@substrat-run/kernel 0.136.0 → 0.137.0

package/dist/system-switch.d.ts

@@ -19,19 +19,25 @@
  * `scope:<id>` marker. The gate is OFF while that marker is live, whatever grants are
  * live beside it. **Restore is the lever; a grant is not.** The marker is an ordinary
  * K-21 tuple: switching back on tombstones it, so the row stays as evidence of when the
- * switch was last pulled. The permission walk reads only `role:` and `granted:` relations
- * (`permission-eval.ts`), so the marker authorizes nothing and denies nothing by itself.
+ * switch was last pulled. The permission walk reads only `role:` and `granted:` relations,
+ * so the marker authorizes nothing; what it denies, it denies through the one question the
+ * evaluator asks before the walk (below).
  *
  * Switching off ALSO tombstones every live `granted:` tuple the module holds on the scope.
  * That is what makes it a kill switch rather than a schedule pause: anything that acts
  * with the module's system authority — a resumable job run (#1577), a `getSystemScope`
  * invoke — is denied by its own `ctx.check` while the switch is off.
  *
- * **And nothing may write a new one while it is off**, which is what makes that denial
- * hold. The checker is deliberately NOT marker-aware; the switch is closed on the WRITE
- * side instead, at the only two writers of a scope-level `system:` grant:
+ * **And the checker reads the marker too** (#1823), which is what makes that denial hold
+ * against a grant OFF cannot tombstone. A TENANT-level `system:` grant lives in the directory
+ * (and in every scope's projection of it), not at `scope:<id>`, so OFF leaves it live. The
+ * permission evaluator asks the scope reader's `switchedOff` before it reads any tuple, and a
+ * live marker denies the subject on that scope whatever it holds (`permission-eval.ts`). The
+ * write side stays closed as well, so a switched-off scope does not accumulate grants that
+ * ON would then hand back:
  * - `grantToSystem` refuses while the module is switched off on that scope (the adapters
- *   ask `systemSwitchedOff` in the same unit as the write);
+ *   ask `systemSwitchedOff` in the same unit as the write), and a tenant-level grant while
+ *   the directory records it off on any scope (#1743);
  * - provisioning's seat (`seatScopeTuple`) seats nothing for a subject whose marker is
  *   live, so a reconcile cannot create a grant a newer version declares.
  *
@@ -97,8 +103,15 @@ export interface SystemGrantsEntry {
 export declare function systemGrantsStatus(db: SwitchSql, now: string): SystemGrantsEntry[];
 /** Is this module switched off on the scope `db` is? What `grantToSystem` refuses on. */
 export declare function systemSwitchedOff(db: SwitchSql, moduleId: string): boolean;
+/**
+ * `SYSTEM_SWITCH_OFF_PREDICATE` as a whole statement answering `off` (0/1), over the one bound
+ * subject — what `subjectSwitchedOff` runs, and what each adapter's permission reader prepares
+ * once and runs on every check of a switchable subject (#1823).
+ */
+export declare const SYSTEM_SWITCH_OFF_QUERY = "SELECT EXISTS (SELECT 1 FROM _substrat_tuples\n  WHERE subject = ? AND relation = 'switch:off' AND revoked_at IS NULL) AS off";
 /** Is this subject's OFF marker live on the scope `db` is? Any subject — see `switchSubjectGrants`. */
 export declare function subjectSwitchedOff(db: SwitchSql, subject: string): boolean;
+export declare const isSwitchableSubjectKind: (kind: string) => boolean;
 /** The refusal `grantToSystem` throws while the switch is off — one wording, both adapters. */
 export declare function systemSwitchedOffMessage(moduleId: string, scopeId: string): string;
 /**
@@ -111,6 +124,15 @@ export interface SwitchOutcome {
     held: boolean;
     changed: boolean;
     permissions: string[];
+    /**
+     * #1823: this code's evaluator denies a module on a scope whose marker is live, its
+     * TENANT-level grants included. Set by `switchSystemSchedules` on every answer, because it
+     * is a fact about the code that answered, not about the call: a deployment built before
+     * #1823 omits it, and its OFF leaves a tenant-level grant authorizing. The platform reads
+     * its absence on an OFF of a module it found tenant-held as "this deployment cannot hold
+     * that OFF", and refuses it rather than record a scope off that is not.
+     */
+    deniesTenantGrants?: true;
 }
 /**
  * Move one module's switch on one scope. Idempotent: a repeat changes nothing and says so.
@@ -121,9 +143,13 @@ export interface SwitchOutcome {
  * marker. A repeated OFF re-asserts the whole position: a grant that became live meanwhile
  * (only a raw write can do that now) is tombstoned and recorded too.
  *
- * `held: false`, with nothing written, when the scope holds neither a grant nor a marker
- * for the module: the caller named something this scope never ran, and turning "nothing"
- * off must not write a marker that silently disables a module the day it is installed.
+ * `held: false`, with nothing written, when the module has no authority reaching the scope:
+ * no grant and no marker here, and no live TENANT-level grant (`tenantHeld`, which the caller
+ * reads from the directory, since the scope's storage cannot answer it). The caller named
+ * something this scope never ran, and turning "nothing" off must not write a marker that
+ * silently disables a module the day it is installed. A module whose only authority here is a
+ * tenant-level grant IS held (#1823): OFF writes the marker, which the evaluator then denies
+ * the module on, and tombstones nothing, because nothing of it is here to tombstone.
  *
  * Run it inside one transaction; the reads and writes here are meant to be one unit.
  */
@@ -132,6 +158,7 @@ export declare function switchSystemSchedules(db: SwitchSql, input: {
     scopeId: string;
     to: 'on' | 'off';
     at: string;
+    tenantHeld?: boolean;
 }): SwitchOutcome;
 /** One module `switchRecordedOff` switched off — `SwitchedOffInUnit`'s shape. */
 export interface SwitchedOff extends SwitchOutcome {
@@ -147,13 +174,15 @@ export interface SwitchedOff extends SwitchOutcome {
  * `scopeId` is the scope `db` is, and the caller passes the one the request provisions or
  * restores, never a second id: the list names modules, never scopes, so it can only reach
  * the scope that unit is already writing. A module the scope holds nothing for answers
- * `held: false` and writes nothing, as the switch always does. Off only: nothing here turns
- * a module on.
+ * `held: false` and writes nothing, as the switch always does — unless it is in `tenantHeld`,
+ * the recorded-off modules the caller found a live tenant-level grant for (#1823). Off only:
+ * nothing here turns a module on.
  */
 export declare function switchRecordedOff(db: SwitchSql, input: {
     scopeId: string;
     moduleIds: readonly string[];
     at: string;
+    tenantHeld?: readonly string[];
 }): SwitchedOff[];
 /**
  * The switch itself, for ANY non-person subject's scope-level grants — `switchSystemSchedules`
@@ -169,5 +198,6 @@ export declare function switchSubjectGrants(db: SwitchSql, input: {
     scopeId: string;
     to: 'on' | 'off';
     at: string;
+    tenantHeld?: boolean;
 }): SwitchOutcome;
 //# sourceMappingURL=system-switch.d.ts.map

package/dist/system-switch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"system-switch.d.ts","sourceRoot":"","sources":["../src/system-switch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEH,4FAA4F;AAC5F,eAAO,MAAM,0BAA0B,eAAe,CAAC;AAKvD,sFAAsF;AACtF,MAAM,WAAW,SAAS;IACxB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IACnF,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC;CAC/D;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,mBAAmB,GAAG,IAAI,GAAG,KAAK,GAAG,WAAW,CAAC;AAI7D;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,oHACmD,CAAC;AAE5F;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,mBAAmB,CAErG;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,mBAAmB,CAalG;AAED,4EAA4E;AAC5E,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,mBAAmB,CAAC;CAChC;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,iBAAiB,EAAE,CAWlF;AAED,yFAAyF;AACzF,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE1E;AAED,uGAAuG;AACvG,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAK1E;AAUD,+FAA+F;AAC/F,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAElF;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAKpG;AAED,2FAA2F;AAC3F,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CACnC,EAAE,EAAE,SAAS,EACb,KAAK,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,IAAI,GAAG,KAAK,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GACzE,aAAa,CAOf;AAED,iFAAiF;AACjF,MAAM,WAAW,WAAY,SAAQ,aAAa;IAChD,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAC/B,EAAE,EAAE,SAAS,EACb,KAAK,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GACnE,WAAW,EAAE,CAKf;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,EAAE,EAAE,SAAS,EACb,KAAK,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,IAAI,GAAG,KAAK,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GACxE,aAAa,CA4Ff"}
+{"version":3,"file":"system-switch.d.ts","sourceRoot":"","sources":["../src/system-switch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAEH,4FAA4F;AAC5F,eAAO,MAAM,0BAA0B,eAAe,CAAC;AAKvD,sFAAsF;AACtF,MAAM,WAAW,SAAS;IACxB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IACnF,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC;CAC/D;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,mBAAmB,GAAG,IAAI,GAAG,KAAK,GAAG,WAAW,CAAC;AAI7D;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,oHACmD,CAAC;AAE5F;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,mBAAmB,CAErG;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,mBAAmB,CAalG;AAED,4EAA4E;AAC5E,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,mBAAmB,CAAC;CAChC;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,iBAAiB,EAAE,CAWlF;AAED,yFAAyF;AACzF,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE1E;AAED;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,kIAAiD,CAAC;AAEtF,uGAAuG;AACvG,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAG1E;AAQD,eAAO,MAAM,uBAAuB,SAAU,MAAM,KAAG,OAAqC,CAAC;AAU7F,+FAA+F;AAC/F,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAElF;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAKpG;AAED,2FAA2F;AAC3F,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,IAAI,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,qBAAqB,CACnC,EAAE,EAAE,SAAS,EACb,KAAK,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,IAAI,GAAG,KAAK,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GAC/F,aAAa,CASf;AAED,iFAAiF;AACjF,MAAM,WAAW,WAAY,SAAQ,aAAa;IAChD,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAC/B,EAAE,EAAE,SAAS,EACb,KAAK,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GACnG,WAAW,EAAE,CAYf;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,EAAE,EAAE,SAAS,EACb,KAAK,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,IAAI,GAAG,KAAK,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GAC9F,aAAa,CA4Ff"}

package/dist/system-switch.js

@@ -19,19 +19,25 @@
  * `scope:<id>` marker. The gate is OFF while that marker is live, whatever grants are
  * live beside it. **Restore is the lever; a grant is not.** The marker is an ordinary
  * K-21 tuple: switching back on tombstones it, so the row stays as evidence of when the
- * switch was last pulled. The permission walk reads only `role:` and `granted:` relations
- * (`permission-eval.ts`), so the marker authorizes nothing and denies nothing by itself.
+ * switch was last pulled. The permission walk reads only `role:` and `granted:` relations,
+ * so the marker authorizes nothing; what it denies, it denies through the one question the
+ * evaluator asks before the walk (below).
  *
  * Switching off ALSO tombstones every live `granted:` tuple the module holds on the scope.
  * That is what makes it a kill switch rather than a schedule pause: anything that acts
  * with the module's system authority — a resumable job run (#1577), a `getSystemScope`
  * invoke — is denied by its own `ctx.check` while the switch is off.
  *
- * **And nothing may write a new one while it is off**, which is what makes that denial
- * hold. The checker is deliberately NOT marker-aware; the switch is closed on the WRITE
- * side instead, at the only two writers of a scope-level `system:` grant:
+ * **And the checker reads the marker too** (#1823), which is what makes that denial hold
+ * against a grant OFF cannot tombstone. A TENANT-level `system:` grant lives in the directory
+ * (and in every scope's projection of it), not at `scope:<id>`, so OFF leaves it live. The
+ * permission evaluator asks the scope reader's `switchedOff` before it reads any tuple, and a
+ * live marker denies the subject on that scope whatever it holds (`permission-eval.ts`). The
+ * write side stays closed as well, so a switched-off scope does not accumulate grants that
+ * ON would then hand back:
  * - `grantToSystem` refuses while the module is switched off on that scope (the adapters
- *   ask `systemSwitchedOff` in the same unit as the write);
+ *   ask `systemSwitchedOff` in the same unit as the write), and a tenant-level grant while
+ *   the directory records it off on any scope (#1743);
  * - provisioning's seat (`seatScopeTuple`) seats nothing for a subject whose marker is
  *   live, so a reconcile cannot create a grant a newer version declares.
  *
@@ -101,11 +107,24 @@ export function systemGrantsStatus(db, now) {
 export function systemSwitchedOff(db, moduleId) {
     return subjectSwitchedOff(db, subjectOf(moduleId));
 }
+/**
+ * `SYSTEM_SWITCH_OFF_PREDICATE` as a whole statement answering `off` (0/1), over the one bound
+ * subject — what `subjectSwitchedOff` runs, and what each adapter's permission reader prepares
+ * once and runs on every check of a switchable subject (#1823).
+ */
+export const SYSTEM_SWITCH_OFF_QUERY = `SELECT ${SYSTEM_SWITCH_OFF_PREDICATE} AS off`;
 /** Is this subject's OFF marker live on the scope `db` is? Any subject — see `switchSubjectGrants`. */
 export function subjectSwitchedOff(db, subject) {
-    const row = db.all(`SELECT ${SYSTEM_SWITCH_OFF_PREDICATE} AS off`, subject)[0];
+    const row = db.all(SYSTEM_SWITCH_OFF_QUERY, subject)[0];
     return Number(row?.off) === 1;
 }
+/**
+ * The subject kinds a kill switch can name: a module's system authority (#1666, `system:`) and
+ * a peer vertical's (#1706, `vertical:`). A principal, connection or capability never carries a
+ * marker, so the evaluator asks the switch only for these (#1823).
+ */
+const SWITCHABLE_KINDS = new Set(['system', 'vertical']);
+export const isSwitchableSubjectKind = (kind) => SWITCHABLE_KINDS.has(kind);
 /** How many scopes a tenant-level refusal names before it says "and N more". */
 const NAMED_SCOPES = 5;
 const switchedOffMessage = (moduleId, where, reach) => `module '${moduleId}' is switched off on ${where} (#1666) — restore it first ` +
@@ -134,19 +153,25 @@ export function tenantSystemSwitchedOffMessage(moduleId, scopeIds) {
  * marker. A repeated OFF re-asserts the whole position: a grant that became live meanwhile
  * (only a raw write can do that now) is tombstoned and recorded too.
  *
- * `held: false`, with nothing written, when the scope holds neither a grant nor a marker
- * for the module: the caller named something this scope never ran, and turning "nothing"
- * off must not write a marker that silently disables a module the day it is installed.
+ * `held: false`, with nothing written, when the module has no authority reaching the scope:
+ * no grant and no marker here, and no live TENANT-level grant (`tenantHeld`, which the caller
+ * reads from the directory, since the scope's storage cannot answer it). The caller named
+ * something this scope never ran, and turning "nothing" off must not write a marker that
+ * silently disables a module the day it is installed. A module whose only authority here is a
+ * tenant-level grant IS held (#1823): OFF writes the marker, which the evaluator then denies
+ * the module on, and tombstones nothing, because nothing of it is here to tombstone.
  *
  * Run it inside one transaction; the reads and writes here are meant to be one unit.
  */
 export function switchSystemSchedules(db, input) {
-    return switchSubjectGrants(db, {
+    const outcome = switchSubjectGrants(db, {
         subject: subjectOf(input.moduleId),
         scopeId: input.scopeId,
         to: input.to,
         at: input.at,
+        tenantHeld: input.tenantHeld,
     });
+    return { ...outcome, deniesTenantGrants: true };
 }
 /**
  * Switch the directory's recorded-off modules off again, inside the unit that re-created the
@@ -158,13 +183,21 @@ export function switchSystemSchedules(db, input) {
  * `scopeId` is the scope `db` is, and the caller passes the one the request provisions or
  * restores, never a second id: the list names modules, never scopes, so it can only reach
  * the scope that unit is already writing. A module the scope holds nothing for answers
- * `held: false` and writes nothing, as the switch always does. Off only: nothing here turns
- * a module on.
+ * `held: false` and writes nothing, as the switch always does — unless it is in `tenantHeld`,
+ * the recorded-off modules the caller found a live tenant-level grant for (#1823). Off only:
+ * nothing here turns a module on.
  */
 export function switchRecordedOff(db, input) {
+    const tenantHeld = new Set(input.tenantHeld ?? []);
     return [...new Set(input.moduleIds)].map((moduleId) => ({
         moduleId,
-        ...switchSystemSchedules(db, { moduleId, scopeId: input.scopeId, to: 'off', at: input.at }),
+        ...switchSystemSchedules(db, {
+            moduleId,
+            scopeId: input.scopeId,
+            to: 'off',
+            at: input.at,
+            tenantHeld: tenantHeld.has(moduleId),
+        }),
     }));
 }
 /**
@@ -183,7 +216,7 @@ export function switchSubjectGrants(db, input) {
       WHERE subject = ? AND object = ? AND substr(relation, 1, 8) = 'granted:'
       ORDER BY relation`, subject, object);
     const marker = db.all(`SELECT revoked_at FROM _substrat_tuples WHERE subject = ? AND relation = ? AND object = ?`, subject, SYSTEM_SWITCH_OFF_RELATION, object)[0];
-    if (grants.length === 0 && !marker)
+    if (grants.length === 0 && !marker && !input.tenantHeld)
         return { held: false, changed: false, permissions: [] };
     const permissionOf = (relation) => relation.slice('granted:'.length);
     if (input.to === 'off') {

package/dist/system-switch.js.map

@@ -1 +1 @@
-{"version":3,"file":"system-switch.js","sourceRoot":"","sources":["../src/system-switch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEH,4FAA4F;AAC5F,MAAM,CAAC,MAAM,0BAA0B,GAAG,YAAY,CAAC;AAEvD,uFAAuF;AACvF,MAAM,eAAe,GAAG,WAAW,CAAC;AAqBpC,MAAM,SAAS,GAAG,CAAC,QAAgB,EAAU,EAAE,CAAC,UAAU,QAAQ,EAAE,CAAC;AAErE;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG;sCACL,0BAA0B,2BAA2B,CAAC;AAE5F;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAAa,EAAE,QAAgB,EAAE,GAAW;IAC9E,OAAO,iBAAiB,CAAC,EAAE,EAAE,SAAS,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;AACzD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAAa,EAAE,OAAe,EAAE,GAAW;IAC3E,MAAM,GAAG,GAAG,EAAE,CAAC,GAAG,CAChB;SACK,2BAA2B;;;gGAG4D,EAC5F,OAAO,EACP,OAAO,EACP,GAAG,CACJ,CAAC,CAAC,CAAiD,CAAC;IACrD,IAAI,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,OAAO,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC;AACzD,CAAC;AAQD;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,EAAa,EAAE,GAAW;IAC3D,MAAM,IAAI,GAAG,EAAE,CAAC,GAAG,CACjB;;kEAE8D,0BAA0B;uBACrE,CACK,CAAC;IAC3B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACtB,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACrD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,mBAAmB,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,CAAC;IACzE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,iBAAiB,CAAC,EAAa,EAAE,QAAgB;IAC/D,OAAO,kBAAkB,CAAC,EAAE,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,kBAAkB,CAAC,EAAa,EAAE,OAAe;IAC/D,MAAM,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,UAAU,2BAA2B,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,CAEhE,CAAC;IACd,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,gFAAgF;AAChF,MAAM,YAAY,GAAG,CAAC,CAAC;AAEvB,MAAM,kBAAkB,GAAG,CAAC,QAAgB,EAAE,KAAa,EAAE,KAAa,EAAU,EAAE,CACpF,WAAW,QAAQ,wBAAwB,KAAK,8BAA8B;IAC9E,gDAAgD,KAAK,0CAA0C;IAC/F,+DAA+D,CAAC;AAElE,+FAA+F;AAC/F,MAAM,UAAU,wBAAwB,CAAC,QAAgB,EAAE,OAAe;IACxE,OAAO,kBAAkB,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAAC,QAAgB,EAAE,QAA2B;IAC1F,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,QAAQ,CAAC,MAAM,GAAG,YAAY,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IACjG,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,GAAG,IAAI,EAAE,CAAC;IAClF,OAAO,kBAAkB,CAAC,QAAQ,EAAE,KAAK,EAAE,6DAA6D,CAAC,CAAC;AAC5G,CAAC;AASD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,qBAAqB,CACnC,EAAa,EACb,KAA0E;IAE1E,OAAO,mBAAmB,CAAC,EAAE,EAAE;QAC7B,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC;QAClC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,EAAE,EAAE,KAAK,CAAC,EAAE;KACb,CAAC,CAAC;AACL,CAAC;AAOD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB,CAC/B,EAAa,EACb,KAAoE;IAEpE,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACtD,QAAQ;QACR,GAAG,qBAAqB,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;KAC5F,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CACjC,EAAa,EACb,KAAyE;IAEzE,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,MAAM,MAAM,GAAG,SAAS,KAAK,CAAC,OAAO,EAAE,CAAC;IACxC,MAAM,MAAM,GAAG,EAAE,CAAC,GAAG,CACnB;;wBAEoB,EACpB,OAAO,EACP,MAAM,CAC8C,CAAC;IACvD,MAAM,MAAM,GAAG,EAAE,CAAC,GAAG,CACnB,2FAA2F,EAC3F,OAAO,EACP,0BAA0B,EAC1B,MAAM,CACP,CAAC,CAAC,CAA8C,CAAC;IAClD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IAE5F,MAAM,YAAY,GAAG,CAAC,QAAgB,EAAU,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACrF,IAAI,KAAK,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC9F,KAAK,MAAM,UAAU,IAAI,IAAI,EAAE,CAAC;YAC9B,EAAE,CAAC,GAAG,CACJ,8FAA8F,EAC9F,KAAK,CAAC,EAAE,EACR,OAAO,EACP,WAAW,UAAU,EAAE,EACvB,MAAM,CACP,CAAC;YACF,kFAAkF;YAClF,2DAA2D;YAC3D,EAAE,CAAC,GAAG,CACJ;sCAC8B,EAC9B,OAAO,EACP,GAAG,eAAe,GAAG,UAAU,EAAE,EACjC,MAAM,CACP,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,CAAC;QAC1D,IAAI,WAAW,EAAE,CAAC;YAChB,EAAE,CAAC,GAAG,CACJ;sCAC8B,EAC9B,OAAO,EACP,0BAA0B,EAC1B,MAAM,CACP,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACpF,CAAC;IAED,MAAM,OAAO,GAAG,EAAE,CAAC,GAAG,CACpB;;wBAEoB,EACpB,OAAO,EACP,MAAM,EACN,eAAe,CACU,CAAC;IAC5B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,EAAE,QAAQ,EAAE,IAAI,OAAO,EAAE,CAAC;QACnC,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,WAAW,UAAU,EAAE,IAAI,CAAC,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC;QACpG,IAAI,OAAO,EAAE,CAAC;YACZ,EAAE,CAAC,GAAG,CACJ,iGAAiG,EACjG,OAAO,EACP,WAAW,UAAU,EAAE,EACvB,MAAM,CACP,CAAC;YACF,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC5B,CAAC;QACD,EAAE,CAAC,GAAG,CACJ,8FAA8F,EAC9F,KAAK,CAAC,EAAE,EACR,OAAO,EACP,QAAQ,EACR,MAAM,CACP,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,CAAC;IACvE,IAAI,WAAW,EAAE,CAAC;QAChB,EAAE,CAAC,GAAG,CACJ,8FAA8F,EAC9F,KAAK,CAAC,EAAE,EACR,OAAO,EACP,0BAA0B,EAC1B,MAAM,CACP,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;AAC5F,CAAC"}
+{"version":3,"file":"system-switch.js","sourceRoot":"","sources":["../src/system-switch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAEH,4FAA4F;AAC5F,MAAM,CAAC,MAAM,0BAA0B,GAAG,YAAY,CAAC;AAEvD,uFAAuF;AACvF,MAAM,eAAe,GAAG,WAAW,CAAC;AAqBpC,MAAM,SAAS,GAAG,CAAC,QAAgB,EAAU,EAAE,CAAC,UAAU,QAAQ,EAAE,CAAC;AAErE;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG;sCACL,0BAA0B,2BAA2B,CAAC;AAE5F;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAAa,EAAE,QAAgB,EAAE,GAAW;IAC9E,OAAO,iBAAiB,CAAC,EAAE,EAAE,SAAS,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;AACzD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAAa,EAAE,OAAe,EAAE,GAAW;IAC3E,MAAM,GAAG,GAAG,EAAE,CAAC,GAAG,CAChB;SACK,2BAA2B;;;gGAG4D,EAC5F,OAAO,EACP,OAAO,EACP,GAAG,CACJ,CAAC,CAAC,CAAiD,CAAC;IACrD,IAAI,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,OAAO,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC;AACzD,CAAC;AAQD;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,EAAa,EAAE,GAAW;IAC3D,MAAM,IAAI,GAAG,EAAE,CAAC,GAAG,CACjB;;kEAE8D,0BAA0B;uBACrE,CACK,CAAC;IAC3B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACtB,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACrD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,mBAAmB,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,CAAC;IACzE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,iBAAiB,CAAC,EAAa,EAAE,QAAgB;IAC/D,OAAO,kBAAkB,CAAC,EAAE,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;AACrD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,UAAU,2BAA2B,SAAS,CAAC;AAEtF,uGAAuG;AACvG,MAAM,UAAU,kBAAkB,CAAC,EAAa,EAAE,OAAe;IAC/D,MAAM,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAC,CAAC,CAAgC,CAAC;IACvF,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;AAC9E,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,IAAY,EAAW,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAE7F,gFAAgF;AAChF,MAAM,YAAY,GAAG,CAAC,CAAC;AAEvB,MAAM,kBAAkB,GAAG,CAAC,QAAgB,EAAE,KAAa,EAAE,KAAa,EAAU,EAAE,CACpF,WAAW,QAAQ,wBAAwB,KAAK,8BAA8B;IAC9E,gDAAgD,KAAK,0CAA0C;IAC/F,+DAA+D,CAAC;AAElE,+FAA+F;AAC/F,MAAM,UAAU,wBAAwB,CAAC,QAAgB,EAAE,OAAe;IACxE,OAAO,kBAAkB,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAAC,QAAgB,EAAE,QAA2B;IAC1F,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,QAAQ,CAAC,MAAM,GAAG,YAAY,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IACjG,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,GAAG,IAAI,EAAE,CAAC;IAClF,OAAO,kBAAkB,CAAC,QAAQ,EAAE,KAAK,EAAE,6DAA6D,CAAC,CAAC;AAC5G,CAAC;AAkBD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,qBAAqB,CACnC,EAAa,EACb,KAAgG;IAEhG,MAAM,OAAO,GAAG,mBAAmB,CAAC,EAAE,EAAE;QACtC,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC;QAClC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC;AAClD,CAAC;AAOD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB,CAC/B,EAAa,EACb,KAAoG;IAEpG,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IACnD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACtD,QAAQ;QACR,GAAG,qBAAqB,CAAC,EAAE,EAAE;YAC3B,QAAQ;YACR,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,EAAE,EAAE,KAAK;YACT,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC;SACrC,CAAC;KACH,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CACjC,EAAa,EACb,KAA+F;IAE/F,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,MAAM,MAAM,GAAG,SAAS,KAAK,CAAC,OAAO,EAAE,CAAC;IACxC,MAAM,MAAM,GAAG,EAAE,CAAC,GAAG,CACnB;;wBAEoB,EACpB,OAAO,EACP,MAAM,CAC8C,CAAC;IACvD,MAAM,MAAM,GAAG,EAAE,CAAC,GAAG,CACnB,2FAA2F,EAC3F,OAAO,EACP,0BAA0B,EAC1B,MAAM,CACP,CAAC,CAAC,CAA8C,CAAC;IAClD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IAEjH,MAAM,YAAY,GAAG,CAAC,QAAgB,EAAU,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACrF,IAAI,KAAK,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC9F,KAAK,MAAM,UAAU,IAAI,IAAI,EAAE,CAAC;YAC9B,EAAE,CAAC,GAAG,CACJ,8FAA8F,EAC9F,KAAK,CAAC,EAAE,EACR,OAAO,EACP,WAAW,UAAU,EAAE,EACvB,MAAM,CACP,CAAC;YACF,kFAAkF;YAClF,2DAA2D;YAC3D,EAAE,CAAC,GAAG,CACJ;sCAC8B,EAC9B,OAAO,EACP,GAAG,eAAe,GAAG,UAAU,EAAE,EACjC,MAAM,CACP,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,CAAC;QAC1D,IAAI,WAAW,EAAE,CAAC;YAChB,EAAE,CAAC,GAAG,CACJ;sCAC8B,EAC9B,OAAO,EACP,0BAA0B,EAC1B,MAAM,CACP,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACpF,CAAC;IAED,MAAM,OAAO,GAAG,EAAE,CAAC,GAAG,CACpB;;wBAEoB,EACpB,OAAO,EACP,MAAM,EACN,eAAe,CACU,CAAC;IAC5B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,EAAE,QAAQ,EAAE,IAAI,OAAO,EAAE,CAAC;QACnC,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,WAAW,UAAU,EAAE,IAAI,CAAC,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC;QACpG,IAAI,OAAO,EAAE,CAAC;YACZ,EAAE,CAAC,GAAG,CACJ,iGAAiG,EACjG,OAAO,EACP,WAAW,UAAU,EAAE,EACvB,MAAM,CACP,CAAC;YACF,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC5B,CAAC;QACD,EAAE,CAAC,GAAG,CACJ,8FAA8F,EAC9F,KAAK,CAAC,EAAE,EACR,OAAO,EACP,QAAQ,EACR,MAAM,CACP,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,CAAC;IACvE,IAAI,WAAW,EAAE,CAAC;QAChB,EAAE,CAAC,GAAG,CACJ,8FAA8F,EAC9F,KAAK,CAAC,EAAE,EACR,OAAO,EACP,0BAA0B,EAC1B,MAAM,CACP,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;AAC5F,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@substrat-run/kernel",
-  "version": "0.136.0",
+  "version": "0.137.0",
   "description": "Substrat kernel contracts and services — pure TypeScript, no platform imports (D-14)",
   "license": "AGPL-3.0-only",
   "repository": {
@@ -22,7 +22,7 @@
     "dist"
   ],
   "dependencies": {
-    "@substrat-run/contracts": "^0.136.0"
+    "@substrat-run/contracts": "^0.137.0"
   },
   "devDependencies": {
     "@types/node": "^22.20.4",