@substrat-run/kernel 0.138.0 → 0.140.0

package/dist/module-erasure.d.ts

@@ -0,0 +1,156 @@
+/**
+ * Subject erasure inside a module's OWN tables (#2068) — the half of open question 17 that
+ * K-37 left named and unbuilt.
+ *
+ * `shredSubject` redacts the spine and destroys the key that seals the platform's copies. A
+ * module's rows were outside that, and §13.1 said so (limit 2). This file brings them in, two
+ * ways, both run by the kernel in the SAME transaction as the spine redaction and before the
+ * key is destroyed:
+ *
+ * - **Declared.** An entity names its subject columns beside its `erasable` fields
+ *   (`erasure: { subjects }`, `subject-erasure.ts` in contracts), and the kernel blanks those
+ *   fields — or deletes the row — wherever a subject column equals the id. No module code
+ *   runs, so a vertical gets the right behaviour by declaring, and a declaration cannot forget
+ *   a column the way a hand-written UPDATE can.
+ * - **A hook.** `onSubjectErased(ctx, { subjectId })` on the registration, for a link the row
+ *   does not hold itself (a rating reached through its conversation). It is narrow on purpose:
+ *   a `sql` that reaches the module's own tables and nothing else, and `now()`. No emit — an
+ *   event about the erasure would be a new immutable copy of what is being erased — no
+ *   check, grant, link or platform request, and no await: it is synchronous, so it runs inside
+ *   the erasure's one transaction and nothing interleaves with it.
+ *
+ * **Failure is all or nothing.** A hook that throws rolls the whole scope-side unit back, the
+ * spine redaction with it, and the erasure throws before the key is touched or a receipt is
+ * written. Nothing claims an erasure that did not happen, and a re-run converges: a declared
+ * blank skips rows already blank, and a hook is idempotent by contract.
+ *
+ * **Derived stores.** A search index over an erased column is kept in step by its own triggers,
+ * but FTS5 keeps a deleted row's terms in older index segments until they merge — the words
+ * are still in the database file, findable by anyone reading the shadow tables. So the erasure
+ * runs with FTS5's `secure-delete` on for the indexes over the erasing modules' tables, which
+ * removes each entry where it sits rather than recording its deletion. A list index is an ordinary b-tree and loses the old value with the
+ * UPDATE. What neither reaches — free pages SQLite has not reused, and attachment text — is
+ * written down in kernel-design.md §13.1 rather than implied.
+ */
+import { type ErasedEntityCount, type ErasureHookCount, type SubjectErasureDeclaration, type UnreachedEntity } from '@substrat-run/contracts';
+import type { ModuleRegistration, ScopedSql } from './scope-host.js';
+import type { SearchIndexPlan } from './search-index.js';
+/** What a module's `onSubjectErased` hook is handed — and all it is handed. */
+export interface SubjectErasureContext {
+    /**
+     * The module's own tables, and only those — the ones its migrations create: a statement
+     * naming any other table in the scope (another module's, a view, a TEMP object, the spine)
+     * is refused before it runs, reads included. Only `SELECT`, `UPDATE`, `DELETE`, `INSERT` and
+     * `REPLACE`; no `WITH`, no DDL, no `PRAGMA`. Revoked when the hook returns: a call after that
+     * throws and writes nothing.
+     */
+    readonly sql: ScopedSql;
+    /** The erasure's instant, the same one the spine's tombstones carry. Revoked with `sql`. */
+    now(): string;
+}
+/**
+ * A module's own erasure step (#2068). Synchronous and returning nothing — a promise, an
+ * iterator or any other returned value refuses the whole erasure — and
+ * idempotent: an erasure is re-run after any failure, so a second call for the same subject
+ * must find nothing left to do.
+ */
+export type OnSubjectErased = (ctx: SubjectErasureContext, subject: {
+    readonly subjectId: string;
+}) => void;
+/** One registered module's erasure, validated once at registration. */
+export interface ModuleErasurePlan {
+    readonly moduleId: string;
+    readonly declaration: SubjectErasureDeclaration;
+    readonly hook?: OnSubjectErased;
+    /**
+     * The tables this module's erasure may touch, lowercased: the declaration's, each one VERIFIED
+     * at registration to be created by the module's own migrations. The hook's whole reach.
+     */
+    readonly ownTables: ReadonlySet<string>;
+}
+/** What the module half of one erasure did — the receipt's three new lines. */
+export interface ModuleErasureCounts {
+    verticalRows: ErasedEntityCount[];
+    hookRows: ErasureHookCount[];
+    unreachedEntities: UnreachedEntity[];
+}
+/**
+ * The tables a module's own migration TEXT creates, lowercased — read at registration, where no
+ * scope exists yet, as early feedback only: it can refuse a module whose erasure names a table it
+ * plainly never creates, and it never grants anything. `CREATE TABLE IF NOT EXISTS` on another
+ * module's table reads as a creation here and creates nothing in a scope, which is why the
+ * authority is the ownership each scope RECORDS as its migrations run (`table-ownership.ts`),
+ * checked by the erasure itself before it writes.
+ */
+export declare function tablesCreatedBy(migrations: readonly {
+    readonly sql: string;
+}[]): Set<string>;
+/**
+ * The erasure plan for one registration, or undefined when it has nothing to erase. Throws,
+ * at registration, for every way a module can claim an erasure it cannot deliver, or one that
+ * would reach past itself:
+ *
+ * - a hook with no `manifest.erasure` — the hook's reach IS that block's `tables`, and a hook
+ *   with no reach declared is refused rather than handed the whole scope;
+ * - an entity declared `custom` with no hook to reach it;
+ * - an entity the erasure would write (`blank`, `delete`, `custom`) on a table the module's own
+ *   migrations do not create, and — when there is a hook — any table in its reach that they do
+ *   not create. The declaration is a claim; the migrations are what the kernel ran. A misdeclared
+ *   entity naming another module's table would otherwise have that table erased through the
+ *   kernel's own handle. An `unreached` entity writes nothing and is not held to it.
+ */
+export declare function moduleErasurePlan(registration: ModuleRegistration): ModuleErasurePlan | undefined;
+/**
+ * Refuse a hook statement that reaches past the module's own tables (#2068).
+ *
+ * An ALLOWLIST, judged where a table can stand: every name in a table position — after `FROM`,
+ * `JOIN`, `INTO` and `UPDATE`, and each further name in a comma-joined `FROM` list, at any
+ * nesting depth — must be one of `own`, unqualified. Whatever else the scope holds — another
+ * module's table, a view, a TEMP object, the spine — is refused without having to be listed,
+ * so nothing the schema grows later widens the reach. Also refused: a qualified name
+ * (`main.x`, `temp.x`), a table-valued function other than `json_each`/`json_tree`, `WITH`
+ * (a CTE could shadow an own table's name), and any spine- or `sqlite_`-prefixed name
+ * anywhere. Every statement chained after a `;` starts with an allowed verb.
+ *
+ * It errs toward refusing: a name in a table position that is not a table at all
+ * (`a IS DISTINCT FROM b`) is held to the allowlist too, and fails closed with a message.
+ */
+export declare function assertWithinErasureReach(moduleId: string, sql: string, own: ReadonlySet<string>): void;
+/**
+ * The oldest SQLite that may run an erasure over a search index (#2068): FTS5 `secure-delete`
+ * arrived in 3.42.0, and an index deleted from under it is recorded at FTS5 format version 5,
+ * which no older SQLite can read. A dump never carries a search index (it is rebuilt on load),
+ * so the reader that matters is the runtime holding the scope's own file.
+ */
+export declare const SECURE_DELETE_MIN_SQLITE = "3.42.0";
+/**
+ * Run the module half of one erasure: every declared entity, then every hook, with FTS5's
+ * `secure-delete` on for the search indexes over those modules' tables. `sql` is the kernel's
+ * own handle on the scope — never module code's — and the caller holds it inside the
+ * transaction the spine redaction runs in, so a throw from here rolls both back.
+ *
+ * Order between the two halves: declared first, hooks after, so a hook reading a declared
+ * entity sees it already blank and a hook that deletes cannot strand a declared blank. Order
+ * between modules is registration order, which nothing here depends on: each touches its own
+ * tables only.
+ */
+export declare function eraseSubjectFromModules(input: {
+    readonly sql: ScopedSql;
+    readonly plans: readonly ModuleErasurePlan[];
+    readonly searchPlans: Iterable<SearchIndexPlan>;
+    /** The module tables carrying archive/trash columns (#119), lowercased — `guardSpine`'s. */
+    readonly statefulTables?: ReadonlySet<string>;
+    readonly subjectId: string;
+    readonly at: string;
+    /** A registered module's migration text, for backfilling a scope migrated before ownership was recorded. */
+    readonly migrationSqlOf: (moduleId: string, version: string) => string | undefined;
+}): ModuleErasureCounts;
+/** Every row the module half changed — what the access log adds to "how much evidence this destroyed". */
+export declare function moduleRowsErased(counts: ModuleErasureCounts): number;
+/**
+ * Whether a host's reply carries the module half (#2068) in the shape this kernel wrote — what a
+ * coordinator checks before destroying the key, so a host built before the half existed is
+ * refused rather than read as having reached nothing.
+ */
+export declare function isModuleErasureCounts(value: unknown): value is ModuleErasureCounts;
+//# sourceMappingURL=module-erasure.d.ts.map

package/dist/module-erasure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module-erasure.d.ts","sourceRoot":"","sources":["../src/module-erasure.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,EAKL,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,yBAAyB,EAC9B,KAAK,eAAe,EACrB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,kBAAkB,EAAE,SAAS,EAAY,MAAM,iBAAiB,CAAC;AAC/E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAKzD,+EAA+E;AAC/E,MAAM,WAAW,qBAAqB;IACpC;;;;;;OAMG;IACH,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IACxB,4FAA4F;IAC5F,GAAG,IAAI,MAAM,CAAC;CACf;AAED;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,qBAAqB,EAAE,OAAO,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,KAAK,IAAI,CAAC;AAE5G,uEAAuE;AACvE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,yBAAyB,CAAC;IAChD,QAAQ,CAAC,IAAI,CAAC,EAAE,eAAe,CAAC;IAChC;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACzC;AAED,+EAA+E;AAC/E,MAAM,WAAW,mBAAmB;IAClC,YAAY,EAAE,iBAAiB,EAAE,CAAC;IAClC,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAC7B,iBAAiB,EAAE,eAAe,EAAE,CAAC;CACtC;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,SAAS;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,CAW5F;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,kBAAkB,GAAG,iBAAiB,GAAG,SAAS,CAyCjG;AAkBD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,IAAI,CAqEtG;AAoCD;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,WAAW,CAAC;AA0BjD;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE;IAC7C,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC7C,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,eAAe,CAAC,CAAC;IAChD,4FAA4F;IAC5F,QAAQ,CAAC,cAAc,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC9C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,4GAA4G;IAC5G,QAAQ,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;CACpF,GAAG,mBAAmB,CAgJtB;AAED,0GAA0G;AAC1G,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,mBAAmB,GAAG,MAAM,CAEpE;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,mBAAmB,CAIlF"}

package/dist/module-erasure.js

@@ -0,0 +1,440 @@
+/**
+ * Subject erasure inside a module's OWN tables (#2068) — the half of open question 17 that
+ * K-37 left named and unbuilt.
+ *
+ * `shredSubject` redacts the spine and destroys the key that seals the platform's copies. A
+ * module's rows were outside that, and §13.1 said so (limit 2). This file brings them in, two
+ * ways, both run by the kernel in the SAME transaction as the spine redaction and before the
+ * key is destroyed:
+ *
+ * - **Declared.** An entity names its subject columns beside its `erasable` fields
+ *   (`erasure: { subjects }`, `subject-erasure.ts` in contracts), and the kernel blanks those
+ *   fields — or deletes the row — wherever a subject column equals the id. No module code
+ *   runs, so a vertical gets the right behaviour by declaring, and a declaration cannot forget
+ *   a column the way a hand-written UPDATE can.
+ * - **A hook.** `onSubjectErased(ctx, { subjectId })` on the registration, for a link the row
+ *   does not hold itself (a rating reached through its conversation). It is narrow on purpose:
+ *   a `sql` that reaches the module's own tables and nothing else, and `now()`. No emit — an
+ *   event about the erasure would be a new immutable copy of what is being erased — no
+ *   check, grant, link or platform request, and no await: it is synchronous, so it runs inside
+ *   the erasure's one transaction and nothing interleaves with it.
+ *
+ * **Failure is all or nothing.** A hook that throws rolls the whole scope-side unit back, the
+ * spine redaction with it, and the erasure throws before the key is touched or a receipt is
+ * written. Nothing claims an erasure that did not happen, and a re-run converges: a declared
+ * blank skips rows already blank, and a hook is idempotent by contract.
+ *
+ * **Derived stores.** A search index over an erased column is kept in step by its own triggers,
+ * but FTS5 keeps a deleted row's terms in older index segments until they merge — the words
+ * are still in the database file, findable by anyone reading the shadow tables. So the erasure
+ * runs with FTS5's `secure-delete` on for the indexes over the erasing modules' tables, which
+ * removes each entry where it sits rather than recording its deletion. A list index is an ordinary b-tree and loses the old value with the
+ * UPDATE. What neither reaches — free pages SQLite has not reused, and attachment text — is
+ * written down in kernel-design.md §13.1 rather than implied.
+ */
+import { namesSpineTable, substratError, subjectErasureDeclaration, tokenizeSql, } from '@substrat-run/contracts';
+import { guardSpine } from './spine-guard.js';
+import { assertSqlIdentifier } from './sql-identifier.js';
+import { assertTablesOwned, tableStatements } from './table-ownership.js';
+/**
+ * The tables a module's own migration TEXT creates, lowercased — read at registration, where no
+ * scope exists yet, as early feedback only: it can refuse a module whose erasure names a table it
+ * plainly never creates, and it never grants anything. `CREATE TABLE IF NOT EXISTS` on another
+ * module's table reads as a creation here and creates nothing in a scope, which is why the
+ * authority is the ownership each scope RECORDS as its migrations run (`table-ownership.ts`),
+ * checked by the erasure itself before it writes.
+ */
+export function tablesCreatedBy(migrations) {
+    const owned = new Set();
+    for (const migration of migrations) {
+        for (const st of tableStatements(migration.sql)) {
+            if (st.kind === 'create')
+                owned.add(st.table);
+            else if (st.kind === 'rename') {
+                if (owned.delete(st.from))
+                    owned.add(st.to);
+            }
+            else
+                owned.delete(st.table);
+        }
+    }
+    return owned;
+}
+/**
+ * The erasure plan for one registration, or undefined when it has nothing to erase. Throws,
+ * at registration, for every way a module can claim an erasure it cannot deliver, or one that
+ * would reach past itself:
+ *
+ * - a hook with no `manifest.erasure` — the hook's reach IS that block's `tables`, and a hook
+ *   with no reach declared is refused rather than handed the whole scope;
+ * - an entity declared `custom` with no hook to reach it;
+ * - an entity the erasure would write (`blank`, `delete`, `custom`) on a table the module's own
+ *   migrations do not create, and — when there is a hook — any table in its reach that they do
+ *   not create. The declaration is a claim; the migrations are what the kernel ran. A misdeclared
+ *   entity naming another module's table would otherwise have that table erased through the
+ *   kernel's own handle. An `unreached` entity writes nothing and is not held to it.
+ */
+export function moduleErasurePlan(registration) {
+    const { manifest, onSubjectErased: hook } = registration;
+    if (hook !== undefined && typeof hook !== 'function') {
+        throw new Error(`${manifest.id}: onSubjectErased must be a function`);
+    }
+    if (!manifest.erasure) {
+        if (hook) {
+            throw new Error(`${manifest.id}: onSubjectErased is registered but the manifest declares no \`erasure\` — the ` +
+                "hook's reach is that block's `tables`. Spread `manifestEntities(...)` into the manifest");
+        }
+        return undefined;
+    }
+    const declaration = subjectErasureDeclaration.parse(manifest.erasure);
+    const custom = declaration.entities.filter((e) => e.mode === 'custom');
+    if (custom.length && !hook) {
+        throw new Error(`${manifest.id}: ${custom.map((e) => e.entityType).join(', ')} declare${custom.length === 1 ? 's' : ''} ` +
+            "`erasure: { mode: 'custom' }` but the module registers no onSubjectErased hook to reach them");
+    }
+    const created = tablesCreatedBy(registration.migrations ?? []);
+    const claimed = [
+        ...declaration.entities.filter((e) => e.mode !== 'unreached').map((e) => e.table),
+        ...(hook ? declaration.tables : []),
+    ];
+    const foreign = [...new Set(claimed.filter((t) => !created.has(t.toLowerCase())))];
+    if (foreign.length) {
+        throw new Error(`${manifest.id}: its erasure names ${foreign.map((t) => `'${t}'`).join(', ')}, which its own migrations ` +
+            'do not create — an erasure reaches only the tables a module owns. Create the table in this ' +
+            "module's migrations, or leave the entity without an `erasure`");
+    }
+    return {
+        moduleId: manifest.id,
+        declaration,
+        ...(hook ? { hook } : {}),
+        ownTables: new Set(claimed.map((t) => t.toLowerCase())),
+    };
+}
+/** The statements a hook may run. Everything else — DDL, PRAGMA, ATTACH, VACUUM, WITH — is refused. */
+const HOOK_VERBS = new Set(['select', 'update', 'delete', 'insert', 'replace']);
+/** The only table-valued functions a hook may name in a FROM: they read the row's own JSON. */
+const TABLE_FUNCTIONS = new Set(['json_each', 'json_tree']);
+/** Words that end a FROM list (or an UPDATE / INTO target) — what follows them is no table. */
+const ENDS_TABLE_LIST = new Set([
+    'set', 'where', 'on', 'using', 'group', 'order', 'limit', 'values', 'select', 'returning',
+    'union', 'except', 'intersect', 'default', 'having', 'window', 'left', 'right', 'full',
+    'inner', 'cross', 'natural', 'outer',
+]);
+/** The conflict clause words between `UPDATE` and its table: `UPDATE OR IGNORE t`. */
+const CONFLICT_WORDS = new Set(['or', 'rollback', 'abort', 'replace', 'fail', 'ignore']);
+/**
+ * Refuse a hook statement that reaches past the module's own tables (#2068).
+ *
+ * An ALLOWLIST, judged where a table can stand: every name in a table position — after `FROM`,
+ * `JOIN`, `INTO` and `UPDATE`, and each further name in a comma-joined `FROM` list, at any
+ * nesting depth — must be one of `own`, unqualified. Whatever else the scope holds — another
+ * module's table, a view, a TEMP object, the spine — is refused without having to be listed,
+ * so nothing the schema grows later widens the reach. Also refused: a qualified name
+ * (`main.x`, `temp.x`), a table-valued function other than `json_each`/`json_tree`, `WITH`
+ * (a CTE could shadow an own table's name), and any spine- or `sqlite_`-prefixed name
+ * anywhere. Every statement chained after a `;` starts with an allowed verb.
+ *
+ * It errs toward refusing: a name in a table position that is not a table at all
+ * (`a IS DISTINCT FROM b`) is held to the allowlist too, and fails closed with a message.
+ */
+export function assertWithinErasureReach(moduleId, sql, own) {
+    const refuse = (what) => {
+        throw substratError('forbidden', `${moduleId}: onSubjectErased reaches its own module's tables only — refused ${what}`, { reason: 'erasure_reach' });
+    };
+    const tokens = tokenizeSql(sql, { punctuation: true });
+    const stack = [];
+    let f = { expect: false, clause: null, inList: false };
+    let start = true;
+    let prev = '';
+    for (let i = 0; i < tokens.length; i += 1) {
+        const token = tokens[i];
+        if (token.punct) {
+            if (token.text === ';') {
+                start = true;
+                stack.length = 0;
+                f = { expect: false, clause: null, inList: false };
+            }
+            else if (token.text === '(') {
+                // A subquery in a FROM position stands where a table would: once it closes, the outer
+                // list continues after it, so a `, other` that follows is still judged.
+                stack.push(f.expect ? { expect: false, clause: f.clause, inList: true } : { ...f, expect: false });
+                f = { expect: false, clause: null, inList: false };
+            }
+            else if (token.text === ')') {
+                f = stack.pop() ?? { expect: false, clause: null, inList: false };
+            }
+            else if (token.text === ',' && f.inList && f.clause === 'from') {
+                f = { ...f, expect: true, inList: false };
+            }
+            continue;
+        }
+        const word = token.quoted ? '' : token.text.toLowerCase();
+        for (const part of token.text.split('.')) {
+            const name = part.toLowerCase();
+            if (namesSpineTable(name) || name.startsWith('sqlite_'))
+                refuse(`'${part}'`);
+        }
+        if (start) {
+            start = false;
+            if (!HOOK_VERBS.has(word))
+                refuse(`the statement: ${sql.slice(0, 60)}`);
+        }
+        if (word === 'with')
+            refuse('WITH — a common table expression could shadow a table name');
+        if (f.expect) {
+            if (f.clause === 'update' && CONFLICT_WORDS.has(word))
+                continue;
+            const next = tokens[i + 1];
+            if (f.clause === 'from' && next?.punct && next.text === '(') {
+                if (!TABLE_FUNCTIONS.has(word))
+                    refuse(`the table-valued function '${token.text}'`);
+            }
+            else if (token.text.includes('.')) {
+                refuse(`the qualified name '${token.text}'`);
+            }
+            else if (!own.has(token.text.toLowerCase())) {
+                refuse(`'${token.text}', which is not one of its tables`);
+            }
+            f = { ...f, expect: false, inList: true };
+        }
+        else if (word === 'from' || word === 'join') {
+            f = { expect: true, clause: 'from', inList: false };
+        }
+        else if (word === 'into') {
+            f = { expect: true, clause: 'into', inList: false };
+        }
+        else if (word === 'update' && prev !== 'do') {
+            f = { expect: true, clause: 'update', inList: false };
+        }
+        else if (f.inList && ENDS_TABLE_LIST.has(word)) {
+            f = { ...f, inList: false };
+        }
+        prev = word;
+    }
+}
+/**
+ * Refuse the erasure when a TEMP object carries the name of a table it is about to touch: an
+ * unqualified name resolves to the temp schema first, so the declared write or the hook would
+ * land on the shadow. A host whose SQLite will not show its temp schema (a Durable Object) has
+ * none for anything to have made.
+ */
+function assertNoTempShadow(sql, tables) {
+    let temp;
+    try {
+        temp = sql.query('SELECT name FROM temp.sqlite_master');
+    }
+    catch {
+        return;
+    }
+    const shadow = temp.map((r) => r.name).find((n) => tables.has(n.toLowerCase()));
+    if (shadow) {
+        throw substratError('precondition_failed', `erasure: a TEMP object '${shadow}' shadows a module table this erasure would touch — nothing was erased`);
+    }
+}
+/**
+ * What the statement just run changed, as SQLite counts it: `changes()` is that statement's own
+ * rows and never a trigger's; `total_changes()` is the connection's running count, compared and
+ * never reported. Read rather than taken from the handle's exec result because the two adapters
+ * disagree there — a Durable Object's `rowsWritten` counts every index and FTS trigger write
+ * too — and a receipt must say the same number whichever host erased.
+ */
+function changeCounts(sql) {
+    const row = sql.query('SELECT changes() AS c, total_changes() AS t')[0];
+    return { changes: row?.c ?? 0, total: row?.t ?? 0 };
+}
+/**
+ * The oldest SQLite that may run an erasure over a search index (#2068): FTS5 `secure-delete`
+ * arrived in 3.42.0, and an index deleted from under it is recorded at FTS5 format version 5,
+ * which no older SQLite can read. A dump never carries a search index (it is rebuilt on load),
+ * so the reader that matters is the runtime holding the scope's own file.
+ */
+export const SECURE_DELETE_MIN_SQLITE = '3.42.0';
+/**
+ * Switch `secure-delete` on for one index, or refuse the erasure if this SQLite cannot.
+ *
+ * A capability probe rather than a version check, because a Durable Object will not run
+ * `sqlite_version()`. The probe is exact anyway: an FTS5 older than 3.42.0 has no
+ * `secure-delete` command and rejects it, and that rejection comes before anything is written
+ * to the index's table, so the erasure fails closed — nothing erased, and no index left at a
+ * format the runtime holding it could not read back.
+ */
+function enableSecureDelete(sql, idx) {
+    try {
+        sql.exec(`INSERT INTO ${idx}(${idx}, rank) VALUES('secure-delete', 1)`);
+    }
+    catch (err) {
+        throw substratError('precondition_failed', `erasure: erasing from a search index needs FTS5 secure-delete (SQLite ${SECURE_DELETE_MIN_SQLITE}+), ` +
+            `which this host's SQLite refused (${err instanceof Error ? err.message : String(err)}) — nothing was erased`);
+    }
+}
+/** A name the kernel interpolates — re-checked here, never trusted from a manifest. */
+const ident = (name) => assertSqlIdentifier('erasure', 'an identifier', name, 'a module erasure');
+/**
+ * Run the module half of one erasure: every declared entity, then every hook, with FTS5's
+ * `secure-delete` on for the search indexes over those modules' tables. `sql` is the kernel's
+ * own handle on the scope — never module code's — and the caller holds it inside the
+ * transaction the spine redaction runs in, so a throw from here rolls both back.
+ *
+ * Order between the two halves: declared first, hooks after, so a hook reading a declared
+ * entity sees it already blank and a hook that deletes cannot strand a declared blank. Order
+ * between modules is registration order, which nothing here depends on: each touches its own
+ * tables only.
+ */
+export function eraseSubjectFromModules(input) {
+    const { sql, plans, subjectId, at } = input;
+    const out = { verticalRows: [], hookRows: [], unreachedEntities: [] };
+    // Before anything is written: every table this erasure would touch must be recorded, in THIS
+    // scope, as created by the erasing module's own migrations.
+    for (const plan of plans)
+        assertTablesOwned(sql, plan.moduleId, plan.ownTables, input.migrationSqlOf, at);
+    if (plans.some((p) => p.ownTables.size > 0)) {
+        assertNoTempShadow(sql, new Set(plans.flatMap((p) => [...p.ownTables])));
+    }
+    // FTS5 keeps a deleted row's terms in the older index segments until they merge, so an
+    // erased word stays in the database file after search stops finding it. `secure-delete`
+    // makes a delete remove the entry from the segment it sits in instead — at the cost of that
+    // one entry, where a full merge ('optimize') rewrites the whole index (0.5 s at 100k rows,
+    // measured). It is switched on lazily, for an index whose table this erasure is about to
+    // change and no other, and off again at the end; a throw rolls the switch back with
+    // everything else. Lazily because the switch leaves a row in the index's own config, which
+    // SQLite will not let anyone remove: an erasure that holds nothing for the subject — the
+    // common case, every scope it is not about — leaves every index exactly as it found it.
+    const indexesOf = new Map();
+    for (const p of input.searchPlans) {
+        const key = p.table.toLowerCase();
+        const list = indexesOf.get(key) ?? [];
+        list.push(ident(p.indexTable));
+        indexesOf.set(key, list);
+    }
+    const secured = new Set();
+    const secure = (table) => {
+        for (const idx of indexesOf.get(table.toLowerCase()) ?? []) {
+            if (secured.has(idx))
+                continue;
+            enableSecureDelete(sql, idx);
+            secured.add(idx);
+        }
+    };
+    for (const plan of plans) {
+        for (const entity of plan.declaration.entities) {
+            if (entity.mode === 'unreached') {
+                out.unreachedEntities.push({ module: plan.moduleId, entityType: entity.entityType });
+                continue;
+            }
+            if (entity.mode === 'custom')
+                continue;
+            const table = ident(entity.table);
+            const subjects = (entity.subjects ?? []).map(ident);
+            const match = `(${subjects.map((s) => `${s} = ?`).join(' OR ')})`;
+            const subjectParams = subjects.map(() => subjectId);
+            // Only rows still holding something: a re-run changes nothing and counts zero.
+            const cols = entity.fields.map((f) => ident(f.name));
+            const blanks = entity.fields.map((f) => f.blank);
+            const isDelete = entity.mode === 'delete';
+            const filter = isDelete ? match : `${match} AND (${cols.map((c) => `${c} IS NOT ?`).join(' OR ')})`;
+            const params = isDelete ? subjectParams : [...subjectParams, ...blanks];
+            // The probe exists only to switch an index's secure-delete on lazily; a table no index
+            // covers goes straight to its write.
+            const indexed = indexesOf.has(table.toLowerCase());
+            let rows = 0;
+            if (!indexed || sql.query(`SELECT 1 FROM ${table} WHERE ${filter} LIMIT 1`, params).length > 0) {
+                secure(table);
+                if (isDelete) {
+                    sql.exec(`DELETE FROM ${table} WHERE ${filter}`, params);
+                }
+                else {
+                    sql.exec(`UPDATE ${table} SET ${cols.map((c) => `${c} = ?`).join(', ')} WHERE ${filter}`, [...blanks, ...params]);
+                }
+                rows = changeCounts(sql).changes;
+            }
+            out.verticalRows.push({ module: plan.moduleId, entityType: entity.entityType, mode: entity.mode, rows });
+        }
+    }
+    const guarded = guardSpine(sql, input.statefulTables);
+    for (const plan of plans) {
+        if (!plan.hook)
+            continue;
+        const own = plan.ownTables;
+        let rows = 0;
+        // The hook's capability lives exactly as long as its synchronous run. A hook that kept
+        // `ctx` — an async continuation, a handle stored on a global — and used it later would
+        // write outside the erasure's transaction, after a refusal had rolled it back; revoked,
+        // every later call throws and writes nothing.
+        let live = true;
+        const alive = () => {
+            if (!live) {
+                throw substratError('forbidden', `${plan.moduleId}: onSubjectErased's ctx was used after the hook returned — it is valid only while the hook runs`, { reason: 'erasure_revoked' });
+            }
+        };
+        // `changes()` is the last WRITE's count, so a read run through `exec` would repeat the
+        // previous one; `total_changes()` moving at all is what says a statement wrote.
+        let total = changeCounts(sql).total;
+        const hookSql = {
+            query: (statement, params) => {
+                alive();
+                assertWithinErasureReach(plan.moduleId, statement, own);
+                return guarded.query(statement, params);
+            },
+            exec: (statement, params) => {
+                alive();
+                assertWithinErasureReach(plan.moduleId, statement, own);
+                // Any statement the hook runs may change any of its tables; secure their indexes first.
+                for (const t of own)
+                    secure(t);
+                guarded.exec(statement, params);
+                const after = changeCounts(sql);
+                const changes = after.total === total ? 0 : after.changes;
+                total = after.total;
+                rows += changes;
+                return { changes };
+            },
+        };
+        const ctx = {
+            sql: hookSql,
+            now: () => {
+                alive();
+                return at;
+            },
+        };
+        let returned;
+        try {
+            returned = plan.hook(ctx, { subjectId });
+        }
+        finally {
+            live = false;
+        }
+        if (returned !== undefined) {
+            // Anything but `undefined` is a hook that did not finish in its synchronous run: a promise
+            // (an async hook), an iterator (a generator hook, whose body has not even started), or a
+            // value it meant as a result. Each refuses the whole erasure, before the key. A promise's
+            // rejection is the module's — swallowed so it does not surface unhandled after the erasure
+            // it belonged to has been refused and rolled back; its continuation can do nothing, `ctx`
+            // being revoked above.
+            if (returned !== null && typeof returned.then === 'function') {
+                returned.then(undefined, () => undefined);
+            }
+            throw substratError('precondition_failed', `${plan.moduleId}: onSubjectErased returned a value — it must run to completion synchronously and ` +
+                "return nothing (no async, no generator), so it runs inside the erasure's one transaction");
+        }
+        out.hookRows.push({ module: plan.moduleId, rows });
+    }
+    for (const idx of secured)
+        sql.exec(`INSERT INTO ${idx}(${idx}, rank) VALUES('secure-delete', 0)`);
+    return out;
+}
+/** Every row the module half changed — what the access log adds to "how much evidence this destroyed". */
+export function moduleRowsErased(counts) {
+    return [...counts.verticalRows, ...counts.hookRows].reduce((n, c) => n + c.rows, 0);
+}
+/**
+ * Whether a host's reply carries the module half (#2068) in the shape this kernel wrote — what a
+ * coordinator checks before destroying the key, so a host built before the half existed is
+ * refused rather than read as having reached nothing.
+ */
+export function isModuleErasureCounts(value) {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    const v = value;
+    return Array.isArray(v.verticalRows) && Array.isArray(v.hookRows) && Array.isArray(v.unreachedEntities);
+}
+//# sourceMappingURL=module-erasure.js.map

package/dist/module-erasure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"module-erasure.js","sourceRoot":"","sources":["../src/module-erasure.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,EACL,eAAe,EACf,aAAa,EACb,yBAAyB,EACzB,WAAW,GAKZ,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AA2C1E;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,UAA+C;IAC7E,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,KAAK,MAAM,EAAE,IAAI,eAAe,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YAChD,IAAI,EAAE,CAAC,IAAI,KAAK,QAAQ;gBAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;iBACzC,IAAI,EAAE,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC9B,IAAI,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC;oBAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,CAAC;;gBAAM,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB,CAAC,YAAgC;IAChE,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,EAAE,GAAG,YAAY,CAAC;IACzD,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,KAAK,UAAU,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,CAAC,EAAE,sCAAsC,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CACb,GAAG,QAAQ,CAAC,EAAE,iFAAiF;gBAC7F,yFAAyF,CAC5F,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,WAAW,GAAG,yBAAyB,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IACvE,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,GAAG,QAAQ,CAAC,EAAE,KAAK,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG;YACvG,8FAA8F,CACjG,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,eAAe,CAAC,YAAY,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG;QACd,GAAG,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;QACjF,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;KACpC,CAAC;IACF,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACnF,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,GAAG,QAAQ,CAAC,EAAE,uBAAuB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,6BAA6B;YACvG,6FAA6F;YAC7F,+DAA+D,CAClE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,QAAQ,CAAC,EAAE;QACrB,WAAW;QACX,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,SAAS,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;KACxD,CAAC;AACJ,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;AAEhF,+FAA+F;AAC/F,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;AAE5D,+FAA+F;AAC/F,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW;IACzF,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;IACtF,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO;CACrC,CAAC,CAAC;AAEH,sFAAsF;AACtF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEzF;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,wBAAwB,CAAC,QAAgB,EAAE,GAAW,EAAE,GAAwB;IAC9F,MAAM,MAAM,GAAG,CAAC,IAAY,EAAS,EAAE;QACrC,MAAM,aAAa,CACjB,WAAW,EACX,GAAG,QAAQ,oEAAoE,IAAI,EAAE,EACrF,EAAE,MAAM,EAAE,eAAe,EAAE,CAC5B,CAAC;IACJ,CAAC,CAAC;IAMF,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,MAAM,KAAK,GAAY,EAAE,CAAC;IAC1B,IAAI,CAAC,GAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC9D,IAAI,KAAK,GAAG,IAAI,CAAC;IACjB,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC;QACzB,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,IAAI,KAAK,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;gBACvB,KAAK,GAAG,IAAI,CAAC;gBACb,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;gBACjB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YACrD,CAAC;iBAAM,IAAI,KAAK,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;gBAC9B,sFAAsF;gBACtF,wEAAwE;gBACxE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;gBACnG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YACrD,CAAC;iBAAM,IAAI,KAAK,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;gBAC9B,CAAC,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YACpE,CAAC;iBAAM,IAAI,KAAK,CAAC,IAAI,KAAK,GAAG,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBACjE,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YAC5C,CAAC;YACD,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QAC1D,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YAChC,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;gBAAE,MAAM,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,GAAG,KAAK,CAAC;YACd,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,MAAM,CAAC,kBAAkB,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,IAAI,KAAK,MAAM;YAAE,MAAM,CAAC,4DAA4D,CAAC,CAAC;QAC1F,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;YACb,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,SAAS;YAChE,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC3B,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;gBAC5D,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC;oBAAE,MAAM,CAAC,8BAA8B,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;YACtF,CAAC;iBAAM,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACpC,MAAM,CAAC,uBAAuB,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;YAC/C,CAAC;iBAAM,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;gBAC9C,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,mCAAmC,CAAC,CAAC;YAC5D,CAAC;YACD,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC5C,CAAC;aAAM,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YAC9C,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QACtD,CAAC;aAAM,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YAC3B,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QACtD,CAAC;aAAM,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAC9C,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QACxD,CAAC;aAAM,IAAI,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACjD,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC9B,CAAC;QACD,IAAI,GAAG,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,GAAc,EAAE,MAA2B;IACrE,IAAI,IAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,IAAI,GAAG,GAAG,CAAC,KAAK,CAAmB,qCAAqC,CAAC,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAChF,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,aAAa,CACjB,qBAAqB,EACrB,2BAA2B,MAAM,wEAAwE,CAC1G,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,GAAc;IAClC,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAA2B,6CAA6C,CAAC,CAAC,CAAC,CAAC,CAAC;IAClG,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;AACtD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,QAAQ,CAAC;AAEjD;;;;;;;;GAQG;AACH,SAAS,kBAAkB,CAAC,GAAc,EAAE,GAAW;IACrD,IAAI,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,eAAe,GAAG,IAAI,GAAG,oCAAoC,CAAC,CAAC;IAC1E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,aAAa,CACjB,qBAAqB,EACrB,yEAAyE,wBAAwB,MAAM;YACrG,qCAAqC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,wBAAwB,CAChH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,uFAAuF;AACvF,MAAM,KAAK,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,mBAAmB,CAAC,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,kBAAkB,CAAC,CAAC;AAElH;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAUvC;IACC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,KAAK,CAAC;IAC5C,MAAM,GAAG,GAAwB,EAAE,YAAY,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE,CAAC;IAC3F,6FAA6F;IAC7F,4DAA4D;IAC5D,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IAC1G,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC;QAC5C,kBAAkB,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED,uFAAuF;IACvF,wFAAwF;IACxF,4FAA4F;IAC5F,2FAA2F;IAC3F,yFAAyF;IACzF,oFAAoF;IACpF,2FAA2F;IAC3F,yFAAyF;IACzF,wFAAwF;IACxF,MAAM,SAAS,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACtC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;QAC/B,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC3B,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,MAAM,GAAG,CAAC,KAAa,EAAQ,EAAE;QACrC,KAAK,MAAM,GAAG,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;YAC3D,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC/B,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC7B,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;IACH,CAAC,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;YAC/C,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAChC,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;gBACrF,SAAS;YACX,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;gBAAE,SAAS;YACvC,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAClC,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACpD,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;YAClE,MAAM,aAAa,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACpD,+EAA+E;YAC/E,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YACrD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACjD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC;YAC1C,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;YACpG,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,GAAG,aAAa,EAAE,GAAG,MAAM,CAAC,CAAC;YACxE,uFAAuF;YACvF,qCAAqC;YACrC,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;YACnD,IAAI,IAAI,GAAG,CAAC,CAAC;YACb,IAAI,CAAC,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,iBAAiB,KAAK,UAAU,MAAM,UAAU,EAAE,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC/F,MAAM,CAAC,KAAK,CAAC,CAAC;gBACd,IAAI,QAAQ,EAAE,CAAC;oBACb,GAAG,CAAC,IAAI,CAAC,eAAe,KAAK,UAAU,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;gBAC3D,CAAC;qBAAM,CAAC;oBACN,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,MAAM,EAAE,EAAE,CAAC,GAAG,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC;gBACpH,CAAC;gBACD,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;YACnC,CAAC;YACD,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3G,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;IACtD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,SAAS;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC;QAC3B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,uFAAuF;QACvF,uFAAuF;QACvF,wFAAwF;QACxF,8CAA8C;QAC9C,IAAI,IAAI,GAAG,IAAI,CAAC;QAChB,MAAM,KAAK,GAAG,GAAS,EAAE;YACvB,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,aAAa,CACjB,WAAW,EACX,GAAG,IAAI,CAAC,QAAQ,iGAAiG,EACjH,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAC9B,CAAC;YACJ,CAAC;QACH,CAAC,CAAC;QACF,uFAAuF;QACvF,gFAAgF;QAChF,IAAI,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;QACpC,MAAM,OAAO,GAAc;YACzB,KAAK,EAAE,CAA+B,SAAiB,EAAE,MAA4B,EAAO,EAAE;gBAC5F,KAAK,EAAE,CAAC;gBACR,wBAAwB,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;gBACxD,OAAO,OAAO,CAAC,KAAK,CAAI,SAAS,EAAE,MAAM,CAAC,CAAC;YAC7C,CAAC;YACD,IAAI,EAAE,CAAC,SAAiB,EAAE,MAA4B,EAAE,EAAE;gBACxD,KAAK,EAAE,CAAC;gBACR,wBAAwB,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;gBACxD,wFAAwF;gBACxF,KAAK,MAAM,CAAC,IAAI,GAAG;oBAAE,MAAM,CAAC,CAAC,CAAC,CAAC;gBAC/B,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;gBAChC,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;gBAChC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;gBAC1D,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;gBACpB,IAAI,IAAI,OAAO,CAAC;gBAChB,OAAO,EAAE,OAAO,EAAE,CAAC;YACrB,CAAC;SACF,CAAC;QACF,MAAM,GAAG,GAA0B;YACjC,GAAG,EAAE,OAAO;YACZ,GAAG,EAAE,GAAG,EAAE;gBACR,KAAK,EAAE,CAAC;gBACR,OAAO,EAAE,CAAC;YACZ,CAAC;SACF,CAAC;QACF,IAAI,QAAiB,CAAC;QACtB,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QAC3C,CAAC;gBAAS,CAAC;YACT,IAAI,GAAG,KAAK,CAAC;QACf,CAAC;QACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,2FAA2F;YAC3F,yFAAyF;YACzF,0FAA0F;YAC1F,2FAA2F;YAC3F,0FAA0F;YAC1F,uBAAuB;YACvB,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAQ,QAA+B,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBACpF,QAA6B,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAClE,CAAC;YACD,MAAM,aAAa,CACjB,qBAAqB,EACrB,GAAG,IAAI,CAAC,QAAQ,mFAAmF;gBACjG,0FAA0F,CAC7F,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,OAAO;QAAE,GAAG,CAAC,IAAI,CAAC,eAAe,GAAG,IAAI,GAAG,oCAAoC,CAAC,CAAC;IACnG,OAAO,GAAG,CAAC;AACb,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,gBAAgB,CAAC,MAA2B;IAC1D,OAAO,CAAC,GAAG,MAAM,CAAC,YAAY,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AACtF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;AAC1G,CAAC"}