primitive-admin 1.1.0-alpha.74 → 1.1.0-alpha.76

package/dist/src/lib/generated-config-surfaces.js

@@ -791,6 +791,35 @@ export const RETIRED_CONFIG_KEYS = {
                 "`primitive functions enable|disable` to change availability, or " +
                 "`primitive functions archive` to retire the function (#2907).",
         },
+        // #3279 — function code acts as the system. `runAs` chose between two
+        // authority models (forward the caller's, or the app's); there is one
+        // model now, so the key is not merely unnecessary: a file that still
+        // carries it is asking for a mode that no longer exists, and accepting
+        // and ignoring it would leave the author believing `"caller"` limited
+        // what the code could reach. A stored value on a pre-change row decides
+        // nothing anywhere.
+        runAs: {
+            toml: "`runAs` is no longer authored in TOML (#3279): function code acts as " +
+                "the system whoever invoked it, so there is no mode to choose. The " +
+                "`access` gate is the authorization, and `ctx.user` is the caller " +
+                "(null for a trigger fire). Delete the line and push again.",
+            request: "`runAs` is retired (#3279): function code acts as the system " +
+                "whoever invoked it, so there is no mode to choose. The `access` gate " +
+                "is the authorization; omit the field.",
+        },
+        // #3279 — the flag declared that a database READ grant read every row of
+        // a model for every caller. There is no database read grant: the
+        // per-model grammar is retired with the mode, and a function's reads are
+        // the app's own.
+        unscopedReads: {
+            toml: "`unscopedReads` is no longer authored in TOML (#3279): function code " +
+                "acts as the system, so there is no database read grant for the flag " +
+                "to widen — every records call inside a function carries the app's " +
+                "own authority. Delete the line and push again.",
+            request: "`unscopedReads` is retired (#3279): function code acts as the " +
+                "system, so there is no database read grant for the flag to widen. " +
+                "Omit the field.",
+        },
     },
     // #2803 — availability is one server-owned `status`. As a TOML key it made
     // `config push` a second writer: pushing a file pulled before an operator ran
@@ -811,6 +840,607 @@ export const RETIRED_CONFIG_KEYS = {
 export function retiredConfigKey(prefix, key) {
     return RETIRED_CONFIG_KEYS[prefix]?.[key] ?? null;
 }
+// ── src/config-surface/function-grants.ts ────────────────────────────────
+/**
+ * The capability grammar for server functions — #3182 phase 1, rewritten by
+ * #3279 (project `server-functions` phase 3).
+ *
+ * A function declares in its own TOML what it may CONFIGURE:
+ *
+ *   capabilities = ["integration:stripe", "secret:STRIPE_KEY", "databases:delete"]
+ *
+ * ── Why the grammar is this small ────────────────────────────────────────
+ *
+ * The intent's decision (2026-09-09, "Authorization inside a function?"):
+ * function code acts as the system. The invocation gate is the authorization,
+ * and inside a function every platform call carries the app's own authority in
+ * every family. A capability is therefore never a statement about DATA — a
+ * model, a prompt, a channel, a member — because the function may reach all of
+ * it. It is declared only where it configures something:
+ *
+ *   `integration:<key>`   the egress allowlist — which upstream hosts the
+ *                         function's outbound calls may reach;
+ *   `secret:<NAME>`       credential least privilege — which secret VALUES may
+ *                         cross into the sandbox at all;
+ *   the high-blast list   {@link HIGH_BLAST_CAPABILITIES} — the operations
+ *                         whose blast radius the intent keeps opt-in.
+ *
+ * Every other string a function used to declare is RETIRED, and the grammar
+ * says so by name: an author who still writes `database:orders/Order:read`
+ * is told the model changed and what stays, not "unknown family", which would
+ * send them to check their spelling.
+ *
+ * ── Why the components have a charset ────────────────────────────────────
+ *
+ * A keyed grant's key must match `[A-Za-z0-9_-]+`, so neither `:` nor `/` can
+ * enter a component and the string is INJECTIVE — one string, one object. An
+ * integration or secret whose key carries a delimiter is simply unreachable
+ * from functions, with an error that says why (D3182-001's argument, kept).
+ *
+ * ── Why this module is pure ──────────────────────────────────────────────
+ *
+ * Capabilities are validated twice — by `config push`'s preflight, so an
+ * author sees the error against their own file, and by the server, which is
+ * authoritative because the raw admin API exists. Two enforcement points must
+ * not be two grammars, so the grammar lives here, in the dependency-free
+ * `src/config-surface/` tree the CLI vendors at build time
+ * (`cli/scripts/gen-config-surfaces.mjs`). The server imports this module; the
+ * CLI imports the generated copy; the drift guard fails if they differ.
+ */
+/** Every component of a grant. Injectivity depends on this. */
+export const GRANT_COMPONENT_PATTERN = /^[A-Za-z0-9_-]+$/;
+/** `ServerFunctionConfig.capabilities` is a StringSet with these bounds. */
+export const MAX_CAPABILITY_ENTRIES = 100;
+export const MAX_CAPABILITY_ENTRY_LENGTH = 200;
+/**
+ * The two keyed families the intent keeps: one component under
+ * {@link GRANT_COMPONENT_PATTERN}, naming a single object. Every key format the
+ * platform issues fits: an integration key is `^[a-z0-9][a-z0-9-_]{2,}$` and a
+ * secret name is `^[A-Z][A-Z0-9_]{0,63}$`.
+ */
+export const KEYED_GRANT_FAMILIES = ["integration", "secret"];
+/**
+ * The high-blast-radius opt-ins — #3279, criterion 5 (CR3279-001, D3279-003).
+ *
+ * Since function code acts as the system, admission to a family is no longer
+ * an authority statement: everything the gateway lets through runs with the
+ * app's own authority. Most operations are fine that way — that is the whole
+ * decision. A short list is not, and the intent names its categories: delete a
+ * database, app or user; role changes; secret changes; resource provisioning.
+ * Those stay opt-in, so a function that can do them says so in a reviewable
+ * line of its TOML.
+ *
+ * The strings are EXACT and 1:1 with the operation id, so there is nothing to
+ * look up: `users.setRole` needs `users:setRole`. They parse with the verb as
+ * their KEY, because two exact capabilities in one family must not cover each
+ * other — `databases:create` is not permission to delete a database.
+ *
+ * The database ROLE mutations are here because they hand out persistent
+ * authority: a group grant assigns the manager role (D3279-003). App deletion
+ * and secret writes have no app-API route today; they are recorded, not gated,
+ * and the profile generator refuses to admit a future such route without a row
+ * here (`HIGH_BLAST_WATCH` in `scripts/lib/function-profile.mjs`).
+ */
+export const HIGH_BLAST_CAPABILITIES = [
+    "databases:create",
+    "databases:delete",
+    "databases:transferOwnership",
+    "databases:addManager",
+    "databases:revokePermission",
+    "databases:grantGroupPermission",
+    "databases:revokeGroupPermission",
+    "users:remove",
+    "users:setRole",
+    "blobBuckets:createBucket",
+    "blobBuckets:deleteBucket",
+];
+/** The exact strings, which since #3279 are exactly the high-blast list. */
+export const EXACT_GRANT_STRINGS = HIGH_BLAST_CAPABILITIES;
+/**
+ * What stays, in one sentence, for every retirement to point at. An author
+ * who reads a refusal should not need the guide to know what to write next.
+ */
+const KEPT_KINDS = "Capabilities are declared only for `integration:<key>` (the egress " +
+    "allowlist), `secret:<NAME>` (which secret values may enter the sandbox) " +
+    "and the high-blast-radius opt-ins (" +
+    HIGH_BLAST_CAPABILITIES.map((entry) => `\`${entry}\``).join(", ") +
+    ").";
+/**
+ * The retired FAMILIES (#3279), each with the reason it is gone.
+ *
+ * The value is what the family used to authorize, phrased as what a function
+ * now reaches without it. A refusal names the authored string, says it is
+ * retired, gives this reason, tells the author to delete the entry, and lists
+ * what stays.
+ */
+export const RETIRED_GRANT_FAMILIES = {
+    database: "a database model needs no grant — every records call inside a function " +
+        "carries the app's own authority, and the models a function touches are " +
+        "collected at push as a manifest, not an authorization",
+    prompt: "a prompt needs no grant — `ctx.prompts.run` reaches every prompt of the " +
+        "app on the app's own authority",
+    var: "a config var needs no grant — `ctx.configVar` reads every var of the " +
+        "app on the app's own authority",
+    channel: "a channel needs no grant — `ctx.channels.authorize` and " +
+        "`ctx.channels.publish` reach every channel on the app's own authority",
+};
+/** The retired EXACT strings (#3279), on the same terms. */
+export const RETIRED_GRANT_STRINGS = {
+    "users:send": "a send needs no grant — `ctx.users.send` reaches every member on the " +
+        "app's own authority",
+    "connections:send": "a send needs no grant — `ctx.connections.send` reaches every connection " +
+        "on the app's own authority",
+    "email:send": "sending mail needs no grant — `ctx.api.email.send` runs on the app's " +
+        "own authority, under the app's own hourly email budget",
+    "analytics:writeForUser": "an analytics write needs no grant — `ctx.api.analytics.writeForUser` " +
+        "runs on the app's own authority",
+};
+/**
+ * The retirement sentence for one authored string, or null when the string is
+ * not a retired one.
+ *
+ * Exported so the enforcement-time reader (`loadConfigGrants`) can tell a
+ * retired string on a pre-change row — tolerated, logged — from a string that
+ * was never a grant at all, which still authorizes nothing.
+ */
+export function retiredGrantRefusal(raw) {
+    const colon = raw.indexOf(":");
+    const family = colon === -1 ? raw : raw.slice(0, colon);
+    const reason = RETIRED_GRANT_STRINGS[raw] ??
+        (family in RETIRED_GRANT_FAMILIES ? RETIRED_GRANT_FAMILIES[family] : null);
+    if (!reason)
+        return null;
+    return (`capability '${raw}' is retired (#3279): function code acts as the ` +
+        `system, so ${reason}. Delete the entry. ${KEPT_KINDS}`);
+}
+/** The keyed families' charset rule, as one sentence an author can act on. */
+const KEY_CHARSET_GUIDANCE = "the key must match [A-Za-z0-9_-]+ so the grant string names exactly one " +
+    "object; a key carrying ':' or '/' is unreachable from functions and needs " +
+    "renaming to be granted";
+/**
+ * What each keyed family's component is CALLED, so a refusal names the thing
+ * the author got wrong rather than "the key".
+ */
+const KEYED_FAMILY_NOUNS = {
+    integration: "integration key",
+    secret: "secret name",
+};
+/** The placeholder each family's grant shape uses, for the same reason. */
+const KEYED_FAMILY_PLACEHOLDERS = {
+    integration: "key",
+    secret: "NAME",
+};
+/** Every accepted shape, in one sentence, for the unknown-family error. */
+const ACCEPTED_FAMILIES = "`integration:<integrationKey>`, `secret:<NAME>`, and the high-blast " +
+    "opt-ins " +
+    HIGH_BLAST_CAPABILITIES.map((entry) => `\`${entry}\``).join(", ");
+/**
+ * A channel name's ceiling, and the reason it has one.
+ *
+ * The name rides in a `ConnectionMapping` row's document-id slot as
+ * `ch:<appId>:<channel>` and in every grant token's claims, so an unbounded
+ * name would be an unbounded key and an unbounded credential. 200 characters
+ * is {@link MAX_CAPABILITY_ENTRY_LENGTH}, kept for continuity with the rows
+ * #3184 already wrote.
+ */
+export const MAX_CHANNEL_NAME_LENGTH = 200;
+/**
+ * A channel NAME, and its namespace.
+ *
+ * The grammar is the grant component charset applied per segment: one or more
+ * `[A-Za-z0-9_-]+` segments joined by `:`. The `channel:<namespace>` GRANT
+ * that used to cover a name is retired (#3279); the name grammar stays because
+ * the authorize and publish routes answer 400 about a name outside it before
+ * anything else, and the connection worker keys membership by it.
+ *
+ * Refusals name the segment that failed, because "channel name is invalid" on
+ * a name like `orders:a::b` tells an author nothing they cannot already see.
+ */
+export function parseChannelName(value) {
+    if (typeof value !== "string" || value === "") {
+        return {
+            error: "a channel name must be a non-empty string of `[A-Za-z0-9_-]+` " +
+                "segments joined by ':' (for example `orders` or `orders:42`)",
+        };
+    }
+    if (value.length > MAX_CHANNEL_NAME_LENGTH) {
+        return {
+            error: `channel name '${value.slice(0, 40)}…' is ${value.length} characters, ` +
+                `over the ${MAX_CHANNEL_NAME_LENGTH}-character limit for one channel.`,
+        };
+    }
+    const segments = value.split(":");
+    for (const segment of segments) {
+        if (segment === "") {
+            return {
+                error: `channel name '${value}' has an empty segment: a channel name is ` +
+                    "one or more `[A-Za-z0-9_-]+` segments joined by ':', with no " +
+                    "leading, trailing, or doubled ':'.",
+            };
+        }
+        if (!GRANT_COMPONENT_PATTERN.test(segment)) {
+            return {
+                error: `channel name '${value}' has the segment '${segment}', which is ` +
+                    "outside the channel charset: every segment must match " +
+                    "[A-Za-z0-9_-]+.",
+            };
+        }
+    }
+    return { namespace: segments[0] };
+}
+/**
+ * One capability entry as a grant, or the reason it is not one.
+ *
+ * The single entry point the enforcement path and both preflights use: a
+ * caller holds one authored string and asks what it grants, without having to
+ * know which of the shapes to try. Every diagnosis is specific — a retired
+ * string gets the retirement and what stays; a near miss in a kept family gets
+ * the family's own strings; a keyed family gets its charset rule.
+ */
+export function parseFunctionGrant(entry) {
+    if (typeof entry !== "string" || entry.trim() === "") {
+        return { error: "a capability must be a non-empty string" };
+    }
+    const raw = entry;
+    // The exact strings first: they name no object, so nothing about them is
+    // negotiable. The VERB is the key, so `databases:create` never covers
+    // `databases.delete`.
+    if (EXACT_GRANT_STRINGS.indexOf(raw) !== -1) {
+        const at = raw.indexOf(":");
+        return {
+            grant: {
+                family: raw.slice(0, at),
+                key: raw.slice(at + 1),
+                raw,
+            },
+        };
+    }
+    // A retired string is the retirement, never "unknown" and never a near
+    // miss — `users:send` in the `users` family is not a typo of `users:remove`.
+    const retired = retiredGrantRefusal(raw);
+    if (retired)
+        return { error: retired };
+    const colon = raw.indexOf(":");
+    const family = colon === -1 ? raw : raw.slice(0, colon);
+    // A kept family that exists, asked for an operation it does not have.
+    // Naming the operations it DOES have is the difference between an author
+    // fixing a typo and an author concluding the family is unavailable (#3187).
+    const operations = EXACT_GRANT_STRINGS.filter((entry) => entry.startsWith(`${family}:`));
+    if (operations.length > 0) {
+        return {
+            error: `capability '${raw}' names the '${family}' family, whose only ` +
+                `capabilit${operations.length > 1 ? "ies are" : "y is"} ` +
+                `${operations.map((op) => `\`${op}\``).join(", ")}.`,
+        };
+    }
+    if (KEYED_GRANT_FAMILIES.indexOf(family) !== -1) {
+        const key = colon === -1 ? "" : raw.slice(colon + 1);
+        const noun = KEYED_FAMILY_NOUNS[family];
+        if (key === "") {
+            return {
+                error: `capability '${raw}' names no ${noun}: a ${family} grant is ` +
+                    `\`${family}:<${KEYED_FAMILY_PLACEHOLDERS[family]}>\`.`,
+            };
+        }
+        if (key === "*") {
+            return {
+                error: `capability '${raw}' uses a wildcard, which no capability family ` +
+                    `accepts: name each ${noun} the function may reach, one grant each.`,
+            };
+        }
+        if (!GRANT_COMPONENT_PATTERN.test(key)) {
+            return {
+                error: `capability '${raw}' names the ${noun} '${key}', which is not one ` +
+                    `component: ${KEY_CHARSET_GUIDANCE}.`,
+            };
+        }
+        return { grant: { family: family, key, raw } };
+    }
+    return {
+        error: `capability '${raw}' names no capability family this platform knows. ` +
+            `The capabilities a function may declare are: ${ACCEPTED_FAMILIES}.`,
+    };
+}
+/**
+ * A whole `capabilities` list: shape, bounds, grammar, duplicates.
+ *
+ * The model's own caps are checked HERE rather than left to the StringSet
+ * field, so an over-long entry is a named push error instead of a late model
+ * throw after the R2 object has already been written (principle 6).
+ */
+export function parseCapabilities(value, options = {}) {
+    const empty = { capabilities: [], allGrants: [], retired: [] };
+    if (value === undefined || value === null) {
+        return { ok: true, ...empty, errors: [] };
+    }
+    if (!Array.isArray(value)) {
+        return {
+            ok: false,
+            ...empty,
+            errors: [
+                "`capabilities` must be an array of capability strings, e.g. " +
+                    '["integration:stripe"]',
+            ],
+        };
+    }
+    const errors = [];
+    const capabilities = [];
+    const allGrants = [];
+    const retired = [];
+    const seen = new Set();
+    for (const entry of value) {
+        if (typeof entry !== "string") {
+            errors.push(`\`capabilities\` carries a ${typeof entry} — every entry is a capability string.`);
+            continue;
+        }
+        if (entry.length > MAX_CAPABILITY_ENTRY_LENGTH) {
+            errors.push(`capability '${entry.slice(0, 40)}…' is ${entry.length} characters, ` +
+                `over the ${MAX_CAPABILITY_ENTRY_LENGTH}-character limit for one grant.`);
+            continue;
+        }
+        if (options.tolerateRetired && retiredGrantRefusal(entry)) {
+            if (!retired.includes(entry))
+                retired.push(entry);
+            continue;
+        }
+        const parsed = parseFunctionGrant(entry);
+        if (parsed.error || !parsed.grant) {
+            errors.push(parsed.error ?? `capability '${entry}' is not a valid grant.`);
+            continue;
+        }
+        // StringSet semantics: a repeated grant is the same grant.
+        if (seen.has(entry))
+            continue;
+        seen.add(entry);
+        capabilities.push(entry);
+        allGrants.push(parsed.grant);
+    }
+    if (capabilities.length > MAX_CAPABILITY_ENTRIES) {
+        errors.push(`\`capabilities\` declares ${capabilities.length} distinct grants, over ` +
+            `the ${MAX_CAPABILITY_ENTRIES}-grant limit for one function.`);
+    }
+    if (errors.length > 0) {
+        return { ok: false, ...empty, errors };
+    }
+    return { ok: true, capabilities, allGrants, retired, errors: [] };
+}
+/**
+ * Grants naming an integration the app does not have.
+ *
+ * One message per offending grant, quoting the whole authored string AND the
+ * key on its own, so an operator reading the line knows both what to fix in
+ * the file and what to create in the app.
+ *
+ * The rule is here, beside the grammar, for the reason the whole module
+ * exists: `config push`'s preflight and the authoritative server check read
+ * different sources for the same facts — a `.toml` in the tree versus a row
+ * in DynamoDB — and it is the RULE that must not differ between them.
+ */
+export function validateKeyedGrantsAgainstTargets(grants, known) {
+    const errors = [];
+    for (const grant of grants) {
+        if (grant.family !== "integration")
+            continue;
+        // `null` is a family this enforcement point could not answer for, which
+        // is a deferral, not a refusal.
+        if (known.integrations === null)
+            continue;
+        if (known.integrations.has(grant.key))
+            continue;
+        errors.push(`capability '${grant.raw}' names integration '${grant.key}', which ` +
+            "this app does not have. A grant names an ACTIVE integration by " +
+            "its key; an archived one does not count. Create the integration, " +
+            "or fix the grant.");
+    }
+    return errors;
+}
+// ── src/config-surface/function-manifest.ts ──────────────────────────────
+/**
+ * The query manifest's grammar, and the read rule it unlocks — #3187, project
+ * `server-functions` phase 5.
+ *
+ * A pushed config version may carry a MANIFEST: the queries and mutations the
+ * tree registered at module scope, collected by the CLI (`function-collect.ts`)
+ * by running the tree with `primitive-functions` aliased to a recording stub.
+ *
+ * ── What the manifest is for ─────────────────────────────────────────────
+ *
+ * Observability, and nothing else. `primitive functions get` and the admin
+ * get list what a version registered, so an operator can see it without
+ * reading the bundle (principle 8). The read rule it used to be decided from
+ * (#3187's `$caller` relaxation of `unscopedReads`) is retired by #3279:
+ * function code acts as the system, so there is no per-model grant for a
+ * binding to waive. The intent says so in as many words — "the models a
+ * function touches are collected at push as a reviewable manifest, not an
+ * authorization".
+ *
+ * It is HONEST-CODE evidence and the design doc says so: a hostile bundle can
+ * register whatever it likes, because the collector runs the tenant's own
+ * code. Nothing security-relevant at runtime reads it — parameter injection
+ * and cache verification happen in the platform-owned SDK inside the isolate,
+ * and the invocation gate remains the adversarial boundary.
+ *
+ * ── Why the grammar is here ──────────────────────────────────────────────
+ *
+ * Same reason as `function-grants.ts`: the CLI validates at push preflight so
+ * an author sees the error against their own tree, and the server validates
+ * authoritatively because the raw admin API exists. Two enforcement points,
+ * one rule, in the dependency-free tree the CLI vendors.
+ */
+/**
+ * The manifest encoding, versioned with the envelope that carries it.
+ *
+ * Version 2 (#3279 behavior 10) adds what a function TOUCHES beside what it
+ * registers: the deduplicated `models` its code names and the `families` of
+ * `ctx.api` and the ctx helpers it reaches, collected by a static scan of the
+ * built bundle, plus a `dynamicModels` marker for a model name the scan
+ * could not resolve — distinct from an empty list, which means "names none".
+ * A version-1 manifest still parses: it records registrations only.
+ */
+export const FUNCTION_MANIFEST_SCHEMA_VERSION = 2;
+export const FUNCTION_MANIFEST_SCHEMA_VERSIONS = [1, 2];
+/** Bounds, so a manifest cannot be a way to store an unbounded blob. */
+export const MAX_MANIFEST_QUERIES = 200;
+export const MAX_MANIFEST_NAME_LENGTH = 120;
+export const MAX_MANIFEST_MODELS = 200;
+export const MAX_MANIFEST_FAMILIES = 40;
+/**
+ * Validate a manifest's grammar and normalize it.
+ *
+ * Deliberately strict about SHAPE and silent about meaning: whether the models
+ * exist, whether the queries are the ones the sandbox will really register,
+ * and whether the author meant any of it are questions this cannot answer.
+ */
+export function parseFunctionManifest(value) {
+    const errors = [];
+    const fail = (message) => ({
+        ok: false,
+        manifest: null,
+        errors: [message],
+    });
+    let document = value;
+    if (typeof document === "string") {
+        try {
+            document = JSON.parse(document);
+        }
+        catch (error) {
+            return fail(`the manifest is not valid JSON: ${error?.message || String(error)}`);
+        }
+    }
+    if (!document || typeof document !== "object" || Array.isArray(document)) {
+        return fail("the manifest must be an object with a `queries` array.");
+    }
+    const schemaVersion = Number(document.schemaVersion);
+    if (!FUNCTION_MANIFEST_SCHEMA_VERSIONS.includes(schemaVersion)) {
+        return fail(`the manifest declares schemaVersion ${JSON.stringify(document.schemaVersion)}; this platform reads versions ${FUNCTION_MANIFEST_SCHEMA_VERSIONS.join(" and ")}.`);
+    }
+    if (!Array.isArray(document.queries)) {
+        return fail("the manifest's `queries` must be an array.");
+    }
+    if (document.queries.length > MAX_MANIFEST_QUERIES) {
+        return fail(`the manifest lists ${document.queries.length} registrations, over the ` +
+            `${MAX_MANIFEST_QUERIES} limit for one function.`);
+    }
+    const queries = [];
+    const seen = new Set();
+    for (const entry of document.queries) {
+        if (!entry || typeof entry !== "object" || Array.isArray(entry)) {
+            errors.push("every entry in `queries` must be an object.");
+            continue;
+        }
+        const name = typeof entry.name === "string" ? entry.name : "";
+        if (!name) {
+            errors.push("a manifest entry has no `name`.");
+            continue;
+        }
+        if (name.length > MAX_MANIFEST_NAME_LENGTH) {
+            errors.push(`manifest entry '${name.slice(0, 40)}…' has a name over ` +
+                `${MAX_MANIFEST_NAME_LENGTH} characters.`);
+            continue;
+        }
+        if (seen.has(name)) {
+            errors.push(`manifest entry '${name}' appears twice; every registration needs its ` +
+                "own name.");
+            continue;
+        }
+        seen.add(name);
+        if (entry.kind !== "query" && entry.kind !== "mutation") {
+            errors.push(`manifest entry '${name}' declares kind ${JSON.stringify(entry.kind)}; a registration is a 'query' or a 'mutation'.`);
+            continue;
+        }
+        if (!Array.isArray(entry.models) || entry.models.some((m) => typeof m !== "string")) {
+            errors.push(`manifest entry '${name}' must declare ` + "`models` as an array of strings.");
+            continue;
+        }
+        const params = {};
+        const rawParams = entry.params;
+        if (rawParams !== undefined && rawParams !== null) {
+            if (typeof rawParams !== "object" || Array.isArray(rawParams)) {
+                errors.push(`manifest entry '${name}' must declare ` + "`params` as an object.");
+                continue;
+            }
+            for (const [key, spec] of Object.entries(rawParams)) {
+                if (!spec || typeof spec !== "object" || Array.isArray(spec)) {
+                    errors.push(`manifest entry '${name}' declares parameter '${key}' as ` +
+                        "something other than an object.");
+                    continue;
+                }
+                params[key] = {
+                    ...(spec.type !== undefined ? { type: String(spec.type) } : {}),
+                    ...(spec.caller === true ? { caller: true } : {}),
+                    ...(spec.optional === true ? { optional: true } : {}),
+                    ...(Object.prototype.hasOwnProperty.call(spec, "default")
+                        ? { default: spec.default }
+                        : {}),
+                };
+            }
+        }
+        let cache = null;
+        if (entry.cache !== undefined && entry.cache !== null) {
+            const ttl = Number(entry.cache.ttlMs);
+            if (!Number.isFinite(ttl) || ttl <= 0) {
+                errors.push(`manifest entry '${name}' declares a cache with no positive ` +
+                    "`ttlMs`.");
+                continue;
+            }
+            cache = { ttlMs: ttl };
+        }
+        queries.push({
+            name,
+            kind: entry.kind,
+            models: entry.models.map(String),
+            params,
+            cache,
+            // Derived, never trusted from the entry: a caller-scoped registration is
+            // one with a `$caller` parameter, and that is visible in `params`.
+            callerScoped: Object.values(params).some((p) => p.caller === true),
+        });
+    }
+    // Version 2's touched-surface lists. Bounded and normalized like the
+    // queries; a version-1 document has none and reads as "records
+    // registrations only".
+    const names = (field, max) => {
+        const raw = document[field];
+        if (raw === undefined || raw === null)
+            return [];
+        if (!Array.isArray(raw) || raw.some((m) => typeof m !== "string")) {
+            errors.push(`the manifest's \`${field}\` must be an array of strings.`);
+            return null;
+        }
+        const list = [...new Set(raw.map(String))].sort();
+        if (list.length > max) {
+            errors.push(`the manifest lists ${list.length} ${field}, over the ${max} limit for one function.`);
+            return null;
+        }
+        for (const name of list) {
+            if (name === "" || name.length > MAX_MANIFEST_NAME_LENGTH) {
+                errors.push(`the manifest's \`${field}\` carries '${name.slice(0, 40)}…', which is empty or over ` +
+                    `${MAX_MANIFEST_NAME_LENGTH} characters.`);
+                return null;
+            }
+        }
+        return list;
+    };
+    const models = schemaVersion >= 2 ? names("models", MAX_MANIFEST_MODELS) : [];
+    const families = schemaVersion >= 2 ? names("families", MAX_MANIFEST_FAMILIES) : [];
+    if (schemaVersion >= 2 && document.dynamicModels !== undefined && typeof document.dynamicModels !== "boolean") {
+        errors.push("the manifest's `dynamicModels` must be a boolean.");
+    }
+    if (errors.length > 0)
+        return { ok: false, manifest: null, errors };
+    queries.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
+    return {
+        ok: true,
+        manifest: {
+            schemaVersion,
+            queries,
+            models: models ?? [],
+            families: families ?? [],
+            dynamicModels: schemaVersion >= 2 && document.dynamicModels === true,
+        },
+        errors: [],
+    };
+}
 // ── src/config-surface/workflow.ts ───────────────────────────────────────
 /**
  * The `workflow` configuration object's definition (issue #2644, phase 1).
@@ -3171,18 +3801,23 @@ export const TRANSFORM_SURFACE = {
  * possible (a table is addressed by its path) and would in any case claim the
  * version is a table an author writes, which is exactly what F-002 removed.
  *
- * ── The phase-1 key set is narrower than the models ──────────────────────
- *
- * `capabilities` (#3182/#3183) is declared on the models now so that child
- * touches only the surface, and is deliberately NOT accepted here: a file
- * carrying it today is rejected as an unknown key rather than accepted and
- * dropped, which is the silent-200 failure the whole registry exists to end.
+ * ── The key set is still narrower than the models ────────────────────────
  *
  * The trigger blocks joined the accepted set with #3181. They are `structural`
  * for the same reason `entry` is: they are authored, they are not fields of
  * the header model, and they travel inside the version envelope's TOML bytes
  * rather than as a payload field of their own.
  *
+ * `capabilities` joined the accepted set with #3182 (with `unscopedReads`,
+ * which #3279 retired together with `runAs` and the per-model grammar: the
+ * code acts as the system, and a capability is declared only where it
+ * configures something). It is version-carried and DERIVED by the server from
+ * the TOML inside the pushed envelope rather than sent as a payload field of
+ * its own — the file a human reviews on pull has to be the same statement the
+ * platform enforces (D3182-002). It is listed in `tomlOnlyKeys` for that
+ * reason: it is authored, and it travels as envelope bytes. The two retired
+ * keys carry their guidance in `retired-keys.ts` under this table's prefix.
+ *
  * ── `status` ─────────────────────────────────────────────────────────────
  *
  * A server function is the SIXTH status-carrying type. `status` is server-owned
@@ -3208,16 +3843,6 @@ export const SERVER_FUNCTION_SURFACE = {
                     writableOn: BOTH,
                     validation: "passthrough",
                 },
-                {
-                    field: "runAs",
-                    tomlKey: "runAs",
-                    type: "string",
-                    emit: "always",
-                    writableOn: BOTH,
-                    // `caller | system` — the identity the function's own API calls run
-                    // as (the intent, "Who may invoke a function, and as whom?").
-                    validation: handledBy(FUNCTION_HANDLER, "ServerFunctionsController"),
-                },
                 {
                     field: "access",
                     tomlKey: "access",
@@ -3280,6 +3905,21 @@ export const SERVER_FUNCTION_SURFACE = {
                         "Repointed by a config-version push; versions are nameless, so " +
                         "there is no `activeConfigName` for an author to write.",
                 },
+                runAs: {
+                    kind: "server-owned",
+                    note: "RETIRED from the write surface by #3279: function code acts as " +
+                        "the system whoever invoked it, so the mode the column chose " +
+                        "between no longer exists. Declared-and-deprecated storage only " +
+                        "until phase 6 drops the column; a stored value decides nothing " +
+                        "and is never echoed.",
+                },
+                deleteLockedAt: {
+                    kind: "server-owned",
+                    note: "#3186 — the lease a hard delete takes before it scans for live " +
+                        "runs, so that a start already in flight either shows up in that " +
+                        "scan or sees the lease. Held for minutes at a time by one " +
+                        "request, never authored and never pulled.",
+                },
                 createdBy: {
                     kind: "server-owned",
                     note: "Admin who created the function; assigned server-side.",
@@ -3329,6 +3969,17 @@ export const SERVER_FUNCTION_SURFACE = {
                         "behavior is covered by `envelopeHash` and cannot disagree with " +
                         "the file even for a direct API caller (D3181-005).",
                 },
+                capabilities: {
+                    kind: "structural",
+                    note: "What this version may CONFIGURE (#3279): `integration:<key>` " +
+                        "(the egress allowlist), `secret:<NAME>` (which secret values may " +
+                        "enter the sandbox) and the high-blast-radius opt-ins such as " +
+                        "`databases:delete` or `users:setRole`. Never a statement about " +
+                        "data — function code acts as the system. Stored on the config " +
+                        "version and DERIVED by the server from these authored bytes, so " +
+                        "the file a human reviews is the authority — a push cannot store a " +
+                        "capability the TOML does not declare.",
+                },
             },
             responseOnlyKeys: {},
         },
@@ -3464,7 +4115,7 @@ export const TEST_CASE_SURFACE = {
                     requestModes: ["create", "update"],
                     note: "The sidecar's file name (basename without `.toml`) — the case's " +
                         "identity in the committed tree (#2896). It travels in the BODY " +
-                        "so a clean checkout with no `.primitive-sync.json` reconciles " +
+                        "so a clean checkout with no `.sync-state.json` reconciles " +
                         "instead of creating a duplicate of every case; create stamps it " +
                         "and update backfills it onto a legacy case. Never inside the " +
                         "`[test]` table: sidecar bytes and the content hash are unchanged " +
@@ -4313,6 +4964,7 @@ export const GENERATED_CONFIG_MODEL_FIELDS = {
         "access",
         "inputSchema",
         "outputSchema",
+        "deleteLockedAt",
         "createdBy",
         "createdAt",
         "modifiedAt",