@substrat-run/contract-tests 0.141.0 → 0.143.0

package/dist/shape-reconcile-plan.d.ts

@@ -0,0 +1,23 @@
+import { type SwitchSql } from '@substrat-run/kernel';
+interface ShapeReconcilePlanReport {
+    /** The plan of each marker walk the passes sent (one per retire and top-up walk). */
+    walks: string[];
+    /** The plan of each grantee backfill read. */
+    backfills: string[];
+    /** Every planned table scan of `_substrat_tuples`, with the statement that planned it. */
+    scans: string[];
+    /** Passes the reconcile took, and whether every holder ended up with the whole shape. */
+    passes: number;
+    complete: boolean;
+}
+/**
+ * Seed one shape's world on `raw` — holders of the old shape, legacy grantees with no marker, a
+ * retired key, and another type's markers beside them — then reconcile it in small passes, each
+ * resuming from the last, planning every statement. Run it on a scope nothing else is writing.
+ */
+export declare function shapeReconcilePlans(raw: SwitchSql, ids: {
+    tenantId: string;
+    scopeId: string;
+}): ShapeReconcilePlanReport;
+export {};
+//# sourceMappingURL=shape-reconcile-plan.d.ts.map

package/dist/shape-reconcile-plan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shape-reconcile-plan.d.ts","sourceRoot":"","sources":["../src/shape-reconcile-plan.ts"],"names":[],"mappings":"AAeA,OAAO,EAAkD,KAAK,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAItG,UAAU,wBAAwB;IAChC,qFAAqF;IACrF,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,8CAA8C;IAC9C,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,0FAA0F;IAC1F,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,yFAAyF;IACzF,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;CACnB;AAOD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,wBAAwB,CA2DxH"}

package/dist/shape-reconcile-plan.js

@@ -0,0 +1,87 @@
+/**
+ * The shape reconcile's reads, planned by the SQLite each adapter actually runs (#2083).
+ *
+ * A pass walks a shape's markers on `_substrat_tuples_shape_marker`, a partial index SQLite uses
+ * only where it can prove the index's `relation = 'bootstrap'` from the query. A relation term it
+ * cannot prove that from, or an object prefix written as `substr`, plans a scan of the whole tuple
+ * table, which no functional test notices, because a test scope has a dozen rows. So the probe here drives the kernel's own
+ * pass over a scope's real schema and asks the engine to plan every statement the pass sends,
+ * exactly as sent. Pure, with no runner: each adapter hands it its scope's own SQLite as the
+ * kernel's `SwitchSql` (over a `better-sqlite3` file, a Durable Object's `storage.sql`) and
+ * asserts on the report.
+ *
+ * Harness code: it writes `_substrat_*` rows directly, which is exactly what `ctx.sql` refuses.
+ */
+import { entityGrantShape } from '@substrat-run/contracts';
+import { topUpEntityGrantShapes, ulid } from '@substrat-run/kernel';
+const MARKERS = 30;
+const LEGACY = 5;
+const KEYS = ['shape-plan:read', 'shape-plan:use'];
+const RETIRED = 'shape-plan:old';
+/**
+ * Seed one shape's world on `raw` — holders of the old shape, legacy grantees with no marker, a
+ * retired key, and another type's markers beside them — then reconcile it in small passes, each
+ * resuming from the last, planning every statement. Run it on a scope nothing else is writing.
+ */
+export function shapeReconcilePlans(raw, ids) {
+    const tuple = (subject, relation, object) => raw.run('INSERT OR REPLACE INTO _substrat_tuples (subject, relation, object) VALUES (?, ?, ?)', subject, relation, object);
+    const pad = (i) => String(i).padStart(3, '0');
+    for (let i = 0; i < MARKERS; i++) {
+        const [who, desk] = [`principal:${ulid()}`, `desk:d${pad(i)}`];
+        tuple(who, 'bootstrap', desk);
+        tuple(who, `granted:${KEYS[0]}`, desk);
+        if (i % 3 === 0)
+            tuple(who, `granted:${RETIRED}`, desk);
+        tuple(who, 'bootstrap', `room:d${pad(i)}`); // another type's marker: never read by this shape
+    }
+    for (let i = 0; i < LEGACY; i++)
+        tuple(`principal:${ulid()}`, `granted:${KEYS[0]}`, `desk:l${pad(i)}`);
+    const walks = [];
+    const backfills = [];
+    const scans = [];
+    const plan = (sql, params) => {
+        if (!/^\s*(SELECT|UPDATE|DELETE)/i.test(sql))
+            return;
+        const detail = raw.all(`EXPLAIN QUERY PLAN ${sql}`, ...params).map((r) => String(r['detail']));
+        const joined = detail.join(' | ');
+        if (sql.includes('(m.object, m.subject) > (?, ?)'))
+            walks.push(joined);
+        if (sql.includes('SELECT DISTINCT t.subject, t.object'))
+            backfills.push(joined);
+        // A virtual table (`json_each`) is scanned by design; a scan of the tuple table never is.
+        for (const d of detail)
+            if (/^SCAN /.test(d) && !/VIRTUAL TABLE/.test(d))
+                scans.push(`${d} — ${sql.replace(/\s+/g, ' ').slice(0, 160)}`);
+    };
+    const sql = {
+        all: (q, ...p) => {
+            plan(q, p);
+            return raw.all(q, ...p);
+        },
+        run: (q, ...p) => {
+            plan(q, p);
+            raw.run(q, ...p);
+        },
+    };
+    const shapes = [entityGrantShape.parse({ entityType: 'desk', permissions: KEYS, retired: [RETIRED], bootstrap: true, holder: 'grantee' })];
+    let after = null;
+    let passes = 0;
+    do {
+        after = topUpEntityGrantShapes(sql, {
+            ...ids,
+            shapes,
+            now: new Date().toISOString(),
+            limit: 4,
+            after,
+            mintEventId: () => ulid(),
+            version: null,
+        }).next;
+        passes++;
+    } while (after && passes < 100);
+    const short = raw.all(`SELECT count(*) AS n FROM _substrat_tuples m
+      WHERE m.relation = 'bootstrap' AND m.object >= 'desk:' AND m.object < 'desk;'
+        AND NOT EXISTS (SELECT 1 FROM _substrat_tuples t WHERE t.subject = m.subject AND t.object = m.object
+                         AND t.relation = 'granted:${KEYS[1]}' AND t.revoked_at IS NULL)`)[0]['n'];
+    return { walks, backfills, scans, passes, complete: after === null && Number(short) === 0 };
+}
+//# sourceMappingURL=shape-reconcile-plan.js.map

package/dist/shape-reconcile-plan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shape-reconcile-plan.js","sourceRoot":"","sources":["../src/shape-reconcile-plan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,IAAI,EAAoC,MAAM,sBAAsB,CAAC;AAgBtG,MAAM,OAAO,GAAG,EAAE,CAAC;AACnB,MAAM,MAAM,GAAG,CAAC,CAAC;AACjB,MAAM,IAAI,GAAG,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,CAAC;AACnD,MAAM,OAAO,GAAG,gBAAgB,CAAC;AAEjC;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAc,EAAE,GAA0C;IAC5F,MAAM,KAAK,GAAG,CAAC,OAAe,EAAE,QAAgB,EAAE,MAAc,EAAE,EAAE,CAClE,GAAG,CAAC,GAAG,CAAC,sFAAsF,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC7H,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACtD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,EAAE,EAAE,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/D,KAAK,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;QAC9B,KAAK,CAAC,GAAG,EAAE,WAAW,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,KAAK,CAAC,GAAG,EAAE,WAAW,OAAO,EAAE,EAAE,IAAI,CAAC,CAAC;QACxD,KAAK,CAAC,GAAG,EAAE,WAAW,EAAE,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,kDAAkD;IAChG,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE;QAAE,KAAK,CAAC,aAAa,IAAI,EAAE,EAAE,EAAE,WAAW,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAEvG,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,MAAwB,EAAE,EAAE;QACrD,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO;QACrD,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,sBAAsB,GAAG,EAAE,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC/F,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,GAAG,CAAC,QAAQ,CAAC,gCAAgC,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvE,IAAI,GAAG,CAAC,QAAQ,CAAC,qCAAqC,CAAC;YAAE,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAChF,0FAA0F;QAC1F,KAAK,MAAM,CAAC,IAAI,MAAM;YAAE,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC3I,CAAC,CAAC;IACF,MAAM,GAAG,GAAc;QACrB,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE;YACf,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACX,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC1B,CAAC;QACD,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE;YACf,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACX,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACnB,CAAC;KACF,CAAC;IAEF,MAAM,MAAM,GAAG,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IAC3I,IAAI,KAAK,GAAuB,IAAI,CAAC;IACrC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,GAAG,CAAC;QACF,KAAK,GAAG,sBAAsB,CAAC,GAAG,EAAE;YAClC,GAAG,GAAG;YACN,MAAM;YACN,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC7B,KAAK,EAAE,CAAC;YACR,KAAK;YACL,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE;YACzB,OAAO,EAAE,IAAI;SACd,CAAC,CAAC,IAAI,CAAC;QACR,MAAM,EAAE,CAAC;IACX,CAAC,QAAQ,KAAK,IAAI,MAAM,GAAG,GAAG,EAAE;IAEhC,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CACnB;;;qDAGiD,IAAI,CAAC,CAAC,CAAC,6BAA6B,CACtF,CAAC,CAAC,CAAE,CAAC,GAAG,CAAC,CAAC;IACX,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,KAAK,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;AAC9F,CAAC"}

package/dist/test-operations.d.ts

@@ -0,0 +1,25 @@
+import { type BoundOperations, type HandlerMap } from '@substrat-run/kernel';
+/** The maps a registration derives from a declaration, as a fixture may hand them over raw. */
+export interface RawDerivedMaps {
+    inputs?: BoundOperations['inputs'];
+    concurrency?: BoundOperations['concurrency'];
+    idempotencyOptOuts?: BoundOperations['idempotencyOptOuts'];
+}
+/**
+ * A fixture's operations, registered without binding them to a declaration (#1835) — the TEST
+ * SEAM around `operationsFor`, and the only one.
+ *
+ * The suites drive the host with modules built for one assertion each, so most have no declared
+ * surface: `testOperations(handlers)` is `undeclaredOperations` with the reason stated once.
+ *
+ * A few prove what the HOST refuses when the derived maps are wrong — a schema or a precondition
+ * naming an unbound operation, an `inputs` map that is not the one `operationInputsOf`
+ * returned, a forged trash surface — or need maps over handlers whose types they erase on
+ * purpose. Those pass `derived`, and get a `BoundOperations` no binder made, through the kernel's
+ * `./testing` subpath — the value a module cannot build, and boundary-lint R2 refuses that import,
+ * and this package's, from module code.
+ */
+export declare function testOperations(handlers: HandlerMap, derived?: RawDerivedMaps): {
+    operations: BoundOperations;
+};
+//# sourceMappingURL=test-operations.d.ts.map

package/dist/test-operations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-operations.d.ts","sourceRoot":"","sources":["../src/test-operations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,KAAK,eAAe,EAAE,KAAK,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAGnG,+FAA+F;AAC/F,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAC;IACnC,WAAW,CAAC,EAAE,eAAe,CAAC,aAAa,CAAC,CAAC;IAC7C,kBAAkB,CAAC,EAAE,eAAe,CAAC,oBAAoB,CAAC,CAAC;CAC5D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG;IAAE,UAAU,EAAE,eAAe,CAAA;CAAE,CAG9G"}

package/dist/test-operations.js

@@ -0,0 +1,22 @@
+import { undeclaredOperations } from '@substrat-run/kernel';
+import { forgeBoundOperationsForTest } from '@substrat-run/kernel/testing';
+/**
+ * A fixture's operations, registered without binding them to a declaration (#1835) — the TEST
+ * SEAM around `operationsFor`, and the only one.
+ *
+ * The suites drive the host with modules built for one assertion each, so most have no declared
+ * surface: `testOperations(handlers)` is `undeclaredOperations` with the reason stated once.
+ *
+ * A few prove what the HOST refuses when the derived maps are wrong — a schema or a precondition
+ * naming an unbound operation, an `inputs` map that is not the one `operationInputsOf`
+ * returned, a forged trash surface — or need maps over handlers whose types they erase on
+ * purpose. Those pass `derived`, and get a `BoundOperations` no binder made, through the kernel's
+ * `./testing` subpath — the value a module cannot build, and boundary-lint R2 refuses that import,
+ * and this package's, from module code.
+ */
+export function testOperations(handlers, derived) {
+    if (!derived)
+        return undeclaredOperations('a contract-test fixture, built to drive the host rather than declared', handlers);
+    return { operations: forgeBoundOperationsForTest(handlers, derived) };
+}
+//# sourceMappingURL=test-operations.js.map

package/dist/test-operations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-operations.js","sourceRoot":"","sources":["../src/test-operations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAyC,MAAM,sBAAsB,CAAC;AACnG,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAS3E;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,cAAc,CAAC,QAAoB,EAAE,OAAwB;IAC3E,IAAI,CAAC,OAAO;QAAE,OAAO,oBAAoB,CAAC,uEAAuE,EAAE,QAAQ,CAAC,CAAC;IAC7H,OAAO,EAAE,UAAU,EAAE,2BAA2B,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;AACxE,CAAC"}

package/dist/vertical-events-suite.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vertical-events-suite.d.ts","sourceRoot":"","sources":["../src/vertical-events-suite.ts"],"names":[],"mappings":"AACA,OAAO,EASL,CAAC,EAED,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EAGtB,KAAK,OAAO,EACZ,KAAK,QAAQ,EACd,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAML,KAAK,kBAAkB,EAEvB,KAAK,kBAAkB,EAGvB,KAAK,SAAS,EAEf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAA4D,KAAK,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAcvH,eAAO,MAAM,YAAY,aAAa,CAAC;AACvC,eAAO,MAAM,cAAc,eAAe,CAAC;AAI3C,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiC/B,CAAC;AAiFH,eAAO,MAAM,YAAY,EAAE,kBAuC1B,CAAC;AAEF,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2BjC,CAAC;AAkCH,eAAO,MAAM,cAAc,EAAE,kBAgD5B,CAAC;AAIF;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,SAAS,CAAC;IACpB,QAAQ,EAAE,SAAS,CAAC;IACpB,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,IAAI,CAAC,kBAAkB,EAAE,YAAY,CAAC,CAAC;IACnD;;;;OAIG;IACH,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzF;;;;OAIG;IACH,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACrG;;;OAGG;IACH,IAAI,CAAC,EAAE,CACL,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,KACb,OAAO,CAAC,SAAS;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE;YAAE,MAAM,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI,CAAA;KAAE,EAAE,CAAC,CAAC;IACtG;;;;OAIG;IACH,eAAe,CAAC,EAAE,aAAa,CAAC,iBAAiB,CAAC,CAAC;CACpD;AAID;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,2BAA2B,CACzC,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,GAChD,IAAI,CA+1CN"}
+{"version":3,"file":"vertical-events-suite.d.ts","sourceRoot":"","sources":["../src/vertical-events-suite.ts"],"names":[],"mappings":"AACA,OAAO,EASL,CAAC,EAED,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EAGtB,KAAK,OAAO,EACZ,KAAK,QAAQ,EACd,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAOL,KAAK,kBAAkB,EAEvB,KAAK,kBAAkB,EAGvB,KAAK,SAAS,EAEf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAA4D,KAAK,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAevH,eAAO,MAAM,YAAY,aAAa,CAAC;AACvC,eAAO,MAAM,cAAc,eAAe,CAAC;AAI3C,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiC/B,CAAC;AAiFH,eAAO,MAAM,YAAY,EAAE,kBAuC1B,CAAC;AAEF,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8BjC,CAAC;AAgDH,eAAO,MAAM,cAAc,EAAE,kBA0D5B,CAAC;AAIF;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,SAAS,CAAC;IACpB,QAAQ,EAAE,SAAS,CAAC;IACpB,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,IAAI,CAAC,kBAAkB,EAAE,YAAY,CAAC,CAAC;IACnD;;;;OAIG;IACH,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzF;;;;OAIG;IACH,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACrG;;;OAGG;IACH,IAAI,CAAC,EAAE,CACL,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,KACb,OAAO,CAAC,SAAS;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE;YAAE,MAAM,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI,CAAA;KAAE,EAAE,CAAC,CAAC;IACtG;;;;OAIG;IACH,eAAe,CAAC,EAAE,aAAa,CAAC,iBAAiB,CAAC,CAAC;CACpD;AAID;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,2BAA2B,CACzC,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,GAChD,IAAI,CA24CN"}

package/dist/vertical-events-suite.js

@@ -1,7 +1,8 @@
 import { describe, it, expect, beforeAll, afterAll, beforeEach } from 'vitest';
 import { dataSubjectId, eventId, moduleManifest, permissionKey, platformActorId, principalId, scopeId, tenantId, z, } from '@substrat-run/contracts';
-import { assertAllowed, crossVerticalHealth, INERT_SCOPE_REASON, runPlatformSweep, ulid, } from '@substrat-run/kernel';
+import { assertAllowed, crossVerticalHealth, INERT_SCOPE_REASON, REDACTED_DELIVERY_NOTE, runPlatformSweep, ulid, } from '@substrat-run/kernel';
 import { expectAnswered, expectSettledUnknown, withRefusedOutcome } from './switch-audit-fault.js';
+import { testOperations } from './test-operations.js';
 // -- the two fixture verticals ------------------------------------------------
 //
 // Named as the verticals of one tenant would be: a CRM that owns customers, and a board-room
@@ -127,13 +128,13 @@ const crmFlag = async (ctx, input) => {
 export const crmExportMod = {
     manifest: crmExportModManifest,
     migrations: [{ version: '0001-init', sql: 'CREATE TABLE crm_customers (id TEXT PRIMARY KEY, name TEXT NOT NULL)' }],
-    operations: {
+    ...testOperations({
         'crm/create': crmCreate,
         'crm/note': crmNote,
         'crm/touch': crmTouch,
         'crm/create-then-fail': crmCreateThenFail,
         'crm/flag': crmFlag,
-    },
+    }),
     consumers: {
         // In the invoke's post-commit tail: an exported type committed by a consumer, not the operation.
         'crm.customer-flagged': async (ctx, event) => {
@@ -176,8 +177,11 @@ export const boardImportModManifest = moduleManifest.parse({
         emits: [
             { type: 'board.association-created', schemaVersion: 1 },
             { type: 'board.association-linked', schemaVersion: 1 },
+            // #1757: board's OWN classified event, whose local consumer fails quoting the subject.
+            { type: 'board.member-noted', schemaVersion: 1 },
         ],
         consumes: [
+            { type: 'board.member-noted', schemaVersion: 1 },
             { from: CRM_VERTICAL, type: 'crm.customer-created', schemaVersion: 1 },
             // crm emits this and does not export it. Declaring it must not be enough to receive it.
             { from: CRM_VERTICAL, type: 'crm.customer-noted', schemaVersion: 1 },
@@ -202,9 +206,22 @@ const boardRead = async (ctx) => {
         imports: ctx.sql.query('SELECT event_id, source_vertical, source_scope_id, type, hops, withheld FROM _substrat_imports ORDER BY event_id'),
         deliveries: ctx.sql.query('SELECT event_id, consumer_module, error FROM _substrat_deliveries ORDER BY event_id, consumer_module'),
         outbox: ctx.sql.query('SELECT id, type, caused_by, actor FROM _substrat_outbox ORDER BY id'),
-        replays: ctx.sql.query('SELECT replay_id, kind, event_id, consumer_module FROM _substrat_import_replays ORDER BY kind, event_id'),
+        replays: ctx.sql.query(`SELECT replay_id, kind, event_id, consumer_module, json_extract(row, '$.error') AS error
+         FROM _substrat_import_replays ORDER BY kind, event_id`),
     };
 };
+/** #1757: emits board's own classified event about one subject. */
+const boardNoteMember = async (ctx, input) => {
+    assertAllowed(await ctx.check(key('association:read')));
+    ctx.emit({
+        type: 'board.member-noted',
+        schemaVersion: 1,
+        entity: { entityType: 'member', entityId: input.subjectId },
+        piiClass: 'direct',
+        subjectId: dataSubjectId.parse(input.subjectId),
+        payload: { subjectId: input.subjectId },
+    });
+};
 export const boardImportMod = {
     manifest: boardImportModManifest,
     migrations: [
@@ -216,14 +233,24 @@ export const boardImportMod = {
       `,
         },
     ],
-    operations: { 'board/read': boardRead },
+    ...testOperations({
+        'board/read': boardRead,
+        'board/note-member': boardNoteMember,
+    }),
+    consumers: {
+        // #1757: fails quoting the subject, so its delivery row holds the subject's id as text.
+        'board.member-noted': async (_ctx, event) => {
+            throw new Error(`board cannot note member ${event.subjectId}`);
+        },
+    },
     imports: {
         [CRM_VERTICAL]: {
             'crm.customer-created': async (ctx, event) => {
                 assertAllowed(await ctx.check(key('association:sync')));
                 const c = customerCreated.parse(event.payload);
-                if (c.name === 'poison')
-                    throw new Error('board refuses the poison customer');
+                // The name is quoted, so a handler's own sentence can carry a subject's id (#1757).
+                if (c.name.startsWith('poison'))
+                    throw new Error(`board refuses the poison customer ${c.name}`);
                 ctx.sql.exec(`INSERT INTO board_associations (crm_id, name) VALUES (?, ?)
            ON CONFLICT (crm_id) DO UPDATE SET name = excluded.name`, [c.id, c.name]);
                 ctx.emit({
@@ -742,6 +769,44 @@ export function verticalEventsContractSuite(adapterName, makeFixture) {
             expect(createdFor(first.event_id)).toBe(1);
             expect(createdFor(second.event_id)).toBe(2);
         });
+        // #1757: a replay keeps an import's delivery row in `_substrat_import_replays`, `error`
+        // included. On a released import that text is a handler's own sentence and can name a
+        // subject, but no erasure reaches it, live or moved aside: a released event is piiClass
+        // 'none', so no subject link names its delivery. (A withheld one, a classified one included,
+        // gets a dead letter whose error is the platform's own note, which names no one.) The control is
+        // the scope's OWN classified event, whose failed delivery the same erasure does rewrite.
+        // What is held is that the two copies of an import's delivery agree after an erasure, so a
+        // later erasure that reaches the live row cannot leave the replayed one behind.
+        it('an erasure treats an import\'s moved-aside delivery exactly as its live one (#1757)', async () => {
+            const t = await newTenant();
+            const p = await install(t, CRM_VERTICAL);
+            const c = await install(t, BOARD_VERTICAL);
+            const subject = dataSubjectId.parse(ulid());
+            await create(t, p, `poison ${subject}`);
+            await sweep();
+            await lever(t, c, replay(null));
+            // The redelivery fails again, so the live table and the replay history each hold the text.
+            await sweep();
+            await (await fx.consumer.getScope(reader, t, c)).invoke('board/note-member', { subjectId: subject });
+            const receipt = await fx.consumer.admin.shredSubject(staff, t, c, subject);
+            expect(receipt).toMatchObject({ subjectId: subject, eventsRedacted: 1 });
+            const view = await board(t, c);
+            const [own] = view.outbox.filter((o) => o.type === 'board.member-noted');
+            expect(view.deliveries.find((d) => d.event_id === own.id)?.error).toBe(REDACTED_DELIVERY_NOTE);
+            const [imported] = view.imports;
+            const live = view.deliveries.find((d) => d.event_id === imported.event_id)?.error;
+            const archived = view.replays.find((r) => r.kind === 'delivery' && r.event_id === imported.event_id)?.error;
+            // Both copies exist, so the comparison below cannot pass on two absences.
+            expect(typeof live).toBe('string');
+            expect(typeof archived).toBe('string');
+            expect(archived, '#1757: an erasure changed an imported delivery\'s live error but not its copy in ' +
+                '_substrat_import_replays (or the reverse). Whatever reaches _substrat_deliveries.error for an ' +
+                'imported event must rewrite json_extract(row, \'$.error\') of its kind=\'delivery\' rows too, in ' +
+                'the same transaction, or the replay history keeps what the live table gave up.').toBe(live);
+            // Today no erasure reaches either copy. When one does, this line changes, and the one above
+            // is what holds the replay history to it.
+            expect(live).toContain(subject);
+        });
         it('skip to now: nothing before the skip is delivered, what comes after is, and a replay reaches back', async () => {
             const t = await newTenant();
             const p = await install(t, CRM_VERTICAL);