@forge-cms/runtime 0.5.0 → 0.6.0

package/dist/runtime.js

@@ -1,5 +1,7 @@
-import { defineField } from '@forge-cms/core';
+import { isReferenced, noReferenceAssertions, validateRelationSchema } from './relation-lifecycle.js';
 import * as operations from './operations.js';
+import { validateLocalizationSchema } from './localization.js';
+import { hasUploadCollections, reconcileStorage, storageIntentsDefinition } from './storage-intents.js';
 import * as globalOps from './globals.js';
 import * as versionOps from './versions.js';
 /**
@@ -19,8 +21,59 @@ export class ForgeCmsRuntime {
     config;
     adapters;
     constructor(config) {
+        // Reference shapes relation integrity cannot enforce are refused here, at startup, instead of being
+        // accepted and silently ignored on every delete (spec 064 §2).
+        const relationErrors = validateRelationSchema(config.collections, config.globals ?? [], (slug) => config.adapters.auth.managesCollection?.(slug) === true);
+        if (relationErrors.length > 0) {
+            throw new Error(`Unsupported relation configuration:\n${relationErrors.join('\n')}`);
+        }
+        // Global options that could never apply are refused too, instead of silently ignored (spec 066).
+        const globalErrors = [
+            ...globalOps.validateGlobalSchema(config.globals ?? []),
+            ...validateLocalizationSchema([
+                ...config.collections.map((c) => ({
+                    label: `Collection '${c.slug}'`,
+                    fields: c.fields,
+                    ...(c.locales !== undefined && { locales: c.locales })
+                })),
+                ...(config.globals ?? []).map((g) => ({
+                    label: `Global '${g.slug}'`,
+                    fields: g.fields,
+                    ...(g.locales !== undefined && { locales: g.locales })
+                }))
+            ])
+        ];
+        if (globalErrors.length > 0) {
+            throw new Error(`Unsupported global/localization configuration:\n${globalErrors.join('\n')}`);
+        }
         this.config = config;
         this.adapters = config.adapters;
+        this.wireManagedDeleteGuards();
+    }
+    /**
+     * Hands every auth-managed collection's relation guard to the auth adapter (spec 065), so its own
+     * user delete commits "nothing references this document" in the same batch — no setup code needed.
+     * An adapter that manages a referenced collection but cannot enforce the guard is refused here: it
+     * would otherwise delete documents that content still references.
+     */
+    wireManagedDeleteGuards() {
+        const auth = this.adapters.auth;
+        for (const { slug } of this.config.collections) {
+            if (auth.managesCollection?.(slug) !== true)
+                continue;
+            const referenced = isReferenced(this, slug);
+            const enforced = auth.setManagedDeleteGuard?.(slug, {
+                database: this.adapters.database,
+                assertions: (id) => noReferenceAssertions(this, slug, [id])
+            }) === true;
+            if (referenced && !enforced) {
+                throw new Error(`Unsupported relation configuration: collection '${slug}' is managed by the auth adapter ` +
+                    `'${auth.name}' and referenced by relation/upload fields, but that adapter cannot enforce ` +
+                    `those references when it deletes a document (it does not implement setManagedDeleteGuard, ` +
+                    `spec 065), so a deletion could leave them dangling. Use an adapter that supports it (e.g. ` +
+                    `UsersCollectionAuthAdapter), or store the id in a text field as an explicit unchecked reference.`);
+            }
+        }
     }
     /** Initialise all adapters with the runtime environment */
     init() {
@@ -34,6 +87,10 @@ export class ForgeCmsRuntime {
     async syncSchema() {
         await this.adapters.database.syncSchema(this.config.collections);
         await this.adapters.auth.syncSchema?.();
+        // Durable storage-cleanup intents (spec 067), only where uploads exist.
+        if (hasUploadCollections(this.config.collections)) {
+            await this.adapters.database.syncSchema([storageIntentsDefinition()]);
+        }
         for (const global of this.config.globals ?? []) {
             await this.adapters.database.syncSchema([
                 {
@@ -43,27 +100,53 @@ export class ForgeCmsRuntime {
                 }
             ]);
         }
-        // Create version tables for collections with versions enabled
-        for (const collection of this.config.collections) {
-            if (collection.versions === true ||
-                (typeof collection.versions === 'object' && collection.versions !== null)) {
-                const versionFields = {
-                    documentId: defineField.text({ required: true }),
-                    versionNumber: defineField.number({ required: true }),
-                    data: defineField.json({ required: true }),
-                    createdAt: defineField.date({ required: true }),
-                    createdBy: defineField.text(),
-                    autosave: defineField.boolean(),
-                    label: defineField.text()
-                };
-                await this.adapters.database.syncSchema([
-                    {
-                        slug: `_versions_${collection.slug}`,
-                        fields: versionFields
-                    }
-                ]);
+        // Version tables for collections with versions enabled (spec 062 §1/§8).
+        const versioned = this.config.collections.filter((c) => versionOps.versionsEnabled(c));
+        if (versioned.length > 0) {
+            const database = this.adapters.database;
+            if (typeof database.atomicWrite !== 'function') {
+                throw new Error(`Collections with versions enabled (${versioned.map((c) => `'${c.slug}'`).join(', ')}) ` +
+                    `require a DatabaseAdapter implementing atomicWrite() — a document and its version ` +
+                    `snapshot must commit together (specs 060/062); '${String(database.name)}' does not.`);
             }
         }
+        for (const collection of versioned) {
+            await this.syncVersionTable(collection);
+        }
+    }
+    /**
+     * Creates/extends one `_versions_<slug>` table additively. Adding its unique
+     * `(documentId, versionNumber)` index fails on a database that already holds duplicate version
+     * identities (only the pre-062 read-then-insert race produced them): history is then reported, never
+     * deleted, renumbered or merged — the operator decides (spec 062 §8, roadmap 0.7 / M03).
+     */
+    async syncVersionTable(collection) {
+        const definition = versionOps.versionCollectionDefinition(collection.slug);
+        try {
+            await this.adapters.database.syncSchema([definition]);
+        }
+        catch (err) {
+            let duplicates;
+            try {
+                duplicates = await versionOps.findDuplicateVersionIdentities(this.adapters.database, definition.slug);
+            }
+            catch {
+                throw err;
+            }
+            if (duplicates.length === 0)
+                throw err;
+            const examples = duplicates
+                .slice(0, 5)
+                .map((d) => `document "${d.documentId}" version ${d.versionNumber} (${d.rows} rows)`)
+                .join('; ');
+            throw new Error(`Cannot add the unique (documentId, versionNumber) index to "${definition.slug}": it already ` +
+                `contains ${duplicates.length} duplicate version ${duplicates.length === 1 ? 'identity' : 'identities'} ` +
+                `— e.g. ${examples}. They were produced by concurrent updates before ForgeCMS enforced ` +
+                `version identity. ForgeCMS will not delete, renumber or merge version history automatically. ` +
+                `Inspect them with: SELECT "documentId", "versionNumber", COUNT(*) FROM "${definition.slug}" ` +
+                `GROUP BY "documentId", "versionNumber" HAVING COUNT(*) > 1; decide which rows to keep ` +
+                `(renumber or delete the extras after taking a backup), then restart.`, { cause: err });
+        }
     }
     /** Find a collection definition by slug */
     getCollection(slug) {
@@ -133,6 +216,15 @@ export class ForgeCmsRuntime {
     createVersion(args) {
         return versionOps.createVersion(this, args);
     }
+    // --- Storage ----------------------------------------------------------------------------
+    /**
+     * Deletes the stored objects that crashed or failed uploads and deletes left owned by no document, as
+     * recorded by their durable storage intents (spec 067). Safe to run repeatedly and concurrently; run it
+     * from a scheduled job or an operator script. See `reconcileStorage` for the exact guarantees.
+     */
+    reconcileStorage(options) {
+        return reconcileStorage(this, options);
+    }
     // --- Preview ----------------------------------------------------------------------------
     /**
      * A non-persistent simulation of a permitted create/update (spec 058 §3) — merges stored data with

package/dist/runtime.js.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAG9C,OAAO,KAAK,UAAU,MAAM,iBAAiB,CAAC;AAqB9C,OAAO,KAAK,SAAS,MAAM,cAAc,CAAC;AAE1C,OAAO,KAAK,UAAU,MAAM,eAAe,CAAC;AAS5C;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,eAAe;IAIjB,MAAM,CAAqC;IAC3C,QAAQ,CAAa;IAE9B,YAAY,MAA0C;QACpD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IAClC,CAAC;IAED,2DAA2D;IAC3D,IAAI;QACF,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;QAC5B,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,sEAAsE;IACtE,KAAK,CAAC,UAAU;QACd,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACjE,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;QAExC,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;YAC/C,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;gBACtC;oBACE,IAAI,EAAE,WAAW,MAAM,CAAC,IAAI,EAAE;oBAC9B,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;iBAChD;aACF,CAAC,CAAC;QACL,CAAC;QAED,8DAA8D;QAC9D,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YACjD,IACE,UAAU,CAAC,QAAQ,KAAK,IAAI;gBAC5B,CAAC,OAAO,UAAU,CAAC,QAAQ,KAAK,QAAQ,IAAI,UAAU,CAAC,QAAQ,KAAK,IAAI,CAAC,EACzE,CAAC;gBACD,MAAM,aAAa,GAA6B;oBAC9C,UAAU,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;oBAChD,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;oBACrD,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;oBAC1C,SAAS,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;oBAC/C,SAAS,EAAE,WAAW,CAAC,IAAI,EAAE;oBAC7B,QAAQ,EAAE,WAAW,CAAC,OAAO,EAAE;oBAC/B,KAAK,EAAE,WAAW,CAAC,IAAI,EAAE;iBAC1B,CAAC;gBAEF,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;oBACtC;wBACE,IAAI,EAAE,aAAa,UAAU,CAAC,IAAI,EAAE;wBACpC,MAAM,EAAE,aAAa;qBACtB;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,2CAA2C;IAC3C,aAAa,CAAC,IAAY;QACxB,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAC9D,CAAC;IAED,gDAAgD;IAChD,cAAc;QACZ,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;IACjC,CAAC;IAED,uCAAuC;IACvC,SAAS,CAAC,IAAY;QACpB,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAC3D,CAAC;IAED,4CAA4C;IAC5C,UAAU;QACR,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;IACnC,CAAC;IAED,4FAA4F;IAC5F,EAAE;IACF,+FAA+F;IAC/F,mGAAmG;IACnG,kGAAkG;IAClG,mGAAmG;IACnG,qFAAqF;IAErF,IAAI,CACF,IAAwC;QAExC,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,IAAgB,CAE5C,CAAC;IACJ,CAAC;IAED,QAAQ,CACN,IAA4C;QAE5C,OAAO,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAoB,CAEpD,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,OAAO,CACL,IAA2C;QAE3C,OAAO,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,IAAmB,CAE1C,CAAC;IACZ,CAAC;IAED,KAAK,CACH,IAAyC;QAEzC,OAAO,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,IAAiB,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,CACJ,IAA0C;QAE1C,OAAO,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,IAAkB,CAEhD,CAAC;IACJ,CAAC;IAED,MAAM,CACJ,IAA0C;QAE1C,OAAO,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,IAAkB,CAEhD,CAAC;IACJ,CAAC;IAED,MAAM,CACJ,IAA0C;QAE1C,OAAO,UAAU,CAAC,cAAc,CAAC,IAAI,EAAE,IAAkB,CAExD,CAAC;IACJ,CAAC;IAED,4FAA4F;IAE5F,iBAAiB,CAAC,IAAmB;QACnC,OAAO,SAAS,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;IAED,oBAAoB,CAAC,IAAsB;QACzC,OAAO,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC;IAED,2FAA2F;IAE3F,YAAY,CAAC,IAAsB;QACjC,OAAO,UAAU,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC7C,CAAC;IAED,UAAU,CAAC,IAAoB;QAC7B,OAAO,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC3C,CAAC;IAED,cAAc,CAAC,IAAwB;QACrC,OAAO,UAAU,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC/C,CAAC;IAED,aAAa,CAAC,IAAuB;QACnC,OAAO,UAAU,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9C,CAAC;IAED,2FAA2F;IAE3F;;;;;;OAMG;IACH,OAAO,CACL,IAA2C;QAE3C,OAAO,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,IAA8B,CAE7D,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAWA,OAAO,EACL,YAAY,EACZ,qBAAqB,EACrB,sBAAsB,EACvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,UAAU,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACzB,MAAM,sBAAsB,CAAC;AAsB9B,OAAO,KAAK,SAAS,MAAM,cAAc,CAAC;AAE1C,OAAO,KAAK,UAAU,MAAM,eAAe,CAAC;AAS5C;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,eAAe;IAIjB,MAAM,CAAqC;IAC3C,QAAQ,CAAa;IAE9B,YAAY,MAA0C;QACpD,oGAAoG;QACpG,+DAA+D;QAC/D,MAAM,cAAc,GAAG,sBAAsB,CAC3C,MAAM,CAAC,WAAW,EAClB,MAAM,CAAC,OAAO,IAAI,EAAE,EACpB,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,IAAI,CAAC,KAAK,IAAI,CAClE,CAAC;QACF,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,wCAAwC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,iGAAiG;QACjG,MAAM,YAAY,GAAG;YACnB,GAAG,SAAS,CAAC,oBAAoB,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;YACvD,GAAG,0BAA0B,CAAC;gBAC5B,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBAChC,KAAK,EAAE,eAAe,CAAC,CAAC,IAAI,GAAG;oBAC/B,MAAM,EAAE,CAAC,CAAC,MAAM;oBAChB,GAAG,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;iBACvD,CAAC,CAAC;gBACH,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACpC,KAAK,EAAE,WAAW,CAAC,CAAC,IAAI,GAAG;oBAC3B,MAAM,EAAE,CAAC,CAAC,MAAM;oBAChB,GAAG,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;iBACvD,CAAC,CAAC;aACJ,CAAC;SACH,CAAC;QACF,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,mDAAmD,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChG,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,uBAAuB,EAAE,CAAC;IACjC,CAAC;IAED;;;;;OAKG;IACK,uBAAuB;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAChC,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAC/C,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC,IAAI,CAAC,KAAK,IAAI;gBAAE,SAAS;YACtD,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC5C,MAAM,QAAQ,GACZ,IAAI,CAAC,qBAAqB,EAAE,CAAC,IAAI,EAAE;gBACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ;gBAChC,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;aAC5D,CAAC,KAAK,IAAI,CAAC;YACd,IAAI,UAAU,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CACb,mDAAmD,IAAI,mCAAmC;oBACxF,IAAI,IAAI,CAAC,IAAI,8EAA8E;oBAC3F,4FAA4F;oBAC5F,4FAA4F;oBAC5F,kGAAkG,CACrG,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,2DAA2D;IAC3D,IAAI;QACF,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;QAC5B,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,sEAAsE;IACtE,KAAK,CAAC,UAAU;QACd,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACjE,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;QACxC,wEAAwE;QACxE,IAAI,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,wBAAwB,EAAE,CAAC,CAAC,CAAC;QACxE,CAAC;QAED,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;YAC/C,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;gBACtC;oBACE,IAAI,EAAE,WAAW,MAAM,CAAC,IAAI,EAAE;oBAC9B,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;iBAChD;aACF,CAAC,CAAC;QACL,CAAC;QAED,yEAAyE;QACzE,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;QACvF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAkD,CAAC;YAClF,IAAI,OAAO,QAAQ,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;gBAC/C,MAAM,IAAI,KAAK,CACb,sCAAsC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;oBACtF,oFAAoF;oBACpF,mDAAmD,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CACxF,CAAC;YACJ,CAAC;QACH,CAAC;QACD,KAAK,MAAM,UAAU,IAAI,SAAS,EAAE,CAAC;YACnC,MAAM,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,gBAAgB,CAAC,UAAgC;QAC7D,MAAM,UAAU,GAAG,UAAU,CAAC,2BAA2B,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC3E,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,UAAiD,CAAC;YACtD,IAAI,CAAC;gBACH,UAAU,GAAG,MAAM,UAAU,CAAC,8BAA8B,CAC1D,IAAI,CAAC,QAAQ,CAAC,QAAQ,EACtB,UAAU,CAAC,IAAI,CAChB,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,GAAG,CAAC;YAEvC,MAAM,QAAQ,GAAG,UAAU;iBACxB,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;iBACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,UAAU,aAAa,CAAC,CAAC,aAAa,KAAK,CAAC,CAAC,IAAI,QAAQ,CAAC;iBACpF,IAAI,CAAC,IAAI,CAAC,CAAC;YACd,MAAM,IAAI,KAAK,CACb,+DAA+D,UAAU,CAAC,IAAI,gBAAgB;gBAC5F,YAAY,UAAU,CAAC,MAAM,sBAAsB,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,GAAG;gBACzG,UAAU,QAAQ,sEAAsE;gBACxF,+FAA+F;gBAC/F,2EAA2E,UAAU,CAAC,IAAI,IAAI;gBAC9F,wFAAwF;gBACxF,sEAAsE,EACxE,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;QACJ,CAAC;IACH,CAAC;IAED,2CAA2C;IAC3C,aAAa,CAAC,IAAY;QACxB,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAC9D,CAAC;IAED,gDAAgD;IAChD,cAAc;QACZ,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;IACjC,CAAC;IAED,uCAAuC;IACvC,SAAS,CAAC,IAAY;QACpB,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAC3D,CAAC;IAED,4CAA4C;IAC5C,UAAU;QACR,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;IACnC,CAAC;IAED,4FAA4F;IAC5F,EAAE;IACF,+FAA+F;IAC/F,mGAAmG;IACnG,kGAAkG;IAClG,mGAAmG;IACnG,qFAAqF;IAErF,IAAI,CACF,IAAwC;QAExC,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,IAAgB,CAE5C,CAAC;IACJ,CAAC;IAED,QAAQ,CACN,IAA4C;QAE5C,OAAO,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAoB,CAEpD,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,OAAO,CACL,IAA2C;QAE3C,OAAO,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,IAAmB,CAE1C,CAAC;IACZ,CAAC;IAED,KAAK,CACH,IAAyC;QAEzC,OAAO,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,IAAiB,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,CACJ,IAA0C;QAE1C,OAAO,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,IAAkB,CAEhD,CAAC;IACJ,CAAC;IAED,MAAM,CACJ,IAA0C;QAE1C,OAAO,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,IAAkB,CAEhD,CAAC;IACJ,CAAC;IAED,MAAM,CACJ,IAA0C;QAE1C,OAAO,UAAU,CAAC,cAAc,CAAC,IAAI,EAAE,IAAkB,CAExD,CAAC;IACJ,CAAC;IAED,4FAA4F;IAE5F,iBAAiB,CAAC,IAAmB;QACnC,OAAO,SAAS,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;IAED,oBAAoB,CAAC,IAAsB;QACzC,OAAO,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC;IAED,2FAA2F;IAE3F,YAAY,CAAC,IAAsB;QACjC,OAAO,UAAU,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC7C,CAAC;IAED,UAAU,CAAC,IAAoB;QAC7B,OAAO,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC3C,CAAC;IAED,cAAc,CAAC,IAAwB;QACrC,OAAO,UAAU,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC/C,CAAC;IAED,aAAa,CAAC,IAAuB;QACnC,OAAO,UAAU,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9C,CAAC;IAED,2FAA2F;IAE3F;;;;OAIG;IACH,gBAAgB,CAAC,OAAiC;QAChD,OAAO,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IAED,2FAA2F;IAE3F;;;;;;OAMG;IACH,OAAO,CACL,IAA2C;QAE3C,OAAO,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,IAA8B,CAE7D,CAAC;IACJ,CAAC;CACF"}

package/dist/storage-intents.d.ts

@@ -0,0 +1,96 @@
+import type { CollectionDefinition } from '@forge-cms/core';
+import type { AtomicWriteOperation, DatabaseAdapter } from '@forge-cms/db';
+import type { OperationContext } from './context.js';
+/**
+ * Durable storage-cleanup intents (spec 067). A database transaction cannot include object storage, so
+ * every step where an object can end up owned by no document leaves a row here **first**, in the
+ * database, and removes it only once the object is accounted for:
+ *
+ * - **Upload:** an `upload` intent is written *before* the object is stored, and removed in the **same
+ *   batch** that creates the owning document. A process that dies between storing the object and
+ *   committing the document leaves the intent behind.
+ * - **Delete:** a `delete` intent is written in the **same batch** that deletes the owning document, and
+ *   removed once the object is deleted. A failed or interrupted object delete leaves it behind.
+ *
+ * A remaining intent means exactly "this object belongs to no document; delete it". {@link reconcileStorage}
+ * works them off. Nothing here is transactional with the bucket; the row is what survives a crash.
+ */
+export declare const STORAGE_INTENTS_COLLECTION = "_forge_storage_intents";
+/** How long an `upload` intent is left alone: its upload may still be committing its document. */
+export declare const DEFAULT_UPLOAD_GRACE_MS: number;
+/**
+ * The internal collection, built without `defineCollection()` because its identifier validation
+ * reserves the `_forge_` prefix for Forge's own tables — the same pattern as `_forge_bootstrap`.
+ */
+export declare function storageIntentsDefinition(): CollectionDefinition;
+export declare function hasUploadCollections(collections: readonly CollectionDefinition[]): boolean;
+/** Records, before the object is stored, that `key` may end up owned by nothing. Returns the intent id. */
+export declare function recordUploadIntent(database: DatabaseAdapter, collection: string, key: string): Promise<string>;
+/**
+ * The batch operation that turns an upload intent into ownership: it joins the document's own create
+ * batch, and must apply — if reconciliation already claimed the intent (it is deleting the object), the
+ * document is not created either.
+ */
+export declare function claimUploadIntent(intentId: string): AtomicWriteOperation;
+/**
+ * After a failed upload create. The object belongs to nothing **only if this call can claim the
+ * intent**: the document batch removes it on commit, so a claim that does not apply means the document
+ * committed (a later step failed) or a reconciler took over, and either way the object is left alone.
+ * Claim-first, like {@link reconcileStorage}: a batch whose outcome the driver could not report (a lost
+ * connection) and that commits afterwards finds its own claim gone and rolls back, so no document can
+ * point at the object deleted here. A failed object delete puts a `delete` intent back for reconciliation.
+ */
+export declare function settleFailedUpload(ctx: OperationContext, intentId: string, key: string): Promise<void>;
+/** The `delete` intent a document delete writes in its own batch. */
+export declare function deletionIntent(collection: string, key: string): AtomicWriteOperation;
+/** After the delete committed: remove the object, then its intent; a failure leaves the intent. */
+export declare function finishDeletion(ctx: OperationContext, intentId: string, key: string): Promise<void>;
+export interface ReconcileStorageOptions {
+    /** `upload` intents younger than this are skipped — their upload may still be committing. Default 1 hour. */
+    uploadGraceMs?: number;
+    /** At most this many intents per call. Default 100. */
+    limit?: number;
+    /** "Now", for tests. */
+    now?: Date;
+}
+export interface ReconcileStorageReport {
+    /** Objects deleted (or already absent), whose intents are now gone. */
+    deleted: string[];
+    /** Intents dropped without touching storage, because their object turned out to be owned. */
+    kept: string[];
+    /** `upload` intents still inside their grace period. */
+    pending: number;
+    /** Object deletes that failed; their intents remain for the next run. Messages only, no secrets. */
+    failed: {
+        key: string;
+        error: string;
+    }[];
+}
+/**
+ * Works off the storage intents left by crashed or failed uploads and deletes (spec 067): each remaining
+ * object that belongs to no document is deleted, and its intent removed. Safe to run at any time and
+ * repeatedly, from several processes at once:
+ *
+ * - An intent is first **claimed** — deleted by a conditional delete that only one caller can apply — so
+ *   no two reconcilers, and no still-committing upload, can both act on it (the upload's own claim then
+ *   fails and its document is not created).
+ * - An object is never deleted while a document owns it: an intent whose key a document of its
+ *   collection records as `_storageKey` is dropped and the object kept.
+ * - A failed object delete puts the intent back for the next run. Only a process that dies between the
+ *   claim and the object delete can leak that one object (a stored object with no intent); it can never
+ *   leave a document pointing at a deleted object.
+ *
+ * Run it from a scheduled job (e.g. a Cloudflare Cron Trigger) or an operator script. It is not called
+ * automatically.
+ */
+export declare function reconcileStorage(ctx: OperationContext, options?: ReconcileStorageOptions): Promise<ReconcileStorageReport>;
+/**
+ * The upload document that owns `key`: in the upload-enabled collection `collection` (default: the one
+ * the key is namespaced under, `<collection>/…`), the document whose Forge-recorded `_storageKey` is
+ * `key`. The single definition of file ownership (spec 067), used by `handleFile` and reconciliation.
+ */
+export declare function findStorageOwner(ctx: OperationContext, key: string, collection?: string | undefined): Promise<{
+    collection: string;
+    id: string;
+} | null>;
+//# sourceMappingURL=storage-intents.d.ts.map

package/dist/storage-intents.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage-intents.d.ts","sourceRoot":"","sources":["../src/storage-intents.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAE5D,OAAO,KAAK,EAAE,oBAAoB,EAAE,eAAe,EAAkB,MAAM,eAAe,CAAC;AAC3F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,0BAA0B,2BAA2B,CAAC;AAEnE,kGAAkG;AAClG,eAAO,MAAM,uBAAuB,QAAiB,CAAC;AAEtD;;;GAGG;AACH,wBAAgB,wBAAwB,IAAI,oBAAoB,CAe/D;AAED,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,SAAS,oBAAoB,EAAE,GAAG,OAAO,CAE1F;AAED,2GAA2G;AAC3G,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,eAAe,EACzB,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,CAOjB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,oBAAoB,CAQxE;AAED;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,gBAAgB,EACrB,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,IAAI,CAAC,CAcf;AAED,qEAAqE;AACrE,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,oBAAoB,CAMpF;AAED,mGAAmG;AACnG,wBAAsB,cAAc,CAClC,GAAG,EAAE,gBAAgB,EACrB,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,IAAI,CAAC,CAOf;AAED,MAAM,WAAW,uBAAuB;IACtC,6GAA6G;IAC7G,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,uDAAuD;IACvD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wBAAwB;IACxB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAED,MAAM,WAAW,sBAAsB;IACrC,uEAAuE;IACvE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,6FAA6F;IAC7F,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,wDAAwD;IACxD,OAAO,EAAE,MAAM,CAAC;IAChB,oGAAoG;IACpG,MAAM,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC1C;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,gBAAgB,EACrB,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,sBAAsB,CAAC,CA0CjC;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,gBAAgB,EACrB,GAAG,EAAE,MAAM,EACX,UAAU,GAAE,MAAM,GAAG,SAA6B,GACjD,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CASpD"}

package/dist/storage-intents.js

@@ -0,0 +1,217 @@
+import { defineField, getLogger } from '@forge-cms/core';
+/**
+ * Durable storage-cleanup intents (spec 067). A database transaction cannot include object storage, so
+ * every step where an object can end up owned by no document leaves a row here **first**, in the
+ * database, and removes it only once the object is accounted for:
+ *
+ * - **Upload:** an `upload` intent is written *before* the object is stored, and removed in the **same
+ *   batch** that creates the owning document. A process that dies between storing the object and
+ *   committing the document leaves the intent behind.
+ * - **Delete:** a `delete` intent is written in the **same batch** that deletes the owning document, and
+ *   removed once the object is deleted. A failed or interrupted object delete leaves it behind.
+ *
+ * A remaining intent means exactly "this object belongs to no document; delete it". {@link reconcileStorage}
+ * works them off. Nothing here is transactional with the bucket; the row is what survives a crash.
+ */
+export const STORAGE_INTENTS_COLLECTION = '_forge_storage_intents';
+/** How long an `upload` intent is left alone: its upload may still be committing its document. */
+export const DEFAULT_UPLOAD_GRACE_MS = 60 * 60 * 1000;
+/**
+ * The internal collection, built without `defineCollection()` because its identifier validation
+ * reserves the `_forge_` prefix for Forge's own tables — the same pattern as `_forge_bootstrap`.
+ */
+export function storageIntentsDefinition() {
+    return {
+        slug: STORAGE_INTENTS_COLLECTION,
+        access: {
+            read: () => false,
+            create: () => false,
+            update: () => false,
+            delete: () => false
+        },
+        fields: {
+            key: defineField.text({ required: true, index: true }),
+            reason: defineField.text({ required: true }),
+            collection: defineField.text({ required: true })
+        }
+    };
+}
+export function hasUploadCollections(collections) {
+    return collections.some((collection) => collection.upload === true);
+}
+/** Records, before the object is stored, that `key` may end up owned by nothing. Returns the intent id. */
+export async function recordUploadIntent(database, collection, key) {
+    const intent = await database.create(STORAGE_INTENTS_COLLECTION, {
+        key,
+        reason: 'upload',
+        collection
+    });
+    return intent.id;
+}
+/**
+ * The batch operation that turns an upload intent into ownership: it joins the document's own create
+ * batch, and must apply — if reconciliation already claimed the intent (it is deleting the object), the
+ * document is not created either.
+ */
+export function claimUploadIntent(intentId) {
+    return {
+        type: 'deleteIf',
+        collection: STORAGE_INTENTS_COLLECTION,
+        id: intentId,
+        condition: {},
+        requireApplied: true
+    };
+}
+/**
+ * After a failed upload create. The object belongs to nothing **only if this call can claim the
+ * intent**: the document batch removes it on commit, so a claim that does not apply means the document
+ * committed (a later step failed) or a reconciler took over, and either way the object is left alone.
+ * Claim-first, like {@link reconcileStorage}: a batch whose outcome the driver could not report (a lost
+ * connection) and that commits afterwards finds its own claim gone and rolls back, so no document can
+ * point at the object deleted here. A failed object delete puts a `delete` intent back for reconciliation.
+ */
+export async function settleFailedUpload(ctx, intentId, key) {
+    const database = ctx.adapters.database;
+    let claimed = false;
+    try {
+        claimed = (await database.deleteIf(STORAGE_INTENTS_COLLECTION, intentId, {})).applied;
+        if (!claimed)
+            return;
+        await ctx.adapters.storage.delete(key);
+    }
+    catch (err) {
+        if (!claimed) {
+            logCleanupFailure(key, 'after a failed upload', err, 'kept');
+            return;
+        }
+        await restoreIntent(ctx, key, keyCollection(key), err, 'after a failed upload');
+    }
+}
+/** The `delete` intent a document delete writes in its own batch. */
+export function deletionIntent(collection, key) {
+    return {
+        type: 'create',
+        collection: STORAGE_INTENTS_COLLECTION,
+        data: { key, reason: 'delete', collection }
+    };
+}
+/** After the delete committed: remove the object, then its intent; a failure leaves the intent. */
+export async function finishDeletion(ctx, intentId, key) {
+    try {
+        await ctx.adapters.storage.delete(key);
+        await ctx.adapters.database.delete(STORAGE_INTENTS_COLLECTION, intentId);
+    }
+    catch (err) {
+        logCleanupFailure(key, 'after document deletion', err, 'kept');
+    }
+}
+/**
+ * Works off the storage intents left by crashed or failed uploads and deletes (spec 067): each remaining
+ * object that belongs to no document is deleted, and its intent removed. Safe to run at any time and
+ * repeatedly, from several processes at once:
+ *
+ * - An intent is first **claimed** — deleted by a conditional delete that only one caller can apply — so
+ *   no two reconcilers, and no still-committing upload, can both act on it (the upload's own claim then
+ *   fails and its document is not created).
+ * - An object is never deleted while a document owns it: an intent whose key a document of its
+ *   collection records as `_storageKey` is dropped and the object kept.
+ * - A failed object delete puts the intent back for the next run. Only a process that dies between the
+ *   claim and the object delete can leak that one object (a stored object with no intent); it can never
+ *   leave a document pointing at a deleted object.
+ *
+ * Run it from a scheduled job (e.g. a Cloudflare Cron Trigger) or an operator script. It is not called
+ * automatically.
+ */
+export async function reconcileStorage(ctx, options = {}) {
+    const database = ctx.adapters.database;
+    const now = (options.now ?? new Date()).getTime();
+    const grace = options.uploadGraceMs ?? DEFAULT_UPLOAD_GRACE_MS;
+    const report = { deleted: [], kept: [], pending: 0, failed: [] };
+    const intents = await database.findMany({
+        collection: STORAGE_INTENTS_COLLECTION,
+        limit: options.limit ?? 100,
+        sort: 'created_at',
+        order: 'asc'
+    });
+    for (const intent of intents) {
+        const key = intent.key;
+        const collection = intent.collection;
+        if (intent.reason === 'upload' && now - createdAt(intent) < grace) {
+            report.pending++;
+            continue;
+        }
+        let claimed = false;
+        try {
+            // Ownership first: if a document records the key, the object stays. Checked before the claim, so
+            // a failing read leaves the intent in place; a commit racing in between consumes the intent and
+            // our claim below then does not apply.
+            const owned = (await findStorageOwner(ctx, key, collection)) !== null;
+            claimed = (await database.deleteIf(STORAGE_INTENTS_COLLECTION, intent.id, {}))
+                .applied;
+            if (!claimed)
+                continue; // another reconciler, or the upload's own commit, got it first
+            if (owned) {
+                report.kept.push(key);
+                continue;
+            }
+            await ctx.adapters.storage.delete(key);
+            report.deleted.push(key);
+        }
+        catch (err) {
+            report.failed.push({ key, error: messageOf(err) });
+            if (claimed)
+                await restoreIntent(ctx, key, collection, err, 'during reconciliation');
+        }
+    }
+    return report;
+}
+/**
+ * The upload document that owns `key`: in the upload-enabled collection `collection` (default: the one
+ * the key is namespaced under, `<collection>/…`), the document whose Forge-recorded `_storageKey` is
+ * `key`. The single definition of file ownership (spec 067), used by `handleFile` and reconciliation.
+ */
+export async function findStorageOwner(ctx, key, collection = key.split('/')[0]) {
+    const definition = collection ? ctx.getCollection(collection) : undefined;
+    if (!definition || definition.upload !== true)
+        return null;
+    const [owner] = await ctx.adapters.database.findMany({
+        collection: definition.slug,
+        where: { _storageKey: key },
+        limit: 1
+    });
+    return owner ? { collection: definition.slug, id: owner.id } : null;
+}
+function createdAt(intent) {
+    const value = typeof intent.created_at === 'string' ? Date.parse(intent.created_at) : NaN;
+    return Number.isNaN(value) ? 0 : value;
+}
+function messageOf(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+/** Puts a `delete` intent back after a claimed object could not be deleted, so the next run retries. */
+async function restoreIntent(ctx, key, collection, err, when) {
+    try {
+        await ctx.adapters.database.create(STORAGE_INTENTS_COLLECTION, {
+            key,
+            reason: 'delete',
+            collection
+        });
+        logCleanupFailure(key, when, err, 'kept');
+    }
+    catch (restoreErr) {
+        logCleanupFailure(key, when, err, 'lost');
+        getLogger().error(`Could not restore the storage intent for '${key}': ${messageOf(restoreErr)}`);
+    }
+}
+function keyCollection(key) {
+    return key.split('/')[0] ?? '';
+}
+/** The key and the error's message only — never the error object, which can carry request/credential details. */
+function logCleanupFailure(key, when, err, intent) {
+    getLogger().error(`Failed to delete storage object '${key}' ${when}: ${messageOf(err)}. ` +
+        (intent === 'kept'
+            ? `Its storage intent remains; run reconcileStorage() to retry (spec 067).`
+            : `Its storage intent could not be kept, so the object is now orphaned and must be removed by ` +
+                `hand (spec 067).`));
+}
+//# sourceMappingURL=storage-intents.js.map

package/dist/storage-intents.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage-intents.js","sourceRoot":"","sources":["../src/storage-intents.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAIzD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,wBAAwB,CAAC;AAEnE,kGAAkG;AAClG,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEtD;;;GAGG;AACH,MAAM,UAAU,wBAAwB;IACtC,OAAO;QACL,IAAI,EAAE,0BAA0B;QAChC,MAAM,EAAE;YACN,IAAI,EAAE,GAAG,EAAE,CAAC,KAAK;YACjB,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK;YACnB,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK;YACnB,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK;SACpB;QACD,MAAM,EAAE;YACN,GAAG,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YACtD,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YAC5C,UAAU,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;SACjD;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,WAA4C;IAC/E,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;AACtE,CAAC;AAED,2GAA2G;AAC3G,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,QAAyB,EACzB,UAAkB,EAClB,GAAW;IAEX,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,0BAA0B,EAAE;QAC/D,GAAG;QACH,MAAM,EAAE,QAAQ;QAChB,UAAU;KACX,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,EAAY,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,UAAU,EAAE,0BAA0B;QACtC,EAAE,EAAE,QAAQ;QACZ,SAAS,EAAE,EAAE;QACb,cAAc,EAAE,IAAI;KACrB,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAqB,EACrB,QAAgB,EAChB,GAAW;IAEX,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;IACvC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,0BAA0B,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;QACtF,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,MAAM,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,iBAAiB,CAAC,GAAG,EAAE,uBAAuB,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QACD,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,uBAAuB,CAAC,CAAC;IAClF,CAAC;AACH,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,cAAc,CAAC,UAAkB,EAAE,GAAW;IAC5D,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE,0BAA0B;QACtC,IAAI,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE;KAC5C,CAAC;AACJ,CAAC;AAED,mGAAmG;AACnG,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAqB,EACrB,QAAgB,EAChB,GAAW;IAEX,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,0BAA0B,EAAE,QAAQ,CAAC,CAAC;IAC3E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,iBAAiB,CAAC,GAAG,EAAE,yBAAyB,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAsBD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAqB,EACrB,UAAmC,EAAE;IAErC,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;IACvC,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IAClD,MAAM,KAAK,GAAG,OAAO,CAAC,aAAa,IAAI,uBAAuB,CAAC;IAC/D,MAAM,MAAM,GAA2B,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAEzF,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC;QACtC,UAAU,EAAE,0BAA0B;QACtC,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,GAAG;QAC3B,IAAI,EAAE,YAAY;QAClB,KAAK,EAAE,KAAK;KACb,CAAC,CAAC;IAEH,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,GAAa,CAAC;QACjC,MAAM,UAAU,GAAG,MAAM,CAAC,UAAoB,CAAC;QAC/C,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,GAAG,KAAK,EAAE,CAAC;YAClE,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,SAAS;QACX,CAAC;QAED,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC;YACH,iGAAiG;YACjG,gGAAgG;YAChG,uCAAuC;YACvC,MAAM,KAAK,GAAG,CAAC,MAAM,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC,KAAK,IAAI,CAAC;YACtE,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,0BAA0B,EAAE,MAAM,CAAC,EAAY,EAAE,EAAE,CAAC,CAAC;iBACrF,OAAO,CAAC;YACX,IAAI,CAAC,OAAO;gBAAE,SAAS,CAAC,+DAA+D;YACvF,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACtB,SAAS;YACX,CAAC;YACD,MAAM,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACvC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACnD,IAAI,OAAO;gBAAE,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,uBAAuB,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAqB,EACrB,GAAW,EACX,aAAiC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAElD,MAAM,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1E,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC3D,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACnD,UAAU,EAAE,UAAU,CAAC,IAAI;QAC3B,KAAK,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE;QAC3B,KAAK,EAAE,CAAC;KACT,CAAC,CAAC;IACH,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,EAAY,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAChF,CAAC;AAED,SAAS,SAAS,CAAC,MAAsB;IACvC,MAAM,KAAK,GAAG,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC1F,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACzC,CAAC;AAED,SAAS,SAAS,CAAC,GAAY;IAC7B,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED,wGAAwG;AACxG,KAAK,UAAU,aAAa,CAC1B,GAAqB,EACrB,GAAW,EACX,UAAkB,EAClB,GAAY,EACZ,IAAY;IAEZ,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,0BAA0B,EAAE;YAC7D,GAAG;YACH,MAAM,EAAE,QAAQ;YAChB,UAAU;SACX,CAAC,CAAC;QACH,iBAAiB,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,UAAU,EAAE,CAAC;QACpB,iBAAiB,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAC1C,SAAS,EAAE,CAAC,KAAK,CACf,6CAA6C,GAAG,MAAM,SAAS,CAAC,UAAU,CAAC,EAAE,CAC9E,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACjC,CAAC;AAED,iHAAiH;AACjH,SAAS,iBAAiB,CAAC,GAAW,EAAE,IAAY,EAAE,GAAY,EAAE,MAAuB;IACzF,SAAS,EAAE,CAAC,KAAK,CACf,oCAAoC,GAAG,KAAK,IAAI,KAAK,SAAS,CAAC,GAAG,CAAC,IAAI;QACrE,CAAC,MAAM,KAAK,MAAM;YAChB,CAAC,CAAC,yEAAyE;YAC3E,CAAC,CAAC,6FAA6F;gBAC7F,kBAAkB,CAAC,CAC1B,CAAC;AACJ,CAAC"}

package/dist/system-fields.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Forge-owned document metadata (spec 063): never content, never written through the CMS mutation
+ * pipeline by a caller or a hook. `_status` is deliberately absent — on a `drafts: true` collection it
+ * is lifecycle input and stays writable. Raw `DatabaseAdapter` writes are outside this boundary.
+ */
+export declare const FORGE_OWNED_KEYS: readonly string[];
+/**
+ * The caller-input screen for an update (or an update-mode preview / an existing global): echoes of
+ * `existing` are dropped, any other Forge-owned value is a `400`.
+ */
+export declare function screenUpdateInput(data: Record<string, unknown>, existing: Record<string, unknown>): Record<string, unknown>;
+/**
+ * The caller-input screen for a create. A trusted caller (`overrideAccess` not `false`) may choose the
+ * new document's `id` — a non-empty string, returned separately so hooks never see or change it; every
+ * other Forge-owned key (and an untrusted caller's `id`) is a `400`.
+ */
+export declare function screenCreateInput(data: Record<string, unknown>, trusted: boolean): {
+    content: Record<string, unknown>;
+    id: string | undefined;
+};
+/**
+ * Screens what a hook stage returned: hooks may change content and `_status`, never Forge-owned
+ * metadata. Echoes of `stored` (e.g. a hook returning `{ ...previousData, ...data }`) are dropped; any
+ * other value is a server-code bug, reported as a plain `Error` (500) rather than the caller's `400`.
+ */
+export declare function screenHookOutput(data: Record<string, unknown>, stored: Record<string, unknown>, stage: string, target: string): Record<string, unknown>;
+//# sourceMappingURL=system-fields.d.ts.map

package/dist/system-fields.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"system-fields.d.ts","sourceRoot":"","sources":["../src/system-fields.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAK7C,CAAC;AAgCF;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,EAAE,OAAO,GACf;IAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,EAAE,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAY9D;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GACb,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAUzB"}

package/dist/system-fields.js

@@ -0,0 +1,74 @@
+import { InvalidInputError } from './errors.js';
+/**
+ * Forge-owned document metadata (spec 063): never content, never written through the CMS mutation
+ * pipeline by a caller or a hook. `_status` is deliberately absent — on a `drafts: true` collection it
+ * is lifecycle input and stays writable. Raw `DatabaseAdapter` writes are outside this boundary.
+ */
+export const FORGE_OWNED_KEYS = [
+    'id',
+    'created_at',
+    'updated_at',
+    '_storageKey'
+];
+/** `null` and absent are the same stored value — echoing a missing key back as `null` is a no-op. */
+function sameValue(a, b) {
+    return (a ?? null) === (b ?? null);
+}
+/**
+ * Returns `data` without the Forge-owned keys that merely echo `stored` (the document as it is — `{}`
+ * for a document that does not exist yet), calling `reject(key)` for any other value. An echo is a
+ * no-op, so a client round-tripping the document it read keeps working; a changed value is a write
+ * attempt and is refused rather than silently stripped.
+ */
+function screen(data, stored, reject) {
+    let screened = data;
+    for (const key of FORGE_OWNED_KEYS) {
+        if (!Object.hasOwn(data, key))
+            continue;
+        if (!sameValue(data[key], stored[key]))
+            throw reject(key);
+        if (screened === data)
+            screened = { ...data };
+        delete screened[key];
+    }
+    return screened;
+}
+function callerRejection(key) {
+    return new InvalidInputError(`Field '${key}' is managed by Forge and cannot be written`);
+}
+/**
+ * The caller-input screen for an update (or an update-mode preview / an existing global): echoes of
+ * `existing` are dropped, any other Forge-owned value is a `400`.
+ */
+export function screenUpdateInput(data, existing) {
+    return screen(data, existing, callerRejection);
+}
+/**
+ * The caller-input screen for a create. A trusted caller (`overrideAccess` not `false`) may choose the
+ * new document's `id` — a non-empty string, returned separately so hooks never see or change it; every
+ * other Forge-owned key (and an untrusted caller's `id`) is a `400`.
+ */
+export function screenCreateInput(data, trusted) {
+    const { id, ...rest } = data;
+    if (id !== undefined && id !== null) {
+        if (!trusted)
+            throw callerRejection('id');
+        if (typeof id !== 'string' || id === '') {
+            throw new InvalidInputError(`Field 'id' must be a non-empty string`);
+        }
+    }
+    return {
+        content: screen(rest, {}, callerRejection),
+        id: typeof id === 'string' ? id : undefined
+    };
+}
+/**
+ * Screens what a hook stage returned: hooks may change content and `_status`, never Forge-owned
+ * metadata. Echoes of `stored` (e.g. a hook returning `{ ...previousData, ...data }`) are dropped; any
+ * other value is a server-code bug, reported as a plain `Error` (500) rather than the caller's `400`.
+ */
+export function screenHookOutput(data, stored, stage, target) {
+    return screen(data, stored, (key) => new Error(`${stage} hook on '${target}' set the Forge-owned field '${key}'; hooks may only change ` +
+        `content fields and _status (spec 063)`));
+}
+//# sourceMappingURL=system-fields.js.map

package/dist/system-fields.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"system-fields.js","sourceRoot":"","sources":["../src/system-fields.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAsB;IACjD,IAAI;IACJ,YAAY;IACZ,YAAY;IACZ,aAAa;CACd,CAAC;AAEF,qGAAqG;AACrG,SAAS,SAAS,CAAC,CAAU,EAAE,CAAU;IACvC,OAAO,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;AACrC,CAAC;AAED;;;;;GAKG;AACH,SAAS,MAAM,CACb,IAA6B,EAC7B,MAA+B,EAC/B,MAA8B;IAE9B,IAAI,QAAQ,GAAG,IAAI,CAAC;IACpB,KAAK,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC;YAAE,SAAS;QACxC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;YAAE,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1D,IAAI,QAAQ,KAAK,IAAI;YAAE,QAAQ,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;QAC9C,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,eAAe,CAAC,GAAW;IAClC,OAAO,IAAI,iBAAiB,CAAC,UAAU,GAAG,6CAA6C,CAAC,CAAC;AAC3F,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAA6B,EAC7B,QAAiC;IAEjC,OAAO,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;AACjD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAA6B,EAC7B,OAAgB;IAEhB,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;IAC7B,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;QACpC,IAAI,CAAC,OAAO;YAAE,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACxC,MAAM,IAAI,iBAAiB,CAAC,uCAAuC,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IACD,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,eAAe,CAAC;QAC1C,EAAE,EAAE,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;KAC5C,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAA6B,EAC7B,MAA+B,EAC/B,KAAa,EACb,MAAc;IAEd,OAAO,MAAM,CACX,IAAI,EACJ,MAAM,EACN,CAAC,GAAG,EAAE,EAAE,CACN,IAAI,KAAK,CACP,GAAG,KAAK,aAAa,MAAM,gCAAgC,GAAG,2BAA2B;QACvF,uCAAuC,CAC1C,CACJ,CAAC;AACJ,CAAC"}