@substrat-run/kernel 0.140.0 → 0.142.0

package/dist/invocation-line.d.ts

@@ -0,0 +1,211 @@
+/**
+ * The invocation line's grammar: the shape of the one structured log line written per
+ * invocation, and the one function that builds it (#1901).
+ *
+ * Two writers build through it, in two packages. The request line is written by
+ * `invocationLog` / `withInvocationLog` in `@substrat-run/vertical-host`, the host-side
+ * middleware that moved there from the kernel (#1978). The async line — a consumer
+ * delivery or a schedule run — is written by the scope host itself
+ * (`async-invocation-log.ts`), which is why the grammar stays here: both adapters run that
+ * writer, and a field added to one line is a field added to both, in one order.
+ *
+ * Imports nothing at run time. The platform's entry (#1893) bundles this file in front of
+ * every deployed vertical through the `./invocation-line` subpath, and a runtime import of
+ * the contracts root would put every schema in the vocabulary — and zod — into that bundle.
+ */
+import type { InvocationLevel } from '@substrat-run/contracts/invocation-record';
+import type { EmittedReport } from './scope-host.js';
+/**
+ * The field walk's answer for one response (#1331). Names only, and only names the
+ * operation DECLARES: a key the response carries that the declaration does not name is
+ * never written down, since a key can be data (a map keyed by email is still a map). No
+ * value is ever read into it.
+ */
+export interface OutputFieldsReport {
+    /** Declared fields the response carried with a value other than `null`, in declaration order. */
+    present: string[];
+    /** Declared fields the response carried as `null` — on the wire, carrying nothing. */
+    empty: string[];
+    /** Declared fields the response did not carry (missing, or `undefined`). */
+    absent: string[];
+}
+/**
+ * The shape of the emitted line. Deliberately a published contract rather than an
+ * incidental object: the read proxy filters on these key names, and Workers Logs indexes
+ * a `JSON.stringify`ed `console.log` as queryable TOP-LEVEL fields (`tenantId`, not
+ * `$metadata.tenantId` nor `source.tenantId` — verified against the live telemetry API).
+ * Renaming a key here silently empties a view, because a filter on a key that does not
+ * exist returns `success: true` with zero events. Add fields; never rename one.
+ */
+export interface InvocationLogLine {
+    /** Discriminator — what lets a reader tell this line from a vertical's own output. */
+    substrat: 'invocation';
+    /**
+     * #1901: what kind of work the line is about. ABSENT on a request's line — the line every
+     * reader already knew — and present only on the scope host's lines for async work: a
+     * consumer delivery (`consumer`) or a schedule run (`schedule`). A reader treats a missing
+     * `kind` as `request`, which keeps every line written before this field existed meaning
+     * what it meant.
+     */
+    kind?: AsyncInvocationKind;
+    tenantId: string;
+    scopeId: string | null;
+    vertical: string | null;
+    /**
+     * The K-26 surface that answered. Taken from the verified node, so an assertion that
+     * named none reads as `readRoutedNode`'s documented default (`app`) rather than as a
+     * null only this writer would produce — one representation across the platform.
+     */
+    surface: string | null;
+    /** The request's method. `null` on an async line (#1901), which no request carried. */
+    method: string | null;
+    /** Path ONLY: the request writer drops the query string. `null` on an async line (#1901). */
+    path: string | null;
+    /**
+     * #1237: the id every event this invocation emitted is stamped with.
+     *
+     * The join nothing could make before. `$metadata.requestId` correlates the LINES of
+     * one invocation, and it is stamped by the log platform at ingestion — no code here
+     * can read it, and the spine could not have been given it. So the platform mints its
+     * own, writes it here, and carries it to the scope on `InvokeOptions`.
+     *
+     * Which makes this line the other half of a trace: the events say what happened and
+     * in what order, and this says how long the whole call took and how it ended.
+     */
+    invocationId: string;
+    /**
+     * The response status as the caller received it — including the status `onError`
+     * mapped a thrown error to.
+     *
+     * Hono composes `onError` INSIDE the handler chain, not around it, so a handler that
+     * throws does not reject the request middleware's `await next()`: the envelope has already
+     * turned it into a response by the time control comes back, and `c.res` holds the
+     * mapped status. That is worth stating because the opposite is the natural guess, and
+     * guessing it would have put `null` on every error line — the exact rows a tenant
+     * opens this view to find.
+     *
+     * `null` therefore survives only for a genuine escape: an error that got past the
+     * envelope itself, which `threw` marks.
+     *
+     * Always `null` on an async line (#1901): no caller received a status. Its `outcome` and
+     * `level` say how it ended instead.
+     */
+    status: number | null;
+    /** The error escaped even `onError` — rare, and the most interesting line on the page. */
+    threw: boolean;
+    durationMs: number;
+    /** Contracts' `invocationLevelOf`. Always present: it is derived from the two fields above. */
+    level: InvocationLevel;
+    /** The operation that ran. `null` for a route that is not a mounted operation. */
+    operation: string | null;
+    /** The kernel `errorCode` of a failed call, when it has one. */
+    problemCode: string | null;
+    /** Who the call ran as: `principal`, `connection`, `system`, `capability` or `vertical`. */
+    principalKind: string | null;
+    /**
+     * How many events the operation itself emitted. `null` when not recorded, which is
+     * different from `0`: a read emits nothing, and that is a fact about it.
+     */
+    eventCount: number | null;
+    /** The distinct types among those events, in emission order (capped, see `entities`). */
+    eventTypes: string[];
+    /**
+     * The distinct entities those events were about, as `<entityType>:<entityId>`. Taken from
+     * at most `EMITTED_REPORT_CAP` events, so a bulk operation's line names the first few and
+     * `eventCount` says how many there were.
+     */
+    entities: string[];
+    /**
+     * The registry id of the version that served the call — the platform's
+     * `SUBSTRAT_VERSION_ID` binding, the same identity the spine stamps on events. `null`
+     * locally and on a script pushed before the binding existed.
+     */
+    versionId: string | null;
+    /**
+     * #1331: which declared output fields the response carried. The one field on this line
+     * that is OMITTED rather than `null` when unrecorded: the walk behind it is off by
+     * default, and an unarmed line must stay byte-for-byte what it was before the field
+     * existed. A reader treats absence exactly as it treats `null` elsewhere.
+     */
+    outputFields?: OutputFieldsReport;
+    /**
+     * #1923: the router's dispatch id for the request whose response {@link outputFields}
+     * describes — its provenance. Present exactly when `outputFields` is: a reader joins it to
+     * the router's own line for the request, and counts the report only for the tenant and app
+     * that line names.
+     */
+    fieldCoverageId?: string;
+    /** How the unit ended — see {@link AsyncOutcome}. */
+    outcome?: AsyncOutcome;
+    /** A consumer's event type. */
+    eventType?: string | null;
+    /** A consumer's event id — the join to the spine's outbox and delivery journal. */
+    eventId?: string | null;
+    /** Which attempt at this delivery the line is about, counting from 1. */
+    attempt?: number | null;
+    /** A schedule run's due time (ISO 8601), or `null` for a schedule's first run. */
+    dueAt?: string | null;
+    /** How late the run started against `dueAt`, in milliseconds; `null` on a first run. */
+    latenessMs?: number | null;
+    /** A `suppressed` line's count of the lines the pass's cap withheld. */
+    suppressed?: number;
+    /** The same count per `<kind>:<outcome>`, so a storm of one outcome is named, not averaged. */
+    suppressedBy?: Record<string, number>;
+}
+/** #1901: the kinds of async work a scope host writes a line for. A request has no `kind`. */
+export type AsyncInvocationKind = 'consumer' | 'schedule';
+/**
+ * #1901: how a unit of async work ended.
+ *
+ * - `delivered` — a consumer's handler ran and its delivery is journaled done.
+ * - `retrying` — the handler threw and the delivery is due again later.
+ * - `dead-lettered` — the delivery is journaled failed for good: the handler threw on its
+ *   last attempt, or the event never reached it (undecodable, a schema version the consumer
+ *   does not take, withheld by the producer).
+ * - `inert` — a copy of a scope (#2005): the delivery is journaled terminal and NO handler
+ *   ran. Never `delivered`, because nothing was.
+ * - `routed` — the delivery was handed to the platform's drain to run with authority this
+ *   host lacks (a connector on a control-plane-less host).
+ * - `ok` / `failed` — a schedule run.
+ * - `suppressed` — the pass's line cap was reached; the line counts what it withheld.
+ */
+export type AsyncOutcome = 'delivered' | 'retrying' | 'dead-lettered' | 'inert' | 'routed' | 'ok' | 'failed' | 'suppressed';
+/**
+ * The fields of an invocation line, before defaults. The ONE place the line's grammar lives
+ * (#1901): the request writer (`vertical-host`'s `invocationLog`) and the scope host's async
+ * writer both build through {@link invocationLine}, so a field added to one is a field added
+ * to both, in one order.
+ */
+export interface InvocationLineFields {
+    kind?: AsyncInvocationKind;
+    tenantId: string;
+    scopeId: string | null;
+    vertical?: string | null;
+    surface?: string | null;
+    method?: string | null;
+    path?: string | null;
+    invocationId: string;
+    status?: number | null;
+    threw: boolean;
+    durationMs: number;
+    level: InvocationLevel;
+    operation?: string | null;
+    problemCode?: string | null;
+    principalKind?: string | null;
+    emitted?: EmittedReport;
+    /**
+     * #1901: write `entities` from `emitted` (the default). An async line passes `false`: an
+     * entity id is data a vertical chose — an email, a customer number — and the async line
+     * carries ids the platform minted, declared names and codes only. Its `entities` is then
+     * always `[]`, which a reader takes as "not recorded" beside a non-null `eventCount`.
+     */
+    withEntities?: boolean;
+    versionId?: string | null;
+    outputFields?: OutputFieldsReport;
+    /** #1923: written only beside `outputFields`. */
+    fieldCoverageId?: string;
+    async?: Pick<InvocationLogLine, 'outcome' | 'eventType' | 'eventId' | 'attempt' | 'dueAt' | 'latenessMs' | 'suppressed' | 'suppressedBy'>;
+}
+/** Build a line. Unfilled fields are `null` (or empty), as the line's contract says. */
+export declare function invocationLine(f: InvocationLineFields): InvocationLogLine;
+//# sourceMappingURL=invocation-line.d.ts.map

package/dist/invocation-line.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invocation-line.d.ts","sourceRoot":"","sources":["../src/invocation-line.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAErD;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,iGAAiG;IACjG,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,sFAAsF;IACtF,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,4EAA4E;IAC5E,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAChC,sFAAsF;IACtF,QAAQ,EAAE,YAAY,CAAC;IACvB;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,mBAAmB,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB;;;;OAIG;IACH,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,uFAAuF;IACvF,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,6FAA6F;IAC7F,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB;;;;;;;;;;OAUG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;;;;;;;;;;;;OAgBG;IACH,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,0FAA0F;IAC1F,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IAMnB,+FAA+F;IAC/F,KAAK,EAAE,eAAe,CAAC;IACvB,kFAAkF;IAClF,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,gEAAgE;IAChE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,4FAA4F;IAC5F,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;;;OAGG;IACH,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,yFAAyF;IACzF,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB;;;;OAIG;IACH,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB;;;;OAIG;IACH,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IAMzB,qDAAqD;IACrD,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,+BAA+B;IAC/B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,mFAAmF;IACnF,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,yEAAyE;IACzE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,kFAAkF;IAClF,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,wFAAwF;IACxF,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,wEAAwE;IACxE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+FAA+F;IAC/F,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACvC;AAED,8FAA8F;AAC9F,MAAM,MAAM,mBAAmB,GAAG,UAAU,GAAG,UAAU,CAAC;AAE1D;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,YAAY,GACpB,WAAW,GACX,UAAU,GACV,eAAe,GACf,OAAO,GACP,QAAQ,GACR,IAAI,GACJ,QAAQ,GACR,YAAY,CAAC;AAEjB;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,IAAI,CAAC,EAAE,mBAAmB,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,eAAe,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC,iDAAiD;IACjD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE,IAAI,CACV,iBAAiB,EACjB,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,GAAG,YAAY,GAAG,YAAY,GAAG,cAAc,CACzG,CAAC;CACH;AAED,wFAAwF;AACxF,wBAAgB,cAAc,CAAC,CAAC,EAAE,oBAAoB,GAAG,iBAAiB,CA0BzE"}

package/dist/invocation-line.js

@@ -0,0 +1,33 @@
+/** Build a line. Unfilled fields are `null` (or empty), as the line's contract says. */
+export function invocationLine(f) {
+    const emitted = f.emitted;
+    return {
+        substrat: 'invocation',
+        ...(f.kind ? { kind: f.kind } : {}),
+        tenantId: f.tenantId,
+        scopeId: f.scopeId,
+        vertical: f.vertical ?? null,
+        surface: f.surface ?? null,
+        method: f.method ?? null,
+        path: f.path ?? null,
+        status: f.status ?? null,
+        threw: f.threw,
+        durationMs: f.durationMs,
+        invocationId: f.invocationId,
+        level: f.level,
+        operation: f.operation ?? null,
+        problemCode: f.problemCode ?? null,
+        principalKind: f.principalKind ?? null,
+        eventCount: emitted ? emitted.total : null,
+        eventTypes: emitted ? distinct(emitted.events.map((e) => e.type)) : [],
+        entities: emitted && f.withEntities !== false ? distinct(emitted.events.map((e) => e.entity)) : [],
+        versionId: f.versionId ?? null,
+        ...(f.outputFields ? { outputFields: f.outputFields, ...(f.fieldCoverageId ? { fieldCoverageId: f.fieldCoverageId } : {}) } : {}),
+        ...(f.async ?? {}),
+    };
+}
+/** Distinct values, first occurrence wins — the order a reader expects to see them in. */
+function distinct(values) {
+    return [...new Set(values)];
+}
+//# sourceMappingURL=invocation-line.js.map

package/dist/invocation-line.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invocation-line.js","sourceRoot":"","sources":["../src/invocation-line.ts"],"names":[],"mappings":"AA2OA,wFAAwF;AACxF,MAAM,UAAU,cAAc,CAAC,CAAuB;IACpD,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;IAC1B,OAAO;QACL,QAAQ,EAAE,YAAY;QACtB,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,IAAI;QAC5B,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,IAAI;QAC1B,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI;QACxB,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI;QACpB,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI;QACxB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI;QAC9B,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,IAAI;QAClC,aAAa,EAAE,CAAC,CAAC,aAAa,IAAI,IAAI;QACtC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;QAC1C,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;QACtE,QAAQ,EAAE,OAAO,IAAI,CAAC,CAAC,YAAY,KAAK,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;QAClG,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI;QAC9B,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;KACnB,CAAC;AACJ,CAAC;AAED,0FAA0F;AAC1F,SAAS,QAAQ,CAAC,MAAyB;IACzC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9B,CAAC"}

package/dist/meters.d.ts

@@ -18,10 +18,12 @@ export interface MeterTenantInput {
     slug: string;
     status: TenantStatus;
 }
-/** One scope row the fold needs. Only its tenant and status matter to a meter. */
+/** One scope row the fold needs. Its tenant and status, and for storage what it was archived from. */
 export interface MeterScopeInput {
     tenantId: TenantId;
     status: ScopeStatus;
+    /** #1524: `provisioning` = archived before it held data, so it has no storage to count. */
+    archivedFromStatus?: ScopeStatus | null;
 }
 /** One entitlement grant the fold needs; `quota` is expression only, so it is absent. */
 export interface MeterEntitlementInput {
@@ -40,6 +42,24 @@ export interface MeterInput {
     tenants: MeterTenantInput[];
     scopes: MeterScopeInput[];
     entitlements: MeterEntitlementInput[];
+    /**
+     * The stored storage gauge (#1524): the latest sample of each non-reaped scope. Absent when
+     * the host keeps no gauge, and then the reading carries no `storage` at all, rather than a
+     * zero that would read as "this tenant stores nothing".
+     */
+    storage?: MeterStorageInput[];
+    /** Each non-reaped scope's latest storage-read attempt, so a failing scope is named, not missing. */
+    storageAttempts?: {
+        tenantId: TenantId;
+        attemptedAt: string;
+        error: string | null;
+    }[];
+}
+/** One scope's latest storage sample, as the fold needs it. */
+export interface MeterStorageInput {
+    tenantId: TenantId;
+    bytes: number;
+    readAt: string;
 }
 /**
  * Fold directory rows into one reading. Pure: same rows in, same numbers out, no clock

package/dist/meters.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"meters.d.ts","sourceRoot":"","sources":["../src/meters.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,OAAO,EACP,YAAY,EAEZ,WAAW,EACX,QAAQ,EAER,YAAY,EACb,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;;;;GAYG;AAEH,2EAA2E;AAC3E,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,QAAQ,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,YAAY,CAAC;CACtB;AAED,kFAAkF;AAClF,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,QAAQ,CAAC;IACnB,MAAM,EAAE,WAAW,CAAC;CACrB;AAED,yFAAyF;AACzF,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,QAAQ,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,UAAU;IACzB;;;;OAIG;IACH,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC5B,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1B,YAAY,EAAE,qBAAqB,EAAE,CAAC;CACvC;AA2CD;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,UAAU,GAAG,YAAY,CAkEhE"}
+{"version":3,"file":"meters.d.ts","sourceRoot":"","sources":["../src/meters.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,OAAO,EACP,YAAY,EAEZ,WAAW,EACX,QAAQ,EAER,YAAY,EACb,MAAM,yBAAyB,CAAC;AAGjC;;;;;;;;;;;;GAYG;AAEH,2EAA2E;AAC3E,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,QAAQ,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,YAAY,CAAC;CACtB;AAED,sGAAsG;AACtG,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,QAAQ,CAAC;IACnB,MAAM,EAAE,WAAW,CAAC;IACpB,2FAA2F;IAC3F,kBAAkB,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;CACzC;AAED,yFAAyF;AACzF,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,QAAQ,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,UAAU;IACzB;;;;OAIG;IACH,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC5B,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1B,YAAY,EAAE,qBAAqB,EAAE,CAAC;IACtC;;;;OAIG;IACH,OAAO,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAC9B,qGAAqG;IACrG,eAAe,CAAC,EAAE;QAAE,QAAQ,EAAE,QAAQ,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,EAAE,CAAC;CACvF;AAED,+DAA+D;AAC/D,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AA2CD;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,UAAU,GAAG,YAAY,CAiGhE"}

package/dist/meters.js.map

@@ -1 +1 @@
-{"version":3,"file":"meters.js","sourceRoot":"","sources":["../src/meters.ts"],"names":[],"mappings":"AA0DA,MAAM,gBAAgB,GAAG,GAAqB,EAAE,CAAC,CAAC;IAChD,KAAK,EAAE,CAAC;IACR,MAAM,EAAE,CAAC;IACT,SAAS,EAAE,CAAC;IACZ,YAAY,EAAE,CAAC;IACf,QAAQ,EAAE,CAAC;IACX,MAAM,EAAE,CAAC;CACV,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,SAAS,MAAM,CAAC,KAAsB,EAAE,YAAsC;IAC5E,QAAQ,KAAK,CAAC,MAAM,EAAE,CAAC;QACrB,KAAK,QAAQ;YACX,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC;QAC5D,KAAK,WAAW;YACd,OAAO,WAAW,CAAC;QACrB,KAAK,cAAc;YACjB,OAAO,cAAc,CAAC;QACxB,KAAK,WAAW,CAAC;QACjB,KAAK,UAAU;YACb,OAAO,UAAU,CAAC;QACpB,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAC;IACpB,CAAC;AACH,CAAC;AAED,oGAAoG;AACpG,SAAS,MAAM,CAAC,KAA4B,EAAE,MAAe;IAC3D,OAAO,KAAK,CAAC,SAAS,KAAK,IAAI,IAAI,KAAK,CAAC,SAAS,GAAG,MAAM,CAAC;AAC9D,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAiB;IAChD,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAyB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAE3F,MAAM,cAAc,GAAG,IAAI,GAAG,CAA6B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,CAAC;IACjH,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM;YAAE,SAAS,CAAC,mCAAmC;QAC1D,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACtD,CAAC;IAED,MAAM,cAAc,GAAG,IAAI,GAAG,CAC5B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,CAC1D,CAAC;IACF,8EAA8E;IAC9E,qFAAqF;IACrF,qFAAqF;IACrF,MAAM,KAAK,GAAG,IAAI,GAAG,EAA+B,CAAC;IACrD,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,IAAmB,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;IAC5E,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI;YAAE,SAAS,CAAC,mCAAmC;QACxD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,IAAI;YAAE,IAAI,CAAC,IAAI,EAAE,CAAC;;YACjB,IAAI,CAAC,OAAO,EAAE,CAAC;QACpB,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,QAAQ;YAAE,SAAS,CAAC,yBAAyB;QAChF,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QAChH,IAAI,IAAI;YAAE,GAAG,CAAC,OAAO,EAAE,CAAC;;YACnB,GAAG,CAAC,OAAO,EAAE,CAAC;QACnB,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IACrB,CAAC;IAED,MAAM,SAAS,GAAqB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtD,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,QAAQ,EAAE,CAAC,CAAC,MAAM,KAAK,QAAQ;QAC/B,MAAM,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAE;QACvC,YAAY,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAE;KAC9C,CAAC,CAAC,CAAC;IAEJ,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAA+B;YAAE,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAChG,CAAC;IAED,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE;YACP,KAAK,EAAE,OAAO,CAAC,MAAM;YACrB,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,MAAM;YAC3D,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,MAAM;YACjE,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,MAAM;YAC/D,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,MAAM;SAC5D;QACD,MAAM;QACN,YAAY,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CACpC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,CAAC,CAAC,CAAC,cAAc,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACxF,yEAAyE;YACzE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAC7C;QACD,SAAS;KACV,CAAC;AACJ,CAAC"}
+{"version":3,"file":"meters.js","sourceRoot":"","sources":["../src/meters.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAkElE,MAAM,gBAAgB,GAAG,GAAqB,EAAE,CAAC,CAAC;IAChD,KAAK,EAAE,CAAC;IACR,MAAM,EAAE,CAAC;IACT,SAAS,EAAE,CAAC;IACZ,YAAY,EAAE,CAAC;IACf,QAAQ,EAAE,CAAC;IACX,MAAM,EAAE,CAAC;CACV,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,SAAS,MAAM,CAAC,KAAsB,EAAE,YAAsC;IAC5E,QAAQ,KAAK,CAAC,MAAM,EAAE,CAAC;QACrB,KAAK,QAAQ;YACX,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC;QAC5D,KAAK,WAAW;YACd,OAAO,WAAW,CAAC;QACrB,KAAK,cAAc;YACjB,OAAO,cAAc,CAAC;QACxB,KAAK,WAAW,CAAC;QACjB,KAAK,UAAU;YACb,OAAO,UAAU,CAAC;QACpB,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAC;IACpB,CAAC;AACH,CAAC;AAED,oGAAoG;AACpG,SAAS,MAAM,CAAC,KAA4B,EAAE,MAAe;IAC3D,OAAO,KAAK,CAAC,SAAS,KAAK,IAAI,IAAI,KAAK,CAAC,SAAS,GAAG,MAAM,CAAC;AAC9D,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAiB;IAChD,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAyB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAE3F,MAAM,cAAc,GAAG,IAAI,GAAG,CAA6B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,CAAC;IACjH,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM;YAAE,SAAS,CAAC,mCAAmC;QAC1D,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACtD,CAAC;IAED,MAAM,cAAc,GAAG,IAAI,GAAG,CAC5B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,CAC1D,CAAC;IACF,8EAA8E;IAC9E,qFAAqF;IACrF,qFAAqF;IACrF,MAAM,KAAK,GAAG,IAAI,GAAG,EAA+B,CAAC;IACrD,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,IAAmB,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;IAC5E,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI;YAAE,SAAS,CAAC,mCAAmC;QACxD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,IAAI;YAAE,IAAI,CAAC,IAAI,EAAE,CAAC;;YACjB,IAAI,CAAC,OAAO,EAAE,CAAC;QACpB,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,QAAQ;YAAE,SAAS,CAAC,yBAAyB;QAChF,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QAChH,IAAI,IAAI;YAAE,GAAG,CAAC,OAAO,EAAE,CAAC;;YACnB,GAAG,CAAC,OAAO,EAAE,CAAC;QACnB,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IACrB,CAAC;IAED,MAAM,eAAe,GAAG,IAAI,GAAG,CAAgC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACrG,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,IAAI,EAAE;QAAE,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC7F,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAuD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7H,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,eAAe,IAAI,EAAE;QAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACvF,wFAAwF;IACxF,4FAA4F;IAC5F,MAAM,cAAc,GAAG,IAAI,GAAG,CAAmB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACtF,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5D,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAE,GAAG,CAAC,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAqB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtD,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,QAAQ,EAAE,CAAC,CAAC,MAAM,KAAK,QAAQ;QAC/B,MAAM,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAE;QACvC,YAAY,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAE;QAC7C,GAAG,CAAC,KAAK,CAAC,OAAO;YACf,CAAC,CAAC;gBACE,OAAO,EAAE,gBAAgB,CACvB,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAE,EAChC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAE,EAC/B,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAE,CAClC;aACF;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC,CAAC;IAEJ,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAA+B;YAAE,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAChG,CAAC;IAED,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE;YACP,KAAK,EAAE,OAAO,CAAC,MAAM;YACrB,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,MAAM;YAC3D,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,MAAM;YACjE,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,MAAM;YAC/D,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,MAAM;SAC5D;QACD,MAAM;QACN,YAAY,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CACpC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,CAAC,CAAC,CAAC,cAAc,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACxF,yEAAyE;YACzE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAC7C;QACD,SAAS;QACT,GAAG,CAAC,KAAK,CAAC,OAAO;YACf,CAAC,CAAC;gBACE,OAAO,EAAE,gBAAgB,CACvB,CAAC,GAAG,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,EACpC,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EACvD,CAAC,GAAG,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CACtC;aACF;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC"}

package/dist/module-log.d.ts

@@ -3,10 +3,11 @@
  *
  * ## Why module code needs one
  *
- * The invocation line (`invocation-log.ts`) is the per-request record: which operation ran,
- * who ran it, how it ended. A vertical's own `console.log` inside a handler carries none of
- * that. It is reachable only by correlating out from the stamped line, it cannot be filtered
- * by operation, and it is free text, so similar lines can only be grouped by guessing.
+ * The invocation line (`invocation-line.ts`, which vertical-host writes per request) is the
+ * per-request record: which operation ran, who ran it, how it ended. A vertical's own
+ * `console.log` inside a handler carries none of that. It is reachable only by correlating
+ * out from the stamped line, it cannot be filtered by operation, and it is free text, so
+ * similar lines can only be grouped by guessing.
  *
  * `ctx.log` writes the line with the fields already on it — tenant, scope, operation,
  * invocation, who it ran as — and with the TEMPLATE it was written from:

package/dist/module-log.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module-log.d.ts","sourceRoot":"","sources":["../src/module-log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,8DAA8D;AAC9D,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAEjE,kEAAkE;AAClE,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;AAEnE,0CAA0C;AAC1C,MAAM,MAAM,eAAe,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAE5E,0EAA0E;AAC1E,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;IACxD,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;IACvD,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;IACvD,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;CACzD;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,8FAA8F;IAC9F,QAAQ,EAAE,KAAK,CAAC;IAChB,KAAK,EAAE,cAAc,CAAC;IACtB,uFAAuF;IACvF,QAAQ,EAAE,MAAM,CAAC;IACjB,oEAAoE;IACpE,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAC5C,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,wGAAwG;IACxG,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,qFAAqF;IACrF,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,4FAA4F;IAC5F,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,iFAAiF;AACjF,MAAM,MAAM,aAAa,GAAG,CAAC,IAAI,EAAE,aAAa,KAAK,IAAI,CAAC;AAE1D,8FAA8F;AAC9F,eAAO,MAAM,iBAAiB;aAC5B,QAAQ,EAAE,GAAG;aACb,OAAO,EAAE,IAAI;aACb,MAAM,EAAE,EAAE;aACV,KAAK,EAAE,IAAI;CACH,CAAC;AAcX;;;GAGG;AACH,eAAO,MAAM,cAAc,EAAE,aAM5B,CAAC;AAsBF;;;GAGG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,GAAG,MAAM,CAI9G;AAED,gEAAgE;AAChE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,0FAA0F;IAC1F,YAAY,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IAClC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;;;;OAIG;IACH,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;CACnC;AAED,+FAA+F;AAC/F,wBAAgB,aAAa,CAC3B,GAAG,EAAE,gBAAgB,EACrB,KAAK,EAAE,cAAc,EACrB,QAAQ,EAAE,OAAO,EACjB,KAAK,EAAE,OAAO,GACb,aAAa,CAmCf;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,gBAAgB,EAAE,IAAI,GAAE,aAA8B,GAAG,SAAS,CAShG"}
+{"version":3,"file":"module-log.d.ts","sourceRoot":"","sources":["../src/module-log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,8DAA8D;AAC9D,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAEjE,kEAAkE;AAClE,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;AAEnE,0CAA0C;AAC1C,MAAM,MAAM,eAAe,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAE5E,0EAA0E;AAC1E,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;IACxD,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;IACvD,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;IACvD,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;CACzD;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,8FAA8F;IAC9F,QAAQ,EAAE,KAAK,CAAC;IAChB,KAAK,EAAE,cAAc,CAAC;IACtB,uFAAuF;IACvF,QAAQ,EAAE,MAAM,CAAC;IACjB,oEAAoE;IACpE,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAC5C,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,wGAAwG;IACxG,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,qFAAqF;IACrF,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,4FAA4F;IAC5F,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,iFAAiF;AACjF,MAAM,MAAM,aAAa,GAAG,CAAC,IAAI,EAAE,aAAa,KAAK,IAAI,CAAC;AAE1D,8FAA8F;AAC9F,eAAO,MAAM,iBAAiB;aAC5B,QAAQ,EAAE,GAAG;aACb,OAAO,EAAE,IAAI;aACb,MAAM,EAAE,EAAE;aACV,KAAK,EAAE,IAAI;CACH,CAAC;AAcX;;;GAGG;AACH,eAAO,MAAM,cAAc,EAAE,aAM5B,CAAC;AAsBF;;;GAGG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,GAAG,MAAM,CAI9G;AAED,gEAAgE;AAChE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,0FAA0F;IAC1F,YAAY,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IAClC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;;;;OAIG;IACH,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;CACnC;AAED,+FAA+F;AAC/F,wBAAgB,aAAa,CAC3B,GAAG,EAAE,gBAAgB,EACrB,KAAK,EAAE,cAAc,EACrB,QAAQ,EAAE,OAAO,EACjB,KAAK,EAAE,OAAO,GACb,aAAa,CAmCf;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,gBAAgB,EAAE,IAAI,GAAE,aAA8B,GAAG,SAAS,CAShG"}

package/dist/module-log.js

@@ -3,10 +3,11 @@
  *
  * ## Why module code needs one
  *
- * The invocation line (`invocation-log.ts`) is the per-request record: which operation ran,
- * who ran it, how it ended. A vertical's own `console.log` inside a handler carries none of
- * that. It is reachable only by correlating out from the stamped line, it cannot be filtered
- * by operation, and it is free text, so similar lines can only be grouped by guessing.
+ * The invocation line (`invocation-line.ts`, which vertical-host writes per request) is the
+ * per-request record: which operation ran, who ran it, how it ended. A vertical's own
+ * `console.log` inside a handler carries none of that. It is reachable only by correlating
+ * out from the stamped line, it cannot be filtered by operation, and it is free text, so
+ * similar lines can only be grouped by guessing.
  *
  * `ctx.log` writes the line with the fields already on it — tenant, scope, operation,
  * invocation, who it ran as — and with the TEMPLATE it was written from:

package/dist/module-log.js.map

@@ -1 +1 @@
-{"version":3,"file":"module-log.js","sourceRoot":"","sources":["../src/module-log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AA8CH,8FAA8F;AAC9F,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,QAAQ,EAAE,GAAG;IACb,OAAO,EAAE,IAAI;IACb,MAAM,EAAE,EAAE;IACV,KAAK,EAAE,IAAI;CACH,CAAC;AAEX,4FAA4F;AAC5F,MAAM,UAAU,GAAG,+BAA+B,CAAC;AAWnD;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAkB,CAAC,IAAI,EAAE,EAAE;IACpD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,IAAI,CAAC,KAAK,KAAK,OAAO;QAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;SAC3C,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM;QAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;SAC9C,IAAI,IAAI,CAAC,KAAK,KAAK,OAAO;QAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;;QAChD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC,CAAC;AAEF,SAAS,IAAI,CAAC,IAAY,EAAE,GAAW;IACrC,OAAO,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACjE,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CAAC,CAAU;IAC5B,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IACnD,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACrE,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,MAAqD;IACpG,OAAO,QAAQ,CAAC,OAAO,CAAC,oCAAoC,EAAE,CAAC,KAAK,EAAE,IAAY,EAAE,EAAE,CACpF,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAClF,CAAC;AACJ,CAAC;AAkBD,+FAA+F;AAC/F,MAAM,UAAU,aAAa,CAC3B,GAAqB,EACrB,KAAqB,EACrB,QAAiB,EACjB,KAAc;IAEd,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAChD,yFAAyF;IACzF,0FAA0F;IAC1F,qFAAqF;IACrF,0EAA0E;IAC1E,MAAM,IAAI,GAAwC,EAAE,CAAC;IACrD,MAAM,MAAM,GAAwC,EAAE,CAAC;IACvD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;YACtE,IAAI,CAAC,IAAI,iBAAiB,CAAC,MAAM;gBAAE,MAAM;YACzC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,SAAS;YAClC,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YAC5B,IAAI,CAAC,CAAC,CAAC,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YAC5D,MAAM,CAAC,CAAC,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAW,EAAE,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC;YACtG,CAAC,IAAI,CAAC,CAAC;QACT,CAAC;IACH,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxF,qFAAqF;IACrF,0DAA0D;IAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,EAAE,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC5F,OAAO;QACL,QAAQ,EAAE,KAAK;QACf,KAAK;QACL,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,iBAAiB,CAAC,QAAQ,CAAC;QACxD,OAAO;QACP,MAAM;QACN,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE;QAChC,aAAa,EAAE,GAAG,CAAC,aAAa;KACjC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,GAAqB,EAAE,IAAI,GAAkB,cAAc;IACnF,MAAM,KAAK,GAAG,CAAC,KAAqB,EAAE,EAAE,CAAC,CAAC,QAAgB,EAAE,MAAwB,EAAE,EAAE;QACtF,IAAI,CAAC;YACH,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;QACzE,CAAC;IACH,CAAC,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;AACpG,CAAC"}
+{"version":3,"file":"module-log.js","sourceRoot":"","sources":["../src/module-log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AA8CH,8FAA8F;AAC9F,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,QAAQ,EAAE,GAAG;IACb,OAAO,EAAE,IAAI;IACb,MAAM,EAAE,EAAE;IACV,KAAK,EAAE,IAAI;CACH,CAAC;AAEX,4FAA4F;AAC5F,MAAM,UAAU,GAAG,+BAA+B,CAAC;AAWnD;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAkB,CAAC,IAAI,EAAE,EAAE;IACpD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,IAAI,CAAC,KAAK,KAAK,OAAO;QAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;SAC3C,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM;QAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;SAC9C,IAAI,IAAI,CAAC,KAAK,KAAK,OAAO;QAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;;QAChD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC,CAAC;AAEF,SAAS,IAAI,CAAC,IAAY,EAAE,GAAW;IACrC,OAAO,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACjE,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CAAC,CAAU;IAC5B,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IACnD,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACrE,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,MAAqD;IACpG,OAAO,QAAQ,CAAC,OAAO,CAAC,oCAAoC,EAAE,CAAC,KAAK,EAAE,IAAY,EAAE,EAAE,CACpF,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAClF,CAAC;AACJ,CAAC;AAkBD,+FAA+F;AAC/F,MAAM,UAAU,aAAa,CAC3B,GAAqB,EACrB,KAAqB,EACrB,QAAiB,EACjB,KAAc;IAEd,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAChD,yFAAyF;IACzF,0FAA0F;IAC1F,qFAAqF;IACrF,0EAA0E;IAC1E,MAAM,IAAI,GAAwC,EAAE,CAAC;IACrD,MAAM,MAAM,GAAwC,EAAE,CAAC;IACvD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;YACtE,IAAI,CAAC,IAAI,iBAAiB,CAAC,MAAM;gBAAE,MAAM;YACzC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,SAAS;YAClC,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YAC5B,IAAI,CAAC,CAAC,CAAC,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YAC5D,MAAM,CAAC,CAAC,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAW,EAAE,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC;YACtG,CAAC,IAAI,CAAC,CAAC;QACT,CAAC;IACH,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxF,qFAAqF;IACrF,0DAA0D;IAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,EAAE,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC5F,OAAO;QACL,QAAQ,EAAE,KAAK;QACf,KAAK;QACL,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,iBAAiB,CAAC,QAAQ,CAAC;QACxD,OAAO;QACP,MAAM;QACN,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE;QAChC,aAAa,EAAE,GAAG,CAAC,aAAa;KACjC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,GAAqB,EAAE,IAAI,GAAkB,cAAc;IACnF,MAAM,KAAK,GAAG,CAAC,KAAqB,EAAE,EAAE,CAAC,CAAC,QAAgB,EAAE,MAAwB,EAAE,EAAE;QACtF,IAAI,CAAC;YACH,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;QACzE,CAAC;IACH,CAAC,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;AACpG,CAAC"}

package/dist/permission-checker.d.ts

@@ -49,6 +49,29 @@ export interface PermissionChecker {
      * refusal a person can act on names them.
      */
     covers(subject: CheckSubject, required: readonly PermissionKey[], node: Node): Promise<Coverage>;
+    /**
+     * What `subject` holds at `node` (#1686): every permission it holds at the node itself — the
+     * set `covers` compares against — and every live entity-narrowed grant it holds in the scope,
+     * each through the same subject expansion (its orgs included). What the bound on minting a
+     * `become` capability reads about the principal being become.
+     *
+     * Optional for a pluggable checker; an absent implementation makes that bound refuse.
+     */
+    holdings?(subject: CheckSubject, node: Node): Promise<Holdings>;
+}
+/** What `PermissionChecker.holdings` answers. */
+export interface Holdings {
+    /** Held at the node (scope or tenant level), roles expanded, deduplicated — what `covers` compares. */
+    permissions: PermissionKey[];
+    /** The role keys held at the node, as assigned — unexpanded, deduplicated. */
+    roles: string[];
+    /** The permissions granted directly at the node (not through a role), deduplicated. */
+    granted: PermissionKey[];
+    /** Live entity-narrowed grants, one per (permission, entity). */
+    narrowed: {
+        permission: PermissionKey;
+        entity: EntityRef;
+    }[];
 }
 export declare const unknownRoleError: (roleKey: string) => SubstratError;
 export declare const isUnknownRoleError: (err: unknown, roleKey: string) => boolean;

package/dist/permission-checker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permission-checker.d.ts","sourceRoot":"","sources":["../src/permission-checker.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,aAAa,EACb,KAAK,KAAK,EACV,KAAK,QAAQ,EACb,KAAK,QAAQ,EACb,KAAK,SAAS,EACd,KAAK,IAAI,EACT,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,WAAW,EACjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAElE;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,KAAK,CACH,OAAO,EAAE,YAAY,EACrB,UAAU,EAAE,aAAa,EACzB,IAAI,EAAE,IAAI,EACV,MAAM,CAAC,EAAE,SAAS,GACjB,OAAO,CAAC,QAAQ,CAAC,CAAC;IACrB,4FAA4F;IAC5F,eAAe,CAAC,CACd,OAAO,EAAE,YAAY,EACrB,UAAU,EAAE,aAAa,EACzB,IAAI,EAAE,IAAI,EACV,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,CAAC,MAAM,EAAE,SAAS,KAAK,OAAO,CAAC,OAAO,CAAC,EACpD,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAC5C,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAChC;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,MAAM,CACJ,OAAO,EAAE,YAAY,EACrB,QAAQ,EAAE,SAAS,aAAa,EAAE,EAClC,IAAI,EAAE,IAAI,GACT,OAAO,CAAC,QAAQ,CAAC,CAAC;CACtB;AAUD,eAAO,MAAM,gBAAgB,YAAa,MAAM,KAAG,aAAwE,CAAC;AAC5H,eAAO,MAAM,kBAAkB,QAAS,OAAO,WAAW,MAAM,KAAG,OACsC,CAAC;AAE1G,sDAAsD;AACtD,eAAO,MAAM,WAAW,OAAQ,WAAW,KAAG,YAA2C,CAAC;AAE1F;;;;;GAKG;AACH,eAAO,MAAM,OAAO,YAAa,YAAY,KAAG,KAc/C,CAAC;AAEF;;;;;;GAMG;AACH,qBAAa,gBAAiB,SAAQ,aAAa;IACjD,QAAQ,CAAC,UAAU,CAAC,EAAE,aAAa,CAAC;IACpC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC;IACrB,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE;QAAE,UAAU,EAAE,aAAa,CAAC;QAAC,IAAI,EAAE,IAAI,CAAA;KAAE,EAS9E;CACF;AAED,sFAAsF;AACtF,wBAAgB,aAAa,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAC5E,QAAQ,EACR;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,CAClB,CAOA;AAED,4FAA4F;AAC5F,eAAO,MAAM,cAAc,EAAE,iBAa5B,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAgBpC,CAAC"}
+{"version":3,"file":"permission-checker.d.ts","sourceRoot":"","sources":["../src/permission-checker.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,aAAa,EACb,KAAK,KAAK,EACV,KAAK,QAAQ,EACb,KAAK,QAAQ,EACb,KAAK,SAAS,EACd,KAAK,IAAI,EACT,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,WAAW,EACjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAElE;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,KAAK,CACH,OAAO,EAAE,YAAY,EACrB,UAAU,EAAE,aAAa,EACzB,IAAI,EAAE,IAAI,EACV,MAAM,CAAC,EAAE,SAAS,GACjB,OAAO,CAAC,QAAQ,CAAC,CAAC;IACrB,4FAA4F;IAC5F,eAAe,CAAC,CACd,OAAO,EAAE,YAAY,EACrB,UAAU,EAAE,aAAa,EACzB,IAAI,EAAE,IAAI,EACV,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,CAAC,MAAM,EAAE,SAAS,KAAK,OAAO,CAAC,OAAO,CAAC,EACpD,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAC5C,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAChC;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,MAAM,CACJ,OAAO,EAAE,YAAY,EACrB,QAAQ,EAAE,SAAS,aAAa,EAAE,EAClC,IAAI,EAAE,IAAI,GACT,OAAO,CAAC,QAAQ,CAAC,CAAC;IACrB;;;;;;;OAOG;IACH,QAAQ,CAAC,CAAC,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CACjE;AAED,iDAAiD;AACjD,MAAM,WAAW,QAAQ;IACvB,uGAAuG;IACvG,WAAW,EAAE,aAAa,EAAE,CAAC;IAC7B,8EAA8E;IAC9E,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,uFAAuF;IACvF,OAAO,EAAE,aAAa,EAAE,CAAC;IACzB,iEAAiE;IACjE,QAAQ,EAAE;QAAE,UAAU,EAAE,aAAa,CAAC;QAAC,MAAM,EAAE,SAAS,CAAA;KAAE,EAAE,CAAC;CAC9D;AAUD,eAAO,MAAM,gBAAgB,YAAa,MAAM,KAAG,aAAwE,CAAC;AAC5H,eAAO,MAAM,kBAAkB,QAAS,OAAO,WAAW,MAAM,KAAG,OACsC,CAAC;AAE1G,sDAAsD;AACtD,eAAO,MAAM,WAAW,OAAQ,WAAW,KAAG,YAA2C,CAAC;AAE1F;;;;;GAKG;AACH,eAAO,MAAM,OAAO,YAAa,YAAY,KAAG,KAc/C,CAAC;AAEF;;;;;;GAMG;AACH,qBAAa,gBAAiB,SAAQ,aAAa;IACjD,QAAQ,CAAC,UAAU,CAAC,EAAE,aAAa,CAAC;IACpC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC;IACrB,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE;QAAE,UAAU,EAAE,aAAa,CAAC;QAAC,IAAI,EAAE,IAAI,CAAA;KAAE,EAS9E;CACF;AAED,sFAAsF;AACtF,wBAAgB,aAAa,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAC5E,QAAQ,EACR;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,CAClB,CAOA;AAED,4FAA4F;AAC5F,eAAO,MAAM,cAAc,EAAE,iBAa5B,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAgBpC,CAAC"}

package/dist/permission-checker.js.map

@@ -1 +1 @@
-{"version":3,"file":"permission-checker.js","sourceRoot":"","sources":["../src/permission-checker.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,SAAS,EACT,aAAa,EACb,aAAa,GASd,MAAM,yBAAyB,CAAC;AAmEjC;;;;;;GAMG;AACH,MAAM,kBAAkB,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,gCAAgC,OAAO,EAAE,CAAC;AAClG,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAAe,EAAiB,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;AAC5H,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAY,EAAE,OAAe,EAAW,EAAE,CAC3E,GAAG,YAAY,KAAK,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,WAAW,IAAI,GAAG,CAAC,OAAO,KAAK,kBAAkB,CAAC,OAAO,CAAC,CAAC;AAE1G,sDAAsD;AACtD,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,EAAe,EAAgB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;AAE1F;;;;;GAKG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,OAAqB,EAAS,EAAE;IACtD,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,WAAW;YACd,OAAO,OAAO,CAAC,EAAE,CAAC;QACpB,KAAK,QAAQ;YACX,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;QAChC,KAAK,YAAY;YACf,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;QACpC,KAAK,YAAY;YACf,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;QACpC,KAAK,UAAU;YACb,+EAA+E;YAC/E,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;IAC1D,CAAC;AACH,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,OAAO,gBAAiB,SAAQ,aAAa;IACxC,UAAU,CAAiB;IAC3B,IAAI,CAAQ;IACrB,YAAY,OAAe,EAAE,MAAkD;QAC7E,KAAK,CAAC,mBAAmB,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrF,kFAAkF;QAClF,kFAAkF;QAClF,8EAA8E;QAC9E,2EAA2E;QAC3E,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,UAAU,GAAG,MAAM,EAAE,UAAU,CAAC;QACrC,IAAI,CAAC,IAAI,GAAG,MAAM,EAAE,IAAI,CAAC;IAC3B,CAAC;CACF;AAED,sFAAsF;AACtF,MAAM,UAAU,aAAa,CAAC,QAAkB;IAI9C,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,MAAM,IAAI,gBAAgB,CAAC,sBAAsB,QAAQ,CAAC,OAAO,EAAE,EAAE;YACnE,UAAU,EAAE,QAAQ,CAAC,OAAO;YAC5B,IAAI,EAAE,QAAQ,CAAC,IAAI;SACpB,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,MAAM,cAAc,GAAsB;IAC/C,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAC9C,OAAO,EAAE,KAAK;QACd,OAAO,EAAE,UAAU;QACnB,IAAI;KACL,CAAC;IACF,sFAAsF;IACtF,kFAAkF;IAClF,kFAAkF;IAClF,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,CACnC,QAAQ,CAAC,MAAM,KAAK,CAAC;QACnB,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE;QAChC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE;CACjD,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAsB;IACvD,oFAAoF;IACpF,uEAAuE;IACvE,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACpD,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAC7C,OAAO,EAAE,IAAI;QACb,KAAK,EAAE;YACL;gBACE,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,aAAa,SAAS,EAAE,CAAC;gBAClD,QAAQ,EAAE,WAAW,UAAU,EAAE;gBACjC,MAAM,EAAE,SAAS,CAAC,KAAK,CACrB,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,QAAQ,EAAE,CACnE;aACF;SACF;KACF,CAAC;CACH,CAAC"}
+{"version":3,"file":"permission-checker.js","sourceRoot":"","sources":["../src/permission-checker.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,SAAS,EACT,aAAa,EACb,aAAa,GASd,MAAM,yBAAyB,CAAC;AAwFjC;;;;;;GAMG;AACH,MAAM,kBAAkB,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,gCAAgC,OAAO,EAAE,CAAC;AAClG,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAAe,EAAiB,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;AAC5H,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAY,EAAE,OAAe,EAAW,EAAE,CAC3E,GAAG,YAAY,KAAK,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,WAAW,IAAI,GAAG,CAAC,OAAO,KAAK,kBAAkB,CAAC,OAAO,CAAC,CAAC;AAE1G,sDAAsD;AACtD,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,EAAe,EAAgB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;AAE1F;;;;;GAKG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,OAAqB,EAAS,EAAE;IACtD,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,WAAW;YACd,OAAO,OAAO,CAAC,EAAE,CAAC;QACpB,KAAK,QAAQ;YACX,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;QAChC,KAAK,YAAY;YACf,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;QACpC,KAAK,YAAY;YACf,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;QACpC,KAAK,UAAU;YACb,+EAA+E;YAC/E,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;IAC1D,CAAC;AACH,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,OAAO,gBAAiB,SAAQ,aAAa;IACxC,UAAU,CAAiB;IAC3B,IAAI,CAAQ;IACrB,YAAY,OAAe,EAAE,MAAkD;QAC7E,KAAK,CAAC,mBAAmB,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrF,kFAAkF;QAClF,kFAAkF;QAClF,8EAA8E;QAC9E,2EAA2E;QAC3E,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,UAAU,GAAG,MAAM,EAAE,UAAU,CAAC;QACrC,IAAI,CAAC,IAAI,GAAG,MAAM,EAAE,IAAI,CAAC;IAC3B,CAAC;CACF;AAED,sFAAsF;AACtF,MAAM,UAAU,aAAa,CAAC,QAAkB;IAI9C,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,MAAM,IAAI,gBAAgB,CAAC,sBAAsB,QAAQ,CAAC,OAAO,EAAE,EAAE;YACnE,UAAU,EAAE,QAAQ,CAAC,OAAO;YAC5B,IAAI,EAAE,QAAQ,CAAC,IAAI;SACpB,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,MAAM,cAAc,GAAsB;IAC/C,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAC9C,OAAO,EAAE,KAAK;QACd,OAAO,EAAE,UAAU;QACnB,IAAI;KACL,CAAC;IACF,sFAAsF;IACtF,kFAAkF;IAClF,kFAAkF;IAClF,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,CACnC,QAAQ,CAAC,MAAM,KAAK,CAAC;QACnB,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE;QAChC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE;CACjD,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAsB;IACvD,oFAAoF;IACpF,uEAAuE;IACvE,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACpD,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAC7C,OAAO,EAAE,IAAI;QACb,KAAK,EAAE;YACL;gBACE,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,aAAa,SAAS,EAAE,CAAC;gBAClD,QAAQ,EAAE,WAAW,UAAU,EAAE;gBACjC,MAAM,EAAE,SAAS,CAAC,KAAK,CACrB,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,QAAQ,EAAE,CACnE;aACF;SACF;KACF,CAAC;CACH,CAAC"}

package/dist/permission-eval.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permission-eval.d.ts","sourceRoot":"","sources":["../src/permission-eval.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,QAAQ,EACb,KAAK,QAAQ,EACb,KAAK,SAAS,EACd,KAAK,IAAI,EACT,KAAK,aAAa,EAClB,KAAK,YAAY,EAEjB,KAAK,cAAc,EACpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAqC,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAExF,OAAO,EAAuB,KAAK,mBAAmB,EAAE,KAAK,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAe1G,4FAA4F;AAC5F,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,iBAAiB,EAC1B,OAAO,EAAE,YAAY,EACrB,UAAU,EAAE,aAAa,EACzB,IAAI,EAAE,IAAI,EACV,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,EACxD,QAAQ,EAAE,CAAC,UAAU,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,SAAS,KAAK,OAAO,CAAC,QAAQ,CAAC,EAC9E,QAAQ,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,EAC9B,YAAY,UAAQ,GACnB,OAAO,CAAC,mBAAmB,CAAC,CAqB9B;AAyBD,KAAK,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;AAEtC;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,oFAAoF;IACpF,SAAS,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAAC;IACvF,SAAS,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAAC;IACpE;;;;OAIG;IACH,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,YAAY,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACpF,qEAAqE;IACrE,KAAK,CACH,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,YAAY,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAAC;IAChD,mDAAmD;IACnD,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAC5D;;;;;OAKG;IACH,UAAU,CAAC,CAAC,EAAE,EAAE,MAAM,GAAG,YAAY,CAAC,aAAa,GAAG,SAAS,CAAC,CAAC;IACjE;;;;;;;OAOG;IACH,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;CACrD;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,qBAAqB;IACpC,qEAAqE;IACrE,GAAG,IAAI,MAAM,CAAC;IACd,qFAAqF;IACrF,YAAY,CACV,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,cAAc,EAAE,MAAM,GACrB,YAAY,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACtC,iGAAiG;IACjG,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,YAAY,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACjF,gEAAgE;IAChE,QAAQ,CAAC,IAAI,EAAE,IAAI,GAAG,gBAAgB,GAAG,SAAS,CAAC;CACpD;AAeD;;;GAGG;AACH,eAAO,MAAM,YAAY,WAAY,MAAM,KAAG,MAG7C,CAAC;AAqFF;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,IAAI,CAAC,gBAAgB,EAAE,SAAS,CAAC,EACxC,MAAM,EAAE,SAAS,EACjB,IAAI,EAAE,SAAS,EACf,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,OAAO,CAAC,CAMlB;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,IAAI,CAAC,gBAAgB,EAAE,SAAS,CAAC,EACxC,MAAM,EAAE,SAAS,EACjB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAOtB;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,qBAAqB,GAAG,iBAAiB,CA2QrF;AAED;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,GAAG,IAAI,MAAM,CAAC;IACd,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,kBAAkB,EAAE,CAAC;IAC9F,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAAC;CACpE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,qBAAqB,EAC7B,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,SAAS,aAAa,EAAE,GACjC,QAAQ,CA0BV;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,qBAAqB,EAC7B,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GACZ,kBAAkB,GAAG,SAAS,CAMhC;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,qBAAqB,EAC7B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE;IAAE,EAAE,EAAE,KAAK,GAAG,QAAQ,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACpF;IAAE,OAAO,EAAE,KAAK,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAQlE;AAED,mGAAmG;AACnG,eAAO,MAAM,gBAAgB,cAAe,MAAM,SAAS,MAAM,aAAa,MAAM,GAAG,IAAI;;;;CAIzF,CAAC;AAEH;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,IAAI,CAAC,kBAAkB,EAAE,YAAY,CAAC,EAC7C,QAAQ,EAAE,IAAI,CAAC,kBAAkB,EAAE,YAAY,CAAC,GAAG,SAAS,GAC3D,MAAM,GAAG,IAAI,CAIf"}
+{"version":3,"file":"permission-eval.d.ts","sourceRoot":"","sources":["../src/permission-eval.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,QAAQ,EACb,KAAK,QAAQ,EACb,KAAK,SAAS,EACd,KAAK,IAAI,EACT,KAAK,aAAa,EAClB,KAAK,YAAY,EAEjB,KAAK,cAAc,EACpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAY,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC3E,OAAO,EAAqC,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAExF,OAAO,EAAuB,KAAK,mBAAmB,EAAE,KAAK,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAe1G,4FAA4F;AAC5F,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,iBAAiB,EAC1B,OAAO,EAAE,YAAY,EACrB,UAAU,EAAE,aAAa,EACzB,IAAI,EAAE,IAAI,EACV,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,EACxD,QAAQ,EAAE,CAAC,UAAU,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,SAAS,KAAK,OAAO,CAAC,QAAQ,CAAC,EAC9E,QAAQ,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,EAC9B,YAAY,UAAQ,GACnB,OAAO,CAAC,mBAAmB,CAAC,CAqB9B;AAyBD,KAAK,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;AAEtC;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,oFAAoF;IACpF,SAAS,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAAC;IACvF,SAAS,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAAC;IACpE;;;;OAIG;IACH,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,YAAY,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACpF,qEAAqE;IACrE,KAAK,CACH,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,YAAY,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAAC;IAChD,mDAAmD;IACnD,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAC5D;;;;;OAKG;IACH,UAAU,CAAC,CAAC,EAAE,EAAE,MAAM,GAAG,YAAY,CAAC,aAAa,GAAG,SAAS,CAAC,CAAC;IACjE;;;;;;;OAOG;IACH,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;CACrD;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,qBAAqB;IACpC,qEAAqE;IACrE,GAAG,IAAI,MAAM,CAAC;IACd,qFAAqF;IACrF,YAAY,CACV,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,cAAc,EAAE,MAAM,GACrB,YAAY,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACtC,iGAAiG;IACjG,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,YAAY,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACjF,gEAAgE;IAChE,QAAQ,CAAC,IAAI,EAAE,IAAI,GAAG,gBAAgB,GAAG,SAAS,CAAC;CACpD;AAeD;;;GAGG;AACH,eAAO,MAAM,YAAY,WAAY,MAAM,KAAG,MAG7C,CAAC;AAqFF;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,IAAI,CAAC,gBAAgB,EAAE,SAAS,CAAC,EACxC,MAAM,EAAE,SAAS,EACjB,IAAI,EAAE,SAAS,EACf,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,OAAO,CAAC,CAMlB;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,IAAI,CAAC,gBAAgB,EAAE,SAAS,CAAC,EACxC,MAAM,EAAE,SAAS,EACjB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAOtB;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,qBAAqB,GAAG,iBAAiB,CAsTrF;AAED;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,GAAG,IAAI,MAAM,CAAC;IACd,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,kBAAkB,EAAE,CAAC;IAC9F,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAAC;CACpE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,qBAAqB,EAC7B,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,SAAS,aAAa,EAAE,GACjC,QAAQ,CA0BV;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,qBAAqB,EAC7B,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GACZ,kBAAkB,GAAG,SAAS,CAMhC;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,qBAAqB,EAC7B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE;IAAE,EAAE,EAAE,KAAK,GAAG,QAAQ,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACpF;IAAE,OAAO,EAAE,KAAK,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAQlE;AAED,mGAAmG;AACnG,eAAO,MAAM,gBAAgB,cAAe,MAAM,SAAS,MAAM,aAAa,MAAM,GAAG,IAAI;;;;CAIzF,CAAC;AAEH;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,IAAI,CAAC,kBAAkB,EAAE,YAAY,CAAC,EAC7C,QAAQ,EAAE,IAAI,CAAC,kBAAkB,EAAE,YAAY,CAAC,GAAG,SAAS,GAC3D,MAAM,GAAG,IAAI,CAIf"}

package/dist/permission-eval.js

@@ -388,30 +388,69 @@ export function createTupleEvaluator(reader) {
             if (await switchedOff(subject, node, scope)) {
                 return { covered: false, missing: [...new Set(required)] };
             }
-            const subjects = await subjectsOf(subject, node, now);
-            const getRole = roleReaderFor(node.tenantId);
-            const held = new Set();
-            for (const nodeObj of nodeObjectsOf(node)) {
-                for (const s of subjects) {
-                    const rows = nodeObj.scoped
-                        ? scope
-                            ? await scope.tuples(s.ref, '')
-                            : []
-                        : await reader.tenantTuples(node.tenantId, s.ref, '');
-                    for (const row of rows) {
-                        const grant = heldBy(row, nodeObj.obj, now);
-                        if (grant?.role !== undefined)
-                            for (const p of (await getRole(grant.role))?.permissions ?? [])
-                                held.add(p);
-                        else if (grant)
-                            held.add(grant.permission);
-                    }
-                }
-            }
-            return coverageOf(required, held);
+            return coverageOf(required, (await holdingsOf(subject, node, now, scope, false)).held);
+        },
+        /**
+         * `covers`'s held set, plus the entity-narrowed grants it deliberately leaves out (#1686).
+         * A capability or a switched-off subject holds nothing here, as `covers` says.
+         */
+        async holdings(subject, node) {
+            const none = { permissions: [], roles: [], granted: [], narrowed: [] };
+            if (subject.kind === 'capability')
+                return none;
+            const now = reader.now();
+            const scope = reader.scopeFor(node);
+            if (await switchedOff(subject, node, scope))
+                return none;
+            const { held, roles, granted, narrowed } = await holdingsOf(subject, node, now, scope, true);
+            return { permissions: [...held], roles: [...roles], granted: [...granted], narrowed };
         },
         check,
     });
+    /**
+     * One pass over the subject's tuples at each node object — two reads per (subject, level) —
+     * collecting the node-level set `covers` compares against. The scope-level rows also carry
+     * the subject's entity-narrowed grants (an `entityType:entityId` object, which matches no
+     * node object), collected beside it for `holdings`.
+     */
+    async function holdingsOf(subject, node, now, scope, 
+    /** `covers` asks for the node-level set only, and skips parsing the entity grants. */
+    withNarrowed) {
+        const subjects = await subjectsOf(subject, node, now);
+        const getRole = roleReaderFor(node.tenantId);
+        const nodeObjs = nodeObjectsOf(node);
+        const held = new Set();
+        const roles = new Set();
+        const granted = new Set();
+        const narrowed = new Map();
+        for (const nodeObj of nodeObjs) {
+            for (const s of subjects) {
+                const rows = nodeObj.scoped
+                    ? scope
+                        ? await scope.tuples(s.ref, '')
+                        : []
+                    : await reader.tenantTuples(node.tenantId, s.ref, '');
+                for (const row of rows) {
+                    const grant = heldBy(row, nodeObj.obj, now);
+                    if (grant?.role !== undefined) {
+                        roles.add(grant.role);
+                        for (const p of (await getRole(grant.role))?.permissions ?? [])
+                            held.add(p);
+                    }
+                    else if (grant) {
+                        granted.add(grant.permission);
+                        held.add(grant.permission);
+                    }
+                    else if (withNarrowed && nodeObj.scoped) {
+                        const entity = narrowedBy(row, nodeObjs, now);
+                        if (entity)
+                            narrowed.set(`${entity.permission}\n${row.object}`, entity);
+                    }
+                }
+            }
+        }
+        return { held, roles, granted, narrowed: [...narrowed.values()] };
+    }
 }
 /**
  * `covers` at the TENANT node, synchronously (#1184): the K-21 set comparison over the
@@ -523,6 +562,23 @@ function heldBy(row, nodeObj, now) {
         return { permission: row.relation.slice('granted:'.length) };
     return undefined;
 }
+/**
+ * The entity-narrowed grant a scope-level row is, if it is one: a live `granted:` tuple whose
+ * object is an entity rather than one of the node's objects (§4.2 rule 3).
+ */
+function narrowedBy(row, nodeObjs, now) {
+    if (!row.relation.startsWith('granted:') || !live(row, now))
+        return undefined;
+    if (nodeObjs.some((n) => n.obj === row.object))
+        return undefined;
+    const sep = row.object.indexOf(':');
+    if (sep <= 0 || sep === row.object.length - 1)
+        return undefined;
+    return {
+        permission: row.relation.slice('granted:'.length),
+        entity: { entityType: row.object.slice(0, sep), entityId: row.object.slice(sep + 1) },
+    };
+}
 /**
  * `required` against `held`. Order follows the request so a refusal reads predictably;
  * deduplicated so a caller passing the same key twice does not see it twice.