@substrat-run/adapter-cloudflare 0.98.1 → 0.103.0

package/dist/host.js

@@ -1,6 +1,6 @@
-import { fromWireFailure, accessLogEntry, adminLogEntry, opsFailureEntry, modelUsageEntry, attachmentRecord, createTenantInput, identityLink, identityPool, createOrgInput, promotionAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, registerVerticalInput, vertical as verticalSchema, verticalServingState, verticalChannel, verticalVersion, connection, capabilityGrant, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, entitlementGrant, entitlementGrantInput, instant, meterReading, subjectRef, createConnectionInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, org as orgSchema, orgMembership, resolvedIdentity, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, subjectShredReceipt, platformRequest, connectorDispatchKind, outboundOfManifestJson, substratError, } from '@substrat-run/contracts';
+import { fromWireFailure, accessLogEntry, adminLogEntry, opsFailureEntry, opsFailureFingerprint, issueEntry, sweepRunEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunsPayload, modelUsageEntry, attachmentRecord, createTenantInput, identityLink, identityPool, createOrgInput, promotionAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, registerVerticalInput, vertical as verticalSchema, verticalServingState, verticalChannel, verticalVersion, connection, capabilityGrant, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, entitlementGrant, entitlementGrantInput, instant, meterReading, subjectRef, createConnectionInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, org as orgSchema, orgMembership, resolvedIdentity, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, subjectShredReceipt, platformRequest, connectorDispatchKind, outboundOfManifestJson, substratError, } from '@substrat-run/contracts';
 import { normalizeHostname, toRouteTarget } from './route-resolver.js';
-import { attachmentBlobKey, entitlementDenial, foldMeterReading, parseValidationRecords, resolveScopeRecord, ulid, foldModelUsage, backoffAt, resolveRetryPolicy, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, openSealed, ImpersonationRefused, assertSessionUsable, impersonationRowValues, mapImpersonationRow, newImpersonationSession, } from '@substrat-run/kernel';
+import { attachmentBlobKey, entitlementDenial, foldMeterReading, parseValidationRecords, resolveScopeRecord, ulid, foldModelUsage, backoffAt, resolveRetryPolicy, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, openSealed, ImpersonationRefused, assertSessionUsable, impersonationRowValues, mapImpersonationRow, newImpersonationSession, globalFetch, } from '@substrat-run/kernel';
 import { tenantStoreDatabaseName } from './d1.js';
 import { blobStoreBucketName, r2TenantBlobStore } from './r2.js';
 /** DO row → contract shape. Never reads the secrets table — that is the split. */
@@ -81,6 +81,10 @@ export class CloudflareScopeHost {
     moduleIds = new Set();
     /** Module id → its declared recurring schedules (#383), for `registeredSchedules`/`runDueSchedules`. */
     moduleSchedules = new Map();
+    /** #1232: declared freshness per module. Registered UNCONDITIONALLY — the schedule
+     *  map is only populated for modules WITH schedules, and hanging freshness off it
+     *  would drop a freshness-only module at registration. */
+    moduleFreshness = new Map();
     /** Registered (module, version) pairs — the frontier `schemaVersion` counts toward (§5.3, #49). */
     migrationTotal = 0;
     operations = new Set();
@@ -122,7 +126,7 @@ export class CloudflareScopeHost {
         this.tenantStores = options.tenantStores;
         this.blobStores = options.blobStores;
         this.attachmentBuckets = options.attachmentBuckets;
-        this.fetchImpl = options.fetch ?? ((input, init) => globalThis.fetch(input, init));
+        this.fetchImpl = options.fetch ?? globalFetch;
         this.scopeLocalPermissions = options.scopeLocalPermissions ?? false;
         this.scopeNs = options.scope;
         this.cpLess = !options.controlPlane;
@@ -326,6 +330,14 @@ export class CloudflareScopeHost {
         await this.migrateAndRecord(scopeId);
         return this.scopeStub(scopeId).executorDeadLetters();
     }
+    /**
+     * #1232: hand one pass's schedule outcomes to the scope's own intent journal —
+     * the CP-less deployment's only road to `_substrat_sweep_runs`. Null = the
+     * journal is full and the report was deliberately dropped, never queued late.
+     */
+    async enqueueSweepRuns(scopeId, payload) {
+        return this.scopeStub(scopeId).enqueueSweepRuns(JSON.stringify(sweepRunsPayload.parse(payload)), JSON.stringify({ system: 'scope-sweeper' }));
+    }
     async listPlatformRequests(tenantId, scopeId) {
         await this.cp.validateScopeAccess(tenantId, scopeId);
         await this.migrateAndRecord(scopeId);
@@ -531,6 +543,9 @@ export class CloudflareScopeHost {
         if (manifest.schedules && manifest.schedules.length > 0) {
             this.moduleSchedules.set(manifest.id, manifest.schedules);
         }
+        if (manifest.freshness && manifest.freshness.length > 0) {
+            this.moduleFreshness.set(manifest.id, manifest.freshness);
+        }
         this.migrationTotal += migrations.length;
         const ownOperations = new Set(Object.keys(registration.operations ?? {}));
         for (const name of manifest.withdraws ?? []) {
@@ -1075,8 +1090,64 @@ export class CloudflareScopeHost {
         }
         return out;
     }
+    registeredFreshness() {
+        const out = [];
+        for (const [moduleId, freshness] of this.moduleFreshness) {
+            if (freshness.length > 0)
+                out.push({ moduleId: moduleId, freshness });
+        }
+        return out;
+    }
+    /**
+     * The freshness evaluator (#1232), CF half — same verdicts and gating as the pure
+     * adapter's, over one `freshnessProbe` round trip to the scope DO. Aggregates
+     * across EVERY registered module (two modules declaring one type share one
+     * gating-state key and one dedupe unit — per-module evaluation would corrupt
+     * both), collapsing duplicates to the tightest window; called once per scope,
+     * any registered module's id as the entry ticket. NOT gated on the system
+     * grant — see the kernel interface doc.
+     */
+    async checkFreshness(moduleId, tenantId, scopeId) {
+        const report = { checks: [] };
+        if (!this.moduleIds.has(moduleId))
+            return report;
+        if (!this.cpLess) {
+            const rec = await this.cp.getScopeRecord(tenantId, scopeId);
+            if (!rec || rec.status !== 'active')
+                return report;
+        }
+        const stub = this.scopeStub(scopeId);
+        const windows = new Map();
+        for (const specs of this.moduleFreshness.values()) {
+            for (const f of specs) {
+                const prev = windows.get(f.eventType);
+                if (prev === undefined || f.within.hours < prev)
+                    windows.set(f.eventType, f.within.hours);
+            }
+        }
+        if (windows.size === 0)
+            return report;
+        const probe = await stub.freshnessProbe([...windows.keys()]);
+        const now = Date.now();
+        const nowIso = new Date(now).toISOString();
+        for (const [eventType, withinHours] of windows) {
+            const p = probe[eventType] ?? { observedAt: null, stateAt: null, stateOutcome: null };
+            const outcome = p.observedAt === null
+                ? 'skipped' // never observed — the never-run analogue, not a failure
+                : now - Date.parse(p.observedAt) <= withinHours * 3_600_000
+                    ? 'ok'
+                    : 'failed';
+            const changed = p.stateOutcome !== outcome;
+            const heartbeatDue = p.stateAt === null || now - Date.parse(p.stateAt) > FRESHNESS_HEARTBEAT_MINUTES * 60_000;
+            if (!changed && !heartbeatDue)
+                continue;
+            await stub.recordScheduleRun(`freshness:${eventType}`, nowIso, outcome);
+            report.checks.push({ eventType, outcome, observedAt: p.observedAt, withinHours });
+        }
+        return report;
+    }
     async runDueSchedules(moduleId, tenantId, scopeId) {
-        const report = { fired: 0, skipped: 0, failed: 0, errors: [] };
+        const report = { fired: 0, skipped: 0, failed: 0, errors: [], runs: [] };
         const schedules = this.moduleSchedules.get(moduleId);
         if (!schedules || schedules.length === 0)
             return report;
@@ -1103,6 +1174,7 @@ export class CloudflareScopeHost {
             const dueAt = lastRun === null ? -Infinity : lastRun + schedule.cadence.everyMinutes * 60_000;
             if (now < dueAt) {
                 report.skipped += 1;
+                report.runs.push({ operation: schedule.operation, outcome: 'skipped' });
                 continue;
             }
             let status = 'ok';
@@ -1120,6 +1192,7 @@ export class CloudflareScopeHost {
                 });
             }
             await stub.recordScheduleRun(schedule.operation, new Date(now).toISOString(), status);
+            report.runs.push({ operation: schedule.operation, outcome: status === 'ok' ? 'ok' : 'failed' });
         }
         return report;
     }
@@ -2702,11 +2775,15 @@ export class CloudflareScopeHost {
                     tenant_id: entry.tenantId ?? null,
                     scope_id: entry.scopeId ?? null,
                     vertical: entry.vertical ?? null,
+                    version: entry.version ?? null,
                     status: entry.status ?? null,
                     // Bounded here, not trusted from the catch site: one runaway upstream body
                     // must not become a runaway directory row (#559).
                     message: entry.message.slice(0, 2000),
                     reference: entry.reference ?? null,
+                    origin: entry.origin ?? null,
+                    code: entry.code ?? null,
+                    fingerprint: opsFailureFingerprint(entry),
                     at: new Date().toISOString(),
                 });
             },
@@ -2715,7 +2792,10 @@ export class CloudflareScopeHost {
                     tenantId: filter?.tenantId,
                     scopeId: filter?.scopeId,
                     vertical: filter?.vertical,
+                    version: filter?.version,
                     operation: filter?.operation,
+                    code: filter?.code,
+                    fingerprint: filter?.fingerprint,
                     reference: filter?.reference,
                     since: filter?.since,
                     until: filter?.until,
@@ -2728,6 +2808,67 @@ export class CloudflareScopeHost {
                 await this.recordAccess(actor, 'listOpsFailures', { tenantId: filter?.tenantId ?? null, scopeId: filter?.scopeId ?? null }, filter, rows.length);
                 return rows.map((r) => opsFailureEntry.parse(r));
             },
+            recordSweepRun: async (entry) => {
+                await this.cp.recordSweepRun({
+                    id: ulid(),
+                    kind: entry.kind,
+                    unit: entry.unit,
+                    outcome: entry.outcome,
+                    tenant_id: entry.tenantId ?? null,
+                    scope_id: entry.scopeId ?? null,
+                    vertical: entry.vertical ?? null,
+                    version: entry.version ?? null,
+                    operation: entry.operation ?? null,
+                    connection_id: entry.connectionId ?? null,
+                    // Bounded here, not trusted from the sweep (the #559 rule).
+                    error: entry.error == null ? null : entry.error.slice(0, 2000),
+                    elapsed_ms: entry.elapsedMs ?? null,
+                    request_id: entry.requestId ?? null,
+                    event_type: entry.eventType ?? null,
+                    observed_at: entry.observedAt ?? null,
+                    at: entry.at ?? new Date().toISOString(),
+                });
+            },
+            listSweepRuns: async (actor, filter) => {
+                const rows = await this.cp.listSweepRuns({
+                    kind: filter?.kind,
+                    unit: filter?.unit,
+                    outcome: filter?.outcome,
+                    tenantId: filter?.tenantId,
+                    scopeId: filter?.scopeId,
+                    vertical: filter?.vertical,
+                    connectionId: filter?.connectionId,
+                    since: filter?.since,
+                    until: filter?.until,
+                    limit: filter?.limit,
+                    cursor: filter?.cursor,
+                    order: filter?.order,
+                });
+                // Rows can name tenants and scopes, so reading them is recorded (K-24).
+                await this.recordAccess(actor, 'listSweepRuns', { tenantId: filter?.tenantId ?? null, scopeId: filter?.scopeId ?? null }, filter, rows.length);
+                return rows.map((r) => sweepRunEntry.parse(r));
+            },
+            listIssues: async (actor, filter) => {
+                const rows = await this.cp.listIssues({
+                    status: filter?.status,
+                    operation: filter?.operation,
+                    code: filter?.code,
+                    limit: filter?.limit,
+                });
+                // Issues aggregate fleet-wide failures; the read is recorded like the rows' own (K-24).
+                await this.recordAccess(actor, 'listIssues', {}, filter, rows.length);
+                return rows.map((r) => issueEntry.parse(r));
+            },
+            setIssueStatus: async (actor, fingerprint, status) => {
+                const change = await this.cp.setIssueStatus(fingerprint, status, new Date().toISOString());
+                if (!change)
+                    return undefined;
+                const before = issueEntry.parse(change.before);
+                const after = issueEntry.parse(change.after);
+                // A lifecycle flip is a staff mutation — audited with the diff (K-33).
+                await this.recordAdmin(actor, 'setIssueStatus', { tenantId: null, vertical: after.lastVertical }, { fingerprint, status: before.status }, { fingerprint, status: after.status });
+                return after;
+            },
             recordModelUsage: async (input) => {
                 const l = input.line;
                 return this.cp.recordModelUsage({
@@ -3135,6 +3276,35 @@ export class CloudflareScopeHost {
     async assignScopeRole(scopeId, principal, roleKey) {
         await this.scopeStub(scopeId).writeTuple(`principal:${principal}`, `role:${roleKey}`, `scope:${scopeId}`, null);
     }
+    /**
+     * Take a scope-level role back — the counterpart `assignScopeRole` went without (#1161).
+     * A tombstone, exactly as `HostAdmin.unassignRole` writes for a scope-level assignment:
+     * the row stays with `revoked_at` set and the local checker's walk skips it, so the
+     * principal loses the role's permissions on the next check. `assignScopeRole` is
+     * `INSERT OR REPLACE`, so a later re-assign clears the tombstone and grants again.
+     *
+     * Returns whether anything changed: a repeat revoke, or a revoke of a role that was never
+     * assigned, is a silent `false` rather than an error, which lets a harness route stay
+     * idempotent. Emits nothing on the scope outbox — the vertical whose flow revoked the
+     * seat is the one that knows what to announce, and it emits from its own operation.
+     * Guarded like `assignScopeRole`: at the harness route, not at this seam.
+     *
+     * Two things a caller has to know, because the tombstone is only as durable as the next
+     * `INSERT OR REPLACE` on the same row:
+     * - Anything that re-projects the scope's tuples clears it — `provisionScopeLocal` on a
+     *   reconcile re-seats the owner and the `system:` grants, and a vertical's `onProvision`
+     *   hook that re-issues `assignScopeRole` re-seats whatever it names. A revoke of a role
+     *   such a path grants is undone on the next reconcile, silently. Revoke the seats your
+     *   own flow granted, not the ones provisioning did.
+     * - Revoking the LAST live role tuple in a scope leaves nobody who passes a check, and
+     *   the local checker has no way back in (#332 guards the flip to local on the way in
+     *   only). Seat the successor before unseating the last holder.
+     * On a CP-less host this records no admin-log row (there is no control plane to hold
+     * one), so the row's `revoked_at` is the only evidence, and a re-assign replaces it.
+     */
+    async revokeScopeRole(scopeId, principal, roleKey) {
+        return this.scopeStub(scopeId).revokeTuple(`principal:${principal}`, `role:${roleKey}`, `scope:${scopeId}`, new Date().toISOString());
+    }
     /**
      * Grant a principal an ENTITY-NARROWED permission in a CP-less vertical — the self-service
      * half of membership, the local equivalent of `HostAdmin.grant` with an `entity`. Where a