@substrat-run/kernel 0.138.0 → 0.140.0

package/dist/module-migrations.d.ts

@@ -1,11 +1,13 @@
+import type { EntityStateDeclaration } from '@substrat-run/contracts';
 import { type ListDeclaration } from './list-index.js';
 import { type SearchableDeclaration } from './search-index.js';
 import type { SqlMigration } from './scope-host.js';
 /**
  * Every migration a module's scope applies, in the order the host applies them: the module's
- * own `migrations`, then the search indexes its `searchables` declare (#827), then the list
- * indexes its `lists` declare (#811). The two derived sets come after the authored ones because
- * their DDL names the tables those create.
+ * own `migrations`, then the search indexes its `searchables` declare (#827), then the archive and
+ * trash columns its `entityStates` declare (#119), then the list indexes its `lists` declare
+ * (#811). The derived sets come after the authored ones because their DDL names the tables those
+ * create, and the columns come before the list indexes because a partial index names them.
  *
  * The one place that order is written. Both hosts store what this returns as a module's
  * migrations, and `substrat push` calls it (from the vertical's own kernel) to carry the SQL a
@@ -20,6 +22,7 @@ export declare function moduleMigrations(registration: {
         readonly id: string;
         readonly searchables?: readonly SearchableDeclaration[];
         readonly lists?: readonly ListDeclaration[];
+        readonly entityStates?: readonly EntityStateDeclaration[];
     };
     readonly migrations?: readonly SqlMigration[];
 }): SqlMigration[];

package/dist/module-migrations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module-migrations.d.ts","sourceRoot":"","sources":["../src/module-migrations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,KAAK,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAC5E,OAAO,EAAyB,KAAK,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AACtF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAEpD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,EAAE;IAC7C,QAAQ,CAAC,QAAQ,EAAE;QACjB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAC;QACxD,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;KAC7C,CAAC;IACF,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;CAC/C,GAAG,YAAY,EAAE,CAGjB"}
+{"version":3,"file":"module-migrations.d.ts","sourceRoot":"","sources":["../src/module-migrations.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAEtE,OAAO,EAAuB,KAAK,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAC5E,OAAO,EAAyB,KAAK,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AACtF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAEpD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,EAAE;IAC7C,QAAQ,CAAC,QAAQ,EAAE;QACjB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAC;QACxD,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;QAC5C,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,sBAAsB,EAAE,CAAC;KAC3D,CAAC;IACF,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;CAC/C,GAAG,YAAY,EAAE,CAQjB"}

package/dist/module-migrations.js

@@ -1,10 +1,12 @@
+import { entityStateMigrations } from './entity-state.js';
 import { listIndexMigrations } from './list-index.js';
 import { searchIndexMigrations } from './search-index.js';
 /**
  * Every migration a module's scope applies, in the order the host applies them: the module's
- * own `migrations`, then the search indexes its `searchables` declare (#827), then the list
- * indexes its `lists` declare (#811). The two derived sets come after the authored ones because
- * their DDL names the tables those create.
+ * own `migrations`, then the search indexes its `searchables` declare (#827), then the archive and
+ * trash columns its `entityStates` declare (#119), then the list indexes its `lists` declare
+ * (#811). The derived sets come after the authored ones because their DDL names the tables those
+ * create, and the columns come before the list indexes because a partial index names them.
  *
  * The one place that order is written. Both hosts store what this returns as a module's
  * migrations, and `substrat push` calls it (from the vertical's own kernel) to carry the SQL a
@@ -15,7 +17,12 @@ import { searchIndexMigrations } from './search-index.js';
  * Structural, so a `ModuleRegistration` fits and so does a module read back as data.
  */
 export function moduleMigrations(registration) {
-    const { id, searchables, lists } = registration.manifest;
-    return [...(registration.migrations ?? []), ...searchIndexMigrations(id, searchables), ...listIndexMigrations(id, lists)];
+    const { id, searchables, lists, entityStates } = registration.manifest;
+    return [
+        ...(registration.migrations ?? []),
+        ...searchIndexMigrations(id, searchables),
+        ...entityStateMigrations(id, entityStates),
+        ...listIndexMigrations(id, lists, entityStates),
+    ];
 }
 //# sourceMappingURL=module-migrations.js.map

package/dist/module-migrations.js.map

@@ -1 +1 @@
-{"version":3,"file":"module-migrations.js","sourceRoot":"","sources":["../src/module-migrations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAwB,MAAM,iBAAiB,CAAC;AAC5E,OAAO,EAAE,qBAAqB,EAA8B,MAAM,mBAAmB,CAAC;AAGtF;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB,CAAC,YAOhC;IACC,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,YAAY,CAAC,QAAQ,CAAC;IACzD,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,GAAG,qBAAqB,CAAC,EAAE,EAAE,WAAW,CAAC,EAAE,GAAG,mBAAmB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;AAC5H,CAAC"}
+{"version":3,"file":"module-migrations.js","sourceRoot":"","sources":["../src/module-migrations.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAwB,MAAM,iBAAiB,CAAC;AAC5E,OAAO,EAAE,qBAAqB,EAA8B,MAAM,mBAAmB,CAAC;AAGtF;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,gBAAgB,CAAC,YAQhC;IACC,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,YAAY,CAAC,QAAQ,CAAC;IACvE,OAAO;QACL,GAAG,CAAC,YAAY,CAAC,UAAU,IAAI,EAAE,CAAC;QAClC,GAAG,qBAAqB,CAAC,EAAE,EAAE,WAAW,CAAC;QACzC,GAAG,qBAAqB,CAAC,EAAE,EAAE,YAAY,CAAC;QAC1C,GAAG,mBAAmB,CAAC,EAAE,EAAE,KAAK,EAAE,YAAY,CAAC;KAChD,CAAC;AACJ,CAAC"}

package/dist/peer.d.ts

@@ -36,9 +36,11 @@
  * way `getConnectorScope` trusts the connection id the control plane hands it. The door's own
  * guarantees are the ones above; the caller's liveness and tenancy are the platform's gate.
  */
-import { type CheckSubject, type PeerSpec, type Scope, type TenantId, type VerticalCaller, type VerticalResolution } from '@substrat-run/contracts';
+import { type CheckSubject, type PeerSpec, type Scope, type TenantId, type ScopeId, type PeerInstanceResolution, type VerticalCaller, type VerticalResolution } from '@substrat-run/contracts';
 import { PEER_SUBJECT_PREFIX, peerSubjectRef, type SwitchOutcome, type SwitchSql } from './system-switch.js';
 export { PEER_SUBJECT_PREFIX, peerSubjectRef };
+/** Directory-owned, on both adapters. The row survives a target's lifecycle changes. */
+export declare const PEER_BINDINGS_DDL = "\n  CREATE TABLE IF NOT EXISTS peer_bindings (\n    tenant_id TEXT NOT NULL,\n    caller_scope_id TEXT NOT NULL,\n    vertical TEXT NOT NULL,\n    target_scope_id TEXT NOT NULL,\n    invalidated INTEGER NOT NULL DEFAULT 0,\n    PRIMARY KEY (tenant_id, caller_scope_id, vertical)\n  );\n  CREATE INDEX IF NOT EXISTS peer_bindings_target ON peer_bindings (target_scope_id);\n";
 /** One peer vertical as every registered module declares it, together. */
 export interface PeerDeclaration {
     readonly vertical: string;
@@ -134,4 +136,10 @@ export type VerticalInstanceCandidate = Pick<Scope, 'id' | 'tenantId' | 'vertica
  * names a tenant, so a cross-tenant answer is not reachable from here.
  */
 export declare function resolveVerticalInstanceFrom(scopes: Iterable<VerticalInstanceCandidate>, tenantId: TenantId, vertical: string): VerticalResolution;
+/**
+ * Resolve a peer call using the tenant's explicit choice, if any. Every caller of this rule
+ * supplies only scopes read from its own tenant; the predicate checks tenant and vertical again
+ * so a corrupt or forged binding cannot turn a foreign scope into a destination.
+ */
+export declare function resolvePeerInstanceFrom(scopes: Iterable<VerticalInstanceCandidate>, tenantId: TenantId, vertical: string, boundScopeId: ScopeId | null, invalidated?: boolean): PeerInstanceResolution;
 //# sourceMappingURL=peer.d.ts.map

package/dist/peer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"peer.d.ts","sourceRoot":"","sources":["../src/peer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,OAAO,EAEL,KAAK,YAAY,EACjB,KAAK,QAAQ,EACb,KAAK,KAAK,EACV,KAAK,QAAQ,EACb,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACxB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,mBAAmB,EAEnB,cAAc,EAId,KAAK,aAAa,EAClB,KAAK,SAAS,EACf,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,CAAC;AAG/C,0EAA0E;AAC1E,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,2DAA2D;IAC3D,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACzC,6DAA6D;IAC7D,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC3C;AACD,MAAM,MAAM,gBAAgB,GAAG,WAAW,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;AAEpE;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,QAAQ,CAAC;IAAE,KAAK,CAAC,EAAE,SAAS,QAAQ,EAAE,CAAA;CAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAe/G;AAED,iFAAiF;AACjF,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,GAAG,QAAQ,EAAE,CAQ9E;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CACvB,EAAE,EAAE,SAAS,EACb,KAAK,EAAE,gBAAgB,EACvB,MAAM,EAAE,cAAc,EACtB,SAAS,EAAE,MAAM,GAAG,IAAI,GACvB,YAAY,CAuBd;AAED;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CACxB,EAAE,EAAE,SAAS,EACb,KAAK,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,IAAI,GAAG,KAAK,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/G,aAAa,CAGf;AAED,sDAAsD;AACtD,wBAAgB,eAAe,CAAC,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAExE;AAED,+EAA+E;AAC/E,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,IAAI,GAAG,KAAK,GAAG,WAAW,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,aAAa,EAAE,CAW5E;AAED,8DAA8D;AAC9D,MAAM,MAAM,yBAAyB,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,GAAG,UAAU,GAAG,UAAU,GAAG,QAAQ,GAAG,MAAM,GAAG,YAAY,CAAC,CAAC;AAEvH;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,QAAQ,CAAC,yBAAyB,CAAC,EAC3C,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,MAAM,GACf,kBAAkB,CAapB"}
+{"version":3,"file":"peer.d.ts","sourceRoot":"","sources":["../src/peer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,OAAO,EAEL,KAAK,YAAY,EACjB,KAAK,QAAQ,EACb,KAAK,KAAK,EACV,KAAK,QAAQ,EACb,KAAK,OAAO,EACZ,KAAK,sBAAsB,EAC3B,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACxB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,mBAAmB,EAEnB,cAAc,EAId,KAAK,aAAa,EAClB,KAAK,SAAS,EACf,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,CAAC;AAE/C,wFAAwF;AACxF,eAAO,MAAM,iBAAiB,0XAU7B,CAAC;AAEF,0EAA0E;AAC1E,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,2DAA2D;IAC3D,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACzC,6DAA6D;IAC7D,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC3C;AACD,MAAM,MAAM,gBAAgB,GAAG,WAAW,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;AAEpE;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,QAAQ,CAAC;IAAE,KAAK,CAAC,EAAE,SAAS,QAAQ,EAAE,CAAA;CAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAe/G;AAED,iFAAiF;AACjF,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,GAAG,QAAQ,EAAE,CAQ9E;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CACvB,EAAE,EAAE,SAAS,EACb,KAAK,EAAE,gBAAgB,EACvB,MAAM,EAAE,cAAc,EACtB,SAAS,EAAE,MAAM,GAAG,IAAI,GACvB,YAAY,CAuBd;AAED;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CACxB,EAAE,EAAE,SAAS,EACb,KAAK,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,IAAI,GAAG,KAAK,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/G,aAAa,CAGf;AAED,sDAAsD;AACtD,wBAAgB,eAAe,CAAC,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAExE;AAED,+EAA+E;AAC/E,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,IAAI,GAAG,KAAK,GAAG,WAAW,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,aAAa,EAAE,CAW5E;AAED,8DAA8D;AAC9D,MAAM,MAAM,yBAAyB,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,GAAG,UAAU,GAAG,UAAU,GAAG,QAAQ,GAAG,MAAM,GAAG,YAAY,CAAC,CAAC;AAEvH;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,QAAQ,CAAC,yBAAyB,CAAC,EAC3C,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,MAAM,GACf,kBAAkB,CAapB;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,QAAQ,CAAC,yBAAyB,CAAC,EAC3C,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,OAAO,GAAG,IAAI,EAC5B,WAAW,UAAQ,GAClB,sBAAsB,CAWxB"}

package/dist/peer.js

@@ -40,6 +40,18 @@ import { substratError, } from '@substrat-run/contracts';
 import { isPrimaryScope } from './platform-sweep.js';
 import { PEER_SUBJECT_PREFIX, SYSTEM_SWITCH_OFF_RELATION, peerSubjectRef, subjectGrantState, subjectSwitchedOff, moveSwitch, } from './system-switch.js';
 export { PEER_SUBJECT_PREFIX, peerSubjectRef };
+/** Directory-owned, on both adapters. The row survives a target's lifecycle changes. */
+export const PEER_BINDINGS_DDL = `
+  CREATE TABLE IF NOT EXISTS peer_bindings (
+    tenant_id TEXT NOT NULL,
+    caller_scope_id TEXT NOT NULL,
+    vertical TEXT NOT NULL,
+    target_scope_id TEXT NOT NULL,
+    invalidated INTEGER NOT NULL DEFAULT 0,
+    PRIMARY KEY (tenant_id, caller_scope_id, vertical)
+  );
+  CREATE INDEX IF NOT EXISTS peer_bindings_target ON peer_bindings (target_scope_id);
+`;
 /**
  * The union of every module's `peers` declaration, keyed by peer slug. Two modules naming one
  * peer contribute both of their allowlists and both of their key sets: each module speaks for
@@ -173,4 +185,21 @@ export function resolveVerticalInstanceFrom(scopes, tenantId, vertical) {
         return { outcome: 'not-installed', tenantId, vertical };
     return { outcome: 'ambiguous', tenantId, vertical, count: matches.length };
 }
+/**
+ * Resolve a peer call using the tenant's explicit choice, if any. Every caller of this rule
+ * supplies only scopes read from its own tenant; the predicate checks tenant and vertical again
+ * so a corrupt or forged binding cannot turn a foreign scope into a destination.
+ */
+export function resolvePeerInstanceFrom(scopes, tenantId, vertical, boundScopeId, invalidated = false) {
+    const candidates = [...scopes];
+    if (boundScopeId === null)
+        return resolveVerticalInstanceFrom(candidates, tenantId, vertical);
+    if (invalidated)
+        return { outcome: 'bound-unavailable', tenantId, vertical, targetScopeId: boundScopeId };
+    const target = candidates.find((scope) => scope.id === boundScopeId && scope.tenantId === tenantId && scope.vertical === vertical &&
+        scope.status === 'active' && isPrimaryScope(scope));
+    return target
+        ? { outcome: 'resolved', instance: { tenantId, scopeId: target.id, vertical } }
+        : { outcome: 'bound-unavailable', tenantId, vertical, targetScopeId: boundScopeId };
+}
 //# sourceMappingURL=peer.js.map

package/dist/peer.js.map

@@ -1 +1 @@
-{"version":3,"file":"peer.js","sourceRoot":"","sources":["../src/peer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,OAAO,EACL,aAAa,GAOd,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,cAAc,EACd,iBAAiB,EACjB,kBAAkB,EAClB,UAAU,GAGX,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,CAAC;AAa/C;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,SAAoD;IAC/E,MAAM,GAAG,GAAG,IAAI,GAAG,EAAmF,CAAC;IACvG,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI;gBACtC,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,UAAU,EAAE,IAAI,GAAG,EAAU;gBAC7B,WAAW,EAAE,IAAI,GAAG,EAAU;aAC/B,CAAC;YACF,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,UAAU;gBAAE,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC3D,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,WAAW;gBAAE,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AASD;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,KAAuB,EAAE,OAAe;IAChE,MAAM,GAAG,GAAe,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC5F,KAAK,MAAM,UAAU,IAAI,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACtD,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,WAAW,UAAU,EAAE,EAAE,MAAM,EAAE,SAAS,OAAO,EAAE,EAAE,CAAC,CAAC;QACtH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS,CACvB,EAAa,EACb,KAAuB,EACvB,MAAsB,EACtB,SAAwB;IAExB,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,aAAa,CACjB,WAAW,EACX,aAAa,MAAM,CAAC,QAAQ,oEAAoE;YAC9F,8EAA8E,CACjF,CAAC;IACJ,CAAC;IACD,IAAI,kBAAkB,CAAC,EAAE,EAAE,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC5D,MAAM,aAAa,CACjB,WAAW,EACX,aAAa,MAAM,CAAC,QAAQ,kEAAkE,CAC/F,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9D,MAAM,aAAa,CACjB,WAAW,EACX,aAAa,MAAM,CAAC,QAAQ,qBAAqB,SAAS,qCAAqC;YAC7F,iDAAiD,CACpD,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;AACxE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CACxB,EAAa,EACb,KAAgH;IAEhH,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;IACpC,OAAO,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,eAAe,CAAC,EAAa,EAAE,QAAgB;IAC7D,OAAO,kBAAkB,CAAC,EAAE,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC1D,CAAC;AAQD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAAa,EAAE,GAAW;IACzD,MAAM,IAAI,GAAG,EAAE,CAAC,GAAG,CACjB;iCAC6B,mBAAmB,CAAC,MAAM,QAAQ,mBAAmB;kEACpB,0BAA0B;uBACrE,CACK,CAAC;IAC3B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACtB,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAC/D,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,iBAAiB,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;IACtE,CAAC,CAAC,CAAC;AACL,CAAC;AAKD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,2BAA2B,CACzC,MAA2C,EAC3C,QAAkB,EAClB,QAAgB;IAEhB,MAAM,OAAO,GAAgC,EAAE,CAAC;IAChD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ;YAAE,SAAS;QACzE,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC;YAAE,SAAS;QAClE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC;IACvB,IAAI,IAAI,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC;IACpG,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IAClF,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;AAC7E,CAAC"}
+{"version":3,"file":"peer.js","sourceRoot":"","sources":["../src/peer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,OAAO,EACL,aAAa,GASd,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,cAAc,EACd,iBAAiB,EACjB,kBAAkB,EAClB,UAAU,GAGX,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,CAAC;AAE/C,wFAAwF;AACxF,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;CAUhC,CAAC;AAYF;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,SAAoD;IAC/E,MAAM,GAAG,GAAG,IAAI,GAAG,EAAmF,CAAC;IACvG,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI;gBACtC,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,UAAU,EAAE,IAAI,GAAG,EAAU;gBAC7B,WAAW,EAAE,IAAI,GAAG,EAAU;aAC/B,CAAC;YACF,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,UAAU;gBAAE,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC3D,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,WAAW;gBAAE,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AASD;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,KAAuB,EAAE,OAAe;IAChE,MAAM,GAAG,GAAe,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC5F,KAAK,MAAM,UAAU,IAAI,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACtD,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,WAAW,UAAU,EAAE,EAAE,MAAM,EAAE,SAAS,OAAO,EAAE,EAAE,CAAC,CAAC;QACtH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS,CACvB,EAAa,EACb,KAAuB,EACvB,MAAsB,EACtB,SAAwB;IAExB,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,aAAa,CACjB,WAAW,EACX,aAAa,MAAM,CAAC,QAAQ,oEAAoE;YAC9F,8EAA8E,CACjF,CAAC;IACJ,CAAC;IACD,IAAI,kBAAkB,CAAC,EAAE,EAAE,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC5D,MAAM,aAAa,CACjB,WAAW,EACX,aAAa,MAAM,CAAC,QAAQ,kEAAkE,CAC/F,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9D,MAAM,aAAa,CACjB,WAAW,EACX,aAAa,MAAM,CAAC,QAAQ,qBAAqB,SAAS,qCAAqC;YAC7F,iDAAiD,CACpD,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;AACxE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CACxB,EAAa,EACb,KAAgH;IAEhH,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;IACpC,OAAO,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,eAAe,CAAC,EAAa,EAAE,QAAgB;IAC7D,OAAO,kBAAkB,CAAC,EAAE,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC1D,CAAC;AAQD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAAa,EAAE,GAAW;IACzD,MAAM,IAAI,GAAG,EAAE,CAAC,GAAG,CACjB;iCAC6B,mBAAmB,CAAC,MAAM,QAAQ,mBAAmB;kEACpB,0BAA0B;uBACrE,CACK,CAAC;IAC3B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACtB,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAC/D,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,iBAAiB,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;IACtE,CAAC,CAAC,CAAC;AACL,CAAC;AAKD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,2BAA2B,CACzC,MAA2C,EAC3C,QAAkB,EAClB,QAAgB;IAEhB,MAAM,OAAO,GAAgC,EAAE,CAAC;IAChD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ;YAAE,SAAS;QACzE,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC;YAAE,SAAS;QAClE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC;IACvB,IAAI,IAAI,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC;IACpG,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IAClF,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;AAC7E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAA2C,EAC3C,QAAkB,EAClB,QAAgB,EAChB,YAA4B,EAC5B,WAAW,GAAG,KAAK;IAEnB,MAAM,UAAU,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;IAC/B,IAAI,YAAY,KAAK,IAAI;QAAE,OAAO,2BAA2B,CAAC,UAAU,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC9F,IAAI,WAAW;QAAE,OAAO,EAAE,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;IAC1G,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CACvC,KAAK,CAAC,EAAE,KAAK,YAAY,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ;QACvF,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,cAAc,CAAC,KAAK,CAAC,CACnD,CAAC;IACF,OAAO,MAAM;QACX,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE;QAC/E,CAAC,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;AACxF,CAAC"}

package/dist/permission-checker.d.ts

@@ -1,4 +1,5 @@
 import { SubstratError, type Actor, type Coverage, type Decision, type EntityRef, type Node, type PermissionKey, type CheckSubject, type PrincipalId } from '@substrat-run/contracts';
+import type { GrantedEntitiesPage } from './grant-scoped-read.js';
 /**
  * The evaluation seam (D-16): the MODEL is kernel-owned, the evaluation engine
  * is an adapter — the built-in default is a constrained relationship-tuple
@@ -16,6 +17,11 @@ export interface PermissionChecker {
      * caller passes `{ kind: 'principal', id }` and behaves exactly as before.
      */
     check(subject: CheckSubject, permission: PermissionKey, node: Node, entity?: EntityRef): Promise<Decision>;
+    /** Optional for a pluggable checker; an absent implementation is reported as incomplete. */
+    grantedEntities?(subject: CheckSubject, permission: PermissionKey, node: Node, entityType: string, checkEntity: (entity: EntityRef) => Promise<boolean>, options?: {
+        limit?: number;
+        cursor?: string;
+    }): Promise<GrantedEntitiesPage>;
     /**
      * Does `subject` already hold every one of `required` at `node`? (K-21,
      * membership.md §5.1.)

package/dist/permission-checker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permission-checker.d.ts","sourceRoot":"","sources":["../src/permission-checker.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,aAAa,EACb,KAAK,KAAK,EACV,KAAK,QAAQ,EACb,KAAK,QAAQ,EACb,KAAK,SAAS,EACd,KAAK,IAAI,EACT,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,WAAW,EACjB,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,KAAK,CACH,OAAO,EAAE,YAAY,EACrB,UAAU,EAAE,aAAa,EACzB,IAAI,EAAE,IAAI,EACV,MAAM,CAAC,EAAE,SAAS,GACjB,OAAO,CAAC,QAAQ,CAAC,CAAC;IACrB;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,MAAM,CACJ,OAAO,EAAE,YAAY,EACrB,QAAQ,EAAE,SAAS,aAAa,EAAE,EAClC,IAAI,EAAE,IAAI,GACT,OAAO,CAAC,QAAQ,CAAC,CAAC;CACtB;AAUD,eAAO,MAAM,gBAAgB,YAAa,MAAM,KAAG,aAAwE,CAAC;AAC5H,eAAO,MAAM,kBAAkB,QAAS,OAAO,WAAW,MAAM,KAAG,OACsC,CAAC;AAE1G,sDAAsD;AACtD,eAAO,MAAM,WAAW,OAAQ,WAAW,KAAG,YAA2C,CAAC;AAE1F;;;;;GAKG;AACH,eAAO,MAAM,OAAO,YAAa,YAAY,KAAG,KAc/C,CAAC;AAEF;;;;;;GAMG;AACH,qBAAa,gBAAiB,SAAQ,aAAa;IACjD,QAAQ,CAAC,UAAU,CAAC,EAAE,aAAa,CAAC;IACpC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC;IACrB,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE;QAAE,UAAU,EAAE,aAAa,CAAC;QAAC,IAAI,EAAE,IAAI,CAAA;KAAE,EAS9E;CACF;AAED,sFAAsF;AACtF,wBAAgB,aAAa,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAC5E,QAAQ,EACR;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,CAClB,CAOA;AAED,4FAA4F;AAC5F,eAAO,MAAM,cAAc,EAAE,iBAa5B,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAgBpC,CAAC"}
+{"version":3,"file":"permission-checker.d.ts","sourceRoot":"","sources":["../src/permission-checker.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,aAAa,EACb,KAAK,KAAK,EACV,KAAK,QAAQ,EACb,KAAK,QAAQ,EACb,KAAK,SAAS,EACd,KAAK,IAAI,EACT,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,WAAW,EACjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAElE;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,KAAK,CACH,OAAO,EAAE,YAAY,EACrB,UAAU,EAAE,aAAa,EACzB,IAAI,EAAE,IAAI,EACV,MAAM,CAAC,EAAE,SAAS,GACjB,OAAO,CAAC,QAAQ,CAAC,CAAC;IACrB,4FAA4F;IAC5F,eAAe,CAAC,CACd,OAAO,EAAE,YAAY,EACrB,UAAU,EAAE,aAAa,EACzB,IAAI,EAAE,IAAI,EACV,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,CAAC,MAAM,EAAE,SAAS,KAAK,OAAO,CAAC,OAAO,CAAC,EACpD,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAC5C,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAChC;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,MAAM,CACJ,OAAO,EAAE,YAAY,EACrB,QAAQ,EAAE,SAAS,aAAa,EAAE,EAClC,IAAI,EAAE,IAAI,GACT,OAAO,CAAC,QAAQ,CAAC,CAAC;CACtB;AAUD,eAAO,MAAM,gBAAgB,YAAa,MAAM,KAAG,aAAwE,CAAC;AAC5H,eAAO,MAAM,kBAAkB,QAAS,OAAO,WAAW,MAAM,KAAG,OACsC,CAAC;AAE1G,sDAAsD;AACtD,eAAO,MAAM,WAAW,OAAQ,WAAW,KAAG,YAA2C,CAAC;AAE1F;;;;;GAKG;AACH,eAAO,MAAM,OAAO,YAAa,YAAY,KAAG,KAc/C,CAAC;AAEF;;;;;;GAMG;AACH,qBAAa,gBAAiB,SAAQ,aAAa;IACjD,QAAQ,CAAC,UAAU,CAAC,EAAE,aAAa,CAAC;IACpC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC;IACrB,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE;QAAE,UAAU,EAAE,aAAa,CAAC;QAAC,IAAI,EAAE,IAAI,CAAA;KAAE,EAS9E;CACF;AAED,sFAAsF;AACtF,wBAAgB,aAAa,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAC5E,QAAQ,EACR;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,CAClB,CAOA;AAED,4FAA4F;AAC5F,eAAO,MAAM,cAAc,EAAE,iBAa5B,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAgBpC,CAAC"}

package/dist/permission-checker.js.map

@@ -1 +1 @@
-{"version":3,"file":"permission-checker.js","sourceRoot":"","sources":["../src/permission-checker.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,SAAS,EACT,aAAa,EACb,aAAa,GASd,MAAM,yBAAyB,CAAC;AAyDjC;;;;;;GAMG;AACH,MAAM,kBAAkB,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,gCAAgC,OAAO,EAAE,CAAC;AAClG,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAAe,EAAiB,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;AAC5H,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAY,EAAE,OAAe,EAAW,EAAE,CAC3E,GAAG,YAAY,KAAK,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,WAAW,IAAI,GAAG,CAAC,OAAO,KAAK,kBAAkB,CAAC,OAAO,CAAC,CAAC;AAE1G,sDAAsD;AACtD,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,EAAe,EAAgB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;AAE1F;;;;;GAKG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,OAAqB,EAAS,EAAE;IACtD,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,WAAW;YACd,OAAO,OAAO,CAAC,EAAE,CAAC;QACpB,KAAK,QAAQ;YACX,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;QAChC,KAAK,YAAY;YACf,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;QACpC,KAAK,YAAY;YACf,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;QACpC,KAAK,UAAU;YACb,+EAA+E;YAC/E,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;IAC1D,CAAC;AACH,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,OAAO,gBAAiB,SAAQ,aAAa;IACxC,UAAU,CAAiB;IAC3B,IAAI,CAAQ;IACrB,YAAY,OAAe,EAAE,MAAkD;QAC7E,KAAK,CAAC,mBAAmB,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrF,kFAAkF;QAClF,kFAAkF;QAClF,8EAA8E;QAC9E,2EAA2E;QAC3E,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,UAAU,GAAG,MAAM,EAAE,UAAU,CAAC;QACrC,IAAI,CAAC,IAAI,GAAG,MAAM,EAAE,IAAI,CAAC;IAC3B,CAAC;CACF;AAED,sFAAsF;AACtF,MAAM,UAAU,aAAa,CAAC,QAAkB;IAI9C,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,MAAM,IAAI,gBAAgB,CAAC,sBAAsB,QAAQ,CAAC,OAAO,EAAE,EAAE;YACnE,UAAU,EAAE,QAAQ,CAAC,OAAO;YAC5B,IAAI,EAAE,QAAQ,CAAC,IAAI;SACpB,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,MAAM,cAAc,GAAsB;IAC/C,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAC9C,OAAO,EAAE,KAAK;QACd,OAAO,EAAE,UAAU;QACnB,IAAI;KACL,CAAC;IACF,sFAAsF;IACtF,kFAAkF;IAClF,kFAAkF;IAClF,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,CACnC,QAAQ,CAAC,MAAM,KAAK,CAAC;QACnB,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE;QAChC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE;CACjD,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAsB;IACvD,oFAAoF;IACpF,uEAAuE;IACvE,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACpD,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAC7C,OAAO,EAAE,IAAI;QACb,KAAK,EAAE;YACL;gBACE,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,aAAa,SAAS,EAAE,CAAC;gBAClD,QAAQ,EAAE,WAAW,UAAU,EAAE;gBACjC,MAAM,EAAE,SAAS,CAAC,KAAK,CACrB,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,QAAQ,EAAE,CACnE;aACF;SACF;KACF,CAAC;CACH,CAAC"}
+{"version":3,"file":"permission-checker.js","sourceRoot":"","sources":["../src/permission-checker.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,SAAS,EACT,aAAa,EACb,aAAa,GASd,MAAM,yBAAyB,CAAC;AAmEjC;;;;;;GAMG;AACH,MAAM,kBAAkB,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,gCAAgC,OAAO,EAAE,CAAC;AAClG,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAAe,EAAiB,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;AAC5H,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAY,EAAE,OAAe,EAAW,EAAE,CAC3E,GAAG,YAAY,KAAK,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,WAAW,IAAI,GAAG,CAAC,OAAO,KAAK,kBAAkB,CAAC,OAAO,CAAC,CAAC;AAE1G,sDAAsD;AACtD,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,EAAe,EAAgB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;AAE1F;;;;;GAKG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,OAAqB,EAAS,EAAE;IACtD,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,WAAW;YACd,OAAO,OAAO,CAAC,EAAE,CAAC;QACpB,KAAK,QAAQ;YACX,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;QAChC,KAAK,YAAY;YACf,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;QACpC,KAAK,YAAY;YACf,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;QACpC,KAAK,UAAU;YACb,+EAA+E;YAC/E,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;IAC1D,CAAC;AACH,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,OAAO,gBAAiB,SAAQ,aAAa;IACxC,UAAU,CAAiB;IAC3B,IAAI,CAAQ;IACrB,YAAY,OAAe,EAAE,MAAkD;QAC7E,KAAK,CAAC,mBAAmB,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrF,kFAAkF;QAClF,kFAAkF;QAClF,8EAA8E;QAC9E,2EAA2E;QAC3E,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,UAAU,GAAG,MAAM,EAAE,UAAU,CAAC;QACrC,IAAI,CAAC,IAAI,GAAG,MAAM,EAAE,IAAI,CAAC;IAC3B,CAAC;CACF;AAED,sFAAsF;AACtF,MAAM,UAAU,aAAa,CAAC,QAAkB;IAI9C,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,MAAM,IAAI,gBAAgB,CAAC,sBAAsB,QAAQ,CAAC,OAAO,EAAE,EAAE;YACnE,UAAU,EAAE,QAAQ,CAAC,OAAO;YAC5B,IAAI,EAAE,QAAQ,CAAC,IAAI;SACpB,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,MAAM,cAAc,GAAsB;IAC/C,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAC9C,OAAO,EAAE,KAAK;QACd,OAAO,EAAE,UAAU;QACnB,IAAI;KACL,CAAC;IACF,sFAAsF;IACtF,kFAAkF;IAClF,kFAAkF;IAClF,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,CACnC,QAAQ,CAAC,MAAM,KAAK,CAAC;QACnB,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE;QAChC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE;CACjD,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAsB;IACvD,oFAAoF;IACpF,uEAAuE;IACvE,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACpD,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAC7C,OAAO,EAAE,IAAI;QACb,KAAK,EAAE;YACL;gBACE,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,aAAa,SAAS,EAAE,CAAC;gBAClD,QAAQ,EAAE,WAAW,UAAU,EAAE;gBACjC,MAAM,EAAE,SAAS,CAAC,KAAK,CACrB,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,QAAQ,EAAE,CACnE;aACF;SACF;KACF,CAAC;CACH,CAAC"}

package/dist/permission-eval.d.ts

@@ -1,6 +1,12 @@
-import { type Coverage, type EntityRef, type Node, type PermissionKey, type RoleDefinition } from '@substrat-run/contracts';
+import { type Coverage, type Decision, type EntityRef, type Node, type PermissionKey, type CheckSubject, type RoleDefinition } from '@substrat-run/contracts';
 import type { PermissionChecker } from './permission-checker.js';
 import { type CapabilityRow } from './capability.js';
+import { type GrantedEntitiesPage, type GrantWalkRow } from './grant-scoped-read.js';
+/** The one result selector both adapter contexts call, using their own `ctx.check` path. */
+export declare function grantedEntitiesForContext(checker: PermissionChecker, subject: CheckSubject, permission: PermissionKey, node: Node, entityType: string, options: {
+    limit?: number;
+    cursor?: string;
+} | undefined, runCheck: (permission: PermissionKey, entity?: EntityRef) => Promise<Decision>, withheld?: ReadonlySet<string>, nodeOverride?: boolean): Promise<GrantedEntitiesPage>;
 type MaybePromise<T> = T | Promise<T>;
 /**
  * One tuple row as the spine stores it — snake_case, because that is what both adapters
@@ -20,6 +26,9 @@ export interface PermissionTupleRow {
  * construction, so all three live together.
  */
 export interface ScopeTupleReader {
+    /** Keyset grant root and reverse parent edge reads for grant-scoped enumeration. */
+    nextGrant?(subject: string, relation: string, after: string): GrantWalkRow | undefined;
+    nextChild?(parent: string, after: string): GrantWalkRow | undefined;
     /**
      * Scope-level tuples for `subject` whose relation starts with `relationPrefix`. A
      * pre-filter only: the adapters answer it with SQL `LIKE`, which ignores ASCII case and
@@ -114,5 +123,46 @@ export interface TenantDirectoryReader {
  * `permission-eval.test.ts` pins over the cases where the two could part.
  */
 export declare function tenantCoverage(reader: TenantDirectoryReader, tenantId: string, principal: string, required: readonly PermissionKey[]): Coverage;
+/**
+ * `principal`'s live membership of `orgId` — its tuple, or `undefined` (#2047). Synchronous, for
+ * the org bound a directory unit asks: joining someone to an org, or taking them out of it,
+ * needs the inviter or remover to be a live member themselves.
+ *
+ * That is the exact K-21 bound for an org. Membership confers the same thing on every member,
+ * at every node — the org's tenant grants, its grants in each scope's own store, its
+ * entity-narrowed grants, and whatever it is granted later — so a member holds everything a
+ * join would confer, and a non-member does not. No scope store is read, because none needs to
+ * be: equality of membership is the comparison.
+ */
+export declare function liveOrgMembership(reader: TenantDirectoryReader, tenantId: string, principal: string, orgId: string): PermissionTupleRow | undefined;
+/**
+ * The org half of a membership change's unit (#2047), decided once for both adapters: whether
+ * `boundedBy` may join `principal` to the org or take them out of it, and — for a join — when
+ * the membership it writes expires. Reads only; the adapter writes.
+ */
+export declare function orgChangeBound(reader: TenantDirectoryReader, tenantId: string, change: {
+    op: 'add' | 'remove';
+    principal: string;
+    boundedBy: string;
+    orgId: string;
+}): {
+    bounded: false;
+} | {
+    bounded: true;
+    expiresAt: string | null;
+};
+/** The `after` of an `addMember` audit row: the expiry only when there is one, as before #2047. */
+export declare const memberAddedAudit: (principal: string, orgId: string, expiresAt: string | null) => {
+    principal: string;
+    orgId: string;
+    expiresAt?: string | undefined;
+};
+/**
+ * When a membership written by a join expires (#2047): never later than the membership of the
+ * principal whose authority bounded it, so a temporary member cannot confer a permanent one,
+ * and never earlier than a live membership the joiner already holds, which a re-invitation must
+ * not cut short. `null` is "never".
+ */
+export declare function joinedMembershipExpiry(bound: Pick<PermissionTupleRow, 'expires_at'>, existing: Pick<PermissionTupleRow, 'expires_at'> | undefined): string | null;
 export {};
 //# sourceMappingURL=permission-eval.d.ts.map

package/dist/permission-eval.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permission-eval.d.ts","sourceRoot":"","sources":["../src/permission-eval.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,QAAQ,EAEb,KAAK,SAAS,EACd,KAAK,IAAI,EACT,KAAK,aAAa,EAGlB,KAAK,cAAc,EACpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAqC,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAC;AA0BxF,KAAK,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;AAEtC;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,YAAY,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACpF,qEAAqE;IACrE,KAAK,CACH,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,YAAY,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAAC;IAChD,mDAAmD;IACnD,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAC5D;;;;;OAKG;IACH,UAAU,CAAC,CAAC,EAAE,EAAE,MAAM,GAAG,YAAY,CAAC,aAAa,GAAG,SAAS,CAAC,CAAC;IACjE;;;;;;;OAOG;IACH,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;CACrD;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,qBAAqB;IACpC,qEAAqE;IACrE,GAAG,IAAI,MAAM,CAAC;IACd,qFAAqF;IACrF,YAAY,CACV,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,cAAc,EAAE,MAAM,GACrB,YAAY,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACtC,iGAAiG;IACjG,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,YAAY,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACjF,gEAAgE;IAChE,QAAQ,CAAC,IAAI,EAAE,IAAI,GAAG,gBAAgB,GAAG,SAAS,CAAC;CACpD;AAeD;;;GAGG;AACH,eAAO,MAAM,YAAY,WAAY,MAAM,KAAG,MAG7C,CAAC;AAqFF;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,IAAI,CAAC,gBAAgB,EAAE,SAAS,CAAC,EACxC,MAAM,EAAE,SAAS,EACjB,IAAI,EAAE,SAAS,EACf,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,OAAO,CAAC,CAMlB;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,IAAI,CAAC,gBAAgB,EAAE,SAAS,CAAC,EACxC,MAAM,EAAE,SAAS,EACjB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAOtB;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,qBAAqB,GAAG,iBAAiB,CA+PrF;AAED;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,GAAG,IAAI,MAAM,CAAC;IACd,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,kBAAkB,EAAE,CAAC;IAC9F,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAAC;CACpE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,qBAAqB,EAC7B,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,SAAS,aAAa,EAAE,GACjC,QAAQ,CA0BV"}
+{"version":3,"file":"permission-eval.d.ts","sourceRoot":"","sources":["../src/permission-eval.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,QAAQ,EACb,KAAK,QAAQ,EACb,KAAK,SAAS,EACd,KAAK,IAAI,EACT,KAAK,aAAa,EAClB,KAAK,YAAY,EAEjB,KAAK,cAAc,EACpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAqC,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAExF,OAAO,EAAuB,KAAK,mBAAmB,EAAE,KAAK,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAe1G,4FAA4F;AAC5F,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,iBAAiB,EAC1B,OAAO,EAAE,YAAY,EACrB,UAAU,EAAE,aAAa,EACzB,IAAI,EAAE,IAAI,EACV,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,EACxD,QAAQ,EAAE,CAAC,UAAU,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,SAAS,KAAK,OAAO,CAAC,QAAQ,CAAC,EAC9E,QAAQ,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,EAC9B,YAAY,UAAQ,GACnB,OAAO,CAAC,mBAAmB,CAAC,CAqB9B;AAyBD,KAAK,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;AAEtC;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,oFAAoF;IACpF,SAAS,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAAC;IACvF,SAAS,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAAC;IACpE;;;;OAIG;IACH,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,YAAY,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACpF,qEAAqE;IACrE,KAAK,CACH,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,YAAY,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAAC;IAChD,mDAAmD;IACnD,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAC5D;;;;;OAKG;IACH,UAAU,CAAC,CAAC,EAAE,EAAE,MAAM,GAAG,YAAY,CAAC,aAAa,GAAG,SAAS,CAAC,CAAC;IACjE;;;;;;;OAOG;IACH,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;CACrD;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,qBAAqB;IACpC,qEAAqE;IACrE,GAAG,IAAI,MAAM,CAAC;IACd,qFAAqF;IACrF,YAAY,CACV,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,cAAc,EAAE,MAAM,GACrB,YAAY,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACtC,iGAAiG;IACjG,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,YAAY,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACjF,gEAAgE;IAChE,QAAQ,CAAC,IAAI,EAAE,IAAI,GAAG,gBAAgB,GAAG,SAAS,CAAC;CACpD;AAeD;;;GAGG;AACH,eAAO,MAAM,YAAY,WAAY,MAAM,KAAG,MAG7C,CAAC;AAqFF;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,IAAI,CAAC,gBAAgB,EAAE,SAAS,CAAC,EACxC,MAAM,EAAE,SAAS,EACjB,IAAI,EAAE,SAAS,EACf,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,OAAO,CAAC,CAMlB;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,IAAI,CAAC,gBAAgB,EAAE,SAAS,CAAC,EACxC,MAAM,EAAE,SAAS,EACjB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAOtB;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,qBAAqB,GAAG,iBAAiB,CA2QrF;AAED;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,GAAG,IAAI,MAAM,CAAC;IACd,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,kBAAkB,EAAE,CAAC;IAC9F,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAAC;CACpE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,qBAAqB,EAC7B,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,SAAS,aAAa,EAAE,GACjC,QAAQ,CA0BV;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,qBAAqB,EAC7B,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GACZ,kBAAkB,GAAG,SAAS,CAMhC;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,qBAAqB,EAC7B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE;IAAE,EAAE,EAAE,KAAK,GAAG,QAAQ,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACpF;IAAE,OAAO,EAAE,KAAK,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAQlE;AAED,mGAAmG;AACnG,eAAO,MAAM,gBAAgB,cAAe,MAAM,SAAS,MAAM,aAAa,MAAM,GAAG,IAAI;;;;CAIzF,CAAC;AAEH;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,IAAI,CAAC,kBAAkB,EAAE,YAAY,CAAC,EAC7C,QAAQ,EAAE,IAAI,CAAC,kBAAkB,EAAE,YAAY,CAAC,GAAG,SAAS,GAC3D,MAAM,GAAG,IAAI,CAIf"}

package/dist/permission-eval.js

@@ -1,6 +1,44 @@
 import { objectRef, subjectRef, } from '@substrat-run/contracts';
 import { capabilityGrantOf, capabilityLive } from './capability.js';
 import { isSwitchableSubjectKind } from './system-switch.js';
+import { walkGrantedEntities } from './grant-scoped-read.js';
+// Only createTupleEvaluator can register a checker. A provider cannot claim the
+// built-in tuple algebra's node-wide semantics for its own implementation.
+const nodeWideTupleCheckers = new WeakSet();
+function trustTupleChecker(checker) {
+    const check = Object.getOwnPropertyDescriptor(checker, 'check');
+    if (!check || !('value' in check) || typeof check.value !== 'function') {
+        throw new TypeError('tuple evaluator check must be an own method');
+    }
+    Object.freeze(checker);
+    nodeWideTupleCheckers.add(checker);
+    return checker;
+}
+/** The one result selector both adapter contexts call, using their own `ctx.check` path. */
+export async function grantedEntitiesForContext(checker, subject, permission, node, entityType, options, runCheck, withheld, nodeOverride = false) {
+    if (withheld?.has(permission))
+        return { kind: 'ids', ids: [], nextCursor: null };
+    if ((await runCheck(permission)).allowed) {
+        return nodeOverride || nodeWideTupleCheckers.has(checker)
+            ? { kind: 'all' }
+            : { kind: 'incomplete', reason: 'checker' };
+    }
+    if (subject.kind === 'capability')
+        return { kind: 'incomplete', reason: 'capability' };
+    if (!checker.grantedEntities)
+        return { kind: 'incomplete', reason: 'checker' };
+    const page = await checker.grantedEntities(subject, permission, node, entityType, async (entity) => (await runCheck(permission, entity)).allowed, options);
+    if (page.kind === 'all')
+        return { kind: 'incomplete', reason: 'checker' };
+    if (page.kind === 'incomplete')
+        return page;
+    const ids = [];
+    for (const id of page.ids) {
+        if ((await runCheck(permission, { entityType, entityId: id })).allowed)
+            ids.push(id);
+    }
+    return { ...page, ids };
+}
 /**
  * The built-in constrained relationship-tuple evaluator (design doc §4.2, plan D-23),
  * as ONE implementation both adapters call.
@@ -311,7 +349,18 @@ export function createTupleEvaluator(reader) {
         }
         return deny;
     }
-    return {
+    return trustTupleChecker({
+        grantedEntities: async (subject, permission, node, entityType, checkEntity, options) => {
+            if (subject.kind === 'capability')
+                return { kind: 'incomplete', reason: 'capability' };
+            const scope = reader.scopeFor(node);
+            if (!scope?.nextGrant || !scope.nextChild)
+                return { kind: 'incomplete', reason: 'checker' };
+            // The same subject expansion and liveness predicate `check` uses, including orgs.
+            const now = reader.now();
+            const subjects = (await subjectsOf(subject, node, now)).map((s) => s.ref);
+            return walkGrantedEntities({ nextGrant: scope.nextGrant, nextChild: scope.nextChild }, subjects, permission, entityType, now, checkEntity, options);
+        },
         /**
          * The subject's effective permission set at the node, compared against `required`
          * (K-21, membership.md §5.1).
@@ -362,7 +411,7 @@ export function createTupleEvaluator(reader) {
             return coverageOf(required, held);
         },
         check,
-    };
+    });
 }
 /**
  * `covers` at the TENANT node, synchronously (#1184): the K-21 set comparison over the
@@ -408,6 +457,59 @@ export function tenantCoverage(reader, tenantId, principal, required) {
     }
     return coverageOf(required, held);
 }
+/**
+ * `principal`'s live membership of `orgId` — its tuple, or `undefined` (#2047). Synchronous, for
+ * the org bound a directory unit asks: joining someone to an org, or taking them out of it,
+ * needs the inviter or remover to be a live member themselves.
+ *
+ * That is the exact K-21 bound for an org. Membership confers the same thing on every member,
+ * at every node — the org's tenant grants, its grants in each scope's own store, its
+ * entity-narrowed grants, and whatever it is granted later — so a member holds everything a
+ * join would confer, and a non-member does not. No scope store is read, because none needs to
+ * be: equality of membership is the comparison.
+ */
+export function liveOrgMembership(reader, tenantId, principal, orgId) {
+    const now = reader.now();
+    const org = `org:${orgId}`;
+    return reader
+        .tenantTuples(tenantId, `principal:${principal}`, 'member')
+        .find((row) => row.relation === 'member' && row.object === org && live(row, now));
+}
+/**
+ * The org half of a membership change's unit (#2047), decided once for both adapters: whether
+ * `boundedBy` may join `principal` to the org or take them out of it, and — for a join — when
+ * the membership it writes expires. Reads only; the adapter writes.
+ */
+export function orgChangeBound(reader, tenantId, change) {
+    const bound = liveOrgMembership(reader, tenantId, change.boundedBy, change.orgId);
+    if (!bound)
+        return { bounded: false };
+    if (change.op === 'remove')
+        return { bounded: true, expiresAt: null };
+    return {
+        bounded: true,
+        expiresAt: joinedMembershipExpiry(bound, liveOrgMembership(reader, tenantId, change.principal, change.orgId)),
+    };
+}
+/** The `after` of an `addMember` audit row: the expiry only when there is one, as before #2047. */
+export const memberAddedAudit = (principal, orgId, expiresAt) => ({
+    principal,
+    orgId,
+    ...(expiresAt ? { expiresAt } : {}),
+});
+/**
+ * When a membership written by a join expires (#2047): never later than the membership of the
+ * principal whose authority bounded it, so a temporary member cannot confer a permanent one,
+ * and never earlier than a live membership the joiner already holds, which a re-invitation must
+ * not cut short. `null` is "never".
+ */
+export function joinedMembershipExpiry(bound, existing) {
+    if (!existing)
+        return bound.expires_at;
+    if (existing.expires_at === null || bound.expires_at === null)
+        return null;
+    return existing.expires_at > bound.expires_at ? existing.expires_at : bound.expires_at;
+}
 /**
  * What one tuple row contributes at `nodeObj` — a role to expand, a permission held directly, or
  * nothing — for `covers` and `tenantCoverage` alike, so the two read a row the same way.

package/dist/permission-eval.js.map

@@ -1 +1 @@
-{"version":3,"file":"permission-eval.js","sourceRoot":"","sources":["../src/permission-eval.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,UAAU,GASX,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAsB,MAAM,iBAAiB,CAAC;AACxF,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAE7D;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,iBAAiB,GAAG,CAAC,CAAC;AA8E5B,MAAM,CAAC,GAAG,CAAC,OAAe,EAAE,QAAgB,EAAE,MAAc,EAAiB,EAAE,CAAC,CAAC;IAC/E,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC;IACjC,QAAQ;IACR,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC;CAChC,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,IAAI,GAAG,CAAC,GAAuB,EAAE,GAAW,EAAW,EAAE,CAC7D,CAAC,GAAG,CAAC,UAAU,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC;AAE/E;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAc,EAAU,EAAE;IACrD,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAClE,OAAO,GAAG,GAAG,CAAC,YAAY,CAAC,iBAAiB,GAAG,CAAC,YAAY,CAAC,eAAe,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC;AACvG,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,aAAa,GAAG,CAAC,IAAU,EAAsC,EAAE,CACvE,IAAI,CAAC,OAAO;IACV,CAAC,CAAC;QACE,EAAE,GAAG,EAAE,SAAS,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;QAC9C,EAAE,GAAG,EAAE,UAAU,IAAI,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;KAClD;IACH,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,IAAI,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AAE1D;;;;;;;;;;;;;;GAcG;AACH,KAAK,UAAU,WAAW,CAAC,OAAqB,EAAE,IAAU,EAAE,KAAmC;IAC/F,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC1E,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACrE,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,WAAW,CACxB,KAAwC,EACxC,KAAa,EACb,GAAW,EACX,KAAsE;IAGtE,IAAI,QAAQ,GAAe,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;IACvD,wFAAwF;IACxF,qFAAqF;IACrF,qFAAqF;IACrF,sFAAsF;IACtF,wFAAwF;IACxF,oDAAoD;IACpD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IACzC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,iBAAiB,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QAC/E,KAAK,MAAM,SAAS,IAAI,QAAQ,EAAE,CAAC;YACjC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;YACxD,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,GAAG,CAAC;QACpC,CAAC;QACD,gFAAgF;QAChF,oDAAoD;QACpD,IAAI,KAAK,KAAK,iBAAiB;YAAE,MAAM;QACvC,MAAM,IAAI,GAAe,EAAE,CAAC;QAC5B,KAAK,MAAM,SAAS,IAAI,QAAQ,EAAE,CAAC;YACjC,KAAK,MAAM,CAAC,IAAI,MAAM,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnD,+EAA+E;gBAC/E,6EAA6E;gBAC7E,wEAAwE;gBACxE,sCAAsC;gBACtC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;oBAAE,SAAS;gBACrD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;gBACtB,IAAI,CAAC,IAAI,CAAC;oBACR,GAAG,EAAE,CAAC,CAAC,MAAM;oBACb,KAAK,EAAE,CAAC,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;iBAC9D,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAwC,EACxC,MAAiB,EACjB,IAAe,EACf,GAAW;IAEX,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;IACrD,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,GAAG,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CACjG,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAClC,CAAC;IACF,OAAO,GAAG,KAAK,IAAI,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAwC,EACxC,MAAiB,EACjB,GAAW;IAEX,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,WAAW,CAAC,KAAK,EAAE,GAAG,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACrF,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAA6B;IAChE;;;;;;OAMG;IACH,MAAM,aAAa,GAAG,CAAC,QAAgB,EAAE,EAAE;QACzC,MAAM,IAAI,GAAG,IAAI,GAAG,EAA+C,CAAC;QACpE,OAAO,CAAC,GAAW,EAAuC,EAAE;YAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC1B,IAAI,GAAG;gBAAE,OAAO,GAAG,CAAC;YACpB,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;YAC/D,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YACvB,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC;IACJ,CAAC,CAAC;IAEF;;;;;;;;OAQG;IACH,MAAM,UAAU,GAAG,KAAK,EACtB,OAAqB,EACrB,IAAU,EACV,GAAW,EACsC,EAAE;QACnD,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,GAAG,GAA2C,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;QACvE,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YACjC,KAAK,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAC5E,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;oBAC5C,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACvE,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IAEF;;;;;;;;;;;;;;;;;;OAkBG;IACH,KAAK,UAAU,eAAe,CAC5B,EAAU,EACV,UAAyB,EACzB,IAAU,EACV,MAA6B;QAE7B,MAAM,IAAI,GAAa,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QACrE,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,EAAE,UAAU;YAAE,OAAO,IAAI,CAAC;QACpC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACvC,IAAI,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACnD,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC;QACtF,MAAM,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,UAAU,IAAI,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACnE,MAAM,IAAI,GAAG,cAAc,EAAE,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,MAAM,WAAW,CAC7B,KAAK,EACL,GAAG,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,EAAE,EACzC,GAAG,EACH,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CACpB,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,UAAU,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CACjF,CAAC;QACF,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,MAAM,MAAM,GAAG,MAAM,KAAK,CACxB,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,KAAK,CAAC,QAAQ,EAAE,EACzC,UAAU,EACV,IAAI,EACJ,MAAM,CACP,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QACjC,OAAO;YACL,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,aAAa,KAAK,CAAC,QAAQ,EAAE,CAAC,EAAE,GAAG,KAAK,CAAC;SACxF,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,KAAK,CAClB,OAAqB,EACrB,UAAyB,EACzB,IAAU,EACV,MAAkB;QAElB,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAClC,OAAO,eAAe,CAAC,OAAO,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,IAAI,GAAa,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QACrE,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,MAAM,WAAW,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACzD,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAE7C,gFAAgF;QAChF,6BAA6B;QAC7B,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAEtD,0FAA0F;QAC1F,oFAAoF;QACpF,MAAM,SAAS,GAAG,KAAK,EACrB,eAAuB,EACvB,MAAc,EACd,MAAe,EACgB,EAAE,CACjC,CAAC,MAAM;YACL,CAAC,CAAC,KAAK;gBACL,CAAC,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC;gBAC7C,CAAC,CAAC,EAAE;YACN,CAAC,CAAC,MAAM,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,EAAE,MAAM,CAAC,CACpE,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;QAErD,KAAK,MAAM,OAAO,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACzB,2BAA2B;gBAC3B,KAAK,MAAM,GAAG,IAAI,MAAM,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;oBAClE,IAAI,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC;wBAAE,SAAS;oBAC5D,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;oBACnD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;oBACpC,IAAI,IAAI,EAAE,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;wBAC3C,OAAO;4BACL,OAAO,EAAE,IAAI;4BACb,KAAK,EAAE;gCACL,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gCACzB,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC;gCACxC,CAAC,CAAC,QAAQ,OAAO,EAAE,EAAE,WAAW,UAAU,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC;6BAC3D;yBACF,CAAC;oBACJ,CAAC;gBACH,CAAC;gBACD,6BAA6B;gBAC7B,KAAK,MAAM,GAAG,IAAI,MAAM,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,WAAW,UAAU,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;oBAClF,IACE,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC,GAAG;wBAC1B,GAAG,CAAC,QAAQ,KAAK,WAAW,UAAU,EAAE;wBACxC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,EACd,CAAC;wBACD,OAAO;4BACL,OAAO,EAAE,IAAI;4BACb,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;yBAC7E,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,qFAAqF;QACrF,kDAAkD;QAClD,IAAI,MAAM,IAAI,KAAK,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,MAAM,WAAW,CAC7B,KAAK,EACL,GAAG,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,EAAE,EACzC,GAAG,EACH,KAAK,EAAE,GAAG,EAAE,KAAK,EAAiC,EAAE;gBAClD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;oBACzB,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,WAAW,UAAU,EAAE,EAAE,GAAG,CAAC,CAAC;oBACrE,IAAI,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;wBAC9B,OAAO;4BACL,OAAO,EAAE,IAAI;4BACb,KAAK,EAAE;gCACL,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gCACzB,GAAG,KAAK;gCACR,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC;6BAC/C;yBACF,CAAC;oBACJ,CAAC;gBACH,CAAC;gBACD,OAAO,SAAS,CAAC;YACnB,CAAC,CACF,CAAC;YACF,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;QAC1B,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL;;;;;;;;;;;WAWG;QACH,KAAK,CAAC,MAAM,CACV,OAAqB,EACrB,QAAkC,EAClC,IAAU;YAEV,qFAAqF;YACrF,+CAA+C;YAC/C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;YACjE,qFAAqF;YACrF,qFAAqF;YACrF,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAClC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAwC,EAAE,CAAC;YACpG,CAAC;YAED,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,MAAM,WAAW,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;gBAC5C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAwC,EAAE,CAAC;YACpG,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YACtD,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAE7C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;YAC/B,KAAK,MAAM,OAAO,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;oBACzB,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM;wBACzB,CAAC,CAAC,KAAK;4BACL,CAAC,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC;4BAC/B,CAAC,CAAC,EAAE;wBACN,CAAC,CAAC,MAAM,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;oBACxD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;wBACvB,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;wBAC5C,IAAI,KAAK,EAAE,IAAI,KAAK,SAAS;4BAAE,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,WAAW,IAAI,EAAE;gCAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;6BACtG,IAAI,KAAK;4BAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;oBAC7C,CAAC;gBACH,CAAC;YACH,CAAC;YACD,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACpC,CAAC;QAED,KAAK;KACN,CAAC;AAEJ,CAAC;AAaD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,cAAc,CAC5B,MAA6B,EAC7B,QAAgB,EAChB,SAAiB,EACjB,QAAkC;IAElC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACjE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,SAAS,GAAG,UAAU,QAAQ,EAAE,CAAC;IACvC,MAAM,KAAK,GAAG,IAAI,GAAG,EAA6B,CAAC;IACnD,MAAM,aAAa,GAAG,CAAC,GAAW,EAAqB,EAAE;QACvD,IAAI,WAAW,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,WAAW;YAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC;QACnG,OAAO,WAAW,CAAC;IACrB,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,IAAI,GAAG,CAAC,IAAmC,EAAE,EAAE;QACnD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;YAC1C,IAAI,KAAK,EAAE,IAAI,KAAK,SAAS;gBAAE,KAAK,MAAM,CAAC,IAAI,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC;oBAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;iBACjF,IAAI,KAAK;gBAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC,CAAC;IACF,4FAA4F;IAC5F,mEAAmE;IACnE,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,aAAa,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;IACxE,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACpB,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC;YAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,SAAS,MAAM,CACb,GAAuB,EACvB,OAAe,EACf,GAAW;IAEX,IAAI,GAAG,CAAC,MAAM,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAChE,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;IAC1F,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;IACtG,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CAAC,QAAkC,EAAE,IAAyB;IAC/E,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC7F,CAAC"}
+{"version":3,"file":"permission-eval.js","sourceRoot":"","sources":["../src/permission-eval.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,UAAU,GASX,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAsB,MAAM,iBAAiB,CAAC;AACxF,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAA+C,MAAM,wBAAwB,CAAC;AAE1G,gFAAgF;AAChF,2EAA2E;AAC3E,MAAM,qBAAqB,GAAG,IAAI,OAAO,EAAqB,CAAC;AAC/D,SAAS,iBAAiB,CAA8B,OAAU;IAChE,MAAM,KAAK,GAAG,MAAM,CAAC,wBAAwB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAChE,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,IAAI,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;QACvE,MAAM,IAAI,SAAS,CAAC,6CAA6C,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACvB,qBAAqB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACnC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAA0B,EAC1B,OAAqB,EACrB,UAAyB,EACzB,IAAU,EACV,UAAkB,EAClB,OAAwD,EACxD,QAA8E,EAC9E,QAA8B,EAC9B,YAAY,GAAG,KAAK;IAEpB,IAAI,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACjF,IAAI,CAAC,MAAM,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QACzC,OAAO,YAAY,IAAI,qBAAqB,CAAC,GAAG,CAAC,OAAO,CAAC;YACvD,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE;YACjB,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAChD,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IACvF,IAAI,CAAC,OAAO,CAAC,eAAe;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC/E,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,eAAe,CACxC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EACrC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,EAC9D,OAAO,CACR,CAAC;IACF,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC1E,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC;IAC5C,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QAC1B,IAAI,CAAC,MAAM,QAAQ,CAAC,UAAU,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,CAAC;AAC1B,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAiF5B,MAAM,CAAC,GAAG,CAAC,OAAe,EAAE,QAAgB,EAAE,MAAc,EAAiB,EAAE,CAAC,CAAC;IAC/E,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC;IACjC,QAAQ;IACR,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC;CAChC,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,IAAI,GAAG,CAAC,GAAuB,EAAE,GAAW,EAAW,EAAE,CAC7D,CAAC,GAAG,CAAC,UAAU,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC;AAE/E;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAc,EAAU,EAAE;IACrD,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAClE,OAAO,GAAG,GAAG,CAAC,YAAY,CAAC,iBAAiB,GAAG,CAAC,YAAY,CAAC,eAAe,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC;AACvG,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,aAAa,GAAG,CAAC,IAAU,EAAsC,EAAE,CACvE,IAAI,CAAC,OAAO;IACV,CAAC,CAAC;QACE,EAAE,GAAG,EAAE,SAAS,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;QAC9C,EAAE,GAAG,EAAE,UAAU,IAAI,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;KAClD;IACH,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,IAAI,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AAE1D;;;;;;;;;;;;;;GAcG;AACH,KAAK,UAAU,WAAW,CAAC,OAAqB,EAAE,IAAU,EAAE,KAAmC;IAC/F,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC1E,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACrE,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,WAAW,CACxB,KAAwC,EACxC,KAAa,EACb,GAAW,EACX,KAAsE;IAGtE,IAAI,QAAQ,GAAe,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;IACvD,wFAAwF;IACxF,qFAAqF;IACrF,qFAAqF;IACrF,sFAAsF;IACtF,wFAAwF;IACxF,oDAAoD;IACpD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IACzC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,iBAAiB,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QAC/E,KAAK,MAAM,SAAS,IAAI,QAAQ,EAAE,CAAC;YACjC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;YACxD,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,GAAG,CAAC;QACpC,CAAC;QACD,gFAAgF;QAChF,oDAAoD;QACpD,IAAI,KAAK,KAAK,iBAAiB;YAAE,MAAM;QACvC,MAAM,IAAI,GAAe,EAAE,CAAC;QAC5B,KAAK,MAAM,SAAS,IAAI,QAAQ,EAAE,CAAC;YACjC,KAAK,MAAM,CAAC,IAAI,MAAM,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnD,+EAA+E;gBAC/E,6EAA6E;gBAC7E,wEAAwE;gBACxE,sCAAsC;gBACtC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;oBAAE,SAAS;gBACrD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;gBACtB,IAAI,CAAC,IAAI,CAAC;oBACR,GAAG,EAAE,CAAC,CAAC,MAAM;oBACb,KAAK,EAAE,CAAC,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;iBAC9D,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAwC,EACxC,MAAiB,EACjB,IAAe,EACf,GAAW;IAEX,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;IACrD,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,GAAG,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CACjG,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAClC,CAAC;IACF,OAAO,GAAG,KAAK,IAAI,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAwC,EACxC,MAAiB,EACjB,GAAW;IAEX,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,WAAW,CAAC,KAAK,EAAE,GAAG,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACrF,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAA6B;IAChE;;;;;;OAMG;IACH,MAAM,aAAa,GAAG,CAAC,QAAgB,EAAE,EAAE;QACzC,MAAM,IAAI,GAAG,IAAI,GAAG,EAA+C,CAAC;QACpE,OAAO,CAAC,GAAW,EAAuC,EAAE;YAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC1B,IAAI,GAAG;gBAAE,OAAO,GAAG,CAAC;YACpB,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;YAC/D,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YACvB,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC;IACJ,CAAC,CAAC;IAEF;;;;;;;;OAQG;IACH,MAAM,UAAU,GAAG,KAAK,EACtB,OAAqB,EACrB,IAAU,EACV,GAAW,EACsC,EAAE;QACnD,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,GAAG,GAA2C,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;QACvE,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YACjC,KAAK,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAC5E,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;oBAC5C,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACvE,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IAEF;;;;;;;;;;;;;;;;;;OAkBG;IACH,KAAK,UAAU,eAAe,CAC5B,EAAU,EACV,UAAyB,EACzB,IAAU,EACV,MAA6B;QAE7B,MAAM,IAAI,GAAa,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QACrE,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,EAAE,UAAU;YAAE,OAAO,IAAI,CAAC;QACpC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACvC,IAAI,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACnD,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC;QACtF,MAAM,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,UAAU,IAAI,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACnE,MAAM,IAAI,GAAG,cAAc,EAAE,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,MAAM,WAAW,CAC7B,KAAK,EACL,GAAG,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,EAAE,EACzC,GAAG,EACH,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CACpB,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,UAAU,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CACjF,CAAC;QACF,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,MAAM,MAAM,GAAG,MAAM,KAAK,CACxB,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,KAAK,CAAC,QAAQ,EAAE,EACzC,UAAU,EACV,IAAI,EACJ,MAAM,CACP,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QACjC,OAAO;YACL,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,aAAa,KAAK,CAAC,QAAQ,EAAE,CAAC,EAAE,GAAG,KAAK,CAAC;SACxF,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,KAAK,CAClB,OAAqB,EACrB,UAAyB,EACzB,IAAU,EACV,MAAkB;QAElB,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAClC,OAAO,eAAe,CAAC,OAAO,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,IAAI,GAAa,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QACrE,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,MAAM,WAAW,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACzD,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAE7C,gFAAgF;QAChF,6BAA6B;QAC7B,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAEtD,0FAA0F;QAC1F,oFAAoF;QACpF,MAAM,SAAS,GAAG,KAAK,EACrB,eAAuB,EACvB,MAAc,EACd,MAAe,EACgB,EAAE,CACjC,CAAC,MAAM;YACL,CAAC,CAAC,KAAK;gBACL,CAAC,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC;gBAC7C,CAAC,CAAC,EAAE;YACN,CAAC,CAAC,MAAM,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,EAAE,MAAM,CAAC,CACpE,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;QAErD,KAAK,MAAM,OAAO,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACzB,2BAA2B;gBAC3B,KAAK,MAAM,GAAG,IAAI,MAAM,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;oBAClE,IAAI,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC;wBAAE,SAAS;oBAC5D,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;oBACnD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;oBACpC,IAAI,IAAI,EAAE,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;wBAC3C,OAAO;4BACL,OAAO,EAAE,IAAI;4BACb,KAAK,EAAE;gCACL,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gCACzB,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC;gCACxC,CAAC,CAAC,QAAQ,OAAO,EAAE,EAAE,WAAW,UAAU,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC;6BAC3D;yBACF,CAAC;oBACJ,CAAC;gBACH,CAAC;gBACD,6BAA6B;gBAC7B,KAAK,MAAM,GAAG,IAAI,MAAM,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,WAAW,UAAU,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;oBAClF,IACE,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC,GAAG;wBAC1B,GAAG,CAAC,QAAQ,KAAK,WAAW,UAAU,EAAE;wBACxC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,EACd,CAAC;wBACD,OAAO;4BACL,OAAO,EAAE,IAAI;4BACb,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;yBAC7E,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,qFAAqF;QACrF,kDAAkD;QAClD,IAAI,MAAM,IAAI,KAAK,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,MAAM,WAAW,CAC7B,KAAK,EACL,GAAG,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,EAAE,EACzC,GAAG,EACH,KAAK,EAAE,GAAG,EAAE,KAAK,EAAiC,EAAE;gBAClD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;oBACzB,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,WAAW,UAAU,EAAE,EAAE,GAAG,CAAC,CAAC;oBACrE,IAAI,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;wBAC9B,OAAO;4BACL,OAAO,EAAE,IAAI;4BACb,KAAK,EAAE;gCACL,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gCACzB,GAAG,KAAK;gCACR,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC;6BAC/C;yBACF,CAAC;oBACJ,CAAC;gBACH,CAAC;gBACD,OAAO,SAAS,CAAC;YACnB,CAAC,CACF,CAAC;YACF,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;QAC1B,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,iBAAiB,CAAC;QACvB,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE;YACrF,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY;gBAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;YACvF,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,CAAC,KAAK,EAAE,SAAS,IAAI,CAAC,KAAK,CAAC,SAAS;gBAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAC5F,kFAAkF;YAClF,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,CAAC,MAAM,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAC1E,OAAO,mBAAmB,CACxB,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,EAC1D,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,EAAE,WAAW,EAAE,OAAO,CAC5D,CAAC;QACJ,CAAC;QACD;;;;;;;;;;;WAWG;QACH,KAAK,CAAC,MAAM,CACV,OAAqB,EACrB,QAAkC,EAClC,IAAU;YAEV,qFAAqF;YACrF,+CAA+C;YAC/C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;YACjE,qFAAqF;YACrF,qFAAqF;YACrF,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAClC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAwC,EAAE,CAAC;YACpG,CAAC;YAED,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,MAAM,WAAW,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;gBAC5C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAwC,EAAE,CAAC;YACpG,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YACtD,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAE7C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;YAC/B,KAAK,MAAM,OAAO,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;oBACzB,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM;wBACzB,CAAC,CAAC,KAAK;4BACL,CAAC,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC;4BAC/B,CAAC,CAAC,EAAE;wBACN,CAAC,CAAC,MAAM,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;oBACxD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;wBACvB,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;wBAC5C,IAAI,KAAK,EAAE,IAAI,KAAK,SAAS;4BAAE,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,WAAW,IAAI,EAAE;gCAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;6BACtG,IAAI,KAAK;4BAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;oBAC7C,CAAC;gBACH,CAAC;YACH,CAAC;YACD,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACpC,CAAC;QAED,KAAK;KACN,CAAC,CAAC;AAEL,CAAC;AAaD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,cAAc,CAC5B,MAA6B,EAC7B,QAAgB,EAChB,SAAiB,EACjB,QAAkC;IAElC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACjE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,SAAS,GAAG,UAAU,QAAQ,EAAE,CAAC;IACvC,MAAM,KAAK,GAAG,IAAI,GAAG,EAA6B,CAAC;IACnD,MAAM,aAAa,GAAG,CAAC,GAAW,EAAqB,EAAE;QACvD,IAAI,WAAW,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,WAAW;YAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC;QACnG,OAAO,WAAW,CAAC;IACrB,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,IAAI,GAAG,CAAC,IAAmC,EAAE,EAAE;QACnD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;YAC1C,IAAI,KAAK,EAAE,IAAI,KAAK,SAAS;gBAAE,KAAK,MAAM,CAAC,IAAI,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC;oBAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;iBACjF,IAAI,KAAK;gBAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC,CAAC;IACF,4FAA4F;IAC5F,mEAAmE;IACnE,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,aAAa,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;IACxE,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACpB,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC;YAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAA6B,EAC7B,QAAgB,EAChB,SAAiB,EACjB,KAAa;IAEb,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,GAAG,GAAG,OAAO,KAAK,EAAE,CAAC;IAC3B,OAAO,MAAM;SACV,YAAY,CAAC,QAAQ,EAAE,aAAa,SAAS,EAAE,EAAE,QAAQ,CAAC;SAC1D,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AACtF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,MAA6B,EAC7B,QAAgB,EAChB,MAAqF;IAErF,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAClF,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACtC,IAAI,MAAM,CAAC,EAAE,KAAK,QAAQ;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACtE,OAAO;QACL,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,sBAAsB,CAAC,KAAK,EAAE,iBAAiB,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;KAC9G,CAAC;AACJ,CAAC;AAED,mGAAmG;AACnG,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,SAAiB,EAAE,KAAa,EAAE,SAAwB,EAAE,EAAE,CAAC,CAAC;IAC/F,SAAS;IACT,KAAK;IACL,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;CACpC,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAA6C,EAC7C,QAA4D;IAE5D,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC,UAAU,CAAC;IACvC,IAAI,QAAQ,CAAC,UAAU,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC3E,OAAO,QAAQ,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC;AACzF,CAAC;AAED;;;GAGG;AACH,SAAS,MAAM,CACb,GAAuB,EACvB,OAAe,EACf,GAAW;IAEX,IAAI,GAAG,CAAC,MAAM,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAChE,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;IAC1F,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;IACtG,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CAAC,QAAkC,EAAE,IAAyB;IAC/E,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC7F,CAAC"}

package/dist/platform-sweep.d.ts

@@ -1,6 +1,7 @@
 import type { AccessLogEntry, ConnectionId, MigrationProgress, MigrationStraggler, PlatformActorId, Scope, ScopeId, TenantId, DrainedEvent } from '@substrat-run/contracts';
 import type { ExportBreak, ManifestExports, EdgeHealthReport, ExportReadInput, ExportedBatch, ImportBatch, ImportResult, ImportState, ManifestImports, WantedEvent } from '@substrat-run/contracts';
 import type { ExecutorDrainReport, FetchLike, HostAdmin, ScopeHost, SweepRunInput, TelemetryPruneReport } from './scope-host.js';
+import type { FindingPruneReport } from './findings.js';
 /**
  * A connector's reconcile sweep — the unit `runPlatformSweep` calls per live
  * connection of a given provider (`sweepScriveReconciliations` is one).
@@ -323,7 +324,7 @@ export type ScheduleStateKind = 'schedule' | 'freshness';
  * definition is what keeps the rebuilt shape and the created shape the same shape;
  * the gate then holds each adapter to including it.
  */
-export declare const SCHEDULE_STATE_DDL = "\n  CREATE TABLE IF NOT EXISTS _substrat_schedule_state (\n    -- #1288: WHICH of the two families this row belongs to, named with the same two\n    -- words _substrat_sweep_runs already records its entries under:\n    --   * 'schedule'  -- keyed by the operation (module/verb). last_run_at and\n    --     last_status are when that operation RAN here and how it ended.\n    --   * 'freshness' -- keyed freshness:<eventType> (#1232). last_run_at and\n    --     last_status are when the evaluator last RECORDED a verdict for that event\n    --     type and what it was. Nothing ran; the row gates what the sweep records.\n    kind TEXT NOT NULL,\n    schedule_op TEXT NOT NULL,\n    last_run_at TEXT,\n    last_status TEXT,\n    -- #1525: the invocation this row's last run happened in, or null. Null is a fact\n    -- here, not a gap: a 'freshness' row never invokes anything (the evaluator only\n    -- records a verdict), a 'schedule' row a pass SKIPPED carries no fresh call to\n    -- attribute and keeps whatever it already held, and a row written before this\n    -- column existed predates the possibility. Only a due schedule's own invoke\n    -- mints one and writes it here, in the same call that stamps it onto whatever\n    -- the operation emits \u2014 see runDueSchedules in each adapter.\n    invocation_id TEXT,\n    -- The key LEADS with kind, and that is the point of #1288 rather than a tidy-up.\n    -- Until it did, the two families were told apart by the spelling of one column:\n    -- a freshness key could never LOOK like an operation (an event type has passed\n    -- contracts' eventType regex -- lowercase ns.verb, no colon, no slash), but the\n    -- other direction was convention only, because scheduleSpec.operation is\n    -- z.string().min(1). A module declaring a schedule literally named\n    -- \"freshness:orders.placed\" shared the evaluator's row and nothing refused it:\n    -- each write clobbered the other's verdict, and the sweep read back whichever\n    -- ran last. With kind in the key those are two rows that cannot meet.\n    PRIMARY KEY (kind, schedule_op)\n  );\n";
+export declare const SCHEDULE_STATE_DDL = "\n  CREATE TABLE IF NOT EXISTS _substrat_schedule_state (\n    -- #1288: WHICH of the two families this row belongs to, named with the same two\n    -- words _substrat_sweep_runs already records its entries under:\n    --   * 'schedule'  -- keyed by the operation (module/verb). last_run_at and\n    --     last_status are when that operation RAN here and how it ended.\n    --   * 'freshness' -- keyed freshness:<eventType> (#1232). last_run_at and\n    --     last_status are when the evaluator last RECORDED a verdict for that event\n    --     type and what it was. Nothing ran; the row gates what the sweep records.\n    kind TEXT NOT NULL,\n    schedule_op TEXT NOT NULL,\n    last_run_at TEXT,\n    last_status TEXT,\n    -- #1525: the invocation this row's last run happened in, or null. Null is a fact\n    -- here, not a gap: a 'freshness' row never invokes anything (the evaluator only\n    -- records a verdict), a 'schedule' row a pass SKIPPED carries no fresh call to\n    -- attribute and keeps whatever it already held, and a row written before this\n    -- column existed predates the possibility. Only a due schedule's own invoke\n    -- mints one and writes it here, in the same call that stamps it onto whatever\n    -- the operation emits \u2014 see runDueSchedules in each adapter.\n    invocation_id TEXT,\n    -- #2096: a purge horizon's lap in progress (entity-trash.ts, PurgeLap) -- where its\n    -- next pass resumes in the bin, and how many purges failed earlier in the lap. Only a\n    -- 'schedule' row of a purge schedule holds one, and only mid-lap: NULL is the start\n    -- of a lap, which is also the honest reading of every row written before the column.\n    purge_cursor TEXT,\n    -- The key LEADS with kind, and that is the point of #1288 rather than a tidy-up.\n    -- Until it did, the two families were told apart by the spelling of one column:\n    -- a freshness key could never LOOK like an operation (an event type has passed\n    -- contracts' eventType regex -- lowercase ns.verb, no colon, no slash), but the\n    -- other direction was convention only, because scheduleSpec.operation is\n    -- z.string().min(1). A module declaring a schedule literally named\n    -- \"freshness:orders.placed\" shared the evaluator's row and nothing refused it:\n    -- each write clobbered the other's verdict, and the sweep read back whichever\n    -- ran last. With kind in the key those are two rows that cannot meet.\n    PRIMARY KEY (kind, schedule_op)\n  );\n";
 /**
  * The `kind` a pre-#1288 row belongs to, derived from its `schedule_op` — the backfill's one
  * rule, shared by `SCHEDULE_STATE_REBUILD` below and by a restore of a dump taken before the
@@ -528,9 +529,14 @@ export interface PlatformSweepReport {
      * `pruneTelemetry`. Null and zeros are different facts, as everywhere in this report.
      */
     telemetry?: TelemetryPruneReport | null;
+    /**
+     * What the findings retention phase did (#1748), or null when the host predates
+     * `pruneFindings`.
+     */
+    findings?: FindingPruneReport | null;
     /** Per-unit failures; the pass records and steps over each rather than aborting. */
     errors: {
-        kind: 'drain' | 'sweep' | 'gc' | 'reap' | 'reap-tenant' | 'migrate' | 'platform-request' | 'provision-reconcile' | 'schedule' | 'freshness' | 'access-log' | 'telemetry' | 'event-drain' | 'vertical-events';
+        kind: 'drain' | 'sweep' | 'gc' | 'reap' | 'reap-tenant' | 'migrate' | 'platform-request' | 'provision-reconcile' | 'schedule' | 'freshness' | 'access-log' | 'telemetry' | 'findings' | 'event-drain' | 'vertical-events';
         id: string;
         error: string;
     }[];