@substrat-run/kernel 0.127.0 → 0.129.0

package/dist/scope-repoint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope-repoint.d.ts","sourceRoot":"","sources":["../src/scope-repoint.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAEpD,0FAA0F;AAC1F,MAAM,WAAW,aAAa;IAC5B,4CAA4C;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,IAAI,CA2BpG"}
+{"version":3,"file":"scope-repoint.d.ts","sourceRoot":"","sources":["../src/scope-repoint.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAEpD,0FAA0F;AAC1F,MAAM,WAAW,aAAa;IAC5B,4CAA4C;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgEG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,SAAS,EACd,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,aAAa,GAAG,SAAS;AACjC,sFAAsF;AACtF,GAAG,EAAE,MAAM,GACV,IAAI,CA0BN"}

package/dist/scope-repoint.js

@@ -1,4 +1,5 @@
 import { scopeId, substratError } from '@substrat-run/contracts';
+import { liveTupleSql } from './permission-eval.js';
 /**
  * Re-point a dump's scope-level grants at the scope it lands in, the step every restore, fork
  * and preview carry ends with (#1869). One definition for both adapters' `importDump`, so the
@@ -33,19 +34,48 @@ import { scopeId, substratError } from '@substrat-run/contracts';
  * `WHERE`: the update rewrites the very rows the probe looks for, and the answer must not
  * change part-way through.
  *
- * `COLLATE BINARY` is written out because the tuples table's DDL comes from the dump, and a
- * column declared `COLLATE NOCASE` there would make a bare `=` fold case again.
+ * **Which row wins a collision (#1882).** `(subject, relation, object)` is the primary key,
+ * so a moved row can land on a row the dump already holds for the destination. That used to
+ * be `UPDATE OR REPLACE`, so the moved row always won, `expires_at` and `revoked_at` with it:
+ * a revoked or expired source row could replace a live grant on the destination. Now each
+ * row is ranked, and the higher rank is kept:
+ *
+ * 1. **live**: not revoked, and not expired at `now`;
+ * 2. **revoked**: a K-21 tombstone, the evidence of a revocation (#1659's reconcile never
+ *    re-seats a grant it finds tombstoned, so losing one would un-revoke it);
+ * 3. **expired**: not revoked, but past its `expires_at`, which is evidence of nothing.
+ *
+ * | moved row \ destination row | live        | revoked     | expired     |
+ * |-----------------------------|-------------|-------------|-------------|
+ * | live                        | destination | moved       | moved       |
+ * | revoked                     | destination | destination | moved       |
+ * | expired                     | destination | destination | destination |
+ *
+ * On a tie the destination row stays. Two moved rows that would land on the same key (only
+ * the fallback moves more than one object) are settled by the same rank, and on a tie by the
+ * lower `object`, before either meets the destination. Whichever live row is kept takes the
+ * EARLIEST expiry among the live rows for its key (no expiry counting as the latest), so a
+ * restore never widens a grant's life, whichever side it came from. The loser is deleted: it cannot stay under its old object, because a row naming another scope
+ * is exactly what a later restore of this scope refuses. Everything runs inside the load's
+ * transaction, and the final `UPDATE` is a plain one, so a collision this missed fails the
+ * restore instead of replacing a row.
+ *
+ * `COLLATE BINARY` is written out on every comparison. Since #1883 the tuples table is always
+ * built from the kernel's DDL, never the dump's, so its columns are BINARY already; the
+ * collation stays as a second guard, so this function never depends on the table it is
+ * handed having the right one.
  */
-export function repointScopeGrants(sql, destScopeId, source) {
+export function repointScopeGrants(sql, destScopeId, source, 
+/** The instant `expires_at` is judged against, as the adapter's checker judges it. */
+now) {
     // `exact` is a claim about a named source; with none named it would silently take the fallback.
     if (source !== undefined && !source.scopeId) {
         throw substratError('validation_failed', 'restore refused: `exact` needs the scope the dump came from');
     }
     const dest = `scope:${destScopeId}`;
-    const update = 'UPDATE OR REPLACE _substrat_tuples SET object = ? WHERE object <> ? COLLATE BINARY AND';
     const from = source === undefined ? undefined : `scope:${source.scopeId}`;
     if (from === undefined || (!source?.exact && sql.all(SOURCE_PROBE, from).length === 0)) {
-        sql.run(`${update} substr(object, 1, 6) = 'scope:' COLLATE BINARY`, dest, dest);
+        moveOnto(sql, dest, now, undefined);
         return;
     }
     const strays = source.exact
@@ -59,7 +89,50 @@ export function repointScopeGrants(sql, destScopeId, source) {
             `(${source.scopeId}) and this scope (${destScopeId}), which a restore cannot re-point: ` +
             `${strays.slice(0, 3).join(', ')}${strays.length > 3 ? ', …' : ''}`);
     }
-    sql.run(`${update} object = ? COLLATE BINARY`, dest, dest, from);
+    moveOnto(sql, dest, now, from);
+}
+/**
+ * Move onto `dest` every row naming `from` (the exact rule), or every `scope:` row when `from`
+ * is undefined (the fallback), settling each key collision by the rule in
+ * `repointScopeGrants`'s header. A row already on `dest` is never moved.
+ */
+function moveOnto(sql, dest, now, from) {
+    // Whether the row under `alias` moves. Binds `moved` (below), in that order.
+    const isMoved = (alias) => `(${from === undefined ? `substr(${alias}.object, 1, 6) = 'scope:'` : `${alias}.object = ?`} COLLATE BINARY ` +
+        `AND ${alias}.object <> ? COLLATE BINARY)`;
+    const moved = from === undefined ? [dest] : [from, dest];
+    // The rank in the header: 2 live (the checker's own definition, so a restore keeps the row a
+    // check would honour), 1 revoked, 0 expired. Binds `now`.
+    const rank = (alias) => `(CASE WHEN ${liveTupleSql(alias)} THEN 2 WHEN ${alias}.revoked_at IS NOT NULL THEN 1 ELSE 0 END)`;
+    // A row competing for `dest`: moved there, or already on it. Binds `moved`, then `dest`.
+    const competes = (alias) => `(${isMoved(alias)} OR ${alias}.object = ? COLLATE BINARY)`;
+    const competing = [...moved, dest];
+    const live = (alias) => `(${liveTupleSql(alias)})`;
+    const sameKey = (a, b) => `${a}.subject = ${b}.subject COLLATE BINARY AND ${a}.relation = ${b}.relation COLLATE BINARY`;
+    // `_substrat_tuples` is the row being judged; SQLite takes no alias on a DELETE's target.
+    const T = '_substrat_tuples';
+    // 0. Every live row that meets another live one, carrying an earlier expiry, for its key
+    //    takes the earliest, so the row kept below never outlives any of them. MIN skips NULL,
+    //    which is "no expiry", the latest.
+    sql.run(`UPDATE ${T} SET expires_at = (
+       SELECT MIN(o.expires_at) FROM ${T} o WHERE ${sameKey('o', T)} AND ${competes('o')} AND ${live('o')})
+     WHERE ${live(T)} AND ${competes(T)} AND EXISTS (
+       SELECT 1 FROM ${T} o WHERE ${sameKey('o', T)} AND o.object <> ${T}.object COLLATE BINARY
+         AND ${competes('o')} AND ${live('o')} AND o.expires_at IS NOT NULL
+         AND (${T}.expires_at IS NULL OR o.expires_at < ${T}.expires_at))`, ...competing, now, now, ...competing, ...competing, now);
+    // 1. Between two moved rows for one key: the higher rank, then the lower object.
+    sql.run(`DELETE FROM ${T} WHERE ${isMoved(T)} AND EXISTS (
+       SELECT 1 FROM ${T} o WHERE ${sameKey('o', T)} AND ${isMoved('o')} AND o.object <> ${T}.object COLLATE BINARY
+         AND (${rank('o')} > ${rank(T)} OR (${rank('o')} = ${rank(T)} AND o.object < ${T}.object COLLATE BINARY)))`, ...moved, ...moved, now, now, now, now);
+    // 2. A moved row loses to the destination row unless it ranks higher.
+    sql.run(`DELETE FROM ${T} WHERE ${isMoved(T)} AND EXISTS (
+       SELECT 1 FROM ${T} d WHERE ${sameKey('d', T)} AND d.object = ? COLLATE BINARY
+         AND ${rank('d')} >= ${rank(T)})`, ...moved, dest, now, now);
+    // 3. Every moved row still standing beat the destination row for its key, which goes.
+    sql.run(`DELETE FROM ${T} WHERE object = ? COLLATE BINARY AND EXISTS (
+       SELECT 1 FROM ${T} o WHERE ${sameKey('o', T)} AND ${isMoved('o')})`, dest, ...moved);
+    // 4. No key collides now. A plain UPDATE, so one that still did would fail the restore.
+    sql.run(`UPDATE ${T} SET object = ? WHERE ${isMoved(T)}`, dest, ...moved);
 }
 const SOURCE_PROBE = 'SELECT 1 FROM _substrat_tuples WHERE object = ? COLLATE BINARY LIMIT 1';
 // Live rows only: a revoked grant (K-21 tombstone) on a third scope authorizes nothing anywhere.

package/dist/scope-repoint.js.map

@@ -1 +1 @@
-{"version":3,"file":"scope-repoint.js","sourceRoot":"","sources":["../src/scope-repoint.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAejE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAc,EAAE,WAAmB,EAAE,MAAsB;IAC5F,gGAAgG;IAChG,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAC5C,MAAM,aAAa,CAAC,mBAAmB,EAAE,6DAA6D,CAAC,CAAC;IAC1G,CAAC;IACD,MAAM,IAAI,GAAG,SAAS,WAAW,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,wFAAwF,CAAC;IACxG,MAAM,IAAI,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,MAAM,CAAC,OAAO,EAAE,CAAC;IAC1E,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,IAAI,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QACvF,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,iDAAiD,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAChF,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,MAAO,CAAC,KAAK;QAC1B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,GAAG;aACA,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC;aAC7B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;aAC5B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC1E,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,aAAa,CACjB,mBAAmB,EACnB,6CAA6C,MAAM,CAAC,MAAM,kCAAkC;YAC1F,IAAI,MAAO,CAAC,OAAO,qBAAqB,WAAW,sCAAsC;YACzF,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CACtE,CAAC;IACJ,CAAC;IACD,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,4BAA4B,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,YAAY,GAAG,wEAAwE,CAAC;AAC9F,iGAAiG;AACjG,MAAM,YAAY,GAAG;;;kBAGH,CAAC"}
+{"version":3,"file":"scope-repoint.js","sourceRoot":"","sources":["../src/scope-repoint.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAepD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgEG;AACH,MAAM,UAAU,kBAAkB,CAChC,GAAc,EACd,WAAmB,EACnB,MAAiC;AACjC,sFAAsF;AACtF,GAAW;IAEX,gGAAgG;IAChG,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAC5C,MAAM,aAAa,CAAC,mBAAmB,EAAE,6DAA6D,CAAC,CAAC;IAC1G,CAAC;IACD,MAAM,IAAI,GAAG,SAAS,WAAW,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,MAAM,CAAC,OAAO,EAAE,CAAC;IAC1E,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,IAAI,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QACvF,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;QACpC,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,MAAO,CAAC,KAAK;QAC1B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,GAAG;aACA,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC;aAC7B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;aAC5B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC1E,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,aAAa,CACjB,mBAAmB,EACnB,6CAA6C,MAAM,CAAC,MAAM,kCAAkC;YAC1F,IAAI,MAAO,CAAC,OAAO,qBAAqB,WAAW,sCAAsC;YACzF,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CACtE,CAAC;IACJ,CAAC;IACD,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;AACjC,CAAC;AAED;;;;GAIG;AACH,SAAS,QAAQ,CAAC,GAAc,EAAE,IAAY,EAAE,GAAW,EAAE,IAAwB;IACnF,6EAA6E;IAC7E,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,EAAE,CAChC,IAAI,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,KAAK,2BAA2B,CAAC,CAAC,CAAC,GAAG,KAAK,aAAa,kBAAkB;QAC7G,OAAO,KAAK,8BAA8B,CAAC;IAC7C,MAAM,KAAK,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACzD,6FAA6F;IAC7F,0DAA0D;IAC1D,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,EAAE,CAC7B,cAAc,YAAY,CAAC,KAAK,CAAC,gBAAgB,KAAK,4CAA4C,CAAC;IACrG,yFAAyF;IACzF,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,KAAK,6BAA6B,CAAC;IAChG,MAAM,SAAS,GAAG,CAAC,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC;IAC3D,MAAM,OAAO,GAAG,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CACvC,GAAG,CAAC,cAAc,CAAC,+BAA+B,CAAC,eAAe,CAAC,0BAA0B,CAAC;IAChG,0FAA0F;IAC1F,MAAM,CAAC,GAAG,kBAAkB,CAAC;IAE7B,yFAAyF;IACzF,2FAA2F;IAC3F,uCAAuC;IACvC,GAAG,CAAC,GAAG,CACL,UAAU,CAAC;uCACwB,CAAC,YAAY,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,QAAQ,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC;aAC5F,IAAI,CAAC,CAAC,CAAC,QAAQ,QAAQ,CAAC,CAAC,CAAC;uBAChB,CAAC,YAAY,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,oBAAoB,CAAC;eACzD,QAAQ,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC;gBAC7B,CAAC,yCAAyC,CAAC,eAAe,EACtE,GAAG,SAAS,EACZ,GAAG,EACH,GAAG,EACH,GAAG,SAAS,EACZ,GAAG,SAAS,EACZ,GAAG,CACJ,CAAC;IACF,iFAAiF;IACjF,GAAG,CAAC,GAAG,CACL,eAAe,CAAC,UAAU,OAAO,CAAC,CAAC,CAAC;uBACjB,CAAC,YAAY,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;gBAC5E,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,2BAA2B,EAC/G,GAAG,KAAK,EACR,GAAG,KAAK,EACR,GAAG,EACH,GAAG,EACH,GAAG,EACH,GAAG,CACJ,CAAC;IACF,sEAAsE;IACtE,GAAG,CAAC,GAAG,CACL,eAAe,CAAC,UAAU,OAAO,CAAC,CAAC,CAAC;uBACjB,CAAC,YAAY,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;eACpC,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,EACrC,GAAG,KAAK,EACR,IAAI,EACJ,GAAG,EACH,GAAG,CACJ,CAAC;IACF,sFAAsF;IACtF,GAAG,CAAC,GAAG,CACL,eAAe,CAAC;uBACG,CAAC,YAAY,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,OAAO,CAAC,GAAG,CAAC,GAAG,EACtE,IAAI,EACJ,GAAG,KAAK,CACT,CAAC;IACF,wFAAwF;IACxF,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,yBAAyB,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,YAAY,GAAG,wEAAwE,CAAC;AAC9F,iGAAiG;AACjG,MAAM,YAAY,GAAG;;;kBAGH,CAAC"}

package/dist/scope-tuple-seat.d.ts

@@ -64,9 +64,13 @@ export declare function seatScopeTuple(subject: string, relation: string, object
  * So: a non-revoked, unexpired role tuple JOINED to a non-revoked definition of the same
  * key for this tenant. Expiry is compared as ISO text, as every tuple walk here does.
  * Returns one row, `effective` 0 or 1.
+ *
+ * `subject` narrows the same question to one holder (#1665): does THIS principal hold a role
+ * the scope can expand? An owner hand-over asks it of the successor, so the scope is not
+ * handed to a principal whose member role was taken back.
  */
-export declare function effectiveRoleGrantQuery(tenantId: string, now: string): {
+export declare function effectiveRoleGrantQuery(tenantId: string, now: string, subject?: string): {
     sql: string;
-    params: [string, string, string, string];
+    params: string[];
 };
 //# sourceMappingURL=scope-tuple-seat.d.ts.map

package/dist/scope-tuple-seat.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope-tuple-seat.d.ts","sourceRoot":"","sources":["../src/scope-tuple-seat.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAAG,IAAI,GACvB;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,CAAC,CAAA;CAAE,CAQ1E;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,GACV;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAkB3D"}
+{"version":3,"file":"scope-tuple-seat.d.ts","sourceRoot":"","sources":["../src/scope-tuple-seat.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAAG,IAAI,GACvB;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,CAAC,CAAA;CAAE,CAQ1E;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE,MAAM,GACf;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAoBnC"}

package/dist/scope-tuple-seat.js

@@ -70,24 +70,30 @@ export function seatScopeTuple(subject, relation, object, expiresAt) {
  * So: a non-revoked, unexpired role tuple JOINED to a non-revoked definition of the same
  * key for this tenant. Expiry is compared as ISO text, as every tuple walk here does.
  * Returns one row, `effective` 0 or 1.
+ *
+ * `subject` narrows the same question to one holder (#1665): does THIS principal hold a role
+ * the scope can expand? An owner hand-over asks it of the successor, so the scope is not
+ * handed to a principal whose member role was taken back.
  */
-export function effectiveRoleGrantQuery(tenantId, now) {
+export function effectiveRoleGrantQuery(tenantId, now, subject) {
+    const only = subject === undefined ? '' : ' AND subject = ?';
+    const who = subject === undefined ? [] : [subject];
     return {
         sql: `SELECT (
         EXISTS (
           SELECT 1 FROM _substrat_tuples t
             JOIN _substrat_roles r
               ON r.tenant_id = ? AND r.revoked_at IS NULL AND t.relation = 'role:' || r.role_key
-           WHERE t.revoked_at IS NULL AND (t.expires_at IS NULL OR t.expires_at > ?)
+           WHERE t.revoked_at IS NULL AND (t.expires_at IS NULL OR t.expires_at > ?)${only.replace('subject', 't.subject')}
         )
         OR EXISTS (
           SELECT 1 FROM _substrat_tenant_tuples tt
             JOIN _substrat_roles r
               ON r.tenant_id = tt.tenant_id AND r.revoked_at IS NULL AND tt.relation = 'role:' || r.role_key
-           WHERE tt.tenant_id = ? AND tt.revoked_at IS NULL AND (tt.expires_at IS NULL OR tt.expires_at > ?)
+           WHERE tt.tenant_id = ? AND tt.revoked_at IS NULL AND (tt.expires_at IS NULL OR tt.expires_at > ?)${only.replace('subject', 'tt.subject')}
         )
       ) AS effective`,
-        params: [tenantId, now, tenantId, now],
+        params: [tenantId, now, ...who, tenantId, now, ...who],
     };
 }
 //# sourceMappingURL=scope-tuple-seat.js.map

package/dist/scope-tuple-seat.js.map

@@ -1 +1 @@
-{"version":3,"file":"scope-tuple-seat.js","sourceRoot":"","sources":["../src/scope-tuple-seat.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AAEjE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAe,EACf,QAAgB,EAChB,MAAc,EACd,SAAwB;IAExB,OAAO;QACL,GAAG,EAAE;yCACgC,2BAA2B;;+CAErB;QAC3C,MAAM,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC;KACxD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,uBAAuB,CACrC,QAAgB,EAChB,GAAW;IAEX,OAAO;QACL,GAAG,EAAE;;;;;;;;;;;;;qBAaY;QACjB,MAAM,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC;KACvC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"scope-tuple-seat.js","sourceRoot":"","sources":["../src/scope-tuple-seat.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AAEjE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAe,EACf,QAAgB,EAChB,MAAc,EACd,SAAwB;IAExB,OAAO;QACL,GAAG,EAAE;yCACgC,2BAA2B;;+CAErB;QAC3C,MAAM,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC;KACxD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,uBAAuB,CACrC,QAAgB,EAChB,GAAW,EACX,OAAgB;IAEhB,MAAM,IAAI,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC;IAC7D,MAAM,GAAG,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACnD,OAAO;QACL,GAAG,EAAE;;;;;sFAK6E,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC;;;;;;8GAMZ,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,YAAY,CAAC;;qBAE9H;QACjB,MAAM,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC;KACvD,CAAC;AACJ,CAAC"}

package/dist/spine-guard.d.ts

@@ -7,6 +7,18 @@ import type { ScopedSql } from './scope-host.js';
  * the table so the author sees which line to delete.
  */
 export declare function assertNoSpineWrite(sql: string): void;
+/**
+ * Refuse a statement whose `REFERENCES` clause names a `_substrat_*` table (#1898), for the
+ * same reason `CREATE TRIGGER … ON` is refused above: the spine's rows become the parent of a
+ * module's, and with foreign keys enforced the kernel's own writes to that table (a revoke, a
+ * restore's re-point, an outbox prune) then fail on the module's rows. That denies the spine
+ * rather than forging it. `what` names the SQL's source in the message.
+ *
+ * `ctx.sql` passes through here (`assertNoSpineWrite`), and so does every migration a scope
+ * applies, which reaches the database on the kernel's own handle rather than through
+ * `ctx.sql`. A dump's replayed DDL is held to the same rule by `assertReplayableDump`.
+ */
+export declare function assertNoSpineReference(sql: string, what: string): void;
 /**
  * Wrap a module-facing `ScopedSql` so every statement passes `assertNoSpineWrite`
  * first. `query` is guarded too: SQLite runs `INSERT … RETURNING` perfectly well

package/dist/spine-guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spine-guard.d.ts","sourceRoot":"","sources":["../src/spine-guard.ts"],"names":[],"mappings":"AAqCA,OAAO,KAAK,EAAE,SAAS,EAAY,MAAM,iBAAiB,CAAC;AA8K3D;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAqBpD;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,SAAS,GAAG,SAAS,CAWtD"}
+{"version":3,"file":"spine-guard.d.ts","sourceRoot":"","sources":["../src/spine-guard.ts"],"names":[],"mappings":"AAqCA,OAAO,KAAK,EAAE,SAAS,EAAY,MAAM,iBAAiB,CAAC;AAsD3D;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAsBpD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAEtE;AAcD;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,SAAS,GAAG,SAAS,CAWtD"}

package/dist/spine-guard.js

@@ -18,7 +18,8 @@
  * What is refused: a statement whose write TARGET is a `_substrat_*` table —
  * `INSERT`/`REPLACE INTO`, `UPDATE`, `DELETE FROM`, `DROP`, `ALTER`, `CREATE` — and
  * the second table a statement can reach past the one it names first: `CREATE
- * TRIGGER … ON`, `CREATE INDEX … ON`, `ALTER TABLE … RENAME TO`.
+ * TRIGGER … ON`, `CREATE INDEX … ON`, `ALTER TABLE … RENAME TO`, and a `REFERENCES` clause
+ * naming the spine (`assertNoSpineReference`, #1898).
  * What is allowed, deliberately: every read of the spine, including one that feeds
  * a write — `INSERT INTO my_timeline SELECT … FROM _substrat_events` is the
  * projection pattern CLAUDE.md explicitly blesses, and only the target is judged.
@@ -27,16 +28,13 @@
  * runtime refuses them outright, and widening this guard to cover them would make
  * it a second read-only console rather than a rule about forging.
  *
- * The scan tokenises OUTSIDE comments and string literals but KEEPS quoted
- * identifiers as tokens — `INSERT INTO "_substrat_tuples"` is the first thing
- * anyone tries, and a scanner that skips quotes hands it through. Dotted names
- * (`main._substrat_tuples`) merge into one token, and every part is checked.
+ * The scan is `tokenizeSql` from `@substrat-run/contracts`, the one reading of the grammar
+ * the dump checks share: comments and string literals skipped, quoted identifiers kept as
+ * tokens, dotted names merged into one, and every part of one checked.
  * Multiple statements in one string are walked in full: the DO's `sql.exec` accepts
  * them, so a forge chained after a legitimate write must not slip past.
  */
-import { substratError } from '@substrat-run/contracts';
-/** The platform spine's table prefix — the same one `isSystemTable` groups on. */
-const SPINE_PREFIX = '_substrat';
+import { namesSpineTable, referencedTablesIn, substratError, tokenizeSql } from '@substrat-run/contracts';
 /**
  * Tokens that may stand between a write verb and the table it names. The first
  * following token that is NOT one of these (or that is quoted) is the target.
@@ -62,120 +60,6 @@ const MODIFIERS = {
         'exists',
     ]),
 };
-function tokenize(sql) {
-    const tokens = [];
-    const n = sql.length;
-    let i = 0;
-    // Set when the previous token ended on a `.`, so `main . tbl` folds into one name.
-    let continues = false;
-    const push = (text, quoted) => {
-        const prev = tokens[tokens.length - 1];
-        if (continues && prev) {
-            tokens[tokens.length - 1] = { text: `${prev.text}.${text}`, quoted: prev.quoted || quoted };
-        }
-        else {
-            tokens.push({ text, quoted });
-        }
-        // Look ahead for the dot that joins this name to the next part. SQLite treats a
-        // COMMENT as whitespace, so `main /* … */ . _substrat_tuples` is one qualified
-        // name — skipping only spaces here would record `main` as the target and miss it.
-        let j = i;
-        for (;;) {
-            if (j < n && /\s/.test(sql[j])) {
-                j += 1;
-                continue;
-            }
-            if (sql[j] === '-' && sql[j + 1] === '-') {
-                while (j < n && sql[j] !== '\n')
-                    j += 1;
-                continue;
-            }
-            if (sql[j] === '/' && sql[j + 1] === '*') {
-                j += 2;
-                while (j < n && !(sql[j] === '*' && sql[j + 1] === '/'))
-                    j += 1;
-                j += 2;
-                continue;
-            }
-            break;
-        }
-        if (sql[j] === '.') {
-            continues = true;
-            i = j + 1;
-        }
-        else {
-            continues = false;
-        }
-    };
-    while (i < n) {
-        const c = sql[i];
-        const c2 = sql[i + 1];
-        if (c === '-' && c2 === '-') {
-            while (i < n && sql[i] !== '\n')
-                i += 1;
-            continue;
-        }
-        if (c === '/' && c2 === '*') {
-            i += 2;
-            while (i < n && !(sql[i] === '*' && sql[i + 1] === '/'))
-                i += 1;
-            i += 2;
-            continue;
-        }
-        if (c === "'" || c === '"' || c === '`') {
-            // A quoted identifier, or a string literal SQLite would still accept as one
-            // in a table position. The closing quote doubles to escape itself.
-            i += 1;
-            let text = '';
-            while (i < n) {
-                if (sql[i] === c) {
-                    if (sql[i + 1] === c) {
-                        text += c;
-                        i += 2;
-                        continue;
-                    }
-                    i += 1;
-                    break;
-                }
-                text += sql[i];
-                i += 1;
-            }
-            push(text, true);
-            continue;
-        }
-        if (c === '[') {
-            i += 1;
-            let text = '';
-            while (i < n && sql[i] !== ']') {
-                text += sql[i];
-                i += 1;
-            }
-            i += 1;
-            push(text, true);
-            continue;
-        }
-        if (/[A-Za-z_]/.test(c)) {
-            let j = i;
-            while (j < n && /[A-Za-z0-9_$]/.test(sql[j]))
-                j += 1;
-            const text = sql.slice(i, j);
-            i = j;
-            push(text, false);
-            continue;
-        }
-        // Whitespace does not break a dotted name (`main . tbl` is one); anything else does.
-        if (!/\s/.test(c))
-            continues = false;
-        i += 1;
-    }
-    return tokens;
-}
-/** True when any part of a (possibly dotted, possibly quoted) name is spine. */
-function namesSpine(token) {
-    return token.text
-        .split('.')
-        .some((part) => part.toLowerCase().startsWith(SPINE_PREFIX));
-}
 /**
  * A SECOND table a statement can reach, past the one it names first.
  *
@@ -190,7 +74,7 @@ const SECOND_TARGET = { create: 'on', alter: 'to' };
 /** The first token at or after `from` that names the spine, following this verb's grammar. */
 function spineTargetFrom(tokens, from, verb) {
     const first = tokens[from];
-    if (first && namesSpine(first))
+    if (first && namesSpineTable(first.text))
         return first;
     const keyword = SECOND_TARGET[verb];
     if (!keyword)
@@ -199,7 +83,7 @@ function spineTargetFrom(tokens, from, verb) {
         if (tokens[k].quoted || tokens[k].text.toLowerCase() !== keyword)
             continue;
         const after = tokens[k + 1];
-        return after && namesSpine(after) ? after : undefined;
+        return after && namesSpineTable(after.text) ? after : undefined;
     }
     return undefined;
 }
@@ -211,7 +95,7 @@ function spineTargetFrom(tokens, from, verb) {
  * the table so the author sees which line to delete.
  */
 export function assertNoSpineWrite(sql) {
-    const tokens = tokenize(sql);
+    const tokens = tokenizeSql(sql);
     for (let i = 0; i < tokens.length; i += 1) {
         const token = tokens[i];
         if (token.quoted)
@@ -230,6 +114,29 @@ export function assertNoSpineWrite(sql) {
         throw substratError('forbidden', `ctx.sql cannot write the platform spine: ${verb.toUpperCase()} on '${target.text}'. ` +
             'Reads are fine; writes go through ctx.emit / ctx.link / ctx.grant.', { reason: 'spine_write' });
     }
+    refuseSpineReference(referencedTablesIn(tokens), 'ctx.sql');
+}
+/**
+ * Refuse a statement whose `REFERENCES` clause names a `_substrat_*` table (#1898), for the
+ * same reason `CREATE TRIGGER … ON` is refused above: the spine's rows become the parent of a
+ * module's, and with foreign keys enforced the kernel's own writes to that table (a revoke, a
+ * restore's re-point, an outbox prune) then fail on the module's rows. That denies the spine
+ * rather than forging it. `what` names the SQL's source in the message.
+ *
+ * `ctx.sql` passes through here (`assertNoSpineWrite`), and so does every migration a scope
+ * applies, which reaches the database on the kernel's own handle rather than through
+ * `ctx.sql`. A dump's replayed DDL is held to the same rule by `assertReplayableDump`.
+ */
+export function assertNoSpineReference(sql, what) {
+    refuseSpineReference(referencedTablesIn(tokenizeSql(sql)), what);
+}
+/** The refusal itself, over a statement's `REFERENCES` targets. */
+function refuseSpineReference(referenced, what) {
+    const target = referenced.find(namesSpineTable);
+    if (target === undefined)
+        return;
+    throw substratError('forbidden', `${what} cannot declare a foreign key to the platform spine: REFERENCES '${target}'. ` +
+        'A module table may reference its own tables; spine rows are reached through the kernel, never as a parent.', { reason: 'spine_write' });
 }
 /**
  * Wrap a module-facing `ScopedSql` so every statement passes `assertNoSpineWrite`

package/dist/spine-guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"spine-guard.js","sourceRoot":"","sources":["../src/spine-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAGxD,kFAAkF;AAClF,MAAM,YAAY,GAAG,WAAW,CAAC;AASjC;;;GAGG;AACH,MAAM,SAAS,GAAkD;IAC/D,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjF,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAC1B,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACzE,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IACzB,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IACpE,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;IACzB,MAAM,EAAE,IAAI,GAAG,CAAC;QACd,MAAM;QACN,WAAW;QACX,QAAQ;QACR,SAAS;QACT,OAAO;QACP,OAAO;QACP,MAAM;QACN,SAAS;QACT,IAAI;QACJ,KAAK;QACL,QAAQ;KACT,CAAC;CACH,CAAC;AAEF,SAAS,QAAQ,CAAC,GAAW;IAC3B,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC;IACrB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,mFAAmF;IACnF,IAAI,SAAS,GAAG,KAAK,CAAC;IAEtB,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,MAAe,EAAQ,EAAE;QACnD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACvC,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;YACtB,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,MAAM,EAAE,CAAC;QAC9F,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAChC,CAAC;QACD,gFAAgF;QAChF,+EAA+E;QAC/E,kFAAkF;QAClF,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,SAAS,CAAC;YACR,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;gBAChC,CAAC,IAAI,CAAC,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACzC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI;oBAAE,CAAC,IAAI,CAAC,CAAC;gBACxC,SAAS;YACX,CAAC;YACD,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACzC,CAAC,IAAI,CAAC,CAAC;gBACP,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;oBAAE,CAAC,IAAI,CAAC,CAAC;gBAChE,CAAC,IAAI,CAAC,CAAC;gBACP,SAAS;YACX,CAAC;YACD,MAAM;QACR,CAAC;QACD,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACnB,SAAS,GAAG,IAAI,CAAC;YACjB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC;aAAM,CAAC;YACN,SAAS,GAAG,KAAK,CAAC;QACpB,CAAC;IACH,CAAC,CAAC;IAEF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAE,CAAC;QAClB,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACtB,IAAI,CAAC,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAC5B,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,IAAI,CAAC,CAAC;YACxC,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAC5B,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;gBAAE,CAAC,IAAI,CAAC,CAAC;YAChE,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACxC,4EAA4E;YAC5E,mEAAmE;YACnE,CAAC,IAAI,CAAC,CAAC;YACP,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACb,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;oBACjB,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;wBACrB,IAAI,IAAI,CAAC,CAAC;wBACV,CAAC,IAAI,CAAC,CAAC;wBACP,SAAS;oBACX,CAAC;oBACD,CAAC,IAAI,CAAC,CAAC;oBACP,MAAM;gBACR,CAAC;gBACD,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;gBACf,CAAC,IAAI,CAAC,CAAC;YACT,CAAC;YACD,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACjB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,CAAC,IAAI,CAAC,CAAC;YACP,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC/B,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;gBACf,CAAC,IAAI,CAAC,CAAC;YACT,CAAC;YACD,CAAC,IAAI,CAAC,CAAC;YACP,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACjB,SAAS;QACX,CAAC;QACD,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACxB,IAAI,CAAC,GAAG,CAAC,CAAC;YACV,OAAO,CAAC,GAAG,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC;gBAAE,CAAC,IAAI,CAAC,CAAC;YACtD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC7B,CAAC,GAAG,CAAC,CAAC;YACN,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAClB,SAAS;QACX,CAAC;QACD,qFAAqF;QACrF,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,SAAS,GAAG,KAAK,CAAC;QACrC,CAAC,IAAI,CAAC,CAAC;IACT,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,gFAAgF;AAChF,SAAS,UAAU,CAAC,KAAY;IAC9B,OAAO,KAAK,CAAC,IAAI;SACd,KAAK,CAAC,GAAG,CAAC;SACV,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,aAAa,GAAqC,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAEtF,8FAA8F;AAC9F,SAAS,eAAe,CAAC,MAAe,EAAE,IAAY,EAAE,IAAY;IAClE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,KAAK,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7C,IAAI,MAAM,CAAC,CAAC,CAAE,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,OAAO;YAAE,SAAS;QAC7E,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5B,OAAO,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACxD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC;QACzB,IAAI,KAAK,CAAC,MAAM;YAAE,SAAS;QAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACtC,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC,SAAS;YAAE,SAAS;QACzB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,MAAM,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAC/F,CAAC,IAAI,CAAC,CAAC;QACT,CAAC;QACD,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,MAAM,aAAa,CACjB,WAAW,EACX,4CAA4C,IAAI,CAAC,WAAW,EAAE,QAAQ,MAAM,CAAC,IAAI,KAAK;YACpF,oEAAoE,EACtE,EAAE,MAAM,EAAE,aAAa,EAAE,CAC1B,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,KAAgB;IACzC,OAAO;QACL,KAAK,EAAE,CAA+B,GAAW,EAAE,MAA4B,EAAO,EAAE;YACtF,kBAAkB,CAAC,GAAG,CAAC,CAAC;YACxB,OAAO,KAAK,CAAC,KAAK,CAAI,GAAG,EAAE,MAAM,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,EAAE,CAAC,GAAW,EAAE,MAA4B,EAAE,EAAE;YAClD,kBAAkB,CAAC,GAAG,CAAC,CAAC;YACxB,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACjC,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"spine-guard.js","sourceRoot":"","sources":["../src/spine-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,aAAa,EAAE,WAAW,EAAiB,MAAM,yBAAyB,CAAC;AAGzH;;;GAGG;AACH,MAAM,SAAS,GAAkD;IAC/D,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjF,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAC1B,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACzE,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IACzB,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IACpE,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;IACzB,MAAM,EAAE,IAAI,GAAG,CAAC;QACd,MAAM;QACN,WAAW;QACX,QAAQ;QACR,SAAS;QACT,OAAO;QACP,OAAO;QACP,MAAM;QACN,SAAS;QACT,IAAI;QACJ,KAAK;QACL,QAAQ;KACT,CAAC;CACH,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,aAAa,GAAqC,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAEtF,8FAA8F;AAC9F,SAAS,eAAe,CAAC,MAAkB,EAAE,IAAY,EAAE,IAAY;IACrE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,KAAK,IAAI,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACvD,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,KAAK,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7C,IAAI,MAAM,CAAC,CAAC,CAAE,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,OAAO;YAAE,SAAS;QAC7E,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5B,OAAO,KAAK,IAAI,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC;QACzB,IAAI,KAAK,CAAC,MAAM;YAAE,SAAS;QAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACtC,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC,SAAS;YAAE,SAAS;QACzB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,MAAM,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAC/F,CAAC,IAAI,CAAC,CAAC;QACT,CAAC;QACD,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,MAAM,aAAa,CACjB,WAAW,EACX,4CAA4C,IAAI,CAAC,WAAW,EAAE,QAAQ,MAAM,CAAC,IAAI,KAAK;YACpF,oEAAoE,EACtE,EAAE,MAAM,EAAE,aAAa,EAAE,CAC1B,CAAC;IACJ,CAAC;IACD,oBAAoB,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAW,EAAE,IAAY;IAC9D,oBAAoB,CAAC,kBAAkB,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;AACnE,CAAC;AAED,mEAAmE;AACnE,SAAS,oBAAoB,CAAC,UAA6B,EAAE,IAAY;IACvE,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAChD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO;IACjC,MAAM,aAAa,CACjB,WAAW,EACX,GAAG,IAAI,oEAAoE,MAAM,KAAK;QACpF,4GAA4G,EAC9G,EAAE,MAAM,EAAE,aAAa,EAAE,CAC1B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,KAAgB;IACzC,OAAO;QACL,KAAK,EAAE,CAA+B,GAAW,EAAE,MAA4B,EAAO,EAAE;YACtF,kBAAkB,CAAC,GAAG,CAAC,CAAC;YACxB,OAAO,KAAK,CAAC,KAAK,CAAI,GAAG,EAAE,MAAM,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,EAAE,CAAC,GAAW,EAAE,MAA4B,EAAE,EAAE;YAClD,kBAAkB,CAAC,GAAG,CAAC,CAAC;YACxB,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACjC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/spine-restore.d.ts

@@ -0,0 +1,87 @@
+/**
+ * How a restore, fork or carry loads a dump's `_substrat_*` spine tables (#1883). One
+ * definition for both adapters' loaders, so the DO and the pure host build the same tables
+ * from the same dump.
+ *
+ * A dump used to be replayed table by table, `CREATE TABLE` from the dump and then its rows,
+ * spine included; the kernel's `CREATE TABLE IF NOT EXISTS` afterwards filled only the gaps.
+ * So a dump could decide the schema of the tables the permission checker reads. A dump that
+ * declared `_substrat_tuples.object` as `COLLATE NOCASE` made every `=` the checker and the
+ * spine SQL wrote on it ignore case: a grant on `aiTurn:x` answered for `aiturn:x`.
+ *
+ * Now the loader builds every spine table from its own kernel DDL, and the dump contributes
+ * rows only, inserted by column name:
+ * - a column the kernel's table does not have (a dump from a newer kernel) is added as a plain
+ *   untyped column, unless it is named for SQLite's rowid (refused, since it would shadow it), with no type, collation, constraint or default, and keeps its values
+ *   (`spineColumnAdditions`). It is not one the checker reads, and it carries nothing that
+ *   could change how the columns the checker does read compare. When a later kernel adds the
+ *   column for real, its additive ALTER meets it and tolerates it as a duplicate;
+ * - a column the dump lacks takes the kernel's default (NULL for every additive column), so
+ *   a dump taken before a column existed still restores. The one column that is not additive,
+ *   `_substrat_schedule_state.kind` (#1288, part of the key), is derived from the row the way
+ *   the #1288 rebuild derives it;
+ * - a spine table the kernel does not build is refused (`assertSpineTablesBuilt`), every such
+ *   table named at once.
+ *
+ * Tables outside the spine keep the dump's own DDL: a vertical's schema is the dump's to say.
+ */
+/**
+ * A kernel-owned table, which a restore builds from the kernel's DDL rather than the dump's.
+ * The prefix is the spine guard's, compared the way SQLite compares table names, without case:
+ * a dump's `_Substrat_tuples` IS the tuples table, and read as a vertical one its DDL would be
+ * replayed and the kernel's `IF NOT EXISTS` would skip its own.
+ */
+export declare function isSpineTable(name: string): boolean;
+/**
+ * Refuse a dump carrying `_substrat_*` tables this host's kernel does not build, naming every
+ * one of them. Called before any spine row goes in, inside the load's transaction; `columnsOf`
+ * is the same lookup `dumpRowsInsert` takes, `undefined` for a table the kernel did not build.
+ *
+ * The usual cause is a dump from the other kind of host: a Durable Object's scope builds spine
+ * tables (`_substrat_roles`, `_substrat_tenant_tuples`, …) that a node scope keeps in its
+ * directory instead. Loading one anyway would mean dropping its rows, which a restore does not
+ * do silently.
+ *
+ * Every `_substrat*` name is judged, the search index's namespace included (`namesSpineTable`,
+ * not `isSpineTable`): a scope restore has skipped its index tables before this, since it
+ * rebuilds them, and a directory has no search index, so there such a table is one more spine
+ * table the directory does not build (#1898).
+ */
+export declare function assertSpineTablesBuilt(names: readonly string[], columnsOf: KernelColumnsOf): void;
+/** A table's columns as the kernel built it here, or `undefined` when it built no such table. */
+export type KernelColumnsOf = (name: string) => readonly string[] | undefined;
+/**
+ * The `INSERT` that loads one dumped table's rows, one row of positional parameters per
+ * execution, in the dump's column order: `spineRowsInsert` for a spine table, and the dump's
+ * own columns for a vertical one. The names are quoted as given: the loader has already passed
+ * the dump through `assertReplayableDump`.
+ */
+export declare function dumpRowsInsert(table: {
+    name: string;
+    columns: readonly string[];
+}, columnsOf: KernelColumnsOf): string;
+/**
+ * The statements that add to a kernel-built spine table each column the dump carries and the
+ * kernel does not, as a plain untyped column: `ADD COLUMN "<name>"`, lowercased, and nothing after it, so it
+ * has no type, collation, constraint or default. Run after `assertSpineTablesBuilt` and before
+ * the table's rows go in, inside the load's transaction. The names are the dump's, which
+ * `assertReplayableDump` has already held to the identifier rule. Empty for a table the kernel
+ * did not build, which `assertSpineTablesBuilt` has refused.
+ */
+export declare function spineColumnAdditions(table: {
+    name: string;
+    columns: readonly string[];
+}, kernelColumns: readonly string[] | undefined): string[];
+/**
+ * The `INSERT` that loads one dumped spine table's rows into the table the kernel built.
+ *
+ * `kernelColumns` is the kernel table's column list as the loader reads it back after
+ * `spineColumnAdditions`, or `undefined` when the kernel built no such table. Either refusal
+ * below is a backstop the loader's order makes unreachable, and throws `validation_failed`
+ * inside the load's transaction, so the target keeps what it held.
+ */
+export declare function spineRowsInsert(table: {
+    name: string;
+    columns: readonly string[];
+}, kernelColumns: readonly string[] | undefined): string;
+//# sourceMappingURL=spine-restore.d.ts.map

package/dist/spine-restore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spine-restore.d.ts","sourceRoot":"","sources":["../src/spine-restore.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAIlD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,SAAS,EAAE,eAAe,GAAG,IAAI,CAGjG;AAED,iGAAiG;AACjG,MAAM,MAAM,eAAe,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;AAmB9E;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,EAAE,SAAS,EAAE,eAAe,GAAG,MAAM,CAEtH;AASD;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,EACnD,aAAa,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GAC3C,MAAM,EAAE,CAkBV;AAKD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,EACnD,aAAa,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GAC3C,MAAM,CAyBR"}