@substrat-run/kernel 0.116.0 → 0.117.0

package/dist/subject-redaction.js

@@ -0,0 +1,210 @@
+/**
+ * The intent journal's half of a subject erasure (#1600).
+ *
+ * `shredSubject` holds K-37's Tier-1 line — *the payload goes, the envelope stays* —
+ * and for a year that line reached exactly one table, `_substrat_outbox`. It is not the
+ * only place the spine keeps an event's payload. A CP-less host cannot run a connector
+ * (no directory, no credentials, no sanctioned egress), so each connector delivery
+ * becomes a `connector:<provider>` platform intent whose payload is the WHOLE
+ * `DomainEvent` — fat by design, because "the platform's handler needs everything the
+ * in-process handler would have been handed" (`connectorDispatchPayload`). That copy
+ * lands in `_substrat_platform_requests`, which nothing ever deletes: the retention is
+ * deliberate, `listPlatformRequestHistory` exists precisely so a settled row stays
+ * readable. So a name the redaction did not reach there survived in the live scope
+ * database, and in every export, backup and PITR window taken from it afterwards.
+ *
+ * **The rule this module implements is narrow on purpose:** an intent that carries a
+ * COPY OF AN EVENT is redacted exactly when the erasure redacts that event. Not "any
+ * payload mentioning the subject" — the outbox spares a `piiClass: 'none'` event even
+ * when it names the subject, and a copy judged more harshly than its original is an
+ * incoherent rule, not a stricter one. So the predicate below is the outbox's own
+ * predicate (`subject_id = ? AND pii_class != 'none'`) applied to whatever spine
+ * envelope the payload embeds, at whatever depth. `subjectId` and `piiClass` occur
+ * together only on `domainEventShape`, which is what makes the walk kind-agnostic
+ * rather than a guess about `connector:*`.
+ *
+ * What it therefore does NOT reach is an intent kind that carries a subject's PII
+ * WITHOUT carrying the classified event — an intent payload has no `piiClass` of its
+ * own, so the kernel has nothing to read. No kind does that today (kernel-design.md
+ * §13.1 limit 7 says so and names the walk), and a kind that started to would be
+ * inventing an unclassified PII store inside the spine.
+ *
+ * This is a kernel module rather than two copies of the same SQL for
+ * `platformRequestHistoryQuery`'s reason, sharpened: three surfaces answer one question
+ * from this table, and a privacy guarantee that holds on one adapter is not a guarantee.
+ */
+/**
+ * The one key a redacted intent payload carries, and nothing else in the system does.
+ *
+ * Underscore-prefixed on the `_substrat_*` habit: the marker is the platform's, not a
+ * field some vertical's payload could plausibly own.
+ */
+export const REDACTED_INTENT_MARKER = '_substratRedacted';
+/**
+ * What replaces a redacted intent's payload.
+ *
+ * The column is `payload TEXT NOT NULL` on both adapters, so the outbox's
+ * `SET payload = NULL` cannot transfer and *what a redacted intent looks like* is a
+ * shape to choose rather than a null to write. Three things decide this one:
+ *
+ * - **Obviously redacted, never plausible data.** A reader who has the row in front of
+ *   them must not have to know the kind's schema to see that the content is gone.
+ * - **It fails every handler's parse.** Each drain handler opens with
+ *   `<kind>Payload.parse(request.payload)`, and no kind's schema admits an object whose
+ *   only key is this marker. So a drain that reaches the row after the redaction settles
+ *   loudly instead of executing a tombstone as if it were an instruction. What this does
+ *   NOT close, and should not be read as closing, is the drain that had already READ the
+ *   payload when the erasure landed: it DELIVERS what it read. That window is the one the
+ *   outbox redaction has too — a consumer mid-dispatch holds the payload it was handed —
+ *   and closing it wants a lock across the drain hop rather than a shape here. Its
+ *   WRITEBACK is closed separately and is not part of that residue: `settlePlatformRequest`
+ *   is a compare-and-set on `status = 'pending'` on both adapters, so a stale pass cannot
+ *   undo the redaction or put a provider's reply — which can quote the person — back into
+ *   `last_error`. The two halves were one sentence in the first cut of this file, which
+ *   made an avoidable write look as unavoidable as the delivery.
+ * - **It keeps the pseudonymous key, exactly as the outbox row does.** The redacted
+ *   outbox row still carries `subject_id`; §5.3's "pseudonymous keys and transaction
+ *   facts remain" is the same sentence here. A row that is blank for no stated reason
+ *   reads as corruption; this one says what happened to it and when.
+ */
+export function redactedIntentPayload(subjectId, at) {
+    return JSON.stringify({
+        [REDACTED_INTENT_MARKER]: { reason: 'subject-erasure', subjectId, at },
+    });
+}
+/**
+ * The note a redaction leaves on an intent that had already settled.
+ *
+ * `last_error` is overwritten rather than kept, and that is deliberate: it is free text
+ * a third party wrote about the delivery of this person's data — the surface #618 built
+ * precisely so a provider's own sentence ("…requires valid personal number field") is
+ * readable — so it is content about the subject, not envelope. An erasure that emptied
+ * `payload` and left a provider quoting the name two columns over would be the same bug
+ * this fixes, one column to the right.
+ */
+export const REDACTED_INTENT_NOTE = 'redacted by subject erasure (#37) — what this intent said is gone; that it happened, and when, is not';
+/**
+ * The note a redaction leaves on an intent that was still `pending`.
+ *
+ * A pending row is redacted like any other AND settled `failed` in the same statement,
+ * because the two halves of the alternative are both wrong: leaving it pending-and-intact
+ * keeps the name (the defect), and leaving it pending-and-redacted hands the drain a
+ * tombstone to execute. `failed` is the truthful terminal state — the delivery did not
+ * happen and now cannot — and the executor delivery behind it was already journaled as
+ * routed, so nothing re-routes the event to replace this row.
+ */
+export const CANCELLED_INTENT_NOTE = 'cancelled by subject erasure (#37) — the payload was redacted before the drain reached it, so this intent never ran';
+/**
+ * The candidate read: every intent whose stored payload TEXT contains the subject id.
+ *
+ * A prefilter, not the decision — `intentPayloadCarriesSubject` decides. `instr` rather
+ * than `LIKE` because it is a literal substring search with no wildcard to escape, and
+ * the needle is the subject id as `JSON.stringify` would have written it into the
+ * payload (identical to the raw id for a `dataSubjectId`, which is a ULID and so has
+ * nothing to escape — spelled out anyway, since the host contract types the parameter
+ * `string`).
+ *
+ * Unindexed, and that is affordable: this runs once per staff-triggered erasure over one
+ * scope's journal, where the alternative is parsing every row's JSON in the host.
+ */
+export function platformRequestRedactionQuery(subjectId) {
+    return {
+        sql: 'SELECT id, payload FROM _substrat_platform_requests WHERE instr(payload, ?) > 0',
+        // Strip the quotes JSON.stringify adds and keep the escaped body — the exact run of
+        // characters the serialized payload holds.
+        params: [JSON.stringify(subjectId).slice(1, -1)],
+    };
+}
+/**
+ * The write. One statement per redacted row, so the payload, the note and the pending
+ * row's settlement are one atomic change rather than three that can half-land.
+ *
+ * Every SET expression is evaluated against the ORIGINAL row in SQLite, so both `CASE
+ * WHEN status = 'pending'` arms read the status as it was before this statement touched
+ * it — which is what lets one statement both re-word the note and change the status it
+ * branched on. `settled_at` is COALESCEd so a row that already settled keeps the instant
+ * it settled at; only a cancelled pending row is stamped now.
+ *
+ * Params, in order: payload, cancelled-note, redacted-note, at, id.
+ */
+export const PLATFORM_REQUEST_REDACTION_SQL = `UPDATE _substrat_platform_requests
+     SET payload = ?,
+         last_error = CASE WHEN status = 'pending' THEN ? ELSE ? END,
+         settled_at = COALESCE(settled_at, ?),
+         status = CASE WHEN status = 'pending' THEN 'failed' ELSE status END
+   WHERE id = ?`;
+/** The bound parameters for `PLATFORM_REQUEST_REDACTION_SQL`, in its declared order. */
+export function platformRequestRedactionParams(id, subjectId, at) {
+    return [redactedIntentPayload(subjectId, at), CANCELLED_INTENT_NOTE, REDACTED_INTENT_NOTE, at, id];
+}
+/**
+ * Does this stored payload carry a copy of an event the erasure redacts?
+ *
+ * The outbox's predicate, walked over the payload's structure: an object carrying BOTH
+ * `subjectId` equal to this subject AND a `piiClass` other than `'none'` IS a spine
+ * envelope — those two field names occur together nowhere else — so wherever the spine
+ * has copied one into an intent, the copy inherits the original's redaction.
+ *
+ * Returns false for a payload that IS already a tombstone (so a re-run after a crash
+ * converges rather than re-stamping) and false for a payload that is not JSON at all,
+ * which nothing in the kernel can write but which a stricter answer would have to invent
+ * a meaning for.
+ */
+export function intentPayloadCarriesSubject(payloadText, subjectId) {
+    let parsed;
+    try {
+        parsed = JSON.parse(payloadText);
+    }
+    catch {
+        return false;
+    }
+    if (isRedactedPayload(parsed))
+        return false;
+    return carriesSubject(parsed, subjectId);
+}
+/**
+ * Is this payload one we already redacted?
+ *
+ * **Asked of the WHOLE payload, once, and never inside the walk (#1600 review).** The
+ * first cut short-circuited the walk at any object carrying the marker key, which made
+ * `{ _substratRedacted: false, event: <a real envelope> }` a payload the erasure stepped
+ * straight past, PII and all — and the comment beside it claimed the check was redundant
+ * belt-and-braces because a tombstone has no `piiClass`. That was true of the tombstone
+ * and false of everything else wearing its key. An intent payload is `unknown` and module
+ * code chooses it, so a marker that means "stop looking" must not be something a payload
+ * can merely CONTAIN.
+ *
+ * The invariant asked instead is un-forgeable in the only way that matters: *a payload
+ * that is nothing but a redaction tombstone is already redacted*. One top-level key, and
+ * that key's value says why. Anything beside the marker is not this, gets walked, and is
+ * judged on its own contents — which is exactly right, because something beside the
+ * marker is something the erasure might need to reach. Inner fields beyond `reason` are
+ * deliberately not pinned: a later tombstone that carries more would still be nothing but
+ * a tombstone, and hard-coding its shape here is how idempotency would quietly regress.
+ */
+function isRedactedPayload(parsed) {
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed))
+        return false;
+    const keys = Object.keys(parsed);
+    if (keys.length !== 1 || keys[0] !== REDACTED_INTENT_MARKER)
+        return false;
+    const marker = parsed[REDACTED_INTENT_MARKER];
+    return (typeof marker === 'object' &&
+        marker !== null &&
+        !Array.isArray(marker) &&
+        marker['reason'] === 'subject-erasure');
+}
+function carriesSubject(node, subjectId) {
+    if (Array.isArray(node))
+        return node.some((child) => carriesSubject(child, subjectId));
+    if (node === null || typeof node !== 'object')
+        return false;
+    const obj = node;
+    if (obj['subjectId'] === subjectId &&
+        typeof obj['piiClass'] === 'string' &&
+        obj['piiClass'] !== 'none') {
+        return true;
+    }
+    return Object.values(obj).some((child) => carriesSubject(child, subjectId));
+}
+//# sourceMappingURL=subject-redaction.js.map

package/dist/subject-redaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"subject-redaction.js","sourceRoot":"","sources":["../src/subject-redaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,mBAAmB,CAAC;AAE1D;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,qBAAqB,CAAC,SAAiB,EAAE,EAAU;IACjE,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,CAAC,sBAAsB,CAAC,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,SAAS,EAAE,EAAE,EAAE;KACvE,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAC/B,uGAAuG,CAAC;AAE1G;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAChC,qHAAqH,CAAC;AAyBxH;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,6BAA6B,CAAC,SAAiB;IAI7D,OAAO;QACL,GAAG,EAAE,iFAAiF;QACtF,oFAAoF;QACpF,2CAA2C;QAC3C,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;KACjD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG;;;;;gBAK9B,CAAC;AAEjB,wFAAwF;AACxF,MAAM,UAAU,8BAA8B,CAC5C,EAAU,EACV,SAAiB,EACjB,EAAU;IAEV,OAAO,CAAC,qBAAqB,CAAC,SAAS,EAAE,EAAE,CAAC,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;AACrG,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,2BAA2B,CAAC,WAAmB,EAAE,SAAiB;IAChF,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,iBAAiB,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,cAAc,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAS,iBAAiB,CAAC,MAAe;IACxC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACzF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,sBAAsB;QAAE,OAAO,KAAK,CAAC;IAC1E,MAAM,MAAM,GAAI,MAAkC,CAAC,sBAAsB,CAAC,CAAC;IAC3E,OAAO,CACL,OAAO,MAAM,KAAK,QAAQ;QAC1B,MAAM,KAAK,IAAI;QACf,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QACrB,MAAkC,CAAC,QAAQ,CAAC,KAAK,iBAAiB,CACpE,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,IAAa,EAAE,SAAiB;IACtD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;IACvF,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5D,MAAM,GAAG,GAAG,IAA+B,CAAC;IAC5C,IACE,GAAG,CAAC,WAAW,CAAC,KAAK,SAAS;QAC9B,OAAO,GAAG,CAAC,UAAU,CAAC,KAAK,QAAQ;QACnC,GAAG,CAAC,UAAU,CAAC,KAAK,MAAM,EAC1B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;AAC9E,CAAC"}

package/dist/system-switch.d.ts

@@ -0,0 +1,108 @@
+/**
+ * The schedule kill switch (#1666), shared by both adapters so the gate that decides
+ * whether a module's schedules run and the lever that moves it cannot disagree.
+ *
+ * A scope runs a module's schedules only while it holds a live `system:<module>` grant
+ * (#383) — "the grant IS the switch". That sentence was true of the gate and had no
+ * lever: nothing could revoke the grant. This file is the lever, and it has to be more
+ * than a revoke, for two reasons found while building it:
+ *
+ * 1. **A reconcile seats grants.** Since #1659 a reconcile leaves a revoked grant revoked,
+ *    but it still CREATES a missing one. A vertical whose next version declares a schedule
+ *    with a new permission gets that grant seated live on every install — and a gate that
+ *    reads "any live grant" is open again, on a scope an operator switched off.
+ * 2. **An explicit grant clears a tombstone.** `grantToSystem` is `INSERT OR REPLACE` by
+ *    design (#1659's re-grant guarantee), so a stray grant of one permission would bring
+ *    that tuple back — and with it, under the old gate, the whole module.
+ *
+ * So the OFF position is a tuple of its own: a live `system:<module>` / `switch:off` /
+ * `scope:<id>` marker. The gate is OFF while that marker is live, whatever grants are
+ * live beside it. **Restore is the lever; a grant is not.** The marker is an ordinary
+ * K-21 tuple: switching back on tombstones it, so the row stays as evidence of when the
+ * switch was last pulled. The permission walk reads only `role:` and `granted:` relations
+ * (`permission-eval.ts`), so the marker authorizes nothing and denies nothing by itself.
+ *
+ * Switching off ALSO tombstones every live `granted:` tuple the module holds on the scope.
+ * That is what makes it a kill switch rather than a schedule pause: anything that acts
+ * with the module's system authority — a resumable job run (#1577), a `getSystemScope`
+ * invoke — is denied by its own `ctx.check` while the switch is off.
+ *
+ * **And nothing may write a new one while it is off**, which is what makes that denial
+ * hold. The checker is deliberately NOT marker-aware; the switch is closed on the WRITE
+ * side instead, at the only two writers of a scope-level `system:` grant:
+ * - `grantToSystem` refuses while the module is switched off on that scope (the adapters
+ *   ask `systemSwitchedOff` in the same unit as the write);
+ * - provisioning's seat (`seatScopeTuple`) seats nothing for a subject whose marker is
+ *   live, so a reconcile cannot create a grant a newer version declares.
+ *
+ * **Restore returns exactly what OFF took, never more.** Each grant OFF tombstones gets a
+ * `switched:<permission>` record, live for as long as the switch holds it. ON restores
+ * only grants with a live record, then tombstones the records — so a grant that was
+ * revoked independently BEFORE the switch was pulled stays revoked through OFF and ON.
+ *
+ * Params and results are plain SQL over `_substrat_tuples`, run through `SwitchSql`,
+ * which each adapter implements over its own handle inside one transaction.
+ */
+/** The relation of the OFF marker. Not `granted:` and not `role:`, so no check reads it. */
+export declare const SYSTEM_SWITCH_OFF_RELATION = "switch:off";
+/** The two statement shapes the switch needs, over either adapter's SQLite handle. */
+export interface SwitchSql {
+    all(sql: string, ...params: (string | null)[]): Record<string, unknown>[];
+    run(sql: string, ...params: (string | null)[]): void;
+}
+/**
+ * Where one module's schedules stand on one scope.
+ *
+ * - `on`: a live grant and no live OFF marker — due schedules fire.
+ * - `off`: a live OFF marker. The schedules do not fire, and each is reported `skipped`
+ *   with `switchedOff: true` — the sweep reached the scope and chose not to run, which
+ *   is not the same fact as a sweep that never reached it.
+ * - `ungranted`: no live grant and no marker. A foreign vertical's scope on a CP-full host
+ *   (the module is registered and this scope never ran it), or a grant removed by a raw
+ *   write. Quiet, exactly as before the switch existed: no run, no skip, no error.
+ */
+export type SystemScheduleState = 'on' | 'off' | 'ungranted';
+/**
+ * "Is this subject's OFF marker live?", as a SQL predicate over ONE bound parameter (the
+ * subject). The one spelling the gate, the grant refusal and the provisioning seat share,
+ * so the three cannot disagree about what "switched off" means.
+ */
+export declare const SYSTEM_SWITCH_OFF_PREDICATE = "EXISTS (SELECT 1 FROM _substrat_tuples\n  WHERE subject = ? AND relation = 'switch:off' AND revoked_at IS NULL)";
+/**
+ * The gate, one statement: is the OFF marker live, and is any `granted:` tuple live?
+ * `substr` rather than `LIKE`: `LIKE` is case-insensitive in SQLite and a Durable
+ * Object caps its patterns (#1655); an exact prefix compare is neither.
+ */
+export declare function systemScheduleState(db: SwitchSql, moduleId: string, now: string): SystemScheduleState;
+/** Is this module switched off on the scope `db` is? What `grantToSystem` refuses on. */
+export declare function systemSwitchedOff(db: SwitchSql, moduleId: string): boolean;
+/** The refusal `grantToSystem` throws while the switch is off — one wording, both adapters. */
+export declare function systemSwitchedOffMessage(moduleId: string, scopeId: string): string;
+/** What one switch call did in the scope's own storage — `SystemSwitchOutcome`'s shape. */
+export interface SwitchOutcome {
+    held: boolean;
+    changed: boolean;
+    permissions: string[];
+}
+/**
+ * Move one module's switch on one scope. Idempotent: a repeat changes nothing and says so.
+ *
+ * OFF tombstones every live `granted:` tuple the module holds at `scope:<id>`, records each
+ * as `switched:<permission>`, and makes the marker live. ON un-tombstones exactly the
+ * grants with a live `switched:` record, tombstones those records, and tombstones the
+ * marker. A repeated OFF re-asserts the whole position: a grant that became live meanwhile
+ * (only a raw write can do that now) is tombstoned and recorded too.
+ *
+ * `held: false`, with nothing written, when the scope holds neither a grant nor a marker
+ * for the module: the caller named something this scope never ran, and turning "nothing"
+ * off must not write a marker that silently disables a module the day it is installed.
+ *
+ * Run it inside one transaction; the reads and writes here are meant to be one unit.
+ */
+export declare function switchSystemSchedules(db: SwitchSql, input: {
+    moduleId: string;
+    scopeId: string;
+    to: 'on' | 'off';
+    at: string;
+}): SwitchOutcome;
+//# sourceMappingURL=system-switch.d.ts.map

package/dist/system-switch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"system-switch.d.ts","sourceRoot":"","sources":["../src/system-switch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEH,4FAA4F;AAC5F,eAAO,MAAM,0BAA0B,eAAe,CAAC;AAKvD,sFAAsF;AACtF,MAAM,WAAW,SAAS;IACxB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IAC1E,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC;CACtD;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,mBAAmB,GAAG,IAAI,GAAG,KAAK,GAAG,WAAW,CAAC;AAI7D;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,oHACmD,CAAC;AAE5F;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,mBAAmB,CAcrG;AAED,yFAAyF;AACzF,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAK1E;AAED,+FAA+F;AAC/F,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAMlF;AAED,2FAA2F;AAC3F,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CACnC,EAAE,EAAE,SAAS,EACb,KAAK,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,IAAI,GAAG,KAAK,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GACzE,aAAa,CA4Ff"}

package/dist/system-switch.js

@@ -0,0 +1,145 @@
+/**
+ * The schedule kill switch (#1666), shared by both adapters so the gate that decides
+ * whether a module's schedules run and the lever that moves it cannot disagree.
+ *
+ * A scope runs a module's schedules only while it holds a live `system:<module>` grant
+ * (#383) — "the grant IS the switch". That sentence was true of the gate and had no
+ * lever: nothing could revoke the grant. This file is the lever, and it has to be more
+ * than a revoke, for two reasons found while building it:
+ *
+ * 1. **A reconcile seats grants.** Since #1659 a reconcile leaves a revoked grant revoked,
+ *    but it still CREATES a missing one. A vertical whose next version declares a schedule
+ *    with a new permission gets that grant seated live on every install — and a gate that
+ *    reads "any live grant" is open again, on a scope an operator switched off.
+ * 2. **An explicit grant clears a tombstone.** `grantToSystem` is `INSERT OR REPLACE` by
+ *    design (#1659's re-grant guarantee), so a stray grant of one permission would bring
+ *    that tuple back — and with it, under the old gate, the whole module.
+ *
+ * So the OFF position is a tuple of its own: a live `system:<module>` / `switch:off` /
+ * `scope:<id>` marker. The gate is OFF while that marker is live, whatever grants are
+ * live beside it. **Restore is the lever; a grant is not.** The marker is an ordinary
+ * K-21 tuple: switching back on tombstones it, so the row stays as evidence of when the
+ * switch was last pulled. The permission walk reads only `role:` and `granted:` relations
+ * (`permission-eval.ts`), so the marker authorizes nothing and denies nothing by itself.
+ *
+ * Switching off ALSO tombstones every live `granted:` tuple the module holds on the scope.
+ * That is what makes it a kill switch rather than a schedule pause: anything that acts
+ * with the module's system authority — a resumable job run (#1577), a `getSystemScope`
+ * invoke — is denied by its own `ctx.check` while the switch is off.
+ *
+ * **And nothing may write a new one while it is off**, which is what makes that denial
+ * hold. The checker is deliberately NOT marker-aware; the switch is closed on the WRITE
+ * side instead, at the only two writers of a scope-level `system:` grant:
+ * - `grantToSystem` refuses while the module is switched off on that scope (the adapters
+ *   ask `systemSwitchedOff` in the same unit as the write);
+ * - provisioning's seat (`seatScopeTuple`) seats nothing for a subject whose marker is
+ *   live, so a reconcile cannot create a grant a newer version declares.
+ *
+ * **Restore returns exactly what OFF took, never more.** Each grant OFF tombstones gets a
+ * `switched:<permission>` record, live for as long as the switch holds it. ON restores
+ * only grants with a live record, then tombstones the records — so a grant that was
+ * revoked independently BEFORE the switch was pulled stays revoked through OFF and ON.
+ *
+ * Params and results are plain SQL over `_substrat_tuples`, run through `SwitchSql`,
+ * which each adapter implements over its own handle inside one transaction.
+ */
+/** The relation of the OFF marker. Not `granted:` and not `role:`, so no check reads it. */
+export const SYSTEM_SWITCH_OFF_RELATION = 'switch:off';
+/** `switched:<permission>` — "the switch revoked this grant, and ON gives it back". */
+const SWITCHED_PREFIX = 'switched:';
+const subjectOf = (moduleId) => `system:${moduleId}`;
+/**
+ * "Is this subject's OFF marker live?", as a SQL predicate over ONE bound parameter (the
+ * subject). The one spelling the gate, the grant refusal and the provisioning seat share,
+ * so the three cannot disagree about what "switched off" means.
+ */
+export const SYSTEM_SWITCH_OFF_PREDICATE = `EXISTS (SELECT 1 FROM _substrat_tuples
+  WHERE subject = ? AND relation = '${SYSTEM_SWITCH_OFF_RELATION}' AND revoked_at IS NULL)`;
+/**
+ * The gate, one statement: is the OFF marker live, and is any `granted:` tuple live?
+ * `substr` rather than `LIKE`: `LIKE` is case-insensitive in SQLite and a Durable
+ * Object caps its patterns (#1655); an exact prefix compare is neither.
+ */
+export function systemScheduleState(db, moduleId, now) {
+    const subject = subjectOf(moduleId);
+    const row = db.all(`SELECT
+       ${SYSTEM_SWITCH_OFF_PREDICATE} AS off,
+       EXISTS (SELECT 1 FROM _substrat_tuples
+                WHERE subject = ? AND substr(relation, 1, 8) = 'granted:'
+                  AND revoked_at IS NULL AND (expires_at IS NULL OR expires_at > ?)) AS granted`, subject, subject, now)[0];
+    if (Number(row?.off) === 1)
+        return 'off';
+    return Number(row?.granted) === 1 ? 'on' : 'ungranted';
+}
+/** Is this module switched off on the scope `db` is? What `grantToSystem` refuses on. */
+export function systemSwitchedOff(db, moduleId) {
+    const row = db.all(`SELECT ${SYSTEM_SWITCH_OFF_PREDICATE} AS off`, subjectOf(moduleId))[0];
+    return Number(row?.off) === 1;
+}
+/** The refusal `grantToSystem` throws while the switch is off — one wording, both adapters. */
+export function systemSwitchedOffMessage(moduleId, scopeId) {
+    return (`module '${moduleId}' is switched off on scope ${scopeId} (#1666) — restore it first ` +
+        `(restoreToSystem). A grant is not the lever: granting while it is off would hand the ` +
+        `module's system authority back to anything but its schedules.`);
+}
+/**
+ * Move one module's switch on one scope. Idempotent: a repeat changes nothing and says so.
+ *
+ * OFF tombstones every live `granted:` tuple the module holds at `scope:<id>`, records each
+ * as `switched:<permission>`, and makes the marker live. ON un-tombstones exactly the
+ * grants with a live `switched:` record, tombstones those records, and tombstones the
+ * marker. A repeated OFF re-asserts the whole position: a grant that became live meanwhile
+ * (only a raw write can do that now) is tombstoned and recorded too.
+ *
+ * `held: false`, with nothing written, when the scope holds neither a grant nor a marker
+ * for the module: the caller named something this scope never ran, and turning "nothing"
+ * off must not write a marker that silently disables a module the day it is installed.
+ *
+ * Run it inside one transaction; the reads and writes here are meant to be one unit.
+ */
+export function switchSystemSchedules(db, input) {
+    const subject = subjectOf(input.moduleId);
+    const object = `scope:${input.scopeId}`;
+    const grants = db.all(`SELECT relation, revoked_at FROM _substrat_tuples
+      WHERE subject = ? AND object = ? AND substr(relation, 1, 8) = 'granted:'
+      ORDER BY relation`, subject, object);
+    const marker = db.all(`SELECT revoked_at FROM _substrat_tuples WHERE subject = ? AND relation = ? AND object = ?`, subject, SYSTEM_SWITCH_OFF_RELATION, object)[0];
+    if (grants.length === 0 && !marker)
+        return { held: false, changed: false, permissions: [] };
+    const permissionOf = (relation) => relation.slice('granted:'.length);
+    if (input.to === 'off') {
+        const live = grants.filter((g) => g.revoked_at === null).map((g) => permissionOf(g.relation));
+        for (const permission of live) {
+            db.run(`UPDATE _substrat_tuples SET revoked_at = ? WHERE subject = ? AND relation = ? AND object = ?`, input.at, subject, `granted:${permission}`, object);
+            // What ON may give back — and nothing else. INSERT OR REPLACE, so a record a past
+            // OFF/ON cycle left tombstoned is live again for this one.
+            db.run(`INSERT OR REPLACE INTO _substrat_tuples (subject, relation, object, expires_at, revoked_at)
+         VALUES (?, ?, ?, NULL, NULL)`, subject, `${SWITCHED_PREFIX}${permission}`, object);
+        }
+        const markerMoved = !marker || marker.revoked_at !== null;
+        if (markerMoved) {
+            db.run(`INSERT OR REPLACE INTO _substrat_tuples (subject, relation, object, expires_at, revoked_at)
+         VALUES (?, ?, ?, NULL, NULL)`, subject, SYSTEM_SWITCH_OFF_RELATION, object);
+        }
+        return { held: true, changed: markerMoved || live.length > 0, permissions: live };
+    }
+    const records = db.all(`SELECT relation FROM _substrat_tuples
+      WHERE subject = ? AND object = ? AND substr(relation, 1, 9) = ? AND revoked_at IS NULL
+      ORDER BY relation`, subject, object, SWITCHED_PREFIX);
+    const restored = [];
+    for (const { relation } of records) {
+        const permission = relation.slice(SWITCHED_PREFIX.length);
+        const revoked = grants.find((g) => g.relation === `granted:${permission}` && g.revoked_at !== null);
+        if (revoked) {
+            db.run(`UPDATE _substrat_tuples SET revoked_at = NULL WHERE subject = ? AND relation = ? AND object = ?`, subject, `granted:${permission}`, object);
+            restored.push(permission);
+        }
+        db.run(`UPDATE _substrat_tuples SET revoked_at = ? WHERE subject = ? AND relation = ? AND object = ?`, input.at, subject, relation, object);
+    }
+    const markerMoved = marker !== undefined && marker.revoked_at === null;
+    if (markerMoved) {
+        db.run(`UPDATE _substrat_tuples SET revoked_at = ? WHERE subject = ? AND relation = ? AND object = ?`, input.at, subject, SYSTEM_SWITCH_OFF_RELATION, object);
+    }
+    return { held: true, changed: markerMoved || restored.length > 0, permissions: restored };
+}
+//# sourceMappingURL=system-switch.js.map

package/dist/system-switch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"system-switch.js","sourceRoot":"","sources":["../src/system-switch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEH,4FAA4F;AAC5F,MAAM,CAAC,MAAM,0BAA0B,GAAG,YAAY,CAAC;AAEvD,uFAAuF;AACvF,MAAM,eAAe,GAAG,WAAW,CAAC;AAqBpC,MAAM,SAAS,GAAG,CAAC,QAAgB,EAAU,EAAE,CAAC,UAAU,QAAQ,EAAE,CAAC;AAErE;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG;sCACL,0BAA0B,2BAA2B,CAAC;AAE5F;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAAa,EAAE,QAAgB,EAAE,GAAW;IAC9E,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,EAAE,CAAC,GAAG,CAChB;SACK,2BAA2B;;;gGAG4D,EAC5F,OAAO,EACP,OAAO,EACP,GAAG,CACJ,CAAC,CAAC,CAAiD,CAAC;IACrD,IAAI,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,OAAO,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC;AACzD,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,iBAAiB,CAAC,EAAa,EAAE,QAAgB;IAC/D,MAAM,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,UAAU,2BAA2B,SAAS,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAE5E,CAAC;IACd,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,wBAAwB,CAAC,QAAgB,EAAE,OAAe;IACxE,OAAO,CACL,WAAW,QAAQ,8BAA8B,OAAO,8BAA8B;QACtF,uFAAuF;QACvF,+DAA+D,CAChE,CAAC;AACJ,CAAC;AASD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,qBAAqB,CACnC,EAAa,EACb,KAA0E;IAE1E,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,SAAS,KAAK,CAAC,OAAO,EAAE,CAAC;IACxC,MAAM,MAAM,GAAG,EAAE,CAAC,GAAG,CACnB;;wBAEoB,EACpB,OAAO,EACP,MAAM,CAC8C,CAAC;IACvD,MAAM,MAAM,GAAG,EAAE,CAAC,GAAG,CACnB,2FAA2F,EAC3F,OAAO,EACP,0BAA0B,EAC1B,MAAM,CACP,CAAC,CAAC,CAA8C,CAAC;IAClD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IAE5F,MAAM,YAAY,GAAG,CAAC,QAAgB,EAAU,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACrF,IAAI,KAAK,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC9F,KAAK,MAAM,UAAU,IAAI,IAAI,EAAE,CAAC;YAC9B,EAAE,CAAC,GAAG,CACJ,8FAA8F,EAC9F,KAAK,CAAC,EAAE,EACR,OAAO,EACP,WAAW,UAAU,EAAE,EACvB,MAAM,CACP,CAAC;YACF,kFAAkF;YAClF,2DAA2D;YAC3D,EAAE,CAAC,GAAG,CACJ;sCAC8B,EAC9B,OAAO,EACP,GAAG,eAAe,GAAG,UAAU,EAAE,EACjC,MAAM,CACP,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,CAAC;QAC1D,IAAI,WAAW,EAAE,CAAC;YAChB,EAAE,CAAC,GAAG,CACJ;sCAC8B,EAC9B,OAAO,EACP,0BAA0B,EAC1B,MAAM,CACP,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACpF,CAAC;IAED,MAAM,OAAO,GAAG,EAAE,CAAC,GAAG,CACpB;;wBAEoB,EACpB,OAAO,EACP,MAAM,EACN,eAAe,CACU,CAAC;IAC5B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,EAAE,QAAQ,EAAE,IAAI,OAAO,EAAE,CAAC;QACnC,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,WAAW,UAAU,EAAE,IAAI,CAAC,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC;QACpG,IAAI,OAAO,EAAE,CAAC;YACZ,EAAE,CAAC,GAAG,CACJ,iGAAiG,EACjG,OAAO,EACP,WAAW,UAAU,EAAE,EACvB,MAAM,CACP,CAAC;YACF,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC5B,CAAC;QACD,EAAE,CAAC,GAAG,CACJ,8FAA8F,EAC9F,KAAK,CAAC,EAAE,EACR,OAAO,EACP,QAAQ,EACR,MAAM,CACP,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,CAAC;IACvE,IAAI,WAAW,EAAE,CAAC;QAChB,EAAE,CAAC,GAAG,CACJ,8FAA8F,EAC9F,KAAK,CAAC,EAAE,EACR,OAAO,EACP,0BAA0B,EAC1B,MAAM,CACP,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;AAC5F,CAAC"}

package/dist/timeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"timeline.d.ts","sourceRoot":"","sources":["../src/timeline.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,SAAS,EAEd,KAAK,OAAO,EACZ,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,WAAW,EAEhB,KAAK,gBAAgB,EACrB,KAAK,UAAU,EAOf,KAAK,QAAQ,EACb,KAAK,IAAI,EAET,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACtB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,SAAS,EAAY,MAAM,iBAAiB,CAAC;AAE3D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAEH,oFAAoF;AACpF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;CACxC;AAmHD;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAC1B,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,SAAS,EACjB,IAAI,CAAC,EAAE,QAAQ,GACd,IAAI,CAAC,aAAa,CAAC,CAKrB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,WAAW,CACzB,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,SAAS,EACjB,IAAI,CAAC,EAAE,QAAQ,GACd,IAAI,CAAC,YAAY,CAAC,CAKpB;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,OAAO,EAChB,QAAQ,SAAK,GACZ,UAAU,CAuCZ;AAwCD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,OAAO,EAChB,QAAQ,SAAK,GACZ,WAAW,CAoFb;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,cAAc,EACnB,YAAY,EAAE,MAAM,EACpB,KAAK,SAAM,GACV,gBAAgB,CAOlB;AAqBD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,GAAG,QAAQ,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CA6ChH;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,eAAe,GAAG,gBAAgB,CAqEzF"}
+{"version":3,"file":"timeline.d.ts","sourceRoot":"","sources":["../src/timeline.ts"],"names":[],"mappings":"AAAA,OAAO,EAOL,KAAK,SAAS,EACd,KAAK,OAAO,EACZ,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,WAAW,EAEhB,KAAK,gBAAgB,EACrB,KAAK,UAAU,EAMf,KAAK,QAAQ,EACb,KAAK,IAAI,EACT,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACtB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,KAAK,EAAE,SAAS,EAAY,MAAM,iBAAiB,CAAC;AAE3D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAEH,oFAAoF;AACpF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;CACxC;AAmID;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAC1B,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,SAAS,EACjB,IAAI,CAAC,EAAE,QAAQ,GACd,IAAI,CAAC,aAAa,CAAC,CAKrB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,WAAW,CACzB,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,SAAS,EACjB,IAAI,CAAC,EAAE,QAAQ,GACd,IAAI,CAAC,YAAY,CAAC,CAKpB;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,OAAO,EAChB,QAAQ,SAAK,GACZ,UAAU,CA+CZ;AAkDD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,OAAO,EAChB,QAAQ,SAAK,GACZ,WAAW,CAoFb;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,cAAc,EACnB,YAAY,EAAE,MAAM,EACpB,KAAK,SAAM,GACV,gBAAgB,CAOlB;AA+DD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,GAAG,QAAQ,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CA4BhH;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,eAAe,GAAG,gBAAgB,CAqEzF"}