@substrat-run/kernel 0.137.0 → 0.139.0

package/dist/sql-identifier.d.ts

@@ -0,0 +1,12 @@
+/**
+ * The check every kernel-derived DDL runs on a name before interpolating it (#827, #811, #119).
+ *
+ * SQL identifiers reach the DDL by interpolation — there is no parameter form for a table or
+ * column name — so every one is checked first. The inputs are declarations rather than user
+ * input, but a declaration is still a string somebody typed, and "it came from the manifest"
+ * is exactly the reasoning that makes an injection a surprise.
+ */
+export declare const SQL_IDENTIFIER: RegExp;
+/** `value`, or a throw naming the declaration (`where`) and the role it plays (`kind`). */
+export declare function assertSqlIdentifier(area: string, kind: string, value: string, where: string): string;
+//# sourceMappingURL=sql-identifier.d.ts.map

package/dist/sql-identifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql-identifier.d.ts","sourceRoot":"","sources":["../src/sql-identifier.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,QAA6B,CAAC;AAEzD,2FAA2F;AAC3F,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAKpG"}

package/dist/sql-identifier.js

@@ -0,0 +1,17 @@
+/**
+ * The check every kernel-derived DDL runs on a name before interpolating it (#827, #811, #119).
+ *
+ * SQL identifiers reach the DDL by interpolation — there is no parameter form for a table or
+ * column name — so every one is checked first. The inputs are declarations rather than user
+ * input, but a declaration is still a string somebody typed, and "it came from the manifest"
+ * is exactly the reasoning that makes an injection a surprise.
+ */
+export const SQL_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/** `value`, or a throw naming the declaration (`where`) and the role it plays (`kind`). */
+export function assertSqlIdentifier(area, kind, value, where) {
+    if (!SQL_IDENTIFIER.test(value)) {
+        throw new Error(`${area}: ${where} names ${kind} '${value}', which is not a plain SQL identifier`);
+    }
+    return value;
+}
+//# sourceMappingURL=sql-identifier.js.map

package/dist/sql-identifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql-identifier.js","sourceRoot":"","sources":["../src/sql-identifier.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,0BAA0B,CAAC;AAEzD,2FAA2F;AAC3F,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,IAAY,EAAE,KAAa,EAAE,KAAa;IAC1F,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,wCAAwC,CAAC,CAAC;IACrG,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/system-switch-record.d.ts

@@ -23,9 +23,25 @@
  *   would be a second one.
  *
  * The admin log is still the history. This is only the current position.
+ *
+ * **The record and the scope follow the same call** (#2045). A switch call writes this record, then
+ * moves the scope, and nothing makes the pair one unit, so two calls on one subject could interleave
+ * and leave the two on different positions. Each row holds the operation id of the call that wrote
+ * it, and a write from an older call writes nothing (`recordWriteSuperseded`). The scope refuses an
+ * older move the same way (`SWITCH_FENCES_DDL`), and re-asserts move under the row's id
+ * (`switchFencesOf`). Both sides therefore settle on the newest call's position.
+ *
+ * **Two kinds of switch, one record path** (#2029). The peer kill switch (#1706,
+ * `revokeFromPeer`) moves the same marker for a `vertical:<slug>` subject, and loses it the
+ * same ways: a wipe, a restore, a PITR rewind. So it is recorded the same way, in its own
+ * table (`_substrat_peer_switches`, keyed by the calling vertical's slug), by the same
+ * functions below, each told which `SwitchKind` it is writing. Its own table, not rows in the
+ * module table: that table's key is (tenant, scope, module id), and a vertical slug can be
+ * spelled exactly like a module id.
  */
 import type { ListPage } from '@substrat-run/contracts';
-import type { SwitchSql, SwitchedOff, SystemScheduleState } from './system-switch.js';
+import { type SwitchKind, type SwitchSql, type SwitchedOff, type SystemScheduleState } from './system-switch.js';
+export type { SwitchKind };
 /** The record's table name, as the DDL below spells it. */
 export declare const SYSTEM_SWITCHES_TABLE = "_substrat_system_switches";
 /**
@@ -34,33 +50,113 @@ export declare const SYSTEM_SWITCHES_TABLE = "_substrat_system_switches";
  * constraints, and the writers below are the only thing that sets it.
  */
 export declare const SYSTEM_SWITCHES_DDL = "\n  CREATE TABLE IF NOT EXISTS _substrat_system_switches (\n    tenant_id    TEXT NOT NULL,\n    scope_id     TEXT NOT NULL,\n    module_id    TEXT NOT NULL,\n    -- 'on' or 'off'. A row exists only for a module some switch call actually held.\n    position     TEXT NOT NULL,\n    actor        TEXT NOT NULL,\n    reason       TEXT NOT NULL,\n    -- The switch call's own id, the one its admin-log intent and outcome rows carry.\n    -- A ULID, so it is also the fleet read's chronological keyset cursor.\n    operation_id TEXT NOT NULL,\n    switched_at  TEXT NOT NULL,\n    PRIMARY KEY (tenant_id, scope_id, module_id)\n  );\n  CREATE INDEX IF NOT EXISTS _substrat_system_switches_position\n    ON _substrat_system_switches (position, operation_id);\n  CREATE INDEX IF NOT EXISTS _substrat_system_switches_operation\n    ON _substrat_system_switches (operation_id);\n";
+/**
+ * The peer switch's record (#2029): `SYSTEM_SWITCHES_DDL`'s shape, keyed by the calling
+ * vertical's slug. No fleet read pages it yet, so it carries none of that read's indexes; every
+ * read here names (tenant, scope), the primary key's prefix.
+ */
+export declare const PEER_SWITCHES_DDL = "\n  CREATE TABLE IF NOT EXISTS _substrat_peer_switches (\n    tenant_id    TEXT NOT NULL,\n    scope_id     TEXT NOT NULL,\n    -- The calling vertical's slug, as the target's peers declaration names it.\n    vertical     TEXT NOT NULL,\n    position     TEXT NOT NULL,\n    actor        TEXT NOT NULL,\n    reason       TEXT NOT NULL,\n    operation_id TEXT NOT NULL,\n    switched_at  TEXT NOT NULL,\n    PRIMARY KEY (tenant_id, scope_id, vertical)\n  );\n";
+/**
+ * Everything that differs between the two kinds, in one place: where each is recorded, how its
+ * switch calls and re-asserts are written to the admin log, and how a call that held nothing is
+ * refused. Every function below reads this table; none branches on the kind itself.
+ */
+declare const RECORDS: {
+    readonly system: {
+        readonly table: "_substrat_system_switches";
+        readonly ddl: "\n  CREATE TABLE IF NOT EXISTS _substrat_system_switches (\n    tenant_id    TEXT NOT NULL,\n    scope_id     TEXT NOT NULL,\n    module_id    TEXT NOT NULL,\n    -- 'on' or 'off'. A row exists only for a module some switch call actually held.\n    position     TEXT NOT NULL,\n    actor        TEXT NOT NULL,\n    reason       TEXT NOT NULL,\n    -- The switch call's own id, the one its admin-log intent and outcome rows carry.\n    -- A ULID, so it is also the fleet read's chronological keyset cursor.\n    operation_id TEXT NOT NULL,\n    switched_at  TEXT NOT NULL,\n    PRIMARY KEY (tenant_id, scope_id, module_id)\n  );\n  CREATE INDEX IF NOT EXISTS _substrat_system_switches_position\n    ON _substrat_system_switches (position, operation_id);\n  CREATE INDEX IF NOT EXISTS _substrat_system_switches_operation\n    ON _substrat_system_switches (operation_id);\n";
+        readonly key: 'module_id';
+        readonly subjectPrefix: 'system:';
+        readonly actions: readonly ['revokeFromSystem', 'restoreToSystem'];
+        readonly reassertAction: 'reassertSystemSwitch';
+        /** The payload fields naming the subject and its position (`moduleId` + `schedules`). */
+        readonly payloadKey: 'moduleId';
+        readonly positionField: 'schedules';
+        readonly notFound: (scopeId: string, key: string, to: string) => string;
+    };
+    readonly peer: {
+        readonly table: "_substrat_peer_switches";
+        readonly ddl: "\n  CREATE TABLE IF NOT EXISTS _substrat_peer_switches (\n    tenant_id    TEXT NOT NULL,\n    scope_id     TEXT NOT NULL,\n    -- The calling vertical's slug, as the target's peers declaration names it.\n    vertical     TEXT NOT NULL,\n    position     TEXT NOT NULL,\n    actor        TEXT NOT NULL,\n    reason       TEXT NOT NULL,\n    operation_id TEXT NOT NULL,\n    switched_at  TEXT NOT NULL,\n    PRIMARY KEY (tenant_id, scope_id, vertical)\n  );\n";
+        readonly key: 'vertical';
+        readonly subjectPrefix: "vertical:";
+        readonly actions: readonly ['revokeFromPeer', 'restoreToPeer'];
+        readonly reassertAction: 'reassertPeerSwitch';
+        readonly payloadKey: 'vertical';
+        readonly positionField: 'calls';
+        readonly notFound: (scopeId: string, key: string, to: string) => string;
+    };
+};
+/** Every kind, for the passes that walk them all (a scope's reap, a directory restore). */
+export declare const SWITCH_KINDS: readonly SwitchKind[];
+/** The admin-log action a switch call of this kind writes its intent and outcome rows under. */
+export declare const switchActionOf: (kind: SwitchKind, to: 'on' | 'off') => (typeof RECORDS)[SwitchKind]['actions'][number];
+/** The `not_found` a switch call that held nothing answers — one wording per kind, both adapters. */
+export declare const switchNotFoundMessage: (kind: SwitchKind, scopeId: string, key: string, to: 'on' | 'off') => string;
+/**
+ * #2045: the `conflict` a switch call answers when a newer call on the same subject got there first —
+ * its record write or its move was refused by the fence, and nothing of it was written.
+ */
+export declare const switchSupersededMessage: (kind: SwitchKind, scopeId: string, key: string, to: 'on' | 'off') => string;
+/** The record table of one kind. */
+export declare const switchesTableOf: (kind: SwitchKind) => string;
+/**
+ * #2045: the subjects whose scope may not be where their record says. A WRITE-AHEAD intent
+ * (Codex r3): the switch call's record write marks its subject owed in the same directory write,
+ * BEFORE anything moves, and the mark is cleared only once the scope has confirmed a move under a
+ * fence at least the call's own (`clearSwitchOwed`). So every way a move can go wrong — it throws,
+ * its answer is lost, the RPC that would have cleared the mark fails, the caller dies — leaves the
+ * mark set, and the next re-assert moves the scope to its record, in EITHER direction, under the
+ * record's fence. Without a mark a re-assert keeps #1674's rule: a record never turns anything on.
+ *
+ * `operation_id` is the newest call that marked the subject. A confirmation under an older fence
+ * clears nothing, so a newer call's mark outlives an older call's success.
+ */
+export declare const SWITCH_OWED_DDL = "\n  CREATE TABLE IF NOT EXISTS _substrat_switch_owed (\n    tenant_id    TEXT NOT NULL,\n    scope_id     TEXT NOT NULL,\n    -- 'system' or 'peer', and the module id or the peer's slug.\n    kind         TEXT NOT NULL,\n    subject      TEXT NOT NULL,\n    -- The newest switch call that marked it: a ULID, so it orders by text.\n    operation_id TEXT NOT NULL,\n    PRIMARY KEY (tenant_id, scope_id, kind, subject)\n  );\n";
+/** #2045: mark one subject's scope owed a re-assert, by this switch call. Never moves a mark backwards. */
+export declare function markSwitchOwed(db: SwitchSql, kind: SwitchKind, tenantId: string, scopeId: string, key: string, operationId: string): void;
+/** #2045: the subjects of one kind marked owed on one scope, each with the newest call that marked it. */
+export declare function switchesOwedOf(db: SwitchSql, kind: SwitchKind, tenantId: string, scopeId: string): Map<string, string>;
+/**
+ * #2045: the scope confirmed a move of this subject under `fence` — its mark goes, unless a newer
+ * call has marked it since (a compare-and-set on the mark's operation id).
+ */
+export declare function clearSwitchOwed(db: SwitchSql, kind: SwitchKind, tenantId: string, scopeId: string, key: string, fence: string): void;
+/**
+ * #2045: does any subject on this scope still owe a re-assert? While one does, the scope's
+ * reconcile receipt is not written (the control plane's `markScopeProvisioned`), so the sweep keeps
+ * reconciling it until a re-assert has settled every mark.
+ */
+export declare function scopeOwesSwitch(db: SwitchSql, scopeId: string): boolean;
+/** Each kind's DDL, for a pass that creates a table with its backfill. */
+export declare const switchesDdlOf: (kind: SwitchKind) => string;
 /**
  * The one-time backfill from the admin log: every switch moved before the record existed.
  * Without it, those are exactly the switches a wipe would still lose.
  *
- * It reads the admin-log shape `revokeFromSystem` / `restoreToSystem` have written since
- * #1666, two rows per call sharing `after.operationId`: an `intent` row carrying
- * `after.moduleId` and `after.reason`, then an outcome row whose `after.phase` is
- * `applied`, `refused` or `failed`. Only calls whose outcome is `applied` count, because a
- * refused call moved nothing and a failed one may not have. Of those, only the LATEST per
- * (tenant, scope, module) is taken, by the intent's ULID id. `at` is the intent's, the
- * same instant the status read's who/why join reports. A key whose calls include no
- * applied OFF gets no row, even when its latest applied call is an ON: a live
- * `restoreToSystem` of a module never switched off writes none either
- * (`recordSystemSwitchedOn`), and the backfill must not record what the live path would not.
+ * It reads the admin-log shape the switch calls have written since they existed
+ * (`revokeFromSystem` / `restoreToSystem` since #1666, `revokeFromPeer` / `restoreToPeer`
+ * since #1706), two rows per call sharing `after.operationId`: an `intent` row carrying the
+ * subject (`after.moduleId`, or `after.vertical` for a peer) and `after.reason`, then an
+ * outcome row whose `after.phase` is `applied`, `refused` or `failed`. Only calls whose
+ * outcome is `applied` count, because a refused call moved nothing and a failed one may not
+ * have. Of those, only the LATEST per (tenant, scope, subject) is taken, by the intent's ULID
+ * id. `at` is the intent's, the same instant the status read's who/why join reports. A key
+ * whose calls include no applied OFF gets no row, even when its latest applied call is an ON:
+ * history wrote no scope fence (#2045), so there is no fence for such a row to keep pace with,
+ * and an ON-only key needs no record to re-assert.
  *
  * `INSERT OR IGNORE`, so a row the switch wrote itself is never overwritten by history.
  * The adapters run it only on the construction that creates the table, so it runs once.
  */
-export declare const SYSTEM_SWITCHES_BACKFILL_SQL = "\n  WITH applied AS (\n    SELECT DISTINCT action, json_extract(after, '$.operationId') AS operation_id\n      FROM _substrat_admin_log\n     WHERE action IN ('revokeFromSystem', 'restoreToSystem')\n       AND json_extract(after, '$.phase') = 'applied'\n  ),\n  intents AS (\n    SELECT i.id AS id, i.tenant_id AS tenant_id, i.scope_id AS scope_id,\n           json_extract(i.after, '$.moduleId') AS module_id,\n           CASE i.action WHEN 'revokeFromSystem' THEN 'off' ELSE 'on' END AS position,\n           i.actor AS actor,\n           json_extract(i.after, '$.reason') AS reason,\n           json_extract(i.after, '$.operationId') AS operation_id,\n           i.at AS at\n      FROM _substrat_admin_log i\n      JOIN applied a\n        ON a.action = i.action AND a.operation_id = json_extract(i.after, '$.operationId')\n     WHERE i.action IN ('revokeFromSystem', 'restoreToSystem')\n       AND i.tenant_id IS NOT NULL AND i.scope_id IS NOT NULL\n       AND json_extract(i.after, '$.phase') = 'intent'\n       AND json_extract(i.after, '$.moduleId') IS NOT NULL\n       AND json_extract(i.after, '$.reason') IS NOT NULL\n  ),\n  ranked AS (\n    SELECT *,\n           ROW_NUMBER() OVER (PARTITION BY tenant_id, scope_id, module_id ORDER BY id DESC) AS latest,\n           MAX(position = 'off') OVER (PARTITION BY tenant_id, scope_id, module_id) AS ever_off\n      FROM intents\n  )\n  INSERT OR IGNORE INTO _substrat_system_switches\n    (tenant_id, scope_id, module_id, position, actor, reason, operation_id, switched_at)\n  SELECT tenant_id, scope_id, module_id, position, actor, reason, operation_id, at\n    FROM ranked\n   WHERE latest = 1 AND ever_off = 1\n";
+export declare function switchesBackfillSqlOf(kind: SwitchKind): string;
 /**
- * Does a dump carry the record table? A directory restore builds the table either way, and
- * backfills it from the dump's own admin log only when the dump did not (#1898). Compared
+ * Does a dump carry this kind's record table? A directory restore builds the table either way,
+ * and backfills it from the dump's own admin log only when the dump did not (#1898). Compared
  * without case, as SQLite resolves a table name.
  */
-export declare function dumpCarriesSystemSwitches(names: readonly string[]): boolean;
-/** "Does the record table exist yet?" — asked BEFORE the DDL, so the backfill runs once. */
-export declare function systemSwitchesTableExists(db: SwitchSql): boolean;
+export declare function dumpCarriesSwitches(names: readonly string[], kind: SwitchKind): boolean;
+/** "Does this kind's record table exist yet?" — asked BEFORE the DDL, so the backfill runs once. */
+export declare function switchesTableExists(db: SwitchSql, kind: SwitchKind): boolean;
 /** One record row as the directory holds it, with the scope's binding joined on. */
 export interface SystemSwitchRecordRow {
     tenantId: string;
@@ -93,8 +189,11 @@ export interface SystemSwitchRecordFilter extends ListPage {
  * miss a row that moved after the walk started, so use ascending for "every switch".
  */
 export declare function listSystemSwitchRecords(db: SwitchSql, filter?: SystemSwitchRecordFilter): SystemSwitchRecordRow[];
-/** One scope's record rows by module — what the per-scope status read joins as `recorded`. */
-export declare function systemSwitchRecordsOf(db: SwitchSql, tenantId: string, scopeId: string): Map<string, 'on' | 'off'>;
+/**
+ * One scope's record rows of one kind, by subject (module id or peer slug) — what the per-scope
+ * status read joins as `recorded`, and what a re-assert reverts a stale carry against.
+ */
+export declare function switchRecordsOf(db: SwitchSql, kind: SwitchKind, tenantId: string, scopeId: string): Map<string, 'on' | 'off'>;
 /**
  * The per-scope status read's rows with the record joined on. Each module the scope
  * reports gets its recorded position (or null). A module the record holds that the scope
@@ -109,8 +208,8 @@ export declare function withRecorded(states: {
     schedules: SystemScheduleState;
     recorded: 'on' | 'off' | null;
 }[];
-/** The modules a reconcile must re-assert OFF on this scope. */
-export declare function switchedOffModulesOf(db: SwitchSql, tenantId: string, scopeId: string): string[];
+/** The subjects of one kind (module ids, or peer slugs) a reconcile must re-assert OFF on this scope. */
+export declare function switchedOffOf(db: SwitchSql, kind: SwitchKind, tenantId: string, scopeId: string): string[];
 /**
  * The scopes of one tenant the record holds a module OFF on — what a tenant-level
  * `grantToSystem` refuses on (#1743). A tenant tuple has no scope of its own to read a
@@ -120,82 +219,181 @@ export declare function switchedOffModulesOf(db: SwitchSql, tenantId: string, sc
  */
 export declare function scopesSwitchedOffFor(db: SwitchSql, tenantId: string, moduleId: string): string[];
 /**
- * Does the tenant hold a live TENANT-level grant for this module (#1823)? Asked of the
- * directory, where the tenant tuple lives, and handed to the switch as `tenantHeld`: a module
- * whose only authority on a scope is a tenant-level grant has nothing in the scope's storage
- * for the switch to find, and must still be switchable there. One statement on both adapters'
- * directories; the same "live" the evaluator judges a grant by (unrevoked, unexpired at `now`).
+ * Does the tenant hold a live TENANT-level grant for this subject (#1823, and #2030 for a peer)?
+ * Asked of the directory, where the tenant tuple lives, and handed to the switch as
+ * `tenantHeld`: a subject whose only authority on a scope is a tenant-level grant has nothing
+ * in the scope's storage for the switch to find, and must still be switchable there. One
+ * statement on both adapters' directories; the same "live" the evaluator judges a grant by
+ * (unrevoked, unexpired at `now`).
  */
-export declare function tenantHoldsSystemGrant(db: SwitchSql, tenantId: string, moduleId: string, now: string): boolean;
-/** What one switch call writes into the record. */
-export interface SystemSwitchRecordWrite {
+export declare function tenantHoldsGrant(db: SwitchSql, kind: SwitchKind, tenantId: string, key: string, now: string): boolean;
+/** Of `keys`, those the tenant holds a live tenant-level grant for (`tenantHoldsGrant`), in order. */
+export declare function tenantHeldOf(db: SwitchSql, kind: SwitchKind, tenantId: string, keys: readonly string[], now: string): string[];
+/** What one switch call writes into the record. `key` is the module id, or the peer's slug. */
+export interface SwitchRecordWrite {
+    kind: SwitchKind;
     tenantId: string;
     scopeId: string;
-    moduleId: string;
+    key: string;
     actor: string;
     reason: string;
     operationId: string;
     at: string;
 }
 /** The row as it stood before a write, so a failed switch can put it back. */
-export type SystemSwitchRecordPrior = Pick<SystemSwitchRecordRow, 'position' | 'actor' | 'reason' | 'operationId' | 'at'> | null;
-/** What a re-assert did for one recorded-off module — `HostAdmin.reassertSystemSwitches`' answer. */
-export interface SystemSwitchReassert {
-    moduleId: string;
+export type SwitchRecordPrior = Pick<SystemSwitchRecordRow, 'position' | 'actor' | 'reason' | 'operationId' | 'at'> | null;
+/** One record row's identity. */
+type RecordKey = Pick<SwitchRecordWrite, 'kind' | 'tenantId' | 'scopeId' | 'key'>;
+/**
+ * What a re-assert did for one recorded-off subject — `HostAdmin.reassertSystemSwitches`'
+ * answer: a module (`moduleId`) or, since #2029, a peer (`vertical`).
+ */
+export type SystemSwitchReassert = {
     held: boolean;
     changed: boolean;
-}
+} & ({
+    moduleId: string;
+    vertical?: never;
+} | {
+    vertical: string;
+    moduleId?: never;
+});
 /**
  * What the deployment reports it switched off inside the reconcile's own unit (#1742), passed
  * to `HostAdmin.reassertSystemSwitches` so the move is audited here. The re-assert that
- * follows finds those modules already off (`changed: false`), and without this the admin log
+ * follows finds those subjects already off (`changed: false`), and without this the admin log
  * would stop showing that a wiped scope was put back off.
  */
 export interface SystemSwitchReassertOptions {
-    appliedInUnit?: readonly Pick<SwitchedOff, 'moduleId' | 'changed' | 'permissions'>[];
+    appliedInUnit?: readonly InUnitReport[];
 }
+/** One in-unit move as a deployment reports it: a module's, or (#2029) a peer's. */
+export type InUnitReport = Pick<SwitchedOff, 'changed' | 'permissions'> & ({
+    moduleId: string;
+    vertical?: never;
+} | {
+    vertical: string;
+    moduleId?: never;
+});
+/** The subject an in-unit report names, if it is of this kind. */
+export declare const reportKeyOf: (kind: SwitchKind, report: InUnitReport) => string | undefined;
 /**
- * The `reassertSystemSwitch` audit rows (less their `operationId`) for the in-unit moves:
- * those that changed something, on a module the directory records `off` for this scope.
- * That filter is the point. The report comes from the deployment, and an audit row naming
- * a module the record never switched off would be the deployment writing the platform's
- * log. One row per module, first report wins. Built here so both adapters write one shape.
+ * The fields an audit row names its subject and position with — the shape each kind's switch
+ * calls have always written (`moduleId` + `schedules`, `vertical` + `calls`).
+ */
+export declare function switchAuditSubject(kind: SwitchKind, key: string, position: 'on' | 'off'): {
+    moduleId: string;
+    schedules: 'on' | 'off';
+} | {
+    vertical: string;
+    calls: 'on' | 'off';
+};
+/** The admin-log action a re-assert of this kind writes its rows under. */
+export declare const reassertActionOf: (kind: SwitchKind) => (typeof RECORDS)[SwitchKind]['reassertAction'];
+/** One re-assert answer entry: the subject by its kind's field, and what the move did. */
+export declare const reassertEntry: (kind: SwitchKind, key: string, outcome: {
+    held: boolean;
+    changed: boolean;
+}) => SystemSwitchReassert;
+/**
+ * #2045: the audit row (less its `operationId`) for a re-assert's ON that moved something — a
+ * record of ON beside a scope that was off, converged to the record under its fence.
  */
-export declare function inUnitMovesToAudit(recordedOff: readonly string[], applied: SystemSwitchReassertOptions['appliedInUnit']): {
+export declare const reassertOnRow: (kind: SwitchKind, key: string, permissions: readonly string[]) => {
     moduleId: string;
-    schedules: 'off';
+    schedules: 'on' | 'off';
+    phase: 'applied';
+    changed: true;
+    permissions: string[];
+} | {
+    vertical: string;
+    calls: 'on' | 'off';
+    phase: 'applied';
+    changed: true;
+    permissions: string[];
+};
+/** The audit row (less its `operationId`) for a re-assert's own OFF that moved something — both adapters. */
+export declare const reassertOffRow: (kind: SwitchKind, key: string, permissions: readonly string[]) => {
+    moduleId: string;
+    schedules: 'on' | 'off';
+    phase: 'applied';
+    changed: true;
+    permissions: string[];
+} | {
+    vertical: string;
+    calls: 'on' | 'off';
+    phase: 'applied';
+    changed: true;
+    permissions: string[];
+};
+/**
+ * The re-assert's audit rows (less their `operationId`) for the in-unit moves of one kind:
+ * those that changed something, on a subject the directory records `off` for this scope.
+ * That filter is the point. The report comes from the deployment, and an audit row naming
+ * a subject the record never switched off would be the deployment writing the platform's
+ * log. One row per subject, first report wins. Built here so both adapters write one shape.
+ */
+export declare function inUnitMovesToAudit(kind: SwitchKind, recordedOff: readonly string[], applied: SystemSwitchReassertOptions['appliedInUnit'], 
+/** Subjects this re-assert's stale-carry pass switched back on: their in-unit move is not credited. */
+reverted?: ReadonlySet<string>): (ReturnType<typeof switchAuditSubject> & {
     phase: 'applied';
     changed: true;
     permissions: string[];
     inUnit: true;
-}[];
+})[];
 /**
  * The in-unit moves a STALE carry made, which the re-assert must undo (#1742 review): the
- * deployment switched a module off because the list it was handed said so, but by the time
- * the re-assert reads the record, an operator's `restoreToSystem` has moved it to `on`. The
- * list was read before the call and the ON landed in between. Left alone, the scope would
- * stay off while the record says on, and no later pass would put it back.
+ * deployment switched a subject off because the list it was handed said so, but by the time
+ * the re-assert reads the record, an operator's restore has moved it to `on`. The list was
+ * read before the call and the ON landed in between. Left alone, the scope would stay off
+ * while the record says on, and no later pass would put it back.
  *
- * Only a module the record now holds `on`, so a revert only ever re-applies an operator's
- * own ON. It never turns on a module whose record is `off` or missing, and so a report from
+ * Only a subject the record now holds `on`, so a revert only ever re-applies an operator's
+ * own ON. It never turns on a subject whose record is `off` or missing, and so a report from
  * the deployment can never switch on anything the platform has not already restored.
  */
-export declare function staleCarryReverts(recorded: ReadonlyMap<string, 'on' | 'off'>, applied: SystemSwitchReassertOptions['appliedInUnit']): string[];
+export declare function staleCarryReverts(kind: SwitchKind, recorded: ReadonlyMap<string, 'on' | 'off'>, applied: SystemSwitchReassertOptions['appliedInUnit']): string[];
 /** The audit row (less its `operationId`) for one stale-carry revert — both adapters write this shape. */
-export declare function staleCarryRevertRow(moduleId: string, outcome: {
+export declare function staleCarryRevertRow(kind: SwitchKind, key: string, outcome: {
     changed: boolean;
     permissions: readonly string[];
-}): {
-    moduleId: string;
-    schedules: 'on';
+}): ReturnType<typeof switchAuditSubject> & {
     phase: 'applied';
     changed: boolean;
     permissions: string[];
     staleCarry: true;
 };
+/**
+ * #2045: the record's half of the switch fence (`SWITCH_FENCES_DDL`). A write from a call OLDER than
+ * the one the row holds writes nothing: a newer call has already recorded its position, and the
+ * scope will refuse this call's move for the same reason. Both writes answer the prior row, and the
+ * caller reads this off it, with the same test (`recordWriteSuperseded`).
+ */
+declare const supersededBy: (prior: SwitchRecordPrior, row: Pick<SwitchRecordWrite, 'operationId'>) => boolean;
+/** #2045: did this record write find a newer call's row, and so write nothing? */
+export declare const recordWriteSuperseded: typeof supersededBy;
+/**
+ * #2045: the operation id each of one scope's record rows of one kind holds, by subject — the fence a
+ * re-assert or a carry moves the scope with, so a scope moved since by a newer call stays as that
+ * call put it.
+ */
+export declare function switchFencesOf(db: SwitchSql, kind: SwitchKind, tenantId: string, scopeId: string): Map<string, string>;
+/**
+ * #2045: each record row's position AND operation id, by subject, in ONE read. A caller that moves
+ * the scope to a row's position under the row's fence must take both from the same instant: read
+ * apart, a row that moves between them pairs one call's position with another call's fence (an OFF
+ * carried under the ON's fence applies, since the scope holds that very fence), and a row the undo
+ * deleted between them is moved with no fence at all, which the scope applies unconditionally.
+ */
+export declare function switchRecordStatesOf(db: SwitchSql, kind: SwitchKind, tenantId: string, scopeId: string): Map<string, {
+    position: 'on' | 'off';
+    fence: string;
+}>;
+/** #2045: the tuple subject a record key names (`system:<m>`, `vertical:<v>`) — how a carry keys its fences. */
+export declare const switchSubjectOf: (kind: SwitchKind, key: string) => string;
 /**
  * OFF's write, made BEFORE the scope's switch moves (#1823), and undone by
- * `restoreSystemSwitchRecord` when the move throws or holds nothing. An upsert: a repeat OFF
+ * `restoreSwitchRecord` when the move throws or holds nothing. An upsert: a repeat OFF
  * refreshes the actor, reason and time, as the status read reports the latest reason.
  * Answers the row as it was.
  *
@@ -205,34 +403,36 @@ export declare function staleCarryRevertRow(moduleId: string, outcome: {
  * which the scope is off and the record is not. This order fails toward a record of `off`
  * beside a scope still on, until the undo runs — the direction OFF wins anyway, and the one a
  * kill switch should fail in. Still never LEFT behind for a call that held nothing: a row
- * saying `off` for a module the scope never ran would switch it off on the day it is
+ * saying `off` for a subject the scope never had would switch it off on the day it is
  * installed (the kernel's `held` check, for the same reason).
  */
-export declare function recordSystemSwitchedOff(db: SwitchSql, row: SystemSwitchRecordWrite): SystemSwitchRecordPrior;
+export declare function recordSwitchedOff(db: SwitchSql, row: SwitchRecordWrite): SwitchRecordPrior;
 /**
- * ON's write, made BEFORE the scope's switch moves, and only to a row that exists. Before,
- * because the other order fails unsafely: a scope switched on whose record write then
- * failed would still read `off`, and the next reconcile would switch the operator's
- * restore back off. This order fails toward a record of `on` beside a live marker, which
- * the marker wins. Answers the row as it was, for `restoreSystemSwitchRecord`.
+ * ON's write, made BEFORE the scope's switch moves. Before, because the other order fails
+ * unsafely: a scope switched on whose record write then failed would still read `off`, and the
+ * next reconcile would switch the operator's restore back off. Answers the row as it was, for
+ * `restoreSwitchRecord`.
+ *
+ * #2045: an upsert, like OFF's. An ON with no row before it writes one, because its move stores
+ * its id in the scope's fence: without a row carrying the same id, an OLDER OFF arriving after
+ * it would find no row to be refused by, record itself, and leave the directory behind the scope
+ * (Codex r2). The directory's fence is never behind the scope's. An ON that holds nothing still
+ * leaves no row: its undo removes the one it wrote.
  */
-export declare function recordSystemSwitchedOn(db: SwitchSql, row: SystemSwitchRecordWrite): SystemSwitchRecordPrior;
+export declare function recordSwitchedOn(db: SwitchSql, row: SwitchRecordWrite): SwitchRecordPrior;
 /**
- * Put a row back as `recordSystemSwitchedOn` or `recordSystemSwitchedOff` found it — the call
- * that wrote it threw, or held nothing. A row that did not exist is removed again. A
- * compare-and-set on the call's own `operationId`: if another switch call has written the row
- * since, the row is left as that call wrote it, so an undo can never clobber a newer position.
+ * Put a row back as `recordSwitchedOn` or `recordSwitchedOff` found it — the call that wrote
+ * it threw, or held nothing. A row that did not exist is removed again. A compare-and-set on
+ * the call's own `operationId`: if another switch call has written the row since, the row is
+ * left as that call wrote it, so an undo can never clobber a newer position.
  */
-export declare function restoreSystemSwitchRecord(db: SwitchSql, call: {
-    tenantId: string;
-    scopeId: string;
-    moduleId: string;
+export declare function restoreSwitchRecord(db: SwitchSql, call: RecordKey & {
     operationId: string;
-}, prior: SystemSwitchRecordPrior): void;
+}, prior: SwitchRecordPrior): void;
 /**
- * Forget one scope's switch records — the scope's directory row is going too (a reaped
- * preview or fork, a reaped scope). Without this the fleet read keeps listing a switch on
+ * Forget one scope's switch records, of every kind — the scope's directory row is going too (a
+ * reaped preview or fork, a reaped scope). Without this the fleet read keeps listing a switch on
  * a scope that no longer exists. The admin log keeps the history, as it keeps the scope's.
  */
-export declare function forgetSystemSwitchesOf(db: SwitchSql, scopeId: string): void;
+export declare function forgetSwitchesOf(db: SwitchSql, scopeId: string): void;
 //# sourceMappingURL=system-switch-record.d.ts.map

package/dist/system-switch-record.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"system-switch-record.d.ts","sourceRoot":"","sources":["../src/system-switch-record.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAExD,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEtF,2DAA2D;AAC3D,eAAO,MAAM,qBAAqB,8BAA8B,CAAC;AAEjE;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,22BAmB/B,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,4BAA4B,0oDAmCxC,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAE3E;AAED,4FAA4F;AAC5F,wBAAgB,yBAAyB,CAAC,EAAE,EAAE,SAAS,GAAG,OAAO,CAKhE;AAED,oFAAoF;AACpF,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,IAAI,GAAG,KAAK,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED;;;GAGG;AACH,MAAM,WAAW,wBAAyB,SAAQ,QAAQ;IACxD,QAAQ,CAAC,EAAE,IAAI,GAAG,KAAK,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAmBD;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,GAAE,wBAA6B,GAAG,qBAAqB,EAAE,CA6BrH;AAED,8FAA8F;AAC9F,wBAAgB,qBAAqB,CACnC,EAAE,EAAE,SAAS,EACb,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GACd,GAAG,CAAC,MAAM,EAAE,IAAI,GAAG,KAAK,CAAC,CAO3B;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,mBAAmB,CAAA;CAAE,EAAE,EAC9D,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,GAAG,KAAK,CAAC,GAClC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,mBAAmB,CAAC;IAAC,QAAQ,EAAE,IAAI,GAAG,KAAK,GAAG,IAAI,CAAA;CAAE,EAAE,CAOvF;AAED,gEAAgE;AAChE,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAS/F;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAShG;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAW9G;AAED,mDAAmD;AACnD,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,8EAA8E;AAC9E,MAAM,MAAM,uBAAuB,GAAG,IAAI,CACxC,qBAAqB,EACrB,UAAU,GAAG,OAAO,GAAG,QAAQ,GAAG,aAAa,GAAG,IAAI,CACvD,GAAG,IAAI,CAAC;AAET,qGAAqG;AACrG,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;;GAKG;AACH,MAAM,WAAW,2BAA2B;IAC1C,aAAa,CAAC,EAAE,SAAS,IAAI,CAAC,WAAW,EAAE,UAAU,GAAG,SAAS,GAAG,aAAa,CAAC,EAAE,CAAC;CACtF;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,SAAS,MAAM,EAAE,EAC9B,OAAO,EAAE,2BAA2B,CAAC,eAAe,CAAC,GACpD;IACD,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,KAAK,CAAC;IACjB,KAAK,EAAE,SAAS,CAAC;IACjB,OAAO,EAAE,IAAI,CAAC;IACd,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,MAAM,EAAE,IAAI,CAAC;CACd,EAAE,CAcF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,IAAI,GAAG,KAAK,CAAC,EAC3C,OAAO,EAAE,2BAA2B,CAAC,eAAe,CAAC,GACpD,MAAM,EAAE,CAIV;AAED,0GAA0G;AAC1G,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAC5D;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,MAAM,EAAE,CAAC;IAAC,UAAU,EAAE,IAAI,CAAA;CAAE,CASpH;AAgDD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,uBAAuB,GAAG,uBAAuB,CAkB5G;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,uBAAuB,GAAG,uBAAuB,CAM3G;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,EAAE,EAAE,SAAS,EACb,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,EAClF,KAAK,EAAE,uBAAuB,GAC7B,IAAI,CAaN;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAE3E"}
+{"version":3,"file":"system-switch-record.d.ts","sourceRoot":"","sources":["../src/system-switch-record.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAExD,OAAO,EAEL,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACzB,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EAAE,UAAU,EAAE,CAAC;AAE3B,2DAA2D;AAC3D,eAAO,MAAM,qBAAqB,8BAA8B,CAAC;AAIjE;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,22BAmB/B,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,+cAa7B,CAAC;AAEF;;;;GAIG;AACH,QAAA,MAAM,OAAO;aACX,MAAM;iBACJ,KAAK;iBACL,GAAG;iBACH,GAAG,EAAE,WAAW;iBAChB,aAAa,EAAE,SAAS;iBACxB,OAAO,YAAG,kBAAkB,EAAE,iBAAiB;iBAC/C,cAAc,EAAE,sBAAsB;QACtC,yFAAyF;iBACzF,UAAU,EAAE,UAAU;iBACtB,aAAa,EAAE,WAAW;iBAC1B,QAAQ,YAAY,MAAM,OAAO,MAAM,MAAM,MAAM;;aAIrD,IAAI;iBACF,KAAK;iBACL,GAAG;iBACH,GAAG,EAAE,UAAU;iBACf,aAAa;iBACb,OAAO,YAAG,gBAAgB,EAAE,eAAe;iBAC3C,cAAc,EAAE,oBAAoB;iBACpC,UAAU,EAAE,UAAU;iBACtB,aAAa,EAAE,OAAO;iBACtB,QAAQ,YAAY,MAAM,OAAO,MAAM,MAAM,MAAM;;CAI7C,CAAC;AAEX,2FAA2F;AAC3F,eAAO,MAAM,YAAY,EAAE,SAAS,UAAU,EAAuB,CAAC;AAEtE,gGAAgG;AAChG,eAAO,MAAM,cAAc,SAAU,UAAU,MAAM,IAAI,GAAG,KAAK,KAAG,CAAC,OAAO,OAAO,CAAC,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,CAAC,MAAM,CACrE,CAAC;AAE9C,qGAAqG;AACrG,eAAO,MAAM,qBAAqB,SAAU,UAAU,WAAW,MAAM,OAAO,MAAM,MAAM,IAAI,GAAG,KAAK,KAAG,MAC/D,CAAC;AAE3C;;;GAGG;AACH,eAAO,MAAM,uBAAuB,SAAU,UAAU,WAAW,MAAM,OAAO,MAAM,MAAM,IAAI,GAAG,KAAK,KAAG,MAElB,CAAC;AAE1F,oCAAoC;AACpC,eAAO,MAAM,eAAe,SAAU,UAAU,KAAG,MAA6B,CAAC;AAEjF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,eAAe,6aAW3B,CAAC;AAEF,2GAA2G;AAC3G,wBAAgB,cAAc,CAC5B,EAAE,EAAE,SAAS,EACb,IAAI,EAAE,UAAU,EAChB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,EACX,WAAW,EAAE,MAAM,GAClB,IAAI,CAWN;AAED,0GAA0G;AAC1G,wBAAgB,cAAc,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAStH;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,EAAE,EAAE,SAAS,EACb,IAAI,EAAE,UAAU,EAChB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,GACZ,IAAI,CAUN;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAEvE;AAED,0EAA0E;AAC1E,eAAO,MAAM,aAAa,SAAU,UAAU,KAAG,MAA2B,CAAC;AAE7E;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,CAuC9D;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAGvF;AAED,oGAAoG;AACpG,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAK5E;AAED,oFAAoF;AACpF,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,IAAI,GAAG,KAAK,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED;;;GAGG;AACH,MAAM,WAAW,wBAAyB,SAAQ,QAAQ;IACxD,QAAQ,CAAC,EAAE,IAAI,GAAG,KAAK,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAmBD;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,GAAE,wBAA6B,GAAG,qBAAqB,EAAE,CA6BrH;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,EAAE,EAAE,SAAS,EACb,IAAI,EAAE,UAAU,EAChB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GACd,GAAG,CAAC,MAAM,EAAE,IAAI,GAAG,KAAK,CAAC,CAI3B;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,mBAAmB,CAAA;CAAE,EAAE,EAC9D,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,GAAG,KAAK,CAAC,GAClC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,mBAAmB,CAAC;IAAC,QAAQ,EAAE,IAAI,GAAG,KAAK,GAAG,IAAI,CAAA;CAAE,EAAE,CAOvF;AAED,yGAAyG;AACzG,wBAAgB,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAS1G;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAShG;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAWrH;AAED,sGAAsG;AACtG,wBAAgB,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAE9H;AAED,+FAA+F;AAC/F,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,8EAA8E;AAC9E,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAAC,qBAAqB,EAAE,UAAU,GAAG,OAAO,GAAG,QAAQ,GAAG,aAAa,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;AAE3H,iCAAiC;AACjC,KAAK,SAAS,GAAG,IAAI,CAAC,iBAAiB,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,GAAG,KAAK,CAAC,CAAC;AAElF;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GAAG,CACrE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,KAAK,CAAA;CAAE,GACtC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,KAAK,CAAA;CAAE,CACzC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,WAAW,2BAA2B;IAC1C,aAAa,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;CACzC;AAED,oFAAoF;AACpF,MAAM,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,EAAE,SAAS,GAAG,aAAa,CAAC,GACrE,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,KAAK,CAAA;CAAE,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,KAAK,CAAA;CAAE,CAAC,CAAC;AAEpF,kEAAkE;AAClE,eAAO,MAAM,WAAW,SAAU,UAAU,UAAU,YAAY,KAAG,MAAM,GAAG,SAC5C,CAAC;AAEnC;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,UAAU,EAChB,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,IAAI,GAAG,KAAK,GACrB;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,IAAI,GAAG,KAAK,CAAA;CAAE,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,IAAI,GAAG,KAAK,CAAA;CAAE,CAG3F;AAED,2EAA2E;AAC3E,eAAO,MAAM,gBAAgB,SAAU,UAAU,KAAG,CAAC,OAAO,OAAO,CAAC,CAAC,UAAU,CAAC,CAAC,gBAAgB,CACnE,CAAC;AAE/B,0FAA0F;AAC1F,eAAO,MAAM,aAAa,SAClB,UAAU,OACX,MAAM,WACF;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,KAC3C,oBACqH,CAAC;AAEzH;;;GAGG;AACH,eAAO,MAAM,aAAa,SAAU,UAAU,OAAO,MAAM,eAAe,SAAS,MAAM,EAAE;cArB5E,MAAM;eAAa,IAAI,GAAG,KAAK;WAuBrC,SAAS;;;;cAvB6C,MAAM;WAAS,IAAI,GAAG,KAAK;WAuBjF,SAAS;;;CAGhB,CAAC;AAEH,6GAA6G;AAC7G,eAAO,MAAM,cAAc,SAAU,UAAU,OAAO,MAAM,eAAe,SAAS,MAAM,EAAE;cA7B7E,MAAM;eAAa,IAAI,GAAG,KAAK;WA+BrC,SAAS;;;;cA/B6C,MAAM;WAAS,IAAI,GAAG,KAAK;WA+BjF,SAAS;;;CAGhB,CAAC;AAEH;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,UAAU,EAChB,WAAW,EAAE,SAAS,MAAM,EAAE,EAC9B,OAAO,EAAE,2BAA2B,CAAC,eAAe,CAAC;AACrD,uGAAuG;AACvG,QAAQ,GAAE,WAAW,CAAC,MAAM,CAAa,GACxC,CAAC,UAAU,CAAC,OAAO,kBAAkB,CAAC,GAAG;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,IAAI,CAAC;IAAC,WAAW,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,EAAE,IAAI,CAAA;CAAE,CAAC,EAAE,CAetH;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,UAAU,EAChB,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,IAAI,GAAG,KAAK,CAAC,EAC3C,OAAO,EAAE,2BAA2B,CAAC,eAAe,CAAC,GACpD,MAAM,EAAE,CAMV;AAED,0GAA0G;AAC1G,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,UAAU,EAChB,GAAG,EAAE,MAAM,EACX,OAAO,EAAE;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAC5D,UAAU,CAAC,OAAO,kBAAkB,CAAC,GAAG;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,MAAM,EAAE,CAAC;IAAC,UAAU,EAAE,IAAI,CAAA;CAAE,CAQzH;AA4CD;;;;;GAKG;AACH,QAAA,MAAM,YAAY,UAAW,iBAAiB,OAAO,IAAI,CAAC,iBAAiB,EAAE,aAAa,CAAC,KAAG,OACvC,CAAC;AAExD,kFAAkF;AAClF,eAAO,MAAM,qBAAqB,qBAAe,CAAC;AAElD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAItH;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,EAAE,EAAE,SAAS,EACb,IAAI,EAAE,UAAU,EAChB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GACd,GAAG,CAAC,MAAM,EAAE;IAAE,QAAQ,EAAE,IAAI,GAAG,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAQxD;AAED,gHAAgH;AAChH,eAAO,MAAM,eAAe,SAAU,UAAU,OAAO,MAAM,KAAG,MAAgD,CAAC;AAEjH;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,iBAAiB,GAAG,iBAAiB,CAE1F;AA0BD;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,iBAAiB,GAAG,iBAAiB,CAEzF;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,EAAE,EAAE,SAAS,EACb,IAAI,EAAE,SAAS,GAAG;IAAE,WAAW,EAAE,MAAM,CAAA;CAAE,EACzC,KAAK,EAAE,iBAAiB,GACvB,IAAI,CAaN;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAGrE"}