@substrat-run/adapter-cloudflare 0.98.0 → 0.102.0

package/dist/host.js

@@ -1,6 +1,6 @@
-import { fromWireFailure, accessLogEntry, adminLogEntry, opsFailureEntry, modelUsageEntry, attachmentRecord, createTenantInput, identityLink, identityPool, createOrgInput, promotionAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, registerVerticalInput, vertical as verticalSchema, verticalServingState, verticalChannel, verticalVersion, connection, capabilityGrant, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, entitlementGrant, entitlementGrantInput, instant, meterReading, subjectRef, createConnectionInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, org as orgSchema, orgMembership, resolvedIdentity, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, subjectShredReceipt, platformRequest, connectorDispatchKind, outboundOfManifestJson, substratError, } from '@substrat-run/contracts';
+import { fromWireFailure, accessLogEntry, adminLogEntry, opsFailureEntry, opsFailureFingerprint, issueEntry, sweepRunEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunsPayload, modelUsageEntry, attachmentRecord, createTenantInput, identityLink, identityPool, createOrgInput, promotionAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, registerVerticalInput, vertical as verticalSchema, verticalServingState, verticalChannel, verticalVersion, connection, capabilityGrant, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, entitlementGrant, entitlementGrantInput, instant, meterReading, subjectRef, createConnectionInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, org as orgSchema, orgMembership, resolvedIdentity, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, subjectShredReceipt, platformRequest, connectorDispatchKind, outboundOfManifestJson, substratError, } from '@substrat-run/contracts';
 import { normalizeHostname, toRouteTarget } from './route-resolver.js';
-import { attachmentBlobKey, entitlementDenial, foldMeterReading, parseValidationRecords, resolveScopeRecord, ulid, foldModelUsage, backoffAt, resolveRetryPolicy, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, openSealed, ImpersonationRefused, assertSessionUsable, impersonationRowValues, mapImpersonationRow, newImpersonationSession, } from '@substrat-run/kernel';
+import { attachmentBlobKey, entitlementDenial, foldMeterReading, parseValidationRecords, resolveScopeRecord, ulid, foldModelUsage, backoffAt, resolveRetryPolicy, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, openSealed, ImpersonationRefused, assertSessionUsable, impersonationRowValues, mapImpersonationRow, newImpersonationSession, globalFetch, } from '@substrat-run/kernel';
 import { tenantStoreDatabaseName } from './d1.js';
 import { blobStoreBucketName, r2TenantBlobStore } from './r2.js';
 /** DO row → contract shape. Never reads the secrets table — that is the split. */
@@ -81,6 +81,10 @@ export class CloudflareScopeHost {
     moduleIds = new Set();
     /** Module id → its declared recurring schedules (#383), for `registeredSchedules`/`runDueSchedules`. */
     moduleSchedules = new Map();
+    /** #1232: declared freshness per module. Registered UNCONDITIONALLY — the schedule
+     *  map is only populated for modules WITH schedules, and hanging freshness off it
+     *  would drop a freshness-only module at registration. */
+    moduleFreshness = new Map();
     /** Registered (module, version) pairs — the frontier `schemaVersion` counts toward (§5.3, #49). */
     migrationTotal = 0;
     operations = new Set();
@@ -122,7 +126,7 @@ export class CloudflareScopeHost {
         this.tenantStores = options.tenantStores;
         this.blobStores = options.blobStores;
         this.attachmentBuckets = options.attachmentBuckets;
-        this.fetchImpl = options.fetch ?? ((input, init) => globalThis.fetch(input, init));
+        this.fetchImpl = options.fetch ?? globalFetch;
         this.scopeLocalPermissions = options.scopeLocalPermissions ?? false;
         this.scopeNs = options.scope;
         this.cpLess = !options.controlPlane;
@@ -326,6 +330,14 @@ export class CloudflareScopeHost {
         await this.migrateAndRecord(scopeId);
         return this.scopeStub(scopeId).executorDeadLetters();
     }
+    /**
+     * #1232: hand one pass's schedule outcomes to the scope's own intent journal —
+     * the CP-less deployment's only road to `_substrat_sweep_runs`. Null = the
+     * journal is full and the report was deliberately dropped, never queued late.
+     */
+    async enqueueSweepRuns(scopeId, payload) {
+        return this.scopeStub(scopeId).enqueueSweepRuns(JSON.stringify(sweepRunsPayload.parse(payload)), JSON.stringify({ system: 'scope-sweeper' }));
+    }
     async listPlatformRequests(tenantId, scopeId) {
         await this.cp.validateScopeAccess(tenantId, scopeId);
         await this.migrateAndRecord(scopeId);
@@ -531,6 +543,9 @@ export class CloudflareScopeHost {
         if (manifest.schedules && manifest.schedules.length > 0) {
             this.moduleSchedules.set(manifest.id, manifest.schedules);
         }
+        if (manifest.freshness && manifest.freshness.length > 0) {
+            this.moduleFreshness.set(manifest.id, manifest.freshness);
+        }
         this.migrationTotal += migrations.length;
         const ownOperations = new Set(Object.keys(registration.operations ?? {}));
         for (const name of manifest.withdraws ?? []) {
@@ -1075,8 +1090,64 @@ export class CloudflareScopeHost {
         }
         return out;
     }
+    registeredFreshness() {
+        const out = [];
+        for (const [moduleId, freshness] of this.moduleFreshness) {
+            if (freshness.length > 0)
+                out.push({ moduleId: moduleId, freshness });
+        }
+        return out;
+    }
+    /**
+     * The freshness evaluator (#1232), CF half — same verdicts and gating as the pure
+     * adapter's, over one `freshnessProbe` round trip to the scope DO. Aggregates
+     * across EVERY registered module (two modules declaring one type share one
+     * gating-state key and one dedupe unit — per-module evaluation would corrupt
+     * both), collapsing duplicates to the tightest window; called once per scope,
+     * any registered module's id as the entry ticket. NOT gated on the system
+     * grant — see the kernel interface doc.
+     */
+    async checkFreshness(moduleId, tenantId, scopeId) {
+        const report = { checks: [] };
+        if (!this.moduleIds.has(moduleId))
+            return report;
+        if (!this.cpLess) {
+            const rec = await this.cp.getScopeRecord(tenantId, scopeId);
+            if (!rec || rec.status !== 'active')
+                return report;
+        }
+        const stub = this.scopeStub(scopeId);
+        const windows = new Map();
+        for (const specs of this.moduleFreshness.values()) {
+            for (const f of specs) {
+                const prev = windows.get(f.eventType);
+                if (prev === undefined || f.within.hours < prev)
+                    windows.set(f.eventType, f.within.hours);
+            }
+        }
+        if (windows.size === 0)
+            return report;
+        const probe = await stub.freshnessProbe([...windows.keys()]);
+        const now = Date.now();
+        const nowIso = new Date(now).toISOString();
+        for (const [eventType, withinHours] of windows) {
+            const p = probe[eventType] ?? { observedAt: null, stateAt: null, stateOutcome: null };
+            const outcome = p.observedAt === null
+                ? 'skipped' // never observed — the never-run analogue, not a failure
+                : now - Date.parse(p.observedAt) <= withinHours * 3_600_000
+                    ? 'ok'
+                    : 'failed';
+            const changed = p.stateOutcome !== outcome;
+            const heartbeatDue = p.stateAt === null || now - Date.parse(p.stateAt) > FRESHNESS_HEARTBEAT_MINUTES * 60_000;
+            if (!changed && !heartbeatDue)
+                continue;
+            await stub.recordScheduleRun(`freshness:${eventType}`, nowIso, outcome);
+            report.checks.push({ eventType, outcome, observedAt: p.observedAt, withinHours });
+        }
+        return report;
+    }
     async runDueSchedules(moduleId, tenantId, scopeId) {
-        const report = { fired: 0, skipped: 0, failed: 0, errors: [] };
+        const report = { fired: 0, skipped: 0, failed: 0, errors: [], runs: [] };
         const schedules = this.moduleSchedules.get(moduleId);
         if (!schedules || schedules.length === 0)
             return report;
@@ -1103,6 +1174,7 @@ export class CloudflareScopeHost {
             const dueAt = lastRun === null ? -Infinity : lastRun + schedule.cadence.everyMinutes * 60_000;
             if (now < dueAt) {
                 report.skipped += 1;
+                report.runs.push({ operation: schedule.operation, outcome: 'skipped' });
                 continue;
             }
             let status = 'ok';
@@ -1120,6 +1192,7 @@ export class CloudflareScopeHost {
                 });
             }
             await stub.recordScheduleRun(schedule.operation, new Date(now).toISOString(), status);
+            report.runs.push({ operation: schedule.operation, outcome: status === 'ok' ? 'ok' : 'failed' });
         }
         return report;
     }
@@ -2702,11 +2775,15 @@ export class CloudflareScopeHost {
                     tenant_id: entry.tenantId ?? null,
                     scope_id: entry.scopeId ?? null,
                     vertical: entry.vertical ?? null,
+                    version: entry.version ?? null,
                     status: entry.status ?? null,
                     // Bounded here, not trusted from the catch site: one runaway upstream body
                     // must not become a runaway directory row (#559).
                     message: entry.message.slice(0, 2000),
                     reference: entry.reference ?? null,
+                    origin: entry.origin ?? null,
+                    code: entry.code ?? null,
+                    fingerprint: opsFailureFingerprint(entry),
                     at: new Date().toISOString(),
                 });
             },
@@ -2715,7 +2792,10 @@ export class CloudflareScopeHost {
                     tenantId: filter?.tenantId,
                     scopeId: filter?.scopeId,
                     vertical: filter?.vertical,
+                    version: filter?.version,
                     operation: filter?.operation,
+                    code: filter?.code,
+                    fingerprint: filter?.fingerprint,
                     reference: filter?.reference,
                     since: filter?.since,
                     until: filter?.until,
@@ -2728,6 +2808,67 @@ export class CloudflareScopeHost {
                 await this.recordAccess(actor, 'listOpsFailures', { tenantId: filter?.tenantId ?? null, scopeId: filter?.scopeId ?? null }, filter, rows.length);
                 return rows.map((r) => opsFailureEntry.parse(r));
             },
+            recordSweepRun: async (entry) => {
+                await this.cp.recordSweepRun({
+                    id: ulid(),
+                    kind: entry.kind,
+                    unit: entry.unit,
+                    outcome: entry.outcome,
+                    tenant_id: entry.tenantId ?? null,
+                    scope_id: entry.scopeId ?? null,
+                    vertical: entry.vertical ?? null,
+                    version: entry.version ?? null,
+                    operation: entry.operation ?? null,
+                    connection_id: entry.connectionId ?? null,
+                    // Bounded here, not trusted from the sweep (the #559 rule).
+                    error: entry.error == null ? null : entry.error.slice(0, 2000),
+                    elapsed_ms: entry.elapsedMs ?? null,
+                    request_id: entry.requestId ?? null,
+                    event_type: entry.eventType ?? null,
+                    observed_at: entry.observedAt ?? null,
+                    at: entry.at ?? new Date().toISOString(),
+                });
+            },
+            listSweepRuns: async (actor, filter) => {
+                const rows = await this.cp.listSweepRuns({
+                    kind: filter?.kind,
+                    unit: filter?.unit,
+                    outcome: filter?.outcome,
+                    tenantId: filter?.tenantId,
+                    scopeId: filter?.scopeId,
+                    vertical: filter?.vertical,
+                    connectionId: filter?.connectionId,
+                    since: filter?.since,
+                    until: filter?.until,
+                    limit: filter?.limit,
+                    cursor: filter?.cursor,
+                    order: filter?.order,
+                });
+                // Rows can name tenants and scopes, so reading them is recorded (K-24).
+                await this.recordAccess(actor, 'listSweepRuns', { tenantId: filter?.tenantId ?? null, scopeId: filter?.scopeId ?? null }, filter, rows.length);
+                return rows.map((r) => sweepRunEntry.parse(r));
+            },
+            listIssues: async (actor, filter) => {
+                const rows = await this.cp.listIssues({
+                    status: filter?.status,
+                    operation: filter?.operation,
+                    code: filter?.code,
+                    limit: filter?.limit,
+                });
+                // Issues aggregate fleet-wide failures; the read is recorded like the rows' own (K-24).
+                await this.recordAccess(actor, 'listIssues', {}, filter, rows.length);
+                return rows.map((r) => issueEntry.parse(r));
+            },
+            setIssueStatus: async (actor, fingerprint, status) => {
+                const change = await this.cp.setIssueStatus(fingerprint, status, new Date().toISOString());
+                if (!change)
+                    return undefined;
+                const before = issueEntry.parse(change.before);
+                const after = issueEntry.parse(change.after);
+                // A lifecycle flip is a staff mutation — audited with the diff (K-33).
+                await this.recordAdmin(actor, 'setIssueStatus', { tenantId: null, vertical: after.lastVertical }, { fingerprint, status: before.status }, { fingerprint, status: after.status });
+                return after;
+            },
             recordModelUsage: async (input) => {
                 const l = input.line;
                 return this.cp.recordModelUsage({