@substrat-run/adapter-sqlite 0.122.1 → 0.125.0

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 import { type BlobStoreHandle, type ImportBatch, type ImportResult, type PeerCoverage, type VerticalCaller, type CapabilityExchange, type ConnectionId, type ModuleId, type DomainEvent, type PlatformRequestId, type PlatformRequest, type PlatformRequestFilter, type PlatformRequestStatus, type PlatformRequestFailure, type ProjectedConnectionGrant, type PermissionKey, type PlatformActorId, type PrincipalId, type ScopeDump, type ScopeId, type ImpersonationSessionId, type TenantId, type TenantStoreHandle } from '@substrat-run/contracts';
-import { type FreshnessReport, type FreshnessRegistration, type BlobStoreProvisionInput, type ScopeAttachments, type ExecutorDeadLetter, type ExecutorDrainReport, type MigrateScopeOutcome, type MigrationFrontier, type ExecutorHandler, type ExecutorRetryPolicy, type ConnectorHandler, type ConnectorOptions, type Clock, type FetchLike, type SecretBox, type HostAdmin, type ModuleRegistration, type OperationHandler, type PermissionChecker, type ProvisionScopeInput, type ScheduleRegistration, type ScheduleRunReport, type ScopeHost, type ScopeStub, type ScopeStubOptions, type TenantRelationalStore, type TenantStoreProvisionInput, type JobDriveReport, type JobHandler, type JobRun, type JobRunFilter, type StartJobRunInput, type ConnectorCallRecorder } from '@substrat-run/kernel';
+import { type ModuleLogSink, type FreshnessReport, type FreshnessRegistration, type BlobStoreProvisionInput, type ScopeAttachments, type ExecutorDeadLetter, type ExecutorDrainReport, type MigrateScopeOutcome, type MigrationFrontier, type ExecutorHandler, type ExecutorRetryPolicy, type ConnectorHandler, type ConnectorOptions, type Clock, type FetchLike, type SecretBox, type HostAdmin, type ModuleRegistration, type OperationHandler, type PermissionChecker, type ProvisionScopeInput, type ScheduleRegistration, type ScheduleRunReport, type ScopeHost, type ScopeStub, type ScopeStubOptions, type TenantRelationalStore, type TenantStoreProvisionInput, type JobDriveReport, type JobHandler, type JobRun, type JobRunFilter, type StartJobRunInput, type ConnectorCallRecorder } from '@substrat-run/kernel';
 /**
  * A fault in the database itself (full, corrupt, I/O), as opposed to one statement failing.
  * The #1764 backfill logs and opens past a failed batch, but never past one of these.
@@ -49,6 +49,11 @@ export interface SqliteScopeHostOptions {
      * admin-log entry) are untouched and stay on the real clock.
      */
     clock?: Clock;
+    /**
+     * #1746: where `ctx.log` lines go. Defaults to the console, one JSON line per call, which
+     * is what a deployment's log platform indexes. A test passes a collector.
+     */
+    logSink?: ModuleLogSink;
     /**
      * The version REGISTRY id of the vertical version this host runs (#1242) — stamped
      * into the outbox `version` column at emit, the signals dimension (#1231) that joins
@@ -161,6 +166,8 @@ export declare class SqliteScopeHost implements ScopeHost {
     private readonly connectorCalls;
     private readonly clock;
     private readonly versionId;
+    /** #1746: where `ctx.log` lines go — the console unless a caller (a test) says otherwise. */
+    private readonly logSink;
     constructor(options: SqliteScopeHostOptions);
     /**
      * The directory schema, applied on every open — and again after a restore (#40).
@@ -223,6 +230,11 @@ export declare class SqliteScopeHost implements ScopeHost {
      * holds on the scope's actor: every module the directory records OFF on the scope is
      * switched off again. Already off answers `changed: false` and writes nothing, and a
      * module the scope does not hold is left alone. Audited only when something moved.
+     *
+     * `audit` receives each row. By default it writes to the admin log at once. A caller running
+     * this inside a scope transaction that may still roll back (a restore's replay) collects
+     * the rows and writes them once the transaction commits. The admin log is another
+     * database, and a row must not outlive a move that was rolled back.
      */
     private reassertSwitchesInTurn;
     provisionTenantStore(actor: PlatformActorId, input: TenantStoreProvisionInput): Promise<TenantStoreHandle>;

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAcL,KAAK,eAAe,EAcpB,KAAK,WAAW,EAEhB,KAAK,YAAY,EAuBjB,KAAK,YAAY,EAIjB,KAAK,cAAc,EAqCnB,KAAK,kBAAkB,EAMvB,KAAK,YAAY,EAGjB,KAAK,QAAQ,EAeb,KAAK,WAAW,EAIhB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAI3B,KAAK,wBAAwB,EAW7B,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,WAAW,EAehB,KAAK,SAAS,EAEd,KAAK,OAAO,EAYZ,KAAK,sBAAsB,EAG3B,KAAK,QAAQ,EAGb,KAAK,iBAAiB,EAcvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAgCL,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAc1B,KAAK,uBAAuB,EAG5B,KAAK,gBAAgB,EAGrB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EAoFxB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,KAAK,EACV,KAAK,SAAS,EACd,KAAK,SAAS,EAEd,KAAK,SAAS,EACd,KAAK,kBAAkB,EAEvB,KAAK,gBAAgB,EAErB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EAExB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EAGtB,KAAK,SAAS,EACd,KAAK,SAAS,EACd,KAAK,gBAAgB,EAGrB,KAAK,qBAAqB,EAC1B,KAAK,yBAAyB,EAuD9B,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,MAAM,EACX,KAAK,YAAY,EAMjB,KAAK,gBAAgB,EA+BrB,KAAK,qBAAqB,EAC3B,MAAM,sBAAsB,CAAC;AAI9B;;;GAGG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAGpD;AAsGD,MAAM,WAAW,sBAAsB;IACrC,+EAA+E;IAC/E,GAAG,EAAE,MAAM,CAAC;IACZ,gFAAgF;IAChF,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B;;;;OAIG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,qBAAqB,CAAC;IACvC;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,EAAE,KAAK,CAAC;IACd;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AA4rBD,qBAAa,eAAgB,YAAW,SAAS;IAC/C,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC;IAC3B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;IAC5C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoB;IAC9C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmC;IAC1D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmC;IAC9D,qGAAqG;IACrG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmC;IAC3D;;+EAE2E;IAC3E,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAwC;IACvE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAuD;IAClF,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuC;IAC/D,oFAAoF;IACpF,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA+B;IAC7D,gFAAgF;IAChF,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsC;IAC7D,gFAAgF;IAChF,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkE;IAC7F,2EAA2E;IAC3E,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA6B;IACvD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkC;IAC5D,8EAA8E;IAC9E,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAsC;IAClE,4FAA4F;IAC5F,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoC;IAC9D,8FAA8F;IAC9F,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAoE;IACtG,uEAAuE;IACvE,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAA6B;IAClE;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAyD;IACxF;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAyD;IAC9F;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAqB;IAChE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqC;IAC3D,kFAAkF;IAClF,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAyC;IACnE;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA2E;IAChG;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAuB;IACvC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA0C;IAC1E,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;IACtC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;IACtC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAwB;IACvD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAC9B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAgB;IAO1C,YAAY,OAAO,EAAE,sBAAsB,EAwB1C;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,OAAO,CAAC,oBAAoB;IA8iB5B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,qBAAqB;IA4B7B,gBAAgB,CACd,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,eAAe,EACxB,KAAK,CAAC,EAAE,mBAAmB,GAC1B,IAAI,CAQN;IAED,iBAAiB,CACf,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,gBAAgB,EACzB,OAAO,CAAC,EAAE,gBAAgB,GACzB,IAAI,CASN;IAED;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,gBAAgB;IAiGxB,cAAc,CAAC,YAAY,EAAE,kBAAkB,GAAG,IAAI,CAuMrD;IAED,eAAe,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,CAIzE;IAEK,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAwHtF;IAED;;;;;OAKG;IACH,OAAO,CAAC,sBAAsB;IAyBxB,oBAAoB,CACxB,KAAK,EAAE,eAAe,EACtB,KAAK,EAAE,yBAAyB,GAC/B,OAAO,CAAC,iBAAiB,CAAC,CAwD5B;IAED,eAAe,CAAC,MAAM,EAAE,iBAAiB,GAAG,qBAAqB,CAoBhE;IAED,sFAAsF;IACtF,OAAO,CAAC,aAAa;IAUf,kBAAkB,CACtB,KAAK,EAAE,eAAe,EACtB,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,eAAe,CAAC,CA0C1B;IAED;;mFAE+E;IAC/E,OAAO,CAAC,SAAS;IAoDjB;;;wEAGoE;IACpE,OAAO,CAAC,eAAe;IAuBjB,WAAW,CACf,SAAS,EAAE,WAAW,EACtB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,gBAAgB,CAAC,CAU3B;IAED;;;;;;OAMG;IACH,OAAO,CAAC,gBAAgB;IA2QlB,WAAW,CACf,KAAK,EAAE,eAAe,EACtB,KAAK,EAAE,mBAAmB,EAC1B,IAAI,EAAE,SAAS,GACd,OAAO,CAAC,IAAI,CAAC,CAoBf;IAED,oFAAoF;YACtE,QAAQ;IAwGhB,YAAY,CAChB,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,SAAS,GACd,OAAO,CAAC,IAAI,CAAC,CAYf;IAEK,aAAa,CACjB,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAC3C,OAAO,CAAC,OAAO,CAAC,CAwBlB;IAEK,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CA6BhG;IAEK,QAAQ,CACZ,SAAS,EAAE,WAAW,EACtB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,SAAS,CAAC,CA2CpB;IAED;;;;;;;;;;;;;OAaG;IACG,iBAAiB,CAAC,YAAY,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CA4BxF;IAEK,uBAAuB,CAC3B,YAAY,EAAE,YAAY,EAC1B,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,gBAAgB,CAAC,CA2B3B;IAED,mFAAmF;IACnF,OAAO,CAAC,iBAAiB;IAOzB;;;;;;;OAOG;IACG,oBAAoB,CACxB,OAAO,EAAE,sBAAsB,EAC/B,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,SAAS,CAAC,CAiBpB;IAEK,cAAc,CAClB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,SAAS,CAAC,CAoBpB;IAED;;;;;;;;OAQG;YACW,WAAW;IA8BzB;;;;OAIG;YACW,WAAW;IAUzB,uEAAuE;IACvE,OAAO,CAAC,aAAa;IAgBf,aAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAkHjG;IAED;;;OAGG;IACH,OAAO,CAAC,cAAc;IAWtB;;;;OAIG;IACH,OAAO,CAAC,UAAU;IA2BlB,yGAAyG;IACzG,OAAO,CAAC,cAAc;IAMtB,4FAA4F;IAC5F,OAAO,CAAC,mBAAmB;IAgB3B;;;;;OAKG;YACW,eAAe;IAyB7B;;;;;OAKG;IACG,kBAAkB,CACtB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAA;KAAE,GACpC,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CA0CpC;IAED;;;;;OAKG;IACG,kBAAkB,CACtB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,SAAS,CAAC,CAOpB;IAED;;;;;OAKG;IACG,wBAAwB,CAC5B,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,gBAAgB,CAAC,CAW3B;IAED,uFAAuF;IACvF,OAAO,CAAC,gBAAgB;IAIxB;;;;OAIG;IACG,gBAAgB,CACpB,MAAM,EAAE,cAAc,EACtB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,SAAS,CAAC,CAIpB;IAED;;;;;OAKG;IACG,UAAU,CACd,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,SAAS,aAAa,EAAE,GACpC,OAAO,CAAC,YAAY,EAAE,CAAC,CAQzB;IAED,kGAAkG;IAClG,iBAAiB,IAAI;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,EAAE,CAE3E;IAED,mBAAmB,IAAI,oBAAoB,EAAE,CAQ5C;IAED,mBAAmB,IAAI,qBAAqB,EAAE,CAQ7C;IAED;;;;;;;;;;;;;;;OAeG;IACG,cAAc,CAClB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,eAAe,CAAC,CA+E1B;IAGK,eAAe,CACnB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,iBAAiB,CAAC,CAyG5B;IAED,sGAAsG;IACtG,OAAO,CAAC,SAAS;IA4SjB;;;;;;;;;OASG;IACH,OAAO,CAAC,cAAc;IAgBtB,qFAAqF;IACrF,OAAO,CAAC,SAAS;YAKH,SAAS;IAqBjB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAG3B;IAOD;;;;;;;;;;;;;;;;;;;;OAoBG;YACW,iBAAiB;IAgF/B;;;;;;;OAOG;IACH,OAAO,CAAC,sBAAsB;IAmDxB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAOjF;IAED,WAAW,CACT,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,UAAU,EACnB,KAAK,CAAC,EAAE,mBAAmB,GAC1B,IAAI,CAIN;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,QAAQ;IAuGV,WAAW,CACf,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,gBAAgB,GACtB,OAAO,CAAC,MAAM,CAAC,CAIjB;IAEK,UAAU,CACd,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAC/C,OAAO,CAAC,cAAc,CAAC,CAWzB;IAEK,OAAO,CACX,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,MAAM,CAAC,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,EAAE,CAAC,CAInB;IAEK,iBAAiB,CACrB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,gBAAgB,EACzB,KAAK,EAAE,WAAW,EAClB,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAC/B,OAAO,CAAC,IAAI,CAAC,CAgBf;IAED;;;;;;;OAOG;IACG,uBAAuB,CAC3B,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,wBAAwB,EAAE,CAAC,CAgCrC;IAED,iBAAiB,IAAI,iBAAiB,CAIrC;IAED;;;;;;;;OAQG;IACG,YAAY,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA6CrF;IAEK,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CA6B7F;IAEK,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAW3F;IAEK,0BAA0B,CAC9B,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,MAAM,CAAC,EAAE,qBAAqB,GAC7B,OAAO,CAAC,eAAe,EAAE,CAAC,CAO5B;IAEK,qBAAqB,CACzB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,EAAE,EAAE,iBAAiB,EACrB,OAAO,EAAE;QACP,MAAM,EAAE,qBAAqB,CAAC;QAC9B,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,OAAO,CAAC,EAAE,sBAAsB,GAAG,IAAI,CAAC;KACzC,GACA,OAAO,CAAC,IAAI,CAAC,CA4Bf;YAEa,QAAQ;IAyFtB;;;;OAIG;IACH,OAAO,CAAC,YAAY;IAmDpB;;;;;;OAMG;IACH;;;;;;OAMG;IACH,mFAAmF;IACnF,OAAO,CAAC,gBAAgB;IA4CxB,OAAO,CAAC,YAAY;IA0BpB;;;;;OAKG;IACH,OAAO,CAAC,WAAW;IASnB;;;;OAIG;IACH,OAAO,CAAC,cAAc;IAiDtB;;;;;;;;;OASG;YACW,gBAAgB;IA0D9B;;;;;;;;;OASG;YACW,eAAe;IAiB7B,gFAAgF;IAChF,OAAO,CAAC,aAAa;IAQrB,OAAO,CAAC,WAAW;IA2BnB,OAAO,CAAC,sBAAsB;IAe9B,4FAA4F;IAC5F,OAAO,CAAC,gBAAgB;IAYxB,OAAO,CAAC,UAAU;IAkoIlB;;;;;;;;;OASG;IACH;;;;OAIG;IACH,OAAO,CAAC,YAAY;IAOpB;;;;;OAKG;IACH,OAAO,CAAC,uBAAuB;IAc/B;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,iBAAiB;IAIzB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,iBAAiB;IA0BzB;;;;;;OAMG;IACH,OAAO,CAAC,4BAA4B;IA2BpC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,yBAAyB;IAWjC,OAAO,CAAC,sBAAsB;IAiI9B,OAAO,CAAC,SAAS;IAejB;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;YAoeV,sBAAsB;IAqDpC;;;;;;;;;OASG;IACH,OAAO,CAAC,oBAAoB;IAyB5B;;;;;OAKG;IACH;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,oBAAoB;IAU5B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,oBAAoB;IAa5B,OAAO,CAAC,UAAU;IAKlB;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,cAAc;IAKtB;;;;;OAKG;IACH,OAAO,CAAC,MAAM;IAuBd;;;OAGG;IACH,OAAO,CAAC,YAAY;IAUpB;;;;;;;OAOG;IACH,OAAO,CAAC,kBAAkB;IAiE1B,OAAO,CAAC,OAAO;CA6ChB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAeL,KAAK,eAAe,EAcpB,KAAK,WAAW,EAEhB,KAAK,YAAY,EAuBjB,KAAK,YAAY,EAIjB,KAAK,cAAc,EAsCnB,KAAK,kBAAkB,EAMvB,KAAK,YAAY,EAGjB,KAAK,QAAQ,EAeb,KAAK,WAAW,EAIhB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAI3B,KAAK,wBAAwB,EAW7B,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,WAAW,EAehB,KAAK,SAAS,EAEd,KAAK,OAAO,EAYZ,KAAK,sBAAsB,EAG3B,KAAK,QAAQ,EAGb,KAAK,iBAAiB,EAcvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAmBL,KAAK,aAAa,EAoBlB,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAc1B,KAAK,uBAAuB,EAG5B,KAAK,gBAAgB,EAGrB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EA0FxB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,KAAK,EACV,KAAK,SAAS,EACd,KAAK,SAAS,EAEd,KAAK,SAAS,EACd,KAAK,kBAAkB,EAEvB,KAAK,gBAAgB,EAErB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EAExB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EAGtB,KAAK,SAAS,EACd,KAAK,SAAS,EACd,KAAK,gBAAgB,EAGrB,KAAK,qBAAqB,EAC1B,KAAK,yBAAyB,EA2D9B,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,MAAM,EACX,KAAK,YAAY,EAMjB,KAAK,gBAAgB,EA+BrB,KAAK,qBAAqB,EAC3B,MAAM,sBAAsB,CAAC;AAI9B;;;GAGG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAGpD;AAsGD,MAAM,WAAW,sBAAsB;IACrC,+EAA+E;IAC/E,GAAG,EAAE,MAAM,CAAC;IACZ,gFAAgF;IAChF,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B;;;;OAIG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,qBAAqB,CAAC;IACvC;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,EAAE,KAAK,CAAC;IACd;;;OAGG;IACH,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AA8rBD,qBAAa,eAAgB,YAAW,SAAS;IAC/C,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC;IAC3B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;IAC5C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoB;IAC9C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmC;IAC1D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmC;IAC9D,qGAAqG;IACrG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmC;IAC3D;;+EAE2E;IAC3E,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAwC;IACvE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAuD;IAClF,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuC;IAC/D,oFAAoF;IACpF,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA+B;IAC7D,gFAAgF;IAChF,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsC;IAC7D,gFAAgF;IAChF,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkE;IAC7F,2EAA2E;IAC3E,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA6B;IACvD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkC;IAC5D,8EAA8E;IAC9E,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAsC;IAClE,4FAA4F;IAC5F,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoC;IAC9D,8FAA8F;IAC9F,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAoE;IACtG,uEAAuE;IACvE,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAA6B;IAClE;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAyD;IACxF;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAyD;IAC9F;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAqB;IAChE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqC;IAC3D,kFAAkF;IAClF,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAyC;IACnE;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA2E;IAChG;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAuB;IACvC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA0C;IAC1E,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;IACtC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;IACtC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAwB;IACvD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAC9B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAgB;IAC1C,6FAA6F;IAC7F,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgB;IAOxC,YAAY,OAAO,EAAE,sBAAsB,EAyB1C;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,OAAO,CAAC,oBAAoB;IAijB5B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,qBAAqB;IA4B7B,gBAAgB,CACd,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,eAAe,EACxB,KAAK,CAAC,EAAE,mBAAmB,GAC1B,IAAI,CAQN;IAED,iBAAiB,CACf,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,gBAAgB,EACzB,OAAO,CAAC,EAAE,gBAAgB,GACzB,IAAI,CASN;IAED;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,gBAAgB;IAiGxB,cAAc,CAAC,YAAY,EAAE,kBAAkB,GAAG,IAAI,CAuMrD;IAED,eAAe,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,CAIzE;IAEK,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAwHtF;IAED;;;;;;;;;;OAUG;IACH,OAAO,CAAC,sBAAsB;IA6CxB,oBAAoB,CACxB,KAAK,EAAE,eAAe,EACtB,KAAK,EAAE,yBAAyB,GAC/B,OAAO,CAAC,iBAAiB,CAAC,CAwD5B;IAED,eAAe,CAAC,MAAM,EAAE,iBAAiB,GAAG,qBAAqB,CAoBhE;IAED,sFAAsF;IACtF,OAAO,CAAC,aAAa;IAUf,kBAAkB,CACtB,KAAK,EAAE,eAAe,EACtB,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,eAAe,CAAC,CA0C1B;IAED;;mFAE+E;IAC/E,OAAO,CAAC,SAAS;IAoDjB;;;wEAGoE;IACpE,OAAO,CAAC,eAAe;IAuBjB,WAAW,CACf,SAAS,EAAE,WAAW,EACtB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,gBAAgB,CAAC,CAU3B;IAED;;;;;;OAMG;IACH,OAAO,CAAC,gBAAgB;IA2QlB,WAAW,CACf,KAAK,EAAE,eAAe,EACtB,KAAK,EAAE,mBAAmB,EAC1B,IAAI,EAAE,SAAS,GACd,OAAO,CAAC,IAAI,CAAC,CAoBf;IAED,oFAAoF;YACtE,QAAQ;IAkHhB,YAAY,CAChB,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,SAAS,GACd,OAAO,CAAC,IAAI,CAAC,CAoBf;IAEK,aAAa,CACjB,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAC3C,OAAO,CAAC,OAAO,CAAC,CAwBlB;IAEK,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CA6BhG;IAEK,QAAQ,CACZ,SAAS,EAAE,WAAW,EACtB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,SAAS,CAAC,CA2CpB;IAED;;;;;;;;;;;;;OAaG;IACG,iBAAiB,CAAC,YAAY,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CA4BxF;IAEK,uBAAuB,CAC3B,YAAY,EAAE,YAAY,EAC1B,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,gBAAgB,CAAC,CA2B3B;IAED,mFAAmF;IACnF,OAAO,CAAC,iBAAiB;IAOzB;;;;;;;OAOG;IACG,oBAAoB,CACxB,OAAO,EAAE,sBAAsB,EAC/B,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,SAAS,CAAC,CAiBpB;IAEK,cAAc,CAClB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,SAAS,CAAC,CAoBpB;IAED;;;;;;;;OAQG;YACW,WAAW;IA8BzB;;;;OAIG;YACW,WAAW;IAUzB,uEAAuE;IACvE,OAAO,CAAC,aAAa;IAgBf,aAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAkHjG;IAED;;;OAGG;IACH,OAAO,CAAC,cAAc;IAWtB;;;;OAIG;IACH,OAAO,CAAC,UAAU;IA2BlB,yGAAyG;IACzG,OAAO,CAAC,cAAc;IAMtB,4FAA4F;IAC5F,OAAO,CAAC,mBAAmB;IAgB3B;;;;;OAKG;YACW,eAAe;IAyB7B;;;;;OAKG;IACG,kBAAkB,CACtB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAA;KAAE,GACpC,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CA0CpC;IAED;;;;;OAKG;IACG,kBAAkB,CACtB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,SAAS,CAAC,CAOpB;IAED;;;;;OAKG;IACG,wBAAwB,CAC5B,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,gBAAgB,CAAC,CAW3B;IAED,uFAAuF;IACvF,OAAO,CAAC,gBAAgB;IAIxB;;;;OAIG;IACG,gBAAgB,CACpB,MAAM,EAAE,cAAc,EACtB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,SAAS,CAAC,CAIpB;IAED;;;;;OAKG;IACG,UAAU,CACd,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,SAAS,aAAa,EAAE,GACpC,OAAO,CAAC,YAAY,EAAE,CAAC,CAQzB;IAED,kGAAkG;IAClG,iBAAiB,IAAI;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,EAAE,CAE3E;IAED,mBAAmB,IAAI,oBAAoB,EAAE,CAQ5C;IAED,mBAAmB,IAAI,qBAAqB,EAAE,CAQ7C;IAED;;;;;;;;;;;;;;;OAeG;IACG,cAAc,CAClB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,eAAe,CAAC,CA+E1B;IAGK,eAAe,CACnB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,iBAAiB,CAAC,CA8G5B;IAED,sGAAsG;IACtG,OAAO,CAAC,SAAS;IAmUjB;;;;;;;;;OASG;IACH,OAAO,CAAC,cAAc;IAgBtB,qFAAqF;IACrF,OAAO,CAAC,SAAS;YAKH,SAAS;IAqBjB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAG3B;IAOD;;;;;;;;;;;;;;;;;;;;OAoBG;YACW,iBAAiB;IAgF/B;;;;;;;OAOG;IACH,OAAO,CAAC,sBAAsB;IAmDxB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAOjF;IAED,WAAW,CACT,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,UAAU,EACnB,KAAK,CAAC,EAAE,mBAAmB,GAC1B,IAAI,CAIN;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,QAAQ;IAuGV,WAAW,CACf,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,gBAAgB,GACtB,OAAO,CAAC,MAAM,CAAC,CAIjB;IAEK,UAAU,CACd,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAC/C,OAAO,CAAC,cAAc,CAAC,CAWzB;IAEK,OAAO,CACX,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,MAAM,CAAC,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,EAAE,CAAC,CAInB;IAEK,iBAAiB,CACrB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,gBAAgB,EACzB,KAAK,EAAE,WAAW,EAClB,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAC/B,OAAO,CAAC,IAAI,CAAC,CAgBf;IAED;;;;;;;OAOG;IACG,uBAAuB,CAC3B,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,wBAAwB,EAAE,CAAC,CAgCrC;IAED,iBAAiB,IAAI,iBAAiB,CAIrC;IAED;;;;;;;;OAQG;IACG,YAAY,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA6CrF;IAEK,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CA6B7F;IAEK,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAW3F;IAEK,0BAA0B,CAC9B,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,MAAM,CAAC,EAAE,qBAAqB,GAC7B,OAAO,CAAC,eAAe,EAAE,CAAC,CAO5B;IAEK,qBAAqB,CACzB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,EAAE,EAAE,iBAAiB,EACrB,OAAO,EAAE;QACP,MAAM,EAAE,qBAAqB,CAAC;QAC9B,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,OAAO,CAAC,EAAE,sBAAsB,GAAG,IAAI,CAAC;KACzC,GACA,OAAO,CAAC,IAAI,CAAC,CA4Bf;YAEa,QAAQ;IAyFtB;;;;OAIG;IACH,OAAO,CAAC,YAAY;IAmDpB;;;;;;OAMG;IACH;;;;;;OAMG;IACH,mFAAmF;IACnF,OAAO,CAAC,gBAAgB;IA4CxB,OAAO,CAAC,YAAY;IA0BpB;;;;;OAKG;IACH,OAAO,CAAC,WAAW;IASnB;;;;OAIG;IACH,OAAO,CAAC,cAAc;IAiDtB;;;;;;;;;OASG;YACW,gBAAgB;IA0D9B;;;;;;;;;OASG;YACW,eAAe;IAiB7B,gFAAgF;IAChF,OAAO,CAAC,aAAa;IAQrB,OAAO,CAAC,WAAW;IA2BnB,OAAO,CAAC,sBAAsB;IAe9B,4FAA4F;IAC5F,OAAO,CAAC,gBAAgB;IAYxB,OAAO,CAAC,UAAU;IA2pIlB;;;;;;;;;OASG;IACH;;;;OAIG;IACH,OAAO,CAAC,YAAY;IAOpB;;;;;OAKG;IACH,OAAO,CAAC,uBAAuB;IAc/B;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,iBAAiB;IAIzB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,iBAAiB;IA0BzB;;;;;;OAMG;IACH,OAAO,CAAC,4BAA4B;IA2BpC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,yBAAyB;IAWjC,OAAO,CAAC,sBAAsB;IAkI9B,OAAO,CAAC,SAAS;IAejB;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;YA4fV,sBAAsB;IAsDpC;;;;;;;;;OASG;IACH,OAAO,CAAC,oBAAoB;IAyB5B;;;;;OAKG;IACH;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,oBAAoB;IAU5B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,oBAAoB;IAa5B,OAAO,CAAC,UAAU;IAKlB;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,cAAc;IAKtB;;;;;OAKG;IACH,OAAO,CAAC,MAAM;IAuBd;;;OAGG;IACH,OAAO,CAAC,YAAY;IAUpB;;;;;;;OAOG;IACH,OAAO,CAAC,kBAAkB;IAyE1B,OAAO,CAAC,OAAO;CA6ChB"}

package/dist/index.js

@@ -1,8 +1,8 @@
 import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import Database from 'better-sqlite3';
-import { accessLogEntry, adminLogEntry, opsFailureEntry, opsFailureFingerprint, issueEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunEntry, modelUsageEntry, ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, createTenantInput, domainEvent, domainEventInput, exportReadInput, importBatch, importCursorMove, exportsOfManifestJson, importsOfManifestJson, entitlementGrant, entitlementGrantInput, eventId, meterReading, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, identityLink, identityPool, instant, connection, capabilityGrant, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchRecord, peerSwitch, verticalCaller, verticalSlug as verticalSlugOf, subjectRef, requestFingerprint, createConnectionInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, routeTarget, registerVerticalInput, vertical as verticalSchema, verticalChannel, verticalVersion, objectRef, grantRefFromProof, org as orgSchema, orgMembership, principalId, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, subjectShredReceipt, SCOPE_TABLE_PAGE_DEFAULT, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, verticalServingState, callsOfManifestJson, outboundOfManifestJson, listLimitOf, substratError, assertReplayableDump, delegatedReadRecord, redrainEventsInput, REDRAIN_BATCH, } from '@substrat-run/contracts';
-import { actorOf, asPrincipal, assertAllowed, assertNoSecret, assertPermissionKey, CAPABILITY_DDL, CAPABILITY_EXCHANGE_OPERATION, capabilityAttachmentWriteRefused, capabilityTokenHash, createCapabilityVerbs, exchangeCapability as exchangeCapabilitySecret, guardSecrets, mintBecomeCapability, plausibleSessionToken, redactSecrets, resolveCapabilitySession, revokeCapabilityAsPlatform, assertReadOnlyQuery, attachmentBlobKey, entitlementDenial, foldMeterReading, guardSpine, guardSqlLimits, parseValidationRecords, resolveScopeRecord, ulid, ISSUE_RETENTION_DAYS, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, SWEEP_RUNS_INTENT_INDEX, sweepRunsIntentHasKind, MODEL_USAGE_RETENTION_DAYS, foldModelUsage, backoffAt, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, JOB_RUN_PATCH_SQL, JOB_STEP_RECORD_SQL, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, switchSystemSchedules, admitPeer, collectPeers, peerSeats, resolveVerticalInstanceFrom, switchPeer, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, systemSwitchedOffMessage, SYSTEM_SWITCHES_BACKFILL_SQL, SYSTEM_SWITCHES_DDL, forgetSystemSwitchesOf, listSystemSwitchRecords, recordSystemSwitchedOff, recordSystemSwitchedOn, restoreSystemSwitchRecord, switchedOffModulesOf, systemSwitchRecordsOf, systemSwitchesTableExists, withRecorded, VERSION_MIGRATIONS_DDL, splitManifestMigrations, splitVersionMigrationsBatch, versionMigrationsOf, writeVersionMigrations, denialListQuery, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, IMPERSONATION_COLUMNS, IMPERSONATION_DDL, ImpersonationRefused, assertImpersonationWrites, assertModuleEnqueueableKind, assertSessionUsable, impersonationByIdQuery, impersonationListQuery, impersonationRowValues, impersonationStampOf, mapImpersonationRow, newImpersonationSession, resolveRetryPolicy, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, noSealingKeyMessage, openSealed, sealTo, ConnectionSealingKeyUnavailableError, PermissionDenied, createAtomic, NotSearchable, NotListable, listIndexMigrations, listIndexPlans, listQuery, cursorOf, moduleMigrations, isSearchIndexTable, searchIndexDdl, searchIndexMigrations, searchIndexPlans, searchLimit, searchMatchExpression, searchQuery, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, exportedSinceQuery, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, bindExportBreaksOf, bindExportBreakRefusal, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, jobRunListLimit, jobRunOf, runDueJobRuns, startJobRun, IDEMPOTENCY_DDL, assertIdempotencyKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, globalFetch, createUlid, facetEvents, readHistory, walkEventCause, walkEventEffects, assertRedrainWindow, readInvocation, readDeadLetters, domainEventOf, readUndrainedOutbox, undrainedEventsOf, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, } from '@substrat-run/kernel';
+import { accessLogEntry, adminLogEntry, delegatedReadParams, opsFailureEntry, opsFailureFingerprint, issueEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunEntry, modelUsageEntry, ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, createTenantInput, domainEvent, domainEventInput, exportReadInput, importBatch, importCursorMove, exportsOfManifestJson, importsOfManifestJson, entitlementGrant, entitlementGrantInput, eventId, meterReading, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, identityLink, identityPool, instant, connection, capabilityGrant, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchRecord, peerSwitch, verticalCaller, verticalSlug as verticalSlugOf, subjectRef, requestFingerprint, createConnectionInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, routeTarget, registerVerticalInput, vertical as verticalSchema, verticalChannel, verticalVersion, objectRef, entityObjectRef, grantRefFromProof, org as orgSchema, orgMembership, principalId, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, subjectShredReceipt, SCOPE_TABLE_PAGE_DEFAULT, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, verticalServingState, callsOfManifestJson, outboundOfManifestJson, listLimitOf, substratError, assertReplayableDump, delegatedReadRecord, redrainEventsInput, REDRAIN_BATCH, } from '@substrat-run/contracts';
+import { actorOf, asPrincipal, assertAllowed, assertNoSecret, assertPermissionKey, CAPABILITY_DDL, CAPABILITY_EXCHANGE_OPERATION, capabilityAttachmentWriteRefused, capabilityTokenHash, createCapabilityVerbs, exchangeCapability as exchangeCapabilitySecret, guardSecrets, mintBecomeCapability, plausibleSessionToken, redactSecrets, redactSecretText, moduleLog, consoleLogSink, resolveCapabilitySession, revokeCapabilityAsPlatform, assertReadOnlyQuery, attachmentBlobKey, entitlementDenial, foldMeterReading, guardSpine, guardSqlLimits, DO_SQL_LIMITS, tooManyResultColumns, tooManyTableColumns, parseValidationRecords, resolveScopeRecord, ulid, ISSUE_RETENTION_DAYS, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, SWEEP_RUNS_INTENT_INDEX, sweepRunsIntentHasKind, MODEL_USAGE_RETENTION_DAYS, foldModelUsage, backoffAt, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, JOB_RUN_PATCH_SQL, JOB_STEP_RECORD_SQL, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, switchSystemSchedules, admitPeer, collectPeers, peerSeats, resolveVerticalInstanceFrom, switchPeer, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, SYSTEM_SWITCHES_BACKFILL_SQL, SYSTEM_SWITCHES_DDL, forgetSystemSwitchesOf, listSystemSwitchRecords, recordSystemSwitchedOff, recordSystemSwitchedOn, restoreSystemSwitchRecord, scopesSwitchedOffFor, switchedOffModulesOf, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, systemSwitchRecordsOf, systemSwitchesTableExists, withRecorded, VERSION_MIGRATIONS_DDL, splitManifestMigrations, splitVersionMigrationsBatch, versionMigrationsOf, writeVersionMigrations, denialListQuery, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, IMPERSONATION_COLUMNS, IMPERSONATION_DDL, ImpersonationRefused, assertImpersonationWrites, assertModuleEnqueueableKind, assertSessionUsable, impersonationByIdQuery, impersonationListQuery, impersonationRowValues, impersonationStampOf, mapImpersonationRow, newImpersonationSession, resolveRetryPolicy, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, noSealingKeyMessage, openSealed, sealTo, ConnectionSealingKeyUnavailableError, PermissionDenied, createAtomic, NotSearchable, NotListable, listIndexMigrations, listIndexPlans, listQuery, cursorOf, moduleMigrations, isSearchIndexTable, searchIndexDdl, searchIndexMigrations, searchIndexPlans, searchLimit, searchMatchExpression, searchQuery, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, exportedSinceQuery, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, bindExportBreaksOf, bindExportBreakRefusal, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, jobRunListLimit, jobRunOf, runDueJobRuns, startJobRun, IDEMPOTENCY_DDL, assertIdempotencyKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, globalFetch, createUlid, facetEvents, readHistory, walkEventCause, walkEventEffects, assertRedrainWindow, readInvocation, readDeadLetters, domainEventOf, readUndrainedOutbox, undrainedEventsOf, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, } from '@substrat-run/kernel';
 import { ScopeActor } from './actor.js';
 import { createTupleChecker } from './checker.js';
 /**
@@ -505,6 +505,8 @@ export class SqliteScopeHost {
     connectorCalls;
     clock;
     versionId;
+    /** #1746: where `ctx.log` lines go — the console unless a caller (a test) says otherwise. */
+    logSink;
     // The mint for event ids (#956) is NOT here: it lives on `ScopeRuntime`, one per
     // scope, seeded from that scope's persisted maximum (#1335). Its own monotonic
     // floor, because the timestamp it stamps comes from `this.clock` — a scripted
@@ -516,6 +518,7 @@ export class SqliteScopeHost {
         this.connectorCalls = options.connectorCalls ?? noopConnectorCallRecorder;
         this.clock = options.clock ?? (() => instant.parse(new Date().toISOString()));
         this.versionId = options.versionId ?? null;
+        this.logSink = options.logSink ?? consoleLogSink;
         this.dir = options.dir;
         mkdirSync(this.dir, { recursive: true });
         this.directory = new Database(join(this.dir, '_directory.sqlite'));
@@ -1078,6 +1081,9 @@ export class SqliteScopeHost {
         -- the operation column) and the newest matching evidence. NULL on other kinds.
         event_type TEXT,
         observed_at TEXT,
+        -- #1840 platform-request rows: the drain pass's fleet-wide totals, as JSON.
+        -- NULL on every other kind.
+        platform_requests TEXT,
         at TEXT NOT NULL
       );
       CREATE INDEX IF NOT EXISTS _substrat_sweep_runs_unit ON _substrat_sweep_runs (kind, unit, id);
@@ -1557,13 +1563,35 @@ export class SqliteScopeHost {
      * holds on the scope's actor: every module the directory records OFF on the scope is
      * switched off again. Already off answers `changed: false` and writes nothing, and a
      * module the scope does not hold is left alone. Audited only when something moved.
+     *
+     * `audit` receives each row. By default it writes to the admin log at once. A caller running
+     * this inside a scope transaction that may still roll back (a restore's replay) collects
+     * the rows and writes them once the transaction commits. The admin log is another
+     * database, and a row must not outlive a move that was rolled back.
      */
-    reassertSwitchesInTurn(rt, actor, tenantId, scopeId) {
+    reassertSwitchesInTurn(rt, actor, tenantId, scopeId, opts, audit = (after) => this.recordAdmin(actor, 'reassertSystemSwitch', { tenantId, scopeId }, null, after)) {
         const at = new Date().toISOString();
-        return switchedOffModulesOf(switchSqlOf(this.directory), tenantId, scopeId).map((moduleId) => {
+        // #1742 review: a move the deployment made from a stale list — the module was restored
+        // ON after the list was read — is undone first, so the operator's ON stands.
+        const recorded = systemSwitchRecordsOf(switchSqlOf(this.directory), tenantId, scopeId);
+        // One synchronous turn: no switch can land between this read and the moves below.
+        const reverted = new Set(staleCarryReverts(recorded, opts?.appliedInUnit));
+        for (const moduleId of reverted) {
+            const outcome = rt.db.transaction(() => switchSystemSchedules(switchSqlOf(rt.db), { moduleId, scopeId, to: 'on', at }))();
+            if (outcome.changed)
+                audit({ operationId: ulid(), ...staleCarryRevertRow(moduleId, outcome) });
+        }
+        const recordedOff = switchedOffModulesOf(switchSqlOf(this.directory), tenantId, scopeId);
+        // #1742: what a deployment already switched off inside its own unit, audited here — the
+        // switch below answers `changed: false` for it and would write no row.
+        // A move the revert above undid is not credited as an in-unit OFF.
+        const applied = opts?.appliedInUnit?.filter((a) => !reverted.has(a.moduleId));
+        for (const row of inUnitMovesToAudit(recordedOff, applied))
+            audit({ operationId: ulid(), ...row });
+        return recordedOff.map((moduleId) => {
             const outcome = rt.db.transaction(() => switchSystemSchedules(switchSqlOf(rt.db), { moduleId, scopeId, to: 'off', at }))();
             if (outcome.changed) {
-                this.recordAdmin(actor, 'reassertSystemSwitch', { tenantId, scopeId }, null, {
+                audit({
                     operationId: ulid(),
                     moduleId,
                     schedules: 'off',
@@ -2015,7 +2043,10 @@ export class SqliteScopeHost {
         this.recordAdmin(actor, 'importScope', { tenantId: input.tenantId, scopeId: input.scopeId }, null, { sourceScopeId: dump.scopeId, tables: dump.tables.length, capturedAt: dump.capturedAt });
     }
     /** Drop-then-replay a dump into a scope's db, refreshing the migration frontier. */
-    async loadDump(tenantId, scopeId, tables) {
+    async loadDump(tenantId, scopeId, tables, 
+    /** Run inside the load's own transaction, after the replay (#1742) — the restore's re-assert
+     *  of the switch. It throws to roll the load back. */
+    afterLoad) {
         const rt = this.runtime(tenantId, scopeId);
         const db = rt.db;
         const load = db.transaction((dumped) => {
@@ -2098,6 +2129,9 @@ export class SqliteScopeHost {
             // rewritten row collapses onto an existing one rather than failing the restore.
             db.prepare(`UPDATE OR REPLACE _substrat_tuples SET object = ?
           WHERE object LIKE 'scope:%' AND object <> ?`).run(`scope:${scopeId}`, `scope:${scopeId}`);
+            // #1742: inside the replay's transaction, so a failure here rolls the whole load back and
+            // the dump's grants never commit without the switch that should cover them.
+            afterLoad?.(rt);
         });
         // On the scope actor (#1678): issued while an invoke held its transaction open, the
         // load was a SAVEPOINT inside it, and that invoke's rollback undid the restore after
@@ -2117,7 +2151,14 @@ export class SqliteScopeHost {
         const existing = await this.admin.getScopeRecord(actor, tenantId, scopeId);
         if (!existing)
             throw substratError('not_found', `unknown scope ${scopeId} in tenant ${tenantId}`);
-        await this.loadDump(tenantId, scopeId, dump.tables);
+        // #1742: a dump from before a switch was pulled brings the module's grants back live, so
+        // the directory's recorded-off modules go back off in the load's own turn, as a
+        // provision's seat does — no schedule pass can run in between.
+        // The re-assert's audit rows are written only once the load has committed.
+        const rows = [];
+        await this.loadDump(tenantId, scopeId, dump.tables, (rt) => this.reassertSwitchesInTurn(rt, actor, tenantId, scopeId, undefined, (after) => rows.push(after)));
+        for (const after of rows)
+            this.recordAdmin(actor, 'reassertSystemSwitch', { tenantId, scopeId }, null, after);
         this.recordAdmin(actor, 'restoreScope', { tenantId, scopeId }, null, { sourceScopeId: dump.scopeId, tables: dump.tables.length, capturedAt: dump.capturedAt });
     }
     async snapshotScope(actor, tenantId, scopeId, opts) {
@@ -2865,10 +2906,14 @@ export class SqliteScopeHost {
             }
             // Due — invoke through the system door (a fresh stub per schedule keeps the
             // K-34 authorization accumulator clean, and the door re-checks the scope).
+            // #1525: one id for THIS call, minted before the invoke so it is the same id
+            // whether the operation succeeds or throws — an event or a denial the call
+            // produces either way carries it, and so does the row below.
+            const invocationId = ulid();
             let status = 'ok';
             try {
                 const stub = await this.getSystemScope(moduleId, tenantId, scopeId);
-                await stub.invoke(schedule.operation, schedule.input);
+                await stub.invoke(schedule.operation, schedule.input, { invocationId });
                 report.fired += 1;
             }
             catch (err) {
@@ -2882,11 +2927,12 @@ export class SqliteScopeHost {
             // On the scope actor (#1678): the cadence row joined whatever transaction an invoke
             // held open, so its rollback forgot the run and the next pass fired it AGAIN.
             await rt.actor.turn(() => rt.db
-                .prepare(`INSERT INTO _substrat_schedule_state (kind, schedule_op, last_run_at, last_status)
-               VALUES ('schedule', ?, ?, ?)
+                .prepare(`INSERT INTO _substrat_schedule_state (kind, schedule_op, last_run_at, last_status, invocation_id)
+               VALUES ('schedule', ?, ?, ?, ?)
              ON CONFLICT(kind, schedule_op) DO UPDATE SET last_run_at = excluded.last_run_at,
-                                                          last_status = excluded.last_status`)
-                .run(schedule.operation, new Date(now).toISOString(), status));
+                                                          last_status = excluded.last_status,
+                                                          invocation_id = excluded.invocation_id`)
+                .run(schedule.operation, new Date(now).toISOString(), status, invocationId));
             report.runs.push({ operation: schedule.operation, outcome: status === 'ok' ? 'ok' : 'failed' });
         }
         return report;
@@ -2911,6 +2957,13 @@ export class SqliteScopeHost {
         return {
             tenantId,
             scopeId,
+            // #1746: the door decided it. A capability session and a peer door each resolve to
+            // their subject per invoke, but the KIND is fixed when the stub is minted.
+            subjectKind: authority.kind === 'capability-session'
+                ? 'capability'
+                : authority.kind === 'vertical-peer'
+                    ? 'vertical'
+                    : authority.kind,
             invoke: async (operation, input, invokeOptions) => {
                 const handler = operations.get(operation);
                 // `not_found`, not a bare throw (#113) — the same code `adapter-cloudflare`
@@ -2978,6 +3031,8 @@ export class SqliteScopeHost {
                 // #116: reported after the task, like the version — a replay is a fact
                 // about the response, and the response is not one until it is returned.
                 let replayed = false;
+                // #1746: what this call itself emitted, for `onEmitted`. Set only after a commit.
+                let emittedReport;
                 const invoked = await rt.actor.enqueue(async () => {
                     // #1237: the invocation this call belongs to, for the duration of it. Set
                     // INSIDE the actor task — the actor serializes invoke and dispatch alike, so
@@ -2988,6 +3043,11 @@ export class SqliteScopeHost {
                     // The outbox's insertion mark, inside the actor task so nothing else writes between it
                     // and this invoke (`OUTBOX_MARK_SQL` says why rowid and not the id).
                     const exportMark = exportTypes.length > 0 ? Number(rt.db.prepare(OUTBOX_MARK_SQL).get().mark) : null;
+                    // #1746: the same mark, taken only when the caller asked what this call emitted. A
+                    // read-only session commits nothing, so it has nothing to report and skips the read.
+                    const emittedMark = invokeOptions?.onEmitted !== undefined && session?.mode !== 'read-only'
+                        ? (exportMark ?? Number(rt.db.prepare(OUTBOX_MARK_SQL).get().mark))
+                        : null;
                     try {
                         // #1672: the capability door's session, re-resolved on EVERY invoke and inside the
                         // actor task — so nothing can revoke between this read and the transaction below.
@@ -3122,6 +3182,12 @@ export class SqliteScopeHost {
                                 this.recordDenial(rt, subject, operation, err, rt.invocationId, session);
                             throw err;
                         }
+                        // #1746: read BEFORE the drain below, so the rows above the mark are this
+                        // operation's own emits and none of its consumers'. A replay committed nothing.
+                        if (emittedMark !== null && !replayed) {
+                            const q = emittedSinceQuery(emittedMark, EMITTED_REPORT_CAP);
+                            emittedReport = emittedReportOf(rt.db.prepare(q.sql).all(...q.params));
+                        }
                         // Post-commit, still inside the actor task: drain outbox → consumers,
                         // then → executors. Prompt dispatch (K-22 §4.2): the common case
                         // completes inside this request, with the outbox as the retry backstop
@@ -3158,6 +3224,8 @@ export class SqliteScopeHost {
                     invokeOptions?.onEntityVersion?.(committedVersion);
                 if (replayed)
                     invokeOptions?.onIdempotentReplay?.();
+                if (emittedReport)
+                    invokeOptions?.onEmitted?.(emittedReport);
                 return invoked;
             },
         };
@@ -4240,7 +4308,8 @@ export class SqliteScopeHost {
         };
         const writeGrant = (subject, permission, node, entity, expiresAt) => {
             if (entity) {
-                writeScopeTuple(node, subject, `granted:${permission}`, `${entity.entityType}:${entity.entityId}`, expiresAt);
+                writeScopeTuple(node, subject, `granted:${permission}`, entityObjectRef(entity, 'HostAdmin'), // #1856: grant and grantToOrg both land here
+                expiresAt);
             }
             else if (node.scopeId) {
                 writeScopeTuple(node, subject, `granted:${permission}`, `scope:${node.scopeId}`, expiresAt);
@@ -4722,8 +4791,15 @@ export class SqliteScopeHost {
                     });
                 }
                 else {
-                    // Tenant-level: a directory write, which no scope's transaction can hold.
-                    write();
+                    // Tenant-level: a directory write, which no scope's transaction can hold. #1743:
+                    // refused while the record holds the module off on any scope (`scopesSwitchedOffFor`);
+                    // the record and the tenant tuple share the directory, so this is one transaction.
+                    this.directory.transaction(() => {
+                        const off = scopesSwitchedOffFor(switchSqlOf(this.directory), grant.node.tenantId, grant.moduleId);
+                        if (off.length > 0)
+                            throw substratError('conflict', tenantSystemSwitchedOffMessage(grant.moduleId, off));
+                        write();
+                    })();
                 }
                 this.recordAdmin(actor, 'grantToSystem', { tenantId: grant.node.tenantId, scopeId: grant.node.scopeId }, null, { moduleId: grant.moduleId, permission: grant.permission, node: grant.node });
             },
@@ -4744,10 +4820,10 @@ export class SqliteScopeHost {
                 this.recordAccess(actor, 'listSystemSwitches', { tenantId: filter?.tenantId ?? null }, filter ?? null, rows.length);
                 return rows.map((r) => systemSwitchRecord.parse(r));
             },
-            reassertSystemSwitches: async (actor, node) => {
+            reassertSystemSwitches: async (actor, node, opts) => {
                 this.assertScope(node.tenantId, node.scopeId);
                 const rt = this.runtime(node.tenantId, node.scopeId);
-                return rt.actor.turn(() => this.reassertSwitchesInTurn(rt, actor, node.tenantId, node.scopeId));
+                return rt.actor.turn(() => this.reassertSwitchesInTurn(rt, actor, node.tenantId, node.scopeId, opts));
             },
             peerGrantsStatus: peerGrantsStatusOf,
             // #1672 — the platform's two capability verbs, both a turn on the scope actor
@@ -5701,7 +5777,7 @@ export class SqliteScopeHost {
                 // NULL a missing field does, and only the helper counts them apart.
                 const db = this.scopeReadDbFor(tenantId, scopeId);
                 const result = facetEvents({ sql: scopedSql(db) }, input);
-                this.recordAccess(actor, 'facetEvents', { tenantId, scopeId }, input, result.buckets.length);
+                this.recordAccess(actor, 'facetEvents', { tenantId, scopeId }, delegatedReadParams.facetEvents(input, result), result.buckets.length);
                 return result;
             },
             entityHistory: async (actor, tenantId, scopeId, input) => {
@@ -6158,6 +6234,11 @@ export class SqliteScopeHost {
                 // Counted before the replace — afterwards the old directory is gone, and
                 // "restored over N tenants" is the fact the audit entry exists to carry.
                 const before = this.directory.prepare('SELECT COUNT(*) AS n FROM tenants').get().n;
+                // The dump is untrusted input, as it is on the DO path (#1143). Its names reach SQL
+                // as identifiers, and `exec` runs every statement a `ddl` contains, so a CREATE
+                // TABLE with anything appended used to run that too. Judged as a whole before the
+                // first DROP, so a refused dump leaves the directory untouched.
+                assertReplayableDump(dump.tables);
                 // One transaction, foreign keys deferred to commit: the dump is ordered by
                 // table NAME (which says nothing about references — `scopes` points at
                 // `tenants`), and the DROPs themselves delete rows a populated child would
@@ -6170,8 +6251,10 @@ export class SqliteScopeHost {
                         .all();
                     for (const { name } of existing)
                         this.directory.exec(`DROP TABLE IF EXISTS "${name}"`);
+                    // `prepare` compiles only the first statement, as in `loadDump`. The check above
+                    // has pinned that one to this table's CREATE TABLE.
                     for (const t of dump.tables)
-                        this.directory.exec(t.ddl);
+                        this.directory.prepare(t.ddl).run();
                     for (const t of dump.tables) {
                         if (t.rows.length === 0)
                             continue;
@@ -7150,12 +7233,12 @@ export class SqliteScopeHost {
                 this.directory
                     .prepare(`INSERT OR IGNORE INTO _substrat_sweep_runs
                (id, kind, unit, outcome, tenant_id, scope_id, vertical, version, operation,
-                connection_id, error, elapsed_ms, request_id, event_type, observed_at, at)
-             VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+                connection_id, error, elapsed_ms, request_id, event_type, observed_at, platform_requests, at)
+             VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
                     .run(ulid(), entry.kind, entry.unit, entry.outcome, entry.tenantId ?? null, entry.scopeId ?? null, entry.vertical ?? null, entry.version ?? null, entry.operation ?? null, entry.connectionId ?? null, 
                 // Bounded here, not trusted from the sweep: one runaway provider body
                 // must not become a runaway directory row (the #559 rule).
-                entry.error == null ? null : entry.error.slice(0, 2000), entry.elapsedMs ?? null, entry.requestId ?? null, entry.eventType ?? null, entry.observedAt ?? null, entry.at ?? new Date().toISOString());
+                entry.error == null ? null : entry.error.slice(0, 2000), entry.elapsedMs ?? null, entry.requestId ?? null, entry.eventType ?? null, entry.observedAt ?? null, entry.platformRequests == null ? null : JSON.stringify(entry.platformRequests), entry.at ?? new Date().toISOString());
                 // Prune-on-write, like ops failures and for the same reason: the table stays
                 // bounded even on a deployment whose scheduled pass is broken.
                 const horizon = new Date(Date.now() - SWEEP_RUN_RETENTION_DAYS * 86_400_000).toISOString();
@@ -7216,6 +7299,7 @@ export class SqliteScopeHost {
                     elapsedMs: r.elapsed_ms,
                     eventType: r.event_type,
                     observedAt: r.observed_at,
+                    platformRequests: r.platform_requests == null ? null : JSON.parse(r.platform_requests),
                     at: r.at,
                 }));
             },
@@ -7515,6 +7599,7 @@ export class SqliteScopeHost {
         this.ensureColumn(this.directory, '_substrat_sweep_runs', 'request_id', 'request_id TEXT');
         this.ensureColumn(this.directory, '_substrat_sweep_runs', 'event_type', 'event_type TEXT');
         this.ensureColumn(this.directory, '_substrat_sweep_runs', 'observed_at', 'observed_at TEXT');
+        this.ensureColumn(this.directory, '_substrat_sweep_runs', 'platform_requests', 'platform_requests TEXT');
         this.ensureSweepRunsIntentKind();
         const existing = new Set(this.directory.prepare('PRAGMA table_info(scopes)').all().map((c) => c.name));
         for (const [column, ddl] of [
@@ -7713,8 +7798,22 @@ export class SqliteScopeHost {
             tenantId: rt.tenantId,
             scopeId: rt.scopeId,
             principal,
-            sql: guardSecrets(guardSqlLimits(scopedSql(rt.db)), minted),
+            sql: guardSecrets(guardSqlLimits(scopedSql(rt.db, true)), minted),
             now: () => at,
+            // #1746/#1747: the host stamps who and where; module code supplies only the template
+            // and its fields. The invocation id is read per call — it is set for the duration of
+            // the actor task this context runs in.
+            log: moduleLog({
+                tenantId: rt.tenantId,
+                scopeId: rt.scopeId,
+                operation: operation ?? null,
+                invocationId: () => rt.invocationId,
+                // A consumer runs under the system override, so it logs as `system`.
+                principalKind: overrideActor ? 'system' : subject.kind,
+                // The string-safe redaction: `redactSecrets` parses its serialization back, and a
+                // log's text is not JSON.
+                redact: (text) => redactSecretText(text, minted),
+            }, this.logSink),
             emit: (event) => {
                 assertImpersonationWrites(impersonation, 'ctx.emit');
                 const input = domainEventInput.parse(event);
@@ -7865,6 +7964,7 @@ export class SqliteScopeHost {
              */
             grant: async (principal, permission, entity) => {
                 assertImpersonationWrites(impersonation, 'ctx.grant');
+                entityObjectRef(entity, 'ctx.grant'); // #1856: a tuple the walk can read back
                 const held = await runCheck(permission, entity);
                 if (!held.allowed) {
                     throw new PermissionDenied(`cannot grant '${permission}' on ${entity.entityType}:${entity.entityId} — ` +
@@ -7875,7 +7975,11 @@ export class SqliteScopeHost {
              VALUES (?, ?, ?)`)
                     .run(`principal:${principal}`, `granted:${permission}`, `${entity.entityType}:${entity.entityId}`);
             },
-            /** Withdraw a grant this caller could have made. Same guardrails, same reason. */
+            /**
+             * Withdraw a grant this caller could have made. Same guardrails, same reason — but NOT
+             * the #1856 grammar check `grant` and `link` make: a revoke writes nothing the walk
+             * must read back, and a grant stored before that check existed must stay removable.
+             */
             revoke: async (principal, permission, entity) => {
                 assertImpersonationWrites(impersonation, 'ctx.revoke');
                 const held = await runCheck(permission, entity);
@@ -7905,6 +8009,8 @@ export class SqliteScopeHost {
             }),
             link: (child, parent) => {
                 assertImpersonationWrites(impersonation, 'ctx.link');
+                entityObjectRef(child, 'ctx.link'); // #1856: an edge the walk can read back
+                entityObjectRef(parent, 'ctx.link');
                 const allowed = relations.get(child.entityType);
                 if (!allowed?.has(parent.entityType)) {
                     throw new Error(`undeclared entity relation: ${child.entityType} → ${parent.entityType} ` +
@@ -7995,6 +8101,7 @@ export class SqliteScopeHost {
                             .get(moduleId, migration.version);
                         if (!already) {
                             rt.db.exec(migration.sql);
+                            assertTablesWithinColumnLimit(rt.db);
                             rt.db
                                 .prepare('INSERT INTO _substrat_migrations (module_id, version, applied_at) VALUES (?, ?, ?)')
                                 .run(moduleId, migration.version, this.clock());
@@ -8223,6 +8330,14 @@ export class SqliteScopeHost {
         // #1288: not an ensureColumn, because `kind` joins the schedule-state PRIMARY KEY
         // and no ALTER can widen a key. Rebuilt instead, from the kernel's statements.
         this.ensureScheduleStateKind(db);
+        // #1525: the invocation a fired schedule ran in, on a scope DB created before the
+        // column. Nullable, and the null is honestly "no call was carried" for every legacy
+        // row — a past run's id cannot be recovered afterwards, exactly as the other #1525
+        // columns above argued. AFTER `ensureScheduleStateKind`, not before: a pre-#1288
+        // table has no `kind` column, and that call's rebuild already recreates the table
+        // from the kernel's (now widened) DDL when it runs — so by the time this ALTER
+        // executes, the table always already has `kind` in its key, never `invocation_id`.
+        this.ensureColumn(db, '_substrat_schedule_state', 'invocation_id', 'invocation_id TEXT');
         // #1237: `readInvocation`'s lookup — WHERE invocation_id = ? ORDER BY id — over an outbox
         // that is never pruned. No index leads with invocation_id, so without this one SQLite
         // walks the PRIMARY KEY from the oldest event until it reaches the call, and reading a
@@ -8309,13 +8424,49 @@ function spineSql(db) {
         },
     };
 }
-function scopedSql(db) {
+/**
+ * Refuse a migration that left a table wider than a Durable Object allows (#1811). Judged on the
+ * schema AFTER the migration ran, inside its transaction, so the throw rolls the migration back
+ * and the scope fails closed as it would hosted — from `CREATE TABLE` and from `ADD COLUMN` alike,
+ * with no parsing of the migration's text. `table_xinfo`, not `table_info`: the DO counts a
+ * generated column and a virtual table's hidden columns, and `table_info` shows neither.
+ */
+function assertTablesWithinColumnLimit(db) {
+    const wide = db
+        .prepare(`SELECT m.name AS name, COUNT(*) AS width FROM sqlite_master m, pragma_table_xinfo(m.name) c
+        WHERE m.type = 'table' GROUP BY m.name HAVING COUNT(*) > ? ORDER BY m.name LIMIT 1`)
+        .get(DO_SQL_LIMITS.columns);
+    if (wide)
+        throw new Error(tooManyTableColumns(wide.name, wide.width));
+}
+function scopedSql(db, judgeWidth = false) {
+    // #1811: a Durable Object refuses a result set over its column cap, `exec` of a SELECT included.
+    // The driver knows the width, so it is read off the prepared statement rather than parsed out
+    // of the text (a `SELECT *` is as wide as the tables under it). Module SQL only, like the
+    // other limits.
+    const prepare = (sql) => {
+        const stmt = db.prepare(sql);
+        if (judgeWidth && stmt.reader) {
+            const width = stmt.columns().length;
+            if (width > DO_SQL_LIMITS.columns)
+                throw new Error(tooManyResultColumns(width));
+        }
+        return stmt;
+    };
     return guardSpine({
-        query: (sql, params = []) => db.prepare(sql).all(...params),
+        query: (sql, params = []) => prepare(sql).all(...params),
         exec: (sql, params = []) => {
-            const info = db.prepare(sql).run(...params);
+            const stmt = prepare(sql);
+            // Runtime DDL (a module's own `CREATE TABLE` / `ADD COLUMN` outside a migration) is judged
+            // the same way a migration is: by what the schema is afterwards. `schema_version` moves on
+            // exactly the statements that change it, so a plain write costs two header reads and no scan.
+            const before = judgeWidth && !stmt.reader ? schemaVersion(db) : 0;
+            const info = stmt.run(...params);
+            if (judgeWidth && !stmt.reader && schemaVersion(db) !== before)
+                assertTablesWithinColumnLimit(db);
             return { changes: info.changes };
         },
     });
 }
+const schemaVersion = (db) => db.pragma('schema_version', { simple: true });
 //# sourceMappingURL=index.js.map