@substrat-run/adapter-sqlite 0.152.0 → 0.154.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (5) hide show
  1. package/dist/index.d.ts +23 -2
  2. package/dist/index.d.ts.map +1 -1
  3. package/dist/index.js +80 -9
  4. package/dist/index.js.map +1 -1
  5. package/package.json +6 -6
package/dist/index.d.ts CHANGED
@@ -1,5 +1,5 @@
1
1
  import { type UploadLinkView, type BlobStoreHandle, type ImportBatch, type ImportResult, type Coverage, type PeerCoverage, type VerticalCaller, type BoundedBecomeMint, type BoundedBecomeRevoke, type BoundedUnbind, type BecomeLinkState, type PrincipalBecomeCapabilityInput, type CapabilityExchange, type CapabilityId, type ConnectionId, type ModuleId, type DomainEvent, type PlatformRequestId, type PlatformRequestEntry, type PlatformRequestFilter, type ProjectedConnectionGrant, type EntityRef, type PermissionKey, type PlatformActorId, type OnBehalfOf, type PrincipalId, type ScopeDumpInput, type ScopeId, type ImpersonationSessionId, type TenantId, type TenantStoreHandle } from '@substrat-run/contracts';
2
- import { type ModuleLogSink, type InvocationLineSink, type FreshnessReport, type FreshnessRegistration, type BlobStoreProvisionInput, type ScopeAttachments, type TenantBlobStore, type ExecutorDeadLetter, type ExecutorDrainReport, type MigrateScopeOutcome, type MigrationFrontier, type ExecutorHandler, type ExecutorRetryPolicy, type ScopeRoleHolder, type ConnectorHandler, type ConnectorOptions, type Clock, type FetchLike, type SecretBox, type HostAdmin, type ModuleRegistration, type OperationHandler, type PermissionChecker, type ProvisionScopeInput, type ScheduleRegistration, type ScheduleRunReport, type ScopeHost, type ScopeStub, type ScopeStubOptions, type TenantRelationalStore, type TenantStoreProvisionInput, type AttachmentExtractor, type AttachmentTextBounds, type OrphanSweepReport, type OrphanSweepRequest, type JobDriveReport, type JobHandler, type JobRun, type JobRunFilter, type StartJobRunInput, type ConnectorCallRecorder, type StoreStub, type ScopeStoreStubOptions, type ScopeStoreHostOptions, type StoreErasureReplay } from '@substrat-run/kernel';
2
+ import { type ModuleLogSink, type InvocationLineSink, type FreshnessReport, type FreshnessRegistration, type BlobStoreProvisionInput, type ScopeAttachments, type TenantBlobStore, type ExecutorDeadLetter, type ExecutorDrainReport, type MigrateScopeOutcome, type MigrationFrontier, type ExecutorHandler, type ExecutorRetryPolicy, type ScopeRoleHolder, type DeclaredPermissions, type ConnectorHandler, type ConnectorOptions, type Clock, type FetchLike, type SecretBox, type HostAdmin, type ModuleRegistration, type OperationHandler, type PermissionChecker, type ProvisionScopeInput, type ScheduleRegistration, type ScheduleRunReport, type ScopeHost, type ScopeStub, type ScopeStubOptions, type TenantRelationalStore, type TenantStoreProvisionInput, type AttachmentExtractor, type AttachmentTextBounds, type OrphanSweepReport, type OrphanSweepRequest, type JobDriveReport, type JobHandler, type JobRun, type JobRunFilter, type StartJobRunInput, type ConnectorCallRecorder, type StoreStub, type ScopeStoreStubOptions, type ScopeStoreHostOptions, type StoreErasureReplay } from '@substrat-run/kernel';
3
3
  import { type PlatformRequestSettle } from '@substrat-run/kernel';
4
4
  import { type RedeemedUploadLink, type UploadLinkRedeemInput } from '@substrat-run/kernel';
5
5
  export { scopeStoreRunnersFor } from './scope-store-runners.js';
@@ -126,6 +126,13 @@ export interface SqliteScopeHostOptions {
126
126
  * matches (`migrationSetDivergence`). Omitted, nothing is compared.
127
127
  */
128
128
  migrationsDigest?: string;
129
+ /**
130
+ * The vertical's declared permission surface (#2430): its `definePermissions(...)` value, the one
131
+ * `substrat push` and `lint:permissions` read. Given, `registerModule` refuses a module its
132
+ * `modules` leaves out, since nothing that module declares would be judged by either. Omitted,
133
+ * nothing is compared (a test fixture, a host with no declared surface).
134
+ */
135
+ permissions?: DeclaredPermissions;
129
136
  }
130
137
  /**
131
138
  * The scope spine a fresh scope gets, for a tool that replays a vertical's migrations outside a
@@ -177,6 +184,10 @@ export declare class SqliteScopeHost implements ScopeHost {
177
184
  private readonly tenantStoreDbs;
178
185
  private readonly operations;
179
186
  private readonly modules;
187
+ /** #2430: what a registered module declares `holder: 'system'` — the role doors' refusal reads it. */
188
+ private readonly reservedKeys;
189
+ /** #2430: the declared permission surface `registerModule` holds each module to, when given. */
190
+ private readonly permissions;
180
191
  /** #1705: what this deployment exports to other verticals and imports from them. */
181
192
  private readonly crossVertical;
182
193
  /** operation name → guards declared before it, in registration order (K-17). */
@@ -484,7 +495,9 @@ export declare class SqliteScopeHost implements ScopeHost {
484
495
  * ordinary invoke against the impersonated principal.
485
496
  */
486
497
  getImpersonatedScope(session: ImpersonationSessionId, tenantId: TenantId, scopeId: ScopeId, options?: ScopeStubOptions): Promise<ScopeStub>;
487
- getSystemScope(moduleId: ModuleId, tenantId: TenantId, scopeId: ScopeId): Promise<ScopeStub>;
498
+ getSystemScope(moduleId: ModuleId, tenantId: TenantId, scopeId: ScopeId,
499
+ /** #2431: observers, as `getScope` takes them — `runDueSchedules` counts its fires' requests through them. */
500
+ options?: ScopeStubOptions): Promise<ScopeStub>;
488
501
  /**
489
502
  * The system door's stub. `purge` (#119) is set only by `runPurgeSweep`, which never hands the
490
503
  * stub on: it is the one stub whose invokes may use the module's purge-only keys, and only on
@@ -647,6 +660,14 @@ export declare class SqliteScopeHost implements ScopeHost {
647
660
  unbindEntityHolderBounded(tenantId: TenantId, scopeId: ScopeId, caller: PrincipalId, entity: EntityRef): Promise<BoundedUnbind>;
648
661
  /** What a principal holds at this scope, for a `become` exchange (#1686); absent with a checker that cannot say. */
649
662
  private holdingsAt;
663
+ /**
664
+ * #2430: refuse conferring `roleKey` through `door` when the tenant's role carries a key a module
665
+ * registered here reserves (`reservedRoleRefusal`). A role the tenant does not define is left to
666
+ * the door's own answer for it.
667
+ */
668
+ private refuseReservedRole;
669
+ /** #2430: refuse a raw grant of a key a module registered here reserves (`reservedGrantRefusal`). */
670
+ private refuseReservedGrant;
650
671
  /** The caller's bound per role at the scope, `null` for a role this tenant does not define (#1150). */
651
672
  private roleBound;
652
673
  /**
package/dist/index.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAoBL,KAAK,cAAc,EACnB,KAAK,eAAe,EAepB,KAAK,WAAW,EAEhB,KAAK,YAAY,EAwBjB,KAAK,QAAQ,EACb,KAAK,YAAY,EAIjB,KAAK,cAAc,EA4CnB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,8BAA8B,EAGnC,KAAK,kBAAkB,EAEvB,KAAK,YAAY,EAMjB,KAAK,YAAY,EAOjB,KAAK,QAAQ,EAeb,KAAK,WAAW,EAIhB,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAM1B,KAAK,wBAAwB,EAE7B,KAAK,SAAS,EASd,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,UAAU,EACf,KAAK,WAAW,EAgBhB,KAAK,cAAc,EAEnB,KAAK,OAAO,EAeZ,KAAK,sBAAsB,EAG3B,KAAK,QAAQ,EAGb,KAAK,iBAAiB,EAyBvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EA8EL,KAAK,aAAa,EAKlB,KAAK,kBAAkB,EAwDvB,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAc1B,KAAK,uBAAuB,EAG5B,KAAK,gBAAgB,EACrB,KAAK,eAAe,EAEpB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EAEpB,KAAK,mBAAmB,EAuCxB,KAAK,eAAe,EAiJpB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,KAAK,EACV,KAAK,SAAS,EACd,KAAK,SAAS,EAEd,KAAK,SAAS,EAEd,KAAK,kBAAkB,EAEvB,KAAK,gBAAgB,EAGrB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EAExB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EAGtB,KAAK,SAAS,EACd,KAAK,SAAS,EACd,KAAK,gBAAgB,EAGrB,KAAK,qBAAqB,EAC1B,KAAK,yBAAyB,EAiC9B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EAmBzB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EA0EvB,KAAK,cAAc,EAEnB,KAAK,UAAU,EACf,KAAK,MAAM,EACX,KAAK,YAAY,EAQjB,KAAK,gBAAgB,EAwCrB,KAAK,qBAAqB,EAG1B,KAAK,SAAS,EACd,KAAK,qBAAqB,EAQ1B,KAAK,qBAAqB,EAG1B,KAAK,kBAAkB,EACxB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAQL,KAAK,qBAAqB,EAC3B,MAAM,sBAAsB,CAAC;AAW9B,OAAO,EAAmE,KAAK,kBAAkB,EAAE,KAAK,qBAAqB,EAAqB,MAAM,sBAAsB,CAAC;AAY/K,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAEhE;;;GAGG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAGpD;AAgBD;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,EAAE,WAAW,CAAC,MAAM,CAQzD,CAAC;AAsHH,MAAM,WAAW,sBAAsB;IACrC;;;;;OAKG;IACH,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,KAAK,eAAe,CAAC;IACzE;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACtD;;;OAGG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACrD;;;;;;;;;;;;OAYG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,WAAW,CAAC,EAAE,qBAAqB,CAAC;IACpC,gFAAgF;IAChF,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B;;;;OAIG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,qBAAqB,CAAC;IACvC;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,EAAE,KAAK,CAAC;IACd;;;OAGG;IACH,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB;;;OAGG;IACH,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AA6PD;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,MAAmB,CAAC;AAuiBlD,qBAAa,eAAgB,YAAW,SAAS;IAC/C,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC;IAC3B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,uGAAuG;IACvG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAsB;IAC5C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;IAC5C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoB;IAE9C,uFAAuF;IACvF,OAAO,CAAC,iBAAiB;IAuCzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmC;IAC1D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmC;IAC9D,qGAAqG;IACrG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmC;IAC3D;;+EAE2E;IAC3E,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAwC;IACvE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAuD;IAClF,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuC;IAC/D,oFAAoF;IACpF,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA+B;IAC7D,gFAAgF;IAChF,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsC;IAC7D,gFAAgF;IAChF,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkE;IAC7F,2EAA2E;IAC3E,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAgC;IAClE,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAS;IAC7C,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAsB;IAC1D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA6B;IACvD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkC;IAC5D,8EAA8E;IAC9E,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAsC;IAClE,4FAA4F;IAC5F,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoC;IAC9D,gFAAgF;IAChF,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsC;IACjE,4FAA4F;IAC5F,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAuC;IACzE,iGAAiG;IACjG,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA2B;IACxD,8FAA8F;IAC9F,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAoE;IACtG,uGAAuG;IACvG,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAuC;IAC1E;sGACkG;IAClG,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAA2C;IAChF;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAyD;IACxF;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAyD;IAC9F;;;OAGG;IACH,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAsC;IACtE;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAqB;IAChE;;;OAGG;IACH,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAqB;IACxD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqC;IAC3D,kFAAkF;IAClF,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAyC;IACnE;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAsC;IAC3D;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAuB;IAChD;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA2B;IACtD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA0C;IAC1E,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;IACtC,iGAAiG;IACjG,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAiC;IACtE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA2D;IACzF,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAuB;IAC5D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;IACtC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAwB;IACvD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAC9B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAgB;IAC1C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAqB;IACtD,6FAA6F;IAC7F,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgB;IACxC,qDAAqD;IACrD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAqB;IAOxD,YAAY,OAAO,EAAE,sBAAsB,EAuD1C;IAED;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,OAAO,CAAC,oBAAoB;IA+mB5B;;;;OAIG;IACH,OAAO,CAAC,oBAAoB;IAsB5B;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,qBAAqB;IAc7B;;;;;;OAMG;IACH,OAAO,CAAC,sBAAsB;IAY9B,gBAAgB,CACd,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,eAAe,EACxB,KAAK,CAAC,EAAE,mBAAmB,GAC1B,IAAI,CAQN;IAED,iBAAiB,CACf,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,gBAAgB,EACzB,OAAO,CAAC,EAAE,gBAAgB,GACzB,IAAI,CASN;IAED;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,gBAAgB;IAiGxB,cAAc,CAAC,YAAY,EAAE,kBAAkB,GAAG,IAAI,CA6OrD;IAED,eAAe,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,CAIzE;IAEK,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAwHtF;IAED;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,sBAAsB;IA+CxB,oBAAoB,CACxB,KAAK,EAAE,eAAe,EACtB,KAAK,EAAE,yBAAyB,GAC/B,OAAO,CAAC,iBAAiB,CAAC,CAwD5B;IAED,eAAe,CAAC,MAAM,EAAE,iBAAiB,GAAG,qBAAqB,CAoBhE;IAED,sFAAsF;IACtF,OAAO,CAAC,aAAa;IAUf,kBAAkB,CACtB,KAAK,EAAE,eAAe,EACtB,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,eAAe,CAAC,CA0C1B;IAED;;mFAE+E;IAC/E,OAAO,CAAC,SAAS;IAoDjB;;;wEAGoE;IACpE,OAAO,CAAC,eAAe;IAuBjB,WAAW,CACf,SAAS,EAAE,WAAW,EACtB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,gBAAgB,CAAC,CAU3B;IAED,6GAA6G;IAC7G,OAAO,CAAC,cAAc;IAOhB,iBAAiB,CACrB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,SAAS,EAClB,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,cAAc,CAAC,CAMzB;IAED;;;;OAIG;IACG,sBAAsB,CAC1B,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,iBAAiB,CAAC,CAmD5B;IAED;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAQlB,gBAAgB,CACpB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC,kBAAkB,CAAC,CA6B7B;IAEK,oBAAoB,CACxB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAczC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,gBAAgB;IAySlB,WAAW,CACf,KAAK,EAAE,eAAe,EACtB,KAAK,EAAE,mBAAmB,EAC1B,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC,IAAI,CAAC,CAuBf;IAED,oFAAoF;YACtE,QAAQ;IAkJhB,YAAY,CAChB,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,cAAc,EACpB,IAAI,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,OAAO,CAAA;KAAE,GACjC,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAsCpC;IAEK,aAAa,CACjB,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAC3C,OAAO,CAAC,OAAO,CAAC,CAyBlB;IAEK,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAoChG;IAEK,QAAQ,CACZ,SAAS,EAAE,WAAW,EACtB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,SAAS,CAAC,CA6CpB;IAEK,aAAa,CACjB,SAAS,EAAE,WAAW,EACtB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,qBAAqB,GAC9B,OAAO,CAAC,SAAS,CAAC,CA+BpB;IAED,+FAA+F;IAC/F,OAAO,CAAC,2BAA2B;IAenC,8EAA8E;IAC9E,OAAO,CAAC,oBAAoB;IAQ5B;;;OAGG;YACW,mBAAmB;IAWjC;;;OAGG;YACW,mBAAmB;IAgBjC,0FAA0F;IAC1F,OAAO,CAAC,eAAe;IAWvB,qGAAqG;IACrG,OAAO,CAAC,mBAAmB;IAO3B;;;;;;OAMG;YACW,gBAAgB;IAuB9B;;;;;;OAMG;IACH,OAAO,CAAC,yBAAyB;YAgCnB,iBAAiB;YAkBjB,iBAAiB;IAoB/B;;;;OAIG;YACW,2BAA2B;IAiBzC,qFAAqF;YACvE,eAAe;IAU7B;;;;;;;;;;;;;OAaG;IACG,iBAAiB,CAAC,YAAY,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CA4BxF;IAEK,uBAAuB,CAC3B,YAAY,EAAE,YAAY,EAC1B,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,gBAAgB,CAAC,CA2B3B;IAED,mFAAmF;IACnF,OAAO,CAAC,iBAAiB;IAOzB;;;;;;;OAOG;IACG,oBAAoB,CACxB,OAAO,EAAE,sBAAsB,EAC/B,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,SAAS,CAAC,CAgBpB;IAEK,cAAc,CAClB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,SAAS,CAAC,CAEpB;IAED;;;;OAIG;YACW,eAAe;IA0B7B;;;;;;;;OAQG;YACW,WAAW;IA8BzB;;;;OAIG;YACW,WAAW;IAUzB,uEAAuE;IACvE,OAAO,CAAC,aAAa;IAgBf,aAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAoIjG;IAED;;;OAGG;IACH,OAAO,CAAC,cAAc;IAWtB;;;;OAIG;IACH,OAAO,CAAC,UAAU;IAkBlB;;;OAGG;IACH,OAAO,CAAC,gBAAgB;IAIxB,4DAA4D;IAC5D,OAAO,CAAC,wBAAwB;IAOhC;;;OAGG;IACH,OAAO,CAAC,kBAAkB;IAQ1B;;;;OAIG;IACH,OAAO,CAAC,uBAAuB;IAS/B,qDAAqD;IACrD,OAAO,CAAC,qBAAqB;IAI7B,yGAAyG;IACzG,OAAO,CAAC,cAAc;IAMtB,4FAA4F;IAC5F,OAAO,CAAC,mBAAmB;IAgB3B;;;;;OAKG;YACW,eAAe;IAyB7B;;;OAGG;IACH,OAAO,CAAC,UAAU;IAOlB;;;OAGG;IACH,OAAO,CAAC,cAAc;IAoBtB,qFAAqF;IACrF,OAAO,CAAC,gBAAgB;IAYxB;;;;;OAKG;IACG,kBAAkB,CACtB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAA;KAAE,GACpC,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CA4CpC;IAED;;;;;OAKG;IACG,kBAAkB,CACtB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,SAAS,CAAC,CAOpB;IAED;;;;;OAKG;IACG,wBAAwB,CAC5B,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,gBAAgB,CAAC,CAW3B;IAED;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAGxB,OAAO,CAAC,SAAS,CAA+B;IAEhD;;;;OAIG;IACG,gBAAgB,CACpB,MAAM,EAAE,cAAc,EACtB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,SAAS,CAAC,CAKpB;IAED;;;;;OAKG;IACG,UAAU,CACd,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,SAAS,aAAa,EAAE,GACpC,OAAO,CAAC,YAAY,EAAE,CAAC,CAQzB;IAED;;;OAGG;IACG,SAAS,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAIhH;IAEK,sBAAsB,CAC1B,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,WAAW,EACrB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,QAAQ,CAAC,CASnB;IAEK,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAIpH;IAEK,sBAAsB,CAC1B,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,WAAW,EACnB,SAAS,EAAE,WAAW,EACtB,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,QAAQ,CAAC,CASnB;IAEK,uBAAuB,CAC3B,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,WAAW,EACnB,SAAS,EAAE,WAAW,GACrB,OAAO,CAAC;QAAE,QAAQ,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAQpD;IAED;;;;;OAKG;IACG,2BAA2B,CAC/B,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,8BAA8B,GACpC,OAAO,CAAC,iBAAiB,CAAC,CAmC5B;IAED;;;;;OAKG;IACG,sBAAsB,CAC1B,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,YAAY,EAAE,YAAY,EAC1B,EAAE,EAAE,WAAW,GACd,OAAO,CAAC,mBAAmB,CAAC,CAS9B;IAED;;;OAGG;IACG,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,YAAY,EAAE,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAGrH;IAED;;;;;OAKG;IACG,yBAAyB,CAC7B,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,WAAW,EACnB,MAAM,EAAE,SAAS,GAChB,OAAO,CAAC,aAAa,CAAC,CA6BxB;IAED,oHAAoH;IACpH,OAAO,CAAC,UAAU;IAKlB,uGAAuG;IACvG,OAAO,CAAC,SAAS;IAMjB;;;;;OAKG;YACW,eAAe;IAc7B,kGAAkG;IAClG,iBAAiB,IAAI;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,EAAE,CAE3E;IAED,mBAAmB,IAAI,oBAAoB,EAAE,CAQ5C;IAED,mBAAmB,IAAI,qBAAqB,EAAE,CAQ7C;IAED;;;;;;;;;;;;;;;OAeG;IACG,cAAc,CAClB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,eAAe,CAAC,CA4E1B;IAGK,eAAe,CACnB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,iBAAiB,CAAC,CAwJ5B;IAED;;;;;;;OAOG;YACW,aAAa;IA0C3B;;;;OAIG;IACH,OAAO,CAAC,cAAc;IAetB,sGAAsG;IACtG,OAAO,CAAC,SAAS;IAyajB;;;;;;;;;OASG;IACH,OAAO,CAAC,cAAc;IAgBtB,qFAAqF;IACrF,OAAO,CAAC,SAAS;YAKH,SAAS;IA4BjB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAQ3B;IAOD;;;;;;;;;;;;;;;;;;;;OAoBG;IACH;;;;OAIG;IACH,OAAO,CAAC,aAAa;YAQP,iBAAiB;YA6BjB,qBAAqB;IAgInC;;;;;;;OAOG;IACH,OAAO,CAAC,sBAAsB;IAmD9B,6FAA6F;IAC7F,OAAO,CAAC,oBAAoB;IAQtB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAUjF;IAED,WAAW,CACT,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,UAAU,EACnB,KAAK,CAAC,EAAE,mBAAmB,EAC3B,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAC7B,IAAI,CAON;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,QAAQ;IAuJhB;;;;OAIG;IACH,OAAO,CAAC,qBAAqB;IA0BvB,WAAW,CACf,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,gBAAgB,GACtB,OAAO,CAAC,MAAM,CAAC,CAGjB;IAEK,UAAU,CACd,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAC/C,OAAO,CAAC,cAAc,CAAC,CAuBzB;IAEK,OAAO,CACX,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,MAAM,CAAC,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,EAAE,CAAC,CAInB;IAEK,iBAAiB,CACrB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,gBAAgB,EACzB,KAAK,EAAE,WAAW,EAClB,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAC/B,OAAO,CAAC,IAAI,CAAC,CAcf;IAED;;;;;;;OAOG;IACG,uBAAuB,CAC3B,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,wBAAwB,EAAE,CAAC,CAiCrC;IAED,iBAAiB,IAAI,iBAAiB,CAIrC;IAED;;;;;;;;OAQG;IACG,YAAY,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA6CrF;IAEK,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CA6B7F;IAEK,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAWhG;IAEK,0BAA0B,CAC9B,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,MAAM,CAAC,EAAE,qBAAqB,GAC7B,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAOjC;IAEK,qBAAqB,CACzB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,EAAE,EAAE,iBAAiB,EACrB,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,IAAI,CAAC,CAsBf;YAEa,QAAQ;YAkBR,cAAc;IA6F5B;;;;OAIG;IACH;;;;OAIG;IACH,OAAO,CAAC,aAAa;IAuBrB,OAAO,CAAC,YAAY;IAmDpB;;;;;;OAMG;IACH;;;;;;OAMG;IACH,mFAAmF;IACnF,OAAO,CAAC,gBAAgB;IA4CxB,OAAO,CAAC,YAAY;IA0BpB;;;;;OAKG;IACH,OAAO,CAAC,WAAW;IASnB;;;;OAIG;IACH,OAAO,CAAC,cAAc;IAiDtB;;;;;;;;;OASG;YACW,gBAAgB;IA0D9B;;;;;;;;;OASG;YACW,eAAe;IAiB7B,gFAAgF;IAChF,OAAO,CAAC,aAAa;IAQrB;;;;OAIG;IACH,OAAO,CAAC,eAAe;IAMvB;;;;OAIG;IACH,OAAO,CAAC,kBAAkB;IAQ1B;;;OAGG;IACH,OAAO,CAAC,eAAe;IA+EvB,OAAO,CAAC,WAAW;IAgCnB,OAAO,CAAC,sBAAsB;IAe9B,4FAA4F;IAC5F,OAAO,CAAC,gBAAgB;IAYxB,sFAAsF;IACtF,UAAU,CAAC,UAAU,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAExE;IAED,sFAAsF;IACtF,OAAO,CAAC,YAAY;IAIpB,OAAO,CAAC,UAAU;IAi5JlB;;;;;;;;;OASG;IACH;;;;OAIG;IACH;;;;;OAKG;IACH,OAAO,CAAC,YAAY;IA6BpB,oGAAoG;IACpG,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,YAAY;IAkBpB;;;;;OAKG;IACH,OAAO,CAAC,uBAAuB;IAI/B;;;OAGG;IACH,OAAO,CAAC,yBAAyB;IAIjC;;;OAGG;IACH,OAAO,CAAC,cAAc;IAmBtB;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,CAAC,iBAAiB;IAIzB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,iBAAiB;IA0BzB;;;;;;;OAOG;IACH,OAAO,CAAC,4BAA4B;IA4BpC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,yBAAyB;IAWjC,OAAO,CAAC,sBAAsB;IA+I9B,OAAO,CAAC,SAAS;IAejB;;;;OAIG;IACH,qGAAqG;IACrG,OAAO,CAAC,eAAe;IASvB,OAAO,CAAC,gBAAgB;IAmnBxB,oGAAoG;IACpG,OAAO,CAAC,YAAY;IAIpB;;;;;;OAMG;YACW,aAAa;YAqBb,sBAAsB;IA6FpC;;;;;;;;;OASG;IACH,OAAO,CAAC,oBAAoB;IAyB5B;;;;;OAKG;IACH;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,oBAAoB;IAU5B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,oBAAoB;IAa5B,OAAO,CAAC,UAAU;IAKlB;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,cAAc;IAKtB;;;;;OAKG;IACH,OAAO,CAAC,MAAM;IAuBd;;;OAGG;IACH,OAAO,CAAC,YAAY;IAUpB;;;;;;;OAOG;IACH,OAAO,CAAC,kBAAkB;IA8G1B,OAAO,CAAC,OAAO;CAsChB"}
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAoBL,KAAK,cAAc,EACnB,KAAK,eAAe,EAepB,KAAK,WAAW,EAEhB,KAAK,YAAY,EAwBjB,KAAK,QAAQ,EACb,KAAK,YAAY,EAIjB,KAAK,cAAc,EA4CnB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,8BAA8B,EAGnC,KAAK,kBAAkB,EAEvB,KAAK,YAAY,EAMjB,KAAK,YAAY,EAOjB,KAAK,QAAQ,EAeb,KAAK,WAAW,EAIhB,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAM1B,KAAK,wBAAwB,EAE7B,KAAK,SAAS,EASd,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,UAAU,EACf,KAAK,WAAW,EAgBhB,KAAK,cAAc,EAEnB,KAAK,OAAO,EAeZ,KAAK,sBAAsB,EAG3B,KAAK,QAAQ,EAGb,KAAK,iBAAiB,EAyBvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EA8EL,KAAK,aAAa,EAKlB,KAAK,kBAAkB,EAwDvB,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAc1B,KAAK,uBAAuB,EAG5B,KAAK,gBAAgB,EACrB,KAAK,eAAe,EAEpB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EAEpB,KAAK,mBAAmB,EAuCxB,KAAK,eAAe,EAMpB,KAAK,mBAAmB,EAiJxB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,KAAK,EACV,KAAK,SAAS,EACd,KAAK,SAAS,EAEd,KAAK,SAAS,EAEd,KAAK,kBAAkB,EAEvB,KAAK,gBAAgB,EAGrB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EAExB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EAGtB,KAAK,SAAS,EACd,KAAK,SAAS,EACd,KAAK,gBAAgB,EAGrB,KAAK,qBAAqB,EAC1B,KAAK,yBAAyB,EAiC9B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EAmBzB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EA0EvB,KAAK,cAAc,EAEnB,KAAK,UAAU,EACf,KAAK,MAAM,EACX,KAAK,YAAY,EAQjB,KAAK,gBAAgB,EAwCrB,KAAK,qBAAqB,EAG1B,KAAK,SAAS,EACd,KAAK,qBAAqB,EAQ1B,KAAK,qBAAqB,EAG1B,KAAK,kBAAkB,EACxB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAQL,KAAK,qBAAqB,EAC3B,MAAM,sBAAsB,CAAC;AAW9B,OAAO,EAAmE,KAAK,kBAAkB,EAAE,KAAK,qBAAqB,EAAqB,MAAM,sBAAsB,CAAC;AAY/K,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAEhE;;;GAGG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAGpD;AAgBD;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,EAAE,WAAW,CAAC,MAAM,CAQzD,CAAC;AAsHH,MAAM,WAAW,sBAAsB;IACrC;;;;;OAKG;IACH,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,KAAK,eAAe,CAAC;IACzE;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACtD;;;OAGG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACrD;;;;;;;;;;;;OAYG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,WAAW,CAAC,EAAE,qBAAqB,CAAC;IACpC,gFAAgF;IAChF,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B;;;;OAIG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,qBAAqB,CAAC;IACvC;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,EAAE,KAAK,CAAC;IACd;;;OAGG;IACH,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB;;;OAGG;IACH,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,mBAAmB,CAAC;CACnC;AA6PD;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,MAAmB,CAAC;AAuiBlD,qBAAa,eAAgB,YAAW,SAAS;IAC/C,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC;IAC3B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,uGAAuG;IACvG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAsB;IAC5C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;IAC5C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoB;IAE9C,uFAAuF;IACvF,OAAO,CAAC,iBAAiB;IAuCzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmC;IAC1D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmC;IAC9D,qGAAqG;IACrG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmC;IAC3D;;+EAE2E;IAC3E,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAwC;IACvE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAuD;IAClF,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuC;IAC/D,sGAAsG;IACtG,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAqB;IAClD,gGAAgG;IAChG,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAkC;IAC9D,oFAAoF;IACpF,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA+B;IAC7D,gFAAgF;IAChF,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsC;IAC7D,gFAAgF;IAChF,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkE;IAC7F,2EAA2E;IAC3E,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAgC;IAClE,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAS;IAC7C,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAsB;IAC1D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA6B;IACvD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkC;IAC5D,8EAA8E;IAC9E,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAsC;IAClE,4FAA4F;IAC5F,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoC;IAC9D,gFAAgF;IAChF,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsC;IACjE,4FAA4F;IAC5F,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAuC;IACzE,iGAAiG;IACjG,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA2B;IACxD,8FAA8F;IAC9F,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAoE;IACtG,uGAAuG;IACvG,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAuC;IAC1E;sGACkG;IAClG,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAA2C;IAChF;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAyD;IACxF;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAyD;IAC9F;;;OAGG;IACH,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAsC;IACtE;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAqB;IAChE;;;OAGG;IACH,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAqB;IACxD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqC;IAC3D,kFAAkF;IAClF,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAyC;IACnE;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAsC;IAC3D;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAuB;IAChD;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA2B;IACtD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA0C;IAC1E,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;IACtC,iGAAiG;IACjG,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAiC;IACtE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA2D;IACzF,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAuB;IAC5D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;IACtC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAwB;IACvD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAC9B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAgB;IAC1C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAqB;IACtD,6FAA6F;IAC7F,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgB;IACxC,qDAAqD;IACrD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAqB;IAOxD,YAAY,OAAO,EAAE,sBAAsB,EA0D1C;IAED;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,OAAO,CAAC,oBAAoB;IA+mB5B;;;;OAIG;IACH,OAAO,CAAC,oBAAoB;IAsB5B;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,qBAAqB;IAc7B;;;;;;OAMG;IACH,OAAO,CAAC,sBAAsB;IAY9B,gBAAgB,CACd,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,eAAe,EACxB,KAAK,CAAC,EAAE,mBAAmB,GAC1B,IAAI,CAQN;IAED,iBAAiB,CACf,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,gBAAgB,EACzB,OAAO,CAAC,EAAE,gBAAgB,GACzB,IAAI,CASN;IAED;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,gBAAgB;IAiGxB,cAAc,CAAC,YAAY,EAAE,kBAAkB,GAAG,IAAI,CA+OrD;IAED,eAAe,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,CAIzE;IAEK,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAwHtF;IAED;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,sBAAsB;IA+CxB,oBAAoB,CACxB,KAAK,EAAE,eAAe,EACtB,KAAK,EAAE,yBAAyB,GAC/B,OAAO,CAAC,iBAAiB,CAAC,CAwD5B;IAED,eAAe,CAAC,MAAM,EAAE,iBAAiB,GAAG,qBAAqB,CAoBhE;IAED,sFAAsF;IACtF,OAAO,CAAC,aAAa;IAUf,kBAAkB,CACtB,KAAK,EAAE,eAAe,EACtB,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,eAAe,CAAC,CA0C1B;IAED;;mFAE+E;IAC/E,OAAO,CAAC,SAAS;IAoDjB;;;wEAGoE;IACpE,OAAO,CAAC,eAAe;IAuBjB,WAAW,CACf,SAAS,EAAE,WAAW,EACtB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,gBAAgB,CAAC,CAU3B;IAED,6GAA6G;IAC7G,OAAO,CAAC,cAAc;IAOhB,iBAAiB,CACrB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,SAAS,EAClB,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,cAAc,CAAC,CAMzB;IAED;;;;OAIG;IACG,sBAAsB,CAC1B,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,iBAAiB,CAAC,CAmD5B;IAED;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAQlB,gBAAgB,CACpB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC,kBAAkB,CAAC,CA6B7B;IAEK,oBAAoB,CACxB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAczC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,gBAAgB;IAySlB,WAAW,CACf,KAAK,EAAE,eAAe,EACtB,KAAK,EAAE,mBAAmB,EAC1B,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC,IAAI,CAAC,CAuBf;IAED,oFAAoF;YACtE,QAAQ;IAkJhB,YAAY,CAChB,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,cAAc,EACpB,IAAI,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,OAAO,CAAA;KAAE,GACjC,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAsCpC;IAEK,aAAa,CACjB,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAC3C,OAAO,CAAC,OAAO,CAAC,CAyBlB;IAEK,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAoChG;IAEK,QAAQ,CACZ,SAAS,EAAE,WAAW,EACtB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,SAAS,CAAC,CA6CpB;IAEK,aAAa,CACjB,SAAS,EAAE,WAAW,EACtB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,qBAAqB,GAC9B,OAAO,CAAC,SAAS,CAAC,CA+BpB;IAED,+FAA+F;IAC/F,OAAO,CAAC,2BAA2B;IAenC,8EAA8E;IAC9E,OAAO,CAAC,oBAAoB;IAQ5B;;;OAGG;YACW,mBAAmB;IAWjC;;;OAGG;YACW,mBAAmB;IAgBjC,0FAA0F;IAC1F,OAAO,CAAC,eAAe;IAWvB,qGAAqG;IACrG,OAAO,CAAC,mBAAmB;IAO3B;;;;;;OAMG;YACW,gBAAgB;IAuB9B;;;;;;OAMG;IACH,OAAO,CAAC,yBAAyB;YAgCnB,iBAAiB;YAkBjB,iBAAiB;IAoB/B;;;;OAIG;YACW,2BAA2B;IAiBzC,qFAAqF;YACvE,eAAe;IAU7B;;;;;;;;;;;;;OAaG;IACG,iBAAiB,CAAC,YAAY,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CA4BxF;IAEK,uBAAuB,CAC3B,YAAY,EAAE,YAAY,EAC1B,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,gBAAgB,CAAC,CA2B3B;IAED,mFAAmF;IACnF,OAAO,CAAC,iBAAiB;IAOzB;;;;;;;OAOG;IACG,oBAAoB,CACxB,OAAO,EAAE,sBAAsB,EAC/B,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,SAAS,CAAC,CAgBpB;IAEK,cAAc,CAClB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO;IAChB,8GAA8G;IAC9G,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,SAAS,CAAC,CAEpB;IAED;;;;OAIG;YACW,eAAe;IA2B7B;;;;;;;;OAQG;YACW,WAAW;IA8BzB;;;;OAIG;YACW,WAAW;IAUzB,uEAAuE;IACvE,OAAO,CAAC,aAAa;IAgBf,aAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAoIjG;IAED;;;OAGG;IACH,OAAO,CAAC,cAAc;IAWtB;;;;OAIG;IACH,OAAO,CAAC,UAAU;IAkBlB;;;OAGG;IACH,OAAO,CAAC,gBAAgB;IAIxB,4DAA4D;IAC5D,OAAO,CAAC,wBAAwB;IAOhC;;;OAGG;IACH,OAAO,CAAC,kBAAkB;IAQ1B;;;;OAIG;IACH,OAAO,CAAC,uBAAuB;IAS/B,qDAAqD;IACrD,OAAO,CAAC,qBAAqB;IAI7B,yGAAyG;IACzG,OAAO,CAAC,cAAc;IAMtB,4FAA4F;IAC5F,OAAO,CAAC,mBAAmB;IAgB3B;;;;;OAKG;YACW,eAAe;IAyB7B;;;OAGG;IACH,OAAO,CAAC,UAAU;IAOlB;;;OAGG;IACH,OAAO,CAAC,cAAc;IAoBtB,qFAAqF;IACrF,OAAO,CAAC,gBAAgB;IAYxB;;;;;OAKG;IACG,kBAAkB,CACtB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAA;KAAE,GACpC,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CA4CpC;IAED;;;;;OAKG;IACG,kBAAkB,CACtB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,SAAS,CAAC,CAOpB;IAED;;;;;OAKG;IACG,wBAAwB,CAC5B,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,gBAAgB,CAAC,CAW3B;IAED;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAGxB,OAAO,CAAC,SAAS,CAA+B;IAEhD;;;;OAIG;IACG,gBAAgB,CACpB,MAAM,EAAE,cAAc,EACtB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,SAAS,CAAC,CAKpB;IAED;;;;;OAKG;IACG,UAAU,CACd,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,SAAS,aAAa,EAAE,GACpC,OAAO,CAAC,YAAY,EAAE,CAAC,CAQzB;IAED;;;OAGG;IACG,SAAS,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAQhH;IAEK,sBAAsB,CAC1B,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,WAAW,EACrB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,QAAQ,CAAC,CAWnB;IAEK,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAIpH;IAEK,sBAAsB,CAC1B,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,WAAW,EACnB,SAAS,EAAE,WAAW,EACtB,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,QAAQ,CAAC,CAYnB;IAEK,uBAAuB,CAC3B,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,WAAW,EACnB,SAAS,EAAE,WAAW,GACrB,OAAO,CAAC;QAAE,QAAQ,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAQpD;IAED;;;;;OAKG;IACG,2BAA2B,CAC/B,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,8BAA8B,GACpC,OAAO,CAAC,iBAAiB,CAAC,CAmC5B;IAED;;;;;OAKG;IACG,sBAAsB,CAC1B,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,YAAY,EAAE,YAAY,EAC1B,EAAE,EAAE,WAAW,GACd,OAAO,CAAC,mBAAmB,CAAC,CAS9B;IAED;;;OAGG;IACG,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,YAAY,EAAE,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAGrH;IAED;;;;;OAKG;IACG,yBAAyB,CAC7B,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,WAAW,EACnB,MAAM,EAAE,SAAS,GAChB,OAAO,CAAC,aAAa,CAAC,CA6BxB;IAED,oHAAoH;IACpH,OAAO,CAAC,UAAU;IAKlB;;;;OAIG;IACH,OAAO,CAAC,kBAAkB;IAM1B,qGAAqG;IACrG,OAAO,CAAC,mBAAmB;IAK3B,uGAAuG;IACvG,OAAO,CAAC,SAAS;IAMjB;;;;;OAKG;YACW,eAAe;IAc7B,kGAAkG;IAClG,iBAAiB,IAAI;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,EAAE,CAE3E;IAED,mBAAmB,IAAI,oBAAoB,EAAE,CAQ5C;IAED,mBAAmB,IAAI,qBAAqB,EAAE,CAQ7C;IAED;;;;;;;;;;;;;;;OAeG;IACG,cAAc,CAClB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,eAAe,CAAC,CA4E1B;IAGK,eAAe,CACnB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,iBAAiB,CAAC,CA+J5B;IAED;;;;;;;OAOG;YACW,aAAa;IA0C3B;;;;OAIG;IACH,OAAO,CAAC,cAAc;IAetB,sGAAsG;IACtG,OAAO,CAAC,SAAS;IAyajB;;;;;;;;;OASG;IACH,OAAO,CAAC,cAAc;IAgBtB,qFAAqF;IACrF,OAAO,CAAC,SAAS;YAKH,SAAS;IA4BjB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAQ3B;IAOD;;;;;;;;;;;;;;;;;;;;OAoBG;IACH;;;;OAIG;IACH,OAAO,CAAC,aAAa;YAQP,iBAAiB;YA6BjB,qBAAqB;IAgInC;;;;;;;OAOG;IACH,OAAO,CAAC,sBAAsB;IAmD9B,6FAA6F;IAC7F,OAAO,CAAC,oBAAoB;IAQtB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAUjF;IAED,WAAW,CACT,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,UAAU,EACnB,KAAK,CAAC,EAAE,mBAAmB,EAC3B,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAC7B,IAAI,CAON;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,QAAQ;IAuJhB;;;;OAIG;IACH,OAAO,CAAC,qBAAqB;IA0BvB,WAAW,CACf,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,gBAAgB,GACtB,OAAO,CAAC,MAAM,CAAC,CAGjB;IAEK,UAAU,CACd,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAC/C,OAAO,CAAC,cAAc,CAAC,CAuBzB;IAEK,OAAO,CACX,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,MAAM,CAAC,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,EAAE,CAAC,CAInB;IAEK,iBAAiB,CACrB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,gBAAgB,EACzB,KAAK,EAAE,WAAW,EAClB,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAC/B,OAAO,CAAC,IAAI,CAAC,CAcf;IAED;;;;;;;OAOG;IACG,uBAAuB,CAC3B,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,wBAAwB,EAAE,CAAC,CAiCrC;IAED,iBAAiB,IAAI,iBAAiB,CAIrC;IAED;;;;;;;;OAQG;IACG,YAAY,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA6CrF;IAEK,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CA6B7F;IAEK,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAWhG;IAEK,0BAA0B,CAC9B,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,MAAM,CAAC,EAAE,qBAAqB,GAC7B,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAOjC;IAEK,qBAAqB,CACzB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,EAAE,EAAE,iBAAiB,EACrB,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,IAAI,CAAC,CAsBf;YAEa,QAAQ;YAkBR,cAAc;IA6F5B;;;;OAIG;IACH;;;;OAIG;IACH,OAAO,CAAC,aAAa;IAuBrB,OAAO,CAAC,YAAY;IAmDpB;;;;;;OAMG;IACH;;;;;;OAMG;IACH,mFAAmF;IACnF,OAAO,CAAC,gBAAgB;IA4CxB,OAAO,CAAC,YAAY;IA0BpB;;;;;OAKG;IACH,OAAO,CAAC,WAAW;IASnB;;;;OAIG;IACH,OAAO,CAAC,cAAc;IAiDtB;;;;;;;;;OASG;YACW,gBAAgB;IA0D9B;;;;;;;;;OASG;YACW,eAAe;IAiB7B,gFAAgF;IAChF,OAAO,CAAC,aAAa;IAQrB;;;;OAIG;IACH,OAAO,CAAC,eAAe;IAMvB;;;;OAIG;IACH,OAAO,CAAC,kBAAkB;IAQ1B;;;OAGG;IACH,OAAO,CAAC,eAAe;IA+EvB,OAAO,CAAC,WAAW;IAgCnB,OAAO,CAAC,sBAAsB;IAe9B,4FAA4F;IAC5F,OAAO,CAAC,gBAAgB;IAYxB,sFAAsF;IACtF,UAAU,CAAC,UAAU,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAExE;IAED,sFAAsF;IACtF,OAAO,CAAC,YAAY;IAIpB,OAAO,CAAC,UAAU;IAg6JlB;;;;;;;;;OASG;IACH;;;;OAIG;IACH;;;;;OAKG;IACH,OAAO,CAAC,YAAY;IA6BpB,oGAAoG;IACpG,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,YAAY;IAkBpB;;;;;OAKG;IACH,OAAO,CAAC,uBAAuB;IAI/B;;;OAGG;IACH,OAAO,CAAC,yBAAyB;IAIjC;;;OAGG;IACH,OAAO,CAAC,cAAc;IAmBtB;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,CAAC,iBAAiB;IAIzB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,iBAAiB;IA0BzB;;;;;;;OAOG;IACH,OAAO,CAAC,4BAA4B;IA4BpC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,yBAAyB;IAWjC,OAAO,CAAC,sBAAsB;IA+I9B,OAAO,CAAC,SAAS;IAejB;;;;OAIG;IACH,qGAAqG;IACrG,OAAO,CAAC,eAAe;IASvB,OAAO,CAAC,gBAAgB;IAwnBxB,oGAAoG;IACpG,OAAO,CAAC,YAAY;IAIpB;;;;;;OAMG;YACW,aAAa;YAqBb,sBAAsB;IA6FpC;;;;;;;;;OASG;IACH,OAAO,CAAC,oBAAoB;IAyB5B;;;;;OAKG;IACH;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,oBAAoB;IAU5B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,oBAAoB;IAa5B,OAAO,CAAC,UAAU;IAKlB;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,cAAc;IAKtB;;;;;OAKG;IACH,OAAO,CAAC,MAAM;IAuBd;;;OAGG;IACH,OAAO,CAAC,YAAY;IAUpB;;;;;;;OAOG;IACH,OAAO,CAAC,kBAAkB;IA8G1B,OAAO,CAAC,OAAO;CAsChB"}
package/dist/index.js CHANGED
@@ -2,7 +2,7 @@ import { existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, rmSync,
2
2
  import { dirname, join } from 'node:path';
3
3
  import Database from 'better-sqlite3';
4
4
  import { accessLogEntry, adminLogEntry, delegatedReadParams, operationSeriesCount, opsFailureEntry, opsFailureFingerprint, issueEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunEntry, modelUsageEntry, ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, createTenantInput, domainEvent, domainEventInput, exportReadInput, importBatch, importCursorMove, exportsOfManifestJson, assertNoBindingShapeBreak, importsOfManifestJson, entitlementGrant, entitlementGrantInput, eventId, meterReading, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, identityLink, identityPool, instant, isSubstratError, connection, capabilityGrant, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchRecord, peerSwitch, verticalCaller, verticalSlug as verticalSlugOf, subjectRef, requestFingerprint, createConnectionInput, connectLinkFilter, connectLinkKey, consumeConnectLinkInput, mintConnectLinkInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, routeTarget, ROUTE_SCOPE_HOSTNAMES_MAX, registerVerticalInput, vertical as verticalSchema, verticalChannel, verticalVersion, objectRef, entityObjectRef, assertModuleEmittableType, assertKernelAuthoredType, grantRefFromProof, org as orgSchema, orgMembership, principalId, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, principalBecomeCapabilityInput, subjectShredReceipt, SCOPE_TABLE_PAGE_DEFAULT, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, verticalServingState, callsOfManifestJson, outboundOfManifestJson, listLimitOf, pageOf, countedPageOf, SCOPE_GATE_REASONS, substratError, assertReplayableDump, delegatedReadRecord, ownerTransferAudit, memberChangeAudit, peerBindingAudit, connectionBindingAudit, copyMarkAudit, orphanSweepAudit, redrainEventsInput, REDRAIN_BATCH, errorCodeOf, } from '@substrat-run/contracts';
5
- import { actorOf, asPrincipal, assertAllowed, assertNoSecret, assertPermissionKey, CAPABILITY_DDL, UPLOAD_LINK_DDL, createAttachmentVerbs, inspectUploadLink, redeemUploadLinkInTransaction, redeemOrReplayUploadLink, COPY_ORIGIN_DDL, ENTITY_STATE_MOVES_DDL, CAPABILITY_EXCHANGE_OPERATION, CAPABILITY_BECOME_MINT_OPERATION, becomeMintCheck, mintBecomeCapabilityAsPrincipal, revokeBecomeCapabilityAsPrincipal, readBecomeLinkStates, ENTITY_UNBIND_OPERATION, allowedFor, unbindEntityHolderBounded, capabilityAttachmentWriteRefused, capabilityTokenHash, createCapabilityVerbs, createEntityEdgeVerbs, createEntityStateVerbs, createTrashedReads, CONTINUATION_POSITION_CAP, visibleContinuation, searchStateWhere, uncheckedView, addStatePlans, addUpdatedStampPlans, watchUpdatedStamps, entityStateMigrations, assertNoCallerPurge, isUnreachableParent, heldPurgePass, purgeDueOf, purgeHeldBy, lifecycleRefusal, purgeOnlyKeysOf, purgeReportOf, purgeStillDue, refuseTrashedTarget, assertBoundOperations, checkHeldOperationsOf, countChecks, noteUncheckedCompletion, registerTrashTargets, runPurgePass, withheldKeysFor, statefulTablesOf, afterMigration, afterRuntimeDdl, derivesAnything, repairDerivedObjects, StateColumnLost, exchangeCapability as exchangeCapabilitySecret, guardSecrets, mintBecomeCapability, plausibleSessionToken, readCapabilityPage, redactSecrets, redactSecretText, moduleLog, consoleLogSink, asyncInvocationId, asyncLinePass, consoleInvocationLineSink, resolveCapabilitySession, revokeCapabilityAsPlatform, assertReadOnlyQuery, attachmentBlobKey, attachmentSha256, entitlementDenial, requiredEntitlementFor, foldMeterReading, guardSpine, guardSqlLimits, DO_SQL_LIMITS, tooManyResultColumns, tooManyTableColumns, parseValidationRecords, resolveScopeRecord, ulid, ISSUE_RETENTION_DAYS, telemetryRetentionStatements, FINDINGS_DDL, SCOPE_STORAGE_DDL, forgetScopeStorage, listScopeStorageAttemptRows, listScopeStorageRows, listScopeStoreStorageRows, pruneScopeStorageRows, recordScopeStorageRows, CONNECT_LINKS_DDL, consumeConnectLinkRow, insertConnectLink, listConnectLinks as listConnectLinkRows, readConnectLink, restoreConnectLinkRow, revokeConnectLinkRow, createFindingRule, findingOfOpsFailure, findingOfSweepRun, pruneFindings, listFindingRules, listFindings, observeFinding, revokeFindingRule, setFindingStatus, assertRowLimit, assertRowOffset, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, SWEEP_RUNS_INTENT_INDEX, sweepRunsIntentHasKind, MODEL_USAGE_RETENTION_DAYS, foldModelUsage, backoffAt, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, eraseSubjectFromModules, moduleRowsErased, moduleErasurePlan, redactSubjectScopeText, redactSubjectDirectoryText, ISSUE_EXEMPLAR_OWNER_BACKFILL_SQL, issueExemplarOwner, JOB_RUN_PATCH_SQL, JOB_RUN_CLAIM_SQL, JOB_RUN_RENEW_SQL, JOB_RUN_BEGIN_SQL, JOB_RUN_MISS_SQL, JOB_RUN_MISS_SETTLE_SQL, admissionMissOutcome, JOB_STEP_RECORD_SQL, JOB_LEASE_EXPIRED_NOTE, assertLeaseMs, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, applyScopeRoleChange, changeScopeRole, revokeScopeRoles, scopeRoleHolders, admitPeer, boundToPeerDeclarations, peerCallerAt, collectPeers, peerSeats, resolveVerticalInstanceFrom, resolvePeerInstanceFrom, peerVerticalSpellings, samePeerVertical, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, PEER_SWITCHES_DDL, PEER_BINDINGS_DDL, SWITCH_OWED_DDL, SWITCH_FENCES_DDL, TABLE_OWNERS_DDL, assertMigrationLeavesLedgerAlone, recordOwnershipSteps, runMigrationStatements, executableSqlStatements, blankSqlComments, recordWriteSuperseded, switchFencesOf, switchSupersededMessage, SWITCH_KINDS, SYSTEM_SWITCHES_DDL, forgetSwitchesOf, listSystemSwitchRecords, moveSwitch, reassertActionOf, reassertEntry, reassertOffRow, recordSwitchedOff, recordSwitchedOn, restoreSwitchRecord, scopesSwitchedOffFor, switchActionOf, switchAuditSubject, recordAuditOutcome, auditedCapabilityRevoke, auditWarningOf, switchNotFoundMessage, switchRecordsOf, switchedOffOf, switchesBackfillSqlOf, switchesTableExists, tenantHeldOf, tenantHoldsGrant, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, withRecorded, VERSION_MIGRATIONS_DDL, VERTICAL_SCOPE_STORES_DDL, forgetVerticalScopeStores, indexVersionScopeStores, driverDeclarationsOf, verticalScopeStoresOf, STORE_DRIVER_RELEASES_DDL, legacyStoreDriverConflict, legacyStoreDriverRenames, beginStoreDriverRolloutIn, finishStoreDriverRolloutIn, holdStoreDriverIn, advanceStoreDriverRebuildIn, claimStoreDriverRebuildIn, storeDriverRebuildIn, recordStoreDriverReleaseIn, releaseStoreDriverHoldIn, storeDriverReleaseIn, storeDriverStateIn, storeDriverRolloutPendingIn, storeDriverRolloutWalkedIn, splitManifestMigrations, splitVersionMigrationsBatch, versionMigrationsOf, deriveVersionMigrationDigest, publishedMigrationDigest, migrationChangeRefusal, writeVersionMigrations, denialListQuery, refusalListQuery, mapRefusalRow, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, IMPERSONATION_COLUMNS, IMPERSONATION_DDL, ImpersonationRefused, assertImpersonationWrites, assertModuleEnqueueableKind, assertSessionUsable, impersonationByIdQuery, impersonationListQuery, impersonationRowValues, impersonationStampOf, mapImpersonationRow, newImpersonationSession, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, membershipFencesBackfillSql, MEMBERSHIP_FENCES_DDL, membershipFencesTableExists, MEMBERSHIP_FENCE_SINCE_SQL, RAISE_MEMBERSHIP_FENCE_SQL, memberAddedAudit, orgChangeBound, tenantCoverage, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, noSealingKeyMessage, openSealed, sealTo, ConnectionSealingKeyUnavailableError, PermissionDenied, createAtomic, NotSearchable, NotListable, listIndexMigrations, listIndexPlans, listQuery, cursorOf, moduleMigrations, MIGRATION_DIGEST_FENCE_DDL, MIGRATION_DIGEST_MARK_LEGACY, assertJournalDumpCoherent, assertMigrationSql, migrationDivergence, migrationFailedError, migrationSetDivergence, migrationSteps, planMigrations, isSearchIndexTable, searchIndexMigrations, searchIndexPlans, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, ATTACHMENT_CONDEMNED_DDL, ATTACHMENT_SWEEP_LICENCE_DDL, ATTACHMENT_SWEEP_LICENCE_TABLE, clearOrphanSweepLicence, condemnLicensedOrphanAttachments, consumeOrphanSweepLicence, licensedOrphanIds, recordOrphanSweepLicence, refuseUnlicensedOrphanSweep, fenceAttachmentSweep, refuseCondemnedAttachment, refuseCondemnedInDump, rowlessAttachmentIds, sweepOrphanAttachments, missingAttachmentStore, SETTLED_COPY_STATES, unsettledCopyRefusal, assertAttachmentExtractors, resolveAttachmentTextBounds, assertJobRegistrable, attachmentRecordOfRow, attachmentTextJob, enqueueAttachmentText, ATTACHMENT_TEXT_BACKFILL_JOB, ATTACHMENT_TEXT_JOB, kernelJobFor, queueAttachmentTextBackfill, startAttachmentTextBackfill, attachmentTextBackfillJob, reconcileAttachmentText, recordAttachmentText, searchAttachments, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, emptyImportResult, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, exportedSinceQuery, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, assertPromoteReviewCurrent, promoteRaceRefusal, rebindRaceRefusal, SERVES_NOW_CONDITION, SERVES_NOW_PREDICATE, servesNowParams, bindExportBreaksOf, bindExportBreakRefusal, scopeMoveOf, runningVersionOf, isPrimaryScope, PROVISIONED_VERSIONS_SQL, installsReconciledOf, strandJudgmentsOf, provisionedVersionsParams, boundShapesColumn, boundShapesOfColumn, installReconciled, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, JOB_RUN_DUE_AT, jobRunListLimit, jobRunOf, runDueJobRuns, startJobRun, IDEMPOTENCY_DDL, REFUSALS_TABLE_DDL, REFUSALS_INDEX, refusalInsert, refusalOf, markGuardRefusal, REFUSALS_REBUILD, refusalsAdmitGuards, assertIdempotencyKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, globalFetch, createUlid, facetEvents, readHistory, walkEventCause, walkEventEffects, assertRedrainWindow, readInvocation, readDeadLetters, readLifecycleFlow, readOperationSeries, domainEventOf, readUndrainedOutbox, undrainedEventsOf, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, unknownRoleError, callReservedStoreOperation, callScopeStore, observeStoreCall, replayStoreErasures, scopeStoreLifecycleOf, scopeStoreRunnersOf, } from '@substrat-run/kernel';
5
+ import { actorOf, asPrincipal, assertAllowed, assertNoSecret, assertPermissionKey, CAPABILITY_DDL, UPLOAD_LINK_DDL, createAttachmentVerbs, inspectUploadLink, redeemUploadLinkInTransaction, redeemOrReplayUploadLink, COPY_ORIGIN_DDL, ENTITY_STATE_MOVES_DDL, CAPABILITY_EXCHANGE_OPERATION, CAPABILITY_BECOME_MINT_OPERATION, becomeMintCheck, mintBecomeCapabilityAsPrincipal, revokeBecomeCapabilityAsPrincipal, readBecomeLinkStates, ENTITY_UNBIND_OPERATION, allowedFor, unbindEntityHolderBounded, capabilityAttachmentWriteRefused, capabilityTokenHash, createCapabilityVerbs, createEntityEdgeVerbs, createEntityStateVerbs, createTrashedReads, CONTINUATION_POSITION_CAP, visibleContinuation, searchStateWhere, uncheckedView, addStatePlans, addUpdatedStampPlans, watchUpdatedStamps, entityStateMigrations, assertNoCallerPurge, isUnreachableParent, heldPurgePass, purgeDueOf, purgeHeldBy, lifecycleRefusal, purgeOnlyKeysOf, purgeReportOf, purgeStillDue, refuseTrashedTarget, assertBoundOperations, checkHeldOperationsOf, countChecks, noteUncheckedCompletion, registerTrashTargets, runPurgePass, withheldKeysFor, statefulTablesOf, afterMigration, afterRuntimeDdl, derivesAnything, repairDerivedObjects, StateColumnLost, exchangeCapability as exchangeCapabilitySecret, guardSecrets, mintBecomeCapability, plausibleSessionToken, readCapabilityPage, redactSecrets, redactSecretText, moduleLog, consoleLogSink, asyncInvocationId, asyncLinePass, consoleInvocationLineSink, resolveCapabilitySession, revokeCapabilityAsPlatform, assertReadOnlyQuery, attachmentBlobKey, attachmentSha256, entitlementDenial, requiredEntitlementFor, foldMeterReading, guardSpine, guardSqlLimits, DO_SQL_LIMITS, tooManyResultColumns, tooManyTableColumns, parseValidationRecords, resolveScopeRecord, ulid, ISSUE_RETENTION_DAYS, telemetryRetentionStatements, FINDINGS_DDL, SCOPE_STORAGE_DDL, forgetScopeStorage, listScopeStorageAttemptRows, listScopeStorageRows, listScopeStoreStorageRows, pruneScopeStorageRows, recordScopeStorageRows, CONNECT_LINKS_DDL, consumeConnectLinkRow, insertConnectLink, listConnectLinks as listConnectLinkRows, readConnectLink, restoreConnectLinkRow, revokeConnectLinkRow, createFindingRule, findingOfOpsFailure, findingOfSweepRun, pruneFindings, listFindingRules, listFindings, observeFinding, revokeFindingRule, setFindingStatus, assertRowLimit, assertRowOffset, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, SWEEP_RUNS_INTENT_INDEX, sweepRunsIntentHasKind, MODEL_USAGE_RETENTION_DAYS, foldModelUsage, backoffAt, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, eraseSubjectFromModules, moduleRowsErased, moduleErasurePlan, redactSubjectScopeText, redactSubjectDirectoryText, ISSUE_EXEMPLAR_OWNER_BACKFILL_SQL, issueExemplarOwner, JOB_RUN_PATCH_SQL, JOB_RUN_CLAIM_SQL, JOB_RUN_RENEW_SQL, JOB_RUN_BEGIN_SQL, JOB_RUN_MISS_SQL, JOB_RUN_MISS_SETTLE_SQL, admissionMissOutcome, JOB_STEP_RECORD_SQL, JOB_LEASE_EXPIRED_NOTE, assertLeaseMs, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, applyScopeRoleChange, changeScopeRole, revokeScopeRoles, scopeRoleHolders, assertModuleDeclared, noteReservedKeys, reservedGrantRefusal, reservedRoleRefusal, reservedShapeRefusal, admitPeer, boundToPeerDeclarations, peerCallerAt, collectPeers, peerSeats, resolveVerticalInstanceFrom, resolvePeerInstanceFrom, peerVerticalSpellings, samePeerVertical, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, PEER_SWITCHES_DDL, PEER_BINDINGS_DDL, SWITCH_OWED_DDL, SWITCH_FENCES_DDL, TABLE_OWNERS_DDL, assertMigrationLeavesLedgerAlone, recordOwnershipSteps, runMigrationStatements, executableSqlStatements, blankSqlComments, recordWriteSuperseded, switchFencesOf, switchSupersededMessage, SWITCH_KINDS, SYSTEM_SWITCHES_DDL, forgetSwitchesOf, listSystemSwitchRecords, moveSwitch, reassertActionOf, reassertEntry, reassertOffRow, recordSwitchedOff, recordSwitchedOn, restoreSwitchRecord, scopesSwitchedOffFor, switchActionOf, switchAuditSubject, recordAuditOutcome, auditedCapabilityRevoke, auditWarningOf, switchNotFoundMessage, switchRecordsOf, switchedOffOf, switchesBackfillSqlOf, switchesTableExists, tenantHeldOf, tenantHoldsGrant, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, withRecorded, VERSION_MIGRATIONS_DDL, VERTICAL_SCOPE_STORES_DDL, forgetVerticalScopeStores, indexVersionScopeStores, driverDeclarationsOf, verticalScopeStoresOf, STORE_DRIVER_RELEASES_DDL, legacyStoreDriverConflict, legacyStoreDriverRenames, beginStoreDriverRolloutIn, finishStoreDriverRolloutIn, holdStoreDriverIn, advanceStoreDriverRebuildIn, claimStoreDriverRebuildIn, storeDriverRebuildIn, recordStoreDriverReleaseIn, releaseStoreDriverHoldIn, storeDriverReleaseIn, storeDriverStateIn, storeDriverRolloutPendingIn, storeDriverRolloutWalkedIn, splitManifestMigrations, splitVersionMigrationsBatch, versionMigrationsOf, deriveVersionMigrationDigest, publishedMigrationDigest, migrationChangeRefusal, writeVersionMigrations, denialListQuery, refusalListQuery, mapRefusalRow, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, IMPERSONATION_COLUMNS, IMPERSONATION_DDL, ImpersonationRefused, assertImpersonationWrites, assertModuleEnqueueableKind, assertSessionUsable, impersonationByIdQuery, impersonationListQuery, impersonationRowValues, impersonationStampOf, mapImpersonationRow, newImpersonationSession, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, membershipFencesBackfillSql, MEMBERSHIP_FENCES_DDL, membershipFencesTableExists, MEMBERSHIP_FENCE_SINCE_SQL, RAISE_MEMBERSHIP_FENCE_SQL, memberAddedAudit, orgChangeBound, tenantCoverage, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, noSealingKeyMessage, openSealed, sealTo, ConnectionSealingKeyUnavailableError, PermissionDenied, createAtomic, NotSearchable, NotListable, listIndexMigrations, listIndexPlans, listQuery, cursorOf, moduleMigrations, MIGRATION_DIGEST_FENCE_DDL, MIGRATION_DIGEST_MARK_LEGACY, assertJournalDumpCoherent, assertMigrationSql, migrationDivergence, migrationFailedError, migrationSetDivergence, migrationSteps, planMigrations, isSearchIndexTable, searchIndexMigrations, searchIndexPlans, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, ATTACHMENT_CONDEMNED_DDL, ATTACHMENT_SWEEP_LICENCE_DDL, ATTACHMENT_SWEEP_LICENCE_TABLE, clearOrphanSweepLicence, condemnLicensedOrphanAttachments, consumeOrphanSweepLicence, licensedOrphanIds, recordOrphanSweepLicence, refuseUnlicensedOrphanSweep, fenceAttachmentSweep, refuseCondemnedAttachment, refuseCondemnedInDump, rowlessAttachmentIds, sweepOrphanAttachments, missingAttachmentStore, SETTLED_COPY_STATES, unsettledCopyRefusal, assertAttachmentExtractors, resolveAttachmentTextBounds, assertJobRegistrable, attachmentRecordOfRow, attachmentTextJob, enqueueAttachmentText, ATTACHMENT_TEXT_BACKFILL_JOB, ATTACHMENT_TEXT_JOB, kernelJobFor, queueAttachmentTextBackfill, startAttachmentTextBackfill, attachmentTextBackfillJob, reconcileAttachmentText, recordAttachmentText, searchAttachments, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, emptyImportResult, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, exportedSinceQuery, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, assertPromoteReviewCurrent, promoteRaceRefusal, rebindRaceRefusal, SERVES_NOW_CONDITION, SERVES_NOW_PREDICATE, servesNowParams, bindExportBreaksOf, bindExportBreakRefusal, scopeMoveOf, runningVersionOf, isPrimaryScope, PROVISIONED_VERSIONS_SQL, installsReconciledOf, strandJudgmentsOf, provisionedVersionsParams, boundShapesColumn, boundShapesOfColumn, installReconciled, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, JOB_RUN_DUE_AT, jobRunListLimit, jobRunOf, runDueJobRuns, startJobRun, IDEMPOTENCY_DDL, REFUSALS_TABLE_DDL, REFUSALS_INDEX, refusalInsert, refusalOf, markGuardRefusal, REFUSALS_REBUILD, refusalsAdmitGuards, assertIdempotencyKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, globalFetch, createUlid, facetEvents, readHistory, walkEventCause, walkEventEffects, assertRedrainWindow, readInvocation, readDeadLetters, readLifecycleFlow, readOperationSeries, domainEventOf, readUndrainedOutbox, undrainedEventsOf, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, unknownRoleError, callReservedStoreOperation, callScopeStore, observeStoreCall, replayStoreErasures, scopeStoreLifecycleOf, scopeStoreRunnersOf, } from '@substrat-run/kernel';
6
6
  import { attributedView, delegatedRevokeSql, writeExplicitTupleIn, grantEntityShapeIn, shapeTopUpBatch, topUpEntityGrantShapes, settlePlatformRequestIn, } from '@substrat-run/kernel';
7
7
  import { ADMIN_LOG_INDEXES_SQL, SETTLE_INTENT_SQL, SETTLE_OUTCOME_SQL, settleOutcomeParamsOf, readAuditedOperations, unknownOutcomeOf, } from '@substrat-run/kernel';
8
8
  import { INERT_SCOPE_REASON, isPrimaryScopeRow, normalizeUploadMediaType } from '@substrat-run/kernel';
@@ -629,6 +629,10 @@ export class SqliteScopeHost {
629
629
  tenantStoreDbs = new Map();
630
630
  operations = new Map();
631
631
  modules = new Map();
632
+ /** #2430: what a registered module declares `holder: 'system'` — the role doors' refusal reads it. */
633
+ reservedKeys = new Set();
634
+ /** #2430: the declared permission surface `registerModule` holds each module to, when given. */
635
+ permissions;
632
636
  /** #1705: what this deployment exports to other verticals and imports from them. */
633
637
  crossVertical = new CrossVerticalRegistry();
634
638
  /** operation name → guards declared before it, in registration order (K-17). */
@@ -742,6 +746,10 @@ export class SqliteScopeHost {
742
746
  this.clock = options.clock ?? (() => instant.parse(new Date().toISOString()));
743
747
  this.versionId = options.versionId ?? null;
744
748
  this.migrationsDigest = options.migrationsDigest;
749
+ this.permissions = options.permissions;
750
+ // #2430: what the declared surface reserves holds here too, whatever is registered under its ids.
751
+ for (const m of options.permissions?.modules ?? [])
752
+ noteReservedKeys(this.reservedKeys, m.manifest);
745
753
  this.scopeStoreVertical = options.scopeStores?.vertical;
746
754
  this.scopeStoreRunners = scopeStoreRunnersOf(options.scopeStores);
747
755
  this.scopeStoreLifecycle = scopeStoreLifecycleOf(this.scopeStoreRunners);
@@ -1626,6 +1634,7 @@ export class SqliteScopeHost {
1626
1634
  if (this.modules.has(manifest.id)) {
1627
1635
  throw new Error(`module already registered: ${manifest.id}`);
1628
1636
  }
1637
+ assertModuleDeclared(this.permissions, manifest.id); // #2430
1629
1638
  // #1835: the operations are the binder's own value, or the maps beside the handlers are a
1630
1639
  // copy nothing bound to them.
1631
1640
  assertBoundOperations(manifest.id, registration.operations);
@@ -1733,6 +1742,7 @@ export class SqliteScopeHost {
1733
1742
  peers: manifest.peers ?? [],
1734
1743
  purgeOnlyKeys: purgeOnlyKeysOf(manifest.schedules ?? []),
1735
1744
  });
1745
+ noteReservedKeys(this.reservedKeys, manifest);
1736
1746
  if (erasure)
1737
1747
  this.erasurePlans.push(erasure);
1738
1748
  for (const rel of manifest.entityRelations ?? []) {
@@ -3138,15 +3148,17 @@ export class SqliteScopeHost {
3138
3148
  await this.applyPendingMigrations(rt);
3139
3149
  return this.buildStub(tenantId, scopeId, rt, asPrincipal(record.principal), options, record.id);
3140
3150
  }
3141
- async getSystemScope(moduleId, tenantId, scopeId) {
3142
- return this.openSystemScope(moduleId, tenantId, scopeId, false);
3151
+ async getSystemScope(moduleId, tenantId, scopeId,
3152
+ /** #2431: observers, as `getScope` takes them — `runDueSchedules` counts its fires' requests through them. */
3153
+ options) {
3154
+ return this.openSystemScope(moduleId, tenantId, scopeId, false, options);
3143
3155
  }
3144
3156
  /**
3145
3157
  * The system door's stub. `purge` (#119) is set only by `runPurgeSweep`, which never hands the
3146
3158
  * stub on: it is the one stub whose invokes may use the module's purge-only keys, and only on
3147
3159
  * the purge operation. Every stub any caller can get is built with it off.
3148
3160
  */
3149
- async openSystemScope(moduleId, tenantId, scopeId, purge) {
3161
+ async openSystemScope(moduleId, tenantId, scopeId, purge, options) {
3150
3162
  // The scheduler's door (#383) — mirror of getConnectorScope. The module must be
3151
3163
  // registered on this host (a schedule can only invoke its own vertical's ops),
3152
3164
  // and the scope must be active. Authority is then an ordinary check against
@@ -3165,7 +3177,7 @@ export class SqliteScopeHost {
3165
3177
  throw substratError('conflict', refusal, { reason: SCOPE_GATE_REASONS.notActive });
3166
3178
  const rt = this.runtime(tenantId, scopeId);
3167
3179
  await this.applyPendingMigrations(rt);
3168
- return this.buildStub(tenantId, scopeId, rt, { kind: 'system', id: moduleId }, undefined, undefined, purge);
3180
+ return this.buildStub(tenantId, scopeId, rt, { kind: 'system', id: moduleId }, options, undefined, purge);
3169
3181
  }
3170
3182
  /**
3171
3183
  * #1705: the producer's release, decided by THIS deployment's own declarations. The admin
@@ -3619,13 +3631,19 @@ export class SqliteScopeHost {
3619
3631
  async canAssign(tenantId, scopeId, principal, roleKey) {
3620
3632
  const rt = await this.openActiveScope(tenantId, scopeId);
3621
3633
  const subject = asPrincipal(principalId.parse(principal));
3622
- return rt.actor.enqueue(() => this.assignmentBound(subject, tenantId, scopeId, roleKey));
3634
+ return rt.actor.enqueue(() => {
3635
+ // #2430: the answer a person's door would give — a role carrying a reserved key is refused.
3636
+ this.refuseReservedRole(tenantId, roleKey, 'person');
3637
+ return this.assignmentBound(subject, tenantId, scopeId, roleKey);
3638
+ });
3623
3639
  }
3624
3640
  async assignScopeRoleBounded(tenantId, scopeId, caller, assignee, roleKey) {
3625
3641
  const rt = await this.openActiveScope(tenantId, scopeId);
3626
3642
  const subject = asPrincipal(principalId.parse(caller));
3627
3643
  const target = principalId.parse(assignee);
3628
3644
  return rt.actor.turn(async () => {
3645
+ // #2430: read in the same serialized task as the bound and the grant.
3646
+ this.refuseReservedRole(tenantId, roleKey, 'person');
3629
3647
  const bound = await this.assignmentBound(subject, tenantId, scopeId, roleKey);
3630
3648
  if (bound.covered)
3631
3649
  applyScopeRoleChange(switchSqlOf(rt.db), scopeId, target, { revoke: [], grant: roleKey }, this.clock());
@@ -3640,7 +3658,12 @@ export class SqliteScopeHost {
3640
3658
  async changeScopeRoleBounded(tenantId, scopeId, caller, principal, from, to) {
3641
3659
  const rt = await this.openActiveScope(tenantId, scopeId);
3642
3660
  const target = principalId.parse(principal);
3643
- const answer = await rt.actor.turn(() => changeScopeRole(switchSqlOf(rt.db), scopeId, target, from, to, this.clock(), this.roleBound(caller, tenantId, scopeId), (run) => rt.db.transaction(run)()));
3661
+ const answer = await rt.actor.turn(() => {
3662
+ // #2430: the role moved TO is conferred by a person; the one moved from is only taken back.
3663
+ // Read in the same serialized task as the bound and the write.
3664
+ this.refuseReservedRole(tenantId, to, 'person');
3665
+ return changeScopeRole(switchSqlOf(rt.db), scopeId, target, from, to, this.clock(), this.roleBound(caller, tenantId, scopeId), (run) => rt.db.transaction(run)());
3666
+ });
3644
3667
  if (answer === 'not-held')
3645
3668
  throw substratError('conflict', `${target} does not hold '${from}' at this scope`);
3646
3669
  if (answer === 'unknown-to')
@@ -3743,6 +3766,23 @@ export class SqliteScopeHost {
3743
3766
  const checker = this.checker;
3744
3767
  return checker.holdings ? (principal) => checker.holdings(asPrincipal(principal), { tenantId, scopeId }) : undefined;
3745
3768
  }
3769
+ /**
3770
+ * #2430: refuse conferring `roleKey` through `door` when the tenant's role carries a key a module
3771
+ * registered here reserves (`reservedRoleRefusal`). A role the tenant does not define is left to
3772
+ * the door's own answer for it.
3773
+ */
3774
+ refuseReservedRole(tenantId, roleKey, door) {
3775
+ const role = this.roles.get(`${tenantId}/${roleKey}`);
3776
+ const refusal = role ? reservedRoleRefusal(role, this.reservedKeys, door) : null;
3777
+ if (refusal)
3778
+ throw substratError('forbidden', refusal);
3779
+ }
3780
+ /** #2430: refuse a raw grant of a key a module registered here reserves (`reservedGrantRefusal`). */
3781
+ refuseReservedGrant(permissions) {
3782
+ const refusal = reservedGrantRefusal(permissions, this.reservedKeys);
3783
+ if (refusal)
3784
+ throw substratError('forbidden', refusal);
3785
+ }
3746
3786
  /** The caller's bound per role at the scope, `null` for a role this tenant does not define (#1150). */
3747
3787
  roleBound(caller, tenantId, scopeId) {
3748
3788
  const subject = asPrincipal(principalId.parse(caller));
@@ -3936,6 +3976,11 @@ export class SqliteScopeHost {
3936
3976
  // for what the same two columns mean there.
3937
3977
  const now = Date.parse(nowIso);
3938
3978
  const lines = asyncLinePass(this.invocationLineSink);
3979
+ // #2431: what the fires below report through `onPlatformRequests` — the callback an HTTP
3980
+ // harness uses to flag the router kick (#458) — so the sweep that ran this pass can drain the
3981
+ // scope at once. `ScheduleRunReport.platformRequests` says what that does and does not count.
3982
+ let platformRequests = 0;
3983
+ const counted = { onPlatformRequests: (n) => (platformRequests += n) };
3939
3984
  for (const schedule of mod.schedules) {
3940
3985
  const lastRunAt = gate.lastRuns.get(schedule.operation) ?? null;
3941
3986
  const lastRun = lastRunAt ? Date.parse(lastRunAt) : null;
@@ -3962,6 +4007,7 @@ export class SqliteScopeHost {
3962
4007
  if (schedule.purge) {
3963
4008
  // #119: a purge horizon's schedule runs its operation once per due entity, never once.
3964
4009
  // #2192: under the run's own id, so the purges and their deliveries join this run's line.
4010
+ // #2431: what the purges enqueue is not counted (`ScheduleRunReport.platformRequests`).
3965
4011
  const pass = await this.runPurgeSweep(moduleId, tenantId, scopeId, schedule.operation, invocationId);
3966
4012
  stillDue = purgeStillDue(pass);
3967
4013
  const outcome = purgeReportOf(schedule.operation, schedule.purge.entityType, pass);
@@ -3970,7 +4016,7 @@ export class SqliteScopeHost {
3970
4016
  throw outcome.failure;
3971
4017
  }
3972
4018
  else {
3973
- const stub = await this.getSystemScope(moduleId, tenantId, scopeId);
4019
+ const stub = await this.getSystemScope(moduleId, tenantId, scopeId, counted);
3974
4020
  await stub.invoke(schedule.operation, schedule.input, { invocationId, onEmitted: (r) => (emitted = r) });
3975
4021
  }
3976
4022
  report.fired += 1;
@@ -4023,6 +4069,8 @@ export class SqliteScopeHost {
4023
4069
  .run(schedule.operation, new Date(now).toISOString(), status, invocationId));
4024
4070
  }
4025
4071
  lines.end();
4072
+ if (platformRequests > 0)
4073
+ report.platformRequests = platformRequests;
4026
4074
  return report;
4027
4075
  }
4028
4076
  /**
@@ -6228,6 +6276,8 @@ export class SqliteScopeHost {
6228
6276
  }));
6229
6277
  },
6230
6278
  assignRole: async (actor, assignment) => {
6279
+ // #2430: the platform's door — a role mixing reserved and other keys is refused (K-55).
6280
+ this.refuseReservedRole(assignment.node.tenantId, assignment.roleKey, 'platform');
6231
6281
  const subject = `principal:${assignment.principalId}`;
6232
6282
  if (assignment.node.scopeId) {
6233
6283
  const scopeNode = assignment.node.scopeId;
@@ -6264,12 +6314,14 @@ export class SqliteScopeHost {
6264
6314
  // trust: the parse is where an `expiresAt` carrying a UTC offset is normalised
6265
6315
  // to Z text (#963), and liveness here is a lexicographic `expires_at > ?`.
6266
6316
  const grant = capabilityGrant.parse(raw);
6317
+ this.refuseReservedGrant([grant.permission]); // #2430
6267
6318
  await onNode(grant.node, () => writeGrant(`principal:${grant.principalId}`, grant.permission, grant.node, grant.entity, grant.expiresAt));
6268
6319
  this.recordAdmin(actor, 'grant', { tenantId: grant.node.tenantId, scopeId: grant.node.scopeId }, null, grant);
6269
6320
  },
6270
6321
  grantEntityShape: async (actor, grant) => {
6271
6322
  const { tenantId, scopeId } = grant.node;
6272
6323
  this.assertScope(tenantId, scopeId);
6324
+ this.refuseReservedGrant(grant.permissions); // #2430
6273
6325
  const rt = this.runtime(tenantId, scopeId);
6274
6326
  // One unit on the scope actor (#1678): the marker and its keys land together or not at all.
6275
6327
  await rt.actor.turn(() => rt.db.transaction(() => grantEntityShapeIn(switchSqlOf(rt.db), grant.principalId, grant.entity, grant.permissions))());
@@ -6279,6 +6331,10 @@ export class SqliteScopeHost {
6279
6331
  const limit = shapeTopUpBatch(opts?.batch);
6280
6332
  const { tenantId, scopeId } = node;
6281
6333
  this.assertScope(tenantId, scopeId);
6334
+ // #2430: before any pass, so a refused registry tops nobody up and records no binding.
6335
+ const reserved = reservedShapeRefusal(shapes, this.reservedKeys);
6336
+ if (reserved)
6337
+ throw substratError('forbidden', reserved);
6282
6338
  const rt = this.runtime(tenantId, scopeId);
6283
6339
  let toppedUp = 0;
6284
6340
  let retired = 0;
@@ -6336,6 +6392,10 @@ export class SqliteScopeHost {
6336
6392
  }
6337
6393
  return conn;
6338
6394
  };
6395
+ // #2430: a connection acts for the external provider holding its token, so it is never
6396
+ // given a key reserved to a system principal — refused before the tuple and the directory
6397
+ // row, so a refused grant is gathered by no later provision. A grant recorded before stays.
6398
+ this.refuseReservedGrant([grant.permission]);
6339
6399
  // Once BEFORE the turn, so a refused grant never opens (and so creates) the scope's
6340
6400
  // file; then again inside it, with the tuple and the directory row, in ONE body on
6341
6401
  // the scope actor (#1678) — so the tuple cannot roll back with a stranger's
@@ -6488,6 +6548,7 @@ export class SqliteScopeHost {
6488
6548
  // Checked once before the turn, so a refusal opens no scope file; then again with
6489
6549
  // the write in one body, on the scope actor when the node is a scope (#1678).
6490
6550
  requireOrg(node.tenantId, orgId);
6551
+ this.refuseReservedGrant([permission]); // #2430: an org's members are people
6491
6552
  await onNode(node, () => {
6492
6553
  requireOrg(node.tenantId, orgId);
6493
6554
  writeGrant(`org:${orgId}`, permission, node, entity);
@@ -7817,6 +7878,10 @@ export class SqliteScopeHost {
7817
7878
  const role = directoryReader.getRole(tenantId, roleKey);
7818
7879
  if (!role)
7819
7880
  return { applied: false, unknownRole: roleKey };
7881
+ // #2430: an add is a person conferring a role on a person (a removal only takes one back).
7882
+ const reserved = change.op === 'add' ? reservedRoleRefusal(role, this.reservedKeys, 'person') : null;
7883
+ if (reserved)
7884
+ return { applied: false, reserved };
7820
7885
  const bound = tenantCoverage(directoryReader, tenantId, boundedBy, role.permissions);
7821
7886
  if (!bound.covered)
7822
7887
  return { applied: false, missing: bound.missing };
@@ -10162,7 +10227,11 @@ export class SqliteScopeHost {
10162
10227
  return decision;
10163
10228
  }
10164
10229
  : decideCheck;
10165
- const runCanAssign = (roleKey) => this.assignmentBound(subject, rt.tenantId, rt.scopeId, roleKey);
10230
+ // #2430: the answer a person's door would give — a role carrying a reserved key is refused.
10231
+ const runCanAssign = async (roleKey) => {
10232
+ this.refuseReservedRole(rt.tenantId, roleKey, 'person');
10233
+ return this.assignmentBound(subject, rt.tenantId, rt.scopeId, roleKey);
10234
+ };
10166
10235
  // ctx.emit's writer, and the kernel's own events' (#1864): one path to the outbox, with the
10167
10236
  // reserved-type refusal applied to module code only. Never handed to module code as-is.
10168
10237
  const writeEvent = (event, author) => {
@@ -10367,6 +10436,8 @@ export class SqliteScopeHost {
10367
10436
  grant: async (principal, permission, entity) => {
10368
10437
  assertImpersonationWrites(impersonation, 'ctx.grant');
10369
10438
  entityObjectRef(entity, 'ctx.grant'); // #1856: a tuple the walk can read back
10439
+ // #2430: whoever the caller is — a system actor passes guardrail 2 by construction.
10440
+ this.refuseReservedGrant([permission]);
10370
10441
  const held = await runCheck(permission, entity);
10371
10442
  if (!held.allowed) {
10372
10443
  throw new PermissionDenied(`cannot grant '${permission}' on ${entity.entityType}:${entity.entityId} — ` +