@substrat-run/kernel 0.114.0 → 0.117.0

package/dist/permission-eval.js

@@ -1,4 +1,5 @@
 import { objectRef, subjectRef, } from '@substrat-run/contracts';
+import { capabilityGrantOf, capabilityLive } from './capability.js';
 /**
  * The built-in constrained relationship-tuple evaluator (design doc §4.2, plan D-23),
  * as ONE implementation both adapters call.
@@ -40,6 +41,45 @@ const nodeObjectsOf = (node) => node.scopeId
         { obj: `tenant:${node.tenantId}`, scoped: false },
     ]
     : [{ obj: `tenant:${node.tenantId}`, scoped: false }];
+/**
+ * Rule 3's walk, as ONE function: from `start`, look for a hit at each frontier object, then
+ * expand one level of declared `parent` edges, to `ENTITY_WALK_DEPTH`. `probe` decides what a
+ * hit is — a live entity-narrowed grant for a principal, the capability's own root for a
+ * capability subject — so both subjects travel exactly the same edges, to exactly the same
+ * depth, skipping exactly the same revoked edges. A capability that reached further than an
+ * entity grant (or less far) would be a second algebra.
+ */
+async function walkParents(scope, start, now, probe) {
+    let frontier = [{ ref: start, chain: [] }];
+    for (let depth = 0; depth <= ENTITY_WALK_DEPTH && frontier.length > 0; depth++) {
+        for (const candidate of frontier) {
+            const hit = await probe(candidate.ref, candidate.chain);
+            if (hit !== undefined)
+                return hit;
+        }
+        // Nothing consults the frontier past the last depth, so expanding it there is a
+        // read per candidate for an answer no one asks for.
+        if (depth === ENTITY_WALK_DEPTH)
+            break;
+        const next = [];
+        for (const candidate of frontier) {
+            for (const p of await scope.parents(candidate.ref)) {
+                // A revoked parent edge stops expanding. Without this the tombstone would work
+                // for grants and membership but silently NOT for entity edges — which is the
+                // case open question 15 is actually about (a facility moving management
+                // company must stop being reachable).
+                if (!live(p, now))
+                    continue;
+                next.push({
+                    ref: p.object,
+                    chain: [...candidate.chain, t(p.subject, 'parent', p.object)],
+                });
+            }
+        }
+        frontier = next;
+    }
+    return undefined;
+}
 /**
  * Build the evaluator over one adapter's reader. Stateless per call: everything it knows it
  * reads at check time, which is what makes check-after-write consistent (the "no zookies"
@@ -85,6 +125,124 @@ export function createTupleEvaluator(reader) {
         }
         return out;
     };
+    /**
+     * A CAPABILITY subject (#1672). Resolved against the capability's own directory row —
+     * never against tuples, so no `capability:` tuple anywhere could widen it — in four steps,
+     * each of which denies on its own:
+     *
+     * 1. **Usable.** The row exists, can act (`mode: 'act'`), and is neither revoked nor
+     *    expired — `capabilityLive`, the predicate the session door and the exchange share.
+     * 2. **The key.** `permission` is one the capability carries.
+     * 3. **The subtree.** An entity is named, and it is the capability's root or lies beneath
+     *    it along declared parent edges — `walkParents`, the walk entity grants take. A
+     *    capability holds NO node-level authority: a check without an entity denies.
+     * 4. **The minter, now.** The principal who minted it must hold `permission` on this
+     *    entity at this moment, by the ordinary check. This is what makes "a capability never
+     *    grants more than its minter holds" true on every use rather than only at mint time:
+     *    revoke the minter's access and their links stop granting it.
+     *
+     * The proof is the minter's own chain, a `minted-by` link, the parent chain, and last the
+     * capability's grant on its root — last so K-34's `grantRefFromProof` names the root.
+     */
+    async function checkCapability(id, permission, node, entity) {
+        const deny = { allowed: false, checked: permission, node };
+        if (!entity || !node.scopeId)
+            return deny;
+        const scope = reader.scopeFor(node);
+        if (!scope?.capability)
+            return deny;
+        const now = reader.now();
+        const row = await scope.capability(id);
+        if (!row || !capabilityLive(row, now))
+            return deny;
+        const grant = capabilityGrantOf(row);
+        if (!grant || !grant.mintedBy || !grant.permissions.includes(permission))
+            return deny;
+        const root = `${grant.entity.entityType}:${grant.entity.entityId}`;
+        const self = `capability:${id}`;
+        const chain = await walkParents(scope, `${entity.entityType}:${entity.entityId}`, now, async (ref, walked) => ref === root ? [...walked, t(self, `granted:${permission}`, root)] : undefined);
+        if (!chain)
+            return deny;
+        const minter = await check({ kind: 'principal', id: grant.mintedBy }, permission, node, entity);
+        if (!minter.allowed)
+            return deny;
+        return {
+            allowed: true,
+            proof: [...minter.proof, t(self, 'minted-by', `principal:${grant.mintedBy}`), ...chain],
+        };
+    }
+    async function check(subject, permission, node, entity) {
+        if (subject.kind === 'capability') {
+            return checkCapability(subject.id, permission, node, entity);
+        }
+        const now = reader.now();
+        const deny = { allowed: false, checked: permission, node };
+        const scope = reader.scopeFor(node);
+        const getRole = roleReaderFor(node.tenantId);
+        // Rule 4 — membership: the subject set is the caller plus its orgs. Shared with
+        // `covers` (§ `subjectsOf`).
+        const subjects = await subjectsOf(subject, node, now);
+        const tuplesFor = async (subjectRefValue, prefix, scoped) => scoped
+            ? scope
+                ? scope.tuples(subjectRefValue, prefix)
+                : []
+            : reader.tenantTuples(node.tenantId, subjectRefValue, prefix);
+        for (const nodeObj of nodeObjectsOf(node)) {
+            for (const s of subjects) {
+                // Rule 1 — role expansion.
+                for (const row of await tuplesFor(s.ref, 'role:', nodeObj.scoped)) {
+                    if (row.object !== nodeObj.obj || !live(row, now))
+                        continue;
+                    const roleKey = row.relation.slice('role:'.length);
+                    const role = await getRole(roleKey);
+                    if (role?.permissions.includes(permission)) {
+                        return {
+                            allowed: true,
+                            proof: [
+                                ...(s.via ? [s.via] : []),
+                                t(row.subject, row.relation, row.object),
+                                t(`role:${roleKey}`, `granted:${permission}`, nodeObj.obj),
+                            ],
+                        };
+                    }
+                }
+                // Direct grants at the node.
+                for (const row of await tuplesFor(s.ref, `granted:${permission}`, nodeObj.scoped)) {
+                    if (row.object === nodeObj.obj &&
+                        row.relation === `granted:${permission}` &&
+                        live(row, now)) {
+                        return {
+                            allowed: true,
+                            proof: [...(s.via ? [s.via] : []), t(row.subject, row.relation, row.object)],
+                        };
+                    }
+                }
+            }
+        }
+        // Rule 3 — entity walk along declared parent edges (entity grants are scope-local by
+        // construction, so no scope store means no walk).
+        if (entity && scope) {
+            const found = await walkParents(scope, `${entity.entityType}:${entity.entityId}`, now, async (ref, chain) => {
+                for (const s of subjects) {
+                    const grant = await scope.grant(s.ref, `granted:${permission}`, ref);
+                    if (grant && live(grant, now)) {
+                        return {
+                            allowed: true,
+                            proof: [
+                                ...(s.via ? [s.via] : []),
+                                ...chain,
+                                t(grant.subject, grant.relation, grant.object),
+                            ],
+                        };
+                    }
+                }
+                return undefined;
+            });
+            if (found)
+                return found;
+        }
+        return deny;
+    }
     return {
         /**
          * The subject's effective permission set at the node, compared against `required`
@@ -103,6 +261,11 @@ export function createTupleEvaluator(reader) {
             // prove the empty set is a subset of anything.
             if (required.length === 0)
                 return { covered: true, missing: [] };
+            // A capability holds no node-level authority by construction (#1672) — everything it
+            // carries is narrowed onto one entity — so it covers nothing and can confer nothing.
+            if (subject.kind === 'capability') {
+                return { covered: false, missing: [...new Set(required)] };
+            }
             const now = reader.now();
             const scope = reader.scopeFor(node);
             const subjects = await subjectsOf(subject, node, now);
@@ -138,97 +301,7 @@ export function createTupleEvaluator(reader) {
             }
             return missing.length === 0 ? { covered: true, missing: [] } : { covered: false, missing };
         },
-        async check(subject, permission, node, entity) {
-            const now = reader.now();
-            const deny = { allowed: false, checked: permission, node };
-            const scope = reader.scopeFor(node);
-            const getRole = roleReaderFor(node.tenantId);
-            // Rule 4 — membership: the subject set is the caller plus its orgs. Shared with
-            // `covers` (§ `subjectsOf`).
-            const subjects = await subjectsOf(subject, node, now);
-            const tuplesFor = async (subjectRefValue, prefix, scoped) => scoped
-                ? scope
-                    ? scope.tuples(subjectRefValue, prefix)
-                    : []
-                : reader.tenantTuples(node.tenantId, subjectRefValue, prefix);
-            for (const nodeObj of nodeObjectsOf(node)) {
-                for (const s of subjects) {
-                    // Rule 1 — role expansion.
-                    for (const row of await tuplesFor(s.ref, 'role:', nodeObj.scoped)) {
-                        if (row.object !== nodeObj.obj || !live(row, now))
-                            continue;
-                        const roleKey = row.relation.slice('role:'.length);
-                        const role = await getRole(roleKey);
-                        if (role?.permissions.includes(permission)) {
-                            return {
-                                allowed: true,
-                                proof: [
-                                    ...(s.via ? [s.via] : []),
-                                    t(row.subject, row.relation, row.object),
-                                    t(`role:${roleKey}`, `granted:${permission}`, nodeObj.obj),
-                                ],
-                            };
-                        }
-                    }
-                    // Direct grants at the node.
-                    for (const row of await tuplesFor(s.ref, `granted:${permission}`, nodeObj.scoped)) {
-                        if (row.object === nodeObj.obj &&
-                            row.relation === `granted:${permission}` &&
-                            live(row, now)) {
-                            return {
-                                allowed: true,
-                                proof: [...(s.via ? [s.via] : []), t(row.subject, row.relation, row.object)],
-                            };
-                        }
-                    }
-                }
-            }
-            // Rule 3 — entity walk along declared parent edges (entity grants are scope-local by
-            // construction, so no scope store means no walk).
-            if (entity && scope) {
-                let frontier = [{ ref: `${entity.entityType}:${entity.entityId}`, chain: [] }];
-                for (let depth = 0; depth <= ENTITY_WALK_DEPTH && frontier.length > 0; depth++) {
-                    // grant lookup at current frontier objects
-                    for (const candidate of frontier) {
-                        for (const s of subjects) {
-                            const grant = await scope.grant(s.ref, `granted:${permission}`, candidate.ref);
-                            if (grant && live(grant, now)) {
-                                return {
-                                    allowed: true,
-                                    proof: [
-                                        ...(s.via ? [s.via] : []),
-                                        ...candidate.chain,
-                                        t(grant.subject, grant.relation, grant.object),
-                                    ],
-                                };
-                            }
-                        }
-                    }
-                    // Nothing consults the frontier past the last depth, so expanding it there is a
-                    // read per candidate for an answer no one asks for.
-                    if (depth === ENTITY_WALK_DEPTH)
-                        break;
-                    // expand one level of parents
-                    const next = [];
-                    for (const candidate of frontier) {
-                        for (const p of await scope.parents(candidate.ref)) {
-                            // A revoked parent edge stops expanding. Without this the tombstone would work
-                            // for grants and membership but silently NOT for entity edges — which is the
-                            // case open question 15 is actually about (a facility moving management
-                            // company must stop being reachable).
-                            if (!live(p, now))
-                                continue;
-                            next.push({
-                                ref: p.object,
-                                chain: [...candidate.chain, t(p.subject, 'parent', p.object)],
-                            });
-                        }
-                    }
-                    frontier = next;
-                }
-            }
-            return deny;
-        },
+        check,
     };
 }
 //# sourceMappingURL=permission-eval.js.map

package/dist/permission-eval.js.map

@@ -1 +1 @@
-{"version":3,"file":"permission-eval.js","sourceRoot":"","sources":["../src/permission-eval.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,UAAU,GASX,MAAM,yBAAyB,CAAC;AAGjC;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,iBAAiB,GAAG,CAAC,CAAC;AA0D5B,MAAM,CAAC,GAAG,CAAC,OAAe,EAAE,QAAgB,EAAE,MAAc,EAAiB,EAAE,CAAC,CAAC;IAC/E,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC;IACjC,QAAQ;IACR,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC;CAChC,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,IAAI,GAAG,CAAC,GAAuB,EAAE,GAAW,EAAW,EAAE,CAC7D,CAAC,GAAG,CAAC,UAAU,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC;AAE/E;;;GAGG;AACH,MAAM,aAAa,GAAG,CAAC,IAAU,EAAsC,EAAE,CACvE,IAAI,CAAC,OAAO;IACV,CAAC,CAAC;QACE,EAAE,GAAG,EAAE,SAAS,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;QAC9C,EAAE,GAAG,EAAE,UAAU,IAAI,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;KAClD;IACH,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,IAAI,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AAE1D;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAA6B;IAChE;;;;;;OAMG;IACH,MAAM,aAAa,GAAG,CAAC,QAAgB,EAAE,EAAE;QACzC,MAAM,IAAI,GAAG,IAAI,GAAG,EAA+C,CAAC;QACpE,OAAO,CAAC,GAAW,EAAuC,EAAE;YAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC1B,IAAI,GAAG;gBAAE,OAAO,GAAG,CAAC;YACpB,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;YAC/D,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YACvB,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC;IACJ,CAAC,CAAC;IAEF;;;;;;;;OAQG;IACH,MAAM,UAAU,GAAG,KAAK,EACtB,OAAqB,EACrB,IAAU,EACV,GAAW,EACsC,EAAE;QACnD,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,GAAG,GAA2C,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;QACvE,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YACjC,KAAK,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAC5E,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;oBAC5C,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACvE,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IAEF,OAAO;QACL;;;;;;;;;;;WAWG;QACH,KAAK,CAAC,MAAM,CACV,OAAqB,EACrB,QAAkC,EAClC,IAAU;YAEV,qFAAqF;YACrF,+CAA+C;YAC/C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;YAEjE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACpC,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YACtD,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAE7C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;YAC/B,KAAK,MAAM,OAAO,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;oBACzB,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM;wBACzB,CAAC,CAAC,KAAK;4BACL,CAAC,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC;4BAC/B,CAAC,CAAC,EAAE;wBACN,CAAC,CAAC,MAAM,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;oBACxD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;wBACvB,IAAI,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC;4BAAE,SAAS;wBAC5D,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;4BACrC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;4BAC/D,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,WAAW,IAAI,EAAE;gCAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;wBACvD,CAAC;6BAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;4BAC/C,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;wBAClD,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YAED,qFAAqF;YACrF,oDAAoD;YACpD,MAAM,OAAO,GAAoB,EAAE,CAAC;YACpC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACzB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;oBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC5D,CAAC;YACD,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAC7F,CAAC;QAED,KAAK,CAAC,KAAK,CACT,OAAqB,EACrB,UAAyB,EACzB,IAAU,EACV,MAAkB;YAElB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC;YACzB,MAAM,IAAI,GAAa,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;YACrE,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACpC,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAE7C,gFAAgF;YAChF,6BAA6B;YAC7B,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAEtD,MAAM,SAAS,GAAG,KAAK,EACrB,eAAuB,EACvB,MAAc,EACd,MAAe,EACgB,EAAE,CACjC,MAAM;gBACJ,CAAC,CAAC,KAAK;oBACL,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC;oBACvC,CAAC,CAAC,EAAE;gBACN,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC;YAElE,KAAK,MAAM,OAAO,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;oBACzB,2BAA2B;oBAC3B,KAAK,MAAM,GAAG,IAAI,MAAM,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;wBAClE,IAAI,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC;4BAAE,SAAS;wBAC5D,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;wBACnD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;wBACpC,IAAI,IAAI,EAAE,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;4BAC3C,OAAO;gCACL,OAAO,EAAE,IAAI;gCACb,KAAK,EAAE;oCACL,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oCACzB,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC;oCACxC,CAAC,CAAC,QAAQ,OAAO,EAAE,EAAE,WAAW,UAAU,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC;iCAC3D;6BACF,CAAC;wBACJ,CAAC;oBACH,CAAC;oBACD,6BAA6B;oBAC7B,KAAK,MAAM,GAAG,IAAI,MAAM,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,WAAW,UAAU,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;wBAClF,IACE,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC,GAAG;4BAC1B,GAAG,CAAC,QAAQ,KAAK,WAAW,UAAU,EAAE;4BACxC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,EACd,CAAC;4BACD,OAAO;gCACL,OAAO,EAAE,IAAI;gCACb,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;6BAC7E,CAAC;wBACJ,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YAED,qFAAqF;YACrF,kDAAkD;YAClD,IAAI,MAAM,IAAI,KAAK,EAAE,CAAC;gBAEpB,IAAI,QAAQ,GAAe,CAAC,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;gBAC3F,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,iBAAiB,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;oBAC/E,2CAA2C;oBAC3C,KAAK,MAAM,SAAS,IAAI,QAAQ,EAAE,CAAC;wBACjC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;4BACzB,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,WAAW,UAAU,EAAE,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC;4BAC/E,IAAI,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;gCAC9B,OAAO;oCACL,OAAO,EAAE,IAAI;oCACb,KAAK,EAAE;wCACL,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;wCACzB,GAAG,SAAS,CAAC,KAAK;wCAClB,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC;qCAC/C;iCACF,CAAC;4BACJ,CAAC;wBACH,CAAC;oBACH,CAAC;oBACD,gFAAgF;oBAChF,oDAAoD;oBACpD,IAAI,KAAK,KAAK,iBAAiB;wBAAE,MAAM;oBACvC,8BAA8B;oBAC9B,MAAM,IAAI,GAAe,EAAE,CAAC;oBAC5B,KAAK,MAAM,SAAS,IAAI,QAAQ,EAAE,CAAC;wBACjC,KAAK,MAAM,CAAC,IAAI,MAAM,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;4BACnD,+EAA+E;4BAC/E,6EAA6E;4BAC7E,wEAAwE;4BACxE,sCAAsC;4BACtC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC;gCAAE,SAAS;4BAC5B,IAAI,CAAC,IAAI,CAAC;gCACR,GAAG,EAAE,CAAC,CAAC,MAAM;gCACb,KAAK,EAAE,CAAC,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;6BAC9D,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;oBACD,QAAQ,GAAG,IAAI,CAAC;gBAClB,CAAC;YACH,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"permission-eval.js","sourceRoot":"","sources":["../src/permission-eval.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,UAAU,GASX,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAsB,MAAM,iBAAiB,CAAC;AAExF;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAiE5B,MAAM,CAAC,GAAG,CAAC,OAAe,EAAE,QAAgB,EAAE,MAAc,EAAiB,EAAE,CAAC,CAAC;IAC/E,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC;IACjC,QAAQ;IACR,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC;CAChC,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,IAAI,GAAG,CAAC,GAAuB,EAAE,GAAW,EAAW,EAAE,CAC7D,CAAC,GAAG,CAAC,UAAU,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC;AAE/E;;;GAGG;AACH,MAAM,aAAa,GAAG,CAAC,IAAU,EAAsC,EAAE,CACvE,IAAI,CAAC,OAAO;IACV,CAAC,CAAC;QACE,EAAE,GAAG,EAAE,SAAS,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;QAC9C,EAAE,GAAG,EAAE,UAAU,IAAI,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;KAClD;IACH,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,IAAI,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AAE1D;;;;;;;GAOG;AACH,KAAK,UAAU,WAAW,CACxB,KAAuB,EACvB,KAAa,EACb,GAAW,EACX,KAAsE;IAGtE,IAAI,QAAQ,GAAe,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;IACvD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,iBAAiB,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QAC/E,KAAK,MAAM,SAAS,IAAI,QAAQ,EAAE,CAAC;YACjC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;YACxD,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,GAAG,CAAC;QACpC,CAAC;QACD,gFAAgF;QAChF,oDAAoD;QACpD,IAAI,KAAK,KAAK,iBAAiB;YAAE,MAAM;QACvC,MAAM,IAAI,GAAe,EAAE,CAAC;QAC5B,KAAK,MAAM,SAAS,IAAI,QAAQ,EAAE,CAAC;YACjC,KAAK,MAAM,CAAC,IAAI,MAAM,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnD,+EAA+E;gBAC/E,6EAA6E;gBAC7E,wEAAwE;gBACxE,sCAAsC;gBACtC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC;oBAAE,SAAS;gBAC5B,IAAI,CAAC,IAAI,CAAC;oBACR,GAAG,EAAE,CAAC,CAAC,MAAM;oBACb,KAAK,EAAE,CAAC,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;iBAC9D,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAA6B;IAChE;;;;;;OAMG;IACH,MAAM,aAAa,GAAG,CAAC,QAAgB,EAAE,EAAE;QACzC,MAAM,IAAI,GAAG,IAAI,GAAG,EAA+C,CAAC;QACpE,OAAO,CAAC,GAAW,EAAuC,EAAE;YAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC1B,IAAI,GAAG;gBAAE,OAAO,GAAG,CAAC;YACpB,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;YAC/D,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YACvB,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC;IACJ,CAAC,CAAC;IAEF;;;;;;;;OAQG;IACH,MAAM,UAAU,GAAG,KAAK,EACtB,OAAqB,EACrB,IAAU,EACV,GAAW,EACsC,EAAE;QACnD,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,GAAG,GAA2C,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;QACvE,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YACjC,KAAK,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAC5E,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;oBAC5C,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACvE,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IAEF;;;;;;;;;;;;;;;;;;OAkBG;IACH,KAAK,UAAU,eAAe,CAC5B,EAAU,EACV,UAAyB,EACzB,IAAU,EACV,MAA6B;QAE7B,MAAM,IAAI,GAAa,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QACrE,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,EAAE,UAAU;YAAE,OAAO,IAAI,CAAC;QACpC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACvC,IAAI,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACnD,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC;QACtF,MAAM,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,UAAU,IAAI,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACnE,MAAM,IAAI,GAAG,cAAc,EAAE,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,MAAM,WAAW,CAC7B,KAAK,EACL,GAAG,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,EAAE,EACzC,GAAG,EACH,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CACpB,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,UAAU,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CACjF,CAAC;QACF,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,MAAM,MAAM,GAAG,MAAM,KAAK,CACxB,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,KAAK,CAAC,QAAQ,EAAE,EACzC,UAAU,EACV,IAAI,EACJ,MAAM,CACP,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QACjC,OAAO;YACL,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,aAAa,KAAK,CAAC,QAAQ,EAAE,CAAC,EAAE,GAAG,KAAK,CAAC;SACxF,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,KAAK,CAClB,OAAqB,EACrB,UAAyB,EACzB,IAAU,EACV,MAAkB;QAElB,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAClC,OAAO,eAAe,CAAC,OAAO,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,IAAI,GAAa,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QACrE,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAE7C,gFAAgF;QAChF,6BAA6B;QAC7B,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAEtD,MAAM,SAAS,GAAG,KAAK,EACrB,eAAuB,EACvB,MAAc,EACd,MAAe,EACgB,EAAE,CACjC,MAAM;YACJ,CAAC,CAAC,KAAK;gBACL,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC;gBACvC,CAAC,CAAC,EAAE;YACN,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC;QAElE,KAAK,MAAM,OAAO,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACzB,2BAA2B;gBAC3B,KAAK,MAAM,GAAG,IAAI,MAAM,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;oBAClE,IAAI,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC;wBAAE,SAAS;oBAC5D,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;oBACnD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;oBACpC,IAAI,IAAI,EAAE,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;wBAC3C,OAAO;4BACL,OAAO,EAAE,IAAI;4BACb,KAAK,EAAE;gCACL,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gCACzB,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC;gCACxC,CAAC,CAAC,QAAQ,OAAO,EAAE,EAAE,WAAW,UAAU,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC;6BAC3D;yBACF,CAAC;oBACJ,CAAC;gBACH,CAAC;gBACD,6BAA6B;gBAC7B,KAAK,MAAM,GAAG,IAAI,MAAM,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,WAAW,UAAU,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;oBAClF,IACE,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC,GAAG;wBAC1B,GAAG,CAAC,QAAQ,KAAK,WAAW,UAAU,EAAE;wBACxC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,EACd,CAAC;wBACD,OAAO;4BACL,OAAO,EAAE,IAAI;4BACb,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;yBAC7E,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,qFAAqF;QACrF,kDAAkD;QAClD,IAAI,MAAM,IAAI,KAAK,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,MAAM,WAAW,CAC7B,KAAK,EACL,GAAG,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,EAAE,EACzC,GAAG,EACH,KAAK,EAAE,GAAG,EAAE,KAAK,EAAiC,EAAE;gBAClD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;oBACzB,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,WAAW,UAAU,EAAE,EAAE,GAAG,CAAC,CAAC;oBACrE,IAAI,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;wBAC9B,OAAO;4BACL,OAAO,EAAE,IAAI;4BACb,KAAK,EAAE;gCACL,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gCACzB,GAAG,KAAK;gCACR,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC;6BAC/C;yBACF,CAAC;oBACJ,CAAC;gBACH,CAAC;gBACD,OAAO,SAAS,CAAC;YACnB,CAAC,CACF,CAAC;YACF,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;QAC1B,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL;;;;;;;;;;;WAWG;QACH,KAAK,CAAC,MAAM,CACV,OAAqB,EACrB,QAAkC,EAClC,IAAU;YAEV,qFAAqF;YACrF,+CAA+C;YAC/C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;YACjE,qFAAqF;YACrF,qFAAqF;YACrF,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAClC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAwC,EAAE,CAAC;YACpG,CAAC;YAED,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACpC,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YACtD,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAE7C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;YAC/B,KAAK,MAAM,OAAO,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;oBACzB,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM;wBACzB,CAAC,CAAC,KAAK;4BACL,CAAC,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC;4BAC/B,CAAC,CAAC,EAAE;wBACN,CAAC,CAAC,MAAM,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;oBACxD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;wBACvB,IAAI,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC;4BAAE,SAAS;wBAC5D,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;4BACrC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;4BAC/D,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,WAAW,IAAI,EAAE;gCAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;wBACvD,CAAC;6BAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;4BAC/C,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;wBAClD,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YAED,qFAAqF;YACrF,oDAAoD;YACpD,MAAM,OAAO,GAAoB,EAAE,CAAC;YACpC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACzB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;oBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC5D,CAAC;YACD,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAC7F,CAAC;QAED,KAAK;KACN,CAAC;AAEJ,CAAC"}

package/dist/platform-request-query.d.ts

@@ -1,4 +1,4 @@
-import { type PlatformRequestFilter } from '@substrat-run/contracts';
+import { type Actor, type PlatformRequest, type PlatformRequestFilter } from '@substrat-run/contracts';
 /**
  * The one SELECT behind every read of a scope's intent journal (#618).
  *
@@ -16,4 +16,61 @@ export declare function platformRequestHistoryQuery(filter?: PlatformRequestFilt
     sql: string;
     params: (string | number)[];
 };
+/** A stored `_substrat_platform_requests` row — snake_case, the JSON columns still text. */
+export interface PlatformRequestRawRow {
+    id: string;
+    kind: string;
+    payload: string;
+    requested_by: string;
+    impersonation: string | null;
+    status: string;
+    attempts: number;
+    last_error: string | null;
+    last_failure: string | null;
+    result: string | null;
+    requested_at: string;
+    settled_at: string | null;
+}
+/**
+ * What `requestedBy` reads as when the stored actor did not decode. The field is required and
+ * an actor has no empty value, so this is a marker that names itself rather than a plausible
+ * requester: a guessed principal would be the one thing worse than admitting nobody can tell.
+ * The same marker every tolerant spine read uses (#1636), so it is one value, not four.
+ */
+export declare const UNDECODED_REQUESTER: Actor;
+/**
+ * A stored row → the `PlatformRequest` contract shape — TOLERANTLY, and saying so (#1588).
+ *
+ * Every read of the journal returns a LIST, and this decode used to be strict: one row whose
+ * JSON would not parse threw out of the map and took every other intent on the scope with it.
+ * That disabled the drain's own queue, and `listPlatformRequestHistory` too — the read that
+ * exists so a settled intent's failure is legible afterwards (#618), switched off by the row
+ * that failed. Each field is now decoded against its own contract field, and whatever did not
+ * decode is named, by column, in `decodeError`, with the field EMPTY in its place:
+ *
+ * - a JSON column comes back `null`, or {@link UNDECODED_REQUESTER} for the one that cannot be
+ *   null. Never the raw text: a raw `payload` would read as a string payload that was never
+ *   sent, which is a guess dressed as a fact.
+ * - a nullable scalar (`last_error`, `settled_at`) comes back `null`.
+ *
+ * **Every value this returns satisfies the contract.** A field is only ever replaced by a value
+ * its own schema accepts, so the type is not asserting something the published schema would
+ * refuse — a consumer switching on `status` or passing `id` on as a branded id can trust both.
+ * The price is the REQUIRED scalars (`id`, `kind`, `status`, `attempts`, `requested_at`): they
+ * have no empty value, so a row that breaks one of them cannot be a `PlatformRequest` without
+ * lying, and it throws, naming every column it broke — the strict decode this replaced, kept
+ * for exactly the part it cannot honestly be relaxed for. JSON is what a foreign dump actually
+ * gets wrong; representing a row whose identity itself is corrupt needs a variant beside
+ * `PlatformRequest` on every read, which is a contract change of its own.
+ *
+ * A row the kernel wrote decodes whole and carries no `decodeError` at all, so a healthy list
+ * is exactly what it was. This is the READ's half of #1587's rule — strict where work happens,
+ * tolerant where evidence is read; the work half is the drain, which refuses any row carrying
+ * `decodeError` rather than run a handler on it.
+ *
+ * Reachable without a forge: `importDump` replays a dump's rows verbatim, so a dump from
+ * another world, or one edited by hand, is enough. The field-by-field mechanics are
+ * `rowDecoder`'s, shared with the history and denial reads (#1636).
+ */
+export declare function platformRequestOf(row: PlatformRequestRawRow): PlatformRequest;
 //# sourceMappingURL=platform-request-query.d.ts.map

package/dist/platform-request-query.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"platform-request-query.d.ts","sourceRoot":"","sources":["../src/platform-request-query.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,qBAAqB,EAC3B,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;;GAUG;AAEH,0FAA0F;AAC1F,eAAO,MAAM,wBAAwB,iIAC2F,CAAC;AAEjI,wBAAgB,2BAA2B,CAAC,MAAM,CAAC,EAAE,qBAAqB,GAAG;IAC3E,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;CAC7B,CAoBA"}
+{"version":3,"file":"platform-request-query.d.ts","sourceRoot":"","sources":["../src/platform-request-query.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,KAAK,EACV,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC3B,MAAM,yBAAyB,CAAC;AAGjC;;;;;;;;;;GAUG;AAEH,0FAA0F;AAC1F,eAAO,MAAM,wBAAwB,iIAC2F,CAAC;AAEjI,wBAAgB,2BAA2B,CAAC,MAAM,CAAC,EAAE,qBAAqB,GAAG;IAC3E,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;CAC7B,CAoBA;AAED,4FAA4F;AAC5F,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,EAAE,KAAuB,CAAC;AAE1D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,qBAAqB,GAAG,eAAe,CAiB7E"}

package/dist/platform-request-query.js

@@ -1,4 +1,5 @@
-import { DEFAULT_PLATFORM_REQUEST_HISTORY_LIMIT, platformRequestFilter, } from '@substrat-run/contracts';
+import { DEFAULT_PLATFORM_REQUEST_HISTORY_LIMIT, platformRequest, platformRequestFilter, } from '@substrat-run/contracts';
+import { rowDecoder, UNDECODED_ACTOR } from './row-decode.js';
 /**
  * The one SELECT behind every read of a scope's intent journal (#618).
  *
@@ -32,4 +33,63 @@ export function platformRequestHistoryQuery(filter) {
         params,
     };
 }
+/**
+ * What `requestedBy` reads as when the stored actor did not decode. The field is required and
+ * an actor has no empty value, so this is a marker that names itself rather than a plausible
+ * requester: a guessed principal would be the one thing worse than admitting nobody can tell.
+ * The same marker every tolerant spine read uses (#1636), so it is one value, not four.
+ */
+export const UNDECODED_REQUESTER = UNDECODED_ACTOR;
+/**
+ * A stored row → the `PlatformRequest` contract shape — TOLERANTLY, and saying so (#1588).
+ *
+ * Every read of the journal returns a LIST, and this decode used to be strict: one row whose
+ * JSON would not parse threw out of the map and took every other intent on the scope with it.
+ * That disabled the drain's own queue, and `listPlatformRequestHistory` too — the read that
+ * exists so a settled intent's failure is legible afterwards (#618), switched off by the row
+ * that failed. Each field is now decoded against its own contract field, and whatever did not
+ * decode is named, by column, in `decodeError`, with the field EMPTY in its place:
+ *
+ * - a JSON column comes back `null`, or {@link UNDECODED_REQUESTER} for the one that cannot be
+ *   null. Never the raw text: a raw `payload` would read as a string payload that was never
+ *   sent, which is a guess dressed as a fact.
+ * - a nullable scalar (`last_error`, `settled_at`) comes back `null`.
+ *
+ * **Every value this returns satisfies the contract.** A field is only ever replaced by a value
+ * its own schema accepts, so the type is not asserting something the published schema would
+ * refuse — a consumer switching on `status` or passing `id` on as a branded id can trust both.
+ * The price is the REQUIRED scalars (`id`, `kind`, `status`, `attempts`, `requested_at`): they
+ * have no empty value, so a row that breaks one of them cannot be a `PlatformRequest` without
+ * lying, and it throws, naming every column it broke — the strict decode this replaced, kept
+ * for exactly the part it cannot honestly be relaxed for. JSON is what a foreign dump actually
+ * gets wrong; representing a row whose identity itself is corrupt needs a variant beside
+ * `PlatformRequest` on every read, which is a contract change of its own.
+ *
+ * A row the kernel wrote decodes whole and carries no `decodeError` at all, so a healthy list
+ * is exactly what it was. This is the READ's half of #1587's rule — strict where work happens,
+ * tolerant where evidence is read; the work half is the drain, which refuses any row carrying
+ * `decodeError` rather than run a handler on it.
+ *
+ * Reachable without a forge: `importDump` replays a dump's rows verbatim, so a dump from
+ * another world, or one edited by hand, is enough. The field-by-field mechanics are
+ * `rowDecoder`'s, shared with the history and denial reads (#1636).
+ */
+export function platformRequestOf(row) {
+    const shape = platformRequest.shape;
+    const d = rowDecoder(`platform request row ${JSON.stringify(row.id)}`, 'PlatformRequest');
+    return d.finish({
+        id: d.required('id', shape.id, row.id),
+        kind: d.required('kind', shape.kind, row.kind),
+        payload: d.json('payload', shape.payload, row.payload, null),
+        requestedBy: d.json('requested_by', shape.requestedBy, row.requested_by, UNDECODED_REQUESTER),
+        impersonation: d.json('impersonation', shape.impersonation, row.impersonation, null),
+        status: d.required('status', shape.status, row.status),
+        attempts: d.required('attempts', shape.attempts, row.attempts),
+        lastError: d.nullable('last_error', shape.lastError, row.last_error),
+        failure: d.json('last_failure', shape.failure, row.last_failure, null),
+        result: d.json('result', shape.result, row.result, null),
+        requestedAt: d.required('requested_at', shape.requestedAt, row.requested_at),
+        settledAt: d.nullable('settled_at', shape.settledAt, row.settled_at),
+    });
+}
 //# sourceMappingURL=platform-request-query.js.map

package/dist/platform-request-query.js.map

@@ -1 +1 @@
-{"version":3,"file":"platform-request-query.js","sourceRoot":"","sources":["../src/platform-request-query.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sCAAsC,EACtC,qBAAqB,GAEtB,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;;GAUG;AAEH,0FAA0F;AAC1F,MAAM,CAAC,MAAM,wBAAwB,GACnC,8HAA8H,CAAC;AAEjI,MAAM,UAAU,2BAA2B,CAAC,MAA8B;IAIxE,MAAM,CAAC,GAAG,qBAAqB,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IACpD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAwB,EAAE,CAAC;IACvC,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACvB,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,sCAAsC,CAAC,CAAC;IAC/D,OAAO;QACL,GAAG,EACD,UAAU,wBAAwB,mCAAmC;YACrE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,2BAA2B;QAC7B,MAAM;KACP,CAAC;AACJ,CAAC"}
+{"version":3,"file":"platform-request-query.js","sourceRoot":"","sources":["../src/platform-request-query.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sCAAsC,EACtC,eAAe,EACf,qBAAqB,GAItB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAE9D;;;;;;;;;;GAUG;AAEH,0FAA0F;AAC1F,MAAM,CAAC,MAAM,wBAAwB,GACnC,8HAA8H,CAAC;AAEjI,MAAM,UAAU,2BAA2B,CAAC,MAA8B;IAIxE,MAAM,CAAC,GAAG,qBAAqB,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IACpD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAwB,EAAE,CAAC;IACvC,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACvB,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,sCAAsC,CAAC,CAAC;IAC/D,OAAO;QACL,GAAG,EACD,UAAU,wBAAwB,mCAAmC;YACrE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,2BAA2B;QAC7B,MAAM;KACP,CAAC;AACJ,CAAC;AAkBD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAU,eAAe,CAAC;AAE1D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAA0B;IAC1D,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC;IACpC,MAAM,CAAC,GAAG,UAAU,CAAC,wBAAwB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,iBAAiB,CAAC,CAAC;IAC1F,OAAO,CAAC,CAAC,MAAM,CAAkB;QAC/B,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAwB,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC;QAC7D,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAS,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC;QACtD,OAAO,EAAE,CAAC,CAAC,IAAI,CAAU,SAAS,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC;QACrE,WAAW,EAAE,CAAC,CAAC,IAAI,CAAQ,cAAc,EAAE,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,YAAY,EAAE,mBAAmB,CAAC;QACpG,aAAa,EAAE,CAAC,CAAC,IAAI,CAAmC,eAAe,EAAE,KAAK,CAAC,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC;QACtH,MAAM,EAAE,CAAC,CAAC,QAAQ,CAA4B,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC;QACjF,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAS,UAAU,EAAE,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC;QACtE,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAS,YAAY,EAAE,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC;QAC5E,OAAO,EAAE,CAAC,CAAC,IAAI,CAA6B,cAAc,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC;QAClG,MAAM,EAAE,CAAC,CAAC,IAAI,CAAU,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC;QACjE,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAiC,cAAc,EAAE,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,YAAY,CAAC;QAC5G,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAiC,YAAY,EAAE,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC;KACrG,CAAC,CAAC;AACL,CAAC"}