@substrat-run/kernel 0.136.0 → 0.138.0

package/dist/permission-eval.js

@@ -1,5 +1,6 @@
 import { objectRef, subjectRef, } from '@substrat-run/contracts';
 import { capabilityGrantOf, capabilityLive } from './capability.js';
+import { isSwitchableSubjectKind } from './system-switch.js';
 /**
  * The built-in constrained relationship-tuple evaluator (design doc §4.2, plan D-23),
  * as ONE implementation both adapters call.
@@ -49,6 +50,26 @@ const nodeObjectsOf = (node) => node.scopeId
         { obj: `tenant:${node.tenantId}`, scoped: false },
     ]
     : [{ obj: `tenant:${node.tenantId}`, scoped: false }];
+/**
+ * "Is this subject switched off on this scope?" — asked before any tuple is read, by `check`
+ * and `covers` alike, so a switched-off subject is denied on the scope whatever it holds
+ * (#1823). OFF tombstones the subject's SCOPE-level grants, but a TENANT-level grant lives in
+ * the directory (and, on the Durable-Object adapter, in every scope's projection of it), and
+ * OFF touches neither: without this, a tenant grant made before the switch was pulled kept the
+ * module's authority alive on a scope its operator had switched off. Asking the scope, rather
+ * than tombstoning the tenant tuple, is what confines the denial to the ONE scope (the algebra
+ * has no per-scope negative tuple), and what makes it survive a re-projection: no projection
+ * writes the switch's state.
+ *
+ * The answer is the reader's `switchedOff` — one seam, so where the switch's state is read
+ * from is the adapter's decision and the rule is the evaluator's. Fails CLOSED when a scope
+ * node has no reachable store: the switch cannot be read, so no grant can be vouched for.
+ */
+async function switchedOff(subject, node, scope) {
+    if (!isSwitchableSubjectKind(subject.kind) || !node.scopeId)
+        return false;
+    return scope ? await scope.switchedOff(subjectRef(subject)) : true;
+}
 /**
  * Rule 3's walk, as ONE function: from `start`, look for a hit at each frontier object, then
  * expand one level of declared `parent` edges, to `ENTITY_WALK_DEPTH`. `probe` decides what a
@@ -59,6 +80,13 @@ const nodeObjectsOf = (node) => node.scopeId
  */
 async function walkParents(scope, start, now, probe) {
     let frontier = [{ ref: start, chain: [] }];
+    // Each node is probed and expanded once, at the first (shallowest) depth it is reached,
+    // so the walk costs one `parents` read per distinct node — not one per PATH to it. A
+    // multi-parent row whose parents share an ancestor (a ticket0 message under N widget
+    // sessions, each under one conversation) would otherwise expand that ancestor N times
+    // (#1853). Shallowest-first keeps the answer: a later sighting is never closer to a hit
+    // and never reaches further within the depth bound.
+    const visited = new Set([start]);
     for (let depth = 0; depth <= ENTITY_WALK_DEPTH && frontier.length > 0; depth++) {
         for (const candidate of frontier) {
             const hit = await probe(candidate.ref, candidate.chain);
@@ -76,8 +104,9 @@ async function walkParents(scope, start, now, probe) {
                 // for grants and membership but silently NOT for entity edges — which is the
                 // case open question 15 is actually about (a facility moving management
                 // company must stop being reachable).
-                if (!live(p, now))
+                if (!live(p, now) || visited.has(p.object))
                     continue;
+                visited.add(p.object);
                 next.push({
                     ref: p.object,
                     chain: [...candidate.chain, t(p.subject, 'parent', p.object)],
@@ -88,6 +117,33 @@ async function walkParents(scope, start, now, probe) {
     }
     return undefined;
 }
+/**
+ * Is `entity` the `root`, or does it lie beneath it along live declared `parent` edges?
+ *
+ * The walk a capability check makes to its own root (`checkCapability` above), with no
+ * subject and no grant: a live read narrowed `within` an entity (#1853) asks exactly this
+ * of every frame, so it travels the same edges to the same depth, skipping the same
+ * revoked ones. A row linked to two parents (`ctx.link` twice) reaches either root; a row
+ * `ctx.relink`ed away from one reaches only the other (#1864).
+ */
+export async function reachesWithin(scope, entity, root, now) {
+    const target = `${root.entityType}:${root.entityId}`;
+    const hit = await walkParents(scope, `${entity.entityType}:${entity.entityId}`, now, async (ref) => ref === target ? true : undefined);
+    return hit === true;
+}
+/**
+ * Every root `reachesWithin` would answer `true` for, as `entityType:entityId` refs — the
+ * entity itself included. The same walk, run to its full depth once, for a caller asking
+ * about many roots: a live fan-out with one socket per widget session (#1853).
+ */
+export async function ancestorsWithin(scope, entity, now) {
+    const seen = new Set();
+    await walkParents(scope, `${entity.entityType}:${entity.entityId}`, now, async (ref) => {
+        seen.add(ref);
+        return undefined;
+    });
+    return seen;
+}
 /**
  * Build the evaluator over one adapter's reader. Stateless per call: everything it knows it
  * reads at check time, which is what makes check-after-write consistent (the "no zookies"
@@ -186,6 +242,8 @@ export function createTupleEvaluator(reader) {
         const now = reader.now();
         const deny = { allowed: false, checked: permission, node };
         const scope = reader.scopeFor(node);
+        if (await switchedOff(subject, node, scope))
+            return deny;
         const getRole = roleReaderFor(node.tenantId);
         // Rule 4 — membership: the subject set is the caller plus its orgs. Shared with
         // `covers` (§ `subjectsOf`).
@@ -278,6 +336,9 @@ export function createTupleEvaluator(reader) {
             }
             const now = reader.now();
             const scope = reader.scopeFor(node);
+            if (await switchedOff(subject, node, scope)) {
+                return { covered: false, missing: [...new Set(required)] };
+            }
             const subjects = await subjectsOf(subject, node, now);
             const getRole = roleReaderFor(node.tenantId);
             const held = new Set();
@@ -289,29 +350,87 @@ export function createTupleEvaluator(reader) {
                             : []
                         : await reader.tenantTuples(node.tenantId, s.ref, '');
                     for (const row of rows) {
-                        if (row.object !== nodeObj.obj || !live(row, now))
-                            continue;
-                        if (row.relation.startsWith('role:')) {
-                            const role = await getRole(row.relation.slice('role:'.length));
-                            for (const p of role?.permissions ?? [])
+                        const grant = heldBy(row, nodeObj.obj, now);
+                        if (grant?.role !== undefined)
+                            for (const p of (await getRole(grant.role))?.permissions ?? [])
                                 held.add(p);
-                        }
-                        else if (row.relation.startsWith('granted:')) {
-                            held.add(row.relation.slice('granted:'.length));
-                        }
+                        else if (grant)
+                            held.add(grant.permission);
                     }
                 }
             }
-            // Order follows the request so a refusal reads predictably; deduplicated so a caller
-            // passing the same key twice does not see it twice.
-            const missing = [];
-            for (const p of required) {
-                if (!held.has(p) && !missing.includes(p))
-                    missing.push(p);
-            }
-            return missing.length === 0 ? { covered: true, missing: [] } : { covered: false, missing };
+            return coverageOf(required, held);
         },
         check,
     };
 }
+/**
+ * `covers` at the TENANT node, synchronously (#1184): the K-21 set comparison over the
+ * principal and every org it is a live member of, each one's live tenant-level `role:` and
+ * `granted:` tuples, roles expanded. The membership executor's bound, asked again inside the
+ * unit that writes the role, so a grant, role definition or demotion landing between its
+ * early check and its write cannot be written past.
+ *
+ * The same answer as `createTupleEvaluator(reader).covers(principal, required, tenantNode)` —
+ * a tenant node has no scope store, no entity walk and no switch — which
+ * `permission-eval.test.ts` pins over the cases where the two could part.
+ */
+export function tenantCoverage(reader, tenantId, principal, required) {
+    if (required.length === 0)
+        return { covered: true, missing: [] };
+    const now = reader.now();
+    const tenantObj = `tenant:${tenantId}`;
+    const roles = new Map();
+    const permissionsOf = (key) => {
+        let permissions = roles.get(key);
+        if (!permissions)
+            roles.set(key, (permissions = reader.getRole(tenantId, key)?.permissions ?? []));
+        return permissions;
+    };
+    const held = new Set();
+    const fold = (rows) => {
+        for (const row of rows) {
+            const grant = heldBy(row, tenantObj, now);
+            if (grant?.role !== undefined)
+                for (const p of permissionsOf(grant.role))
+                    held.add(p);
+            else if (grant)
+                held.add(grant.permission);
+        }
+    };
+    // Rule 4, as `subjectsOf` has it: the principal's own rows, then each live org's — one read
+    // of the principal yields both its memberships and its own grants.
+    const own = reader.tenantTuples(tenantId, `principal:${principal}`, '');
+    fold(own);
+    for (const m of own) {
+        if (m.relation === 'member' && live(m, now))
+            fold(reader.tenantTuples(tenantId, m.object, ''));
+    }
+    return coverageOf(required, held);
+}
+/**
+ * What one tuple row contributes at `nodeObj` — a role to expand, a permission held directly, or
+ * nothing — for `covers` and `tenantCoverage` alike, so the two read a row the same way.
+ */
+function heldBy(row, nodeObj, now) {
+    if (row.object !== nodeObj || !live(row, now))
+        return undefined;
+    if (row.relation.startsWith('role:'))
+        return { role: row.relation.slice('role:'.length) };
+    if (row.relation.startsWith('granted:'))
+        return { permission: row.relation.slice('granted:'.length) };
+    return undefined;
+}
+/**
+ * `required` against `held`. Order follows the request so a refusal reads predictably;
+ * deduplicated so a caller passing the same key twice does not see it twice.
+ */
+function coverageOf(required, held) {
+    const missing = [];
+    for (const p of required) {
+        if (!held.has(p) && !missing.includes(p))
+            missing.push(p);
+    }
+    return missing.length === 0 ? { covered: true, missing: [] } : { covered: false, missing };
+}
 //# sourceMappingURL=permission-eval.js.map

package/dist/permission-eval.js.map

@@ -1 +1 @@
-{"version":3,"file":"permission-eval.js","sourceRoot":"","sources":["../src/permission-eval.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,UAAU,GASX,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAsB,MAAM,iBAAiB,CAAC;AAExF;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAqE5B,MAAM,CAAC,GAAG,CAAC,OAAe,EAAE,QAAgB,EAAE,MAAc,EAAiB,EAAE,CAAC,CAAC;IAC/E,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC;IACjC,QAAQ;IACR,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC;CAChC,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,IAAI,GAAG,CAAC,GAAuB,EAAE,GAAW,EAAW,EAAE,CAC7D,CAAC,GAAG,CAAC,UAAU,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC;AAE/E;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAc,EAAU,EAAE;IACrD,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAClE,OAAO,GAAG,GAAG,CAAC,YAAY,CAAC,iBAAiB,GAAG,CAAC,YAAY,CAAC,eAAe,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC;AACvG,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,aAAa,GAAG,CAAC,IAAU,EAAsC,EAAE,CACvE,IAAI,CAAC,OAAO;IACV,CAAC,CAAC;QACE,EAAE,GAAG,EAAE,SAAS,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;QAC9C,EAAE,GAAG,EAAE,UAAU,IAAI,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;KAClD;IACH,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,IAAI,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AAE1D;;;;;;;GAOG;AACH,KAAK,UAAU,WAAW,CACxB,KAAuB,EACvB,KAAa,EACb,GAAW,EACX,KAAsE;IAGtE,IAAI,QAAQ,GAAe,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;IACvD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,iBAAiB,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QAC/E,KAAK,MAAM,SAAS,IAAI,QAAQ,EAAE,CAAC;YACjC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;YACxD,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,GAAG,CAAC;QACpC,CAAC;QACD,gFAAgF;QAChF,oDAAoD;QACpD,IAAI,KAAK,KAAK,iBAAiB;YAAE,MAAM;QACvC,MAAM,IAAI,GAAe,EAAE,CAAC;QAC5B,KAAK,MAAM,SAAS,IAAI,QAAQ,EAAE,CAAC;YACjC,KAAK,MAAM,CAAC,IAAI,MAAM,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnD,+EAA+E;gBAC/E,6EAA6E;gBAC7E,wEAAwE;gBACxE,sCAAsC;gBACtC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC;oBAAE,SAAS;gBAC5B,IAAI,CAAC,IAAI,CAAC;oBACR,GAAG,EAAE,CAAC,CAAC,MAAM;oBACb,KAAK,EAAE,CAAC,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;iBAC9D,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAA6B;IAChE;;;;;;OAMG;IACH,MAAM,aAAa,GAAG,CAAC,QAAgB,EAAE,EAAE;QACzC,MAAM,IAAI,GAAG,IAAI,GAAG,EAA+C,CAAC;QACpE,OAAO,CAAC,GAAW,EAAuC,EAAE;YAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC1B,IAAI,GAAG;gBAAE,OAAO,GAAG,CAAC;YACpB,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;YAC/D,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YACvB,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC;IACJ,CAAC,CAAC;IAEF;;;;;;;;OAQG;IACH,MAAM,UAAU,GAAG,KAAK,EACtB,OAAqB,EACrB,IAAU,EACV,GAAW,EACsC,EAAE;QACnD,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,GAAG,GAA2C,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;QACvE,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YACjC,KAAK,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAC5E,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;oBAC5C,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACvE,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IAEF;;;;;;;;;;;;;;;;;;OAkBG;IACH,KAAK,UAAU,eAAe,CAC5B,EAAU,EACV,UAAyB,EACzB,IAAU,EACV,MAA6B;QAE7B,MAAM,IAAI,GAAa,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QACrE,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,EAAE,UAAU;YAAE,OAAO,IAAI,CAAC;QACpC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACvC,IAAI,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACnD,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC;QACtF,MAAM,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,UAAU,IAAI,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACnE,MAAM,IAAI,GAAG,cAAc,EAAE,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,MAAM,WAAW,CAC7B,KAAK,EACL,GAAG,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,EAAE,EACzC,GAAG,EACH,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CACpB,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,UAAU,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CACjF,CAAC;QACF,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,MAAM,MAAM,GAAG,MAAM,KAAK,CACxB,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,KAAK,CAAC,QAAQ,EAAE,EACzC,UAAU,EACV,IAAI,EACJ,MAAM,CACP,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QACjC,OAAO;YACL,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,aAAa,KAAK,CAAC,QAAQ,EAAE,CAAC,EAAE,GAAG,KAAK,CAAC;SACxF,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,KAAK,CAClB,OAAqB,EACrB,UAAyB,EACzB,IAAU,EACV,MAAkB;QAElB,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAClC,OAAO,eAAe,CAAC,OAAO,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,IAAI,GAAa,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QACrE,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAE7C,gFAAgF;QAChF,6BAA6B;QAC7B,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAEtD,0FAA0F;QAC1F,oFAAoF;QACpF,MAAM,SAAS,GAAG,KAAK,EACrB,eAAuB,EACvB,MAAc,EACd,MAAe,EACgB,EAAE,CACjC,CAAC,MAAM;YACL,CAAC,CAAC,KAAK;gBACL,CAAC,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC;gBAC7C,CAAC,CAAC,EAAE;YACN,CAAC,CAAC,MAAM,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,EAAE,MAAM,CAAC,CACpE,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;QAErD,KAAK,MAAM,OAAO,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACzB,2BAA2B;gBAC3B,KAAK,MAAM,GAAG,IAAI,MAAM,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;oBAClE,IAAI,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC;wBAAE,SAAS;oBAC5D,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;oBACnD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;oBACpC,IAAI,IAAI,EAAE,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;wBAC3C,OAAO;4BACL,OAAO,EAAE,IAAI;4BACb,KAAK,EAAE;gCACL,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gCACzB,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC;gCACxC,CAAC,CAAC,QAAQ,OAAO,EAAE,EAAE,WAAW,UAAU,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC;6BAC3D;yBACF,CAAC;oBACJ,CAAC;gBACH,CAAC;gBACD,6BAA6B;gBAC7B,KAAK,MAAM,GAAG,IAAI,MAAM,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,WAAW,UAAU,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;oBAClF,IACE,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC,GAAG;wBAC1B,GAAG,CAAC,QAAQ,KAAK,WAAW,UAAU,EAAE;wBACxC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,EACd,CAAC;wBACD,OAAO;4BACL,OAAO,EAAE,IAAI;4BACb,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;yBAC7E,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,qFAAqF;QACrF,kDAAkD;QAClD,IAAI,MAAM,IAAI,KAAK,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,MAAM,WAAW,CAC7B,KAAK,EACL,GAAG,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,EAAE,EACzC,GAAG,EACH,KAAK,EAAE,GAAG,EAAE,KAAK,EAAiC,EAAE;gBAClD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;oBACzB,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,WAAW,UAAU,EAAE,EAAE,GAAG,CAAC,CAAC;oBACrE,IAAI,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;wBAC9B,OAAO;4BACL,OAAO,EAAE,IAAI;4BACb,KAAK,EAAE;gCACL,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gCACzB,GAAG,KAAK;gCACR,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC;6BAC/C;yBACF,CAAC;oBACJ,CAAC;gBACH,CAAC;gBACD,OAAO,SAAS,CAAC;YACnB,CAAC,CACF,CAAC;YACF,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;QAC1B,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL;;;;;;;;;;;WAWG;QACH,KAAK,CAAC,MAAM,CACV,OAAqB,EACrB,QAAkC,EAClC,IAAU;YAEV,qFAAqF;YACrF,+CAA+C;YAC/C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;YACjE,qFAAqF;YACrF,qFAAqF;YACrF,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAClC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAwC,EAAE,CAAC;YACpG,CAAC;YAED,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACpC,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YACtD,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAE7C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;YAC/B,KAAK,MAAM,OAAO,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;oBACzB,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM;wBACzB,CAAC,CAAC,KAAK;4BACL,CAAC,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC;4BAC/B,CAAC,CAAC,EAAE;wBACN,CAAC,CAAC,MAAM,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;oBACxD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;wBACvB,IAAI,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC;4BAAE,SAAS;wBAC5D,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;4BACrC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;4BAC/D,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,WAAW,IAAI,EAAE;gCAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;wBACvD,CAAC;6BAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;4BAC/C,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;wBAClD,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YAED,qFAAqF;YACrF,oDAAoD;YACpD,MAAM,OAAO,GAAoB,EAAE,CAAC;YACpC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACzB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;oBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC5D,CAAC;YACD,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAC7F,CAAC;QAED,KAAK;KACN,CAAC;AAEJ,CAAC"}
+{"version":3,"file":"permission-eval.js","sourceRoot":"","sources":["../src/permission-eval.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,UAAU,GASX,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAsB,MAAM,iBAAiB,CAAC;AACxF,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAE7D;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,iBAAiB,GAAG,CAAC,CAAC;AA8E5B,MAAM,CAAC,GAAG,CAAC,OAAe,EAAE,QAAgB,EAAE,MAAc,EAAiB,EAAE,CAAC,CAAC;IAC/E,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC;IACjC,QAAQ;IACR,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC;CAChC,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,IAAI,GAAG,CAAC,GAAuB,EAAE,GAAW,EAAW,EAAE,CAC7D,CAAC,GAAG,CAAC,UAAU,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC;AAE/E;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAc,EAAU,EAAE;IACrD,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAClE,OAAO,GAAG,GAAG,CAAC,YAAY,CAAC,iBAAiB,GAAG,CAAC,YAAY,CAAC,eAAe,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC;AACvG,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,aAAa,GAAG,CAAC,IAAU,EAAsC,EAAE,CACvE,IAAI,CAAC,OAAO;IACV,CAAC,CAAC;QACE,EAAE,GAAG,EAAE,SAAS,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;QAC9C,EAAE,GAAG,EAAE,UAAU,IAAI,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;KAClD;IACH,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,IAAI,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AAE1D;;;;;;;;;;;;;;GAcG;AACH,KAAK,UAAU,WAAW,CAAC,OAAqB,EAAE,IAAU,EAAE,KAAmC;IAC/F,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC1E,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACrE,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,WAAW,CACxB,KAAwC,EACxC,KAAa,EACb,GAAW,EACX,KAAsE;IAGtE,IAAI,QAAQ,GAAe,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;IACvD,wFAAwF;IACxF,qFAAqF;IACrF,qFAAqF;IACrF,sFAAsF;IACtF,wFAAwF;IACxF,oDAAoD;IACpD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IACzC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,iBAAiB,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QAC/E,KAAK,MAAM,SAAS,IAAI,QAAQ,EAAE,CAAC;YACjC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;YACxD,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,GAAG,CAAC;QACpC,CAAC;QACD,gFAAgF;QAChF,oDAAoD;QACpD,IAAI,KAAK,KAAK,iBAAiB;YAAE,MAAM;QACvC,MAAM,IAAI,GAAe,EAAE,CAAC;QAC5B,KAAK,MAAM,SAAS,IAAI,QAAQ,EAAE,CAAC;YACjC,KAAK,MAAM,CAAC,IAAI,MAAM,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnD,+EAA+E;gBAC/E,6EAA6E;gBAC7E,wEAAwE;gBACxE,sCAAsC;gBACtC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;oBAAE,SAAS;gBACrD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;gBACtB,IAAI,CAAC,IAAI,CAAC;oBACR,GAAG,EAAE,CAAC,CAAC,MAAM;oBACb,KAAK,EAAE,CAAC,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;iBAC9D,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAwC,EACxC,MAAiB,EACjB,IAAe,EACf,GAAW;IAEX,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;IACrD,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,GAAG,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CACjG,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAClC,CAAC;IACF,OAAO,GAAG,KAAK,IAAI,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAwC,EACxC,MAAiB,EACjB,GAAW;IAEX,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,WAAW,CAAC,KAAK,EAAE,GAAG,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACrF,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAA6B;IAChE;;;;;;OAMG;IACH,MAAM,aAAa,GAAG,CAAC,QAAgB,EAAE,EAAE;QACzC,MAAM,IAAI,GAAG,IAAI,GAAG,EAA+C,CAAC;QACpE,OAAO,CAAC,GAAW,EAAuC,EAAE;YAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC1B,IAAI,GAAG;gBAAE,OAAO,GAAG,CAAC;YACpB,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;YAC/D,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YACvB,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC;IACJ,CAAC,CAAC;IAEF;;;;;;;;OAQG;IACH,MAAM,UAAU,GAAG,KAAK,EACtB,OAAqB,EACrB,IAAU,EACV,GAAW,EACsC,EAAE;QACnD,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,GAAG,GAA2C,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;QACvE,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YACjC,KAAK,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAC5E,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;oBAC5C,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACvE,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IAEF;;;;;;;;;;;;;;;;;;OAkBG;IACH,KAAK,UAAU,eAAe,CAC5B,EAAU,EACV,UAAyB,EACzB,IAAU,EACV,MAA6B;QAE7B,MAAM,IAAI,GAAa,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QACrE,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,EAAE,UAAU;YAAE,OAAO,IAAI,CAAC;QACpC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACvC,IAAI,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACnD,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC;QACtF,MAAM,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,UAAU,IAAI,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACnE,MAAM,IAAI,GAAG,cAAc,EAAE,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,MAAM,WAAW,CAC7B,KAAK,EACL,GAAG,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,EAAE,EACzC,GAAG,EACH,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CACpB,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,UAAU,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CACjF,CAAC;QACF,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,MAAM,MAAM,GAAG,MAAM,KAAK,CACxB,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,KAAK,CAAC,QAAQ,EAAE,EACzC,UAAU,EACV,IAAI,EACJ,MAAM,CACP,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QACjC,OAAO;YACL,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,aAAa,KAAK,CAAC,QAAQ,EAAE,CAAC,EAAE,GAAG,KAAK,CAAC;SACxF,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,KAAK,CAClB,OAAqB,EACrB,UAAyB,EACzB,IAAU,EACV,MAAkB;QAElB,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAClC,OAAO,eAAe,CAAC,OAAO,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,IAAI,GAAa,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QACrE,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,MAAM,WAAW,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACzD,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAE7C,gFAAgF;QAChF,6BAA6B;QAC7B,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAEtD,0FAA0F;QAC1F,oFAAoF;QACpF,MAAM,SAAS,GAAG,KAAK,EACrB,eAAuB,EACvB,MAAc,EACd,MAAe,EACgB,EAAE,CACjC,CAAC,MAAM;YACL,CAAC,CAAC,KAAK;gBACL,CAAC,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC;gBAC7C,CAAC,CAAC,EAAE;YACN,CAAC,CAAC,MAAM,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,EAAE,MAAM,CAAC,CACpE,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;QAErD,KAAK,MAAM,OAAO,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACzB,2BAA2B;gBAC3B,KAAK,MAAM,GAAG,IAAI,MAAM,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;oBAClE,IAAI,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC;wBAAE,SAAS;oBAC5D,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;oBACnD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;oBACpC,IAAI,IAAI,EAAE,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;wBAC3C,OAAO;4BACL,OAAO,EAAE,IAAI;4BACb,KAAK,EAAE;gCACL,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gCACzB,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC;gCACxC,CAAC,CAAC,QAAQ,OAAO,EAAE,EAAE,WAAW,UAAU,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC;6BAC3D;yBACF,CAAC;oBACJ,CAAC;gBACH,CAAC;gBACD,6BAA6B;gBAC7B,KAAK,MAAM,GAAG,IAAI,MAAM,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,WAAW,UAAU,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;oBAClF,IACE,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC,GAAG;wBAC1B,GAAG,CAAC,QAAQ,KAAK,WAAW,UAAU,EAAE;wBACxC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,EACd,CAAC;wBACD,OAAO;4BACL,OAAO,EAAE,IAAI;4BACb,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;yBAC7E,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,qFAAqF;QACrF,kDAAkD;QAClD,IAAI,MAAM,IAAI,KAAK,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,MAAM,WAAW,CAC7B,KAAK,EACL,GAAG,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,EAAE,EACzC,GAAG,EACH,KAAK,EAAE,GAAG,EAAE,KAAK,EAAiC,EAAE;gBAClD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;oBACzB,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,WAAW,UAAU,EAAE,EAAE,GAAG,CAAC,CAAC;oBACrE,IAAI,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;wBAC9B,OAAO;4BACL,OAAO,EAAE,IAAI;4BACb,KAAK,EAAE;gCACL,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gCACzB,GAAG,KAAK;gCACR,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC;6BAC/C;yBACF,CAAC;oBACJ,CAAC;gBACH,CAAC;gBACD,OAAO,SAAS,CAAC;YACnB,CAAC,CACF,CAAC;YACF,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;QAC1B,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL;;;;;;;;;;;WAWG;QACH,KAAK,CAAC,MAAM,CACV,OAAqB,EACrB,QAAkC,EAClC,IAAU;YAEV,qFAAqF;YACrF,+CAA+C;YAC/C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;YACjE,qFAAqF;YACrF,qFAAqF;YACrF,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAClC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAwC,EAAE,CAAC;YACpG,CAAC;YAED,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,MAAM,WAAW,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;gBAC5C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAwC,EAAE,CAAC;YACpG,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YACtD,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAE7C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;YAC/B,KAAK,MAAM,OAAO,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;oBACzB,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM;wBACzB,CAAC,CAAC,KAAK;4BACL,CAAC,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC;4BAC/B,CAAC,CAAC,EAAE;wBACN,CAAC,CAAC,MAAM,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;oBACxD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;wBACvB,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;wBAC5C,IAAI,KAAK,EAAE,IAAI,KAAK,SAAS;4BAAE,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,WAAW,IAAI,EAAE;gCAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;6BACtG,IAAI,KAAK;4BAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;oBAC7C,CAAC;gBACH,CAAC;YACH,CAAC;YACD,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACpC,CAAC;QAED,KAAK;KACN,CAAC;AAEJ,CAAC;AAaD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,cAAc,CAC5B,MAA6B,EAC7B,QAAgB,EAChB,SAAiB,EACjB,QAAkC;IAElC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACjE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,SAAS,GAAG,UAAU,QAAQ,EAAE,CAAC;IACvC,MAAM,KAAK,GAAG,IAAI,GAAG,EAA6B,CAAC;IACnD,MAAM,aAAa,GAAG,CAAC,GAAW,EAAqB,EAAE;QACvD,IAAI,WAAW,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,WAAW;YAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC;QACnG,OAAO,WAAW,CAAC;IACrB,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,IAAI,GAAG,CAAC,IAAmC,EAAE,EAAE;QACnD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;YAC1C,IAAI,KAAK,EAAE,IAAI,KAAK,SAAS;gBAAE,KAAK,MAAM,CAAC,IAAI,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC;oBAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;iBACjF,IAAI,KAAK;gBAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC,CAAC;IACF,4FAA4F;IAC5F,mEAAmE;IACnE,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,aAAa,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;IACxE,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACpB,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC;YAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,SAAS,MAAM,CACb,GAAuB,EACvB,OAAe,EACf,GAAW;IAEX,IAAI,GAAG,CAAC,MAAM,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAChE,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;IAC1F,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;IACtG,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CAAC,QAAkC,EAAE,IAAyB;IAC/E,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC7F,CAAC"}

package/dist/read-only-sql.d.ts

@@ -1,31 +1,7 @@
-/**
- * The textual gate in front of the scope SQL console (`HostAdmin.queryScope`, #219).
- *
- * `readScopeTable` is safe by construction — no user SQL ever reaches the DB. The
- * console breaks that, so read-only-ness has to be ENFORCED per statement, in two
- * layers: this shared scan (both adapters, same rejections, so a query that runs in
- * dev runs in prod), and an adapter-authoritative backstop behind it —
- * better-sqlite3's `prepare().readonly` (sqlite3_stmt_readonly) on the pure adapter,
- * and a transaction that always rolls back on the DO, whose `exec` exposes no
- * read-only flag.
- *
- * The scan works on bare tokens OUTSIDE comments, string literals, and quoted
- * identifiers ('…', "…", `…`, […]), so a `;` or an "update" inside a string never
- * trips it. It rejects:
- *  - anything that isn't a single statement (no `;` chaining — a trailing `;` is fine);
- *  - a first keyword outside SELECT / WITH / VALUES / EXPLAIN;
- *  - any bare write/DDL/session keyword ANYWHERE — because `WITH … INSERT INTO` is
- *    valid SQLite, the first keyword alone proves nothing.
- *
- * Deliberately over-strict: a bare token like `attach` used as an (unquoted) column
- * name is rejected even where SQLite would allow it. False positives cost a quoted
- * identifier in a console query; a false negative writes the spine. Callers get the
- * trimmed statement back and must pass THAT to the DB, so what was checked is what runs.
- */
 /**
  * Assert `sql` is one read-only statement; returns the trimmed statement to run.
- * Throws an `Error` whose message names the offending token — it crosses the RPC
- * boundary and lands in the console UI, so it is written for the person typing.
+ * Throws a `validation_failed` refusal whose message names the offending token — it
+ * lands in the console UI, so it is written for the person typing.
  */
 export declare function assertReadOnlyQuery(sql: string): string;
 //# sourceMappingURL=read-only-sql.d.ts.map

package/dist/read-only-sql.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"read-only-sql.d.ts","sourceRoot":"","sources":["../src/read-only-sql.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AA4BH;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CA0EvD"}
+{"version":3,"file":"read-only-sql.d.ts","sourceRoot":"","sources":["../src/read-only-sql.ts"],"names":[],"mappings":"AAyDA;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CA0EvD"}

package/dist/read-only-sql.js

@@ -1,3 +1,4 @@
+import { substratError } from '@substrat-run/contracts';
 /**
  * The textual gate in front of the scope SQL console (`HostAdmin.queryScope`, #219).
  *
@@ -46,10 +47,13 @@ const FORBIDDEN = new Set([
     'savepoint',
     'release',
 ]);
+/** The gate's refusal: the caller's mistake (`validation_failed`), under the `read-only console:` prefix. */
+const refuse = (reason) => substratError('validation_failed', `read-only console: ${reason}`);
+const SINGLE_STATEMENT = 'only a single statement is allowed';
 /**
  * Assert `sql` is one read-only statement; returns the trimmed statement to run.
- * Throws an `Error` whose message names the offending token — it crosses the RPC
- * boundary and lands in the console UI, so it is written for the person typing.
+ * Throws a `validation_failed` refusal whose message names the offending token — it
+ * lands in the console UI, so it is written for the person typing.
  */
 export function assertReadOnlyQuery(sql) {
     const tokens = [];
@@ -86,7 +90,7 @@ export function assertReadOnlyQuery(sql) {
                 i += 1;
             }
             if (statementEnded)
-                throw new Error('read-only console: only a single statement is allowed');
+                throw refuse(SINGLE_STATEMENT);
             continue;
         }
         if (c === '[') {
@@ -94,7 +98,7 @@ export function assertReadOnlyQuery(sql) {
                 i += 1;
             i += 1;
             if (statementEnded)
-                throw new Error('read-only console: only a single statement is allowed');
+                throw refuse(SINGLE_STATEMENT);
             continue;
         }
         if (c === ';') {
@@ -108,24 +112,24 @@ export function assertReadOnlyQuery(sql) {
             while (j < n && /[A-Za-z0-9_]/.test(sql[j]))
                 j += 1;
             if (statementEnded)
-                throw new Error('read-only console: only a single statement is allowed');
+                throw refuse(SINGLE_STATEMENT);
             tokens.push(sql.slice(i, j).toLowerCase());
             i = j;
             continue;
         }
         if (statementEnded && /\S/.test(c))
-            throw new Error('read-only console: only a single statement is allowed');
+            throw refuse(SINGLE_STATEMENT);
         i += 1;
     }
     const first = tokens[0];
     if (!first)
-        throw new Error('read-only console: empty statement');
+        throw refuse('empty statement');
     if (!FIRST_KEYWORDS.has(first)) {
-        throw new Error(`read-only console: statement must start with SELECT, WITH, VALUES, or EXPLAIN (got '${first.toUpperCase()}')`);
+        throw refuse(`statement must start with SELECT, WITH, VALUES, or EXPLAIN (got '${first.toUpperCase()}')`);
     }
     for (const t of tokens) {
         if (FORBIDDEN.has(t)) {
-            throw new Error(`read-only console: '${t.toUpperCase()}' is not allowed (quote it if it names a column or table)`);
+            throw refuse(`'${t.toUpperCase()}' is not allowed (quote it if it names a column or table)`);
         }
     }
     const trimmed = sql.trim();

package/dist/read-only-sql.js.map

@@ -1 +1 @@
-{"version":3,"file":"read-only-sql.js","sourceRoot":"","sources":["../src/read-only-sql.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;AAExE,kFAAkF;AAClF,2EAA2E;AAC3E,gFAAgF;AAChF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;IACxB,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,SAAS;IACT,OAAO;IACP,QAAQ;IACR,UAAU;IACV,WAAW;IACX,SAAS;CACV,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC;IACrB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAE,CAAC;QAClB,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACtB,IAAI,CAAC,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAC5B,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,IAAI,CAAC,CAAC;YACxC,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAC5B,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;gBAAE,CAAC,IAAI,CAAC,CAAC;YAChE,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACxC,4EAA4E;YAC5E,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACb,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;oBACjB,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;wBACrB,CAAC,IAAI,CAAC,CAAC;wBACP,SAAS;oBACX,CAAC;oBACD,CAAC,IAAI,CAAC,CAAC;oBACP,MAAM;gBACR,CAAC;gBACD,CAAC,IAAI,CAAC,CAAC;YACT,CAAC;YACD,IAAI,cAAc;gBAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;YAC7F,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG;gBAAE,CAAC,IAAI,CAAC,CAAC;YACvC,CAAC,IAAI,CAAC,CAAC;YACP,IAAI,cAAc;gBAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;YAC7F,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,sEAAsE;YACtE,cAAc,GAAG,IAAI,CAAC;YACtB,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACxB,IAAI,CAAC,GAAG,CAAC,CAAC;YACV,OAAO,CAAC,GAAG,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC;gBAAE,CAAC,IAAI,CAAC,CAAC;YACrD,IAAI,cAAc;gBAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;YAC7F,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YAC3C,CAAC,GAAG,CAAC,CAAC;YACN,SAAS;QACX,CAAC;QACD,IAAI,cAAc,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC7G,CAAC,IAAI,CAAC,CAAC;IACT,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAClE,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,uFAAuF,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAClI,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,uBAAuB,CAAC,CAAC,WAAW,EAAE,2DAA2D,CAClG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,OAAO,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;AACvE,CAAC"}
+{"version":3,"file":"read-only-sql.js","sourceRoot":"","sources":["../src/read-only-sql.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAExD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;AAExE,kFAAkF;AAClF,2EAA2E;AAC3E,gFAAgF;AAChF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;IACxB,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,SAAS;IACT,OAAO;IACP,QAAQ;IACR,UAAU;IACV,WAAW;IACX,SAAS;CACV,CAAC,CAAC;AAEH,6GAA6G;AAC7G,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,aAAa,CAAC,mBAAmB,EAAE,sBAAsB,MAAM,EAAE,CAAC,CAAC;AACtG,MAAM,gBAAgB,GAAG,oCAAoC,CAAC;AAE9D;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC;IACrB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAE,CAAC;QAClB,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACtB,IAAI,CAAC,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAC5B,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,IAAI,CAAC,CAAC;YACxC,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAC5B,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;gBAAE,CAAC,IAAI,CAAC,CAAC;YAChE,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACxC,4EAA4E;YAC5E,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACb,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;oBACjB,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;wBACrB,CAAC,IAAI,CAAC,CAAC;wBACP,SAAS;oBACX,CAAC;oBACD,CAAC,IAAI,CAAC,CAAC;oBACP,MAAM;gBACR,CAAC;gBACD,CAAC,IAAI,CAAC,CAAC;YACT,CAAC;YACD,IAAI,cAAc;gBAAE,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;YACnD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG;gBAAE,CAAC,IAAI,CAAC,CAAC;YACvC,CAAC,IAAI,CAAC,CAAC;YACP,IAAI,cAAc;gBAAE,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;YACnD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,sEAAsE;YACtE,cAAc,GAAG,IAAI,CAAC;YACtB,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACxB,IAAI,CAAC,GAAG,CAAC,CAAC;YACV,OAAO,CAAC,GAAG,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC;gBAAE,CAAC,IAAI,CAAC,CAAC;YACrD,IAAI,cAAc;gBAAE,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;YACnD,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YAC3C,CAAC,GAAG,CAAC,CAAC;YACN,SAAS;QACX,CAAC;QACD,IAAI,cAAc,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACnE,CAAC,IAAI,CAAC,CAAC;IACT,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,CAAC,KAAK;QAAE,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAC5C,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,MAAM,CAAC,oEAAoE,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAC5G,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACrB,MAAM,MAAM,CACV,IAAI,CAAC,CAAC,WAAW,EAAE,2DAA2D,CAC/E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,OAAO,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;AACvE,CAAC"}

package/dist/refusal-query.d.ts

@@ -18,10 +18,13 @@ export interface RefusalDbRow {
     scope_id: string | null;
     entity_type: string | null;
     entity_id: string | null;
-    from_state: string;
+    from_state: string | null;
     attempted_state: string | null;
     operation: string;
     invoked_operation: string | null;
+    guard: string | null;
+    /** NULL on a row written before the column; the kind implies it there. */
+    reason: string | null;
     actor: string;
     impersonation: string | null;
     invocation_id: string | null;

package/dist/refusal-query.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"refusal-query.d.ts","sourceRoot":"","sources":["../src/refusal-query.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,aAAa,EAClB,KAAK,aAAa,EACnB,MAAM,yBAAyB,CAAC;AAKjC;;;;;;;;GAQG;AAEH,kFAAkF;AAClF,eAAO,MAAM,eAAe,QAE+C,CAAC;AAE5E,0DAA0D;AAC1D,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAKD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,YAAY,GAAG,aAAa,CAuB9D;AAED,wDAAwD;AACxD,wBAAgB,gBAAgB,CAAC,MAAM,CAAC,EAAE,aAAa,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAA;CAAE,CA4BrG"}
+{"version":3,"file":"refusal-query.d.ts","sourceRoot":"","sources":["../src/refusal-query.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,aAAa,EAClB,KAAK,aAAa,EACnB,MAAM,yBAAyB,CAAC;AAKjC;;;;;;;;GAQG;AAEH,kFAAkF;AAClF,eAAO,MAAM,eAAe,QAE8D,CAAC;AAE3F,0DAA0D;AAC1D,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,0EAA0E;IAC1E,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAKD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,YAAY,GAAG,aAAa,CAwB9D;AAED,wDAAwD;AACxD,wBAAgB,gBAAgB,CAAC,MAAM,CAAC,EAAE,aAAa,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAA;CAAE,CA6BrG"}

package/dist/refusal-query.js

@@ -13,8 +13,8 @@ import { rowDecoder, UNDECODED_ACTOR } from './row-decode.js';
  */
 /** Every column of `_substrat_refusals`, in the order `mapRefusalRow` expects. */
 export const REFUSAL_COLUMNS = 'id, kind, tenant_id, scope_id, entity_type, entity_id, from_state, attempted_state, operation,' +
-    ' invoked_operation, actor, impersonation, invocation_id, at, drained_at';
-/** The problem code each recorded kind was refused with — the 409's `reason`. */
+    ' invoked_operation, guard, reason, actor, impersonation, invocation_id, at, drained_at';
+/** The problem code a row written before the `reason` column was refused with, by kind. */
 const REASON_OF_KIND = { transition: INVALID_TRANSITION };
 /**
  * Turn a stored row into the contract shape, tolerantly (#1636's rule for the denial log):
@@ -28,14 +28,15 @@ export function mapRefusalRow(row) {
     return d.finish({
         id: d.required('id', shape.id, row.id),
         kind,
-        reason: REASON_OF_KIND[kind] ?? null,
+        reason: d.nullable('reason', shape.reason, row.reason ?? null) ?? REASON_OF_KIND[kind] ?? null,
+        guard: d.nullable('guard', shape.guard, row.guard ?? null),
         actor: d.json('actor', shape.actor, row.actor, UNDECODED_ACTOR),
         actorKind: actorKindOf(row.actor),
         tenantId: d.required('tenant_id', shape.tenantId, row.tenant_id),
         scopeId: d.nullable('scope_id', shape.scopeId, row.scope_id ?? null),
         entityType: d.nullable('entity_type', shape.entityType, row.entity_type ?? null),
         entityId: d.nullable('entity_id', shape.entityId, row.entity_id ?? null),
-        fromState: d.required('from_state', shape.fromState, row.from_state),
+        fromState: d.nullable('from_state', shape.fromState, row.from_state ?? null),
         attemptedState: d.nullable('attempted_state', shape.attemptedState, row.attempted_state ?? null),
         operation: d.required('operation', shape.operation, row.operation),
         invokedOperation: d.nullable('invoked_operation', shape.invokedOperation, row.invoked_operation ?? null),
@@ -56,6 +57,7 @@ export function refusalListQuery(filter) {
         parts.push(`${column} = ?`);
         params.push(value);
     };
+    eq('kind', f.kind);
     eq('entity_type', f.entityType);
     eq('entity_id', f.entityId);
     eq('actor', f.actor === undefined ? undefined : storedActor(f.actor));

package/dist/refusal-query.js.map

@@ -1 +1 @@
-{"version":3,"file":"refusal-query.js","sourceRoot":"","sources":["../src/refusal-query.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,aAAa,EACb,aAAa,GAGd,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAE9D;;;;;;;;GAQG;AAEH,kFAAkF;AAClF,MAAM,CAAC,MAAM,eAAe,GAC1B,gGAAgG;IAChG,yEAAyE,CAAC;AAqB5E,iFAAiF;AACjF,MAAM,cAAc,GAAqC,EAAE,UAAU,EAAE,kBAAkB,EAAE,CAAC;AAE5F;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAAiB;IAC7C,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC;IAClC,MAAM,CAAC,GAAG,UAAU,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;IAC/E,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAS,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,CAAC,CAAC,MAAM,CAAgB;QAC7B,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAS,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC;QAC9C,IAAI;QACJ,MAAM,EAAE,cAAc,CAAC,IAAI,CAAC,IAAI,IAAI;QACpC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,eAAe,CAAC;QAC/D,SAAS,EAAE,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC;QACjC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC;QAChE,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC;QACpE,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,aAAa,EAAE,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC;QAChF,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC;QACxE,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAS,YAAY,EAAE,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC;QAC5E,cAAc,EAAE,CAAC,CAAC,QAAQ,CAAC,iBAAiB,EAAE,KAAK,CAAC,cAAc,EAAE,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC;QAChG,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAS,WAAW,EAAE,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC;QAC1E,gBAAgB,EAAE,CAAC,CAAC,QAAQ,CAAC,mBAAmB,EAAE,KAAK,CAAC,gBAAgB,EAAE,GAAG,CAAC,iBAAiB,IAAI,IAAI,CAAC;QACxG,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,aAAa,EAAE,GAAG,CAAC,aAAa,IAAI,IAAI,EAAE,IAAI,CAAC;QAC5F,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,eAAe,EAAE,KAAK,CAAC,YAAY,EAAE,GAAG,CAAC,aAAa,IAAI,IAAI,CAAC;QACxF,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAS,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC;QAC9C,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,YAAY,EAAE,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC;KAC7E,CAAC,CAAC;AACL,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,gBAAgB,CAAC,MAAsB;IACrD,MAAM,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAwB,EAAE,CAAC;IACvC,MAAM,EAAE,GAAG,CAAC,MAAc,EAAE,KAAyB,EAAQ,EAAE;QAC7D,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO;QAChC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,MAAM,CAAC,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC,CAAC;IACF,EAAE,CAAC,aAAa,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC;IAChC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC5B,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACtE,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;IAC7B,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC;IACpC,uFAAuF;IACvF,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IACD,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrB,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACnE,OAAO;QACL,GAAG,EAAE,UAAU,eAAe,2BAA2B,MAAM,2BAA2B;QAC1F,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC,KAAK,IAAI,qBAAqB,CAAC;KACtD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"refusal-query.js","sourceRoot":"","sources":["../src/refusal-query.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,aAAa,EACb,aAAa,GAGd,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAE9D;;;;;;;;GAQG;AAEH,kFAAkF;AAClF,MAAM,CAAC,MAAM,eAAe,GAC1B,gGAAgG;IAChG,wFAAwF,CAAC;AAwB3F,2FAA2F;AAC3F,MAAM,cAAc,GAAqC,EAAE,UAAU,EAAE,kBAAkB,EAAE,CAAC;AAE5F;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAAiB;IAC7C,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC;IAClC,MAAM,CAAC,GAAG,UAAU,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;IAC/E,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAS,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,CAAC,CAAC,MAAM,CAAgB;QAC7B,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAS,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC;QAC9C,IAAI;QACJ,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,IAAI;QAC9F,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,IAAI,CAAC;QAC1D,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,eAAe,CAAC;QAC/D,SAAS,EAAE,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC;QACjC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC;QAChE,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC;QACpE,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,aAAa,EAAE,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC;QAChF,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC;QACxE,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,YAAY,EAAE,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC;QAC5E,cAAc,EAAE,CAAC,CAAC,QAAQ,CAAC,iBAAiB,EAAE,KAAK,CAAC,cAAc,EAAE,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC;QAChG,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAS,WAAW,EAAE,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC;QAC1E,gBAAgB,EAAE,CAAC,CAAC,QAAQ,CAAC,mBAAmB,EAAE,KAAK,CAAC,gBAAgB,EAAE,GAAG,CAAC,iBAAiB,IAAI,IAAI,CAAC;QACxG,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,aAAa,EAAE,GAAG,CAAC,aAAa,IAAI,IAAI,EAAE,IAAI,CAAC;QAC5F,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,eAAe,EAAE,KAAK,CAAC,YAAY,EAAE,GAAG,CAAC,aAAa,IAAI,IAAI,CAAC;QACxF,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAS,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC;QAC9C,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,YAAY,EAAE,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC;KAC7E,CAAC,CAAC;AACL,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,gBAAgB,CAAC,MAAsB;IACrD,MAAM,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAwB,EAAE,CAAC;IACvC,MAAM,EAAE,GAAG,CAAC,MAAc,EAAE,KAAyB,EAAQ,EAAE;QAC7D,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO;QAChC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,MAAM,CAAC,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC,CAAC;IACF,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACnB,EAAE,CAAC,aAAa,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC;IAChC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC5B,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACtE,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;IAC7B,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC;IACpC,uFAAuF;IACvF,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IACD,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrB,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACnE,OAAO;QACL,GAAG,EAAE,UAAU,eAAe,2BAA2B,MAAM,2BAA2B;QAC1F,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC,KAAK,IAAI,qBAAqB,CAAC;KACtD,CAAC;AACJ,CAAC"}

package/dist/refusals.d.ts

@@ -1,11 +1,12 @@
 /**
- * Refused transitions, recorded (#1745).
+ * Refused transitions and refusing guards, recorded (#1745).
  *
  * An illegal move is refused inside the operation by `assertTransition`, which throws a
- * `conflict`. The operation's transaction rolls back with it, so nothing about the attempt
- * survives — the denial log holds permission refusals only, and the outbox only what
- * committed. That made "someone tried to reopen a closed conversation twelve times" a fact
- * nobody could see: not on the process map, not in a finding.
+ * `conflict`; a manifest-declared guard (K-38) refuses the operation it stands before the
+ * same way, before the handler runs. The operation's transaction rolls back with either, so
+ * nothing about the attempt survives — the denial log holds permission refusals only, and
+ * the outbox only what committed. That made "someone tried to reopen a closed conversation
+ * twelve times" a fact nobody could see: not on the process map, not in a finding.
  *
  * Recorded the way a denial is (K-35): on the failure path, AFTER the rollback, as a write
  * of its own, so the attempt survives the transaction that refused it. Kernel-owned and
@@ -14,13 +15,84 @@
  *
  * Only a refusal that FAILED the operation is recorded. One a vertical caught inside
  * `ctx.atomic` and recovered from is the vertical's business — its operation committed.
+ *
+ * **What a row holds, and what it never does.** Keys and vocabulary only: the record's type
+ * (held to the entity-type grammar, `refusalEntityType`) and id, state names, operation and
+ * predicate names, the problem code (held to the `problemReason` grammar), the actor's id
+ * and the call's. Never the error's message, the operation's input, or a guard's config —
+ * any of those can quote what a person typed. So a row has nothing for a subject erasure to rewrite
+ * (master-plan §5.3: pseudonymous keys and transaction facts remain), which is the denial
+ * log's position too, and it is kept the way the denial log is: `drained_at` marks a shipped
+ * row, and rows drain rather than expire.
  */
 import { refusedTransitionOf, type RefusedTransition } from '@substrat-run/contracts';
-export declare const REFUSALS_DDL = "\n  CREATE TABLE IF NOT EXISTS _substrat_refusals (\n    id TEXT PRIMARY KEY,\n    -- 'transition' today; a guard refusal (K-38) is the next kind, recorded the same way.\n    kind TEXT NOT NULL,\n    tenant_id TEXT NOT NULL,\n    scope_id TEXT,\n    -- The record the move was refused on. NULL when the caller of assertTransition did\n    -- not name it: the attempt is still recorded, and cannot be counted against an entity.\n    entity_type TEXT,\n    entity_id TEXT,\n    from_state TEXT NOT NULL,\n    -- Where the operation leads where it IS legal; NULL when that is not one state.\n    attempted_state TEXT,\n    -- The lifecycle's operation (what the edge is keyed by) and the invoke() string the\n    -- call ran as; the same today for every caller, kept apart because they need not be.\n    operation TEXT NOT NULL,\n    invoked_operation TEXT,\n    actor TEXT NOT NULL,\n    impersonation TEXT,\n    invocation_id TEXT,\n    at TEXT NOT NULL,\n    drained_at TEXT\n  );\n  -- The process map's read: one entity type's refusals in a window.\n  CREATE INDEX IF NOT EXISTS _substrat_refusals_entity_at ON _substrat_refusals (entity_type, at);\n";
+/** The table alone — what `REFUSALS_REBUILD` creates under its scratch name. */
+export declare const REFUSALS_TABLE_DDL = "\n  CREATE TABLE IF NOT EXISTS _substrat_refusals (\n    id TEXT PRIMARY KEY,\n    -- 'transition' (assertTransition) or 'guard' (a manifest-declared guard, K-38).\n    kind TEXT NOT NULL,\n    tenant_id TEXT NOT NULL,\n    scope_id TEXT,\n    -- The record the refusal was about. NULL when the refusing code did not name it: the\n    -- attempt is still recorded, and cannot be counted against an entity.\n    entity_type TEXT,\n    entity_id TEXT,\n    -- The state the record was in. NULL on a guard row: a guard stands before an operation,\n    -- and the kernel that ran it cannot know the state of the record behind it.\n    from_state TEXT,\n    -- Where the operation leads where it IS legal; NULL when that is not one state.\n    attempted_state TEXT,\n    -- The lifecycle's operation (what the edge is keyed by), or the one a guard stands\n    -- before, and the invoke() string the call ran as.\n    operation TEXT NOT NULL,\n    invoked_operation TEXT,\n    -- The guard's named predicate; NULL on a transition row.\n    guard TEXT,\n    -- The problem code the operation failed with (the 409's reason). NULL on a row written\n    -- before the column, where the kind implies it.\n    reason TEXT,\n    actor TEXT NOT NULL,\n    impersonation TEXT,\n    invocation_id TEXT,\n    at TEXT NOT NULL,\n    drained_at TEXT\n  );\n";
+/** The process map's read: one entity type's refusals in a window. */
+export declare const REFUSALS_INDEX = "\n  CREATE INDEX IF NOT EXISTS _substrat_refusals_entity_at ON _substrat_refusals (entity_type, at);\n";
+/**
+ * The table and its index. The adapters interpolate the two literals above instead, which
+ * is what `lint:spine-ddl` can resolve; this is for a caller that wants the whole thing.
+ */
+export declare const REFUSALS_DDL: string;
+/**
+ * `_substrat_refusals` rebuilt to the shape above on a store created before guard refusals:
+ * `from_state` loses its NOT NULL and `guard` / `reason` join. Create-copy-drop-rename,
+ * because SQLite cannot relax a constraint in place — `SCHEDULE_STATE_REBUILD`'s shape and
+ * reasons (#1288), detected the same way (`refusalsAdmitGuards`, off `sqlite_master.sql`,
+ * which DO SQLite serves and `PRAGMA` does not).
+ *
+ * The new table is `REFUSALS_TABLE_DDL` under a temporary name, so the rebuilt shape cannot drift
+ * from the created one, and every row is copied verbatim: the two new columns are NULL on a
+ * transition row written before them, which the reader takes as "implied by the kind". The
+ * index is dropped with the old table and created again on the renamed one.
+ *
+ * **Run inside the adapter's transaction API**, as both callers do: un-wrapped, a stop
+ * between the DROP and the RENAME leaves the next wake's `CREATE TABLE IF NOT EXISTS` an
+ * empty table of the new shape, detection reads it as migrated, and the copied rows are
+ * orphaned in the scratch table. The leading `DROP TABLE IF EXISTS` makes a re-run start
+ * clean. A restore never reaches this: it builds the table from the current DDL and loads a
+ * legacy dump's rows by column name.
+ */
+export declare const REFUSALS_REBUILD: string;
+/**
+ * Whether a store's `_substrat_refusals` already admits a guard row, read off the `sql`
+ * column of `sqlite_master`. `false` means `REFUSALS_REBUILD` is due.
+ */
+export declare function refusalsAdmitGuards(tableSql: string): boolean;
+/**
+ * A guard refusal, as the kernel records it: which predicate refused which operation, with
+ * which problem code, about which record. Stamped on the thrown error by the adapter that
+ * ran the guard (`markGuardRefusal`), under a registered symbol for `RefusedTransition`'s
+ * reason — none of it belongs in the problem document the caller is handed.
+ */
+export interface RefusedGuard {
+    kind: 'guard';
+    predicate: string;
+    /** The operation the guard stands before. */
+    operation: string;
+    /** The problem's `reason` code (`keptReason`), or null when it carried none. */
+    reason: string | null;
+    entityType: string | null;
+    entityId: string | null;
+}
+/**
+ * Mark a guard predicate's throw as a refusal, when it is one — called by both adapters'
+ * `runGuards` around each predicate, so the two cannot disagree about what counts.
+ *
+ * A refusal is a `conflict`: what a predicate throws to say "not yet" (`protocol_required`).
+ * Anything else — a validation failure, a bug, a denied check (which the denial log has) —
+ * is not a guard refusing, and is left unmarked. So is a throw that already carries a
+ * refused transition: it is recorded once, as the transition it is.
+ */
+export declare function markGuardRefusal(err: unknown, predicate: string, operation: string): void;
+/** The refusal an operation failed with — a transition, a guard, or null for anything else. */
+export declare function refusalOf(err: unknown): RefusedTransition | RefusedGuard | null;
 export interface RefusalRow {
     tenantId: string;
     scopeId: string | null;
-    refused: RefusedTransition;
+    /** What `refusalOf` returned. A `RefusedTransition` carries no `kind`: it is one. */
+    refused: RefusedTransition | RefusedGuard;
     invokedOperation: string | null;
     /** The actor, as the outbox stores one: JSON. */
     actor: string;
@@ -33,6 +105,6 @@ export declare function refusalInsert(row: RefusalRow): {
     sql: string;
     params: (string | null)[];
 };
-/** The refused transition an operation failed with, or null — what the adapters branch on. */
+/** The refused transition an operation failed with, or null. */
 export { refusedTransitionOf };
 //# sourceMappingURL=refusals.d.ts.map

package/dist/refusals.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"refusals.d.ts","sourceRoot":"","sources":["../src/refusals.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,mBAAmB,EAAE,KAAK,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAGtF,eAAO,MAAM,YAAY,qoCA0BxB,CAAC;AAEF,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,iBAAiB,CAAC;IAC3B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,iDAAiD;IACjD,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAA;CAAE,CAsBzF;AAED,8FAA8F;AAC9F,OAAO,EAAE,mBAAmB,EAAE,CAAC"}
+{"version":3,"file":"refusals.d.ts","sourceRoot":"","sources":["../src/refusals.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAOL,mBAAmB,EACnB,KAAK,iBAAiB,EACvB,MAAM,yBAAyB,CAAC;AAGjC,gFAAgF;AAChF,eAAO,MAAM,kBAAkB,+zCA+B9B,CAAC;AAEF,sEAAsE;AACtE,eAAO,MAAM,cAAc,2GAE1B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,YAAY,QAAsC,CAAC;AAEhE;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,gBAAgB,QAY5B,CAAC;AAEF;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAG7D;AAED;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,OAAO,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,6CAA6C;IAC7C,SAAS,EAAE,MAAM,CAAC;IAClB,gFAAgF;IAChF,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAID;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAYzF;AAYD,+FAA+F;AAC/F,wBAAgB,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,iBAAiB,GAAG,YAAY,GAAG,IAAI,CAM/E;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,qFAAqF;IACrF,OAAO,EAAE,iBAAiB,GAAG,YAAY,CAAC;IAC1C,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,iDAAiD;IACjD,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAA;CAAE,CA+BzF;AAED,gEAAgE;AAChE,OAAO,EAAE,mBAAmB,EAAE,CAAC"}