`)
+            .toArray();
+    }
+    // -- entitlements (control-plane.md §4.3) -----------------------------------
+    /** INSERT OR IGNORE; return whether it changed (idempotent). */
+    grantEntitlement(tenantId, key) {
+        if (this.tenantHoldsEntitlement(tenantId, key))
+            return false;
+        this.sql.exec(`INSERT OR IGNORE INTO _substrat_entitlements (tenant_id, entitlement_key)
+       VALUES (?, ?)`, tenantId, key);
+        return true;
+    }
+    /** DELETE; return whether it changed (idempotent). */
+    revokeEntitlement(tenantId, key) {
+        if (!this.tenantHoldsEntitlement(tenantId, key))
+            return false;
+        this.sql.exec('DELETE FROM _substrat_entitlements WHERE tenant_id = ? AND entitlement_key = ?', tenantId, key);
+        return true;
+    }
+    tenantHoldsEntitlement(tenantId, key) {
+        return (this.sql
+            .exec('SELECT 1 FROM _substrat_entitlements WHERE tenant_id = ? AND entitlement_key = ?', tenantId, key)
+            .toArray()[0] !== undefined);
+    }
+    listEntitlements(tenantId) {
+        return this.sql
+            .exec('SELECT entitlement_key FROM _substrat_entitlements WHERE tenant_id = ? ORDER BY entitlement_key', tenantId)
+            .toArray().map((r) => r.entitlement_key);
+    }
+    // -- identities (D-16; control-plane.md §6) ---------------------------------
+    /** INSERT OR IGNORE; return whether it changed (idempotent). */
+    linkIdentity(provider, externalId, principal, tenantId, scopeId, createdAt) {
+        const existed = this.sql
+            .exec('SELECT 1 FROM _substrat_identities WHERE provider = ? AND external_id = ?', provider, externalId)
+            .toArray()[0] !== undefined;
+        if (existed)
+            return false;
+        this.sql.exec(`INSERT OR IGNORE INTO _substrat_identities
+         (provider, external_id, principal_id, tenant_id, scope_id, created_at)
+       VALUES (?, ?, ?, ?, ?, ?)`, provider, externalId, principal, tenantId, scopeId, createdAt);
+        return true;
+    }
+    resolveIdentity(provider, externalId) {
+        const row = this.sql
+            .exec(`SELECT principal_id, tenant_id, scope_id FROM _substrat_identities
+         WHERE provider = ? AND external_id = ?`, provider, externalId)
+            .toArray()[0];
+        if (!row)
+            return undefined;
+        return { principal: row.principal_id, tenantId: row.tenant_id, scopeId: row.scope_id };
+    }
+    // -- admin audit log (control-plane.md §4.4) --------------------------------
+    /** Append one audit row. before/after are arbitrary JSON, stringified here. */
+    recordAdmin(entry) {
+        this.sql.exec(`INSERT INTO _substrat_admin_log
+         (id, actor, action, tenant_id, scope_id, vertical, before, after, at)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`, entry.id, entry.actor, entry.action, entry.tenantId, entry.scopeId, entry.vertical, entry.before == null ? null : JSON.stringify(entry.before), entry.after == null ? null : JSON.stringify(entry.after), entry.at);
+    }
+    auditLog(tenantId) {
+        const rows = (tenantId
+            ? this.sql.exec('SELECT * FROM _substrat_admin_log WHERE tenant_id = ? ORDER BY id', tenantId)
+            : this.sql.exec('SELECT * FROM _substrat_admin_log ORDER BY id')).toArray();
+        return rows.map((r) => ({
+            id: r.id,
+            actor: r.actor,
+            action: r.action,
+            tenantId: r.tenant_id,
+            scopeId: r.scope_id,
+            vertical: r.vertical,
+            before: r.before === null ? null : JSON.parse(r.before),
+            after: r.after === null ? null : JSON.parse(r.after),
+            at: r.at,
+        }));
+    }
+}
+//# sourceMappingURL=control-plane-do.js.map

package/dist/control-plane-do.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"control-plane-do.js","sourceRoot":"","sources":["../src/control-plane-do.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAoEnD,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyDrB,CAAC;AAEF,MAAM,OAAO,cAAe,SAAQ,aAAa;IAC9B,GAAG,CAAa;IAEjC,YAAY,GAAuB,EAAE,GAAY;QAC/C,KAAK,CAAC,GAAG,EAAE,GAAY,CAAC,CAAC;QACzB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC;QAC3B,KAAK,MAAM,IAAI,IAAI,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5C,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YACtB,IAAI,CAAC;gBAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,8EAA8E;IAEtE,SAAS,CAAC,CAAY;QAC5B,OAAO;YACL,EAAE,EAAE,CAAC,CAAC,SAAS;YACf,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,SAAS,EAAE,CAAC,CAAC,UAAU;SACd,CAAC;IACd,CAAC;IAEO,UAAU,CAAC,QAAgB;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG;aACjB,IAAI,CAAC,2CAA2C,EAAE,QAAQ,CAAC;aAC3D,OAAO,EAAE,CAAC,CAAC,CAA0B,CAAC;QACzC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/C,CAAC;IAED,8EAA8E;IAC9E,YAAY,CAAC,EAAU,EAAE,IAAY,EAAE,IAAY,EAAE,SAAiB;QACpE,IAAI,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,+BAA+B;QACrE,IAAI,CAAC,GAAG,CAAC,IAAI,CACX;qCAC+B,EAC/B,EAAE,EACF,IAAI,EACJ,IAAI,EACJ,SAAS,CACV,CAAC;QACF,OAAO,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC;IACrC,CAAC;IAED,mEAAmE;IACnE,eAAe,CAAC,QAAgB,EAAE,MAAoB;QACpD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,QAAQ,EAAE,CAAC,CAAC;QAC5D,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,mDAAmD,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QACrF,OAAO,MAAM,CAAC,MAAM,CAAC;IACvB,CAAC;IAED,SAAS,CAAC,QAAgB;QACxB,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;IAED,WAAW;QACT,OACE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC,OAAO,EAClE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IAED,8EAA8E;IAE9E;;;;OAIG;IACH,cAAc,CACZ,QAAgB,EAChB,OAAe,EACf,YAAoB,EACpB,YAA2B,EAC3B,SAAiB;QAEjB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG;aACvB,IAAI,CAAC,gDAAgD,EAAE,QAAQ,CAAC;aAChE,OAAO,EAAE,CAAC,CAAC,CAAmC,CAAC;QAClD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,gDAAgD,QAAQ,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACb,2DAA2D,SAAS,CAAC,MAAM,MAAM,QAAQ,EAAE,CAC5F,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GACX,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,yCAAyC,EAAE,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC;QAC/F,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,IAAI,CACX;0CACkC,EAClC,OAAO,EACP,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,SAAS,CACV,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,OAAO,CAAC;IAClB,CAAC;IAED;;;OAGG;IACH,mBAAmB,CAAC,QAAgB,EAAE,OAAe;QACnD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG;aACjB,IAAI,CAAC,yDAAyD,EAAE,OAAO,CAAC;aACxE,OAAO,EAAE,CAAC,CAAC,CAAsD,CAAC;QACrE,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,8BAA8B,QAAQ,KAAK,OAAO,GAAG,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG;aACvB,IAAI,CAAC,gDAAgD,EAAE,QAAQ,CAAC;aAChE,OAAO,EAAE,CAAC,CAAC,CAAmC,CAAC;QAClD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,gCAAgC,QAAQ,KAAK,OAAO,GAAG,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,8BAA8B,SAAS,CAAC,MAAM,MAAM,QAAQ,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,CAAC,MAAM,MAAM,OAAO,EAAE,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,eAAe,CACb,QAAgB,EAChB,OAAe,EACf,IAAc,EACd,EAAe,EACf,MAAc;QAEd,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG;aACjB,IAAI,CAAC,yDAAyD,EAAE,OAAO,CAAC;aACxE,OAAO,EAAE,CAAC,CAAC,CAAsD,CAAC;QACrE,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,8BAA8B,QAAQ,KAAK,OAAO,GAAG,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,gCAAgC,MAAM,KAAK,GAAG,CAAC,MAAM,MAAM,EAAE,GAAG;gBAC9D,kBAAkB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CACtC,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,iDAAiD,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;QAC9E,OAAO,GAAG,CAAC,MAAM,CAAC;IACpB,CAAC;IAED,8EAA8E;IAE9E,oFAAoF;IACpF,UAAU,CAAC,QAAgB,EAAE,IAAoB;QAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;QACxD,IAAI,CAAC,GAAG,CAAC,IAAI,CACX;2BACqB,EACrB,QAAQ,EACR,IAAI,CAAC,GAAG,EACR,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,EAChC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CACpB,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO,CAAC,QAAgB,EAAE,GAAW;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG;aACjB,IAAI,CACH,gGAAgG,EAChG,QAAQ,EACR,GAAG,CACJ;aACA,OAAO,EAAE,CAAC,CAAC,CAA0E,CAAC;QACzF,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAC3B,OAAO;YACL,GAAG,EAAE,GAAG,CAAC,QAAQ;YACjB,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC;YACxC,MAAM,EAAE,GAAG,CAAC,MAAM;SACD,CAAC;IACtB,CAAC;IAED,8EAA8E;IAE9E,gBAAgB,CACd,QAAgB,EAChB,OAAe,EACf,QAAgB,EAChB,MAAc,EACd,SAAwB;QAExB,IAAI,CAAC,GAAG,CAAC,IAAI,CACX;;8BAEwB,EACxB,QAAQ,EACR,OAAO,EACP,QAAQ,EACR,MAAM,EACN,SAAS,CACV,CAAC;IACJ,CAAC;IAED,YAAY,CAAC,QAAgB,EAAE,OAAe,EAAE,cAAsB;QACpE,OAAO,IAAI,CAAC,GAAG;aACZ,IAAI,CACH;iEACyD,EACzD,QAAQ,EACR,OAAO,EACP,GAAG,cAAc,GAAG,CACrB;aACA,OAAO,EAA2B,CAAC;IACxC,CAAC;IAED,8EAA8E;IAE9E,gEAAgE;IAChE,gBAAgB,CAAC,QAAgB,EAAE,GAAW;QAC5C,IAAI,IAAI,CAAC,sBAAsB,CAAC,QAAQ,EAAE,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAC7D,IAAI,CAAC,GAAG,CAAC,IAAI,CACX;qBACe,EACf,QAAQ,EACR,GAAG,CACJ,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,sDAAsD;IACtD,iBAAiB,CAAC,QAAgB,EAAE,GAAW;QAC7C,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,QAAQ,EAAE,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9D,IAAI,CAAC,GAAG,CAAC,IAAI,CACX,gFAAgF,EAChF,QAAQ,EACR,GAAG,CACJ,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,sBAAsB,CAAC,QAAgB,EAAE,GAAW;QAClD,OAAO,CACL,IAAI,CAAC,GAAG;aACL,IAAI,CACH,kFAAkF,EAClF,QAAQ,EACR,GAAG,CACJ;aACA,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,CAC9B,CAAC;IACJ,CAAC;IAED,gBAAgB,CAAC,QAAgB;QAC/B,OACE,IAAI,CAAC,GAAG;aACL,IAAI,CACH,iGAAiG,EACjG,QAAQ,CACT;aACA,OAAO,EACX,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;IAClC,CAAC;IAED,8EAA8E;IAE9E,gEAAgE;IAChE,YAAY,CACV,QAAgB,EAChB,UAAkB,EAClB,SAAiB,EACjB,QAAgB,EAChB,OAAsB,EACtB,SAAiB;QAEjB,MAAM,OAAO,GACX,IAAI,CAAC,GAAG;aACL,IAAI,CACH,2EAA2E,EAC3E,QAAQ,EACR,UAAU,CACX;aACA,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC;QAChC,IAAI,OAAO;YAAE,OAAO,KAAK,CAAC;QAC1B,IAAI,CAAC,GAAG,CAAC,IAAI,CACX;;iCAE2B,EAC3B,QAAQ,EACR,UAAU,EACV,SAAS,EACT,QAAQ,EACR,OAAO,EACP,SAAS,CACV,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,eAAe,CACb,QAAgB,EAChB,UAAkB;QAElB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG;aACjB,IAAI,CACH;gDACwC,EACxC,QAAQ,EACR,UAAU,CACX;aACA,OAAO,EAAE,CAAC,CAAC,CAED,CAAC;QACd,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAC3B,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,YAAY,EAAE,QAAQ,EAAE,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;IACzF,CAAC;IAED,8EAA8E;IAE9E,+EAA+E;IAC/E,WAAW,CAAC,KAAsB;QAChC,IAAI,CAAC,GAAG,CAAC,IAAI,CACX;;0CAEoC,EACpC,KAAK,CAAC,EAAE,EACR,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,EAC1D,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,EACxD,KAAK,CAAC,EAAE,CACT,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,QAAuB;QAC9B,MAAM,IAAI,GAAG,CACX,QAAQ;YACN,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CACX,mEAAmE,EACnE,QAAQ,CACT;YACH,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,+CAA+C,CAAC,CACnE,CAAC,OAAO,EAA8B,CAAC;QACxC,OAAO,IAAI,CAAC,GAAG,CACb,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC;YACC,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,QAAQ,EAAE,CAAC,CAAC,SAAS;YACrB,OAAO,EAAE,CAAC,CAAC,QAAQ;YACnB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,MAAM,EAAE,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;YACvD,KAAK,EAAE,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;YACpD,EAAE,EAAE,CAAC,CAAC,EAAE;SACT,CAAkB,CACtB,CAAC;IACJ,CAAC;CACF"}

package/dist/host.d.ts

@@ -0,0 +1,34 @@
+import { type PlatformActorId, type PrincipalId, type ScopeId, type TenantId } from '@substrat-run/contracts';
+import { type HostAdmin, type ModuleRegistration, type OperationHandler, type PermissionChecker, type ProvisionScopeInput, type ScopeHost, type ScopeStub } from '@substrat-run/kernel';
+export interface CloudflareScopeHostOptions {
+    scope: DurableObjectNamespace;
+    controlPlane: DurableObjectNamespace;
+    /**
+     * Accepted for parity with the pure adapter's constructor. In milestone 1 the
+     * ScopeDO owns permission evaluation (a checker function cannot cross the RPC
+     * boundary), so this is informational only — the DO builds the tuple checker.
+     */
+    checker?: PermissionChecker;
+}
+export declare class CloudflareScopeHost implements ScopeHost {
+    readonly admin: HostAdmin;
+    private readonly scopeNs;
+    private readonly cp;
+    private readonly moduleIds;
+    private readonly operations;
+    private readonly predicateNames;
+    private readonly withdrawn;
+    private readonly operationEntitlement;
+    constructor(options: CloudflareScopeHostOptions);
+    registerModule(registration: ModuleRegistration): void;
+    defineOperation<I, O>(name: string, _handler: OperationHandler<I, O>): void;
+    private bindOperation;
+    provisionScope(actor: PlatformActorId, input: ProvisionScopeInput): Promise<void>;
+    getScope(principal: PrincipalId, tenantId: TenantId, scopeId: ScopeId): Promise<ScopeStub>;
+    close(): Promise<void>;
+    private buildAdmin;
+    private recordAdmin;
+    private writeScopeTuple;
+    private scopeStub;
+}
+//# sourceMappingURL=host.d.ts.map

package/dist/host.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host.d.ts","sourceRoot":"","sources":["../src/host.ts"],"names":[],"mappings":"AAAA,OAAO,EAgBL,KAAK,eAAe,EACpB,KAAK,WAAW,EAIhB,KAAK,OAAO,EAGZ,KAAK,QAAQ,EAEd,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAEL,KAAK,SAAS,EACd,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,SAAS,EACd,KAAK,SAAS,EACf,MAAM,sBAAsB,CAAC;AA2G9B,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,sBAAsB,CAAC;IAC9B,YAAY,EAAE,sBAAsB,CAAC;IACrC;;;;OAIG;IACH,OAAO,CAAC,EAAE,iBAAiB,CAAC;CAC7B;AAED,qBAAa,mBAAoB,YAAW,SAAS;IACnD,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAE1B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyB;IACjD,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAmB;IAItC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqB;IAC/C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAqB;IAChD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA6B;IAC5D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA6B;IACvD,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAA6B;gBAEtD,OAAO,EAAE,0BAA0B;IAU/C,cAAc,CAAC,YAAY,EAAE,kBAAkB,GAAG,IAAI;IAgDtD,eAAe,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI;IAI3E,OAAO,CAAC,aAAa;IAQf,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;IAwBjF,QAAQ,CACZ,SAAS,EAAE,WAAW,EACtB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,SAAS,CAAC;IA6Bf,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAM5B,OAAO,CAAC,UAAU;YAmMJ,WAAW;YAoBX,eAAe;IAU7B,OAAO,CAAC,SAAS;CAKlB"}