@substrat-run/kernel 0.136.0 → 0.138.0

package/dist/refusals.js

@@ -1,11 +1,12 @@
 /**
- * Refused transitions, recorded (#1745).
+ * Refused transitions and refusing guards, recorded (#1745).
  *
  * An illegal move is refused inside the operation by `assertTransition`, which throws a
- * `conflict`. The operation's transaction rolls back with it, so nothing about the attempt
- * survives — the denial log holds permission refusals only, and the outbox only what
- * committed. That made "someone tried to reopen a closed conversation twelve times" a fact
- * nobody could see: not on the process map, not in a finding.
+ * `conflict`; a manifest-declared guard (K-38) refuses the operation it stands before the
+ * same way, before the handler runs. The operation's transaction rolls back with either, so
+ * nothing about the attempt survives — the denial log holds permission refusals only, and
+ * the outbox only what committed. That made "someone tried to reopen a closed conversation
+ * twelve times" a fact nobody could see: not on the process map, not in a finding.
  *
  * Recorded the way a denial is (K-35): on the failure path, AFTER the rollback, as a write
  * of its own, so the attempt survives the transaction that refused it. Kernel-owned and
@@ -14,53 +15,171 @@
  *
  * Only a refusal that FAILED the operation is recorded. One a vertical caught inside
  * `ctx.atomic` and recovered from is the vertical's business — its operation committed.
+ *
+ * **What a row holds, and what it never does.** Keys and vocabulary only: the record's type
+ * (held to the entity-type grammar, `refusalEntityType`) and id, state names, operation and
+ * predicate names, the problem code (held to the `problemReason` grammar), the actor's id
+ * and the call's. Never the error's message, the operation's input, or a guard's config —
+ * any of those can quote what a person typed. So a row has nothing for a subject erasure to rewrite
+ * (master-plan §5.3: pseudonymous keys and transaction facts remain), which is the denial
+ * log's position too, and it is kept the way the denial log is: `drained_at` marks a shipped
+ * row, and rows drain rather than expire.
  */
-import { refusedTransitionOf } from '@substrat-run/contracts';
+import { errorCodeOf, INVALID_TRANSITION, problemReason, UNRECOGNIZED_REFUSAL_REASON, refusalEntityType, refusedRecordOf, refusedTransitionOf, } from '@substrat-run/contracts';
 import { ulid } from './ulid.js';
-export const REFUSALS_DDL = `
+/** The table alone — what `REFUSALS_REBUILD` creates under its scratch name. */
+export const REFUSALS_TABLE_DDL = `
   CREATE TABLE IF NOT EXISTS _substrat_refusals (
     id TEXT PRIMARY KEY,
-    -- 'transition' today; a guard refusal (K-38) is the next kind, recorded the same way.
+    -- 'transition' (assertTransition) or 'guard' (a manifest-declared guard, K-38).
     kind TEXT NOT NULL,
     tenant_id TEXT NOT NULL,
     scope_id TEXT,
-    -- The record the move was refused on. NULL when the caller of assertTransition did
-    -- not name it: the attempt is still recorded, and cannot be counted against an entity.
+    -- The record the refusal was about. NULL when the refusing code did not name it: the
+    -- attempt is still recorded, and cannot be counted against an entity.
     entity_type TEXT,
     entity_id TEXT,
-    from_state TEXT NOT NULL,
+    -- The state the record was in. NULL on a guard row: a guard stands before an operation,
+    -- and the kernel that ran it cannot know the state of the record behind it.
+    from_state TEXT,
     -- Where the operation leads where it IS legal; NULL when that is not one state.
     attempted_state TEXT,
-    -- The lifecycle's operation (what the edge is keyed by) and the invoke() string the
-    -- call ran as; the same today for every caller, kept apart because they need not be.
+    -- The lifecycle's operation (what the edge is keyed by), or the one a guard stands
+    -- before, and the invoke() string the call ran as.
     operation TEXT NOT NULL,
     invoked_operation TEXT,
+    -- The guard's named predicate; NULL on a transition row.
+    guard TEXT,
+    -- The problem code the operation failed with (the 409's reason). NULL on a row written
+    -- before the column, where the kind implies it.
+    reason TEXT,
     actor TEXT NOT NULL,
     impersonation TEXT,
     invocation_id TEXT,
     at TEXT NOT NULL,
     drained_at TEXT
   );
-  -- The process map's read: one entity type's refusals in a window.
+`;
+/** The process map's read: one entity type's refusals in a window. */
+export const REFUSALS_INDEX = `
   CREATE INDEX IF NOT EXISTS _substrat_refusals_entity_at ON _substrat_refusals (entity_type, at);
 `;
+/**
+ * The table and its index. The adapters interpolate the two literals above instead, which
+ * is what `lint:spine-ddl` can resolve; this is for a caller that wants the whole thing.
+ */
+export const REFUSALS_DDL = REFUSALS_TABLE_DDL + REFUSALS_INDEX;
+/**
+ * `_substrat_refusals` rebuilt to the shape above on a store created before guard refusals:
+ * `from_state` loses its NOT NULL and `guard` / `reason` join. Create-copy-drop-rename,
+ * because SQLite cannot relax a constraint in place — `SCHEDULE_STATE_REBUILD`'s shape and
+ * reasons (#1288), detected the same way (`refusalsAdmitGuards`, off `sqlite_master.sql`,
+ * which DO SQLite serves and `PRAGMA` does not).
+ *
+ * The new table is `REFUSALS_TABLE_DDL` under a temporary name, so the rebuilt shape cannot drift
+ * from the created one, and every row is copied verbatim: the two new columns are NULL on a
+ * transition row written before them, which the reader takes as "implied by the kind". The
+ * index is dropped with the old table and created again on the renamed one.
+ *
+ * **Run inside the adapter's transaction API**, as both callers do: un-wrapped, a stop
+ * between the DROP and the RENAME leaves the next wake's `CREATE TABLE IF NOT EXISTS` an
+ * empty table of the new shape, detection reads it as migrated, and the copied rows are
+ * orphaned in the scratch table. The leading `DROP TABLE IF EXISTS` makes a re-run start
+ * clean. A restore never reaches this: it builds the table from the current DDL and loads a
+ * legacy dump's rows by column name.
+ */
+export const REFUSALS_REBUILD = `
+  DROP TABLE IF EXISTS _substrat_refusals_new;
+  ${REFUSALS_TABLE_DDL.replace('CREATE TABLE IF NOT EXISTS _substrat_refusals (', 'CREATE TABLE _substrat_refusals_new (')}
+  INSERT INTO _substrat_refusals_new
+    (id, kind, tenant_id, scope_id, entity_type, entity_id, from_state, attempted_state,
+     operation, invoked_operation, actor, impersonation, invocation_id, at, drained_at)
+    SELECT id, kind, tenant_id, scope_id, entity_type, entity_id, from_state, attempted_state,
+           operation, invoked_operation, actor, impersonation, invocation_id, at, drained_at
+      FROM _substrat_refusals;
+  DROP TABLE _substrat_refusals;
+  ALTER TABLE _substrat_refusals_new RENAME TO _substrat_refusals;
+  ${REFUSALS_INDEX}
+`;
+/**
+ * Whether a store's `_substrat_refusals` already admits a guard row, read off the `sql`
+ * column of `sqlite_master`. `false` means `REFUSALS_REBUILD` is due.
+ */
+export function refusalsAdmitGuards(tableSql) {
+    // Line-anchored: the stored DDL keeps its comments, and a comment may say "guard".
+    return /^\s*guard TEXT,?\s*$/m.test(tableSql);
+}
+const REFUSED_GUARD = Symbol.for('substrat.refused-guard');
+/**
+ * Mark a guard predicate's throw as a refusal, when it is one — called by both adapters'
+ * `runGuards` around each predicate, so the two cannot disagree about what counts.
+ *
+ * A refusal is a `conflict`: what a predicate throws to say "not yet" (`protocol_required`).
+ * Anything else — a validation failure, a bug, a denied check (which the denial log has) —
+ * is not a guard refusing, and is left unmarked. So is a throw that already carries a
+ * refused transition: it is recorded once, as the transition it is.
+ */
+export function markGuardRefusal(err, predicate, operation) {
+    if (err === null || typeof err !== 'object' || refusedTransitionOf(err))
+        return;
+    if (errorCodeOf(err) !== 'conflict')
+        return;
+    const record = refusedRecordOf(err);
+    err[REFUSED_GUARD] = {
+        kind: 'guard',
+        predicate,
+        operation,
+        reason: keptReason(err.extensions?.reason),
+        entityType: record?.entityType ?? null,
+        entityId: record?.entityId ?? null,
+    };
+}
+/**
+ * The reason a row keeps: the problem's code when it is one (`problemReason`), the fixed
+ * `UNRECOGNIZED_REFUSAL_REASON` when it is anything else, null when there was none. The
+ * wire accepts any non-empty string here, so a predicate could put request text in it.
+ */
+function keptReason(reason) {
+    if (reason === undefined || reason === null)
+        return null;
+    return problemReason.safeParse(reason).success ? reason : UNRECOGNIZED_REFUSAL_REASON;
+}
+/** The refusal an operation failed with — a transition, a guard, or null for anything else. */
+export function refusalOf(err) {
+    const transition = refusedTransitionOf(err);
+    if (transition)
+        return transition;
+    if (err === null || typeof err !== 'object')
+        return null;
+    const g = err[REFUSED_GUARD];
+    return g !== null && typeof g === 'object' ? g : null;
+}
 /** The one INSERT both adapters run, so the rows they write cannot differ. */
 export function refusalInsert(row) {
+    const r = row.refused;
+    const guard = 'kind' in r && r.kind === 'guard' ? r : null;
+    const transition = guard ? null : r;
     return {
         sql: `INSERT INTO _substrat_refusals
             (id, kind, tenant_id, scope_id, entity_type, entity_id, from_state, attempted_state,
-             operation, invoked_operation, actor, impersonation, invocation_id, at)
-          VALUES (?, 'transition', ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+             operation, invoked_operation, guard, reason, actor, impersonation, invocation_id, at)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
         params: [
             ulid(),
+            guard ? 'guard' : 'transition',
             row.tenantId,
             row.scopeId,
-            row.refused.entityType,
-            row.refused.entityId,
-            row.refused.from,
-            row.refused.attempted,
-            row.refused.operation,
+            // The type reaches here from code that may be handed request data; kept only when it
+            // is spelled as one. The id stays: it is the record's key, the join every log shares.
+            refusalEntityType(r.entityType),
+            r.entityId,
+            transition?.from ?? null,
+            transition?.attempted ?? null,
+            r.operation,
             row.invokedOperation,
+            guard?.predicate ?? null,
+            // Bounded here too, the one INSERT, so no caller of this function can keep raw text.
+            guard ? keptReason(guard.reason) : INVALID_TRANSITION,
             row.actor,
             row.impersonation,
             row.invocationId,
@@ -68,6 +187,6 @@ export function refusalInsert(row) {
         ],
     };
 }
-/** The refused transition an operation failed with, or null — what the adapters branch on. */
+/** The refused transition an operation failed with, or null. */
 export { refusedTransitionOf };
 //# sourceMappingURL=refusals.js.map

package/dist/refusals.js.map

@@ -1 +1 @@
-{"version":3,"file":"refusals.js","sourceRoot":"","sources":["../src/refusals.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,mBAAmB,EAA0B,MAAM,yBAAyB,CAAC;AACtF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;CA0B3B,CAAC;AAcF,8EAA8E;AAC9E,MAAM,UAAU,aAAa,CAAC,GAAe;IAC3C,OAAO;QACL,GAAG,EAAE;;;uEAG8D;QACnE,MAAM,EAAE;YACN,IAAI,EAAE;YACN,GAAG,CAAC,QAAQ;YACZ,GAAG,CAAC,OAAO;YACX,GAAG,CAAC,OAAO,CAAC,UAAU;YACtB,GAAG,CAAC,OAAO,CAAC,QAAQ;YACpB,GAAG,CAAC,OAAO,CAAC,IAAI;YAChB,GAAG,CAAC,OAAO,CAAC,SAAS;YACrB,GAAG,CAAC,OAAO,CAAC,SAAS;YACrB,GAAG,CAAC,gBAAgB;YACpB,GAAG,CAAC,KAAK;YACT,GAAG,CAAC,aAAa;YACjB,GAAG,CAAC,YAAY;YAChB,GAAG,CAAC,EAAE;SACP;KACF,CAAC;AACJ,CAAC;AAED,8FAA8F;AAC9F,OAAO,EAAE,mBAAmB,EAAE,CAAC"}
+{"version":3,"file":"refusals.js","sourceRoot":"","sources":["../src/refusals.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,2BAA2B,EAC3B,iBAAiB,EACjB,eAAe,EACf,mBAAmB,GAEpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,gFAAgF;AAChF,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+BjC,CAAC;AAEF,sEAAsE;AACtE,MAAM,CAAC,MAAM,cAAc,GAAG;;CAE7B,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,kBAAkB,GAAG,cAAc,CAAC;AAEhE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;;IAE5B,kBAAkB,CAAC,OAAO,CAAC,iDAAiD,EAAE,uCAAuC,CAAC;;;;;;;;;IAStH,cAAc;CACjB,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgB;IAClD,mFAAmF;IACnF,OAAO,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAChD,CAAC;AAmBD,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;AAE3D;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAY,EAAE,SAAiB,EAAE,SAAiB;IACjF,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,mBAAmB,CAAC,GAAG,CAAC;QAAE,OAAO;IAChF,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,UAAU;QAAE,OAAO;IAC5C,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACnC,GAAoC,CAAC,aAAa,CAAC,GAAG;QACrD,IAAI,EAAE,OAAO;QACb,SAAS;QACT,SAAS;QACT,MAAM,EAAE,UAAU,CAAE,GAA6C,CAAC,UAAU,EAAE,MAAM,CAAC;QACrF,UAAU,EAAE,MAAM,EAAE,UAAU,IAAI,IAAI;QACtC,QAAQ,EAAE,MAAM,EAAE,QAAQ,IAAI,IAAI;KACnC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,MAAe;IACjC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,aAAa,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAE,MAAiB,CAAC,CAAC,CAAC,2BAA2B,CAAC;AACpG,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,SAAS,CAAC,GAAY;IACpC,MAAM,UAAU,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAClC,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,CAAC,GAAI,GAA+B,CAAC,aAAa,CAAC,CAAC;IAC1D,OAAO,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAkB,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1E,CAAC;AAeD,8EAA8E;AAC9E,MAAM,UAAU,aAAa,CAAC,GAAe;IAC3C,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC;IACtB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3D,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,CAAuB,CAAC;IAC3D,OAAO;QACL,GAAG,EAAE;;;kEAGyD;QAC9D,MAAM,EAAE;YACN,IAAI,EAAE;YACN,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY;YAC9B,GAAG,CAAC,QAAQ;YACZ,GAAG,CAAC,OAAO;YACX,qFAAqF;YACrF,sFAAsF;YACtF,iBAAiB,CAAC,CAAC,CAAC,UAAU,CAAC;YAC/B,CAAC,CAAC,QAAQ;YACV,UAAU,EAAE,IAAI,IAAI,IAAI;YACxB,UAAU,EAAE,SAAS,IAAI,IAAI;YAC7B,CAAC,CAAC,SAAS;YACX,GAAG,CAAC,gBAAgB;YACpB,KAAK,EAAE,SAAS,IAAI,IAAI;YACxB,qFAAqF;YACrF,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,kBAAkB;YACrD,GAAG,CAAC,KAAK;YACT,GAAG,CAAC,aAAa;YACjB,GAAG,CAAC,YAAY;YAChB,GAAG,CAAC,EAAE;SACP;KACF,CAAC;AACJ,CAAC;AAED,gEAAgE;AAChE,OAAO,EAAE,mBAAmB,EAAE,CAAC"}

package/dist/scope-copy.d.ts

@@ -13,6 +13,24 @@ import type { SwitchSql } from './system-switch.js';
  * An unknown source (`sourceScopeId` or `destScopeId` absent) counts as a copy: a load that cannot
  * say where the dump came from cannot show it is a return. Only a control plane that predates the
  * field sends a restore with no source.
+ *
+ * Two kinds of state are decided here without a rule in the load, because the load never sees
+ * the part that holds the power (#2004):
+ *
+ * - **Staff impersonation sessions (K-42).** `_substrat_impersonations` is a DIRECTORY table on
+ *   both adapters, never a scope table, so no dump carries a session and a copy holds none. The
+ *   session's power is checked at the door, against the (tenant, scope) the session names
+ *   (`assertSessionUsable`), so a live session opened on the source is refused at every copy of
+ *   it and still honoured at the source after a return. What a copy does carry is the history:
+ *   the impersonation stamps on the rows the session wrote, as the source recorded them.
+ * - **Cross-vertical import cursors (#1705).** `_substrat_import_cursors` and `_substrat_imports`
+ *   are carried as they are, on a copy and on a return. A cursor is written in the same
+ *   transaction as the import handlers' writes, so it describes the data it sits beside, and the
+ *   journal is what dedupes a re-delivery. Reset either and the data would be handed events whose
+ *   effects it already holds. The power to consume lives in the delivery, not the cursor: the
+ *   sweep visits primary scopes only (`isPrimaryScope`), and `deliverToPeer` into a copy answers
+ *   `paused` with nothing run and the watermark unmoved. The producer keeps no record of a
+ *   consumer's position, so a copy's cursor acknowledges nothing at the source either.
  */
 export declare const isCopyLoad: (destScopeId: string | undefined, sourceScopeId: string | undefined) => boolean;
 /**

package/dist/scope-copy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope-copy.d.ts","sourceRoot":"","sources":["../src/scope-copy.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAEpD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,UAAU,gBAAiB,MAAM,GAAG,SAAS,iBAAiB,MAAM,GAAG,SAAS,KAAG,OACpC,CAAC;AAK7D;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,SAAS;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,SAAS,OAAO,EAAE,CAAA;CAAE,EACtF,MAAM,EAAE,CAAC,EAAE,EACX,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,aAAa,EAAE,MAAM,GAAG,SAAS,GAChC,CAAC,EAAE,CAGL;AAcD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,eAAe,8cAW3B,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,WAAW,sBAAiB,MACqD,CAAC;AAE/F;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,SAAS,EACd,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,GAAG,EAAE,MAAM,GACV,IAAI,CAiDN;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAInE;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,QAEa,CAAC;AAE/C;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,SAAS,GAAG,SAAS,GAAG,QAAQ,CAIpE;AAED;;;;;GAKG;AACH,eAAO,MAAM,WAAW,0FAA0F,CAAC"}
+{"version":3,"file":"scope-copy.d.ts","sourceRoot":"","sources":["../src/scope-copy.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAEpD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,UAAU,gBAAiB,MAAM,GAAG,SAAS,iBAAiB,MAAM,GAAG,SAAS,KAAG,OACpC,CAAC;AAK7D;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,SAAS;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,SAAS,OAAO,EAAE,CAAA;CAAE,EACtF,MAAM,EAAE,CAAC,EAAE,EACX,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,aAAa,EAAE,MAAM,GAAG,SAAS,GAChC,CAAC,EAAE,CAGL;AAcD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,eAAe,8cAW3B,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,WAAW,sBAAiB,MACqD,CAAC;AAE/F;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,SAAS,EACd,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,GAAG,EAAE,MAAM,GACV,IAAI,CAiDN;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAInE;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,QAEa,CAAC;AAE/C;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,SAAS,GAAG,SAAS,GAAG,QAAQ,CAIpE;AAED;;;;;GAKG;AACH,eAAO,MAAM,WAAW,0FAA0F,CAAC"}

package/dist/scope-copy.js

@@ -13,6 +13,24 @@ import { CAPABILITY_TABLE_NAMES } from './capability.js';
  * An unknown source (`sourceScopeId` or `destScopeId` absent) counts as a copy: a load that cannot
  * say where the dump came from cannot show it is a return. Only a control plane that predates the
  * field sends a restore with no source.
+ *
+ * Two kinds of state are decided here without a rule in the load, because the load never sees
+ * the part that holds the power (#2004):
+ *
+ * - **Staff impersonation sessions (K-42).** `_substrat_impersonations` is a DIRECTORY table on
+ *   both adapters, never a scope table, so no dump carries a session and a copy holds none. The
+ *   session's power is checked at the door, against the (tenant, scope) the session names
+ *   (`assertSessionUsable`), so a live session opened on the source is refused at every copy of
+ *   it and still honoured at the source after a return. What a copy does carry is the history:
+ *   the impersonation stamps on the rows the session wrote, as the source recorded them.
+ * - **Cross-vertical import cursors (#1705).** `_substrat_import_cursors` and `_substrat_imports`
+ *   are carried as they are, on a copy and on a return. A cursor is written in the same
+ *   transaction as the import handlers' writes, so it describes the data it sits beside, and the
+ *   journal is what dedupes a re-delivery. Reset either and the data would be handed events whose
+ *   effects it already holds. The power to consume lives in the delivery, not the cursor: the
+ *   sweep visits primary scopes only (`isPrimaryScope`), and `deliverToPeer` into a copy answers
+ *   `paused` with nothing run and the watermark unmoved. The producer keeps no record of a
+ *   consumer's position, so a copy's cursor acknowledges nothing at the source either.
  */
 export const isCopyLoad = (destScopeId, sourceScopeId) => destScopeId === undefined || sourceScopeId !== destScopeId;
 /** The capability tables, as `capabilitiesForLoad` matches a dump's (lowercased) names. */

package/dist/scope-copy.js.map

@@ -1 +1 @@
-{"version":3,"file":"scope-copy.js","sourceRoot":"","sources":["../src/scope-copy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAGzD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,WAA+B,EAAE,aAAiC,EAAW,EAAE,CACxG,WAAW,KAAK,SAAS,IAAI,aAAa,KAAK,WAAW,CAAC;AAE7D,2FAA2F;AAC3F,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC,sBAAsB,CAAC,CAAC;AAE/E;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAW,EACX,WAA+B,EAC/B,aAAiC;IAEjC,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,aAAa,CAAC;QAAE,OAAO,MAAM,CAAC;IAC3D,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACnG,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,GAAG,CAAC,aAAiC,EAAU,EAAE,CAC/D,4BAA4B,aAAa,CAAC,CAAC,CAAC,SAAS,aAAa,EAAE,CAAC,CAAC,CAAC,eAAe,kBAAkB;IACxG,yDAAyD,CAAC;AAE5D,0FAA0F;AAC1F,MAAM,mBAAmB,GAAG,IAAI,CAAC,SAAS,CAAC;IACzC,MAAM,EAAE,UAAU;IAClB,IAAI,EAAE,qBAAqB;IAC3B,UAAU,EAAE,IAAI;CACgB,CAAC,CAAC;AAEpC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;;;;;;;;;;;CAW9B,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAAK,GAAG,EAAE,EAAU,EAAE,CAChD,GAAG,KAAK,oFAAoF,CAAC;AAE/F;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAAc,EACd,WAA+B,EAC/B,aAAiC,EACjC,GAAW;IAEX,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,aAAa,CAAC;QAAE,OAAO;IACpD,MAAM,MAAM,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC;IACzC,GAAG,CAAC,GAAG,CACL;;+BAE2B,EAC3B,MAAM,EACN,mBAAmB,EACnB,GAAG,CACJ,CAAC;IACF,GAAG,CAAC,GAAG,CACL;wCACoC,EACpC,MAAM,EACN,GAAG,CACJ,CAAC;IACF,GAAG,CAAC,GAAG,CACL;;+BAE2B,EAC3B,MAAM,EACN,GAAG,EACH,GAAG,CACJ,CAAC;IACF,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC7E,8FAA8F;IAC9F,+FAA+F;IAC/F,6FAA6F;IAC7F,yBAAyB;IACzB,EAAE;IACF,6FAA6F;IAC7F,wFAAwF;IACxF,0FAA0F;IAC1F,qBAAqB;IACrB,GAAG,CAAC,GAAG,CACL;;;;;;;;mEAQ+D,EAC/D,aAAa,IAAI,IAAI,EACrB,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAC1C,GAAG,CACJ,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,GAAc,EAAE,GAAW;IACxD,IAAI,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAClD,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;IACnC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAC/B,yHAAyH;IACzH,4CAA4C,CAAC;AAE/C;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,GAAc;IAC5C,IAAI,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IACvD,GAAG,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC;IACrE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,uFAAuF,CAAC"}
+{"version":3,"file":"scope-copy.js","sourceRoot":"","sources":["../src/scope-copy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAGzD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,WAA+B,EAAE,aAAiC,EAAW,EAAE,CACxG,WAAW,KAAK,SAAS,IAAI,aAAa,KAAK,WAAW,CAAC;AAE7D,2FAA2F;AAC3F,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC,sBAAsB,CAAC,CAAC;AAE/E;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAW,EACX,WAA+B,EAC/B,aAAiC;IAEjC,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,aAAa,CAAC;QAAE,OAAO,MAAM,CAAC;IAC3D,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACnG,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,GAAG,CAAC,aAAiC,EAAU,EAAE,CAC/D,4BAA4B,aAAa,CAAC,CAAC,CAAC,SAAS,aAAa,EAAE,CAAC,CAAC,CAAC,eAAe,kBAAkB;IACxG,yDAAyD,CAAC;AAE5D,0FAA0F;AAC1F,MAAM,mBAAmB,GAAG,IAAI,CAAC,SAAS,CAAC;IACzC,MAAM,EAAE,UAAU;IAClB,IAAI,EAAE,qBAAqB;IAC3B,UAAU,EAAE,IAAI;CACgB,CAAC,CAAC;AAEpC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;;;;;;;;;;;CAW9B,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAAK,GAAG,EAAE,EAAU,EAAE,CAChD,GAAG,KAAK,oFAAoF,CAAC;AAE/F;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAAc,EACd,WAA+B,EAC/B,aAAiC,EACjC,GAAW;IAEX,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,aAAa,CAAC;QAAE,OAAO;IACpD,MAAM,MAAM,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC;IACzC,GAAG,CAAC,GAAG,CACL;;+BAE2B,EAC3B,MAAM,EACN,mBAAmB,EACnB,GAAG,CACJ,CAAC;IACF,GAAG,CAAC,GAAG,CACL;wCACoC,EACpC,MAAM,EACN,GAAG,CACJ,CAAC;IACF,GAAG,CAAC,GAAG,CACL;;+BAE2B,EAC3B,MAAM,EACN,GAAG,EACH,GAAG,CACJ,CAAC;IACF,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC7E,8FAA8F;IAC9F,+FAA+F;IAC/F,6FAA6F;IAC7F,yBAAyB;IACzB,EAAE;IACF,6FAA6F;IAC7F,wFAAwF;IACxF,0FAA0F;IAC1F,qBAAqB;IACrB,GAAG,CAAC,GAAG,CACL;;;;;;;;mEAQ+D,EAC/D,aAAa,IAAI,IAAI,EACrB,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAC1C,GAAG,CACJ,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,GAAc,EAAE,GAAW;IACxD,IAAI,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAClD,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;IACnC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAC/B,yHAAyH;IACzH,4CAA4C,CAAC;AAE/C;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,GAAc;IAC5C,IAAI,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IACvD,GAAG,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC;IACrE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,uFAAuF,CAAC"}