@substrat-run/control-plane-api 0.136.0 → 0.138.0

package/dist/errors.js

@@ -2,106 +2,6 @@ import { errorCodeOf, PROBLEM_CATALOG, problemForStatus, substratError, toProble
 import { SecretBoxUnconfiguredError } from '@substrat-run/kernel';
 import { ControlPlaneError } from '@substrat-run/control-plane-client';
 import { ConnectionRelayError } from './connection-relay.js';
-/**
- * Map a `HostAdmin` throw onto a problem document — #113 phase 4.
- *
- * **The code is read first, and the table below is what is left.** A throw that
- * declared what it is (`substratError`, `PermissionDenied`, anything carrying a
- * `Substrat.<code>` name across the RPC hop) is rendered from its own declaration by
- * `toProblem`, extensions and all. Only a throw that declared nothing reaches the
- * patterns, and each pattern that survives is one more `HostAdmin` throw site nobody
- * has typed yet — a to-do list that shortens, rather than a mapping layer that grows.
- *
- * The table names a CODE now, not a status. The status follows from the catalog, so the
- * two can no longer disagree — and the entry says what the failure IS, which is the
- * thing a reviewer can check against the throw site. `409` was never checkable.
- *
- * What has not changed, and should not:
- *
- * - The patterns are less brittle than they look. Every one is a message the CONTRACT
- *   SUITE asserts on (`/unknown tenant/`, `/illegal scope transition/`, `/already
- *   taken/`, `/not active/`), against both adapters. Changing one turns a contract test
- *   red, not just this mapping. Phase 5 migrates those assertions onto codes and this
- *   table goes with them — **one family at a time, and ten are gone.** `unknown vertical`
- *   went first; `unknown version` followed, its ten throw sites across the two adapters
- *   now saying `substratError('not_found', …)` with the contract suite asserting that
- *   code rather than the sentence, so the row had nothing left to do. `deploy refused:`
- *   is the third, and the first whose throw is not in an adapter at all: its one site
- *   is `assertSandboxContract` in this package's own `deploy.ts`, now `substratError(
- *   'forbidden', …)`, pinned by `test/deploy.test.ts` on the code. `still backs` is the
- *   fourth, and the first that fixed an operator-facing BUG rather than only removing a
- *   row: `deleteVertical` refuses twice, and the row read `/still backs \d+ scope\(s\)/`
- *   — which the archived sentence ("still backs 1 ARCHIVED scope(s) — reap or restore
- *   them first") does not match, because the word sits between the digits and `scope(s)`.
- *   Nothing else caught it, so archiving an app and then deleting its vertical answered
- *   `internal error`. Both branches are typed now and a code cannot miss a reword.
- *   `was rejected — publish a new one` is the fifth: `admitVersion`'s refusal of a rejected
- *   version, one site per adapter, now `substratError('conflict', …)` and pinned on the
- *   code by the contract suite. The sixth to eighth are the registry's own refusals, all in
- *   `host.ts` / `adapter-sqlite` and all `conflict`: `is owned by` (`registerVertical` —
- *   claim-on-first-push, a slug's owner is fixed at first push), `is auto-admitted` (the
- *   publish seam, `setVerticalListed`: prod points at a version only the AUTO admission note
- *   vouches for, so a staff admit is what it names as the way out) and `not admitted`
- *   (`bindScopeVersion` and `promoteVersion` refusing a version that is not admitted).
- *   The ninth and tenth are the last two coordinator-only registry refusals: `is already admitted`
- *   (`rejectVersion` — an admitted version may be bound, so it cannot be un-vouched) and
- *   `belongs to '` (`promoteVersion` — a version promoted through a vertical that does not own
- *   it), now `substratError('conflict', …)` at one site per adapter each.
- *   That is the shape every remaining row is waiting for: type the throws, move the
- *   suite's assertion, delete the row. A row is not removed before its throws are typed —
- *   deleting one early turns its refusal into the generic 500 below.
- *
- *   **What decides whether a row CAN go, and it is not the row:** where its throws live.
- *   Both families removed so far are thrown on the COORDINATOR — `adapter-cloudflare`'s
- *   `host.ts` and `adapter-sqlite` — where the real error object reaches this function and
- *   `errorCodeOf` reads it. A throw raised inside a Durable Object does not arrive that
- *   way. workerd folds `name` into the message and resets it, so a `substratError` thrown
- *   in `scope-do.ts` or `control-plane-do.ts` arrives here as a plain `Error` whose
- *   message has grown a `Substrat.<code>: ` prefix — the code lost, and the sentence no
- *   longer the one that was written (it lands in the SQL console UI). That is measured,
- *   not assumed: see the note on `toRpcError` in `adapter-cloudflare/src/scope-do.ts`,
- *   which also names the fix — structure must travel as a VALUE, the `{ ok, error }`
- *   envelope, not as `name`. So typing a DO-side throw today makes things WORSE, and
- *   roughly half the rows still below are waiting on that envelope rather than on
- *   somebody getting around to them. Check where a family throws before planning its row.
- * - Anything unmatched is a 500 with a GENERIC body: an unrecognised throw is, by
- *   definition, one whose message we have not reviewed for what it discloses, and this
- *   surface has cross-tenant reach.
- *
- * **ORDER IS SIGNIFICANT** — first match wins, so every specific pattern must precede
- * the general one it would otherwise be swallowed by. `cannot provision scope under
- * unknown tenant` contains `unknown tenant:`, and listing the general one first turned a
- * precondition conflict into a 404 claiming POST /scopes does not exist. That is the
- * message-matching fragility this file admits to above, caught by the test below rather
- * than by reading.
- */
-const CODE_PATTERNS = [
-    // Well-formed, but conflicts with current state or references something absent.
-    // The addressed collection exists; the request cannot be applied to it.
-    [/cannot provision scope under unknown tenant/, 'conflict'],
-    [/already taken/, 'conflict'],
-    [/illegal scope transition/, 'conflict'],
-    // #1738: a ScopeDO refusing a projection for a tenant other than the one it was provisioned
-    // for. Thrown inside the DO, so it arrives with the code flattened into the message.
-    [/applyProjection refused/, 'conflict'],
-    [/non-active tenant/, 'conflict'],
-    [/not active \(status:/, 'conflict'],
-    // Registry (#31): well-formed, but conflicts with a version's admission state or
-    // ownership, or needs an unacknowledged change acknowledged (the two checkpoints).
-    [/is already registered/, 'conflict'],
-    [/acknowledge it explicitly to promote/, 'conflict'],
-    // The ADDRESSED resource does not exist — including the K-3 fail-closed case
-    // where it exists under a DIFFERENT tenant and must read as absent.
-    [/unknown tenant:/, 'not_found'],
-    [/unknown scope for tenant/, 'not_found'],
-    [/unknown scope /, 'not_found'],
-    // A read-only introspection read (§5.4) for a table the scope's schema does not have.
-    [/unknown table /, 'not_found'],
-    // The SQL console's gate (#219) refused the statement — a malformed request, not a
-    // server fault. The prefix is pinned by the contract suite against both adapters.
-    [/read-only console/, 'validation_failed'],
-    [/scope has no tenant record/, 'not_found'],
-];
 /** A body built from a code this layer decided, rather than one the throw declared. */
 const coded = (code, message) => ({
     status: PROBLEM_CATALOG[code].status,
@@ -112,6 +12,29 @@ const relayed = (status, message) => ({
     status: status,
     body: problemForStatus(status, message),
 });
+/**
+ * Map a `HostAdmin` throw onto a problem document — #113.
+ *
+ * **The code decides, and nothing else does.** A throw that declared what it is
+ * (`substratError`, `PermissionDenied`, anything carrying a `Substrat.<code>` name) is
+ * rendered from its own declaration by `toProblem`, extensions and all. There is no
+ * message table behind it any more: every `HostAdmin` refusal that used to reach one is
+ * typed at its throw site, on both adapters, and the contract suite asserts the code
+ * rather than the sentence. The last fourteen rows went together, so a reworded refusal
+ * can no longer slip past the table into the generic 500, or be caught by the wrong row.
+ *
+ * Where the throw is raised inside a Durable Object, its code does not survive being
+ * THROWN across the hop: workerd folds `name` into the message and drops every own
+ * property. Those refusals travel as a value instead — the DO answers a `DoReply`
+ * (`adapter-cloudflare/src/do-reply.ts`) or a refusal record, and the coordinator throws
+ * it, typed, on this side. So a new DO-side refusal needs that envelope as well as its
+ * code, or it arrives here untyped.
+ *
+ * Anything untyped is a 500 with a GENERIC body: an unrecognised throw is, by
+ * definition, one whose message we have not reviewed for what it discloses, and this
+ * surface has cross-tenant reach. That is also what makes a new untyped refusal VISIBLE:
+ * it answers `internal error` in its first test, rather than being quietly matched.
+ */
 export function mapError(err) {
     // A ControlPlaneError is a DELIBERATE downstream answer, not an unreviewed throw —
     // the VerticalClient wraps the vertical's own JSON status/message in it. Passing it
@@ -152,19 +75,13 @@ export function mapError(err) {
     // screen alone.
     if (err instanceof ConnectionRelayError)
         return relayed(err.status, err.message);
-    // THE CODE, FIRST (#113 phase 4). A throw that declared what it is renders from its own
-    // declaration — extensions included, so a `conflict` arrives carrying the `reason` the
-    // engine narrowed it with, and a parse failure its field list. Everything below this
-    // line is a throw site nobody has typed yet.
+    // THE CODE (#113). A throw that declared what it is renders from its own declaration —
+    // extensions included, so a `conflict` arrives carrying the `reason` the engine narrowed
+    // it with, and a parse failure its field list.
     const declared = errorCodeOf(err);
     if (declared !== undefined && err instanceof Error) {
         return { status: PROBLEM_CATALOG[declared].status, body: toProblem(err) };
     }
-    const message = err instanceof Error ? err.message : String(err);
-    for (const [pattern, code] of CODE_PATTERNS) {
-        if (pattern.test(message))
-            return coded(code, message);
-    }
     // The generic 500. `toProblem` refuses to disclose the message — that is the rule, and
     // this surface has cross-tenant reach — so the body carries no `detail`. The deprecated
     // `error` duplicate is set by hand to the same constant this branch has always

package/dist/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AACA,OAAO,EACL,WAAW,EACX,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,SAAS,GAGV,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAE7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwEG;AACH,MAAM,aAAa,GAAmC;IACpD,gFAAgF;IAChF,wEAAwE;IACxE,CAAC,6CAA6C,EAAE,UAAU,CAAC;IAC3D,CAAC,eAAe,EAAE,UAAU,CAAC;IAC7B,CAAC,0BAA0B,EAAE,UAAU,CAAC;IACxC,4FAA4F;IAC5F,qFAAqF;IACrF,CAAC,yBAAyB,EAAE,UAAU,CAAC;IACvC,CAAC,mBAAmB,EAAE,UAAU,CAAC;IACjC,CAAC,sBAAsB,EAAE,UAAU,CAAC;IACpC,iFAAiF;IACjF,mFAAmF;IACnF,CAAC,uBAAuB,EAAE,UAAU,CAAC;IACrC,CAAC,sCAAsC,EAAE,UAAU,CAAC;IACpD,6EAA6E;IAC7E,oEAAoE;IACpE,CAAC,iBAAiB,EAAE,WAAW,CAAC;IAChC,CAAC,0BAA0B,EAAE,WAAW,CAAC;IACzC,CAAC,gBAAgB,EAAE,WAAW,CAAC;IAC/B,sFAAsF;IACtF,CAAC,gBAAgB,EAAE,WAAW,CAAC;IAC/B,mFAAmF;IACnF,kFAAkF;IAClF,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;IAC1C,CAAC,4BAA4B,EAAE,WAAW,CAAC;CAC5C,CAAC;AAOF,uFAAuF;AACvF,MAAM,KAAK,GAAG,CAAC,IAAe,EAAE,OAAe,EAAY,EAAE,CAAC,CAAC;IAC7D,MAAM,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC,MAA8B;IAC5D,IAAI,EAAE,SAAS,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;CAC9C,CAAC,CAAC;AAEH,0FAA0F;AAC1F,MAAM,OAAO,GAAG,CAAC,MAAc,EAAE,OAAe,EAAY,EAAE,CAAC,CAAC;IAC9D,MAAM,EAAE,MAA8B;IACtC,IAAI,EAAE,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC;CACxC,CAAC,CAAC;AAEH,MAAM,UAAU,QAAQ,CAAC,GAAY;IACnC,mFAAmF;IACnF,oFAAoF;IACpF,iFAAiF;IACjF,oFAAoF;IACpF,sFAAsF;IACtF,yFAAyF;IACzF,EAAE;IACF,qFAAqF;IACrF,+DAA+D;IAC/D,IAAI,GAAG,YAAY,iBAAiB;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC9E,oFAAoF;IACpF,sFAAsF;IACtF,qFAAqF;IACrF,wFAAwF;IACxF,wFAAwF;IACxF,EAAE;IACF,sFAAsF;IACtF,6EAA6E;IAC7E,qFAAqF;IACrF,qFAAqF;IACrF,mFAAmF;IACnF,uEAAuE;IACvE,EAAE;IACF,4EAA4E;IAC5E,uFAAuF;IACvF,2FAA2F;IAC3F,wFAAwF;IACxF,qDAAqD;IACrD,IAAI,GAAG,YAAY,0BAA0B,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,aAAa,EAAE,CAAC;QACpF,OAAO,KAAK,CAAC,aAAa,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAChF,CAAC;IACD,uFAAuF;IACvF,uFAAuF;IACvF,+EAA+E;IAC/E,qFAAqF;IACrF,gBAAgB;IAChB,IAAI,GAAG,YAAY,oBAAoB;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAEjF,wFAAwF;IACxF,uFAAuF;IACvF,qFAAqF;IACrF,6CAA6C;IAC7C,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,QAAQ,KAAK,SAAS,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;QACnD,OAAO,EAAE,MAAM,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAC,MAA8B,EAAE,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;IACpG,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,KAAK,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,aAAa,EAAE,CAAC;QAC5C,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACzD,CAAC;IACD,uFAAuF;IACvF,wFAAwF;IACxF,+EAA+E;IAC/E,uFAAuF;IACvF,4DAA4D;IAC5D,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,CAAC;AAC/E,CAAC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AACA,OAAO,EACL,WAAW,EACX,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,SAAS,GAGV,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAO7D,uFAAuF;AACvF,MAAM,KAAK,GAAG,CAAC,IAAe,EAAE,OAAe,EAAY,EAAE,CAAC,CAAC;IAC7D,MAAM,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC,MAA8B;IAC5D,IAAI,EAAE,SAAS,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;CAC9C,CAAC,CAAC;AAEH,0FAA0F;AAC1F,MAAM,OAAO,GAAG,CAAC,MAAc,EAAE,OAAe,EAAY,EAAE,CAAC,CAAC;IAC9D,MAAM,EAAE,MAA8B;IACtC,IAAI,EAAE,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC;CACxC,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,QAAQ,CAAC,GAAY;IACnC,mFAAmF;IACnF,oFAAoF;IACpF,iFAAiF;IACjF,oFAAoF;IACpF,sFAAsF;IACtF,yFAAyF;IACzF,EAAE;IACF,qFAAqF;IACrF,+DAA+D;IAC/D,IAAI,GAAG,YAAY,iBAAiB;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC9E,oFAAoF;IACpF,sFAAsF;IACtF,qFAAqF;IACrF,wFAAwF;IACxF,wFAAwF;IACxF,EAAE;IACF,sFAAsF;IACtF,6EAA6E;IAC7E,qFAAqF;IACrF,qFAAqF;IACrF,mFAAmF;IACnF,uEAAuE;IACvE,EAAE;IACF,4EAA4E;IAC5E,uFAAuF;IACvF,2FAA2F;IAC3F,wFAAwF;IACxF,qDAAqD;IACrD,IAAI,GAAG,YAAY,0BAA0B,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,aAAa,EAAE,CAAC;QACpF,OAAO,KAAK,CAAC,aAAa,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAChF,CAAC;IACD,uFAAuF;IACvF,uFAAuF;IACvF,+EAA+E;IAC/E,qFAAqF;IACrF,gBAAgB;IAChB,IAAI,GAAG,YAAY,oBAAoB;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAEjF,uFAAuF;IACvF,yFAAyF;IACzF,+CAA+C;IAC/C,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,QAAQ,KAAK,SAAS,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;QACnD,OAAO,EAAE,MAAM,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAC,MAA8B,EAAE,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;IACpG,CAAC;IAED,uFAAuF;IACvF,wFAAwF;IACxF,+EAA+E;IAC/E,uFAAuF;IACvF,4DAA4D;IAC5D,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,CAAC;AAC/E,CAAC"}

package/dist/field-coverage-tally.d.ts

@@ -0,0 +1,58 @@
+/** How often one declared field was carried, across the responses counted. */
+export interface FieldCoverageCount {
+    field: string;
+    /** Carried with a value. */
+    present: number;
+    /** Carried as `null`. */
+    empty: number;
+    /** Not carried. */
+    absent: number;
+}
+/** One operation's counts. `responses` is how many reports were counted for it. */
+export interface OperationFieldCoverage {
+    operation: string;
+    responses: number;
+    /** In first-seen order, which for a well-behaved vertical is declaration order. */
+    fields: FieldCoverageCount[];
+}
+export interface FieldCoverageTally {
+    /** The tenant the caller asked about — echoed, so a view never has to take it from a line. */
+    tenantId: string;
+    /** By operation name. */
+    operations: OperationFieldCoverage[];
+    /**
+     * This tenant's lines, from this app's scripts, whose report was refused (malformed, over a
+     * cap, or naming an undeclared field). Lines of other tenants or other scripts are not in
+     * it. A view shows it so a refused report reads as refused, not as "never returned".
+     */
+    refused: number;
+}
+/** What the tally is for. Every field is the CALLER's resolution, never a line's. */
+export interface FieldCoverageScope {
+    /** The tenant, forced from the principal the way every tenant read forces it. */
+    tenantId: string;
+    /** The app's vertical slug, as the router resolves it onto its line (`vertical`). */
+    vertical: string;
+    /** The app's script family stems. Empty names no script, so nothing counts. */
+    services: readonly string[];
+    /**
+     * The declared output field names per operation, when the caller has the manifest. A report
+     * on an operation not in this map, or naming a field outside its list, is refused.
+     */
+    declared?: Readonly<Record<string, readonly string[]>>;
+}
+/**
+ * How many distinct operations one tally keeps. Past it, a report on a new operation is
+ * refused: a vertical cannot grow the answer without bound by inventing names.
+ */
+export declare const FIELD_COVERAGE_OPERATIONS_MAX = 1000;
+/**
+ * Tally the field coverage in `events` — raw Workers Logs events (`{ source, $metadata }`), as
+ * the telemetry query returns them — for one tenant and one app, counting only the reports
+ * whose dispatch id `routerEvents` (the router's own request lines) vouches for.
+ *
+ * The query that fetched them should already filter on both; this checks them again, because
+ * the tally is the thing a view trusts, and a query is one forgotten parameter from fleet-wide.
+ */
+export declare function tallyFieldCoverage(events: Iterable<unknown>, routerEvents: Iterable<unknown>, scope: FieldCoverageScope): FieldCoverageTally;
+//# sourceMappingURL=field-coverage-tally.d.ts.map

package/dist/field-coverage-tally.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"field-coverage-tally.d.ts","sourceRoot":"","sources":["../src/field-coverage-tally.ts"],"names":[],"mappings":"AAuDA,8EAA8E;AAC9E,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,4BAA4B;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,yBAAyB;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,mBAAmB;IACnB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,mFAAmF;AACnF,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,mFAAmF;IACnF,MAAM,EAAE,kBAAkB,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,kBAAkB;IACjC,8FAA8F;IAC9F,QAAQ,EAAE,MAAM,CAAC;IACjB,yBAAyB;IACzB,UAAU,EAAE,sBAAsB,EAAE,CAAC;IACrC;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,qFAAqF;AACrF,MAAM,WAAW,kBAAkB;IACjC,iFAAiF;IACjF,QAAQ,EAAE,MAAM,CAAC;IACjB,qFAAqF;IACrF,QAAQ,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;CACxD;AAgCD;;;GAGG;AACH,eAAO,MAAM,6BAA6B,OAAO,CAAC;AAyBlD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,EACzB,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,EAC/B,KAAK,EAAE,kBAAkB,GACxB,kBAAkB,CAqGpB"}

package/dist/field-coverage-tally.js

@@ -0,0 +1,234 @@
+/**
+ * The one sanctioned reading of `outputFields` (#1923 part c): per-(operation, field) counts for
+ * ONE tenant, from the stamped invocation lines its app's scripts wrote, joined to the router's
+ * own line for each request.
+ *
+ * ## Why the reading needs rules at all
+ *
+ * The report on a line is written by the vertical's own code, like `operation` and
+ * `problemCode` on the router's header. A vertical can mislabel its own responses, and it can
+ * `console.log` a line that looks exactly like the platform's, naming any tenant id it likes.
+ * So nothing on a line is taken as given except what the reader resolved itself:
+ *
+ * - **The tenant is the caller's, never the line's.** `tenantId` is required, and there is no
+ *   "every tenant" spelling.
+ * - **The tenant and app a report counts for are the ROUTER's.** A report counts only when
+ *   its `fieldCoverageId` — the dispatch id the router armed the walk with — matches the
+ *   router's own line for that request, and that line names this tenant and this app. Router
+ *   lines are read from the router's scripts only (`ROUTER_SCRIPT_NAMES`, by
+ *   `$metadata.service`, which the log platform stamps). A vertical cannot log under those
+ *   names: a slug that would deploy under any platform script name is refused at
+ *   registration and at deploy (`platformScriptCollision`), from the same list. Workers Logs
+ *   carry no field that tells a dispatch-namespace script from a top-level worker that this
+ *   reader could check instead, so the reserved names are the whole of that guarantee. A vertical serving tenants A and
+ *   B that writes a report naming B during A's request has only A's id to give it, which joins
+ *   to A; an invented id joins to nothing. Each id counts once.
+ * - **The script is the app's.** A vertical line counts only if one of the app's own script
+ *   families wrote it, which keeps one app's lines out of another's tally before the join.
+ * - **Silence about other tenants.** A line that does not join is dropped without trace —
+ *   not counted as refused — since a count of someone else's lines is a fact about them.
+ *
+ * What remains is the accepted residual: a vertical can mislabel the report of a response it
+ * actually served for that tenant, the same way it can mislabel `operation`.
+ * - **Names are bounded, and declared when the caller can say so.** A report is refused whole
+ *   when it is not three string arrays, names a field twice, names more than the declared
+ *   half's cap, or names a field longer than an operation name may be. Given the operation's
+ *   declared output (`declared`), a report naming anything outside it is refused too, so a
+ *   vertical cannot grow the tally with names its own declaration never had.
+ *
+ * ## Why aggregate only
+ *
+ * One report is a fact about one response, and the line it rides also carries a path that
+ * can name a record (`/customers/{id}`): "this customer's `phone` is null". The question field
+ * coverage asks is "is this field ever returned", and a count answers it without holding a
+ * fact about any one record. So the tally keeps counts per (operation, field) and the number
+ * of responses behind them, and nothing per request: no path, scope, time, invocation id or
+ * value. It does not pass any of those through, so a view built on it cannot either.
+ *
+ * Every count is per response serialisation, never per row: a paged read of 200 rows is one
+ * response (#1331).
+ */
+import { DECLARED_OUTPUT_FIELDS_MAX, FIELD_COVERAGE_ID_FIELD, INVOCATION_RECORD_FIELD_MAX, ROUTER_SCRIPT_NAMES } from '@substrat-run/contracts';
+import { ownsInvocation } from './cf-observability.js';
+import { serviceFamilyMatcher } from './service-family.js';
+/** A dispatch id: the ULID the router mints for a sampled request. */
+const DISPATCH_ID = /^[0-9A-HJKMNP-TV-Z]{26}$/;
+/** The service a raw event was logged by, as the log platform stamped it. */
+function serviceOf(event) {
+    const metadata = event['$metadata'];
+    return metadata && typeof metadata === 'object' ? metadata['service'] : undefined;
+}
+/**
+ * The dispatch ids the router minted for THIS tenant's requests to THIS app, from the
+ * router's own request lines (`router: 'request'`). Anything not logged by a router service is
+ * ignored, whatever it says.
+ */
+function dispatchIdsFor(routerEvents, scope) {
+    const ids = new Set();
+    for (const event of routerEvents) {
+        if (event === null || typeof event !== 'object')
+            continue;
+        const service = serviceOf(event);
+        if (typeof service !== 'string' || !ROUTER_SCRIPT_NAMES.includes(service))
+            continue;
+        const source = event['source'];
+        if (source === null || typeof source !== 'object')
+            continue;
+        const line = source;
+        if (line['router'] !== 'request' || line['tenantId'] !== scope.tenantId || line['vertical'] !== scope.vertical)
+            continue;
+        const id = line[FIELD_COVERAGE_ID_FIELD];
+        if (typeof id === 'string' && DISPATCH_ID.test(id))
+            ids.add(id);
+    }
+    return ids;
+}
+/**
+ * How many distinct operations one tally keeps. Past it, a report on a new operation is
+ * refused: a vertical cannot grow the answer without bound by inventing names.
+ */
+export const FIELD_COVERAGE_OPERATIONS_MAX = 1000;
+/** The report's buckets — the writer's own shape, so a renamed bucket is a compile error here. */
+const BUCKETS = ['present', 'empty', 'absent'];
+/** A report's three name lists, or `undefined` when it is not a well-formed one. */
+function namesOf(report, allowed) {
+    if (report === null || typeof report !== 'object' || Array.isArray(report))
+        return undefined;
+    const seen = new Set();
+    const out = { present: [], empty: [], absent: [] };
+    for (const bucket of BUCKETS) {
+        const list = report[bucket];
+        if (!Array.isArray(list))
+            return undefined;
+        for (const name of list) {
+            if (typeof name !== 'string' || name.length === 0 || name.length > INVOCATION_RECORD_FIELD_MAX)
+                return undefined;
+            if (seen.has(name))
+                return undefined;
+            if (allowed && !allowed.has(name))
+                return undefined;
+            seen.add(name);
+            out[bucket].push(name);
+        }
+    }
+    if (seen.size === 0 || seen.size > DECLARED_OUTPUT_FIELDS_MAX)
+        return undefined;
+    return out;
+}
+/**
+ * Tally the field coverage in `events` — raw Workers Logs events (`{ source, $metadata }`), as
+ * the telemetry query returns them — for one tenant and one app, counting only the reports
+ * whose dispatch id `routerEvents` (the router's own request lines) vouches for.
+ *
+ * The query that fetched them should already filter on both; this checks them again, because
+ * the tally is the thing a view trusts, and a query is one forgotten parameter from fleet-wide.
+ */
+export function tallyFieldCoverage(events, routerEvents, scope) {
+    if (typeof scope.tenantId !== 'string' || scope.tenantId.length === 0) {
+        throw new TypeError('a field-coverage tally is for one tenant, and names it');
+    }
+    if (typeof scope.vertical !== 'string' || scope.vertical.length === 0) {
+        throw new TypeError('a field-coverage tally is for one app, and names it');
+    }
+    const ownService = serviceFamilyMatcher(scope.services);
+    // #1923: an app whose own scripts would be named like the router's has no provenance to
+    // join to — its lines and the router's are one set. Registration and deploy refuse such a
+    // slug; a registry entry that predates the rule is refused here rather than trusted.
+    const shadowed = ROUTER_SCRIPT_NAMES.find((name) => ownService(name));
+    if (shadowed) {
+        throw new TypeError(`a field-coverage tally cannot trust router lines for an app whose scripts are named like '${shadowed}'`);
+    }
+    const dispatched = dispatchIdsFor(routerEvents, scope);
+    const counted = new Set();
+    const operations = new Map();
+    // Each operation's declared names as a set, built the first time a report needs it.
+    const declaredSets = new Map();
+    let refused = 0;
+    for (const event of events) {
+        if (event === null || typeof event !== 'object')
+            continue;
+        // The same isolation predicate the tenant log reads use: a stamped line naming this tenant.
+        if (!ownsInvocation(event, { tenantId: scope.tenantId }))
+            continue;
+        const line = event.source;
+        if (!ownService(serviceOf(event)))
+            continue;
+        // A line with no report was not walked (unarmed, failed, or nothing declared): no data.
+        if (!('outputFields' in line))
+            continue;
+        // The provenance: the router minted this id for this tenant's request to this app. A line
+        // that does not join is not this tenant's as far as anything trusted says, and is dropped
+        // as silently as a line naming another tenant.
+        const id = line[FIELD_COVERAGE_ID_FIELD];
+        if (typeof id !== 'string' || !dispatched.has(id))
+            continue;
+        // From here the line is this tenant's, from this app: a bad report is the app's own fault,
+        // and is counted as refused rather than ignored. So is a second report on one dispatch id:
+        // one request is one response, and the first report on it is the one that counts.
+        if (counted.has(id)) {
+            refused++;
+            continue;
+        }
+        counted.add(id);
+        const operation = line['operation'];
+        // An async line (`kind`) has no response to report on, whatever it says.
+        if (line['kind'] !== undefined || typeof operation !== 'string' || operation.length === 0 || operation.length > INVOCATION_RECORD_FIELD_MAX) {
+            refused++;
+            continue;
+        }
+        let allowed;
+        if (scope.declared) {
+            if (!Object.hasOwn(scope.declared, operation)) {
+                refused++;
+                continue;
+            }
+            allowed = declaredSets.get(operation);
+            if (!allowed)
+                declaredSets.set(operation, (allowed = new Set(scope.declared[operation])));
+        }
+        const names = namesOf(line['outputFields'], allowed);
+        if (!names) {
+            refused++;
+            continue;
+        }
+        let entry = operations.get(operation);
+        if (!entry) {
+            if (operations.size >= FIELD_COVERAGE_OPERATIONS_MAX) {
+                refused++;
+                continue;
+            }
+            entry = { responses: 0, fields: new Map() };
+        }
+        // The field cap holds per operation across reports too, so a vertical naming a different
+        // field each time cannot grow one operation past what one declaration could hold.
+        let fresh = 0;
+        for (const bucket of BUCKETS)
+            for (const field of names[bucket])
+                if (!entry.fields.has(field))
+                    fresh++;
+        if (entry.fields.size + fresh > DECLARED_OUTPUT_FIELDS_MAX) {
+            refused++;
+            continue;
+        }
+        operations.set(operation, entry);
+        entry.responses++;
+        for (const bucket of BUCKETS) {
+            for (const field of names[bucket]) {
+                let count = entry.fields.get(field);
+                if (!count) {
+                    count = { field, present: 0, empty: 0, absent: 0 };
+                    entry.fields.set(field, count);
+                }
+                count[bucket]++;
+            }
+        }
+    }
+    return {
+        tenantId: scope.tenantId,
+        operations: [...operations]
+            .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
+            .map(([operation, e]) => ({ operation, responses: e.responses, fields: [...e.fields.values()] })),
+        refused,
+    };
+}
+//# sourceMappingURL=field-coverage-tally.js.map

package/dist/field-coverage-tally.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"field-coverage-tally.js","sourceRoot":"","sources":["../src/field-coverage-tally.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,OAAO,EAAE,0BAA0B,EAAE,uBAAuB,EAAE,2BAA2B,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAEhJ,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAiD3D,sEAAsE;AACtE,MAAM,WAAW,GAAG,0BAA0B,CAAC;AAE/C,6EAA6E;AAC7E,SAAS,SAAS,CAAC,KAAa;IAC9B,MAAM,QAAQ,GAAI,KAAiC,CAAC,WAAW,CAAC,CAAC;IACjE,OAAO,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAE,QAAoC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACjH,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,YAA+B,EAAE,KAAyB;IAChF,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;QACjC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS;QAC1D,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACpF,MAAM,MAAM,GAAI,KAAiC,CAAC,QAAQ,CAAC,CAAC;QAC5D,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,SAAS;QAC5D,MAAM,IAAI,GAAG,MAAiC,CAAC;QAC/C,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,KAAK,CAAC,QAAQ;YAAE,SAAS;QACzH,MAAM,EAAE,GAAG,IAAI,CAAC,uBAAuB,CAAC,CAAC;QACzC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,IAAI,CAAC;AAElD,kGAAkG;AAClG,MAAM,OAAO,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,CAA4D,CAAC;AAE1G,oFAAoF;AACpF,SAAS,OAAO,CAAC,MAAe,EAAE,OAAwC;IACxE,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7F,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAuB,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACvE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAI,MAAkC,CAAC,MAAM,CAAC,CAAC;QACzD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QAC3C,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;YACxB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,2BAA2B;gBAAE,OAAO,SAAS,CAAC;YACjH,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YACrC,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YACpD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACf,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,0BAA0B;QAAE,OAAO,SAAS,CAAC;IAChF,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAyB,EACzB,YAA+B,EAC/B,KAAyB;IAEzB,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,SAAS,CAAC,wDAAwD,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,SAAS,CAAC,qDAAqD,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,UAAU,GAAG,oBAAoB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACxD,wFAAwF;IACxF,0FAA0F;IAC1F,qFAAqF;IACrF,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IACtE,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,IAAI,SAAS,CAAC,6FAA6F,QAAQ,GAAG,CAAC,CAAC;IAChI,CAAC;IACD,MAAM,UAAU,GAAG,cAAc,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,UAAU,GAAG,IAAI,GAAG,EAA0E,CAAC;IACrG,oFAAoF;IACpF,MAAM,YAAY,GAAG,IAAI,GAAG,EAA+B,CAAC;IAC5D,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS;QAC1D,4FAA4F;QAC5F,IAAI,CAAC,cAAc,CAAC,KAAgC,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;YAAE,SAAS;QAC9F,MAAM,IAAI,GAAI,KAA6C,CAAC,MAAM,CAAC;QACnE,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAAE,SAAS;QAC5C,wFAAwF;QACxF,IAAI,CAAC,CAAC,cAAc,IAAI,IAAI,CAAC;YAAE,SAAS;QACxC,0FAA0F;QAC1F,0FAA0F;QAC1F,+CAA+C;QAC/C,MAAM,EAAE,GAAG,IAAI,CAAC,uBAAuB,CAAC,CAAC;QACzC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,SAAS;QAE5D,2FAA2F;QAC3F,2FAA2F;QAC3F,kFAAkF;QAClF,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YACpB,OAAO,EAAE,CAAC;YACV,SAAS;QACX,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;QACpC,yEAAyE;QACzE,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,2BAA2B,EAAE,CAAC;YAC5I,OAAO,EAAE,CAAC;YACV,SAAS;QACX,CAAC;QACD,IAAI,OAAwC,CAAC;QAC7C,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACnB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;gBAC9C,OAAO,EAAE,CAAC;gBACV,SAAS;YACX,CAAC;YACD,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACtC,IAAI,CAAC,OAAO;gBAAE,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5F,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,CAAC;YACV,SAAS;QACX,CAAC;QACD,IAAI,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,UAAU,CAAC,IAAI,IAAI,6BAA6B,EAAE,CAAC;gBACrD,OAAO,EAAE,CAAC;gBACV,SAAS;YACX,CAAC;YACD,KAAK,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;QAC9C,CAAC;QACD,yFAAyF;QACzF,kFAAkF;QAClF,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,MAAM,IAAI,OAAO;YAAE,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;gBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;oBAAE,KAAK,EAAE,CAAC;QACvG,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,GAAG,KAAK,GAAG,0BAA0B,EAAE,CAAC;YAC3D,OAAO,EAAE,CAAC;YACV,SAAS;QACX,CAAC;QACD,UAAU,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACjC,KAAK,CAAC,SAAS,EAAE,CAAC;QAClB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;gBAClC,IAAI,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBACpC,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,KAAK,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;oBACnD,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;gBACjC,CAAC;gBACD,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,UAAU,EAAE,CAAC,GAAG,UAAU,CAAC;aACxB,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;aAChD,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACnG,OAAO;KACR,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -16,7 +16,7 @@ export { retireAllPreviewClients, retireClientsOfReapedScope, tenantIssuers, wir
 export type { PreviewAuthDeps, WirePreviewAuthInput } from './preview-auth.js';
 export type { ScopeDeployment, ScopeDeploymentVia } from './scope-deployment.js';
 export { drainScopePlatformRequests, MAX_PLATFORM_REQUEST_ATTEMPTS, provisionSiblingScope, provisionSiblingHandler, archiveScopeHandler, peerInvokeHandler, provisionTenantHandler, setEntitlementsHandler, modelUsageHandler, sweepRunsHandler, connectorDispatchHandler, type ConnectorDispatchDeps, type ManagedTenantDeps, type PlatformDrainOptions, type ArchiveScopeDeps, type PlatformRequestHandler, type PlatformDrainContext, type PlatformRequestContext, type PlatformRequestOutcome, type PlatformDrainReport, type PeerInvokeDeps, type ProvisionSiblingDeps, type ProvisionSiblingInput, type ProvisionSiblingResult, } from './platform-drain.js';
-export { reconcilePayloadFor, reconcileThenReassert } from './reconcile.js';
+export { reconcilePayloadFor, reconcileThenReassert, switchCarryFor, type SwitchCarry } from './reconcile.js';
 export type { ReconcilePayload, ReconcileGatherAdmin } from './reconcile.js';
 export { attributeFailure, terminalFailureNote } from './failure-attribution.js';
 export { isTerminalDispatchFailure, isTerminalProviderError, providerErrorStatus, RETRYABLE_CLIENT_STATUSES, } from './provider-error.js';
@@ -37,6 +37,8 @@ export type { PlatformRuntime } from './platform-runtime.js';
 export { createCfDoNamespaceReader, namespacesForScript } from './do-namespaces.js';
 export type { DoNamespaceReader, DoNamespaceRecord, CfDoNamespaceOptions } from './do-namespaces.js';
 export { createCfObservabilityReader } from './cf-observability.js';
+export { tallyFieldCoverage, FIELD_COVERAGE_OPERATIONS_MAX } from './field-coverage-tally.js';
+export type { FieldCoverageTally, FieldCoverageScope, OperationFieldCoverage, FieldCoverageCount } from './field-coverage-tally.js';
 export { cachedSource, memoryCubeStore, grainFor, blockMsFor, CLOSE_LAG_MS } from './aggregate-source.js';
 export type { AggregateSource, Cube, CubeQuery, CubeStore, StoredBlock, RequestCubeRow, PatternCubeRow } from './aggregate-source.js';
 export { aggregateReads } from './aggregate-reads.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,UAAU,CAAC;AAClB,YAAY,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAC5E,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,aAAa,EACb,2BAA2B,EAC3B,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,EAChB,cAAc,GACf,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AACjH,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACzE,YAAY,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,EACL,yBAAyB,EACzB,KAAK,4BAA4B,EACjC,KAAK,8BAA8B,GACpC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACrG,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACxF,YAAY,EACV,iBAAiB,EACjB,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,EACf,WAAW,EACX,qBAAqB,EACrB,iBAAiB,EACjB,SAAS,GACV,MAAM,WAAW,CAAC;AAGnB,cAAc,cAAc,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAG/D,OAAO,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACxH,YAAY,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAC/E,YAAY,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AACjF,OAAO,EACL,0BAA0B,EAC1B,6BAA6B,EAC7B,qBAAqB,EACrB,uBAAuB,EACvB,mBAAmB,EACnB,iBAAiB,EACjB,sBAAsB,EACtB,sBAAsB,EACtB,iBAAiB,EACjB,gBAAgB,EAChB,wBAAwB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,GAC5B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAC5E,YAAY,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAEjF,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACvB,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,qBAAqB,EACrB,sBAAsB,EACtB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACtB,qBAAqB,EACrB,cAAc,EACd,eAAe,EACf,cAAc,GACf,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAC;AAChG,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,uBAAuB,EACvB,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,kBAAkB,EAClB,qBAAqB,EACrB,iBAAiB,EACjB,aAAa,EACb,aAAa,GACd,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,+BAA+B,EAC/B,WAAW,EACX,cAAc,EACd,yBAAyB,EACzB,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,yBAAyB,EACzB,gCAAgC,EAChC,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,EAClB,aAAa,EACb,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,UAAU,EACV,WAAW,EACX,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,EACf,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACzE,YAAY,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACpF,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AACrG,OAAO,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AAGpE,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAC1G,YAAY,EAAE,eAAe,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACtI,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACtE,YAAY,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,YAAY,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACpE,YAAY,EACV,WAAW,EACX,gBAAgB,EAChB,eAAe,EACf,oBAAoB,GACrB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,4BAA4B,EAI5B,iBAAiB,EACjB,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAI/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,YAAY,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAM3F,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC3E,YAAY,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEhE,OAAO,EAAE,0BAA0B,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACnG,YAAY,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,UAAU,CAAC;AAClB,YAAY,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAC5E,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,aAAa,EACb,2BAA2B,EAC3B,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,EAChB,cAAc,GACf,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AACjH,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACzE,YAAY,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,EACL,yBAAyB,EACzB,KAAK,4BAA4B,EACjC,KAAK,8BAA8B,GACpC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACrG,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACxF,YAAY,EACV,iBAAiB,EACjB,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,EACf,WAAW,EACX,qBAAqB,EACrB,iBAAiB,EACjB,SAAS,GACV,MAAM,WAAW,CAAC;AAGnB,cAAc,cAAc,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAG/D,OAAO,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACxH,YAAY,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAC/E,YAAY,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AACjF,OAAO,EACL,0BAA0B,EAC1B,6BAA6B,EAC7B,qBAAqB,EACrB,uBAAuB,EACvB,mBAAmB,EACnB,iBAAiB,EACjB,sBAAsB,EACtB,sBAAsB,EACtB,iBAAiB,EACjB,gBAAgB,EAChB,wBAAwB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,GAC5B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,cAAc,EAAE,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC9G,YAAY,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAEjF,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACvB,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,qBAAqB,EACrB,sBAAsB,EACtB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACtB,qBAAqB,EACrB,cAAc,EACd,eAAe,EACf,cAAc,GACf,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAC;AAChG,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,uBAAuB,EACvB,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,kBAAkB,EAClB,qBAAqB,EACrB,iBAAiB,EACjB,aAAa,EACb,aAAa,GACd,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,+BAA+B,EAC/B,WAAW,EACX,cAAc,EACd,yBAAyB,EACzB,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,yBAAyB,EACzB,gCAAgC,EAChC,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,EAClB,aAAa,EACb,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,UAAU,EACV,WAAW,EACX,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,EACf,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACzE,YAAY,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACpF,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AACrG,OAAO,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AAEpE,OAAO,EAAE,kBAAkB,EAAE,6BAA6B,EAAE,MAAM,2BAA2B,CAAC;AAC9F,YAAY,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAGpI,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAC1G,YAAY,EAAE,eAAe,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACtI,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACtE,YAAY,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,YAAY,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACpE,YAAY,EACV,WAAW,EACX,gBAAgB,EAChB,eAAe,EACf,oBAAoB,GACrB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,4BAA4B,EAI5B,iBAAiB,EACjB,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAI/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,YAAY,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAM3F,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC3E,YAAY,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEhE,OAAO,EAAE,0BAA0B,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACnG,YAAY,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC"}

package/dist/index.js

@@ -16,7 +16,7 @@ export { hostedCrossVerticalReach } from './cross-vertical.js';
 // platform sweep also runs when it garbage-collects an expired preview.
 export { retireAllPreviewClients, retireClientsOfReapedScope, tenantIssuers, wirePreviewAuth } from './preview-auth.js';
 export { drainScopePlatformRequests, MAX_PLATFORM_REQUEST_ATTEMPTS, provisionSiblingScope, provisionSiblingHandler, archiveScopeHandler, peerInvokeHandler, provisionTenantHandler, setEntitlementsHandler, modelUsageHandler, sweepRunsHandler, connectorDispatchHandler, } from './platform-drain.js';
-export { reconcilePayloadFor, reconcileThenReassert } from './reconcile.js';
+export { reconcilePayloadFor, reconcileThenReassert, switchCarryFor } from './reconcile.js';
 export { attributeFailure, terminalFailureNote } from './failure-attribution.js';
 // #1978: moving here from the kernel — the drain is its only reader.
 export { isTerminalDispatchFailure, isTerminalProviderError, providerErrorStatus, RETRYABLE_CLIENT_STATUSES, } from './provider-error.js';
@@ -29,6 +29,8 @@ export { TENANT_SERIES_SCOPE_CAP, TENANT_METRICS_LIMIT, REQUEST_FACET_KEYS, REQU
 export { STORAGE_PAGE_DEFAULT, STORAGE_PAGE_MAX, STORAGE_READ_CONCURRENCY, readStoragePage, } from './storage-meter.js';
 export { createCfDoNamespaceReader, namespacesForScript } from './do-namespaces.js';
 export { createCfObservabilityReader } from './cf-observability.js';
+// #1923: the one sanctioned reading of a line's `outputFields` — tenant- and app-scoped, aggregate only.
+export { tallyFieldCoverage, FIELD_COVERAGE_OPERATIONS_MAX } from './field-coverage-tally.js';
 // #1877: the aggregate seam under ObservabilityReader, and the store its cache keeps
 // closed blocks in (a Durable Object's SQL in production).
 export { cachedSource, memoryCubeStore, grainFor, blockMsFor, CLOSE_LAG_MS } from './aggregate-source.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,aAAa,EACb,2BAA2B,EAC3B,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,EAChB,cAAc,GACf,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AACjH,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAEzE,OAAO,EACL,yBAAyB,GAG1B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACrG,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAYxF,uFAAuF;AACvF,iFAAiF;AACjF,cAAc,cAAc,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,gGAAgG;AAChG,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,uFAAuF;AACvF,wEAAwE;AACxE,OAAO,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAGxH,OAAO,EACL,0BAA0B,EAC1B,6BAA6B,EAC7B,qBAAqB,EACrB,uBAAuB,EACvB,mBAAmB,EACnB,iBAAiB,EACjB,sBAAsB,EACtB,sBAAsB,EACtB,iBAAiB,EACjB,gBAAgB,EAChB,wBAAwB,GAczB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAE5E,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AACjF,qEAAqE;AACrE,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACvB,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,qBAAqB,CAAC;AAO7B,OAAO,EACL,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,aAAa,CAAC;AAUrB,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAC;AAChG,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,uBAAuB,EACvB,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAQ7B,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,+BAA+B,EAC/B,WAAW,EACX,cAAc,EACd,yBAAyB,EACzB,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AA2B/B,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,EACf,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEpF,OAAO,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AACpE,qFAAqF;AACrF,2DAA2D;AAC3D,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAE1G,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAStE,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,4BAA4B;AAC5B,iFAAiF;AACjF,mFAAmF;AACnF,gFAAgF;AAChF,iBAAiB,EACjB,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AACzB,kFAAkF;AAClF,iFAAiF;AACjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,yFAAyF;AACzF,yFAAyF;AACzF,oFAAoF;AACpF,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAE7D,uFAAuF;AACvF,yFAAyF;AACzF,uFAAuF;AACvF,yFAAyF;AACzF,8EAA8E;AAC9E,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAG3E,OAAO,EAAE,0BAA0B,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,aAAa,EACb,2BAA2B,EAC3B,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,EAChB,cAAc,GACf,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AACjH,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAEzE,OAAO,EACL,yBAAyB,GAG1B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACrG,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAYxF,uFAAuF;AACvF,iFAAiF;AACjF,cAAc,cAAc,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,gGAAgG;AAChG,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,uFAAuF;AACvF,wEAAwE;AACxE,OAAO,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAGxH,OAAO,EACL,0BAA0B,EAC1B,6BAA6B,EAC7B,qBAAqB,EACrB,uBAAuB,EACvB,mBAAmB,EACnB,iBAAiB,EACjB,sBAAsB,EACtB,sBAAsB,EACtB,iBAAiB,EACjB,gBAAgB,EAChB,wBAAwB,GAczB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,cAAc,EAAoB,MAAM,gBAAgB,CAAC;AAE9G,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AACjF,qEAAqE;AACrE,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACvB,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,qBAAqB,CAAC;AAO7B,OAAO,EACL,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,aAAa,CAAC;AAUrB,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAC;AAChG,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,uBAAuB,EACvB,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAQ7B,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,+BAA+B,EAC/B,WAAW,EACX,cAAc,EACd,yBAAyB,EACzB,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AA2B/B,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,EACf,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEpF,OAAO,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AACpE,yGAAyG;AACzG,OAAO,EAAE,kBAAkB,EAAE,6BAA6B,EAAE,MAAM,2BAA2B,CAAC;AAE9F,qFAAqF;AACrF,2DAA2D;AAC3D,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAE1G,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAStE,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,4BAA4B;AAC5B,iFAAiF;AACjF,mFAAmF;AACnF,gFAAgF;AAChF,iBAAiB,EACjB,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AACzB,kFAAkF;AAClF,iFAAiF;AACjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,yFAAyF;AACzF,yFAAyF;AACzF,oFAAoF;AACpF,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAE7D,uFAAuF;AACvF,yFAAyF;AACzF,uFAAuF;AACvF,yFAAyF;AACzF,8EAA8E;AAC9E,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAG3E,OAAO,EAAE,0BAA0B,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC"}

package/dist/platform-entry.generated.d.ts

@@ -7,7 +7,7 @@
 export declare const PLATFORM_ENTRY_MODULE = "substrat-platform-entry.js";
 /** The import specifier the uploader replaces with `./<the bundle's entry>`. */
 export declare const PLATFORM_ENTRY_PLACEHOLDER = "__SUBSTRAT_VERTICAL_ENTRY__";
-/** The entry itself — 9378 bytes of ESM. */
+/** The entry itself — 10039 bytes of ESM. */
 export declare const PLATFORM_ENTRY_SOURCE: string;
 /**
  * The scope sweeper the platform supplies (#1902) — uploaded beside the entry, which

package/dist/platform-entry.generated.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"platform-entry.generated.d.ts","sourceRoot":"","sources":["../src/platform-entry.generated.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,+BAA+B,CAAC;AAElE,gFAAgF;AAChF,eAAO,MAAM,0BAA0B,gCAAgC,CAAC;AAExE,4CAA4C;AAC5C,eAAO,MAAM,qBAAqB,EAAE,MAA6iT,CAAC;AAEllT;;;GAGG;AACH,eAAO,MAAM,uBAAuB,iCAAiC,CAAC;AAEtE,8CAA8C;AAC9C,eAAO,MAAM,uBAAuB,EAAE,MAAuxT,CAAC"}
+{"version":3,"file":"platform-entry.generated.d.ts","sourceRoot":"","sources":["../src/platform-entry.generated.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,+BAA+B,CAAC;AAElE,gFAAgF;AAChF,eAAO,MAAM,0BAA0B,gCAAgC,CAAC;AAExE,6CAA6C;AAC7C,eAAO,MAAM,qBAAqB,EAAE,MAAktU,CAAC;AAEvvU;;;GAGG;AACH,eAAO,MAAM,uBAAuB,iCAAiC,CAAC;AAEtE,8CAA8C;AAC9C,eAAO,MAAM,uBAAuB,EAAE,MAAuxT,CAAC"}