@innovatorstack/harness 0.0.0-stage → 0.1.0

package/dist/platform/security/source-inheritance.js

@@ -0,0 +1,87 @@
+import { assertActiveContext, spendContext } from "../../core/context.js";
+import { dataNodesMax } from "../../core/limits.js";
+import { PlatformError } from "../errors.js";
+import { recordKey } from "../references/catalog.js";
+import { InheritedRelationships } from "./inherited-relationships.js";
+const inheritedFields = ["permission_id", "owned_by_id", "managed_by_id", "team_id"];
+/** Audit fields belong to the relationship; these four fields inherit from its source. */
+export function inheritedSecurity(source) {
+    const values = {};
+    for (const name of inheritedFields) {
+        values[name] = source.properties[name] ?? null;
+    }
+    return values;
+}
+/** Native ACL propagation is a platform write in the original action's transaction. */
+export class SourceInheritance {
+    storage;
+    sources;
+    trace;
+    permissions;
+    constructor(storage, sources, trace, permissions) {
+        this.storage = storage;
+        this.sources = sources;
+        this.trace = trace;
+        this.permissions = permissions;
+    }
+    changed(before, after, context) {
+        const fields = inheritedFields.filter((name) => (before.properties[name] ?? null) !== (after.properties[name] ?? null));
+        if (fields.length === 0) {
+            return;
+        }
+        const definition = this.storage.getItemType(after.type);
+        if (!definition) {
+            throw new PlatformError("MissingItemType", `Permission source '${after.type}' has no schema.`);
+        }
+        const inherited = this.permissions.sourceProperties(definition, after, context);
+        const changes = {
+            permission_id: inherited.permission_id ?? null,
+        };
+        for (const name of fields) {
+            changes[name] = after.properties[name] ?? null;
+        }
+        this.propagate(after, changes, context);
+    }
+    propagate(source, changes, context) {
+        const pending = [source];
+        const visited = new Set();
+        const relationships = new InheritedRelationships(this.storage, this.sources, context);
+        while (pending.length > 0) {
+            spendContext(context);
+            const parent = pending.pop();
+            if (!parent || visited.size >= dataNodesMax) {
+                throw new PlatformError("ProtocolLimit", "Inherited permissions exceed their graph limit.");
+            }
+            const key = recordKey(parent);
+            if (visited.has(key)) {
+                throw new PlatformError("SourceAccessCycle", "Inherited permissions contain a cycle.");
+            }
+            visited.add(key);
+            for (const child of relationships.children(parent)) {
+                if (pending.length >= dataNodesMax) {
+                    throw new PlatformError("ProtocolLimit", "Inherited permissions exceed their pending graph limit.");
+                }
+                pending.push(this.update(child, changes, context));
+            }
+        }
+    }
+    update(before, changes, context) {
+        if (Object.entries(changes).every(([name, value]) => before.properties[name] === value)) {
+            return before;
+        }
+        assertActiveContext(context);
+        this.storage.updateItem(before.type, before.id, changes);
+        const after = this.storage.getItem(before.type, before.id);
+        if (!after) {
+            throw new Error("Permission propagation must retain its relationship.");
+        }
+        this.trace.record(context, {
+            kind: "mutation",
+            name: "inherit-permissions",
+            before,
+            after,
+        });
+        return after;
+    }
+}
+//# sourceMappingURL=source-inheritance.js.map

package/dist/platform/security/source-inheritance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-inheritance.js","sourceRoot":"","sources":["../../../src/platform/security/source-inheritance.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAGpD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAErD,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAItE,MAAM,eAAe,GAAG,CAAC,eAAe,EAAE,aAAa,EAAE,eAAe,EAAE,SAAS,CAAC,CAAC;AAErF,0FAA0F;AAC1F,MAAM,UAAU,iBAAiB,CAAC,MAAkB;IAChD,MAAM,MAAM,GAAiC,EAAE,CAAC;IAEhD,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;IACnD,CAAC;IAED,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,uFAAuF;AACvF,MAAM,OAAO,iBAAiB;IAEL,OAAO;IACP,OAAO;IACP,KAAK;IACL,WAAW;IAJhC,YACqB,OAAuB,EACvB,OAAqB,EACrB,KAAoB,EACpB,WAA4B;uBAH5B,OAAO;uBACP,OAAO;qBACP,KAAK;2BACL,WAAW;IAC7B,CAAC;IAEJ,OAAO,CAAC,MAAkB,EAAE,KAAiB,EAAE,OAAyB;QACpE,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CACjC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CACnF,CAAC;QAEF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO;QACX,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAExD,IAAI,CAAC,UAAU,EAAE,CAAC;YACd,MAAM,IAAI,aAAa,CACnB,iBAAiB,EACjB,sBAAsB,KAAK,CAAC,IAAI,kBAAkB,CACrD,CAAC;QACN,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QAChF,MAAM,OAAO,GAAiC;YAC1C,aAAa,EAAE,SAAS,CAAC,aAAa,IAAI,IAAI;SACjD,CAAC;QAEF,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;YACxB,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;QACnD,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;IAEO,SAAS,CACb,MAAkB,EAClB,OAA+C,EAC/C,OAAyB;QAEzB,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC;QACzB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,MAAM,aAAa,GAAG,IAAI,sBAAsB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAEtF,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;YAE7B,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,IAAI,YAAY,EAAE,CAAC;gBAC1C,MAAM,IAAI,aAAa,CACnB,eAAe,EACf,iDAAiD,CACpD,CAAC;YACN,CAAC;YAED,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;YAE9B,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnB,MAAM,IAAI,aAAa,CACnB,mBAAmB,EACnB,wCAAwC,CAC3C,CAAC;YACN,CAAC;YAED,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAEjB,KAAK,MAAM,KAAK,IAAI,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACjD,IAAI,OAAO,CAAC,MAAM,IAAI,YAAY,EAAE,CAAC;oBACjC,MAAM,IAAI,aAAa,CACnB,eAAe,EACf,yDAAyD,CAC5D,CAAC;gBACN,CAAC;gBAED,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;YACvD,CAAC;QACL,CAAC;IACL,CAAC;IAEO,MAAM,CACV,MAAkB,EAClB,OAA+C,EAC/C,OAAyB;QAEzB,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;YACtF,OAAO,MAAM,CAAC;QAClB,CAAC;QAED,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC7B,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAE3D,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC5E,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE;YACvB,IAAI,EAAE,UAAU;YAChB,IAAI,EAAE,qBAAqB;YAC3B,MAAM;YACN,KAAK;SACR,CAAC,CAAC;QAEH,OAAO,KAAK,CAAC;IACjB,CAAC;CACJ"}

package/dist/platform/security/system-identities.d.ts

@@ -0,0 +1,4 @@
+/** Virtual roles are identified by genuine standard IDs, even if their display names change. */
+export declare function systemIdentity(id: string, name: string): boolean;
+export declare function systemIdentityId(name: string): string | undefined;
+//# sourceMappingURL=system-identities.d.ts.map

package/dist/platform/security/system-identities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"system-identities.d.ts","sourceRoot":"","sources":["../../../src/platform/security/system-identities.ts"],"names":[],"mappings":"AAQA,gGAAgG;AAChG,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAEhE;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEjE"}

package/dist/platform/security/system-identities.js

@@ -0,0 +1,12 @@
+import { baselineEntries } from "../../baseline/catalog.js";
+const identities = new Map(baselineEntries
+    .filter((entry) => entry.type === "Identity")
+    .map((entry) => [String(entry.properties.name), entry.id]));
+/** Virtual roles are identified by genuine standard IDs, even if their display names change. */
+export function systemIdentity(id, name) {
+    return id.toLowerCase() === identities.get(name)?.toLowerCase();
+}
+export function systemIdentityId(name) {
+    return identities.get(name);
+}
+//# sourceMappingURL=system-identities.js.map

package/dist/platform/security/system-identities.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"system-identities.js","sourceRoot":"","sources":["../../../src/platform/security/system-identities.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAE5D,MAAM,UAAU,GAAG,IAAI,GAAG,CACtB,eAAe;KACV,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC;KAC5C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CACjE,CAAC;AAEF,gGAAgG;AAChG,MAAM,UAAU,cAAc,CAAC,EAAU,EAAE,IAAY;IACnD,OAAO,EAAE,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY;IACzC,OAAO,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC"}

package/dist/platform/security/teams.d.ts

@@ -0,0 +1,15 @@
+import type { ExecutionContext } from "../../core/types.js";
+import type { HarnessStorage, StoredItem } from "../../storage/types.js";
+/** One synchronous permission check owns its membership snapshot; actions never share it. */
+export declare class TeamRoles {
+    private readonly storage;
+    private readonly identities;
+    private readonly context;
+    private memberships;
+    constructor(storage: HarnessStorage, identities: ReadonlySet<string>, context: ExecutionContext);
+    matches(roleId: string, record: StoredItem): boolean;
+    private isRole;
+    private teamId;
+    private memberRoles;
+}
+//# sourceMappingURL=teams.d.ts.map

package/dist/platform/security/teams.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"teams.d.ts","sourceRoot":"","sources":["../../../src/platform/security/teams.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAMzE,6FAA6F;AAC7F,qBAAa,SAAS;IAId,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAL5B,OAAO,CAAC,WAAW,CAAuD;IAE1E,YACqB,OAAO,EAAE,cAAc,EACvB,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,EAC/B,OAAO,EAAE,gBAAgB,EAC1C;IAEJ,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,OAAO,CAiBnD;IAED,OAAO,CAAC,MAAM;IAUd,OAAO,CAAC,MAAM;IA4Bd,OAAO,CAAC,WAAW;CAwBtB"}

package/dist/platform/security/teams.js

@@ -0,0 +1,68 @@
+import { spendContext } from "../../core/context.js";
+import { PlatformError } from "../errors.js";
+import { systemIdentity } from "./system-identities.js";
+const standardRoles = ["Team", "Team Manager", "Team Member", "Team Guest"];
+/** One synchronous permission check owns its membership snapshot; actions never share it. */
+export class TeamRoles {
+    storage;
+    identities;
+    context;
+    memberships;
+    constructor(storage, identities, context) {
+        this.storage = storage;
+        this.identities = identities;
+        this.context = context;
+    }
+    matches(roleId, record) {
+        if (!this.isRole(roleId)) {
+            return false;
+        }
+        const teamId = this.teamId(record);
+        if (!teamId) {
+            return false;
+        }
+        const roles = this.memberRoles().get(teamId.toLowerCase());
+        // The standard Team Identity represents membership in any role, including no role.
+        return Boolean(roles && (systemIdentity(roleId, "Team") || roles.has(roleId.toLowerCase())));
+    }
+    isRole(id) {
+        if (standardRoles.some((name) => systemIdentity(id, name))) {
+            return true;
+        }
+        const identity = this.storage.getItem("Identity", id);
+        return String(identity?.properties.classification ?? "").toLowerCase() === "team";
+    }
+    teamId(record) {
+        const id = record.properties.team_id;
+        if (id === undefined || id === null || id === "") {
+            return undefined;
+        }
+        const source = this.storage.getItemType(record.type)?.source;
+        if (typeof id !== "string") {
+            throw new PlatformError("InvalidTeamReference", `Item '${record.type}:${record.id}' requires a Team ID in team_id.`, source ? { source } : undefined);
+        }
+        if (!this.storage.getItem("Team", id)) {
+            throw new PlatformError("MissingTeam", `Import Team '${id}' before checking roles on '${record.type}:${record.id}'.`, source ? { source } : undefined);
+        }
+        return id;
+    }
+    memberRoles() {
+        if (this.memberships) {
+            return this.memberships;
+        }
+        const memberships = new Map();
+        for (const member of this.storage.listItems("Team Identity")) {
+            spendContext(this.context);
+            if (!this.identities.has(String(member.properties.related_id).toLowerCase())) {
+                continue;
+            }
+            const teamId = String(member.properties.source_id).toLowerCase();
+            const roles = memberships.get(teamId) ?? new Set();
+            roles.add(String(member.properties.team_role ?? "").toLowerCase());
+            memberships.set(teamId, roles);
+        }
+        this.memberships = memberships;
+        return memberships;
+    }
+}
+//# sourceMappingURL=teams.js.map

package/dist/platform/security/teams.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"teams.js","sourceRoot":"","sources":["../../../src/platform/security/teams.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAGrD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAExD,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC;AAE5E,6FAA6F;AAC7F,MAAM,OAAO,SAAS;IAIG,OAAO;IACP,UAAU;IACV,OAAO;IALpB,WAAW,CAAuD;IAE1E,YACqB,OAAuB,EACvB,UAA+B,EAC/B,OAAyB;uBAFzB,OAAO;0BACP,UAAU;uBACV,OAAO;IACzB,CAAC;IAEJ,OAAO,CAAC,MAAc,EAAE,MAAkB;QACtC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,OAAO,KAAK,CAAC;QACjB,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAEnC,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,OAAO,KAAK,CAAC;QACjB,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;QAE3D,mFAAmF;QACnF,OAAO,OAAO,CACV,KAAK,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAC/E,CAAC;IACN,CAAC;IAEO,MAAM,CAAC,EAAU;QACrB,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;YACzD,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAEtD,OAAO,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC;IACtF,CAAC;IAEO,MAAM,CAAC,MAAkB;QAC7B,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;QAErC,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC/C,OAAO,SAAS,CAAC;QACrB,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAE7D,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;YACzB,MAAM,IAAI,aAAa,CACnB,sBAAsB,EACtB,SAAS,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,EAAE,kCAAkC,EACnE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAClC,CAAC;QACN,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,aAAa,CACnB,aAAa,EACb,gBAAgB,EAAE,+BAA+B,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,EAAE,IAAI,EAC7E,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAClC,CAAC;QACN,CAAC;QAED,OAAO,EAAE,CAAC;IACd,CAAC;IAEO,WAAW;QACf,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,WAAW,CAAC;QAC5B,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,GAAG,EAAuB,CAAC;QAEnD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,eAAe,CAAC,EAAE,CAAC;YAC3D,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAE3B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;gBAC3E,SAAS;YACb,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;YACjE,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;YAC3D,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YACnE,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACnC,CAAC;QAED,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAE/B,OAAO,WAAW,CAAC;IACvB,CAAC;CACJ"}

package/dist/platform/security/time.d.ts

@@ -0,0 +1,4 @@
+import type { StoredItem } from "../../storage/types.js";
+/** Membership dates use the same UTC and fractional precision rules as native AML date queries. */
+export declare function effective(record: StoredItem, now: Date): boolean;
+//# sourceMappingURL=time.d.ts.map

package/dist/platform/security/time.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"time.d.ts","sourceRoot":"","sources":["../../../src/platform/security/time.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAGzD,mGAAmG;AACnG,wBAAgB,SAAS,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAMhE"}

package/dist/platform/security/time.js

@@ -0,0 +1,26 @@
+import { dateKey } from "../../queries/date.js";
+import { PlatformError } from "../errors.js";
+/** Membership dates use the same UTC and fractional precision rules as native AML date queries. */
+export function effective(record, now) {
+    const start = instant(record.properties.from_date);
+    const end = instant(record.properties.end_date);
+    const current = BigInt(dateKey(now.toISOString()));
+    return (start === undefined || start <= current) && (end === undefined || current <= end);
+}
+function instant(value) {
+    if (value === undefined || value === null || value === "") {
+        return undefined;
+    }
+    if (typeof value !== "string") {
+        throw new PlatformError("InvalidPermissionDate", "Permission dates must be date text.");
+    }
+    try {
+        return BigInt(dateKey(value));
+    }
+    catch (cause) {
+        throw new PlatformError("InvalidPermissionDate", `Invalid permission date '${value}'.`, {
+            cause,
+        });
+    }
+}
+//# sourceMappingURL=time.js.map

package/dist/platform/security/time.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"time.js","sourceRoot":"","sources":["../../../src/platform/security/time.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAEhD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,mGAAmG;AACnG,MAAM,UAAU,SAAS,CAAC,MAAkB,EAAE,GAAS;IACnD,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAEnD,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,IAAI,GAAG,CAAC,CAAC;AAC9F,CAAC;AAED,SAAS,OAAO,CAAC,KAAmD;IAChE,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QACxD,OAAO,SAAS,CAAC;IACrB,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,aAAa,CAAC,uBAAuB,EAAE,qCAAqC,CAAC,CAAC;IAC5F,CAAC;IAED,IAAI,CAAC;QACD,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,MAAM,IAAI,aAAa,CAAC,uBAAuB,EAAE,4BAA4B,KAAK,IAAI,EAAE;YACpF,KAAK;SACR,CAAC,CAAC;IACP,CAAC;AACL,CAAC"}

package/dist/platform/security/types.d.ts

@@ -0,0 +1,12 @@
+import type { Item } from "../../items/item.js";
+export declare enum AuthorizationMode {
+    Native = "native",
+    Unchecked = "unchecked"
+}
+export interface AuthorizationRequest {
+    readonly kind: "action" | "method" | "transition";
+    readonly name: string;
+    readonly item?: Item;
+}
+export type AuthorizationPolicy = AuthorizationMode | "unchecked" | ((request: AuthorizationRequest) => void | Promise<void>);
+//# sourceMappingURL=types.d.ts.map

package/dist/platform/security/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/platform/security/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAEhD,oBAAY,iBAAiB;IACzB,MAAM,WAAW;IACjB,SAAS,cAAc;CAC1B;AAED,MAAM,WAAW,oBAAoB;IACjC,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,YAAY,CAAC;IAClD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC;CACxB;AAED,MAAM,MAAM,mBAAmB,GACzB,iBAAiB,GACjB,WAAW,GACX,CAAC,CAAC,OAAO,EAAE,oBAAoB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC"}

package/dist/platform/security/types.js

@@ -0,0 +1,6 @@
+export var AuthorizationMode;
+(function (AuthorizationMode) {
+    AuthorizationMode["Native"] = "native";
+    AuthorizationMode["Unchecked"] = "unchecked";
+})(AuthorizationMode || (AuthorizationMode = {}));
+//# sourceMappingURL=types.js.map

package/dist/platform/security/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/platform/security/types.ts"],"names":[],"mappings":"AAEA,MAAM,CAAN,IAAY,iBAGX;AAHD,WAAY,iBAAiB;IACzB,sCAAiB,CAAA;IACjB,4CAAuB,CAAA;AAC3B,CAAC,EAHW,iBAAiB,KAAjB,iBAAiB,QAG5B"}

package/dist/platform/trace.d.ts

@@ -0,0 +1,41 @@
+import type { ExecutionContext, TransactionOutcome } from "../core/types.js";
+import type { SourceLocation } from "../diagnostics/source-location.js";
+import type { ItemPayload } from "../items/item.js";
+import type { MockValue } from "../mocks/types.js";
+import type { StoredItem } from "../storage/types.js";
+export interface SourceDefinition {
+    readonly type: "Method" | "SQL";
+    readonly id: string;
+}
+export interface PlatformTraceEvent {
+    readonly sequence: number;
+    readonly requestId: string;
+    readonly executionId: string;
+    readonly parentExecutionId?: string;
+    readonly kind: "action" | "event" | "method" | "execution" | "result" | "mock" | "mutation" | "seed" | "authorization";
+    readonly name: string;
+    readonly source?: SourceLocation;
+    readonly sourceHash?: string;
+    readonly request?: Readonly<ItemPayload>;
+    readonly result?: Readonly<ItemPayload>;
+    readonly definition?: SourceDefinition;
+    readonly mock?: {
+        readonly definition: string;
+        readonly responseFile?: string;
+        readonly responseHash: string;
+        readonly parameters: Readonly<Record<string, MockValue>>;
+    };
+    readonly before?: StoredItem;
+    readonly after?: StoredItem;
+    readonly outcome?: TransactionOutcome;
+}
+export declare class PlatformTrace {
+    private readonly observe?;
+    private readonly events;
+    private bytes;
+    constructor(observe?: ((event: PlatformTraceEvent) => void) | undefined);
+    record(context: ExecutionContext, event: Omit<PlatformTraceEvent, "sequence" | "requestId" | "executionId" | "outcome">): void;
+    read(outcome: (requestId: string) => TransactionOutcome | undefined): readonly PlatformTraceEvent[];
+    reset(): void;
+}
+//# sourceMappingURL=trace.d.ts.map

package/dist/platform/trace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trace.d.ts","sourceRoot":"","sources":["../../src/platform/trace.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC7E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAGtD,MAAM,WAAW,gBAAgB;IAC7B,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,KAAK,CAAC;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,kBAAkB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,IAAI,EACP,QAAQ,GACR,OAAO,GACP,QAAQ,GACR,WAAW,GACX,QAAQ,GACR,MAAM,GACN,UAAU,GACV,MAAM,GACN,eAAe,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;IACzC,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,gBAAgB,CAAC;IACvC,QAAQ,CAAC,IAAI,CAAC,EAAE;QACZ,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;KAC5D,CAAC;IACF,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,kBAAkB,CAAC;CACzC;AAED,qBAAa,aAAa;IAIV,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IAHrC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA4B;IACnD,OAAO,CAAC,KAAK,CAAK;IAElB,YAA6B,OAAO,CAAC,GAAE,CAAC,KAAK,EAAE,kBAAkB,KAAK,IAAI,aAAA,EAAI;IAE9E,MAAM,CACF,OAAO,EAAE,gBAAgB,EACzB,KAAK,EAAE,IAAI,CAAC,kBAAkB,EAAE,UAAU,GAAG,WAAW,GAAG,aAAa,GAAG,SAAS,CAAC,GACtF,IAAI,CAiCN;IAED,IAAI,CACA,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,kBAAkB,GAAG,SAAS,GAC/D,SAAS,kBAAkB,EAAE,CAW/B;IAED,KAAK,IAAI,IAAI,CAGZ;CACJ"}

package/dist/platform/trace.js

@@ -0,0 +1,46 @@
+import { assertActiveContext } from "../core/context.js";
+import { cloneFrozenData } from "../core/data.js";
+import { traceBytesMax, traceEventsMax } from "../core/limits.js";
+import { PlatformError } from "./errors.js";
+export class PlatformTrace {
+    observe;
+    events = [];
+    bytes = 0;
+    constructor(observe) {
+        this.observe = observe;
+    }
+    record(context, event) {
+        assertActiveContext(context);
+        if (this.events.length >= traceEventsMax) {
+            context.fail(new PlatformError("ProtocolLimit", "The platform trace event limit was reached. Reset the world."));
+        }
+        const recorded = cloneFrozenData({
+            ...event,
+            sequence: this.events.length + 1,
+            requestId: context.requestId,
+            executionId: context.executionId,
+            ...(context.parentExecutionId ? { parentExecutionId: context.parentExecutionId } : {}),
+        });
+        const bytes = JSON.stringify(recorded).length * 3;
+        if (bytes > traceBytesMax - this.bytes) {
+            context.fail(new PlatformError("ProtocolLimit", "The platform trace byte limit was reached. Reset the world."));
+        }
+        this.bytes += bytes;
+        this.events.push(recorded);
+        this.observe?.(recorded);
+    }
+    read(outcome) {
+        return Object.freeze(this.events.map((event) => {
+            const status = outcome(event.requestId);
+            return Object.freeze({
+                ...event,
+                ...(status ? { outcome: status } : {}),
+            });
+        }));
+    }
+    reset() {
+        this.events.length = 0;
+        this.bytes = 0;
+    }
+}
+//# sourceMappingURL=trace.js.map

package/dist/platform/trace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trace.js","sourceRoot":"","sources":["../../src/platform/trace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAMlE,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAuC5C,MAAM,OAAO,aAAa;IAIO,OAAO;IAHnB,MAAM,GAAyB,EAAE,CAAC;IAC3C,KAAK,GAAG,CAAC,CAAC;IAElB,YAA6B,OAA6C;uBAA7C,OAAO;IAAyC,CAAC;IAE9E,MAAM,CACF,OAAyB,EACzB,KAAqF;QAErF,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAE7B,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,cAAc,EAAE,CAAC;YACvC,OAAO,CAAC,IAAI,CACR,IAAI,aAAa,CACb,eAAe,EACf,8DAA8D,CACjE,CACJ,CAAC;QACN,CAAC;QAED,MAAM,QAAQ,GAAG,eAAe,CAAC;YAC7B,GAAG,KAAK;YACR,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;YAChC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzF,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QAElD,IAAI,KAAK,GAAG,aAAa,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;YACrC,OAAO,CAAC,IAAI,CACR,IAAI,aAAa,CACb,eAAe,EACf,6DAA6D,CAChE,CACJ,CAAC;QACN,CAAC;QAED,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;QACpB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3B,IAAI,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAC;IAC7B,CAAC;IAED,IAAI,CACA,OAA8D;QAE9D,OAAO,MAAM,CAAC,MAAM,CAChB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YACtB,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAExC,OAAO,MAAM,CAAC,MAAM,CAAC;gBACjB,GAAG,KAAK;gBACR,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACzC,CAAC,CAAC;QACP,CAAC,CAAC,CACL,CAAC;IACN,CAAC;IAED,KAAK;QACD,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;QACvB,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;IACnB,CAAC;CACJ"}

package/dist/platform/unlocking.d.ts

@@ -0,0 +1,27 @@
+import type { ExecutionContext } from "../core/types.js";
+import { Item } from "../items/item.js";
+import type { SelectQuery } from "../queries/types.js";
+import type { HarnessStorage, ItemTypeDefinition, StoredItem } from "../storage/types.js";
+import type { RunEvents } from "./events/types.js";
+import type { ReferenceCatalog } from "./references/catalog.js";
+import type { PlatformTrace } from "./trace.js";
+/** Internal version/edit cleanup bypasses replacements while retaining native unlock hooks. */
+export declare class ItemUnlocks {
+    private readonly storage;
+    private readonly trace;
+    private readonly events;
+    private readonly owner;
+    private readonly catalog;
+    private readonly select?;
+    constructor(storage: HarnessStorage, trace: PlatformTrace, events: RunEvents, owner: () => string, catalog: ReferenceCatalog, select?: SelectQuery | undefined);
+    unlockVersionSources(definition: ItemTypeDefinition, sources: readonly StoredItem[], context: ExecutionContext, request?: Item): Promise<void>;
+    private enter;
+    private after;
+    private scheduleChildren;
+    private related;
+    private relationshipRows;
+    private relationships;
+    private current;
+    private assertOwned;
+}
+//# sourceMappingURL=unlocking.d.ts.map

package/dist/platform/unlocking.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"unlocking.d.ts","sourceRoot":"","sources":["../../src/platform/unlocking.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAExC,OAAO,KAAK,EAAa,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,KAAK,EAAE,cAAc,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAE1F,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAEnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAwBhD,+FAA+F;AAC/F,qBAAa,WAAW;IAEhB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAN5B,YACqB,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,aAAa,EACpB,MAAM,EAAE,SAAS,EACjB,KAAK,EAAE,MAAM,MAAM,EACnB,OAAO,EAAE,gBAAgB,EACzB,MAAM,CAAC,EAAE,WAAW,YAAA,EACrC;IAEE,oBAAoB,CACtB,UAAU,EAAE,kBAAkB,EAC9B,OAAO,EAAE,SAAS,UAAU,EAAE,EAC9B,OAAO,EAAE,gBAAgB,EACzB,OAAO,CAAC,EAAE,IAAI,GACf,OAAO,CAAC,IAAI,CAAC,CA2Cf;YAEa,KAAK;YA6CL,KAAK;IAYnB,OAAO,CAAC,gBAAgB;IAwBxB,OAAO,CAAC,OAAO;IAoCf,OAAO,CAAC,gBAAgB;IA0BxB,OAAO,CAAC,aAAa;IAkCrB,OAAO,CAAC,OAAO;IAUf,OAAO,CAAC,WAAW;CAWtB"}

package/dist/platform/unlocking.js

@@ -0,0 +1,192 @@
+import { assertActiveContext, spendContext } from "../core/context.js";
+import { dataDepthMax, dataNodesMax } from "../core/limits.js";
+import { Item } from "../items/item.js";
+import { Comparison } from "../queries/types.js";
+import { PlatformError } from "./errors.js";
+import { recordKey } from "./references/catalog.js";
+import { manualVersioning } from "./version-policy.js";
+/** Internal version/edit cleanup bypasses replacements while retaining native unlock hooks. */
+export class ItemUnlocks {
+    storage;
+    trace;
+    events;
+    owner;
+    catalog;
+    select;
+    constructor(storage, trace, events, owner, catalog, select) {
+        this.storage = storage;
+        this.trace = trace;
+        this.events = events;
+        this.owner = owner;
+        this.catalog = catalog;
+        this.select = select;
+    }
+    async unlockVersionSources(definition, sources, context, request) {
+        const records = sources.filter((record) => Boolean(record.properties.locked_by_id));
+        if (records.length === 0) {
+            return;
+        }
+        const outgoing = this.relationships(context);
+        const active = new Set();
+        const event = request?.clone() ?? Item.create(definition.name);
+        delete event.node.attributes.where;
+        delete event.node.attributes.idlist;
+        const pending = [
+            {
+                kind: "enter",
+                batch: { definition, records, event, depth: 0 },
+            },
+        ];
+        let visited = 0;
+        while (pending.length > 0) {
+            const task = pending.pop();
+            if (!task || ++visited > dataNodesMax || pending.length > dataNodesMax) {
+                throw new PlatformError("ProtocolLimit", "Unlocks exceed their graph budget.");
+            }
+            spendContext(context);
+            if (task.kind === "enter") {
+                await this.enter(task.batch, active, context);
+                pending.push({ kind: "after", batch: task.batch });
+                this.scheduleChildren(task.batch, outgoing, pending, context);
+            }
+            else if (task.kind === "related") {
+                const batch = this.related(task, context);
+                if (batch) {
+                    pending.push({ kind: "enter", batch });
+                }
+            }
+            else {
+                await this.after(task.batch, active, context);
+            }
+        }
+    }
+    async enter(batch, active, context) {
+        if (batch.depth > dataDepthMax || active.size + batch.records.length > dataNodesMax) {
+            throw new PlatformError("ProtocolLimit", "Unlock ownership exceeds its depth or size limit.");
+        }
+        for (const record of batch.records) {
+            const key = recordKey(record);
+            if (active.has(key)) {
+                throw new PlatformError("RelationshipCycle", "Unlock ownership contains a cycle.");
+            }
+            active.add(key);
+            this.assertOwned(this.current(record));
+        }
+        for (const record of batch.records) {
+            batch.event.setProperty("id", record.id);
+            await this.events(batch.definition, "onBeforeUnlock", batch.event, true, context);
+        }
+        for (const record of batch.records) {
+            const before = this.current(record);
+            const changes = batch.definition.isVersionable && !manualVersioning(this.storage, batch.definition)
+                ? { locked_by_id: null, new_version: 0 }
+                : { locked_by_id: null };
+            assertActiveContext(context);
+            this.storage.updateItem(batch.definition.name, record.id, changes);
+            this.trace.record(context, {
+                kind: "mutation",
+                name: "unlock",
+                before,
+                after: this.current(record),
+            });
+        }
+    }
+    async after(batch, active, context) {
+        for (const record of batch.records) {
+            batch.event.setProperty("id", record.id);
+            await this.events(batch.definition, "onAfterUnlock", batch.event, true, context);
+            active.delete(recordKey(record));
+        }
+    }
+    scheduleChildren(batch, outgoing, pending, context) {
+        const relationships = outgoing.get(batch.definition.id.toLowerCase()) ?? [];
+        for (const parent of [...batch.records].reverse()) {
+            for (const relationship of [...relationships].reverse()) {
+                spendContext(context);
+                if (pending.length >= dataNodesMax) {
+                    throw new PlatformError("ProtocolLimit", "Unlocks exceed their work queue limit.");
+                }
+                pending.push({ kind: "related", parent, relationship, depth: batch.depth + 1 });
+            }
+        }
+    }
+    related(task, context) {
+        const { relationship, related } = task.relationship;
+        if (!this.catalog.dependent(related)) {
+            return undefined;
+        }
+        const records = new Map();
+        const owner = this.owner().toLowerCase();
+        for (const link of this.relationshipRows(relationship, task.parent.id, context)) {
+            spendContext(context);
+            const id = link.properties.related_id;
+            const record = typeof id === "string" ? this.storage.getItem(related.name, id) : undefined;
+            if (record && String(record.properties.locked_by_id ?? "").toLowerCase() === owner) {
+                records.set(record.id.toLowerCase(), record);
+            }
+        }
+        if (records.size === 0) {
+            return undefined;
+        }
+        return {
+            definition: related,
+            records: [...records.values()],
+            event: Item.create(related.name),
+            depth: task.depth,
+        };
+    }
+    relationshipRows(definition, sourceId, context) {
+        const predicate = {
+            kind: "compare",
+            field: { name: "source_id", column: "source_id", kind: "identifier", path: [] },
+            operator: Comparison.Equal,
+            value: sourceId,
+        };
+        const candidates = this.select
+            ? this.select(definition.name, predicate, (units) => {
+                spendContext(context, units);
+            })
+            : this.storage.listItems(definition.name);
+        return candidates.filter((record) => {
+            spendContext(context);
+            return (String(record.properties.source_id ?? "").toLowerCase() === sourceId.toLowerCase());
+        });
+    }
+    relationships(context) {
+        const definitions = this.storage.listItemTypes();
+        spendContext(context, definitions.length);
+        const types = new Map(definitions.map((definition) => [definition.id.toLowerCase(), definition]));
+        const outgoing = new Map();
+        for (const entry of this.storage.listCatalogEntries("RelationshipType")) {
+            spendContext(context);
+            const source = entry.properties.source_id;
+            const target = entry.properties.related_id;
+            if (typeof source !== "string" || !source || typeof target !== "string" || !target) {
+                continue;
+            }
+            const related = types.get(target.toLowerCase());
+            const relationship = types.get(String(entry.properties.relationship_id).toLowerCase());
+            if (!related || !relationship) {
+                continue;
+            }
+            const links = outgoing.get(source.toLowerCase()) ?? [];
+            links.push({ related, relationship });
+            outgoing.set(source.toLowerCase(), links);
+        }
+        return outgoing;
+    }
+    current(record) {
+        const current = this.storage.getItem(record.type, record.id);
+        if (!current) {
+            throw new PlatformError("MissingItem", "An unlock target disappeared in its event.");
+        }
+        return current;
+    }
+    assertOwned(record) {
+        if (String(record.properties.locked_by_id ?? "").toLowerCase() !==
+            this.owner().toLowerCase()) {
+            throw new PlatformError("LockOwnership", "An internal unlock requires the current User's lock.");
+        }
+    }
+}
+//# sourceMappingURL=unlocking.js.map

package/dist/platform/unlocking.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"unlocking.js","sourceRoot":"","sources":["../../src/platform/unlocking.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAE/D,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAGjD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAGpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAuBvD,+FAA+F;AAC/F,MAAM,OAAO,WAAW;IAEC,OAAO;IACP,KAAK;IACL,MAAM;IACN,KAAK;IACL,OAAO;IACP,MAAM;IAN3B,YACqB,OAAuB,EACvB,KAAoB,EACpB,MAAiB,EACjB,KAAmB,EACnB,OAAyB,EACzB,MAAoB;uBALpB,OAAO;qBACP,KAAK;sBACL,MAAM;qBACN,KAAK;uBACL,OAAO;sBACP,MAAM;IACxB,CAAC;IAEJ,KAAK,CAAC,oBAAoB,CACtB,UAA8B,EAC9B,OAA8B,EAC9B,OAAyB,EACzB,OAAc;QAEd,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;QAEpF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;QACjC,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC/D,OAAO,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;QACnC,OAAO,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QACpC,MAAM,OAAO,GAAiB;YAC1B;gBACI,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE;aAClD;SACJ,CAAC;QACF,IAAI,OAAO,GAAG,CAAC,CAAC;QAEhB,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;YAE3B,IAAI,CAAC,IAAI,IAAI,EAAE,OAAO,GAAG,YAAY,IAAI,OAAO,CAAC,MAAM,GAAG,YAAY,EAAE,CAAC;gBACrE,MAAM,IAAI,aAAa,CAAC,eAAe,EAAE,oCAAoC,CAAC,CAAC;YACnF,CAAC;YAED,YAAY,CAAC,OAAO,CAAC,CAAC;YAEtB,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBACxB,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;gBAC9C,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;gBACnD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;YAClE,CAAC;iBAAM,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBACjC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBAE1C,IAAI,KAAK,EAAE,CAAC;oBACR,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC3C,CAAC;YACL,CAAC;iBAAM,CAAC;gBACJ,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YAClD,CAAC;QACL,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,KAAK,CACf,KAAkB,EAClB,MAAmB,EACnB,OAAyB;QAEzB,IAAI,KAAK,CAAC,KAAK,GAAG,YAAY,IAAI,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,YAAY,EAAE,CAAC;YAClF,MAAM,IAAI,aAAa,CACnB,eAAe,EACf,mDAAmD,CACtD,CAAC;QACN,CAAC;QAED,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YACjC,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;YAE9B,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClB,MAAM,IAAI,aAAa,CAAC,mBAAmB,EAAE,oCAAoC,CAAC,CAAC;YACvF,CAAC;YAED,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAChB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3C,CAAC;QAED,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YACjC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;YACzC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,gBAAgB,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QACtF,CAAC;QAED,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,OAAO,GACT,KAAK,CAAC,UAAU,CAAC,aAAa,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC;gBAC/E,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE;gBACxC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;YACjC,mBAAmB,CAAC,OAAO,CAAC,CAAC;YAC7B,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YACnE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE;gBACvB,IAAI,EAAE,UAAU;gBAChB,IAAI,EAAE,QAAQ;gBACd,MAAM;gBACN,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;aAC9B,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,KAAK,CACf,KAAkB,EAClB,MAAmB,EACnB,OAAyB;QAEzB,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YACjC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;YACzC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,eAAe,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;YACjF,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QACrC,CAAC;IACL,CAAC;IAEO,gBAAgB,CACpB,KAAkB,EAClB,QAA+D,EAC/D,OAAqB,EACrB,OAAyB;QAEzB,MAAM,aAAa,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;QAE5E,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YAChD,KAAK,MAAM,YAAY,IAAI,CAAC,GAAG,aAAa,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;gBACtD,YAAY,CAAC,OAAO,CAAC,CAAC;gBAEtB,IAAI,OAAO,CAAC,MAAM,IAAI,YAAY,EAAE,CAAC;oBACjC,MAAM,IAAI,aAAa,CACnB,eAAe,EACf,wCAAwC,CAC3C,CAAC;gBACN,CAAC;gBAED,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;YACpF,CAAC;QACL,CAAC;IACL,CAAC;IAEO,OAAO,CACX,IAA8C,EAC9C,OAAyB;QAEzB,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC;QAEpD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YACnC,OAAO,SAAS,CAAC;QACrB,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,GAAG,EAAsB,CAAC;QAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC;QAEzC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,gBAAgB,CAAC,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC;YAC9E,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,MAAM,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;YACtC,MAAM,MAAM,GACR,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAEhF,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,EAAE,CAAC;gBACjF,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,CAAC;YACjD,CAAC;QACL,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACrB,OAAO,SAAS,CAAC;QACrB,CAAC;QAED,OAAO;YACH,UAAU,EAAE,OAAO;YACnB,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;YAC9B,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;YAChC,KAAK,EAAE,IAAI,CAAC,KAAK;SACpB,CAAC;IACN,CAAC;IAEO,gBAAgB,CACpB,UAA8B,EAC9B,QAAgB,EAChB,OAAyB;QAEzB,MAAM,SAAS,GAAc;YACzB,IAAI,EAAE,SAAS;YACf,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,EAAE;YAC/E,QAAQ,EAAE,UAAU,CAAC,KAAK;YAC1B,KAAK,EAAE,QAAQ;SAClB,CAAC;QACF,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM;YAC1B,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC9C,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACjC,CAAC,CAAC;YACJ,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAE9C,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE;YAChC,YAAY,CAAC,OAAO,CAAC,CAAC;YAEtB,OAAO,CACH,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,WAAW,EAAE,CACrF,CAAC;QACN,CAAC,CAAC,CAAC;IACP,CAAC;IAEO,aAAa,CACjB,OAAyB;QAEzB,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QACjD,YAAY,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,IAAI,GAAG,CACjB,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,WAAW,EAAE,EAAE,UAAU,CAAC,CAAC,CAC7E,CAAC;QACF,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAmC,CAAC;QAE5D,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACtE,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC;YAC1C,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC;YAE3C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;gBACjF,SAAS;YACb,CAAC;YAED,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;YAChD,MAAM,YAAY,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YAEvF,IAAI,CAAC,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC;gBAC5B,SAAS;YACb,CAAC;YAED,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;YACvD,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;YACtC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,KAAK,CAAC,CAAC;QAC9C,CAAC;QAED,OAAO,QAAQ,CAAC;IACpB,CAAC;IAEO,OAAO,CAAC,MAAkB;QAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAE7D,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,MAAM,IAAI,aAAa,CAAC,aAAa,EAAE,4CAA4C,CAAC,CAAC;QACzF,CAAC;QAED,OAAO,OAAO,CAAC;IACnB,CAAC;IAEO,WAAW,CAAC,MAAkB;QAClC,IACI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;YAC1D,IAAI,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,EAC5B,CAAC;YACC,MAAM,IAAI,aAAa,CACnB,eAAe,EACf,sDAAsD,CACzD,CAAC;QACN,CAAC;IACL,CAAC;CACJ"}