@substrat-run/kernel 0.137.0 → 0.139.0

package/dist/findings.js

@@ -0,0 +1,463 @@
+import { FINDING_RULE_MAX_DAYS, findingEntry, findingRuleEntry, opsFailureFingerprint, substratError, } from '@substrat-run/contracts';
+import { ulid } from './ulid.js';
+import { assertRowLimit, boundedRetentionDelete, ISSUE_RETENTION_DAYS } from './scope-host.js';
+/**
+ * How long a finding outlives its last occurrence — the issue store's window, since a Recurring
+ * finding is the tenant's projection of an issue and should be recognisable for as long.
+ */
+export const FINDING_RETENTION_DAYS = ISSUE_RETENTION_DAYS;
+/**
+ * The findings store (#1748), as statements both adapters run against their directory — the
+ * SQLite host over better-sqlite3, the hosted one inside ControlPlaneDO — so the lifecycle is
+ * written once. `sql` is the row-returning executor subject erasure already uses.
+ *
+ * Detection is ON WRITE: the call that records an ops failure or a sweep run also observes the
+ * finding it implies, so there is no cron and no scan. Per occurrence that is one indexed rule
+ * lookup and one primary-key upsert, over evidence that is already bounded upstream.
+ */
+export const FINDINGS_DDL = `
+  CREATE TABLE IF NOT EXISTS _substrat_findings (
+    id TEXT PRIMARY KEY,
+    tenant_id TEXT NOT NULL,
+    kind TEXT NOT NULL,
+    subject TEXT NOT NULL,
+    status TEXT NOT NULL,
+    regressed INTEGER NOT NULL DEFAULT 0,
+    severity TEXT NOT NULL,
+    title TEXT NOT NULL,
+    operation TEXT,
+    codes TEXT NOT NULL DEFAULT '[]',
+    vertical TEXT,
+    scope_id TEXT,
+    seen_count INTEGER NOT NULL,
+    first_seen TEXT NOT NULL,
+    last_seen TEXT NOT NULL,
+    last_version TEXT,
+    resolved_version TEXT,
+    resolved_at TEXT,
+    resolution TEXT,
+    acknowledged_at TEXT,
+    rule_id TEXT,
+    evidence TEXT NOT NULL,
+    likely_cause TEXT,
+    UNIQUE (tenant_id, kind, subject)
+  );
+  CREATE INDEX IF NOT EXISTS _substrat_findings_tenant_seen ON _substrat_findings (tenant_id, last_seen);
+  CREATE INDEX IF NOT EXISTS _substrat_findings_seen ON _substrat_findings (last_seen);
+  CREATE INDEX IF NOT EXISTS _substrat_findings_quiet ON _substrat_findings (last_seen) WHERE status IN ('open', 'acked');
+  CREATE TABLE IF NOT EXISTS _substrat_finding_rules (
+    id TEXT PRIMARY KEY,
+    tenant_id TEXT NOT NULL,
+    kind TEXT,
+    operation TEXT,
+    code TEXT,
+    subject TEXT,
+    expires_at TEXT NOT NULL,
+    reason TEXT NOT NULL,
+    created_by TEXT NOT NULL,
+    created_at TEXT NOT NULL
+  );
+  CREATE INDEX IF NOT EXISTS _substrat_finding_rules_tenant ON _substrat_finding_rules (tenant_id, expires_at);
+  CREATE INDEX IF NOT EXISTS _substrat_finding_rules_expiry ON _substrat_finding_rules (expires_at);
+`;
+/**
+ * The Recurring source: a tenant's own ops failure, keyed on the same fingerprint as the fleet
+ * issue. A failure with no tenant is the platform's own and stays in the staff issue store.
+ */
+export function findingOfOpsFailure(f) {
+    if (!f.tenantId)
+        return null;
+    const fingerprint = opsFailureFingerprint(f);
+    return {
+        tenantId: f.tenantId,
+        kind: 'recurring',
+        subject: fingerprint,
+        severity: 'warning',
+        title: `${f.operation} fails${f.stage ? ` at ${f.stage}` : ''}${f.code ? ` (${f.code})` : ''}`,
+        operation: f.operation,
+        code: f.code ?? null,
+        vertical: f.vertical ?? null,
+        scopeId: f.scopeId ?? null,
+        version: f.version ?? null,
+        evidence: { source: 'ops-failures', fingerprint },
+    };
+}
+/**
+ * The Invariant and Drift sources: a scheduled run that failed (expected 0 failed runs,
+ * observed N) and a freshness expectation judged stale. Every other sweep row implies nothing.
+ */
+export function findingOfSweepRun(r) {
+    if (!r.tenantId || r.outcome !== 'failed')
+        return null;
+    const base = {
+        tenantId: r.tenantId,
+        subject: r.unit,
+        code: null,
+        vertical: r.vertical ?? null,
+        scopeId: r.scopeId ?? null,
+        version: r.version ?? null,
+    };
+    if (r.kind === 'schedule') {
+        return {
+            ...base,
+            kind: 'invariant',
+            severity: 'critical',
+            title: `Scheduled ${r.operation ?? r.unit} failed`,
+            operation: r.operation ?? null,
+            evidence: { source: 'sweep-runs', kind: 'schedule', unit: r.unit },
+        };
+    }
+    if (r.kind === 'freshness') {
+        return {
+            ...base,
+            kind: 'drift',
+            severity: 'warning',
+            title: `${r.eventType ?? r.unit} has gone stale`,
+            operation: null,
+            evidence: { source: 'sweep-runs', kind: 'freshness', unit: r.unit },
+        };
+    }
+    return null;
+}
+const FINDING_COLUMNS = 'id, tenant_id, kind, subject, status, regressed, severity, title, operation, codes, vertical, scope_id, ' +
+    'seen_count, first_seen, last_seen, last_version, resolved_version, resolved_at, resolution, acknowledged_at, ' +
+    'rule_id, evidence, likely_cause';
+const RULE_COLUMNS = 'id, tenant_id, kind, operation, code, subject, expires_at, reason, created_by, created_at';
+function findingOf(r) {
+    return findingEntry.parse({
+        id: r.id,
+        tenantId: r.tenant_id,
+        kind: r.kind,
+        subject: r.subject,
+        status: r.status,
+        regressed: r.regressed === 1,
+        severity: r.severity,
+        title: r.title,
+        operation: r.operation,
+        codes: JSON.parse(r.codes),
+        vertical: r.vertical,
+        scopeId: r.scope_id,
+        count: r.seen_count,
+        firstSeen: r.first_seen,
+        lastSeen: r.last_seen,
+        lastVersion: r.last_version,
+        resolvedVersion: r.resolved_version,
+        resolvedAt: r.resolved_at,
+        resolution: r.resolution,
+        acknowledgedAt: r.acknowledged_at,
+        ruleId: r.rule_id,
+        evidence: JSON.parse(r.evidence),
+        likelyCause: r.likely_cause === null ? null : JSON.parse(r.likely_cause),
+    });
+}
+function ruleOf(r) {
+    return findingRuleEntry.parse({
+        id: r.id,
+        tenantId: r.tenant_id,
+        kind: r.kind,
+        operation: r.operation,
+        code: r.code,
+        subject: r.subject,
+        expiresAt: r.expires_at,
+        reason: r.reason,
+        createdBy: r.created_by,
+        createdAt: r.created_at,
+    });
+}
+/**
+ * The unexpired rule covering this occurrence, if any. A rule field left NULL matches anything;
+ * a set one must equal the occurrence's — and `= NULL` is never true, so a rule naming an
+ * operation never covers a finding that has none.
+ */
+function activeRule(sql, o, at) {
+    const row = sql(`SELECT id FROM _substrat_finding_rules
+      WHERE tenant_id = ? AND expires_at > ?
+        AND (kind IS NULL OR kind = ?)
+        AND (operation IS NULL OR operation = ?)
+        AND (code IS NULL OR code = ?)
+        AND (subject IS NULL OR subject = ?)
+      ORDER BY expires_at DESC, id LIMIT 1`, [o.tenantId, at, o.kind, o.operation, o.code, o.subject])[0];
+    return row?.id ?? null;
+}
+const MAX_CODES = 5;
+/**
+ * Record one occurrence on its finding, opening it if new. The transitions, in order:
+ * - an unexpired rule covers it → `suppressed` (counted all the same: suppressing hides the
+ *   finding, never the evidence);
+ * - it was `resolved` → `open`, `regressed`, and its likely cause is worked out afresh from
+ *   THIS regression: the version it came back under, when that is not the one it was resolved
+ *   under, and none otherwise — never a cause left over from an earlier cycle;
+ * - it was `suppressed` and no rule covers it any longer → `open`;
+ * - otherwise the status stands (`acked` stays acked: somebody is already on it).
+ */
+export function observeFinding(sql, o, at) {
+    const ruleId = activeRule(sql, o, at);
+    const existing = sql(`SELECT id, status, regressed, codes, resolved_version, likely_cause
+       FROM _substrat_findings WHERE tenant_id = ? AND kind = ? AND subject = ?`, [o.tenantId, o.kind, o.subject])[0];
+    if (!existing) {
+        sql(`INSERT INTO _substrat_findings (${FINDING_COLUMNS})
+       VALUES (?, ?, ?, ?, ?, 0, ?, ?, ?, ?, ?, ?, 1, ?, ?, ?, NULL, NULL, NULL, NULL, ?, ?, NULL)`, [
+            ulid(),
+            o.tenantId,
+            o.kind,
+            o.subject,
+            ruleId ? 'suppressed' : 'open',
+            o.severity,
+            o.title,
+            o.operation,
+            JSON.stringify(o.code ? [o.code] : []),
+            o.vertical,
+            o.scopeId,
+            at,
+            at,
+            o.version,
+            ruleId,
+            JSON.stringify(o.evidence),
+        ]);
+        return;
+    }
+    let status = existing.status;
+    let regressed = existing.regressed;
+    let likelyCause = existing.likely_cause;
+    if (ruleId) {
+        status = 'suppressed';
+    }
+    else if (status === 'resolved') {
+        status = 'open';
+        regressed = 1;
+        likelyCause = null;
+        if (o.version !== null && o.version !== existing.resolved_version) {
+            const cause = {
+                kind: 'deploy',
+                version: o.version,
+                reason: existing.resolved_version
+                    ? `resolved under ${existing.resolved_version}, seen again under ${o.version}`
+                    : `seen again under ${o.version} after it was resolved`,
+            };
+            likelyCause = JSON.stringify(cause);
+        }
+    }
+    else if (status === 'suppressed') {
+        status = 'open';
+    }
+    const codes = JSON.parse(existing.codes);
+    const nextCodes = o.code ? [o.code, ...codes.filter((c) => c !== o.code)].slice(0, MAX_CODES) : codes;
+    sql(`UPDATE _substrat_findings SET
+       status = ?, regressed = ?, rule_id = ?, likely_cause = ?, codes = ?,
+       seen_count = seen_count + 1, last_seen = ?,
+       last_version = COALESCE(?, last_version), vertical = COALESCE(?, vertical), scope_id = COALESCE(?, scope_id)
+     WHERE id = ?`, [
+        status,
+        regressed,
+        status === 'suppressed' ? ruleId : null,
+        likelyCause,
+        JSON.stringify(nextCodes),
+        at,
+        o.version,
+        o.vertical,
+        o.scopeId,
+        existing.id,
+    ]);
+}
+/**
+ * Findings, most recently seen first. No cursor, like the issue read it projects: the
+ * cardinality is the number of distinct shapes a tenant has, and `limit` bounds it.
+ */
+export function listFindings(sql, filter = {}) {
+    const where = [];
+    const params = [];
+    if (filter.tenantId !== undefined) {
+        where.push('tenant_id = ?');
+        params.push(filter.tenantId);
+    }
+    if (filter.status !== undefined) {
+        where.push('status = ?');
+        params.push(filter.status);
+    }
+    if (filter.kind !== undefined) {
+        where.push('kind = ?');
+        params.push(filter.kind);
+    }
+    params.push(assertRowLimit('limit', filter.limit ?? 100));
+    const rows = sql(`SELECT ${FINDING_COLUMNS} FROM _substrat_findings` +
+        (where.length ? ` WHERE ${where.join(' AND ')}` : '') +
+        ' ORDER BY last_seen DESC, id LIMIT ?', params);
+    return rows.map(findingOf);
+}
+/**
+ * A person's verdict: acknowledge, resolve, or reopen. Keyed on (tenant, id), so a tenant can
+ * never move another tenant's finding by guessing its id. Reopening a suppressed finding lifts
+ * it out of its rule for now; the next occurrence the rule still covers suppresses it again —
+ * revoking the rule is what ends a suppression.
+ */
+export function setFindingStatus(sql, tenantId, id, status, at, audit) {
+    const existing = sql(`SELECT ${FINDING_COLUMNS} FROM _substrat_findings WHERE tenant_id = ? AND id = ?`, [
+        tenantId,
+        id,
+    ])[0];
+    if (!existing)
+        return undefined;
+    const resolved = status === 'resolved';
+    const [after] = sql(`UPDATE _substrat_findings SET status = ?, rule_id = NULL, regressed = ?, resolved_at = ?,
+       resolved_version = ?, resolution = ?, acknowledged_at = ?, likely_cause = ?
+     WHERE id = ? RETURNING ${FINDING_COLUMNS}`, [
+        status,
+        resolved ? 0 : existing.regressed,
+        resolved ? at : existing.resolved_at,
+        resolved ? existing.last_version : existing.resolved_version,
+        resolved ? 'verdict' : existing.resolution,
+        status === 'acked' ? at : status === 'open' ? null : existing.acknowledged_at,
+        // A resolve closes the cycle its cause explained; the next regression names its own.
+        resolved ? null : existing.likely_cause,
+        id,
+    ]);
+    const change = { before: findingOf(existing), after: findingOf(after) };
+    audit({
+        action: 'setFindingStatus',
+        target: { tenantId, vertical: change.after.vertical },
+        before: { id, status: change.before.status },
+        after: { id, status: change.after.status },
+    });
+    return change;
+}
+/**
+ * A rule expires in the future and within `FINDING_RULE_MAX_DAYS` of `at`. A host whose store
+ * sits behind an RPC hop calls `createFindingRule` as a replied method, so this keeps its code.
+ */
+function assertFindingRuleExpiry(expiresAt, at) {
+    if (!(expiresAt > at))
+        throw substratError('validation_failed', 'a suppress rule must expire in the future');
+    const ceiling = new Date(Date.parse(at) + FINDING_RULE_MAX_DAYS * 86_400_000).toISOString();
+    if (expiresAt > ceiling) {
+        throw substratError('validation_failed', `a suppress rule lasts at most ${FINDING_RULE_MAX_DAYS} days`);
+    }
+}
+/**
+ * Create a suppress rule and apply it to the findings it covers now: each one not already
+ * resolved becomes `suppressed` under it. Returns the rule and the ids it suppressed, for the
+ * caller's audit row. The input is parsed by the caller (`findingRuleInput`); the expiry is
+ * held here (`assertFindingRuleExpiry`), against the same `at` every other write in the call uses.
+ */
+export function createFindingRule(sql, tenantId, input, createdBy, at, audit) {
+    assertFindingRuleExpiry(input.expiresAt, at);
+    const id = ulid();
+    const [rule] = sql(`INSERT INTO _substrat_finding_rules (${RULE_COLUMNS}) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+     RETURNING ${RULE_COLUMNS}`, [
+        id,
+        tenantId,
+        input.kind ?? null,
+        input.operation ?? null,
+        input.code ?? null,
+        input.subject ?? null,
+        input.expiresAt,
+        input.reason,
+        createdBy,
+        at,
+    ]);
+    const covered = sql(`UPDATE _substrat_findings SET status = 'suppressed', rule_id = ?
+      WHERE tenant_id = ? AND status IN ('open', 'acked', 'suppressed')
+        AND (? IS NULL OR kind = ?)
+        AND (? IS NULL OR operation = ?)
+        AND (? IS NULL OR EXISTS (SELECT 1 FROM json_each(codes) WHERE value = ?))
+        AND (? IS NULL OR subject = ?)
+      RETURNING id`, [
+        id,
+        tenantId,
+        input.kind ?? null,
+        input.kind ?? null,
+        input.operation ?? null,
+        input.operation ?? null,
+        input.code ?? null,
+        input.code ?? null,
+        input.subject ?? null,
+        input.subject ?? null,
+    ]);
+    const created = { rule: ruleOf(rule), suppressed: covered.map((c) => c.id) };
+    audit({
+        action: 'createFindingRule',
+        target: { tenantId, vertical: null },
+        before: null,
+        after: { rule: created.rule, suppressed: covered.length },
+    });
+    return created;
+}
+/**
+ * End a rule now. Its findings stay suppressed until their next occurrence, which then opens
+ * them — the same thing an expiry does, brought forward.
+ */
+export function revokeFindingRule(sql, tenantId, ruleId, at, audit) {
+    const existing = sql(`SELECT ${RULE_COLUMNS} FROM _substrat_finding_rules WHERE tenant_id = ? AND id = ?`, [
+        tenantId,
+        ruleId,
+    ])[0];
+    if (!existing)
+        return undefined;
+    // An already-expired rule keeps its expiry: revoking it changes nothing.
+    const expiresAt = existing.expires_at > at ? at : existing.expires_at;
+    sql('UPDATE _substrat_finding_rules SET expires_at = ? WHERE id = ?', [expiresAt, ruleId]);
+    const change = { before: ruleOf(existing), after: ruleOf({ ...existing, expires_at: expiresAt }) };
+    audit({
+        action: 'revokeFindingRule',
+        target: { tenantId, vertical: null },
+        before: { id: ruleId, expiresAt: change.before.expiresAt },
+        after: { id: ruleId, expiresAt: change.after.expiresAt },
+    });
+    return change;
+}
+/** A tenant's rules, newest first; `activeAt` keeps only those unexpired at that instant. */
+export function listFindingRules(sql, tenantId, activeAt, limit = 100) {
+    const where = [];
+    const params = [];
+    if (tenantId !== undefined) {
+        where.push('tenant_id = ?');
+        params.push(tenantId);
+    }
+    if (activeAt !== undefined) {
+        where.push('expires_at > ?');
+        params.push(activeAt);
+    }
+    params.push(assertRowLimit('limit', limit));
+    return sql(`SELECT ${RULE_COLUMNS} FROM _substrat_finding_rules` +
+        (where.length ? ` WHERE ${where.join(' AND ')}` : '') +
+        ' ORDER BY created_at DESC, id DESC LIMIT ?', params).map(ruleOf);
+}
+/**
+ * The findings retention pass, bounded by `limit` per step, oldest first. Run in ONE unit with
+ * `audit`, which the adapter points at its own admin-log write, so a stale resolution never
+ * lands without its row.
+ *
+ * An `open` or `acked` finding is never deleted for going quiet: deleting it would take it out
+ * of the inbox of whoever was watching it with nothing said. One quiet for the whole
+ * `FINDING_RETENTION_DAYS` is RESOLVED as `stale` instead, and audited. A `resolved` or
+ * `suppressed` finding is deleted once both its last occurrence and its last resolve are past
+ * the horizon — so a stale-resolved finding stays readable for one more window. An expired rule
+ * is deleted once its expiry is past the horizon; the admin log keeps its story.
+ */
+export function pruneFindings(sql, nowMs, limit, audit) {
+    assertRowLimit('limit', limit);
+    const now = new Date(nowMs).toISOString();
+    const horizon = new Date(nowMs - FINDING_RETENTION_DAYS * 86_400_000).toISOString();
+    const quiet = sql(`SELECT id, tenant_id, vertical, status FROM _substrat_findings
+      WHERE last_seen < ? AND status IN ('open', 'acked') ORDER BY last_seen LIMIT ?`, [horizon, limit]);
+    if (quiet.length > 0) {
+        sql(`UPDATE _substrat_findings SET status = 'resolved', resolution = 'stale', resolved_at = ?,
+         resolved_version = last_version, regressed = 0, likely_cause = NULL
+       WHERE id IN (SELECT value FROM json_each(?))`, [now, JSON.stringify(quiet.map((q) => q.id))]);
+    }
+    for (const q of quiet) {
+        audit({
+            action: 'resolveStaleFinding',
+            target: { tenantId: q.tenant_id, vertical: q.vertical },
+            before: { id: q.id, status: q.status },
+            after: { id: q.id, status: 'resolved', resolution: 'stale' },
+        });
+    }
+    const deleted = sql(`DELETE FROM _substrat_findings WHERE rowid IN (
+       SELECT rowid FROM _substrat_findings
+        WHERE last_seen < ? AND status IN ('resolved', 'suppressed')
+          AND (resolved_at IS NULL OR resolved_at < ?)
+        ORDER BY last_seen LIMIT ?) RETURNING 1`, [horizon, horizon, limit]).length;
+    const rulesDeleted = sql(boundedRetentionDelete('_substrat_finding_rules', 'expires_at'), [horizon, limit]).length;
+    return { deleted, staled: quiet.length, rulesDeleted };
+}
+//# sourceMappingURL=findings.js.map

package/dist/findings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"findings.js","sourceRoot":"","sources":["../src/findings.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,YAAY,EACZ,gBAAgB,EAChB,qBAAqB,EACrB,aAAa,GAad,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAE/F;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,oBAAoB,CAAC;AAE3D;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4C3B,CAAC;AAiBF;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,CAQnC;IACC,IAAI,CAAC,CAAC,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,WAAW,GAAG,qBAAqB,CAAC,CAAC,CAAC,CAAC;IAC7C,OAAO;QACL,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,WAAW;QACpB,QAAQ,EAAE,SAAS;QACnB,KAAK,EAAE,GAAG,CAAC,CAAC,SAAS,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC9F,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI;QACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,IAAI;QAC5B,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,IAAI;QAC1B,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,IAAI;QAC1B,QAAQ,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE;KAClD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAUjC;IACC,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACvD,MAAM,IAAI,GAAG;QACX,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,OAAO,EAAE,CAAC,CAAC,IAAI;QACf,IAAI,EAAE,IAAI;QACV,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,IAAI;QAC5B,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,IAAI;QAC1B,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,IAAI;KAC3B,CAAC;IACF,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC1B,OAAO;YACL,GAAG,IAAI;YACP,IAAI,EAAE,WAAW;YACjB,QAAQ,EAAE,UAAU;YACpB,KAAK,EAAE,aAAa,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,IAAI,SAAS;YAClD,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI;YAC9B,QAAQ,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;SACnE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAC3B,OAAO;YACL,GAAG,IAAI;YACP,IAAI,EAAE,OAAO;YACb,QAAQ,EAAE,SAAS;YACnB,KAAK,EAAE,GAAG,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,IAAI,iBAAiB;YAChD,SAAS,EAAE,IAAI;YACf,QAAQ,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;SACpE,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAyCD,MAAM,eAAe,GACnB,0GAA0G;IAC1G,+GAA+G;IAC/G,iCAAiC,CAAC;AACpC,MAAM,YAAY,GAAG,2FAA2F,CAAC;AAEjH,SAAS,SAAS,CAAC,CAAa;IAC9B,OAAO,YAAY,CAAC,KAAK,CAAC;QACxB,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,SAAS,EAAE,CAAC,CAAC,SAAS,KAAK,CAAC;QAC5B,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAY;QACrC,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,OAAO,EAAE,CAAC,CAAC,QAAQ;QACnB,KAAK,EAAE,CAAC,CAAC,UAAU;QACnB,SAAS,EAAE,CAAC,CAAC,UAAU;QACvB,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,WAAW,EAAE,CAAC,CAAC,YAAY;QAC3B,eAAe,EAAE,CAAC,CAAC,gBAAgB;QACnC,UAAU,EAAE,CAAC,CAAC,WAAW;QACzB,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,cAAc,EAAE,CAAC,CAAC,eAAe;QACjC,MAAM,EAAE,CAAC,CAAC,OAAO;QACjB,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAY;QAC3C,WAAW,EAAE,CAAC,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAa;KACtF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,CAAU;IACxB,OAAO,gBAAgB,CAAC,KAAK,CAAC;QAC5B,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,SAAS,EAAE,CAAC,CAAC,UAAU;QACvB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,SAAS,EAAE,CAAC,CAAC,UAAU;QACvB,SAAS,EAAE,CAAC,CAAC,UAAU;KACxB,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CACjB,GAAiB,EACjB,CAAqG,EACrG,EAAU;IAEV,MAAM,GAAG,GAAG,GAAG,CACb;;;;;;2CAMuC,EACvC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CACzD,CAAC,CAAC,CAA+B,CAAC;IACnC,OAAO,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC;AACzB,CAAC;AAED,MAAM,SAAS,GAAG,CAAC,CAAC;AAEpB;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAC,GAAiB,EAAE,CAAqB,EAAE,EAAU;IACjF,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,GAAG,CAClB;gFAC4E,EAC5E,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAChC,CAAC,CAAC,CAAgH,CAAC;IACpH,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,GAAG,CACD,mCAAmC,eAAe;mGAC2C,EAC7F;YACE,IAAI,EAAE;YACN,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,OAAO;YACT,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM;YAC9B,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,SAAS;YACX,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACtC,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,OAAO;YACT,EAAE;YACF,EAAE;YACF,CAAC,CAAC,OAAO;YACT,MAAM;YACN,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;SAC3B,CACF,CAAC;QACF,OAAO;IACT,CAAC;IACD,IAAI,MAAM,GAAG,QAAQ,CAAC,MAAuB,CAAC;IAC9C,IAAI,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;IACnC,IAAI,WAAW,GAAG,QAAQ,CAAC,YAAY,CAAC;IACxC,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,GAAG,YAAY,CAAC;IACxB,CAAC;SAAM,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;QACjC,MAAM,GAAG,MAAM,CAAC;QAChB,SAAS,GAAG,CAAC,CAAC;QACd,WAAW,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YAClE,MAAM,KAAK,GAAuB;gBAChC,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,MAAM,EAAE,QAAQ,CAAC,gBAAgB;oBAC/B,CAAC,CAAC,kBAAkB,QAAQ,CAAC,gBAAgB,sBAAsB,CAAC,CAAC,OAAO,EAAE;oBAC9E,CAAC,CAAC,oBAAoB,CAAC,CAAC,OAAO,wBAAwB;aAC1D,CAAC;YACF,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;SAAM,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;QACnC,MAAM,GAAG,MAAM,CAAC;IAClB,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAa,CAAC;IACrD,MAAM,SAAS,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACtG,GAAG,CACD;;;;kBAIc,EACd;QACE,MAAM;QACN,SAAS;QACT,MAAM,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;QACvC,WAAW;QACX,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;QACzB,EAAE;QACF,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,OAAO;QACT,QAAQ,CAAC,EAAE;KACZ,CACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,GAAiB,EAAE,MAAM,GAAkB,EAAE;IACxE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAwB,EAAE,CAAC;IACvC,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACvB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,GAAG,CACd,UAAU,eAAe,0BAA0B;QACjD,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,sCAAsC,EACxC,MAAM,CACS,CAAC;IAClB,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AAC7B,CAAC;AAmBD;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAAiB,EACjB,QAAkB,EAClB,EAAU,EACV,MAA0B,EAC1B,EAAU,EACV,KAAkC;IAElC,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,eAAe,yDAAyD,EAAE;QACvG,QAAQ;QACR,EAAE;KACH,CAAC,CAAC,CAAC,CAA2B,CAAC;IAChC,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,MAAM,QAAQ,GAAG,MAAM,KAAK,UAAU,CAAC;IACvC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CACjB;;8BAE0B,eAAe,EAAE,EAC3C;QACE,MAAM;QACN,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS;QACjC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW;QACpC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,gBAAgB;QAC5D,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU;QAC1C,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,eAAe;QAC7E,qFAAqF;QACrF,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY;QACvC,EAAE;KACH,CACc,CAAC;IAClB,MAAM,MAAM,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,KAAM,CAAC,EAAE,CAAC;IACzE,KAAK,CAAC;QACJ,MAAM,EAAE,kBAAkB;QAC1B,MAAM,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE;QACrD,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE;QAC5C,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE;KAC3C,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,SAAS,uBAAuB,CAAC,SAAiB,EAAE,EAAU;IAC5D,IAAI,CAAC,CAAC,SAAS,GAAG,EAAE,CAAC;QAAE,MAAM,aAAa,CAAC,mBAAmB,EAAE,2CAA2C,CAAC,CAAC;IAC7G,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,qBAAqB,GAAG,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5F,IAAI,SAAS,GAAG,OAAO,EAAE,CAAC;QACxB,MAAM,aAAa,CAAC,mBAAmB,EAAE,iCAAiC,qBAAqB,OAAO,CAAC,CAAC;IAC1G,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAiB,EACjB,QAAkB,EAClB,KAAuB,EACvB,SAAiB,EACjB,EAAU,EACV,KAAkC;IAElC,uBAAuB,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAC7C,MAAM,EAAE,GAAG,IAAI,EAAE,CAAC;IAClB,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,CAChB,wCAAwC,YAAY;iBACvC,YAAY,EAAE,EAC3B;QACE,EAAE;QACF,QAAQ;QACR,KAAK,CAAC,IAAI,IAAI,IAAI;QAClB,KAAK,CAAC,SAAS,IAAI,IAAI;QACvB,KAAK,CAAC,IAAI,IAAI,IAAI;QAClB,KAAK,CAAC,OAAO,IAAI,IAAI;QACrB,KAAK,CAAC,SAAS;QACf,KAAK,CAAC,MAAM;QACZ,SAAS;QACT,EAAE;KACH,CACW,CAAC;IACf,MAAM,OAAO,GAAG,GAAG,CACjB;;;;;;mBAMe,EACf;QACE,EAAE;QACF,QAAQ;QACR,KAAK,CAAC,IAAI,IAAI,IAAI;QAClB,KAAK,CAAC,IAAI,IAAI,IAAI;QAClB,KAAK,CAAC,SAAS,IAAI,IAAI;QACvB,KAAK,CAAC,SAAS,IAAI,IAAI;QACvB,KAAK,CAAC,IAAI,IAAI,IAAI;QAClB,KAAK,CAAC,IAAI,IAAI,IAAI;QAClB,KAAK,CAAC,OAAO,IAAI,IAAI;QACrB,KAAK,CAAC,OAAO,IAAI,IAAI;KACtB,CACkB,CAAC;IACtB,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,IAAK,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC9E,KAAK,CAAC;QACJ,MAAM,EAAE,mBAAmB;QAC3B,MAAM,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;QACpC,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,MAAM,EAAE;KAC1D,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAiB,EACjB,QAAkB,EAClB,MAAc,EACd,EAAU,EACV,KAAkC;IAElC,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,YAAY,8DAA8D,EAAE;QACzG,QAAQ;QACR,MAAM;KACP,CAAC,CAAC,CAAC,CAAwB,CAAC;IAC7B,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,yEAAyE;IACzE,MAAM,SAAS,GAAG,QAAQ,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC;IACtE,GAAG,CAAC,gEAAgE,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3F,MAAM,MAAM,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,GAAG,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACnG,KAAK,CAAC;QACJ,MAAM,EAAE,mBAAmB;QAC3B,MAAM,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;QACpC,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE;QAC1D,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE;KACzD,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,gBAAgB,CAC9B,GAAiB,EACjB,QAA8B,EAC9B,QAAiB,EACjB,KAAK,GAAG,GAAG;IAEX,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAwB,EAAE,CAAC;IACvC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxB,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IAC5C,OACE,GAAG,CACD,UAAU,YAAY,+BAA+B;QACnD,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,4CAA4C,EAC9C,MAAM,CAET,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAChB,CAAC;AAYD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAC3B,GAAiB,EACjB,KAAa,EACb,KAAa,EACb,KAAkC;IAElC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC/B,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IAC1C,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,KAAK,GAAG,sBAAsB,GAAG,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IACpF,MAAM,KAAK,GAAG,GAAG,CACf;qFACiF,EACjF,CAAC,OAAO,EAAE,KAAK,CAAC,CACiD,CAAC;IACpE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,GAAG,CACD;;oDAE8C,EAC9C,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAC9C,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,KAAK,CAAC;YACJ,MAAM,EAAE,qBAAqB;YAC7B,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,SAAqB,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE;YACnE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAuB,EAAE;YACvD,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE;SAC7D,CAAC,CAAC;IACL,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CACjB;;;;gDAI4C,EAC5C,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAC1B,CAAC,MAAM,CAAC;IACT,MAAM,YAAY,GAAG,GAAG,CAAC,sBAAsB,CAAC,yBAAyB,EAAE,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IACnH,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC;AACzD,CAAC"}

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export type { AccessLogFilter, AttachmentSearchOptions, AttachmentUploadInput, AuditLogFilter, BlobStoreProvisionInput, BlobStoreRecord, ConsumerHandler, ImportHandler, ExecutorDeadLetter, ExecutorDrainReport, ExecutorHandler, ExecutorRetryPolicy, ConnectorConnection, ScopedConnectorConnection, ConnectorContext, ConnectorHandler, ConnectorOptions, ConnectorRequestInit, ConnectorResponse, Clock, FetchLike, GuardPredicate, HostAdmin, MigrateScopeOutcome, MigrationFrontier, ModuleRegistration, ConsumersOf, EventContract, EventPayloadOf, EventTypeOf, TypedConsumerHandler, TypedConsumers, OpenedAttachment, OperationContext, PageParams, OperationHandler, AppliedMigration, OpsFailureFilter, OpsFailureInput, KeptCopyResolution, IssueFilter, TelemetryPruneReport, SweepRunFilter, SweepRunInput, ProvisionScopeInput, RoleFilter, FreshnessRegistration, FreshnessReport, LiveChange, LiveReadSurface, LiveUpgradeRequest, OperationEntitlement, ScheduleRegistration, ScheduleRunReport, ScopeAttachments, ScopedSql, ScopeFilter, ScopeHost, ScopeStub, ScopeStubOptions, InvokeOptions, EmittedEvent, EmittedReport, SqlMigration, SqlValue, TenantBlobStore, TenantRelationalStore, TenantStoreProvisionInput, TenantStoreRecord, } from './scope-host.js';
+export type { AccessLogFilter, AttachmentSearchOptions, AttachmentUploadInput, AuditLogFilter, BlobStoreProvisionInput, BlobStoreRecord, ConsumerHandler, ImportHandler, ExecutorDeadLetter, ExecutorDrainReport, ExecutorHandler, ExecutorOutcome, ExecutorRetryPolicy, ExecutorScope, MembershipChange, MembershipChangeResult, ConnectorConnection, ScopedConnectorConnection, ConnectorContext, ConnectorHandler, ConnectorOptions, ConnectorRequestInit, ConnectorResponse, Clock, FetchLike, GuardPredicate, HostAdmin, MigrateScopeOutcome, MigrationFrontier, ModuleRegistration, ConsumersOf, EventContract, EventPayloadOf, EventTypeOf, TypedConsumerHandler, TypedConsumers, OpenedAttachment, OperationContext, PageParams, OperationHandler, AppliedMigration, OpsFailureFilter, OpsFailureInput, KeptCopyResolution, IssueFilter, TelemetryPruneReport, SweepRunFilter, SweepRunInput, ProvisionScopeInput, RoleFilter, FreshnessRegistration, FreshnessReport, LiveChange, LiveFrame, LiveNudge, LiveReadSurface, LiveUpgradeRequest, OperationEntitlement, ScheduleRegistration, ScheduleRunReport, ScopeAttachments, ScopedSql, ScopeFilter, ScopeHost, ScopeStub, ScopeStubOptions, InvokeOptions, EmittedEvent, EmittedReport, SqlMigration, SqlValue, TenantBlobStore, TenantRelationalStore, TenantStoreProvisionInput, TenantStoreRecord, } from './scope-host.js';
 export type { 
 /** @deprecated Import from `@substrat-run/adapter-cloudflare` (#1978); this kernel export goes in a later release. */
 AnalyticsEngineDatasetLike, ConnectionUseOutcome, ConnectionUseTiming, ConnectorCallErrorType, ConnectorCallRecord, ConnectorCallRecorder, CountingConnectorCallRecorder, } from './connector-calls.js';
@@ -9,9 +9,9 @@ CONNECTOR_CALL_DATA_POINT_LAYOUT, CONNECTOR_CALL_ERROR_TYPES,
 analyticsEngineConnectorCallRecorder, 
 /** @deprecated Import from `@substrat-run/adapter-cloudflare` (#1978); this kernel export goes in a later release. */
 connectorCallDataPoint, connectorCallErrorType, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, } from './connector-calls.js';
-export { assertRedrainWindow, attachmentBlobKey, attachmentSha256, consumersFor, entitlementDenial, requiredEntitlementFor, backoffAt, globalFetch, parseValidationRecords, resolveRetryPolicy, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, SWEEP_RUNS_INTENT_INDEX, sweepRunsIntentHasKind, ISSUE_RETENTION_DAYS, telemetryRetentionStatements, TELEMETRY_PRUNE_BATCH, assertRowLimit, assertRowOffset, EMITTED_REPORT_CAP, 
+export { assertRedrainWindow, attachmentBlobKey, attachmentSha256, consumersFor, entitlementDenial, requiredEntitlementFor, backoffAt, globalFetch, executorOutcomeOf, parseValidationRecords, resolveRetryPolicy, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, SWEEP_RUNS_INTENT_INDEX, sweepRunsIntentHasKind, ISSUE_RETENTION_DAYS, telemetryRetentionStatements, TELEMETRY_PRUNE_BATCH, assertRowLimit, assertRowOffset, EMITTED_REPORT_CAP, 
 /** @deprecated Import from `@substrat-run/vertical-host` (#1978); this kernel export goes in a later release. */
-isUpgradeRequest, } from './scope-host.js';
+isUpgradeRequest, isVouchedWithin, vouchedWithin, type VouchedWithin, } from './scope-host.js';
 export { 
 /** @deprecated Import from `@substrat-run/contracts` (#1978); this kernel export goes in a later release. */
 LIVE_MODE_HEADER, 
@@ -36,28 +36,32 @@ export type { ResolvedScopeRecord } from './scope-record.js';
 export { assertAllowed, denyAllChecker, PermissionDenied, UNSAFE_allowAllChecker, } from './permission-checker.js';
 export { actorOf, asPrincipal, isUnknownRoleError, unknownRoleError } from './permission-checker.js';
 export type { PermissionChecker } from './permission-checker.js';
-export { createTupleEvaluator } from './permission-eval.js';
-export type { PermissionTupleReader, PermissionTupleRow, ScopeTupleReader, } from './permission-eval.js';
+export { ancestorsWithin, createTupleEvaluator, joinedMembershipExpiry, liveOrgMembership, memberAddedAudit, orgChangeBound, reachesWithin, tenantCoverage, } from './permission-eval.js';
+export type { PermissionTupleReader, TenantDirectoryReader, PermissionTupleRow, ScopeTupleReader, } from './permission-eval.js';
 export { CAPABILITY_COLUMNS, CAPABILITY_DDL, CAPABILITY_EXCHANGE_OPERATION, CAPABILITY_SESSION_PRUNE_BATCH, WITHHELD_SECRET, assertNoSecret, capabilityAttachmentWriteRefused, capabilityByIdQuery, capabilityExchangeable, capabilityGrantOf, capabilityListQuery, capabilityLive, capabilityRecordOf, capabilityTokenHash, carriesSecret, checkBecomeInput, createCapabilityVerbs, exchangeCapability, guardSecrets, mintBecomeCapability, mintCapabilitySecret, mintCapabilitySessionToken, persistedText, readCapabilities, readCapabilityPage, plausibleSessionToken, plausibleCapabilitySecret, redactSecrets, redactSecretText, resolveCapabilitySession, revokeCapabilityAsPlatform, } from './capability.js';
 export type { CapabilityGrantView, CapabilityRow, CapabilityVerbDeps, CapabilityVerbs, } from './capability.js';
 export { createEntityEdgeVerbs } from './entity-edges.js';
 export type { EntityEdgeDeps, EntityEdgeVerbs } from './entity-edges.js';
+export { addStatePlans, createEntityStateVerbs, entityStateMigrations, entityStatePlans, entityStateTriggerDdl, assertEntityStateIntact, ENTITY_STATE_MOVES_DDL, ENTITY_STATE_MOVES_TABLE, statefulTablesOf, entityStateWhere, stateColumnsOf, } from './entity-state.js';
+export type { EntityStateDeps, EntityStatePlan, EntityStateVerbs, StateColumns } from './entity-state.js';
+export { TRASH_SCAN_BUDGET, createTrashedReads, searchStateWhere, uncheckedView } from './entity-state-reads.js';
+export type { TrashedReadDeps, TrashedReads } from './entity-state-reads.js';
 export { createAtomic } from './sub-transaction.js';
 export type { RunSub, AtomicMarks } from './sub-transaction.js';
 export { DEFAULT_SEARCH_LIMIT, MAX_SEARCH_LIMIT, MIN_SEARCH_TERM, NotSearchable, SEARCH_INDEX_PREFIX, SearchTermTooShort, isSearchIndexTable, searchIndexDdl, searchIndexMigrations, searchIndexPlans, searchLimit, searchMatchExpression, searchPlansByEntityType, searchQuery, } from './search-index.js';
 export type { SearchHit, SearchIndexPlan, SearchOptions, SearchTokenizer, SearchableDeclaration, } from './search-index.js';
-export { ATTACHMENT_SEARCH_OWNER_MAX, ATTACHMENT_SEARCH_OWNERS_SQL, ATTACHMENT_SEARCH_SQL, ATTACHMENT_SEARCH_TOO_MANY_OWNERS, ATTACHMENT_TEXT_DDL, ATTACHMENT_TEXT_JOB, ATTACHMENT_TEXT_MODULE, assertJobRegistrable, attachmentRecordOfRow, attachmentTextJob, enqueueAttachmentText, isAttachmentTextRun, readAttachmentText, reconcileAttachmentText, recordAttachmentText, searchAttachments, } from './attachment-text.js';
-export type { AttachmentRowShape, AttachmentSearchGate, AttachmentTextSource, AttachmentTextState, AttachmentTextStatus, } from './attachment-text.js';
-export { DEFAULT_ATTACHMENT_TEXT_BOUNDS, EXTRACTION_STRIDE, assertAttachmentExtractors, assertAttachmentTextBounds, chooseAttachmentExtractor, inputBoundRefusal, isPositiveIntegerBound, mediaTypeOf, normalizeExtractedText, runAttachmentExtractor, truncateUtf8, } from './attachment-extractor.js';
+export { ATTACHMENT_SEARCH_OWNER_MAX, ATTACHMENT_SEARCH_OWNERS_SQL, ATTACHMENT_SEARCH_SQL, ATTACHMENT_SEARCH_TOO_MANY_OWNERS, ATTACHMENT_TEXT_BACKFILL_BATCH, ATTACHMENT_TEXT_BACKFILL_JOB, ATTACHMENT_TEXT_DDL, ATTACHMENT_TEXT_JOB, ATTACHMENT_TEXT_MODULE, assertJobRegistrable, attachmentRecordOfRow, attachmentTextBackfillJob, attachmentTextJob, enqueueAttachmentText, kernelJobFor, isAttachmentTextRun, queueAttachmentTextBackfill, readAttachmentText, reconcileAttachmentText, recordAttachmentText, searchAttachments, startAttachmentTextBackfill, } from './attachment-text.js';
+export type { AttachmentRowShape, AttachmentTextBackfillBatch, KernelJobHandlers, AttachmentSearchGate, AttachmentTextSource, AttachmentTextState, AttachmentTextStatus, } from './attachment-text.js';
+export { DEFAULT_ATTACHMENT_TEXT_BOUNDS, EXTRACTION_STRIDE, assertAttachmentExtractors, assertAttachmentTextBounds, chooseAttachmentExtractor, inputBoundRefusal, isPositiveIntegerBound, mediaTypeOf, normalizeExtractedText, resolveAttachmentTextBounds, runAttachmentExtractor, truncateUtf8, } from './attachment-extractor.js';
 export type { AttachmentExtractor, AttachmentExtractorInput, AttachmentExtractorResult, AttachmentTextBounds, ExtractionOutcome, ExtractionSignal, } from './attachment-extractor.js';
-export { CursorMismatch, FilterNotDeclared, LIST_INDEX_PREFIX, NotListable, SortNotDeclared, cursorOf, isListIndexName, listIndexColumns, listIndexDdl, listIndexMigrations, listIndexPlans, listPlansByEntityType, listQuery, splitCursor, } from './list-index.js';
+export { CursorMismatch, FilterNotDeclared, LIST_INDEX_PREFIX, NotListable, SortNotDeclared, cursorOf, isListIndexName, listIndexColumns, listIndexDdl, listIndexMigrations, listIndexPlans, stateListIndexNames, listPlansByEntityType, listQuery, splitCursor, } from './list-index.js';
 export type { ComposedListQuery, ListDeclaration, ListIndexPlan, ListQueryParams, } from './list-index.js';
 export { moduleMigrations } from './module-migrations.js';
 export { frozenClock, manualClock } from './clock.js';
 export type { ManualClock } from './clock.js';
-export { createUlid, ulid, ulidCeiling, ulidTime, type UlidMint } from './ulid.js';
+export { createUlid, ulid, ulidCeiling, ulidFloor, ulidTime, type UlidMint } from './ulid.js';
 export { assertReadOnlyQuery } from './read-only-sql.js';
-export { assertNoSpineReference, assertNoSpineWrite, guardSpine } from './spine-guard.js';
+export { assertNoReservedColumnWrite, assertNoSpineReference, assertNoSpineWrite, assertNoStatefulDdl, changesSchema, guardSpine } from './spine-guard.js';
 export { DO_SQL_LIMITS, tooManyResultColumns, tooManyTableColumns, assertWithinSqlLimits, guardSqlLimits, } from './sql-limits.js';
 export { assertPermissionKey } from './check-key.js';
 export { assertModuleEnqueueableKind } from './platform-kinds.js';
@@ -86,16 +90,18 @@ export { PLATFORM_REQUEST_COLUMNS, platformRequestHistoryQuery, platformRequestO
 export type { PlatformRequestRawRow } from './platform-request-query.js';
 export { CANCELLED_INTENT_NOTE, CANCELLED_JOB_NOTE, DELIVERY_ERROR_REDACTION_SQL, intentPayloadCarriesSubject, JOB_RUN_REDACTION_SQL, JOB_STEP_REDACTION_SQL, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, REDACTED_DELIVERY_NOTE, REDACTED_INTENT_MARKER, REDACTED_INTENT_NOTE, REDACTED_JOB_NOTE, redactedIntentPayload, redactSubjectJobRuns, REDACTED_FAILURE_NOTE, redactSubjectScopeText, ISSUE_EXEMPLAR_OWNER_BACKFILL_SQL, issueExemplarOwner, redactSubjectDirectoryText, platformIntentFailureMessage, intentIdOfFailureMessage, } from './subject-redaction.js';
 export type { LegacySubjectRedactionCounts, PlatformRequestRedactionCandidate, RedactionSql, SubjectRedactionCounts, SubjectTextTarget, IssueExemplarOwner, } from './subject-redaction.js';
+export { FINDINGS_DDL, FINDING_RETENTION_DAYS, createFindingRule, findingOfOpsFailure, findingOfSweepRun, pruneFindings, listFindingRules, listFindings, observeFinding, revokeFindingRule, setFindingStatus, type FindingPruneReport, type FindingAudit, type FindingChange, type FindingObservation, } from './findings.js';
 export { effectiveRoleGrantQuery, seatScopeTuple } from './scope-tuple-seat.js';
+export { applyScopeRoleChange, changeScopeRole, combineCoverage, revokeScopeRoles, scopeRoleHolders, type Atomically, type RoleBound, type ScopeRoleHolder } from './scope-role-admin.js';
 export { repointScopeGrants, type RepointSource } from './scope-repoint.js';
 export { COPY_ORIGIN_DDL, capabilitiesForLoad, clearCopyMarker, emittedHere, isCopyLoad, IS_COPY_SQL, MARK_COPY_ORIGIN_SQL, markCopyOrigin, settleCopiedWork } from './scope-copy.js';
 export { isLifecycleWrite, lifecycleAfterLoad, lifecycleReceipt, lifecycleRefusal, readLifecycle, settleLifecycleAfterLoad, SCOPE_LIFECYCLE_KEY, WRITE_LIFECYCLE_SQL, writeLifecycle } from './scope-lifecycle.js';
 export { CARRIED_AWAY_KEY, COPY_MARK_CLEARED_KEY, KEPT_COPY_REFUSAL, KEPT_DIVERGENT_KEY, LOAD_STAMP_KEY, STORE_LOCAL_META_KEYS, WRITE_REVISION_KEY, type KeptCopy, carriedAwayDump, dumpMetaValue, isCopyMarkInsert, isWriteStatement, metaValueIn, type CarriedAway, type LoadMarker } from './carried-copy.js';
 export { LEGACY_SCOPE_ROWS_BACKFILL, assertDirectoryTablesBuilt, assertSpineTablesBuilt, dumpRowsInsert, isSpineTable, loadDirectoryDump, spineColumnAdditions, spineRowsInsert, type KernelColumnsOf } from './spine-restore.js';
-export { SYSTEM_SWITCH_OFF_PREDICATE, SYSTEM_SWITCH_OFF_QUERY, SYSTEM_SWITCH_OFF_RELATION, subjectSwitchedOff, switchRecordedOff, switchSubjectGrants, switchSystemSchedules, subjectGrantState, systemGrantsStatus, systemScheduleState, systemSwitchedOff, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, } from './system-switch.js';
-export type { SwitchOutcome, SwitchSql, SwitchedOff, SystemGrantsEntry, SystemScheduleState, } from './system-switch.js';
-export { SYSTEM_SWITCHES_BACKFILL_SQL, SYSTEM_SWITCHES_DDL, SYSTEM_SWITCHES_TABLE, dumpCarriesSystemSwitches, forgetSystemSwitchesOf, inUnitMovesToAudit, listSystemSwitchRecords, staleCarryRevertRow, staleCarryReverts, recordSystemSwitchedOff, recordSystemSwitchedOn, restoreSystemSwitchRecord, scopesSwitchedOffFor, tenantHoldsSystemGrant, switchedOffModulesOf, systemSwitchRecordsOf, systemSwitchesTableExists, withRecorded, } from './system-switch-record.js';
-export type { SystemSwitchReassert, SystemSwitchReassertOptions, SystemSwitchRecordFilter, SystemSwitchRecordPrior, SystemSwitchRecordRow, SystemSwitchRecordWrite, } from './system-switch-record.js';
+export { SYSTEM_SWITCH_OFF_PREDICATE, SYSTEM_SWITCH_OFF_QUERY, SYSTEM_SWITCH_OFF_RELATION, subjectSwitchedOff, SWITCH_FENCES_DDL, moveSwitch, recordedOffFromWire, switchRecordedOff, switchSubjectGrants, switchSystemSchedules, subjectGrantState, systemGrantsStatus, systemScheduleState, systemSwitchedOff, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, } from './system-switch.js';
+export type { RecordedOffCarry, SwitchCarryWire, SwitchOutcome, SwitchSql, SwitchedOff, SystemGrantsEntry, SystemScheduleState, } from './system-switch.js';
+export { PEER_SWITCHES_DDL, SWITCH_KINDS, SWITCH_OWED_DDL, SYSTEM_SWITCHES_DDL, SYSTEM_SWITCHES_TABLE, clearSwitchOwed, scopeOwesSwitch, markSwitchOwed, switchesOwedOf, dumpCarriesSwitches, forgetSwitchesOf, inUnitMovesToAudit, listSystemSwitchRecords, reassertActionOf, recordWriteSuperseded, reassertEntry, reassertOffRow, reassertOnRow, recordSwitchedOff, recordSwitchedOn, restoreSwitchRecord, scopesSwitchedOffFor, staleCarryRevertRow, staleCarryReverts, reportKeyOf, switchActionOf, switchAuditSubject, switchNotFoundMessage, switchFencesOf, switchRecordStatesOf, switchRecordsOf, switchSubjectOf, switchSupersededMessage, switchedOffOf, switchesBackfillSqlOf, switchesDdlOf, switchesTableExists, switchesTableOf, tenantHeldOf, tenantHoldsGrant, withRecorded, } from './system-switch-record.js';
+export type { InUnitReport, SwitchKind, SwitchRecordPrior, SwitchRecordWrite, SystemSwitchReassert, SystemSwitchReassertOptions, SystemSwitchRecordFilter, SystemSwitchRecordRow, } from './system-switch-record.js';
 export { VERSION_MIGRATIONS_DDL, splitManifestMigrations, splitVersionMigrationsBatch, versionMigrationsOf, versionsAwaitSplit, writeVersionMigrations, } from './version-migrations.js';
 export type { SplitManifest } from './version-migrations.js';
 export { PEER_SUBJECT_PREFIX, admitPeer, collectPeers, peerGrantsStatus, peerSeats, peerSubjectRef, peerSwitchedOff, resolveVerticalInstanceFrom, switchPeer, } from './peer.js';
@@ -104,9 +110,10 @@ export { DENIAL_COLUMNS, DENIAL_WINDOW_QUERY, denialListQuery, denialSummaryQuer
 export { entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, type EntityVersion, type EntityVersionRow, } from './entity-version.js';
 export { IMPERSONATION_COLUMNS, IMPERSONATION_DDL, ImpersonationRefused, assertImpersonationWrites, assertSessionUsable, impersonationByIdQuery, impersonationListQuery, impersonationRowValues, impersonationStampOf, mapImpersonationRow, newImpersonationSession, type ImpersonationRow, } from './impersonation.js';
 export { readLifecycleFlow } from './lifecycle-flow.js';
+export { OPERATION_SERIES_ID_SLACK_MS, operationSeriesQuery, readOperationSeries } from './operation-series.js';
 export { REFUSALS_DDL, REFUSALS_INDEX, REFUSALS_REBUILD, REFUSALS_TABLE_DDL, markGuardRefusal, refusalInsert, refusalOf, refusalsAdmitGuards, refusedTransitionOf, type RefusalRow, type RefusedGuard, } from './refusals.js';
 export { REFUSAL_COLUMNS, mapRefusalRow, refusalListQuery, type RefusalDbRow } from './refusal-query.js';
-export { readTimeline, readHistory, readScopeTimeline, readScopeHistory, facetEvents, walkEventCause, walkEventEffects, readInvocation, readDeadLetters } from './timeline.js';
+export { readTimeline, readHistory, readScopeTimeline, readScopeHistory, facetEvents, walkEventCause, walkEventEffects, readInvocation, readDeadLetters, readExecutorDelivery, type ExecutorDelivery, type ExecutorDeliveryState } from './timeline.js';
 export type { ScopeWalkPage } from './timeline.js';
 export type { TimelineReader } from './timeline.js';
 export { rowDecoder, UNDECODED_ACTOR, UNDECODED_PERMISSION } from './row-decode.js';
@@ -114,8 +121,8 @@ export type { RowDecoder } from './row-decode.js';
 export { domainEventOf, drainedEventOf, readUndrainedOutbox, undrainedEventsOf, UNDRAINED_SCAN_FACTOR, UNDRAINED_SKIPPED_IDS, } from './outbox-event.js';
 export type { OutboxEnvelopeRow, OutboxDrainRow, UndrainedEvents, UndrainedRead, UndrainedSkipped, } from './outbox-event.js';
 export { IDEMPOTENCY_DDL, assertIdempotencyKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencySubject, idempotencyOptedOutMessage, replayFor, type IdempotencyRow, type IdempotentReplay, } from './idempotency.js';
-export { JOB_RUN_DDL, JOB_RUN_PATCH_SQL, JOB_STEP_RECORD_SQL, JOB_DRIVE_LIMIT, JOB_DRIVE_SCAN_MAX, JOB_RUN_LIST_LIMIT, JOB_RUN_LIST_MAX, jobRunListLimit, JOB_STEP_REUSED, SYSTEM_DOOR_WAIT, JOB_DEFER_MS, JOB_RUN_DUE_AT, assertQueueSafe, jobRunOf, runDueJobRuns, runJobPass, startJobRun, } from './job-run.js';
-export type { JobDueKey, JobDriveReport, JobHandler, JobPassContext, JobPassOutcome, JobPassResult, JobRun, JobRunFilter, JobRunKey, JobRunPatch, JobRunRow, JobRunStatus, JobRunStore, JobStepRow, StartJobRunInput, } from './job-run.js';
+export { JOB_RUN_DDL, JOB_RUN_PATCH_SQL, JOB_RUN_CLAIM_SQL, JOB_RUN_RENEW_SQL, JOB_RUN_BEGIN_SQL, JOB_RUN_MISS_SQL, JOB_RUN_MISS_SETTLE_SQL, admissionMissOutcome, JOB_STEP_RECORD_SQL, JOB_LEASE_MS, JOB_LEASE_MIN_MS, JOB_LEASE_ENTRY_MARGIN, JOB_ADMISSION_MISS_MAX, JOB_ADMISSION_BACKOFF_BASE_MS, JOB_ADMISSION_BACKOFF_MAX_MS, JOB_LEASE_TOO_SHORT_NOTE, admissionBackoffMs, JOB_LEASE_EXPIRED_NOTE, assertLeaseMs, JOB_DRIVE_LIMIT, JOB_DRIVE_SCAN_MAX, JOB_RUN_LIST_LIMIT, JOB_RUN_LIST_MAX, jobRunListLimit, JOB_STEP_REUSED, SYSTEM_DOOR_WAIT, JOB_DEFER_MS, JOB_RUN_DUE_AT, assertQueueSafe, jobRunOf, runDueJobRuns, runJobPass, startJobRun, } from './job-run.js';
+export type { JobDueKey, JobDriveReport, JobHandler, JobPassContext, JobPassOutcome, JobPassResult, JobRun, JobRegistration, JobRunClaim, JobRunFilter, JobRunKey, JobRunPatch, JobRunRow, JobRunStatus, JobRunStore, JobStepRow, StartJobRunInput, } from './job-run.js';
 export { 
 /** @deprecated Import from `@substrat-run/control-plane-api` (#1978); this kernel export goes in a later release. */
 isTerminalDispatchFailure, 
@@ -171,6 +178,9 @@ export {
 invocationLevelOf, 
 /** @deprecated Import from `@substrat-run/contracts` (#1978); this kernel export goes in a later release. */
 type InvocationLevel, } from '@substrat-run/contracts/invocation-record';
-export { VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, OUTBOX_MARK_SQL, emittedSinceQuery, emittedReportOf, moveImportCursor, importCursorSourceOf, exportedSinceQuery, exportReadQuery, exportReadPlan, exportsOf, planExportBatch, withheldNote, CrossVerticalRegistry, type ExportRow, type RegisteredImport, } from './vertical-events.js';
-export { attributedHost } from './attribution.js';
+export { VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, emptyImportResult, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, OUTBOX_MARK_SQL, emittedSinceQuery, emittedReportOf, moveImportCursor, importCursorSourceOf, exportedSinceQuery, exportReadQuery, exportReadPlan, exportsOf, planExportBatch, withheldNote, CrossVerticalRegistry, type ExportRow, type RegisteredImport, } from './vertical-events.js';
+export { attributedHost, attributedView, type ConsumerDelivery, type HostAttribution } from './attribution.js';
+export { isDeliveryRefusal, refuseDelivery, refusalJournalText, REFUSAL_JOURNAL_PREFIX, type DeliveryRefusal, } from './delivery-refusal.js';
+export { MEMBER_ADD_REQUESTED, MEMBER_REMOVE_REQUESTED, MEMBERSHIP_EXECUTOR_ID, MEMBERSHIP_REMOVAL_SKEW_MS, membershipEntity, membershipRemoveExecutorId, memberRemoveRequestedPayload, registerMembershipExecutor, type MemberRemoveRequestedPayload, type MembershipExecutorOptions, } from './membership-executor.js';
+export { membershipFencesBackfillSql, MEMBERSHIP_FENCES_DDL, MEMBERSHIP_FENCES_TABLE, MEMBERSHIP_FENCE_SINCE_SQL, RAISE_MEMBERSHIP_FENCE_SQL, membershipFencesTableExists, } from './membership-fence.js';
 //# sourceMappingURL=index.d.ts.map