@substrat-run/kernel 0.133.0 → 0.135.0

package/dist/subject-redaction.d.ts

@@ -26,8 +26,10 @@
  *
  * What it therefore does NOT reach is an intent kind that carries a subject's PII
  * WITHOUT carrying the classified event — an intent payload has no `piiClass` of its
- * own, so the kernel has nothing to read. No kind does that today (kernel-design.md
- * §13.1 limit 7 says so and names the walk), and a kind that started to would be
+ * own, so the kernel has nothing to read. One shipped kind can: a `sweep-runs` entry's
+ * `error` is a scheduled operation's throw, and that text gets its own walk on the subject's
+ * id (`redactSubjectSweepRunIntents`, at the end of this file). Any other kind is limit 7 in
+ * kernel-design.md §13.1, and a kind that started carrying a person directly would be
  * inventing an unclassified PII store inside the spine.
  *
  * This is a kernel module rather than two copies of the same SQL for
@@ -119,13 +121,29 @@ export interface SubjectRedactionCounts {
      * a count of rewritten cells would read larger than anything a DSAR answer could say.
      */
     jobRuns: number;
+    /**
+     * Recorded idempotent responses (#1632) that named the subject and now hold the tombstone.
+     * Not on the receipt — a cached reply is not another copy of an event — but answered, so a
+     * coordinator can tell a host that looked from one that never did.
+     */
+    idempotencyResults: number;
+    /**
+     * Every intent in the journal holding this subject's tombstone after the pass, whether this
+     * pass or an earlier one wrote it. The directory half needs them (`redactSubjectDirectoryText`):
+     * a drain failure about one of these intents quotes its `last_error`. All of them rather than
+     * the new ones, so an erasure that crashed between the two halves converges on its re-run.
+     */
+    intentIds: string[];
 }
 /**
- * What a ScopeDO from after #1600 and before #1632 answers — the job-run count absent,
- * because that host never looked at the job tables. The coordinator refuses it rather than
- * reading the absence as zero (see `redactSubject`'s callers).
+ * What an older ScopeDO answers. One from after #1600 and before #1632 has no job-run count,
+ * because that host never looked at the job tables; one from before the free-text half has
+ * the count but no `idempotencyResults` or `intentIds`. The coordinator refuses both rather
+ * than reading an absence as zero (see `redactSubject`'s callers).
  */
-export type LegacySubjectRedactionCounts = Omit<SubjectRedactionCounts, 'jobRuns'>;
+export type LegacySubjectRedactionCounts = Omit<SubjectRedactionCounts, 'jobRuns' | 'idempotencyResults' | 'intentIds'> & {
+    jobRuns?: number;
+};
 /**
  * The candidate read: every intent whose stored payload TEXT contains the subject id.
  *
@@ -183,6 +201,27 @@ export declare function platformRequestRedactionParams(id: string, subjectId: st
  * a meaning for.
  */
 export declare function intentPayloadCarriesSubject(payloadText: string, subjectId: string): boolean;
+/**
+ * Is this payload one we already redacted?
+ *
+ * **Asked of the WHOLE payload, once, and never inside the walk (#1600 review).** The
+ * first cut short-circuited the walk at any object carrying the marker key, which made
+ * `{ _substratRedacted: false, event: <a real envelope> }` a payload the erasure stepped
+ * straight past, PII and all — and the comment beside it claimed the check was redundant
+ * belt-and-braces because a tombstone has no `piiClass`. That was true of the tombstone
+ * and false of everything else wearing its key. An intent payload is `unknown` and module
+ * code chooses it, so a marker that means "stop looking" must not be something a payload
+ * can merely CONTAIN.
+ *
+ * The invariant asked instead is un-forgeable in the only way that matters: *a payload
+ * that is nothing but a redaction tombstone is already redacted*. One top-level key, and
+ * that key's value says why. Anything beside the marker is not this, gets walked, and is
+ * judged on its own contents — which is exactly right, because something beside the
+ * marker is something the erasure might need to reach. Inner fields beyond `reason` are
+ * deliberately not pinned: a later tombstone that carries more would still be nothing but
+ * a tombstone, and hard-coding its shape here is how idempotency would quietly regress.
+ */
+export declare function isRedactedPayload(parsed: unknown): boolean;
 /**
  * The note a redaction leaves on a delivery of a redacted event that had failed.
  *
@@ -260,4 +299,110 @@ export declare const JOB_STEP_REDACTION_SQL = "UPDATE _substrat_job_steps\n
  * redacted-note, at (ended_at), at (updated_at), id.
  */
 export declare const JOB_RUN_REDACTION_SQL = "UPDATE _substrat_job_runs\n     SET payload = CASE WHEN ? = 1 THEN ? ELSE payload END,\n         cursor = CASE WHEN ? = 1 THEN ? ELSE cursor END,\n         last_error = CASE WHEN status = 'running' THEN ? ELSE ? END,\n         next_attempt_at = CASE WHEN status = 'running' THEN NULL ELSE next_attempt_at END,\n         ended_at = COALESCE(ended_at, ?),\n         updated_at = ?,\n         status = CASE WHEN status = 'running' THEN 'failed' ELSE status END\n   WHERE id = ?";
+/**
+ * The note a redaction leaves where a failure's text named the subject: an ops-failure
+ * message, an issue's exemplar, a sweep record's error, or that error still queued inside a
+ * `sweep-runs` intent. One note for all four, because the drain lands the last into the third
+ * and a reader should meet the same sentence wherever the redaction found the text.
+ */
+export declare const REDACTED_FAILURE_NOTE = "redacted by subject erasure (#37) \u2014 what this failure said is gone; that it happened, and when, is not";
+/**
+ * The idempotency ledger's half (#1632): a recorded response that names the subject.
+ *
+ * `result` is an operation's return value, kept for a day so a retry is answered without
+ * running again — and an operation that returns a person's record returns their id with it.
+ * Nothing else in the row says whose response it is, so the link is the direct one: the
+ * subject's id appears in the stored JSON. A `DataSubjectId` is a ULID, so the match does not
+ * happen by coincidence. A response that names the person but not their id is not reached.
+ *
+ * The result becomes the intent tombstone; every other column stays, so the key is still
+ * recorded and a retry is still not executed twice. `replayFor` refuses a tombstoned result
+ * instead of replaying it. Idempotent: a row already holding this subject's tombstone is
+ * skipped. Returns how many rows it rewrote.
+ */
+export declare function redactSubjectIdempotency(sql: RedactionSql, subjectId: string, at: string): number;
+/**
+ * Every intent in the journal that holds this subject's tombstone — the ids the directory
+ * half links its drain-failure rows through. Read after the intent redaction, so it covers
+ * this pass's tombstones and every earlier pass's.
+ */
+export declare function redactedIntentIds(sql: RedactionSql, subjectId: string): string[];
+/**
+ * The scope's free-text half (#1632), shared by both adapters so the order is one fact: a
+ * recorded idempotent response and a queued `sweep-runs` entry's error that name the subject,
+ * and THEN the intents holding its tombstone — read after every other intent write, so the ids
+ * cover this pass's tombstones and every earlier one's.
+ */
+export declare function redactSubjectScopeText(sql: RedactionSql, subjectId: string, at: string): Pick<SubjectRedactionCounts, 'idempotencyResults' | 'intentIds'>;
+/**
+ * A `sweep-runs` intent's queued error text (#1632).
+ *
+ * A CP-less pass reports its schedule outcomes as one `sweep-runs` intent; the drain lands
+ * each entry in the directory's `_substrat_sweep_runs`, and the intent itself is kept like
+ * every other. So an entry's `error` — a scheduled operation's throw — is held twice, and the
+ * directory half alone would leave this copy. Only `entries[].error` is rewritten, and only
+ * where it names the subject's id: the payload keeps its shape and every other field, so a
+ * pending intent still drains (the note is a valid `error`) and lands the note instead of the
+ * text. Idempotent: the note does not name the subject.
+ */
+export declare function redactSubjectSweepRunIntents(sql: RedactionSql, subjectId: string): void;
+/**
+ * How the drain words an ops failure about one intent. The reader below parses the same
+ * prefix, so the directory walk and the writer cannot drift about the link between them.
+ */
+export declare function platformIntentFailureMessage(intentId: string, text: string): string;
+/** The intent an ops-failure message is about, or null — `platformIntentFailureMessage` read back. */
+export declare function intentIdOfFailureMessage(message: string): string | null;
+/** What the directory half is handed: the erased scope's tenant, and the scope half's intent ids. */
+export interface SubjectTextTarget {
+    tenantId: string;
+    scopeId: string;
+    subjectId: string;
+    intentIds: string[];
+}
+/**
+ * Whose failure an issue exemplar was copied from, as the issue upsert records it beside
+ * `last_tenant_id`: a tenant's, or the platform's own (a failure with no tenant). NULL is never
+ * written. It is reserved for an issue from before the columns that no retained row attributes,
+ * so "the platform's" and "nobody knows" stay different facts.
+ *
+ * A kind column rather than a sentinel in `last_tenant_id`, so that column stays what its name
+ * says — a tenant id or nothing — for any reader or join, and a later owner kind is a new value
+ * here instead of a second magic string.
+ */
+export type IssueExemplarOwner = 'tenant' | 'platform';
+/** The owner kind both adapters' issue upserts write, from the failure's tenant. */
+export declare function issueExemplarOwner(tenantId: string | null): IssueExemplarOwner;
+/**
+ * #1632: the one-time backfill of an issue's exemplar owner, run as the columns are added to
+ * a directory that predates them. A row is attributed only when the retained ops-failure rows
+ * carrying its exemplar (same fingerprint, same text) all have one origin: a single tenant, or
+ * only the platform. When they name none, or more than one origin, the row stays unknown
+ * (NULL), and erasure skips it. Rows whose evidence already expired stay unknown too, so the
+ * gap fails closed.
+ */
+export declare const ISSUE_EXEMPLAR_OWNER_BACKFILL_SQL = "UPDATE _substrat_issues\n     SET last_tenant_id = (SELECT MIN(o.tenant_id) FROM _substrat_ops_failures o\n                            WHERE o.fingerprint = _substrat_issues.fingerprint\n                              AND o.message = _substrat_issues.last_message),\n         last_owner_kind = CASE WHEN (SELECT MIN(o.tenant_id) FROM _substrat_ops_failures o\n                                       WHERE o.fingerprint = _substrat_issues.fingerprint\n                                         AND o.message = _substrat_issues.last_message) IS NULL\n                                THEN 'platform' ELSE 'tenant' END\n   WHERE last_owner_kind IS NULL\n     AND (SELECT COUNT(DISTINCT COALESCE(o.tenant_id, '')) FROM _substrat_ops_failures o\n           WHERE o.fingerprint = _substrat_issues.fingerprint\n             AND o.message = _substrat_issues.last_message) = 1";
+/**
+ * The directory's half (#1632): three tables of failure text the control plane keeps.
+ *
+ * - `_substrat_ops_failures.message` — the drain's record of an intent it gave up on, or
+ *   settled `failed`, quotes that intent's `last_error`. When the intent is one the erasure
+ *   tombstoned (`intentIds`, in this tenant and scope), the message is a copy of text the
+ *   scope half already redacted, and goes with it. A row in this tenant, or the platform's
+ *   own row with no tenant, that names the subject's id goes too.
+ * - `_substrat_issues.last_message` — the newest exemplar of an ops-failure group. Its
+ *   writer records whose failure it copied (`last_owner_kind`, `last_tenant_id`, in the same
+ *   statement), and erasure reads that rather than the ops-failure rows, which issues outlive.
+ *   A tenant's exemplar is rewritten only for that tenant, by the same two links; the
+ *   platform's own on a direct id match, as its ops-failure row is. An exemplar of unknown
+ *   owner (a legacy row nothing attributed) is skipped: the matched text can come from
+ *   anyone's request, so an unattributed row is never read as this tenant's.
+ * - `_substrat_sweep_runs.error` — a scheduled operation's throw, matched on the subject's
+ *   id in this tenant's rows or the platform's own. There is no link to an event here.
+ *
+ * Rows for another tenant are never touched. Free text that names the person but not their
+ * id, on a row with no intent link, is not reached. Idempotent: the note names neither an
+ * intent nor the subject.
+ */
+export declare function redactSubjectDirectoryText(sql: RedactionSql, target: SubjectTextTarget): void;
 //# sourceMappingURL=subject-redaction.d.ts.map

package/dist/subject-redaction.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"subject-redaction.d.ts","sourceRoot":"","sources":["../src/subject-redaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,sBAAsB,CAAC;AAE1D;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAI3E;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,+GACwE,CAAC;AAE1G;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,6HACqF,CAAC;AAExH,mDAAmD;AACnD,MAAM,WAAW,iCAAiC;IAChD,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,MAAM,MAAM,4BAA4B,GAAG,IAAI,CAAC,sBAAsB,EAAE,SAAS,CAAC,CAAC;AAEnF;;;;;;;;;;;;GAYG;AACH,wBAAgB,6BAA6B,CAAC,SAAS,EAAE,MAAM,GAAG;IAChE,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB,CAOA;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,8BAA8B,qXAO3B,CAAC;AAEjB,wFAAwF;AACxF,wBAAgB,8BAA8B,CAC5C,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,MAAM,EACjB,EAAE,EAAE,MAAM,GACT,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAGlD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,2BAA2B,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAS3F;AAmDD;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,mHAC0E,CAAC;AAE9G;;;;;;;;GAQG;AACH,eAAO,MAAM,4BAA4B,oMAG2D,CAAC;AAIrG;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,6HACyF,CAAC;AAExH;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,gHAC4E,CAAC;AAE5G;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC,EAAE,KAAK,OAAO,EAAE,CAAC;AAEnG;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAsE7F;AAWD;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,sGAEF,CAAC;AAElC;;;;;;;;GAQG;AACH,eAAO,MAAM,qBAAqB,+dAQlB,CAAC"}
+{"version":3,"file":"subject-redaction.d.ts","sourceRoot":"","sources":["../src/subject-redaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAIH;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,sBAAsB,CAAC;AAE1D;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAI3E;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,+GACwE,CAAC;AAE1G;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,6HACqF,CAAC;AAExH,mDAAmD;AACnD,MAAM,WAAW,iCAAiC;IAChD,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAC3B;;;;;OAKG;IACH,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;;;;GAKG;AACH,MAAM,MAAM,4BAA4B,GAAG,IAAI,CAC7C,sBAAsB,EACtB,SAAS,GAAG,oBAAoB,GAAG,WAAW,CAC/C,GAAG;IAAE,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAWzB;;;;;;;;;;;;GAYG;AACH,wBAAgB,6BAA6B,CAAC,SAAS,EAAE,MAAM,GAAG;IAChE,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB,CAKA;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,8BAA8B,qXAO3B,CAAC;AAEjB,wFAAwF;AACxF,wBAAgB,8BAA8B,CAC5C,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,MAAM,EACjB,EAAE,EAAE,MAAM,GACT,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAGlD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,2BAA2B,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAS3F;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAW1D;AAkBD;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,mHAC0E,CAAC;AAE9G;;;;;;;;GAQG;AACH,eAAO,MAAM,4BAA4B,oMAG2D,CAAC;AAIrG;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,6HACyF,CAAC;AAExH;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,gHAC4E,CAAC;AAE5G;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC,EAAE,KAAK,OAAO,EAAE,CAAC;AAEnG;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAqE7F;AAWD;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,sGAEF,CAAC;AAElC;;;;;;;;GAQG;AACH,eAAO,MAAM,qBAAqB,+dAQlB,CAAC;AAIjB;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,gHACwE,CAAC;AAE3G;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAiBjG;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAIhF;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,YAAY,EACjB,SAAS,EAAE,MAAM,EACjB,EAAE,EAAE,MAAM,GACT,IAAI,CAAC,sBAAsB,EAAE,oBAAoB,GAAG,WAAW,CAAC,CAIlE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CA6BvF;AAID;;;GAGG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnF;AAED,sGAAsG;AACtG,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAKvE;AAED,qGAAqG;AACrG,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,UAAU,CAAC;AAEvD,oFAAoF;AACpF,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,kBAAkB,CAE9E;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,iCAAiC,q2BAWkB,CAAC;AAEjE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAyC7F"}

package/dist/subject-redaction.js

@@ -26,14 +26,17 @@
  *
  * What it therefore does NOT reach is an intent kind that carries a subject's PII
  * WITHOUT carrying the classified event — an intent payload has no `piiClass` of its
- * own, so the kernel has nothing to read. No kind does that today (kernel-design.md
- * §13.1 limit 7 says so and names the walk), and a kind that started to would be
+ * own, so the kernel has nothing to read. One shipped kind can: a `sweep-runs` entry's
+ * `error` is a scheduled operation's throw, and that text gets its own walk on the subject's
+ * id (`redactSubjectSweepRunIntents`, at the end of this file). Any other kind is limit 7 in
+ * kernel-design.md §13.1, and a kind that started carrying a person directly would be
  * inventing an unclassified PII store inside the spine.
  *
  * This is a kernel module rather than two copies of the same SQL for
  * `platformRequestHistoryQuery`'s reason, sharpened: three surfaces answer one question
  * from this table, and a privacy guarantee that holds on one adapter is not a guarantee.
  */
+import { SWEEP_RUNS_KIND } from '@substrat-run/contracts';
 /**
  * The one key a redacted intent payload carries, and nothing else in the system does.
  *
@@ -95,6 +98,14 @@ export const REDACTED_INTENT_NOTE = 'redacted by subject erasure (#37) — what
  * routed, so nothing re-routes the event to replace this row.
  */
 export const CANCELLED_INTENT_NOTE = 'cancelled by subject erasure (#37) — the payload was redacted before the drain reached it, so this intent never ran';
+/**
+ * The needle every walk in this file searches a stored text for: the subject id with the
+ * quotes JSON.stringify adds stripped, keeping the escaped body — the exact run of characters
+ * a serialized payload holds.
+ */
+function subjectNeedle(subjectId) {
+    return JSON.stringify(subjectId).slice(1, -1);
+}
 /**
  * The candidate read: every intent whose stored payload TEXT contains the subject id.
  *
@@ -111,9 +122,7 @@ export const CANCELLED_INTENT_NOTE = 'cancelled by subject erasure (#37) — the
 export function platformRequestRedactionQuery(subjectId) {
     return {
         sql: 'SELECT id, payload FROM _substrat_platform_requests WHERE instr(payload, ?) > 0',
-        // Strip the quotes JSON.stringify adds and keep the escaped body — the exact run of
-        // characters the serialized payload holds.
-        params: [JSON.stringify(subjectId).slice(1, -1)],
+        params: [subjectNeedle(subjectId)],
     };
 }
 /**
@@ -197,7 +206,7 @@ export function intentPayloadCarriesSubject(payloadText, subjectId) {
  * deliberately not pinned: a later tombstone that carries more would still be nothing but
  * a tombstone, and hard-coding its shape here is how idempotency would quietly regress.
  */
-function isRedactedPayload(parsed) {
+export function isRedactedPayload(parsed) {
     if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed))
         return false;
     const keys = Object.keys(parsed);
@@ -282,8 +291,7 @@ export const CANCELLED_JOB_NOTE = 'stopped by subject erasure (#37) — this run
  * Returns the number of distinct runs touched.
  */
 export function redactSubjectJobRuns(sql, subjectId, at) {
-    // The needle, spelled as `platformRequestRedactionQuery` spells it.
-    const needle = JSON.stringify(subjectId).slice(1, -1);
+    const needle = subjectNeedle(subjectId);
     const tombstone = redactedIntentPayload(subjectId, at);
     const runs = new Set();
     const hits = new Map();
@@ -379,4 +387,200 @@ export const JOB_RUN_REDACTION_SQL = `UPDATE _substrat_job_runs
          updated_at = ?,
          status = CASE WHEN status = 'running' THEN 'failed' ELSE status END
    WHERE id = ?`;
+// -- the spine's free-text copies (#1632) ---------------------------------------------
+/**
+ * The note a redaction leaves where a failure's text named the subject: an ops-failure
+ * message, an issue's exemplar, a sweep record's error, or that error still queued inside a
+ * `sweep-runs` intent. One note for all four, because the drain lands the last into the third
+ * and a reader should meet the same sentence wherever the redaction found the text.
+ */
+export const REDACTED_FAILURE_NOTE = 'redacted by subject erasure (#37) — what this failure said is gone; that it happened, and when, is not';
+/**
+ * The idempotency ledger's half (#1632): a recorded response that names the subject.
+ *
+ * `result` is an operation's return value, kept for a day so a retry is answered without
+ * running again — and an operation that returns a person's record returns their id with it.
+ * Nothing else in the row says whose response it is, so the link is the direct one: the
+ * subject's id appears in the stored JSON. A `DataSubjectId` is a ULID, so the match does not
+ * happen by coincidence. A response that names the person but not their id is not reached.
+ *
+ * The result becomes the intent tombstone; every other column stays, so the key is still
+ * recorded and a retry is still not executed twice. `replayFor` refuses a tombstoned result
+ * instead of replaying it. Idempotent: a row already holding this subject's tombstone is
+ * skipped. Returns how many rows it rewrote.
+ */
+export function redactSubjectIdempotency(sql, subjectId, at) {
+    const rows = sql('SELECT subject, key, result FROM _substrat_idempotency WHERE instr(result, ?) > 0', [subjectNeedle(subjectId)]);
+    const tombstone = redactedIntentPayload(subjectId, at);
+    let redacted = 0;
+    for (const row of rows) {
+        if (isRedactedPayloadText(row.result, subjectId))
+            continue;
+        sql('UPDATE _substrat_idempotency SET result = ? WHERE subject = ? AND key = ?', [
+            tombstone,
+            row.subject,
+            row.key,
+        ]);
+        redacted += 1;
+    }
+    return redacted;
+}
+/**
+ * Every intent in the journal that holds this subject's tombstone — the ids the directory
+ * half links its drain-failure rows through. Read after the intent redaction, so it covers
+ * this pass's tombstones and every earlier pass's.
+ */
+export function redactedIntentIds(sql, subjectId) {
+    const q = platformRequestRedactionQuery(subjectId);
+    const rows = sql(q.sql, q.params);
+    return rows.filter((r) => isRedactedPayloadText(r.payload, subjectId)).map((r) => r.id);
+}
+/**
+ * The scope's free-text half (#1632), shared by both adapters so the order is one fact: a
+ * recorded idempotent response and a queued `sweep-runs` entry's error that name the subject,
+ * and THEN the intents holding its tombstone — read after every other intent write, so the ids
+ * cover this pass's tombstones and every earlier one's.
+ */
+export function redactSubjectScopeText(sql, subjectId, at) {
+    const idempotencyResults = redactSubjectIdempotency(sql, subjectId, at);
+    redactSubjectSweepRunIntents(sql, subjectId);
+    return { idempotencyResults, intentIds: redactedIntentIds(sql, subjectId) };
+}
+/**
+ * A `sweep-runs` intent's queued error text (#1632).
+ *
+ * A CP-less pass reports its schedule outcomes as one `sweep-runs` intent; the drain lands
+ * each entry in the directory's `_substrat_sweep_runs`, and the intent itself is kept like
+ * every other. So an entry's `error` — a scheduled operation's throw — is held twice, and the
+ * directory half alone would leave this copy. Only `entries[].error` is rewritten, and only
+ * where it names the subject's id: the payload keeps its shape and every other field, so a
+ * pending intent still drains (the note is a valid `error`) and lands the note instead of the
+ * text. Idempotent: the note does not name the subject.
+ */
+export function redactSubjectSweepRunIntents(sql, subjectId) {
+    const rows = sql('SELECT id, payload FROM _substrat_platform_requests WHERE kind = ? AND instr(payload, ?) > 0', [SWEEP_RUNS_KIND, subjectNeedle(subjectId)]);
+    for (const row of rows) {
+        let parsed;
+        try {
+            parsed = JSON.parse(row.payload);
+        }
+        catch {
+            continue;
+        }
+        if (typeof parsed !== 'object' || parsed === null)
+            continue;
+        const entries = parsed.entries;
+        if (!Array.isArray(entries))
+            continue;
+        let changed = false;
+        const rewritten = entries.map((entry) => {
+            if (typeof entry !== 'object' || entry === null)
+                return entry;
+            const error = entry.error;
+            if (typeof error !== 'string' || !error.includes(subjectId))
+                return entry;
+            changed = true;
+            return { ...entry, error: REDACTED_FAILURE_NOTE };
+        });
+        if (!changed)
+            continue;
+        sql('UPDATE _substrat_platform_requests SET payload = ? WHERE id = ?', [
+            JSON.stringify({ ...parsed, entries: rewritten }),
+            row.id,
+        ]);
+    }
+}
+const PLATFORM_INTENT_FAILURE_PREFIX = 'platform intent ';
+/**
+ * How the drain words an ops failure about one intent. The reader below parses the same
+ * prefix, so the directory walk and the writer cannot drift about the link between them.
+ */
+export function platformIntentFailureMessage(intentId, text) {
+    return `${PLATFORM_INTENT_FAILURE_PREFIX}${intentId} ${text}`;
+}
+/** The intent an ops-failure message is about, or null — `platformIntentFailureMessage` read back. */
+export function intentIdOfFailureMessage(message) {
+    if (!message.startsWith(PLATFORM_INTENT_FAILURE_PREFIX))
+        return null;
+    const rest = message.slice(PLATFORM_INTENT_FAILURE_PREFIX.length);
+    const end = rest.indexOf(' ');
+    return end > 0 ? rest.slice(0, end) : null;
+}
+/** The owner kind both adapters' issue upserts write, from the failure's tenant. */
+export function issueExemplarOwner(tenantId) {
+    return tenantId === null ? 'platform' : 'tenant';
+}
+/**
+ * #1632: the one-time backfill of an issue's exemplar owner, run as the columns are added to
+ * a directory that predates them. A row is attributed only when the retained ops-failure rows
+ * carrying its exemplar (same fingerprint, same text) all have one origin: a single tenant, or
+ * only the platform. When they name none, or more than one origin, the row stays unknown
+ * (NULL), and erasure skips it. Rows whose evidence already expired stay unknown too, so the
+ * gap fails closed.
+ */
+export const ISSUE_EXEMPLAR_OWNER_BACKFILL_SQL = `UPDATE _substrat_issues
+     SET last_tenant_id = (SELECT MIN(o.tenant_id) FROM _substrat_ops_failures o
+                            WHERE o.fingerprint = _substrat_issues.fingerprint
+                              AND o.message = _substrat_issues.last_message),
+         last_owner_kind = CASE WHEN (SELECT MIN(o.tenant_id) FROM _substrat_ops_failures o
+                                       WHERE o.fingerprint = _substrat_issues.fingerprint
+                                         AND o.message = _substrat_issues.last_message) IS NULL
+                                THEN 'platform' ELSE 'tenant' END
+   WHERE last_owner_kind IS NULL
+     AND (SELECT COUNT(DISTINCT COALESCE(o.tenant_id, '')) FROM _substrat_ops_failures o
+           WHERE o.fingerprint = _substrat_issues.fingerprint
+             AND o.message = _substrat_issues.last_message) = 1`;
+/**
+ * The directory's half (#1632): three tables of failure text the control plane keeps.
+ *
+ * - `_substrat_ops_failures.message` — the drain's record of an intent it gave up on, or
+ *   settled `failed`, quotes that intent's `last_error`. When the intent is one the erasure
+ *   tombstoned (`intentIds`, in this tenant and scope), the message is a copy of text the
+ *   scope half already redacted, and goes with it. A row in this tenant, or the platform's
+ *   own row with no tenant, that names the subject's id goes too.
+ * - `_substrat_issues.last_message` — the newest exemplar of an ops-failure group. Its
+ *   writer records whose failure it copied (`last_owner_kind`, `last_tenant_id`, in the same
+ *   statement), and erasure reads that rather than the ops-failure rows, which issues outlive.
+ *   A tenant's exemplar is rewritten only for that tenant, by the same two links; the
+ *   platform's own on a direct id match, as its ops-failure row is. An exemplar of unknown
+ *   owner (a legacy row nothing attributed) is skipped: the matched text can come from
+ *   anyone's request, so an unattributed row is never read as this tenant's.
+ * - `_substrat_sweep_runs.error` — a scheduled operation's throw, matched on the subject's
+ *   id in this tenant's rows or the platform's own. There is no link to an event here.
+ *
+ * Rows for another tenant are never touched. Free text that names the person but not their
+ * id, on a row with no intent link, is not reached. Idempotent: the note names neither an
+ * intent nor the subject.
+ */
+export function redactSubjectDirectoryText(sql, target) {
+    const needle = subjectNeedle(target.subjectId);
+    sql(`UPDATE _substrat_ops_failures SET message = ?
+      WHERE instr(message, ?) > 0 AND (tenant_id IS NULL OR tenant_id = ?)`, [REDACTED_FAILURE_NOTE, needle, target.tenantId]);
+    sql(`UPDATE _substrat_issues SET last_message = ?
+      WHERE instr(last_message, ?) > 0
+        AND ((last_owner_kind = 'tenant' AND last_tenant_id = ?) OR last_owner_kind = 'platform')`, [REDACTED_FAILURE_NOTE, needle, target.tenantId]);
+    sql(`UPDATE _substrat_sweep_runs SET error = ?
+      WHERE instr(error, ?) > 0 AND (tenant_id IS NULL OR tenant_id = ?)`, [REDACTED_FAILURE_NOTE, needle, target.tenantId]);
+    if (target.intentIds.length === 0)
+        return;
+    const intents = new Set(target.intentIds);
+    // Rows whose text the drain wrote about one of those intents — read back by the grammar it
+    // wrote them in, so the SQL only narrows to the prefix and the id decides.
+    const redactLinked = (table, key, text, where, params) => {
+        const rows = sql(`SELECT ${key} AS key, ${text} AS text FROM ${table} WHERE ${where}instr(${text}, ?) = 1`, [...params, PLATFORM_INTENT_FAILURE_PREFIX]);
+        for (const row of rows) {
+            const id = intentIdOfFailureMessage(row.text);
+            if (id !== null && intents.has(id)) {
+                sql(`UPDATE ${table} SET ${text} = ? WHERE ${key} = ?`, [REDACTED_FAILURE_NOTE, row.key]);
+            }
+        }
+    };
+    redactLinked('_substrat_ops_failures', 'id', 'message', 'tenant_id = ? AND scope_id = ? AND ', [
+        target.tenantId,
+        target.scopeId,
+    ]);
+    redactLinked('_substrat_issues', 'fingerprint', 'last_message', "last_owner_kind = 'tenant' AND last_tenant_id = ? AND ", [
+        target.tenantId,
+    ]);
+}
 //# sourceMappingURL=subject-redaction.js.map

package/dist/subject-redaction.js.map

@@ -1 +1 @@
-{"version":3,"file":"subject-redaction.js","sourceRoot":"","sources":["../src/subject-redaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,mBAAmB,CAAC;AAE1D;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,qBAAqB,CAAC,SAAiB,EAAE,EAAU;IACjE,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,CAAC,sBAAsB,CAAC,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,SAAS,EAAE,EAAE,EAAE;KACvE,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAC/B,uGAAuG,CAAC;AAE1G;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAChC,qHAAqH,CAAC;AAwCxH;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,6BAA6B,CAAC,SAAiB;IAI7D,OAAO;QACL,GAAG,EAAE,iFAAiF;QACtF,oFAAoF;QACpF,2CAA2C;QAC3C,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;KACjD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG;;;;;;;gBAO9B,CAAC;AAEjB,wFAAwF;AACxF,MAAM,UAAU,8BAA8B,CAC5C,EAAU,EACV,SAAiB,EACjB,EAAU;IAEV,MAAM,SAAS,GAAG,qBAAqB,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACvD,OAAO,CAAC,SAAS,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;AACrF,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,2BAA2B,CAAC,WAAmB,EAAE,SAAiB;IAChF,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,iBAAiB,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,cAAc,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAS,iBAAiB,CAAC,MAAe;IACxC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACzF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,sBAAsB;QAAE,OAAO,KAAK,CAAC;IAC1E,MAAM,MAAM,GAAI,MAAkC,CAAC,sBAAsB,CAAC,CAAC;IAC3E,OAAO,CACL,OAAO,MAAM,KAAK,QAAQ;QAC1B,MAAM,KAAK,IAAI;QACf,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QACrB,MAAkC,CAAC,QAAQ,CAAC,KAAK,iBAAiB,CACpE,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,IAAa,EAAE,SAAiB;IACtD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;IACvF,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5D,MAAM,GAAG,GAAG,IAA+B,CAAC;IAC5C,IACE,GAAG,CAAC,WAAW,CAAC,KAAK,SAAS;QAC9B,OAAO,GAAG,CAAC,UAAU,CAAC,KAAK,QAAQ;QACnC,GAAG,CAAC,UAAU,CAAC,KAAK,MAAM,EAC1B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,uFAAuF;AAEvF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,sBAAsB,GACjC,2GAA2G,CAAC;AAE9G;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG;;;oGAGwD,CAAC;AAErG,uFAAuF;AAEvF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAC5B,qHAAqH,CAAC;AAExH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAC7B,yGAAyG,CAAC;AAS5G;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAiB,EAAE,SAAiB,EAAE,EAAU;IACnF,oEAAoE;IACpE,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,qBAAqB,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAiD,CAAC;IACtE,MAAM,QAAQ,GAAG,GAAG,CAClB,6FAA6F,EAC7F,CAAC,SAAS,CAAC,CAC2F,CAAC;IACzG,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,iFAAiF;QACjF,8EAA8E;QAC9E,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,qBAAqB,CAAC,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC;YACrE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,qBAAqB,CAAC,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YACjE,CAAC,CAAC,CAAC,UAAU,KAAK,kBAAkB,IAAI,CAAC,CAAC,UAAU,KAAK,iBAAiB,CAAC,EAAE,CAAC;YAChF,MAAM,KAAK,GAAG,GAAG,CAAC,qEAAqE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACvC,CAAC;YACzD,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CACvB,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,qBAAqB,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;gBACvE,CAAC,IAAI,CAAC,UAAU,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,KAAK,iBAAiB,CAAC,CAAC;gBAAE,SAAS;QACnF,CAAC;QACD,GAAG,CAAC;;;0BAGkB,EAAE,CAAC,SAAS,EAAE,iBAAiB,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC9D,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,MAAM,KAAK,GAAG,GAAG,CACf,iFAAiF,EACjF,CAAC,MAAM,CAAC,CAC6C,CAAC;IACxD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,2BAA2B,CAAC,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC;YAAE,SAAS;QAChE,GAAG,CAAC,sBAAsB,EAAE,CAAC,SAAS,EAAE,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9E,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACrB,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,CACpB;0DACsD,EACtD,CAAC,MAAM,EAAE,MAAM,CAAC,CAC2C,CAAC;IAC9D,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,2BAA2B,CAAC,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,2BAA2B,CAAC,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACrF,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,oFAAoF;IACpF,gDAAgD;IAChD,KAAK,MAAM,EAAE,IAAI,IAAI;QAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAE1F,KAAK,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QAC7B,GAAG,CAAC,qBAAqB,EAAE;YACzB,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnB,SAAS;YACT,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAClB,SAAS;YACT,kBAAkB;YAClB,iBAAiB;YACjB,EAAE;YACF,EAAE;YACF,EAAE;SACH,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC;AACnB,CAAC;AAED,wFAAwF;AACxF,SAAS,qBAAqB,CAAC,IAAY,EAAE,SAAiB;IAC5D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;QAC3D,OAAO,iBAAiB,CAAC,MAAM,CAAC;YAC7B,MAAM,CAAC,sBAAsB,CAA6B,CAAC,WAAW,CAAC,KAAK,SAAS,CAAC;IAC3F,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AAC3B,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;;iCAEL,CAAC;AAElC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;;;;;;;;gBAQrB,CAAC"}
+{"version":3,"file":"subject-redaction.js","sourceRoot":"","sources":["../src/subject-redaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE1D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,mBAAmB,CAAC;AAE1D;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,qBAAqB,CAAC,SAAiB,EAAE,EAAU;IACjE,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,CAAC,sBAAsB,CAAC,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,SAAS,EAAE,EAAE,EAAE;KACvE,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAC/B,uGAAuG,CAAC;AAE1G;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAChC,qHAAqH,CAAC;AAyDxH;;;;GAIG;AACH,SAAS,aAAa,CAAC,SAAiB;IACtC,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,6BAA6B,CAAC,SAAiB;IAI7D,OAAO;QACL,GAAG,EAAE,iFAAiF;QACtF,MAAM,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;KACnC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG;;;;;;;gBAO9B,CAAC;AAEjB,wFAAwF;AACxF,MAAM,UAAU,8BAA8B,CAC5C,EAAU,EACV,SAAiB,EACjB,EAAU;IAEV,MAAM,SAAS,GAAG,qBAAqB,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACvD,OAAO,CAAC,SAAS,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;AACrF,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,2BAA2B,CAAC,WAAmB,EAAE,SAAiB;IAChF,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,iBAAiB,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,cAAc,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAe;IAC/C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACzF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,sBAAsB;QAAE,OAAO,KAAK,CAAC;IAC1E,MAAM,MAAM,GAAI,MAAkC,CAAC,sBAAsB,CAAC,CAAC;IAC3E,OAAO,CACL,OAAO,MAAM,KAAK,QAAQ;QAC1B,MAAM,KAAK,IAAI;QACf,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QACrB,MAAkC,CAAC,QAAQ,CAAC,KAAK,iBAAiB,CACpE,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,IAAa,EAAE,SAAiB;IACtD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;IACvF,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5D,MAAM,GAAG,GAAG,IAA+B,CAAC;IAC5C,IACE,GAAG,CAAC,WAAW,CAAC,KAAK,SAAS;QAC9B,OAAO,GAAG,CAAC,UAAU,CAAC,KAAK,QAAQ;QACnC,GAAG,CAAC,UAAU,CAAC,KAAK,MAAM,EAC1B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,uFAAuF;AAEvF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,sBAAsB,GACjC,2GAA2G,CAAC;AAE9G;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG;;;oGAGwD,CAAC;AAErG,uFAAuF;AAEvF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAC5B,qHAAqH,CAAC;AAExH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAC7B,yGAAyG,CAAC;AAS5G;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAiB,EAAE,SAAiB,EAAE,EAAU;IACnF,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,SAAS,GAAG,qBAAqB,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAiD,CAAC;IACtE,MAAM,QAAQ,GAAG,GAAG,CAClB,6FAA6F,EAC7F,CAAC,SAAS,CAAC,CAC2F,CAAC;IACzG,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,iFAAiF;QACjF,8EAA8E;QAC9E,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,qBAAqB,CAAC,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC;YACrE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,qBAAqB,CAAC,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YACjE,CAAC,CAAC,CAAC,UAAU,KAAK,kBAAkB,IAAI,CAAC,CAAC,UAAU,KAAK,iBAAiB,CAAC,EAAE,CAAC;YAChF,MAAM,KAAK,GAAG,GAAG,CAAC,qEAAqE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACvC,CAAC;YACzD,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CACvB,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,qBAAqB,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;gBACvE,CAAC,IAAI,CAAC,UAAU,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,KAAK,iBAAiB,CAAC,CAAC;gBAAE,SAAS;QACnF,CAAC;QACD,GAAG,CAAC;;;0BAGkB,EAAE,CAAC,SAAS,EAAE,iBAAiB,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC9D,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,MAAM,KAAK,GAAG,GAAG,CACf,iFAAiF,EACjF,CAAC,MAAM,CAAC,CAC6C,CAAC;IACxD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,2BAA2B,CAAC,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC;YAAE,SAAS;QAChE,GAAG,CAAC,sBAAsB,EAAE,CAAC,SAAS,EAAE,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9E,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACrB,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,CACpB;0DACsD,EACtD,CAAC,MAAM,EAAE,MAAM,CAAC,CAC2C,CAAC;IAC9D,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,2BAA2B,CAAC,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,2BAA2B,CAAC,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACrF,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,oFAAoF;IACpF,gDAAgD;IAChD,KAAK,MAAM,EAAE,IAAI,IAAI;QAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAE1F,KAAK,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QAC7B,GAAG,CAAC,qBAAqB,EAAE;YACzB,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnB,SAAS;YACT,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAClB,SAAS;YACT,kBAAkB;YAClB,iBAAiB;YACjB,EAAE;YACF,EAAE;YACF,EAAE;SACH,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC;AACnB,CAAC;AAED,wFAAwF;AACxF,SAAS,qBAAqB,CAAC,IAAY,EAAE,SAAiB;IAC5D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;QAC3D,OAAO,iBAAiB,CAAC,MAAM,CAAC;YAC7B,MAAM,CAAC,sBAAsB,CAA6B,CAAC,WAAW,CAAC,KAAK,SAAS,CAAC;IAC3F,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AAC3B,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;;iCAEL,CAAC;AAElC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;;;;;;;;gBAQrB,CAAC;AAEjB,wFAAwF;AAExF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAChC,wGAAwG,CAAC;AAE3G;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAiB,EAAE,SAAiB,EAAE,EAAU;IACvF,MAAM,IAAI,GAAG,GAAG,CACd,mFAAmF,EACnF,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAC2B,CAAC;IACxD,MAAM,SAAS,GAAG,qBAAqB,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACvD,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,qBAAqB,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC;YAAE,SAAS;QAC3D,GAAG,CAAC,2EAA2E,EAAE;YAC/E,SAAS;YACT,GAAG,CAAC,OAAO;YACX,GAAG,CAAC,GAAG;SACR,CAAC,CAAC;QACH,QAAQ,IAAI,CAAC,CAAC;IAChB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAiB,EAAE,SAAiB;IACpE,MAAM,CAAC,GAAG,6BAA6B,CAAC,SAAS,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAwC,CAAC;IACzE,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC1F,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,GAAiB,EACjB,SAAiB,EACjB,EAAU;IAEV,MAAM,kBAAkB,GAAG,wBAAwB,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IACxE,4BAA4B,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC7C,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,iBAAiB,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,CAAC;AAC9E,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,4BAA4B,CAAC,GAAiB,EAAE,SAAiB;IAC/E,MAAM,IAAI,GAAG,GAAG,CACd,8FAA8F,EAC9F,CAAC,eAAe,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC,CACP,CAAC;IACvC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAAE,SAAS;QAC5D,MAAM,OAAO,GAAI,MAAgC,CAAC,OAAO,CAAC;QAC1D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,SAAS;QACtC,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,KAAc,EAAE,EAAE;YAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;gBAAE,OAAO,KAAK,CAAC;YAC9D,MAAM,KAAK,GAAI,KAA6B,CAAC,KAAK,CAAC;YACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC1E,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;QACpD,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,GAAG,CAAC,iEAAiE,EAAE;YACrE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;YACjD,GAAG,CAAC,EAAE;SACP,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,MAAM,8BAA8B,GAAG,kBAAkB,CAAC;AAE1D;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAAC,QAAgB,EAAE,IAAY;IACzE,OAAO,GAAG,8BAA8B,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAC;AAChE,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,wBAAwB,CAAC,OAAe;IACtD,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,8BAA8B,CAAC;QAAE,OAAO,IAAI,CAAC;IACrE,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC;AAsBD,oFAAoF;AACpF,MAAM,UAAU,kBAAkB,CAAC,QAAuB;IACxD,OAAO,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;AACnD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG;;;;;;;;;;;gEAWe,CAAC;AAEjE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,0BAA0B,CAAC,GAAiB,EAAE,MAAyB;IACrF,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC/C,GAAG,CACD;2EACuE,EACvE,CAAC,qBAAqB,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CACjD,CAAC;IACF,GAAG,CACD;;kGAE8F,EAC9F,CAAC,qBAAqB,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CACjD,CAAC;IACF,GAAG,CACD;yEACqE,EACrE,CAAC,qBAAqB,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CACjD,CAAC;IACF,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC1C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1C,2FAA2F;IAC3F,2EAA2E;IAC3E,MAAM,YAAY,GAAG,CAAC,KAAa,EAAE,GAAW,EAAE,IAAY,EAAE,KAAa,EAAE,MAAgB,EAAE,EAAE;QACjG,MAAM,IAAI,GAAG,GAAG,CACd,UAAU,GAAG,YAAY,IAAI,iBAAiB,KAAK,UAAU,KAAK,SAAS,IAAI,UAAU,EACzF,CAAC,GAAG,MAAM,EAAE,8BAA8B,CAAC,CACT,CAAC;QACrC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,EAAE,GAAG,wBAAwB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC9C,IAAI,EAAE,KAAK,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBACnC,GAAG,CAAC,UAAU,KAAK,QAAQ,IAAI,cAAc,GAAG,MAAM,EAAE,CAAC,qBAAqB,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;YAC5F,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,YAAY,CAAC,wBAAwB,EAAE,IAAI,EAAE,SAAS,EAAE,qCAAqC,EAAE;QAC7F,MAAM,CAAC,QAAQ;QACf,MAAM,CAAC,OAAO;KACf,CAAC,CAAC;IACH,YAAY,CAAC,kBAAkB,EAAE,aAAa,EAAE,cAAc,EAAE,wDAAwD,EAAE;QACxH,MAAM,CAAC,QAAQ;KAChB,CAAC,CAAC;AACL,CAAC"}

package/dist/timeline.d.ts

@@ -1,4 +1,4 @@
-import { type EntityRef, type EventId, type HistoryEntry, type CauseChain, type EffectsTree, type InvocationEvents, type DeadLetter, type ListPage, type Page, type TimelineEntry, type EventFacetInput, type EventFacetResult } from '@substrat-run/contracts';
+import { type EntityRef, type EventId, type HistoryEntry, type CauseChain, type EffectsTree, type InvocationEvents, type DeadLetter, type ListPage, type Page, type TimelineEntry, type ScopeTimelineEntry, type ScopeHistoryEntry, type EventFacetInput, type EventFacetResult } from '@substrat-run/contracts';
 import type { ScopedSql } from './scope-host.js';
 /**
  * Reading an entity's history out of the spine (#800).
@@ -98,6 +98,70 @@ export declare function readTimeline(ctx: TimelineReader, entity: EntityRef, pag
  * can disclose what an event said.
  */
 export declare function readHistory(ctx: TimelineReader, entity: EntityRef, page?: ListPage): Page<HistoryEntry>;
+/**
+ * The page params of a scope-wide walk (#1582): a `ListPage` whose `cursor` is the
+ * WATERMARK, plus one optional equality filter.
+ *
+ * `entityType` narrows the walk to events about one kind of entity — what an offline
+ * mirror of one entity type, or a projection over it, wants. Equality only, for K-41's
+ * reason: a richer filter is where a page read becomes a query language. A read that
+ * needs more is an operation with its own name.
+ */
+export interface ScopeWalkPage extends ListPage {
+    entityType?: string;
+}
+/**
+ * Everything that happened in this scope, since a watermark — the envelope only
+ * (#1582).
+ *
+ * `readTimeline` with the entity unpinned, and each entry carrying the `entity` it
+ * was about. This is the read a projection IS, and an offline mirror under another
+ * name: a per-scope monotonic sequence resumed from a client-held watermark.
+ *
+ * **The watermark is the `id` of the last entry you APPLIED, not `nextCursor`.**
+ * `nextCursor` is null on a short page, which means "caught up", and a caller that
+ * stored it would restart from the beginning on its next poll. Keep the last id;
+ * pass it back as `cursor`; the walk is exclusive, so nothing is applied twice.
+ *
+ * ## It checks nothing — and here that is most load-bearing
+ *
+ * Same posture as `readTimeline`, stated again because the stakes are higher: a
+ * per-entity read can be gated by a per-entity check, but THIS read returns events
+ * about every entity in the scope, including ones the caller may not read. So the
+ * caller's check must be one that justifies seeing all of them — a SCOPE-WIDE
+ * permission, checked first:
+ *
+ * ```ts
+ * assertAllowed(await ctx.check(AUDIT.read));          // no entity: the whole scope
+ * return readScopeTimeline(ctx, { ...input, entityType: 'workorder' });
+ * ```
+ *
+ * A caller who can only justify SOME entities must not use this read and filter
+ * afterwards without saying so: post-filtering with `ctx.check(perm, entry.entity)`
+ * per row is legitimate, but it changes the page size (a page of 20 can come back
+ * with 3) and the cursor must then advance by the last row EXAMINED, not the last
+ * row returned — see callout's `portal-orders` for that shape. A walk that only
+ * visits what the caller may read is a different read with a different cost, and
+ * is deliberately not this one.
+ */
+export declare function readScopeTimeline(ctx: TimelineReader, page?: ScopeWalkPage): Page<ScopeTimelineEntry>;
+/**
+ * Everything that happened in this scope, since a watermark — with what was said
+ * and under what authority (#1582).
+ *
+ * `readHistory` with the entity unpinned. Every field decodes exactly as it does
+ * there, through the same mapper, so the nulls keep their meanings: `payload` null
+ * after a shred (the row stays), `authorization` null for a row written before
+ * K-34, `operation` null for a consumer emit or a pre-column row, `version` from
+ * the outbox COLUMN and never the envelope. A hand-rolled scope walk reads every
+ * one of those as missing data; that is the reason this exists.
+ *
+ * Same watermark rule as `readScopeTimeline` — keep the last applied `id`, not
+ * `nextCursor`. Same permission posture, with the payload making it heavier still:
+ * this read discloses what every event in the scope SAID, so the caller's scope-wide
+ * check comes first, and nothing here makes it for them.
+ */
+export declare function readScopeHistory(ctx: TimelineReader, page?: ScopeWalkPage): Page<ScopeHistoryEntry>;
 /**
  * Walk one event's causal chain backwards (#1237) — "this invoice exists; what
  * started that?"

package/dist/timeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"timeline.d.ts","sourceRoot":"","sources":["../src/timeline.ts"],"names":[],"mappings":"AAAA,OAAO,EAOL,KAAK,SAAS,EACd,KAAK,OAAO,EAEZ,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,WAAW,EAEhB,KAAK,gBAAgB,EACrB,KAAK,UAAU,EAMf,KAAK,QAAQ,EACb,KAAK,IAAI,EACT,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACtB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,KAAK,EAAE,SAAS,EAAY,MAAM,iBAAiB,CAAC;AAE3D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAEH,oFAAoF;AACpF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;CACxC;AAmID;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAC1B,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,SAAS,EACjB,IAAI,CAAC,EAAE,QAAQ,GACd,IAAI,CAAC,aAAa,CAAC,CAKrB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,WAAW,CACzB,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,SAAS,EACjB,IAAI,CAAC,EAAE,QAAQ,GACd,IAAI,CAAC,YAAY,CAAC,CAKpB;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,OAAO,EAChB,QAAQ,SAAK,GACZ,UAAU,CAiEZ;AAkDD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,OAAO,EAChB,QAAQ,SAAK,GACZ,WAAW,CAoFb;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,cAAc,EACnB,YAAY,EAAE,MAAM,EACpB,KAAK,SAAM,GACV,gBAAgB,CAOlB;AA+DD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,GAAG,QAAQ,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAwChH;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,eAAe,GAAG,gBAAgB,CA6EzF"}
+{"version":3,"file":"timeline.d.ts","sourceRoot":"","sources":["../src/timeline.ts"],"names":[],"mappings":"AAAA,OAAO,EAQL,KAAK,SAAS,EACd,KAAK,OAAO,EAEZ,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,WAAW,EAEhB,KAAK,gBAAgB,EACrB,KAAK,UAAU,EAMf,KAAK,QAAQ,EACb,KAAK,IAAI,EACT,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACtB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,KAAK,EAAE,SAAS,EAAY,MAAM,iBAAiB,CAAC;AAE3D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAEH,oFAAoF;AACpF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;CACxC;AAmID;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAC1B,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,SAAS,EACjB,IAAI,CAAC,EAAE,QAAQ,GACd,IAAI,CAAC,aAAa,CAAC,CAKrB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,WAAW,CACzB,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,SAAS,EACjB,IAAI,CAAC,EAAE,QAAQ,GACd,IAAI,CAAC,YAAY,CAAC,CAKpB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAc,SAAQ,QAAQ;IAC7C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AA4ED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,cAAc,EACnB,IAAI,CAAC,EAAE,aAAa,GACnB,IAAI,CAAC,kBAAkB,CAAC,CAS1B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,cAAc,EACnB,IAAI,CAAC,EAAE,aAAa,GACnB,IAAI,CAAC,iBAAiB,CAAC,CAazB;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,OAAO,EAChB,QAAQ,SAAK,GACZ,UAAU,CAiEZ;AAkDD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,OAAO,EAChB,QAAQ,SAAK,GACZ,WAAW,CAoFb;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,cAAc,EACnB,YAAY,EAAE,MAAM,EACpB,KAAK,SAAM,GACV,gBAAgB,CAOlB;AA+DD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,GAAG,QAAQ,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAwChH;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,eAAe,GAAG,gBAAgB,CA6EzF"}