@substrat-run/adapter-cloudflare 0.5.0 → 0.7.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +1 -1
- package/dist/checker.d.ts +1 -0
- package/dist/checker.d.ts.map +1 -1
- package/dist/checker.js +12 -4
- package/dist/checker.js.map +1 -1
- package/dist/control-plane-do.d.ts +177 -5
- package/dist/control-plane-do.d.ts.map +1 -1
- package/dist/control-plane-do.js +414 -25
- package/dist/control-plane-do.js.map +1 -1
- package/dist/host.d.ts +41 -1
- package/dist/host.d.ts.map +1 -1
- package/dist/host.js +444 -18
- package/dist/host.js.map +1 -1
- package/dist/index.d.ts +2 -0
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +1 -0
- package/dist/index.js.map +1 -1
- package/dist/route-resolver.d.ts +31 -0
- package/dist/route-resolver.d.ts.map +1 -0
- package/dist/route-resolver.js +47 -0
- package/dist/route-resolver.js.map +1 -0
- package/dist/scope-do.d.ts.map +1 -1
- package/dist/scope-do.js +58 -0
- package/dist/scope-do.js.map +1 -1
- package/package.json +8 -4
package/README.md
CHANGED
|
@@ -53,7 +53,7 @@ export default {
|
|
|
53
53
|
(`new_sqlite_classes`). Run it on real `workerd` with `wrangler dev` (no account needed);
|
|
54
54
|
deploy with `wrangler deploy` (DO SQLite needs a Workers Paid plan).
|
|
55
55
|
|
|
56
|
-
A demo vertical — [
|
|
56
|
+
A demo vertical — [Callout](https://github.com/substrat-run/substrat/tree/main/demos/callout) —
|
|
57
57
|
runs deployed on it today, behind Better Auth.
|
|
58
58
|
|
|
59
59
|
## How the semantics map
|
package/dist/checker.d.ts
CHANGED
package/dist/checker.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"checker.d.ts","sourceRoot":"","sources":["../src/checker.ts"],"names":[],"mappings":"AAAA,OAAO,EAQL,KAAK,cAAc,EACpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAmB9D,UAAU,QAAQ;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,kFAAkF;AAClF,MAAM,WAAW,kBAAkB;IACjC,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC7F,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;CAC7E;AAED,MAAM,WAAW,aAAa;IAC5B,wEAAwE;IACxE,QAAQ,EAAE,UAAU,CAAC;IACrB,8DAA8D;IAC9D,YAAY,EAAE,kBAAkB,CAAC;CAClC;AAQD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,aAAa,GAAG,iBAAiB,
|
|
1
|
+
{"version":3,"file":"checker.d.ts","sourceRoot":"","sources":["../src/checker.ts"],"names":[],"mappings":"AAAA,OAAO,EAQL,KAAK,cAAc,EACpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAmB9D,UAAU,QAAQ;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,kFAAkF;AAClF,MAAM,WAAW,kBAAkB;IACjC,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC7F,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;CAC7E;AAED,MAAM,WAAW,aAAa;IAC5B,wEAAwE;IACxE,QAAQ,EAAE,UAAU,CAAC;IACrB,8DAA8D;IAC9D,YAAY,EAAE,kBAAkB,CAAC;CAClC;AAQD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,aAAa,GAAG,iBAAiB,CAkJ3E"}
|
package/dist/checker.js
CHANGED
|
@@ -21,10 +21,13 @@ const t = (subject, relation, object) => ({
|
|
|
21
21
|
});
|
|
22
22
|
export function createDoTupleChecker(deps) {
|
|
23
23
|
const scopeTuples = (subject, relationPrefix) => deps.scopeSql
|
|
24
|
-
.exec(`SELECT subject, relation, object, expires_at FROM _substrat_tuples
|
|
24
|
+
.exec(`SELECT subject, relation, object, expires_at, revoked_at FROM _substrat_tuples
|
|
25
25
|
WHERE subject = ? AND relation LIKE ?`, subject, `${relationPrefix}%`)
|
|
26
26
|
.toArray();
|
|
27
|
-
|
|
27
|
+
// A tuple grants only while it is unexpired AND unrevoked. K-21: revocation
|
|
28
|
+
// tombstones rather than deletes, so a revoked row is still here and still
|
|
29
|
+
// readable as evidence — it just stops granting.
|
|
30
|
+
const live = (row, now) => (row.expires_at === null || row.expires_at > now) && row.revoked_at === null;
|
|
28
31
|
return {
|
|
29
32
|
async check(principal, permission, node, entity) {
|
|
30
33
|
const now = new Date().toISOString();
|
|
@@ -89,7 +92,7 @@ export function createDoTupleChecker(deps) {
|
|
|
89
92
|
for (const candidate of frontier) {
|
|
90
93
|
for (const subject of subjects) {
|
|
91
94
|
const grant = deps.scopeSql
|
|
92
|
-
.exec(`SELECT subject, relation, object, expires_at FROM _substrat_tuples
|
|
95
|
+
.exec(`SELECT subject, relation, object, expires_at, revoked_at FROM _substrat_tuples
|
|
93
96
|
WHERE subject = ? AND relation = ? AND object = ?`, subject.ref, `granted:${permission}`, candidate.ref)
|
|
94
97
|
.toArray()[0];
|
|
95
98
|
if (grant && live(grant, now)) {
|
|
@@ -108,10 +111,15 @@ export function createDoTupleChecker(deps) {
|
|
|
108
111
|
const next = [];
|
|
109
112
|
for (const candidate of frontier) {
|
|
110
113
|
const parents = deps.scopeSql
|
|
111
|
-
.exec(`SELECT subject, relation, object, expires_at FROM _substrat_tuples
|
|
114
|
+
.exec(`SELECT subject, relation, object, expires_at, revoked_at FROM _substrat_tuples
|
|
112
115
|
WHERE subject = ? AND relation = 'parent'`, candidate.ref)
|
|
113
116
|
.toArray();
|
|
114
117
|
for (const p of parents) {
|
|
118
|
+
// A revoked parent edge stops expanding — without this the tombstone
|
|
119
|
+
// would work for grants and membership but silently NOT for entity
|
|
120
|
+
// edges, which is the case open question 15 is actually about.
|
|
121
|
+
if (!live(p, now))
|
|
122
|
+
continue;
|
|
115
123
|
next.push({
|
|
116
124
|
ref: p.object,
|
|
117
125
|
chain: [...candidate.chain, t(p.subject, 'parent', p.object)],
|
package/dist/checker.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"checker.js","sourceRoot":"","sources":["../src/checker.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,GAQV,MAAM,yBAAyB,CAAC;AAGjC;;;;;;;;;;;;;GAaG;AAEH,MAAM,iBAAiB,GAAG,CAAC,CAAC;
|
|
1
|
+
{"version":3,"file":"checker.js","sourceRoot":"","sources":["../src/checker.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,GAQV,MAAM,yBAAyB,CAAC;AAGjC;;;;;;;;;;;;;GAaG;AAEH,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAuB5B,MAAM,CAAC,GAAG,CAAC,OAAe,EAAE,QAAgB,EAAE,MAAc,EAAiB,EAAE,CAAC,CAAC;IAC/E,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC;IACjC,QAAQ;IACR,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC;CAChC,CAAC,CAAC;AAEH,MAAM,UAAU,oBAAoB,CAAC,IAAmB;IACtD,MAAM,WAAW,GAAG,CAAC,OAAe,EAAE,cAAsB,EAAc,EAAE,CAC1E,IAAI,CAAC,QAAQ;SACV,IAAI,CACH;+CACuC,EACvC,OAAO,EACP,GAAG,cAAc,GAAG,CACrB;SACA,OAAO,EAA2B,CAAC;IAExC,4EAA4E;IAC5E,2EAA2E;IAC3E,iDAAiD;IACjD,MAAM,IAAI,GAAG,CAAC,GAAa,EAAE,GAAW,EAAW,EAAE,CACnD,CAAC,GAAG,CAAC,UAAU,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC;IAE/E,OAAO;QACL,KAAK,CAAC,KAAK,CACT,SAAsB,EACtB,UAAyB,EACzB,IAAU,EACV,MAAkB;YAElB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACrC,MAAM,IAAI,GAAa,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;YACrE,MAAM,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC;YAE7B,uEAAuE;YACvE,MAAM,QAAQ,GAA2C,CAAC,EAAE,GAAG,EAAE,aAAa,SAAS,EAAE,EAAE,CAAC,CAAC;YAC7F,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,SAAS,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACzF,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;oBAC5C,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC5E,CAAC;YACH,CAAC;YAED,yEAAyE;YACzE,MAAM,WAAW,GAAuC,IAAI,CAAC,OAAO;gBAClE,CAAC,CAAC;oBACE,EAAE,GAAG,EAAE,SAAS,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;oBAC9C,EAAE,GAAG,EAAE,UAAU,IAAI,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;iBAClD;gBACH,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,IAAI,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAExD,MAAM,SAAS,GAAG,KAAK,EACrB,OAAe,EACf,MAAc,EACd,MAAe,EACM,EAAE,CACvB,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YAE1F,KAAK,MAAM,OAAO,IAAI,WAAW,EAAE,CAAC;gBAClC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;oBAC/B,2BAA2B;oBAC3B,KAAK,MAAM,GAAG,IAAI,MAAM,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;wBACxE,IAAI,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC;4BAAE,SAAS;wBAC5D,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;wBACnD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;wBACtD,IAAI,IAAI,EAAE,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;4BAC3C,OAAO;gCACL,OAAO,EAAE,IAAI;gCACb,KAAK,EAAE;oCACL,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oCACrC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC;oCACxC,CAAC,CAAC,QAAQ,OAAO,EAAE,EAAE,WAAW,UAAU,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC;iCAC3D;6BACF,CAAC;wBACJ,CAAC;oBACH,CAAC;oBACD,6BAA6B;oBAC7B,KAAK,MAAM,GAAG,IAAI,MAAM,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,UAAU,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;wBACxF,IACE,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC,GAAG;4BAC1B,GAAG,CAAC,QAAQ,KAAK,WAAW,UAAU,EAAE;4BACxC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,EACd,CAAC;4BACD,OAAO;gCACL,OAAO,EAAE,IAAI;gCACb,KAAK,EAAE;oCACL,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oCACrC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC;iCACzC;6BACF,CAAC;wBACJ,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YAED,sEAAsE;YACtE,gCAAgC;YAChC,IAAI,MAAM,EAAE,CAAC;gBAEX,IAAI,QAAQ,GAAe,CAAC,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;gBAC3F,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,iBAAiB,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;oBAC/E,2CAA2C;oBAC3C,KAAK,MAAM,SAAS,IAAI,QAAQ,EAAE,CAAC;wBACjC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;4BAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ;iCACxB,IAAI,CACH;qEACmD,EACnD,OAAO,CAAC,GAAG,EACX,WAAW,UAAU,EAAE,EACvB,SAAS,CAAC,GAAG,CACd;iCACA,OAAO,EAAE,CAAC,CAAC,CAAoC,CAAC;4BACnD,IAAI,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;gCAC9B,OAAO;oCACL,OAAO,EAAE,IAAI;oCACb,KAAK,EAAE;wCACL,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;wCACrC,GAAG,SAAS,CAAC,KAAK;wCAClB,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC;qCAC/C;iCACF,CAAC;4BACJ,CAAC;wBACH,CAAC;oBACH,CAAC;oBACD,8BAA8B;oBAC9B,MAAM,IAAI,GAAe,EAAE,CAAC;oBAC5B,KAAK,MAAM,SAAS,IAAI,QAAQ,EAAE,CAAC;wBACjC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ;6BAC1B,IAAI,CACH;2DAC2C,EAC3C,SAAS,CAAC,GAAG,CACd;6BACA,OAAO,EAA2B,CAAC;wBACtC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;4BACxB,qEAAqE;4BACrE,mEAAmE;4BACnE,+DAA+D;4BAC/D,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC;gCAAE,SAAS;4BAC5B,IAAI,CAAC,IAAI,CAAC;gCACR,GAAG,EAAE,CAAC,CAAC,MAAM;gCACb,KAAK,EAAE,CAAC,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;6BAC9D,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;oBACD,QAAQ,GAAG,IAAI,CAAC;gBAClB,CAAC;YACH,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC"}
|
|
@@ -44,8 +44,67 @@ export interface ScopeRow {
|
|
|
44
44
|
jurisdiction: string | null;
|
|
45
45
|
status: string;
|
|
46
46
|
schema_version: string;
|
|
47
|
+
vertical_version_id: string | null;
|
|
48
|
+
migration_failed_version: string | null;
|
|
49
|
+
migration_error: string | null;
|
|
50
|
+
migration_attempts: number;
|
|
51
|
+
migration_last_attempt_at: string | null;
|
|
47
52
|
created_at: string;
|
|
48
53
|
}
|
|
54
|
+
export interface HostnameRow {
|
|
55
|
+
hostname: string;
|
|
56
|
+
tenant_id: string;
|
|
57
|
+
scope_id: string;
|
|
58
|
+
vertical_slug: string | null;
|
|
59
|
+
surface: string;
|
|
60
|
+
region: string | null;
|
|
61
|
+
status: string;
|
|
62
|
+
status_note: string | null;
|
|
63
|
+
canonical: number;
|
|
64
|
+
created_at: string;
|
|
65
|
+
}
|
|
66
|
+
export interface VerticalRow {
|
|
67
|
+
slug: string;
|
|
68
|
+
name: string;
|
|
69
|
+
source: string;
|
|
70
|
+
created_at: string;
|
|
71
|
+
}
|
|
72
|
+
export interface VersionRow {
|
|
73
|
+
id: string;
|
|
74
|
+
vertical_slug: string;
|
|
75
|
+
version: string;
|
|
76
|
+
manifest_digest: string;
|
|
77
|
+
permission_digest: string;
|
|
78
|
+
migration_digest: string;
|
|
79
|
+
deployment_ref: string | null;
|
|
80
|
+
admission: string;
|
|
81
|
+
admission_note: string | null;
|
|
82
|
+
created_at: string;
|
|
83
|
+
}
|
|
84
|
+
export interface ChannelRow {
|
|
85
|
+
vertical_slug: string;
|
|
86
|
+
channel: string;
|
|
87
|
+
version_id: string;
|
|
88
|
+
updated_at: string;
|
|
89
|
+
}
|
|
90
|
+
export interface OrgRow {
|
|
91
|
+
org_id: string;
|
|
92
|
+
tenant_id: string;
|
|
93
|
+
slug: string;
|
|
94
|
+
name: string;
|
|
95
|
+
created_at: string;
|
|
96
|
+
}
|
|
97
|
+
export interface AccessLogRow {
|
|
98
|
+
id: string;
|
|
99
|
+
actor: string;
|
|
100
|
+
method: string;
|
|
101
|
+
tenant_id: string | null;
|
|
102
|
+
scope_id: string | null;
|
|
103
|
+
params: string | null;
|
|
104
|
+
result_count: number;
|
|
105
|
+
drained_at: string | null;
|
|
106
|
+
at: string;
|
|
107
|
+
}
|
|
49
108
|
/** The audit filter, flattened for the RPC hop (`action` always an array or absent). */
|
|
50
109
|
export interface AuditLogQuery {
|
|
51
110
|
tenantId?: string;
|
|
@@ -63,7 +122,10 @@ export interface AdminEntryInput {
|
|
|
63
122
|
id: string;
|
|
64
123
|
actor: string;
|
|
65
124
|
action: string;
|
|
66
|
-
|
|
125
|
+
/** Null for platform-level actions that target no tenant (K-23). */
|
|
126
|
+
tenantId: string | null;
|
|
127
|
+
/** The event that caused this action, when one did (K-22 §4.2). */
|
|
128
|
+
causedBy?: string | null;
|
|
67
129
|
scopeId: string | null;
|
|
68
130
|
vertical: string | null;
|
|
69
131
|
before: unknown;
|
|
@@ -86,6 +148,23 @@ export declare class ControlPlaneDO extends DurableObject {
|
|
|
86
148
|
* expected steady state on every cold start after the first — anything else
|
|
87
149
|
* rethrows.
|
|
88
150
|
*/
|
|
151
|
+
/** Attempt-and-tolerate ALTER — DO SQLite restricts PRAGMA, so no column probe. */
|
|
152
|
+
private addColumn;
|
|
153
|
+
/**
|
|
154
|
+
* Rebuild `_substrat_identities` when it still carries the pre-K-22 global key
|
|
155
|
+
* (§4.3: a globally-keyed identity mapping is a cross-tenant identity bleed). A
|
|
156
|
+
* PRIMARY KEY cannot be ALTERed, so this is create-copy-drop-rename.
|
|
157
|
+
*
|
|
158
|
+
* Detected from `sqlite_master.sql`, which works here as well as in the pure
|
|
159
|
+
* adapter — DO SQLite restricts PRAGMA, so this is the one detection strategy both
|
|
160
|
+
* adapters can share. Rows already carry `tenant_id`, so the copy is lossless.
|
|
161
|
+
*/
|
|
162
|
+
private ensureIdentityKey;
|
|
163
|
+
/**
|
|
164
|
+
* Drop the admin log's `tenant_id NOT NULL` (K-23) — same create-copy-drop-rename
|
|
165
|
+
* as the identity key, detected the same way. Rows copy verbatim.
|
|
166
|
+
*/
|
|
167
|
+
private ensureAdminLogTenantNullable;
|
|
89
168
|
private ensureDirectoryColumns;
|
|
90
169
|
private mapTenant;
|
|
91
170
|
private readTenant;
|
|
@@ -113,8 +192,16 @@ export declare class ControlPlaneDO extends DurableObject {
|
|
|
113
192
|
* question ("which scopes are behind?") is answerable from the index alone —
|
|
114
193
|
* §5.4's "fleet questions never fan out". Written by the coordinator after the
|
|
115
194
|
* ScopeDO reports what it applied.
|
|
195
|
+
*
|
|
196
|
+
* Written on the FAILURE path too (#32): projecting only on success is what let
|
|
197
|
+
* a half-migrated scope keep a stale `schema_version` and render as healthy.
|
|
198
|
+
* `failure` null clears the columns, so `migration_attempts` counts *consecutive*
|
|
199
|
+
* failures — what the reconciliation sweep's backoff (#49) needs.
|
|
116
200
|
*/
|
|
117
|
-
|
|
201
|
+
setMigrationState(scopeId: string, schemaVersion: string, failure: {
|
|
202
|
+
version: string;
|
|
203
|
+
error: string;
|
|
204
|
+
} | null): void;
|
|
118
205
|
listScopes(filter: {
|
|
119
206
|
tenantId?: string;
|
|
120
207
|
status?: string[];
|
|
@@ -146,6 +233,59 @@ export declare class ControlPlaneDO extends DurableObject {
|
|
|
146
233
|
}): RoleRow[];
|
|
147
234
|
getRole(tenantId: string, key: string): RoleDefinition | undefined;
|
|
148
235
|
writeTenantTuple(tenantId: string, subject: string, relation: string, object: string, expiresAt: string | null): void;
|
|
236
|
+
readHostname(hostname: string): HostnameRow | undefined;
|
|
237
|
+
/** Demote any current canonical for this surface — exactly one may hold it. */
|
|
238
|
+
demoteCanonical(scopeId: string, surface: string): void;
|
|
239
|
+
upsertHostname(h: {
|
|
240
|
+
hostname: string;
|
|
241
|
+
tenantId: string;
|
|
242
|
+
scopeId: string;
|
|
243
|
+
verticalSlug: string | null;
|
|
244
|
+
surface: string;
|
|
245
|
+
region: string | null;
|
|
246
|
+
canonical: boolean;
|
|
247
|
+
createdAt: string;
|
|
248
|
+
}): void;
|
|
249
|
+
setHostnameStatus(hostname: string, status: string, note: string | null): void;
|
|
250
|
+
listHostnames(filter: {
|
|
251
|
+
tenantId?: string;
|
|
252
|
+
scopeId?: string;
|
|
253
|
+
}): HostnameRow[];
|
|
254
|
+
readVertical(slug: string): VerticalRow | undefined;
|
|
255
|
+
insertVertical(slug: string, name: string, source: string, createdAt: string): void;
|
|
256
|
+
listVerticals(): VerticalRow[];
|
|
257
|
+
readVersion(id: string): VersionRow | undefined;
|
|
258
|
+
insertVersion(v: {
|
|
259
|
+
id: string;
|
|
260
|
+
verticalSlug: string;
|
|
261
|
+
version: string;
|
|
262
|
+
manifestDigest: string;
|
|
263
|
+
permissionDigest: string;
|
|
264
|
+
migrationDigest: string;
|
|
265
|
+
deploymentRef: string | null;
|
|
266
|
+
createdAt: string;
|
|
267
|
+
}): void;
|
|
268
|
+
listVersions(verticalSlug: string): VersionRow[];
|
|
269
|
+
setAdmission(id: string, admission: string, note: string | null): void;
|
|
270
|
+
bindScopeVersion(scopeId: string, versionId: string, verticalSlug: string): void;
|
|
271
|
+
readChannel(verticalSlug: string, channel: string): ChannelRow | undefined;
|
|
272
|
+
setChannel(verticalSlug: string, channel: string, versionId: string, updatedAt: string): void;
|
|
273
|
+
listChannels(verticalSlug: string): ChannelRow[];
|
|
274
|
+
readOrg(tenantId: string, orgId: string): OrgRow | undefined;
|
|
275
|
+
/** Returns false when the org already exists (idempotent); throws on slug collision. */
|
|
276
|
+
createOrg(orgId: string, tenantId: string, slug: string, name: string, createdAt: string): boolean;
|
|
277
|
+
listOrgs(tenantId: string): OrgRow[];
|
|
278
|
+
/**
|
|
279
|
+
* Tombstone a membership (K-21), never DELETE. Guarded on `revoked_at IS NULL`
|
|
280
|
+
* so a repeat revoke neither moves the timestamp nor produces a second audit
|
|
281
|
+
* row. Returns whether it changed, so the coordinator can skip the audit write.
|
|
282
|
+
*/
|
|
283
|
+
revokeMember(tenantId: string, subject: string, object: string, at: string): boolean;
|
|
284
|
+
/** Members of an org. Live only unless `includeRevoked` — revoked rows are evidence. */
|
|
285
|
+
listMembers(tenantId: string, object: string, includeRevoked: boolean): {
|
|
286
|
+
subject: string;
|
|
287
|
+
revoked_at: string | null;
|
|
288
|
+
}[];
|
|
149
289
|
tenantTuples(tenantId: string, subject: string, relationPrefix: string): TupleRow[];
|
|
150
290
|
/** INSERT OR IGNORE; return whether it changed (idempotent). */
|
|
151
291
|
grantEntitlement(tenantId: string, key: string): boolean;
|
|
@@ -153,14 +293,46 @@ export declare class ControlPlaneDO extends DurableObject {
|
|
|
153
293
|
revokeEntitlement(tenantId: string, key: string): boolean;
|
|
154
294
|
tenantHoldsEntitlement(tenantId: string, key: string): boolean;
|
|
155
295
|
listEntitlements(tenantId: string): string[];
|
|
156
|
-
|
|
296
|
+
readPool(provider: string): {
|
|
297
|
+
provider: string;
|
|
298
|
+
topology: string;
|
|
299
|
+
tenant_id: string | null;
|
|
300
|
+
} | undefined;
|
|
301
|
+
/** Returns false when an identical registration already exists; throws on a conflicting one. */
|
|
302
|
+
registerIdentityPool(provider: string, topology: string, tenantId: string | null, createdAt: string): boolean;
|
|
303
|
+
identityTenants(provider: string, externalId: string): string[];
|
|
304
|
+
/**
|
|
305
|
+
* Bind an identity within a tenant. Returns false when the key already maps to the
|
|
306
|
+
* SAME principal (idempotent, unaudited); throws when it maps to a DIFFERENT one.
|
|
307
|
+
*
|
|
308
|
+
* Read before write: `INSERT OR IGNORE` alone cannot tell those two apart, and
|
|
309
|
+
* silently ignoring a genuine collision resolves one person as another.
|
|
310
|
+
*/
|
|
157
311
|
linkIdentity(provider: string, externalId: string, principal: string, tenantId: string, scopeId: string | null, createdAt: string): boolean;
|
|
158
|
-
resolveIdentity(provider: string, externalId: string): {
|
|
312
|
+
resolveIdentity(tenantId: string, provider: string, externalId: string): {
|
|
159
313
|
principal: string;
|
|
160
|
-
tenantId: string;
|
|
161
314
|
scopeId: string | null;
|
|
162
315
|
} | undefined;
|
|
163
316
|
/** Append one audit row. before/after are arbitrary JSON, stringified here. */
|
|
317
|
+
/** Staff READS (K-24). Separate table, separate lifetime — see control-plane.md §4.6. */
|
|
318
|
+
recordAccess(entry: {
|
|
319
|
+
id: string;
|
|
320
|
+
actor: string;
|
|
321
|
+
method: string;
|
|
322
|
+
tenantId: string | null;
|
|
323
|
+
scopeId: string | null;
|
|
324
|
+
params: string | null;
|
|
325
|
+
resultCount: number;
|
|
326
|
+
at: string;
|
|
327
|
+
}): void;
|
|
328
|
+
accessLog(query: {
|
|
329
|
+
actor?: string;
|
|
330
|
+
tenantId?: string;
|
|
331
|
+
method?: string;
|
|
332
|
+
limit?: number;
|
|
333
|
+
}): AccessLogRow[];
|
|
334
|
+
/** ONLY drained rows. Age alone is not a licence to delete evidence (K-24). */
|
|
335
|
+
pruneAccessLog(limit: number): number;
|
|
164
336
|
recordAdmin(entry: AdminEntryInput): void;
|
|
165
337
|
auditLog(query: AuditLogQuery): AdminLogEntry[];
|
|
166
338
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"control-plane-do.d.ts","sourceRoot":"","sources":["../src/control-plane-do.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,KAAK,EACV,aAAa,EACb,cAAc,EACd,WAAW,EACX,MAAM,EACN,YAAY,EACb,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;;;;;;;;;GAiBG;AAEH,UAAU,QAAQ;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAUD,uEAAuE;AACvE,MAAM,WAAW,OAAO;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,mFAAmF;AACnF,MAAM,WAAW,QAAQ;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;CACpB;
|
|
1
|
+
{"version":3,"file":"control-plane-do.d.ts","sourceRoot":"","sources":["../src/control-plane-do.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,KAAK,EACV,aAAa,EACb,cAAc,EACd,WAAW,EACX,MAAM,EACN,YAAY,EACb,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;;;;;;;;;GAiBG;AAEH,UAAU,QAAQ;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAUD,uEAAuE;AACvE,MAAM,WAAW,OAAO;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,mFAAmF;AACnF,MAAM,WAAW,QAAQ;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,wBAAwB,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,yBAAyB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,MAAM;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,EAAE,EAAE,MAAM,CAAC;CACZ;AAeD,wFAAwF;AACxF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;CACxB;AAED,sFAAsF;AACtF,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,mEAAmE;IACnE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,EAAE,EAAE,MAAM,CAAC;CACZ;AAkLD,qBAAa,cAAe,SAAQ,aAAa;IAC/C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;gBAErB,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,OAAO;IAUjD;;;;;;;;;;;;OAYG;IACH,mFAAmF;IACnF,OAAO,CAAC,SAAS;IAQjB;;;;;;;;OAQG;IACH,OAAO,CAAC,iBAAiB;IA0BzB;;;OAGG;IACH,OAAO,CAAC,4BAA4B;IA2BpC,OAAO,CAAC,sBAAsB;IAyB9B,OAAO,CAAC,SAAS;IAUjB,OAAO,CAAC,UAAU;IAOlB,kFAAkF;IAClF,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAuBtF,mEAAmE;IACnE,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,MAAM;IAO/D,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAI/C,WAAW,IAAI,MAAM,EAAE;IAQvB;;;;OAIG;IACH,cAAc,CACZ,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,YAAY,EAAE,MAAM,CAAC;QACrB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;KAC7B,EACD,SAAS,EAAE,MAAM,GAChB,OAAO;IA8CV;;;;;;;;;;OAUG;IACH,iBAAiB,CACf,OAAO,EAAE,MAAM,EACf,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,GACjD,IAAI;IAwBP,UAAU,CAAC,MAAM,EAAE;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,QAAQ,EAAE;IAyBd,qFAAqF;IACrF,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS;IAQvE;;;OAGG;IACH,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI;IAqB5D;;;;;OAKG;IACH,eAAe,CACb,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,EAAE,EAAE,WAAW,EACf,MAAM,EAAE,MAAM,GACb;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;IAmB9C,oFAAoF;IACpF,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,cAAc,GAAG,IAAI;IAazE,+EAA+E;IAC/E,SAAS,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,EAAE;IAkBpE,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAkBlE,gBAAgB,CACd,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAAG,IAAI,GACvB,IAAI;IAeP,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS;IAMvD,+EAA+E;IAC/E,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI;IAOvD,cAAc,CAAC,CAAC,EAAE;QAChB,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QACjF,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;KAC/E,GAAG,IAAI;IAWR,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAO9E,aAAa,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,WAAW,EAAE;IAa7E,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS;IAMnD,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI;IAOnF,aAAa,IAAI,WAAW,EAAE;IAI9B,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS;IAM/C,aAAa,CAAC,CAAC,EAAE;QACf,EAAE,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAC;QAC1E,gBAAgB,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;QAChF,SAAS,EAAE,MAAM,CAAC;KACnB,GAAG,IAAI;IAWR,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,UAAU,EAAE;IAMhD,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAOtE,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI;IAOhF,WAAW,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS;IAS1E,UAAU,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI;IAS7F,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,UAAU,EAAE;IAQhD,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAM5D,wFAAwF;IACxF,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO;IAqBlG,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE;IAMpC;;;;OAIG;IACH,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO;IAwBpF,wFAAwF;IACxF,WAAW,CACT,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,OAAO,GACtB;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,EAAE;IAanD,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,QAAQ,EAAE;IAcnF,gEAAgE;IAChE,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO;IAWxD,sDAAsD;IACtD,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO;IAUzD,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO;IAY9D,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE;IAa5C,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,SAAS;IAQxG,gGAAgG;IAChG,oBAAoB,CAClB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GAAG,IAAI,EACvB,SAAS,EAAE,MAAM,GAChB,OAAO;IAmBV,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE;IAc/D;;;;;;OAMG;IACH,YAAY,CACV,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GAAG,IAAI,EACtB,SAAS,EAAE,MAAM,GAChB,OAAO;IA8BV,eAAe,CACb,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GACjB;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,SAAS;IAgB5D,+EAA+E;IAC/E,yFAAyF;IACzF,YAAY,CAAC,KAAK,EAAE;QAClB,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;QACvB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,WAAW,EAAE,MAAM,CAAC;QACpB,EAAE,EAAE,MAAM,CAAC;KACZ,GAAG,IAAI;IAgBR,SAAS,CAAC,KAAK,EAAE;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,YAAY,EAAE;IAalB,+EAA+E;IAC/E,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAerC,WAAW,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI;IAkBzC,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,aAAa,EAAE;CA2DhD"}
|