@substrat-run/adapter-cloudflare 0.132.1 → 0.134.0

package/dist/scope-do.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope-do.d.ts","sourceRoot":"","sources":["../src/scope-do.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAcL,KAAK,WAAW,EAsCjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAoCL,KAAK,SAAS,EAmBd,KAAK,kBAAkB,EAEvB,KAAK,gBAAgB,EAuEtB,MAAM,sBAAsB,CAAC;AAsF9B;;;;;;;;;;;;;GAaG;AAEH,MAAM,WAAW,UAAU;IACzB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,sBAAsB,CAAC;IACvC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AA0bD;;;GAGG;AACH,MAAM,MAAM,yBAAyB,CAAC,CAAC,IAAI;IAAE,KAAK,EAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,WAAW,CAAA;CAAE,CAAC;AAgDxG;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,GAAG,SAAS,CAOxD;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAwDxD;AAED,wBAAgB,aAAa,CAC3B,OAAO,EAAE,kBAAkB,EAAE,EAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,GACxD,KAAK,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,UAAU,KAAK,aAAa,CAklKjE"}
+{"version":3,"file":"scope-do.d.ts","sourceRoot":"","sources":["../src/scope-do.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAcL,KAAK,WAAW,EAsCjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAuCL,KAAK,SAAS,EAmBd,KAAK,kBAAkB,EAEvB,KAAK,gBAAgB,EA+EtB,MAAM,sBAAsB,CAAC;AAsF9B;;;;;;;;;;;;;GAaG;AAEH,MAAM,WAAW,UAAU;IACzB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,sBAAsB,CAAC;IACvC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AA6bD;;;GAGG;AACH,MAAM,MAAM,yBAAyB,CAAC,CAAC,IAAI;IAAE,KAAK,EAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,WAAW,CAAA;CAAE,CAAC;AAgDxG;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,GAAG,SAAS,CAOxD;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAwDxD;AAED,wBAAgB,aAAa,CAC3B,OAAO,EAAE,kBAAkB,EAAE,EAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,GACxD,KAAK,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,UAAU,KAAK,aAAa,CAupKjE"}

package/dist/scope-do.js

@@ -1,10 +1,10 @@
 import { REWIND_REFUSED } from './rewind-refusal.js';
 import { DurableObject } from 'cloudflare:workers';
 import { ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, domainEvent, domainEventInput, eventId, instant, objectRef, entityObjectRef, assertModuleEmittableType, assertKernelAuthoredType, toWireFailure, grantRefFromProof, principalId, scopeId as scopeIdOf, tenantId as tenantIdOf, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, MAX_PENDING_SWEEP_RUNS, SWEEP_RUNS_KIND, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, listLimitOf, requestFingerprint, substratError, assertReplayableDump, REDRAIN_BATCH, } from '@substrat-run/contracts';
-import { ulid, DO_SQL_LIMITS, unknownRoleError, createUlid, assertAllowed, ConnectionSealingKeyUnavailableError, noSealingKeyMessage, sealTo, assertReadOnlyQuery, entitlementDenial, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, JOB_RUN_PATCH_SQL, JOB_STEP_RECORD_SQL, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, effectiveRoleGrantQuery, switchRecordedOff, switchSystemSchedules, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, denialListQuery, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, PermissionDenied, assertImpersonationWrites, assertModuleEnqueueableKind, impersonationStampOf, createAtomic, NotSearchable, isSearchIndexTable, searchIndexDdl, searchIndexPlans, NotListable, listIndexPlans, moduleMigrations, listQuery, cursorOf, searchLimit, searchMatchExpression, searchQuery, IDEMPOTENCY_DDL, REFUSALS_DDL, refusalInsert, refusedTransitionOf, assertIdempotencyKey, assertPermissionKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, exportedSinceQuery, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, jobRunListLimit, } from '@substrat-run/kernel';
+import { ulid, DO_SQL_LIMITS, unknownRoleError, createUlid, assertAllowed, ConnectionSealingKeyUnavailableError, noSealingKeyMessage, sealTo, assertReadOnlyQuery, entitlementDenial, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, redactSubjectScopeText, assertRowLimit, assertRowOffset, JOB_RUN_PATCH_SQL, JOB_STEP_RECORD_SQL, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, effectiveRoleGrantQuery, switchRecordedOff, switchSystemSchedules, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, denialListQuery, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, PermissionDenied, assertImpersonationWrites, assertModuleEnqueueableKind, impersonationStampOf, createAtomic, NotSearchable, isSearchIndexTable, searchIndexDdl, searchIndexPlans, NotListable, listIndexPlans, moduleMigrations, listQuery, cursorOf, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, attachmentRecordOfRow, enqueueAttachmentText, reconcileAttachmentText, recordAttachmentText, searchAttachments, IDEMPOTENCY_DDL, REFUSALS_DDL, refusalInsert, refusedTransitionOf, assertIdempotencyKey, assertPermissionKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, exportedSinceQuery, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, jobRunListLimit, } from '@substrat-run/kernel';
 import { isUpgradeRequest, readSubscription, LIVE_FANOUT_LIMIT, LIVE_MODE_HEADER, LIVE_PRINCIPAL_HEADER, LIVE_SCOPE_HEADER, LIVE_SUBSCRIBE_PATH, LIVE_TENANT_HEADER, } from './live-reads.js';
 import { OperationQueue } from './serialization.js';
-import { doScopedSql, doBuiltColumnsOf, doSpineSql } from './sql.js';
+import { doScopedSql, doBuiltColumnsOf, doRedactionSql, doSpineSql } from './sql.js';
 import { actorOf, admitPeer, collectPeers, switchPeer, assertNoSecret, CAPABILITY_DDL, CAPABILITY_EXCHANGE_OPERATION, capabilityAttachmentWriteRefused, createCapabilityVerbs, createEntityEdgeVerbs, exchangeCapability, guardSecrets, mintBecomeCapability, redactSecrets, redactSecretText, moduleLog, resolveCapabilitySession, revokeCapabilityAsPlatform, domainEventOf, facetEvents, readDeadLetters, readLifecycleFlow, readHistory, readInvocation, readUndrainedOutbox, walkEventCause, walkEventEffects, } from '@substrat-run/kernel';
 import { createDoTupleChecker, createLocalControlPlaneReader } from './checker.js';
 import { assertNoSpineReference, assertSpineTablesBuilt, dumpRowsInsert, isSpineTable, repointScopeGrants, spineColumnAdditions } from '@substrat-run/kernel';
@@ -312,6 +312,9 @@ const KERNEL_DDL = `
   );
   CREATE INDEX IF NOT EXISTS _substrat_attachments_entity
     ON _substrat_attachments (entity_type, entity_id);
+  -- #1575: attachment text and its FTS5 index, shared from @substrat-run/kernel. After
+  -- _substrat_attachments, whose delete trigger it adds.
+  ${ATTACHMENT_TEXT_DDL}
   -- #901: an entity's version is the ULID of the last event about it, so
   -- MAX(id) per (entity_type, entity_id) is the read. The id column sits last so
   -- SQLite walks to the end of the matched range instead of aggregating over it.
@@ -2089,19 +2092,7 @@ export function defineScopeDO(modules, bareOps) {
             const row = this.sql
                 .exec('SELECT * FROM _substrat_attachments WHERE id = ?', attachmentId)
                 .toArray()[0];
-            if (!row)
-                return null;
-            return attachmentRecord.parse({
-                id: row.id,
-                entity: { entityType: row.entity_type, entityId: row.entity_id },
-                filename: row.filename,
-                contentType: row.content_type,
-                size: Number(row.size),
-                sha256: row.sha256,
-                visibility: row.visibility,
-                createdBy: row.created_by,
-                createdAt: row.created_at,
-            });
+            return row ? attachmentRecordOfRow(row) : null;
         }
         /** Record an uploaded attachment: write gate + row + `attachment.added`, one txn. */
         async attachmentAdd(record, principal, tenantId, scopeId, 
@@ -2131,6 +2122,9 @@ export function defineScopeDO(modules, bareOps) {
                             piiClass: 'none',
                             payload: { attachment: parsed },
                         });
+                        // #1575: queue its text extraction in the same transaction — a `pending` row
+                        // and a job run. Nothing is extracted here, so nothing here can fail the upload.
+                        enqueueAttachmentText(doSpineSql(this.sql), parsed.id, ulid(), new Date().toISOString());
                     });
                 }
                 catch (err) {
@@ -2263,6 +2257,49 @@ export function defineScopeDO(modules, bareOps) {
                 return record;
             });
         }
+        // -- attachment text (#1575) ---------------------------------------------------
+        /**
+         * Extracted-text search as `ctx`'s subject: authorized first — the check `open` makes,
+         * the target's read key on the owning entity — then matched over readable owners only
+         * (`searchAttachments`). The term and the limit are judged here again, never trusted
+         * from the coordinator.
+         */
+        searchAttachmentsAs(ctx, term, limit) {
+            return searchAttachments(doSpineSql(this.sql), { targets: this.attachmentTargets, check: (permission, entity) => ctx.check(permission, entity) }, term, limit);
+        }
+        /**
+         * #1575: `ScopeAttachments.search` for a principal or a connection. Its failure travels as
+         * DATA, the capability verbs' envelope, because a throw across this RPC keeps only its
+         * message — and the too-many-owners refusal's `reason` is what a UI explains it by.
+         */
+        async attachmentSearch(term, limit, principal, tenantId, scopeId, connectionId) {
+            await this.ensureMigrations();
+            try {
+                const ctx = this.operationContext(principal, tenantId, scopeId, undefined, connectionId, undefined, undefined, undefined, 'attachments.search');
+                return { value: await this.searchAttachmentsAs(ctx, term, limit) };
+            }
+            catch (err) {
+                return { failure: toWireFailure(err) };
+            }
+        }
+        /**
+         * #1575: the extraction job's read of one record. No gate, deliberately — extraction
+         * is the kernel's own derivation and the coordinator is its only caller; what a person
+         * learns is gated at search.
+         */
+        async attachmentTextSource(attachmentId) {
+            await this.ensureMigrations();
+            return this.attachmentRow(attachmentId);
+        }
+        /**
+         * #1575: write one extraction outcome, guarded on the attachment still existing.
+         * Through the queue, so it can never land inside an invoke's or an upload's open
+         * transaction and roll back with it.
+         */
+        async attachmentTextRecord(attachmentId, outcome) {
+            await this.ensureMigrations();
+            return this.queue.enqueue(async () => this.ctx.storage.transactionSync(() => recordAttachmentText(doSpineSql(this.sql), attachmentId, outcome, new Date().toISOString())));
+        }
         // -- attachments through a capability (#1686) -------------------------------
         // The coordinator hashed the session token; only the hash arrives. Each verb resolves it
         // INSIDE the queue, as `invoke` does, so nothing can revoke between the resolution and
@@ -2332,6 +2369,11 @@ export function defineScopeDO(modules, bareOps) {
                 return record;
             });
         }
+        /** #1575: extracted-text search as the capability — its keys, its subtree, its minter now. */
+        async capabilityAttachmentSearch(term, limit, sessionHash, tenantId, scopeId) {
+            await this.ensureMigrations();
+            return this.asCapability(sessionHash, tenantId, scopeId, 'attachments.search', (ctx) => this.searchAttachmentsAs(ctx, term, limit));
+        }
         /**
          * Refuse an upload or a remove through a capability, and record it. Throws for an
          * unknown attachment id too — the same answer either way — but only a known target has
@@ -2822,8 +2864,8 @@ export function defineScopeDO(modules, bareOps) {
             this.ctx.storage.transactionSync(() => {
                 this.sql.exec(`INSERT INTO _substrat_job_runs
              (id, module_id, job, instance, payload, status, cursor, counters, attempts,
-              last_error, started_at, updated_at, next_attempt_at, ended_at)
-           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, row.id, row.module_id, row.job, row.instance, row.payload, row.status, row.cursor, row.counters, row.attempts, row.last_error, row.started_at, row.updated_at, row.next_attempt_at, row.ended_at);
+              last_error, started_at, updated_at, next_attempt_at, ended_at, subject_id)
+           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, row.id, row.module_id, row.job, row.instance, row.payload, row.status, row.cursor, row.counters, row.attempts, row.last_error, row.started_at, row.updated_at, row.next_attempt_at, row.ended_at, row.subject_id ?? null);
             });
             return row;
         }
@@ -2835,8 +2877,8 @@ export function defineScopeDO(modules, bareOps) {
         async jobRunInsert(row) {
             this.sql.exec(`INSERT INTO _substrat_job_runs
            (id, module_id, job, instance, payload, status, cursor, counters, attempts,
-            last_error, started_at, updated_at, next_attempt_at, ended_at)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, row.id, row.module_id, row.job, row.instance, row.payload, row.status, row.cursor, row.counters, row.attempts, row.last_error, row.started_at, row.updated_at, row.next_attempt_at, row.ended_at);
+            last_error, started_at, updated_at, next_attempt_at, ended_at, subject_id)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, row.id, row.module_id, row.job, row.instance, row.payload, row.status, row.cursor, row.counters, row.attempts, row.last_error, row.started_at, row.updated_at, row.next_attempt_at, row.ended_at, row.subject_id ?? null);
         }
         /**
          * `running` runs whose backoff has elapsed, oldest first, after `afterId`.
@@ -3284,8 +3326,10 @@ export function defineScopeDO(modules, bareOps) {
                 .toArray().map((r) => r.name));
             if (!known.has(table))
                 throw new Error(`unknown table '${table}'`);
-            const l = Math.min(Math.max(1, limit), SCOPE_TABLE_PAGE_MAX);
-            const o = Math.max(0, offset);
+            // The ceiling clamps; a bound SQLite would misread (NaN, non-finite, fractional,
+            // negative) is refused instead of reaching LIMIT / OFFSET (#1632).
+            const l = Math.min(assertRowLimit('limit', limit), SCOPE_TABLE_PAGE_MAX);
+            const o = assertRowOffset('offset', offset);
             const cursor = this.sql.exec(`SELECT * FROM "${table}" LIMIT ? OFFSET ?`, l, o);
             const columns = cursor.columnNames;
             const rows = Array.from(cursor.raw(), (row) => row.map(cellToJson));
@@ -3416,6 +3460,8 @@ export function defineScopeDO(modules, bareOps) {
                 'ALTER TABLE _substrat_migrations ADD COLUMN duration_ms INTEGER',
                 'ALTER TABLE _substrat_migrations ADD COLUMN rows_changed INTEGER',
                 'ALTER TABLE _substrat_tuples ADD COLUMN revoked_at TEXT',
+                // #1632: legacy runs retain an unknown subject; no content-based backfill.
+                'ALTER TABLE _substrat_job_runs ADD COLUMN subject_id TEXT',
                 // Executor retry state (#100). The defaults read as "terminal", which is
                 // right for every row already there: each is a completed delivery or a
                 // consumer dead-letter.
@@ -3599,6 +3645,10 @@ export function defineScopeDO(modules, bareOps) {
                 // not this one. Dropped, so a restore never carries a receipt over; the repair
                 // projection that follows writes this scope's own.
                 this.sql.exec(`DELETE FROM _substrat_meta WHERE key = 'provisioned_for'`);
+                // #1575: attachment text is not in a dump, so the load left it as it was. Drop the
+                // text of attachments the dump did not bring back, and queue extraction for those
+                // it brought back without text — the bytes decide what that run finds.
+                reconcileAttachmentText(doSpineSql(this.sql), ulid, new Date().toISOString());
                 // Re-point the restored grants at THIS scope (after the spine exists, so a dump
                 // that carried no tuples table still finds one here).
                 if (destScopeId) {
@@ -3745,12 +3795,16 @@ export function defineScopeDO(modules, bareOps) {
             // A failed delivery's error text about one of those events (#1632) — keyed by event
             // id, so the outbox predicate names it. Not a copy of the event; not counted.
             this.sql.exec(DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, REDACTED_DELIVERY_NOTE, subjectId);
+            const sql = doRedactionSql(this.sql);
             return {
                 events: doomed.length,
                 intents: this.redactSubjectIntents(subjectId, at),
                 // The job-run tables (#1632) — the kernel's walk, so the pure host runs the
                 // identical SQL.
-                jobRuns: redactSubjectJobRuns((sql, params) => this.sql.exec(sql, ...params).toArray(), subjectId, at),
+                jobRuns: redactSubjectJobRuns(sql, subjectId, at),
+                // The free-text copies (#1632), and the tombstoned intents the coordinator hands to
+                // the directory half. Last, so those ids include every intent tombstoned above.
+                ...redactSubjectScopeText(sql, subjectId, at),
             };
         }
         /**
@@ -4425,7 +4479,9 @@ export function defineScopeDO(modules, bareOps) {
         /** The directory's recorded-off modules (#1742), switched off in THIS unit right after the
          *  seat, so no sweep can run the grants the seat just re-created. `scopeId` is the scope
          *  this projection provisions (the object of `scopeTuples`), never another. */
-        switchOff) {
+        switchOff, 
+        /** Declared service subjects excluded only from human lockout repair (#1896). */
+        serviceSubjects) {
             if (await this.isReaped())
                 return [];
             // A projection that arrives after this scope was reaped is dropped, not
@@ -4510,14 +4566,14 @@ export function defineScopeDO(modules, bareOps) {
                     this.sql.exec(seat.sql, ...seat.params);
                 }
                 // #1659's one exception: the owner-of-record's seat comes back over a revoke when
-                // NOTHING else would let anyone act here — roles projected, no effective role grant.
-                // That is the #332 lockout this path exists to repair, and it is decided by the same
-                // predicate as the flip guard below, so "locked out" means one thing in this unit.
+                // No HUMAN holder remains — declared service subjects cannot prevent lockout repair.
+                // That is the #332 lockout this path exists to repair. The flip guard below still
+                // counts service authority; only the repair excludes the declared service subjects.
                 // With any other effective holder, the revoke stands: a hand-over that seats a
                 // successor before unseating the owner is not undone by the next promote. A holder of
                 // a role the vertical no longer defines is NOT one — it passes no check, so it must
                 // not stand in for the holder this repair exists to restore.
-                if (roles.length > 0 && !this.hasEffectiveRoleGrant(tenantId)) {
+                if (roles.length > 0 && !this.hasEffectiveRoleGrant(tenantId, serviceSubjects)) {
                     for (const st of scopeTuples ?? []) {
                         if (!st.lockout_reseat)
                             continue;
@@ -4566,8 +4622,8 @@ export function defineScopeDO(modules, bareOps) {
          *  kernel's `effectiveRoleGrantQuery`, where it is tested against a real SQLite. A tuple
          *  for a role the vertical no longer defines counts for nothing, exactly as in the local
          *  checker, which expands a role only through its definition. */
-        hasEffectiveRoleGrant(tenantId) {
-            const q = effectiveRoleGrantQuery(tenantId, new Date().toISOString());
+        hasEffectiveRoleGrant(tenantId, excludedSubjects) {
+            const q = effectiveRoleGrantQuery(tenantId, new Date().toISOString(), undefined, excludedSubjects);
             const row = this.sql.exec(q.sql, ...q.params).toArray()[0];
             return row?.effective === 1;
         }