@substrat-run/adapter-cloudflare 0.55.0 → 0.57.0

package/dist/host.js

@@ -1,4 +1,4 @@
-import { accessLogEntry, adminLogEntry, opsFailureEntry, attachmentRecord, createTenantInput, identityLink, identityPool, createOrgInput, promotionAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, registerVerticalInput, vertical as verticalSchema, verticalServingState, verticalChannel, verticalVersion, connection, connectionGrant, connectionSecret, systemGrant, entitlementGrant, entitlementGrantInput, instant, meterReading, subjectRef, createConnectionInput, moduleManifest, org as orgSchema, orgMembership, resolvedIdentity, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, subjectShredReceipt, platformRequest, } from '@substrat-run/contracts';
+import { accessLogEntry, adminLogEntry, opsFailureEntry, attachmentRecord, createTenantInput, identityLink, identityPool, createOrgInput, promotionAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, registerVerticalInput, vertical as verticalSchema, verticalServingState, verticalChannel, verticalVersion, connection, connectionGrant, connectionSecret, systemGrant, entitlementGrant, entitlementGrantInput, instant, meterReading, subjectRef, createConnectionInput, moduleManifest, org as orgSchema, orgMembership, resolvedIdentity, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, subjectShredReceipt, platformRequest, connectorDispatchKind, } from '@substrat-run/contracts';
 import { normalizeHostname, toRouteTarget } from './route-resolver.js';
 import { attachmentBlobKey, foldMeterReading, parseValidationRecords, resolveScopeRecord, ulid, backoffAt, resolveRetryPolicy, unconfiguredSecretBox, createSubjectKeys, } from '@substrat-run/kernel';
 import { tenantStoreDatabaseName } from './d1.js';
@@ -102,6 +102,8 @@ export class CloudflareScopeHost {
     causedBy = null;
     withdrawn = new Map(); // operation → module
     operationEntitlement = new Map();
+    /** #574: remote connector write-back for scopes served by another deployment. */
+    connectorDelegation;
     /**
      * MUST be constructed per request. Never cache an instance across requests.
      *
@@ -125,6 +127,7 @@ export class CloudflareScopeHost {
         this.cp = options.controlPlane
             ? options.controlPlane.get(options.controlPlane.idFromName('control-plane'))
             : nullControlPlane();
+        this.connectorDelegation = options.connectorDelegation;
         this.admin = this.buildAdmin();
     }
     // -- registration mechanics (validation only) -----------------------------
@@ -147,6 +150,7 @@ export class CloudflareScopeHost {
             handler,
             retry: resolveRetryPolicy(options),
             timeoutMs: options?.timeoutMs ?? 30_000,
+            provider: options?.provider ?? id,
         });
     }
     /**
@@ -216,6 +220,7 @@ export class CloudflareScopeHost {
             delivered: 0,
             retrying: 0,
             deadLettered: 0,
+            routedToPlatform: 0,
         };
         if (this.executors.size === 0)
             return report;
@@ -227,14 +232,28 @@ export class CloudflareScopeHost {
                 report.attempted += 1;
                 this.causedBy = event.id;
                 try {
-                    if (executor.kind === 'connector') {
+                    if (executor.kind === 'connector' && this.cpLess) {
+                        // #574 phase 3: this host cannot run a connector — no connection
+                        // directory, no credentials, no sanctioned egress. Route the delivery
+                        // onto the platform-requests surface instead: the DO enqueues the
+                        // `connector:<provider>` intent and journals the delivery as routed in
+                        // one atomic verb, and the platform's drain executes the handler with
+                        // the authority this host lacks. The intent row carries the retry
+                        // state from here on; the handler's own idempotency ledger absorbs
+                        // the at-least-once residue, as it already must in-process.
+                        await stub.routeExecutorEventToPlatform(event.id, deliveryId, connectorDispatchKind(executor.provider), JSON.stringify({ executorId: id, event }), JSON.stringify({ system: 'connector-dispatch' }));
+                        report.routedToPlatform += 1;
+                    }
+                    else if (executor.kind === 'connector') {
                         await executor.handler(await this.connectorContext(tenantId, scopeId, executor.timeoutMs), event);
+                        await stub.recordExecutorAttempt(event.id, deliveryId, null, null);
+                        report.delivered += 1;
                     }
                     else {
                         await executor.handler(this.admin, event);
+                        await stub.recordExecutorAttempt(event.id, deliveryId, null, null);
+                        report.delivered += 1;
                     }
-                    await stub.recordExecutorAttempt(event.id, deliveryId, null, null);
-                    report.delivered += 1;
                 }
                 catch (err) {
                     const message = err instanceof Error ? (err.stack ?? err.message) : String(err);
@@ -263,6 +282,21 @@ export class CloudflareScopeHost {
         await this.migrateAndRecord(scopeId);
         return this.drainExecutors(tenantId, scopeId);
     }
+    async dispatchConnector(tenantId, scopeId, handler, event, options) {
+        // The platform half of a routed delivery (#574 phase 3). The same lifecycle gate as
+        // `drainDue` — a suspended scope's routed intent waits, it does not execute — and the
+        // same context build as the in-process path, so the handler cannot tell which host
+        // ran it. On a CP-less host `connectorContext` throws from the null control plane:
+        // fail closed, exactly the hole routing exists to avoid.
+        await this.cp.validateScopeAccess(tenantId, scopeId);
+        this.causedBy = event.id;
+        try {
+            await handler(await this.connectorContext(tenantId, scopeId, options?.timeoutMs ?? 30_000), event);
+        }
+        finally {
+            this.causedBy = null;
+        }
+    }
     async executorDeadLetters(tenantId, scopeId) {
         await this.cp.validateScopeAccess(tenantId, scopeId);
         await this.migrateAndRecord(scopeId);
@@ -654,6 +688,24 @@ export class CloudflareScopeHost {
                 `runs '${scope.vertical ?? 'none'}'`);
         }
         await this.cp.validateScopeAccess(conn.tenant_id, scopeId);
+        // #574: same delegation as getConnectorScope. Only `upload` crosses the seam in
+        // phase 1 — it is the one verb the reconcile path needs (landing the sealed PDF);
+        // the read/remove verbs fail loudly rather than pretending.
+        if (this.connectorDelegation) {
+            const delegation = this.connectorDelegation;
+            const tenant = conn.tenant_id;
+            const vertical = conn.vertical;
+            const notDelegated = (verb) => async () => {
+                throw new Error(`connector attachment ${verb} is not delegated (#574 phase 1) — only upload ` +
+                    `crosses the /internal seam to the serving deployment`);
+            };
+            return {
+                upload: (upload) => delegation.uploadAttachment({ connectionId, tenantId: tenant, scopeId, vertical, upload }),
+                list: notDelegated('list'),
+                open: notDelegated('open'),
+                remove: notDelegated('remove'),
+            };
+        }
         await this.migrateAndRecord(scopeId);
         const store = await this.resolveAttachmentStore(conn.tenant_id);
         return this.buildAttachmentSurface({ connectionId }, conn.tenant_id, scopeId, store);
@@ -876,6 +928,26 @@ export class CloudflareScopeHost {
                 `runs '${scope.vertical ?? 'none'}'`);
         }
         await this.cp.validateScopeAccess(conn.tenant_id, scopeId);
+        // #574: a scope served by ANOTHER deployment (the shared control plane running the
+        // connector pass for a dispatch vertical) — the write-back rides the delegation
+        // seam; migration is the serving deployment's business, exactly like provision.
+        if (this.connectorDelegation) {
+            const delegation = this.connectorDelegation;
+            const tenant = conn.tenant_id;
+            const vertical = conn.vertical;
+            return {
+                tenantId: tenant,
+                scopeId,
+                invoke: async (operation, input) => (await delegation.invoke({
+                    connectionId,
+                    tenantId: tenant,
+                    scopeId,
+                    vertical,
+                    operation,
+                    input,
+                })),
+            };
+        }
         await this.migrateAndRecord(scopeId);
         return this.buildStub(conn.tenant_id, scopeId, undefined, connectionId);
     }
@@ -974,11 +1046,15 @@ export class CloudflareScopeHost {
                     return Promise.reject(new Error(`operation not entitled: ${operation} — tenant does not hold '${requiredKey}'`));
                 }
                 const envelope = await stub.invoke(operation, input, asPrincipalId, tenantId, scopeId, connectionId, requiredKey, systemModuleId);
-                await this.drainExecutors(tenantId, scopeId);
+                const drained = await this.drainExecutors(tenantId, scopeId);
                 // #458: the operation committed having enqueued platform intents — tell the
                 // caller's harness so it can flag the response for the router kick (#381).
-                if (envelope.platformRequests > 0)
-                    options?.onPlatformRequests?.(envelope.platformRequests);
+                // Routed connector deliveries (#574 phase 3) count too: the inline drain just
+                // turned this operation's event into a `connector:<provider>` intent, and the
+                // kick is what collapses its dispatch latency from sweep-cadence to seconds.
+                const enqueued = envelope.platformRequests + (drained.routedToPlatform ?? 0);
+                if (enqueued > 0)
+                    options?.onPlatformRequests?.(enqueued);
                 return envelope.result;
             },
         };
@@ -1033,6 +1109,7 @@ export class CloudflareScopeHost {
             deploymentRef: r.deployment_ref,
             admission: r.admission,
             admissionNote: r.admission_note,
+            origin: r.origin_json ? JSON.parse(r.origin_json) : null,
             createdAt: r.created_at,
         });
         const mapOrg = (r) => orgSchema.parse({
@@ -1193,7 +1270,23 @@ export class CloudflareScopeHost {
                             `${grant.node.scopeId} runs '${scope.vertical ?? 'none'}'`);
                     }
                 }
-                await writeGrant(subjectRef({ kind: 'connection', id: grant.connectionId }), grant.permission, grant.node, undefined, grant.expiresAt);
+                // #574: a scope-level grant is a SCOPE tuple, and the scope's DO lives in the
+                // deployment serving it — for the shared control plane that is the vertical's
+                // dispatch script, so the tuple write rides the delegation seam. Tenant-level
+                // grants stay directory-side either way.
+                if (this.connectorDelegation && grant.node.scopeId) {
+                    await this.connectorDelegation.grant({
+                        connectionId: grant.connectionId,
+                        tenantId: grant.node.tenantId,
+                        scopeId: grant.node.scopeId,
+                        vertical: conn.vertical,
+                        permission: grant.permission,
+                        expiresAt: grant.expiresAt,
+                    });
+                }
+                else {
+                    await writeGrant(subjectRef({ kind: 'connection', id: grant.connectionId }), grant.permission, grant.node, undefined, grant.expiresAt);
+                }
                 await this.recordAdmin(actor, 'grantToConnection', { tenantId: grant.node.tenantId, scopeId: grant.node.scopeId, vertical: conn.vertical }, null, {
                     connectionId: grant.connectionId,
                     provider: conn.provider,
@@ -1372,16 +1465,18 @@ export class CloudflareScopeHost {
                 const selfAdmits = owning.owner_tenant !== null && !owning.listed;
                 // The manifest is retained for the serving upload (#286), not audited — a whole
                 // manifest per publish would drown the admin log in bundle metadata.
-                const { manifestJson, ...audited } = parsed;
+                const { manifestJson, origin, ...audited } = parsed;
                 await this.cp.insertVersion({
                     ...audited,
                     manifestJson: manifestJson ?? null,
+                    originJson: origin ? JSON.stringify(origin) : null,
                     admission: selfAdmits ? 'admitted' : 'pending',
                     admissionNote: selfAdmits ? AUTO_ADMISSION_NOTE : null,
                     createdAt: new Date().toISOString(),
                 });
                 await this.recordAdmin(actor, 'publishVersion', { tenantId: null }, null, {
                     ...audited,
+                    ...(origin ? { origin } : {}),
                     admission: selfAdmits ? 'admitted' : 'pending',
                 });
             },
@@ -2550,5 +2645,35 @@ export class CloudflareScopeHost {
     async grantEntityLocal(scopeId, principal, permission, entity) {
         await this.scopeStub(scopeId).writeTuple(`principal:${principal}`, `granted:${permission}`, `${entity.entityType}:${entity.entityId}`, null);
     }
+    // -- the connector write-back's far end (#574) -----------------------------
+    // A CP-less dispatch vertical cannot run a connector, so the shared control
+    // plane runs the pass FOR it and reaches back through the platform-secret-gated
+    // `/internal/connector-*` surface — these are that surface's host methods. The
+    // directory gates (live connection, tenant/vertical match) ran on the platform
+    // side before the call; what runs HERE is the half only this deployment can
+    // enforce: the scope's own permission check against its delivered
+    // `connection:<id>` tuple, in the scope's own DO. Fail closed — no grant, no
+    // effect — exactly as for any other caller.
+    /** Invoke ONE operation in this deployment as a CONNECTION (#574). */
+    async connectorInvokeLocal(connectionId, tenantId, scopeId, operation, input) {
+        await this.migrateAndRecord(scopeId);
+        return this.buildStub(tenantId, scopeId, undefined, connectionId).invoke(operation, input);
+    }
+    /** Land provider bytes in this deployment as a CONNECTION — the bytes leg (#574). */
+    async connectorAttachmentUploadLocal(connectionId, tenantId, scopeId, upload) {
+        await this.migrateAndRecord(scopeId);
+        const store = await this.resolveAttachmentStore(tenantId);
+        return this.buildAttachmentSurface({ connectionId }, tenantId, scopeId, store).upload(upload);
+    }
+    /**
+     * The delivery half of `grantToConnection` for a scope served HERE (#574): write
+     * the scope-local `connection:<id>` grant tuple the permission checker reads.
+     * Revocation needs no mirror verb — every delegated call re-passes the platform's
+     * live-connection gate first, so revoking the connection closes the door even
+     * while the tuple remains; `expiresAt` bounds the tuple itself.
+     */
+    async connectorGrantLocal(connectionId, scopeId, permission, expiresAt) {
+        await this.writeScopeTuple(scopeId, subjectRef({ kind: 'connection', id: connectionId }), `granted:${permission}`, `scope:${scopeId}`, expiresAt ?? null);
+    }
 }
 //# sourceMappingURL=host.js.map