@ketvietlab/ketjs 0.1.2 → 0.1.3

package/dist/server/ratelimit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ratelimit.d.ts","sourceRoot":"","sources":["../../../../../packages/ketjs/src/server/ratelimit.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAA;AAkB1C;;;;;;;GAOG;AACH,MAAM,MAAM,UAAU,GAAG;IACvB,kEAAkE;IAClE,MAAM,EAAE,MAAM,CAAA;IACd,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,MAAM,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,EAAE,EAAE,OAAO,CAAA;IACX,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAA;IACjB,kEAAkE;IAClE,YAAY,EAAE,MAAM,CAAA;CACrB,CAAA;AAKD;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,UAAU,EAClB,CAAC,GAAE;IAAE,GAAG,CAAC,EAAE,IAAI,CAAA;CAAO,GACrB,OAAO,CAAC,WAAW,CAAC,CAoDtB;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,OAAO,EAChB,CAAC,GAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,IAAI,CAAA;CAAO,GAC3C,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAQ9B"}

package/dist/server/ratelimit.js

@@ -0,0 +1,102 @@
+// A durable ceiling on how often something may be done.
+//
+// Durable, because the alternative is a Map in one process: two replicas then
+// enforce two independent limits and the ceiling is whatever the load balancer
+// decides. The state lives in the tenant's own database for the same reason every
+// other piece of framework state does — a tenant's limits are that tenant's.
+//
+// What this is not: protection from volume. Every check costs a database round
+// trip, so pointing it at all traffic makes an attacker's job easier rather than
+// harder. It exists to bound what one identified caller may repeat — sign-in
+// attempts, token refreshes, an expensive report — and a volumetric flood belongs
+// to whatever sits in front of the process.
+//
+// Fixed window rather than a token bucket, because `limit per windowMs` is what a
+// person means and a bucket quietly changes it. The cost is stated: a caller can
+// spend a full allowance at the end of one window and another at the start of the
+// next, so the real worst case across a boundary is twice the limit.
+import { createHash } from 'node:crypto';
+const DDL = `
+CREATE TABLE IF NOT EXISTS ket_rate (
+  id           TEXT PRIMARY KEY,
+  action       TEXT NOT NULL,
+  window_start TEXT NOT NULL,
+  count        INTEGER NOT NULL
+)`;
+const prepared = new WeakSet();
+async function prepare(adapter) {
+    if (prepared.has(adapter))
+        return;
+    await adapter.run(DDL, []);
+    prepared.add(adapter);
+}
+const idOf = (action, key) => createHash('sha256').update(`ketrate\n${action}\n${key}`).digest('hex').slice(0, 32);
+/**
+ * Spend one slot, or refuse.
+ *
+ * The read-then-compare-and-set is retried because losing the race is the normal
+ * case under exactly the load this exists for: every replica checking the same
+ * counter at once is not a fault, it is Tuesday. Running out of attempts refuses
+ * rather than allows — under contention the safe answer is the closed one.
+ */
+export async function claimRateSlot(adapter, policy, o = {}) {
+    const limit = Math.max(1, Math.floor(policy.limit));
+    const windowMs = Math.max(1, Math.floor(policy.windowMs));
+    const now = o.now ?? new Date();
+    const action = policy.action.slice(0, 120);
+    const id = idOf(action, policy.key);
+    await prepare(adapter);
+    const pg = adapter.name === 'postgres';
+    const p = (n) => (pg ? `$${n}` : '?');
+    const refused = (startedAt) => ({
+        ok: false,
+        remaining: 0,
+        retryAfterMs: Math.max(1, startedAt + windowMs - now.getTime()),
+    });
+    for (let attempt = 0; attempt < 8; attempt += 1) {
+        const rows = await adapter.all(`SELECT window_start, count FROM ket_rate WHERE id = ${p(1)}`, [id]);
+        const held = rows[0];
+        if (!held) {
+            const inserted = await adapter.run(`INSERT INTO ket_rate (id, action, window_start, count) VALUES (${p(1)}, ${p(2)}, ${p(3)}, 1)
+         ON CONFLICT DO NOTHING`, [id, action, now.toISOString()]);
+            if (inserted.changes > 0)
+                return { ok: true, remaining: limit - 1, retryAfterMs: 0 };
+            continue;
+        }
+        const startedAt = Date.parse(String(held.window_start));
+        const count = Number(held.count);
+        const inWindow = Number.isFinite(startedAt) && now.getTime() - startedAt < windowMs;
+        if (inWindow && count >= limit)
+            return refused(startedAt);
+        const nextStart = inWindow ? String(held.window_start) : now.toISOString();
+        const nextCount = inWindow ? count + 1 : 1;
+        const moved = await adapter.run(`UPDATE ket_rate SET window_start = ${p(1)}, count = ${p(2)}
+       WHERE id = ${p(3)} AND window_start = ${p(4)} AND count = ${p(5)}`, [nextStart, nextCount, id, String(held.window_start), count]);
+        if (moved.changes > 0) {
+            return { ok: true, remaining: Math.max(0, limit - nextCount), retryAfterMs: 0 };
+        }
+    }
+    // Eight lost races means the counter is genuinely hot, which is the situation a
+    // limit is for. Refusing is the honest answer; allowing would make contention a
+    // way through it. The wait offered is short, though: losing a race is this
+    // process's problem, and charging the caller a full window for it would be
+    // punishing them for somebody else's traffic.
+    return { ok: false, remaining: 0, retryAfterMs: 1_000 };
+}
+/**
+ * Drop counters nobody has touched for a while.
+ *
+ * A row for an active key is reused rather than added to, so growth comes only
+ * from keys never seen again — a one-off address, a deleted account. Left alone
+ * that is unbounded, which is why this exists and why the worker calls it.
+ */
+export async function pruneRateSlots(adapter, o = {}) {
+    const now = o.now ?? new Date();
+    const olderThanMs = Math.max(60_000, o.olderThanMs ?? 24 * 3_600_000);
+    await prepare(adapter);
+    const pg = adapter.name === 'postgres';
+    const cutoff = new Date(now.getTime() - olderThanMs).toISOString();
+    const removed = await adapter.run(`DELETE FROM ket_rate WHERE window_start < ${pg ? '$1' : '?'}`, [cutoff]);
+    return { removed: removed.changes };
+}
+//# sourceMappingURL=ratelimit.js.map

package/dist/server/ratelimit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ratelimit.js","sourceRoot":"","sources":["../../../../../../packages/ketjs/src/server/ratelimit.ts"],"names":[],"mappings":"AAAA,wDAAwD;AACxD,EAAE;AACF,8EAA8E;AAC9E,+EAA+E;AAC/E,kFAAkF;AAClF,6EAA6E;AAC7E,EAAE;AACF,+EAA+E;AAC/E,iFAAiF;AACjF,6EAA6E;AAC7E,kFAAkF;AAClF,4CAA4C;AAC5C,EAAE;AACF,kFAAkF;AAClF,iFAAiF;AACjF,kFAAkF;AAClF,qEAAqE;AAErE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAGxC,MAAM,GAAG,GAAG;;;;;;EAMV,CAAA;AAEF,MAAM,QAAQ,GAAG,IAAI,OAAO,EAAW,CAAA;AAEvC,KAAK,UAAU,OAAO,CAAC,OAAgB;IACrC,IAAI,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAM;IACjC,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;IAC1B,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;AACvB,CAAC;AA0BD,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,GAAW,EAAU,EAAE,CACnD,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,MAAM,KAAK,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;AAEtF;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAgB,EAChB,MAAkB,EAClB,CAAC,GAAmB,EAAE;IAEtB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;IACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA;IACzD,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAA;IAC/B,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAC1C,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAA;IACnC,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;IAEtB,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,KAAK,UAAU,CAAA;IACtC,MAAM,CAAC,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;IAC7C,MAAM,OAAO,GAAG,CAAC,SAAiB,EAAe,EAAE,CAAC,CAAC;QACnD,EAAE,EAAE,KAAK;QACT,SAAS,EAAE,CAAC;QACZ,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,GAAG,QAAQ,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;KAChE,CAAC,CAAA;IAEF,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,uDAAuD,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;QACnG,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAA0D,CAAA;QAE7E,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC,kEAAkE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gCAChE,EACxB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAChC,CAAA;YACD,IAAI,QAAQ,CAAC,OAAO,GAAG,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,GAAG,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,CAAA;YACpF,SAAQ;QACV,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAA;QACvD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAChC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,SAAS,GAAG,QAAQ,CAAA;QACnF,IAAI,QAAQ,IAAI,KAAK,IAAI,KAAK;YAAE,OAAO,OAAO,CAAC,SAAS,CAAC,CAAA;QAEzD,MAAM,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,CAAA;QAC1E,MAAM,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAC1C,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAC7B,sCAAsC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;oBAC7C,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,EACnE,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,CAC7D,CAAA;QACD,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,SAAS,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,CAAA;QACjF,CAAC;IACH,CAAC;IACD,gFAAgF;IAChF,gFAAgF;IAChF,2EAA2E;IAC3E,2EAA2E;IAC3E,8CAA8C;IAC9C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,CAAA;AACzD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAgB,EAChB,CAAC,GAAyC,EAAE;IAE5C,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAA;IAC/B,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,WAAW,IAAI,EAAE,GAAG,SAAS,CAAC,CAAA;IACrE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;IACtB,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,KAAK,UAAU,CAAA;IACtC,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,WAAW,CAAC,CAAC,WAAW,EAAE,CAAA;IAClE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,6CAA6C,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAA;IAC3G,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAA;AACrC,CAAC"}

package/dist/server/respond.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"respond.d.ts","sourceRoot":"","sources":["../../../../../packages/ketjs/src/server/respond.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAC5D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAEhD,qFAAqF;AACrF,MAAM,MAAM,IAAI,GAAG,cAAc,CAAA;AACjC,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,UAAU,GAAG,aAAa,CAAC,UAAU,CAAC,CAAA;AAC1E,eAAO,MAAM,iBAAiB,qBAAqB,CAAA;AACnD,eAAO,MAAM,kBAAkB,gBAAgB,CAAA;AAC/C,eAAO,MAAM,eAAe,gCAAgC,CAAA;AAE5D,OAAO,CAAC,MAAM,QAAQ,EAAE,OAAO,MAAM,CAAA;AACrC,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,YAAY,CAAA;IAClB,kEAAkE;IAClE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC,QAAQ,CAAC,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAA;CAC1B,CAAA;AAKD;;;GAGG;AACH,wBAAgB,IAAI,CAAC,CAAC,EAAE;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,WAAW,CAEpE;AAED,mEAAmE;AACnE,wBAAgB,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,WAAW,CAE5F;AAED,+EAA+E;AAC/E,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,SAAS,CAAC,GAAG,OAAO,CAElF;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,SAAS,CAAC,EACrC,CAAC,EAAE;IACD,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,MAAM,IAAI,CAAA;IACpB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,CAAA;IACjC,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,GACA,WAAW,CAeb;AAED,wBAAgB,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,WAAW,CAE7E;AAED,wBAAgB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,GAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,WAAW,CAE1F;AASD,kGAAkG;AAClG,wBAAgB,KAAK,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,WAAW,CAEzF;AAED,uFAAuF;AACvF,wBAAgB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,WAAW,CAE3G;AAED;;;;;;GAMG;AACH,wBAAgB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,GAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,WAAW,CAEzF;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,WAAW,CAE7F;AAED;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,CAAC,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,IAAI,CAAA;CAAE,GAAG,IAAI,CAK3F"}
+{"version":3,"file":"respond.d.ts","sourceRoot":"","sources":["../../../../../packages/ketjs/src/server/respond.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAC5D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAEhD,qFAAqF;AACrF,MAAM,MAAM,IAAI,GAAG,cAAc,CAAA;AACjC,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,UAAU,GAAG,aAAa,CAAC,UAAU,CAAC,CAAA;AAC1E,eAAO,MAAM,iBAAiB,qBAAqB,CAAA;AACnD,eAAO,MAAM,kBAAkB,gBAAgB,CAAA;AAC/C,eAAO,MAAM,eAAe,gCAAgC,CAAA;AAE5D,OAAO,CAAC,MAAM,QAAQ,EAAE,OAAO,MAAM,CAAA;AACrC,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,YAAY,CAAA;IAClB,kEAAkE;IAClE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC,QAAQ,CAAC,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAA;CAC1B,CAAA;AAKD;;;GAGG;AACH,wBAAgB,IAAI,CAAC,CAAC,EAAE;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,WAAW,CAEpE;AAED,mEAAmE;AACnE,wBAAgB,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,WAAW,CAE5F;AAED,+EAA+E;AAC/E,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,SAAS,CAAC,GAAG,OAAO,CAElF;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,SAAS,CAAC,EACrC,CAAC,EAAE;IACD,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,MAAM,IAAI,CAAA;IACpB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,CAAA;IACjC,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,GACA,WAAW,CAeb;AAED,wBAAgB,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,WAAW,CAE7E;AAED,wBAAgB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,GAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,WAAW,CAE1F;AASD,kGAAkG;AAClG,wBAAgB,KAAK,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,WAAW,CAEzF;AAED,uFAAuF;AACvF,wBAAgB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,WAAW,CAE3G;AAED;;;;;;GAMG;AACH,wBAAgB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,GAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,WAAW,CAEzF;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,WAAW,CAE7F;AAkBD;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,CAAC,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,IAAI,CAAA;CAAE,GAAG,IAAI,CAK3F"}

package/dist/server/respond.js

@@ -87,6 +87,21 @@ export function raw(body, o = {}) {
 export function withHeaders(result, headers) {
     return { ...result, headers: { ...result.headers, ...headers } };
 }
+/**
+ * The cascade order, declared before the first stylesheet can define a layer.
+ *
+ * `@layer a, b, c;` is what fixes the order; where the layers are then written no
+ * longer matters. Without it the order is first-appearance across whatever
+ * stylesheets happened to load, so `ket.theme` could outrank `ket.app` purely
+ * because a theme's file came second — and `ket.user`, the layer that is supposed
+ * to have the last word, had no guarantee at all. It was documented in three
+ * places and emitted in none.
+ */
+// Written out rather than interpolated: a hole would put hydration markers
+// (`<!--k[-->`) inside the stylesheet, and CSS treats `<!--` as a token it then has
+// to recover from — which can swallow the statement it is here to make. The
+// literal is kept honest by a test against LAYER_ORDER_CSS.
+const layerOrder = html `<style>@layer ket.reset, ket.theme, ket.app, ket.user;</style>`;
 /**
  * The document every screen sits in, as markup rather than as a string.
  *
@@ -94,6 +109,6 @@ export function withHeaders(result, headers) {
  * where the old concatenated shell put whatever the query string said.
  */
 export function document(o) {
-    return html `<html lang=${o.lang}><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">${when(o.title !== undefined, () => html `<title>${o.title}</title>`)}${o.head ?? ''}</head><body>${o.body}</body></html>`;
+    return html `<html lang=${o.lang}><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">${when(o.title !== undefined, () => html `<title>${o.title}</title>`)}${layerOrder}${o.head ?? ''}</head><body>${o.body}</body></html>`;
 }
 //# sourceMappingURL=respond.js.map

package/dist/server/respond.js.map

@@ -1 +1 @@
-{"version":3,"file":"respond.js","sourceRoot":"","sources":["../../../../../../packages/ketjs/src/server/respond.ts"],"names":[],"mappings":"AAAA,qCAAqC;AACrC,EAAE;AACF,kFAAkF;AAClF,mFAAmF;AACnF,oFAAoF;AACpF,gFAAgF;AAChF,EAAE;AACF,iFAAiF;AACjF,gFAAgF;AAChF,wEAAwE;AACxE,kFAAkF;AAClF,kFAAkF;AAClF,oFAAoF;AACpF,8DAA8D;AAE9D,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAA;AAOzE,MAAM,CAAC,MAAM,iBAAiB,GAAG,kBAAkB,CAAA;AACnD,MAAM,CAAC,MAAM,kBAAkB,GAAG,aAAa,CAAA;AAC/C,MAAM,CAAC,MAAM,eAAe,GAAG,6BAA6B,CAAA;AAY5D,MAAM,IAAI,GAAG,CAAC,IAAkB,EAAE,IAAY,EAAE,MAAe,EAAe,EAAE,CAC9E,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAgB,CAAA;AAE9E;;;GAGG;AACH,MAAM,UAAU,IAAI,CAAC,CAAkC;IACrD,OAAO,IAAI,CAAC,iBAAiB,GAAG,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAA;AAChF,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,QAAQ,CAAC,IAAU,EAAE,CAAC,GAAuC,EAAE;IAC7E,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAA;AACpE,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,mBAAmB,CAAC,GAAqC;IACvE,OAAO,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,KAAK,kBAAkB,CAAA;AAC9D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,GAAqC,EACrC,CAKC;IAED,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAA;IACzC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC;QAAE,OAAO,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,CAAA;IAEvG,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;IACvC,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,oCAAoC,CAAC,IAAI,CAAC,IAAI,CAAC;YAClD,MAAM,IAAI,SAAS,CAAC,oBAAoB,IAAI,mCAAmC,CAAC,CAAA;IACpF,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAA,6BAA6B,CAAC,CAAC,KAAK,IAAI,IAAI,CAC3D,OAAO,EACP,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,EAChB,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,IAAI,CAAA,2BAA2B,IAAI,IAAI,MAAM,EAAE,aAAa,CACjF,kBAAkB,CAAA;IACnB,OAAO,WAAW,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAA;AACjF,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,KAAc,EAAE,CAAC,GAAwB,EAAE;IAC9D,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAA;AAC3E,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,IAAY,EAAE,CAAC,GAAuC,EAAE;IAC3E,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAA;AACrD,CAAC;AAED,qGAAqG;AACrG,MAAM,MAAM,GAAG,CAAC,IAAY,EAAU,EAAE;IACtC,IAAI,+DAA+D,CAAC,IAAI,CAAC,IAAI,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,sCAAsC,IAAI,oCAAoC,CAAC,CAAA;IACjG,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAED,kGAAkG;AAClG,MAAM,UAAU,KAAK,CAAC,IAAgB,EAAE,CAAoC;IAC1E,OAAO,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAA;AAC7C,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,QAAQ,CAAC,IAA+B,EAAE,CAAoC;IAC5F,OAAO,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAA;AAC7C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,CAAC,GAAuC,EAAE;IAC1E,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAA;AACpD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,MAAmB,EAAE,OAA+B;IAC9E,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,GAAG,OAAO,EAAE,EAAiB,CAAA;AACjF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,CAA4D;IACnF,OAAO,IAAI,CAAA,cAAc,CAAC,CAAC,IAAI,oGAAoG,IAAI,CACrI,CAAC,CAAC,KAAK,KAAK,SAAS,EACrB,GAAG,EAAE,CAAC,IAAI,CAAA,UAAU,CAAC,CAAC,KAAK,UAAU,CACtC,GAAG,CAAC,CAAC,IAAI,IAAI,EAAE,gBAAgB,CAAC,CAAC,IAAI,gBAAgB,CAAA;AACxD,CAAC"}
+{"version":3,"file":"respond.js","sourceRoot":"","sources":["../../../../../../packages/ketjs/src/server/respond.ts"],"names":[],"mappings":"AAAA,qCAAqC;AACrC,EAAE;AACF,kFAAkF;AAClF,mFAAmF;AACnF,oFAAoF;AACpF,gFAAgF;AAChF,EAAE;AACF,iFAAiF;AACjF,gFAAgF;AAChF,wEAAwE;AACxE,kFAAkF;AAClF,kFAAkF;AAClF,oFAAoF;AACpF,8DAA8D;AAE9D,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAA;AAOzE,MAAM,CAAC,MAAM,iBAAiB,GAAG,kBAAkB,CAAA;AACnD,MAAM,CAAC,MAAM,kBAAkB,GAAG,aAAa,CAAA;AAC/C,MAAM,CAAC,MAAM,eAAe,GAAG,6BAA6B,CAAA;AAY5D,MAAM,IAAI,GAAG,CAAC,IAAkB,EAAE,IAAY,EAAE,MAAe,EAAe,EAAE,CAC9E,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAgB,CAAA;AAE9E;;;GAGG;AACH,MAAM,UAAU,IAAI,CAAC,CAAkC;IACrD,OAAO,IAAI,CAAC,iBAAiB,GAAG,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAA;AAChF,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,QAAQ,CAAC,IAAU,EAAE,CAAC,GAAuC,EAAE;IAC7E,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAA;AACpE,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,mBAAmB,CAAC,GAAqC;IACvE,OAAO,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,KAAK,kBAAkB,CAAA;AAC9D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,GAAqC,EACrC,CAKC;IAED,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAA;IACzC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC;QAAE,OAAO,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,CAAA;IAEvG,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;IACvC,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,oCAAoC,CAAC,IAAI,CAAC,IAAI,CAAC;YAClD,MAAM,IAAI,SAAS,CAAC,oBAAoB,IAAI,mCAAmC,CAAC,CAAA;IACpF,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAA,6BAA6B,CAAC,CAAC,KAAK,IAAI,IAAI,CAC3D,OAAO,EACP,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,EAChB,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,IAAI,CAAA,2BAA2B,IAAI,IAAI,MAAM,EAAE,aAAa,CACjF,kBAAkB,CAAA;IACnB,OAAO,WAAW,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAA;AACjF,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,KAAc,EAAE,CAAC,GAAwB,EAAE;IAC9D,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAA;AAC3E,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,IAAY,EAAE,CAAC,GAAuC,EAAE;IAC3E,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAA;AACrD,CAAC;AAED,qGAAqG;AACrG,MAAM,MAAM,GAAG,CAAC,IAAY,EAAU,EAAE;IACtC,IAAI,+DAA+D,CAAC,IAAI,CAAC,IAAI,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,sCAAsC,IAAI,oCAAoC,CAAC,CAAA;IACjG,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAED,kGAAkG;AAClG,MAAM,UAAU,KAAK,CAAC,IAAgB,EAAE,CAAoC;IAC1E,OAAO,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAA;AAC7C,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,QAAQ,CAAC,IAA+B,EAAE,CAAoC;IAC5F,OAAO,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAA;AAC7C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,CAAC,GAAuC,EAAE;IAC1E,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAA;AACpD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,MAAmB,EAAE,OAA+B;IAC9E,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,GAAG,OAAO,EAAE,EAAiB,CAAA;AACjF,CAAC;AAED;;;;;;;;;GASG;AACH,2EAA2E;AAC3E,oFAAoF;AACpF,4EAA4E;AAC5E,4DAA4D;AAC5D,MAAM,UAAU,GAAG,IAAI,CAAA,gEAAgE,CAAA;AAEvF;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,CAA4D;IACnF,OAAO,IAAI,CAAA,cAAc,CAAC,CAAC,IAAI,oGAAoG,IAAI,CACrI,CAAC,CAAC,KAAK,KAAK,SAAS,EACrB,GAAG,EAAE,CAAC,IAAI,CAAA,UAAU,CAAC,CAAC,KAAK,UAAU,CACtC,GAAG,UAAU,GAAG,CAAC,CAAC,IAAI,IAAI,EAAE,gBAAgB,CAAC,CAAC,IAAI,gBAAgB,CAAA;AACrE,CAAC"}

package/dist/server/runtime.d.ts

@@ -1,14 +1,29 @@
-import type { AppSpec } from '../kernel/workspace.ts';
+import type { LogDriver, LogProcess, Logger, OpenLog } from './log/index.ts';
+import type { DeploymentSpec } from '../kernel/workspace.ts';
 import type { KetModule, Manifest } from '../types.ts';
 import type { RuntimeConfig } from './config.ts';
 export type BootedRuntime = {
-    spec: AppSpec;
+    spec: DeploymentSpec;
     config: RuntimeConfig;
     modules: KetModule[];
     manifest: Manifest;
+    /** The sink, already level-filtered and redacted. Closed last on shutdown. */
+    log: LogDriver;
+    /** Carries this deployment and process role; narrow it with `child`. */
+    logger: Logger;
 };
-export declare function bootRuntime(spec: AppSpec, options?: {
+export declare function bootRuntime(spec: DeploymentSpec, options?: {
     env?: Record<string, string | undefined>;
     port?: number;
+    /** Which process role this is. A low-cardinality field on every record. */
+    role?: LogProcess;
+    /**
+     * Override the deployment's sink for this process.
+     *
+     * A host that boots a deployment it did not author — a test harness, an
+     * embedding process — can redirect records without editing the spec, the same
+     * way it already overrides the port.
+     */
+    openLog?: OpenLog;
 }): Promise<BootedRuntime>;
 //# sourceMappingURL=runtime.d.ts.map

package/dist/server/runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../../../../packages/ketjs/src/server/runtime.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAA;AACrD,OAAO,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AACtD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAEhD,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,OAAO,CAAA;IACb,MAAM,EAAE,aAAa,CAAA;IACrB,OAAO,EAAE,SAAS,EAAE,CAAA;IACpB,QAAQ,EAAE,QAAQ,CAAA;CACnB,CAAA;AAED,wBAAsB,WAAW,CAC/B,IAAI,EAAE,OAAO,EACb,OAAO,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAO,GACxE,OAAO,CAAC,aAAa,CAAC,CAexB"}
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../../../../packages/ketjs/src/server/runtime.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAA;AAC5E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAC5D,OAAO,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AACtD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAEhD,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,cAAc,CAAA;IACpB,MAAM,EAAE,aAAa,CAAA;IACrB,OAAO,EAAE,SAAS,EAAE,CAAA;IACpB,QAAQ,EAAE,QAAQ,CAAA;IAClB,8EAA8E;IAC9E,GAAG,EAAE,SAAS,CAAA;IACd,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAA;CACf,CAAA;AAED,wBAAsB,WAAW,CAC/B,IAAI,EAAE,cAAc,EACpB,OAAO,GAAE;IACP,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;IACxC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,2EAA2E;IAC3E,IAAI,CAAC,EAAE,UAAU,CAAA;IACjB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;CACb,GACL,OAAO,CAAC,aAAa,CAAC,CA+CxB"}

package/dist/server/runtime.js

@@ -1,10 +1,12 @@
 // The common process role foundation. HTTP and workers load exactly the same
 // configuration, build artifact, module graph and executable registries; only
 // their outer loops differ.
+import { fingerprintAssets } from './assets.js';
 import { compose } from '../kernel/compose.js';
 import { readConfig } from './config.js';
 import { registerFunctions } from './fn.js';
 import { registerJobs } from './jobs.js';
+import { consoleLog, createLogger, isolatedLog, leveledLog, logFromConfig, redactLog } from './log/index.js';
 export async function bootRuntime(spec, options = {}) {
     const config = readConfig(options.env ?? process.env, {
         sqliteFile: `.ket/${spec.name}.db`,
@@ -13,13 +15,41 @@ export async function bootRuntime(spec, options = {}) {
     });
     if (options.port !== undefined)
         config.port = options.port;
+    // Redaction and isolation are applied here rather than left to whoever opened the
+    // driver, so a deployment's own sink is held to the same rules as the built-in
+    // ones. Isolation sits innermost, against the sink itself: a record is emitted
+    // after a function has already committed and after an idempotency key has been
+    // marked done, so a throw from a sink would report a failure for work that
+    // succeeded. "A sink never breaks the work it describes" has to be structural
+    // rather than something every deployment remembers. The level filter is
+    // outermost, so a record nobody will keep is never redacted at all.
+    const opened = await (options.openLog ?? spec.serve?.openLog ?? logFromConfig)(config);
+    const log = leveledLog(redactLog(isolatedLog(opened, consoleLog())), config.logLevel);
+    const logger = createLogger(log, { deployment: spec.name, process: options.role ?? 'http' });
     const modules = [...spec.modules, ...(spec.theme ? [spec.theme] : []), ...(spec.themes ?? [])];
     const manifest = compose(modules, {
-        appRequires: spec.requires ?? [],
+        requiredRegions: spec.requires ?? [],
         headless: spec.headless ?? false,
+        requirePermissionCoverage: spec.permissions?.requireCoverage,
+        modulePermissionDeclarations: spec.permissions?.modules,
+        roleTemplates: spec.permissions?.roleTemplates,
     });
+    // Asset URLs carry their file's digest from here on, so a browser and
+    // anything in front of it may keep them until the bytes change.
+    await fingerprintAssets(manifest);
     registerFunctions(modules);
     registerJobs(modules);
-    return { spec, config, modules, manifest };
+    logger.info('boot', {
+        driver: opened.name,
+        level: config.logLevel,
+        modules: modules.length,
+        functions: Object.keys(manifest.functions).length,
+        jobs: Object.keys(manifest.jobs).length,
+        // False means correlation is hashed with a bare digest instead of a keyed one,
+        // so a low-entropy command key is guessable and the web and worker processes
+        // cannot derive the same trace for one request.
+        traceKeyed: Boolean(config.secret),
+    });
+    return { spec, config, modules, manifest, log, logger };
 }
 //# sourceMappingURL=runtime.js.map

package/dist/server/runtime.js.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../../../../../packages/ketjs/src/server/runtime.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,8EAA8E;AAC9E,4BAA4B;AAE5B,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAA;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAYxC,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,IAAa,EACb,OAAO,GAAgE,EAAE;IAEzE,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE;QACpD,UAAU,EAAE,QAAQ,IAAI,CAAC,IAAI,KAAK;QAClC,GAAG,IAAI,CAAC,KAAK,EAAE,QAAQ;QACvB,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;KAC9D,CAAC,CAAA;IACF,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;QAAE,MAAM,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;IAC1D,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAA;IAC9F,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,EAAE;QAChC,WAAW,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE;QAChC,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,KAAK;KACjC,CAAC,CAAA;IACF,iBAAiB,CAAC,OAAO,CAAC,CAAA;IAC1B,YAAY,CAAC,OAAO,CAAC,CAAA;IACrB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAA;AAC5C,CAAC"}
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../../../../../packages/ketjs/src/server/runtime.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,8EAA8E;AAC9E,4BAA4B;AAE5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAC/C,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAA;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AACxC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAiB5G,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,IAAoB,EACpB,OAAO,GAaH,EAAE;IAEN,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE;QACpD,UAAU,EAAE,QAAQ,IAAI,CAAC,IAAI,KAAK;QAClC,GAAG,IAAI,CAAC,KAAK,EAAE,QAAQ;QACvB,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;KAC9D,CAAC,CAAA;IACF,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;QAAE,MAAM,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;IAE1D,kFAAkF;IAClF,+EAA+E;IAC/E,+EAA+E;IAC/E,+EAA+E;IAC/E,2EAA2E;IAC3E,8EAA8E;IAC9E,wEAAwE;IACxE,oEAAoE;IACpE,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,EAAE,OAAO,IAAI,aAAa,CAAC,CAAC,MAAM,CAAC,CAAA;IACtF,MAAM,GAAG,GAAG,UAAU,CAAC,SAAS,CAAC,WAAW,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAA;IACrF,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,IAAI,MAAM,EAAE,CAAC,CAAA;IAE5F,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAA;IAC9F,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,EAAE;QAChC,eAAe,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE;QACpC,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,KAAK;QAChC,yBAAyB,EAAE,IAAI,CAAC,WAAW,EAAE,eAAe;QAC5D,4BAA4B,EAAE,IAAI,CAAC,WAAW,EAAE,OAAO;QACvD,aAAa,EAAE,IAAI,CAAC,WAAW,EAAE,aAAa;KAC/C,CAAC,CAAA;IACF,sEAAsE;IACtE,gEAAgE;IAChE,MAAM,iBAAiB,CAAC,QAAQ,CAAC,CAAA;IACjC,iBAAiB,CAAC,OAAO,CAAC,CAAA;IAC1B,YAAY,CAAC,OAAO,CAAC,CAAA;IAErB,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE;QAClB,MAAM,EAAE,MAAM,CAAC,IAAI;QACnB,KAAK,EAAE,MAAM,CAAC,QAAQ;QACtB,OAAO,EAAE,OAAO,CAAC,MAAM;QACvB,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,MAAM;QACjD,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM;QACvC,+EAA+E;QAC/E,6EAA6E;QAC7E,gDAAgD;QAChD,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;KACnC,CAAC,CAAA;IAEF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,CAAA;AACzD,CAAC"}

package/dist/server/schedule.d.ts

@@ -0,0 +1,18 @@
+import type { Adapter, Manifest } from '../types.ts';
+export type ScheduleClaim = {
+    job: string;
+    tick: string;
+    skipped: number;
+};
+/**
+ * Move every due schedule forward in one tenant database, and say which moved.
+ *
+ * The caller enqueues what comes back. Claiming before enqueueing means a crash
+ * between the two loses one tick rather than running it twice, which is the right
+ * way round for anything that touches money.
+ */
+export declare function claimDue(adapter: Adapter, manifest: Manifest, o: {
+    now: Date;
+    timezone: string;
+}): Promise<ScheduleClaim[]>;
+//# sourceMappingURL=schedule.d.ts.map

package/dist/server/schedule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schedule.d.ts","sourceRoot":"","sources":["../../../../../packages/ketjs/src/server/schedule.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,OAAO,EAAe,QAAQ,EAAE,MAAM,aAAa,CAAA;AAmBjE,MAAM,MAAM,aAAa,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAA;AAE1E;;;;;;GAMG;AACH,wBAAsB,QAAQ,CAC5B,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,QAAQ,EAClB,CAAC,EAAE;IAAE,GAAG,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACjC,OAAO,CAAC,aAAa,EAAE,CAAC,CAsC1B"}

package/dist/server/schedule.js

@@ -0,0 +1,70 @@
+// Claiming a due tick, which is the one part a queue cannot help with.
+//
+// A schedule does not run anything: it decides that a tick is due and enqueues the
+// ordinary job, which then goes through the machinery that already exists — leases,
+// retries, timeouts, abort signals, records. That reuse is why this file is short.
+//
+// Several worker replicas looking at one schedule at the same moment must still
+// produce exactly one run. The queue's `uniqueKey` is not enough: it holds only
+// while a job is live and is released the moment one completes, so a tick that
+// finished an hour ago would be enqueued again. The claim is therefore durable and
+// monotonic — one row per job per tenant database holding the last tick anybody
+// enqueued, moved forward with a compare-and-set. Whoever's update changes a row
+// won, and there is no leader to elect.
+import { tickAt, ticksBetween } from '../kernel/schedule.js';
+// Text columns and no types either adapter spells differently, so one statement
+// serves both — the same reason ket_job stores its timestamps as ISO text.
+const DDL = `
+CREATE TABLE IF NOT EXISTS ket_schedule (
+  job        TEXT PRIMARY KEY,
+  last_tick  TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+)`;
+const prepared = new WeakSet();
+async function prepare(adapter) {
+    if (prepared.has(adapter))
+        return;
+    await adapter.run(DDL, []);
+    prepared.add(adapter);
+}
+/**
+ * Move every due schedule forward in one tenant database, and say which moved.
+ *
+ * The caller enqueues what comes back. Claiming before enqueueing means a crash
+ * between the two loses one tick rather than running it twice, which is the right
+ * way round for anything that touches money.
+ */
+export async function claimDue(adapter, manifest, o) {
+    const scheduled = Object.entries(manifest.jobs).filter(([, meta]) => meta.schedule);
+    if (!scheduled.length)
+        return [];
+    await prepare(adapter);
+    const claims = [];
+    const pg = adapter.name === 'postgres';
+    const p = (n) => (pg ? `$${n}` : '?');
+    for (const [job, meta] of scheduled) {
+        const schedule = meta.schedule;
+        const tick = tickAt(schedule, o.now, o.timezone);
+        const at = o.now.toISOString();
+        // A schedule seen for the first time does not fire for the tick it happened to
+        // start inside: nobody asked for a run at deploy time, and a nightly job that
+        // fires the moment it is installed is a surprise at the worst moment.
+        const inserted = await adapter.run(`INSERT INTO ket_schedule (job, last_tick, updated_at) VALUES (${p(1)}, ${p(2)}, ${p(3)})
+       ON CONFLICT DO NOTHING`, [job, tick, at]);
+        if (inserted.changes > 0)
+            continue;
+        const rows = await adapter.all(`SELECT last_tick FROM ket_schedule WHERE job = ${p(1)}`, [job]);
+        const last = rows[0] === undefined ? null : String(rows[0].last_tick);
+        if (last === null || last >= tick)
+            continue;
+        const moved = await adapter.run(`UPDATE ket_schedule SET last_tick = ${p(1)}, updated_at = ${p(2)}
+       WHERE job = ${p(3)} AND last_tick = ${p(4)}`, [tick, at, job, last]);
+        // Lost the compare-and-set: another replica claimed this tick. That is the
+        // whole mutual exclusion, and losing it is the normal case rather than a fault.
+        if (moved.changes === 0)
+            continue;
+        claims.push({ job, tick, skipped: ticksBetween(schedule, last, tick) });
+    }
+    return claims;
+}
+//# sourceMappingURL=schedule.js.map

package/dist/server/schedule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schedule.js","sourceRoot":"","sources":["../../../../../../packages/ketjs/src/server/schedule.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,EAAE;AACF,mFAAmF;AACnF,oFAAoF;AACpF,mFAAmF;AACnF,EAAE;AACF,gFAAgF;AAChF,gFAAgF;AAChF,+EAA+E;AAC/E,mFAAmF;AACnF,gFAAgF;AAChF,iFAAiF;AACjF,wCAAwC;AAExC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAG5D,gFAAgF;AAChF,2EAA2E;AAC3E,MAAM,GAAG,GAAG;;;;;EAKV,CAAA;AAEF,MAAM,QAAQ,GAAG,IAAI,OAAO,EAAW,CAAA;AAEvC,KAAK,UAAU,OAAO,CAAC,OAAgB;IACrC,IAAI,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAM;IACjC,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;IAC1B,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;AACvB,CAAC;AAID;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,OAAgB,EAChB,QAAkB,EAClB,CAAkC;IAElC,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACnF,IAAI,CAAC,SAAS,CAAC,MAAM;QAAE,OAAO,EAAE,CAAA;IAChC,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;IAEtB,MAAM,MAAM,GAAoB,EAAE,CAAA;IAClC,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,KAAK,UAAU,CAAA;IACtC,MAAM,CAAC,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;IAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,SAAS,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAuB,CAAA;QAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAA;QAChD,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,CAAA;QAE9B,+EAA+E;QAC/E,8EAA8E;QAC9E,sEAAsE;QACtE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC,iEAAiE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;8BAC/D,EACxB,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,CAChB,CAAA;QACD,IAAI,QAAQ,CAAC,OAAO,GAAG,CAAC;YAAE,SAAQ;QAElC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAA;QAC/F,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAE,IAAI,CAAC,CAAC,CAA4B,CAAC,SAAS,CAAC,CAAA;QACjG,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,IAAI,IAAI;YAAE,SAAQ;QAE3C,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAC7B,uCAAuC,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC;qBAClD,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,EAAE,EAC7C,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CACtB,CAAA;QACD,2EAA2E;QAC3E,gFAAgF;QAChF,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC;YAAE,SAAQ;QACjC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;IACzE,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/server/sequence.d.ts

@@ -0,0 +1,42 @@
+import type { Adapter, Scope } from '../types.ts';
+export type SequenceOptions = {
+    /**
+     * Where the count starts, the first time anybody asks. Defaults to 1.
+     */
+    start?: number;
+    /**
+     * Count once for the whole tenant instead of once per company.
+     *
+     * The default is per company because that is what an ERP means by a document
+     * number, and because a shared counter reached by forgetting to scope one is a
+     * bug nobody sees until two legal entities have issued the same invoice number.
+     */
+    shared?: boolean;
+};
+export declare const sequenceKey: (name: string, scope: Scope, shared: boolean) => string;
+/**
+ * Take the next number in a named sequence.
+ *
+ * The read and the compare-and-set are retried with jittered backoff, because
+ * every document of one kind funnels through one row: a bulk import is a stampede
+ * by design, and losing the race there is normal rather than exceptional. What must
+ * not happen is giving up while the row is live, which would turn a perfectly good
+ * order into a spurious failure.
+ *
+ * Whether the numbers are gapless is decided by the caller, not here. Taken inside
+ * the transaction that writes the document, a rollback takes the number back with
+ * it. Taken outside, a later failure leaves a gap, and no counter can know that
+ * happened.
+ */
+export declare function nextSequenceNumber(adapter: Adapter, name: string, o: {
+    scope: Scope;
+    dryRun?: boolean;
+    random?: () => number;
+} & SequenceOptions): Promise<number>;
+/** What a sequence stands at, without taking a number. */
+export declare function peekSequenceNumber(adapter: Adapter, name: string, o: {
+    scope: Scope;
+    shared?: boolean;
+    start?: number;
+}): Promise<number>;
+//# sourceMappingURL=sequence.d.ts.map

package/dist/server/sequence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sequence.d.ts","sourceRoot":"","sources":["../../../../../packages/ketjs/src/server/sequence.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AAgBjD,MAAM,MAAM,eAAe,GAAG;IAC5B;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB,CAAA;AAID,eAAO,MAAM,WAAW,SAAU,MAAM,SAAS,KAAK,UAAU,OAAO,KAAG,MACd,CAAA;AAE5D;;;;;;;;;;;;;GAaG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,MAAM,EACZ,CAAC,EAAE;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,MAAM,CAAA;CAAE,GAAG,eAAe,GAC7E,OAAO,CAAC,MAAM,CAAC,CAkDjB;AAED,0DAA0D;AAC1D,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,MAAM,EACZ,CAAC,EAAE;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GACpD,OAAO,CAAC,MAAM,CAAC,CASjB"}

package/dist/server/sequence.js

@@ -0,0 +1,97 @@
+// Document numbers.
+//
+// Every ERP needs them and every module was writing its own: a counter row, a
+// read, a compare-and-set, a retry loop. Written twice already, correctly both
+// times but not identically — one of the two retries thirty-two times with no
+// backoff, which spins hottest exactly when the counter is contended. That is the
+// shape of a primitive that should exist once.
+//
+// The framework returns a number and never a string. How a number becomes
+// "S00001" or "POS/00042" is the domain's, and a framework that decided it would
+// be deciding an invoice format for a tax authority it has never heard of.
+import { KetError } from '../kernel/errors.js';
+const DDL = `
+CREATE TABLE IF NOT EXISTS ket_sequence (
+  id     TEXT PRIMARY KEY,
+  next   INTEGER NOT NULL
+)`;
+const prepared = new WeakSet();
+async function prepare(adapter) {
+    if (prepared.has(adapter))
+        return;
+    await adapter.run(DDL, []);
+    prepared.add(adapter);
+}
+const NAME = /^[a-z][a-z0-9_]*(?:\.[a-z][a-z0-9_]*)*$/;
+export const sequenceKey = (name, scope, shared) => shared ? `-\n${name}` : `${scope.company ?? '-'}\n${name}`;
+/**
+ * Take the next number in a named sequence.
+ *
+ * The read and the compare-and-set are retried with jittered backoff, because
+ * every document of one kind funnels through one row: a bulk import is a stampede
+ * by design, and losing the race there is normal rather than exceptional. What must
+ * not happen is giving up while the row is live, which would turn a perfectly good
+ * order into a spurious failure.
+ *
+ * Whether the numbers are gapless is decided by the caller, not here. Taken inside
+ * the transaction that writes the document, a rollback takes the number back with
+ * it. Taken outside, a later failure leaves a gap, and no counter can know that
+ * happened.
+ */
+export async function nextSequenceNumber(adapter, name, o) {
+    if (!NAME.test(name)) {
+        throw new KetError({
+            code: 'E_SEQUENCE_NAME',
+            message: `"${name}" is not a sequence name`,
+            hint: 'use a qualified lowercase identifier, for example "sale.order"',
+        });
+    }
+    const start = Math.max(1, Math.floor(o.start ?? 1));
+    const id = sequenceKey(name, o.scope, o.shared === true);
+    await prepare(adapter);
+    const pg = adapter.name === 'postgres';
+    const p = (n) => (pg ? `$${n}` : '?');
+    const random = o.random ?? Math.random;
+    const read = async () => {
+        const rows = await adapter.all(`SELECT next FROM ket_sequence WHERE id = ${p(1)}`, [id]);
+        return rows[0] === undefined ? null : Number(rows[0].next);
+    };
+    // A preview must not consume a number: the real command that follows would then
+    // skip one, and the caller would have been shown a number nobody ever used.
+    if (o.dryRun)
+        return (await read()) ?? start;
+    for (let attempt = 0; attempt < 64; attempt += 1) {
+        const current = await read();
+        if (current === null) {
+            const inserted = await adapter.run(`INSERT INTO ket_sequence (id, next) VALUES (${p(1)}, ${p(2)}) ON CONFLICT DO NOTHING`, [id, start + 1]);
+            if (inserted.changes > 0)
+                return start;
+            continue;
+        }
+        const moved = await adapter.run(`UPDATE ket_sequence SET next = ${p(1)} WHERE id = ${p(2)} AND next = ${p(3)}`, [current + 1, id, current]);
+        if (moved.changes > 0)
+            return current;
+        // Spread the herd instead of letting it collide again at full speed.
+        if (attempt >= 2) {
+            const ceiling = Math.min(100, 2 ** (attempt - 2));
+            await new Promise((resolve) => setTimeout(resolve, ceiling * (0.5 + random())));
+        }
+    }
+    throw new KetError({
+        code: 'E_SEQUENCE_CONTENDED',
+        message: `sequence "${name}" did not settle after 64 concurrent updates`,
+        hint: 'one row is carrying more concurrent allocation than it can; split the sequence',
+    });
+}
+/** What a sequence stands at, without taking a number. */
+export async function peekSequenceNumber(adapter, name, o) {
+    await prepare(adapter);
+    const pg = adapter.name === 'postgres';
+    const rows = await adapter.all(`SELECT next FROM ket_sequence WHERE id = ${pg ? '$1' : '?'}`, [
+        sequenceKey(name, o.scope, o.shared === true),
+    ]);
+    return rows[0] === undefined
+        ? Math.max(1, Math.floor(o.start ?? 1))
+        : Number(rows[0].next);
+}
+//# sourceMappingURL=sequence.js.map

package/dist/server/sequence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sequence.js","sourceRoot":"","sources":["../../../../../../packages/ketjs/src/server/sequence.ts"],"names":[],"mappings":"AAAA,oBAAoB;AACpB,EAAE;AACF,8EAA8E;AAC9E,+EAA+E;AAC/E,8EAA8E;AAC9E,kFAAkF;AAClF,+CAA+C;AAC/C,EAAE;AACF,0EAA0E;AAC1E,iFAAiF;AACjF,2EAA2E;AAE3E,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AAG9C,MAAM,GAAG,GAAG;;;;EAIV,CAAA;AAEF,MAAM,QAAQ,GAAG,IAAI,OAAO,EAAW,CAAA;AAEvC,KAAK,UAAU,OAAO,CAAC,OAAgB;IACrC,IAAI,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAM;IACjC,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;IAC1B,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;AACvB,CAAC;AAiBD,MAAM,IAAI,GAAG,yCAAyC,CAAA;AAEtD,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,KAAY,EAAE,MAAe,EAAU,EAAE,CACjF,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,IAAI,GAAG,KAAK,IAAI,EAAE,CAAA;AAE5D;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAgB,EAChB,IAAY,EACZ,CAA8E;IAE9E,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,QAAQ,CAAC;YACjB,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,IAAI,IAAI,0BAA0B;YAC3C,IAAI,EAAE,gEAAgE;SACvE,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAA;IACnD,MAAM,EAAE,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAA;IACxD,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;IAEtB,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,KAAK,UAAU,CAAA;IACtC,MAAM,CAAC,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;IAC7C,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAA;IACtC,MAAM,IAAI,GAAG,KAAK,IAA4B,EAAE;QAC9C,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;QACxF,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAE,IAAI,CAAC,CAAC,CAAuB,CAAC,IAAI,CAAC,CAAA;IACnF,CAAC,CAAA;IAED,gFAAgF;IAChF,4EAA4E;IAC5E,IAAI,CAAC,CAAC,MAAM;QAAE,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,IAAI,KAAK,CAAA;IAE5C,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,EAAE,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QACjD,MAAM,OAAO,GAAG,MAAM,IAAI,EAAE,CAAA;QAC5B,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC,+CAA+C,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,0BAA0B,EACtF,CAAC,EAAE,EAAE,KAAK,GAAG,CAAC,CAAC,CAChB,CAAA;YACD,IAAI,QAAQ,CAAC,OAAO,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAA;YACtC,SAAQ;QACV,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAC7B,kCAAkC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,EAC9E,CAAC,OAAO,GAAG,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,CAC3B,CAAA;QACD,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC;YAAE,OAAO,OAAO,CAAA;QACrC,qEAAqE;QACrE,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;YACjB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAA;YACjD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,GAAG,CAAC,GAAG,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,CAAA;QACjF,CAAC;IACH,CAAC;IACD,MAAM,IAAI,QAAQ,CAAC;QACjB,IAAI,EAAE,sBAAsB;QAC5B,OAAO,EAAE,aAAa,IAAI,8CAA8C;QACxE,IAAI,EAAE,gFAAgF;KACvF,CAAC,CAAA;AACJ,CAAC;AAED,0DAA0D;AAC1D,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAgB,EAChB,IAAY,EACZ,CAAqD;IAErD,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;IACtB,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,KAAK,UAAU,CAAA;IACtC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,4CAA4C,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE;QAC5F,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC;KAC9C,CAAC,CAAA;IACF,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;QAC1B,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC;QACvC,CAAC,CAAC,MAAM,CAAE,IAAI,CAAC,CAAC,CAAuB,CAAC,IAAI,CAAC,CAAA;AACjD,CAAC"}

package/dist/server/session.d.ts

@@ -4,12 +4,16 @@ import type { IncomingMessage } from 'node:http';
 export declare const SESSION_COOKIE = "ket_session";
 export type SessionOptions = {
     store?: SessionStore;
+    /** Bind records to one tenant when several tenants share the same store. */
+    tenant?: string;
     /**
      * Signing key. It MUST be the same on every pod: a cookie signed by one and
      * rejected by another is a login that works only until the load balancer sends
      * you elsewhere. Absent, one is generated and the fact is said out loud.
      */
     secret?: string;
+    /** The supplied secret was generated for this process and must still be reported as ephemeral. */
+    ephemeralSecret?: boolean;
     /** How long an idle session lives. Refreshed while it is being used. */
     idleTtlMs?: number;
     /** How long any session may live, however active. Not refreshable. */
@@ -24,6 +28,8 @@ export type SessionOptions = {
 export declare function parseCookies(header: string | undefined): Record<string, string>;
 export type Sessions = {
     readonly store: SessionStore;
+    /** Present when records in this session manager are bound to one tenant. */
+    readonly tenant?: string;
     /** True when the secret was generated rather than configured — see the banner. */
     readonly ephemeralSecret: boolean;
     start(o: {
@@ -49,6 +55,21 @@ export type Sessions = {
     scopeOf(record: SessionRecord | null): Scope | null;
     sweep(): Promise<number>;
 };
+export type SessionScopePolicy = {
+    /** Reject a record issued for a different tenant when session storage is shared. */
+    tenant?: string;
+    /** Scope used when there is no accepted session record. */
+    anonymous?: Scope | null;
+};
+/**
+ * Turn session data into a detached request scope.
+ *
+ * This stays adapter-free so a pooled tenant facade can keep the policy while the
+ * manager and its adapter are evicted. Arrays are copied on both paths: callers
+ * may narrow a request scope without mutating the stored record or deployment's
+ * anonymous policy.
+ */
+export declare function scopeForSession(record: SessionRecord | null, policy?: SessionScopePolicy): Scope | null;
 export declare function createSessions(o?: SessionOptions): Promise<Sessions>;
 export { memorySessionStore, dbSessionStore } from './sessionstore.ts';
 export type { SessionContext, SessionStore, SessionRecord } from './sessionstore.ts';

package/dist/server/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../../../../packages/ketjs/src/server/session.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AACpF,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAEhD,eAAO,MAAM,cAAc,gBAAgB,CAAA;AAE3C,MAAM,MAAM,cAAc,GAAG;IAC3B,KAAK,CAAC,EAAE,YAAY,CAAA;IACpB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,sEAAsE;IACtE,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,kFAAkF;IAClF,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,sFAAsF;IACtF,SAAS,CAAC,EAAE,KAAK,GAAG,IAAI,CAAA;IACxB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CACnB,CAAA;AAoBD,gFAAgF;AAChF,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAQ/E;AAED,MAAM,MAAM,QAAQ,GAAG;IACrB,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAA;IAC5B,kFAAkF;IAClF,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAA;IACjC,KAAK,CAAC,CAAC,EAAE;QACP,MAAM,EAAE,MAAM,CAAA;QACd,SAAS,EAAE,MAAM,EAAE,CAAA;QACnB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;QACvB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;QACtB,QAAQ,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;QAC1B,eAAe,CAAC,EAAE,MAAM,CAAA;KACzB,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,aAAa,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACtD,qEAAqE;IACrE,EAAE,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAA;IACvD,GAAG,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACxC,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACxC,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAC9D,sEAAsE;IACtE,MAAM,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAA;IACrF,0CAA0C;IAC1C,WAAW,IAAI,MAAM,CAAA;IACrB,OAAO,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,GAAG,KAAK,GAAG,IAAI,CAAA;IACnD,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;CACzB,CAAA;AAED,wBAAsB,cAAc,CAAC,CAAC,GAAE,cAAmB,GAAG,OAAO,CAAC,QAAQ,CAAC,CA6I9E;AAED,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AACtE,YAAY,EAAE,cAAc,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../../../../packages/ketjs/src/server/session.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AACpF,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAEhD,eAAO,MAAM,cAAc,gBAAgB,CAAA;AAE3C,MAAM,MAAM,cAAc,GAAG;IAC3B,KAAK,CAAC,EAAE,YAAY,CAAA;IACpB,4EAA4E;IAC5E,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,kGAAkG;IAClG,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,sEAAsE;IACtE,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,kFAAkF;IAClF,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,sFAAsF;IACtF,SAAS,CAAC,EAAE,KAAK,GAAG,IAAI,CAAA;IACxB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CACnB,CAAA;AAoBD,gFAAgF;AAChF,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAQ/E;AAED,MAAM,MAAM,QAAQ,GAAG;IACrB,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAA;IAC5B,4EAA4E;IAC5E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,kFAAkF;IAClF,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAA;IACjC,KAAK,CAAC,CAAC,EAAE;QACP,MAAM,EAAE,MAAM,CAAA;QACd,SAAS,EAAE,MAAM,EAAE,CAAA;QACnB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;QACvB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;QACtB,QAAQ,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;QAC1B,eAAe,CAAC,EAAE,MAAM,CAAA;KACzB,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,aAAa,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACtD,qEAAqE;IACrE,EAAE,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAA;IACvD,GAAG,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACxC,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACxC,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAC9D,sEAAsE;IACtE,MAAM,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAA;IACrF,0CAA0C;IAC1C,WAAW,IAAI,MAAM,CAAA;IACrB,OAAO,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,GAAG,KAAK,GAAG,IAAI,CAAA;IACnD,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;CACzB,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,oFAAoF;IACpF,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,2DAA2D;IAC3D,SAAS,CAAC,EAAE,KAAK,GAAG,IAAI,CAAA;CACzB,CAAA;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,EAAE,MAAM,GAAE,kBAAuB,GAAG,KAAK,GAAG,IAAI,CAsB3G;AAED,wBAAsB,cAAc,CAAC,CAAC,GAAE,cAAmB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAwL9E;AAED,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AACtE,YAAY,EAAE,cAAc,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA"}