@substrat-run/adapter-sqlite 0.118.0 → 0.119.0

package/dist/index.js

@@ -1,8 +1,8 @@
 import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import Database from 'better-sqlite3';
-import { accessLogEntry, adminLogEntry, opsFailureEntry, opsFailureFingerprint, issueEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunEntry, modelUsageEntry, ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, createTenantInput, domainEvent, domainEventInput, entitlementGrant, entitlementGrantInput, eventId, meterReading, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, identityLink, identityPool, instant, connection, capabilityGrant, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, subjectRef, requestFingerprint, createConnectionInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, createOrgInput, promotionAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, routeTarget, registerVerticalInput, vertical as verticalSchema, verticalChannel, verticalVersion, objectRef, grantRefFromProof, org as orgSchema, orgMembership, principalId, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, subjectShredReceipt, SCOPE_TABLE_PAGE_DEFAULT, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, verticalServingState, outboundOfManifestJson, listLimitOf, substratError, assertReplayableDump, delegatedReadRecord, redrainEventsInput, REDRAIN_BATCH, } from '@substrat-run/contracts';
-import { actorOf, asPrincipal, assertAllowed, assertNoSecret, assertPermissionKey, CAPABILITY_DDL, CAPABILITY_EXCHANGE_OPERATION, capabilityTokenHash, createCapabilityVerbs, exchangeCapability as exchangeCapabilitySecret, guardSecrets, mintBecomeCapability, plausibleSessionToken, redactSecrets, resolveCapabilitySession, revokeCapabilityAsPlatform, assertReadOnlyQuery, attachmentBlobKey, entitlementDenial, foldMeterReading, guardSpine, parseValidationRecords, resolveScopeRecord, ulid, ISSUE_RETENTION_DAYS, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, SWEEP_RUNS_INTENT_INDEX, sweepRunsIntentHasKind, MODEL_USAGE_RETENTION_DAYS, foldModelUsage, backoffAt, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, JOB_RUN_PATCH_SQL, JOB_STEP_RECORD_SQL, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, switchSystemSchedules, systemScheduleState, systemSwitchedOff, systemSwitchedOffMessage, denialListQuery, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, IMPERSONATION_COLUMNS, IMPERSONATION_DDL, ImpersonationRefused, assertImpersonationWrites, assertModuleEnqueueableKind, assertSessionUsable, impersonationByIdQuery, impersonationListQuery, impersonationRowValues, impersonationStampOf, mapImpersonationRow, newImpersonationSession, resolveRetryPolicy, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, noSealingKeyMessage, openSealed, sealTo, ConnectionSealingKeyUnavailableError, PermissionDenied, createAtomic, NotSearchable, NotListable, listIndexMigrations, listIndexPlans, listQuery, cursorOf, isSearchIndexTable, searchIndexDdl, searchIndexMigrations, searchIndexPlans, searchLimit, searchMatchExpression, searchQuery, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, JOB_RUN_DDL, jobRunListLimit, jobRunOf, runDueJobRuns, startJobRun, IDEMPOTENCY_DDL, assertIdempotencyKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, globalFetch, createUlid, facetEvents, readHistory, walkEventCause, walkEventEffects, assertRedrainWindow, readInvocation, readDeadLetters, domainEventOf, readUndrainedOutbox, undrainedEventsOf, } from '@substrat-run/kernel';
+import { accessLogEntry, adminLogEntry, opsFailureEntry, opsFailureFingerprint, issueEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunEntry, modelUsageEntry, ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, createTenantInput, domainEvent, domainEventInput, exportReadInput, importBatch, entitlementGrant, entitlementGrantInput, eventId, meterReading, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, identityLink, identityPool, instant, connection, capabilityGrant, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, peerSwitch, verticalCaller, verticalSlug as verticalSlugOf, subjectRef, requestFingerprint, createConnectionInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, createOrgInput, promotionAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, routeTarget, registerVerticalInput, vertical as verticalSchema, verticalChannel, verticalVersion, objectRef, grantRefFromProof, org as orgSchema, orgMembership, principalId, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, subjectShredReceipt, SCOPE_TABLE_PAGE_DEFAULT, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, verticalServingState, callsOfManifestJson, outboundOfManifestJson, listLimitOf, substratError, assertReplayableDump, delegatedReadRecord, redrainEventsInput, REDRAIN_BATCH, } from '@substrat-run/contracts';
+import { actorOf, asPrincipal, assertAllowed, assertNoSecret, assertPermissionKey, CAPABILITY_DDL, CAPABILITY_EXCHANGE_OPERATION, capabilityAttachmentWriteRefused, capabilityTokenHash, createCapabilityVerbs, exchangeCapability as exchangeCapabilitySecret, guardSecrets, mintBecomeCapability, plausibleSessionToken, redactSecrets, resolveCapabilitySession, revokeCapabilityAsPlatform, assertReadOnlyQuery, attachmentBlobKey, entitlementDenial, foldMeterReading, guardSpine, parseValidationRecords, resolveScopeRecord, ulid, ISSUE_RETENTION_DAYS, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, SWEEP_RUNS_INTENT_INDEX, sweepRunsIntentHasKind, MODEL_USAGE_RETENTION_DAYS, foldModelUsage, backoffAt, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, JOB_RUN_PATCH_SQL, JOB_STEP_RECORD_SQL, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, switchSystemSchedules, admitPeer, collectPeers, peerSeats, resolveVerticalInstanceFrom, switchPeer, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, systemSwitchedOffMessage, denialListQuery, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, IMPERSONATION_COLUMNS, IMPERSONATION_DDL, ImpersonationRefused, assertImpersonationWrites, assertModuleEnqueueableKind, assertSessionUsable, impersonationByIdQuery, impersonationListQuery, impersonationRowValues, impersonationStampOf, mapImpersonationRow, newImpersonationSession, resolveRetryPolicy, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, noSealingKeyMessage, openSealed, sealTo, ConnectionSealingKeyUnavailableError, PermissionDenied, createAtomic, NotSearchable, NotListable, listIndexMigrations, listIndexPlans, listQuery, cursorOf, isSearchIndexTable, searchIndexDdl, searchIndexMigrations, searchIndexPlans, searchLimit, searchMatchExpression, searchQuery, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, jobRunListLimit, jobRunOf, runDueJobRuns, startJobRun, IDEMPOTENCY_DDL, assertIdempotencyKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, globalFetch, createUlid, facetEvents, readHistory, walkEventCause, walkEventEffects, assertRedrainWindow, readInvocation, readDeadLetters, domainEventOf, readUndrainedOutbox, undrainedEventsOf, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, } from '@substrat-run/kernel';
 import { ScopeActor } from './actor.js';
 import { createTupleChecker } from './checker.js';
 /** The kernel's schedule-switch SQL (#1666), over one scope's database handle. */
@@ -167,6 +167,10 @@ const KERNEL_DDL = `
   -- builds and the shape production builds cannot part company; the column
   -- comments, and the reason coalescing is NOT a unique index, are in there.
   ${JOB_RUN_DDL}
+  -- #1705: cross-vertical delivery. The consumer's journal of what it received (envelope
+  -- only) and its watermark per producer, plus the producer-side (type, id) outbox index the
+  -- export read seeks on. Shared with the DO adapter from @substrat-run/kernel.
+  ${VERTICAL_EVENTS_DDL}
   CREATE TABLE IF NOT EXISTS _substrat_migrations (
     module_id TEXT NOT NULL,
     version TEXT NOT NULL,
@@ -433,6 +437,8 @@ export class SqliteScopeHost {
     tenantStoreDbs = new Map();
     operations = new Map();
     modules = new Map();
+    /** #1705: what this deployment exports to other verticals and imports from them. */
+    crossVertical = new CrossVerticalRegistry();
     /** operation name → guards declared before it, in registration order (K-17). */
     guards = new Map();
     /** predicate name → the module-contributed implementation. Names are global. */
@@ -488,6 +494,7 @@ export class SqliteScopeHost {
     systemPrincipal = principalId.parse(ulid());
     secretBox;
     fetchImpl;
+    connectorCalls;
     clock;
     versionId;
     // The mint for event ids (#956) is NOT here: it lives on `ScopeRuntime`, one per
@@ -498,6 +505,7 @@ export class SqliteScopeHost {
     constructor(options) {
         this.secretBox = options.secretBox ?? unconfiguredSecretBox;
         this.fetchImpl = options.fetch ?? globalFetch;
+        this.connectorCalls = options.connectorCalls ?? noopConnectorCallRecorder;
         this.clock = options.clock ?? (() => instant.parse(new Date().toISOString()));
         this.versionId = options.versionId ?? null;
         this.dir = options.dir;
@@ -1183,6 +1191,9 @@ export class SqliteScopeHost {
                     // request pending across a rotation still opens.
                     unseal: async (sealed) => openSealed(await this.openSealingKeys(open.id), sealed),
                     fetch: async (input, init) => {
+                        // #1691: timed here, where the call is made, so the data point the host
+                        // records beside the health line carries a duration.
+                        const started = Date.now();
                         try {
                             const res = await fetchImpl(input, {
                                 ...init,
@@ -1191,22 +1202,11 @@ export class SqliteScopeHost {
                             // A 5xx is the provider failing; a 4xx is usually us. Both are
                             // worth recording, because "the connection stopped working" is the
                             // question a health view answers.
-                            if (!res.ok) {
-                                await admin.recordConnectionUse(open.id, {
-                                    ok: false,
-                                    error: `HTTP ${res.status} from ${provider}`,
-                                });
-                            }
-                            else {
-                                await admin.recordConnectionUse(open.id, { ok: true });
-                            }
+                            await admin.recordConnectionUse(open.id, settleConnectionUse(provider, Date.now() - started, { response: res }));
                             return res;
                         }
                         catch (err) {
-                            await admin.recordConnectionUse(open.id, {
-                                ok: false,
-                                error: err instanceof Error ? err.message : String(err),
-                            });
+                            await admin.recordConnectionUse(open.id, settleConnectionUse(provider, Date.now() - started, { error: err }));
                             throw err;
                         }
                     },
@@ -1227,7 +1227,10 @@ export class SqliteScopeHost {
             }
             seen.add(m.version);
         }
-        const declaredConsumes = new Set(manifest.events.consumes.map((c) => c.type));
+        // IN-SCOPE consumes only (#1705). A `from` entry names another vertical's export, and its
+        // handler lives in `imports`. Letting it satisfy this check would let a local consumer of
+        // the same type name register against a declaration that was reviewed as an import.
+        const declaredConsumes = new Set(manifest.events.consumes.filter((c) => c.from === undefined).map((c) => c.type));
         const consumers = Object.entries(registration.consumers ?? {}).map(([eventType, handler]) => {
             if (!declaredConsumes.has(eventType)) {
                 throw new Error(`${manifest.id} registers a consumer for undeclared event type: ${eventType}`);
@@ -1296,12 +1299,15 @@ export class SqliteScopeHost {
             }
             this.listPlans.set(plan.entityType, plan);
         }
+        // #1705: validated whole and kept only if it passes, so a refused module leaves nothing.
+        this.crossVertical.register(manifest, registration.imports);
         this.modules.set(manifest.id, {
             id: manifest.id,
             migrations: [...migrations, ...searchMigrations, ...listMigrations],
             consumers,
             schedules: manifest.schedules ?? [],
             freshness: manifest.freshness ?? [],
+            peers: manifest.peers ?? [],
         });
         for (const rel of manifest.entityRelations ?? []) {
             const parents = this.relations.get(rel.entityType) ?? new Set();
@@ -1470,6 +1476,14 @@ export class SqliteScopeHost {
                     rt.db.prepare(seat.sql).run(...seat.params);
                 }
             }
+            // #1706: every declared PEER holds its keys on the scope from provisioning on — the one
+            // call that makes "declared and installed" mean "live" (`peerSeats`). Same seat, same
+            // rules: a grant a switch tombstoned stays tombstoned, and a switched-off peer gets
+            // nothing seated.
+            for (const peer of peerSeats(this.peerDeclarations(), input.scopeId)) {
+                const seat = seatScopeTuple(peer.subject, peer.relation, peer.object, null);
+                rt.db.prepare(seat.sql).run(...seat.params);
+            }
         });
         // Audit a real provision only; an idempotent re-provision changed nothing.
         if (!existing) {
@@ -1679,7 +1693,22 @@ export class SqliteScopeHost {
      * the per-entity ref, with a spine event in the same transaction. Bytes go straight to
      * the per-tenant blob store — never through the scope pipe (the issue's point).
      */
-    buildAttachments(rt, subject, store, opts = {}) {
+    buildAttachments(rt, authority, store, opts = {}) {
+        // #1686: a capability session is resolved per CALL, inside the call's own actor task —
+        // the invoke door's discipline, so a revoke or an expiry refuses the next read on a
+        // surface built before it. Throws `unauthenticated`/`forbidden` for a dead session or
+        // an allowlist, before any key is checked (not a K-35 denial). A read takes no use.
+        // THE ORDER, for every verb: the session (here, in the runner), then the target lookup,
+        // then the check — so every `targetGate` call on a capability path sits inside a
+        // `guarded` callback, and a dead link is told `unauthenticated` and nothing else.
+        const capabilitySession = authority.kind === 'capability-session' ? authority.hash : undefined;
+        const actingAs = (operation) => authority.kind === 'capability-session'
+            ? {
+                kind: 'capability',
+                id: resolveCapabilitySession(spineSql(rt.db), authority.hash, this.clock(), operation),
+            }
+            : authority;
+        const node = { tenantId: rt.tenantId, scopeId: rt.scopeId };
         const targetGate = (entityType) => {
             const gate = this.attachmentTargets.get(entityType);
             if (!gate) {
@@ -1707,11 +1736,12 @@ export class SqliteScopeHost {
         // like an operation invoke (including K-35 denial recording and prompt dispatch of
         // the events it emitted).
         const serialized = (operation, fn) => rt.actor.enqueue(async () => {
+            const subject = actingAs(operation);
             const ctx = this.operationContext(rt, subject, undefined, undefined, undefined, operation);
             rt.db.exec('BEGIN IMMEDIATE');
             let result;
             try {
-                result = await fn(ctx);
+                result = await fn(ctx, subject);
                 rt.db.exec('COMMIT');
             }
             catch (err) {
@@ -1742,8 +1772,9 @@ export class SqliteScopeHost {
          * runner does it after its ROLLBACK.
          */
         const reentrant = async (operation, fn) => {
+            const subject = actingAs(operation);
             try {
-                return await fn(this.operationContext(rt, subject, undefined, undefined, undefined, operation));
+                return await fn(this.operationContext(rt, subject, undefined, undefined, undefined, operation), subject);
             }
             catch (err) {
                 // #1525: the ENCLOSING call's id, deliberately. This runner takes no turn of its
@@ -1758,7 +1789,18 @@ export class SqliteScopeHost {
         const guarded = opts.reentrant ? reentrant : serialized;
         return {
             upload: async (input) => {
+                if (capabilitySession !== undefined) {
+                    // #1686: refused BEFORE the bytes go anywhere — through the serialized runner, so
+                    // the session is resolved first (a dead one is `unauthenticated`, no K-35 row) and
+                    // the refusal is recorded against `{ capability }` like any enforced denial. The
+                    // target lookup is INSIDE, after the session: a dead link learns nothing about
+                    // which entity types take attachments.
+                    return guarded('attachments.upload', async (_ctx, subject) => {
+                        throw capabilityAttachmentWriteRefused(subject.id, 'attachments.upload', node, targetGate(input.entity.entityType).write);
+                    });
+                }
                 const gate = targetGate(input.entity.entityType);
+                const creator = authority;
                 const id = ulid();
                 const key = attachmentBlobKey(rt.scopeId, id);
                 const record = attachmentRecord.parse({
@@ -1769,7 +1811,7 @@ export class SqliteScopeHost {
                     size: input.body.byteLength,
                     sha256: await sha256Hex(input.body),
                     visibility: input.visibility,
-                    createdBy: subject.id,
+                    createdBy: creator.id,
                     createdAt: new Date().toISOString(),
                 });
                 // Bytes first, row second: a crash between the two leaves an orphaned object
@@ -1800,17 +1842,18 @@ export class SqliteScopeHost {
                     throw err;
                 }
             },
-            list: async (entity) => {
+            list: async (entity) => 
+            // The target lookup inside the runner, after `actingAs` (#1686): a capability's
+            // session is decided before anything about the entity type is.
+            guarded('attachments.list', async (ctx) => {
                 const gate = targetGate(entity.entityType);
-                return guarded('attachments.list', async (ctx) => {
-                    assertAllowed(await ctx.check(gate.read, entity));
-                    const rows = rt.db
-                        .prepare(`SELECT * FROM _substrat_attachments WHERE entity_type = ? AND entity_id = ?
+                assertAllowed(await ctx.check(gate.read, entity));
+                const rows = rt.db
+                    .prepare(`SELECT * FROM _substrat_attachments WHERE entity_type = ? AND entity_id = ?
                ORDER BY id DESC`)
-                        .all(entity.entityType, entity.entityId);
-                    return rows.map(rowToRecord);
-                });
-            },
+                    .all(entity.entityType, entity.entityId);
+                return rows.map(rowToRecord);
+            }),
             open: async (attachmentId) => {
                 const record = await guarded('attachments.open', async (ctx) => {
                     const row = rt.db
@@ -1839,10 +1882,15 @@ export class SqliteScopeHost {
                 return { record, body: obj.body, contentType: obj.contentType ?? record.contentType };
             },
             remove: async (attachmentId) => {
-                const removed = await guarded('attachments.remove', async (ctx) => {
+                const removed = await guarded('attachments.remove', async (ctx, subject) => {
                     const row = rt.db
                         .prepare('SELECT * FROM _substrat_attachments WHERE id = ?')
                         .get(attachmentId);
+                    if (capabilitySession !== undefined) {
+                        // #1686: refused whether or not the id exists — one answer, so a holder learns
+                        // nothing about ids — but recorded only when there is a write key to record.
+                        throw capabilityAttachmentWriteRefused(subject.id, 'attachments.remove', node, row ? targetGate(row.entity_type).write : undefined);
+                    }
                     if (!row)
                         return null;
                     const gate = targetGate(row.entity_type);
@@ -2201,6 +2249,168 @@ export class SqliteScopeHost {
         await this.applyPendingMigrations(rt);
         return this.buildStub(tenantId, scopeId, rt, { kind: 'system', id: moduleId });
     }
+    /**
+     * #1705: the producer's release, decided by THIS deployment's own declarations. The admin
+     * verb wraps it with the directory gate and the access row.
+     *
+     * The order is the safety argument. What leaves is `exports ∩ wants`, computed from the
+     * modules registered here, and then only if the consumer's principal holds every key that
+     * intersection needs. Only then is a row read. A missing key reads nothing, so the
+     * watermark cannot move past events that authority would have released later.
+     */
+    async readExports(tenantId, scopeId, input) {
+        const plan = exportReadPlan(this.crossVertical.exports(), input.wants);
+        const quiet = {
+            events: [],
+            withheld: [],
+            unexported: plan.unexported,
+            paused: null,
+            next: input.after,
+            more: false,
+        };
+        if (plan.types.length === 0)
+            return quiet;
+        const missing = await this.peerMissing(tenantId, scopeId, input.consumer, plan.keys);
+        if (missing.length > 0)
+            return { ...quiet, paused: { missing } };
+        // The committed outbox (#1624): an in-flight operation's event must not reach another
+        // vertical before its transaction decides whether it exists.
+        const db = this.scopeReadDbFor(tenantId, scopeId);
+        const q = exportReadQuery(plan.types, input.after, input.limit);
+        const rows = db.prepare(q.sql).all(...q.params);
+        const hops = db.prepare(EXPORT_HOPS_SQL);
+        const batch = planExportBatch({
+            rows,
+            wanted: plan.wanted,
+            after: input.after,
+            limit: input.limit,
+            hopsBefore: (row) => row.caused_by ? (hops.get(row.caused_by)?.hops ?? 0) : 0,
+        });
+        return { ...batch, unexported: plan.unexported, paused: null };
+    }
+    /**
+     * #1705: the read keys `consumer`'s principal does NOT hold at this scope — #1706's
+     * `peerCovers`, the checker's own `covers`. A peer whose kill switch is off holds nothing,
+     * so it pauses the edge here with no marker read of its own.
+     */
+    async peerMissing(tenantId, scopeId, consumer, keys) {
+        const coverage = await this.peerCovers(tenantId, scopeId, consumer, keys);
+        return coverage.filter((c) => !c.held).map((c) => c.permission);
+    }
+    /** #1705: this scope's watermark per producer, oldest source first. */
+    importCursors(db) {
+        return db.prepare(IMPORT_CURSORS_SQL).all().map((r) => ({
+            source: r.source_scope_id,
+            vertical: r.source_vertical,
+            cursor: r.cursor,
+            updatedAt: r.updated_at,
+        }));
+    }
+    async deliverToPeer(tenantId, scopeId, raw) {
+        // Parsed at the door, like an operation's input: HostAdmin callers are trusted to be the
+        // platform, not to have built a well-formed batch.
+        const batch = importBatch.parse(raw);
+        const source = batch.source;
+        const rt = await this.openActiveScope(tenantId, scopeId);
+        return rt.actor.enqueue(async () => {
+            const result = {
+                delivered: 0,
+                deadLettered: 0,
+                duplicates: 0,
+                withheld: 0,
+                cursor: batch.after,
+                stale: false,
+                paused: null,
+            };
+            // #1706's door, for a delivery (`operation: null`): the producer must be a declared peer
+            // of this vertical with its switch on. Admitted inside the actor task, before anything
+            // runs, so a switch pulled between two passes refuses the second. A refusal is a PAUSE:
+            // nothing ran, the watermark stays, and the producer's outbox keeps the backlog.
+            let subject;
+            try {
+                subject = admitPeer(switchSqlOf(rt.db), this.peerDeclarations(), { vertical: source.vertical, scope: source.scopeId }, null);
+            }
+            catch (err) {
+                return { ...result, paused: { reason: err instanceof Error ? err.message : String(err) } };
+            }
+            // The compare-and-set. Inside the actor, so nothing moves the watermark between this
+            // read and the advance at the end.
+            const current = rt.db.prepare(IMPORT_CURSOR_OF_SQL).get(source.scopeId)?.cursor ?? null;
+            if (current !== batch.after)
+                return { ...result, cursor: current, stale: true };
+            const at = new Date().toISOString();
+            const record = rt.db.prepare(IMPORT_RECORD_SQL);
+            const journaled = rt.db.prepare('SELECT 1 FROM _substrat_deliveries WHERE event_id = ? AND consumer_module = ?');
+            const deadLetter = rt.db.prepare(`INSERT OR IGNORE INTO _substrat_deliveries
+           (event_id, consumer_module, delivered_at, error, invocation_id)
+         VALUES (?, ?, ?, ?, NULL)`);
+            // Named and not carried: a dead letter per importing module, so the operator who reads
+            // this scope's dead letters sees what the producer sent and why it did not arrive.
+            for (const w of batch.withheld) {
+                record.run(w.id, source.scopeId, source.vertical, w.type, w.schemaVersion, w.occurredAt, w.entity.entityType, w.entity.entityId, 0, w.reason, at);
+                for (const moduleId of this.crossVertical.modulesImporting(source.vertical, w.type)) {
+                    deadLetter.run(w.id, moduleId, at, withheldNote(w.reason, source.vertical));
+                }
+                result.withheld += 1;
+            }
+            for (const e of batch.events) {
+                record.run(e.id, source.scopeId, source.vertical, e.type, e.schemaVersion, e.occurredAt, e.entity.entityType, e.entity.entityId, e.hops, null, at);
+                let ran = false;
+                for (const imp of this.crossVertical.handlersFor(source.vertical, e.type)) {
+                    if (journaled.get(e.id, imp.moduleId))
+                        continue;
+                    ran = true;
+                    if (imp.schemaVersion !== e.schemaVersion) {
+                        // The producer released what the consumer's state asked for. A mismatch here means
+                        // this scope's code changed between the two, so it is refused by version (K-39)
+                        // exactly as the producer would have refused it.
+                        deadLetter.run(e.id, imp.moduleId, at, withheldNote('version', source.vertical));
+                        result.deadLettered += 1;
+                        continue;
+                    }
+                    const { hops: _hops, ...fact } = e;
+                    const event = structuredClone({ ...fact, source });
+                    // What the handler emits was emitted BECAUSE of the producer's event (#1237). The id
+                    // resolves through `_substrat_imports`, which the row above has just written.
+                    rt.causedBy = e.id;
+                    rt.db.exec('BEGIN IMMEDIATE');
+                    try {
+                        // As the producer's principal, admitted above: the handler's checks are real ones,
+                        // against the grants this vertical's `peers` gave it, and its emits carry the actor
+                        // `{ vertical, scope }` and the authorization they passed (K-34).
+                        await imp.handler(this.operationContext(rt, subject), event);
+                        rt.db
+                            .prepare(`INSERT INTO _substrat_deliveries (event_id, consumer_module, delivered_at, invocation_id)
+                 VALUES (?, ?, ?, NULL)`)
+                            .run(e.id, imp.moduleId, new Date().toISOString());
+                        rt.db.exec('COMMIT');
+                        result.delivered += 1;
+                    }
+                    catch (err) {
+                        rt.db.exec('ROLLBACK');
+                        // Dead-letter (v0), the consumer's rule: one failure is terminal, and the events
+                        // behind it still arrive.
+                        deadLetter.run(e.id, imp.moduleId, new Date().toISOString(), String(err));
+                        result.deadLettered += 1;
+                    }
+                    finally {
+                        rt.causedBy = null;
+                    }
+                }
+                if (!ran)
+                    result.duplicates += 1;
+            }
+            // LAST, in this scope's store: a crash before here redelivers the batch, and the journal
+            // rows above absorb it.
+            rt.db.prepare(IMPORT_CURSOR_ADVANCE_SQL).run(source.scopeId, source.vertical, batch.next, at);
+            result.cursor = batch.next;
+            // What the handlers emitted reaches this scope's own consumers and executors in the same
+            // tail, under the ordinary cascade cap.
+            await this.dispatch(rt, null);
+            await this.dispatchExecutors(rt, null);
+            return result;
+        });
+    }
     /**
      * The lifecycle gate the capability doors share (#1672): the scope must exist in this
      * tenant, the tenant must be active, the scope must be active — K-3's fail-closed pair
@@ -2212,7 +2422,11 @@ export class SqliteScopeHost {
             .prepare('SELECT tenant_id, status FROM scopes WHERE scope_id = ?')
             .get(scopeId);
         if (!scope || scope.tenant_id !== tenantId) {
-            throw new Error(`unknown scope for tenant: (${tenantId}, ${scopeId})`);
+            // TYPED (#1714 review): K-3's pair check is the confinement the capability and peer
+            // doors rest on, so its refusal carries a code rather than being one more untyped
+            // throw a test could pass on by accident. `not_found`, in the same words either way:
+            // a scope of another tenant reads exactly as one that does not exist.
+            throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
         }
         const tenant = this.directory
             .prepare('SELECT status FROM tenants WHERE tenant_id = ?')
@@ -2277,6 +2491,55 @@ export class SqliteScopeHost {
         const hash = await capabilityTokenHash(sessionToken);
         return this.buildStub(tenantId, scopeId, rt, { kind: 'capability-session', hash }, options);
     }
+    /**
+     * The capability's attachment door (#1686) — `getCapabilityScope`'s gate, then the
+     * attachment surface with the session's hash as its authority. `buildAttachments`
+     * re-resolves that hash on every call, reads are the checker's as `{ capability }`, and
+     * writes are refused.
+     */
+    async getCapabilityAttachments(sessionToken, tenantId, scopeId) {
+        if (!plausibleSessionToken(sessionToken)) {
+            throw substratError('unauthenticated', 'not a capability session token');
+        }
+        const rt = await this.openActiveScope(tenantId, scopeId);
+        const hash = await capabilityTokenHash(sessionToken);
+        const scopeRow = this.directory
+            .prepare('SELECT vertical FROM scopes WHERE scope_id = ?')
+            .get(scopeId);
+        const store = this.attachmentStore(tenantId, scopeRow?.vertical ?? null);
+        return this.buildAttachments(rt, { kind: 'capability-session', hash }, store);
+    }
+    /** Every registered module's `peers`, as one declaration per peer vertical (#1706). */
+    peerDeclarations() {
+        return collectPeers(this.modules.values());
+    }
+    /**
+     * The peer door (#1706) — mirror of the connection, system and capability doors. The caller is
+     * the local broker's word (the platform's, on the pure host); the pair and lifecycle gate run
+     * here, and `admitPeer` runs inside the scope's actor task on every invoke (`buildStub`).
+     */
+    async getVerticalScope(caller, tenantId, scopeId, options) {
+        const parsed = verticalCaller.parse(caller);
+        const rt = await this.openActiveScope(tenantId, scopeId);
+        return this.buildStub(tenantId, scopeId, rt, { kind: 'vertical-peer', caller: parsed }, options);
+    }
+    /**
+     * Does peer `vertical` hold each key at this scope's node right now (#1706) — the checker's own
+     * `covers`, inside the scope's actor task so no invoke's open transaction is read half-done.
+     * The subject's `scope` is the target scope only to satisfy the type: `covers` records nothing,
+     * and the tuple ref it walks is the slug alone.
+     */
+    async peerCovers(tenantId, scopeId, vertical, permissions) {
+        const rt = await this.openActiveScope(tenantId, scopeId);
+        const subject = { kind: 'vertical', id: verticalSlugOf.parse(vertical), scope: scopeId };
+        const coverage = await rt.actor.enqueue(() => this.checker.covers(subject, [...permissions], { tenantId, scopeId }));
+        const missing = new Set(coverage.covered ? [] : coverage.missing);
+        return permissions.map((permission) => ({ permission, held: !missing.has(permission) }));
+    }
+    /** #1705: what this deployment imports — the sweep's reason to call no scope when it is empty. */
+    registeredImports() {
+        return this.crossVertical.consumes();
+    }
     registeredSchedules() {
         const out = [];
         for (const mod of this.modules.values()) {
@@ -2581,12 +2844,17 @@ export class SqliteScopeHost {
                         // actor task — so nothing can revoke between this read and the transaction below.
                         // Refuses a stale session, a revoked or expired capability and an operation off its
                         // allowlist before anything opens; none of those is a K-35 denial (no key checked).
+                        // #1706: the peer door's admission, on the same terms — every invoke, inside the
+                        // actor task. An undeclared peer, a switched-off one, or an operation off its
+                        // allowlist is refused `forbidden` before anything opens; no key was checked.
                         const subject = authority.kind === 'capability-session'
                             ? {
                                 kind: 'capability',
                                 id: resolveCapabilitySession(spineSql(rt.db), authority.hash, this.clock(), operation),
                             }
-                            : authority;
+                            : authority.kind === 'vertical-peer'
+                                ? admitPeer(switchSqlOf(rt.db), this.peerDeclarations(), authority.caller, operation)
+                                : authority;
                         // #1672: the secrets this invocation mints — withheld from its idempotency recording,
                         // and what the tripwire on its writes looks for.
                         const minted = [];
@@ -3661,6 +3929,7 @@ export class SqliteScopeHost {
             admissionNote: r.admission_note,
             origin: r.origin_json ? JSON.parse(r.origin_json) : null,
             outbound: outboundOfManifestJson(r.manifest_json),
+            calls: callsOfManifestJson(r.manifest_json),
             createdAt: r.created_at,
         });
         const readVersion = (id) => {
@@ -3872,6 +4141,169 @@ export class SqliteScopeHost {
                 permissions: outcome.permissions,
             };
         };
+        /**
+         * #1706: move one PEER's kill switch on one scope — see `HostAdmin.revokeFromPeer`. The
+         * schedule switch's body with the subject swapped (`switchPeer` → `switchSubjectGrants`):
+         * audit first, one turn on the scope actor, outcome after, `not_found` when nothing was held.
+         */
+        const switchPeerAt = async (actor, raw, to) => {
+            const input = peerSwitch.parse(raw);
+            const { tenantId, scopeId } = input.node;
+            const scope = this.directory
+                .prepare('SELECT tenant_id FROM scopes WHERE scope_id = ?')
+                .get(scopeId);
+            if (!scope || scope.tenant_id !== tenantId) {
+                throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
+            }
+            const operationId = ulid();
+            const action = to === 'off' ? 'revokeFromPeer' : 'restoreToPeer';
+            const target = { tenantId, scopeId };
+            const base = { operationId, vertical: input.vertical, calls: to };
+            this.recordAdmin(actor, action, target, null, { ...base, phase: 'intent', reason: input.reason });
+            let outcome;
+            try {
+                const rt = this.runtime(tenantId, scopeId);
+                outcome = await rt.actor.turn(() => rt.db.transaction(() => switchPeer(switchSqlOf(rt.db), {
+                    vertical: input.vertical,
+                    scopeId,
+                    to,
+                    at: new Date().toISOString(),
+                }))());
+            }
+            catch (err) {
+                try {
+                    this.recordAdmin(actor, action, target, null, {
+                        ...base,
+                        phase: 'failed',
+                        error: err instanceof Error ? err.message : String(err),
+                    });
+                }
+                catch {
+                    // Best effort: the original error is what the caller must see.
+                }
+                throw err;
+            }
+            this.recordAdmin(actor, action, target, null, {
+                ...base,
+                phase: outcome.held ? 'applied' : 'refused',
+                changed: outcome.changed,
+                permissions: outcome.permissions,
+            });
+            if (!outcome.held) {
+                throw substratError('not_found', `scope ${scopeId} holds no grant for peer '${input.vertical}' — nothing to switch ${to} ` +
+                    `(check the slug: it is the calling vertical's registry id, as the target's \`peers\` names it)`);
+            }
+            return {
+                operationId,
+                vertical: input.vertical,
+                calls: to,
+                changed: outcome.changed,
+                permissions: outcome.permissions,
+            };
+        };
+        /**
+         * The status read's admin-log join (#1674): the `intent` row of the `revokeFromSystem`
+         * still in force for each OFF module — actor, reason, when. Paired to its `applied` row
+         * by `operationId`, so a refused or failed attempt (only possible on a module this
+         * scope has never switched off before, per `switchSystemSchedules`'s `held` check, so
+         * never the explanation for a module that is currently off) is never read as one.
+         */
+        const lastSwitchedOffBy = (tenantId, scopeId, 
+        /** The revoking action, and the payload field naming its subject. */
+        action, key, subjects) => {
+            const moduleIds = subjects;
+            const rows = this.directory
+                .prepare(`SELECT actor, after, at FROM _substrat_admin_log
+            WHERE tenant_id = ? AND scope_id = ? AND action = ?
+            ORDER BY id DESC`)
+                .all(tenantId, scopeId, action);
+            const appliedOps = new Set();
+            for (const row of rows) {
+                if (!row.after)
+                    continue;
+                const payload = JSON.parse(row.after);
+                if (payload.phase === 'applied' && payload.operationId)
+                    appliedOps.add(payload.operationId);
+            }
+            const result = new Map();
+            for (const row of rows) {
+                if (result.size === moduleIds.size)
+                    break;
+                if (!row.after)
+                    continue;
+                const payload = JSON.parse(row.after);
+                const subject = payload[key];
+                if (payload.phase !== 'intent' || !payload.operationId || typeof subject !== 'string')
+                    continue;
+                if (!moduleIds.has(subject) || result.has(subject))
+                    continue;
+                if (!appliedOps.has(String(payload.operationId)) || typeof payload.reason !== 'string')
+                    continue;
+                result.set(subject, {
+                    actor: row.actor,
+                    reason: payload.reason,
+                    at: row.at,
+                });
+            }
+            return result;
+        };
+        /** #1674's join, bound to the schedule switch — the shape every caller here used. */
+        const lastSwitchedOff = (tenantId, scopeId, moduleIds) => lastSwitchedOffBy(tenantId, scopeId, 'revokeFromSystem', 'moduleId', moduleIds);
+        /**
+         * The status read (#1674): every module this scope holds or has held system authority
+         * for, and where each stands — the SAME predicate `switchSystem` gates its writes on
+         * (`systemGrantsStatus`, over the scope's own storage), so the read and the runner
+         * cannot disagree.
+         */
+        const systemGrantsStatusOf = async (actor, node) => {
+            const { tenantId, scopeId } = node;
+            const scope = this.directory
+                .prepare('SELECT tenant_id FROM scopes WHERE scope_id = ?')
+                .get(scopeId);
+            if (!scope || scope.tenant_id !== tenantId) {
+                throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
+            }
+            const rt = this.runtime(tenantId, scopeId);
+            const states = await rt.actor.turn(() => systemGrantsStatus(switchSqlOf(rt.db), new Date().toISOString()));
+            const offModules = new Set(states.filter((s) => s.schedules === 'off').map((s) => s.moduleId));
+            const explanations = offModules.size > 0 ? lastSwitchedOff(tenantId, scopeId, offModules) : new Map();
+            const result = states.map((s) => ({
+                moduleId: s.moduleId,
+                schedules: s.schedules,
+                switchedOff: explanations.get(s.moduleId) ?? null,
+            }));
+            // K-24: reading the switch's position and any live incident reason is itself
+            // access-logged, the same as every other HostAdmin read.
+            this.recordAccess(actor, 'systemGrantsStatus', { tenantId, scopeId }, null, result.length);
+            return result;
+        };
+        /**
+         * The peer switch's status read (#1706) — `systemGrantsStatusOf` with the subject
+         * swapped: the kernel's `peerGrantsStatus` over the scope's own storage, which is the
+         * SAME predicate `admitPeer` refuses a call on, then the admin log's explanation for
+         * each peer that is off. The join belongs on this side because the admin log is the
+         * control plane's store; the position alone is all a vertical's own deployment can say.
+         */
+        const peerGrantsStatusOf = async (actor, node) => {
+            const { tenantId, scopeId } = node;
+            const scope = this.directory
+                .prepare('SELECT tenant_id FROM scopes WHERE scope_id = ?')
+                .get(scopeId);
+            if (!scope || scope.tenant_id !== tenantId) {
+                throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
+            }
+            const rt = this.runtime(tenantId, scopeId);
+            const states = await rt.actor.turn(() => peerGrantsStatus(switchSqlOf(rt.db), new Date().toISOString()));
+            const offPeers = new Set(states.filter((p) => p.calls === 'off').map((p) => p.vertical));
+            const explanations = offPeers.size > 0 ? lastSwitchedOffBy(tenantId, scopeId, 'revokeFromPeer', 'vertical', offPeers) : new Map();
+            const result = states.map((p) => ({
+                vertical: verticalSlugOf.parse(p.vertical),
+                calls: p.calls,
+                switchedOff: explanations.get(p.vertical) ?? null,
+            }));
+            this.recordAccess(actor, 'peerGrantsStatus', { tenantId, scopeId }, null, result.length);
+            return result;
+        };
         return {
             // #603: fixed at construction — a host built without a box can never store a
             // credential, and saying so is what lets a transport answer 503 instead of 500.
@@ -4062,8 +4494,14 @@ export class SqliteScopeHost {
             // #1666: the schedule kill switch and its lever back — `system-switch.ts` is the
             // whole rule, shared with the Cloudflare adapter; this is the directory check, the
             // transaction and the audit row around it.
+            revokeFromPeer: async (actor, raw) => switchPeerAt(actor, raw, 'off'),
+            restoreToPeer: async (actor, raw) => switchPeerAt(actor, raw, 'on'),
             revokeFromSystem: async (actor, raw) => switchSystem(actor, raw, 'off'),
             restoreToSystem: async (actor, raw) => switchSystem(actor, raw, 'on'),
+            // #1674: the switch's status read — same gate, the admin log to explain an `off`
+            // entry. Nothing to delegate here: the pure adapter's scope storage IS the store.
+            systemGrantsStatus: systemGrantsStatusOf,
+            peerGrantsStatus: peerGrantsStatusOf,
             // #1672 — the platform's two capability verbs, both a turn on the scope actor
             // (#1678: every scope-level admin write takes one, so none lands mid-invoke inside a
             // stranger's transaction) and both in the admin log without the secret or its hash.
@@ -4234,6 +4672,21 @@ export class SqliteScopeHost {
                 this.recordAccess(actor, 'listHostnames', { tenantId: filter?.tenantId ?? null, scopeId: filter?.scopeId ?? null }, filter, rows.length);
                 return rows.map(mapHostname);
             },
+            // #1706: the directory's answer to "vertical Y in tenant T", by the kernel's one rule.
+            resolveVerticalInstance: async (tenantId, vertical) => {
+                const rows = this.directory
+                    .prepare(`SELECT scope_id, tenant_id, vertical, status, kind, forked_from FROM scopes
+              WHERE tenant_id = ? AND vertical = ?`)
+                    .all(tenantId, vertical);
+                return resolveVerticalInstanceFrom(rows.map((r) => ({
+                    id: r.scope_id,
+                    tenantId: r.tenant_id,
+                    vertical: r.vertical,
+                    status: r.status,
+                    kind: r.kind ?? '',
+                    forkedFrom: r.forked_from ?? null,
+                })), tenantId, vertical);
+            },
             resolveHostname: async (raw) => {
                 // The router's per-request read. No actor, not logged — same carve-out as
                 // resolveIdentity (K-24): this is a machine path, not a staff read.
@@ -4822,6 +5275,26 @@ export class SqliteScopeHost {
                 }
                 return drained;
             },
+            readExportedEvents: async (actor, tenantId, scopeId, raw) => {
+                // #1705: the producer's half. Parsed here, since HostAdmin is public and the control
+                // plane is not the only caller: a limit or cursor nobody validated must not reach SQL.
+                const input = exportReadInput.parse(raw);
+                this.assertScopeReachable(tenantId, scopeId);
+                const batch = await this.readExports(tenantId, scopeId, input);
+                this.recordAccess(actor, 'readExportedEvents', { tenantId, scopeId }, { consumer: input.consumer, after: input.after, limit: input.limit }, batch.events.length);
+                return batch;
+            },
+            importState: async (actor, tenantId, scopeId) => {
+                this.assertScopeReachable(tenantId, scopeId);
+                const consumes = this.crossVertical.consumes();
+                // A deployment that imports nothing answers without opening the scope. The sweep
+                // asks this of every active scope on every pass that has the phase on.
+                if (consumes.length === 0)
+                    return { consumes: [], cursors: [] };
+                const cursors = this.importCursors(this.scopeReadDbFor(tenantId, scopeId));
+                this.recordAccess(actor, 'importState', { tenantId, scopeId }, null, cursors.length);
+                return { consumes, cursors };
+            },
             redrainEvents: async (actor, tenantId, scopeId, input) => {
                 // Directory check first, on mark's reasoning: "nothing to reopen" and "you may not
                 // address this scope" are different answers.
@@ -5995,14 +6468,26 @@ export class SqliteScopeHost {
                    status = CASE WHEN status = 'error' THEN 'active' ELSE status END
                WHERE id = ?`)
                         .run(now, id);
+                }
+                else {
+                    this.directory
+                        .prepare(`UPDATE _substrat_connections
+               SET last_error = ?, last_error_at = ?,
+                   status = CASE WHEN status = 'revoked' THEN status ELSE 'error' END
+               WHERE id = ?`)
+                        .run(outcome.error.slice(0, 2000), now, id);
+                }
+                // #1691: the line is settled — now the data point, off the row's own identity
+                // (never the caller's input), fire-and-forget. With the no-op default there is
+                // nothing to hand it, so the self-host path skips the read entirely.
+                if (this.connectorCalls === noopConnectorCallRecorder)
                     return;
+                const row = this.directory
+                    .prepare('SELECT tenant_id, vertical, provider FROM _substrat_connections WHERE id = ?')
+                    .get(id);
+                if (row) {
+                    recordConnectorCall(this.connectorCalls, connectorCallRecord({ tenantId: row.tenant_id, vertical: row.vertical, provider: row.provider }, outcome));
                 }
-                this.directory
-                    .prepare(`UPDATE _substrat_connections
-             SET last_error = ?, last_error_at = ?,
-                 status = CASE WHEN status = 'revoked' THEN status ELSE 'error' END
-             WHERE id = ?`)
-                    .run(outcome.error.slice(0, 2000), now, id);
             },
             putConnectorState: async (id, key, value) => {
                 this.directory
@@ -6784,8 +7269,8 @@ export class SqliteScopeHost {
      * row's `last_used_at` are the same value — a second clock read could disagree.
      */
     at = this.clock()) {
-        // For a connection, system or capability subject this carries THAT id so the type
-        // holds — it is not a person, and the event actor below says what it is instead.
+        // For a connection, system, capability or peer-vertical subject this carries THAT id so
+        // the type holds — it is not a person, and the event actor below says what it is instead.
         const principal = subject.id;
         const checker = this.checker;
         const relations = this.relations;