@substrat-run/contracts 0.147.0 → 0.149.0

package/dist/scope-store-envelope.js

@@ -0,0 +1,438 @@
+/**
+ * The signed envelope a scope-store call carries (#2287, RFC scope-stores §10.3).
+ *
+ * Ed25519 over a canonical encoding of every field the store acts on. The router signs
+ * audience `caller` and the control plane signs audience `platform`, each with its own
+ * private key. A store script holds only public keys, a list per audience, so a key can be
+ * rotated without a moment where no key verifies. The encoding is nine lines joined by
+ * `\n`, with no trailing newline, so a verifier in another language can rebuild it:
+ *
+ * ```
+ * 1
+ * caller|platform
+ * <kid: base64url of the first 8 bytes of SHA-256 over the raw public key>
+ * <store script name>
+ * <object name>
+ * <operation>
+ * <sha256 hex of the exact request body>
+ * <iat, unix seconds>
+ * <nonce, base64url of 16 bytes>
+ * ```
+ *
+ * The signature is base64url over those exact UTF-8 bytes. An envelope is fresh for
+ * {@link SCOPE_STORE_ENVELOPE_WINDOW_SECONDS} on either side of the verifier's clock. A
+ * store does not remember nonces (RFC Q2): an envelope replayed inside the window, at the
+ * same script and object with the same body, is accepted again. The reserved operations are
+ * idempotent, and a driver operation's retry safety is the vertical's.
+ *
+ * The script line is an opaque string compared for equality: the signer builds it, the
+ * verifier is told its own. Nothing here parses it.
+ *
+ * This module imports nothing, so a store entry can load it as one file.
+ */
+export const SCOPE_STORE_ENVELOPE_VERSION = 1;
+export const SCOPE_STORE_ENVELOPE_WINDOW_SECONDS = 60;
+/** The request header carrying base64url of the canonical bytes. */
+export const SCOPE_STORE_ENVELOPE_HEADER = 'x-substrat-store-envelope';
+/** The request header carrying the base64url signature. */
+export const SCOPE_STORE_SIGNATURE_HEADER = 'x-substrat-store-signature';
+/**
+ * The operations only the platform may send to a scope store (#2207). A vertical's
+ * stub refuses every one of them. A driver's registration has to answer all of them,
+ * `substrat.erase` included, before a hosted deploy may store tenant data.
+ */
+export const RESERVED_STORE_OPERATIONS = [
+    'substrat.export',
+    'substrat.import',
+    'substrat.size',
+    'substrat.wipe',
+    'substrat.erase',
+];
+/**
+ * Which operations each (version, audience) admits. Closed: a pair not in this table is
+ * refused. `platform` sends exactly the reserved operations, and `caller` sends anything
+ * else, never a `substrat.*` name.
+ */
+const ADMITTED = {
+    '1': {
+        platform: (op) => RESERVED_STORE_OPERATIONS.includes(op),
+        caller: (op) => !op.startsWith('substrat.'),
+    },
+};
+/** Whether this version admits `op` from `aud`. */
+export function scopeStoreEnvelopeAdmits(v, aud, op) {
+    const byAudience = Object.hasOwn(ADMITTED, String(v)) ? ADMITTED[String(v)] : undefined;
+    if (!byAudience || !Object.hasOwn(byAudience, aud))
+        return false;
+    return byAudience[aud](op);
+}
+export function bytesToBase64Url(bytes) {
+    let binary = '';
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary).replaceAll('+', '-').replaceAll('/', '_').replaceAll('=', '');
+}
+export function base64UrlToBytes(value) {
+    if (!/^[A-Za-z0-9_-]+$/.test(value))
+        return undefined;
+    const padded = value.replaceAll('-', '+').replaceAll('_', '/') + '='.repeat((4 - (value.length % 4)) % 4);
+    try {
+        const binary = atob(padded);
+        const bytes = new Uint8Array(binary.length);
+        for (let i = 0; i < binary.length; i++)
+            bytes[i] = binary.charCodeAt(i);
+        return bytes;
+    }
+    catch {
+        return undefined;
+    }
+}
+function copyBytes(bytes) {
+    const copy = new ArrayBuffer(bytes.byteLength);
+    new Uint8Array(copy).set(bytes);
+    return copy;
+}
+/**
+ * Whether `text` is the canonical base64url of exactly `length` bytes: it decodes to that many
+ * bytes and re-encodes to the same text, so its unused trailing bits are zero and no second
+ * spelling names the same value.
+ */
+function isCanonicalBase64Url(text, length) {
+    const bytes = base64UrlToBytes(text);
+    return bytes?.length === length && bytesToBase64Url(bytes) === text;
+}
+const NONCE = /^[A-Za-z0-9_-]{22}$/;
+const KID = /^[A-Za-z0-9_-]{11}$/;
+const DIGEST = /^[0-9a-f]{64}$/;
+// At most 15 digits, so every value it admits is a safe integer, as the encoder requires.
+const IAT = /^(0|[1-9]\d{0,14})$/;
+/** Nine lines, no trailing newline. Throws on a field the parser would refuse. */
+export function canonicalScopeStoreEnvelope(envelope) {
+    if (envelope.v !== SCOPE_STORE_ENVELOPE_VERSION)
+        throw new Error(`unknown store envelope version ${envelope.v}`);
+    for (const field of [envelope.aud, envelope.kid, envelope.script, envelope.name, envelope.op, envelope.digest, envelope.nonce]) {
+        if (field.length === 0)
+            throw new Error('a store envelope field is empty');
+        if (field.includes('\n'))
+            throw new Error('a store envelope field contains a newline');
+    }
+    if (!Number.isSafeInteger(envelope.iat) || envelope.iat < 0)
+        throw new Error('a store envelope iat is not a non-negative integer');
+    const canonical = [
+        String(envelope.v),
+        envelope.aud,
+        envelope.kid,
+        envelope.script,
+        envelope.name,
+        envelope.op,
+        envelope.digest,
+        String(envelope.iat),
+        envelope.nonce,
+    ].join('\n');
+    if (!parseScopeStoreEnvelope(canonical))
+        throw new Error('a store envelope field is malformed');
+    return canonical;
+}
+/** The envelope those bytes name, or undefined when they are not exactly what the encoder emits. */
+export function parseScopeStoreEnvelope(canonical) {
+    const lines = canonical.split('\n');
+    if (lines.length !== 9)
+        return undefined;
+    const [version, aud, kid, script, name, op, digest, iatText, nonce] = lines;
+    if (version !== '1' || (aud !== 'caller' && aud !== 'platform'))
+        return undefined;
+    if (!script || !name || !op)
+        return undefined;
+    if (!KID.test(kid) || !DIGEST.test(digest) || !IAT.test(iatText) || !NONCE.test(nonce))
+        return undefined;
+    // The kid is 8 bytes and the nonce 16, each in canonical base64url. IAT's grammar already
+    // admits only the decimal text `String(n)` gives for a safe integer n: no sign, no leading zero.
+    if (!isCanonicalBase64Url(kid, 8) || !isCanonicalBase64Url(nonce, 16))
+        return undefined;
+    return { v: 1, aud, kid, script, name, op, digest, iat: Number(iatText), nonce };
+}
+/** SHA-256 of the exact request body, lowercase hex. */
+export async function scopeStoreBodyDigest(body) {
+    const hash = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(body));
+    return [...new Uint8Array(hash)].map((byte) => byte.toString(16).padStart(2, '0')).join('');
+}
+/** Whether `iat` is inside the freshness window of `nowSeconds`. */
+export function scopeStoreEnvelopeFresh(iat, nowSeconds, windowSeconds = SCOPE_STORE_ENVELOPE_WINDOW_SECONDS) {
+    return Math.abs(nowSeconds - iat) <= windowSeconds;
+}
+/**
+ * The encodings of Ed25519's eight small-order points, with the sign bit (the top bit of the
+ * last byte) cleared, including the non-canonical encodings p and p+1 of y: the list libsodium
+ * refuses. Under such a key a forged signature verifies for many messages (with the identity,
+ * R = identity and S = 0 verifies for any message under some verifiers), so no store accepts one.
+ */
+const SMALL_ORDER_KEYS = [
+    '0000000000000000000000000000000000000000000000000000000000000000', // y = 0, order 4
+    '0100000000000000000000000000000000000000000000000000000000000000', // the identity, order 1
+    '26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc05', // order 8
+    'c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac037a', // order 8
+    'ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f', // y = p - 1, order 2
+    'edffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f', // y = p, a non-canonical 0
+    'eeffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f', // y = p + 1, a non-canonical identity
+];
+/** Whether 32 key bytes encode a small-order point, in either sign. */
+function isSmallOrderKey(bytes) {
+    const unsigned = Uint8Array.from(bytes);
+    unsigned[31] = unsigned[31] & 0x7f;
+    const hex = [...unsigned].map((byte) => byte.toString(16).padStart(2, '0')).join('');
+    return SMALL_ORDER_KEYS.includes(hex);
+}
+/**
+ * The key id of a raw Ed25519 public key (base64url): base64url of SHA-256's first 8 bytes.
+ * Throws on a key that is not 32 bytes or encodes a small-order point, so a verifier given one
+ * never matches it.
+ */
+export async function scopeStoreKeyId(publicKey) {
+    const bytes = base64UrlToBytes(publicKey);
+    if (!bytes || bytes.length !== 32)
+        throw new Error('a store public key is not 32 bytes of base64url');
+    if (isSmallOrderKey(bytes))
+        throw new Error('a store public key is a small-order point');
+    const hash = await crypto.subtle.digest('SHA-256', copyBytes(bytes));
+    return bytesToBase64Url(new Uint8Array(hash).slice(0, 8));
+}
+/**
+ * Why a store refuses one configured public key, or undefined when it accepts it: empty, not
+ * 32 bytes of base64url, a small-order point, or not in canonical base64url (its unused trailing
+ * bits set, so two spellings would name one key).
+ */
+export function scopeStorePublicKeyProblem(key) {
+    if (key.length === 0)
+        return 'empty';
+    const bytes = base64UrlToBytes(key);
+    if (bytes?.length !== 32)
+        return 'length';
+    if (isSmallOrderKey(bytes))
+        return 'small-order';
+    // Canonical means the bytes re-encode to the same text, so equal text is equal bytes.
+    if (bytesToBase64Url(bytes) !== key)
+        return 'non-canonical';
+    return undefined;
+}
+const PUBLIC_KEY_PROBLEM = {
+    empty: 'a store public key list is empty or has an empty entry',
+    length: 'a store public key is not 32 bytes of base64url',
+    'small-order': 'a store public key is a small-order point',
+    'non-canonical': 'a store public key is not canonical base64url',
+};
+/**
+ * A store's public keys for one audience, as configured: raw Ed25519 keys, base64url,
+ * separated by commas (whitespace around each is ignored). Throws on an empty list, any key
+ * {@link scopeStorePublicKeyProblem} refuses, or the same key twice. Rotation is: add the new
+ * key, switch the signer, then drop the old key.
+ */
+export function parseScopeStorePublicKeys(text) {
+    const keys = text.split(',').map((key) => key.trim());
+    if (keys.some((key) => key.length === 0))
+        throw new Error(PUBLIC_KEY_PROBLEM.empty);
+    const seen = new Set();
+    for (const key of keys) {
+        const problem = scopeStorePublicKeyProblem(key);
+        if (problem)
+            throw new Error(PUBLIC_KEY_PROBLEM[problem]);
+        if (seen.has(key))
+            throw new Error('a store public key is listed twice');
+        seen.add(key);
+    }
+    return keys;
+}
+/**
+ * Both audiences' public keys, from their configured lists. Throws on anything
+ * {@link parseScopeStorePublicKeys} refuses, and on a key listed for both audiences: whoever
+ * holds the `caller` private key could then sign `platform` envelopes, `substrat.erase`
+ * included (L16). A store builds its keys only through this.
+ */
+export function scopeStorePublicKeysFrom(config) {
+    const caller = parseScopeStorePublicKeys(config.caller);
+    const platform = parseScopeStorePublicKeys(config.platform);
+    if (caller.some((key) => platform.includes(key))) {
+        throw new Error('a store public key is listed for both audiences');
+    }
+    return { caller, platform };
+}
+/**
+ * A fresh Ed25519 pair in the shapes this module takes: the PKCS8 private key a signer holds
+ * and the raw public key a store lists, both base64url, with the key id the envelope names.
+ */
+export async function generateScopeStoreKeyPair() {
+    const pair = (await crypto.subtle.generateKey({ name: 'Ed25519' }, true, ['sign', 'verify']));
+    const privateKey = bytesToBase64Url(new Uint8Array((await crypto.subtle.exportKey('pkcs8', pair.privateKey))));
+    const publicKey = bytesToBase64Url(new Uint8Array((await crypto.subtle.exportKey('raw', pair.publicKey))));
+    return { privateKey, publicKey, kid: await scopeStoreKeyId(publicKey) };
+}
+/**
+ * The DER prefix of an Ed25519 PKCS8 v1 private key (RFC 8410 §7): SEQUENCE, version 0, the
+ * Ed25519 algorithm identifier, then a 34-byte OCTET STRING wrapping the 32-byte seed. With the
+ * seed it is exactly 48 bytes, the form WebCrypto exports and `generateScopeStoreKeyPair` writes.
+ */
+const PKCS8_V1_ED25519_PREFIX = [0x30, 0x2e, 0x02, 0x01, 0x00, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x70, 0x04, 0x22, 0x04, 0x20];
+/**
+ * Import a PKCS8 Ed25519 private key (base64url) and derive its key id from its public half.
+ * Only the canonical 48-byte v1 form is accepted: a DER parser may tolerate trailing bytes or
+ * another encoding of the same seed, and whether it does differs between runtimes, so a key a
+ * tool accepts here could otherwise be one the deployed signer refuses.
+ */
+async function signingKey(pkcs8) {
+    const bytes = base64UrlToBytes(pkcs8);
+    if (!bytes)
+        throw new ScopeStoreKeyError('the store signing key is not base64url', 'encoding');
+    if (bytes.length !== 48 || PKCS8_V1_ED25519_PREFIX.some((byte, i) => bytes[i] !== byte)) {
+        throw new ScopeStoreKeyError('the store signing key is not a 48-byte Ed25519 PKCS8 v1 key', 'not-pkcs8-v1');
+    }
+    let key;
+    let x;
+    try {
+        // Extractable only so its public half (`x`) can be read for the key id; it never leaves here.
+        key = await crypto.subtle.importKey('pkcs8', copyBytes(bytes), { name: 'Ed25519' }, true, ['sign']);
+        x = (await crypto.subtle.exportKey('jwk', key)).x;
+    }
+    catch {
+        throw new ScopeStoreKeyError('the store signing key is not an Ed25519 PKCS8 key', 'not-ed25519');
+    }
+    if (typeof x !== 'string')
+        throw new ScopeStoreKeyError('the store signing key has no public half', 'no-public-half');
+    // The only key a JWK export can name that scopeStoreKeyId refuses is a small-order point.
+    if (scopeStorePublicKeyProblem(x))
+        throw new ScopeStoreKeyError('the store signing key is a small-order point', 'small-order');
+    return { key, publicKey: x, kid: await scopeStoreKeyId(x) };
+}
+/**
+ * The raw public key and key id a PKCS8 Ed25519 private key (base64url) signs under, derived the
+ * way {@link issueScopeStoreEnvelope} derives them. Throws {@link ScopeStoreKeyError} when the key
+ * is unusable, whose message never carries the key.
+ */
+export async function scopeStoreSignerPublicKey(pkcs8) {
+    const { publicKey, kid } = await signingKey(pkcs8);
+    return { publicKey, kid };
+}
+/** A signing key that is present but cannot be used. Its message never carries the key. */
+export class ScopeStoreKeyError extends Error {
+    reason;
+    name = 'ScopeStoreKeyError';
+    constructor(message, reason) {
+        super(message);
+        this.reason = reason;
+    }
+}
+/**
+ * Whether `signature` is the Ed25519 signature of `canonical` under the raw public key.
+ * A malformed key or signature is false.
+ */
+export async function verifyScopeStoreEnvelope(publicKey, canonical, signature) {
+    const keyBytes = base64UrlToBytes(publicKey);
+    const sigBytes = base64UrlToBytes(signature);
+    if (!keyBytes || !sigBytes || sigBytes.length !== 64)
+        return false;
+    try {
+        const key = await crypto.subtle.importKey('raw', copyBytes(keyBytes), { name: 'Ed25519' }, false, ['verify']);
+        return await crypto.subtle.verify('Ed25519', key, copyBytes(sigBytes), new TextEncoder().encode(canonical));
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Build, digest and sign one envelope. `iat` and `nonce` default to now and 16 random bytes.
+ * Throws {@link ScopeStoreKeyError} when the key is unusable, and an Error when a field is.
+ */
+export async function issueScopeStoreEnvelope(input) {
+    const signer = await signingKey(input.privateKey);
+    const envelope = {
+        v: 1,
+        aud: input.aud,
+        kid: signer.kid,
+        script: input.script,
+        name: input.name,
+        op: input.op,
+        digest: await scopeStoreBodyDigest(input.body),
+        iat: input.iat ?? Math.floor(Date.now() / 1000),
+        nonce: input.nonce ?? bytesToBase64Url(crypto.getRandomValues(new Uint8Array(16))),
+    };
+    if (!scopeStoreEnvelopeAdmits(envelope.v, envelope.aud, envelope.op)) {
+        throw new Error(`audience '${envelope.aud}' does not send '${envelope.op}'`);
+    }
+    const canonical = canonicalScopeStoreEnvelope(envelope);
+    const signature = await crypto.subtle.sign('Ed25519', signer.key, new TextEncoder().encode(canonical));
+    return {
+        envelope,
+        canonical,
+        header: bytesToBase64Url(new TextEncoder().encode(canonical)),
+        signature: bytesToBase64Url(new Uint8Array(signature)),
+    };
+}
+/**
+ * Every envelope check a store makes on a call before the driver's class runs (RFC §10.3
+ * checks 1–4, L4, L5), in one place, so a store entry carries no copy. The object binding
+ * (check 5: the object's id is `idFromName` of the signed name) is the entry's, because it
+ * needs the object's id; so is reading the configured keys and script name.
+ *
+ * `script` is the store script's own name, compared with the signed line for equality.
+ * The body must be JSON naming the signed operation as `operation` and the signed object
+ * as `objectName`, so the signed name is the one the driver is asked about.
+ */
+export async function verifyScopeStoreCall(input) {
+    const refuse = (refusal) => ({ ok: false, refusal });
+    if (!input.envelope || !input.signature)
+        return refuse('missing');
+    const bytes = base64UrlToBytes(input.envelope);
+    if (!bytes)
+        return refuse('malformed');
+    let canonical;
+    try {
+        canonical = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+    }
+    catch {
+        return refuse('malformed');
+    }
+    const envelope = parseScopeStoreEnvelope(canonical);
+    if (!envelope)
+        return refuse('malformed');
+    if (!scopeStoreEnvelopeAdmits(envelope.v, envelope.aud, envelope.op))
+        return refuse('audience');
+    // Key ids are over the decoded bytes, so two spellings of one key share an id. A key the
+    // other audience also lists refuses every call: its holder could sign for either (L16).
+    const kidsOf = async (keys) => {
+        const kids = new Map();
+        for (const key of keys) {
+            try {
+                kids.set(await scopeStoreKeyId(key), key);
+            }
+            catch {
+                // A malformed listed key verifies nothing.
+            }
+        }
+        return kids;
+    };
+    const own = await kidsOf(input.keys[envelope.aud]);
+    const other = await kidsOf(input.keys[envelope.aud === 'caller' ? 'platform' : 'caller']);
+    if ([...own.keys()].some((kid) => other.has(kid)))
+        return refuse('keys');
+    const publicKey = own.get(envelope.kid);
+    if (!publicKey)
+        return refuse('kid');
+    if (!(await verifyScopeStoreEnvelope(publicKey, canonical, input.signature)))
+        return refuse('signature');
+    if (envelope.digest !== (await scopeStoreBodyDigest(input.body)))
+        return refuse('digest');
+    if (!scopeStoreEnvelopeFresh(envelope.iat, input.nowSeconds, input.windowSeconds))
+        return refuse('stale');
+    if (envelope.script !== input.script)
+        return refuse('script');
+    let parsed;
+    try {
+        parsed = JSON.parse(input.body);
+    }
+    catch {
+        return refuse('body');
+    }
+    const field = (key) => (typeof parsed === 'object' && parsed !== null ? Reflect.get(parsed, key) : undefined);
+    if (field('operation') !== envelope.op || field('objectName') !== envelope.name)
+        return refuse('body');
+    return { ok: true, envelope };
+}
+//# sourceMappingURL=scope-store-envelope.js.map

package/dist/scope-store-envelope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-store-envelope.js","sourceRoot":"","sources":["../src/scope-store-envelope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAKH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC;AAC9C,MAAM,CAAC,MAAM,mCAAmC,GAAG,EAAE,CAAC;AACtD,oEAAoE;AACpE,MAAM,CAAC,MAAM,2BAA2B,GAAG,2BAA2B,CAAC;AACvE,2DAA2D;AAC3D,MAAM,CAAC,MAAM,4BAA4B,GAAG,4BAA4B,CAAC;AAEzE;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,iBAAiB;IACjB,iBAAiB;IACjB,eAAe;IACf,eAAe;IACf,gBAAgB;CACR,CAAC;AAiBX;;;;GAIG;AACH,MAAM,QAAQ,GAAyF;IACrG,GAAG,EAAE;QACH,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE,CAAE,yBAA+C,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/E,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC;KAC5C;CACF,CAAC;AAEF,mDAAmD;AACnD,MAAM,UAAU,wBAAwB,CAAC,CAAS,EAAE,GAAW,EAAE,EAAU;IACzE,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/F,IAAI,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACjE,OAAO,UAAU,CAAC,GAAyB,CAAC,CAAC,EAAE,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAiB;IAChD,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AACpF,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACtD,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1G,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE;YAAE,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACxE,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,KAAiB;IAClC,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC/C,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAChC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,IAAY,EAAE,MAAc;IACxD,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACrC,OAAO,KAAK,EAAE,MAAM,KAAK,MAAM,IAAI,gBAAgB,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC;AACtE,CAAC;AAED,MAAM,KAAK,GAAG,qBAAqB,CAAC;AACpC,MAAM,GAAG,GAAG,qBAAqB,CAAC;AAClC,MAAM,MAAM,GAAG,gBAAgB,CAAC;AAChC,0FAA0F;AAC1F,MAAM,GAAG,GAAG,qBAAqB,CAAC;AAElC,kFAAkF;AAClF,MAAM,UAAU,2BAA2B,CAAC,QAA4B;IACtE,IAAI,QAAQ,CAAC,CAAC,KAAK,4BAA4B;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;IACjH,KAAK,MAAM,KAAK,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/H,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QAC3E,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,GAAG,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACnI,MAAM,SAAS,GAAG;QAChB,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClB,QAAQ,CAAC,GAAG;QACZ,QAAQ,CAAC,GAAG;QACZ,QAAQ,CAAC,MAAM;QACf,QAAQ,CAAC,IAAI;QACb,QAAQ,CAAC,EAAE;QACX,QAAQ,CAAC,MAAM;QACf,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QACpB,QAAQ,CAAC,KAAK;KACf,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAChG,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,uBAAuB,CAAC,SAAiB;IACvD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACzC,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,KAErE,CAAC;IACF,IAAI,OAAO,KAAK,GAAG,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,UAAU,CAAC;QAAE,OAAO,SAAS,CAAC;IAClF,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,IAAI,CAAC,EAAE;QAAE,OAAO,SAAS,CAAC;IAC9C,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACzG,0FAA0F;IAC1F,iGAAiG;IACjG,IAAI,CAAC,oBAAoB,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,EAAE,CAAC;QAAE,OAAO,SAAS,CAAC;IACxF,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC;AACnF,CAAC;AAED,wDAAwD;AACxD,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAAY;IACrD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACnF,OAAO,CAAC,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC9F,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,uBAAuB,CACrC,GAAW,EACX,UAAkB,EAClB,aAAa,GAAG,mCAAmC;IAEnD,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,IAAI,aAAa,CAAC;AACrD,CAAC;AAED;;;;;GAKG;AACH,MAAM,gBAAgB,GAAG;IACvB,kEAAkE,EAAE,iBAAiB;IACrF,kEAAkE,EAAE,wBAAwB;IAC5F,kEAAkE,EAAE,UAAU;IAC9E,kEAAkE,EAAE,UAAU;IAC9E,kEAAkE,EAAE,qBAAqB;IACzF,kEAAkE,EAAE,2BAA2B;IAC/F,kEAAkE,EAAE,sCAAsC;CAC3G,CAAC;AAEF,uEAAuE;AACvE,SAAS,eAAe,CAAC,KAAiB;IACxC,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxC,QAAQ,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAE,GAAG,IAAI,CAAC;IACpC,MAAM,GAAG,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrF,OAAO,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,SAAiB;IACrD,MAAM,KAAK,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACtG,IAAI,eAAe,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IACzF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IACrE,OAAO,gBAAgB,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAC5D,CAAC;AAKD;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,GAAW;IACpD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IACrC,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,KAAK,EAAE,MAAM,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC;IAC1C,IAAI,eAAe,CAAC,KAAK,CAAC;QAAE,OAAO,aAAa,CAAC;IACjD,sFAAsF;IACtF,IAAI,gBAAgB,CAAC,KAAK,CAAC,KAAK,GAAG;QAAE,OAAO,eAAe,CAAC;IAC5D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,kBAAkB,GAAyD;IAC/E,KAAK,EAAE,wDAAwD;IAC/D,MAAM,EAAE,iDAAiD;IACzD,aAAa,EAAE,2CAA2C;IAC1D,eAAe,EAAE,+CAA+C;CACjE,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAY;IACpD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACtD,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACpF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC;QAChD,IAAI,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;QAC1D,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACzE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAA8D;IACrG,MAAM,MAAM,GAAG,yBAAyB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,yBAAyB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC5D,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC9B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB;IAK7C,MAAM,IAAI,GAAG,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAkB,CAAC;IAC/G,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,UAAU,CAAC,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAgB,CAAC,CAAC,CAAC;IAC9H,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,UAAU,CAAC,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAgB,CAAC,CAAC,CAAC;IAC1H,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;AAC1E,CAAC;AAOD;;;;GAIG;AACH,MAAM,uBAAuB,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAEjI;;;;;GAKG;AACH,KAAK,UAAU,UAAU,CAAC,KAAa;IACrC,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,kBAAkB,CAAC,wCAAwC,EAAE,UAAU,CAAC,CAAC;IAC/F,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,IAAI,uBAAuB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;QACxF,MAAM,IAAI,kBAAkB,CAAC,6DAA6D,EAAE,cAAc,CAAC,CAAC;IAC9G,CAAC;IACD,IAAI,GAAc,CAAC;IACnB,IAAI,CAAU,CAAC;IACf,IAAI,CAAC;QACH,8FAA8F;QAC9F,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;QACpG,CAAC,GAAI,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAAgB,CAAC,CAAC,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,kBAAkB,CAAC,mDAAmD,EAAE,aAAa,CAAC,CAAC;IACnG,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,MAAM,IAAI,kBAAkB,CAAC,0CAA0C,EAAE,gBAAgB,CAAC,CAAC;IACtH,0FAA0F;IAC1F,IAAI,0BAA0B,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,kBAAkB,CAAC,8CAA8C,EAAE,aAAa,CAAC,CAAC;IAC/H,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAAa;IAC3D,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;IACnD,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;AAC5B,CAAC;AAKD,2FAA2F;AAC3F,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAIhC,MAAM;IAHC,IAAI,GAAG,oBAAoB,CAAC;IAC9C,YACE,OAAe,EACN,MAA4B;QAErC,KAAK,CAAC,OAAO,CAAC,CAAC;sBAFN,MAAM;IAGjB,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,SAAiB,EACjB,SAAiB,EACjB,SAAiB;IAEjB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IACnE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC9G,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,SAAS,CAAC,QAAQ,CAAC,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IAC9G,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAWD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAS7C;IACC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAuB;QACnC,CAAC,EAAE,CAAC;QACJ,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,MAAM,EAAE,MAAM,oBAAoB,CAAC,KAAK,CAAC,IAAI,CAAC;QAC9C,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAC/C,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,gBAAgB,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;KACnF,CAAC;IACF,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,aAAa,QAAQ,CAAC,GAAG,oBAAoB,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,SAAS,GAAG,2BAA2B,CAAC,QAAQ,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IACvG,OAAO;QACL,QAAQ;QACR,SAAS;QACT,MAAM,EAAE,gBAAgB,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC7D,SAAS,EAAE,gBAAgB,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;KACvD,CAAC;AACJ,CAAC;AAyBD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAQ1C;IACC,MAAM,MAAM,GAAG,CAAC,OAA0B,EAAyB,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IAC/F,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,SAAS;QAAE,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC;IACvC,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC;IAC7B,CAAC;IACD,MAAM,QAAQ,GAAG,uBAAuB,CAAC,SAAS,CAAC,CAAC;IACpD,IAAI,CAAC,QAAQ;QAAE,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC;IAC1C,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,CAAC;QAAE,OAAO,MAAM,CAAC,UAAU,CAAC,CAAC;IAChG,yFAAyF;IACzF,wFAAwF;IACxF,MAAM,MAAM,GAAG,KAAK,EAAE,IAAuB,EAAE,EAAE;QAC/C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;QACvC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC;gBACH,IAAI,CAAC,GAAG,CAAC,MAAM,eAAe,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;YAC5C,CAAC;YAAC,MAAM,CAAC;gBACP,2CAA2C;YAC7C,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC1F,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;IACzE,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,SAAS;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,CAAC,CAAC,MAAM,wBAAwB,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC;IACzG,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,MAAM,oBAAoB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC1F,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,aAAa,CAAC;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC;IAC1G,IAAI,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC9D,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACtH,IAAI,KAAK,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,EAAE,IAAI,KAAK,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,IAAI;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;IACvG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC"}

package/dist/scope-store-transport.d.ts

@@ -5,7 +5,7 @@ import { z } from 'zod';
  * A vertical fetches `store.substrat.internal`. It names a binding, an operation
  * and an input. It does not name a script, an object or a key: the egress worker
  * hands the call to the router with the dispatch parameters the router set, and
- * the router is what signs the object name and addresses the store script.
+ * the router is what signs the envelope and addresses the store script.
  * `*.substrat.internal` is in no DNS zone, so a call from inside a Durable Object
  * — which an outbound worker does not see — fails instead of leaving the isolate.
  */

package/dist/scope-store-transport.js

@@ -7,7 +7,7 @@ import { RESERVED_STORE_OPERATIONS, storeOperationName } from './deploy.js';
  * A vertical fetches `store.substrat.internal`. It names a binding, an operation
  * and an input. It does not name a script, an object or a key: the egress worker
  * hands the call to the router with the dispatch parameters the router set, and
- * the router is what signs the object name and addresses the store script.
+ * the router is what signs the envelope and addresses the store script.
  * `*.substrat.internal` is in no DNS zone, so a call from inside a Durable Object
  * — which an outbound worker does not see — fails instead of leaving the isolate.
  */
@@ -26,7 +26,7 @@ export const storeCallRequest = z
     .object({
     scopeId,
     binding: z.string().regex(/^[A-Z][A-Z0-9_]*$/),
-    // The same fixed-label rule a log line and a kind's catalog hold (#2245).
+    // The same fixed-label rule a log line and a driver's catalog hold (#2245).
     operation: storeOperationName,
     input: z.unknown().optional(),
 })

package/dist/scope-store-transport.js.map

@@ -1 +1 @@
-{"version":3,"file":"scope-store-transport.js","sourceRoot":"","sources":["../src/scope-store-transport.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AACnC,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAE5E;;;;;;;;;GASG;AAEH,gEAAgE;AAChE,MAAM,CAAC,MAAM,eAAe,GAAG,yBAAyB,CAAC;AAEzD,8FAA8F;AAC9F,MAAM,CAAC,MAAM,cAAc,GAAG,WAAW,eAAe,SAAS,CAAC;AAElE,kFAAkF;AAClF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,QAAgB,EAAW,EAAE,CAC3D,QAAQ,CAAC,WAAW,EAAE,KAAK,eAAe,CAAC;AAE7C;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,OAAO;IACP,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC;IAC9C,0EAA0E;IAC1E,SAAS,EAAE,kBAAkB;IAC7B,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,wFAAwF;AACxF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;AAGhE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAS,yBAAyB,CAAC,CAAC;AAE5D,uFAAuF;AACvF,MAAM,UAAU,mBAAmB,CAAC,SAAiB,EAAE,QAA2B;IAChF,IAAI,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,OAAO,QAAQ,KAAK,UAAU,CAAC;IAC5D,OAAO,QAAQ,KAAK,QAAQ,CAAC;AAC/B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAC,UAAyB,EAAE,SAAiB;IAClF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7C,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC1C,OAAO,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3D,CAAC"}
+{"version":3,"file":"scope-store-transport.js","sourceRoot":"","sources":["../src/scope-store-transport.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AACnC,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAE5E;;;;;;;;;GASG;AAEH,gEAAgE;AAChE,MAAM,CAAC,MAAM,eAAe,GAAG,yBAAyB,CAAC;AAEzD,8FAA8F;AAC9F,MAAM,CAAC,MAAM,cAAc,GAAG,WAAW,eAAe,SAAS,CAAC;AAElE,kFAAkF;AAClF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,QAAgB,EAAW,EAAE,CAC3D,QAAQ,CAAC,WAAW,EAAE,KAAK,eAAe,CAAC;AAE7C;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,OAAO;IACP,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC;IAC9C,4EAA4E;IAC5E,SAAS,EAAE,kBAAkB;IAC7B,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,wFAAwF;AACxF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;AAGhE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAS,yBAAyB,CAAC,CAAC;AAE5D,uFAAuF;AACvF,MAAM,UAAU,mBAAmB,CAAC,SAAiB,EAAE,QAA2B;IAChF,IAAI,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,OAAO,QAAQ,KAAK,UAAU,CAAC;IAC5D,OAAO,QAAQ,KAAK,QAAQ,CAAC;AAC/B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAC,UAAyB,EAAE,SAAiB;IAClF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7C,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC1C,OAAO,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3D,CAAC"}

package/dist/script-names.d.ts

@@ -29,22 +29,33 @@ export declare function verticalScriptStem(slug: string): string;
  * prefix or starts with it, which covers its stable, jurisdictional and per-version scripts.
  */
 export declare const SCOPE_STORE_SCRIPT_PREFIX = "substrat-store-";
-/** A store kind id (L20). No `-` and no `_`, which is what keeps {@link scopeStoreScriptName} injective. */
-export declare const STORE_KIND_ID: RegExp;
+/** A store driver id (L20). No `-` and no `_`, which is what keeps {@link scopeStoreScriptName} injective. */
+export declare const STORE_DRIVER_ID: RegExp;
 /**
- * The script a scope-store kind is uploaded as, for one vertical (#2210).
+ * The script a scope-store driver is uploaded as, for one vertical (#2210).
  *
- * Stable across releases and across the vertical's own pushes: a new release of the kind
+ * Stable across releases and across the vertical's own pushes: a new release of the driver
  * replaces this script in place, and the objects stay where `scopeStoreObjectName` addresses
  * them, since that carries no version either.
  *
- * Injective over (kind, vertical) (L20): `substrat-store-<kind>-<vertical>`, with the `/` of a
- * `<tenant>/<name>` slug written as `_`. A slug never contains `_` and a kind never contains `-`,
- * so the kind ends at the first `-` after the prefix and the rest maps back to exactly one slug.
+ * Injective over (driver, vertical) (L20): `substrat-store-<driver>-<vertical>`, with the `/` of a
+ * `<tenant>/<name>` slug written as `_`. A slug never contains `_` and a driver never contains `-`,
+ * so the driver ends at the first `-` after the prefix and the rest maps back to exactly one slug.
  * A vertical's own stem flattens `/` to `-`, which is not injective; this name does not reuse it.
  * Anything outside those two grammars is refused rather than flattened.
  */
-export declare function scopeStoreScriptName(vertical: string, kind: string): string;
+export declare function scopeStoreScriptName(vertical: string, driver: string): string;
+/**
+ * The vertical segment of the platform's canary script and objects (D-63, #2300). It starts with
+ * `-`, which no vertical slug does, so no vertical's store script or store object is named with it.
+ */
+export declare const SCOPE_STORE_CANARY = "-canary";
+/**
+ * The script a driver's release is canaried in before any vertical runs it (D-63, #2300): the
+ * platform's own, `substrat-store-<driver>--canary`. {@link scopeStoreScriptName} cannot produce it,
+ * because the part after the driver would be a slug starting with `-`.
+ */
+export declare function scopeStoreCanaryScriptName(driver: string): string;
 /**
  * The platform script name a vertical with this slug would deploy under, or `null`. Checks the
  * stable script and its jurisdictional variants. A per-version script ends in a 26-character

package/dist/script-names.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"script-names.d.ts","sourceRoot":"","sources":["../src/script-names.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,iFAAiF;AACjF,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAAgD,CAAC;AAElG,uEAAuE;AACvE,eAAO,MAAM,qBAAqB,EAAE,WAAW,CAAC,MAAM,CAapD,CAAC;AAKH;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,oBAAoB,CAAC;AAE3D,4GAA4G;AAC5G,eAAO,MAAM,aAAa,QAAgB,CAAC;AAK3C;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAQ3E;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAOnE;AAED,wFAAwF;AACxF,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAE7E"}
+{"version":3,"file":"script-names.d.ts","sourceRoot":"","sources":["../src/script-names.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,iFAAiF;AACjF,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAAgD,CAAC;AAElG,uEAAuE;AACvE,eAAO,MAAM,qBAAqB,EAAE,WAAW,CAAC,MAAM,CAapD,CAAC;AAKH;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,oBAAoB,CAAC;AAE3D,8GAA8G;AAC9G,eAAO,MAAM,eAAe,QAAgB,CAAC;AAK7C;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAQ7E;AAED;;;GAGG;AACH,eAAO,MAAM,kBAAkB,YAAY,CAAC;AAE5C;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAKjE;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAOnE;AAED,wFAAwF;AACxF,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAE7E"}

package/dist/script-names.js

@@ -46,31 +46,47 @@ export function verticalScriptStem(slug) {
  * prefix or starts with it, which covers its stable, jurisdictional and per-version scripts.
  */
 export const SCOPE_STORE_SCRIPT_PREFIX = 'substrat-store-';
-/** A store kind id (L20). No `-` and no `_`, which is what keeps {@link scopeStoreScriptName} injective. */
-export const STORE_KIND_ID = /^[a-z0-9]+$/;
+/** A store driver id (L20). No `-` and no `_`, which is what keeps {@link scopeStoreScriptName} injective. */
+export const STORE_DRIVER_ID = /^[a-z0-9]+$/;
 /** The registry id grammar `verticalSlug` parses (ids.ts), repeated so this file imports nothing. */
 const VERTICAL_SLUG = /^([a-z0-9](?:[a-z0-9-]*[a-z0-9])?\/)?[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
 /**
- * The script a scope-store kind is uploaded as, for one vertical (#2210).
+ * The script a scope-store driver is uploaded as, for one vertical (#2210).
  *
- * Stable across releases and across the vertical's own pushes: a new release of the kind
+ * Stable across releases and across the vertical's own pushes: a new release of the driver
  * replaces this script in place, and the objects stay where `scopeStoreObjectName` addresses
  * them, since that carries no version either.
  *
- * Injective over (kind, vertical) (L20): `substrat-store-<kind>-<vertical>`, with the `/` of a
- * `<tenant>/<name>` slug written as `_`. A slug never contains `_` and a kind never contains `-`,
- * so the kind ends at the first `-` after the prefix and the rest maps back to exactly one slug.
+ * Injective over (driver, vertical) (L20): `substrat-store-<driver>-<vertical>`, with the `/` of a
+ * `<tenant>/<name>` slug written as `_`. A slug never contains `_` and a driver never contains `-`,
+ * so the driver ends at the first `-` after the prefix and the rest maps back to exactly one slug.
  * A vertical's own stem flattens `/` to `-`, which is not injective; this name does not reuse it.
  * Anything outside those two grammars is refused rather than flattened.
  */
-export function scopeStoreScriptName(vertical, kind) {
-    if (!STORE_KIND_ID.test(kind)) {
-        throw new Error(`not a scope-store kind id: '${kind}' (expected [a-z0-9]+)`);
+export function scopeStoreScriptName(vertical, driver) {
+    if (!STORE_DRIVER_ID.test(driver)) {
+        throw new Error(`not a scope-store driver id: '${driver}' (expected [a-z0-9]+)`);
     }
     if (!VERTICAL_SLUG.test(vertical)) {
         throw new Error(`not a vertical slug: '${vertical}'`);
     }
-    return `${SCOPE_STORE_SCRIPT_PREFIX}${kind}-${vertical.replace('/', '_')}`;
+    return `${SCOPE_STORE_SCRIPT_PREFIX}${driver}-${vertical.replace('/', '_')}`;
+}
+/**
+ * The vertical segment of the platform's canary script and objects (D-63, #2300). It starts with
+ * `-`, which no vertical slug does, so no vertical's store script or store object is named with it.
+ */
+export const SCOPE_STORE_CANARY = '-canary';
+/**
+ * The script a driver's release is canaried in before any vertical runs it (D-63, #2300): the
+ * platform's own, `substrat-store-<driver>--canary`. {@link scopeStoreScriptName} cannot produce it,
+ * because the part after the driver would be a slug starting with `-`.
+ */
+export function scopeStoreCanaryScriptName(driver) {
+    if (!STORE_DRIVER_ID.test(driver)) {
+        throw new Error(`not a scope-store driver id: '${driver}' (expected [a-z0-9]+)`);
+    }
+    return `${SCOPE_STORE_SCRIPT_PREFIX}${driver}-${SCOPE_STORE_CANARY}`;
 }
 /**
  * The platform script name a vertical with this slug would deploy under, or `null`. Checks the

package/dist/script-names.js.map

@@ -1 +1 @@
-{"version":3,"file":"script-names.js","sourceRoot":"","sources":["../src/script-names.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,iFAAiF;AACjF,MAAM,CAAC,MAAM,mBAAmB,GAAsB,CAAC,iBAAiB,EAAE,sBAAsB,CAAC,CAAC;AAElG,uEAAuE;AACvE,MAAM,CAAC,MAAM,qBAAqB,GAAwB,IAAI,GAAG,CAAC;IAChE,GAAG,mBAAmB;IACtB,sBAAsB;IACtB,kBAAkB;IAClB,wBAAwB;IACxB,6BAA6B;IAC7B,oBAAoB;IACpB,yBAAyB;IACzB,eAAe;IACf,uBAAuB;IACvB,4BAA4B;IAC5B,0BAA0B;IAC1B,+BAA+B;CAChC,CAAC,CAAC;AAEH,sGAAsG;AACtG,MAAM,qBAAqB,GAAG,CAAC,IAAI,EAAE,IAAI,CAAU,CAAC;AAEpD;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AAClF,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,iBAAiB,CAAC;AAE3D,4GAA4G;AAC5G,MAAM,CAAC,MAAM,aAAa,GAAG,aAAa,CAAC;AAE3C,qGAAqG;AACrG,MAAM,aAAa,GAAG,uEAAuE,CAAC;AAE9F;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAgB,EAAE,IAAY;IACjE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,wBAAwB,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,yBAAyB,QAAQ,GAAG,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,GAAG,yBAAyB,GAAG,IAAI,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,yBAAyB,CAAC;QAAE,OAAO,IAAI,CAAC;IAClE,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,EAAE,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAC/E,IAAI,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACnD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,qBAAqB,CAAC,IAAY,EAAE,SAAiB;IACnE,OAAO,kBAAkB,IAAI,yBAAyB,SAAS,iDAAiD,CAAC;AACnH,CAAC"}
+{"version":3,"file":"script-names.js","sourceRoot":"","sources":["../src/script-names.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,iFAAiF;AACjF,MAAM,CAAC,MAAM,mBAAmB,GAAsB,CAAC,iBAAiB,EAAE,sBAAsB,CAAC,CAAC;AAElG,uEAAuE;AACvE,MAAM,CAAC,MAAM,qBAAqB,GAAwB,IAAI,GAAG,CAAC;IAChE,GAAG,mBAAmB;IACtB,sBAAsB;IACtB,kBAAkB;IAClB,wBAAwB;IACxB,6BAA6B;IAC7B,oBAAoB;IACpB,yBAAyB;IACzB,eAAe;IACf,uBAAuB;IACvB,4BAA4B;IAC5B,0BAA0B;IAC1B,+BAA+B;CAChC,CAAC,CAAC;AAEH,sGAAsG;AACtG,MAAM,qBAAqB,GAAG,CAAC,IAAI,EAAE,IAAI,CAAU,CAAC;AAEpD;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AAClF,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,iBAAiB,CAAC;AAE3D,8GAA8G;AAC9G,MAAM,CAAC,MAAM,eAAe,GAAG,aAAa,CAAC;AAE7C,qGAAqG;AACrG,MAAM,aAAa,GAAG,uEAAuE,CAAC;AAE9F;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAgB,EAAE,MAAc;IACnE,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,iCAAiC,MAAM,wBAAwB,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,yBAAyB,QAAQ,GAAG,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,GAAG,yBAAyB,GAAG,MAAM,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;AAC/E,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,SAAS,CAAC;AAE5C;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAAc;IACvD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,iCAAiC,MAAM,wBAAwB,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,GAAG,yBAAyB,GAAG,MAAM,IAAI,kBAAkB,EAAE,CAAC;AACvE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,yBAAyB,CAAC;QAAE,OAAO,IAAI,CAAC;IAClE,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,EAAE,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAC/E,IAAI,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACnD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,qBAAqB,CAAC,IAAY,EAAE,SAAiB;IACnE,OAAO,kBAAkB,IAAI,yBAAyB,SAAS,iDAAiD,CAAC;AACnH,CAAC"}

package/dist/sql-tokens.d.ts

@@ -22,6 +22,13 @@ export interface SqlToken {
     readonly text: string;
     /** A quoted identifier or string literal — never read as a keyword. */
     readonly quoted: boolean;
+    /**
+     * The name's parts as SQLite reads them, each unquoted: `main.n` and `"main"."n"` are
+     * `['main', 'n']`, a schema and a name; `"main.n"` is `['main.n']`, ONE identifier that holds a
+     * dot. `text` joins them and cannot tell the two apart, so a reader deciding which schema a name
+     * is in reads this. Absent on punctuation.
+     */
+    readonly parts?: readonly string[];
     /**
      * One of `( ) , = ;`, present only when asked for (`{ punctuation: true }`). A reader that
      * has to know WHERE in a statement a name sits — an assignment target, a column list — needs

package/dist/sql-tokens.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sql-tokens.d.ts","sourceRoot":"","sources":["../src/sql-tokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,YAAY,cAAc,CAAC;AAExC,MAAM,WAAW,QAAQ;IACvB,mEAAmE;IACnE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,uEAAuE;IACvE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC;CACvB;AAID,4FAA4F;AAC5F,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,QAAQ,EAAE,CAsGjG;AAED,wFAAwF;AACxF,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAErD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAEtD;AAED,gGAAgG;AAChG,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,SAAS,QAAQ,EAAE,GAAG,MAAM,EAAE,CAOxE"}
+{"version":3,"file":"sql-tokens.d.ts","sourceRoot":"","sources":["../src/sql-tokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,YAAY,cAAc,CAAC;AAExC,MAAM,WAAW,QAAQ;IACvB,mEAAmE;IACnE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,uEAAuE;IACvE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC;CACvB;AAID,4FAA4F;AAC5F,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,QAAQ,EAAE,CAsGjG;AAED,wFAAwF;AACxF,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAErD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAEtD;AAED,gGAAgG;AAChG,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,SAAS,QAAQ,EAAE,GAAG,MAAM,EAAE,CAOxE"}