@substrat-run/kernel 0.134.0 → 0.136.0

package/dist/async-invocation-log.d.ts

@@ -0,0 +1,61 @@
+import type { InvocationLevel } from '@substrat-run/contracts/invocation-record';
+import { type AsyncInvocationKind, type AsyncOutcome, type InvocationLogLine } from './invocation-log.js';
+import type { EmittedReport } from './scope-host.js';
+/** One unit of async work, as the host saw it end. */
+export interface AsyncUnit {
+    kind: AsyncInvocationKind;
+    tenantId: string;
+    scopeId: string;
+    /**
+     * The id the unit's `ctx.log` lines and the line itself share. The call's own id when the
+     * unit ran in a call's tail, so the call's drill-down shows it; otherwise one minted for
+     * the unit ({@link asyncInvocationId}).
+     */
+    invocationId: string;
+    /** A consumer's name (its module, or `executor:<id>`), or a schedule's operation. */
+    operation: string;
+    /** `Date.now()` when the unit started — host code, so the real clock. */
+    startedAt: number;
+    outcome: Exclude<AsyncOutcome, 'suppressed'>;
+    /** The handler threw. Only its `errorCode` is kept; see the header. */
+    error?: unknown;
+    eventType?: string;
+    eventId?: string;
+    attempt?: number;
+    dueAt?: string | null;
+    latenessMs?: number | null;
+    /** Who the work ran as. A consumer and a schedule run as `system`; an import as its peer. */
+    principalKind?: string;
+    emitted?: EmittedReport;
+    versionId?: string | null;
+}
+/** Where a host sends an async line. The default writes it to the runtime's console. */
+export type InvocationLineSink = (line: InvocationLogLine) => void;
+/** The default sink: one JSON line, as the request line is written. */
+export declare const consoleInvocationLineSink: InvocationLineSink;
+/** The most unit lines one pass writes before it starts counting instead. */
+export declare const ASYNC_LINES_PER_PASS = 100;
+/**
+ * The level of an async unit. A thrown handler is an error whatever happens next — it broke,
+ * retry or not. A unit that ended without its handler doing the work — dead-lettered without
+ * a throw, held inert on a copy, refused by a schedule — is a warning: nothing broke, and it
+ * is still not success. Everything else is info.
+ */
+export declare function asyncLevelOf(outcome: AsyncOutcome, threw: boolean): InvocationLevel;
+/** The invocation id for a unit: the call it ran in, or a fresh one. */
+export declare function asyncInvocationId(callId: string | null | undefined): string;
+/** The line for one unit — through the request line's own builder. */
+export declare function asyncInvocationLine(unit: AsyncUnit): InvocationLogLine;
+/** One pass's writer: the cap, and the line that stands in for what the cap withheld. */
+export interface AsyncLinePass {
+    /** Write a unit's line, or count it once the pass is over its cap. Never throws. */
+    write(unit: AsyncUnit): void;
+    /** Write the `suppressed` line, if anything was withheld. Call once, when the pass ends. */
+    end(): void;
+}
+/**
+ * Open a pass. Every write is swallowed on failure: a line that cannot be written is one
+ * missing line, never a failed delivery — the delivery has already been journaled.
+ */
+export declare function asyncLinePass(sink?: InvocationLineSink, cap?: number): AsyncLinePass;
+//# sourceMappingURL=async-invocation-log.d.ts.map

package/dist/async-invocation-log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"async-invocation-log.d.ts","sourceRoot":"","sources":["../src/async-invocation-log.ts"],"names":[],"mappings":"AAiDA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2CAA2C,CAAC;AAEjF,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAErD,sDAAsD;AACtD,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,mBAAmB,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB,qFAAqF;IACrF,SAAS,EAAE,MAAM,CAAC;IAClB,yEAAyE;IACzE,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;IAC7C,uEAAuE;IACvE,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,6FAA6F;IAC7F,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,wFAAwF;AACxF,MAAM,MAAM,kBAAkB,GAAG,CAAC,IAAI,EAAE,iBAAiB,KAAK,IAAI,CAAC;AAKnE,uEAAuE;AACvE,eAAO,MAAM,yBAAyB,EAAE,kBAAgE,CAAC;AAEzG,6EAA6E;AAC7E,eAAO,MAAM,oBAAoB,MAAM,CAAC;AAExC;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,GAAG,eAAe,CAInF;AAED,wEAAwE;AACxE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAE3E;AAED,sEAAsE;AACtE,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,SAAS,GAAG,iBAAiB,CAyBtE;AAED,yFAAyF;AACzF,MAAM,WAAW,aAAa;IAC5B,oFAAoF;IACpF,KAAK,CAAC,IAAI,EAAE,SAAS,GAAG,IAAI,CAAC;IAC7B,4FAA4F;IAC5F,GAAG,IAAI,IAAI,CAAC;CACb;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,IAAI,GAAE,kBAA8C,EACpD,GAAG,GAAE,MAA6B,GACjC,aAAa,CA6Cf"}

package/dist/async-invocation-log.js

@@ -0,0 +1,149 @@
+/**
+ * One invocation line per unit of ASYNC work the scope host runs (#1901): a consumer
+ * delivery (a module consumer, an executor, an imported event's handler) and a schedule run.
+ *
+ * ## Why the scope host writes it
+ *
+ * A request's line is written by the platform's entry around the worker's `fetch` (#1893),
+ * and that entry trusts a tenant only from the router's verified assertion. A delivery or a
+ * sweep pass carries none, so before this a consumer that failed every attempt was visible
+ * only as a dead-letter count. The scope host needs no assertion: it runs the dispatch, for
+ * a scope it was asked about by tenant, so it knows the tenant, the scope, the consumer or
+ * schedule, the event, the attempt and the outcome first-hand.
+ *
+ * ## Same line, one more field
+ *
+ * The line is the request line's shape, built by the same `invocationLine`, plus `kind` and
+ * the fields only async work has. Readers that knew the request line read this one without
+ * change: the level histogram, the operation facet and the patterns all count it, and a
+ * reader that treats a missing `kind` as `request` keeps every older line's meaning.
+ *
+ * ## Ids, names and codes — nothing else
+ *
+ * No payload, no error message, no stack: a handler's error text can quote the event it
+ * failed on, and the log store is read by a wider audience than the scope's own data. The
+ * error stays where it already is, on the delivery journal row the line's `eventId` names.
+ * The kernel's `errorCode` of a thrown error is the one thing taken from it. And no entity
+ * id either: a schedule's emitted report names the entities it touched, and an entity id is
+ * whatever the vertical chose — an email address is a valid one. The line keeps the count
+ * and the declared event types.
+ *
+ * Field by field: `tenantId`, `scopeId`, `invocationId`, `eventId` are platform-minted ids;
+ * `operation` is a declared consumer, executor or schedule name; `eventType` and
+ * `eventTypes` are declared types; `problemCode` is the kernel's closed `errorCode`
+ * vocabulary; `principalKind`, `outcome` and `kind` are closed sets; the rest are numbers
+ * and times.
+ *
+ * ## Bounded
+ *
+ * A pass writes at most {@link ASYNC_LINES_PER_PASS} unit lines. Past that it writes one
+ * `suppressed` line counting what it withheld PER `<kind>:<outcome>`, so a storm of
+ * dead-letters is named in the line that stands in for it, never averaged into a total.
+ *
+ * ## Ships with the vertical
+ *
+ * This is the scope host's code, which a vertical bundles. A vertical writes these lines
+ * from the release of its adapter that has them — not from the platform's deploy, unlike the
+ * request line's wrapper (#1893).
+ */
+import { errorCodeOf } from '@substrat-run/contracts';
+import { ulid } from './ulid.js';
+import { invocationLine, } from './invocation-log.js';
+/** The default sink: one JSON line, as the request line is written. */
+export const consoleInvocationLineSink = (line) => console.log(JSON.stringify(line));
+/** The most unit lines one pass writes before it starts counting instead. */
+export const ASYNC_LINES_PER_PASS = 100;
+/**
+ * The level of an async unit. A thrown handler is an error whatever happens next — it broke,
+ * retry or not. A unit that ended without its handler doing the work — dead-lettered without
+ * a throw, held inert on a copy, refused by a schedule — is a warning: nothing broke, and it
+ * is still not success. Everything else is info.
+ */
+export function asyncLevelOf(outcome, threw) {
+    if (threw)
+        return 'error';
+    if (outcome === 'dead-lettered' || outcome === 'inert' || outcome === 'failed')
+        return 'warn';
+    return 'info';
+}
+/** The invocation id for a unit: the call it ran in, or a fresh one. */
+export function asyncInvocationId(callId) {
+    return callId ?? ulid();
+}
+/** The line for one unit — through the request line's own builder. */
+export function asyncInvocationLine(unit) {
+    const threw = unit.error !== undefined;
+    return invocationLine({
+        kind: unit.kind,
+        tenantId: unit.tenantId,
+        scopeId: unit.scopeId,
+        invocationId: unit.invocationId,
+        threw,
+        durationMs: Math.max(0, Date.now() - unit.startedAt),
+        level: asyncLevelOf(unit.outcome, threw),
+        operation: unit.operation,
+        problemCode: threw ? (errorCodeOf(unit.error) ?? null) : null,
+        principalKind: unit.principalKind ?? 'system',
+        // The count and the declared event types only: never the entities, whose ids are the
+        // vertical's data (see the header).
+        ...(unit.emitted ? { emitted: unit.emitted } : {}),
+        withEntities: false,
+        versionId: unit.versionId ?? null,
+        async: {
+            outcome: unit.outcome,
+            ...(unit.kind === 'consumer'
+                ? { eventType: unit.eventType ?? null, eventId: unit.eventId ?? null, attempt: unit.attempt ?? null }
+                : { dueAt: unit.dueAt ?? null, latenessMs: unit.latenessMs ?? null }),
+        },
+    });
+}
+/**
+ * Open a pass. Every write is swallowed on failure: a line that cannot be written is one
+ * missing line, never a failed delivery — the delivery has already been journaled.
+ */
+export function asyncLinePass(sink = consoleInvocationLineSink, cap = ASYNC_LINES_PER_PASS) {
+    let written = 0;
+    let withheld = null;
+    const safe = (line) => {
+        try {
+            sink(line());
+        }
+        catch {
+            /* see above */
+        }
+    };
+    return {
+        write(unit) {
+            if (written < cap) {
+                written += 1;
+                safe(() => asyncInvocationLine(unit));
+                return;
+            }
+            withheld ??= { first: unit, levels: new Set(), by: {}, n: 0 };
+            const key = `${unit.kind}:${unit.outcome}`;
+            withheld.by[key] = (withheld.by[key] ?? 0) + 1;
+            withheld.levels.add(asyncLevelOf(unit.outcome, unit.error !== undefined));
+            withheld.n += 1;
+        },
+        end() {
+            if (!withheld)
+                return;
+            const w = withheld;
+            withheld = null;
+            safe(() => invocationLine({
+                kind: w.first.kind,
+                tenantId: w.first.tenantId,
+                scopeId: w.first.scopeId,
+                invocationId: w.first.invocationId,
+                threw: false,
+                durationMs: 0,
+                // The worst level withheld, so the histogram still shows an error pass as one.
+                level: w.levels.has('error') ? 'error' : w.levels.has('warn') ? 'warn' : 'info',
+                principalKind: w.first.principalKind ?? 'system',
+                versionId: w.first.versionId ?? null,
+                async: { outcome: 'suppressed', suppressed: w.n, suppressedBy: w.by },
+            }));
+        },
+    };
+}
+//# sourceMappingURL=async-invocation-log.js.map

package/dist/async-invocation-log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"async-invocation-log.js","sourceRoot":"","sources":["../src/async-invocation-log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,cAAc,GAIf,MAAM,qBAAqB,CAAC;AAsC7B,uEAAuE;AACvE,MAAM,CAAC,MAAM,yBAAyB,GAAuB,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAEzG,6EAA6E;AAC7E,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAExC;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,OAAqB,EAAE,KAAc;IAChE,IAAI,KAAK;QAAE,OAAO,OAAO,CAAC;IAC1B,IAAI,OAAO,KAAK,eAAe,IAAI,OAAO,KAAK,OAAO,IAAI,OAAO,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IAC9F,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,iBAAiB,CAAC,MAAiC;IACjE,OAAO,MAAM,IAAI,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,mBAAmB,CAAC,IAAe;IACjD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC;IACvC,OAAO,cAAc,CAAC;QACpB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,KAAK;QACL,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;QACpD,KAAK,EAAE,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC;QACxC,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;QAC7D,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,QAAQ;QAC7C,qFAAqF;QACrF,oCAAoC;QACpC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,YAAY,EAAE,KAAK;QACnB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;QACjC,KAAK,EAAE;YACL,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU;gBAC1B,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,IAAI,EAAE;gBACrG,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;SACxE;KACF,CAAC,CAAC;AACL,CAAC;AAUD;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,IAAI,GAAuB,yBAAyB,EACpD,GAAG,GAAW,oBAAoB;IAElC,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,QAAQ,GACV,IAAI,CAAC;IACP,MAAM,IAAI,GAAG,CAAC,IAA6B,EAAE,EAAE;QAC7C,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACf,CAAC;QAAC,MAAM,CAAC;YACP,eAAe;QACjB,CAAC;IACH,CAAC,CAAC;IACF,OAAO;QACL,KAAK,CAAC,IAAI;YACR,IAAI,OAAO,GAAG,GAAG,EAAE,CAAC;gBAClB,OAAO,IAAI,CAAC,CAAC;gBACb,IAAI,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;gBACtC,OAAO;YACT,CAAC;YACD,QAAQ,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;YAC9D,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC3C,QAAQ,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YAC/C,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC;YAC1E,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;QACD,GAAG;YACD,IAAI,CAAC,QAAQ;gBAAE,OAAO;YACtB,MAAM,CAAC,GAAG,QAAQ,CAAC;YACnB,QAAQ,GAAG,IAAI,CAAC;YAChB,IAAI,CAAC,GAAG,EAAE,CACR,cAAc,CAAC;gBACb,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI;gBAClB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ;gBAC1B,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO;gBACxB,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY;gBAClC,KAAK,EAAE,KAAK;gBACZ,UAAU,EAAE,CAAC;gBACb,+EAA+E;gBAC/E,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;gBAC/E,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,IAAI,QAAQ;gBAChD,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,IAAI,IAAI;gBACpC,KAAK,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE;aACtE,CAAC,CACH,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/attachment-extractor.d.ts

@@ -38,8 +38,9 @@
  *
  * What the kernel cannot do from inside one isolate is STOP code that does not yield. A
  * synchronous loop holds the thread until it returns, timer or not; the abort is a request,
- * honoured by an extractor that checks its `signal` and yields between units of work (the
- * bundled parsers do, every 64 KiB). So the guarantee is: a cooperative extractor stops
+ * honoured by an extractor that checks its `signal` and yields a turn at least every
+ * `EXTRACTION_STRIDE` units of work (the bundled parsers do, every native search included).
+ * So the guarantee is: a cooperative extractor stops
  * promptly, an uncooperative one cannot get its late answer indexed, and only the runtime's
  * own CPU limit ends it sooner. A hard deadline on uncooperative code needs process or
  * isolate isolation — a host can provide it by running its extractors in a separate worker
@@ -48,6 +49,13 @@
  * broken parser, not from a hostile one, and the bundled parsers bound their own CPU by
  * construction (linear scans under fixed input caps — their package says how far).
  */
+/**
+ * How much work a cooperative extractor does between two checks of its `signal`: 256 Ki
+ * units, a unit being a character scanned or decoded, or a byte inflated or decoded. Part of
+ * the seam's contract rather than of any one parser, because it is what "stops promptly"
+ * means above — and the one number both sides of the seam cite.
+ */
+export declare const EXTRACTION_STRIDE: number;
 /**
  * The cancellation an extractor is handed — the runtime's own `AbortSignal`, typed here by the
  * one member the kernel promises: once `aborted` is true, nothing the extractor answers will be

package/dist/attachment-extractor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"attachment-extractor.d.ts","sourceRoot":"","sources":["../src/attachment-extractor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAQH;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED,yFAAyF;AACzF,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,6FAA6F;IAC7F,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,2FAA2F;IAC3F,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;CACnC;AAED;;;;GAIG;AACH,MAAM,MAAM,yBAAyB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnG;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,wFAAwF;IACxF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,4EAA4E;IAC5E,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;IACxD,OAAO,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAC;CAC9E;AAED,qFAAqF;AACrF,MAAM,MAAM,iBAAiB,GACzB;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,GAC1E;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACtC;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACzC;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnE,gFAAgF;AAChF,MAAM,WAAW,oBAAoB;IACnC,iFAAiF;IACjF,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,sEAAsE;IACtE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,uEAAuE;IACvE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;GAIG;AACH,eAAO,MAAM,8BAA8B,EAAE,oBAI5C,CAAC;AAEF,uGAAuG;AACvG,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAEtE;AAED,kDAAkD;AAClD,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,kFAAkF;AAClF,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,oBAAoB,GAAG,IAAI,CAM7E;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,SAAS,mBAAmB,EAAE,GAAG,IAAI,CAkB3F;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,IAAI,CAAC,mBAAmB,EAAE,eAAe,CAAC,EACrD,MAAM,EAAE,IAAI,CAAC,oBAAoB,EAAE,eAAe,CAAC,GAClD,MAAM,GAAG,IAAI,CASf;AAED,iGAAiG;AACjG,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,SAAS,mBAAmB,EAAE,EAC1C,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,GACf,mBAAmB,GAAG,SAAS,CAQjC;AAID;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAMjG;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAS3D;AAUD;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,mBAAmB,EAC9B,KAAK,EAAE;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,EAClE,MAAM,GAAE,oBAAqD,GAC5D,OAAO,CAAC,iBAAiB,CAAC,CAwD5B"}
+{"version":3,"file":"attachment-extractor.d.ts","sourceRoot":"","sources":["../src/attachment-extractor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAQH;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,QAAa,CAAC;AAE5C;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED,yFAAyF;AACzF,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,6FAA6F;IAC7F,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,2FAA2F;IAC3F,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;CACnC;AAED;;;;GAIG;AACH,MAAM,MAAM,yBAAyB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnG;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,wFAAwF;IACxF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,4EAA4E;IAC5E,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;IACxD,OAAO,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAC;CAC9E;AAED,qFAAqF;AACrF,MAAM,MAAM,iBAAiB,GACzB;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,GAC1E;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACtC;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACzC;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnE,gFAAgF;AAChF,MAAM,WAAW,oBAAoB;IACnC,iFAAiF;IACjF,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,sEAAsE;IACtE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,uEAAuE;IACvE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;GAIG;AACH,eAAO,MAAM,8BAA8B,EAAE,oBAI5C,CAAC;AAEF,uGAAuG;AACvG,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAEtE;AAED,kDAAkD;AAClD,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,kFAAkF;AAClF,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,oBAAoB,GAAG,IAAI,CAM7E;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,SAAS,mBAAmB,EAAE,GAAG,IAAI,CAkB3F;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,IAAI,CAAC,mBAAmB,EAAE,eAAe,CAAC,EACrD,MAAM,EAAE,IAAI,CAAC,oBAAoB,EAAE,eAAe,CAAC,GAClD,MAAM,GAAG,IAAI,CASf;AAED,iGAAiG;AACjG,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,SAAS,mBAAmB,EAAE,EAC1C,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,GACf,mBAAmB,GAAG,SAAS,CAQjC;AAID;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAMjG;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAS3D;AAeD;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,mBAAmB,EAC9B,KAAK,EAAE;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,EAClE,MAAM,GAAE,oBAAqD,GAC5D,OAAO,CAAC,iBAAiB,CAAC,CAwD5B"}

package/dist/attachment-extractor.js

@@ -38,8 +38,9 @@
  *
  * What the kernel cannot do from inside one isolate is STOP code that does not yield. A
  * synchronous loop holds the thread until it returns, timer or not; the abort is a request,
- * honoured by an extractor that checks its `signal` and yields between units of work (the
- * bundled parsers do, every 64 KiB). So the guarantee is: a cooperative extractor stops
+ * honoured by an extractor that checks its `signal` and yields a turn at least every
+ * `EXTRACTION_STRIDE` units of work (the bundled parsers do, every native search included).
+ * So the guarantee is: a cooperative extractor stops
  * promptly, an uncooperative one cannot get its late answer indexed, and only the runtime's
  * own CPU limit ends it sooner. A hard deadline on uncooperative code needs process or
  * isolate isolation — a host can provide it by running its extractors in a separate worker
@@ -48,6 +49,13 @@
  * broken parser, not from a hostile one, and the bundled parsers bound their own CPU by
  * construction (linear scans under fixed input caps — their package says how far).
  */
+/**
+ * How much work a cooperative extractor does between two checks of its `signal`: 256 Ki
+ * units, a unit being a character scanned or decoded, or a byte inflated or decoded. Part of
+ * the seam's contract rather than of any one parser, because it is what "stops promptly"
+ * means above — and the one number both sides of the seam cite.
+ */
+export const EXTRACTION_STRIDE = 256 * 1024;
 /**
  * The defaults. `maxTextBytes` is 512 KiB of UTF-8 — a few hundred pages of prose, and a
  * quarter of the ~2 MB a Durable Object row holds. 32 MiB of input is what a Worker can hold
@@ -159,7 +167,12 @@ export function normalizeExtractedText(text) {
         .replace(/\n{3,}/g, '\n\n')
         .trim();
 }
-/** One turn of the event loop — a macrotask, so a due timer runs before what follows. */
+/**
+ * One turn of the event loop — a macrotask, so a due timer runs before what follows. A
+ * `setTimeout` on purpose, not the cheaper `setImmediate` the parsers yield with: timers run in
+ * order of when they are due, so this one cannot run before a deadline that has already
+ * passed, whichever phase of the loop the extractor returned in. It runs once per extraction.
+ */
 const nextTurn = () => new Promise((resolve) => setTimeout(resolve, 0));
 const TIMED_OUT = Symbol('timed out');
 /** A recorded reason is short: an extractor's `failed` is cut, never trusted to be. */

package/dist/attachment-extractor.js.map

@@ -1 +1 @@
-{"version":3,"file":"attachment-extractor.js","sourceRoot":"","sources":["../src/attachment-extractor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAsEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAyB;IAClE,aAAa,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;IAC/B,YAAY,EAAE,GAAG,GAAG,IAAI;IACxB,SAAS,EAAE,MAAM;CAClB,CAAC;AAEF,uGAAuG;AACvG,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;AAC3E,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,WAAW,CAAC,WAAmB;IAC7C,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AAChE,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,0BAA0B,CAAC,MAA4B;IACrE,KAAK,MAAM,GAAG,IAAI,CAAC,eAAe,EAAE,cAAc,EAAE,WAAW,CAAU,EAAE,CAAC;QAC1E,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,oCAAoC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;QACzG,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,UAA0C;IACnF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,OAAO,CAAC,EAAE,IAAI,KAAK,QAAQ,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/E,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,uCAAuC,CAAC,CAAC;QACxG,CAAC;QACD,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,UAAU,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;YACvE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC,IAAI,qCAAqC,CAAC,CAAC;QACxF,CAAC;QACD,IAAI,CAAC,CAAC,aAAa,KAAK,SAAS,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC;YAC9E,MAAM,IAAI,KAAK,CACb,yBAAyB,CAAC,CAAC,IAAI,4BAA4B,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI;gBACpF,iCAAiC,CACpC,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC,IAAI,uBAAuB,CAAC,CAAC;QAC9F,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAY,EACZ,SAAqD,EACrD,MAAmD;IAEnD,IAAI,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;QACpC,OAAO,eAAe,IAAI,oBAAoB,MAAM,CAAC,aAAa,mBAAmB,CAAC;IACxF,CAAC;IACD,MAAM,QAAQ,GAAG,SAAS,CAAC,aAAa,CAAC;IACzC,IAAI,sBAAsB,CAAC,QAAQ,CAAC,IAAI,IAAI,GAAG,QAAQ,EAAE,CAAC;QACxD,OAAO,eAAe,IAAI,gCAAgC,QAAQ,mBAAmB,CAAC;IACxF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,yBAAyB,CACvC,UAA0C,EAC1C,WAAmB,EACnB,QAAgB;IAEhB,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QAC3B,IAAI,CAAC;YACH,OAAO,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,KAAK,IAAI,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC;AAE/B;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,QAAgB;IACzD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,KAAK,CAAC,MAAM,IAAI,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAChE,IAAI,GAAG,GAAG,QAAQ,CAAC;IACnB,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAE,GAAG,IAAI,CAAC,KAAK,IAAI;QAAE,GAAG,IAAI,CAAC,CAAC;IAC1D,OAAO,EAAE,IAAI,EAAE,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAC5F,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,OAAO,IAAI;SACR,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC;QACxB,iEAAiE;SAChE,OAAO,CAAC,wDAAwD,EAAE,EAAE,CAAC;SACrE,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC;SACxB,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC;SACxB,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC;SAC1B,IAAI,EAAE,CAAC;AACZ,CAAC;AAED,yFAAyF;AACzF,MAAM,QAAQ,GAAG,GAAkB,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;AAEvF,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;AAEtC,uFAAuF;AACvF,MAAM,UAAU,GAAG,GAAG,CAAC;AAEvB;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,SAA8B,EAC9B,KAAkE,EAClE,MAAM,GAAyB,8BAA8B;IAE7D,MAAM,MAAM,GAAG,CAAC,MAAc,EAAqB,EAAE,CAAC,CAAC;QACrD,MAAM,EAAE,QAAQ;QAChB,SAAS,EAAE,SAAS,CAAC,IAAI;QACzB,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC;KACpC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,CAAC,cAAc,SAAS,CAAC,IAAI,2BAA2B,MAAM,CAAC,SAAS,KAAK,CAAC,CAAC;IACrG,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,SAAS,GAAsC,GAAG,EAAE,GAAE,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;QAC5B,QAAQ,GAAG,IAAI,CAAC;QAChB,UAAU,CAAC,KAAK,EAAE,CAAC;QACnB,SAAS,CAAC,SAAS,CAAC,CAAC;IACvB,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACrB,0FAA0F;IAC1F,2FAA2F;IAC3F,kDAAkD;IAClD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CACvC,SAAS,CAAC,OAAO,CAAC,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAC9F,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACrB,IAAI,MAAe,CAAC;IACpB,IAAI,KAAK,GAAY,SAAS,CAAC;IAC/B,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,OAAO,CAAmB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACzG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,QAAQ,GAAG,IAAI,CAAC;QAChB,KAAK,GAAG,GAAG,CAAC;IACd,CAAC;IACD,2FAA2F;IAC3F,yFAAyF;IACzF,IAAI,CAAC,QAAQ;QAAE,MAAM,QAAQ,EAAE,CAAC;IAChC,YAAY,CAAC,KAAK,CAAC,CAAC;IACpB,IAAI,QAAQ,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IACrD,IAAI,QAAQ,EAAE,CAAC;QACb,sFAAsF;QACtF,MAAM,IAAI,GAAG,KAAK,YAAY,KAAK,IAAI,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACzG,OAAO,MAAM,CAAC,cAAc,SAAS,CAAC,IAAI,YAAY,IAAI,GAAG,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,CAAC,GAAG,MAAwC,CAAC;IACnD,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACnH,IACE,CAAC,KAAK,IAAI;QACV,OAAO,CAAC,KAAK,QAAQ;QACrB,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;QAC1B,iFAAiF;QACjF,QAAQ,IAAI,CAAC;QACb,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,EAC/D,CAAC;QACD,OAAO,MAAM,CAAC,cAAc,SAAS,CAAC,IAAI,iCAAiC,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,GAAG,GAAG,YAAY,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IAC9E,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC;IACjF,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;AAC5H,CAAC"}
+{"version":3,"file":"attachment-extractor.js","sourceRoot":"","sources":["../src/attachment-extractor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAQH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,GAAG,IAAI,CAAC;AAgE5C;;;;GAIG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAyB;IAClE,aAAa,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;IAC/B,YAAY,EAAE,GAAG,GAAG,IAAI;IACxB,SAAS,EAAE,MAAM;CAClB,CAAC;AAEF,uGAAuG;AACvG,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;AAC3E,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,WAAW,CAAC,WAAmB;IAC7C,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AAChE,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,0BAA0B,CAAC,MAA4B;IACrE,KAAK,MAAM,GAAG,IAAI,CAAC,eAAe,EAAE,cAAc,EAAE,WAAW,CAAU,EAAE,CAAC;QAC1E,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,oCAAoC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;QACzG,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,UAA0C;IACnF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,OAAO,CAAC,EAAE,IAAI,KAAK,QAAQ,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/E,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,uCAAuC,CAAC,CAAC;QACxG,CAAC;QACD,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,UAAU,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;YACvE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC,IAAI,qCAAqC,CAAC,CAAC;QACxF,CAAC;QACD,IAAI,CAAC,CAAC,aAAa,KAAK,SAAS,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC;YAC9E,MAAM,IAAI,KAAK,CACb,yBAAyB,CAAC,CAAC,IAAI,4BAA4B,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI;gBACpF,iCAAiC,CACpC,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC,IAAI,uBAAuB,CAAC,CAAC;QAC9F,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAY,EACZ,SAAqD,EACrD,MAAmD;IAEnD,IAAI,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;QACpC,OAAO,eAAe,IAAI,oBAAoB,MAAM,CAAC,aAAa,mBAAmB,CAAC;IACxF,CAAC;IACD,MAAM,QAAQ,GAAG,SAAS,CAAC,aAAa,CAAC;IACzC,IAAI,sBAAsB,CAAC,QAAQ,CAAC,IAAI,IAAI,GAAG,QAAQ,EAAE,CAAC;QACxD,OAAO,eAAe,IAAI,gCAAgC,QAAQ,mBAAmB,CAAC;IACxF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,yBAAyB,CACvC,UAA0C,EAC1C,WAAmB,EACnB,QAAgB;IAEhB,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QAC3B,IAAI,CAAC;YACH,OAAO,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,KAAK,IAAI,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC;AAE/B;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,QAAgB;IACzD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,KAAK,CAAC,MAAM,IAAI,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAChE,IAAI,GAAG,GAAG,QAAQ,CAAC;IACnB,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAE,GAAG,IAAI,CAAC,KAAK,IAAI;QAAE,GAAG,IAAI,CAAC,CAAC;IAC1D,OAAO,EAAE,IAAI,EAAE,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAC5F,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,OAAO,IAAI;SACR,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC;QACxB,iEAAiE;SAChE,OAAO,CAAC,wDAAwD,EAAE,EAAE,CAAC;SACrE,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC;SACxB,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC;SACxB,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC;SAC1B,IAAI,EAAE,CAAC;AACZ,CAAC;AAED;;;;;GAKG;AACH,MAAM,QAAQ,GAAG,GAAkB,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;AAEvF,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;AAEtC,uFAAuF;AACvF,MAAM,UAAU,GAAG,GAAG,CAAC;AAEvB;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,SAA8B,EAC9B,KAAkE,EAClE,MAAM,GAAyB,8BAA8B;IAE7D,MAAM,MAAM,GAAG,CAAC,MAAc,EAAqB,EAAE,CAAC,CAAC;QACrD,MAAM,EAAE,QAAQ;QAChB,SAAS,EAAE,SAAS,CAAC,IAAI;QACzB,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC;KACpC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,CAAC,cAAc,SAAS,CAAC,IAAI,2BAA2B,MAAM,CAAC,SAAS,KAAK,CAAC,CAAC;IACrG,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,SAAS,GAAsC,GAAG,EAAE,GAAE,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;QAC5B,QAAQ,GAAG,IAAI,CAAC;QAChB,UAAU,CAAC,KAAK,EAAE,CAAC;QACnB,SAAS,CAAC,SAAS,CAAC,CAAC;IACvB,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACrB,0FAA0F;IAC1F,2FAA2F;IAC3F,kDAAkD;IAClD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CACvC,SAAS,CAAC,OAAO,CAAC,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAC9F,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACrB,IAAI,MAAe,CAAC;IACpB,IAAI,KAAK,GAAY,SAAS,CAAC;IAC/B,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,OAAO,CAAmB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACzG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,QAAQ,GAAG,IAAI,CAAC;QAChB,KAAK,GAAG,GAAG,CAAC;IACd,CAAC;IACD,2FAA2F;IAC3F,yFAAyF;IACzF,IAAI,CAAC,QAAQ;QAAE,MAAM,QAAQ,EAAE,CAAC;IAChC,YAAY,CAAC,KAAK,CAAC,CAAC;IACpB,IAAI,QAAQ,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IACrD,IAAI,QAAQ,EAAE,CAAC;QACb,sFAAsF;QACtF,MAAM,IAAI,GAAG,KAAK,YAAY,KAAK,IAAI,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACzG,OAAO,MAAM,CAAC,cAAc,SAAS,CAAC,IAAI,YAAY,IAAI,GAAG,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,CAAC,GAAG,MAAwC,CAAC;IACnD,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACnH,IACE,CAAC,KAAK,IAAI;QACV,OAAO,CAAC,KAAK,QAAQ;QACrB,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;QAC1B,iFAAiF;QACjF,QAAQ,IAAI,CAAC;QACb,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,EAC/D,CAAC;QACD,OAAO,MAAM,CAAC,cAAc,SAAS,CAAC,IAAI,iCAAiC,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,GAAG,GAAG,YAAY,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IAC9E,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC;IACjF,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;AAC5H,CAAC"}

package/dist/base64url.d.ts

@@ -0,0 +1,6 @@
+/** The alphabet, whole: what `toBase64url` can emit and `fromBase64url` will accept. */
+export declare const BASE64URL: RegExp;
+export declare function toBase64url(bytes: Uint8Array): string;
+/** The bytes, or `undefined` for a string outside the alphabet or of an impossible length. */
+export declare function fromBase64url(s: string): Uint8Array | undefined;
+//# sourceMappingURL=base64url.d.ts.map

package/dist/base64url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base64url.d.ts","sourceRoot":"","sources":["../src/base64url.ts"],"names":[],"mappings":"AAOA,wFAAwF;AACxF,eAAO,MAAM,SAAS,QAAqB,CAAC;AAE5C,wBAAgB,WAAW,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAIrD;AAED,8FAA8F;AAC9F,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAM/D"}

package/dist/base64url.js

@@ -0,0 +1,19 @@
+/** The alphabet, whole: what `toBase64url` can emit and `fromBase64url` will accept. */
+export const BASE64URL = /^[A-Za-z0-9_-]*$/;
+export function toBase64url(bytes) {
+    let s = '';
+    for (const b of bytes)
+        s += String.fromCharCode(b);
+    return btoa(s).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+/** The bytes, or `undefined` for a string outside the alphabet or of an impossible length. */
+export function fromBase64url(s) {
+    if (!BASE64URL.test(s) || s.length % 4 === 1)
+        return undefined;
+    const raw = atob(s.replace(/-/g, '+').replace(/_/g, '/') + '='.repeat((4 - (s.length % 4)) % 4));
+    const out = new Uint8Array(raw.length);
+    for (let i = 0; i < raw.length; i++)
+        out[i] = raw.charCodeAt(i);
+    return out;
+}
+//# sourceMappingURL=base64url.js.map

package/dist/base64url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base64url.js","sourceRoot":"","sources":["../src/base64url.ts"],"names":[],"mappings":"AAOA,wFAAwF;AACxF,MAAM,CAAC,MAAM,SAAS,GAAG,kBAAkB,CAAC;AAE5C,MAAM,UAAU,WAAW,CAAC,KAAiB;IAC3C,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACnD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,aAAa,CAAC,CAAS;IACrC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACjG,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/capability.d.ts

@@ -1,4 +1,4 @@
-import { type BecomeCapabilityInput, type CapabilityExchange, type CapabilityFilter, type CapabilityId, type CapabilityMintInput, type CapabilityRecord, type CheckSubject, type Decision, type DomainEventInput, type EntityRef, type Instant, type MintedCapability, type Node, type PermissionKey, type PlatformActorId, type PrincipalId } from '@substrat-run/contracts';
+import { type BecomeCapabilityInput, type CapabilityExchange, type CapabilityFilter, type CapabilityId, type CapabilityMintInput, type CapabilityPage, type CapabilityRecord, type CheckSubject, type Decision, type DomainEventInput, type EntityRef, type Instant, type MintedCapability, type Node, type PermissionKey, type PlatformActorId, type PrincipalId } from '@substrat-run/contracts';
 import { PermissionDenied } from './permission-checker.js';
 import type { ScopedSql, SqlValue } from './scope-host.js';
 /**
@@ -7,6 +7,8 @@ import type { ScopedSql, SqlValue } from './scope-host.js';
  * self-host builds and the shape production builds cannot part company.
  */
 export declare const CAPABILITY_DDL = "\n  CREATE TABLE IF NOT EXISTS _substrat_capabilities (\n    id TEXT PRIMARY KEY,\n    -- #1672: SHA-256 hex of the secret. The secret itself is stored NOWHERE \u2014 it leaves\n    -- the kernel once, in the mint's return value, and a lookup is this indexed equality.\n    token_hash TEXT NOT NULL UNIQUE,\n    -- 'act': the holder acts AS the capability ({ capability } on the spine), bounded by\n    -- entity + permissions (+ operations). 'become': exchanging it yields `principal`.\n    mode TEXT NOT NULL,\n    label TEXT,\n    entity_type TEXT,\n    entity_id TEXT,\n    -- JSON array of permission keys (act). The capability's whole authority: no\n    -- `capability:` tuple is ever written, so none can be forged through the tuple table.\n    permissions TEXT,\n    -- JSON array of operation names, or NULL = any operation the keys allow (act).\n    operations TEXT,\n    principal TEXT,\n    -- JSON capabilityAuthor: a principal id (a module minted it, and its authority is\n    -- re-checked on every use) or {\"platform\": \u2026} (HostAdmin minted it).\n    minted_by TEXT NOT NULL,\n    minted_at TEXT NOT NULL,\n    expires_at TEXT,\n    -- NULL = unlimited. A use is an EXCHANGE of the secret, never an invocation.\n    max_uses INTEGER,\n    uses INTEGER NOT NULL DEFAULT 0,\n    last_used_at TEXT,\n    -- Tombstone, never a delete: a capability that once admitted someone is evidence\n    -- of why they were admitted (K-4, K-21).\n    revoked_at TEXT,\n    revoked_by TEXT\n  );\n  CREATE INDEX IF NOT EXISTS _substrat_capabilities_entity\n    ON _substrat_capabilities (entity_type, entity_id);\n  -- #1672: what an exchange hands out instead of the secret \u2014 a session token, of which\n  -- again only the hash is kept. Each session acts as its capability until the earlier of\n  -- its own expiry and the capability's; the capability is re-read on every invoke, so\n  -- revoking it ends every session at once \u2014 a revoke touches only the capability row,\n  -- and it is that per-invoke read, not a cascade here, that refuses the next call.\n  -- Expired rows are pruned on exchange, at most CAPABILITY_SESSION_PRUNE_BATCH at a time,\n  -- on the only path that adds one \u2014 so an exchange's write is bounded however many expired.\n  CREATE TABLE IF NOT EXISTS _substrat_capability_sessions (\n    token_hash TEXT PRIMARY KEY,\n    capability_id TEXT NOT NULL,\n    created_at TEXT NOT NULL,\n    expires_at TEXT NOT NULL\n  );\n  CREATE INDEX IF NOT EXISTS _substrat_capability_sessions_expiry\n    ON _substrat_capability_sessions (expires_at);\n";
+/** The tables `CAPABILITY_DDL` builds — what a copy of a scope leaves behind (`capabilitiesForLoad`, #1686). */
+export declare const CAPABILITY_TABLE_NAMES: readonly ['_substrat_capabilities', '_substrat_capability_sessions'];
 /** One capability row as the spine stores it — snake_case, because that is what both adapters `SELECT`. */
 export interface CapabilityRow {
     id: string;
@@ -33,6 +35,39 @@ export declare function capabilityByIdQuery(id: string): {
     sql: string;
     params: SqlValue[];
 };
+/**
+ * The SELECT behind every read of a scope's capabilities — `ctx.capabilities.list` and the
+ * operator's `HostAdmin.listCapabilities` (#1686) both build it here, so "newest first" and
+ * "live only unless asked" have one definition. Columns are `CAPABILITY_COLUMNS`, which never
+ * includes `token_hash`: no reader of this query can return a hash. The filter is re-parsed
+ * (bounded: `limit` is 1..200, default 50; a `cursor` must be a capability id) and every value
+ * is bound.
+ *
+ * Keyset-paged on `id`, the table's primary key, walked backwards: a ULID id IS creation
+ * order, and a record minted mid-walk gets a LARGER id than any cursor already handed out, so
+ * a concurrent mint can neither repeat a record nor make the walk skip one. `extra` reads that
+ * many rows beyond the page, which is how `readCapabilityPage` knows more follow.
+ */
+export declare function capabilityListQuery(raw?: CapabilityFilter, extra?: number): {
+    sql: string;
+    params: SqlValue[];
+};
+/** A read that names no `limit` gets this many records. */
+export declare const DEFAULT_CAPABILITY_LIMIT = 50;
+/**
+ * The directory read, decoded — the ONE function behind `ctx.capabilities.list`, and (as
+ * `readCapabilityPage`) `HostAdmin.listCapabilities` on both adapters, so "a reader returns
+ * records and never a hash" is held in one place: the query selects no `token_hash`, and the
+ * decode keeps only the record schema's fields.
+ */
+export declare function readCapabilities(sql: ScopedSql, filter?: CapabilityFilter): CapabilityRecord[];
+/**
+ * One page of the operator's read. Reads one row past the page: `nextCursor` is the last
+ * returned record's id when that extra row exists, and `null` when the walk is complete — so
+ * the caller can always tell "that is all" from "there is more", and a console never has to
+ * guess from a full page whether it truncated.
+ */
+export declare function readCapabilityPage(sql: ScopedSql, filter?: CapabilityFilter): CapabilityPage;
 /**
  * Is this capability USABLE — not revoked, not expired? The ONE predicate for it: the
  * permission checker, the session door and the exchange all call this, so the three can

package/dist/capability.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capability.d.ts","sourceRoot":"","sources":["../src/capability.ts"],"names":[],"mappings":"AAAA,OAAO,EAiBL,KAAK,qBAAqB,EAE1B,KAAK,kBAAkB,EAEvB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,mBAAmB,EAExB,KAAK,gBAAgB,EAErB,KAAK,YAAY,EACjB,KAAK,QAAQ,EACb,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACd,KAAK,OAAO,EACZ,KAAK,gBAAgB,EACrB,KAAK,IAAI,EACT,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,WAAW,EACjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AA2C3D;;;;GAIG;AACH,eAAO,MAAM,cAAc,6hFAiD1B,CAAC;AAEF,2GAA2G;AAC3G,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,gGAAgG;AAChG,eAAO,MAAM,kBAAkB,QAEgD,CAAC;AAEhF,qGAAqG;AACrG,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,MAAM,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,QAAQ,EAAE,CAAA;CAAE,CAKnF;AAED;;;;;GAKG;AACH,eAAO,MAAM,cAAc,QACpB,IAAI,CAAC,aAAa,EAAE,YAAY,GAAG,YAAY,CAAC,OAChD,MAAM,KACV,OAAuF,CAAC;AAE3F;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,QAC5B,IAAI,CAAC,aAAa,EAAE,YAAY,GAAG,YAAY,GAAG,UAAU,GAAG,MAAM,CAAC,OACtE,MAAM,KACV,OAAyF,CAAC;AAE7F;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,SAAS,CAAC;IAClB,WAAW,EAAE,aAAa,EAAE,CAAC;IAC7B,iFAAiF;IACjF,QAAQ,EAAE,WAAW,GAAG,IAAI,CAAC;CAC9B;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,aAAa,GAAG,mBAAmB,GAAG,IAAI,CAehF;AAED,yEAAyE;AACzE,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,aAAa,GAAG,gBAAgB,CAwBvE;AAQD,8FAA8F;AAC9F,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED,qEAAqE;AACrE,wBAAgB,0BAA0B,IAAI,MAAM,CAEnD;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAKxE;AAED;;;;;;GAMG;AACH,eAAO,MAAM,8BAA8B,MAAM,CAAC;AA8BlD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAQpD;AAED,gGAAgG;AAChG,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAIjF;AAED,oEAAoE;AACpE,eAAO,MAAM,eAAe,iCAAiC,CAAC;AAE9D;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,CAAC,CAKxE;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAIjF;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAS/F;AAED,mGAAmG;AACnG,wBAAgB,YAAY,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAWpF;AAMD,+JAA+J;AAC/J,MAAM,WAAW,eAAe;IAC9B;;;;;;;;;;;;;OAaG;IACH,IAAI,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC5D;;;;OAIG;IACH,MAAM,CAAC,EAAE,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,iFAAiF;IACjF,IAAI,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,gBAAgB,EAAE,CAAC;CACrD;AAED,MAAM,WAAW,kBAAkB;IACjC,2FAA2F;IAC3F,GAAG,EAAE,SAAS,CAAC;IACf,sBAAsB;IACtB,OAAO,EAAE,YAAY,CAAC;IACtB,+BAA+B;IAC/B,GAAG,EAAE,OAAO,CAAC;IACb,gFAAgF;IAChF,KAAK,EAAE,CAAC,UAAU,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,SAAS,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5E,kFAAkF;IAClF,IAAI,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,CAAC;IACxC,wFAAwF;IACxF,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IACvC,yDAAyD;IACzD,YAAY,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACrC,2FAA2F;IAC3F,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAgBD,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,kBAAkB,GAAG,eAAe,CAmJ/E;AAMD,+FAA+F;AAC/F,eAAO,MAAM,6BAA6B,0BAA0B,CAAC;AAErE;;;;;;;;;;;;;GAaG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE;IACJ,GAAG,EAAE,SAAS,CAAC;IACf,GAAG,EAAE,OAAO,CAAC;IACb,IAAI,EAAE,CAAC,UAAU,EAAE,YAAY,EAAE,KAAK,EAAE,gBAAgB,KAAK,IAAI,CAAC;CACnE,EACD,MAAM,EAAE,OAAO;AACf;;;;GAIG;AACH,IAAI,CAAC,EAAE,KAAK,GAAG,QAAQ,GACtB,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CA0EpC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,SAAS,EACd,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,OAAO,EACZ,SAAS,EAAE,MAAM,GAChB,YAAY,CAyBd;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gCAAgC,CAC9C,UAAU,EAAE,YAAY,EACxB,SAAS,EAAE,oBAAoB,GAAG,oBAAoB,EACtD,IAAI,EAAE;IAAE,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;CAAE,EAC9D,UAAU,CAAC,EAAE,aAAa,GACzB,gBAAgB,CAMlB;AAED,mGAAmG;AACnG,eAAO,MAAM,qBAAqB,UAAW,OAAO,KAAG,KAAK,IAAI,MACnB,CAAC;AAE9C;;;;;GAKG;AACH;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,qBAAqB,EAAE,GAAG,EAAE,OAAO,GAAG,qBAAqB,CAShG;AAED,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,SAAS,EACd,GAAG,EAAE,qBAAqB,EAC1B,KAAK,EAAE,eAAe,EACtB,GAAG,EAAE,OAAO,GACX,OAAO,CAAC,gBAAgB,CAAC,CAsB3B;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,SAAS,EACd,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,eAAe,EACtB,GAAG,EAAE,OAAO,GACX,gBAAgB,GAAG,SAAS,CAY9B"}
+{"version":3,"file":"capability.d.ts","sourceRoot":"","sources":["../src/capability.ts"],"names":[],"mappings":"AAAA,OAAO,EAiBL,KAAK,qBAAqB,EAE1B,KAAK,kBAAkB,EAEvB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,mBAAmB,EAExB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EAErB,KAAK,YAAY,EACjB,KAAK,QAAQ,EACb,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACd,KAAK,OAAO,EACZ,KAAK,gBAAgB,EACrB,KAAK,IAAI,EACT,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,WAAW,EACjB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AA0C3D;;;;GAIG;AACH,eAAO,MAAM,cAAc,6hFAiD1B,CAAC;AAEF,gHAAgH;AAChH,eAAO,MAAM,sBAAsB,YAAI,wBAAwB,EAAE,+BAA+B,CAAU,CAAC;AAE3G,2GAA2G;AAC3G,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,gGAAgG;AAChG,eAAO,MAAM,kBAAkB,QAEgD,CAAC;AAEhF,qGAAqG;AACrG,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,MAAM,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,QAAQ,EAAE,CAAA;CAAE,CAKnF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,CAAC,EAAE,gBAAgB,EACtB,KAAK,SAAI,GACR;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,QAAQ,EAAE,CAAA;CAAE,CAoBrC;AAED,2DAA2D;AAC3D,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAE3C;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,gBAAgB,EAAE,CAG9F;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,cAAc,CAQ5F;AAED;;;;;GAKG;AACH,eAAO,MAAM,cAAc,QACpB,IAAI,CAAC,aAAa,EAAE,YAAY,GAAG,YAAY,CAAC,OAChD,MAAM,KACV,OAAuF,CAAC;AAE3F;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,QAC5B,IAAI,CAAC,aAAa,EAAE,YAAY,GAAG,YAAY,GAAG,UAAU,GAAG,MAAM,CAAC,OACtE,MAAM,KACV,OAAyF,CAAC;AAE7F;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,SAAS,CAAC;IAClB,WAAW,EAAE,aAAa,EAAE,CAAC;IAC7B,iFAAiF;IACjF,QAAQ,EAAE,WAAW,GAAG,IAAI,CAAC;CAC9B;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,aAAa,GAAG,mBAAmB,GAAG,IAAI,CAehF;AAED,yEAAyE;AACzE,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,aAAa,GAAG,gBAAgB,CAwBvE;AAED,8FAA8F;AAC9F,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED,qEAAqE;AACrE,wBAAgB,0BAA0B,IAAI,MAAM,CAEnD;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAKxE;AAED;;;;;;GAMG;AACH,eAAO,MAAM,8BAA8B,MAAM,CAAC;AA8BlD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAQpD;AAED,gGAAgG;AAChG,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAIjF;AAED,oEAAoE;AACpE,eAAO,MAAM,eAAe,iCAAiC,CAAC;AAE9D;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,CAAC,CAKxE;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAIjF;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAS/F;AAED,mGAAmG;AACnG,wBAAgB,YAAY,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAWpF;AAMD,+JAA+J;AAC/J,MAAM,WAAW,eAAe;IAC9B;;;;;;;;;;;;;OAaG;IACH,IAAI,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC5D;;;;OAIG;IACH,MAAM,CAAC,EAAE,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,iFAAiF;IACjF,IAAI,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,gBAAgB,EAAE,CAAC;CACrD;AAED,MAAM,WAAW,kBAAkB;IACjC,2FAA2F;IAC3F,GAAG,EAAE,SAAS,CAAC;IACf,sBAAsB;IACtB,OAAO,EAAE,YAAY,CAAC;IACtB,+BAA+B;IAC/B,GAAG,EAAE,OAAO,CAAC;IACb,gFAAgF;IAChF,KAAK,EAAE,CAAC,UAAU,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,SAAS,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5E,kFAAkF;IAClF,IAAI,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,CAAC;IACxC,wFAAwF;IACxF,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IACvC,yDAAyD;IACzD,YAAY,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACrC,2FAA2F;IAC3F,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAgBD,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,kBAAkB,GAAG,eAAe,CAkI/E;AAMD,+FAA+F;AAC/F,eAAO,MAAM,6BAA6B,0BAA0B,CAAC;AAErE;;;;;;;;;;;;;GAaG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE;IACJ,GAAG,EAAE,SAAS,CAAC;IACf,GAAG,EAAE,OAAO,CAAC;IACb,IAAI,EAAE,CAAC,UAAU,EAAE,YAAY,EAAE,KAAK,EAAE,gBAAgB,KAAK,IAAI,CAAC;CACnE,EACD,MAAM,EAAE,OAAO;AACf;;;;GAIG;AACH,IAAI,CAAC,EAAE,KAAK,GAAG,QAAQ,GACtB,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CA0EpC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,SAAS,EACd,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,OAAO,EACZ,SAAS,EAAE,MAAM,GAChB,YAAY,CAyBd;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gCAAgC,CAC9C,UAAU,EAAE,YAAY,EACxB,SAAS,EAAE,oBAAoB,GAAG,oBAAoB,EACtD,IAAI,EAAE;IAAE,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;CAAE,EAC9D,UAAU,CAAC,EAAE,aAAa,GACzB,gBAAgB,CAMlB;AAED,mGAAmG;AACnG,eAAO,MAAM,qBAAqB,UAAW,OAAO,KAAG,KAAK,IAAI,MACnB,CAAC;AAE9C;;;;;GAKG;AACH;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,qBAAqB,EAAE,GAAG,EAAE,OAAO,GAAG,qBAAqB,CAShG;AAED,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,SAAS,EACd,GAAG,EAAE,qBAAqB,EAC1B,KAAK,EAAE,eAAe,EACtB,GAAG,EAAE,OAAO,GACX,OAAO,CAAC,gBAAgB,CAAC,CAsB3B;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,SAAS,EACd,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,eAAe,EACtB,GAAG,EAAE,OAAO,GACX,gBAAgB,GAAG,SAAS,CAY9B"}

package/dist/capability.js

@@ -1,4 +1,5 @@
 import { CAPABILITY_EXERCISED, CAPABILITY_MINTED, CAPABILITY_REVOKED, CAPABILITY_SECRET_PREFIX, CAPABILITY_SESSION_PREFIX, CAPABILITY_SESSION_TTL_MS, becomeCapabilityInput, capabilityAuthor, capabilityFilter, capabilityId as capabilityIdSchema, capabilityMintInput, capabilityRecord, permissionKey, principalId as principalIdSchema, substratError, entityObjectRef, } from '@substrat-run/contracts';
+import { toBase64url } from './base64url.js';
 import { PermissionDenied } from './permission-checker.js';
 import { ulid } from './ulid.js';
 /**
@@ -56,6 +57,8 @@ export const CAPABILITY_DDL = `
   CREATE INDEX IF NOT EXISTS _substrat_capability_sessions_expiry
     ON _substrat_capability_sessions (expires_at);
 `;
+/** The tables `CAPABILITY_DDL` builds — what a copy of a scope leaves behind (`capabilitiesForLoad`, #1686). */
+export const CAPABILITY_TABLE_NAMES = ['_substrat_capabilities', '_substrat_capability_sessions'];
 /** Every column a read returns — everything but `token_hash`, which no reader has a use for. */
 export const CAPABILITY_COLUMNS = 'id, mode, label, entity_type, entity_id, permissions, operations, principal, minted_by, ' +
     'minted_at, expires_at, max_uses, uses, last_used_at, revoked_at, revoked_by';
@@ -66,6 +69,67 @@ export function capabilityByIdQuery(id) {
         params: [id],
     };
 }
+/**
+ * The SELECT behind every read of a scope's capabilities — `ctx.capabilities.list` and the
+ * operator's `HostAdmin.listCapabilities` (#1686) both build it here, so "newest first" and
+ * "live only unless asked" have one definition. Columns are `CAPABILITY_COLUMNS`, which never
+ * includes `token_hash`: no reader of this query can return a hash. The filter is re-parsed
+ * (bounded: `limit` is 1..200, default 50; a `cursor` must be a capability id) and every value
+ * is bound.
+ *
+ * Keyset-paged on `id`, the table's primary key, walked backwards: a ULID id IS creation
+ * order, and a record minted mid-walk gets a LARGER id than any cursor already handed out, so
+ * a concurrent mint can neither repeat a record nor make the walk skip one. `extra` reads that
+ * many rows beyond the page, which is how `readCapabilityPage` knows more follow.
+ */
+export function capabilityListQuery(raw, extra = 0) {
+    const filter = capabilityFilter.parse(raw ?? {});
+    const where = [];
+    const params = [];
+    if (filter.entity) {
+        where.push('entity_type = ? AND entity_id = ?');
+        params.push(filter.entity.entityType, filter.entity.entityId);
+    }
+    if (!filter.includeRevoked)
+        where.push('revoked_at IS NULL');
+    if (filter.cursor !== undefined) {
+        where.push('id < ?');
+        params.push(filter.cursor);
+    }
+    params.push((filter.limit ?? DEFAULT_CAPABILITY_LIMIT) + extra);
+    return {
+        sql: `SELECT ${CAPABILITY_COLUMNS} FROM _substrat_capabilities` +
+            `${where.length ? ` WHERE ${where.join(' AND ')}` : ''} ORDER BY id DESC LIMIT ?`,
+        params,
+    };
+}
+/** A read that names no `limit` gets this many records. */
+export const DEFAULT_CAPABILITY_LIMIT = 50;
+/**
+ * The directory read, decoded — the ONE function behind `ctx.capabilities.list`, and (as
+ * `readCapabilityPage`) `HostAdmin.listCapabilities` on both adapters, so "a reader returns
+ * records and never a hash" is held in one place: the query selects no `token_hash`, and the
+ * decode keeps only the record schema's fields.
+ */
+export function readCapabilities(sql, filter) {
+    const q = capabilityListQuery(filter);
+    return sql.query(q.sql, q.params).map(capabilityRecordOf);
+}
+/**
+ * One page of the operator's read. Reads one row past the page: `nextCursor` is the last
+ * returned record's id when that extra row exists, and `null` when the walk is complete — so
+ * the caller can always tell "that is all" from "there is more", and a console never has to
+ * guess from a full page whether it truncated.
+ */
+export function readCapabilityPage(sql, filter) {
+    const parsed = capabilityFilter.parse(filter ?? {});
+    const limit = parsed.limit ?? DEFAULT_CAPABILITY_LIMIT;
+    const q = capabilityListQuery(parsed, 1);
+    const rows = sql.query(q.sql, q.params);
+    const entries = rows.slice(0, limit).map(capabilityRecordOf);
+    const last = entries[entries.length - 1];
+    return { entries, nextCursor: rows.length > limit && last ? last.id : null };
+}
 /**
  * Is this capability USABLE — not revoked, not expired? The ONE predicate for it: the
  * permission checker, the session door and the exchange all call this, so the three can
@@ -119,19 +183,13 @@ export function capabilityRecordOf(row) {
             operations: row.operations === null ? null : JSON.parse(row.operations),
         });
 }
-const b64url = (bytes) => {
-    let s = '';
-    for (const b of bytes)
-        s += String.fromCharCode(b);
-    return btoa(s).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
-};
 /** A fresh capability secret: 256 bits, base64url, prefixed. Only its hash is ever stored. */
 export function mintCapabilitySecret() {
-    return CAPABILITY_SECRET_PREFIX + b64url(crypto.getRandomValues(new Uint8Array(32)));
+    return CAPABILITY_SECRET_PREFIX + toBase64url(crypto.getRandomValues(new Uint8Array(32)));
 }
 /** A fresh session token — the same construction, its own prefix. */
 export function mintCapabilitySessionToken() {
-    return CAPABILITY_SESSION_PREFIX + b64url(crypto.getRandomValues(new Uint8Array(32)));
+    return CAPABILITY_SESSION_PREFIX + toBase64url(crypto.getRandomValues(new Uint8Array(32)));
 }
 /**
  * SHA-256 hex of a secret or session token (Web Crypto — the same call in workerd, node and
@@ -354,22 +412,7 @@ export function createCapabilityVerbs(deps) {
                 payload,
             });
         },
-        list(raw) {
-            const filter = capabilityFilter.parse(raw ?? {});
-            const where = [];
-            const params = [];
-            if (filter.entity) {
-                where.push('entity_type = ? AND entity_id = ?');
-                params.push(filter.entity.entityType, filter.entity.entityId);
-            }
-            if (!filter.includeRevoked)
-                where.push('revoked_at IS NULL');
-            params.push(filter.limit ?? 50);
-            const rows = deps.sql.query(`SELECT ${CAPABILITY_COLUMNS} FROM _substrat_capabilities
-         ${where.length ? `WHERE ${where.join(' AND ')}` : ''}
-         ORDER BY id DESC LIMIT ?`, params);
-            return rows.map(capabilityRecordOf);
-        },
+        list: (raw) => readCapabilities(deps.sql, raw),
     };
 }
 // ---------------------------------------------------------------------------