@substrat-run/kernel 0.120.0 → 0.121.0

package/dist/scope-host.js.map

@@ -1 +1 @@
-{"version":3,"file":"scope-host.js","sourceRoot":"","sources":["../src/scope-host.ts"],"names":[],"mappings":"AA8IA,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAqvBxD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,WAAW,GAAc,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CACnD,UAA8C,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AAoPrE;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAA2B;IAC5D,OAAO;QACL,WAAW,EAAE,KAAK,EAAE,WAAW,IAAI,CAAC;QACpC,WAAW,EAAE,KAAK,EAAE,WAAW,IAAI,KAAK;QACxC,UAAU,EAAE,KAAK,EAAE,UAAU,IAAI,OAAO;KACzC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS,CACvB,QAAgB,EAChB,KAAoC,EACpC,IAAU;IAEV,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,GAAG,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IAChF,MAAM,QAAQ,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC;IACnE,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;AAC3D,CAAC;AAqJD,MAAM,UAAU,YAAY;IAC1B,OAAO,CAAoC,QAA+C,EAAK,EAAE,CAAC,QAAQ,CAAC;AAC7G,CAAC;AAuhED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,YAAoB;IACrE,OAAO,SAAS,OAAO,QAAQ,YAAY,EAAE,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,SAAiB,EACjB,WAAmB,EACnB,IAAkD;IAElD,MAAM,SAAS,GACb,IAAI,CAAC,MAAM,KAAK,CAAC;QACf,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7E,OAAO,2BAA2B,SAAS,4BAA4B,WAAW,aAAa,SAAS,EAAE,CAAC;AAC7G,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAA8B;IACnE,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,MAAsB,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,6EAA6E;QAC7E,kFAAkF;QAClF,0DAA0D;QAC1D,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAmFD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAE7C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAE3C;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAClC,iHAAiH,CAAC;AAEpH;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAgB;IACrD,MAAM,OAAO,GAAG,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5D,OAAO,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,MAAM,CAAC,CAAC;AACtF,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAkhCxC;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB,CAAC,aAAqB,EAAE,GAAW;IACpE,IAAI,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;QAAE,OAAO;IACzD,MAAM,aAAa,CACjB,mBAAmB,EACnB,iBAAiB,aAAa,2DAA2D;QACvF,yEAAyE,EAC3E,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC,EAAE,CAC9E,CAAC;AACJ,CAAC"}
+{"version":3,"file":"scope-host.js","sourceRoot":"","sources":["../src/scope-host.ts"],"names":[],"mappings":"AAkJA,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAoxBxD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,WAAW,GAAc,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CACnD,UAA8C,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AAoPrE;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAA2B;IAC5D,OAAO;QACL,WAAW,EAAE,KAAK,EAAE,WAAW,IAAI,CAAC;QACpC,WAAW,EAAE,KAAK,EAAE,WAAW,IAAI,KAAK;QACxC,UAAU,EAAE,KAAK,EAAE,UAAU,IAAI,OAAO;KACzC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS,CACvB,QAAgB,EAChB,KAAoC,EACpC,IAAU;IAEV,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,GAAG,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IAChF,MAAM,QAAQ,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC;IACnE,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;AAC3D,CAAC;AAqJD,MAAM,UAAU,YAAY;IAC1B,OAAO,CAAoC,QAA+C,EAAK,EAAE,CAAC,QAAQ,CAAC;AAC7G,CAAC;AAmmED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,YAAoB;IACrE,OAAO,SAAS,OAAO,QAAQ,YAAY,EAAE,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,SAAiB,EACjB,WAAmB,EACnB,IAAkD;IAElD,MAAM,SAAS,GACb,IAAI,CAAC,MAAM,KAAK,CAAC;QACf,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7E,OAAO,2BAA2B,SAAS,4BAA4B,WAAW,aAAa,SAAS,EAAE,CAAC;AAC7G,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAA8B;IACnE,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,MAAsB,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,6EAA6E;QAC7E,kFAAkF;QAClF,0DAA0D;QAC1D,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAmFD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAE7C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAE3C;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAClC,iHAAiH,CAAC;AAEpH;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAgB;IACrD,MAAM,OAAO,GAAG,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5D,OAAO,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,MAAM,CAAC,CAAC;AACtF,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,CAAC;AA0hCxC;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB,CAAC,aAAqB,EAAE,GAAW;IACpE,IAAI,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;QAAE,OAAO;IACzD,MAAM,aAAa,CACjB,mBAAmB,EACnB,iBAAiB,aAAa,2DAA2D;QACvF,yEAAyE,EAC3E,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC,EAAE,CAC9E,CAAC;AACJ,CAAC"}

package/dist/sql-limits.d.ts

@@ -0,0 +1,70 @@
+/**
+ * The SQLite limits a Durable Object enforces and node does not (#1741).
+ *
+ * A vertical's `ctx.sql` runs on `better-sqlite3` in every local suite and on a Durable
+ * Object's SQLite when it is deployed, and the DO's build sets several limits far below
+ * stock SQLite's. A statement over one passed every node suite and failed only on a
+ * deployed scope — `customer/get` in an adopter vertical counted rows with a 29-term
+ * `UNION ALL` and broke on the first hosted call. #1655 closed the same gap for a `LIKE`
+ * pattern (`tools/vitest/like-pattern-limit.cjs`, which has to patch the driver because
+ * `better-sqlite3` exposes no `sqlite3_limit`). Three of the four limits below can be judged
+ * from the statement text, so the adapter judges them itself, and a vertical's OWN suite sees
+ * what a Durable Object sees. The pattern limit cannot: a pattern is often built at run time,
+ * and judging it exactly means replacing `like()` on every connection, a JavaScript call per
+ * row that also switches off SQLite's `LIKE` prefix index optimisation. That cost is fine in a
+ * test preload and not in an adapter self-hosters run, so it stays a preload's job.
+ *
+ * The values are MEASURED, not read from documentation:
+ * `packages/adapter-cloudflare/test/do-sql-limits.test.ts` drives a real Durable Object's
+ * SQL to each limit and pins the value and the refusal message it gave. If workerd moves
+ * one, that test goes red first.
+ *
+ * | limit                         | value          | DO's refusal                                        |
+ * |-------------------------------|----------------|-----------------------------------------------------|
+ * | terms in one compound SELECT  | 5              | `too many terms in compound SELECT`                 |
+ * | bound parameters              | 100            | `too many SQL variables at offset N`                |
+ * | statement length              | 100 000 bytes  | `statement too long` (`SQLITE_TOOBIG`)              |
+ * | `LIKE`/`GLOB` pattern length  | 50 bytes       | `LIKE or GLOB pattern too complex` (not judged here: preload only) |
+ *
+ * What is NOT a limit, measured: a multi-row `VALUES` list — SQLite does not count its rows
+ * as compound terms; 5 000 rows ran on the DO. So `INSERT … VALUES (…),(…),…` is bounded by
+ * the parameter count and the statement length only.
+ *
+ * Judged here, from the text, exactly as SQLite counts:
+ *  - **compound terms** — `UNION`, `UNION ALL`, `INTERSECT` and `EXCEPT` at one parenthesis
+ *    level chain their operands into one compound; the limit is on the operands (operators + 1).
+ *    A subquery, a CTE body and a view body each start their own count.
+ *  - **bound parameters** — SQLite's own numbering: each `?` takes the next number, `?N`
+ *    takes N, a `:name`/`@name`/`$name` takes the next number the first time it is seen. The
+ *    limit is on the highest number, not on how many are written or how many are bound.
+ *  - **statement length** — the whole string the caller passed, in UTF-8 bytes (a multi-
+ *    statement string counts once, as on the DO).
+ *
+ * The messages are the DO's own, suffix included, so a suite that matches on one matches
+ * both adapters. Only MODULE-facing SQL is wrapped: platform-internal statements are the
+ * platform's own responsibility, and they already run on a real DO in the workerd suites.
+ */
+import type { ScopedSql } from './scope-host.js';
+/** The limits a Durable Object's SQLite enforces — measured, see the file header. */
+export declare const DO_SQL_LIMITS: {
+    /** Terms (operands) in one compound `SELECT`. */
+    readonly compoundTerms: 5;
+    /** Bound parameters — the highest parameter number — in one statement. */
+    readonly boundParameters: 100;
+    /** Statement length, in UTF-8 bytes, of the whole string handed to `sql.exec`. */
+    readonly statementBytes: 100000;
+    /** `LIKE`/`GLOB` pattern length, in UTF-8 bytes. Enforced by `tools/vitest/like-pattern-limit.cjs`. */
+    readonly likePatternBytes: 50;
+};
+/**
+ * Refuse a statement a Durable Object's SQLite would refuse for its length, its compound
+ * `SELECT` terms, or its bound parameters. Throws the DO's own message.
+ */
+export declare function assertWithinSqlLimits(sql: string): void;
+/**
+ * Wrap a module-facing `ScopedSql` so every statement passes `assertWithinSqlLimits` first.
+ * The node adapter wraps `ctx.sql` in it; the DO needs no wrapper — its SQLite is the
+ * source of these limits.
+ */
+export declare function guardSqlLimits(inner: ScopedSql): ScopedSql;
+//# sourceMappingURL=sql-limits.d.ts.map

package/dist/sql-limits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql-limits.d.ts","sourceRoot":"","sources":["../src/sql-limits.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,OAAO,KAAK,EAAE,SAAS,EAAY,MAAM,iBAAiB,CAAC;AAE3D,qFAAqF;AACrF,eAAO,MAAM,aAAa;IACxB,iDAAiD;aACjD,aAAa,EAAE,CAAC;IAChB,0EAA0E;aAC1E,eAAe,EAAE,GAAG;IACpB,kFAAkF;aAClF,cAAc,EAAE,MAAO;IACvB,uGAAuG;aACvG,gBAAgB,EAAE,EAAE;CACZ,CAAC;AA4CX;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAsHvD;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,SAAS,GAAG,SAAS,CAW1D"}

package/dist/sql-limits.js

@@ -0,0 +1,197 @@
+/** The limits a Durable Object's SQLite enforces — measured, see the file header. */
+export const DO_SQL_LIMITS = {
+    /** Terms (operands) in one compound `SELECT`. */
+    compoundTerms: 5,
+    /** Bound parameters — the highest parameter number — in one statement. */
+    boundParameters: 100,
+    /** Statement length, in UTF-8 bytes, of the whole string handed to `sql.exec`. */
+    statementBytes: 100_000,
+    /** `LIKE`/`GLOB` pattern length, in UTF-8 bytes. Enforced by `tools/vitest/like-pattern-limit.cjs`. */
+    likePatternBytes: 50,
+};
+const utf8 = new TextEncoder();
+const byteLength = (s) => utf8.encode(s).length;
+/** The offset SQLite reports is in BYTES from the start of the statement. */
+const byteOffset = (sql, index) => byteLength(sql.slice(0, index));
+const COMPOUND_OPERATORS = new Set(['union', 'intersect', 'except']);
+const isWord = (c) => /[A-Za-z0-9_$\u0080-￿]/.test(c);
+/**
+ * Where a `:name`, `@name` or `$name` parameter token ends — SQLite's own tokenizer rule
+ * (`sqlite3GetToken`, the variable case), which is wider than an identifier:
+ *  - identifier characters (letters, digits, `_`, `$`, anything non-ASCII) continue it;
+ *  - `::` continues it, so `$a::b` is ONE parameter (the pair adds nothing to the name);
+ *  - a `(` starts a Tcl-style suffix that runs to the next `)` or whitespace, and ends the
+ *    token: `$a(b c)` is not one parameter but `$a(b` and, past the space, other words.
+ * A scanner that stopped at the first `:` or `(` counted the rest as more parameters, so a
+ * valid statement could be refused for holding over 100 variables.
+ */
+function endOfNamedParameter(sql, from) {
+    const n = sql.length;
+    let i = from + 1;
+    while (i < n) {
+        const c = sql[i];
+        if (isWord(c)) {
+            i += 1;
+        }
+        else if (c === '(') {
+            i += 1;
+            while (i < n && !/\s/.test(sql[i]) && sql[i] !== ')')
+                i += 1;
+            if (sql[i] === ')')
+                i += 1;
+            break;
+        }
+        else if (c === ':' && sql[i + 1] === ':') {
+            i += 2;
+        }
+        else {
+            break;
+        }
+    }
+    return i;
+}
+/**
+ * Refuse a statement a Durable Object's SQLite would refuse for its length, its compound
+ * `SELECT` terms, or its bound parameters. Throws the DO's own message.
+ */
+export function assertWithinSqlLimits(sql) {
+    // Cheap first: UTF-16 length is at most the byte length, so a string under
+    // a third of the limit cannot be over it, and most statements skip the encode.
+    if (sql.length * 3 > DO_SQL_LIMITS.statementBytes && byteLength(sql) > DO_SQL_LIMITS.statementBytes) {
+        throw new Error('statement too long: SQLITE_TOOBIG');
+    }
+    const n = sql.length;
+    // Operators seen at each open parenthesis level of the statement being scanned.
+    let operators = [0];
+    let nVar = 0;
+    const named = new Map();
+    const tooManyVariables = (at) => new Error(`too many SQL variables at offset ${byteOffset(sql, at)}: SQLITE_ERROR`);
+    const bindOne = (at, number_) => {
+        if (number_ > DO_SQL_LIMITS.boundParameters)
+            throw tooManyVariables(at);
+    };
+    let i = 0;
+    while (i < n) {
+        const c = sql[i];
+        // Comments are whitespace to SQLite.
+        if (c === '-' && sql[i + 1] === '-') {
+            while (i < n && sql[i] !== '\n')
+                i += 1;
+            continue;
+        }
+        if (c === '/' && sql[i + 1] === '*') {
+            i += 2;
+            while (i < n && !(sql[i] === '*' && sql[i + 1] === '/'))
+                i += 1;
+            i += 2;
+            continue;
+        }
+        // String literals and quoted identifiers; a doubled quote is an escaped one.
+        if (c === "'" || c === '"' || c === '`') {
+            i += 1;
+            while (i < n) {
+                if (sql[i] === c) {
+                    if (sql[i + 1] === c) {
+                        i += 2;
+                        continue;
+                    }
+                    break;
+                }
+                i += 1;
+            }
+            i += 1;
+            continue;
+        }
+        if (c === '[') {
+            while (i < n && sql[i] !== ']')
+                i += 1;
+            i += 1;
+            continue;
+        }
+        if (c === '(') {
+            operators.push(0);
+            i += 1;
+            continue;
+        }
+        if (c === ')') {
+            if (operators.length > 1)
+                operators.pop();
+            i += 1;
+            continue;
+        }
+        if (c === ';') {
+            // A new statement: its own compound chain and its own parameter numbering.
+            operators = [0];
+            nVar = 0;
+            named.clear();
+            i += 1;
+            continue;
+        }
+        if (c === '?') {
+            const start = i;
+            i += 1;
+            let digits = '';
+            while (i < n && sql[i] >= '0' && sql[i] <= '9')
+                digits += sql[i++];
+            if (digits === '') {
+                nVar += 1;
+                bindOne(start, nVar);
+            }
+            else {
+                const number_ = Number(digits);
+                if (number_ < 1 || number_ > DO_SQL_LIMITS.boundParameters) {
+                    throw new Error(`variable number must be between ?1 and ?${DO_SQL_LIMITS.boundParameters} at offset ${byteOffset(sql, start)}: SQLITE_ERROR`);
+                }
+                if (number_ > nVar)
+                    nVar = number_;
+            }
+            continue;
+        }
+        if (c === ':' || c === '@' || c === '$') {
+            const start = i;
+            i = endOfNamedParameter(sql, i);
+            // SQLite keys a slot on the WHOLE token, sigil included: `:a` and `@a` are two variables.
+            const token = sql.slice(start, i);
+            if (token.length > 1 && !named.has(token)) {
+                nVar += 1;
+                named.set(token, nVar);
+                bindOne(start, nVar);
+            }
+            continue;
+        }
+        if (isWord(c)) {
+            const start = i;
+            while (i < n && isWord(sql[i]))
+                i += 1;
+            // `t.union` is a column, not an operator; a reserved word cannot be a bare name otherwise.
+            const word = sql.slice(start, i).toLowerCase();
+            if (COMPOUND_OPERATORS.has(word) && sql[start - 1] !== '.') {
+                const level = operators.length - 1;
+                operators[level] = operators[level] + 1;
+                if (operators[level] + 1 > DO_SQL_LIMITS.compoundTerms) {
+                    throw new Error('too many terms in compound SELECT: SQLITE_ERROR');
+                }
+            }
+            continue;
+        }
+        i += 1;
+    }
+}
+/**
+ * Wrap a module-facing `ScopedSql` so every statement passes `assertWithinSqlLimits` first.
+ * The node adapter wraps `ctx.sql` in it; the DO needs no wrapper — its SQLite is the
+ * source of these limits.
+ */
+export function guardSqlLimits(inner) {
+    return {
+        query: (sql, params) => {
+            assertWithinSqlLimits(sql);
+            return inner.query(sql, params);
+        },
+        exec: (sql, params) => {
+            assertWithinSqlLimits(sql);
+            return inner.exec(sql, params);
+        },
+    };
+}
+//# sourceMappingURL=sql-limits.js.map

package/dist/sql-limits.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql-limits.js","sourceRoot":"","sources":["../src/sql-limits.ts"],"names":[],"mappings":"AAgDA,qFAAqF;AACrF,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,iDAAiD;IACjD,aAAa,EAAE,CAAC;IAChB,0EAA0E;IAC1E,eAAe,EAAE,GAAG;IACpB,kFAAkF;IAClF,cAAc,EAAE,OAAO;IACvB,uGAAuG;IACvG,gBAAgB,EAAE,EAAE;CACZ,CAAC;AAIX,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC;AAC/B,MAAM,UAAU,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAEhE,6EAA6E;AAC7E,MAAM,UAAU,GAAG,CAAC,GAAW,EAAE,KAAa,EAAU,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;AAE3F,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;AACrE,MAAM,MAAM,GAAG,CAAC,CAAS,EAAW,EAAE,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAEvE;;;;;;;;;GASG;AACH,SAAS,mBAAmB,CAAC,GAAW,EAAE,IAAY;IACpD,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC;IACrB,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;IACjB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAE,CAAC;QAClB,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YACd,CAAC,IAAI,CAAC,CAAC;QACT,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACrB,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG;gBAAE,CAAC,IAAI,CAAC,CAAC;YAC9D,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG;gBAAE,CAAC,IAAI,CAAC,CAAC;YAC3B,MAAM;QACR,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YAC3C,CAAC,IAAI,CAAC,CAAC;QACT,CAAC;aAAM,CAAC;YACN,MAAM;QACR,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,2EAA2E;IAC3E,+EAA+E;IAC/E,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,GAAG,aAAa,CAAC,cAAc,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,cAAc,EAAE,CAAC;QACpG,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC;IACrB,gFAAgF;IAChF,IAAI,SAAS,GAAa,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,MAAM,gBAAgB,GAAG,CAAC,EAAU,EAAS,EAAE,CAC7C,IAAI,KAAK,CAAC,oCAAoC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC;IACrF,MAAM,OAAO,GAAG,CAAC,EAAU,EAAE,OAAe,EAAQ,EAAE;QACpD,IAAI,OAAO,GAAG,aAAa,CAAC,eAAe;YAAE,MAAM,gBAAgB,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC,CAAC;IAEF,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAE,CAAC;QAClB,qCAAqC;QACrC,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACpC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,IAAI,CAAC,CAAC;YACxC,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACpC,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;gBAAE,CAAC,IAAI,CAAC,CAAC;YAChE,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,6EAA6E;QAC7E,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACxC,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACb,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;oBACjB,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;wBACrB,CAAC,IAAI,CAAC,CAAC;wBACP,SAAS;oBACX,CAAC;oBACD,MAAM;gBACR,CAAC;gBACD,CAAC,IAAI,CAAC,CAAC;YACT,CAAC;YACD,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG;gBAAE,CAAC,IAAI,CAAC,CAAC;YACvC,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;gBAAE,SAAS,CAAC,GAAG,EAAE,CAAC;YAC1C,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,2EAA2E;YAC3E,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC;YAChB,IAAI,GAAG,CAAC,CAAC;YACT,KAAK,CAAC,KAAK,EAAE,CAAC;YACd,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,CAAC,IAAI,CAAC,CAAC;YACP,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAE,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,CAAE,IAAI,GAAG;gBAAE,MAAM,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;YACrE,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;gBAClB,IAAI,IAAI,CAAC,CAAC;gBACV,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACvB,CAAC;iBAAM,CAAC;gBACN,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;gBAC/B,IAAI,OAAO,GAAG,CAAC,IAAI,OAAO,GAAG,aAAa,CAAC,eAAe,EAAE,CAAC;oBAC3D,MAAM,IAAI,KAAK,CACb,2CAA2C,aAAa,CAAC,eAAe,cAAc,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,gBAAgB,CAC7H,CAAC;gBACJ,CAAC;gBACD,IAAI,OAAO,GAAG,IAAI;oBAAE,IAAI,GAAG,OAAO,CAAC;YACrC,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,CAAC,GAAG,mBAAmB,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAChC,0FAA0F;YAC1F,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAClC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1C,IAAI,IAAI,CAAC,CAAC;gBACV,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;gBACvB,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACvB,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YACd,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC;gBAAE,CAAC,IAAI,CAAC,CAAC;YACxC,2FAA2F;YAC3F,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YAC/C,IAAI,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC3D,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC;gBACnC,SAAS,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC,KAAK,CAAE,GAAG,CAAC,CAAC;gBACzC,IAAI,SAAS,CAAC,KAAK,CAAE,GAAG,CAAC,GAAG,aAAa,CAAC,aAAa,EAAE,CAAC;oBACxD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;gBACrE,CAAC;YACH,CAAC;YACD,SAAS;QACX,CAAC;QACD,CAAC,IAAI,CAAC,CAAC;IACT,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,KAAgB;IAC7C,OAAO;QACL,KAAK,EAAE,CAA+B,GAAW,EAAE,MAA4B,EAAO,EAAE;YACtF,qBAAqB,CAAC,GAAG,CAAC,CAAC;YAC3B,OAAO,KAAK,CAAC,KAAK,CAAI,GAAG,EAAE,MAAM,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,EAAE,CAAC,GAAW,EAAE,MAA4B,EAAE,EAAE;YAClD,qBAAqB,CAAC,GAAG,CAAC,CAAC;YAC3B,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACjC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/system-switch-record.d.ts

@@ -0,0 +1,158 @@
+/**
+ * The directory's record of the schedule kill switch (#1674), shared by both adapters.
+ *
+ * The switch itself (`system-switch.ts`) lives in the scope's own storage: a `switch:off`
+ * marker beside the module's grants, which is what the runner gates on. That is the right
+ * place for the gate, and the wrong place for the only copy. A scope whose storage is wiped
+ * and re-provisioned (#321/#332), or restored from a dump taken before the switch was pulled,
+ * loses the marker, and the next reconcile seats the grants live again. The switch is then
+ * silently on, on exactly the scopes an operator switched off.
+ *
+ * So the directory keeps one row per (tenant, scope, module): the position the switch was
+ * last moved to, by whom, why, and when. It is the model `_substrat_connection_grants` set
+ * (#592): the enforcement stays where it is checked, and the directory holds what a
+ * reconcile re-asserts FROM. It also answers the fleet question the scope cannot: "which
+ * scopes have a module switched off", without walking every scope's store.
+ *
+ * **OFF wins from either side, and a record never turns anything on.**
+ * - A record of `off` and a scope that has lost its marker: the record wins, and
+ *   `HostAdmin.reassertSystemSwitches` switches it off again, after the seat, so the grants
+ *   the seat recreated are the ones OFF tombstones and a later ON gives back.
+ * - A record of `on` (or none) and a live marker: the marker wins, and it stays off.
+ *   Restore is the lever (#1666), and a reconcile that could turn a kill switch back on
+ *   would be a second one.
+ *
+ * The admin log is still the history. This is only the current position.
+ */
+import type { ListPage } from '@substrat-run/contracts';
+import type { SwitchSql, SystemScheduleState } from './system-switch.js';
+/**
+ * The table. Interpolated into both adapters' directory DDL, so `lint:spine-ddl` sees the
+ * one spelling on each side. No CHECK on `position`: the drift gate does not compare
+ * constraints, and the writers below are the only thing that sets it.
+ */
+export declare const SYSTEM_SWITCHES_DDL = "\n  CREATE TABLE IF NOT EXISTS _substrat_system_switches (\n    tenant_id    TEXT NOT NULL,\n    scope_id     TEXT NOT NULL,\n    module_id    TEXT NOT NULL,\n    -- 'on' or 'off'. A row exists only for a module some switch call actually held.\n    position     TEXT NOT NULL,\n    actor        TEXT NOT NULL,\n    reason       TEXT NOT NULL,\n    -- The switch call's own id, the one its admin-log intent and outcome rows carry.\n    -- A ULID, so it is also the fleet read's chronological keyset cursor.\n    operation_id TEXT NOT NULL,\n    switched_at  TEXT NOT NULL,\n    PRIMARY KEY (tenant_id, scope_id, module_id)\n  );\n  CREATE INDEX IF NOT EXISTS _substrat_system_switches_position\n    ON _substrat_system_switches (position, operation_id);\n  CREATE INDEX IF NOT EXISTS _substrat_system_switches_operation\n    ON _substrat_system_switches (operation_id);\n";
+/**
+ * The one-time backfill from the admin log: every switch moved before the record existed.
+ * Without it, those are exactly the switches a wipe would still lose.
+ *
+ * It reads the admin-log shape `revokeFromSystem` / `restoreToSystem` have written since
+ * #1666, two rows per call sharing `after.operationId`: an `intent` row carrying
+ * `after.moduleId` and `after.reason`, then an outcome row whose `after.phase` is
+ * `applied`, `refused` or `failed`. Only calls whose outcome is `applied` count, because a
+ * refused call moved nothing and a failed one may not have. Of those, only the LATEST per
+ * (tenant, scope, module) is taken, by the intent's ULID id. `at` is the intent's, the
+ * same instant the status read's who/why join reports. A key whose calls include no
+ * applied OFF gets no row, even when its latest applied call is an ON: a live
+ * `restoreToSystem` of a module never switched off writes none either
+ * (`recordSystemSwitchedOn`), and the backfill must not record what the live path would not.
+ *
+ * `INSERT OR IGNORE`, so a row the switch wrote itself is never overwritten by history.
+ * The adapters run it only on the construction that creates the table, so it runs once.
+ */
+export declare const SYSTEM_SWITCHES_BACKFILL_SQL = "\n  WITH applied AS (\n    SELECT DISTINCT action, json_extract(after, '$.operationId') AS operation_id\n      FROM _substrat_admin_log\n     WHERE action IN ('revokeFromSystem', 'restoreToSystem')\n       AND json_extract(after, '$.phase') = 'applied'\n  ),\n  intents AS (\n    SELECT i.id AS id, i.tenant_id AS tenant_id, i.scope_id AS scope_id,\n           json_extract(i.after, '$.moduleId') AS module_id,\n           CASE i.action WHEN 'revokeFromSystem' THEN 'off' ELSE 'on' END AS position,\n           i.actor AS actor,\n           json_extract(i.after, '$.reason') AS reason,\n           json_extract(i.after, '$.operationId') AS operation_id,\n           i.at AS at\n      FROM _substrat_admin_log i\n      JOIN applied a\n        ON a.action = i.action AND a.operation_id = json_extract(i.after, '$.operationId')\n     WHERE i.action IN ('revokeFromSystem', 'restoreToSystem')\n       AND i.tenant_id IS NOT NULL AND i.scope_id IS NOT NULL\n       AND json_extract(i.after, '$.phase') = 'intent'\n       AND json_extract(i.after, '$.moduleId') IS NOT NULL\n       AND json_extract(i.after, '$.reason') IS NOT NULL\n  ),\n  ranked AS (\n    SELECT *,\n           ROW_NUMBER() OVER (PARTITION BY tenant_id, scope_id, module_id ORDER BY id DESC) AS latest,\n           MAX(position = 'off') OVER (PARTITION BY tenant_id, scope_id, module_id) AS ever_off\n      FROM intents\n  )\n  INSERT OR IGNORE INTO _substrat_system_switches\n    (tenant_id, scope_id, module_id, position, actor, reason, operation_id, switched_at)\n  SELECT tenant_id, scope_id, module_id, position, actor, reason, operation_id, at\n    FROM ranked\n   WHERE latest = 1 AND ever_off = 1\n";
+/** "Does the record table exist yet?" — asked BEFORE the DDL, so the backfill runs once. */
+export declare function systemSwitchesTableExists(db: SwitchSql): boolean;
+/** One record row as the directory holds it, with the scope's binding joined on. */
+export interface SystemSwitchRecordRow {
+    tenantId: string;
+    scopeId: string;
+    moduleId: string;
+    vertical: string | null;
+    position: 'on' | 'off';
+    actor: string;
+    reason: string;
+    operationId: string;
+    at: string;
+}
+/**
+ * Filter for the fleet read. Unset `position` means both; the HTTP route defaults it to
+ * `off`. Paged by `operationId` (the exclusive cursor), oldest first unless `order: 'desc'`.
+ */
+export interface SystemSwitchRecordFilter extends ListPage {
+    position?: 'on' | 'off';
+    tenantId?: string;
+    scopeId?: string;
+    moduleId?: string;
+    vertical?: string;
+}
+/**
+ * The fleet read (`GET /system-switches`): records, keyset-paged by `operation_id`.
+ *
+ * The key is the call that last moved the switch, so a row whose switch moves during a walk
+ * is re-keyed to a newer id and jumps to the end of the order. Ascending (the default) never
+ * skips a row for it; at worst it is seen twice, once per position. A DESCENDING walk can
+ * miss a row that moved after the walk started, so use ascending for "every switch".
+ */
+export declare function listSystemSwitchRecords(db: SwitchSql, filter?: SystemSwitchRecordFilter): SystemSwitchRecordRow[];
+/** One scope's record rows by module — what the per-scope status read joins as `recorded`. */
+export declare function systemSwitchRecordsOf(db: SwitchSql, tenantId: string, scopeId: string): Map<string, 'on' | 'off'>;
+/**
+ * The per-scope status read's rows with the record joined on. Each module the scope
+ * reports gets its recorded position (or null). A module the record holds that the scope
+ * no longer reports at all is ADDED, as `ungranted`: that is the scope a wipe emptied, and
+ * the drift is the whole reason to show it. Sorted by module id, as the scope's rows are.
+ */
+export declare function withRecorded(states: {
+    moduleId: string;
+    schedules: SystemScheduleState;
+}[], recorded: Map<string, 'on' | 'off'>): {
+    moduleId: string;
+    schedules: SystemScheduleState;
+    recorded: 'on' | 'off' | null;
+}[];
+/** The modules a reconcile must re-assert OFF on this scope. */
+export declare function switchedOffModulesOf(db: SwitchSql, tenantId: string, scopeId: string): string[];
+/** What one switch call writes into the record. */
+export interface SystemSwitchRecordWrite {
+    tenantId: string;
+    scopeId: string;
+    moduleId: string;
+    actor: string;
+    reason: string;
+    operationId: string;
+    at: string;
+}
+/** The row as it stood before a write, so a failed switch can put it back. */
+export type SystemSwitchRecordPrior = Pick<SystemSwitchRecordRow, 'position' | 'actor' | 'reason' | 'operationId' | 'at'> | null;
+/** What a re-assert did for one recorded-off module — `HostAdmin.reassertSystemSwitches`' answer. */
+export interface SystemSwitchReassert {
+    moduleId: string;
+    held: boolean;
+    changed: boolean;
+}
+/**
+ * OFF's write, made AFTER the scope's switch held. An upsert: a repeat OFF refreshes the
+ * actor, reason and time, as the status read reports the latest reason. Never made for a
+ * call that held nothing, because a row saying `off` for a module the scope never ran
+ * would switch it off on the day it is installed (the kernel's `held` check, for the same
+ * reason).
+ */
+export declare function recordSystemSwitchedOff(db: SwitchSql, row: SystemSwitchRecordWrite): void;
+/**
+ * ON's write, made BEFORE the scope's switch moves, and only to a row that exists. Before,
+ * because the other order fails unsafely: a scope switched on whose record write then
+ * failed would still read `off`, and the next reconcile would switch the operator's
+ * restore back off. This order fails toward a record of `on` beside a live marker, which
+ * the marker wins. Answers the row as it was, for `restoreSystemSwitchRecord`.
+ */
+export declare function recordSystemSwitchedOn(db: SwitchSql, row: SystemSwitchRecordWrite): SystemSwitchRecordPrior;
+/**
+ * Put a row back as `recordSystemSwitchedOn` found it — the ON that wrote it threw, or held
+ * nothing. A compare-and-set on the ON's own `operationId`: if another switch call has
+ * written the row since (a concurrent OFF), the row is left as that call wrote it, so an
+ * ON's undo can never clobber a newer position.
+ */
+export declare function restoreSystemSwitchRecord(db: SwitchSql, on: {
+    tenantId: string;
+    scopeId: string;
+    moduleId: string;
+    operationId: string;
+}, prior: SystemSwitchRecordPrior): void;
+/**
+ * Forget one scope's switch records — the scope's directory row is going too (a reaped
+ * preview or fork, a reaped scope). Without this the fleet read keeps listing a switch on
+ * a scope that no longer exists. The admin log keeps the history, as it keeps the scope's.
+ */
+export declare function forgetSystemSwitchesOf(db: SwitchSql, scopeId: string): void;
+//# sourceMappingURL=system-switch-record.d.ts.map

package/dist/system-switch-record.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"system-switch-record.d.ts","sourceRoot":"","sources":["../src/system-switch-record.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACxD,OAAO,KAAK,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzE;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,22BAmB/B,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,4BAA4B,0oDAmCxC,CAAC;AAEF,4FAA4F;AAC5F,wBAAgB,yBAAyB,CAAC,EAAE,EAAE,SAAS,GAAG,OAAO,CAKhE;AAED,oFAAoF;AACpF,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,IAAI,GAAG,KAAK,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED;;;GAGG;AACH,MAAM,WAAW,wBAAyB,SAAQ,QAAQ;IACxD,QAAQ,CAAC,EAAE,IAAI,GAAG,KAAK,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAmBD;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,GAAE,wBAA6B,GAAG,qBAAqB,EAAE,CA6BrH;AAED,8FAA8F;AAC9F,wBAAgB,qBAAqB,CACnC,EAAE,EAAE,SAAS,EACb,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GACd,GAAG,CAAC,MAAM,EAAE,IAAI,GAAG,KAAK,CAAC,CAO3B;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,mBAAmB,CAAA;CAAE,EAAE,EAC9D,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,GAAG,KAAK,CAAC,GAClC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,mBAAmB,CAAC;IAAC,QAAQ,EAAE,IAAI,GAAG,KAAK,GAAG,IAAI,CAAA;CAAE,EAAE,CAOvF;AAED,gEAAgE;AAChE,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAS/F;AAED,mDAAmD;AACnD,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,8EAA8E;AAC9E,MAAM,MAAM,uBAAuB,GAAG,IAAI,CACxC,qBAAqB,EACrB,UAAU,GAAG,OAAO,GAAG,QAAQ,GAAG,aAAa,GAAG,IAAI,CACvD,GAAG,IAAI,CAAC;AAET,qGAAqG;AACrG,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;CAClB;AA6BD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,uBAAuB,GAAG,IAAI,CAgBzF;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,uBAAuB,GAAG,uBAAuB,CAiB3G;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,EAAE,EAAE,SAAS,EACb,EAAE,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,EAChF,KAAK,EAAE,uBAAuB,GAC7B,IAAI,CAEN;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAE3E"}