@substrat-run/control-plane-api 0.39.0 → 0.41.0

package/dist/api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AA2B5B,OAAO,KAAK,EAAE,eAAe,EAA4B,MAAM,yBAAyB,CAAC;AACzF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAGtD,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAe3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAGtD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAGL,KAAK,yBAAyB,EAC/B,MAAM,uBAAuB,CAAC;AAE/B,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,SAAS,CAAC;IAChB;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC3C;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAChG;;;;;;;;;OASG;IACH,sBAAsB,CAAC,EAAE,CACvB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,eAAe,KACnB,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACzC;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACpF;;;;;OAKG;IACH,cAAc,CAAC,EAAE,gBAAgB,CAAC;IAClC;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,sBAAsB,CAAC;IAC9C;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,qBAAqB,CAAC;IAC5C;;;;;;;;OAQG;IACH,sBAAsB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C;;;;OAIG;IACH,YAAY,EAAE,iBAAiB,CAAC;IAChC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,WAAW,CAAC;IAClC;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;IAC9C;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;CAChC;AAKD,KAAK,IAAI,GAAG;IAAE,KAAK,EAAE,eAAe,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,CAAC;AA6K7D;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAAE,SAAS,EAAE,IAAI,CAAA;CAAE,CAAC,CAi0EhG"}
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AA6B5B,OAAO,KAAK,EAGV,eAAe,EAIhB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAGtD,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAe3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAQtD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAGL,KAAK,yBAAyB,EAC/B,MAAM,uBAAuB,CAAC;AAE/B,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,SAAS,CAAC;IAChB;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC3C;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAChG;;;;;;;;;OASG;IACH,sBAAsB,CAAC,EAAE,CACvB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,eAAe,KACnB,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACzC;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACpF;;;;;OAKG;IACH,cAAc,CAAC,EAAE,gBAAgB,CAAC;IAClC;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,sBAAsB,CAAC;IAC9C;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,qBAAqB,CAAC;IAC5C;;;;;;;;OAQG;IACH,sBAAsB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C;;;;OAIG;IACH,YAAY,EAAE,iBAAiB,CAAC;IAChC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,WAAW,CAAC;IAClC;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;IAC9C;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;CAChC;AAKD,KAAK,IAAI,GAAG;IAAE,KAAK,EAAE,eAAe,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,CAAC;AAsM7D;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAAE,SAAS,EAAE,IAAI,CAAA;CAAE,CAAC,CA02EhG"}

package/dist/api.js

@@ -1,5 +1,5 @@
 import { Hono } from 'hono';
-import { adminAction, channelName, createTenantInput, entitlementGrantInput, hostname as hostnameSchema, hostnameRegion, hostnameStatus, identityLink, principalId as principalIdSchema, promotionAcknowledgement, provisionableJurisdiction, publishVersionInput, queryScopeInput, readScopeTableInput, registerVerticalInput, scopeDump, scopeId as scopeIdSchema, scopeStatus, storageShape, surfaceName, tenantId as tenantIdSchema, tenantStatus, z, } from '@substrat-run/contracts';
+import { adminAction, channelName, createTenantInput, entitlementGrantInput, hostname as hostnameSchema, hostnameRegion, hostnameStatus, identityLink, listPageQuery, pageOf, principalId as principalIdSchema, promotionAcknowledgement, provisionableJurisdiction, publishVersionInput, queryScopeInput, readScopeTableInput, registerVerticalInput, scopeDump, scopeId as scopeIdSchema, scopeStatus, storageShape, surfaceName, tenantId as tenantIdSchema, tenantStatus, z, } from '@substrat-run/contracts';
 import { migrationProgress, ulid } from '@substrat-run/kernel';
 import { TENANT_HEADER } from './auth.js';
 import { ControlPlaneError } from './client.js';
@@ -7,7 +7,7 @@ import { provisionSiblingScope } from './platform-drain.js';
 import { mapError } from './errors.js';
 import { maskDump } from './mask.js';
 import { assertSandboxContract, deployManifest, storedDeployManifest, deploymentRefFor, stableDeploymentRefFor, nextMigrationTag, upstreamStatusOf, } from './deploy.js';
-import { collectTenantStoreHandles, tenantStoreBindings } from './tenant-stores.js';
+import { blobStoreBindings, collectBlobStoreHandles, collectTenantStoreHandles, tenantStoreBindings, } from './tenant-stores.js';
 import { mintPushToken, pushActorFor } from './push-token.js';
 import { isCustomHostname, validateBindableHostname, } from './custom-hostnames.js';
 // -- request schemas ---------------------------------------------------------
@@ -70,6 +70,29 @@ const listHostnamesQuery = z.object({
     tenantId: tenantIdSchema.optional(),
     scopeId: scopeIdSchema.optional(),
 });
+// Every GET list below shares ONE pagination convention (contracts pagination.ts):
+// keyset over the list's own sort key, `limit` DEFAULTED at this egress (the kernel
+// reads stay unbounded for in-process callers — the admin-log precedent, generalized),
+// `{ entries, nextCursor }` out. The cursor is the last entry's sort key verbatim.
+const pageParams = (c) => listPageQuery.parse({
+    limit: c.req.query('limit'),
+    cursor: c.req.query('cursor'),
+    order: c.req.query('order'),
+});
+/**
+ * Page an already-materialized asc-sorted list — for the one read whose principal
+ * narrowing runs ABOVE the adapter (`GET /verticals`), where a pushed-down page
+ * would terminate early. Same cursor semantics as the keyset reads.
+ */
+const pageSlice = (rows, page, key) => {
+    const found = page.cursor === undefined ? 0 : rows.findIndex((r) => key(r) > page.cursor);
+    const from = found === -1 ? rows.length : found;
+    const entries = rows.slice(from, from + page.limit);
+    return {
+        entries,
+        nextCursor: from + page.limit < rows.length ? key(entries[entries.length - 1]) : null,
+    };
+};
 /** Repeatable query params arrive as `?status=active&status=suspended`. */
 const listScopesQuery = z.object({
     tenantId: tenantIdSchema.optional(),
@@ -151,15 +174,14 @@ const auditLogQuery = z.object({
     action: z.array(adminAction).optional(),
     since: z.string().optional(),
     until: z.string().optional(),
-    // Defaulted, not merely capped: the admin log is append-only and never swept (the
-    // retention decision — it is the compliance witness, control-plane.md §4.4/§4.8), so
-    // it only grows. An unbounded `GET /admin-log` would dump the whole table; a default
-    // page keeps the external read bounded while `nextCursor` still walks the entire log.
-    // The KERNEL call stays deliberately unbounded (an in-process caller that wants
-    // everything asks for everything) — only this HTTP egress vector is bounded by default.
-    limit: z.coerce.number().int().positive().max(1000).default(200),
-    cursor: z.string().optional(),
-    order: z.enum(['asc', 'desc']).optional(),
+    // The shared page fields (contracts pagination.ts). Defaulted, not merely capped:
+    // the admin log is append-only and never swept (the retention decision — it is the
+    // compliance witness, control-plane.md §4.4/§4.8), so it only grows. An unbounded
+    // `GET /admin-log` would dump the whole table; a default page keeps the external
+    // read bounded while `nextCursor` still walks the entire log. The KERNEL call stays
+    // deliberately unbounded (an in-process caller that wants everything asks for
+    // everything) — only the HTTP egress vectors are bounded by default.
+    ...listPageQuery.shape,
 });
 /**
  * The audited HTTP surface over `HostAdmin` (control-plane.md §4.5).
@@ -307,7 +329,11 @@ export function createControlPlaneApi(options) {
         return c.json(body, status);
     });
     // -- tenant registry (§4.1) ------------------------------------------------
-    app.get('/tenants', async (c) => c.json(await admin.listTenants(c.get('actor'))));
+    app.get('/tenants', async (c) => {
+        const page = pageParams(c);
+        const entries = await admin.listTenants(c.get('actor'), page);
+        return c.json(pageOf(entries, page.limit, (t) => t.id));
+    });
     app.post('/tenants', async (c) => {
         const input = createTenantInput.parse(await c.req.json());
         await admin.createTenant(c.get('actor'), input);
@@ -436,7 +462,9 @@ export function createControlPlaneApi(options) {
             status: c.req.queries('status'),
             vertical: c.req.query('vertical'),
         });
-        return c.json(await admin.listScopes(c.get('actor'), filter));
+        const page = pageParams(c);
+        const entries = await admin.listScopes(c.get('actor'), { ...filter, ...page });
+        return c.json(pageOf(entries, page.limit, (s) => s.id));
     });
     // -- fleet migration progress (kernel-design §5.3, #49) ---------------------
     // The ops-console view: "release N: X/Y migrated, P pending, F failed",
@@ -1343,6 +1371,16 @@ export function createControlPlaneApi(options) {
             tenantId: input.tenantId,
             patchBindings: options.patchScriptBindings,
         });
+        // #473: per-tenant BLOB stores the vertical declared, minted + bound the same way.
+        // No handle rides the provision callback (a blob store has no schema to migrate), so
+        // the effect is purely the ledger row + the attached r2_bucket binding.
+        await collectBlobStoreHandles({
+            host: options.host,
+            actor: c.get('actor'),
+            slug,
+            tenantId: input.tenantId,
+            patchBindings: options.patchScriptBindings,
+        });
         try {
             // #424 case 2: the binding attach above races Cloudflare script-settings
             // propagation, so the vertical's FIRST answer can be a transient 5xx that a
@@ -1440,10 +1478,13 @@ export function createControlPlaneApi(options) {
         return (await ownerOf(actor, prefixed)) !== undefined ? prefixed : raw;
     };
     app.get('/verticals', async (c) => {
+        const page = pageParams(c);
         const all = await admin.listVerticals(c.get('actor'));
         const p = c.get('principal');
-        // A builder sees only what it owns; staff see the whole registry.
-        return c.json(p.kind === 'builder' ? all.filter((v) => v.ownerTenant === p.tenantId) : all);
+        // A builder sees only what it owns; staff see the whole registry. The narrowing
+        // runs above the adapter, so the page is sliced here — over the narrowed list.
+        const visible = p.kind === 'builder' ? all.filter((v) => v.ownerTenant === p.tenantId) : all;
+        return c.json(pageSlice(visible, page, (v) => v.slug));
     });
     app.post('/verticals', async (c) => {
         const input = registerVerticalInput.parse(await c.req.json());
@@ -1473,7 +1514,9 @@ export function createControlPlaneApi(options) {
         if (p.kind === 'builder' && (await ownerOf(p.actor, slug)) !== p.tenantId) {
             return c.json({ error: 'not found' }, 404);
         }
-        return c.json(await admin.listVersions(c.get('actor'), slug));
+        const page = pageParams(c);
+        const entries = await admin.listVersions(c.get('actor'), slug, page);
+        return c.json(pageOf(entries, page.limit, (v) => v.id));
     });
     app.post('/verticals/:slug/versions', async (c) => {
         const input = publishVersionInput.parse(await c.req.json());
@@ -1575,7 +1618,9 @@ export function createControlPlaneApi(options) {
         if (p.kind === 'builder' && (await ownerOf(p.actor, slug)) !== p.tenantId) {
             return c.json({ error: 'not found' }, 404);
         }
-        return c.json(await admin.listChannels(c.get('actor'), slug));
+        const page = pageParams(c);
+        const entries = await admin.listChannels(c.get('actor'), slug, page);
+        return c.json(pageOf(entries, page.limit, (ch) => ch.channel));
     });
     // The promotion timeline (newest first) — what a rollback UI picks a target from.
     // Owner-narrowed like the channel read above: a builder sees only its own verticals'
@@ -1587,7 +1632,9 @@ export function createControlPlaneApi(options) {
         if (p.kind === 'builder' && (await ownerOf(p.actor, slug)) !== p.tenantId) {
             return c.json({ error: 'not found' }, 404);
         }
-        return c.json(await admin.listChannelHistory(c.get('actor'), slug, channel));
+        const page = pageParams(c);
+        const entries = await admin.listChannelHistory(c.get('actor'), slug, channel, page);
+        return c.json(pageOf(entries, page.limit, (e) => e.id));
     });
     /**
      * Serve a version IN PLACE (#286): upload its bundle onto the vertical's ONE stable
@@ -1622,7 +1669,15 @@ export function createControlPlaneApi(options) {
         // happened to carry) is what makes a re-deploy structurally unable to drop a
         // tenant's store. Platform-granted after the §4 sandbox check, like injectSecrets:
         // the builder never declared these and never named the ids.
-        const storeBindings = tenantStoreBindings(await admin.listTenantStores(actor, { vertical: slug })).map((b) => ({ type: 'd1', name: b.name, id: b.id }));
+        const storeBindings = [
+            ...tenantStoreBindings(await admin.listTenantStores(actor, { vertical: slug })),
+            // #473: the per-tenant blob-store r2_bucket bindings, re-derived from the ledger on
+            // every serving upload for the same reason — an upload replaces the script's binding
+            // set, so a re-deploy must never drop a tenant's attachment bucket.
+            ...blobStoreBindings(await admin.listBlobStores(actor, { vertical: slug })),
+        ].map((b) => b.type === 'd1'
+            ? { type: 'd1', name: b.name, id: b.id }
+            : { type: 'r2_bucket', name: b.name, bucket_name: b.bucketName });
         await options.deployVertical(ref, {
             entry: manifest.entry,
             compatibilityDate: manifest.compatibilityDate,
@@ -1937,12 +1992,14 @@ export function createControlPlaneApi(options) {
             .object({
             service: z.string().min(1).max(200).optional(),
             level: z.enum(['log', 'info', 'warn', 'error', 'debug']).optional(),
+            search: z.string().min(1).max(200).optional(),
             hours: z.coerce.number().int().min(1).max(72).default(1),
             limit: z.coerce.number().int().min(1).max(500).default(100),
         })
             .parse({
             service: c.req.query('service') || undefined,
             level: c.req.query('level') || undefined,
+            search: c.req.query('search') || undefined,
             hours: c.req.query('hours'),
             limit: c.req.query('limit'),
         });
@@ -1996,7 +2053,9 @@ export function createControlPlaneApi(options) {
         // (scopeId) but never widen; a foreign tenantId in the query loses silently.
         if (p.kind === 'builder')
             filter.tenantId = p.tenantId;
-        return c.json(await admin.listHostnames(c.get('actor'), filter));
+        const page = pageParams(c);
+        const entries = await admin.listHostnames(c.get('actor'), { ...filter, ...page });
+        return c.json(pageOf(entries, page.limit, (h) => h.hostname));
     });
     // Which base domains ride the platform wildcard cert (go straight to `active`);
     // everything else is a custom domain that walks Cloudflare-for-SaaS issuance (§4.7).
@@ -2349,7 +2408,11 @@ export function createControlPlaneApi(options) {
             tenantId: c.req.query('tenantId'),
             source: c.req.query('source'),
         });
-        return c.json(await admin.listRoles(c.get('actor'), filter));
+        const page = pageParams(c);
+        const entries = await admin.listRoles(c.get('actor'), { ...filter, ...page });
+        // Composite sort key (tenant_id, role_key) — the `|` join is the documented
+        // cursor shape (scope-host.ts listRoles).
+        return c.json(pageOf(entries, page.limit, (r) => `${r.tenantId}|${r.key}`));
     });
     // -- the admin log (§4.4/§4.5) ---------------------------------------------
     app.get('/admin-log', async (c) => {
@@ -2367,7 +2430,7 @@ export function createControlPlaneApi(options) {
         const entries = await admin.auditLog(c.get('actor'), filter);
         // The cursor IS the last entry's id (ULID order is chronological), so the
         // page carries its own continuation and the console never assembles one.
-        return c.json({ entries, nextCursor: entries.at(-1)?.id ?? null });
+        return c.json(pageOf(entries, filter.limit, (e) => e.id));
     });
     return app;
 }