primitive-admin 1.1.0-alpha.75 → 1.1.0-alpha.76

package/dist/src/lib/generated-config-surfaces.js

@@ -791,6 +791,35 @@ export const RETIRED_CONFIG_KEYS = {
                 "`primitive functions enable|disable` to change availability, or " +
                 "`primitive functions archive` to retire the function (#2907).",
         },
+        // #3279 — function code acts as the system. `runAs` chose between two
+        // authority models (forward the caller's, or the app's); there is one
+        // model now, so the key is not merely unnecessary: a file that still
+        // carries it is asking for a mode that no longer exists, and accepting
+        // and ignoring it would leave the author believing `"caller"` limited
+        // what the code could reach. A stored value on a pre-change row decides
+        // nothing anywhere.
+        runAs: {
+            toml: "`runAs` is no longer authored in TOML (#3279): function code acts as " +
+                "the system whoever invoked it, so there is no mode to choose. The " +
+                "`access` gate is the authorization, and `ctx.user` is the caller " +
+                "(null for a trigger fire). Delete the line and push again.",
+            request: "`runAs` is retired (#3279): function code acts as the system " +
+                "whoever invoked it, so there is no mode to choose. The `access` gate " +
+                "is the authorization; omit the field.",
+        },
+        // #3279 — the flag declared that a database READ grant read every row of
+        // a model for every caller. There is no database read grant: the
+        // per-model grammar is retired with the mode, and a function's reads are
+        // the app's own.
+        unscopedReads: {
+            toml: "`unscopedReads` is no longer authored in TOML (#3279): function code " +
+                "acts as the system, so there is no database read grant for the flag " +
+                "to widen — every records call inside a function carries the app's " +
+                "own authority. Delete the line and push again.",
+            request: "`unscopedReads` is retired (#3279): function code acts as the " +
+                "system, so there is no database read grant for the flag to widen. " +
+                "Omit the field.",
+        },
     },
     // #2803 — availability is one server-owned `status`. As a TOML key it made
     // `config push` a second writer: pushing a file pulled before an operator ran
@@ -813,39 +842,47 @@ export function retiredConfigKey(prefix, key) {
 }
 // ── src/config-surface/function-grants.ts ────────────────────────────────
 /**
- * The database capability grammar for server functions (#3182, project
- * `server-functions` phase 2 of the intent, phase 1 of this child).
+ * The capability grammar for server functions — #3182 phase 1, rewritten by
+ * #3279 (project `server-functions` phase 3).
  *
- * A function declares what it may reach in its own TOML:
+ * A function declares in its own TOML what it may CONFIGURE:
  *
- *   capabilities = ["database:orders/order:read", "database:orders/order:write"]
- *   unscopedReads = true
+ *   capabilities = ["integration:stripe", "secret:STRIPE_KEY", "databases:delete"]
  *
- * ── Why the components have a charset ────────────────────────────────────
+ * ── Why the grammar is this small ────────────────────────────────────────
  *
- * The intent decides ("What does the database name in a grant refer to?") that
- * a grant names the database TYPE key, and the design fixes the string as
- * `database:<databaseType>/<modelName>:read|write` with no wildcards. That
- * string has to be INJECTIVE — one string, one (type, model, access) triple —
- * or a grant means two things at once. It is not injective for the identifiers
- * the repository accepts today: `database-type-config-controller.ts` forbids
- * only `#` in a type key, and js-bao's TOML loader preserves model names
- * verbatim, so `(type "a", model "b/c")` and `(type "a/b", model "c")` both
- * spell `database:a/b/c:read` (D3182-001).
+ * The intent's decision (2026-09-09, "Authorization inside a function?"):
+ * function code acts as the system. The invocation gate is the authorization,
+ * and inside a function every platform call carries the app's own authority in
+ * every family. A capability is therefore never a statement about DATA — a
+ * model, a prompt, a channel, a member — because the function may reach all of
+ * it. It is declared only where it configures something:
  *
- * The fix is a charset rather than an escaping scheme: both components must
- * match `[A-Za-z0-9_-]+`, so neither delimiter can enter a component and the
- * grammar is injective by construction. Authored TOML stays readable, and a
- * database type whose key carries a delimiter is simply UNREACHABLE from
- * functions — fail closed, with an error that says why rather than a grant
- * that quietly covers a neighbour.
+ *   `integration:<key>`   the egress allowlist — which upstream hosts the
+ *                         function's outbound calls may reach;
+ *   `secret:<NAME>`       credential least privilege — which secret VALUES may
+ *                         cross into the sandbox at all;
+ *   the high-blast list   {@link HIGH_BLAST_CAPABILITIES} — the operations
+ *                         whose blast radius the intent keeps opt-in.
+ *
+ * Every other string a function used to declare is RETIRED, and the grammar
+ * says so by name: an author who still writes `database:orders/Order:read`
+ * is told the model changed and what stays, not "unknown family", which would
+ * send them to check their spelling.
+ *
+ * ── Why the components have a charset ────────────────────────────────────
+ *
+ * A keyed grant's key must match `[A-Za-z0-9_-]+`, so neither `:` nor `/` can
+ * enter a component and the string is INJECTIVE — one string, one object. An
+ * integration or secret whose key carries a delimiter is simply unreachable
+ * from functions, with an error that says why (D3182-001's argument, kept).
  *
  * ── Why this module is pure ──────────────────────────────────────────────
  *
- * Grants are validated twice — by `config push`'s preflight, so an author sees
- * the error against their own file, and by the server, which is authoritative
- * because the raw admin API exists. Two enforcement points must not be two
- * grammars, so the grammar lives here, in the dependency-free
+ * Capabilities are validated twice — by `config push`'s preflight, so an
+ * author sees the error against their own file, and by the server, which is
+ * authoritative because the raw admin API exists. Two enforcement points must
+ * not be two grammars, so the grammar lives here, in the dependency-free
  * `src/config-surface/` tree the CLI vendors at build time
  * (`cli/scripts/gen-config-surfaces.mjs`). The server imports this module; the
  * CLI imports the generated copy; the drift guard fails if they differ.
@@ -855,145 +892,220 @@ export const GRANT_COMPONENT_PATTERN = /^[A-Za-z0-9_-]+$/;
 /** `ServerFunctionConfig.capabilities` is a StringSet with these bounds. */
 export const MAX_CAPABILITY_ENTRIES = 100;
 export const MAX_CAPABILITY_ENTRY_LENGTH = 200;
-/** The whole grammar, in one expression. */
-export const DATABASE_GRANT_PATTERN = /^database:([A-Za-z0-9_-]+)\/([A-Za-z0-9_-]+):(read|write)$/;
 /**
- * Capability families this child does not own, and the child that does. A
- * function author who writes one gets told where it is going rather than "not
- * a valid grant", which reads as "never".
- *
- * #3183 took `integration`, `prompt` and `secret` off this list by shipping
- * them. `channel` stays reserved.
+ * The two keyed families the intent keeps: one component under
+ * {@link GRANT_COMPONENT_PATTERN}, naming a single object. Every key format the
+ * platform issues fits: an integration key is `^[a-z0-9][a-z0-9-_]{2,}$` and a
+ * secret name is `^[A-Z][A-Z0-9_]{0,63}$`.
  */
-const FAMILY_OWNERS = {
-    channel: "#3184 (channels and database-change triggers)",
-};
+export const KEYED_GRANT_FAMILIES = ["integration", "secret"];
 /**
- * The families a grant may name, in the order the guidance lists them.
+ * The high-blast-radius opt-ins — #3279, criterion 5 (CR3279-001, D3279-003).
  *
- * Two shapes, not one:
+ * Since function code acts as the system, admission to a family is no longer
+ * an authority statement: everything the gateway lets through runs with the
+ * app's own authority. Most operations are fine that way — that is the whole
+ * decision. A short list is not, and the intent names its categories: delete a
+ * database, app or user; role changes; secret changes; resource provisioning.
+ * Those stay opt-in, so a function that can do them says so in a reviewable
+ * line of its TOML.
  *
- *   KEYED  `integration:<key>`, `prompt:<key>`, `secret:<NAME>`, `var:<NAME>`
- *          — one component under {@link GRANT_COMPONENT_PATTERN}, naming a
- *          single object. Every key format the platform issues fits: an
- *          integration or prompt key is `^[a-z0-9][a-z0-9-_]{2,}$` and a
- *          secret or config-var name is `^[A-Z][A-Z0-9_]{0,63}$`.
- *   EXACT  `users:send`, `connections:send` — no key component at all. The
- *          design doc spells them this way, and the capability really is
- *          app-wide: a send names its target at CALL time, so there is no
- *          object for the grant to name.
+ * The strings are EXACT and 1:1 with the operation id, so there is nothing to
+ * look up: `users.setRole` needs `users:setRole`. They parse with the verb as
+ * their KEY, because two exact capabilities in one family must not cover each
+ * other — `databases:create` is not permission to delete a database.
  *
- * `database:` keeps its own two-component grammar, unchanged.
- *
- * `var:` is this child's choice (D3183-001). The intent is silent on config
- * vars; the family is named after the `{{vars.*}}` template namespace the
- * integration proxy already resolves, so an author who has written
- * `{{vars.REGION}}` reads `var:REGION` without learning a second word for the
- * same thing.
+ * The database ROLE mutations are here because they hand out persistent
+ * authority: a group grant assigns the manager role (D3279-003). App deletion
+ * and secret writes have no app-API route today; they are recorded, not gated,
+ * and the profile generator refuses to admit a future such route without a row
+ * here (`HIGH_BLAST_WATCH` in `scripts/lib/function-profile.mjs`).
  */
-export const KEYED_GRANT_FAMILIES = [
-    "integration",
-    "prompt",
-    "secret",
-    "var",
+export const HIGH_BLAST_CAPABILITIES = [
+    "databases:create",
+    "databases:delete",
+    "databases:transferOwnership",
+    "databases:addManager",
+    "databases:revokePermission",
+    "databases:grantGroupPermission",
+    "databases:revokeGroupPermission",
+    "users:remove",
+    "users:setRole",
+    "blobBuckets:createBucket",
+    "blobBuckets:deleteBucket",
 ];
+/** The exact strings, which since #3279 are exactly the high-blast list. */
+export const EXACT_GRANT_STRINGS = HIGH_BLAST_CAPABILITIES;
 /**
- * Whole platform capabilities — #3187, project `server-functions` phase 4.
- *
- * The EXACT shape, for the same reason the sends take it: neither names an
- * object. An app has ONE hourly email budget and ONE analytics dataset, so a
- * grant carrying a target would be a promise the enforcement point could not
- * keep.
+ * What stays, in one sentence, for every retirement to point at. An author
+ * who reads a refusal should not need the guide to know what to write next.
+ */
+const KEPT_KINDS = "Capabilities are declared only for `integration:<key>` (the egress " +
+    "allowlist), `secret:<NAME>` (which secret values may enter the sandbox) " +
+    "and the high-blast-radius opt-ins (" +
+    HIGH_BLAST_CAPABILITIES.map((entry) => `\`${entry}\``).join(", ") +
+    ").";
+/**
+ * The retired FAMILIES (#3279), each with the reason it is gone.
  *
- * Both gate a function-principal-only route (`emails/send`,
- * `analytics/write-for-user`) rather than a family the gateway passes a
- * caller's own authority through. `email.send` has no HTTP route for a member
- * to call at all, and `analytics.writeForUser` is system-only by design
- * (D3187-SO-001) — caller-mode family admission cannot reach either, which is
- * why they are grants and not passthrough.
+ * The value is what the family used to authorize, phrased as what a function
+ * now reaches without it. A refusal names the authored string, says it is
+ * retired, gives this reason, tells the author to delete the entry, and lists
+ * what stays.
  */
-export const PLATFORM_CAPABILITIES = [
-    "email:send",
-    "analytics:writeForUser",
-];
-export const EXACT_GRANT_STRINGS = [
-    "users:send",
-    "connections:send",
-    ...PLATFORM_CAPABILITIES,
-];
-/** The operations one exact family offers, for a refusal to name them. */
-function exactFamilyOperations(family) {
-    return EXACT_GRANT_STRINGS.filter((entry) => entry.startsWith(`${family}:`));
-}
+export const RETIRED_GRANT_FAMILIES = {
+    database: "a database model needs no grant — every records call inside a function " +
+        "carries the app's own authority, and the models a function touches are " +
+        "collected at push as a manifest, not an authorization",
+    prompt: "a prompt needs no grant — `ctx.prompts.run` reaches every prompt of the " +
+        "app on the app's own authority",
+    var: "a config var needs no grant — `ctx.configVar` reads every var of the " +
+        "app on the app's own authority",
+    channel: "a channel needs no grant — `ctx.channels.authorize` and " +
+        "`ctx.channels.publish` reach every channel on the app's own authority",
+};
+/** The retired EXACT strings (#3279), on the same terms. */
+export const RETIRED_GRANT_STRINGS = {
+    "users:send": "a send needs no grant — `ctx.users.send` reaches every member on the " +
+        "app's own authority",
+    "connections:send": "a send needs no grant — `ctx.connections.send` reaches every connection " +
+        "on the app's own authority",
+    "email:send": "sending mail needs no grant — `ctx.api.email.send` runs on the app's " +
+        "own authority, under the app's own hourly email budget",
+    "analytics:writeForUser": "an analytics write needs no grant — `ctx.api.analytics.writeForUser` " +
+        "runs on the app's own authority",
+};
 /**
- * The grant string for a (type, model, access) triple, or null when either
- * identifier is outside the charset — which is the whole of "unreachable from
- * functions". Callers that hold real identifiers (the enforcement path, the
- * typed-handle emitter) use this rather than string concatenation, so no code
- * path can mint a string this module would not parse back to the same triple.
+ * The retirement sentence for one authored string, or null when the string is
+ * not a retired one.
+ *
+ * Exported so the enforcement-time reader (`loadConfigGrants`) can tell a
+ * retired string on a pre-change row — tolerated, logged — from a string that
+ * was never a grant at all, which still authorizes nothing.
  */
-export function formatDatabaseGrant(databaseType, modelName, access) {
-    if (!GRANT_COMPONENT_PATTERN.test(String(databaseType ?? "")))
-        return null;
-    if (!GRANT_COMPONENT_PATTERN.test(String(modelName ?? "")))
-        return null;
-    if (access !== "read" && access !== "write")
+export function retiredGrantRefusal(raw) {
+    const colon = raw.indexOf(":");
+    const family = colon === -1 ? raw : raw.slice(0, colon);
+    const reason = RETIRED_GRANT_STRINGS[raw] ??
+        (family in RETIRED_GRANT_FAMILIES ? RETIRED_GRANT_FAMILIES[family] : null);
+    if (!reason)
         return null;
-    return `database:${databaseType}/${modelName}:${access}`;
+    return (`capability '${raw}' is retired (#3279): function code acts as the ` +
+        `system, so ${reason}. Delete the entry. ${KEPT_KINDS}`);
 }
-/** The charset rule, as one sentence an author can act on. */
-const CHARSET_GUIDANCE = "each component must match [A-Za-z0-9_-]+ so the grant string means exactly " +
-    "one (type, model) pair; a database type or model whose name carries '/' or " +
-    "':' is unreachable from functions and needs renaming to be granted";
 /** The keyed families' charset rule, as one sentence an author can act on. */
 const KEY_CHARSET_GUIDANCE = "the key must match [A-Za-z0-9_-]+ so the grant string names exactly one " +
     "object; a key carrying ':' or '/' is unreachable from functions and needs " +
     "renaming to be granted";
-/** Every accepted family, in one sentence, for the unknown-family error. */
-const ACCEPTED_FAMILIES = "`database:<databaseType>/<modelName>:read|write`, " +
-    "`integration:<integrationKey>`, `prompt:<promptKey>`, " +
-    "`secret:<NAME>`, `var:<NAME>`, `users:send`, `connections:send`, " +
-    "`email:send`, `analytics:writeForUser`";
 /**
- * One capability entry as ANY grant, or the reason it is not one.
+ * What each keyed family's component is CALLED, so a refusal names the thing
+ * the author got wrong rather than "the key".
+ */
+const KEYED_FAMILY_NOUNS = {
+    integration: "integration key",
+    secret: "secret name",
+};
+/** The placeholder each family's grant shape uses, for the same reason. */
+const KEYED_FAMILY_PLACEHOLDERS = {
+    integration: "key",
+    secret: "NAME",
+};
+/** Every accepted shape, in one sentence, for the unknown-family error. */
+const ACCEPTED_FAMILIES = "`integration:<integrationKey>`, `secret:<NAME>`, and the high-blast " +
+    "opt-ins " +
+    HIGH_BLAST_CAPABILITIES.map((entry) => `\`${entry}\``).join(", ");
+/**
+ * A channel name's ceiling, and the reason it has one.
+ *
+ * The name rides in a `ConnectionMapping` row's document-id slot as
+ * `ch:<appId>:<channel>` and in every grant token's claims, so an unbounded
+ * name would be an unbounded key and an unbounded credential. 200 characters
+ * is {@link MAX_CAPABILITY_ENTRY_LENGTH}, kept for continuity with the rows
+ * #3184 already wrote.
+ */
+export const MAX_CHANNEL_NAME_LENGTH = 200;
+/**
+ * A channel NAME, and its namespace.
+ *
+ * The grammar is the grant component charset applied per segment: one or more
+ * `[A-Za-z0-9_-]+` segments joined by `:`. The `channel:<namespace>` GRANT
+ * that used to cover a name is retired (#3279); the name grammar stays because
+ * the authorize and publish routes answer 400 about a name outside it before
+ * anything else, and the connection worker keys membership by it.
+ *
+ * Refusals name the segment that failed, because "channel name is invalid" on
+ * a name like `orders:a::b` tells an author nothing they cannot already see.
+ */
+export function parseChannelName(value) {
+    if (typeof value !== "string" || value === "") {
+        return {
+            error: "a channel name must be a non-empty string of `[A-Za-z0-9_-]+` " +
+                "segments joined by ':' (for example `orders` or `orders:42`)",
+        };
+    }
+    if (value.length > MAX_CHANNEL_NAME_LENGTH) {
+        return {
+            error: `channel name '${value.slice(0, 40)}…' is ${value.length} characters, ` +
+                `over the ${MAX_CHANNEL_NAME_LENGTH}-character limit for one channel.`,
+        };
+    }
+    const segments = value.split(":");
+    for (const segment of segments) {
+        if (segment === "") {
+            return {
+                error: `channel name '${value}' has an empty segment: a channel name is ` +
+                    "one or more `[A-Za-z0-9_-]+` segments joined by ':', with no " +
+                    "leading, trailing, or doubled ':'.",
+            };
+        }
+        if (!GRANT_COMPONENT_PATTERN.test(segment)) {
+            return {
+                error: `channel name '${value}' has the segment '${segment}', which is ` +
+                    "outside the channel charset: every segment must match " +
+                    "[A-Za-z0-9_-]+.",
+            };
+        }
+    }
+    return { namespace: segments[0] };
+}
+/**
+ * One capability entry as a grant, or the reason it is not one.
  *
  * The single entry point the enforcement path and both preflights use: a
  * caller holds one authored string and asks what it grants, without having to
- * know which of the families' shapes to try. Every diagnosis is
- * family-specific — an author who mistypes an access verb should not be told
- * to read a charset rule, and an author who hits the charset rule should be
- * told that the identifier, not their typing, is the problem.
+ * know which of the shapes to try. Every diagnosis is specific — a retired
+ * string gets the retirement and what stays; a near miss in a kept family gets
+ * the family's own strings; a keyed family gets its charset rule.
  */
 export function parseFunctionGrant(entry) {
     if (typeof entry !== "string" || entry.trim() === "") {
         return { error: "a capability must be a non-empty string" };
     }
     const raw = entry;
-    // The exact strings first: they have no key component, so nothing about
-    // them is negotiable and a near-miss deserves its own message.
-    if (raw === "users:send")
-        return { grant: { family: "users", key: "", raw } };
-    if (raw === "connections:send") {
-        return { grant: { family: "connections", key: "", raw } };
-    }
-    if (raw === "email:send")
-        return { grant: { family: "email", key: "", raw } };
-    if (raw === "analytics:writeForUser") {
-        return { grant: { family: "analytics", key: "", raw } };
-    }
-    const colon = raw.indexOf(":");
-    const family = colon === -1 ? raw : raw.slice(0, colon);
-    if (family === "users" || family === "connections") {
+    // The exact strings first: they name no object, so nothing about them is
+    // negotiable. The VERB is the key, so `databases:create` never covers
+    // `databases.delete`.
+    if (EXACT_GRANT_STRINGS.indexOf(raw) !== -1) {
+        const at = raw.indexOf(":");
         return {
-            error: `capability '${raw}' is not a send grant: the '${family}' family has ` +
-                `exactly one capability, \`${family}:send\`, with no key component — a ` +
-                "send names its target when it is called, not when it is granted.",
+            grant: {
+                family: raw.slice(0, at),
+                key: raw.slice(at + 1),
+                raw,
+            },
         };
     }
-    // A platform family that exists, asked for an operation it does not have.
+    // A retired string is the retirement, never "unknown" and never a near
+    // miss — `users:send` in the `users` family is not a typo of `users:remove`.
+    const retired = retiredGrantRefusal(raw);
+    if (retired)
+        return { error: retired };
+    const colon = raw.indexOf(":");
+    const family = colon === -1 ? raw : raw.slice(0, colon);
+    // A kept family that exists, asked for an operation it does not have.
     // Naming the operations it DOES have is the difference between an author
     // fixing a typo and an author concluding the family is unavailable (#3187).
-    const operations = exactFamilyOperations(family);
+    const operations = EXACT_GRANT_STRINGS.filter((entry) => entry.startsWith(`${family}:`));
     if (operations.length > 0) {
         return {
             error: `capability '${raw}' names the '${family}' family, whose only ` +
@@ -1003,15 +1115,11 @@ export function parseFunctionGrant(entry) {
     }
     if (KEYED_GRANT_FAMILIES.indexOf(family) !== -1) {
         const key = colon === -1 ? "" : raw.slice(colon + 1);
-        const noun = family === "integration" || family === "prompt"
-            ? `${family} key`
-            : family === "secret"
-                ? "secret name"
-                : "config-var name";
+        const noun = KEYED_FAMILY_NOUNS[family];
         if (key === "") {
             return {
                 error: `capability '${raw}' names no ${noun}: a ${family} grant is ` +
-                    `\`${family}:<${family === "secret" || family === "var" ? "NAME" : "key"}>\`.`,
+                    `\`${family}:<${KEYED_FAMILY_PLACEHOLDERS[family]}>\`.`,
             };
         }
         if (key === "*") {
@@ -1028,89 +1136,9 @@ export function parseFunctionGrant(entry) {
         }
         return { grant: { family: family, key, raw } };
     }
-    if (family === "database") {
-        const parsed = parseDatabaseGrant(raw);
-        if (parsed.error || !parsed.grant) {
-            return { error: parsed.error ?? `capability '${raw}' is not a valid grant.` };
-        }
-        return {
-            grant: {
-                family: "database",
-                key: "",
-                databaseType: parsed.grant.databaseType,
-                modelName: parsed.grant.modelName,
-                access: parsed.grant.access,
-                raw,
-            },
-        };
-    }
-    const owner = FAMILY_OWNERS[family];
-    if (owner) {
-        return {
-            error: `capability '${raw}' names the '${family}' family, which server ` +
-                `functions do not accept yet — it ships with ${owner}.`,
-        };
-    }
     return {
         error: `capability '${raw}' names no capability family this platform knows. ` +
-            `The families a function may declare are: ${ACCEPTED_FAMILIES}.`,
-    };
-}
-/**
- * One capability entry as a DATABASE grant, or the reason it is not one.
- *
- * Kept as its own function because the `database:` grammar has two components
- * and an access verb, and saying which of the three went wrong is most of
- * what makes the error useful.
- */
-export function parseDatabaseGrant(entry) {
-    if (typeof entry !== "string" || entry.trim() === "") {
-        return { error: "a capability must be a non-empty string" };
-    }
-    const raw = entry;
-    const match = DATABASE_GRANT_PATTERN.exec(raw);
-    if (match) {
-        return {
-            grant: {
-                databaseType: match[1],
-                modelName: match[2],
-                access: match[3],
-                raw,
-            },
-        };
-    }
-    if (!raw.startsWith("database:")) {
-        return {
-            error: `capability '${raw}' is not a database grant ` +
-                "(`database:<databaseType>/<modelName>:read|write`).",
-        };
-    }
-    // A `database:` capability that did not match. Say which part failed.
-    const rest = raw.slice("database:".length);
-    const lastColon = rest.lastIndexOf(":");
-    if (lastColon === -1) {
-        return {
-            error: `capability '${raw}' is missing its access verb: a database grant ends ` +
-                "in `:read` or `:write`.",
-        };
-    }
-    const pair = rest.slice(0, lastColon);
-    const access = rest.slice(lastColon + 1);
-    if (access !== "read" && access !== "write") {
-        return {
-            error: `capability '${raw}' names access '${access}': a database grant ends in ` +
-                "`:read` or `:write` (matched exactly — no other verb, no wildcard).",
-        };
-    }
-    const slash = pair.indexOf("/");
-    if (slash === -1) {
-        return {
-            error: `capability '${raw}' names no model: a database grant names a type and ` +
-                "a model as `<databaseType>/<modelName>`.",
-        };
-    }
-    return {
-        error: `capability '${raw}' does not name one type/model pair: ${CHARSET_GUIDANCE}.`,
+            `The capabilities a function may declare are: ${ACCEPTED_FAMILIES}.`,
     };
 }
 /**
@@ -1120,14 +1148,8 @@ export function parseDatabaseGrant(entry) {
  * field, so an over-long entry is a named push error instead of a late model
  * throw after the R2 object has already been written (principle 6).
  */
-export function parseCapabilities(value) {
-    const empty = {
-        capabilities: [],
-        grants: [],
-        allGrants: [],
-        platformGrants: [],
-        hasReadGrant: false,
-    };
+export function parseCapabilities(value, options = {}) {
+    const empty = { capabilities: [], allGrants: [], retired: [] };
     if (value === undefined || value === null) {
         return { ok: true, ...empty, errors: [] };
     }
@@ -1136,19 +1158,19 @@ export function parseCapabilities(value) {
             ok: false,
             ...empty,
             errors: [
-                "`capabilities` must be an array of grant strings, e.g. " +
-                    '["database:orders/order:read"]',
+                "`capabilities` must be an array of capability strings, e.g. " +
+                    '["integration:stripe"]',
             ],
         };
     }
     const errors = [];
     const capabilities = [];
-    const grants = [];
     const allGrants = [];
+    const retired = [];
     const seen = new Set();
     for (const entry of value) {
         if (typeof entry !== "string") {
-            errors.push(`\`capabilities\` carries a ${typeof entry} — every entry is a grant string.`);
+            errors.push(`\`capabilities\` carries a ${typeof entry} — every entry is a capability string.`);
             continue;
         }
         if (entry.length > MAX_CAPABILITY_ENTRY_LENGTH) {
@@ -1156,6 +1178,11 @@ export function parseCapabilities(value) {
                 `over the ${MAX_CAPABILITY_ENTRY_LENGTH}-character limit for one grant.`);
             continue;
         }
+        if (options.tolerateRetired && retiredGrantRefusal(entry)) {
+            if (!retired.includes(entry))
+                retired.push(entry);
+            continue;
+        }
         const parsed = parseFunctionGrant(entry);
         if (parsed.error || !parsed.grant) {
             errors.push(parsed.error ?? `capability '${entry}' is not a valid grant.`);
@@ -1167,14 +1194,6 @@ export function parseCapabilities(value) {
         seen.add(entry);
         capabilities.push(entry);
         allGrants.push(parsed.grant);
-        if (parsed.grant.family === "database") {
-            grants.push({
-                databaseType: String(parsed.grant.databaseType),
-                modelName: String(parsed.grant.modelName),
-                access: parsed.grant.access,
-                raw: parsed.grant.raw,
-            });
-        }
     }
     if (capabilities.length > MAX_CAPABILITY_ENTRIES) {
         errors.push(`\`capabilities\` declares ${capabilities.length} distinct grants, over ` +
@@ -1183,90 +1202,10 @@ export function parseCapabilities(value) {
     if (errors.length > 0) {
         return { ok: false, ...empty, errors };
     }
-    return {
-        ok: true,
-        capabilities,
-        grants,
-        allGrants,
-        platformGrants: allGrants
-            .filter((g) => PLATFORM_CAPABILITIES.includes(g.raw))
-            .map((g) => g.raw),
-        hasReadGrant: grants.some((g) => g.access === "read"),
-        errors: [],
-    };
-}
-/**
- * The unscoped-read rule, from the intent's database-authorization decision:
- * "a member-accessible function whose database read has no `$caller` binding
- * needs an explicit unscoped-read flag in its config, and that flag is the
- * human-reviewed artifact. From phase 2, any member-reachable function holding
- * a database read grant carries the flag."
- *
- * Every HTTP-invocable function is member-reachable behind its access gate, and
- * in this phase every function is HTTP-invocable, so the rule applies to every
- * config declaring a read grant — a fail-closed superset of the intent's rule,
- * which a later child may narrow for trigger-only functions.
- */
-export function unscopedReadsRefusal(grants, unscopedReads) {
-    if (unscopedReads)
-        return null;
-    const reads = grants.filter((g) => g.access === "read");
-    if (reads.length === 0)
-        return null;
-    return (`declares the database read grant${reads.length > 1 ? "s" : ""} ` +
-        `${reads.map((g) => `'${g.raw}'`).join(", ")} but not \`unscopedReads = true\`. ` +
-        "A function's reads are NOT scoped to its caller until `$caller` bindings " +
-        "arrive, so a read grant reads every row of that model for every caller. " +
-        "The flag is the human-reviewed artifact that says that was intended: add " +
-        "`unscopedReads = true` to the `[function]` table, or drop the read grant.");
-}
-/**
- * What a grant may name: a database type the app has, and — when that type
- * declares a schema — a model the schema declares.
- *
- * `models: null` is a type with NO schema. The DatabaseDO is schemaless, so a
- * grant on such a type is accepted by grammar and simply carries no typed
- * handle; refusing it would make an untyped database ungrantable.
- *
- * `schemaUnreadable` is the opposite case and fails CLOSED: the type declares a
- * schema, the platform could not evaluate the grant against it, and an
- * authorization question that could not be evaluated is answered no.
- *
- * The map is supplied by the caller because the two enforcement points read
- * different sources for the same facts — the CLI reads the config tree's
- * `database-type-configs/*.toml`, the server reads the app's rows — and the
- * RULE is what must not differ.
- */
-export function validateGrantsAgainstTypes(grants, types) {
-    const errors = [];
-    for (const grant of grants) {
-        const type = types.get(grant.databaseType);
-        if (type && type.schemaUnreadable) {
-            errors.push(`capability '${grant.raw}' names database type '${grant.databaseType}', ` +
-                "whose schema could not be parsed, so there is no way to check that " +
-                `it declares model '${grant.modelName}'. A grant is refused rather ` +
-                "than guessed: fix the type's schema (or clear it, which makes the " +
-                "type schemaless and grantable) and push again.");
-            continue;
-        }
-        if (!type) {
-            errors.push(`capability '${grant.raw}' names database type '${grant.databaseType}', ` +
-                "which this app does not have. A grant names a database TYPE key (it " +
-                "covers every database of that type); create the type, or fix the grant.");
-            continue;
-        }
-        if (type.models && !type.models.has(grant.modelName)) {
-            const known = [...type.models].sort().slice(0, 8).join(", ");
-            errors.push(`capability '${grant.raw}' names model '${grant.modelName}', which the ` +
-                `schema of database type '${grant.databaseType}' does not declare` +
-                (known ? ` (it declares: ${known})` : "") +
-                ".");
-        }
-    }
-    return errors;
+    return { ok: true, capabilities, allGrants, retired, errors: [] };
 }
 /**
- * Grants naming an integration or prompt the app does not have.
+ * Grants naming an integration the app does not have.
  *
  * One message per offending grant, quoting the whole authored string AND the
  * key on its own, so an operator reading the line knows both what to fix in
@@ -1280,20 +1219,17 @@ export function validateGrantsAgainstTypes(grants, types) {
 export function validateKeyedGrantsAgainstTargets(grants, known) {
     const errors = [];
     for (const grant of grants) {
-        const known_ = grant.family === "integration"
-            ? known.integrations
-            : grant.family === "prompt"
-                ? known.prompts
-                : undefined;
-        // `undefined` is a family with no target check; `null` is one this
-        // enforcement point could not answer for. Neither is a refusal.
-        if (known_ === undefined || known_ === null)
+        if (grant.family !== "integration")
+            continue;
+        // `null` is a family this enforcement point could not answer for, which
+        // is a deferral, not a refusal.
+        if (known.integrations === null)
             continue;
-        if (known_.has(grant.key))
+        if (known.integrations.has(grant.key))
             continue;
-        errors.push(`capability '${grant.raw}' names ${grant.family} '${grant.key}', which ` +
-            `this app does not have. A grant names an ACTIVE ${grant.family} by ` +
-            `its key; an archived one does not count. Create the ${grant.family}, ` +
+        errors.push(`capability '${grant.raw}' names integration '${grant.key}', which ` +
+            "this app does not have. A grant names an ACTIVE integration by " +
+            "its key; an archived one does not count. Create the integration, " +
             "or fix the grant.");
     }
     return errors;
@@ -1309,23 +1245,20 @@ export function validateKeyedGrantsAgainstTargets(grants, known) {
  *
  * ── What the manifest is for ─────────────────────────────────────────────
  *
- * Two things, and neither is authorization at runtime:
- *
- *   1. **The read rule.** The intent's database-authorization decision says
- *      "from phase 4 a recorded `$caller` binding on every read satisfies the
- *      [unscoped-read] rule instead". That decision is made ONCE, at push, by
- *      a human-reviewable statement — which is exactly what a manifest is.
- *   2. **Observability.** `primitive functions get` and the admin get list
- *      what a version registered, so an operator can see it without reading
- *      the bundle (principle 8).
+ * Observability, and nothing else. `primitive functions get` and the admin
+ * get list what a version registered, so an operator can see it without
+ * reading the bundle (principle 8). The read rule it used to be decided from
+ * (#3187's `$caller` relaxation of `unscopedReads`) is retired by #3279:
+ * function code acts as the system, so there is no per-model grant for a
+ * binding to waive. The intent says so in as many words — "the models a
+ * function touches are collected at push as a reviewable manifest, not an
+ * authorization".
  *
  * It is HONEST-CODE evidence and the design doc says so: a hostile bundle can
  * register whatever it likes, because the collector runs the tenant's own
- * code. Nothing security-relevant at runtime reads it — parameter injection,
- * the raw-read refusal and cache verification all happen in the platform-owned
- * SDK inside the isolate, and the grants remain the adversarial boundary. What
- * the manifest buys is protection against BUGS, which is the bound the design
- * doc states and this comment repeats so nobody has to rediscover it.
+ * code. Nothing security-relevant at runtime reads it — parameter injection
+ * and cache verification happen in the platform-owned SDK inside the isolate,
+ * and the invocation gate remains the adversarial boundary.
  *
  * ── Why the grammar is here ──────────────────────────────────────────────
  *
@@ -1334,11 +1267,23 @@ export function validateKeyedGrantsAgainstTargets(grants, known) {
  * authoritatively because the raw admin API exists. Two enforcement points,
  * one rule, in the dependency-free tree the CLI vendors.
  */
-/** The manifest encoding, versioned with the envelope that carries it. */
-export const FUNCTION_MANIFEST_SCHEMA_VERSION = 1;
+/**
+ * The manifest encoding, versioned with the envelope that carries it.
+ *
+ * Version 2 (#3279 behavior 10) adds what a function TOUCHES beside what it
+ * registers: the deduplicated `models` its code names and the `families` of
+ * `ctx.api` and the ctx helpers it reaches, collected by a static scan of the
+ * built bundle, plus a `dynamicModels` marker for a model name the scan
+ * could not resolve — distinct from an empty list, which means "names none".
+ * A version-1 manifest still parses: it records registrations only.
+ */
+export const FUNCTION_MANIFEST_SCHEMA_VERSION = 2;
+export const FUNCTION_MANIFEST_SCHEMA_VERSIONS = [1, 2];
 /** Bounds, so a manifest cannot be a way to store an unbounded blob. */
 export const MAX_MANIFEST_QUERIES = 200;
 export const MAX_MANIFEST_NAME_LENGTH = 120;
+export const MAX_MANIFEST_MODELS = 200;
+export const MAX_MANIFEST_FAMILIES = 40;
 /**
  * Validate a manifest's grammar and normalize it.
  *
@@ -1365,8 +1310,9 @@ export function parseFunctionManifest(value) {
     if (!document || typeof document !== "object" || Array.isArray(document)) {
         return fail("the manifest must be an object with a `queries` array.");
     }
-    if (Number(document.schemaVersion) !== FUNCTION_MANIFEST_SCHEMA_VERSION) {
-        return fail(`the manifest declares schemaVersion ${JSON.stringify(document.schemaVersion)}; this platform reads version ${FUNCTION_MANIFEST_SCHEMA_VERSION}.`);
+    const schemaVersion = Number(document.schemaVersion);
+    if (!FUNCTION_MANIFEST_SCHEMA_VERSIONS.includes(schemaVersion)) {
+        return fail(`the manifest declares schemaVersion ${JSON.stringify(document.schemaVersion)}; this platform reads versions ${FUNCTION_MANIFEST_SCHEMA_VERSIONS.join(" and ")}.`);
     }
     if (!Array.isArray(document.queries)) {
         return fail("the manifest's `queries` must be an array.");
@@ -1450,89 +1396,51 @@ export function parseFunctionManifest(value) {
             callerScoped: Object.values(params).some((p) => p.caller === true),
         });
     }
+    // Version 2's touched-surface lists. Bounded and normalized like the
+    // queries; a version-1 document has none and reads as "records
+    // registrations only".
+    const names = (field, max) => {
+        const raw = document[field];
+        if (raw === undefined || raw === null)
+            return [];
+        if (!Array.isArray(raw) || raw.some((m) => typeof m !== "string")) {
+            errors.push(`the manifest's \`${field}\` must be an array of strings.`);
+            return null;
+        }
+        const list = [...new Set(raw.map(String))].sort();
+        if (list.length > max) {
+            errors.push(`the manifest lists ${list.length} ${field}, over the ${max} limit for one function.`);
+            return null;
+        }
+        for (const name of list) {
+            if (name === "" || name.length > MAX_MANIFEST_NAME_LENGTH) {
+                errors.push(`the manifest's \`${field}\` carries '${name.slice(0, 40)}…', which is empty or over ` +
+                    `${MAX_MANIFEST_NAME_LENGTH} characters.`);
+                return null;
+            }
+        }
+        return list;
+    };
+    const models = schemaVersion >= 2 ? names("models", MAX_MANIFEST_MODELS) : [];
+    const families = schemaVersion >= 2 ? names("families", MAX_MANIFEST_FAMILIES) : [];
+    if (schemaVersion >= 2 && document.dynamicModels !== undefined && typeof document.dynamicModels !== "boolean") {
+        errors.push("the manifest's `dynamicModels` must be a boolean.");
+    }
     if (errors.length > 0)
         return { ok: false, manifest: null, errors };
     queries.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
     return {
         ok: true,
-        manifest: { schemaVersion: FUNCTION_MANIFEST_SCHEMA_VERSION, queries },
+        manifest: {
+            schemaVersion,
+            queries,
+            models: models ?? [],
+            families: families ?? [],
+            dynamicModels: schemaVersion >= 2 && document.dynamicModels === true,
+        },
         errors: [],
     };
 }
-/**
- * The phase-4 relaxation of the unscoped-read rule, from the intent: "from
- * phase 4 a recorded `$caller` binding on every read satisfies the rule
- * instead".
- *
- * Returns the refusal, or null when the config may be pushed without
- * `unscopedReads = true`.
- *
- * Fail-closed in three ways, each of which is a way an author could otherwise
- * get the flag waived without the property it stands for:
- *
- *   - no manifest at all is no evidence, so the flag is still required;
- *   - a manifest naming NO query that touches a read-granted model records
- *     nothing about how those models are read, so it satisfies nothing;
- *   - one non-caller-scoped registration over a read-granted model is enough
- *     to require the flag, because that query reads every row for every
- *     caller — which is exactly what the flag declares.
- */
-export function callerScopedReadsRefusal(grants, unscopedReads, manifest) {
-    if (unscopedReads)
-        return null;
-    const reads = grants.filter((g) => g.access === "read");
-    if (reads.length === 0)
-        return null;
-    const base = `declares the database read grant${reads.length > 1 ? "s" : ""} ` +
-        `${reads.map((g) => `'${g.raw}'`).join(", ")} but not \`unscopedReads = true\`. `;
-    if (!manifest) {
-        return (base +
-            "A function's reads are scoped to its caller only through a `$caller` " +
-            "binding on a registered query, and this push recorded no query " +
-            "manifest. Add `unscopedReads = true` to the `[function]` table, drop " +
-            "the read grant, or register the reads with `defineQuery` and a " +
-            "`$caller` parameter.");
-    }
-    const readModels = new Set(reads.map((g) => g.modelName));
-    const touching = manifest.queries.filter((q) => q.models.some((model) => readModels.has(model)));
-    if (touching.length === 0) {
-        return (base +
-            "Its manifest records no registered query over " +
-            `${[...readModels].map((m) => `'${m}'`).join(", ")}, so nothing says ` +
-            "those reads are scoped to a caller. Add `unscopedReads = true`, drop " +
-            "the read grant, or register the reads with a `$caller` parameter.");
-    }
-    const unscoped = touching.filter((q) => !q.callerScoped);
-    if (unscoped.length > 0) {
-        return (base +
-            `Its registered quer${unscoped.length > 1 ? "ies" : "y"} ` +
-            `${unscoped.map((q) => `'${q.name}'`).join(", ")} read ` +
-            "a granted model without a `$caller` binding, so that read returns " +
-            "every row for every caller. Bind the read to `$caller`, or add " +
-            "`unscopedReads = true` — the flag is the human-reviewed artifact that " +
-            "says an unscoped read was intended.");
-    }
-    return null;
-}
-/**
- * Whether a running version's raw (non-query) reads must be refused inside the
- * sandbox — #3187 behavior 23.
- *
- * True exactly when the version was accepted under the relaxation: it holds a
- * database READ grant and did not declare `unscopedReads`. Such a version was
- * pushed on the strength of its manifest saying every read is caller-scoped,
- * so the SDK admits the caller-scoped registered reads and refuses the rest.
- *
- * Honest-code protection at the design doc's stated adequacy: the SDK is
- * platform-owned, but a hostile bundle is not obliged to use it. The gateway
- * and DatabaseDO grant checks (#3182) are unchanged and remain the adversarial
- * boundary.
- */
-export function callerScopedReadsRequired(capabilities, unscopedReads) {
-    if (unscopedReads)
-        return false;
-    return capabilities.some((entry) => /^database:[^:]+:read$/.test(String(entry)));
-}
 // ── src/config-surface/workflow.ts ───────────────────────────────────────
 /**
  * The `workflow` configuration object's definition (issue #2644, phase 1).
@@ -3900,13 +3808,15 @@ export const TRANSFORM_SURFACE = {
  * the header model, and they travel inside the version envelope's TOML bytes
  * rather than as a payload field of their own.
  *
- * `capabilities` and `unscopedReads` joined the accepted set with #3182 (the
- * non-database grant families are still #3183/#3184). Both are version-carried,
- * and both are DERIVED by the server from the TOML inside the pushed envelope
- * rather than sent as payload fields of their own — the file a human reviews on
- * pull has to be the same statement the platform enforces (D3182-002). They are
- * listed in `tomlOnlyKeys` for that reason: they are authored, and they travel
- * as envelope bytes.
+ * `capabilities` joined the accepted set with #3182 (with `unscopedReads`,
+ * which #3279 retired together with `runAs` and the per-model grammar: the
+ * code acts as the system, and a capability is declared only where it
+ * configures something). It is version-carried and DERIVED by the server from
+ * the TOML inside the pushed envelope rather than sent as a payload field of
+ * its own — the file a human reviews on pull has to be the same statement the
+ * platform enforces (D3182-002). It is listed in `tomlOnlyKeys` for that
+ * reason: it is authored, and it travels as envelope bytes. The two retired
+ * keys carry their guidance in `retired-keys.ts` under this table's prefix.
  *
  * ── `status` ─────────────────────────────────────────────────────────────
  *
@@ -3933,16 +3843,6 @@ export const SERVER_FUNCTION_SURFACE = {
                     writableOn: BOTH,
                     validation: "passthrough",
                 },
-                {
-                    field: "runAs",
-                    tomlKey: "runAs",
-                    type: "string",
-                    emit: "always",
-                    writableOn: BOTH,
-                    // `caller | system` — the identity the function's own API calls run
-                    // as (the intent, "Who may invoke a function, and as whom?").
-                    validation: handledBy(FUNCTION_HANDLER, "ServerFunctionsController"),
-                },
                 {
                     field: "access",
                     tomlKey: "access",
@@ -4005,6 +3905,14 @@ export const SERVER_FUNCTION_SURFACE = {
                         "Repointed by a config-version push; versions are nameless, so " +
                         "there is no `activeConfigName` for an author to write.",
                 },
+                runAs: {
+                    kind: "server-owned",
+                    note: "RETIRED from the write surface by #3279: function code acts as " +
+                        "the system whoever invoked it, so the mode the column chose " +
+                        "between no longer exists. Declared-and-deprecated storage only " +
+                        "until phase 6 drops the column; a stored value decides nothing " +
+                        "and is never echoed.",
+                },
                 deleteLockedAt: {
                     kind: "server-owned",
                     note: "#3186 — the lease a hard delete takes before it scans for live " +
@@ -4063,20 +3971,14 @@ export const SERVER_FUNCTION_SURFACE = {
                 },
                 capabilities: {
                     kind: "structural",
-                    note: "The grants this version may use, as " +
-                        "`database:<databaseType>/<modelName>:read|write` strings (#3182; " +
-                        "other capability families are #3183/#3184). Stored on the config " +
+                    note: "What this version may CONFIGURE (#3279): `integration:<key>` " +
+                        "(the egress allowlist), `secret:<NAME>` (which secret values may " +
+                        "enter the sandbox) and the high-blast-radius opt-ins such as " +
+                        "`databases:delete` or `users:setRole`. Never a statement about " +
+                        "data — function code acts as the system. Stored on the config " +
                         "version and DERIVED by the server from these authored bytes, so " +
                         "the file a human reviews is the authority — a push cannot store a " +
-                        "grant the TOML does not declare.",
-                },
-                unscopedReads: {
-                    kind: "structural",
-                    note: "Required beside any `database:…:read` grant (#3182). A function's " +
-                        "reads are not scoped to its caller until `$caller` bindings " +
-                        "arrive, so the flag is the human-reviewed artifact that says " +
-                        "reading every row of the model for every caller was intended. " +
-                        "Version-carried and server-derived, like `capabilities`.",
+                        "capability the TOML does not declare.",
                 },
             },
             responseOnlyKeys: {},