@substrat-run/kernel 0.138.0 → 0.140.0

package/dist/membership-executor.js

@@ -2,53 +2,6 @@ import { instant, orgId, principalId, z, } from '@substrat-run/contracts';
 import { isUnknownRoleError } from './permission-checker.js';
 import { refuseDelivery } from './delivery-refusal.js';
 import {} from './scope-host.js';
-/**
- * The membership executor (K-22 §4.2, membership.md §4.2; #1184) — the out-of-band half of
- * joining and leaving, written once so a host mounts it instead of hand-rolling the effect.
- *
- * Module code asks in its own transaction and this effects after commit, through `HostAdmin`:
- * an invite engine's accept emits `member.add-requested`; a vertical's removal emits
- * `member.remove-requested`. A rolled-back operation leaves no event and nothing to effect.
- * Both are driven inline by the emitting call, with the outbox and `_substrat_deliveries` as
- * the retry backstop, so the common case completes inside the request.
- *
- * **What it effects: a tenant-level role, and nothing else.** An add assigns the invited role
- * at the tenant node; a removal unassigns it. Neither joins nor leaves an org, although both
- * payloads name one (the invites engine keys its invitations by org): what an org confers
- * includes grants in each scope's own store, which no directory unit can bound, so making
- * someone a member of an org is authority this seam does not carry.
- *
- * **Authority.** Every payload field is module-written, so none of them is authority.
- *
- * - An ADD is bounded by the inviter: the kernel-stamped `actor` of the invitation's own
- *   `invites.sent` event, asked through the K-21 set comparison at the tenant node. Asked
- *   twice: early, to refuse cheaply, and again inside the directory unit that writes the role
- *   (`applyMembership`), so a demotion, a grant lost or a role widened in between is not
- *   written past. The joiner is the request's own actor, who must have made the invitation's
- *   first acceptance, and the request must be the first one naming that invitation: one
- *   invitation, one join. The most a module can do is make the principal who actually invoked
- *   it look like the sender — the same delegation bound `ctx.grant` has.
- * - A REMOVE is bounded by the remover, the request's own actor (§5.1: removal takes the
- *   same bound, or a junior admin could strip a role they could not have granted) — asked the
- *   same two ways, so a remover demoted in between removes nobody.
- *
- * **Removal wins.** An add is refused when the joiner was removed after it was requested: by a
- * later `member.remove-requested` on the same membership (ordered by outbox id), or by any
- * tenant-level removal at all — staff's included, and a no-op one — which raises the person's
- * removal fence in the directory unit that revokes. The add's own unit reads the fence, and a
- * fence at or after `occurredAt - MEMBERSHIP_REMOVAL_SKEW_MS` refuses it.
- *
- * A refusal is terminal (`refuseDelivery`): journaled with its reason, never retried, listed
- * by `executorDeadLetters`, and reported to the emitting call through `onExecutorOutcomes`.
- *
- * **The trail.** Admin rows are written by `actor`, the platform identity that executed them,
- * `onBehalfOf` (#977) the person whose authority bounded them, and with `causedBy` = the event
- * id: the correlation id that joins the scope's half of the trail to the directory's. A
- * removal that took nothing writes no row (K-21), but still raises the fence.
- *
- * **Idempotent.** A delivered event never reaches its handler again. A crash between the
- * effect and its journal row re-runs the handler, and every write it makes is idempotent.
- */
 /** What the add path consumes, and the version it reads. */
 export const MEMBER_ADD_REQUESTED = 'member.add-requested';
 /** What the remove path consumes, and the version it reads. */
@@ -96,39 +49,57 @@ export function registerMembershipExecutor(host, options) {
             'spans the directory and a scope store. A scope role has assignScopeRoleBounded.');
     }
     const id = options.id ?? MEMBERSHIP_EXECUTOR_ID;
+    const removeId = membershipRemoveExecutorId(id);
+    // The org a request names rides along only on a mount that joins orgs (#2047).
+    const orgOf = (request) => (options.orgs === 'join' ? { orgId: request.orgId } : {});
     // Attributed (#977): the person whose authority bounded the write, beside the platform
-    // actor that executed it. `causedBy` is stamped by the host.
-    const adminFor = (who, event) => (host.attributed?.({ principal: who, tenantId: event.tenantId }) ?? host).admin;
-    host.registerExecutor(id, MEMBER_ADD_REQUESTED, async (_admin, event, scope) => {
+    // actor that executed it — added to the `admin` the dispatch handed the handler, which
+    // already carries the event (#2069). A host built before `HostAdmin.attributed` (an adapter
+    // at 0.139) hands an admin without it but has the deprecated `host.attributed(…, { causedBy })`,
+    // so that form is the fallback, and is why it is kept. A host with neither predates #977 and
+    // records no person on any row; that is said aloud rather than lost quietly.
+    // `executorId` is the id the calling path is registered under, so a warning names that path.
+    const adminFor = (executorId, admin, who, event) => {
+        const onBehalfOf = { principal: who, tenantId: event.tenantId };
+        if (admin.attributed)
+            return admin.attributed(onBehalfOf);
+        if (host.attributed)
+            return host.attributed(onBehalfOf, { causedBy: event.id }).admin;
+        console.warn(`executor:${executorId}: this host cannot attribute an admin to a person; ${event.id}'s rows name no onBehalfOf`);
+        return admin;
+    };
+    host.registerExecutor(id, MEMBER_ADD_REQUESTED, async (admin, event, scope) => {
         const decided = await authorizeAdd(event, scope);
         if ('refused' in decided)
             return decided.refused;
         const { request, inviter } = decided;
         // One directory unit: the fence, the bound asked again, the role and its audit row. A
         // removal or a change of authority lands wholly before it or wholly after it.
-        const applied = await adminFor(inviter, event).applyMembership(options.actor, {
+        const applied = await adminFor(id, admin, inviter, event).applyMembership(options.actor, {
             op: 'add',
             tenantId: event.tenantId,
             principal: request.principal,
             roleKey: request.roleKey,
             boundedBy: inviter,
+            ...orgOf(request),
             unlessRemovedSince: instant.parse(new Date(Date.parse(event.occurredAt) - MEMBERSHIP_REMOVAL_SKEW_MS).toISOString()),
         });
         return applied.applied ? undefined : refusalOf(applied, request, 'inviter', inviter);
     }, options.retry);
-    host.registerExecutor(membershipRemoveExecutorId(id), MEMBER_REMOVE_REQUESTED, async (_admin, event, scope) => {
+    host.registerExecutor(removeId, MEMBER_REMOVE_REQUESTED, async (admin, event, scope) => {
         const decided = await authorizeRemove(event, scope);
         if ('refused' in decided)
             return decided.refused;
         const { request, remover } = decided;
         // One directory unit: the remover's bound asked again, the revoke, its audit row if it
         // took anything, and the fence — raised even with nothing held, so a pending add sees it.
-        const applied = await adminFor(remover, event).applyMembership(options.actor, {
+        const applied = await adminFor(removeId, admin, remover, event).applyMembership(options.actor, {
             op: 'remove',
             tenantId: event.tenantId,
             principal: request.principal,
             roleKey: request.roleKey,
             boundedBy: remover,
+            ...orgOf(request),
         });
         return applied.applied ? undefined : refusalOf(applied, request, 'remover', remover);
     }, options.retry);
@@ -139,6 +110,10 @@ function refusalOf(result, request, as, who) {
         return refuseDelivery(`${request.principal} was removed after this request was made`);
     if ('unknownRole' in result)
         return refuseDelivery(`no such role in this tenant: ${result.unknownRole}`);
+    if ('unknownOrg' in result)
+        return refuseDelivery(`no such org in this tenant: ${result.unknownOrg}`);
+    if ('notMember' in result)
+        return refuseDelivery(`the ${as} ${who} is not a member of org ${result.notMember}`);
     return refuseDelivery(`the ${as} ${who} no longer holds ${result.missing.join(', ')}, which '${request.roleKey}' confers`);
 }
 const refused = (reason) => ({ refused: refuseDelivery(reason) });

package/dist/membership-executor.js.map

@@ -1 +1 @@
-{"version":3,"file":"membership-executor.js","sourceRoot":"","sources":["../src/membership-executor.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,OAAO,EACP,KAAK,EACL,WAAW,EACX,CAAC,GAMF,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAwB,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EAMN,MAAM,iBAAiB,CAAC;AAEzB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,4DAA4D;AAC5D,MAAM,CAAC,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AAC3D,+DAA+D;AAC/D,MAAM,CAAC,MAAM,uBAAuB,GAAG,yBAAyB,CAAC;AAEjE,oGAAoG;AACpG,MAAM,CAAC,MAAM,sBAAsB,GAAG,YAAY,CAAC;AACnD,wEAAwE;AACxE,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,EAAE,GAAW,sBAAsB,EAAU,EAAE,CAAC,GAAG,EAAE,SAAS,CAAC;AAE1G,+FAA+F;AAC/F,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,SAAiB,EAAa,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;AAEtH,6EAA6E;AAC7E,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,SAAS,EAAE,WAAW;IACtB,KAAK;IACL,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAChC,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,SAAS,EAAE,WAAW;IACtB,KAAK;IACL,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3B,CAAC,CAAC;AAGH,iFAAiF;AACjF,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC7E,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAkB1D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,GAAG,MAAM,CAAC;AAErD,8FAA8F;AAC9F,MAAM,UAAU,0BAA0B,CAAC,IAAe,EAAE,OAAkC;IAC5F,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CACb,4DAA4D,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,0BAA0B;YACzG,iFAAiF,CACpF,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,sBAAsB,CAAC;IAChD,uFAAuF;IACvF,6DAA6D;IAC7D,MAAM,QAAQ,GAAG,CAAC,GAAgB,EAAE,KAAkB,EAAa,EAAE,CACnE,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC;IAElF,IAAI,CAAC,gBAAgB,CACnB,EAAE,EACF,oBAAoB,EACpB,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QAC7B,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACjD,IAAI,SAAS,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC;QACjD,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QACrC,sFAAsF;QACtF,8EAA8E;QAC9E,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE;YAC5E,EAAE,EAAE,KAAK;YACT,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,SAAS,EAAE,OAAO;YAClB,kBAAkB,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,0BAA0B,CAAC,CAAC,WAAW,EAAE,CAAC;SACrH,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACvF,CAAC,EACD,OAAO,CAAC,KAAK,CACd,CAAC;IAEF,IAAI,CAAC,gBAAgB,CACnB,0BAA0B,CAAC,EAAE,CAAC,EAC9B,uBAAuB,EACvB,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QAC7B,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACpD,IAAI,SAAS,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC;QACjD,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QACrC,uFAAuF;QACvF,0FAA0F;QAC1F,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE;YAC5E,EAAE,EAAE,QAAQ;YACZ,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,SAAS,EAAE,OAAO;SACnB,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACvF,CAAC,EACD,OAAO,CAAC,KAAK,CACd,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,SAAS,SAAS,CAChB,MAA0D,EAC1D,OAAoD,EACpD,EAAyB,EACzB,GAAgB;IAEhB,IAAI,WAAW,IAAI,MAAM;QAAE,OAAO,cAAc,CAAC,GAAG,OAAO,CAAC,SAAS,0CAA0C,CAAC,CAAC;IACjH,IAAI,aAAa,IAAI,MAAM;QAAE,OAAO,cAAc,CAAC,gCAAgC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;IACzG,OAAO,cAAc,CAAC,OAAO,EAAE,IAAI,GAAG,oBAAoB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,OAAO,CAAC,OAAO,WAAW,CAAC,CAAC;AAC7H,CAAC;AAGD,MAAM,OAAO,GAAG,CAAC,MAAc,EAAW,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAEnF,2FAA2F;AAC3F,SAAS,SAAS,CAChB,KAAkB,EAClB,MAAoB;IAEpB,IAAI,KAAK,CAAC,aAAa,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC,eAAe,KAAK,CAAC,IAAI,kBAAkB,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC;IAChH,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC,aAAa,KAAK,CAAC,IAAI,UAAU,CAAC,CAAC;IACvE,+EAA+E;IAC/E,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;QAAE,OAAO,OAAO,CAAC,+CAA+C,CAAC,CAAC;IAC7G,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AAClC,CAAC;AAED,uGAAuG;AACvG,KAAK,UAAU,OAAO,CACpB,KAAoB,EACpB,GAAgB,EAChB,OAAe,EACf,EAAyB;IAEzB,wEAAwE;IACxE,IAAI,OAAkE,CAAC;IACvE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QACzD,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IAC9E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,OAAO,CAAC;YAAE,MAAM,GAAG,CAAC;QACjD,OAAO,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;IACrD,CAAC;IACD,OAAO,OAAO,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC;AAC1F,CAAC;AAED,0EAA0E;AAC1E,KAAK,UAAU,YAAY,CACzB,KAAkB,EAClB,KAAoB;IAEpB,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;IACpD,IAAI,SAAS,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IACvC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;IAC3B,wFAAwF;IACxF,IAAI,KAAK,CAAC,KAAK,KAAK,OAAO,CAAC,SAAS;QAAE,OAAO,OAAO,CAAC,+DAA+D,CAAC,CAAC;IAEvH,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IACtG,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC;IAC9D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC,cAAc,OAAO,CAAC,YAAY,4CAA4C,CAAC,CAAC;IACtH,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;IACtB,MAAM,SAAS,GAAG,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1D,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC;QAC/G,OAAO,OAAO,CAAC,yCAAyC,OAAO,CAAC,YAAY,iBAAiB,CAAC,CAAC;IACjG,CAAC;IACD,sFAAsF;IACtF,6EAA6E;IAC7E,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,kBAAkB,CAAC,CAAC;IACjE,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzE,IAAI,CAAC,UAAU,EAAE,OAAO,IAAI,KAAM,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC;QAC5G,OAAO,OAAO,CAAC,cAAc,OAAO,CAAC,YAAY,8BAA8B,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IACtG,CAAC;IACD,MAAM,OAAO,GAAG,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClD,IAAI,CAAC,OAAO,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC,cAAc,OAAO,CAAC,YAAY,8BAA8B,CAAC,CAAC;IAEvG,oFAAoF;IACpF,2FAA2F;IAC3F,0FAA0F;IAC1F,6EAA6E;IAC7E,IAAI,KAAM,CAAC,EAAE,GAAG,KAAK,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,mCAAmC,OAAO,CAAC,YAAY,eAAe,CAAC,CAAC;IACjH,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IAChF,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAC7B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,oBAAoB,IAAI,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,EAAE,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,YAAY,CACtG,CAAC;IACF,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC,cAAc,OAAO,CAAC,YAAY,iCAAiC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;IAE7G,0FAA0F;IAC1F,wEAAwE;IACxE,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,uBAAuB,IAAI,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;QAClF,OAAO,OAAO,CAAC,GAAG,OAAO,CAAC,SAAS,0CAA0C,CAAC,CAAC;IACjF,CAAC;IACD,kFAAkF;IAClF,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC7E,OAAO,KAAK,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;AACrD,CAAC;AAED,6EAA6E;AAC7E,KAAK,UAAU,eAAe,CAC5B,KAAkB,EAClB,KAAoB;IAEpB,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,4BAA4B,CAAC,CAAC;IAC9D,IAAI,SAAS,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IACvC,MAAM,OAAO,GAAG,WAAW,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACnD,IAAI,CAAC,OAAO,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC,8CAA8C,CAAC,CAAC;IACrF,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACpF,OAAO,KAAK,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;AACrE,CAAC;AAED,sFAAsF;AACtF,SAAS,YAAY,CAAC,KAAmB;IACvC,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3D,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/D,CAAC;AAED,4FAA4F;AAC5F,KAAK,UAAU,UAAU,CAAC,KAAoB,EAAE,MAAiB;IAC/D,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,IAAI,MAA0B,CAAC;IAC/B,GAAG,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACrD,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9B,MAAM,GAAG,IAAI,CAAC,UAAU,IAAI,SAAS,CAAC;IACxC,CAAC,QAAQ,MAAM,EAAE;IACjB,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"membership-executor.js","sourceRoot":"","sources":["../src/membership-executor.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,OAAO,EACP,KAAK,EACL,WAAW,EACX,CAAC,GAOF,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAwB,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EAMN,MAAM,iBAAiB,CAAC;AA2DzB,4DAA4D;AAC5D,MAAM,CAAC,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AAC3D,+DAA+D;AAC/D,MAAM,CAAC,MAAM,uBAAuB,GAAG,yBAAyB,CAAC;AAEjE,oGAAoG;AACpG,MAAM,CAAC,MAAM,sBAAsB,GAAG,YAAY,CAAC;AACnD,wEAAwE;AACxE,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,EAAE,GAAW,sBAAsB,EAAU,EAAE,CAAC,GAAG,EAAE,SAAS,CAAC;AAE1G,+FAA+F;AAC/F,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,SAAiB,EAAa,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;AAEtH,6EAA6E;AAC7E,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,SAAS,EAAE,WAAW;IACtB,KAAK;IACL,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAChC,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,SAAS,EAAE,WAAW;IACtB,KAAK;IACL,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3B,CAAC,CAAC;AAGH,iFAAiF;AACjF,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC7E,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAyB1D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,GAAG,MAAM,CAAC;AAErD,8FAA8F;AAC9F,MAAM,UAAU,0BAA0B,CAAC,IAAe,EAAE,OAAkC;IAC5F,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CACb,4DAA4D,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,0BAA0B;YACzG,iFAAiF,CACpF,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,sBAAsB,CAAC;IAChD,MAAM,QAAQ,GAAG,0BAA0B,CAAC,EAAE,CAAC,CAAC;IAChD,+EAA+E;IAC/E,MAAM,KAAK,GAAG,CAAC,OAAyB,EAAqB,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1H,uFAAuF;IACvF,uFAAuF;IACvF,4FAA4F;IAC5F,iGAAiG;IACjG,6FAA6F;IAC7F,6EAA6E;IAC7E,6FAA6F;IAC7F,MAAM,QAAQ,GAAG,CAAC,UAAkB,EAAE,KAAgB,EAAE,GAAgB,EAAE,KAAkB,EAAa,EAAE;QACzG,MAAM,UAAU,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;QAChE,IAAI,KAAK,CAAC,UAAU;YAAE,OAAO,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAC1D,IAAI,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC;QACtF,OAAO,CAAC,IAAI,CAAC,YAAY,UAAU,sDAAsD,KAAK,CAAC,EAAE,4BAA4B,CAAC,CAAC;QAC/H,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,IAAI,CAAC,gBAAgB,CACnB,EAAE,EACF,oBAAoB,EACpB,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACjD,IAAI,SAAS,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC;QACjD,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QACrC,sFAAsF;QACtF,8EAA8E;QAC9E,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE;YACvF,EAAE,EAAE,KAAK;YACT,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,SAAS,EAAE,OAAO;YAClB,GAAG,KAAK,CAAC,OAAO,CAAC;YACjB,kBAAkB,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,0BAA0B,CAAC,CAAC,WAAW,EAAE,CAAC;SACrH,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACvF,CAAC,EACD,OAAO,CAAC,KAAK,CACd,CAAC;IAEF,IAAI,CAAC,gBAAgB,CACnB,QAAQ,EACR,uBAAuB,EACvB,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACpD,IAAI,SAAS,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC;QACjD,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QACrC,uFAAuF;QACvF,0FAA0F;QAC1F,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE;YAC7F,EAAE,EAAE,QAAQ;YACZ,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,SAAS,EAAE,OAAO;YAClB,GAAG,KAAK,CAAC,OAAO,CAAC;SAClB,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACvF,CAAC,EACD,OAAO,CAAC,KAAK,CACd,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,SAAS,SAAS,CAChB,MAA0D,EAC1D,OAAoD,EACpD,EAAyB,EACzB,GAAgB;IAEhB,IAAI,WAAW,IAAI,MAAM;QAAE,OAAO,cAAc,CAAC,GAAG,OAAO,CAAC,SAAS,0CAA0C,CAAC,CAAC;IACjH,IAAI,aAAa,IAAI,MAAM;QAAE,OAAO,cAAc,CAAC,gCAAgC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;IACzG,IAAI,YAAY,IAAI,MAAM;QAAE,OAAO,cAAc,CAAC,+BAA+B,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IACtG,IAAI,WAAW,IAAI,MAAM;QAAE,OAAO,cAAc,CAAC,OAAO,EAAE,IAAI,GAAG,2BAA2B,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IAChH,OAAO,cAAc,CAAC,OAAO,EAAE,IAAI,GAAG,oBAAoB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,OAAO,CAAC,OAAO,WAAW,CAAC,CAAC;AAC7H,CAAC;AAGD,MAAM,OAAO,GAAG,CAAC,MAAc,EAAW,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAEnF,2FAA2F;AAC3F,SAAS,SAAS,CAChB,KAAkB,EAClB,MAAoB;IAEpB,IAAI,KAAK,CAAC,aAAa,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC,eAAe,KAAK,CAAC,IAAI,kBAAkB,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC;IAChH,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC,aAAa,KAAK,CAAC,IAAI,UAAU,CAAC,CAAC;IACvE,+EAA+E;IAC/E,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;QAAE,OAAO,OAAO,CAAC,+CAA+C,CAAC,CAAC;IAC7G,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AAClC,CAAC;AAED,uGAAuG;AACvG,KAAK,UAAU,OAAO,CACpB,KAAoB,EACpB,GAAgB,EAChB,OAAe,EACf,EAAyB;IAEzB,wEAAwE;IACxE,IAAI,OAAkE,CAAC;IACvE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QACzD,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IAC9E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,OAAO,CAAC;YAAE,MAAM,GAAG,CAAC;QACjD,OAAO,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;IACrD,CAAC;IACD,OAAO,OAAO,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC;AAC1F,CAAC;AAED,0EAA0E;AAC1E,KAAK,UAAU,YAAY,CACzB,KAAkB,EAClB,KAAoB;IAEpB,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;IACpD,IAAI,SAAS,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IACvC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;IAC3B,wFAAwF;IACxF,IAAI,KAAK,CAAC,KAAK,KAAK,OAAO,CAAC,SAAS;QAAE,OAAO,OAAO,CAAC,+DAA+D,CAAC,CAAC;IAEvH,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IACtG,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC;IAC9D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC,cAAc,OAAO,CAAC,YAAY,4CAA4C,CAAC,CAAC;IACtH,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;IACtB,MAAM,SAAS,GAAG,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1D,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC;QAC/G,OAAO,OAAO,CAAC,yCAAyC,OAAO,CAAC,YAAY,iBAAiB,CAAC,CAAC;IACjG,CAAC;IACD,sFAAsF;IACtF,6EAA6E;IAC7E,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,kBAAkB,CAAC,CAAC;IACjE,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzE,IAAI,CAAC,UAAU,EAAE,OAAO,IAAI,KAAM,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC;QAC5G,OAAO,OAAO,CAAC,cAAc,OAAO,CAAC,YAAY,8BAA8B,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IACtG,CAAC;IACD,MAAM,OAAO,GAAG,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClD,IAAI,CAAC,OAAO,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC,cAAc,OAAO,CAAC,YAAY,8BAA8B,CAAC,CAAC;IAEvG,oFAAoF;IACpF,2FAA2F;IAC3F,0FAA0F;IAC1F,6EAA6E;IAC7E,IAAI,KAAM,CAAC,EAAE,GAAG,KAAK,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,mCAAmC,OAAO,CAAC,YAAY,eAAe,CAAC,CAAC;IACjH,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IAChF,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAC7B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,oBAAoB,IAAI,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,EAAE,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,YAAY,CACtG,CAAC;IACF,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC,cAAc,OAAO,CAAC,YAAY,iCAAiC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;IAE7G,0FAA0F;IAC1F,wEAAwE;IACxE,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,uBAAuB,IAAI,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;QAClF,OAAO,OAAO,CAAC,GAAG,OAAO,CAAC,SAAS,0CAA0C,CAAC,CAAC;IACjF,CAAC;IACD,kFAAkF;IAClF,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC7E,OAAO,KAAK,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;AACrD,CAAC;AAED,6EAA6E;AAC7E,KAAK,UAAU,eAAe,CAC5B,KAAkB,EAClB,KAAoB;IAEpB,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,4BAA4B,CAAC,CAAC;IAC9D,IAAI,SAAS,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IACvC,MAAM,OAAO,GAAG,WAAW,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACnD,IAAI,CAAC,OAAO,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC,8CAA8C,CAAC,CAAC;IACrF,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACpF,OAAO,KAAK,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;AACrE,CAAC;AAED,sFAAsF;AACtF,SAAS,YAAY,CAAC,KAAmB;IACvC,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3D,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/D,CAAC;AAED,4FAA4F;AAC5F,KAAK,UAAU,UAAU,CAAC,KAAoB,EAAE,MAAiB;IAC/D,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,IAAI,MAA0B,CAAC;IAC/B,GAAG,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACrD,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9B,MAAM,GAAG,IAAI,CAAC,UAAU,IAAI,SAAS,CAAC;IACxC,CAAC,QAAQ,MAAM,EAAE;IACjB,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/migration-digest.d.ts

@@ -0,0 +1,161 @@
+import { moduleMigrations } from './module-migrations.js';
+import { type SqlMigration } from './scope-host.js';
+/**
+ * What a scope's migration journal records beside each version, and the check that reads it
+ * (#2066). Shared by both adapters, so the rule and the sentence an operator reads are one.
+ *
+ * A scope used to record an applied migration by `(module_id, version)` alone, so a later
+ * `0025` whose SQL differed from the `0025` it ran was skipped as already applied: a dev
+ * database that ran one branch's `0025` and then `main`'s, or a preview that ran an unmerged
+ * branch, kept whichever schema it got first, and the first sign was a query failing against
+ * a column that was not there. `_substrat_migrations.sql_digest` closes that.
+ *
+ * - **The digest is SHA-256 over the exact SQL text**, lowercase hex, with no normalisation:
+ *   not whitespace, not comments, not line endings. Any change is a different migration. A
+ *   shipped migration's text never changes on `main` (`lint:migrations --check` refuses the
+ *   edit upstream), so a difference at a scope means the scope ran something else.
+ * - **Only a module's AUTHORED migrations are held to it.** The kernel-derived DDL
+ *   (`search/…`, `state/…`, `list/…`, see `moduleMigrations`) is versioned by its
+ *   declaration on purpose: the version names what decides the DDL, so the kernel may change
+ *   how it spells the same declaration between releases. Holding those rows to a digest would
+ *   fail every scope with a searchable entity closed on the kernel upgrade that respelled a
+ *   trigger. Their digest is still recorded, as the fact of what ran.
+ * - **A row applied before the column carries `'legacy'`, and is accepted.** Nobody measured
+ *   what it ran, so it gets no digest: backfilling the registered one would write a value
+ *   nobody measured, and bless the one row this exists to catch if that scope did run
+ *   something else. The mark is explicit rather than a NULL, because a NULL cannot say where it
+ *   came from: the rows present when the column arrives are marked (`MIGRATION_DIGEST_MARK_LEGACY`),
+ *   a dump taken before the column restores as `'legacy'` (the restore derives it), and from
+ *   then on the fence below refuses a NULL however it is written. So `'legacy'` is provenance,
+ *   and a NULL — say a dump edited to clear a digest — is refused rather than trusted. Such a
+ *   row is unprotected for good, which is the price of not lying in the journal.
+ */
+export declare function migrationDigest(sql: string): Promise<string>;
+/** What a journal row applied before digests were recorded carries in `sql_digest` (#2066). */
+export declare const MIGRATION_DIGEST_LEGACY = "legacy";
+/**
+ * Marks the rows present when the column arrived. Run right after the column's ALTER on every
+ * wake: once the fence is in place it can only ever find those rows, since nothing else can
+ * leave a NULL. Literal text, like the fence, so `lint:spine-ddl` and a reviewer read one spelling.
+ */
+export declare const MIGRATION_DIGEST_MARK_LEGACY = "UPDATE _substrat_migrations SET sql_digest = 'legacy' WHERE sql_digest IS NULL";
+/**
+ * The fence: no journal row is written, or rewritten, without a digest or the legacy mark — in
+ * both adapters' KERNEL_DDL, after the journal table, so `lint:spine-ddl` holds it like any
+ * spine trigger.
+ *
+ * Without it an older writer (an instance still on the previous release during a rollout or a
+ * rollback, or a second process over the same SQLite file) inserts a row that omits the
+ * column, and SQLite records NULL. With it that INSERT aborts, so the older writer's migration
+ * fails and its scope fails closed until code that records the digest serves it, which then
+ * applies the migration properly. KERNEL_DDL runs before the column is ALTERed onto a legacy
+ * journal, and on a table without the column the INSERT trigger makes any INSERT fail with
+ * `no such column`: there is no window in which a NULL can be written. A restore loads its
+ * rows under the fence too, so a dump that carries a NULL is refused (`spineRowsInsert` gives a
+ * dump from before the column the legacy mark instead).
+ *
+ * Migration SQL cannot drop it: `assertNoJournalSql` refuses any migration naming the journal.
+ * Literal text, no interpolation: `lint:spine-ddl` inlines a kernel fragment one level deep.
+ */
+export declare const MIGRATION_DIGEST_FENCE_DDL = "\n  CREATE TRIGGER IF NOT EXISTS _substrat_migrations_digest_required\n  BEFORE INSERT ON _substrat_migrations WHEN NEW.sql_digest IS NULL\n  BEGIN\n    SELECT RAISE(ABORT, 'a migration journal row must carry its sql_digest (#2066)');\n  END;\n  CREATE TRIGGER IF NOT EXISTS _substrat_migrations_digest_kept\n  BEFORE UPDATE OF sql_digest ON _substrat_migrations WHEN NEW.sql_digest IS NULL\n  BEGIN\n    SELECT RAISE(ABORT, 'a migration journal row must carry its sql_digest (#2066)');\n  END;\n";
+/**
+ * Refuse migration SQL that names the migration journal (`_substrat_migration…`: the table, its
+ * fence, the DO's bookmarks), in any spelling the grammar allows — quoted, any case, schema-
+ * qualified — before any of it runs.
+ *
+ * A migration runs on the kernel's own handle, not `ctx.sql`, so the spine write guard never
+ * sees it, and an authored migration that repairs `_substrat_tuples` is a reviewed, linted path
+ * (`boundary-lint-allow R4 migration`). The journal is different: a migration that drops the
+ * fence, or writes its own journal rows, makes the digest check say whatever it wrote. Nothing
+ * legitimate in a module's migration names it, reads included.
+ */
+export declare function assertNoJournalSql(sql: string, what: string): void;
+/**
+ * Refuse a migration's SQL before any of it runs, if it reaches where a migration must not.
+ *
+ * A migration runs on the kernel's own handle, not `ctx.sql`, so `ctx.sql`'s guard never sees it.
+ * Every migration is held to: no foreign key to the spine (#1898), and nothing that names the
+ * journal (`assertNoJournalSql`). An AUTHORED one is also held to the full spine write guard —
+ * no write, DDL or same-named TEMP object on any `_substrat_*` table — unless it is one of the
+ * exact reviewed texts above. Kernel-derived DDL is exempt from that last rule: creating
+ * `_substrat_*` indexes and triggers is what it is for.
+ */
+export declare function assertMigrationSql(sql: string, step: {
+    key: string;
+    digest: string;
+    authored: boolean;
+}): void;
+/**
+ * Refuse a dump whose journal is not consistent with its own shape (#2066 r3): a table whose
+ * recorded DDL declares `sql_digest` while its columns omit it, or the other way round.
+ *
+ * A dump exported before digests were recorded restores as `'legacy'` (`spineRowsInsert`), so
+ * the shape of the journal is what says which kind of dump this is — and a current dump with
+ * the column stripped would otherwise pass as legacy and unprotect every row. The dump's DDL is
+ * `sqlite_master`'s text, which an ALTER rewrites, so a real pre-#2066 journal carries neither.
+ * Nothing else a dump carries changed with #2066 to cross-check against (the fence is a trigger,
+ * and a dump holds tables). A dump is freely editable data: a consistent edit of both is not
+ * detectable, and restore is privileged, audited staff work that could forge any digest anyway.
+ * This catches corruption and partial edits, not an author set on lying.
+ */
+export declare function assertJournalDumpCoherent(tables: readonly {
+    name: string;
+    ddl: string;
+    columns: readonly string[];
+}[]): void;
+/** One migration a host applies, with its digest and whether it is held to it. */
+export interface MigrationStep {
+    migration: SqlMigration;
+    digest: string;
+    /** Authored by the module, so held to its digest; false for kernel-derived DDL. */
+    authored: boolean;
+}
+/**
+ * A module's migrations in the order the host applies them (`moduleMigrations`), each with its
+ * digest and whether it is authored — read from the registration as it is now. The digest of a
+ * text is computed once per isolate, so a Durable Object that wakes with the same code hashes
+ * nothing again.
+ */
+export declare function migrationSteps(registration: Parameters<typeof moduleMigrations>[0]): Promise<readonly MigrationStep[]>;
+/** A step a migration pass still has to run, with the module it belongs to. */
+export interface PendingMigration extends MigrationStep {
+    moduleId: string;
+}
+/** What a migration pass has to do, or the divergence that fails the scope closed instead. */
+export type MigrationPlan = {
+    pending: PendingMigration[];
+    diverged?: undefined;
+} | {
+    pending: [];
+    diverged: {
+        version: string;
+        error: string;
+    };
+};
+/**
+ * Plan a scope's migration pass against its journal (`module@version` → recorded digest): the
+ * registered steps it has not applied, or the first applied one whose SQL differs, which fails
+ * the scope closed before anything else runs. Both adapters plan through this.
+ */
+export declare function planMigrations(modules: Iterable<{
+    readonly id: string;
+    readonly steps: Promise<readonly MigrationStep[]>;
+}>, applied: ReadonlyMap<string, string | null>): Promise<MigrationPlan>;
+/** The error a scope fails closed with when `module@version` cannot be applied or trusted. */
+export declare function migrationFailedError(key: string, cause: string): Error;
+/**
+ * Why a registered migration the scope has already applied cannot be trusted, or null when it
+ * can: on an authored migration, a recorded digest that differs from the registered one, or
+ * no digest and no legacy mark at all.
+ *
+ * The caller fails the scope closed with this as the cause, the way a migration that threw
+ * does — the same `migration failed for <module>@<version> — scope fails closed:` record, so
+ * the directory, the sweep and the dashboard read it with nothing new. The scope recovers
+ * when its journal and its schema agree with the deployment again: a scope that ran another
+ * branch's migration is rebuilt (a dev database, a preview) or restored to a dump taken before
+ * it ran; a deployment carrying the wrong SQL is redeployed with the SQL the scope ran. A
+ * migration is never edited or renumbered once a scope has it, so re-numbering is not a
+ * recovery: the scope would still hold the other SQL under this version.
+ */
+export declare function migrationDivergence(recorded: string | null | undefined, registered: string, authored: boolean): string | null;
+//# sourceMappingURL=migration-digest.d.ts.map

package/dist/migration-digest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-digest.d.ts","sourceRoot":"","sources":["../src/migration-digest.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,EAAoB,KAAK,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAKtE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE5D;AAED,+FAA+F;AAC/F,eAAO,MAAM,uBAAuB,WAAW,CAAC;AAEhD;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,mFAAmF,CAAC;AAE7H;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,0BAA0B,qfAWtC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CASlE;AAiBD;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CAY9G;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,SAAS;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,EAAE,GAAG,IAAI,CAY5H;AAED,kFAAkF;AAClF,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,YAAY,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,mFAAmF;IACnF,QAAQ,EAAE,OAAO,CAAC;CACnB;AAcD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,YAAY,EAAE,UAAU,CAAC,OAAO,gBAAgB,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,SAAS,aAAa,EAAE,CAAC,CAStH;AAED,+EAA+E;AAC/E,MAAM,WAAW,gBAAiB,SAAQ,aAAa;IACrD,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,8FAA8F;AAC9F,MAAM,MAAM,aAAa,GACrB;IAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAAC,QAAQ,CAAC,EAAE,SAAS,CAAA;CAAE,GACrD;IAAE,OAAO,EAAE,EAAE,CAAC;IAAC,QAAQ,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAElE;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,QAAQ,CAAC;IAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,aAAa,EAAE,CAAC,CAAA;CAAE,CAAC,EAC7F,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,GAC1C,OAAO,CAAC,aAAa,CAAC,CAcxB;AAED,8FAA8F;AAC9F,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,KAAK,CAEtE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACnC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,OAAO,GAChB,MAAM,GAAG,IAAI,CAgBf"}

package/dist/migration-digest.js

@@ -0,0 +1,237 @@
+import { substratError, tokenizeSql } from '@substrat-run/contracts';
+import { moduleMigrations } from './module-migrations.js';
+import { assertNoSpineReference, assertNoSpineWrite } from './spine-guard.js';
+import { attachmentSha256 } from './scope-host.js';
+/**
+ * What a scope's migration journal records beside each version, and the check that reads it
+ * (#2066). Shared by both adapters, so the rule and the sentence an operator reads are one.
+ *
+ * A scope used to record an applied migration by `(module_id, version)` alone, so a later
+ * `0025` whose SQL differed from the `0025` it ran was skipped as already applied: a dev
+ * database that ran one branch's `0025` and then `main`'s, or a preview that ran an unmerged
+ * branch, kept whichever schema it got first, and the first sign was a query failing against
+ * a column that was not there. `_substrat_migrations.sql_digest` closes that.
+ *
+ * - **The digest is SHA-256 over the exact SQL text**, lowercase hex, with no normalisation:
+ *   not whitespace, not comments, not line endings. Any change is a different migration. A
+ *   shipped migration's text never changes on `main` (`lint:migrations --check` refuses the
+ *   edit upstream), so a difference at a scope means the scope ran something else.
+ * - **Only a module's AUTHORED migrations are held to it.** The kernel-derived DDL
+ *   (`search/…`, `state/…`, `list/…`, see `moduleMigrations`) is versioned by its
+ *   declaration on purpose: the version names what decides the DDL, so the kernel may change
+ *   how it spells the same declaration between releases. Holding those rows to a digest would
+ *   fail every scope with a searchable entity closed on the kernel upgrade that respelled a
+ *   trigger. Their digest is still recorded, as the fact of what ran.
+ * - **A row applied before the column carries `'legacy'`, and is accepted.** Nobody measured
+ *   what it ran, so it gets no digest: backfilling the registered one would write a value
+ *   nobody measured, and bless the one row this exists to catch if that scope did run
+ *   something else. The mark is explicit rather than a NULL, because a NULL cannot say where it
+ *   came from: the rows present when the column arrives are marked (`MIGRATION_DIGEST_MARK_LEGACY`),
+ *   a dump taken before the column restores as `'legacy'` (the restore derives it), and from
+ *   then on the fence below refuses a NULL however it is written. So `'legacy'` is provenance,
+ *   and a NULL — say a dump edited to clear a digest — is refused rather than trusted. Such a
+ *   row is unprotected for good, which is the price of not lying in the journal.
+ */
+export function migrationDigest(sql) {
+    return attachmentSha256(new TextEncoder().encode(sql));
+}
+/** What a journal row applied before digests were recorded carries in `sql_digest` (#2066). */
+export const MIGRATION_DIGEST_LEGACY = 'legacy';
+/**
+ * Marks the rows present when the column arrived. Run right after the column's ALTER on every
+ * wake: once the fence is in place it can only ever find those rows, since nothing else can
+ * leave a NULL. Literal text, like the fence, so `lint:spine-ddl` and a reviewer read one spelling.
+ */
+export const MIGRATION_DIGEST_MARK_LEGACY = "UPDATE _substrat_migrations SET sql_digest = 'legacy' WHERE sql_digest IS NULL";
+/**
+ * The fence: no journal row is written, or rewritten, without a digest or the legacy mark — in
+ * both adapters' KERNEL_DDL, after the journal table, so `lint:spine-ddl` holds it like any
+ * spine trigger.
+ *
+ * Without it an older writer (an instance still on the previous release during a rollout or a
+ * rollback, or a second process over the same SQLite file) inserts a row that omits the
+ * column, and SQLite records NULL. With it that INSERT aborts, so the older writer's migration
+ * fails and its scope fails closed until code that records the digest serves it, which then
+ * applies the migration properly. KERNEL_DDL runs before the column is ALTERed onto a legacy
+ * journal, and on a table without the column the INSERT trigger makes any INSERT fail with
+ * `no such column`: there is no window in which a NULL can be written. A restore loads its
+ * rows under the fence too, so a dump that carries a NULL is refused (`spineRowsInsert` gives a
+ * dump from before the column the legacy mark instead).
+ *
+ * Migration SQL cannot drop it: `assertNoJournalSql` refuses any migration naming the journal.
+ * Literal text, no interpolation: `lint:spine-ddl` inlines a kernel fragment one level deep.
+ */
+export const MIGRATION_DIGEST_FENCE_DDL = `
+  CREATE TRIGGER IF NOT EXISTS _substrat_migrations_digest_required
+  BEFORE INSERT ON _substrat_migrations WHEN NEW.sql_digest IS NULL
+  BEGIN
+    SELECT RAISE(ABORT, 'a migration journal row must carry its sql_digest (#2066)');
+  END;
+  CREATE TRIGGER IF NOT EXISTS _substrat_migrations_digest_kept
+  BEFORE UPDATE OF sql_digest ON _substrat_migrations WHEN NEW.sql_digest IS NULL
+  BEGIN
+    SELECT RAISE(ABORT, 'a migration journal row must carry its sql_digest (#2066)');
+  END;
+`;
+/**
+ * Refuse migration SQL that names the migration journal (`_substrat_migration…`: the table, its
+ * fence, the DO's bookmarks), in any spelling the grammar allows — quoted, any case, schema-
+ * qualified — before any of it runs.
+ *
+ * A migration runs on the kernel's own handle, not `ctx.sql`, so the spine write guard never
+ * sees it, and an authored migration that repairs `_substrat_tuples` is a reviewed, linted path
+ * (`boundary-lint-allow R4 migration`). The journal is different: a migration that drops the
+ * fence, or writes its own journal rows, makes the digest check say whatever it wrote. Nothing
+ * legitimate in a module's migration names it, reads included.
+ */
+export function assertNoJournalSql(sql, what) {
+    for (const token of tokenizeSql(sql)) {
+        if (!token.text.split('.').some((part) => part.toLowerCase().startsWith('_substrat_migration')))
+            continue;
+        throw substratError('forbidden', `${what} cannot name the migration journal ('${token.text}'): the journal and its digest fence are the kernel's (#2066)`, { reason: 'spine_write' });
+    }
+}
+/**
+ * The authored migrations allowed to write the spine: four shipped ticket0 repairs of its own
+ * `_substrat_tuples` edges and its hand-recreated derived list indexes, each reviewed under
+ * `boundary-lint-allow R4 migration`. Keyed by module, version AND the digest of the exact text,
+ * so only those texts pass: a new migration, or any edit to one of these, gets the full guard.
+ * Shipped migrations are append-only, so this list only ever shrinks — a new spine repair goes
+ * through the platform, not a migration.
+ */
+const REVIEWED_SPINE_MIGRATIONS = new Set([
+    '@substrat-run/demo-ticket0@0020#d29122b68f3cc5d07a70fb87874085e0e6805e2e19612984160488c59789d75c',
+    '@substrat-run/demo-ticket0@0022#9de9088207fa914e9eb8c8344924708655cbecb11e5b64f76e1d2ec7d0bd0ea2',
+    '@substrat-run/demo-ticket0@0024#ba60103ae91108bfce21fd5b24818cec18aefe4ee3b03b49ca8013fd2634aae3',
+    '@substrat-run/demo-ticket0@0026#da0bb4e3c8b13f5febd8b2202e7267c30e9ee91a19d202181b99ccdeb71ec3a4',
+]);
+/**
+ * Refuse a migration's SQL before any of it runs, if it reaches where a migration must not.
+ *
+ * A migration runs on the kernel's own handle, not `ctx.sql`, so `ctx.sql`'s guard never sees it.
+ * Every migration is held to: no foreign key to the spine (#1898), and nothing that names the
+ * journal (`assertNoJournalSql`). An AUTHORED one is also held to the full spine write guard —
+ * no write, DDL or same-named TEMP object on any `_substrat_*` table — unless it is one of the
+ * exact reviewed texts above. Kernel-derived DDL is exempt from that last rule: creating
+ * `_substrat_*` indexes and triggers is what it is for.
+ */
+export function assertMigrationSql(sql, step) {
+    const what = `migration ${step.key}`;
+    assertNoSpineReference(sql, what);
+    assertNoJournalSql(sql, what);
+    if (!step.authored || REVIEWED_SPINE_MIGRATIONS.has(`${step.key}#${step.digest}`))
+        return;
+    try {
+        assertNoSpineWrite(sql);
+    }
+    catch (err) {
+        throw substratError('forbidden', `${what} cannot write the platform spine: ${err.message.replace(/^ctx\.sql cannot write the platform spine: /, '')}`, {
+            reason: 'spine_write',
+        });
+    }
+}
+/**
+ * Refuse a dump whose journal is not consistent with its own shape (#2066 r3): a table whose
+ * recorded DDL declares `sql_digest` while its columns omit it, or the other way round.
+ *
+ * A dump exported before digests were recorded restores as `'legacy'` (`spineRowsInsert`), so
+ * the shape of the journal is what says which kind of dump this is — and a current dump with
+ * the column stripped would otherwise pass as legacy and unprotect every row. The dump's DDL is
+ * `sqlite_master`'s text, which an ALTER rewrites, so a real pre-#2066 journal carries neither.
+ * Nothing else a dump carries changed with #2066 to cross-check against (the fence is a trigger,
+ * and a dump holds tables). A dump is freely editable data: a consistent edit of both is not
+ * detectable, and restore is privileged, audited staff work that could forge any digest anyway.
+ * This catches corruption and partial edits, not an author set on lying.
+ */
+export function assertJournalDumpCoherent(tables) {
+    for (const t of tables) {
+        if (t.name.toLowerCase() !== '_substrat_migrations')
+            continue;
+        const declared = tokenizeSql(t.ddl).some((tok) => tok.text.toLowerCase() === 'sql_digest');
+        const carried = t.columns.some((c) => c.toLowerCase() === 'sql_digest');
+        if (declared === carried)
+            continue;
+        throw substratError('validation_failed', `restore refused: the dump's _substrat_migrations ${declared ? 'declares sql_digest in its DDL but carries no such column' : 'carries sql_digest but its DDL does not declare it'} — ` +
+            `it is neither a dump from before digests were recorded nor a whole one from after. Nothing was changed (#2066).`);
+    }
+}
+/**
+ * Digests by SQL text. Keyed on the content, not on the registration object: a registration
+ * mutated or rebuilt with other SQL under the same version gets that SQL's digest, never a
+ * stale one. Bounded by the distinct migration texts the isolate has registered.
+ */
+const digestOf = new Map();
+const cachedDigest = (sql) => {
+    let digest = digestOf.get(sql);
+    if (!digest)
+        digestOf.set(sql, (digest = migrationDigest(sql)));
+    return digest;
+};
+/**
+ * A module's migrations in the order the host applies them (`moduleMigrations`), each with its
+ * digest and whether it is authored — read from the registration as it is now. The digest of a
+ * text is computed once per isolate, so a Durable Object that wakes with the same code hashes
+ * nothing again.
+ */
+export function migrationSteps(registration) {
+    const authored = new Set((registration.migrations ?? []).map((m) => m.version));
+    return Promise.all(moduleMigrations(registration).map(async (migration) => ({
+        migration,
+        digest: await cachedDigest(migration.sql),
+        authored: authored.has(migration.version),
+    })));
+}
+/**
+ * Plan a scope's migration pass against its journal (`module@version` → recorded digest): the
+ * registered steps it has not applied, or the first applied one whose SQL differs, which fails
+ * the scope closed before anything else runs. Both adapters plan through this.
+ */
+export async function planMigrations(modules, applied) {
+    const pending = [];
+    for (const mod of modules) {
+        for (const step of await mod.steps) {
+            const key = `${mod.id}@${step.migration.version}`;
+            if (!applied.has(key)) {
+                pending.push({ moduleId: mod.id, ...step });
+                continue;
+            }
+            const error = migrationDivergence(applied.get(key), step.digest, step.authored);
+            if (error)
+                return { pending: [], diverged: { version: key, error } };
+        }
+    }
+    return { pending };
+}
+/** The error a scope fails closed with when `module@version` cannot be applied or trusted. */
+export function migrationFailedError(key, cause) {
+    return new Error(`migration failed for ${key} — scope fails closed: ${cause}`);
+}
+/**
+ * Why a registered migration the scope has already applied cannot be trusted, or null when it
+ * can: on an authored migration, a recorded digest that differs from the registered one, or
+ * no digest and no legacy mark at all.
+ *
+ * The caller fails the scope closed with this as the cause, the way a migration that threw
+ * does — the same `migration failed for <module>@<version> — scope fails closed:` record, so
+ * the directory, the sweep and the dashboard read it with nothing new. The scope recovers
+ * when its journal and its schema agree with the deployment again: a scope that ran another
+ * branch's migration is rebuilt (a dev database, a preview) or restored to a dump taken before
+ * it ran; a deployment carrying the wrong SQL is redeployed with the SQL the scope ran. A
+ * migration is never edited or renumbered once a scope has it, so re-numbering is not a
+ * recovery: the scope would still hold the other SQL under this version.
+ */
+export function migrationDivergence(recorded, registered, authored) {
+    if (!authored || recorded === undefined || recorded === registered || recorded === MIGRATION_DIGEST_LEGACY)
+        return null;
+    if (recorded === null) {
+        // The fence makes this unreachable through the kernel; a row that has it anyway was not
+        // written by the kernel, and says nothing about what ran.
+        return (`this scope's journal records neither a digest nor the legacy mark for this version, so ` +
+            `what it ran is unknown (registered sha256 ${registered}). Rebuild the scope, or restore it ` +
+            `to a dump the kernel wrote (#2066)`);
+    }
+    return (`this scope applied different SQL under this version (applied sha256 ${recorded}, ` +
+        `registered sha256 ${registered}). Rebuild the scope, or restore it to a dump taken before ` +
+        `it ran the other SQL; a migration is never edited or renumbered once a scope has applied it (#2066)`);
+}
+//# sourceMappingURL=migration-digest.js.map

package/dist/migration-digest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-digest.js","sourceRoot":"","sources":["../src/migration-digest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,EAAE,gBAAgB,EAAqB,MAAM,iBAAiB,CAAC;AAKtE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,gBAAgB,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,+FAA+F;AAC/F,MAAM,CAAC,MAAM,uBAAuB,GAAG,QAAQ,CAAC;AAEhD;;;;GAIG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,gFAAgF,CAAC;AAE7H;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG;;;;;;;;;;;CAWzC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW,EAAE,IAAY;IAC1D,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;YAAE,SAAS;QAC1G,MAAM,aAAa,CACjB,WAAW,EACX,GAAG,IAAI,wCAAwC,KAAK,CAAC,IAAI,+DAA+D,EACxH,EAAE,MAAM,EAAE,aAAa,EAAE,CAC1B,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,yBAAyB,GAAwB,IAAI,GAAG,CAAC;IAC7D,kGAAkG;IAClG,kGAAkG;IAClG,kGAAkG;IAClG,kGAAkG;CACnG,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW,EAAE,IAAwD;IACtG,MAAM,IAAI,GAAG,aAAa,IAAI,CAAC,GAAG,EAAE,CAAC;IACrC,sBAAsB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAClC,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC9B,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,yBAAyB,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAAE,OAAO;IAC1F,IAAI,CAAC;QACH,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,aAAa,CAAC,WAAW,EAAE,GAAG,IAAI,qCAAsC,GAAa,CAAC,OAAO,CAAC,OAAO,CAAC,6CAA6C,EAAE,EAAE,CAAC,EAAE,EAAE;YAChK,MAAM,EAAE,aAAa;SACtB,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAA4E;IACpH,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,sBAAsB;YAAE,SAAS;QAC9D,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,YAAY,CAAC,CAAC;QAC3F,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,YAAY,CAAC,CAAC;QACxE,IAAI,QAAQ,KAAK,OAAO;YAAE,SAAS;QACnC,MAAM,aAAa,CACjB,mBAAmB,EACnB,oDAAoD,QAAQ,CAAC,CAAC,CAAC,2DAA2D,CAAC,CAAC,CAAC,oDAAoD,KAAK;YACpL,iHAAiH,CACpH,CAAC;IACJ,CAAC;AACH,CAAC;AAUD;;;;GAIG;AACH,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA2B,CAAC;AACpD,MAAM,YAAY,GAAG,CAAC,GAAW,EAAmB,EAAE;IACpD,IAAI,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC,MAAM;QAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChE,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,YAAoD;IACjF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAChF,OAAO,OAAO,CAAC,GAAG,CAChB,gBAAgB,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QACvD,SAAS;QACT,MAAM,EAAE,MAAM,YAAY,CAAC,SAAS,CAAC,GAAG,CAAC;QACzC,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC;KAC1C,CAAC,CAAC,CACJ,CAAC;AACJ,CAAC;AAYD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAA6F,EAC7F,OAA2C;IAE3C,MAAM,OAAO,GAAuB,EAAE,CAAC;IACvC,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,KAAK,MAAM,IAAI,IAAI,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;YACnC,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YAClD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtB,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;gBAC5C,SAAS;YACX,CAAC;YACD,MAAM,KAAK,GAAG,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YAChF,IAAI,KAAK;gBAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC;QACvE,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,CAAC;AACrB,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,oBAAoB,CAAC,GAAW,EAAE,KAAa;IAC7D,OAAO,IAAI,KAAK,CAAC,wBAAwB,GAAG,0BAA0B,KAAK,EAAE,CAAC,CAAC;AACjF,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAmC,EACnC,UAAkB,EAClB,QAAiB;IAEjB,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,UAAU,IAAI,QAAQ,KAAK,uBAAuB;QAAE,OAAO,IAAI,CAAC;IACxH,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,wFAAwF;QACxF,0DAA0D;QAC1D,OAAO,CACL,yFAAyF;YACzF,6CAA6C,UAAU,sCAAsC;YAC7F,oCAAoC,CACrC,CAAC;IACJ,CAAC;IACD,OAAO,CACL,uEAAuE,QAAQ,IAAI;QACnF,qBAAqB,UAAU,6DAA6D;QAC5F,qGAAqG,CACtG,CAAC;AACJ,CAAC"}