@substrat-run/kernel 0.118.0 → 0.120.0

package/dist/vertical-events.js

@@ -0,0 +1,348 @@
+/**
+ * Cross-vertical event delivery (#1705): the half both adapters share.
+ *
+ * A vertical exports an event type by declaring it (`events.exports`), and another vertical of
+ * the same tenant imports it by declaring `events.consumes: [{ from, … }]`. Nothing is written
+ * when an exported event commits. The producer's outbox is retained and is already the durable
+ * record, so an export is a READ over it, and a consumer's progress is a watermark the consumer
+ * keeps. Each platform sweep pass then:
+ *
+ *   1. asks the consumer scope for its watermark on this producer (`IMPORT_CURSORS_SQL`);
+ *   2. reads the producer's outbox after it, in the producer's own scope, through its own
+ *      running `exports` (`exportReadQuery` + `planExportBatch`);
+ *   3. hands the batch to the consumer, which journals each event and runs its handlers,
+ *      then moves the watermark in the same store (`IMPORT_CURSOR_ADVANCE_SQL`).
+ *
+ * The tables here are the consumer's half of that, and they hold NO payload. The event's only
+ * copy stays in the producer's outbox, where a subject erasure already reaches. An imported
+ * payload would be one more resting copy for the erasure to find, and #1600 and #1632 were
+ * each about a copy it had missed. What the consumer keeps is the envelope. That is enough to
+ * dedupe, to show a dead letter, and to resolve a `caused_by` that points across the edge.
+ *
+ * Shared from here for `CAPABILITY_DDL`'s reason: the self-host builds these tables and
+ * production builds them, and one definition is what keeps the two identical.
+ * `lint:spine-ddl` holds each adapter to including it.
+ */
+import { EXPORT_HOP_CAP, } from '@substrat-run/contracts';
+import { domainEventOf } from './outbox-event.js';
+export const VERTICAL_EVENTS_DDL = `
+  -- #1705: every event this scope has received from another vertical. The envelope only, and
+  -- never the payload. The producer's outbox keeps the one copy, where erasure already reaches.
+  CREATE TABLE IF NOT EXISTS _substrat_imports (
+    -- The PRODUCER's event id. A ULID the producer's host minted, so it is unique across
+    -- every source this scope imports from, and it is the dedupe key: a batch delivered
+    -- twice finds its events here and its handlers' journal rows in _substrat_deliveries.
+    event_id TEXT PRIMARY KEY,
+    source_scope_id TEXT NOT NULL,
+    source_vertical TEXT NOT NULL,
+    type TEXT NOT NULL,
+    schema_version INTEGER NOT NULL,
+    occurred_at TEXT NOT NULL,
+    entity_type TEXT NOT NULL,
+    entity_id TEXT NOT NULL,
+    -- How many vertical boundaries this event's cause chain has crossed, this one included.
+    -- An export read in THIS scope counts from here when one of its own events was caused by
+    -- an import, which is how a loop between two verticals is stopped.
+    hops INTEGER NOT NULL,
+    -- NULL: released, and handed to this scope's handlers. Otherwise the producer's reason
+    -- for NOT releasing it ('pii', 'version', 'cascade', 'undecodable'). Such a row was
+    -- named but never carried.
+    withheld TEXT,
+    imported_at TEXT NOT NULL
+  );
+  -- #1705: how far this scope has read each producer. Written in the same store as the
+  -- handlers' writes, so a restore of this scope rewinds the watermark with the data and the
+  -- producer re-delivers what the restore undid. A watermark the platform held instead would
+  -- skip it.
+  CREATE TABLE IF NOT EXISTS _substrat_import_cursors (
+    source_scope_id TEXT PRIMARY KEY,
+    source_vertical TEXT NOT NULL,
+    -- The id of the last producer row the reads walked (released or withheld). NULL is not
+    -- stored: a producer with no row here has never been read, which the absence says.
+    cursor TEXT NOT NULL,
+    updated_at TEXT NOT NULL
+  );
+  -- #1705: the export read, on the PRODUCER side. It asks for a few types after a watermark,
+  -- in id order. Without this index SQLite walks the primary key from the watermark forward and
+  -- steps over every row of every other type. A consumer that is caught up would then pay, on
+  -- every pass, for all the unexported activity since the last exported event. With it, the read
+  -- seeks each type's range and costs what it returns.
+  CREATE INDEX IF NOT EXISTS _substrat_outbox_type_id ON _substrat_outbox (type, id);
+`;
+/**
+ * The producer-side read: rows of the given types after the watermark, oldest first.
+ *
+ * `types` is already the intersection of what the consumer wants and what this scope exports.
+ * The caller computes it from its own registered manifests, never from the request alone, so
+ * nothing here can widen what leaves.
+ */
+export function exportReadQuery(types, after, limit) {
+    if (types.length === 0)
+        throw new Error('exportReadQuery: no types to read');
+    const placeholders = types.map(() => '?').join(', ');
+    return {
+        sql: `SELECT * FROM _substrat_outbox WHERE type IN (${placeholders})` +
+            (after === null ? '' : ' AND id > ?') +
+            ' ORDER BY id LIMIT ?',
+        params: [...types, ...(after === null ? [] : [after]), limit],
+    };
+}
+/**
+ * How many vertical boundaries the cause chain of an outbox row with this `caused_by` has
+ * already crossed. The answer is the `hops` of the NEAREST import in its chain, or no row when
+ * the chain never crossed one.
+ *
+ * Walks `caused_by` backwards through this scope's outbox. The chain ends at an import, which
+ * is in `_substrat_imports` and not in the outbox, or at an event nothing caused. Bounded at 64
+ * steps: a chain that long inside ONE scope has already been cut many times by the per-call
+ * cascade cap. Past the bound, the row counts as having crossed nothing. That under-counts, and
+ * it is stated rather than hidden. It can only let a loop run for more passes than the cap
+ * intends. It cannot release an event that should not cross.
+ */
+export const EXPORT_HOPS_SQL = `
+  WITH RECURSIVE chain(id, depth) AS (
+    SELECT ?, 0
+    UNION ALL
+    SELECT o.caused_by, c.depth + 1
+      FROM chain c JOIN _substrat_outbox o ON o.id = c.id
+     WHERE o.caused_by IS NOT NULL AND c.depth < 64
+  )
+  SELECT i.hops AS hops FROM chain c JOIN _substrat_imports i ON i.event_id = c.id
+   ORDER BY c.depth LIMIT 1
+`;
+/**
+ * The producer-side decision, over rows already read: what is released, what is withheld and
+ * why, and the watermark the consumer should hold afterwards.
+ *
+ * Pure, so both adapters make the same decision about the same rows. Authority is NOT decided
+ * here. The adapter checks the consumer's principal before it reads anything, and a missing
+ * key pauses the edge without walking a row. Every reason this function withholds for is
+ * fixed at write time (the classification, the version, the cause chain, the stored text),
+ * so stepping the watermark past a withheld row can never lose an event that a later pass
+ * would have released.
+ */
+export function planExportBatch(input) {
+    const cap = input.hopCap ?? EXPORT_HOP_CAP;
+    const events = [];
+    const withheld = [];
+    const withhold = (row, reason) => {
+        withheld.push({
+            id: row.id,
+            type: row.type,
+            schemaVersion: row.schema_version,
+            occurredAt: row.occurred_at,
+            entity: { entityType: row.entity_type, entityId: row.entity_id },
+            reason,
+        });
+    };
+    for (const row of input.rows) {
+        // Classification first: a classified row is withheld whatever else is true of it. The
+        // other reasons would also withhold it, but the one a reader is told must be the one
+        // that answers "why did this not cross".
+        if (row.pii_class !== 'none') {
+            withhold(row, 'pii');
+            continue;
+        }
+        if (input.wanted.get(row.type) !== row.schema_version) {
+            withhold(row, 'version');
+            continue;
+        }
+        const hops = input.hopsBefore(row) + 1;
+        if (hops > cap) {
+            withhold(row, 'cascade');
+            continue;
+        }
+        let decoded;
+        try {
+            decoded = domainEventOf(row);
+        }
+        catch {
+            // The reason and nothing else. The decode's own message names columns, and it
+            // must not travel: it is written into the consumer's dead letter, in another
+            // vertical's scope.
+            withhold(row, 'undecodable');
+            continue;
+        }
+        events.push({
+            id: decoded.id,
+            type: decoded.type,
+            schemaVersion: decoded.schemaVersion,
+            occurredAt: decoded.occurredAt,
+            entity: decoded.entity,
+            payload: decoded.payload,
+            hops,
+        });
+    }
+    const last = input.rows[input.rows.length - 1];
+    return {
+        events,
+        withheld,
+        next: (last?.id ?? input.after),
+        more: input.rows.length === input.limit,
+    };
+}
+/**
+ * The read plan for one request: which types to read, which keys the consumer must hold for
+ * them, and what it asked for that this scope does not export.
+ *
+ * `exports` is THIS scope's running declaration, the union over its registered modules. A
+ * wanted type absent from it is reported and never read. That is the producer's own code
+ * deciding what leaves, whatever the platform asked for.
+ */
+export function exportReadPlan(exports, wants) {
+    const types = [];
+    const keys = new Set();
+    const wanted = new Map();
+    const unexported = [];
+    for (const w of wants) {
+        const e = exports.get(w.type);
+        if (!e) {
+            unexported.push(w);
+            continue;
+        }
+        if (!wanted.has(w.type))
+            types.push(w.type);
+        wanted.set(w.type, w.schemaVersion);
+        keys.add(e.readPermission);
+    }
+    return { types: types.sort(), keys: [...keys].sort(), wanted, unexported };
+}
+/** Every (type → export) the given manifests declare. The caller's registration refuses conflicts. */
+export function exportsOf(manifests) {
+    const out = new Map();
+    for (const m of manifests)
+        for (const e of m.events.exports ?? [])
+            if (!out.has(e.type))
+                out.set(e.type, e);
+    return out;
+}
+/** The consumer's watermark per producer, oldest source first. */
+export const IMPORT_CURSORS_SQL = 'SELECT source_scope_id, source_vertical, cursor, updated_at FROM _substrat_import_cursors ORDER BY source_scope_id';
+/** One producer's watermark, for the compare-and-set a batch is applied under. */
+export const IMPORT_CURSOR_OF_SQL = 'SELECT cursor FROM _substrat_import_cursors WHERE source_scope_id = ?';
+/**
+ * Move one producer's watermark. Params: (source_scope_id, source_vertical, cursor, updated_at).
+ *
+ * Only ever forward. ULIDs sort by time, and a batch's `next` is the last id its read walked,
+ * so a smaller value can only come from a pass that read less than one already applied. The
+ * batch's own compare-and-set normally refuses that pass before it gets here, and this is the
+ * second line.
+ */
+export const IMPORT_CURSOR_ADVANCE_SQL = `
+  INSERT INTO _substrat_import_cursors (source_scope_id, source_vertical, cursor, updated_at)
+  VALUES (?, ?, ?, ?)
+  ON CONFLICT (source_scope_id) DO UPDATE SET
+    source_vertical = excluded.source_vertical,
+    cursor = excluded.cursor,
+    updated_at = excluded.updated_at
+  WHERE excluded.cursor > _substrat_import_cursors.cursor
+`;
+/**
+ * Journal one received (or withheld) event's envelope. Params in column order. Ignored on a
+ * repeat: the first journaling is the fact, and a redelivered batch must not move
+ * `imported_at` forward or rewrite what was withheld and why.
+ */
+export const IMPORT_RECORD_SQL = `
+  INSERT OR IGNORE INTO _substrat_imports
+    (event_id, source_scope_id, source_vertical, type, schema_version, occurred_at,
+     entity_type, entity_id, hops, withheld, imported_at)
+  VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+`;
+/** The note a withheld event's dead letter carries at the consumer. Names the reason, never the content. */
+export function withheldNote(reason, vertical) {
+    const why = {
+        pii: 'it is classified as carrying personal data, and only piiClass none crosses a vertical boundary',
+        version: 'its schemaVersion is not the one this module declares, so a parse here would reject it (K-39)',
+        cascade: `its cause chain has already crossed ${EXPORT_HOP_CAP} vertical boundaries`,
+        undecodable: 'the stored row does not decode (#1636)',
+    };
+    return `withheld by '${vertical}' (#1705): ${why[reason]} — nothing was delivered`;
+}
+/**
+ * A host's cross-vertical declarations (#1705), accumulated module by module. It is held by
+ * every place that registers modules (the pure host, the Cloudflare coordinator and the
+ * scope DO), so the three refuse the same wiring with the same words.
+ *
+ * What it refuses, and why each would otherwise be silent:
+ * - **An import handler for a (source, type) the manifest does not declare `from` it.** It
+ *   would run for events nobody reviewed the module receiving, because the declaration is
+ *   what the permission diff shows.
+ * - **A declared import with no handler.** The edge would be read, the events journaled and
+ *   the watermark moved, and nothing would ever run: a delivery that reports success and
+ *   does nothing. (A LOCAL consume without a handler stays allowed, as it always was.)
+ * - **Two modules importing one (source, type) at different versions**, or **exporting one
+ *   type under different versions or keys**. The edge asks for one version and gates on one
+ *   key, and which module won would depend on registration order.
+ */
+export class CrossVerticalRegistry {
+    exportsByType = new Map();
+    importVersion = new Map();
+    registered = [];
+    register(manifest, handlers) {
+        const declared = new Map();
+        for (const c of manifest.events.consumes)
+            if (c.from !== undefined)
+                declared.set(`${c.from}\u0000${c.type}`, c);
+        const imports = [];
+        for (const [from, byType] of Object.entries(handlers ?? {})) {
+            for (const [type, handler] of Object.entries(byType)) {
+                const decl = declared.get(`${from}\u0000${type}`);
+                if (!decl) {
+                    throw new Error(`${manifest.id} registers an import handler for '${type}' from '${from}', which its manifest does not ` +
+                        `declare — add { from: '${from}', type: '${type}', schemaVersion } to events.consumes`);
+                }
+                imports.push({ moduleId: manifest.id, from, type, schemaVersion: decl.schemaVersion, handler });
+            }
+        }
+        for (const [key, decl] of declared) {
+            if (!imports.some((i) => `${i.from}\u0000${i.type}` === key)) {
+                throw new Error(`${manifest.id} declares it consumes '${decl.type}' from '${decl.from}' but registers no handler for it ` +
+                    `under \`imports['${decl.from}']\` — the edge would deliver into nothing`);
+            }
+            const prior = this.importVersion.get(key);
+            if (prior && prior.schemaVersion !== decl.schemaVersion) {
+                throw new Error(`'${decl.type}' from '${decl.from}' is imported at schemaVersion ${prior.schemaVersion} by ${prior.declaredBy} ` +
+                    `and ${decl.schemaVersion} by ${manifest.id} — one edge asks for one version`);
+            }
+        }
+        for (const e of manifest.events.exports ?? []) {
+            const prior = this.exportsByType.get(e.type);
+            if (prior && (prior.schemaVersion !== e.schemaVersion || prior.readPermission !== e.readPermission)) {
+                throw new Error(`'${e.type}' is exported as v${prior.schemaVersion} under '${prior.readPermission}' by ${prior.declaredBy} ` +
+                    `and as v${e.schemaVersion} under '${e.readPermission}' by ${manifest.id} — one export, one version, one key`);
+            }
+        }
+        // Validated whole before anything is kept, so a refused module leaves no half of itself.
+        for (const e of manifest.events.exports ?? []) {
+            if (!this.exportsByType.has(e.type))
+                this.exportsByType.set(e.type, { ...e, declaredBy: manifest.id });
+        }
+        for (const [key, decl] of declared) {
+            if (!this.importVersion.has(key))
+                this.importVersion.set(key, { schemaVersion: decl.schemaVersion, declaredBy: manifest.id });
+        }
+        this.registered.push(...imports);
+    }
+    /** type → export, over every registered module: what this deployment releases. */
+    exports() {
+        return new Map([...this.exportsByType].map(([t, { declaredBy: _, ...e }]) => [t, e]));
+    }
+    /** What this deployment imports, one row per (source, type), sorted. */
+    consumes() {
+        return [...this.importVersion.entries()]
+            .map(([key, v]) => {
+            const [from, type] = key.split('\u0000');
+            return { from, type, schemaVersion: v.schemaVersion };
+        })
+            .sort((a, b) => a.from.localeCompare(b.from) || a.type.localeCompare(b.type));
+    }
+    /** The handlers for one (source, type), in registration order. */
+    handlersFor(from, type) {
+        return this.registered.filter((i) => i.from === from && i.type === type);
+    }
+    /** Every module that imports anything from `from`: who a withheld event's dead letter is filed under. */
+    modulesImporting(from, type) {
+        return [...new Set(this.handlersFor(from, type).map((i) => i.moduleId))];
+    }
+}
+//# sourceMappingURL=vertical-events.js.map

package/dist/vertical-events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vertical-events.js","sourceRoot":"","sources":["../src/vertical-events.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EACL,cAAc,GAQf,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,aAAa,EAA0B,MAAM,mBAAmB,CAAC;AAG1E,MAAM,CAAC,MAAM,mBAAmB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2ClC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAC7B,KAAwB,EACxB,KAAoB,EACpB,KAAa;IAEb,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAC7E,MAAM,YAAY,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrD,OAAO;QACL,GAAG,EACD,iDAAiD,YAAY,GAAG;YAChE,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC;YACrC,sBAAsB;QACxB,MAAM,EAAE,CAAC,GAAG,KAAK,EAAE,GAAG,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;KAC9D,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;;;;;;;;;;CAU9B,CAAC;AAKF;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,KAS/B;IACC,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,IAAI,cAAc,CAAC;IAC3C,MAAM,MAAM,GAAoB,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAG,CAAC,GAAc,EAAE,MAA+B,EAAQ,EAAE;QACzE,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,GAAG,CAAC,EAAyB;YACjC,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,aAAa,EAAE,GAAG,CAAC,cAAc;YACjC,UAAU,EAAE,GAAG,CAAC,WAAW;YAC3B,MAAM,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,WAAW,EAAE,QAAQ,EAAE,GAAG,CAAC,SAAS,EAAE;YAChE,MAAM;SACP,CAAC,CAAC;IACL,CAAC,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,sFAAsF;QACtF,qFAAqF;QACrF,yCAAyC;QACzC,IAAI,GAAG,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;YAC7B,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACrB,SAAS;QACX,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,cAAc,EAAE,CAAC;YACtD,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YACzB,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,IAAI,GAAG,GAAG,EAAE,CAAC;YACf,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YACzB,SAAS;QACX,CAAC;QACD,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,8EAA8E;YAC9E,6EAA6E;YAC7E,oBAAoB;YACpB,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;YAC7B,SAAS;QACX,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,IAAI;SACL,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/C,OAAO;QACL,MAAM;QACN,QAAQ;QACR,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,IAAI,KAAK,CAAC,KAAK,CAA0B;QACxD,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,KAAK;KACxC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAyC,EACzC,KAA6B;IAE7B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,MAAM,UAAU,GAAkB,EAAE,CAAC;IACrC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACnB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC;QACpC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AAC7E,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,SAAS,CACvB,SAAsE;IAEtE,MAAM,GAAG,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,SAAS;QAAE,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;gBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC5G,OAAO,GAAG,CAAC;AACb,CAAC;AAED,kEAAkE;AAClE,MAAM,CAAC,MAAM,kBAAkB,GAC7B,oHAAoH,CAAC;AAEvH,kFAAkF;AAClF,MAAM,CAAC,MAAM,oBAAoB,GAAG,uEAAuE,CAAC;AAE5G;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG;;;;;;;;CAQxC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;CAKhC,CAAC;AAEF,4GAA4G;AAC5G,MAAM,UAAU,YAAY,CAAC,MAA+B,EAAE,QAAgB;IAC5E,MAAM,GAAG,GAA4C;QACnD,GAAG,EAAE,gGAAgG;QACrG,OAAO,EAAE,+FAA+F;QACxG,OAAO,EAAE,uCAAuC,cAAc,sBAAsB;QACpF,WAAW,EAAE,wCAAwC;KACtD,CAAC;IACF,OAAO,gBAAgB,QAAQ,cAAc,GAAG,CAAC,MAAM,CAAC,0BAA0B,CAAC;AACrF,CAAC;AAWD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,qBAAqB;IACf,aAAa,GAAG,IAAI,GAAG,EAAgD,CAAC;IACxE,aAAa,GAAG,IAAI,GAAG,EAAyD,CAAC;IACjF,UAAU,GAAuB,EAAE,CAAC;IAErD,QAAQ,CACN,QAA+C,EAC/C,QAAmE;QAEnE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA4B,CAAC;QACrD,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,QAAQ;YAAE,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;gBAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;QAChH,MAAM,OAAO,GAAuB,EAAE,CAAC;QACvC,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;YAC5D,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBACrD,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,IAAI,SAAS,IAAI,EAAE,CAAC,CAAC;gBAClD,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,MAAM,IAAI,KAAK,CACb,GAAG,QAAQ,CAAC,EAAE,qCAAqC,IAAI,WAAW,IAAI,iCAAiC;wBACrG,0BAA0B,IAAI,aAAa,IAAI,uCAAuC,CACzF,CAAC;gBACJ,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,EAAE,CAAC,CAAC;YAClG,CAAC;QACH,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC;YACnC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC;gBAC7D,MAAM,IAAI,KAAK,CACb,GAAG,QAAQ,CAAC,EAAE,0BAA0B,IAAI,CAAC,IAAI,WAAW,IAAI,CAAC,IAAI,oCAAoC;oBACvG,oBAAoB,IAAI,CAAC,IAAI,4CAA4C,CAC5E,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,KAAK,IAAI,KAAK,CAAC,aAAa,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC;gBACxD,MAAM,IAAI,KAAK,CACb,IAAI,IAAI,CAAC,IAAI,WAAW,IAAI,CAAC,IAAI,kCAAkC,KAAK,CAAC,aAAa,OAAO,KAAK,CAAC,UAAU,GAAG;oBAC9G,OAAO,IAAI,CAAC,aAAa,OAAO,QAAQ,CAAC,EAAE,kCAAkC,CAChF,CAAC;YACJ,CAAC;QACH,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;YAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC7C,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,aAAa,KAAK,CAAC,CAAC,aAAa,IAAI,KAAK,CAAC,cAAc,KAAK,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC;gBACpG,MAAM,IAAI,KAAK,CACb,IAAI,CAAC,CAAC,IAAI,qBAAqB,KAAK,CAAC,aAAa,WAAW,KAAK,CAAC,cAAc,QAAQ,KAAK,CAAC,UAAU,GAAG;oBAC1G,WAAW,CAAC,CAAC,aAAa,WAAW,CAAC,CAAC,cAAc,QAAQ,QAAQ,CAAC,EAAE,qCAAqC,CAChH,CAAC;YACJ,CAAC;QACH,CAAC;QACD,yFAAyF;QACzF,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;YAC9C,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;gBAAE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QACzG,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC;YACnC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QAChI,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC;IACnC,CAAC;IAED,kFAAkF;IAClF,OAAO;QACL,OAAO,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACxF,CAAC;IAED,wEAAwE;IACxE,QAAQ;QACN,OAAO,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;aACrC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE;YAChB,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAqB,CAAC;YAC7D,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC;QACxD,CAAC,CAAC;aACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAClF,CAAC;IAED,kEAAkE;IAClE,WAAW,CAAC,IAAY,EAAE,IAAY;QACpC,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAC3E,CAAC;IAED,yGAAyG;IACzG,gBAAgB,CAAC,IAAY,EAAE,IAAY;QACzC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC3E,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@substrat-run/kernel",
-  "version": "0.118.0",
+  "version": "0.120.0",
   "description": "Substrat kernel contracts and services — pure TypeScript, no platform imports (D-14)",
   "license": "AGPL-3.0-only",
   "repository": {
@@ -22,7 +22,7 @@
     "dist"
   ],
   "dependencies": {
-    "@substrat-run/contracts": "^0.118.0"
+    "@substrat-run/contracts": "^0.120.0"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",