npm - @substrat-run/adapter-sqlite - Versions diffs - 0.136.0 → 0.137.0 - Mend

@substrat-run/adapter-sqlite 0.136.0 → 0.137.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (8) hide show

package/dist/checker.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"checker.d.ts","sourceRoot":"","sources":["../src/checker.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAC3C,OAAO,KAAK,EAAQ,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,~~EAIL~~,KAAK,KAAK,EACV,KAAK,iBAAiB,EAIvB,MAAM,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;GAaG;AAEH,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC;IAC7B,kFAAkF;IAClF,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,QAAQ,CAAC,QAAQ,GAAG,SAAS,CAAC;IACxD,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAAC;IACnE;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,KAAK,CAAC;CACf;~~AAyCD~~;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,WAAW,GAAG,iBAAiB,CAsBvE"}
1	+ {"version":3,"file":"checker.d.ts","sourceRoot":"","sources":["../src/checker.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAC3C,OAAO,KAAK,EAAQ,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAKL,KAAK,KAAK,EACV,KAAK,iBAAiB,EAIvB,MAAM,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;GAaG;AAEH,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC;IAC7B,kFAAkF;IAClF,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,QAAQ,CAAC,QAAQ,GAAG,SAAS,CAAC;IACxD,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAAC;IACnE;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,KAAK,CAAC;CACf;AA8CD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,WAAW,GAAG,iBAAiB,CAsBvE"}

package/dist/checker.js CHANGED Viewed

@@ -1,4 +1,4 @@
-import { capabilityByIdQuery, createTupleEvaluator, } from '@substrat-run/kernel';
+import { capabilityByIdQuery, createTupleEvaluator, SYSTEM_SWITCH_OFF_QUERY, } from '@substrat-run/kernel';
 const TUPLE_COLUMNS = 'subject, relation, object, expires_at, revoked_at';
 /**
  * The scope-local reads. Each statement is compiled at most once per decision and only if
@@ -12,6 +12,7 @@ const scopeReader = (db) => {
     let grantStmt;
     let parentsStmt;
     let capabilityStmt;
+    let switchedOffStmt;
     return {
         tuples: (subject, relationPrefix) => (tuplesStmt ??= db.prepare(`SELECT ${TUPLE_COLUMNS} FROM _substrat_tuples
          WHERE subject = ? AND relation LIKE ?`)).all(subject, `${relationPrefix}%`),
@@ -22,6 +23,9 @@ const scopeReader = (db) => {
         // #1672: a capability subject is resolved against its own directory row, which lives
         // in this scope's spine beside the entities it reaches.
         capability: (id) => (capabilityStmt ??= db.prepare(capabilityByIdQuery(id).sql)).get(...capabilityByIdQuery(id).params),
+        // #1823: the kill switch's OFF marker, in this scope's own spine — the gate's predicate.
+        switchedOff: (subject) => Number((switchedOffStmt ??= db.prepare(SYSTEM_SWITCH_OFF_QUERY)).get(subject)?.off) ===
+            1,
     };
 };
 /**

package/dist/checker.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"checker.js","sourceRoot":"","sources":["../src/checker.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,mBAAmB,EACnB,oBAAoB,~~GAOrB~~,MAAM,sBAAsB,CAAC;AAiC9B,MAAM,aAAa,GAAG,mDAAmD,CAAC;AAE1E;;;;;;GAMG;AACH,MAAM,WAAW,GAAG,CAAC,EAAqB,EAAoB,EAAE;IAC9D,IAAI,UAA0C,CAAC;IAC/C,IAAI,SAAyC,CAAC;IAC9C,IAAI,WAA2C,CAAC;IAChD,IAAI,cAA8C,CAAC;IACnD,OAAO;QACL,MAAM,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,EAAE,CAClC,CAAC,UAAU,KAAK,EAAE,CAAC,OAAO,CACxB,UAAU,aAAa;+CACgB,CACxC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,cAAc,GAAG,CAAyB;QAC/D,KAAK,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,CACnC,CAAC,SAAS,KAAK,EAAE,CAAC,OAAO,CACvB,UAAU,aAAa;2DAC4B,CACpD,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAmC;QACrE,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAClB,CAAC,WAAW,KAAK,EAAE,CAAC,OAAO,CACzB,UAAU,aAAa;mDACoB,CAC5C,CAAC,CAAC,GAAG,CAAC,MAAM,CAAyB;QACxC,qFAAqF;QACrF,wDAAwD;QACxD,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,CACjB,CAAC,cAAc,KAAK,EAAE,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAC9D,GAAG,mBAAmB,CAAC,EAAE,CAAC,CAAC,MAAM,CACL;~~KACjC~~,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAiB;IAClD,MAAM,OAAO,GAAiB,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IAE7E,MAAM,MAAM,GAA0B;QACpC,GAAG,EAAE,OAAO;QACZ,YAAY,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,CAClD,IAAI,CAAC,SAAS;aACX,OAAO,CACN,UAAU,aAAa;mEACkC,CAC1D;aACA,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,cAAc,GAAG,CAAyB;QACzE,OAAO,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC;QACvD,oFAAoF;QACpF,4EAA4E;QAC5E,QAAQ,EAAE,CAAC,IAAU,EAAE,EAAE;YACvB,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACjE,OAAO,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1C,CAAC;KACF,CAAC;IAEF,OAAO,oBAAoB,CAAC,MAAM,CAAC,CAAC;AACtC,CAAC"}
1	+ {"version":3,"file":"checker.js","sourceRoot":"","sources":["../src/checker.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,GAOxB,MAAM,sBAAsB,CAAC;AAiC9B,MAAM,aAAa,GAAG,mDAAmD,CAAC;AAE1E;;;;;;GAMG;AACH,MAAM,WAAW,GAAG,CAAC,EAAqB,EAAoB,EAAE;IAC9D,IAAI,UAA0C,CAAC;IAC/C,IAAI,SAAyC,CAAC;IAC9C,IAAI,WAA2C,CAAC;IAChD,IAAI,cAA8C,CAAC;IACnD,IAAI,eAA+C,CAAC;IACpD,OAAO;QACL,MAAM,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,EAAE,CAClC,CAAC,UAAU,KAAK,EAAE,CAAC,OAAO,CACxB,UAAU,aAAa;+CACgB,CACxC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,cAAc,GAAG,CAAyB;QAC/D,KAAK,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,CACnC,CAAC,SAAS,KAAK,EAAE,CAAC,OAAO,CACvB,UAAU,aAAa;2DAC4B,CACpD,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAmC;QACrE,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAClB,CAAC,WAAW,KAAK,EAAE,CAAC,OAAO,CACzB,UAAU,aAAa;mDACoB,CAC5C,CAAC,CAAC,GAAG,CAAC,MAAM,CAAyB;QACxC,qFAAqF;QACrF,wDAAwD;QACxD,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,CACjB,CAAC,cAAc,KAAK,EAAE,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAC9D,GAAG,mBAAmB,CAAC,EAAE,CAAC,CAAC,MAAM,CACL;QAChC,yFAAyF;QACzF,WAAW,EAAE,CAAC,OAAO,EAAE,EAAE,CACvB,MAAM,CAAE,CAAC,eAAe,KAAK,EAAE,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAiC,EAAE,GAAG,CAAC;YACpH,CAAC;KACJ,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAiB;IAClD,MAAM,OAAO,GAAiB,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IAE7E,MAAM,MAAM,GAA0B;QACpC,GAAG,EAAE,OAAO;QACZ,YAAY,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,CAClD,IAAI,CAAC,SAAS;aACX,OAAO,CACN,UAAU,aAAa;mEACkC,CAC1D;aACA,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,cAAc,GAAG,CAAyB;QACzE,OAAO,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC;QACvD,oFAAoF;QACpF,4EAA4E;QAC5E,QAAQ,EAAE,CAAC,IAAU,EAAE,EAAE;YACvB,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACjE,OAAO,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1C,CAAC;KACF,CAAC;IAEF,OAAO,oBAAoB,CAAC,MAAM,CAAC,CAAC;AACtC,CAAC"}

package/dist/index.d.ts CHANGED Viewed

@@ -278,7 +278,8 @@ export declare class SqliteScopeHost implements ScopeHost {
      * `HostAdmin.reassertSystemSwitches`' body (#1674), run inside a turn the caller already
      * holds on the scope's actor: every module the directory records OFF on the scope is
      * switched off again. Already off answers `changed: false` and writes nothing, and a
-     * module the scope does not hold is left alone. Audited only when something moved.
+     * module with no authority reaching the scope (no grant here, no tenant-level grant) is left
+     * alone. Audited only when something moved.
      *
      * `audit` receives each row. By default it writes to the admin log at once. A caller running
      * this inside a scope transaction that may still roll back (a restore's replay) collects
@@ -595,8 +596,9 @@ export declare class SqliteScopeHost implements ScopeHost {
      * point, since the denial is exactly the write the rolled-back operation could not make.
      */
     /**
-     * #1745: record a refused transition the operation failed with, after its rollback — the
-     * denial's discipline (above), for the lifecycle's refusals. Anything else is not one.
+     * #1745: record a refused transition or refusing guard the operation failed with, after its
+     * rollback — the denial's discipline (above), for the lifecycle's and the guards' refusals.
+     * Anything else is not one.
      */
     private recordRefusal;
     private recordDenial;
@@ -684,6 +686,16 @@ export declare class SqliteScopeHost implements ScopeHost {
      * read `ensureIdentityKey` already uses — PRAGMA would do here, but not there.
      */
     private ensureScheduleStateKind;
+    /**
+     * #1745: `_substrat_refusals`, rebuilt to admit a guard row (a nullable `from_state`, plus
+     * `guard` and `reason`) on a scope db whose table predates it.
+     */
+    private ensureRefusalsAdmitGuards;
+    /**
+     * Run a kernel create-copy-drop-rename `script` over `table` when the stored DDL fails
+     * `isCurrent` — the DO adapter's `rebuildIfStale`, so the two rebuild byte-identically.
+     */
+    private rebuildIfStale;
     /**
      * #1573: run a create-copy-drop-rename against the directory as ONE transaction.
      * `exec` of four statements is four autocommits, and the state between DROP and

package/dist/index.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAeL,KAAK,eAAe,EAcpB,KAAK,WAAW,EAEhB,KAAK,YAAY,EAuBjB,KAAK,QAAQ,EACb,KAAK,YAAY,EAIjB,KAAK,cAAc,EAyCnB,KAAK,kBAAkB,EAQvB,KAAK,YAAY,EAGjB,KAAK,QAAQ,EAeb,KAAK,WAAW,EAIhB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAI3B,KAAK,wBAAwB,EAW7B,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,UAAU,EACf,KAAK,WAAW,EAehB,KAAK,SAAS,EAEd,KAAK,OAAO,EAcZ,KAAK,sBAAsB,EAG3B,KAAK,QAAQ,EAGb,KAAK,iBAAiB,EAgBvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAsBL,KAAK,aAAa,EAKlB,KAAK,kBAAkB,EA2BvB,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAc1B,KAAK,uBAAuB,EAG5B,KAAK,gBAAgB,EAGrB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EAkGxB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,KAAK,EACV,KAAK,SAAS,EACd,KAAK,SAAS,EAEd,KAAK,SAAS,EACd,KAAK,kBAAkB,EAEvB,KAAK,gBAAgB,EAErB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EAExB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EAGtB,KAAK,SAAS,EACd,KAAK,SAAS,EACd,KAAK,gBAAgB,EAGrB,KAAK,qBAAqB,EAC1B,KAAK,yBAAyB,EAuB9B,KAAK,mBAAmB,EA+CxB,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,MAAM,EACX,KAAK,YAAY,EAMjB,KAAK,gBAAgB,EAmCrB,KAAK,qBAAqB,EAE3B,MAAM,sBAAsB,CAAC;AAO9B;;;GAGG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAGpD;AAgBD;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,EAAE,WAAW,CAAC,MAAM,CAQzD,CAAC;AA8HH,MAAM,WAAW,sBAAsB;IACrC;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACtD,+EAA+E;IAC/E,GAAG,EAAE,MAAM,CAAC;IACZ,gFAAgF;IAChF,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B;;;;OAIG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,qBAAqB,CAAC;IACvC;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,EAAE,KAAK,CAAC;IACd;;;OAGG;IACH,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB;;;OAGG;IACH,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAysBD,qBAAa,eAAgB,YAAW,SAAS;IAC/C,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC;IAC3B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;IAC5C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoB;IAC9C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmC;IAC1D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmC;IAC9D,qGAAqG;IACrG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmC;IAC3D;;+EAE2E;IAC3E,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAwC;IACvE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAuD;IAClF,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuC;IAC/D,oFAAoF;IACpF,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA+B;IAC7D,gFAAgF;IAChF,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsC;IAC7D,gFAAgF;IAChF,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkE;IAC7F,2EAA2E;IAC3E,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA6B;IACvD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkC;IAC5D,8EAA8E;IAC9E,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAsC;IAClE,4FAA4F;IAC5F,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoC;IAC9D,8FAA8F;IAC9F,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAoE;IACtG;sGACkG;IAClG,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAA2C;IAChF;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAyD;IACxF;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAyD;IAC9F;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAqB;IAChE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqC;IAC3D,kFAAkF;IAClF,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAyC;IACnE;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA2E;IAChG;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAuB;IACvC;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA2B;IACtD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA0C;IAC1E,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;IACtC,iGAAiG;IACjG,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAiC;IACtE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;IACtC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAwB;IACvD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAC9B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAgB;IAC1C,6FAA6F;IAC7F,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgB;IACxC,qDAAqD;IACrD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAqB;IAOxD,YAAY,OAAO,EAAE,sBAAsB,EA4B1C;IAED;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,OAAO,CAAC,oBAAoB;IA2jB5B;;;;OAIG;IACH,OAAO,CAAC,oBAAoB;IAU5B;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,qBAAqB;IAS7B;;;;;;OAMG;IACH,OAAO,CAAC,sBAAsB;IAY9B,gBAAgB,CACd,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,eAAe,EACxB,KAAK,CAAC,EAAE,mBAAmB,GAC1B,IAAI,CAQN;IAED,iBAAiB,CACf,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,gBAAgB,EACzB,OAAO,CAAC,EAAE,gBAAgB,GACzB,IAAI,CASN;IAED;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,gBAAgB;IAiGxB,cAAc,CAAC,YAAY,EAAE,kBAAkB,GAAG,IAAI,CA4MrD;IAED,eAAe,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,CAIzE;IAEK,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAwHtF;IAED;;;;;;;;;;OAUG;IACH,OAAO,CAAC,sBAAsB;IA6CxB,oBAAoB,CACxB,KAAK,EAAE,eAAe,EACtB,KAAK,EAAE,yBAAyB,GAC/B,OAAO,CAAC,iBAAiB,CAAC,CAwD5B;IAED,eAAe,CAAC,MAAM,EAAE,iBAAiB,GAAG,qBAAqB,CAoBhE;IAED,sFAAsF;IACtF,OAAO,CAAC,aAAa;IAUf,kBAAkB,CACtB,KAAK,EAAE,eAAe,EACtB,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,eAAe,CAAC,CA0C1B;IAED;;mFAE+E;IAC/E,OAAO,CAAC,SAAS;IAoDjB;;;wEAGoE;IACpE,OAAO,CAAC,eAAe;IAuBjB,WAAW,CACf,SAAS,EAAE,WAAW,EACtB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,gBAAgB,CAAC,CAU3B;IAEK,oBAAoB,CACxB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAczC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,gBAAgB;IAiRlB,WAAW,CACf,KAAK,EAAE,eAAe,EACtB,KAAK,EAAE,mBAAmB,EAC1B,IAAI,EAAE,SAAS,GACd,OAAO,CAAC,IAAI,CAAC,CAqBf;IAED,oFAAoF;YACtE,QAAQ;IAgJhB,YAAY,CAChB,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,SAAS,EACf,IAAI,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,OAAO,CAAA;KAAE,GACjC,OAAO,CAAC,IAAI,CAAC,CAsBf;IAEK,aAAa,CACjB,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAC3C,OAAO,CAAC,OAAO,CAAC,CAwBlB;IAEK,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CA6BhG;IAEK,QAAQ,CACZ,SAAS,EAAE,WAAW,EACtB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,SAAS,CAAC,CA2CpB;IAED;;;;;;;;;;;;;OAaG;IACG,iBAAiB,CAAC,YAAY,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CA4BxF;IAEK,uBAAuB,CAC3B,YAAY,EAAE,YAAY,EAC1B,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,gBAAgB,CAAC,CA2B3B;IAED,mFAAmF;IACnF,OAAO,CAAC,iBAAiB;IAOzB;;;;;;;OAOG;IACG,oBAAoB,CACxB,OAAO,EAAE,sBAAsB,EAC/B,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,SAAS,CAAC,CAiBpB;IAEK,cAAc,CAClB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,SAAS,CAAC,CAoBpB;IAED;;;;;;;;OAQG;YACW,WAAW;IA8BzB;;;;OAIG;YACW,WAAW;IAUzB,uEAAuE;IACvE,OAAO,CAAC,aAAa;IAgBf,aAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CA2IjG;IAED;;;OAGG;IACH,OAAO,CAAC,cAAc;IAWtB;;;;OAIG;IACH,OAAO,CAAC,UAAU;IA2BlB,yGAAyG;IACzG,OAAO,CAAC,cAAc;IAMtB,4FAA4F;IAC5F,OAAO,CAAC,mBAAmB;IAgB3B;;;;;OAKG;YACW,eAAe;IAyB7B;;;;;OAKG;IACG,kBAAkB,CACtB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAA;KAAE,GACpC,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CA0CpC;IAED;;;;;OAKG;IACG,kBAAkB,CACtB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,SAAS,CAAC,CAOpB;IAED;;;;;OAKG;IACG,wBAAwB,CAC5B,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,gBAAgB,CAAC,CAW3B;IAED,uFAAuF;IACvF,OAAO,CAAC,gBAAgB;IAIxB;;;;OAIG;IACG,gBAAgB,CACpB,MAAM,EAAE,cAAc,EACtB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,SAAS,CAAC,CAIpB;IAED;;;;;OAKG;IACG,UAAU,CACd,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,SAAS,aAAa,EAAE,GACpC,OAAO,CAAC,YAAY,EAAE,CAAC,CAQzB;IAED;;;OAGG;IACG,SAAS,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAIhH;IAEK,sBAAsB,CAC1B,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,WAAW,EACrB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,QAAQ,CAAC,CAcnB;IAED;;;;;OAKG;YACW,eAAe;IAa7B,kGAAkG;IAClG,iBAAiB,IAAI;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,EAAE,CAE3E;IAED,mBAAmB,IAAI,oBAAoB,EAAE,CAQ5C;IAED,mBAAmB,IAAI,qBAAqB,EAAE,CAQ7C;IAED;;;;;;;;;;;;;;;OAeG;IACG,cAAc,CAClB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,eAAe,CAAC,CA+E1B;IAGK,eAAe,CACnB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,iBAAiB,CAAC,CAoI5B;IAED,sGAAsG;IACtG,OAAO,CAAC,SAAS;IAgVjB;;;;;;;;;OASG;IACH,OAAO,CAAC,cAAc;IAgBtB,qFAAqF;IACrF,OAAO,CAAC,SAAS;YAKH,SAAS;IAqBjB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAG3B;IAOD;;;;;;;;;;;;;;;;;;;;OAoBG;YACW,iBAAiB;YA2BjB,qBAAqB;IAkGnC;;;;;;;OAOG;IACH,OAAO,CAAC,sBAAsB;IAmD9B,6FAA6F;IAC7F,OAAO,CAAC,oBAAoB;IAQtB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAOjF;IAED,WAAW,CACT,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,UAAU,EACnB,KAAK,CAAC,EAAE,mBAAmB,GAC1B,IAAI,CAMN;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,QAAQ;IAuGhB;;;;OAIG;IACH,OAAO,CAAC,qBAAqB;IAyBvB,WAAW,CACf,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,gBAAgB,GACtB,OAAO,CAAC,MAAM,CAAC,CAIjB;IAEK,UAAU,CACd,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAC/C,OAAO,CAAC,cAAc,CAAC,CAezB;IAEK,OAAO,CACX,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,MAAM,CAAC,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,EAAE,CAAC,CAInB;IAEK,iBAAiB,CACrB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,gBAAgB,EACzB,KAAK,EAAE,WAAW,EAClB,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAC/B,OAAO,CAAC,IAAI,CAAC,CAgBf;IAED;;;;;;;OAOG;IACG,uBAAuB,CAC3B,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,wBAAwB,EAAE,CAAC,CAiCrC;IAED,iBAAiB,IAAI,iBAAiB,CAIrC;IAED;;;;;;;;OAQG;IACG,YAAY,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA6CrF;IAEK,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CA6B7F;IAEK,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAW3F;IAEK,0BAA0B,CAC9B,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,MAAM,CAAC,EAAE,qBAAqB,GAC7B,OAAO,CAAC,eAAe,EAAE,CAAC,CAO5B;IAEK,qBAAqB,CACzB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,EAAE,EAAE,iBAAiB,EACrB,OAAO,EAAE;QACP,MAAM,EAAE,qBAAqB,CAAC;QAC9B,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,OAAO,CAAC,EAAE,sBAAsB,GAAG,IAAI,CAAC;KACzC,GACA,OAAO,CAAC,IAAI,CAAC,CA4Bf;YAEa,QAAQ;YAkBR,cAAc;IAsG5B;;;;OAIG;IACH;;;OAGG;IACH,OAAO,CAAC,aAAa;IAuBrB,OAAO,CAAC,YAAY;IAmDpB;;;;;;OAMG;IACH;;;;;;OAMG;IACH,mFAAmF;IACnF,OAAO,CAAC,gBAAgB;IA4CxB,OAAO,CAAC,YAAY;IA0BpB;;;;;OAKG;IACH,OAAO,CAAC,WAAW;IASnB;;;;OAIG;IACH,OAAO,CAAC,cAAc;IAiDtB;;;;;;;;;OASG;YACW,gBAAgB;IA0D9B;;;;;;;;;OASG;YACW,eAAe;IAiB7B,gFAAgF;IAChF,OAAO,CAAC,aAAa;IAQrB,OAAO,CAAC,WAAW;IA6BnB,OAAO,CAAC,sBAAsB;IAe9B,4FAA4F;IAC5F,OAAO,CAAC,gBAAgB;IAYxB,sFAAsF;IACtF,UAAU,CAAC,UAAU,EAAE,UAAU,GAAG,IAAI,CAEvC;IAED,OAAO,CAAC,UAAU;IA2xIlB;;;;;;;;;OASG;IACH;;;;OAIG;IACH,OAAO,CAAC,YAAY;IAWpB;;;;;OAKG;IACH,OAAO,CAAC,uBAAuB;IAc/B;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,CAAC,iBAAiB;IAIzB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,iBAAiB;IA0BzB;;;;;;OAMG;IACH,OAAO,CAAC,4BAA4B;IA2BpC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,yBAAyB;IAWjC,OAAO,CAAC,sBAAsB;IAuI9B,OAAO,CAAC,SAAS;IAejB;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;YA4eV,sBAAsB;IAkEpC;;;;;;;;;OASG;IACH,OAAO,CAAC,oBAAoB;IAyB5B;;;;;OAKG;IACH;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,oBAAoB;IAU5B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,oBAAoB;IAa5B,OAAO,CAAC,UAAU;IAKlB;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,cAAc;IAKtB;;;;;OAKG;IACH,OAAO,CAAC,MAAM;IAuBd;;;OAGG;IACH,OAAO,CAAC,YAAY;IAUpB;;;;;;;OAOG;IACH,OAAO,CAAC,kBAAkB;IAmF1B,OAAO,CAAC,OAAO;CA8ChB"}
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAeL,KAAK,eAAe,EAcpB,KAAK,WAAW,EAEhB,KAAK,YAAY,EAuBjB,KAAK,QAAQ,EACb,KAAK,YAAY,EAIjB,KAAK,cAAc,EAyCnB,KAAK,kBAAkB,EAQvB,KAAK,YAAY,EAGjB,KAAK,QAAQ,EAeb,KAAK,WAAW,EAIhB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAI3B,KAAK,wBAAwB,EAW7B,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,UAAU,EACf,KAAK,WAAW,EAehB,KAAK,SAAS,EAEd,KAAK,OAAO,EAcZ,KAAK,sBAAsB,EAG3B,KAAK,QAAQ,EAGb,KAAK,iBAAiB,EAgBvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAsBL,KAAK,aAAa,EAKlB,KAAK,kBAAkB,EA2BvB,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAc1B,KAAK,uBAAuB,EAG5B,KAAK,gBAAgB,EAGrB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EAmGxB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,KAAK,EACV,KAAK,SAAS,EACd,KAAK,SAAS,EAEd,KAAK,SAAS,EACd,KAAK,kBAAkB,EAEvB,KAAK,gBAAgB,EAErB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EAExB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EAGtB,KAAK,SAAS,EACd,KAAK,SAAS,EACd,KAAK,gBAAgB,EAGrB,KAAK,qBAAqB,EAC1B,KAAK,yBAAyB,EAuB9B,KAAK,mBAAmB,EAgDxB,KAAK,cAAc,EAEnB,KAAK,UAAU,EACf,KAAK,MAAM,EACX,KAAK,YAAY,EAMjB,KAAK,gBAAgB,EAuCrB,KAAK,qBAAqB,EAE3B,MAAM,sBAAsB,CAAC;AAO9B;;;GAGG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAGpD;AAgBD;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,EAAE,WAAW,CAAC,MAAM,CAQzD,CAAC;AA8HH,MAAM,WAAW,sBAAsB;IACrC;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACtD,+EAA+E;IAC/E,GAAG,EAAE,MAAM,CAAC;IACZ,gFAAgF;IAChF,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B;;;;OAIG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,qBAAqB,CAAC;IACvC;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,EAAE,KAAK,CAAC;IACd;;;OAGG;IACH,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB;;;OAGG;IACH,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AA0sBD,qBAAa,eAAgB,YAAW,SAAS;IAC/C,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC;IAC3B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;IAC5C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoB;IAC9C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmC;IAC1D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmC;IAC9D,qGAAqG;IACrG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmC;IAC3D;;+EAE2E;IAC3E,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAwC;IACvE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAuD;IAClF,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuC;IAC/D,oFAAoF;IACpF,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA+B;IAC7D,gFAAgF;IAChF,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsC;IAC7D,gFAAgF;IAChF,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkE;IAC7F,2EAA2E;IAC3E,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA6B;IACvD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkC;IAC5D,8EAA8E;IAC9E,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAsC;IAClE,4FAA4F;IAC5F,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoC;IAC9D,8FAA8F;IAC9F,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAoE;IACtG;sGACkG;IAClG,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAA2C;IAChF;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAyD;IACxF;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAyD;IAC9F;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAqB;IAChE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqC;IAC3D,kFAAkF;IAClF,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAyC;IACnE;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA2E;IAChG;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAuB;IACvC;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA2B;IACtD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA0C;IAC1E,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;IACtC,iGAAiG;IACjG,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAiC;IACtE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;IACtC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAwB;IACvD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAC9B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAgB;IAC1C,6FAA6F;IAC7F,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgB;IACxC,qDAAqD;IACrD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAqB;IAOxD,YAAY,OAAO,EAAE,sBAAsB,EA4B1C;IAED;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,OAAO,CAAC,oBAAoB;IA2jB5B;;;;OAIG;IACH,OAAO,CAAC,oBAAoB;IAU5B;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,qBAAqB;IAS7B;;;;;;OAMG;IACH,OAAO,CAAC,sBAAsB;IAY9B,gBAAgB,CACd,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,eAAe,EACxB,KAAK,CAAC,EAAE,mBAAmB,GAC1B,IAAI,CAQN;IAED,iBAAiB,CACf,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,gBAAgB,EACzB,OAAO,CAAC,EAAE,gBAAgB,GACzB,IAAI,CASN;IAED;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,gBAAgB;IAiGxB,cAAc,CAAC,YAAY,EAAE,kBAAkB,GAAG,IAAI,CA4MrD;IAED,eAAe,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,CAIzE;IAEK,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAwHtF;IAED;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,sBAAsB;IA+CxB,oBAAoB,CACxB,KAAK,EAAE,eAAe,EACtB,KAAK,EAAE,yBAAyB,GAC/B,OAAO,CAAC,iBAAiB,CAAC,CAwD5B;IAED,eAAe,CAAC,MAAM,EAAE,iBAAiB,GAAG,qBAAqB,CAoBhE;IAED,sFAAsF;IACtF,OAAO,CAAC,aAAa;IAUf,kBAAkB,CACtB,KAAK,EAAE,eAAe,EACtB,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,eAAe,CAAC,CA0C1B;IAED;;mFAE+E;IAC/E,OAAO,CAAC,SAAS;IAoDjB;;;wEAGoE;IACpE,OAAO,CAAC,eAAe;IAuBjB,WAAW,CACf,SAAS,EAAE,WAAW,EACtB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,gBAAgB,CAAC,CAU3B;IAEK,oBAAoB,CACxB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAczC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,gBAAgB;IAiRlB,WAAW,CACf,KAAK,EAAE,eAAe,EACtB,KAAK,EAAE,mBAAmB,EAC1B,IAAI,EAAE,SAAS,GACd,OAAO,CAAC,IAAI,CAAC,CAqBf;IAED,oFAAoF;YACtE,QAAQ;IAgJhB,YAAY,CAChB,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,SAAS,EACf,IAAI,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,OAAO,CAAA;KAAE,GACjC,OAAO,CAAC,IAAI,CAAC,CAsBf;IAEK,aAAa,CACjB,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAC3C,OAAO,CAAC,OAAO,CAAC,CAwBlB;IAEK,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CA6BhG;IAEK,QAAQ,CACZ,SAAS,EAAE,WAAW,EACtB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,SAAS,CAAC,CA2CpB;IAED;;;;;;;;;;;;;OAaG;IACG,iBAAiB,CAAC,YAAY,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CA4BxF;IAEK,uBAAuB,CAC3B,YAAY,EAAE,YAAY,EAC1B,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,gBAAgB,CAAC,CA2B3B;IAED,mFAAmF;IACnF,OAAO,CAAC,iBAAiB;IAOzB;;;;;;;OAOG;IACG,oBAAoB,CACxB,OAAO,EAAE,sBAAsB,EAC/B,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,SAAS,CAAC,CAiBpB;IAEK,cAAc,CAClB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,SAAS,CAAC,CAoBpB;IAED;;;;;;;;OAQG;YACW,WAAW;IA8BzB;;;;OAIG;YACW,WAAW;IAUzB,uEAAuE;IACvE,OAAO,CAAC,aAAa;IAgBf,aAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CA2IjG;IAED;;;OAGG;IACH,OAAO,CAAC,cAAc;IAWtB;;;;OAIG;IACH,OAAO,CAAC,UAAU;IA2BlB,yGAAyG;IACzG,OAAO,CAAC,cAAc;IAMtB,4FAA4F;IAC5F,OAAO,CAAC,mBAAmB;IAgB3B;;;;;OAKG;YACW,eAAe;IAyB7B;;;;;OAKG;IACG,kBAAkB,CACtB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAA;KAAE,GACpC,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CA0CpC;IAED;;;;;OAKG;IACG,kBAAkB,CACtB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,SAAS,CAAC,CAOpB;IAED;;;;;OAKG;IACG,wBAAwB,CAC5B,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,gBAAgB,CAAC,CAW3B;IAED,uFAAuF;IACvF,OAAO,CAAC,gBAAgB;IAIxB;;;;OAIG;IACG,gBAAgB,CACpB,MAAM,EAAE,cAAc,EACtB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,SAAS,CAAC,CAIpB;IAED;;;;;OAKG;IACG,UAAU,CACd,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,SAAS,aAAa,EAAE,GACpC,OAAO,CAAC,YAAY,EAAE,CAAC,CAQzB;IAED;;;OAGG;IACG,SAAS,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAIhH;IAEK,sBAAsB,CAC1B,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,WAAW,EACrB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,QAAQ,CAAC,CAcnB;IAED;;;;;OAKG;YACW,eAAe;IAa7B,kGAAkG;IAClG,iBAAiB,IAAI;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,EAAE,CAE3E;IAED,mBAAmB,IAAI,oBAAoB,EAAE,CAQ5C;IAED,mBAAmB,IAAI,qBAAqB,EAAE,CAQ7C;IAED;;;;;;;;;;;;;;;OAeG;IACG,cAAc,CAClB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,eAAe,CAAC,CA+E1B;IAGK,eAAe,CACnB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,iBAAiB,CAAC,CAoI5B;IAED,sGAAsG;IACtG,OAAO,CAAC,SAAS;IAgVjB;;;;;;;;;OASG;IACH,OAAO,CAAC,cAAc;IAgBtB,qFAAqF;IACrF,OAAO,CAAC,SAAS;YAKH,SAAS;IA4BjB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAG3B;IAOD;;;;;;;;;;;;;;;;;;;;OAoBG;YACW,iBAAiB;YA2BjB,qBAAqB;IAkGnC;;;;;;;OAOG;IACH,OAAO,CAAC,sBAAsB;IAmD9B,6FAA6F;IAC7F,OAAO,CAAC,oBAAoB;IAQtB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAOjF;IAED,WAAW,CACT,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,UAAU,EACnB,KAAK,CAAC,EAAE,mBAAmB,GAC1B,IAAI,CAMN;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,QAAQ;IAuGhB;;;;OAIG;IACH,OAAO,CAAC,qBAAqB;IAyBvB,WAAW,CACf,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,gBAAgB,GACtB,OAAO,CAAC,MAAM,CAAC,CAIjB;IAEK,UAAU,CACd,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAC/C,OAAO,CAAC,cAAc,CAAC,CAezB;IAEK,OAAO,CACX,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,MAAM,CAAC,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,EAAE,CAAC,CAInB;IAEK,iBAAiB,CACrB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,gBAAgB,EACzB,KAAK,EAAE,WAAW,EAClB,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAC/B,OAAO,CAAC,IAAI,CAAC,CAgBf;IAED;;;;;;;OAOG;IACG,uBAAuB,CAC3B,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,wBAAwB,EAAE,CAAC,CAiCrC;IAED,iBAAiB,IAAI,iBAAiB,CAIrC;IAED;;;;;;;;OAQG;IACG,YAAY,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA6CrF;IAEK,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CA6B7F;IAEK,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAW3F;IAEK,0BAA0B,CAC9B,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,MAAM,CAAC,EAAE,qBAAqB,GAC7B,OAAO,CAAC,eAAe,EAAE,CAAC,CAO5B;IAEK,qBAAqB,CACzB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,EAAE,EAAE,iBAAiB,EACrB,OAAO,EAAE;QACP,MAAM,EAAE,qBAAqB,CAAC;QAC9B,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,OAAO,CAAC,EAAE,sBAAsB,GAAG,IAAI,CAAC;KACzC,GACA,OAAO,CAAC,IAAI,CAAC,CA4Bf;YAEa,QAAQ;YAkBR,cAAc;IAsG5B;;;;OAIG;IACH;;;;OAIG;IACH,OAAO,CAAC,aAAa;IAuBrB,OAAO,CAAC,YAAY;IAmDpB;;;;;;OAMG;IACH;;;;;;OAMG;IACH,mFAAmF;IACnF,OAAO,CAAC,gBAAgB;IA4CxB,OAAO,CAAC,YAAY;IA0BpB;;;;;OAKG;IACH,OAAO,CAAC,WAAW;IASnB;;;;OAIG;IACH,OAAO,CAAC,cAAc;IAiDtB;;;;;;;;;OASG;YACW,gBAAgB;IA0D9B;;;;;;;;;OASG;YACW,eAAe;IAiB7B,gFAAgF;IAChF,OAAO,CAAC,aAAa;IAQrB,OAAO,CAAC,WAAW;IA6BnB,OAAO,CAAC,sBAAsB;IAe9B,4FAA4F;IAC5F,OAAO,CAAC,gBAAgB;IAYxB,sFAAsF;IACtF,UAAU,CAAC,UAAU,EAAE,UAAU,GAAG,IAAI,CAEvC;IAED,OAAO,CAAC,UAAU;IAyxIlB;;;;;;;;;OASG;IACH;;;;OAIG;IACH,OAAO,CAAC,YAAY;IAWpB;;;;;OAKG;IACH,OAAO,CAAC,uBAAuB;IAI/B;;;OAGG;IACH,OAAO,CAAC,yBAAyB;IAIjC;;;OAGG;IACH,OAAO,CAAC,cAAc;IAmBtB;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,CAAC,iBAAiB;IAIzB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,iBAAiB;IA0BzB;;;;;;OAMG;IACH,OAAO,CAAC,4BAA4B;IA2BpC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,yBAAyB;IAWjC,OAAO,CAAC,sBAAsB;IAuI9B,OAAO,CAAC,SAAS;IAejB;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;YA4eV,sBAAsB;IAkEpC;;;;;;;;;OASG;IACH,OAAO,CAAC,oBAAoB;IAyB5B;;;;;OAKG;IACH;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,oBAAoB;IAU5B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,oBAAoB;IAa5B,OAAO,CAAC,UAAU;IAKlB;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,cAAc;IAKtB;;;;;OAKG;IACH,OAAO,CAAC,MAAM;IAuBd;;;OAGG;IACH,OAAO,CAAC,YAAY;IAUpB;;;;;;;OAOG;IACH,OAAO,CAAC,kBAAkB;IAqF1B,OAAO,CAAC,OAAO;CA8ChB"}

package/dist/index.js CHANGED Viewed

@@ -2,7 +2,7 @@ import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync
 import { dirname, join } from 'node:path';
 import Database from 'better-sqlite3';
 import { accessLogEntry, adminLogEntry, delegatedReadParams, opsFailureEntry, opsFailureFingerprint, issueEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunEntry, modelUsageEntry, ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, createTenantInput, domainEvent, domainEventInput, exportReadInput, importBatch, importCursorMove, exportsOfManifestJson, importsOfManifestJson, entitlementGrant, entitlementGrantInput, eventId, meterReading, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, identityLink, identityPool, instant, connection, capabilityGrant, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchRecord, peerSwitch, verticalCaller, verticalSlug as verticalSlugOf, subjectRef, requestFingerprint, createConnectionInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, routeTarget, ROUTE_SCOPE_HOSTNAMES_MAX, registerVerticalInput, vertical as verticalSchema, verticalChannel, verticalVersion, objectRef, entityObjectRef, assertModuleEmittableType, assertKernelAuthoredType, grantRefFromProof, org as orgSchema, orgMembership, principalId, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, subjectShredReceipt, SCOPE_TABLE_PAGE_DEFAULT, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, verticalServingState, callsOfManifestJson, outboundOfManifestJson, listLimitOf, substratError, assertReplayableDump, delegatedReadRecord, ownerTransferAudit, copyMarkAudit, redrainEventsInput, REDRAIN_BATCH, } from '@substrat-run/contracts';
-import { actorOf, asPrincipal, assertAllowed, assertNoSecret, assertPermissionKey, CAPABILITY_DDL, COPY_ORIGIN_DDL, CAPABILITY_EXCHANGE_OPERATION, capabilityAttachmentWriteRefused, capabilityTokenHash, createCapabilityVerbs, createEntityEdgeVerbs, exchangeCapability as exchangeCapabilitySecret, guardSecrets, mintBecomeCapability, plausibleSessionToken, readCapabilityPage, redactSecrets, redactSecretText, moduleLog, consoleLogSink, asyncInvocationId, asyncLinePass, consoleInvocationLineSink, resolveCapabilitySession, revokeCapabilityAsPlatform, assertReadOnlyQuery, attachmentBlobKey, attachmentSha256, entitlementDenial, requiredEntitlementFor, foldMeterReading, guardSpine, guardSqlLimits, DO_SQL_LIMITS, tooManyResultColumns, tooManyTableColumns, parseValidationRecords, resolveScopeRecord, ulid, ISSUE_RETENTION_DAYS, telemetryRetentionStatements, assertRowLimit, assertRowOffset, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, SWEEP_RUNS_INTENT_INDEX, sweepRunsIntentHasKind, MODEL_USAGE_RETENTION_DAYS, foldModelUsage, backoffAt, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, redactSubjectScopeText, redactSubjectDirectoryText, ISSUE_EXEMPLAR_OWNER_BACKFILL_SQL, issueExemplarOwner, JOB_RUN_PATCH_SQL, JOB_STEP_RECORD_SQL, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, switchSystemSchedules, admitPeer, collectPeers, peerSeats, resolveVerticalInstanceFrom, switchPeer, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, SYSTEM_SWITCHES_BACKFILL_SQL, SYSTEM_SWITCHES_DDL, forgetSystemSwitchesOf, listSystemSwitchRecords, recordSystemSwitchedOff, recordSystemSwitchedOn, restoreSystemSwitchRecord, scopesSwitchedOffFor, switchedOffModulesOf, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, systemSwitchRecordsOf, systemSwitchesTableExists, withRecorded, VERSION_MIGRATIONS_DDL, splitManifestMigrations, splitVersionMigrationsBatch, versionMigrationsOf, writeVersionMigrations, denialListQuery, refusalListQuery, mapRefusalRow, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, IMPERSONATION_COLUMNS, IMPERSONATION_DDL, ImpersonationRefused, assertImpersonationWrites, assertModuleEnqueueableKind, assertSessionUsable, impersonationByIdQuery, impersonationListQuery, impersonationRowValues, impersonationStampOf, mapImpersonationRow, newImpersonationSession, resolveRetryPolicy, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, noSealingKeyMessage, openSealed, sealTo, ConnectionSealingKeyUnavailableError, PermissionDenied, createAtomic, NotSearchable, NotListable, listIndexMigrations, listIndexPlans, listQuery, cursorOf, moduleMigrations, isSearchIndexTable, searchIndexDdl, searchIndexMigrations, searchIndexPlans, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, assertAttachmentExtractors, assertJobRegistrable, attachmentRecordOfRow, attachmentTextJob, enqueueAttachmentText, isAttachmentTextRun, reconcileAttachmentText, recordAttachmentText, searchAttachments, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, exportedSinceQuery, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, bindExportBreaksOf, bindExportBreakRefusal, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, jobRunListLimit, jobRunOf, runDueJobRuns, startJobRun, IDEMPOTENCY_DDL, REFUSALS_DDL, refusalInsert, refusedTransitionOf, assertIdempotencyKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, globalFetch, createUlid, facetEvents, readHistory, walkEventCause, walkEventEffects, assertRedrainWindow, readInvocation, readDeadLetters, readLifecycleFlow, domainEventOf, readUndrainedOutbox, undrainedEventsOf, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, unknownRoleError, } from '@substrat-run/kernel';
+import { actorOf, asPrincipal, assertAllowed, assertNoSecret, assertPermissionKey, CAPABILITY_DDL, COPY_ORIGIN_DDL, CAPABILITY_EXCHANGE_OPERATION, capabilityAttachmentWriteRefused, capabilityTokenHash, createCapabilityVerbs, createEntityEdgeVerbs, exchangeCapability as exchangeCapabilitySecret, guardSecrets, mintBecomeCapability, plausibleSessionToken, readCapabilityPage, redactSecrets, redactSecretText, moduleLog, consoleLogSink, asyncInvocationId, asyncLinePass, consoleInvocationLineSink, resolveCapabilitySession, revokeCapabilityAsPlatform, assertReadOnlyQuery, attachmentBlobKey, attachmentSha256, entitlementDenial, requiredEntitlementFor, foldMeterReading, guardSpine, guardSqlLimits, DO_SQL_LIMITS, tooManyResultColumns, tooManyTableColumns, parseValidationRecords, resolveScopeRecord, ulid, ISSUE_RETENTION_DAYS, telemetryRetentionStatements, assertRowLimit, assertRowOffset, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, SWEEP_RUNS_INTENT_INDEX, sweepRunsIntentHasKind, MODEL_USAGE_RETENTION_DAYS, foldModelUsage, backoffAt, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, redactSubjectScopeText, redactSubjectDirectoryText, ISSUE_EXEMPLAR_OWNER_BACKFILL_SQL, issueExemplarOwner, JOB_RUN_PATCH_SQL, JOB_STEP_RECORD_SQL, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, switchSystemSchedules, admitPeer, collectPeers, peerSeats, resolveVerticalInstanceFrom, switchPeer, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, SYSTEM_SWITCHES_BACKFILL_SQL, SYSTEM_SWITCHES_DDL, forgetSystemSwitchesOf, listSystemSwitchRecords, recordSystemSwitchedOff, recordSystemSwitchedOn, restoreSystemSwitchRecord, scopesSwitchedOffFor, tenantHoldsSystemGrant, switchedOffModulesOf, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, systemSwitchRecordsOf, systemSwitchesTableExists, withRecorded, VERSION_MIGRATIONS_DDL, splitManifestMigrations, splitVersionMigrationsBatch, versionMigrationsOf, writeVersionMigrations, denialListQuery, refusalListQuery, mapRefusalRow, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, IMPERSONATION_COLUMNS, IMPERSONATION_DDL, ImpersonationRefused, assertImpersonationWrites, assertModuleEnqueueableKind, assertSessionUsable, impersonationByIdQuery, impersonationListQuery, impersonationRowValues, impersonationStampOf, mapImpersonationRow, newImpersonationSession, resolveRetryPolicy, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, noSealingKeyMessage, openSealed, sealTo, ConnectionSealingKeyUnavailableError, PermissionDenied, createAtomic, NotSearchable, NotListable, listIndexMigrations, listIndexPlans, listQuery, cursorOf, moduleMigrations, isSearchIndexTable, searchIndexDdl, searchIndexMigrations, searchIndexPlans, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, assertAttachmentExtractors, assertJobRegistrable, attachmentRecordOfRow, attachmentTextJob, enqueueAttachmentText, isAttachmentTextRun, reconcileAttachmentText, recordAttachmentText, searchAttachments, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, exportedSinceQuery, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, bindExportBreaksOf, bindExportBreakRefusal, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, JOB_RUN_DUE_AT, jobRunListLimit, jobRunOf, runDueJobRuns, startJobRun, IDEMPOTENCY_DDL, REFUSALS_TABLE_DDL, REFUSALS_INDEX, refusalInsert, refusalOf, markGuardRefusal, REFUSALS_REBUILD, refusalsAdmitGuards, assertIdempotencyKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, globalFetch, createUlid, facetEvents, readHistory, walkEventCause, walkEventEffects, assertRedrainWindow, readInvocation, readDeadLetters, readLifecycleFlow, domainEventOf, readUndrainedOutbox, undrainedEventsOf, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, unknownRoleError, } from '@substrat-run/kernel';
 import { attributedHost } from '@substrat-run/kernel';
 import { INERT_SCOPE_REASON, isPrimaryScopeRow } from '@substrat-run/kernel';
 import { LEGACY_SCOPE_ROWS_BACKFILL, assertNoSpineReference, assertSpineTablesBuilt, capabilitiesForLoad, dumpRowsInsert, isSpineTable, loadDirectoryDump, repointScopeGrants, settleCopiedWork, emittedHere, spineColumnAdditions } from '@substrat-run/kernel';
@@ -204,7 +204,8 @@ const KERNEL_DDL = `
     drained_at TEXT
   );
   ${IDEMPOTENCY_DDL}
-  ${REFUSALS_DDL}
+  ${REFUSALS_TABLE_DDL}
+  ${REFUSALS_INDEX}
   -- #1672: capabilities — authority carried by a secret (a link share), and the sessions
   -- an exchange trades that secret for. Spine (kernel-written), shared with the DO adapter
   -- from @substrat-run/kernel so the two cannot part company; the column comments are there.
@@ -1667,7 +1668,8 @@ export class SqliteScopeHost {
      * `HostAdmin.reassertSystemSwitches`' body (#1674), run inside a turn the caller already
      * holds on the scope's actor: every module the directory records OFF on the scope is
      * switched off again. Already off answers `changed: false` and writes nothing, and a
-     * module the scope does not hold is left alone. Audited only when something moved.
+     * module with no authority reaching the scope (no grant here, no tenant-level grant) is left
+     * alone. Audited only when something moved.
      *
      * `audit` receives each row. By default it writes to the admin log at once. A caller running
      * this inside a scope transaction that may still roll back (a restore's replay) collects
@@ -1694,7 +1696,9 @@ export class SqliteScopeHost {
         for (const row of inUnitMovesToAudit(recordedOff, applied))
             audit({ operationId: ulid(), ...row });
         return recordedOff.map((moduleId) => {
-            const outcome = rt.db.transaction(() => switchSystemSchedules(switchSqlOf(rt.db), { moduleId, scopeId, to: 'off', at }))();
+            // #1823: a module whose only authority here is a tenant-level grant is held too.
+            const tenantHeld = tenantHoldsSystemGrant(switchSqlOf(this.directory), tenantId, moduleId, this.clock());
+            const outcome = rt.db.transaction(() => switchSystemSchedules(switchSqlOf(rt.db), { moduleId, scopeId, to: 'off', at, tenantHeld }))();
             if (outcome.changed) {
                 audit({
                     operationId: ulid(),
@@ -3519,7 +3523,15 @@ export class SqliteScopeHost {
                 throw new Error(`unknown guard predicate: '${guard.predicate}' — declared by ${guard.declaredBy} ` +
                     `before '${operation}'; no registered module contributes it (operation blocked)`);
             }
-            await predicate.handler(ctx, guard.config, input);
+            try {
+                await predicate.handler(ctx, guard.config, input);
+            }
+            catch (err) {
+                // #1745: a guard refusing is recorded after the rollback, as a transition is —
+                // marked here, where which guard threw is still known. Always rethrown.
+                markGuardRefusal(err, guard.predicate, operation);
+                throw err;
+            }
         }
     }
     async close() {
@@ -3781,12 +3793,12 @@ export class SqliteScopeHost {
         return {
             startOrJoin: (key, r) => turn(() => startOrJoinTx(key, r)),
             get: (id) => turn(() => row(db.prepare('SELECT * FROM _substrat_job_runs WHERE id = ?').get(id))),
-            due: (now, limit, afterId) => turn(() => db
-                .prepare(`SELECT * FROM _substrat_job_runs
+            // #1834: the drive's one snapshot — keys only, in the order runs became due.
+            dueKeys: (now, max) => turn(() => db
+                .prepare(`SELECT id, module_id, job FROM _substrat_job_runs
               WHERE status = 'running' AND (next_attempt_at IS NULL OR next_attempt_at <= ?)
-                AND (? IS NULL OR id > ?)
-              ORDER BY id LIMIT ?`)
-                .all(now, afterId ?? null, afterId ?? null, limit)),
+              ORDER BY ${JOB_RUN_DUE_AT}, id LIMIT ?`)
+                .all(now, max)),
             list: (filter) => turn(() => {
                 const where = [];
                 const params = [];
@@ -4157,11 +4169,12 @@ export class SqliteScopeHost {
      * point, since the denial is exactly the write the rolled-back operation could not make.
      */
     /**
-     * #1745: record a refused transition the operation failed with, after its rollback — the
-     * denial's discipline (above), for the lifecycle's refusals. Anything else is not one.
+     * #1745: record a refused transition or refusing guard the operation failed with, after its
+     * rollback — the denial's discipline (above), for the lifecycle's and the guards' refusals.
+     * Anything else is not one.
      */
     recordRefusal(rt, subject, operation, err, invocationId, impersonation) {
-        const refused = refusedTransitionOf(err);
+        const refused = refusalOf(err);
         if (!refused)
             return;
         const q = refusalInsert({
@@ -4728,37 +4741,37 @@ export class SqliteScopeHost {
             const target = { tenantId, scopeId };
             const base = { operationId, moduleId: input.moduleId, schedules: to };
             this.recordAdmin(actor, action, target, null, { ...base, phase: 'intent', reason: input.reason });
-            // The directory's record (#1674): ON before the scope moves, OFF after it held — see
-            // `recordSystemSwitchedOn` for why that order is the safe one.
+            // The directory's record (#1674), written BEFORE the scope moves, both ways, and undone
+            // if the move throws or holds nothing — see `recordSystemSwitchedOn` and (#1823)
+            // `recordSystemSwitchedOff` for why that order is the safe one.
             const at = new Date().toISOString();
             const directorySql = switchSqlOf(this.directory);
             const record = { tenantId, scopeId, moduleId: input.moduleId, actor, reason: input.reason, operationId, at };
             const errorOf = (err) => (err instanceof Error ? err.message : String(err));
-            let prior = null;
-            if (to === 'on') {
+            let prior;
+            try {
+                prior = to === 'on' ? recordSystemSwitchedOn(directorySql, record) : recordSystemSwitchedOff(directorySql, record);
+            }
+            catch (err) {
+                // Nothing has moved: fail the call here, audited — the Cloudflare adapter's posture.
                 try {
-                    prior = recordSystemSwitchedOn(directorySql, record);
+                    this.recordAdmin(actor, action, target, null, { ...base, phase: 'failed', error: errorOf(err) });
                 }
-                catch (err) {
-                    // Nothing has moved: fail the call here, audited — the Cloudflare adapter's posture.
-                    try {
-                        this.recordAdmin(actor, action, target, null, { ...base, phase: 'failed', error: errorOf(err) });
-                    }
-                    catch {
-                        // Best effort: the original error is what the caller must see.
-                    }
-                    throw err;
+                catch {
+                    // Best effort: the original error is what the caller must see.
                 }
+                throw err;
             }
-            /** A record write after the scope moved (review #5): retried once, never swallowed. */
-            const recordWrite = (write) => {
+            /** The record's undo, after the scope's move threw or held nothing: retried once, never swallowed. */
+            const undoRecord = () => {
+                const undo = () => restoreSystemSwitchRecord(directorySql, record, prior);
                 try {
-                    write();
+                    undo();
                     return null;
                 }
                 catch {
                     try {
-                        write();
+                        undo();
                         return null;
                     }
                     catch (err) {
@@ -4773,11 +4786,17 @@ export class SqliteScopeHost {
                 // `db.transaction` issued mid-invoke became a SAVEPOINT inside it and rolled back
                 // with it — after this verb had already audited `applied`. `turn` is re-entrant, so a
                 // caller already inside one of this scope's tasks joins it rather than deadlocking.
+                //
+                // #1823: read in the same turn, so no tenant grant moves between the read and the switch.
+                // The directory is this process's own database, so the read is synchronous.
                 const rt = this.runtime(tenantId, scopeId);
-                outcome = await rt.actor.turn(() => rt.db.transaction(() => switchSystemSchedules(switchSqlOf(rt.db), { moduleId: input.moduleId, scopeId, to, at }))());
+                outcome = await rt.actor.turn(() => {
+                    const tenantHeld = tenantHoldsSystemGrant(directorySql, tenantId, input.moduleId, this.clock());
+                    return rt.db.transaction(() => switchSystemSchedules(switchSqlOf(rt.db), { moduleId: input.moduleId, scopeId, to, at, tenantHeld }))();
+                });
             }
             catch (err) {
-                const recordError = recordWrite(() => restoreSystemSwitchRecord(directorySql, record, prior));
+                const recordError = undoRecord();
                 try {
                     this.recordAdmin(actor, action, target, null, {
                         ...base,
@@ -4791,14 +4810,11 @@ export class SqliteScopeHost {
                 }
                 throw err;
             }
-            // OFF is recorded once the scope held it. A refused ON moved nothing, so its record
-            // write is undone: left `on`, the next reconcile of a wiped scope would leave the
-            // module running.
-            const recordError = to === 'off' && outcome.held
-                ? recordWrite(() => recordSystemSwitchedOff(directorySql, record))
-                : to === 'on' && !outcome.held
-                    ? recordWrite(() => restoreSystemSwitchRecord(directorySql, record, prior))
-                    : null;
+            // A call that held nothing moved nothing (the module has no authority reaching the scope,
+            // its own or the tenant's), so its record write is undone: left `off`, it
+            // would switch the module off the day it is installed; left `on`, the next reconcile of
+            // a wiped scope would leave the module running.
+            const recordError = outcome.held ? null : undoRecord();
             this.recordAdmin(actor, action, target, null, {
                 ...base,
                 phase: outcome.held ? 'applied' : 'refused',
@@ -4811,11 +4827,6 @@ export class SqliteScopeHost {
                     `(check the module id: it is the module's manifest id, e.g. '@substrat-run/engine-absence')` +
                     (recordError ? `; and its directory record could not be put back (${recordError})` : ''));
             }
-            if (recordError) {
-                throw substratError('unavailable', `module '${input.moduleId}' is switched ${to} on scope ${scopeId}, but the directory's record of it ` +
-                    `could not be written (${recordError}) — repeat the call to record it; a wipe of this scope would ` +
-                    `otherwise lose the switch`);
-            }
             return {
                 operationId,
                 moduleId: input.moduleId,
@@ -5200,6 +5211,12 @@ export class SqliteScopeHost {
                 this.recordAccess(actor, 'listSystemSwitches', { tenantId: filter?.tenantId ?? null }, filter ?? null, rows.length);
                 return rows.map((r) => systemSwitchRecord.parse(r));
             },
+            tenantHeldSystemModules: async (actor, tenantId, moduleIds) => {
+                const now = this.clock();
+                const held = moduleIds.filter((m) => tenantHoldsSystemGrant(switchSqlOf(this.directory), tenantId, m, now));
+                this.recordAccess(actor, 'tenantHeldSystemModules', { tenantId }, { moduleIds: [...moduleIds] }, held.length);
+                return held;
+            },
             reassertSystemSwitches: async (actor, node, opts) => {
                 this.assertScope(node.tenantId, node.scopeId);
                 const rt = this.runtime(node.tenantId, node.scopeId);
@@ -7878,18 +7895,32 @@ export class SqliteScopeHost {
      * read `ensureIdentityKey` already uses — PRAGMA would do here, but not there.
      */
     ensureScheduleStateKind(db) {
+        this.rebuildIfStale(db, '_substrat_schedule_state', scheduleStateHasKind, SCHEDULE_STATE_REBUILD);
+    }
+    /**
+     * #1745: `_substrat_refusals`, rebuilt to admit a guard row (a nullable `from_state`, plus
+     * `guard` and `reason`) on a scope db whose table predates it.
+     */
+    ensureRefusalsAdmitGuards(db) {
+        this.rebuildIfStale(db, '_substrat_refusals', refusalsAdmitGuards, REFUSALS_REBUILD);
+    }
+    /**
+     * Run a kernel create-copy-drop-rename `script` over `table` when the stored DDL fails
+     * `isCurrent` — the DO adapter's `rebuildIfStale`, so the two rebuild byte-identically.
+     */
+    rebuildIfStale(db, table, isCurrent, script) {
         const row = db
             .prepare("SELECT sql FROM sqlite_master WHERE type = 'table' AND name = ?")
-            .get('_substrat_schedule_state');
-        if (!row || scheduleStateHasKind(row.sql))
+            .get(table);
+        if (!row || isCurrent(row.sql))
             return;
-        // In a transaction, for the reason the kernel constant spells out: create-copy-
+        // In a transaction, for the reason the kernel constants spell out: create-copy-
         // drop-rename has two intermediate states and BOTH are unrecoverable on the next
         // wake — one dies on the leftover scratch table, one silently orphans the rows
         // behind an empty table `CREATE TABLE IF NOT EXISTS` put back. `db.transaction`
         // nests as a SAVEPOINT, which is what makes this safe on the `loadDump` path too,
         // where the whole replay is already inside one.
-        db.transaction(() => db.exec(SCHEDULE_STATE_REBUILD))();
+        db.transaction(() => db.exec(script))();
     }
     /**
      * #1573: run a create-copy-drop-rename against the directory as ONE transaction.
@@ -8817,6 +8848,8 @@ export class SqliteScopeHost {
         // #1288: not an ensureColumn, because `kind` joins the schedule-state PRIMARY KEY
         // and no ALTER can widen a key. Rebuilt instead, from the kernel's statements.
         this.ensureScheduleStateKind(db);
+        // #1745: likewise a rebuild — `from_state` loses its NOT NULL, which no ALTER can do.
+        this.ensureRefusalsAdmitGuards(db);
         // #1525: the invocation a fired schedule ran in, on a scope DB created before the
         // column. Nullable, and the null is honestly "no call was carried" for every legacy
         // row — a past run's id cannot be recovered afterwards, exactly as the other #1525