takos-control 1.0.0

package/src/application/services/resources/index.ts

@@ -0,0 +1,32 @@
+// store
+export {
+  listResourcesForWorkspace,
+  listResourcesForUser,
+  listResourcesByType,
+  getResourceById,
+  getResourceByName,
+  updateResourceMetadata,
+  markResourceDeleting,
+  deleteResource,
+} from './store';
+
+// access
+export {
+  listResourceAccess,
+  upsertResourceAccess,
+  deleteResourceAccess,
+  checkResourceAccess,
+  canAccessResource,
+} from './access';
+
+// bindings
+export {
+  listResourceBindings,
+  countResourceBindings,
+  createServiceBinding,
+  deleteServiceBinding,
+  buildBindingFromResource,
+} from './bindings';
+
+// lifecycle
+export { provisionCloudflareResource } from './lifecycle';

package/src/application/services/resources/lifecycle.ts

@@ -0,0 +1,92 @@
+import type { Env } from '../../../shared/types';
+import { generateId, now } from '../../../shared/utils';
+import { insertFailedResource, insertResource } from './store';
+import { CloudflareResourceService, type CloudflareManagedResourceType } from '../../../platform/providers/cloudflare/resources.ts';
+
+type ProvisionCloudflareResourceInput = {
+  id?: string;
+  timestamp?: string;
+  ownerId: string;
+  spaceId?: string | null;
+  name: string;
+  type: CloudflareManagedResourceType;
+  cfName: string;
+  config?: Record<string, unknown>;
+  recordFailure?: boolean;
+  vectorize?: {
+    dimensions: number;
+    metric: 'cosine' | 'euclidean' | 'dot-product';
+  };
+  queue?: {
+    deliveryDelaySeconds?: number;
+  };
+  analyticsEngine?: {
+    dataset?: string;
+  };
+  workflow?: {
+    service: string;
+    export: string;
+    timeoutMs?: number;
+    maxRetries?: number;
+  };
+};
+
+export async function provisionCloudflareResource(
+  env: Env,
+  input: ProvisionCloudflareResourceInput
+): Promise<{
+  id: string;
+  cfId: string | null;
+  cfName: string;
+}> {
+  const id = input.id || generateId();
+  const timestamp = input.timestamp || now();
+  const provider = new CloudflareResourceService(env);
+
+  try {
+    const created = await provider.createResource(input.type, input.cfName, {
+      ...(input.vectorize ? { vectorize: input.vectorize } : {}),
+      ...(input.queue ? { queue: input.queue } : {}),
+      ...(input.analyticsEngine ? { analyticsEngine: input.analyticsEngine } : {}),
+      ...(input.workflow ? { workflow: input.workflow } : {}),
+    });
+
+    await insertResource(env.DB, {
+      id,
+      owner_id: input.ownerId,
+      name: input.name,
+      type: input.type,
+      status: 'active',
+      cf_id: created.cfId,
+      cf_name: created.cfName,
+      config: input.config || {},
+      space_id: input.spaceId || null,
+      created_at: timestamp,
+      updated_at: timestamp,
+    });
+
+    return {
+      id,
+      cfId: created.cfId,
+      cfName: created.cfName,
+    };
+  } catch (error) {
+    if (input.recordFailure) {
+      await insertFailedResource(env.DB, {
+        id,
+        owner_id: input.ownerId,
+        name: input.name,
+        type: input.type,
+        cf_name: input.cfName,
+        config: {
+          ...(input.config || {}),
+          error: error instanceof Error ? error.message : String(error),
+        },
+        space_id: input.spaceId || null,
+        created_at: timestamp,
+        updated_at: timestamp,
+      });
+    }
+    throw error;
+  }
+}

package/src/application/services/resources/store.ts

@@ -0,0 +1,387 @@
+import type { D1Database } from '../../../shared/types/bindings.ts';
+import type { Resource, ResourcePermission, ResourceType, ResourceStatus } from '../../../shared/types';
+import type { SelectOf } from '../../../shared/types/drizzle-helpers';
+import { getDb, resources, resourceAccess } from '../../../infra/db';
+import { eq, and, ne, inArray, desc, asc, count } from 'drizzle-orm';
+import { now, toIsoString } from '../../../shared/utils';
+import { toApiResource } from './format';
+import { resolveAccessibleAccountIds } from '../identity/membership-resolver';
+
+function buildAccessMap(grants: { resourceId: string; permission: string }[]): Map<string, string> {
+  const map = new Map<string, string>();
+  for (const grant of grants) map.set(grant.resourceId, grant.permission);
+  return map;
+}
+
+function toApiResourceRow(r: {
+  id: string;
+  ownerAccountId: string;
+  accountId: string | null;
+  name: string;
+  type: string;
+  status: string;
+  cfId: string | null;
+  cfName: string | null;
+  config: string;
+  metadata: string;
+  sizeBytes: number | null;
+  itemCount: number | null;
+  lastUsedAt: string | Date | null;
+  createdAt: string | Date;
+  updatedAt: string | Date;
+}): Resource {
+  return toApiResource({
+    ...r,
+    ownerId: r.ownerAccountId,
+    spaceId: r.accountId,
+    lastUsedAt: toIsoString(r.lastUsedAt),
+    createdAt: toIsoString(r.createdAt) ?? new Date(0).toISOString(),
+    updatedAt: toIsoString(r.updatedAt) ?? new Date(0).toISOString(),
+  });
+}
+
+export async function listResourcesForWorkspace(
+  db: D1Database,
+  userId: string,
+  spaceId: string
+) {
+  const drizzle = getDb(db);
+
+  const ownedResources = await drizzle.select().from(resources)
+    .where(and(
+      eq(resources.accountId, spaceId),
+      ne(resources.status, 'deleted'),
+    ))
+    .orderBy(desc(resources.updatedAt))
+    .all();
+
+  // For shared resources, use a subquery approach since Drizzle doesn't support relation filters in where
+  const sharedAccessGrants = await drizzle.select({ resourceId: resourceAccess.resourceId })
+    .from(resourceAccess)
+    .where(eq(resourceAccess.accountId, spaceId))
+    .all();
+  const sharedResourceIds = sharedAccessGrants.map(a => a.resourceId);
+
+  let sharedResources: Array<SelectOf<typeof resources> & { accessPermission?: string }> = [];
+  if (sharedResourceIds.length > 0) {
+    const rawShared = await drizzle.select().from(resources)
+      .where(and(
+        ne(resources.status, 'deleted'),
+        inArray(resources.id, sharedResourceIds),
+      ))
+      .orderBy(desc(resources.updatedAt))
+      .all();
+
+    sharedResources = rawShared.filter(r => r.accountId !== spaceId);
+  }
+
+  // Get access permissions for shared resources
+  let sharedResourceAccessMap = new Map<string, string>();
+  if (sharedResources.length > 0) {
+    const accessRecords = await drizzle.select({
+      resourceId: resourceAccess.resourceId,
+      permission: resourceAccess.permission,
+    }).from(resourceAccess)
+      .where(and(
+        eq(resourceAccess.accountId, spaceId),
+        inArray(resourceAccess.resourceId, sharedResources.map(r => r.id)),
+      ))
+      .all();
+    sharedResourceAccessMap = buildAccessMap(accessRecords);
+  }
+
+  const ownedWithLevel = ownedResources.map((r) => ({
+    ...toApiResourceRow(r),
+    access_level: 'owner',
+  }));
+
+  const sharedWithLevel = sharedResources.map((r) => ({
+    ...toApiResourceRow(r),
+    access_level: sharedResourceAccessMap.get(r.id) || 'read',
+  }));
+
+  const combined = [...ownedWithLevel, ...sharedWithLevel];
+  combined.sort((a, b) => b.updated_at.localeCompare(a.updated_at));
+
+  return combined;
+}
+
+export async function listResourcesForUser(db: D1Database, userId: string) {
+  const drizzle = getDb(db);
+  const accessibleAccountIds = await resolveAccessibleAccountIds(db, userId);
+
+  const ownedResources = await drizzle.select().from(resources)
+    .where(eq(resources.ownerAccountId, userId))
+    .orderBy(desc(resources.updatedAt))
+    .all();
+
+  // Get shared resources via access grants
+  const accessGrants = await drizzle.select({ resourceId: resourceAccess.resourceId, permission: resourceAccess.permission })
+    .from(resourceAccess)
+    .where(inArray(resourceAccess.accountId, accessibleAccountIds))
+    .all();
+  const sharedResourceIds = [...new Set(accessGrants.map(a => a.resourceId))];
+  const accessMap = buildAccessMap(accessGrants);
+
+  let sharedResources: Array<SelectOf<typeof resources>> = [];
+  if (sharedResourceIds.length > 0) {
+    sharedResources = await drizzle.select().from(resources)
+      .where(and(
+        ne(resources.ownerAccountId, userId),
+        inArray(resources.id, sharedResourceIds),
+      ))
+      .orderBy(desc(resources.updatedAt))
+      .all();
+  }
+
+  return {
+    owned: ownedResources.map((r) => ({
+      ...toApiResourceRow(r),
+      access_level: 'owner',
+    })),
+    shared: sharedResources.map((r) => ({
+      ...toApiResourceRow(r),
+      access_level: accessMap.get(r.id) || 'read',
+    })),
+  };
+}
+
+export async function listResourcesByType(
+  db: D1Database,
+  userId: string,
+  resourceType: ResourceType
+) {
+  const drizzle = getDb(db);
+  const accessibleAccountIds = await resolveAccessibleAccountIds(db, userId);
+
+  const ownedResources = await drizzle.select().from(resources)
+    .where(and(
+      eq(resources.type, resourceType),
+      eq(resources.ownerAccountId, userId),
+    ))
+    .orderBy(desc(resources.updatedAt))
+    .all();
+
+  // Get shared resources via access grants
+  const accessGrants = await drizzle.select({ resourceId: resourceAccess.resourceId, permission: resourceAccess.permission })
+    .from(resourceAccess)
+    .where(inArray(resourceAccess.accountId, accessibleAccountIds))
+    .all();
+  const sharedResourceIds = [...new Set(accessGrants.map(a => a.resourceId))];
+  const accessPermMap = buildAccessMap(accessGrants);
+
+  let sharedResources: Array<SelectOf<typeof resources>> = [];
+  if (sharedResourceIds.length > 0) {
+    sharedResources = await drizzle.select().from(resources)
+      .where(and(
+        eq(resources.type, resourceType),
+        ne(resources.ownerAccountId, userId),
+        inArray(resources.id, sharedResourceIds),
+      ))
+      .orderBy(desc(resources.updatedAt))
+      .all();
+  }
+
+  const ownedWithLevel = ownedResources.map((r) => ({
+    ...toApiResourceRow(r),
+    access_level: 'owner',
+  }));
+
+  const sharedWithLevel = sharedResources.map((r) => ({
+    ...toApiResourceRow(r),
+    access_level: accessPermMap.get(r.id) || 'read',
+  }));
+
+  const combined = [...ownedWithLevel, ...sharedWithLevel];
+  combined.sort((a, b) => b.updated_at.localeCompare(a.updated_at));
+
+  return combined;
+}
+
+export async function getResourceById(db: D1Database, resourceId: string) {
+  const drizzle = getDb(db);
+  const resource = await drizzle.select().from(resources)
+    .where(eq(resources.id, resourceId))
+    .get();
+
+  if (!resource) return null;
+  return toApiResourceRow(resource);
+}
+
+export async function getResourceByName(db: D1Database, userId: string, resourceName: string) {
+  const drizzle = getDb(db);
+  const resource = await drizzle.select().from(resources)
+    .where(and(
+      eq(resources.name, resourceName),
+      eq(resources.ownerAccountId, userId),
+    ))
+    .get();
+
+  if (!resource) return null;
+  return {
+    ...toApiResourceRow(resource),
+    _internal_id: resource.id,
+  };
+}
+
+export async function insertResource(
+  db: D1Database,
+  input: {
+    id: string;
+    owner_id: string;
+    name: string;
+    type: ResourceType;
+    status: ResourceStatus;
+    cf_id: string | null;
+    cf_name: string;
+    config: Record<string, unknown>;
+    space_id?: string | null;
+    created_at: string;
+    updated_at: string;
+  }
+) {
+  const drizzle = getDb(db);
+  await drizzle.insert(resources).values({
+    id: input.id,
+    ownerAccountId: input.owner_id,
+    name: input.name,
+    type: input.type,
+    status: input.status,
+    cfId: input.cf_id,
+    cfName: input.cf_name,
+    config: JSON.stringify(input.config || {}),
+    metadata: '{}',
+    accountId: input.space_id || null,
+    createdAt: input.created_at,
+    updatedAt: input.updated_at,
+  });
+
+  return getResourceById(db, input.id);
+}
+
+export async function insertFailedResource(
+  db: D1Database,
+  input: {
+    id: string;
+    owner_id: string;
+    name: string;
+    type: ResourceType;
+    cf_name: string;
+    config: Record<string, unknown>;
+    space_id?: string | null;
+    created_at: string;
+    updated_at: string;
+  }
+) {
+  const drizzle = getDb(db);
+  await drizzle.insert(resources).values({
+    id: input.id,
+    ownerAccountId: input.owner_id,
+    name: input.name,
+    type: input.type,
+    status: 'failed',
+    cfName: input.cf_name,
+    config: JSON.stringify(input.config || {}),
+    metadata: '{}',
+    accountId: input.space_id || null,
+    createdAt: input.created_at,
+    updatedAt: input.updated_at,
+  });
+}
+
+export async function updateResourceMetadata(
+  db: D1Database,
+  resourceId: string,
+  updates: { name?: string; config?: Record<string, unknown>; metadata?: Record<string, unknown> }
+) {
+  const drizzle = getDb(db);
+
+  const data: Record<string, unknown> = {
+    updatedAt: now(),
+  };
+
+  if (updates.name !== undefined) {
+    data.name = updates.name;
+  }
+  if (updates.config !== undefined) {
+    data.config = JSON.stringify(updates.config);
+  }
+  if (updates.metadata !== undefined) {
+    data.metadata = JSON.stringify(updates.metadata);
+  }
+
+  if (Object.keys(data).length === 1) {
+    return null;
+  }
+
+  await drizzle.update(resources)
+    .set(data)
+    .where(eq(resources.id, resourceId));
+
+  return getResourceById(db, resourceId);
+}
+
+export async function markResourceDeleting(db: D1Database, resourceId: string) {
+  const drizzle = getDb(db);
+  await drizzle.update(resources)
+    .set({
+      status: 'deleting',
+      updatedAt: now(),
+    })
+    .where(eq(resources.id, resourceId));
+}
+
+export async function deleteResource(db: D1Database, resourceId: string) {
+  const drizzle = getDb(db);
+  await drizzle.delete(resources).where(eq(resources.id, resourceId));
+}
+
+export async function getAvailableResourcesForWorkspace(
+  db: D1Database,
+  spaceId: string,
+  resourceType: ResourceType
+): Promise<Array<Resource & { access_level: 'owner' | ResourcePermission }>> {
+  const drizzle = getDb(db);
+
+  const ownedResources = await drizzle.select().from(resources)
+    .where(and(
+      eq(resources.type, resourceType),
+      eq(resources.status, 'active'),
+      eq(resources.accountId, spaceId),
+    ))
+    .orderBy(asc(resources.name))
+    .all();
+
+  // Get shared resources via access grants
+  const accessGrants = await drizzle.select({ resourceId: resourceAccess.resourceId, permission: resourceAccess.permission })
+    .from(resourceAccess)
+    .where(eq(resourceAccess.accountId, spaceId))
+    .all();
+  const sharedResourceIds = [...new Set(accessGrants.map(a => a.resourceId))];
+  const accessPermMap = buildAccessMap(accessGrants);
+
+  let sharedResources: Array<SelectOf<typeof resources>> = [];
+  if (sharedResourceIds.length > 0) {
+    sharedResources = await drizzle.select().from(resources)
+      .where(and(
+        eq(resources.type, resourceType),
+        eq(resources.status, 'active'),
+        ne(resources.accountId, spaceId),
+        inArray(resources.id, sharedResourceIds),
+      ))
+      .orderBy(asc(resources.name))
+      .all();
+  }
+
+  const ownedWithLevel = ownedResources.map((r) => ({
+    ...toApiResourceRow(r),
+    access_level: 'owner' as const,
+  }));
+
+  const sharedWithLevel = sharedResources.map((r) => ({
+    ...toApiResourceRow(r),
+    access_level: (accessPermMap.get(r.id) || 'read') as ResourcePermission,
+  }));
+
+  return [...ownedWithLevel, ...sharedWithLevel];
+}

package/src/application/services/routing/cache.ts

@@ -0,0 +1,176 @@
+/**
+ * Routing Cache
+ *
+ * L1 (isolate-local Map) and L2 (KV) cache management,
+ * KV payload building, and Durable Object interaction helpers.
+ */
+
+import { getRoutingDOStub } from './sharding';
+import type {
+  ParsedRoutingValue,
+  ResolvedRouting,
+  RoutingBindings,
+  RoutingRecord,
+  RoutingTarget,
+} from './routing-models';
+import type { PlatformExecutionContext } from '../../../shared/types/bindings.ts';
+import { logWarn } from '../../../shared/utils/logger';
+
+export const ROUTING_LOG_PREFIX = '[Routing]';
+
+const L1_TTL_MS = 10_000; // isolate local cache
+const L1_MAX_ENTRIES = 2048;
+
+// KV "freshness" is enforced in application logic (not relying on KV propagation).
+const L2_MAX_AGE_MS = 90_000;
+
+// Phase 4: KV is pure cache (short TTL)
+export const L2_KV_TTL_SECONDS = 120;
+
+export const DEFAULT_DO_TIMEOUT_MS = 1_000;
+
+export const DEFAULT_TOMBSTONE_TTL_MS = 2 * 60_000; // 2 minutes
+
+type L1Entry = { expiresAt: number; value: ResolvedRouting };
+const l1Cache = new Map<string, L1Entry>();
+
+type RoutingNamespace = NonNullable<RoutingBindings['ROUTING_DO']>;
+export type RoutingEnvWithDo = RoutingBindings & { ROUTING_DO: RoutingNamespace };
+type RoutingFetcherLike = {
+  fetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
+};
+
+export function hasRoutingDO(env: RoutingBindings): env is RoutingEnvWithDo {
+  return Boolean(env.ROUTING_DO);
+}
+
+export function hasRoutingStore(env: RoutingBindings): env is RoutingBindings & { ROUTING_STORE: NonNullable<RoutingBindings['ROUTING_STORE']> } {
+  return Boolean(env.ROUTING_STORE);
+}
+
+export function putL1(hostname: string, value: ResolvedRouting, nowMs: number): void {
+  if (l1Cache.size >= L1_MAX_ENTRIES) {
+    l1Cache.clear();
+  }
+  l1Cache.set(hostname, { expiresAt: nowMs + L1_TTL_MS, value });
+}
+
+export function getL1(hostname: string, nowMs: number): ResolvedRouting | null {
+  const cached = l1Cache.get(hostname);
+  if (!cached) return null;
+  if (cached.expiresAt <= nowMs) {
+    l1Cache.delete(hostname);
+    return null;
+  }
+  return cached.value;
+}
+
+export function buildKVPayload(options: {
+  target: RoutingTarget | null;
+  updatedAt: number;
+  version?: number;
+  tombstoneUntil?: number;
+}): string {
+  if (!options.target) {
+    return JSON.stringify({
+      tombstone: true,
+      tombstoneUntil: options.tombstoneUntil,
+      updatedAt: options.updatedAt,
+      version: options.version,
+    });
+  }
+  return JSON.stringify({
+    ...options.target,
+    updatedAt: options.updatedAt,
+    version: options.version,
+  });
+}
+
+export function shouldUseKvValue(parsed: ParsedRoutingValue, nowMs: number): boolean {
+  if (!parsed.target) return false;
+  if (!parsed.updatedAt) return false;
+  return nowMs - parsed.updatedAt <= L2_MAX_AGE_MS;
+}
+
+function asRoutingFetcher(stub: unknown): RoutingFetcherLike {
+  return stub as unknown as RoutingFetcherLike;
+}
+
+async function fetchJsonWithTimeout<T>(
+  stub: RoutingFetcherLike,
+  url: string,
+  init: RequestInit,
+  timeoutMs: number
+): Promise<T> {
+  const controller = new AbortController();
+  const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const requestInit: RequestInit = {
+      ...init,
+      signal: controller.signal,
+    };
+    const request = new Request(url, requestInit);
+    const res = await stub.fetch(request as unknown as Parameters<RoutingFetcherLike['fetch']>[0]);
+    if (!res.ok) {
+      throw new Error(`DO returned ${res.status}`);
+    }
+    return (await res.json()) as T;
+  } finally {
+    clearTimeout(timeoutId);
+  }
+}
+
+export async function doGetRecord(env: RoutingEnvWithDo, hostname: string, timeoutMs: number): Promise<RoutingRecord | null> {
+  const stub = asRoutingFetcher(getRoutingDOStub(env, hostname));
+  const data = await fetchJsonWithTimeout<{ record: RoutingRecord | null }>(
+    stub,
+    'http://internal/routing/get',
+    {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ hostname }),
+    },
+    timeoutMs
+  );
+  return data.record;
+}
+
+export async function doPutRecord(env: RoutingEnvWithDo, hostname: string, target: RoutingTarget, updatedAt: number, timeoutMs: number): Promise<void> {
+  const stub = asRoutingFetcher(getRoutingDOStub(env, hostname));
+  await fetchJsonWithTimeout<{ record: RoutingRecord }>(
+    stub,
+    'http://internal/routing/put',
+    {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ hostname, target, updatedAt }),
+    },
+    timeoutMs
+  );
+}
+
+export async function doDeleteRecord(env: RoutingEnvWithDo, hostname: string, tombstoneTtlMs: number, updatedAt: number, timeoutMs: number): Promise<void> {
+  const stub = asRoutingFetcher(getRoutingDOStub(env, hostname));
+  await fetchJsonWithTimeout<{ record: RoutingRecord }>(
+    stub,
+    'http://internal/routing/delete',
+    {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ hostname, tombstoneTtlMs, updatedAt }),
+    },
+    timeoutMs
+  );
+}
+
+/**
+ * Run a task in the background via waitUntil if available, otherwise await it.
+ */
+export async function runBackground(ctx: PlatformExecutionContext | undefined, task: Promise<unknown>): Promise<void> {
+  const waitUntil = ctx?.waitUntil;
+  if (typeof waitUntil === 'function') {
+    waitUntil.call(ctx, task);
+  } else {
+    await task;
+  }
+}

package/src/application/services/routing/phase.ts

@@ -0,0 +1,20 @@
+/**
+ * Routing Phase Configuration
+ *
+ * Determines the routing phase from environment bindings.
+ * Phase controls which data sources (KV, DO, L1 cache) are primary.
+ */
+
+import type { RoutingBindings } from './routing-models';
+
+const DEFAULT_PHASE = 1;
+const MIN_PHASE = 1;
+const MAX_PHASE = 4;
+
+export function getRoutingPhase(env: RoutingBindings): number {
+  const raw = env.ROUTING_DO_PHASE;
+  if (!raw) return DEFAULT_PHASE;
+  const parsed = Number.parseInt(String(raw), 10);
+  if (!Number.isFinite(parsed)) return DEFAULT_PHASE;
+  return Math.min(MAX_PHASE, Math.max(MIN_PHASE, parsed));
+}