@substrat-run/control-plane-api 0.57.1 → 0.59.0

package/dist/api.d.ts

@@ -2,7 +2,7 @@ import { Hono } from 'hono';
 import type { PlatformActorId } from '@substrat-run/contracts';
 import type { ScopeHost } from '@substrat-run/kernel';
 import type { PlatformActorAuth, BuilderAuth, Principal } from './auth.js';
-import type { VerticalClient } from './vertical-client.js';
+import { type VerticalClient } from './vertical-client.js';
 import type { DeployVerticalFn, FetchVerticalAssetFn, FetchVerticalModulesFn } from './deploy.js';
 import type { PatchScriptBindingsFn } from './wfp.js';
 import type { ObservabilityReader } from './observability.js';
@@ -64,12 +64,15 @@ export interface ControlPlaneApiOptions {
      */
     fetchVerticalModules?: FetchVerticalModulesFn;
     /**
-     * Reads one static file back from a script's runtime-served assets (#578) — how a
-     * serving upload recovers asset bytes the stable script's upload session reports
-     * missing (the asset store dedups per script, so the push's upload to the archive
-     * script does not cover a re-serve). Host-injected like `fetchVerticalModules`.
-     * Absent ⇒ a re-serve of an asset-carrying version refuses when the runtime wants
-     * bytes (the pre-#578 behavior).
+     * Reads one static file's bytes back from a script in the namespace (#578) — the
+     * asset twin of `fetchVerticalModules`. The runtime's asset store dedupes per
+     * SCRIPT, not namespace-wide, so the first serve of an asset-carrying version onto
+     * the stable serving script always finds its hashes missing there; this seam is how
+     * the serve recovers the bytes the push uploaded to the version's archive script.
+     * Host-injected like `deployVertical` (on Cloudflare, a dispatch fetch — the archive
+     * script's edge serves its own assets without invoking the worker). Absent ⇒ a
+     * re-serve can only ride what the stable script already holds and refuses honestly
+     * otherwise.
      */
     fetchVerticalAsset?: FetchVerticalAssetFn;
     /**

package/dist/api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAiC5B,OAAO,KAAK,EAGV,eAAe,EAMhB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAmB,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAGvE,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAgB3D,OAAO,KAAK,EAAe,gBAAgB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAC/G,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAQtD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAuB,KAAK,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,KAAK,EAEV,oBAAoB,EAEpB,gBAAgB,EACjB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAGL,KAAK,yBAAyB,EAC/B,MAAM,uBAAuB,CAAC;AAE/B,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,SAAS,CAAC;IAChB;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC3C;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAChG;;;;;;;;;OASG;IACH,sBAAsB,CAAC,EAAE,CACvB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,eAAe,KACnB,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACzC;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACpF;;;;;OAKG;IACH,cAAc,CAAC,EAAE,gBAAgB,CAAC;IAClC;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,sBAAsB,CAAC;IAC9C;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,oBAAoB,CAAC;IAC1C;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,qBAAqB,CAAC;IAC5C;;;;;;;;OAQG;IACH,sBAAsB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C;;;;OAIG;IACH,YAAY,EAAE,iBAAiB,CAAC;IAChC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,WAAW,CAAC;IAClC;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC;;;;;;;;;OASG;IACH,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC;;;;;;;;;;;;;OAaG;IACH,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;IACxC;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;IAC9C;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;CAChC;AAKD,KAAK,IAAI,GAAG;IAAE,KAAK,EAAE,eAAe,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,CAAC;AA2P7D;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAAE,SAAS,EAAE,IAAI,CAAA;CAAE,CAAC,CA0wGhG"}
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAkC5B,OAAO,KAAK,EAGV,eAAe,EAMhB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAmB,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAGvE,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3E,OAAO,EAA4B,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAiBrF,OAAO,KAAK,EAEV,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAQtD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAuB,KAAK,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,KAAK,EAEV,oBAAoB,EAEpB,gBAAgB,EACjB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAGL,KAAK,yBAAyB,EAC/B,MAAM,uBAAuB,CAAC;AAE/B,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,SAAS,CAAC;IAChB;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC3C;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAChG;;;;;;;;;OASG;IACH,sBAAsB,CAAC,EAAE,CACvB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,eAAe,KACnB,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACzC;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACpF;;;;;OAKG;IACH,cAAc,CAAC,EAAE,gBAAgB,CAAC;IAClC;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,sBAAsB,CAAC;IAC9C;;;;;;;;;;OAUG;IACH,kBAAkB,CAAC,EAAE,oBAAoB,CAAC;IAC1C;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,qBAAqB,CAAC;IAC5C;;;;;;;;OAQG;IACH,sBAAsB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C;;;;OAIG;IACH,YAAY,EAAE,iBAAiB,CAAC;IAChC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,WAAW,CAAC;IAClC;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC;;;;;;;;;OASG;IACH,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC;;;;;;;;;;;;;OAaG;IACH,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;IACxC;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;IAC9C;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;CAChC;AAKD,KAAK,IAAI,GAAG;IAAE,KAAK,EAAE,eAAe,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,CAAC;AA2P7D;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAAE,SAAS,EAAE,IAAI,CAAA;CAAE,CAAC,CA+1GhG"}

package/dist/api.js

@@ -1,7 +1,9 @@
 import { Hono } from 'hono';
-import { adminAction, ASSET_PART_PREFIX, assetHash, channelName, createTenantInput, entitlementGrantInput, hostname as hostnameSchema, hostnameRegion, hostnameStatus, identityLink, listPageQuery, pageOf, principalId as principalIdSchema, promotionAcknowledgement, provisionableJurisdiction, publishVersionInput, queryScopeInput, readScopeTableInput, registerVerticalInput, scopeDump, dataSubjectId as dataSubjectIdSchema, scopeId as scopeIdSchema, scopeStatus, storageShape, surfaceName, tenantId as tenantIdSchema, tenantStatus, versionOrigin, z, } from '@substrat-run/contracts';
+import { adminAction, ASSET_PART_PREFIX, assetHash, channelName, connectionFilter, createTenantInput, entitlementGrantInput, hostname as hostnameSchema, hostnameRegion, hostnameStatus, identityLink, listPageQuery, pageOf, principalId as principalIdSchema, promotionAcknowledgement, provisionableJurisdiction, publishVersionInput, queryScopeInput, readScopeTableInput, registerVerticalInput, scopeDump, dataSubjectId as dataSubjectIdSchema, scopeId as scopeIdSchema, scopeStatus, storageShape, surfaceName, tenantId as tenantIdSchema, tenantStatus, versionOrigin, z, } from '@substrat-run/contracts';
 import { migrationProgress, ulid } from '@substrat-run/kernel';
 import { TENANT_HEADER } from './auth.js';
+import { connectionGrantsForScope } from './vertical-client.js';
+import { ConnectionRelayError, relayConnectionUpsert } from './connection-relay.js';
 import { ControlPlaneError } from './client.js';
 import { provisionSiblingScope } from './platform-drain.js';
 import { mapError } from './errors.js';
@@ -610,6 +612,67 @@ export function createControlPlaneApi(options) {
         const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
         return c.json(await admin.listIdentityLinks(c.get('actor'), tenantId));
     });
+    // The tenant's live connection grants (#592) — the readable "what may this connection
+    // invoke" (connections.md §6.2.4 Q2), and the rows provision/reconcile deliver from.
+    app.get('/tenants/:tenantId/connection-grants', async (c) => {
+        const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
+        return c.json(await admin.listConnectionGrants(c.get('actor'), tenantId));
+    });
+    // -- the connection store, tenant-scoped (connections.md §3.5) -------------
+    //
+    // The dashboard's door to the PLATFORM's connection store. The dashboard keeps its own
+    // directory (its GitHub App connections live there, consumed by the dashboard itself),
+    // but a provider credential a PLATFORM-run connector consumes (Scrive, Fortnox) must
+    // land in THIS directory — `connector:<provider>` dispatch opens connections here, and
+    // a row written anywhere else is invisible to it. Metadata only on the read: the
+    // `Connection` type cannot carry a secret (contract-tested), so listing is safe as-is.
+    // Not in BUILDER_ROUTES — service/staff only, fail-closed, same law as the identity
+    // mirror above.
+    app.get('/tenants/:tenantId/connections', async (c) => {
+        const filter = connectionFilter.parse({
+            tenantId: tenantIdSchema.parse(c.req.param('tenantId')),
+            vertical: c.req.query('vertical'),
+            provider: c.req.query('provider'),
+            includeRevoked: c.req.query('includeRevoked') === '1' ? true : undefined,
+        });
+        return c.json(await admin.listConnections(c.get('actor'), filter));
+    });
+    // The same upsert semantics as `/internal/connections/upsert` (§3.5.2) — create under a
+    // fresh id, or rotate the one live row in place so its grant tuples survive — behind
+    // platform-actor auth instead of the vertical-harness PLATFORM_SECRET. The tenant is
+    // the path's, never the body's: a body naming a different tenant is refused, not
+    // silently rewritten.
+    app.post('/tenants/:tenantId/connections', async (c) => {
+        const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
+        const raw = await c.req.json();
+        const body = typeof raw === 'object' && raw !== null ? raw : {};
+        if (body.tenantId !== undefined && body.tenantId !== tenantId) {
+            return c.json({ error: 'body tenantId disagrees with the route tenant' }, 400);
+        }
+        try {
+            return c.json(await relayConnectionUpsert(host, c.get('actor'), { ...body, tenantId }));
+        }
+        catch (err) {
+            if (err instanceof ConnectionRelayError)
+                return c.json({ error: err.message }, err.status);
+            throw err;
+        }
+    });
+    // Revoke — terminal (the sealed secret is deleted, grants tombstone; a replacement is a
+    // new connection). Tenant-scoped with K-3 existence hiding: a foreign tenant's
+    // connection id is indistinguishable from an absent one. Idempotent: revoking an
+    // already-revoked row is a 204 no-op, not an error.
+    app.delete('/tenants/:tenantId/connections/:id', async (c) => {
+        const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
+        const id = c.req.param('id');
+        const rows = await admin.listConnections(c.get('actor'), { tenantId, includeRevoked: true });
+        const row = rows.find((r) => r.id === id);
+        if (!row)
+            return c.json({ error: 'unknown connection' }, 404);
+        if (row.status !== 'revoked')
+            await admin.revokeConnection(c.get('actor'), row.id);
+        return c.body(null, 204);
+    });
     // -- the scope directory (§3.2/§4.2) ---------------------------------------
     app.get('/scopes', async (c) => {
         const p = c.get('principal');
@@ -1021,8 +1084,18 @@ export function createControlPlaneApi(options) {
         // #406: re-gathered and re-delivered like entitlements, so a reconcile also repairs a
         // dropped identity-link delivery — and is the channel a link/unlink after provision rides.
         const identityLinks = (await admin.listIdentityLinks(actor, tenantId)).map(({ tenantId: _tenantId, ...link }) => link);
+        // #592: connection grants ride the same authoritative gather — the back-fill for a
+        // scope provisioned before `grantToConnection` ran, and how a revoked connection's
+        // grants stop being delivered (they are absent from the directory's live rows).
+        const connectionGrants = connectionGrantsForScope(await admin.listConnectionGrants(actor, tenantId), scope.vertical, scopeId);
         try {
-            const result = await vertical.reconcileInstance({ tenantId, scopeId, entitlements, identityLinks });
+            const result = await vertical.reconcileInstance({
+                tenantId,
+                scopeId,
+                entitlements,
+                identityLinks,
+                connectionGrants,
+            });
             return c.json(result);
         }
         catch (e) {
@@ -1906,6 +1979,11 @@ export function createControlPlaneApi(options) {
         // so its auth adapter resolves logins from local storage, and offboarding becomes an
         // unlink + re-deliver instead of a source edit + deploy.
         const identityLinks = (await admin.listIdentityLinks(c.get('actor'), input.tenantId)).map(({ tenantId: _tenantId, ...link }) => link);
+        // #592: connection grants too — tenant-wide rows materialize for the NEW scope, so an
+        // install provisioned after `grantToConnection` holds the same `connection:<id>` tuple
+        // as one provisioned before it, and the connector return path works without a human
+        // replaying grants per install.
+        const connectionGrants = connectionGrantsForScope(await admin.listConnectionGrants(c.get('actor'), input.tenantId), slug, input.scopeId);
         // #301 PR-2: per-tenant relational stores the vertical DECLARED, minted here (before
         // the callback — the vertical migrates the store inside the K-31 ready-gate, so it
         // must exist and be bound first). Idempotent like the endpoint: a retried provision
@@ -1937,6 +2015,7 @@ export function createControlPlaneApi(options) {
                 ...input,
                 entitlements,
                 identityLinks,
+                connectionGrants,
                 ...(tenantStores.length ? { tenantStores } : {}),
             }));
             return c.json(instance, 201);
@@ -2229,6 +2308,7 @@ export function createControlPlaneApi(options) {
         if (!version?.deploymentRef) {
             throw new ControlPlaneError(502, `version ${versionId} has no archive script to serve from`);
         }
+        const archiveRef = version.deploymentRef;
         const manifestJson = await admin.versionManifest(actor, slug, versionId);
         if (!manifestJson) {
             throw new ControlPlaneError(502, `version ${versionId} retained no manifest — pushed pre-#286; push it again to serve in place`);
@@ -2259,24 +2339,23 @@ export function createControlPlaneApi(options) {
             modules,
             doClasses: manifest.doClasses,
             bindings: [...manifest.bindings, ...storeBindings],
-            // #340: the version's static files travel with it onto the serving script — from
-            // the RETAINED manifest, with no bytes up front. The asset store dedups PER
-            // SCRIPT (#578), so hashes the push uploaded to the archive script are still
-            // missing for the stable script — each file therefore carries a `fetchContent`
-            // that reads the bytes back from the archive script's runtime-served assets,
-            // invoked (and hash-verified) only for hashes the upload session reports
-            // missing. The archive script gives back the modules (#286) AND the assets:
-            // nothing but the manifest is retained.
+            // #340/#578: the version's static files travel with it onto the serving script —
+            // from the RETAINED manifest, with no bytes. The runtime's asset store dedupes
+            // per SCRIPT (not namespace-wide — the #578 finding), so the serving script only
+            // skips hashes it has itself held before; everything else — every first serve of
+            // new content — is recovered on demand from the version's archive script, the
+            // same store the modules come back from (#286), and verified against its
+            // content-address before upload. This is why the manifest is retained rather
+            // than the bytes: the archive script gives back modules AND assets.
             ...(manifest.assets
                 ? {
                     assets: {
                         ...manifest.assets,
-                        files: manifest.assets.files.map((f) => ({
-                            ...f,
-                            ...(options.fetchVerticalAsset
-                                ? { fetchContent: () => options.fetchVerticalAsset(version.deploymentRef, f.path) }
-                                : {}),
-                        })),
+                        ...(options.fetchVerticalAsset
+                            ? {
+                                recoverContent: (asset) => options.fetchVerticalAsset(archiveRef, asset),
+                            }
+                            : {}),
                     },
                 }
                 : {}),