@substrat-run/contracts 0.136.0 → 0.138.0

package/dist/rate-limit.js

@@ -0,0 +1,248 @@
+/**
+ * Request rate limiting on the request path (#130).
+ *
+ * A tenant must be protected from another tenant, and from its own AI-built frontend with
+ * a polling bug. The limit is enforced where a request first meets the platform: the router
+ * on the hosted path, `@substrat-run/vertical-host`'s `rateLimit()` middleware on a node
+ * host with no router in front. Never in a scope host and never in the kernel: a limiter in
+ * a scope DO serialises behind that scope's write queue, and cannot see one token's
+ * traffic across scopes.
+ *
+ * ## Why the policy lives here
+ *
+ * Both of those choke points derive the same keys, speak the same headers and refuse with
+ * the same problem — through one call, {@link evaluateRateLimits}. This file is that grammar
+ * and nothing else: which counter remembers a key is the caller's ({@link RateLimiter}), so
+ * the router binds Cloudflare's native rate-limit binding and a node host binds
+ * vertical-host's `memoryRateLimiter`, and the two cannot disagree about what a key or a 429
+ * looks like.
+ *
+ * ## The keys
+ *
+ * Every key begins `<tenant>:<scope>:<bucket>:`, so one tenant's traffic can never spend
+ * another tenant's budget. That is a property of the key, not of a configuration.
+ *
+ * - **credential**: one budget per caller. A bearer token when the request carries one, else
+ *   the session cookie a signed-in browser carries, else the client address. A credential is
+ *   only ever represented by a truncated SHA-256 digest: the raw token or cookie is never
+ *   part of a key, so it reaches no counter and no log line.
+ * - **ip**: one budget per client address, set well above the credential budget. The router
+ *   cannot verify a bearer, so without it a caller minting a fresh fake token per request
+ *   would get a fresh credential budget per request too.
+ *
+ * ## The fail mode
+ *
+ * Open. A limiter that throws lets the request through, and the caller logs it. The limiter
+ * protects capacity; it is not an authorization boundary — every request still meets the
+ * vertical's authentication and permission checks — and failing closed would turn an outage
+ * of the counter into an outage of every tenant behind it.
+ */
+import { substratError, toProblem, PROBLEM_CONTENT_TYPE } from './errors.js';
+/** RFC 9110 §10.2.3: seconds a client should wait before trying again. */
+export const RETRY_AFTER_HEADER = 'Retry-After';
+/** The policies a response was judged against (draft-ietf-httpapi-ratelimit-headers). */
+export const RATE_LIMIT_POLICY_HEADER = 'RateLimit-Policy';
+/** The state of the policy that refused (same draft): nothing remaining, and when it resets. */
+export const RATE_LIMIT_HEADER = 'RateLimit';
+/**
+ * Exposed to a cross-origin browser client — the same trap `IDEMPOTENCY_EXPOSED_HEADERS`
+ * documents. An unexposed `Retry-After` is the one that matters: a frontend that cannot
+ * read it cannot back off by it.
+ */
+export const RATE_LIMIT_EXPOSED_HEADERS = [RETRY_AFTER_HEADER, RATE_LIMIT_HEADER, RATE_LIMIT_POLICY_HEADER];
+/** The two buckets every request is counted in. */
+export const RATE_LIMIT_BUCKETS = ['credential', 'ip'];
+/**
+ * The defaults: conservative, so a normal client never meets them. 1200 a minute per
+ * credential is twenty requests a second sustained; the address budget is five times that,
+ * so an office behind one NAT, every person on their own session, stays well clear of it.
+ * A deployment sets its own (the router's `wrangler.jsonc`, a node host's options).
+ */
+export const DEFAULT_RATE_LIMITS = {
+    credential: { limit: 1200, period: 60 },
+    ip: { limit: 6000, period: 60 },
+};
+/**
+ * Read a deployment's configured limits, or `undefined` when they are not a complete,
+ * well-formed set. Strict on purpose: a typo in a limit must be loud (the caller logs and
+ * fails open), never a silently different budget.
+ */
+export function parseRateLimits(value) {
+    if (typeof value !== 'object' || value === null)
+        return undefined;
+    const out = {};
+    for (const bucket of RATE_LIMIT_BUCKETS) {
+        const policy = value[bucket];
+        if (!isPositiveInt(policy?.limit) || !isPositiveInt(policy?.period))
+            return undefined;
+        out[bucket] = { limit: policy.limit, period: policy.period };
+    }
+    return out;
+}
+const isPositiveInt = (n) => Number.isInteger(n) && n > 0;
+/**
+ * The cookies that ARE a signed-in browser's credential: the platform session (oidc-rp's
+ * `sb_session`), a capability session (`sb_capability`, one cookie per link since #1686), and
+ * Better Auth's session token on an instance using that provider. Any other cookie — a
+ * preference, an analytics id — says nothing about who is calling and is ignored.
+ */
+export function isSessionCookie(name) {
+    return (name === 'sb_session' ||
+        name.startsWith('sb_capability') ||
+        name === 'better-auth.session_token' ||
+        name === '__Secure-better-auth.session_token');
+}
+/**
+ * The key one request is counted under in one bucket. Async because a credential is hashed
+ * (Web Crypto) before it goes anywhere — and only when the credential bucket is counted.
+ */
+export async function rateLimitKey(bucket, subject) {
+    const address = subject.clientIp ? `ip:${subject.clientIp}` : 'anon';
+    const caller = bucket === 'credential' ? ((await credentialOf(subject.headers)) ?? address) : address;
+    return `${subject.tenantId}:${subject.scopeId}:${bucket}:${caller}`;
+}
+/**
+ * The caller's credential as a digest: `b:` for a bearer, `s:` for a session cookie set.
+ * Every session cookie the request carries is hashed together, sorted, so a browser holding
+ * a stale host-only `sb_session` beside its domain one is still one caller.
+ */
+async function credentialOf(headers) {
+    const authorization = headers.get('authorization');
+    if (authorization)
+        return `b:${await digest(authorization)}`;
+    const session = sessionCookiesOf(headers.get('cookie'));
+    if (session.length > 0)
+        return `s:${await digest(session.join('\n'))}`;
+    return undefined;
+}
+function sessionCookiesOf(header) {
+    if (!header)
+        return [];
+    const out = [];
+    for (const part of header.split(';')) {
+        const eq = part.indexOf('=');
+        if (eq === -1)
+            continue;
+        const name = part.slice(0, eq).trim();
+        if (isSessionCookie(name))
+            out.push(`${name}=${part.slice(eq + 1).trim()}`);
+    }
+    return out.sort();
+}
+/** 128 bits of SHA-256, hex: unguessable, and short enough to be a counter key. */
+async function digest(text) {
+    const bytes = new Uint8Array(await globalThis.crypto.subtle.digest('SHA-256', new TextEncoder().encode(text)));
+    let hex = '';
+    for (const b of bytes.subarray(0, 16))
+        hex += b.toString(16).padStart(2, '0');
+    return hex;
+}
+/** The order buckets are counted in: the address first (see {@link evaluateRateLimits}). */
+const COUNTING_ORDER = ['ip', 'credential'];
+/**
+ * Count one request in the buckets that have a counter — the whole decision both hosts make.
+ *
+ * The ADDRESS is counted first, and a request it refuses is never counted against a
+ * credential. A credential key is minted from whatever the request sends, so a caller
+ * rotating made-up tokens from one address would otherwise create a fresh credential counter
+ * with every request it was already refused for — unbounded state in a counter that keeps
+ * its keys (the node host's), and spent budget on keys nobody holds. Once the address is
+ * over, the credential bucket is not asked.
+ */
+export async function evaluateRateLimits(input) {
+    // A CORS preflight is never counted, so never refused: a refused preflight is opaque to the
+    // page whatever headers it carries, so the page could not read the 429 its real request
+    // would have met. It reaches the vertical's own preflight handler instead.
+    if (input.subject.method === 'OPTIONS')
+        return { policyHeader: null };
+    const buckets = RATE_LIMIT_BUCKETS.filter((bucket) => input.limiters[bucket]);
+    if (buckets.length === 0)
+        return { policyHeader: null };
+    const results = [];
+    for (const bucket of COUNTING_ORDER) {
+        const limiter = input.limiters[bucket];
+        if (!limiter)
+            continue;
+        try {
+            const key = await rateLimitKey(bucket, input.subject);
+            results.push({ bucket, success: (await limiter.limit({ key })).success });
+        }
+        catch (error) {
+            results.push({ bucket, success: true, error: error instanceof Error ? error.message : String(error) });
+        }
+        if (!results.at(-1).success)
+            break;
+    }
+    const policyHeader = buckets
+        .map((bucket) => `"${bucket}";q=${input.policies[bucket].limit};w=${input.policies[bucket].period}`)
+        .join(', ');
+    const failed = results.filter((r) => r.error !== undefined);
+    const unavailable = failed.length > 0
+        ? {
+            reason: 'the rate limiter threw; the request was let through',
+            buckets: failed.map((r) => r.bucket),
+            error: failed.map((r) => r.error),
+        }
+        : undefined;
+    const refused = results.find((r) => !r.success)?.bucket;
+    return {
+        policyHeader,
+        ...(unavailable ? { unavailable } : {}),
+        ...(refused
+            ? {
+                refusal: refusalFor(refused, input.policies[refused], policyHeader, {
+                    instance: input.instance,
+                    origin: input.subject.headers.get('origin'),
+                }),
+            }
+            : {}),
+    };
+}
+/**
+ * The refusal: 429 `application/problem+json` with code `rate_limited`, and the headers a
+ * client backs off by. Parts rather than a `Response`, as the rest of this package hands out
+ * data: each host builds its own.
+ *
+ * `Retry-After` is the bucket's whole period. A counter that cannot say where in its window
+ * a key sits (Cloudflare's binding cannot) makes the period the only bound that is never
+ * too short, and a retry that is too early is just another 429.
+ */
+function refusalFor(bucket, policy, policyHeader, { instance, origin }) {
+    const retryAfter = policy.period;
+    const body = toProblem(substratError('rate_limited', `Too many requests for this ${bucket === 'ip' ? 'client address' : 'credential'}: ` +
+        `at most ${policy.limit} every ${policy.period} seconds. Retry after ${retryAfter} seconds.`, { retryAfter }), instance);
+    return {
+        status: 429,
+        headers: {
+            'content-type': PROBLEM_CONTENT_TYPE,
+            [RETRY_AFTER_HEADER]: String(retryAfter),
+            [RATE_LIMIT_POLICY_HEADER]: policyHeader,
+            [RATE_LIMIT_HEADER]: `"${bucket}";r=0;t=${retryAfter}`,
+            ...(origin ? refusalCors(origin) : {}),
+        },
+        body,
+    };
+}
+/**
+ * CORS for the refusal, and only for it.
+ *
+ * A refusal is answered before the vertical runs, so the vertical's own CORS policy never
+ * sees it. Without these headers a cross-origin page reads a network error rather than a
+ * 429, and cannot back off by `Retry-After` — the polling loop this exists to stop keeps
+ * polling. The route names no origin allowlist to follow, so the refusal reflects whichever
+ * origin asked, credentials included.
+ *
+ * That is safe for THIS response and would not be for any other: the body and headers are
+ * the requester's own rate state — the budget that refused and when to retry — and no vertical
+ * data, which is why the policy is built here and never applied to a response the vertical
+ * gave.
+ */
+function refusalCors(origin) {
+    return {
+        'access-control-allow-origin': origin,
+        'access-control-allow-credentials': 'true',
+        'access-control-expose-headers': RATE_LIMIT_EXPOSED_HEADERS.join(', '),
+        vary: 'Origin',
+    };
+}
+//# sourceMappingURL=rate-limit.js.map

package/dist/rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../src/rate-limit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,oBAAoB,EAAgB,MAAM,aAAa,CAAC;AAE3F,0EAA0E;AAC1E,MAAM,CAAC,MAAM,kBAAkB,GAAG,aAAa,CAAC;AAChD,yFAAyF;AACzF,MAAM,CAAC,MAAM,wBAAwB,GAAG,kBAAkB,CAAC;AAC3D,gGAAgG;AAChG,MAAM,CAAC,MAAM,iBAAiB,GAAG,WAAW,CAAC;AAE7C;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,kBAAkB,EAAE,iBAAiB,EAAE,wBAAwB,CAAU,CAAC;AAUrH,mDAAmD;AACnD,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,YAAY,EAAE,IAAI,CAAU,CAAC;AAShE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAuD;IACrF,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE;IACvC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE;CAChC,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAClE,MAAM,GAAG,GAAG,EAA8C,CAAC;IAC3D,KAAK,MAAM,MAAM,IAAI,kBAAkB,EAAE,CAAC;QACxC,MAAM,MAAM,GAAI,KAAiC,CAAC,MAAM,CAAyC,CAAC;QAClG,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC;YAAE,OAAO,SAAS,CAAC;QACtF,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IAC/D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,aAAa,GAAG,CAAC,CAAU,EAAe,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAK,CAAY,GAAG,CAAC,CAAC;AAE5F;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,CACL,IAAI,KAAK,YAAY;QACrB,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC;QAChC,IAAI,KAAK,2BAA2B;QACpC,IAAI,KAAK,oCAAoC,CAC9C,CAAC;AACJ,CAAC;AAaD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAuB,EAAE,OAAyB;IACnF,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IACrE,MAAM,MAAM,GAAG,MAAM,KAAK,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACtG,OAAO,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,OAAO,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;AACtE,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,YAAY,CAAC,OAAgB;IAC1C,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACnD,IAAI,aAAa;QAAE,OAAO,KAAK,MAAM,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;IAC7D,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;IACvE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAqB;IAC7C,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,SAAS;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,IAAI,eAAe,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;AACpB,CAAC;AAED,mFAAmF;AACnF,KAAK,UAAU,MAAM,CAAC,IAAY;IAChC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/G,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC;QAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9E,OAAO,GAAG,CAAC;AACb,CAAC;AASD,4FAA4F;AAC5F,MAAM,cAAc,GAA+B,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;AAgBxE;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAMxC;IACC,4FAA4F;IAC5F,wFAAwF;IACxF,2EAA2E;IAC3E,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACtE,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACxD,MAAM,OAAO,GAAoE,EAAE,CAAC;IACpF,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YACtD,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACzG,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,OAAO;YAAE,MAAM;IACtC,CAAC;IACD,MAAM,YAAY,GAAG,OAAO;SACzB,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,MAAM,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,MAAM,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;SACnG,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;IAC5D,MAAM,WAAW,GACf,MAAM,CAAC,MAAM,GAAG,CAAC;QACf,CAAC,CAAC;YACE,MAAM,EAAE,qDAAqD;YAC7D,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;YACpC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAM,CAAC;SACnC;QACH,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IACxD,OAAO;QACL,YAAY;QACZ,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,OAAO;YACT,CAAC,CAAC;gBACE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE;oBAClE,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;iBAC5C,CAAC;aACH;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,UAAU,CACjB,MAAuB,EACvB,MAAuB,EACvB,YAAoB,EACpB,EAAE,QAAQ,EAAE,MAAM,EAA2D;IAE7E,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;IACjC,MAAM,IAAI,GAAG,SAAS,CACpB,aAAa,CACX,cAAc,EACd,8BAA8B,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,YAAY,IAAI;QACjF,WAAW,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,MAAM,yBAAyB,UAAU,WAAW,EAC9F,EAAE,UAAU,EAAE,CACf,EACD,QAAQ,CACT,CAAC;IACF,OAAO;QACL,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACP,cAAc,EAAE,oBAAoB;YACpC,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;YACxC,CAAC,wBAAwB,CAAC,EAAE,YAAY;YACxC,CAAC,iBAAiB,CAAC,EAAE,IAAI,MAAM,WAAW,UAAU,EAAE;YACtD,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACvC;QACD,IAAI;KACL,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,WAAW,CAAC,MAAc;IACjC,OAAO;QACL,6BAA6B,EAAE,MAAM;QACrC,kCAAkC,EAAE,MAAM;QAC1C,+BAA+B,EAAE,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC;QACtE,IAAI,EAAE,QAAQ;KACf,CAAC;AACJ,CAAC"}

package/dist/refusal.d.ts

@@ -1,8 +1,9 @@
 import { z } from 'zod';
 /**
  * The read side of the refusal log (#1745) — a scope-local record of every lifecycle move
- * `assertTransition` refused and the operation failed with, written on the failure path as
- * a write of its own AFTER the rollback it is evidence of.
+ * `assertTransition` refused, and every manifest-declared guard (K-38) that refused the
+ * operation it stands before, where the operation failed with it. Written on the failure
+ * path as a write of its own AFTER the rollback it is evidence of.
  *
  * The denial log's sibling, and read the same way (`permissionDenial` / `denialFilter`):
  * a denial is the permission model disagreeing with an actor, a refusal is the lifecycle
@@ -14,6 +15,8 @@ import { z } from 'zod';
  * retrying an illegal move mints a row per attempt), and the window is a storage bound,
  * not a retention promise — rows drain rather than expire.
  */
+/** What a refusal row stores for a reason outside the `problemReason` grammar. */
+export declare const UNRECOGNIZED_REFUSAL_REASON = "unrecognized";
 /** How many refusal rows an unbounded read returns — a screenful, newest-first. */
 export declare const DEFAULT_REFUSAL_LIMIT = 50;
 /** The hard ceiling on one page of refusal rows. */
@@ -21,14 +24,15 @@ export declare const REFUSAL_LIMIT_MAX = 200;
 /**
  * One recorded refusal.
  *
- * `kind` is `'transition'` for every row today; a K-38 guard refusal is the next kind,
- * recorded in the same table. It is read as text rather than a closed enum so a reader
- * built now does not reject the row a later kernel writes.
+ * `kind` is `'transition'` for a move the lifecycle refused and `'guard'` for an operation a
+ * manifest-declared guard refused (K-38). It is read as text rather than a closed enum so a
+ * reader built now does not reject a kind a later kernel writes.
  */
 export declare const refusalRecord: z.ZodObject<{
     id: z.ZodString;
     kind: z.ZodString;
     reason: z.ZodNullable<z.ZodString>;
+    guard: z.ZodNullable<z.ZodString>;
     actor: z.ZodUnion<readonly [z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">, z.ZodObject<{
         system: z.core.$ZodBranded<z.ZodString, "ModuleId", "out">;
     }, z.core.$strip>, z.ZodObject<{
@@ -51,7 +55,7 @@ export declare const refusalRecord: z.ZodObject<{
     scopeId: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "ScopeId", "out">>;
     entityType: z.ZodNullable<z.ZodString>;
     entityId: z.ZodNullable<z.ZodString>;
-    fromState: z.ZodString;
+    fromState: z.ZodNullable<z.ZodString>;
     attemptedState: z.ZodNullable<z.ZodString>;
     operation: z.ZodString;
     invokedOperation: z.ZodNullable<z.ZodString>;
@@ -74,6 +78,7 @@ export type RefusalRecord = z.infer<typeof refusalRecord>;
  * the object form for any other kind. The stored encoding is the reader's problem.
  */
 export declare const refusalFilter: z.ZodObject<{
+    kind: z.ZodOptional<z.ZodString>;
     entityType: z.ZodOptional<z.ZodString>;
     entityId: z.ZodOptional<z.ZodString>;
     actor: z.ZodOptional<z.ZodString>;
@@ -84,4 +89,42 @@ export declare const refusalFilter: z.ZodObject<{
     limit: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strip>;
 export type RefusalFilter = z.infer<typeof refusalFilter>;
+/**
+ * Name the record a refusal is about, on the error that carries it (#1745).
+ *
+ * For a guard predicate (K-38): the kernel records a guard's refusal, but only the predicate
+ * knows which record it judged — its config says where the id is, and the kernel does not
+ * read a predicate's config. A predicate that names it lets the process map count the
+ * refusal against that record; one that does not is still recorded, with the record unknown.
+ *
+ * Carried under a registered symbol for the reason `RefusedTransition` is: the record's id
+ * is the scope's to keep, never part of the problem document the caller is handed. Returns
+ * the error, so a throw site reads `throw nameRefusedRecord(conflict(…), ref)`.
+ */
+export declare function nameRefusedRecord<E>(err: E, ref: {
+    entityType: string;
+    entityId: string;
+}): E;
+/** The record `nameRefusedRecord` put on an error, or null. */
+export declare function refusedRecordOf(err: unknown): {
+    entityType: string;
+    entityId: string;
+} | null;
+/** What a refusal row stores as its entity type when the one it was handed is not one. */
+export declare const UNDECLARED_ENTITY_TYPE = "undeclared";
+/** The longest entity type a refusal row keeps. */
+export declare const REFUSAL_ENTITY_TYPE_MAX = 64;
+/**
+ * The entity type a refusal row keeps (#1745): the one it was handed when that is spelled as
+ * an entity type — the tuple namespace grammar (`OBJECT_NAMESPACE`, which `ctx.link` and every
+ * entity-narrowed grant are held to), not a kernel namespace, at most
+ * `REFUSAL_ENTITY_TYPE_MAX` — and `UNDECLARED_ENTITY_TYPE` otherwise. Null stays null: the
+ * record was not named.
+ *
+ * Needed because the type reaches a row from code that is handed request data — a guard
+ * predicate naming its record with `nameRefusedRecord` — and the ref takes any string. The
+ * grammar refuses an address, a sentence, anything with a space; it cannot tell a bare word
+ * from a type, which no runtime registry of a scope's entity types exists to do.
+ */
+export declare function refusalEntityType(entityType: string | null): string | null;
 //# sourceMappingURL=refusal.d.ts.map

package/dist/refusal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"refusal.d.ts","sourceRoot":"","sources":["../src/refusal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB;;;;;;;;;;;;;;GAcG;AAEH,mFAAmF;AACnF,eAAO,MAAM,qBAAqB,KAAK,CAAC;AACxC,oDAAoD;AACpD,eAAO,MAAM,iBAAiB,MAAM,CAAC;AAErC;;;;;;GAMG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAwCxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa;;;;;;;;;iBAWxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC"}
+{"version":3,"file":"refusal.d.ts","sourceRoot":"","sources":["../src/refusal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB;;;;;;;;;;;;;;;GAeG;AAEH,kFAAkF;AAClF,eAAO,MAAM,2BAA2B,iBAAiB,CAAC;AAE1D,mFAAmF;AACnF,eAAO,MAAM,qBAAqB,KAAK,CAAC;AACxC,oDAAoD;AACpD,eAAO,MAAM,iBAAiB,MAAM,CAAC;AAErC;;;;;;GAMG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAoDxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;iBAaxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,CAAC,CAK7F;AAID,+DAA+D;AAC/D,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAI7F;AAED,0FAA0F;AAC1F,eAAO,MAAM,sBAAsB,eAAe,CAAC;AACnD,mDAAmD;AACnD,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAE1C;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAO1E"}

package/dist/refusal.js

@@ -3,10 +3,12 @@ import { actor } from './events.js';
 import { impersonationStamp } from './impersonation.js';
 import { scopeId, tenantId } from './ids.js';
 import { lifecycleActorKind } from './lifecycle-flow.js';
+import { OBJECT_NAMESPACE, isKernelNamespace } from './object-ref.js';
 /**
  * The read side of the refusal log (#1745) — a scope-local record of every lifecycle move
- * `assertTransition` refused and the operation failed with, written on the failure path as
- * a write of its own AFTER the rollback it is evidence of.
+ * `assertTransition` refused, and every manifest-declared guard (K-38) that refused the
+ * operation it stands before, where the operation failed with it. Written on the failure
+ * path as a write of its own AFTER the rollback it is evidence of.
  *
  * The denial log's sibling, and read the same way (`permissionDenial` / `denialFilter`):
  * a denial is the permission model disagreeing with an actor, a refusal is the lifecycle
@@ -18,6 +20,8 @@ import { lifecycleActorKind } from './lifecycle-flow.js';
  * retrying an illegal move mints a row per attempt), and the window is a storage bound,
  * not a retention promise — rows drain rather than expire.
  */
+/** What a refusal row stores for a reason outside the `problemReason` grammar. */
+export const UNRECOGNIZED_REFUSAL_REASON = 'unrecognized';
 /** How many refusal rows an unbounded read returns — a screenful, newest-first. */
 export const DEFAULT_REFUSAL_LIMIT = 50;
 /** The hard ceiling on one page of refusal rows. */
@@ -25,34 +29,46 @@ export const REFUSAL_LIMIT_MAX = 200;
 /**
  * One recorded refusal.
  *
- * `kind` is `'transition'` for every row today; a K-38 guard refusal is the next kind,
- * recorded in the same table. It is read as text rather than a closed enum so a reader
- * built now does not reject the row a later kernel writes.
+ * `kind` is `'transition'` for a move the lifecycle refused and `'guard'` for an operation a
+ * manifest-declared guard refused (K-38). It is read as text rather than a closed enum so a
+ * reader built now does not reject a kind a later kernel writes.
  */
 export const refusalRecord = z.object({
     /** ULID — chronological, so it is also the sort key. */
     id: z.string().min(1),
     kind: z.string().min(1),
     /**
-     * The problem code the operation failed with — `invalid_transition` for a transition
-     * refusal, which is the `reason` on the 409 the caller received. Null for a kind this
-     * reader does not know the code of.
+     * The problem code the operation failed with — the `reason` on the 409 the caller received:
+     * `invalid_transition` for a transition refusal, the predicate's own (`protocol_required`)
+     * for a guard. Null when the refusal carried none and the kind implies none, and
+     * `UNRECOGNIZED_REFUSAL_REASON` when it carried one outside the `problemReason` grammar —
+     * kept as a code, never as whatever text the thrower put there.
      */
     reason: z.string().nullable(),
+    /** The guard's named predicate (`protocol/all-signed`) on a `'guard'` row; null otherwise. */
+    guard: z.string().nullable(),
     /** WHO attempted the move: a principal, a `{ system }` module, a `{ connection }`, … */
     actor,
     /** The actor's kind, read off its stored shape — what the process map counts by. */
     actorKind: lifecycleActorKind,
     tenantId,
     scopeId: scopeId.nullable(),
-    /** The record the move was refused on. Null when the caller of `assertTransition` did not name it. */
+    /**
+     * The record the refusal was about. Null when the refusing code did not name it — the
+     * caller of `assertTransition`, or a guard predicate that did not `nameRefusedRecord`.
+     * The type is `UNDECLARED_ENTITY_TYPE` when what it was handed is not spelled as one
+     * (`refusalEntityType`).
+     */
     entityType: z.string().nullable(),
     entityId: z.string().nullable(),
-    /** The state the record was in. */
-    fromState: z.string(),
-    /** Where the operation leads where it IS legal; null when that is not one state. */
+    /**
+     * The state the record was in. Null on a `'guard'` row: a guard stands before an operation,
+     * and the kernel that ran it does not know the state of the record behind it.
+     */
+    fromState: z.string().nullable(),
+    /** Where the operation leads where it IS legal; null when that is not one state, and on a guard. */
     attemptedState: z.string().nullable(),
-    /** The lifecycle's operation — what the edge is keyed by. */
+    /** The lifecycle's operation — what the edge is keyed by — or the operation the guard stands before. */
     operation: z.string(),
     /** The `invoke()` string the call ran as. The same as `operation` for every caller today. */
     invokedOperation: z.string().nullable(),
@@ -79,6 +95,8 @@ export const refusalRecord = z.object({
  * the object form for any other kind. The stored encoding is the reader's problem.
  */
 export const refusalFilter = z.object({
+    /** `'transition'` or `'guard'`; every kind when absent. */
+    kind: z.string().min(1).optional(),
     entityType: z.string().min(1).optional(),
     entityId: z.string().min(1).optional(),
     actor: z.string().min(1).optional(),
@@ -90,4 +108,55 @@ export const refusalFilter = z.object({
     until: z.string().min(1).optional(),
     limit: z.number().int().min(1).max(REFUSAL_LIMIT_MAX).optional(),
 });
+/**
+ * Name the record a refusal is about, on the error that carries it (#1745).
+ *
+ * For a guard predicate (K-38): the kernel records a guard's refusal, but only the predicate
+ * knows which record it judged — its config says where the id is, and the kernel does not
+ * read a predicate's config. A predicate that names it lets the process map count the
+ * refusal against that record; one that does not is still recorded, with the record unknown.
+ *
+ * Carried under a registered symbol for the reason `RefusedTransition` is: the record's id
+ * is the scope's to keep, never part of the problem document the caller is handed. Returns
+ * the error, so a throw site reads `throw nameRefusedRecord(conflict(…), ref)`.
+ */
+export function nameRefusedRecord(err, ref) {
+    if (err !== null && typeof err === 'object') {
+        err[REFUSED_RECORD] = { entityType: ref.entityType, entityId: ref.entityId };
+    }
+    return err;
+}
+const REFUSED_RECORD = Symbol.for('substrat.refused-record');
+/** The record `nameRefusedRecord` put on an error, or null. */
+export function refusedRecordOf(err) {
+    if (err === null || typeof err !== 'object')
+        return null;
+    const r = err[REFUSED_RECORD];
+    return r !== null && typeof r === 'object' ? r : null;
+}
+/** What a refusal row stores as its entity type when the one it was handed is not one. */
+export const UNDECLARED_ENTITY_TYPE = 'undeclared';
+/** The longest entity type a refusal row keeps. */
+export const REFUSAL_ENTITY_TYPE_MAX = 64;
+/**
+ * The entity type a refusal row keeps (#1745): the one it was handed when that is spelled as
+ * an entity type — the tuple namespace grammar (`OBJECT_NAMESPACE`, which `ctx.link` and every
+ * entity-narrowed grant are held to), not a kernel namespace, at most
+ * `REFUSAL_ENTITY_TYPE_MAX` — and `UNDECLARED_ENTITY_TYPE` otherwise. Null stays null: the
+ * record was not named.
+ *
+ * Needed because the type reaches a row from code that is handed request data — a guard
+ * predicate naming its record with `nameRefusedRecord` — and the ref takes any string. The
+ * grammar refuses an address, a sentence, anything with a space; it cannot tell a bare word
+ * from a type, which no runtime registry of a scope's entity types exists to do.
+ */
+export function refusalEntityType(entityType) {
+    if (entityType === null)
+        return null;
+    return entityType.length <= REFUSAL_ENTITY_TYPE_MAX &&
+        OBJECT_NAMESPACE.test(entityType) &&
+        !isKernelNamespace(entityType)
+        ? entityType
+        : UNDECLARED_ENTITY_TYPE;
+}
 //# sourceMappingURL=refusal.js.map

package/dist/refusal.js.map

@@ -1 +1 @@
-{"version":3,"file":"refusal.js","sourceRoot":"","sources":["../src/refusal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD;;;;;;;;;;;;;;GAcG;AAEH,mFAAmF;AACnF,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AACxC,oDAAoD;AACpD,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAErC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,wDAAwD;IACxD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB;;;;OAIG;IACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,wFAAwF;IACxF,KAAK;IACL,oFAAoF;IACpF,SAAS,EAAE,kBAAkB;IAC7B,QAAQ;IACR,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC3B,sGAAsG;IACtG,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,mCAAmC;IACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,oFAAoF;IACpF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,6DAA6D;IAC7D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,6FAA6F;IAC7F,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,4FAA4F;IAC5F,aAAa,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAC5C,wFAAwF;IACxF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,gBAAgB;IAChB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC;;;;OAIG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAGH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC1C,2BAA2B;IAC3B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnC,2BAA2B;IAC3B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE;CACjE,CAAC,CAAC"}
+{"version":3,"file":"refusal.js","sourceRoot":"","sources":["../src/refusal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEtE;;;;;;;;;;;;;;;GAeG;AAEH,kFAAkF;AAClF,MAAM,CAAC,MAAM,2BAA2B,GAAG,cAAc,CAAC;AAE1D,mFAAmF;AACnF,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AACxC,oDAAoD;AACpD,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAErC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,wDAAwD;IACxD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB;;;;;;OAMG;IACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,8FAA8F;IAC9F,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,wFAAwF;IACxF,KAAK;IACL,oFAAoF;IACpF,SAAS,EAAE,kBAAkB;IAC7B,QAAQ;IACR,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC3B;;;;;OAKG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B;;;OAGG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,oGAAoG;IACpG,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,wGAAwG;IACxG,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,6FAA6F;IAC7F,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,4FAA4F;IAC5F,aAAa,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAC5C,wFAAwF;IACxF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,gBAAgB;IAChB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC;;;;OAIG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAGH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,2DAA2D;IAC3D,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC1C,2BAA2B;IAC3B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnC,2BAA2B;IAC3B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE;CACjE,CAAC,CAAC;AAGH;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAAI,GAAM,EAAE,GAA6C;IACxF,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC3C,GAA+B,CAAC,cAAc,CAAC,GAAG,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC5G,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,cAAc,GAAG,MAAM,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;AAE7D,+DAA+D;AAC/D,MAAM,UAAU,eAAe,CAAC,GAAY;IAC1C,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,CAAC,GAAI,GAA+B,CAAC,cAAc,CAAC,CAAC;IAC3D,OAAO,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAA8C,CAAC,CAAC,CAAC,IAAI,CAAC;AACtG,CAAC;AAED,0FAA0F;AAC1F,MAAM,CAAC,MAAM,sBAAsB,GAAG,YAAY,CAAC;AACnD,mDAAmD;AACnD,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAE1C;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAyB;IACzD,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,UAAU,CAAC,MAAM,IAAI,uBAAuB;QACjD,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC;QACjC,CAAC,iBAAiB,CAAC,UAAU,CAAC;QAC9B,CAAC,CAAC,UAAU;QACZ,CAAC,CAAC,sBAAsB,CAAC;AAC7B,CAAC"}

package/dist/registry.d.ts

@@ -71,7 +71,6 @@ export declare const verticalServingState: z.ZodObject<{
 }, z.core.$strip>;
 export type VerticalServingState = z.infer<typeof verticalServingState>;
 export declare const registerVerticalInput: z.ZodObject<{
-    slug: z.ZodString;
     name: z.ZodString;
     source: z.ZodEnum<{
         builtin: "builtin";
@@ -99,6 +98,7 @@ export declare const registerVerticalInput: z.ZodObject<{
     listed: z.ZodDefault<z.ZodBoolean>;
     provisions: z.ZodOptional<z.ZodArray<z.ZodString>>;
     sendsEmail: z.ZodOptional<z.ZodBoolean>;
+    slug: z.ZodString;
     ownerTenant: z.ZodDefault<z.ZodNullable<z.core.$ZodBranded<z.ZodString, "TenantId", "out">>>;
 }, z.core.$strip>;
 export type RegisterVerticalInput = z.input<typeof registerVerticalInput>;

package/dist/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB;;;;;;;;;;GAUG;AAEH,yFAAyF;AACzF,eAAO,MAAM,cAAc;;;;EAAoC,CAAC;AAChE,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAuHnB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB;;;;;iBAK/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAKhC,CAAC;AAGH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe;;;;EAA8C,CAAC;AAC3E,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,oCAAoC,CAAC;AAErE;;;;;;;GAOG;AACH;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;iBAmBxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA6B1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;iBAoB5B,CAAC;AACL,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE;;;;;;;;;GASG;AACH,eAAO,MAAM,WAAW;;EAAmB,CAAC;AAC5C,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD,eAAO,MAAM,eAAe;;;;;;;;iBAe1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;iBAS9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,wBAAwB;;;;iBAUnC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEhF;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB;;kBAAgE,CAAC;AACjG,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB;;;;;;;;;;GAUG;AAEH,yFAAyF;AACzF,eAAO,MAAM,cAAc;;;;EAAoC,CAAC;AAChE,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAuHnB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB;;;;;iBAK/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAchC,CAAC;AAGH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe;;;;EAA8C,CAAC;AAC3E,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,oCAAoC,CAAC;AAErE;;;;;;;GAOG;AACH;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;iBAmBxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA6B1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;iBAoB5B,CAAC;AACL,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE;;;;;;;;;GASG;AACH,eAAO,MAAM,WAAW;;EAAmB,CAAC;AAC5C,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD,eAAO,MAAM,eAAe;;;;;;;;iBAe1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;iBAS9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,wBAAwB;;;;iBAUnC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEhF;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB;;kBAAgE,CAAC;AACjG,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC"}

package/dist/registry.js

@@ -2,6 +2,7 @@ import { z } from 'zod';
 import { instant, permissionKey, tenantId, verticalSlug } from './ids.js';
 import { envVarSpec, capability } from './manifest.js';
 import { declaredSurface } from './routing.js';
+import { platformScriptCollision, platformScriptRefusal } from './script-names.js';
 /**
  * The vertical + version registry (#31 step 1; D-33's milestone one).
  *
@@ -151,6 +152,16 @@ export const verticalServingState = z.object({
 export const registerVerticalInput = vertical
     .pick({ slug: true, name: true, source: true, envSpec: true, entitlements: true, ownerGrants: true, provides: true, requires: true, provisions: true, sendsEmail: true, surfaces: true, listed: true })
     .extend({
+    /**
+     * #1923: a slug that would deploy under one of the platform's own script names is refused
+     * here, at the claim, because its logs would be indistinguishable from that worker's.
+     * Refused on the INPUT only: a stored record is read back with the plain `vertical` schema.
+     */
+    slug: verticalSlug.superRefine((slug, ctx) => {
+        const collision = platformScriptCollision(slug);
+        if (collision)
+            ctx.addIssue({ code: 'custom', message: platformScriptRefusal(slug, collision) });
+    }),
     // Optional on input — a staff/platform push omits it (⇒ platform-owned).
     ownerTenant: tenantId.nullable().default(null),
 });

package/dist/registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"registry.js","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C;;;;;;;;;;GAUG;AAEH,yFAAyF;AACzF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AAGhE,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,IAAI,EAAE,YAAY,EAAE,iFAAiF;IACrG,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,MAAM,EAAE,cAAc;IACtB;;;;;OAKG;IACH,WAAW,EAAE,QAAQ,CAAC,QAAQ,EAAE;IAChC;;;;;;OAMG;IACH,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;IACvC;;;;;;OAMG;IACH,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC5C,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;IAC9C,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;IACxC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;IACxC;;;;;;OAMG;IACH,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;IAC7C;;;;;;;;;OASG;IACH,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAClC;;;;OAIG;IACH,kBAAkB,EAAE,OAAO,CAAC,OAAO,EAAE;IACrC;;;;;;;OAOG;IACH,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC3C;;;;;;;;OAQG;IACH,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE;IAC5C;;;;;;;OAOG;IACH,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAClC;;;;;;;;OAQG;IACH,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACvC;;;;;;;;;;OAUG;IACH,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC7C;;;;;OAKG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE;IACvC;;;;OAIG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE;IAC7C,SAAS,EAAE,OAAO;CACnB,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACrC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAChC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,qBAAqB,GAAG,QAAQ;KAC1C,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;KACtM,MAAM,CAAC;IACR,yEAAyE;IACzE,WAAW,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CAC/C,CAAC,CAAC;AAKH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;AAG3E;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,iCAAiC,CAAC;AAErE;;;;;;;GAOG;AACH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC9B,qDAAqD;IACrD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACrC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC,+DAA+D;IAC/D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpC;;;;;;;;;;OAUG;IACH,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE;CACvD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO;IAC9B,YAAY;IACZ,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,8DAA8D;IAC1F,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,oFAAoF;IACpF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3C,SAAS,EAAE,eAAe;IAC1B,wDAAwD;IACxD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,sEAAsE;IACtE,MAAM,EAAE,aAAa,CAAC,OAAO,EAAE;IAC/B;;;;;OAKG;IACH,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;IACvC;;;;;OAKG;IACH,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;IACpC,SAAS,EAAE,OAAO;CACnB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,mBAAmB,GAAG,eAAe;KAC/C,IAAI,CAAC;IACJ,EAAE,EAAE,IAAI;IACR,YAAY,EAAE,IAAI;IAClB,OAAO,EAAE,IAAI;IACb,cAAc,EAAE,IAAI;IACpB,gBAAgB,EAAE,IAAI;IACtB,eAAe,EAAE,IAAI;IACrB,aAAa,EAAE,IAAI;IACnB,MAAM,EAAE,IAAI;CACb,CAAC;KACD,MAAM,CAAC;IACN;;;;;;OAMG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;CACnC,CAAC,CAAC;AAGL;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAG5C,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,YAAY;IACZ,OAAO,EAAE,WAAW;IACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,SAAS,EAAE,OAAO;IAClB;;;;;;;;OAQG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE;CAC9C,CAAC,CAAC;AAGH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,6BAA6B;IACpD,YAAY;IACZ,OAAO,EAAE,WAAW;IACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,gFAAgF;IAChF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,EAAE,EAAE,OAAO;CACZ,CAAC,CAAC;AAGH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACxC,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACvC;;;;;OAKG;IACH,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,wBAAwB,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC"}
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAEnF;;;;;;;;;;GAUG;AAEH,yFAAyF;AACzF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AAGhE,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,IAAI,EAAE,YAAY,EAAE,iFAAiF;IACrG,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,MAAM,EAAE,cAAc;IACtB;;;;;OAKG;IACH,WAAW,EAAE,QAAQ,CAAC,QAAQ,EAAE;IAChC;;;;;;OAMG;IACH,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;IACvC;;;;;;OAMG;IACH,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC5C,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;IAC9C,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;IACxC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;IACxC;;;;;;OAMG;IACH,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;IAC7C;;;;;;;;;OASG;IACH,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAClC;;;;OAIG;IACH,kBAAkB,EAAE,OAAO,CAAC,OAAO,EAAE;IACrC;;;;;;;OAOG;IACH,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC3C;;;;;;;;OAQG;IACH,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE;IAC5C;;;;;;;OAOG;IACH,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAClC;;;;;;;;OAQG;IACH,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACvC;;;;;;;;;;OAUG;IACH,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC7C;;;;;OAKG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE;IACvC;;;;OAIG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE;IAC7C,SAAS,EAAE,OAAO;CACnB,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACrC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAChC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,qBAAqB,GAAG,QAAQ;KAC1C,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;KACtM,MAAM,CAAC;IACR;;;;OAIG;IACH,IAAI,EAAE,YAAY,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC3C,MAAM,SAAS,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,SAAS;YAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,qBAAqB,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;IACnG,CAAC,CAAC;IACF,yEAAyE;IACzE,WAAW,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CAC/C,CAAC,CAAC;AAKH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;AAG3E;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,iCAAiC,CAAC;AAErE;;;;;;;GAOG;AACH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC9B,qDAAqD;IACrD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACrC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC,+DAA+D;IAC/D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpC;;;;;;;;;;OAUG;IACH,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE;CACvD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO;IAC9B,YAAY;IACZ,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,8DAA8D;IAC1F,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,oFAAoF;IACpF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3C,SAAS,EAAE,eAAe;IAC1B,wDAAwD;IACxD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,sEAAsE;IACtE,MAAM,EAAE,aAAa,CAAC,OAAO,EAAE;IAC/B;;;;;OAKG;IACH,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;IACvC;;;;;OAKG;IACH,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;IACpC,SAAS,EAAE,OAAO;CACnB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,mBAAmB,GAAG,eAAe;KAC/C,IAAI,CAAC;IACJ,EAAE,EAAE,IAAI;IACR,YAAY,EAAE,IAAI;IAClB,OAAO,EAAE,IAAI;IACb,cAAc,EAAE,IAAI;IACpB,gBAAgB,EAAE,IAAI;IACtB,eAAe,EAAE,IAAI;IACrB,aAAa,EAAE,IAAI;IACnB,MAAM,EAAE,IAAI;CACb,CAAC;KACD,MAAM,CAAC;IACN;;;;;;OAMG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;CACnC,CAAC,CAAC;AAGL;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAG5C,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,YAAY;IACZ,OAAO,EAAE,WAAW;IACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,SAAS,EAAE,OAAO;IAClB;;;;;;;;OAQG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE;CAC9C,CAAC,CAAC;AAGH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,6BAA6B;IACpD,YAAY;IACZ,OAAO,EAAE,WAAW;IACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,gFAAgF;IAChF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,EAAE,EAAE,OAAO;CACZ,CAAC,CAAC;AAGH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACxC,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACvC;;;;;OAKG;IACH,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,wBAAwB,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC"}