@substrat-run/control-plane-api 0.57.0 → 0.58.0

package/dist/api.d.ts

@@ -2,7 +2,7 @@ import { Hono } from 'hono';
 import type { PlatformActorId } from '@substrat-run/contracts';
 import type { ScopeHost } from '@substrat-run/kernel';
 import type { PlatformActorAuth, BuilderAuth, Principal } from './auth.js';
-import type { VerticalClient } from './vertical-client.js';
+import { type VerticalClient } from './vertical-client.js';
 import type { DeployVerticalFn, FetchVerticalAssetFn, FetchVerticalModulesFn } from './deploy.js';
 import type { PatchScriptBindingsFn } from './wfp.js';
 import type { ObservabilityReader } from './observability.js';

package/dist/api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAiC5B,OAAO,KAAK,EAGV,eAAe,EAMhB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAmB,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAGvE,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAgB3D,OAAO,KAAK,EAAe,gBAAgB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAC/G,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAQtD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAuB,KAAK,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,KAAK,EAEV,oBAAoB,EAEpB,gBAAgB,EACjB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAGL,KAAK,yBAAyB,EAC/B,MAAM,uBAAuB,CAAC;AAE/B,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,SAAS,CAAC;IAChB;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC3C;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAChG;;;;;;;;;OASG;IACH,sBAAsB,CAAC,EAAE,CACvB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,eAAe,KACnB,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACzC;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACpF;;;;;OAKG;IACH,cAAc,CAAC,EAAE,gBAAgB,CAAC;IAClC;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,sBAAsB,CAAC;IAC9C;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,oBAAoB,CAAC;IAC1C;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,qBAAqB,CAAC;IAC5C;;;;;;;;OAQG;IACH,sBAAsB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C;;;;OAIG;IACH,YAAY,EAAE,iBAAiB,CAAC;IAChC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,WAAW,CAAC;IAClC;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC;;;;;;;;;OASG;IACH,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC;;;;;;;;;;;;;OAaG;IACH,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;IACxC;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;IAC9C;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;CAChC;AAKD,KAAK,IAAI,GAAG;IAAE,KAAK,EAAE,eAAe,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,CAAC;AA2P7D;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAAE,SAAS,EAAE,IAAI,CAAA;CAAE,CAAC,CA+uGhG"}
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAiC5B,OAAO,KAAK,EAGV,eAAe,EAMhB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAmB,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAGvE,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3E,OAAO,EAA4B,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAgBrF,OAAO,KAAK,EAAe,gBAAgB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAC/G,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAQtD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAuB,KAAK,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,KAAK,EAEV,oBAAoB,EAEpB,gBAAgB,EACjB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAGL,KAAK,yBAAyB,EAC/B,MAAM,uBAAuB,CAAC;AAE/B,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,SAAS,CAAC;IAChB;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC3C;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAChG;;;;;;;;;OASG;IACH,sBAAsB,CAAC,EAAE,CACvB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,eAAe,KACnB,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACzC;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACpF;;;;;OAKG;IACH,cAAc,CAAC,EAAE,gBAAgB,CAAC;IAClC;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,sBAAsB,CAAC;IAC9C;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,oBAAoB,CAAC;IAC1C;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,qBAAqB,CAAC;IAC5C;;;;;;;;OAQG;IACH,sBAAsB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C;;;;OAIG;IACH,YAAY,EAAE,iBAAiB,CAAC;IAChC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,WAAW,CAAC;IAClC;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC;;;;;;;;;OASG;IACH,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC;;;;;;;;;;;;;OAaG;IACH,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;IACxC;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;IAC9C;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;CAChC;AAKD,KAAK,IAAI,GAAG;IAAE,KAAK,EAAE,eAAe,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,CAAC;AA2P7D;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAAE,SAAS,EAAE,IAAI,CAAA;CAAE,CAAC,CAyyGhG"}

package/dist/api.js

@@ -2,6 +2,7 @@ import { Hono } from 'hono';
 import { adminAction, ASSET_PART_PREFIX, assetHash, channelName, createTenantInput, entitlementGrantInput, hostname as hostnameSchema, hostnameRegion, hostnameStatus, identityLink, listPageQuery, pageOf, principalId as principalIdSchema, promotionAcknowledgement, provisionableJurisdiction, publishVersionInput, queryScopeInput, readScopeTableInput, registerVerticalInput, scopeDump, dataSubjectId as dataSubjectIdSchema, scopeId as scopeIdSchema, scopeStatus, storageShape, surfaceName, tenantId as tenantIdSchema, tenantStatus, versionOrigin, z, } from '@substrat-run/contracts';
 import { migrationProgress, ulid } from '@substrat-run/kernel';
 import { TENANT_HEADER } from './auth.js';
+import { connectionGrantsForScope } from './vertical-client.js';
 import { ControlPlaneError } from './client.js';
 import { provisionSiblingScope } from './platform-drain.js';
 import { mapError } from './errors.js';
@@ -610,6 +611,12 @@ export function createControlPlaneApi(options) {
         const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
         return c.json(await admin.listIdentityLinks(c.get('actor'), tenantId));
     });
+    // The tenant's live connection grants (#592) — the readable "what may this connection
+    // invoke" (connections.md §6.2.4 Q2), and the rows provision/reconcile deliver from.
+    app.get('/tenants/:tenantId/connection-grants', async (c) => {
+        const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
+        return c.json(await admin.listConnectionGrants(c.get('actor'), tenantId));
+    });
     // -- the scope directory (§3.2/§4.2) ---------------------------------------
     app.get('/scopes', async (c) => {
         const p = c.get('principal');
@@ -1021,8 +1028,18 @@ export function createControlPlaneApi(options) {
         // #406: re-gathered and re-delivered like entitlements, so a reconcile also repairs a
         // dropped identity-link delivery — and is the channel a link/unlink after provision rides.
         const identityLinks = (await admin.listIdentityLinks(actor, tenantId)).map(({ tenantId: _tenantId, ...link }) => link);
+        // #592: connection grants ride the same authoritative gather — the back-fill for a
+        // scope provisioned before `grantToConnection` ran, and how a revoked connection's
+        // grants stop being delivered (they are absent from the directory's live rows).
+        const connectionGrants = connectionGrantsForScope(await admin.listConnectionGrants(actor, tenantId), scope.vertical, scopeId);
         try {
-            const result = await vertical.reconcileInstance({ tenantId, scopeId, entitlements, identityLinks });
+            const result = await vertical.reconcileInstance({
+                tenantId,
+                scopeId,
+                entitlements,
+                identityLinks,
+                connectionGrants,
+            });
             return c.json(result);
         }
         catch (e) {
@@ -1180,6 +1197,30 @@ export function createControlPlaneApi(options) {
     // the vertical must never even be asked to wipe a primary scope — and re-checked
     // below the seam by deleteSnapshot, which also wipes the co-located storage,
     // removes hostnames + the directory row, and writes the audit entry.
+    /**
+     * Wipe a scope's co-located bytes via the vertical's `/internal/delete-scope`,
+     * tolerating the ONE refusal that must never pin a directory row forever: a script
+     * that never implemented the verb (answers 501 — the standalone-app shape; the
+     * retired auth-server lineage is the canonical case). Those bytes are unreachable
+     * through every platform verb — export and delete alike — so they stay in the
+     * script's own storage and die with the script at orphan cleanup (#248): the same
+     * stranded-not-deleted posture as rebind's `abandonData`. Anything else (a real
+     * 5xx, a timeout) still aborts — an implemented wipe that failed is a retry, not a
+     * shrug. Returns true when the storage was stranded.
+     */
+    const deleteScopeStorageOrStrand = async (vertical, scopeId) => {
+        if (!vertical)
+            return false;
+        try {
+            await vertical.deleteScope({ scopeId });
+            return false;
+        }
+        catch (e) {
+            if (e instanceof ControlPlaneError && e.status === 501)
+                return true;
+            throw e;
+        }
+    };
     app.delete('/tenants/:tenantId/scopes/:scopeId', async (c) => {
         const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
         const scopeId = scopeIdSchema.parse(c.req.param('scopeId'));
@@ -1196,10 +1237,9 @@ export function createControlPlaneApi(options) {
             // storage-before-row ordering deleteSnapshot itself keeps, so a crash
             // between the two converges on retry.
             const vertical = await verticalForScope(c, scope);
-            if (vertical)
-                await vertical.deleteScope({ scopeId });
+            const storageStranded = await deleteScopeStorageOrStrand(vertical, scopeId);
             await options.host.deleteSnapshot(actor, tenantId, scopeId);
-            return c.json({ deleted: scopeId });
+            return c.json({ deleted: scopeId, ...(storageStranded ? { storageStranded: true } : {}) });
         }
         catch (e) {
             if (e instanceof ControlPlaneError) {
@@ -1457,13 +1497,14 @@ export function createControlPlaneApi(options) {
         }
         try {
             const vertical = await verticalForScope(c, scope);
-            if (vertical)
-                await vertical.deleteScope({ scopeId });
+            // By this point the backup contract has resolved (a copy landed, or the caller
+            // explicitly declined one), so stranding is a bookkeeping fact, not data loss.
+            const storageStranded = await deleteScopeStorageOrStrand(vertical, scopeId);
             await admin.reapScope(actor, tenantId, scopeId, {
                 ...(backup ? { backupRef: backupRefOf(backup) } : {}),
             });
             const reaped = await admin.getScopeRecord(actor, tenantId, scopeId);
-            return c.json({ ...reaped, backup });
+            return c.json({ ...reaped, backup, ...(storageStranded ? { storageStranded: true } : {}) });
         }
         catch (e) {
             if (e instanceof ControlPlaneError) {
@@ -1882,6 +1923,11 @@ export function createControlPlaneApi(options) {
         // so its auth adapter resolves logins from local storage, and offboarding becomes an
         // unlink + re-deliver instead of a source edit + deploy.
         const identityLinks = (await admin.listIdentityLinks(c.get('actor'), input.tenantId)).map(({ tenantId: _tenantId, ...link }) => link);
+        // #592: connection grants too — tenant-wide rows materialize for the NEW scope, so an
+        // install provisioned after `grantToConnection` holds the same `connection:<id>` tuple
+        // as one provisioned before it, and the connector return path works without a human
+        // replaying grants per install.
+        const connectionGrants = connectionGrantsForScope(await admin.listConnectionGrants(c.get('actor'), input.tenantId), slug, input.scopeId);
         // #301 PR-2: per-tenant relational stores the vertical DECLARED, minted here (before
         // the callback — the vertical migrates the store inside the K-31 ready-gate, so it
         // must exist and be bound first). Idempotent like the endpoint: a retried provision
@@ -1913,6 +1959,7 @@ export function createControlPlaneApi(options) {
                 ...input,
                 entitlements,
                 identityLinks,
+                connectionGrants,
                 ...(tenantStores.length ? { tenantStores } : {}),
             }));
             return c.json(instance, 201);