@substrat-run/kernel 0.138.0 → 0.140.0

package/dist/connect-links.js

@@ -0,0 +1,189 @@
+import { connectLink, } from '@substrat-run/contracts';
+/**
+ * The platform-held connect link (connections.md §3.5.4), as statements both adapters run
+ * against their directory — the SQLite host over better-sqlite3, the hosted one inside
+ * ControlPlaneDO — so the lifecycle is written once, the way the findings store is.
+ *
+ * A vertical mints one to be MAILED: a bookkeeping bureau's staff send it to a client
+ * company's Fortnox administrator, who opens it days later. A signature alone cannot be
+ * withdrawn and cannot be spent, which is what §3.5.3's in-session URL gets away with by
+ * living minutes; a link living a week cannot. So the signed state names this row, and the
+ * row decides: outstanding and unexpired opens, anything else refuses.
+ *
+ * Every read and write is keyed by (tenant, scope, id). A link of another scope or tenant
+ * is not a forbidden row — it is an absent one, and answers exactly as `unknown` does.
+ *
+ * Expiry is judged against the `now` the caller passes: the pure host's clock, or the
+ * coordinator's wall clock on the hosted one. ISO 8601 UTC text on both sides, so a string
+ * comparison is a chronological one.
+ */
+export const CONNECT_LINKS_DDL = `
+  CREATE TABLE IF NOT EXISTS _substrat_connect_links (
+    id            TEXT PRIMARY KEY,
+    tenant_id     TEXT NOT NULL,
+    scope_id      TEXT NOT NULL,
+    vertical      TEXT NOT NULL,
+    provider      TEXT NOT NULL,
+    status        TEXT NOT NULL,
+    created_by    TEXT NOT NULL,
+    subject_ref   TEXT,
+    return_url    TEXT,
+    created_at    TEXT NOT NULL,
+    expires_at    TEXT NOT NULL,
+    used_at       TEXT,
+    account_ref   TEXT,
+    account_label TEXT
+  );
+  CREATE INDEX IF NOT EXISTS _substrat_connect_links_scope
+    ON _substrat_connect_links (tenant_id, scope_id, created_at);
+`;
+/** Named, never `*`: the row a read returns is the shape below, whatever the table grows. */
+const COLUMNS = 'id, tenant_id, scope_id, vertical, provider, status, created_by, subject_ref, return_url, ' +
+    'created_at, expires_at, used_at, account_ref, account_label';
+const toConnectLink = (r) => connectLink.parse({
+    id: r.id,
+    tenantId: r.tenant_id,
+    scopeId: r.scope_id,
+    vertical: r.vertical,
+    provider: r.provider,
+    status: r.status,
+    createdBy: r.created_by,
+    subjectRef: r.subject_ref,
+    returnUrl: r.return_url,
+    createdAt: r.created_at,
+    expiresAt: r.expires_at,
+    usedAt: r.used_at,
+    accountRef: r.account_ref,
+    accountLabel: r.account_label,
+});
+const targetOf = (link) => ({ tenantId: link.tenantId, scopeId: link.scopeId, vertical: link.vertical });
+const readRow = (sql, key) => sql(`SELECT ${COLUMNS} FROM _substrat_connect_links WHERE id = ? AND tenant_id = ? AND scope_id = ?`, [
+    key.id,
+    key.tenantId,
+    key.scopeId,
+])[0];
+export function insertConnectLink(sql, row, audit) {
+    const inserted = sql(`INSERT INTO _substrat_connect_links
+       (id, tenant_id, scope_id, vertical, provider, status, created_by, subject_ref, return_url,
+        created_at, expires_at, used_at, account_ref, account_label)
+     VALUES (?, ?, ?, ?, ?, 'outstanding', ?, ?, ?, ?, ?, NULL, NULL, NULL)
+     RETURNING ${COLUMNS}`, [
+        row.id,
+        row.tenantId,
+        row.scopeId,
+        row.vertical,
+        row.provider,
+        row.createdBy,
+        row.subjectRef,
+        row.returnUrl,
+        row.createdAt,
+        row.expiresAt,
+    ])[0];
+    const link = toConnectLink(inserted);
+    audit({
+        action: 'mintConnectLink',
+        target: targetOf(link),
+        before: null,
+        after: { id: link.id, provider: link.provider, createdBy: link.createdBy, expiresAt: link.expiresAt },
+    });
+    return link;
+}
+export function readConnectLink(sql, key) {
+    const row = readRow(sql, key);
+    return row ? toConnectLink(row) : undefined;
+}
+export function listConnectLinks(sql, filter, now) {
+    if (filter.ids?.length === 0)
+        return []; // no id named — match nothing, never everything
+    const where = ['tenant_id = ?'];
+    const params = [filter.tenantId];
+    if (filter.scopeId)
+        (where.push('scope_id = ?'), params.push(filter.scopeId));
+    // ONE bound JSON array, not a `?` per id: a DO binds at most 100 parameters (#1776).
+    if (filter.ids)
+        (where.push('id IN (SELECT value FROM json_each(?))'), params.push(JSON.stringify(filter.ids)));
+    if (filter.provider)
+        (where.push('provider = ?'), params.push(filter.provider));
+    if (filter.outstandingOnly)
+        (where.push(`status = 'outstanding' AND expires_at > ?`), params.push(now));
+    return sql(`SELECT ${COLUMNS} FROM _substrat_connect_links WHERE ${where.join(' AND ')}
+       ORDER BY created_at DESC, id DESC`, params).map(toConnectLink);
+}
+/**
+ * Withdraw an outstanding link. Idempotent, and only an outstanding row moves: a used link
+ * has already been spent (its connection is what to disconnect), and a revoked one stays
+ * revoked. `undefined` when no such link exists in this scope; `changed` says whether this
+ * call is the one that revoked it, so a no-op is not audited.
+ */
+export function revokeConnectLinkRow(sql, key, audit) {
+    const moved = sql(`UPDATE _substrat_connect_links SET status = 'revoked'
+     WHERE id = ? AND tenant_id = ? AND scope_id = ? AND status = 'outstanding'
+     RETURNING ${COLUMNS}`, [key.id, key.tenantId, key.scopeId])[0];
+    if (moved) {
+        const link = toConnectLink(moved);
+        audit({
+            action: 'revokeConnectLink',
+            target: targetOf(link),
+            before: { status: 'outstanding' },
+            after: { id: link.id, provider: link.provider, status: 'revoked' },
+        });
+        return { link, changed: true };
+    }
+    const row = readRow(sql, key);
+    return row ? { link: toConnectLink(row), changed: false } : undefined;
+}
+/**
+ * Spend a link — the callback's act, BEFORE it stores the credential, so of two racing
+ * callbacks exactly one gets past it. Single-use is decided by the UPDATE's WHERE, not by
+ * the read in front of it: the read only picks which refusal to answer with.
+ */
+export function consumeConnectLinkRow(sql, input, now, audit) {
+    const row = readRow(sql, input);
+    const refuse = (reason) => ({ ok: false, reason });
+    // A link minted for another provider is not this round's link at all.
+    if (!row || row.provider !== input.provider)
+        return refuse('unknown');
+    if (row.status === 'used')
+        return refuse('used');
+    if (row.status === 'revoked')
+        return refuse('revoked');
+    if (row.expires_at <= now)
+        return refuse('expired');
+    const spent = sql(`UPDATE _substrat_connect_links SET status = 'used', used_at = ?, account_ref = ?, account_label = ?
+     WHERE id = ? AND tenant_id = ? AND scope_id = ? AND status = 'outstanding' AND expires_at > ?
+     RETURNING ${COLUMNS}`, [now, input.accountRef ?? null, input.accountLabel ?? null, input.id, input.tenantId, input.scopeId, now])[0];
+    if (!spent)
+        return refuse('used');
+    const link = toConnectLink(spent);
+    audit({
+        action: 'consumeConnectLink',
+        target: targetOf(link),
+        before: { status: 'outstanding' },
+        after: { id: link.id, provider: link.provider, status: 'used', accountRef: link.accountRef },
+    });
+    return { ok: true, link };
+}
+/**
+ * The compensating half of consume: the callback spent the link, then failed to store the
+ * credential, so nothing was connected and the link goes back to outstanding — a platform
+ * hiccup costs a retry, not a fresh link mailed to a client. Only a `used` row moves (a
+ * revocation is never undone by this), and only an unexpired one: a link that lapsed while
+ * the store failed stays spent rather than coming back already dead.
+ */
+export function restoreConnectLinkRow(sql, key, now, audit) {
+    const restored = sql(`UPDATE _substrat_connect_links
+     SET status = 'outstanding', used_at = NULL, account_ref = NULL, account_label = NULL
+     WHERE id = ? AND tenant_id = ? AND scope_id = ? AND status = 'used' AND expires_at > ?
+     RETURNING ${COLUMNS}`, [key.id, key.tenantId, key.scopeId, now])[0];
+    if (!restored)
+        return undefined;
+    const link = toConnectLink(restored);
+    audit({
+        action: 'restoreConnectLink',
+        target: targetOf(link),
+        before: { status: 'used' },
+        after: { id: link.id, provider: link.provider, status: 'outstanding' },
+    });
+    return link;
+}
+//# sourceMappingURL=connect-links.js.map

package/dist/connect-links.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect-links.js","sourceRoot":"","sources":["../src/connect-links.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,GAMZ,MAAM,yBAAyB,CAAC;AAGjC;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;CAmBhC,CAAC;AAEF,6FAA6F;AAC7F,MAAM,OAAO,GACX,4FAA4F;IAC5F,6DAA6D,CAAC;AAmBhE,MAAM,aAAa,GAAG,CAAC,CAAiB,EAAe,EAAE,CACvD,WAAW,CAAC,KAAK,CAAC;IAChB,EAAE,EAAE,CAAC,CAAC,EAAE;IACR,QAAQ,EAAE,CAAC,CAAC,SAAS;IACrB,OAAO,EAAE,CAAC,CAAC,QAAQ;IACnB,QAAQ,EAAE,CAAC,CAAC,QAAQ;IACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;IACpB,MAAM,EAAE,CAAC,CAAC,MAAM;IAChB,SAAS,EAAE,CAAC,CAAC,UAAU;IACvB,UAAU,EAAE,CAAC,CAAC,WAAW;IACzB,SAAS,EAAE,CAAC,CAAC,UAAU;IACvB,SAAS,EAAE,CAAC,CAAC,UAAU;IACvB,SAAS,EAAE,CAAC,CAAC,UAAU;IACvB,MAAM,EAAE,CAAC,CAAC,OAAO;IACjB,UAAU,EAAE,CAAC,CAAC,WAAW;IACzB,YAAY,EAAE,CAAC,CAAC,aAAa;CAC9B,CAAC,CAAC;AAqBL,MAAM,QAAQ,GAAG,CAAC,IAAiB,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;AAEtH,MAAM,OAAO,GAAG,CAAC,GAAiB,EAAE,GAAsB,EAA8B,EAAE,CACxF,GAAG,CAAC,UAAU,OAAO,+EAA+E,EAAE;IACpG,GAAG,CAAC,EAAE;IACN,GAAG,CAAC,QAAQ;IACZ,GAAG,CAAC,OAAO;CACZ,CAAC,CAAC,CAAC,CAA+B,CAAC;AAEtC,MAAM,UAAU,iBAAiB,CAC/B,GAAiB,EACjB,GAWC,EACD,KAAsC;IAEtC,MAAM,QAAQ,GAAG,GAAG,CAClB;;;;iBAIa,OAAO,EAAE,EACtB;QACE,GAAG,CAAC,EAAE;QACN,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,OAAO;QACX,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,SAAS;QACb,GAAG,CAAC,UAAU;QACd,GAAG,CAAC,SAAS;QACb,GAAG,CAAC,SAAS;QACb,GAAG,CAAC,SAAS;KACd,CACF,CAAC,CAAC,CAAmB,CAAC;IACvB,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACrC,KAAK,CAAC;QACJ,MAAM,EAAE,iBAAiB;QACzB,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC;QACtB,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;KACtG,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAiB,EAAE,GAAsB;IACvE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC9B,OAAO,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,GAAiB,EACjB,MAAqH,EACrH,GAAW;IAEX,IAAI,MAAM,CAAC,GAAG,EAAE,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC,CAAC,gDAAgD;IACzF,MAAM,KAAK,GAAG,CAAC,eAAe,CAAC,CAAC;IAChC,MAAM,MAAM,GAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,OAAO;QAAE,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9E,qFAAqF;IACrF,IAAI,MAAM,CAAC,GAAG;QAAE,CAAC,KAAK,CAAC,IAAI,CAAC,wCAAwC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChH,IAAI,MAAM,CAAC,QAAQ;QAAE,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IAChF,IAAI,MAAM,CAAC,eAAe;QAAE,CAAC,KAAK,CAAC,IAAI,CAAC,2CAA2C,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACxG,OACE,GAAG,CACD,UAAU,OAAO,uCAAuC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC;yCACxC,EACnC,MAAM,CAET,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;AACvB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,GAAiB,EACjB,GAAsB,EACtB,KAAsC;IAEtC,MAAM,KAAK,GAAG,GAAG,CACf;;iBAEa,OAAO,EAAE,EACtB,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,CACpC,CAAC,CAAC,CAA+B,CAAC;IACnC,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QAClC,KAAK,CAAC;YACJ,MAAM,EAAE,mBAAmB;YAC3B,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC;YACtB,MAAM,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE;YACjC,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE;SACnE,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACjC,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC9B,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACxE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAAiB,EACjB,KAA2F,EAC3F,GAAW,EACX,KAAsC;IAEtC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,CAAC,MAA0B,EAAsB,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3F,sEAAsE;IACtE,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;QAAE,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC;IACtE,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;IACjD,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC;IACvD,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG;QAAE,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,GAAG,CACf;;iBAEa,OAAO,EAAE,EACtB,CAAC,GAAG,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI,EAAE,KAAK,CAAC,YAAY,IAAI,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAC1G,CAAC,CAAC,CAA+B,CAAC;IACnC,IAAI,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAClC,KAAK,CAAC;QACJ,MAAM,EAAE,oBAAoB;QAC5B,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC;QACtB,MAAM,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE;QACjC,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE;KAC7F,CAAC,CAAC;IACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAAiB,EACjB,GAAsB,EACtB,GAAW,EACX,KAAsC;IAEtC,MAAM,QAAQ,GAAG,GAAG,CAClB;;;iBAGa,OAAO,EAAE,EACtB,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CACzC,CAAC,CAAC,CAA+B,CAAC;IACnC,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACrC,KAAK,CAAC;QACJ,MAAM,EAAE,oBAAoB;QAC5B,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC;QACtB,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;QAC1B,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE;KACvE,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/connect-state.d.ts

@@ -9,13 +9,14 @@
  * reason to have one — presses Connect on the vertical's own screen, and the vertical's
  * operation is the permission-checked act.
  *
- * **Why this claim carries no link row.** The dashboard's connect link is minted, mailed,
- * and clicked days later by someone else, so it is a row: single-use, revocable, and dead
- * when the minting admin loses access. A vertical-minted round is clicked in-session by
+ * **Why an in-session claim carries no link row.** The dashboard's connect link is minted,
+ * mailed, and clicked days later by someone else, so it is a row: single-use, revocable, and
+ * dead when the minting admin loses access. A vertical-minted round is clicked in-session by
  * the person who just pressed the button, so the row would be state nobody reads. What
  * replaces it is the expiry — minutes, not a week — and the account leg of the connection
  * key: a replayed round re-consents the SAME company, which the store rotates in place
  * rather than duplicating (#1267). The consent code itself is single-use at the provider.
+ * A vertical's MAILED link is the other case again, and carries a row: `linkId`, below.
  *
  * **Why the kernel.** Two workers hold the halves — the control plane mints (it owns the
  * directory the vertical is re-derived from), the dashboard verifies (it owns the one
@@ -70,6 +71,14 @@ export interface ConnectStateClaim {
      * just landed without waiting to match on an organisation number.
      */
     subjectRef?: string;
+    /**
+     * Set when the round is a MAILED link (connections.md §3.5.4): the platform-held row in
+     * `_substrat_connect_links` that makes it single-use and revocable. The signature alone
+     * cannot be withdrawn, and a link lives days — so the callback asks this row, consumes it
+     * before storing, and refuses a round whose row is spent or revoked. Absent: an in-session
+     * round, which lives minutes and has no row (above). `exp` is then the row's own expiry.
+     */
+    linkId?: string;
     /** Epoch ms. */
     exp: number;
 }

package/dist/connect-state.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connect-state.d.ts","sourceRoot":"","sources":["../src/connect-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,8FAA8F;AAC9F,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,uCAAuC,CAAC;AAE1E;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,6CAA6C;IAC7C,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,8FAA8F;IAC9F,QAAQ,EAAE,MAAM,CAAC;IACjB,iCAAiC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,6GAA6G;IAC7G,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB;IAChB,GAAG,EAAE,MAAM,CAAC;CACb;AA6DD;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAOxG;AAED;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CACtC,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CA0BnC"}
+{"version":3,"file":"connect-state.d.ts","sourceRoot":"","sources":["../src/connect-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,8FAA8F;AAC9F,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,uCAAuC,CAAC;AAE1E;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,6CAA6C;IAC7C,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,8FAA8F;IAC9F,QAAQ,EAAE,MAAM,CAAC;IACjB,iCAAiC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,6GAA6G;IAC7G,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB;IAChB,GAAG,EAAE,MAAM,CAAC;CACb;AA6DD;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAOxG;AAED;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CACtC,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CA6BnC"}

package/dist/connect-state.js

@@ -9,13 +9,14 @@
  * reason to have one — presses Connect on the vertical's own screen, and the vertical's
  * operation is the permission-checked act.
  *
- * **Why this claim carries no link row.** The dashboard's connect link is minted, mailed,
- * and clicked days later by someone else, so it is a row: single-use, revocable, and dead
- * when the minting admin loses access. A vertical-minted round is clicked in-session by
+ * **Why an in-session claim carries no link row.** The dashboard's connect link is minted,
+ * mailed, and clicked days later by someone else, so it is a row: single-use, revocable, and
+ * dead when the minting admin loses access. A vertical-minted round is clicked in-session by
  * the person who just pressed the button, so the row would be state nobody reads. What
  * replaces it is the expiry — minutes, not a week — and the account leg of the connection
  * key: a replayed round re-consents the SAME company, which the store rotates in place
  * rather than duplicating (#1267). The consent code itself is single-use at the provider.
+ * A vertical's MAILED link is the other case again, and carries a row: `linkId`, below.
  *
  * **Why the kernel.** Two workers hold the halves — the control plane mints (it owns the
  * directory the vertical is re-derived from), the dashboard verifies (it owns the one
@@ -114,6 +115,10 @@ export async function verifyConnectState(platformSecret, token, now) {
             if (typeof claim[field] !== 'string' || !claim[field])
                 return null;
         }
+        // A link round with a malformed row reference would read as an in-session round — the
+        // one kind the callback spends nothing for — so it is refused, never downgraded.
+        if (claim.linkId !== undefined && (typeof claim.linkId !== 'string' || !claim.linkId))
+            return null;
         return claim;
     }
     catch {

package/dist/connect-state.js.map

@@ -1 +1 @@
-{"version":3,"file":"connect-state.js","sourceRoot":"","sources":["../src/connect-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,8FAA8F;AAC9F,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,oCAAoC,CAAC;AAqE1E,MAAM,GAAG,GAAG,CAAC,CAAS,EAAc,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAEnE,MAAM,MAAM,GAAG,CAAC,KAAiB,EAAU,EAAE;IAC3C,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACnD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC5E,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CAAC,CAAS,EAAc,EAAE;IAC9C,MAAM,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9F,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IACzB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAEF,yFAAyF;AACzF,KAAK,UAAU,QAAQ,CAAC,cAAsB;IAC5C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;IACpG,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,qBAAqB,CAAC,EAAE,EACnG,GAAG,EACH,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAC9C,KAAK,EACL,CAAC,MAAM,EAAE,QAAQ,CAAC,CACnB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,cAAsB,EAAE,KAAwB;IACrF,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,iBAAiB,CAAC,0EAA0E,CAAC,CAAC;IAC1G,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,QAAQ,CAAC,cAAc,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxG,OAAO,GAAG,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;AAClC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,cAAkC,EAClC,KAAa,EACb,GAAW;IAEX,IAAI,CAAC,cAAc,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC;IAC1B,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,EAAE,GAAG,KAAK,CAAC;IACf,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACzG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAsB,CAAC;QAC7F,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,IAAI,GAAG;YAAE,OAAO,IAAI,CAAC;QACnE,mFAAmF;QACnF,mFAAmF;QACnF,qEAAqE;QACrE,KAAK,MAAM,KAAK,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,CAAU,EAAE,CAAC;YAC1F,IAAI,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;QACrE,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"connect-state.js","sourceRoot":"","sources":["../src/connect-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,8FAA8F;AAC9F,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,oCAAoC,CAAC;AA6E1E,MAAM,GAAG,GAAG,CAAC,CAAS,EAAc,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAEnE,MAAM,MAAM,GAAG,CAAC,KAAiB,EAAU,EAAE;IAC3C,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACnD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC5E,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CAAC,CAAS,EAAc,EAAE;IAC9C,MAAM,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9F,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IACzB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAEF,yFAAyF;AACzF,KAAK,UAAU,QAAQ,CAAC,cAAsB;IAC5C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;IACpG,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,qBAAqB,CAAC,EAAE,EACnG,GAAG,EACH,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAC9C,KAAK,EACL,CAAC,MAAM,EAAE,QAAQ,CAAC,CACnB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,cAAsB,EAAE,KAAwB;IACrF,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,iBAAiB,CAAC,0EAA0E,CAAC,CAAC;IAC1G,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,QAAQ,CAAC,cAAc,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxG,OAAO,GAAG,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;AAClC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,cAAkC,EAClC,KAAa,EACb,GAAW;IAEX,IAAI,CAAC,cAAc,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC;IAC1B,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,EAAE,GAAG,KAAK,CAAC;IACf,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACzG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAsB,CAAC;QAC7F,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,IAAI,GAAG;YAAE,OAAO,IAAI,CAAC;QACnE,mFAAmF;QACnF,mFAAmF;QACnF,qEAAqE;QACrE,KAAK,MAAM,KAAK,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,CAAU,EAAE,CAAC;YAC1F,IAAI,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;QACrE,CAAC;QACD,sFAAsF;QACtF,iFAAiF;QACjF,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACnG,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/derived-object.d.ts

@@ -0,0 +1,14 @@
+/**
+ * One schema object the kernel derives from a declaration (#2090): the CREATE statement as the
+ * kernel emits it, and the table SQLite files it under (`sqlite_master.tbl_name`). The DDL that
+ * creates it is assembled from this, so what is checked and what is run cannot differ.
+ */
+export interface DerivedObject {
+    readonly name: string;
+    readonly type: 'table' | 'trigger' | 'index';
+    /** `sqlite_master.tbl_name`: the table a trigger or index is on; a table's own name. */
+    readonly table: string;
+    /** The CREATE statement, without its trailing `;` — as `sqlite_master.sql` stores it. */
+    readonly sql: string;
+}
+//# sourceMappingURL=derived-object.d.ts.map

package/dist/derived-object.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"derived-object.d.ts","sourceRoot":"","sources":["../src/derived-object.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,SAAS,GAAG,OAAO,CAAC;IAC7C,wFAAwF;IACxF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,yFAAyF;IACzF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB"}

package/dist/derived-object.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=derived-object.js.map

package/dist/derived-object.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"derived-object.js","sourceRoot":"","sources":["../src/derived-object.ts"],"names":[],"mappings":""}

package/dist/derived-objects.d.ts

@@ -0,0 +1,108 @@
+/**
+ * What the kernel derived onto a module's tables, checked and put back (#2090).
+ *
+ * | Object | Is | When it is missing or not what the kernel emits |
+ * |---|---|---|
+ * | `_substrat_archived_at` / `_substrat_trashed_at` (#119) | state | fail closed: it cannot be invented again |
+ * | the `born` / `moved` archive/trash guard triggers (#119) | derived | put back |
+ * | the derived list indexes, partial per view on a stateful table (#811) | derived | put back |
+| the purge sweep's partial index on a trashable table with a horizon (#119) | derived | put back |
+ * | the search index and the three triggers keeping it in step (#827) | derived | rebuilt from the rows |
+ *
+ * The search triggers are a privacy fact, not only a freshness one: subject erasure rewrites a
+ * row's text and relies on the update and delete triggers to take the old text out of the index.
+ * Without them, erased text stays searchable.
+ *
+ * **An object is judged by its definition, not its name.** `sqlite_master` holds each one's
+ * CREATE statement as it was run, and the kernel knows the statement it emits
+ * (`DerivedObject`), so a same-named trigger that does nothing, an index on the wrong columns or
+ * with the wrong partial predicate, and an object filed under another table are all "not
+ * there". The text is compared exactly: nothing but the kernel writes these objects, and a
+ * normalisation that forgave whitespace would forgive it inside a string literal too — a guard
+ * keyed on a different entity type. An object an older kernel worded differently is re-created
+ * once.
+ *
+ * Four places ask, and all four come here, so "what a table is owed" is written once:
+ *
+ * - **runtime DDL** (`ctx.sql`'s after-DDL hook, #1811) repairs inside the operation's
+ *   transaction, whenever the scope has any derived plan. The text guard already refuses the DDL
+ *   known to move a stateful table's rows; a search-only or list-only table has no such guard,
+ *   and a module may rebuild it — this puts its triggers and indexes back before the operation
+ *   commits. A lost state column fails the operation, and the DDL with it.
+ * - **a migration** checks the state columns after its own SQL, inside its own transaction, so a
+ *   migration that drops one rolls back with nothing applied. The last migration of a pass then
+ *   repairs the derived objects, inside that same transaction: SQLite's ordinary
+ *   create-copy-rename rebuild of a table drops its triggers and indexes with it, and the
+ *   migrations that made them are journaled, so they never run again. Only after the last,
+ *   because a rebuild split over two migrations copies its rows in the second, and a guard put
+ *   back in between would refuse the archived ones — which also means such a split must ship
+ *   in ONE deploy: split over two, the guard is back before the copy runs.
+ * - **a wake with nothing pending** (and every `migrateScope`) repairs the same way, once per
+ *   instance. That is what reaches a scope stripped before this existed, whose migrations are
+ *   all journaled and will never run again.
+ * - **a restore** repairs after the rows, inside the load's transaction, which may legitimately
+ *   bring them archived or trashed.
+ *
+ * ## What the journal says a table is owed
+ *
+ * Every expectation comes from `_substrat_migrations`, not only from the declarations: a scope
+ * mid-upgrade has declared a trash its column migration has not added yet, and a restored dump
+ * carries the journal of the scope it came from. A column is owed once the migration that added
+ * it is journaled; a derived object once the migration that derived it, for the CURRENT
+ * declaration, is. An object from a withdrawn declaration is not this module's business.
+ */
+import { SubstratError } from '@substrat-run/contracts';
+import { type EntityStatePlan } from './entity-state.js';
+import { type ListIndexPlan } from './list-index.js';
+import type { ScopedSql } from './scope-host.js';
+import { type SearchIndexPlan } from './search-index.js';
+/** A scope's derivation inputs: every registered module's plans, entity type → plan. */
+export interface DerivedPlans {
+    readonly state: ReadonlyMap<string, EntityStatePlan>;
+    readonly lists: ReadonlyMap<string, ListIndexPlan>;
+    readonly search: ReadonlyMap<string, SearchIndexPlan>;
+}
+/**
+ * A table without a state column its journal says it has (`internal`). `migration` is the
+ * journaled `<module>@<version>` that added the column — what a scope failing closed on a wake,
+ * where no migration ran, records as its failure.
+ */
+export declare class StateColumnLost extends SubstratError {
+    readonly migration: string;
+    constructor(migration: string, message: string);
+}
+/**
+ * After runtime DDL, inside the operation's transaction: the same repair a migration pass makes.
+ * A lost state column throws `internal`, and the operation and its DDL roll back.
+ */
+export declare function afterRuntimeDdl(sql: ScopedSql, run: (ddl: string) => void, plans: DerivedPlans): void;
+/** Whether a scope has anything derived for `afterRuntimeDdl` to keep — the hook is installed only then. */
+export declare const derivesAnything: (plans: DerivedPlans) => boolean;
+/**
+ * A migration's half, after its own SQL and inside its own transaction: the state columns are
+ * still where the journal put them. A migration that dropped one throws here and rolls back —
+ * the rows keep their state, and the scope fails closed naming the migration.
+ */
+export declare function assertEntityStateColumns(sql: ScopedSql, plans: DerivedPlans, after: string): void;
+/**
+ * Check the state columns, then re-create every derived set the journal says a table is owed
+ * and the catalogue does not hold exactly as emitted. Run inside the caller's transaction, so a
+ * failure — a lost column, or DDL that will not apply — rolls the caller back whole.
+ *
+ * `run` executes a multi-statement script (a Durable Object splits it first). `after` names what
+ * left the schema this way, for the message. `absentTable: 'skip'` is a restore's: a table the
+ * dump did not carry is left absent, and owed nothing. Everywhere else an owed table that is
+ * gone has lost its state, and fails closed.
+ */
+export declare function repairDerivedObjects(sql: ScopedSql, run: (ddl: string) => void, plans: DerivedPlans, opts: {
+    readonly after: string;
+    readonly absentTable?: 'fail' | 'skip';
+}): void;
+/**
+ * Both adapters' migration pass, after one migration's SQL and inside its transaction: the
+ * column check, and — after the last migration of the pass — the derived objects repaired.
+ * `key` is `<module>@<version>`, which a failure names. A last entry the pass skips (journaled
+ * by a pass that ran first) needs nothing here: that pass repaired them after it.
+ */
+export declare function afterMigration(sql: ScopedSql, run: (ddl: string) => void, plans: DerivedPlans, key: string, last: boolean): void;
+//# sourceMappingURL=derived-objects.d.ts.map

package/dist/derived-objects.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"derived-objects.d.ts","sourceRoot":"","sources":["../src/derived-objects.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAExD,OAAO,EAQL,KAAK,eAAe,EACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAoD,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACvG,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAA0D,KAAK,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEjH,wFAAwF;AACxF,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACrD,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACnD,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;CACvD;AAED;;;;GAIG;AACH,qBAAa,eAAgB,SAAQ,aAAa;IAE9C,QAAQ,CAAC,SAAS,EAAE,MAAM;IAD5B,YACW,SAAS,EAAE,MAAM,EAC1B,OAAO,EAAE,MAAM,EAGhB;CACF;AAsHD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,EAAE,KAAK,EAAE,YAAY,GAAG,IAAI,CAErG;AAED,4GAA4G;AAC5G,eAAO,MAAM,eAAe,UAAW,YAAY,KAAG,OACiB,CAAC;AAExE;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAIjG;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,SAAS,EACd,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,EAC1B,KAAK,EAAE,YAAY,EACnB,IAAI,EAAE;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;CAAE,GACvE,IAAI,CAON;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,SAAS,EACd,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,EAC1B,KAAK,EAAE,YAAY,EACnB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,OAAO,GACZ,IAAI,CAGN"}

package/dist/derived-objects.js

@@ -0,0 +1,199 @@
+/**
+ * What the kernel derived onto a module's tables, checked and put back (#2090).
+ *
+ * | Object | Is | When it is missing or not what the kernel emits |
+ * |---|---|---|
+ * | `_substrat_archived_at` / `_substrat_trashed_at` (#119) | state | fail closed: it cannot be invented again |
+ * | the `born` / `moved` archive/trash guard triggers (#119) | derived | put back |
+ * | the derived list indexes, partial per view on a stateful table (#811) | derived | put back |
+| the purge sweep's partial index on a trashable table with a horizon (#119) | derived | put back |
+ * | the search index and the three triggers keeping it in step (#827) | derived | rebuilt from the rows |
+ *
+ * The search triggers are a privacy fact, not only a freshness one: subject erasure rewrites a
+ * row's text and relies on the update and delete triggers to take the old text out of the index.
+ * Without them, erased text stays searchable.
+ *
+ * **An object is judged by its definition, not its name.** `sqlite_master` holds each one's
+ * CREATE statement as it was run, and the kernel knows the statement it emits
+ * (`DerivedObject`), so a same-named trigger that does nothing, an index on the wrong columns or
+ * with the wrong partial predicate, and an object filed under another table are all "not
+ * there". The text is compared exactly: nothing but the kernel writes these objects, and a
+ * normalisation that forgave whitespace would forgive it inside a string literal too — a guard
+ * keyed on a different entity type. An object an older kernel worded differently is re-created
+ * once.
+ *
+ * Four places ask, and all four come here, so "what a table is owed" is written once:
+ *
+ * - **runtime DDL** (`ctx.sql`'s after-DDL hook, #1811) repairs inside the operation's
+ *   transaction, whenever the scope has any derived plan. The text guard already refuses the DDL
+ *   known to move a stateful table's rows; a search-only or list-only table has no such guard,
+ *   and a module may rebuild it — this puts its triggers and indexes back before the operation
+ *   commits. A lost state column fails the operation, and the DDL with it.
+ * - **a migration** checks the state columns after its own SQL, inside its own transaction, so a
+ *   migration that drops one rolls back with nothing applied. The last migration of a pass then
+ *   repairs the derived objects, inside that same transaction: SQLite's ordinary
+ *   create-copy-rename rebuild of a table drops its triggers and indexes with it, and the
+ *   migrations that made them are journaled, so they never run again. Only after the last,
+ *   because a rebuild split over two migrations copies its rows in the second, and a guard put
+ *   back in between would refuse the archived ones — which also means such a split must ship
+ *   in ONE deploy: split over two, the guard is back before the copy runs.
+ * - **a wake with nothing pending** (and every `migrateScope`) repairs the same way, once per
+ *   instance. That is what reaches a scope stripped before this existed, whose migrations are
+ *   all journaled and will never run again.
+ * - **a restore** repairs after the rows, inside the load's transaction, which may legitimately
+ *   bring them archived or trashed.
+ *
+ * ## What the journal says a table is owed
+ *
+ * Every expectation comes from `_substrat_migrations`, not only from the declarations: a scope
+ * mid-upgrade has declared a trash its column migration has not added yet, and a restored dump
+ * carries the journal of the scope it came from. A column is owed once the migration that added
+ * it is journaled; a derived object once the migration that derived it, for the CURRENT
+ * declaration, is. An object from a withdrawn declaration is not this module's business.
+ */
+import { SubstratError } from '@substrat-run/contracts';
+import { entityStateGuardVersion, entityStateTriggerDdl, entityStateTriggerObjects, purgeIndexObjects, purgeIndexRepairDdl, purgeIndexVersion, stateColumnVersionsOf, } from './entity-state.js';
+import { listIndexDdl, listIndexObjects, listIndexVersion } from './list-index.js';
+import { searchIndexDdl, searchIndexObjects, searchIndexVersion } from './search-index.js';
+/**
+ * A table without a state column its journal says it has (`internal`). `migration` is the
+ * journaled `<module>@<version>` that added the column — what a scope failing closed on a wake,
+ * where no migration ran, records as its failure.
+ */
+export class StateColumnLost extends SubstratError {
+    migration;
+    constructor(migration, message) {
+        super('internal', message);
+        this.migration = migration;
+    }
+}
+/** `main`'s own catalogue by lowercased name — so a same-named temp object cannot stand in. */
+function catalogueOf(sql) {
+    return new Map(sql
+        .query(`SELECT type, name, tbl_name, sql FROM main.sqlite_master`)
+        .map((r) => [r.name.toLowerCase(), { type: r.type, table: r.tbl_name, sql: r.sql }]));
+}
+/** The first object of `d` the catalogue does not hold exactly as the kernel emits it. */
+const wrongIn = (catalogue, d) => d.objects.find((o) => {
+    const found = catalogue.get(o.name.toLowerCase());
+    return (found?.type !== o.type ||
+        found.table.toLowerCase() !== o.table.toLowerCase() ||
+        found.sql !== o.sql);
+});
+const columnsOn = (sql, table) => new Set(sql.query(`SELECT name FROM pragma_table_info(?, 'main')`, [table]).map((r) => r.name.toLowerCase()));
+function expectations(sql, plans) {
+    const journal = new Set(sql.query(`SELECT module_id, version FROM _substrat_migrations`).map((r) => `${r.module_id}@${r.version}`));
+    const applied = (moduleId, version) => journal.has(`${moduleId}@${version}`);
+    const byTable = new Map();
+    const entry = (table) => {
+        const key = table.toLowerCase();
+        if (!byTable.has(key))
+            byTable.set(key, { table, derived: [] });
+        return byTable.get(key);
+    };
+    for (const plan of plans.state.values()) {
+        const e = entry(plan.table);
+        const columns = stateColumnVersionsOf(plan)
+            .filter((c) => applied(plan.moduleId, c.version))
+            .map((c) => ({ column: c.column, migration: `${plan.moduleId}@${c.version}` }));
+        if (columns.length)
+            e.columns = columns;
+        if (applied(plan.moduleId, entityStateGuardVersion(plan))) {
+            e.derived.push({ objects: entityStateTriggerObjects(plan), ddl: entityStateTriggerDdl(plan) });
+        }
+        const purge = purgeIndexObjects(plan);
+        if (purge.length && applied(plan.moduleId, purgeIndexVersion(plan))) {
+            e.derived.push({ objects: purge, ddl: purgeIndexRepairDdl(plan) });
+        }
+    }
+    for (const plan of plans.lists.values()) {
+        const objects = listIndexObjects(plan);
+        if (objects.length && applied(plan.moduleId, listIndexVersion(plan))) {
+            entry(plan.table).derived.push({ objects, ddl: listIndexDdl(plan) });
+        }
+    }
+    // The DDL ends in a full `rebuild` from the content table, which is also what repairs an index
+    // that went stale while its triggers were gone or wrong.
+    for (const plan of plans.search.values()) {
+        if (applied(plan.moduleId, searchIndexVersion(plan))) {
+            entry(plan.table).derived.push({ objects: searchIndexObjects(plan), ddl: searchIndexDdl(plan) });
+        }
+    }
+    return [...byTable.values()];
+}
+const lost = (after, table, what, migration) => {
+    throw new StateColumnLost(migration, `${after} left '${table.table}' without ${what} — its archive/trash guarantees depend on it; nothing was changed`);
+};
+/**
+ * The state half: the table holds every column its journal added. Throws `StateColumnLost` on
+ * the first one gone. An absent table counts as losing them all, unless `absentTable` is
+ * `'skip'` — a restore's case, where a dump that did not carry a table is not made to invent one.
+ */
+function assertColumns(sql, catalogue, table, after, absentTable = 'fail') {
+    if (!table.columns)
+        return;
+    if (catalogue.get(table.table.toLowerCase())?.type !== 'table') {
+        if (absentTable === 'skip')
+            return;
+        lost(after, table, 'its table', table.columns[0].migration);
+    }
+    const present = columnsOn(sql, table.table);
+    for (const c of table.columns)
+        if (!present.has(c.column))
+            lost(after, table, c.column, c.migration);
+}
+/**
+ * After runtime DDL, inside the operation's transaction: the same repair a migration pass makes.
+ * A lost state column throws `internal`, and the operation and its DDL roll back.
+ */
+export function afterRuntimeDdl(sql, run, plans) {
+    repairDerivedObjects(sql, run, plans, { after: 'runtime DDL' });
+}
+/** Whether a scope has anything derived for `afterRuntimeDdl` to keep — the hook is installed only then. */
+export const derivesAnything = (plans) => plans.state.size > 0 || plans.lists.size > 0 || plans.search.size > 0;
+/**
+ * A migration's half, after its own SQL and inside its own transaction: the state columns are
+ * still where the journal put them. A migration that dropped one throws here and rolls back —
+ * the rows keep their state, and the scope fails closed naming the migration.
+ */
+export function assertEntityStateColumns(sql, plans, after) {
+    if (plans.state.size === 0)
+        return; // most scopes: nothing holds state, so no read at all
+    const catalogue = catalogueOf(sql);
+    for (const table of expectations(sql, plans))
+        assertColumns(sql, catalogue, table, after);
+}
+/**
+ * Check the state columns, then re-create every derived set the journal says a table is owed
+ * and the catalogue does not hold exactly as emitted. Run inside the caller's transaction, so a
+ * failure — a lost column, or DDL that will not apply — rolls the caller back whole.
+ *
+ * `run` executes a multi-statement script (a Durable Object splits it first). `after` names what
+ * left the schema this way, for the message. `absentTable: 'skip'` is a restore's: a table the
+ * dump did not carry is left absent, and owed nothing. Everywhere else an owed table that is
+ * gone has lost its state, and fails closed.
+ */
+export function repairDerivedObjects(sql, run, plans, opts) {
+    const catalogue = catalogueOf(sql);
+    for (const table of expectations(sql, plans)) {
+        assertColumns(sql, catalogue, table, opts.after, opts.absentTable);
+        if (catalogue.get(table.table.toLowerCase())?.type !== 'table')
+            continue;
+        for (const d of table.derived)
+            if (wrongIn(catalogue, d))
+                run(d.ddl);
+    }
+}
+/**
+ * Both adapters' migration pass, after one migration's SQL and inside its transaction: the
+ * column check, and — after the last migration of the pass — the derived objects repaired.
+ * `key` is `<module>@<version>`, which a failure names. A last entry the pass skips (journaled
+ * by a pass that ran first) needs nothing here: that pass repaired them after it.
+ */
+export function afterMigration(sql, run, plans, key, last) {
+    if (last)
+        repairDerivedObjects(sql, run, plans, { after: `migration ${key}` });
+    else
+        assertEntityStateColumns(sql, plans, `migration ${key}`);
+}
+//# sourceMappingURL=derived-objects.js.map