@substrat-run/kernel 0.116.0 → 0.117.0

package/dist/denial-query.d.ts

@@ -37,7 +37,22 @@ export interface DenialRow {
  * stringified. Round-trips exactly what `recordDenial` wrote in both adapters.
  */
 export declare function storedActor(input: string): string;
-/** Turn a stored row into the contract shape. */
+/**
+ * Turn a stored row into the contract shape — TOLERANTLY, and saying so (#1636).
+ *
+ * Every read of this log is a LIST, and the decode used to `JSON.parse` while mapping: one
+ * row whose `actor` or `impersonation` would not parse threw for the page, which for the
+ * only witness to a refused check is the worst read to lose. Each field is now decoded
+ * against its own contract field and whatever did not decode is named in `decodeError`,
+ * on `rowDecoder`'s rules — an undecodable actor reads as {@link UNDECODED_ACTOR}, and a
+ * row whose id, tenant or time does not decode still throws, naming them.
+ *
+ * `permission` is the exception to that last rule, deliberately. A malformed key is not
+ * only a dump's doing: nothing validates a checked key at runtime, so a module that casts
+ * one is refused and the refusal is recorded with it — and this log is where someone comes
+ * to find out why. Throwing would hide the evidence along with the list. So it reads as
+ * {@link UNDECODED_PERMISSION}, and `decodeError` quotes the stored key verbatim.
+ */
 export declare function mapDenialRow(row: DenialRow): PermissionDenial;
 /** A bounded page of raw denial rows, newest first. */
 export declare function denialListQuery(filter?: DenialFilter): {
@@ -70,6 +85,13 @@ export interface DenialBucketRow {
     first_at: string;
     last_at: string;
 }
+/**
+ * One (actor, permission) bucket, tolerantly (#1636). The buckets are `GROUP BY actor`, so a
+ * stored actor that would not parse is its own bucket — and used to throw the whole summary,
+ * the read a console opens first. It reads as {@link UNDECODED_ACTOR} now, still counted,
+ * with `decodeError` saying why. A malformed permission key is its own bucket too, and reads
+ * as {@link UNDECODED_PERMISSION} with the stored key quoted — `mapDenialRow` says why.
+ */
 export declare function mapDenialBucketRow(row: DenialBucketRow): DenialBucket;
 export interface DenialOperationBucketRow {
     operation: string | null;
@@ -77,6 +99,15 @@ export interface DenialOperationBucketRow {
     first_at: string;
     last_at: string;
 }
+/**
+ * One operation bucket, tolerantly (#1643) — the sibling `mapDenialBucketRow` already was.
+ *
+ * `operation` is the only column with an empty value its schema accepts: one that is not
+ * text reads as `null`, and `decodeError` says so, which is what keeps it from reading as
+ * the bucket for a refusal that ran outside an operation. `count` and the two times are
+ * required scalars: a bucket that breaks one throws, naming them, rather than being
+ * returned typed as valid.
+ */
 export declare function mapDenialOperationBucketRow(row: DenialOperationBucketRow): DenialOperationBucket;
 /** The half of a `DenialSummary` the grouped query answers; the facts are the other half. */
 export type DenialSummaryBuckets = Pick<DenialActorSummary, 'groupBy' | 'buckets'> | Pick<DenialOperationSummary, 'groupBy' | 'buckets'>;

package/dist/denial-query.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"denial-query.d.ts","sourceRoot":"","sources":["../src/denial-query.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAE3B,KAAK,gBAAgB,EAItB,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;;;GAWG;AAEH,gFAAgF;AAChF,eAAO,MAAM,cAAc,wGAC4E,CAAC;AAExG,0DAA0D;AAC1D,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,gFAAgF;IAChF,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,kFAAkF;IAClF,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOjD;AAED,iDAAiD;AACjD,wBAAgB,YAAY,CAAC,GAAG,EAAE,SAAS,GAAG,gBAAgB,CAiB7D;AAgCD,uDAAuD;AACvD,wBAAgB,eAAe,CAAC,MAAM,CAAC,EAAE,YAAY,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAA;CAAE,CAOnG;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,CAAC,EAAE,YAAY,GAAG;IACzD,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;IAC5B,OAAO,EAAE,aAAa,CAAC;CACxB,CAuBA;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,eAAe,GAAG,YAAY,CASrE;AAED,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,wBAAwB,GAAG,qBAAqB,CAOhG;AAED,6FAA6F;AAC7F,MAAM,MAAM,oBAAoB,GAC5B,IAAI,CAAC,kBAAkB,EAAE,SAAS,GAAG,SAAS,CAAC,GAC/C,IAAI,CAAC,sBAAsB,EAAE,SAAS,GAAG,SAAS,CAAC,CAAC;AAExD;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,oBAAoB,CAIrG;AAED,8EAA8E;AAC9E,wBAAgB,iBAAiB,CAAC,MAAM,CAAC,EAAE,YAAY,GAAG;IACxD,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;CAC7B,CAOA;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,QAGL,CAAC;AAE5B,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB"}
+{"version":3,"file":"denial-query.d.ts","sourceRoot":"","sources":["../src/denial-query.ts"],"names":[],"mappings":"AAAA,OAAO,EAML,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,gBAAgB,EACtB,MAAM,yBAAyB,CAAC;AAGjC;;;;;;;;;;;GAWG;AAEH,gFAAgF;AAChF,eAAO,MAAM,cAAc,wGAC4E,CAAC;AAExG,0DAA0D;AAC1D,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,gFAAgF;IAChF,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,kFAAkF;IAClF,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOjD;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,SAAS,GAAG,gBAAgB,CAkB7D;AAgCD,uDAAuD;AACvD,wBAAgB,eAAe,CAAC,MAAM,CAAC,EAAE,YAAY,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAA;CAAE,CAOnG;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,CAAC,EAAE,YAAY,GAAG;IACzD,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;IAC5B,OAAO,EAAE,aAAa,CAAC;CACxB,CAuBA;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,eAAe,GAAG,YAAY,CAWrE;AAED,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,wBAAwB,GAAG,qBAAqB,CAYhG;AAED,6FAA6F;AAC7F,MAAM,MAAM,oBAAoB,GAC5B,IAAI,CAAC,kBAAkB,EAAE,SAAS,GAAG,SAAS,CAAC,GAC/C,IAAI,CAAC,sBAAsB,EAAE,SAAS,GAAG,SAAS,CAAC,CAAC;AAExD;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,oBAAoB,CAIrG;AAED,8EAA8E;AAC9E,wBAAgB,iBAAiB,CAAC,MAAM,CAAC,EAAE,YAAY,GAAG;IACxD,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;CAC7B,CAOA;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,QAGL,CAAC;AAE5B,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB"}

package/dist/denial-query.js

@@ -1,4 +1,5 @@
-import { DEFAULT_DENIAL_LIMIT, denialFilter, } from '@substrat-run/contracts';
+import { DEFAULT_DENIAL_LIMIT, denialBucket, denialFilter, denialOperationBucket, permissionDenial, } from '@substrat-run/contracts';
+import { rowDecoder, UNDECODED_ACTOR, UNDECODED_PERMISSION } from './row-decode.js';
 /**
  * The SELECTs behind every read of a scope's denial log (#867, K-35's stated tail).
  *
@@ -30,23 +31,40 @@ export function storedActor(input) {
         return JSON.stringify(input);
     }
 }
-/** Turn a stored row into the contract shape. */
+/**
+ * Turn a stored row into the contract shape — TOLERANTLY, and saying so (#1636).
+ *
+ * Every read of this log is a LIST, and the decode used to `JSON.parse` while mapping: one
+ * row whose `actor` or `impersonation` would not parse threw for the page, which for the
+ * only witness to a refused check is the worst read to lose. Each field is now decoded
+ * against its own contract field and whatever did not decode is named in `decodeError`,
+ * on `rowDecoder`'s rules — an undecodable actor reads as {@link UNDECODED_ACTOR}, and a
+ * row whose id, tenant or time does not decode still throws, naming them.
+ *
+ * `permission` is the exception to that last rule, deliberately. A malformed key is not
+ * only a dump's doing: nothing validates a checked key at runtime, so a module that casts
+ * one is refused and the refusal is recorded with it — and this log is where someone comes
+ * to find out why. Throwing would hide the evidence along with the list. So it reads as
+ * {@link UNDECODED_PERMISSION}, and `decodeError` quotes the stored key verbatim.
+ */
 export function mapDenialRow(row) {
-    return {
-        id: row.id,
-        actor: JSON.parse(row.actor),
-        permission: row.permission,
-        tenantId: row.tenant_id,
-        scopeId: (row.scope_id ?? null),
-        operation: row.operation ?? null,
-        impersonation: row.impersonation == null ? null : JSON.parse(row.impersonation),
+    const shape = permissionDenial.shape;
+    const d = rowDecoder(`denial row ${JSON.stringify(row.id)}`, 'PermissionDenial');
+    return d.finish({
+        id: d.required('id', shape.id, row.id),
+        actor: d.json('actor', shape.actor, row.actor, UNDECODED_ACTOR),
+        permission: d.marked('permission', shape.permission, row.permission, UNDECODED_PERMISSION),
+        tenantId: d.required('tenant_id', shape.tenantId, row.tenant_id),
+        scopeId: d.nullable('scope_id', shape.scopeId, row.scope_id ?? null),
+        operation: d.nullable('operation', shape.operation, row.operation ?? null),
+        impersonation: d.json('impersonation', shape.impersonation, row.impersonation ?? null, null),
         // #1525: which CALL was refused, not merely which operation — the join that lets
         // "same call" reach a request's refusals. `?? null` rather than a bare read, for
         // the row a legacy store hands back with the column absent.
-        invocationId: row.invocation_id ?? null,
-        at: row.at,
-        drainedAt: row.drained_at ?? null,
-    };
+        invocationId: d.nullable('invocation_id', shape.invocationId, row.invocation_id ?? null),
+        at: d.required('at', shape.at, row.at),
+        drainedAt: d.nullable('drained_at', shape.drainedAt, row.drained_at ?? null),
+    });
 }
 /** The WHERE fragment shared by the row read and the summary. */
 function where(f) {
@@ -122,23 +140,43 @@ export function denialSummaryQuery(filter) {
         groupBy,
     };
 }
+/**
+ * One (actor, permission) bucket, tolerantly (#1636). The buckets are `GROUP BY actor`, so a
+ * stored actor that would not parse is its own bucket — and used to throw the whole summary,
+ * the read a console opens first. It reads as {@link UNDECODED_ACTOR} now, still counted,
+ * with `decodeError` saying why. A malformed permission key is its own bucket too, and reads
+ * as {@link UNDECODED_PERMISSION} with the stored key quoted — `mapDenialRow` says why.
+ */
 export function mapDenialBucketRow(row) {
-    return {
-        actor: JSON.parse(row.actor),
-        permission: row.permission,
-        count: Number(row.count),
-        operations: Number(row.operations),
-        firstAt: row.first_at,
-        lastAt: row.last_at,
-    };
+    const shape = denialBucket.shape;
+    const d = rowDecoder(`denial bucket for ${JSON.stringify(row.permission)}`, 'DenialBucket');
+    return d.finish({
+        actor: d.json('actor', shape.actor, row.actor, UNDECODED_ACTOR),
+        permission: d.marked('permission', shape.permission, row.permission, UNDECODED_PERMISSION),
+        count: d.required('count', shape.count, Number(row.count)),
+        operations: d.required('operations', shape.operations, Number(row.operations)),
+        firstAt: d.required('first_at', shape.firstAt, row.first_at),
+        lastAt: d.required('last_at', shape.lastAt, row.last_at),
+    });
 }
+/**
+ * One operation bucket, tolerantly (#1643) — the sibling `mapDenialBucketRow` already was.
+ *
+ * `operation` is the only column with an empty value its schema accepts: one that is not
+ * text reads as `null`, and `decodeError` says so, which is what keeps it from reading as
+ * the bucket for a refusal that ran outside an operation. `count` and the two times are
+ * required scalars: a bucket that breaks one throws, naming them, rather than being
+ * returned typed as valid.
+ */
 export function mapDenialOperationBucketRow(row) {
-    return {
-        operation: row.operation ?? null,
-        count: Number(row.count),
-        firstAt: row.first_at,
-        lastAt: row.last_at,
-    };
+    const shape = denialOperationBucket.shape;
+    const d = rowDecoder(`denial operation bucket ${JSON.stringify(row.operation ?? null)}`, 'DenialOperationBucket');
+    return d.finish({
+        operation: d.nullable('operation', shape.operation, row.operation ?? null),
+        count: d.required('count', shape.count, Number(row.count)),
+        firstAt: d.required('first_at', shape.firstAt, row.first_at),
+        lastAt: d.required('last_at', shape.lastAt, row.last_at),
+    });
 }
 /**
  * Map the rows `denialSummaryQuery` came back with, under the grouping it reported —

package/dist/denial-query.js.map

@@ -1 +1 @@
-{"version":3,"file":"denial-query.js","sourceRoot":"","sources":["../src/denial-query.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,YAAY,GAab,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;;;GAWG;AAEH,gFAAgF;AAChF,MAAM,CAAC,MAAM,cAAc,GACzB,qGAAqG,CAAC;AAkBxG;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,IAAI,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAClB,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,YAAY,CAAC,GAAc;IACzC,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAU;QACrC,UAAU,EAAE,GAAG,CAAC,UAA2B;QAC3C,QAAQ,EAAE,GAAG,CAAC,SAAqB;QACnC,OAAO,EAAE,CAAC,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAmB;QACjD,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI;QAChC,aAAa,EACX,GAAG,CAAC,aAAa,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAwB;QAC1F,iFAAiF;QACjF,iFAAiF;QACjF,4DAA4D;QAC5D,YAAY,EAAE,GAAG,CAAC,aAAa,IAAI,IAAI;QACvC,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,SAAS,EAAE,GAAG,CAAC,UAAU,IAAI,IAAI;KAClC,CAAC;AACJ,CAAC;AAED,iEAAiE;AACjE,SAAS,KAAK,CAAC,CAAe;IAC5B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAwB,EAAE,CAAC;IACvC,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IAC5B,CAAC;IACD,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC;IACD,+EAA+E;IAC/E,oFAAoF;IACpF,uEAAuE;IACvE,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IACD,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrB,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC;AACjF,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,eAAe,CAAC,MAAqB;IACnD,MAAM,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IAC3C,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACnB,OAAO;QACL,GAAG,EAAE,UAAU,cAAc,0BAA0B,CAAC,CAAC,MAAM,2BAA2B;QAC1F,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,IAAI,oBAAoB,CAAC;KACvD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAqB;IAKtD,MAAM,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IAC3C,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACnB,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,IAAI,kBAAkB,CAAC;IAChD,MAAM,MAAM,GACV,OAAO,KAAK,WAAW;QACrB,CAAC,CAAC,+EAA+E;YAC/E,6EAA6E;YAC7E,mEAAmE;YACnE,sCAAsC;gBACtC,8DAA8D;gBAC9D,0BAA0B,CAAC,CAAC,MAAM,EAAE;gBACpC,qBAAqB;QACvB,CAAC,CAAC,8CAA8C;YAC9C,2CAA2C;YAC3C,8DAA8D;YAC9D,0BAA0B,CAAC,CAAC,MAAM,EAAE;YACpC,6BAA6B,CAAC;IACpC,OAAO;QACL,GAAG,EAAE,GAAG,MAAM,4CAA4C;QAC1D,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,IAAI,oBAAoB,CAAC;QACtD,OAAO;KACR,CAAC;AACJ,CAAC;AAWD,MAAM,UAAU,kBAAkB,CAAC,GAAoB;IACrD,OAAO;QACL,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAU;QACrC,UAAU,EAAE,GAAG,CAAC,UAA2B;QAC3C,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;QACxB,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;QAClC,OAAO,EAAE,GAAG,CAAC,QAAQ;QACrB,MAAM,EAAE,GAAG,CAAC,OAAO;KACpB,CAAC;AACJ,CAAC;AASD,MAAM,UAAU,2BAA2B,CAAC,GAA6B;IACvE,OAAO;QACL,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI;QAChC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;QACxB,OAAO,EAAE,GAAG,CAAC,QAAQ;QACrB,MAAM,EAAE,GAAG,CAAC,OAAO;KACpB,CAAC;AACJ,CAAC;AAOD;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAsB,EAAE,IAAe;IAC7E,OAAO,OAAO,KAAK,WAAW;QAC5B,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAG,IAAmC,CAAC,GAAG,CAAC,2BAA2B,CAAC,EAAE;QAC7F,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAG,IAA0B,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;AAChF,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,iBAAiB,CAAC,MAAqB;IAIrD,MAAM,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IAC3C,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACnB,OAAO;QACL,GAAG,EAAE,mFAAmF,CAAC,CAAC,MAAM,EAAE;QAClG,MAAM,EAAE,CAAC,CAAC,MAAM;KACjB,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAC9B,oDAAoD;IACpD,qEAAqE;IACrE,yBAAyB,CAAC"}
+{"version":3,"file":"denial-query.js","sourceRoot":"","sources":["../src/denial-query.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,YAAY,EACZ,YAAY,EACZ,qBAAqB,EACrB,gBAAgB,GAQjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAEpF;;;;;;;;;;;GAWG;AAEH,gFAAgF;AAChF,MAAM,CAAC,MAAM,cAAc,GACzB,qGAAqG,CAAC;AAkBxG;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,IAAI,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAClB,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,YAAY,CAAC,GAAc;IACzC,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,CAAC;IACrC,MAAM,CAAC,GAAG,UAAU,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,kBAAkB,CAAC,CAAC;IACjF,OAAO,CAAC,CAAC,MAAM,CAAmB;QAChC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAS,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC;QAC9C,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,eAAe,CAAC;QAC/D,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,oBAAoB,CAAC;QAC1F,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC;QAChE,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC;QACpE,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC;QAC1E,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,aAAa,EAAE,GAAG,CAAC,aAAa,IAAI,IAAI,EAAE,IAAI,CAAC;QAC5F,iFAAiF;QACjF,iFAAiF;QACjF,4DAA4D;QAC5D,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,eAAe,EAAE,KAAK,CAAC,YAAY,EAAE,GAAG,CAAC,aAAa,IAAI,IAAI,CAAC;QACxF,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAS,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC;QAC9C,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,YAAY,EAAE,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC;KAC7E,CAAC,CAAC;AACL,CAAC;AAED,iEAAiE;AACjE,SAAS,KAAK,CAAC,CAAe;IAC5B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAwB,EAAE,CAAC;IACvC,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IAC5B,CAAC;IACD,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC;IACD,+EAA+E;IAC/E,oFAAoF;IACpF,uEAAuE;IACvE,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IACD,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrB,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC;AACjF,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,eAAe,CAAC,MAAqB;IACnD,MAAM,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IAC3C,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACnB,OAAO;QACL,GAAG,EAAE,UAAU,cAAc,0BAA0B,CAAC,CAAC,MAAM,2BAA2B;QAC1F,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,IAAI,oBAAoB,CAAC;KACvD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAqB;IAKtD,MAAM,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IAC3C,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACnB,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,IAAI,kBAAkB,CAAC;IAChD,MAAM,MAAM,GACV,OAAO,KAAK,WAAW;QACrB,CAAC,CAAC,+EAA+E;YAC/E,6EAA6E;YAC7E,mEAAmE;YACnE,sCAAsC;gBACtC,8DAA8D;gBAC9D,0BAA0B,CAAC,CAAC,MAAM,EAAE;gBACpC,qBAAqB;QACvB,CAAC,CAAC,8CAA8C;YAC9C,2CAA2C;YAC3C,8DAA8D;YAC9D,0BAA0B,CAAC,CAAC,MAAM,EAAE;YACpC,6BAA6B,CAAC;IACpC,OAAO;QACL,GAAG,EAAE,GAAG,MAAM,4CAA4C;QAC1D,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,IAAI,oBAAoB,CAAC;QACtD,OAAO;KACR,CAAC;AACJ,CAAC;AAWD;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAoB;IACrD,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC;IACjC,MAAM,CAAC,GAAG,UAAU,CAAC,qBAAqB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;IAC5F,OAAO,CAAC,CAAC,MAAM,CAAe;QAC5B,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,eAAe,CAAC;QAC/D,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,oBAAoB,CAAC;QAC1F,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAS,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClE,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAS,YAAY,EAAE,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACtF,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAS,UAAU,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC;QACpE,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAS,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC;KACjE,CAAC,CAAC;AACL,CAAC;AASD;;;;;;;;GAQG;AACH,MAAM,UAAU,2BAA2B,CAAC,GAA6B;IACvE,MAAM,KAAK,GAAG,qBAAqB,CAAC,KAAK,CAAC;IAC1C,MAAM,CAAC,GAAG,UAAU,CAClB,2BAA2B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,EAAE,EAClE,uBAAuB,CACxB,CAAC;IACF,OAAO,CAAC,CAAC,MAAM,CAAwB;QACrC,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC;QAC1E,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAS,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClE,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAS,UAAU,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC;QACpE,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAS,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC;KACjE,CAAC,CAAC;AACL,CAAC;AAOD;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAsB,EAAE,IAAe;IAC7E,OAAO,OAAO,KAAK,WAAW;QAC5B,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAG,IAAmC,CAAC,GAAG,CAAC,2BAA2B,CAAC,EAAE;QAC7F,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAG,IAA0B,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;AAChF,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,iBAAiB,CAAC,MAAqB;IAIrD,MAAM,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IAC3C,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACnB,OAAO;QACL,GAAG,EAAE,mFAAmF,CAAC,CAAC,MAAM,EAAE;QAClG,MAAM,EAAE,CAAC,CAAC,MAAM;KACjB,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAC9B,oDAAoD;IACpD,qEAAqE;IACrE,yBAAyB,CAAC"}

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 export type { AccessLogFilter, AttachmentUploadInput, AuditLogFilter, BlobStoreProvisionInput, BlobStoreRecord, ConsumerHandler, ExecutorDeadLetter, ExecutorDrainReport, ExecutorHandler, ExecutorRetryPolicy, ConnectorConnection, ScopedConnectorConnection, ConnectorContext, ConnectorHandler, ConnectorOptions, ConnectorRequestInit, ConnectorResponse, Clock, FetchLike, GuardPredicate, HostAdmin, MigrateScopeOutcome, MigrationFrontier, ModuleRegistration, ConsumersOf, EventContract, EventPayloadOf, EventTypeOf, TypedConsumerHandler, TypedConsumers, OpenedAttachment, OperationContext, PageParams, OperationHandler, AppliedMigration, OpsFailureFilter, OpsFailureInput, IssueFilter, SweepRunFilter, SweepRunInput, ProvisionScopeInput, RoleFilter, FreshnessRegistration, FreshnessReport, LiveChange, LiveReadSurface, LiveUpgradeRequest, ScheduleRegistration, ScheduleRunReport, ScopeAttachments, ScopedSql, ScopeFilter, ScopeHost, ScopeStub, ScopeStubOptions, InvokeOptions, SqlMigration, SqlValue, TenantBlobStore, TenantRelationalStore, TenantStoreProvisionInput, TenantStoreRecord, } from './scope-host.js';
-export { assertRedrainWindow, attachmentBlobKey, consumersFor, entitlementDenial, backoffAt, globalFetch, parseValidationRecords, resolveRetryPolicy, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, ISSUE_RETENTION_DAYS, } from './scope-host.js';
+export { assertRedrainWindow, attachmentBlobKey, consumersFor, entitlementDenial, backoffAt, globalFetch, parseValidationRecords, resolveRetryPolicy, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, SWEEP_RUNS_INTENT_INDEX, sweepRunsIntentHasKind, ISSUE_RETENTION_DAYS, } from './scope-host.js';
 export { isSecretBoxConfigured, SecretBoxUnconfiguredError, unconfiguredSecretBox, webCryptoSecretBox, } from './secret-box.js';
 export type { SealedSecret, SecretBox } from './secret-box.js';
 export { ConnectionSealingKeyUnavailableError, generateSealingKeyPair, noSealingKeyMessage, openSealed, sealTo, SealedKeyUnavailableError, } from './sealed-box.js';
@@ -9,10 +9,12 @@ export type { SubjectKeyRecords, SubjectKeyRow, SubjectKeys } from './subject-ke
 export { resolveScopeRecord } from './scope-record.js';
 export type { ResolvedScopeRecord } from './scope-record.js';
 export { assertAllowed, denyAllChecker, PermissionDenied, UNSAFE_allowAllChecker, } from './permission-checker.js';
-export { asPrincipal } from './permission-checker.js';
+export { actorOf, asPrincipal } from './permission-checker.js';
 export type { PermissionChecker } from './permission-checker.js';
 export { createTupleEvaluator } from './permission-eval.js';
 export type { PermissionTupleReader, PermissionTupleRow, ScopeTupleReader, } from './permission-eval.js';
+export { CAPABILITY_COLUMNS, CAPABILITY_DDL, CAPABILITY_EXCHANGE_OPERATION, CAPABILITY_SESSION_PRUNE_BATCH, WITHHELD_SECRET, assertNoSecret, capabilityByIdQuery, capabilityExchangeable, capabilityGrantOf, capabilityLive, capabilityRecordOf, capabilityTokenHash, carriesSecret, checkBecomeInput, createCapabilityVerbs, exchangeCapability, guardSecrets, mintBecomeCapability, mintCapabilitySecret, mintCapabilitySessionToken, persistedText, plausibleSessionToken, redactSecrets, resolveCapabilitySession, revokeCapabilityAsPlatform, } from './capability.js';
+export type { CapabilityGrantView, CapabilityRow, CapabilityVerbDeps, CapabilityVerbs, } from './capability.js';
 export { createAtomic } from './sub-transaction.js';
 export type { RunSub, AtomicMarks } from './sub-transaction.js';
 export { DEFAULT_SEARCH_LIMIT, MAX_SEARCH_LIMIT, MIN_SEARCH_TERM, NotSearchable, SEARCH_INDEX_PREFIX, SearchTermTooShort, isSearchIndexTable, searchIndexDdl, searchIndexMigrations, searchIndexPlans, searchLimit, searchMatchExpression, searchPlansByEntityType, searchQuery, } from './search-index.js';
@@ -24,24 +26,37 @@ export type { ManualClock } from './clock.js';
 export { createUlid, ulid, ulidTime, type UlidMint } from './ulid.js';
 export { assertReadOnlyQuery } from './read-only-sql.js';
 export { assertNoSpineWrite, guardSpine } from './spine-guard.js';
+export { assertPermissionKey } from './check-key.js';
 export { assertModuleEnqueueableKind } from './platform-kinds.js';
 export { readRoutedNode, RouterAssertionError } from './routed-node.js';
 export type { RoutedNode, HeaderReader, ReadRoutedNodeOptions } from './routed-node.js';
 export { assertPlatformCall, PlatformCallError, PLATFORM_SECRET_HEADER, PLATFORM_REQUEST_HEADER, CONNECTOR_ATTACHMENT_RECORD_HEADER, } from './platform-call.js';
 export { signConnectState, verifyConnectState, ConnectStateError, CONNECT_STATE_PURPOSE, } from './connect-state.js';
 export type { ConnectStateClaim } from './connect-state.js';
-export { PLATFORM_REQUEST_COLUMNS, platformRequestHistoryQuery, } from './platform-request-query.js';
+export { PLATFORM_REQUEST_COLUMNS, platformRequestHistoryQuery, platformRequestOf, UNDECODED_REQUESTER, } from './platform-request-query.js';
+export type { PlatformRequestRawRow } from './platform-request-query.js';
+export { CANCELLED_INTENT_NOTE, intentPayloadCarriesSubject, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, REDACTED_INTENT_MARKER, REDACTED_INTENT_NOTE, redactedIntentPayload, } from './subject-redaction.js';
+export type { PlatformRequestRedactionCandidate, SubjectRedactionCounts, } from './subject-redaction.js';
+export { effectiveRoleGrantQuery, seatScopeTuple } from './scope-tuple-seat.js';
+export { SYSTEM_SWITCH_OFF_PREDICATE, SYSTEM_SWITCH_OFF_RELATION, switchSystemSchedules, systemScheduleState, systemSwitchedOff, systemSwitchedOffMessage, } from './system-switch.js';
+export type { SwitchOutcome, SwitchSql, SystemScheduleState } from './system-switch.js';
 export { DENIAL_COLUMNS, DENIAL_WINDOW_QUERY, denialListQuery, denialSummaryQuery, denialTotalsQuery, mapDenialRow, mapDenialBucketRow, mapDenialOperationBucketRow, mapDenialSummaryBuckets, storedActor, type DenialRow, type DenialBucketRow, type DenialOperationBucketRow, type DenialSummaryBuckets, type DenialWindowRow, } from './denial-query.js';
 export { entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, type EntityVersion, type EntityVersionRow, } from './entity-version.js';
 export { IMPERSONATION_COLUMNS, IMPERSONATION_DDL, ImpersonationRefused, assertImpersonationWrites, assertSessionUsable, impersonationByIdQuery, impersonationListQuery, impersonationRowValues, impersonationStampOf, mapImpersonationRow, newImpersonationSession, type ImpersonationRow, } from './impersonation.js';
 export { readTimeline, readHistory, facetEvents, walkEventCause, walkEventEffects, readInvocation, readDeadLetters } from './timeline.js';
 export type { TimelineReader } from './timeline.js';
+export { rowDecoder, UNDECODED_ACTOR, UNDECODED_PERMISSION } from './row-decode.js';
+export type { RowDecoder } from './row-decode.js';
+export { domainEventOf, drainedEventOf, readUndrainedOutbox, undrainedEventsOf, UNDRAINED_SCAN_FACTOR, UNDRAINED_SKIPPED_IDS, } from './outbox-event.js';
+export type { OutboxEnvelopeRow, OutboxDrainRow, UndrainedEvents, UndrainedRead, UndrainedSkipped, } from './outbox-event.js';
 export { IDEMPOTENCY_DDL, assertIdempotencyKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencySubject, idempotencyOptedOutMessage, replayFor, type IdempotencyRow, type IdempotentReplay, } from './idempotency.js';
 export { JOB_RUN_DDL, JOB_DRIVE_LIMIT, JOB_DRIVE_SCAN_MAX, JOB_RUN_LIST_LIMIT, JOB_RUN_LIST_MAX, jobRunListLimit, JOB_STEP_REUSED, assertQueueSafe, jobRunOf, runDueJobRuns, runJobPass, startJobRun, } from './job-run.js';
 export type { JobDriveReport, JobHandler, JobPassContext, JobPassOutcome, JobPassResult, JobRun, JobRunFilter, JobRunKey, JobRunPatch, JobRunRow, JobRunStatus, JobRunStore, JobStepRow, StartJobRunInput, } from './job-run.js';
 export { isTerminalDispatchFailure, isTerminalProviderError, providerErrorStatus, RETRYABLE_CLIENT_STATUSES, } from './provider-error.js';
 export { runPlatformSweep, startPlatformSweeper, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, } from './platform-sweep.js';
-export type { AccessLogSink, EventSink, EventDrainReport, AccessLogSweepReport, ConnectorSweeper, MigrationSweepReport, PlatformSweepOptions, PlatformSweepReport, PlatformSweeperHandle, ScheduleSweepReport, ScheduleStateKind, StartPlatformSweeperOptions, } from './platform-sweep.js';
+export type { AccessLogSink, EventSink, EventDrainReport, EventDrainSkipped, AccessLogSweepReport, ConnectorSweeper, MigrationSweepReport, PlatformSweepOptions, PlatformSweepReport, PlatformSweeperHandle, ScheduleSweepReport, ScheduleStateKind, StartPlatformSweeperOptions, } from './platform-sweep.js';
+export { isPrimaryScope, runningVersionOf, PROVISION_RECONCILE_BATCH, PROVISION_RECONCILE_REPORTED_IDS, } from './platform-sweep.js';
+export type { ProvisionReconcileReport, ServingPointer } from './platform-sweep.js';
 export { MIGRATION_FLAG_THRESHOLD, migrationFleet, migrationProgress, migrationSummary, scopeMigrationState, } from './migration-progress.js';
 export type { ScopeMigrationState } from './migration-progress.js';
 export { foldMeterReading } from './meters.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,eAAe,EACf,qBAAqB,EACrB,cAAc,EACd,uBAAuB,EACvB,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,EACf,mBAAmB,EACnB,mBAAmB,EACnB,yBAAyB,EACzB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,EACpB,iBAAiB,EACjB,KAAK,EACL,SAAS,EACT,cAAc,EACd,SAAS,EACT,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,cAAc,EACd,WAAW,EACX,oBAAoB,EACpB,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,UAAU,EACV,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,WAAW,EACX,cAAc,EACd,aAAa,EACb,mBAAmB,EACnB,UAAU,EACV,qBAAqB,EACrB,eAAe,EACf,UAAU,EACV,eAAe,EACf,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,EAChB,SAAS,EACT,WAAW,EACX,SAAS,EACT,SAAS,EACT,gBAAgB,EAChB,aAAa,EACb,YAAY,EACZ,QAAQ,EACR,eAAe,EACf,qBAAqB,EACrB,yBAAyB,EACzB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,SAAS,EACT,WAAW,EACX,sBAAsB,EACtB,kBAAkB,EAClB,0BAA0B,EAC1B,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,qBAAqB,EACrB,0BAA0B,EAC1B,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EACL,oCAAoC,EACpC,sBAAsB,EACtB,mBAAmB,EACnB,UAAU,EACV,MAAM,EACN,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,YAAY,EAAE,iBAAiB,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACvF,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,YAAY,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EACL,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,YAAY,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,YAAY,EACV,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,EACd,qBAAqB,EACrB,gBAAgB,EAChB,WAAW,EACX,qBAAqB,EACrB,uBAAuB,EACvB,WAAW,GACZ,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,SAAS,EACT,eAAe,EACf,aAAa,EACb,eAAe,EACf,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,WAAW,EACX,eAAe,EACf,QAAQ,EACR,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,mBAAmB,EACnB,cAAc,EACd,qBAAqB,EACrB,SAAS,EACT,WAAW,GACZ,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,eAAe,GAChB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACtD,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,QAAQ,EAAE,MAAM,WAAW,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACxF,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,sBAAsB,EACtB,uBAAuB,EACvB,kCAAkC,GACnC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EACL,wBAAwB,EACxB,2BAA2B,GAC5B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,eAAe,EACf,kBAAkB,EAClB,iBAAiB,EACjB,YAAY,EACZ,kBAAkB,EAClB,2BAA2B,EAC3B,uBAAuB,EACvB,WAAW,EACX,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EACzB,KAAK,eAAe,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,aAAa,EACb,mBAAmB,EACnB,KAAK,aAAa,EAClB,KAAK,gBAAgB,GACtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,oBAAoB,EACpB,yBAAyB,EACzB,mBAAmB,EACnB,sBAAsB,EACtB,sBAAsB,EACtB,sBAAsB,EACtB,oBAAoB,EACpB,mBAAmB,EACnB,uBAAuB,EACvB,KAAK,gBAAgB,GACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,cAAc,EAAE,gBAAgB,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAC1I,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,sBAAsB,EACtB,yBAAyB,EACzB,0BAA0B,EAC1B,kBAAkB,EAClB,0BAA0B,EAC1B,SAAS,EACT,KAAK,cAAc,EACnB,KAAK,gBAAgB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,WAAW,EACX,eAAe,EACf,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,eAAe,EACf,QAAQ,EACR,aAAa,EACb,UAAU,EACV,WAAW,GACZ,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,cAAc,EACd,UAAU,EACV,cAAc,EACd,cAAc,EACd,aAAa,EACb,MAAM,EACN,YAAY,EACZ,SAAS,EACT,WAAW,EACX,SAAS,EACT,YAAY,EACZ,WAAW,EACX,UAAU,EACV,gBAAgB,GACjB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACvB,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,aAAa,EACb,SAAS,EACT,gBAAgB,EAChB,oBAAoB,EACpB,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,mBAAmB,EACnB,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,EACjB,2BAA2B,GAC5B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,wBAAwB,EACxB,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EACL,0BAA0B,EAC1B,cAAc,EACd,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,gBAAgB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,qBAAqB,EACrB,UAAU,EACV,eAAe,EACf,gBAAgB,GACjB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,YAAY,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,eAAe,EACf,qBAAqB,EACrB,cAAc,EACd,uBAAuB,EACvB,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,EACf,mBAAmB,EACnB,mBAAmB,EACnB,yBAAyB,EACzB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,EACpB,iBAAiB,EACjB,KAAK,EACL,SAAS,EACT,cAAc,EACd,SAAS,EACT,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,cAAc,EACd,WAAW,EACX,oBAAoB,EACpB,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,UAAU,EACV,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,WAAW,EACX,cAAc,EACd,aAAa,EACb,mBAAmB,EACnB,UAAU,EACV,qBAAqB,EACrB,eAAe,EACf,UAAU,EACV,eAAe,EACf,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,EAChB,SAAS,EACT,WAAW,EACX,SAAS,EACT,SAAS,EACT,gBAAgB,EAChB,aAAa,EACb,YAAY,EACZ,QAAQ,EACR,eAAe,EACf,qBAAqB,EACrB,yBAAyB,EACzB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,SAAS,EACT,WAAW,EACX,sBAAsB,EACtB,kBAAkB,EAClB,0BAA0B,EAC1B,wBAAwB,EACxB,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,qBAAqB,EACrB,0BAA0B,EAC1B,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EACL,oCAAoC,EACpC,sBAAsB,EACtB,mBAAmB,EACnB,UAAU,EACV,MAAM,EACN,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,YAAY,EAAE,iBAAiB,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACvF,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,YAAY,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EACL,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC/D,YAAY,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,YAAY,EACV,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,6BAA6B,EAC7B,8BAA8B,EAC9B,eAAe,EACf,cAAc,EACd,mBAAmB,EACnB,sBAAsB,EACtB,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,aAAa,EACb,gBAAgB,EAChB,qBAAqB,EACrB,kBAAkB,EAClB,YAAY,EACZ,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,EAC1B,aAAa,EACb,qBAAqB,EACrB,aAAa,EACb,wBAAwB,EACxB,0BAA0B,GAC3B,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,mBAAmB,EACnB,aAAa,EACb,kBAAkB,EAClB,eAAe,GAChB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,EACd,qBAAqB,EACrB,gBAAgB,EAChB,WAAW,EACX,qBAAqB,EACrB,uBAAuB,EACvB,WAAW,GACZ,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,SAAS,EACT,eAAe,EACf,aAAa,EACb,eAAe,EACf,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,WAAW,EACX,eAAe,EACf,QAAQ,EACR,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,mBAAmB,EACnB,cAAc,EACd,qBAAqB,EACrB,SAAS,EACT,WAAW,GACZ,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,eAAe,GAChB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACtD,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,QAAQ,EAAE,MAAM,WAAW,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACxF,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,sBAAsB,EACtB,uBAAuB,EACvB,kCAAkC,GACnC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EACL,wBAAwB,EACxB,2BAA2B,EAC3B,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,6BAA6B,CAAC;AACrC,YAAY,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACzE,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,8BAA8B,EAC9B,8BAA8B,EAC9B,6BAA6B,EAC7B,sBAAsB,EACtB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,iCAAiC,EACjC,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,uBAAuB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAChF,OAAO,EACL,2BAA2B,EAC3B,0BAA0B,EAC1B,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,EACjB,wBAAwB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACxF,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,eAAe,EACf,kBAAkB,EAClB,iBAAiB,EACjB,YAAY,EACZ,kBAAkB,EAClB,2BAA2B,EAC3B,uBAAuB,EACvB,WAAW,EACX,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EACzB,KAAK,eAAe,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,aAAa,EACb,mBAAmB,EACnB,KAAK,aAAa,EAClB,KAAK,gBAAgB,GACtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,oBAAoB,EACpB,yBAAyB,EACzB,mBAAmB,EACnB,sBAAsB,EACtB,sBAAsB,EACtB,sBAAsB,EACtB,oBAAoB,EACpB,mBAAmB,EACnB,uBAAuB,EACvB,KAAK,gBAAgB,GACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,cAAc,EAAE,gBAAgB,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAC1I,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACpF,YAAY,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EACL,aAAa,EACb,cAAc,EACd,mBAAmB,EACnB,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,iBAAiB,EACjB,cAAc,EACd,eAAe,EACf,aAAa,EACb,gBAAgB,GACjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,sBAAsB,EACtB,yBAAyB,EACzB,0BAA0B,EAC1B,kBAAkB,EAClB,0BAA0B,EAC1B,SAAS,EACT,KAAK,cAAc,EACnB,KAAK,gBAAgB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,WAAW,EACX,eAAe,EACf,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,eAAe,EACf,QAAQ,EACR,aAAa,EACb,UAAU,EACV,WAAW,GACZ,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,cAAc,EACd,UAAU,EACV,cAAc,EACd,cAAc,EACd,aAAa,EACb,MAAM,EACN,YAAY,EACZ,SAAS,EACT,WAAW,EACX,SAAS,EACT,YAAY,EACZ,WAAW,EACX,UAAU,EACV,gBAAgB,GACjB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACvB,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,aAAa,EACb,SAAS,EACT,gBAAgB,EAChB,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,mBAAmB,EACnB,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,EACjB,2BAA2B,GAC5B,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,yBAAyB,EACzB,gCAAgC,GACjC,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,wBAAwB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACpF,OAAO,EACL,wBAAwB,EACxB,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EACL,0BAA0B,EAC1B,cAAc,EACd,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,gBAAgB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,qBAAqB,EACrB,UAAU,EACV,eAAe,EACf,gBAAgB,GACjB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,YAAY,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/index.js

@@ -1,11 +1,12 @@
-export { assertRedrainWindow, attachmentBlobKey, consumersFor, entitlementDenial, backoffAt, globalFetch, parseValidationRecords, resolveRetryPolicy, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, ISSUE_RETENTION_DAYS, } from './scope-host.js';
+export { assertRedrainWindow, attachmentBlobKey, consumersFor, entitlementDenial, backoffAt, globalFetch, parseValidationRecords, resolveRetryPolicy, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, SWEEP_RUNS_INTENT_INDEX, sweepRunsIntentHasKind, ISSUE_RETENTION_DAYS, } from './scope-host.js';
 export { isSecretBoxConfigured, SecretBoxUnconfiguredError, unconfiguredSecretBox, webCryptoSecretBox, } from './secret-box.js';
 export { ConnectionSealingKeyUnavailableError, generateSealingKeyPair, noSealingKeyMessage, openSealed, sealTo, SealedKeyUnavailableError, } from './sealed-box.js';
 export { createSubjectKeys } from './subject-keys.js';
 export { resolveScopeRecord } from './scope-record.js';
 export { assertAllowed, denyAllChecker, PermissionDenied, UNSAFE_allowAllChecker, } from './permission-checker.js';
-export { asPrincipal } from './permission-checker.js';
+export { actorOf, asPrincipal } from './permission-checker.js';
 export { createTupleEvaluator } from './permission-eval.js';
+export { CAPABILITY_COLUMNS, CAPABILITY_DDL, CAPABILITY_EXCHANGE_OPERATION, CAPABILITY_SESSION_PRUNE_BATCH, WITHHELD_SECRET, assertNoSecret, capabilityByIdQuery, capabilityExchangeable, capabilityGrantOf, capabilityLive, capabilityRecordOf, capabilityTokenHash, carriesSecret, checkBecomeInput, createCapabilityVerbs, exchangeCapability, guardSecrets, mintBecomeCapability, mintCapabilitySecret, mintCapabilitySessionToken, persistedText, plausibleSessionToken, redactSecrets, resolveCapabilitySession, revokeCapabilityAsPlatform, } from './capability.js';
 export { createAtomic } from './sub-transaction.js';
 export { DEFAULT_SEARCH_LIMIT, MAX_SEARCH_LIMIT, MIN_SEARCH_TERM, NotSearchable, SEARCH_INDEX_PREFIX, SearchTermTooShort, isSearchIndexTable, searchIndexDdl, searchIndexMigrations, searchIndexPlans, searchLimit, searchMatchExpression, searchPlansByEntityType, searchQuery, } from './search-index.js';
 export { FilterNotDeclared, LIST_INDEX_PREFIX, NotListable, SortNotDeclared, cursorOf, isListIndexName, listIndexColumns, listIndexDdl, listIndexMigrations, listIndexPlans, listPlansByEntityType, listQuery, splitCursor, } from './list-index.js';
@@ -13,19 +14,29 @@ export { frozenClock, manualClock } from './clock.js';
 export { createUlid, ulid, ulidTime } from './ulid.js';
 export { assertReadOnlyQuery } from './read-only-sql.js';
 export { assertNoSpineWrite, guardSpine } from './spine-guard.js';
+export { assertPermissionKey } from './check-key.js';
 export { assertModuleEnqueueableKind } from './platform-kinds.js';
 export { readRoutedNode, RouterAssertionError } from './routed-node.js';
 export { assertPlatformCall, PlatformCallError, PLATFORM_SECRET_HEADER, PLATFORM_REQUEST_HEADER, CONNECTOR_ATTACHMENT_RECORD_HEADER, } from './platform-call.js';
 export { signConnectState, verifyConnectState, ConnectStateError, CONNECT_STATE_PURPOSE, } from './connect-state.js';
-export { PLATFORM_REQUEST_COLUMNS, platformRequestHistoryQuery, } from './platform-request-query.js';
+export { PLATFORM_REQUEST_COLUMNS, platformRequestHistoryQuery, platformRequestOf, UNDECODED_REQUESTER, } from './platform-request-query.js';
+export { CANCELLED_INTENT_NOTE, intentPayloadCarriesSubject, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, REDACTED_INTENT_MARKER, REDACTED_INTENT_NOTE, redactedIntentPayload, } from './subject-redaction.js';
+export { effectiveRoleGrantQuery, seatScopeTuple } from './scope-tuple-seat.js';
+export { SYSTEM_SWITCH_OFF_PREDICATE, SYSTEM_SWITCH_OFF_RELATION, switchSystemSchedules, systemScheduleState, systemSwitchedOff, systemSwitchedOffMessage, } from './system-switch.js';
 export { DENIAL_COLUMNS, DENIAL_WINDOW_QUERY, denialListQuery, denialSummaryQuery, denialTotalsQuery, mapDenialRow, mapDenialBucketRow, mapDenialOperationBucketRow, mapDenialSummaryBuckets, storedActor, } from './denial-query.js';
 export { entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, } from './entity-version.js';
 export { IMPERSONATION_COLUMNS, IMPERSONATION_DDL, ImpersonationRefused, assertImpersonationWrites, assertSessionUsable, impersonationByIdQuery, impersonationListQuery, impersonationRowValues, impersonationStampOf, mapImpersonationRow, newImpersonationSession, } from './impersonation.js';
 export { readTimeline, readHistory, facetEvents, walkEventCause, walkEventEffects, readInvocation, readDeadLetters } from './timeline.js';
+// #1636: one undecodable spine row no longer takes a list — or a delivery loop — with it.
+export { rowDecoder, UNDECODED_ACTOR, UNDECODED_PERMISSION } from './row-decode.js';
+export { domainEventOf, drainedEventOf, readUndrainedOutbox, undrainedEventsOf, UNDRAINED_SCAN_FACTOR, UNDRAINED_SKIPPED_IDS, } from './outbox-event.js';
 export { IDEMPOTENCY_DDL, assertIdempotencyKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencySubject, idempotencyOptedOutMessage, replayFor, } from './idempotency.js';
 export { JOB_RUN_DDL, JOB_DRIVE_LIMIT, JOB_DRIVE_SCAN_MAX, JOB_RUN_LIST_LIMIT, JOB_RUN_LIST_MAX, jobRunListLimit, JOB_STEP_REUSED, assertQueueSafe, jobRunOf, runDueJobRuns, runJobPass, startJobRun, } from './job-run.js';
 export { isTerminalDispatchFailure, isTerminalProviderError, providerErrorStatus, RETRYABLE_CLIENT_STATUSES, } from './provider-error.js';
 export { runPlatformSweep, startPlatformSweeper, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, } from './platform-sweep.js';
+// #1653: which scopes are the real install, and which version runs on them — shared so
+// every receipt writer and the sweep answer both questions the same way.
+export { isPrimaryScope, runningVersionOf, PROVISION_RECONCILE_BATCH, PROVISION_RECONCILE_REPORTED_IDS, } from './platform-sweep.js';
 export { MIGRATION_FLAG_THRESHOLD, migrationFleet, migrationProgress, migrationSummary, scopeMigrationState, } from './migration-progress.js';
 export { foldMeterReading } from './meters.js';
 export { MODEL_USAGE_RETENTION_DAYS, foldModelUsage, } from './model-usage.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAgEA,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,SAAS,EACT,WAAW,EACX,sBAAsB,EACtB,kBAAkB,EAClB,0BAA0B,EAC1B,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,qBAAqB,EACrB,0BAA0B,EAC1B,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,oCAAoC,EACpC,sBAAsB,EACtB,mBAAmB,EACnB,UAAU,EACV,MAAM,EACN,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAEvD,OAAO,EACL,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAM5D,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEpD,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,EACd,qBAAqB,EACrB,gBAAgB,EAChB,WAAW,EACX,qBAAqB,EACrB,uBAAuB,EACvB,WAAW,GACZ,MAAM,mBAAmB,CAAC;AAQ3B,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,WAAW,EACX,eAAe,EACf,QAAQ,EACR,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,mBAAmB,EACnB,cAAc,EACd,qBAAqB,EACrB,SAAS,EACT,WAAW,GACZ,MAAM,iBAAiB,CAAC;AAOzB,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEtD,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAiB,MAAM,WAAW,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAExE,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,sBAAsB,EACtB,uBAAuB,EACvB,kCAAkC,GACnC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,wBAAwB,EACxB,2BAA2B,GAC5B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,eAAe,EACf,kBAAkB,EAClB,iBAAiB,EACjB,YAAY,EACZ,kBAAkB,EAClB,2BAA2B,EAC3B,uBAAuB,EACvB,WAAW,GAMZ,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,aAAa,EACb,mBAAmB,GAGpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,oBAAoB,EACpB,yBAAyB,EACzB,mBAAmB,EACnB,sBAAsB,EACtB,sBAAsB,EACtB,sBAAsB,EACtB,oBAAoB,EACpB,mBAAmB,EACnB,uBAAuB,GAExB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,cAAc,EAAE,gBAAgB,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAE1I,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,sBAAsB,EACtB,yBAAyB,EACzB,0BAA0B,EAC1B,kBAAkB,EAClB,0BAA0B,EAC1B,SAAS,GAGV,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,WAAW,EACX,eAAe,EACf,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,eAAe,EACf,QAAQ,EACR,aAAa,EACb,UAAU,EACV,WAAW,GACZ,MAAM,cAAc,CAAC;AAiBtB,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACvB,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAe7B,OAAO,EACL,wBAAwB,EACxB,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EACL,0BAA0B,EAC1B,cAAc,GAIf,MAAM,kBAAkB,CAAC;AAQ1B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAgEA,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,SAAS,EACT,WAAW,EACX,sBAAsB,EACtB,kBAAkB,EAClB,0BAA0B,EAC1B,wBAAwB,EACxB,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,qBAAqB,EACrB,0BAA0B,EAC1B,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,oCAAoC,EACpC,sBAAsB,EACtB,mBAAmB,EACnB,UAAU,EACV,MAAM,EACN,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAEvD,OAAO,EACL,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAM5D,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,6BAA6B,EAC7B,8BAA8B,EAC9B,eAAe,EACf,cAAc,EACd,mBAAmB,EACnB,sBAAsB,EACtB,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,aAAa,EACb,gBAAgB,EAChB,qBAAqB,EACrB,kBAAkB,EAClB,YAAY,EACZ,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,EAC1B,aAAa,EACb,qBAAqB,EACrB,aAAa,EACb,wBAAwB,EACxB,0BAA0B,GAC3B,MAAM,iBAAiB,CAAC;AAOzB,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEpD,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,EACd,qBAAqB,EACrB,gBAAgB,EAChB,WAAW,EACX,qBAAqB,EACrB,uBAAuB,EACvB,WAAW,GACZ,MAAM,mBAAmB,CAAC;AAQ3B,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,WAAW,EACX,eAAe,EACf,QAAQ,EACR,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,mBAAmB,EACnB,cAAc,EACd,qBAAqB,EACrB,SAAS,EACT,WAAW,GACZ,MAAM,iBAAiB,CAAC;AAOzB,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEtD,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAiB,MAAM,WAAW,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAExE,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,sBAAsB,EACtB,uBAAuB,EACvB,kCAAkC,GACnC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,wBAAwB,EACxB,2BAA2B,EAC3B,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,8BAA8B,EAC9B,8BAA8B,EAC9B,6BAA6B,EAC7B,sBAAsB,EACtB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,wBAAwB,CAAC;AAKhC,OAAO,EAAE,uBAAuB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAChF,OAAO,EACL,2BAA2B,EAC3B,0BAA0B,EAC1B,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,EACjB,wBAAwB,GACzB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,eAAe,EACf,kBAAkB,EAClB,iBAAiB,EACjB,YAAY,EACZ,kBAAkB,EAClB,2BAA2B,EAC3B,uBAAuB,EACvB,WAAW,GAMZ,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,aAAa,EACb,mBAAmB,GAGpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,oBAAoB,EACpB,yBAAyB,EACzB,mBAAmB,EACnB,sBAAsB,EACtB,sBAAsB,EACtB,sBAAsB,EACtB,oBAAoB,EACpB,mBAAmB,EACnB,uBAAuB,GAExB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,cAAc,EAAE,gBAAgB,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAE1I,0FAA0F;AAC1F,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAEpF,OAAO,EACL,aAAa,EACb,cAAc,EACd,mBAAmB,EACnB,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAQ3B,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,sBAAsB,EACtB,yBAAyB,EACzB,0BAA0B,EAC1B,kBAAkB,EAClB,0BAA0B,EAC1B,SAAS,GAGV,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,WAAW,EACX,eAAe,EACf,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,eAAe,EACf,QAAQ,EACR,aAAa,EACb,UAAU,EACV,WAAW,GACZ,MAAM,cAAc,CAAC;AAiBtB,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACvB,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAgB7B,uFAAuF;AACvF,yEAAyE;AACzE,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,yBAAyB,EACzB,gCAAgC,GACjC,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,wBAAwB,EACxB,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EACL,0BAA0B,EAC1B,cAAc,GAIf,MAAM,kBAAkB,CAAC;AAQ1B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/outbox-event.d.ts

@@ -0,0 +1,131 @@
+import { type DomainEvent, type DrainedEvent } from '@substrat-run/contracts';
+/**
+ * Decoding a stored `_substrat_outbox` row into the envelope work is done with (#1636).
+ *
+ * The READ side of the outbox is tolerant (`readHistory` and the walks, via `rowDecoder`):
+ * a row that does not decode comes back beside its neighbours, saying why. This is the
+ * other side — the rows that are EXECUTED. A consumer's handler, an executor's handler and
+ * the Tier-2 drain each act on the event, and a half-decoded event is not one any of them
+ * may act on: a consumer built from stand-ins would record effects nobody asked for, and a
+ * lake row built from them would be exact history that is not. So this decode is strict and
+ * throws, and what changed is WHERE the throw lands. It used to sit above each loop's
+ * per-event containment, so one bad row halted every event behind it on every pass:
+ *
+ * - consumer delivery never delivered anything of that type after it;
+ * - executor dispatch failed the executor's whole pending list;
+ * - the Tier-2 drain stalled for the scope, because a row that never ships is never
+ *   stamped, so the next pass read it first again.
+ *
+ * Each caller now contains it per event — a dead letter for a delivery, a skip for the
+ * drain — and the event behind it moves.
+ *
+ * One decoder, where there were two copies of the same `domainEvent.parse` in the two
+ * adapters: both now decode through here, so a row cannot deliver on one and dead-letter
+ * on the other.
+ */
+/** The `_substrat_outbox` columns the envelope is built from, as either adapter hands them back. */
+export interface OutboxEnvelopeRow {
+    id: string;
+    type: string;
+    schema_version: number;
+    occurred_at: string;
+    tenant_id: string;
+    scope_id: string;
+    actor: string;
+    entity_type: string;
+    entity_id: string;
+    pii_class: string;
+    subject_id: string | null;
+    authorization: string | null;
+    impersonation: string | null;
+    operation: string | null;
+    payload: string | null;
+}
+/** …plus the columns the Tier-2 drain lifts beside the envelope (#1242, #1237). */
+export interface OutboxDrainRow extends OutboxEnvelopeRow {
+    version?: string | null;
+    caused_by?: string | null;
+    invocation_id?: string | null;
+}
+/**
+ * The stored row → the `DomainEvent` a consumer or executor is handed, or a throw naming
+ * EVERY column that did not decode.
+ *
+ * A row the kernel wrote decodes exactly as it always did — the same candidate into the same
+ * `domainEvent.parse`. The throw's message never quotes the stored text (see `rowDecoder`):
+ * it is written into a dead letter, which is stored beside the event and survives an erasure
+ * of its payload.
+ */
+export declare function domainEventOf(row: OutboxEnvelopeRow): DomainEvent;
+/**
+ * The stored row → the `DrainedEvent` the Tier-2 drain ships, or a throw (`domainEventOf`'s).
+ *
+ * The WHOLE event is parsed by the published `drainedEvent` schema — the envelope and the
+ * columns lifted beside it (`operation`, `version`, `caused_by`, `invocation_id`), which the
+ * envelope does not carry. They used to be copied onto an already-validated envelope as
+ * stored, into a value merely TYPED as a `DrainedEvent` (#1641 review): a restored row with
+ * `version: ''` or a `caused_by` that is not an event id reached the lake, append-only, and
+ * was stamped as having left. Parsed here, it throws, and `readUndrainedOutbox` skips it and
+ * says so. A row the kernel wrote passes unchanged: each lifted column is written from a
+ * validated value or as NULL.
+ */
+export declare function drainedEventOf(row: OutboxDrainRow): DrainedEvent;
+/**
+ * What a Tier-2 read passed over (#1636): rows that would not decode, so were neither
+ * returned nor — since nothing ships them — ever stamped.
+ *
+ * `eventIds` is capped at {@link UNDRAINED_SKIPPED_IDS}; `count` is exact. Ids only, never
+ * a reason: this travels to the control plane's sweep report and its log, and a decode
+ * message is one step from the stored text it describes.
+ */
+export interface UndrainedSkipped {
+    count: number;
+    eventIds: string[];
+}
+/**
+ * `readUndrainedEvents`' answer: the events, oldest first — an ARRAY, because every caller
+ * already reads one — with what the read skipped riding beside them as an optional
+ * property. Absent when every row it read decoded, so a clean read is the array it always
+ * was.
+ *
+ * A property on an array does not survive `JSON.stringify` or an RPC hop, so each hop that
+ * carries this says so explicitly (the DO's `undrainedEventsRead`, the vertical's
+ * `/internal/undrained-events?withSkipped=1`); it is only ever attached in-process.
+ */
+export type UndrainedEvents = DrainedEvent[] & {
+    skipped?: UndrainedSkipped;
+};
+/** The same answer, as a plain object — the shape that crosses an RPC or HTTP hop. */
+export interface UndrainedRead {
+    events: DrainedEvent[];
+    skipped?: UndrainedSkipped;
+}
+/** How many rows past `limit` one read may look through, as a multiple of `limit`. */
+export declare const UNDRAINED_SCAN_FACTOR = 10;
+/** How many skipped ids a read names; the count past it stays exact. */
+export declare const UNDRAINED_SKIPPED_IDS = 50;
+/**
+ * The Tier-2 drain's read over one scope's outbox (#1334), CONTAINED per row (#1636) — the
+ * one implementation both adapters run, so they cannot disagree about what is skipped.
+ *
+ * `page(offset, count)` is the adapter's
+ * `SELECT * … WHERE drained_at IS NULL ORDER BY id LIMIT count OFFSET offset`. Offset
+ * rather than an id cursor on purpose: the rows being stepped over are exactly the ones
+ * whose `id` may be the column that is broken.
+ *
+ * A row that does not decode is SKIPPED: not returned, so no sink ever receives an event
+ * built from stand-ins — the lake is append-only, and a wrong row there cannot be taken
+ * back — and not stamped, so `drained_at` stays an exact record of what left. The read
+ * keeps going past it, so the healthy rows behind it still ship. The cost is stated rather
+ * than hidden: a skipped row never reaches the lake, and every pass reads it again. It
+ * stays visible in Tier 1, where `readHistory` returns it with a `decodeError`.
+ *
+ * Bounded: at most `limit × UNDRAINED_SCAN_FACTOR` rows are looked at. A scope whose next
+ * that-many undrained rows ALL fail to decode ships nothing, pass after pass — at that
+ * point the spine is broken wholesale, which is a restore to repair rather than a row to
+ * step over, and the skipped count in the sweep report is what says so.
+ */
+export declare function readUndrainedOutbox(page: (offset: number, count: number) => OutboxDrainRow[], limit: number): UndrainedRead;
+/** An `UndrainedRead` → the in-process array shape, the skip attached only when there is one. */
+export declare function undrainedEventsOf(read: UndrainedRead): UndrainedEvents;
+//# sourceMappingURL=outbox-event.d.ts.map

package/dist/outbox-event.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"outbox-event.d.ts","sourceRoot":"","sources":["../src/outbox-event.ts"],"names":[],"mappings":"AAAA,OAAO,EAA6B,KAAK,WAAW,EAAE,KAAK,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAGzG;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,oGAAoG;AACpG,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,mFAAmF;AACnF,MAAM,WAAW,cAAe,SAAQ,iBAAiB;IACvD,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AA4FD;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,iBAAiB,GAAG,WAAW,CAGjE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,cAAc,GAAG,YAAY,CAmBhE;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,eAAe,GAAG,YAAY,EAAE,GAAG;IAAE,OAAO,CAAC,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAE9E,sFAAsF;AACtF,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,YAAY,EAAE,CAAC;IACvB,OAAO,CAAC,EAAE,gBAAgB,CAAC;CAC5B;AAED,sFAAsF;AACtF,eAAO,MAAM,qBAAqB,KAAK,CAAC;AACxC,wEAAwE;AACxE,eAAO,MAAM,qBAAqB,KAAK,CAAC;AAExC;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,cAAc,EAAE,EACzD,KAAK,EAAE,MAAM,GACZ,aAAa,CA2Bf;AAED,iGAAiG;AACjG,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,aAAa,GAAG,eAAe,CAItE"}