@substrat-run/kernel 0.142.0 → 0.144.0

package/dist/derived-handlers.js

@@ -0,0 +1,198 @@
+/**
+ * The handlers the platform writes from a declaration (#1773).
+ *
+ * `defineOperations` decides WHAT is derivable and records a plan for each `derive` declaration —
+ * the table, its columns, the permission, the event (`DerivationPlan`, contracts). This turns a
+ * plan into the handler. It takes the same steps a hand-written one does, through the same `ctx`
+ * a module has: the declared check first, then `ctx.sql` over the entity's declared columns
+ * (named, never `*`), `not_found` for a missing row, and one fat event per write.
+ *
+ * Nothing here decides a shape. A handler written from a plan cannot read a column, check a key or
+ * emit an event the declaration did not name, because the plan holds nothing else.
+ */
+import { permissionKey, substratError, } from '@substrat-run/contracts';
+import { assertAllowed } from './permission-checker.js';
+import { ulid } from './ulid.js';
+/** `"col"` — a declared column is an identifier, quoted so a keyword-named one still reads as a column. */
+const quoted = (identifier) => `"${identifier.replace(/"/g, '""')}"`;
+/** The handler a plan describes. */
+export function derivedHandler(plan) {
+    const key = permissionKey.parse(plan.permission.key);
+    const ref = (id) => ({ entityType: plan.entity, entityId: id });
+    const rowOrThrow = lookup(plan.entity, plan.table, plan.primaryKey, plan.columns.map(quoted).join(', '));
+    /** The declared check: on the row the input names, or on its parent, or scope-wide. */
+    const check = async (ctx, input) => {
+        const { entity, idFrom } = plan.permission;
+        const decision = entity === undefined || idFrom === undefined
+            ? await ctx.check(key)
+            : await ctx.check(key, { entityType: entity, entityId: String(input?.[idFrom]) });
+        assertAllowed(decision);
+    };
+    const body = bodyOf(plan, rowOrThrow, ref);
+    // The bin is checked row by row, by `ctx.pageTrashed` itself (#119): a scope-wide check of the
+    // trash key in front of it would deny the person whose key is narrowed to the rows they binned.
+    if (plan.kind === 'trashed')
+        return body;
+    return (async (ctx, input) => {
+        await check(ctx, input);
+        return body(ctx, input);
+    });
+}
+/** What the handler does once the check has passed. */
+function bodyOf(plan, rowOrThrow, ref) {
+    switch (plan.kind) {
+        case 'get':
+            return (ctx, input) => rowOrThrow(ctx, String(input?.[plan.idFrom]));
+        case 'list': {
+            const parentOrThrow = plan.parent && parentLookup(plan.parent);
+            return (ctx, input) => {
+                // A page of a parent's rows names the parent: one that does not exist is not an empty page.
+                parentOrThrow?.(ctx, input);
+                return ctx.page(plan.entity, {
+                    ...pageOf(input),
+                    filters: filtersOf(plan.filters, input),
+                    ...(plan.total ? { total: true } : {}),
+                    // The host parsed it against `z.enum(['active', 'archived'])` (#119).
+                    ...(plan.viewFrom !== undefined && input?.[plan.viewFrom] !== undefined
+                        ? { view: input[plan.viewFrom] }
+                        : {}),
+                });
+            };
+        }
+        case 'update':
+            return (ctx, input) => {
+                const id = String(input?.[plan.idFrom]);
+                const existing = rowOrThrow(ctx, id);
+                // Absent is untouched, `null` clears: only the fields the caller sent are written.
+                const sent = plan.fields.filter(({ field }) => input?.[field] !== undefined);
+                // Nothing sent is nothing changed — no write, and no event to move the version.
+                if (sent.length === 0)
+                    return existing;
+                ctx.sql.exec(`UPDATE ${quoted(plan.table)} SET ${sent.map(({ column }) => `${quoted(column)} = ?`).join(', ')} ` +
+                    `WHERE ${quoted(plan.primaryKey)} = ?`, 
+                // The plan admits only string and number columns, and the host parsed the input against them.
+                [...sent.map(({ field }) => input?.[field]), id]);
+                const row = rowOrThrow(ctx, id);
+                ctx.emit(eventOf(plan.emit, ref(id), row));
+                return row;
+            };
+        case 'delete':
+            return (ctx, input) => {
+                const id = String(input?.[plan.idFrom]);
+                rowOrThrow(ctx, id);
+                ctx.sql.exec(`DELETE FROM ${quoted(plan.table)} WHERE ${quoted(plan.primaryKey)} = ?`, [id]);
+                const result = { id, deleted: true };
+                ctx.emit(eventOf(plan.emit, ref(id), result));
+                return result;
+            };
+        case 'create': {
+            const parentOrThrow = plan.parent && parentLookup(plan.parent);
+            // Every column but the id, in the order the values are bound: the link, the input, the stamps.
+            const written = [
+                ...(plan.parent ? [plan.parent.column] : []),
+                ...plan.values.map(({ column }) => column),
+                ...plan.stamps.map(({ column }) => column),
+            ];
+            const insert = `INSERT INTO ${quoted(plan.table)} (${[plan.primaryKey, ...written].map(quoted).join(', ')}) ` +
+                `VALUES (${['?', ...written.map(() => '?')].join(', ')})`;
+            const keyAt = plan.key.map((column) => written.indexOf(column));
+            const byKey = `SELECT ${plan.columns.map(quoted).join(', ')} FROM ${quoted(plan.table)} WHERE ` +
+                plan.key.map((column) => `${quoted(column)} IS ?`).join(' AND ');
+            return (ctx, input) => {
+                const parentId = parentOrThrow?.(ctx, input);
+                const values = [
+                    ...(parentId !== undefined ? [parentId] : []),
+                    // A field the caller left out is NULL — the plan admits it only over a nullable column.
+                    ...plan.values.map(({ field }) => (input?.[field] ?? null)),
+                    ...stamped(ctx, plan.stamps),
+                ];
+                // Idempotent on the natural key: the row that already holds it is the answer, unchanged.
+                if (keyAt.length > 0) {
+                    const existing = ctx.sql.query(byKey, keyAt.map((i) => values[i]))[0];
+                    if (existing)
+                        return existing;
+                }
+                const id = ulid();
+                ctx.sql.exec(insert, [id, ...values]);
+                // The edge the permission walk follows from the new row to the parent it was checked on.
+                if (plan.parent)
+                    ctx.link(ref(id), { entityType: plan.parent.entity, entityId: String(parentId) });
+                const created = rowOrThrow(ctx, id);
+                ctx.emit(eventOf(plan.emit, ref(id), created));
+                return created;
+            };
+        }
+        // One kernel move (#119): the verb checks the entity's declared key again, refuses a wrong
+        // move as `conflict` and a missing row as `not_found`, and emits the move itself.
+        case 'archive':
+        case 'unarchive':
+        case 'trash':
+        case 'restore': {
+            const move = plan.kind;
+            return async (ctx, input) => {
+                const id = String(input?.[plan.idFrom]);
+                return { id, state: await ctx[move](ref(id)) };
+            };
+        }
+        case 'trashed':
+            return (ctx, input) => ctx.pageTrashed(plan.entity, { ...pageOf(input), filters: filtersOf(plan.filters, input) });
+    }
+}
+/** A read by primary key that answers `not_found` in the words a hand-written read uses. */
+function lookup(entity, table, primaryKey, columns) {
+    const select = `SELECT ${columns} FROM ${quoted(table)} WHERE ${quoted(primaryKey)} = ?`;
+    return (ctx, id) => {
+        const row = ctx.sql.query(select, [id])[0];
+        if (!row)
+            throw substratError('not_found', `${entity} not found: ${id}`);
+        return row;
+    };
+}
+/** The parent the input names, or `not_found` — answered after the check, so it probes nothing. */
+function parentLookup(parent) {
+    const exists = lookup(parent.entity, parent.table, parent.primaryKey, '1 AS found');
+    return (ctx, input) => {
+        const id = String(input?.[parent.idFrom]);
+        exists(ctx, id);
+        return id;
+    };
+}
+/** Each stamp's value for this invocation, in the plan's order: the time, or the caller. */
+function stamped(ctx, stamps) {
+    const now = ctx.now();
+    const caller = String(ctx.principal);
+    return stamps.map(({ kind }) => (kind === 'createdAt' ? now : caller));
+}
+/** The page the platform supplied with the input (`limit`, `cursor`, `sort`, `order`). */
+function pageOf(input) {
+    return {
+        limit: input?.limit,
+        cursor: input?.cursor,
+        sort: input?.sort,
+        order: input?.order,
+    };
+}
+/** The declared filters the caller sent, by column. */
+function filtersOf(filters, input) {
+    const out = {};
+    for (const { field, column } of filters) {
+        if (input?.[field] !== undefined)
+            out[column] = input[field];
+    }
+    return out;
+}
+/** The declared event, its payload and subject drawn from what the operation answers with. */
+function eventOf(emit, entity, output) {
+    const payload = {};
+    for (const field of emit.payload)
+        payload[field] = output[field];
+    return {
+        type: emit.type,
+        schemaVersion: emit.schemaVersion,
+        entity,
+        piiClass: emit.piiClass,
+        ...(emit.subjectId !== undefined ? { subjectId: output[emit.subjectId] } : {}),
+        payload,
+    };
+}
+//# sourceMappingURL=derived-handlers.js.map

package/dist/derived-handlers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"derived-handlers.js","sourceRoot":"","sources":["../src/derived-handlers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EACL,aAAa,EACb,aAAa,GAMd,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAExD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAKjC,2GAA2G;AAC3G,MAAM,MAAM,GAAG,CAAC,UAAkB,EAAU,EAAE,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;AAErF,oCAAoC;AACpC,MAAM,UAAU,cAAc,CAAC,IAAoB;IACjD,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,CAAC,EAAU,EAAa,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;IACnF,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAEzG,uFAAuF;IACvF,MAAM,KAAK,GAAG,KAAK,EAAE,GAAqB,EAAE,KAAY,EAAiB,EAAE;QACzE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC;QAC3C,MAAM,QAAQ,GACZ,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS;YAC1C,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC;YACtB,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;QACtF,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;IAC3C,+FAA+F;IAC/F,gGAAgG;IAChG,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,IAAwC,CAAC;IAC7E,OAAO,CAAC,KAAK,EAAE,GAAqB,EAAE,KAAY,EAAE,EAAE;QACpD,MAAM,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACxB,OAAO,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC1B,CAAC,CAAqC,CAAC;AACzC,CAAC;AAED,uDAAuD;AACvD,SAAS,MAAM,CACb,IAAoB,EACpB,UAAsD,EACtD,GAA8B;IAE9B,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,KAAK;YACR,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAEvE,KAAK,MAAM,EAAE,CAAC;YACZ,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC/D,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;gBACpB,4FAA4F;gBAC5F,aAAa,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBAC5B,OAAO,GAAG,CAAC,IAAI,CAAM,IAAI,CAAC,MAAM,EAAE;oBAChC,GAAG,MAAM,CAAC,KAAK,CAAC;oBAChB,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC;oBACvC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtC,sEAAsE;oBACtE,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,SAAS;wBACrE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAuB,EAAE;wBACtD,CAAC,CAAC,EAAE,CAAC;iBACR,CAAC,CAAC;YACL,CAAC,CAAC;QACJ,CAAC;QAED,KAAK,QAAQ;YACX,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;gBACpB,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;gBACxC,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBACrC,mFAAmF;gBACnF,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,KAAK,SAAS,CAAC,CAAC;gBAC7E,gFAAgF;gBAChF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAO,QAAQ,CAAC;gBACvC,GAAG,CAAC,GAAG,CAAC,IAAI,CACV,UAAU,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;oBACjG,SAAS,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM;gBACxC,8FAA8F;gBAC9F,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,CAAa,CAAC,EAAE,EAAE,CAAC,CAC7D,CAAC;gBACF,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBAChC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;gBAC3C,OAAO,GAAG,CAAC;YACb,CAAC,CAAC;QAEJ,KAAK,QAAQ;YACX,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;gBACpB,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;gBACxC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBACpB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC7F,MAAM,MAAM,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;gBACrC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;gBAC9C,OAAO,MAAM,CAAC;YAChB,CAAC,CAAC;QAEJ,KAAK,QAAQ,EAAE,CAAC;YACd,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC/D,+FAA+F;YAC/F,MAAM,OAAO,GAAG;gBACd,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5C,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC;gBAC1C,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC;aAC3C,CAAC;YACF,MAAM,MAAM,GACV,eAAe,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;gBAC9F,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;YAC5D,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;YAChE,MAAM,KAAK,GACT,UAAU,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS;gBACjF,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACnE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;gBACpB,MAAM,QAAQ,GAAG,aAAa,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBAC7C,MAAM,MAAM,GAAe;oBACzB,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC7C,wFAAwF;oBACxF,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,IAAI,IAAI,CAAa,CAAC;oBACvE,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC;iBAC7B,CAAC;gBACF,yFAAyF;gBACzF,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACrB,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAM,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;oBACvF,IAAI,QAAQ;wBAAE,OAAO,QAAQ,CAAC;gBAChC,CAAC;gBACD,MAAM,EAAE,GAAG,IAAI,EAAE,CAAC;gBAClB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC;gBACtC,yFAAyF;gBACzF,IAAI,IAAI,CAAC,MAAM;oBAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBACnG,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBACpC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;gBAC/C,OAAO,OAAO,CAAC;YACjB,CAAC,CAAC;QACJ,CAAC;QAED,2FAA2F;QAC3F,kFAAkF;QAClF,KAAK,SAAS,CAAC;QACf,KAAK,WAAW,CAAC;QACjB,KAAK,OAAO,CAAC;QACb,KAAK,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;YACvB,OAAO,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;gBAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;gBACxC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YACjD,CAAC,CAAC;QACJ,CAAC;QAED,KAAK,SAAS;YACZ,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,CAAM,IAAI,CAAC,MAAM,EAAE,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IAC5H,CAAC;AACH,CAAC;AAED,4FAA4F;AAC5F,SAAS,MAAM,CAAC,MAAc,EAAE,KAAa,EAAE,UAAkB,EAAE,OAAe;IAChF,MAAM,MAAM,GAAG,UAAU,OAAO,SAAS,MAAM,CAAC,KAAK,CAAC,UAAU,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;IACzF,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE;QACjB,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAM,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChD,IAAI,CAAC,GAAG;YAAE,MAAM,aAAa,CAAC,WAAW,EAAE,GAAG,MAAM,eAAe,EAAE,EAAE,CAAC,CAAC;QACzE,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;AACJ,CAAC;AAED,mGAAmG;AACnG,SAAS,YAAY,CAAC,MAAqB;IACzC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACpF,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;QACpB,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAChB,OAAO,EAAE,CAAC;IACZ,CAAC,CAAC;AACJ,CAAC;AAED,4FAA4F;AAC5F,SAAS,OAAO,CAAC,GAAqB,EAAE,MAA+B;IACrE,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,EAAE,CAAC;IACtB,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACrC,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,0FAA0F;AAC1F,SAAS,MAAM,CAAC,KAAY;IAC1B,OAAO;QACL,KAAK,EAAE,KAAK,EAAE,KAA2B;QACzC,MAAM,EAAE,KAAK,EAAE,MAA4B;QAC3C,IAAI,EAAE,KAAK,EAAE,IAA0B;QACvC,KAAK,EAAE,KAAK,EAAE,KAAmC;KAClD,CAAC;AACJ,CAAC;AAED,uDAAuD;AACvD,SAAS,SAAS,CAAC,OAAuE,EAAE,KAAY;IACtG,MAAM,GAAG,GAAQ,EAAE,CAAC;IACpB,KAAK,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACxC,IAAI,KAAK,EAAE,CAAC,KAAK,CAAC,KAAK,SAAS;YAAE,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8FAA8F;AAC9F,SAAS,OAAO,CAAC,IAAiB,EAAE,MAAiB,EAAE,MAAW;IAChE,MAAM,OAAO,GAAQ,EAAE,CAAC;IACxB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACjE,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,MAAM;QACN,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9E,OAAO;KACmC,CAAC;AAC/C,CAAC"}

package/dist/entity-binding.d.ts

@@ -0,0 +1,121 @@
+import { type BoundedUnbind, type CapabilityId, type Coverage, type DomainEventInput, type EntityRef, type PermissionKey, type PrincipalId } from '@substrat-run/contracts';
+import type { ScopedSql } from './scope-host.js';
+/**
+ * A BINDING shape (#1686): a record names its own person in a declared column, and the person
+ * it names holds the record's declared shape there. What makes a customer invite a binding
+ * rather than a delegation: the link names WHICH record, the reviewed registry says WHAT the
+ * person bound to it holds, and the minter vouches for the record with an ordinary key.
+ *
+ * Three writes, each one statement set shared by both adapters:
+ * - {@link bindIn}: inside a `become` exchange's transaction, once {@link judgeBind} said yes and
+ *   the use is taken — the column set to the claimant, the shape granted (marker and keys), and
+ *   `entity.holder-bound` emitted.
+ * - {@link unbindEntityHolderBounded}: the column cleared, and every holder of the shape on the
+ *   record released from the SPINE — their marker and everything they hold there tombstoned (K-21).
+ * - {@link captureBoundOf} / {@link releaseBound}: the erasure's half — on every type that binds or
+ *   ever bound here, the holders on the erased record and the erased person's own markers, read
+ *   before any module erasure runs and released after the hooks whether or not a row survived.
+ *
+ * People already bound keep the shape until they are released — an unbind (while the shape still
+ * binds), an erasure, or the retirement of its keys — whatever a later version declares.
+ *
+ * Read from the scope's record of its reconciled registry (`shape-bind-*` tuples), never from the
+ * vertical's code: a scope not yet reconciled with a binding declaration binds nothing.
+ */
+interface EntityBinding {
+    entityType: string;
+    table: string;
+    idColumn: string;
+    principalColumn: string;
+    /**
+     * Who holds this on a record may bind its person with a link, and unbind them — null once a
+     * version dropped `bind` and kept the shape: nobody may, and an erasure still releases.
+     */
+    permission: PermissionKey | null;
+    /** The shape's current keys — what a claim gives. */
+    keys: PermissionKey[];
+    /** Every key of the shape, current and retired — what an unbind takes back. */
+    every: PermissionKey[];
+}
+/** The bind key's refusal, in the shape every bounded verb answers a missing key with. */
+declare const lacking: (permission: PermissionKey) => {
+    ok: false;
+    coverage: Extract<Coverage, {
+        covered: false;
+    }>;
+};
+/**
+ * May `entity` be bound by a link its minter vouches for, now? The scope's recorded binding for
+ * the type, the record present, its column naming nobody, nobody holding its shape there on the
+ * spine (`bind-record-held`: unbind them first), and the minter holding the binding's
+ * permission on it (`allowed`, the checker's `check` for the minter). The same judgement at mint
+ * and at the exchange, so a link whose minter has since lost the key, or left, is refused.
+ */
+export declare function judgeBind(sql: ScopedSql, allowed: (permission: PermissionKey, entity: EntityRef) => Promise<boolean>, entity: EntityRef): Promise<{
+    ok: true;
+    binding: EntityBinding;
+} | {
+    ok: false;
+    refused: 'bind-not-declared' | 'bind-record-missing' | 'bind-record-ambiguous' | 'bind-record-bound' | 'bind-record-held';
+} | ReturnType<typeof lacking>>;
+/**
+ * The claim's write, inside the exchange's transaction once {@link judgeBind} has said yes there
+ * and the use is taken: the record's column set to `principal` — only while it still names nobody —
+ * the shape's current keys given with its marker, and `entity.holder-bound` emitted with the
+ * capability as actor. Nothing can have moved since the judgement inside one transaction, so a
+ * column that no longer reads empty is a fault: thrown, so the use rolls back with it.
+ */
+export declare function bindIn(sql: ScopedSql, binding: EntityBinding, entity: EntityRef, principal: PrincipalId, link: {
+    capabilityId: CapabilityId;
+    mintedBy: PrincipalId;
+}, emit: (event: DomainEventInput) => void): void;
+/** The pseudo-operation an unbind's spine event names, on `capabilities.mint-become`'s pattern. */
+export declare const ENTITY_UNBIND_OPERATION = "entities.unbind";
+/**
+ * A principal's unbind of `entity` (#1686) — the lever beside a binding invite, run by a host in one
+ * scope task and transaction. Bounded here: the caller must hold the binding's key on the record
+ * (`allowed`, the checker's `check` for the caller). Clears the record's column (every row with
+ * its id) and releases every holder of the shape on it from the spine — whoever a link bound,
+ * whatever the column says now, and a holder given the shape before the column was written —
+ * with one `entity.holder-unbound` event each through `emit`, whose actor the host stamps as the
+ * caller. `unbound` names everyone released; a refusal writes nothing.
+ */
+export declare function unbindEntityHolderBounded(deps: {
+    sql: ScopedSql;
+    now: string;
+    allowed: (permission: PermissionKey, entity: EntityRef) => Promise<boolean>;
+    emit: (event: DomainEventInput) => void;
+}, entity: EntityRef): Promise<BoundedUnbind>;
+/** What an erasure releases, read before any of it runs. */
+export interface ErasureBindings {
+    /** Shape holders to release: on a record that IS the subject (any holder), or the subject's own markers. */
+    holders: {
+        object: string;
+        only?: string;
+    }[];
+    /** Rows whose column names someone the erasure reaches, to clear where they survive. */
+    columns: {
+        binding: EntityBinding;
+        entityId: string;
+        principal: string;
+    }[];
+}
+/**
+ * Every binding the erasure of `subjectId` reaches, by the spine and by the column: on each type the
+ * scope binds or has ever bound (`shape-bound`) — the id matched against every such type, as a
+ * module's declared erasure matches its subject columns whatever the type, so ids that are not
+ * ULIDs (an integer, say) can collide across types — the record that IS the subject (every holder on it) and every record the subject
+ * holds the shape on (their own marker), plus the rows whose column names the subject or that are
+ * the subject. Read BEFORE any declared blank, delete or hook runs, so a row a module's erasure
+ * deletes is still known. A scope that binds nothing pays the one read of its shape records.
+ */
+export declare function captureBoundOf(sql: ScopedSql, subjectId: string): ErasureBindings;
+/**
+ * The erasure's unbind, after the module hooks: each captured column cleared where the row survived
+ * and still names that person, and each captured holder released from the spine whether or not
+ * its row survived. No event: an event naming the erased subject would be a new copy of what is
+ * being erased.
+ */
+export declare function releaseBound(sql: ScopedSql, captured: ErasureBindings, now: string): void;
+export {};
+//# sourceMappingURL=entity-binding.d.ts.map

package/dist/entity-binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entity-binding.d.ts","sourceRoot":"","sources":["../src/entity-binding.ts"],"names":[],"mappings":"AAAA,OAAO,EAOL,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,QAAQ,EACb,KAAK,gBAAgB,EAGrB,KAAK,SAAS,EACd,KAAK,aAAa,EAClB,KAAK,WAAW,EACjB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAIjD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,UAAU,aAAa;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,UAAU,EAAE,aAAa,GAAG,IAAI,CAAC;IACjC,qDAAqD;IACrD,IAAI,EAAE,aAAa,EAAE,CAAC;IACtB,+EAA+E;IAC/E,KAAK,EAAE,aAAa,EAAE,CAAC;CACxB;AA+ED,0FAA0F;AAC1F,QAAA,MAAM,OAAO,eAAgB,aAAa,KAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;QAAE,OAAO,EAAE,KAAK,CAAA;KAAE,CAAC,CAAA;CAGvG,CAAC;AAEH;;;;;;GAMG;AACH,wBAAsB,SAAS,CAC7B,GAAG,EAAE,SAAS,EACd,OAAO,EAAE,CAAC,UAAU,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,KAAK,OAAO,CAAC,OAAO,CAAC,EAC3E,MAAM,EAAE,SAAS,GAChB,OAAO,CACN;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,aAAa,CAAA;CAAE,GACpC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,mBAAmB,GAAG,qBAAqB,GAAG,uBAAuB,GAAG,mBAAmB,GAAG,kBAAkB,CAAA;CAAE,GACxI,UAAU,CAAC,OAAO,OAAO,CAAC,CAC7B,CAiBA;AAED;;;;;;GAMG;AACH,wBAAgB,MAAM,CACpB,GAAG,EAAE,SAAS,EACd,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,SAAS,EACjB,SAAS,EAAE,WAAW,EACtB,IAAI,EAAE;IAAE,YAAY,EAAE,YAAY,CAAC;IAAC,QAAQ,EAAE,WAAW,CAAA;CAAE,EAC3D,IAAI,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,GACtC,IAAI,CAqBN;AA+CD,mGAAmG;AACnG,eAAO,MAAM,uBAAuB,oBAAoB,CAAC;AAEzD;;;;;;;;GAQG;AACH,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE;IACJ,GAAG,EAAE,SAAS,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,CAAC,UAAU,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5E,IAAI,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,CAAC;CACzC,EACD,MAAM,EAAE,SAAS,GAChB,OAAO,CAAC,aAAa,CAAC,CAYxB;AAED,4DAA4D;AAC5D,MAAM,WAAW,eAAe;IAC9B,4GAA4G;IAC5G,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC7C,wFAAwF;IACxF,OAAO,EAAE;QAAE,OAAO,EAAE,aAAa,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC5E;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,GAAG,eAAe,CAmCjF;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAGzF"}

package/dist/entity-binding.js

@@ -0,0 +1,235 @@
+import { ENTITY_HOLDER_BOUND, ENTITY_HOLDER_UNBOUND, ENTITY_SHAPE_MARKER_RELATION, entityObjectRef, permissionKey, substratError, } from '@substrat-run/contracts';
+import { BIND_HOLDER_RELATION, BIND_KEY_RELATION, BIND_PERMISSION_RELATION, BOUND_EVER_RELATION, grantEntityShapeIn } from './entity-grant-shape.js';
+import { SHAPE_PROTECTED_KEY_RELATION } from './entity-grant.js';
+import { assertSqlIdentifier, tableExists } from './sql-identifier.js';
+import { switchSqlOf } from './system-switch.js';
+const PRINCIPAL = 'principal:';
+const GRANTED = 'granted:';
+const BINDING_RELATIONS = [BIND_HOLDER_RELATION, BIND_PERMISSION_RELATION, BIND_KEY_RELATION, SHAPE_PROTECTED_KEY_RELATION];
+/** One shape's recorded facts as a binding, or null when they do not make one. */
+function bindingFrom(entityType, rows) {
+    const of = (relation) => rows.filter((r) => r.relation === relation).map((r) => r.object);
+    const holder = of(BIND_HOLDER_RELATION);
+    const permission = of(BIND_PERMISSION_RELATION);
+    if (holder.length !== 1 || permission.length > 1)
+        return null;
+    const parts = holder[0].split('.');
+    if (parts.length !== 3)
+        return null;
+    const [table, idColumn, principalColumn] = parts.map((n) => assertSqlIdentifier('entityBinding', 'an identifier', n, `the recorded binding of '${entityType}'`));
+    const keys = (relation) => of(relation).map((o) => permissionKey.parse(o.slice(GRANTED.length))).sort();
+    return {
+        entityType,
+        table,
+        idColumn,
+        principalColumn,
+        permission: permission[0] === undefined ? null : permissionKey.parse(permission[0]),
+        keys: keys(BIND_KEY_RELATION),
+        every: keys(SHAPE_PROTECTED_KEY_RELATION),
+    };
+}
+/**
+ * The scope's recorded binding for `entityType` that still declares its bind key — what a mint, a
+ * claim and an unbind need — or null when its reconciled registry binds nothing there.
+ */
+function entityBindingOf(sql, entityType) {
+    const binding = bindingFrom(entityType, sql.query(`SELECT relation, object FROM _substrat_tuples WHERE subject = ? AND relation IN (?, ?, ?, ?)`, [`shape:${entityType}`, ...BINDING_RELATIONS]));
+    return binding?.permission ? { ...binding, permission: binding.permission } : null;
+}
+/** Every binding the scope's reconciled registry records, bind key or not — what an erasure releases — in one read. */
+function entityBindingsOf(sql) {
+    const bySubject = new Map();
+    for (const row of sql.query(`SELECT subject, relation, object FROM _substrat_tuples
+      WHERE subject >= 'shape:' AND subject < 'shape;' AND relation IN (?, ?, ?, ?)`, [...BINDING_RELATIONS])) {
+        bySubject.set(row.subject, [...(bySubject.get(row.subject) ?? []), row]);
+    }
+    return [...bySubject].flatMap(([subject, rows]) => bindingFrom(subject.slice('shape:'.length), rows) ?? []);
+}
+/**
+ * The record as the binding sees it: how many rows carry its id, and whom the first row that names
+ * someone names. Every row is read: the id column should be unique, and a record any of whose rows
+ * names someone is bound.
+ */
+function boundRecord(sql, b, entityId) {
+    if (!tableExists(switchSqlOf(sql), b.table))
+        return { rows: 0, principal: null };
+    const rows = sql.query(`SELECT "${b.principalColumn}" AS principal FROM "${b.table}" WHERE "${b.idColumn}" = ?`, [entityId]);
+    return { rows: rows.length, principal: rows.find((r) => r.principal !== null)?.principal ?? null };
+}
+/** Does anyone hold a live shape marker on `object`? */
+const heldBySomeone = (sql, object) => sql.query(`SELECT 1 FROM _substrat_tuples WHERE object = ? AND relation = '${ENTITY_SHAPE_MARKER_RELATION}' AND revoked_at IS NULL
+        AND subject >= '${PRINCIPAL}' AND subject < 'principal;' LIMIT 1`, [object]).length > 0;
+/** The bind key's refusal, in the shape every bounded verb answers a missing key with. */
+const lacking = (permission) => ({
+    ok: false,
+    coverage: { covered: false, missing: [permission] },
+});
+/**
+ * May `entity` be bound by a link its minter vouches for, now? The scope's recorded binding for
+ * the type, the record present, its column naming nobody, nobody holding its shape there on the
+ * spine (`bind-record-held`: unbind them first), and the minter holding the binding's
+ * permission on it (`allowed`, the checker's `check` for the minter). The same judgement at mint
+ * and at the exchange, so a link whose minter has since lost the key, or left, is refused.
+ */
+export async function judgeBind(sql, allowed, entity) {
+    entityObjectRef(entity, 'bind');
+    const binding = entityBindingOf(sql, entity.entityType);
+    if (!binding)
+        return { ok: false, refused: 'bind-not-declared' };
+    // The key before anything about the record: a minter without it on this record learns nothing
+    // of whether it exists, names someone, or is held — the same refusal for every record they lack.
+    if (!(await allowed(binding.permission, entity)))
+        return lacking(binding.permission);
+    const record = boundRecord(sql, binding, entity.entityId);
+    if (record.rows === 0)
+        return { ok: false, refused: 'bind-record-missing' };
+    if (record.principal !== null)
+        return { ok: false, refused: 'bind-record-bound' };
+    // Two rows carrying one id are no one record: there is nothing a claim could bind exactly once.
+    if (record.rows > 1)
+        return { ok: false, refused: 'bind-record-ambiguous' };
+    // The spine as well as the column: someone already holding the record's shape there — given it
+    // before the column was written, or left by a holder column a later version moved — is a holder
+    // a new link would bind a second person beside. Unbind them first.
+    if (heldBySomeone(sql, entityObjectRef(entity, 'bind')))
+        return { ok: false, refused: 'bind-record-held' };
+    return { ok: true, binding };
+}
+/**
+ * The claim's write, inside the exchange's transaction once {@link judgeBind} has said yes there
+ * and the use is taken: the record's column set to `principal` — only while it still names nobody —
+ * the shape's current keys given with its marker, and `entity.holder-bound` emitted with the
+ * capability as actor. Nothing can have moved since the judgement inside one transaction, so a
+ * column that no longer reads empty is a fault: thrown, so the use rolls back with it.
+ */
+export function bindIn(sql, binding, entity, principal, link, emit) {
+    // Counted by RETURNING, never by `changes`: on a Durable Object that is `rowsWritten`, which
+    // counts index entries too, so an index on the principal column reads one row as two. Exactly one
+    // row: an id two rows carry is no one record, and the claim refuses it rather than bind both.
+    const set = sql.query(`UPDATE "${binding.table}" SET "${binding.principalColumn}" = ? WHERE "${binding.idColumn}" = ? AND "${binding.principalColumn}" IS NULL RETURNING 1 AS one`, [principal, entity.entityId]);
+    if (set.length !== 1) {
+        throw substratError('internal', `capability ${link.capabilityId}: its bind on ${entity.entityType} was refused after it was judged`);
+    }
+    grantEntityShapeIn(switchSqlOf(sql), principal, entity, binding.keys);
+    // Sticky (the reconcile that recorded the binding wrote it too): an erasure releases this type's
+    // holders whatever a later version declares.
+    sql.exec('INSERT OR IGNORE INTO _substrat_tuples (subject, relation, object) VALUES (?, ?, ?)', [
+        `shape:${entity.entityType}`,
+        BOUND_EVER_RELATION,
+        'bound',
+    ]);
+    const payload = { entity, principal, ...link, granted: binding.keys };
+    emit({ type: ENTITY_HOLDER_BOUND, schemaVersion: 1, entity, piiClass: 'none', payload });
+}
+/**
+ * Release the record's shape holders from the SPINE: every principal holding a live marker on
+ * `object` (or only `only`), and with each marker everything that principal holds on the record —
+ * every `granted:` tuple there, whatever the shape's keys are now. A binding shape's marker and its
+ * keys come only from its own grant (its keys are refused to every direct grant on a record of the
+ * type), so the marker is the person's holding of the record, and what they hold on it goes with it:
+ * a key the shape has since dropped without retiring it included. That is broader than the shape:
+ * it ALSO revokes a direct grant of a key the shape does not declare, made to the same holder on the
+ * same record (a `bind:member` granted to a bound person goes with the unbind) — reported in
+ * `removed`, never silent. Judged by the spine, never the column, so a column module code rewrote
+ * cannot strand the person a link bound. One tombstone statement per holder (K-21).
+ */
+function releaseHolders(sql, object, now, only) {
+    const holders = sql.query(`SELECT subject FROM _substrat_tuples
+      WHERE object = ? AND relation = '${ENTITY_SHAPE_MARKER_RELATION}' AND revoked_at IS NULL
+        AND subject >= '${PRINCIPAL}' AND subject < 'principal;'${only === undefined ? '' : ' AND subject = ?'}`, only === undefined ? [object] : [object, `${PRINCIPAL}${only}`]);
+    return holders.map(({ subject }) => ({
+        principal: subject.slice(PRINCIPAL.length),
+        removed: sql
+            .query(`UPDATE _substrat_tuples SET revoked_at = ?
+          WHERE subject = ? AND object = ? AND revoked_at IS NULL
+            AND (relation = '${ENTITY_SHAPE_MARKER_RELATION}' OR (relation >= '${GRANTED}' AND relation < 'granted;'))
+          RETURNING relation`, [now, subject, object])
+            .flatMap((r) => (r.relation === ENTITY_SHAPE_MARKER_RELATION ? [] : [permissionKey.parse(r.relation.slice(GRANTED.length))]))
+            .sort(),
+    }));
+}
+/** Clear the record's column — every row carrying its id, or only where it still names `principal`. */
+function clearColumn(sql, binding, entityId, principal) {
+    if (!tableExists(switchSqlOf(sql), binding.table))
+        return;
+    sql.exec(`UPDATE "${binding.table}" SET "${binding.principalColumn}" = NULL WHERE "${binding.idColumn}" = ? AND ${principal === undefined ? `"${binding.principalColumn}" IS NOT NULL` : `"${binding.principalColumn}" = ?`}`, principal === undefined ? [entityId] : [entityId, principal]);
+}
+/** The pseudo-operation an unbind's spine event names, on `capabilities.mint-become`'s pattern. */
+export const ENTITY_UNBIND_OPERATION = 'entities.unbind';
+/**
+ * A principal's unbind of `entity` (#1686) — the lever beside a binding invite, run by a host in one
+ * scope task and transaction. Bounded here: the caller must hold the binding's key on the record
+ * (`allowed`, the checker's `check` for the caller). Clears the record's column (every row with
+ * its id) and releases every holder of the shape on it from the spine — whoever a link bound,
+ * whatever the column says now, and a holder given the shape before the column was written —
+ * with one `entity.holder-unbound` event each through `emit`, whose actor the host stamps as the
+ * caller. `unbound` names everyone released; a refusal writes nothing.
+ */
+export async function unbindEntityHolderBounded(deps, entity) {
+    const object = entityObjectRef(entity, 'unbind');
+    const binding = entityBindingOf(deps.sql, entity.entityType);
+    if (!binding)
+        return { ok: false, refused: 'bind-not-declared' };
+    if (!(await deps.allowed(binding.permission, entity)))
+        return lacking(binding.permission);
+    clearColumn(deps.sql, binding, entity.entityId);
+    const released = releaseHolders(deps.sql, object, deps.now);
+    for (const { principal, removed } of released) {
+        const payload = { entity, principal, removed };
+        deps.emit({ type: ENTITY_HOLDER_UNBOUND, schemaVersion: 1, entity, piiClass: 'none', payload });
+    }
+    return { ok: true, unbound: released.map((r) => r.principal) };
+}
+/**
+ * Every binding the erasure of `subjectId` reaches, by the spine and by the column: on each type the
+ * scope binds or has ever bound (`shape-bound`) — the id matched against every such type, as a
+ * module's declared erasure matches its subject columns whatever the type, so ids that are not
+ * ULIDs (an integer, say) can collide across types — the record that IS the subject (every holder on it) and every record the subject
+ * holds the shape on (their own marker), plus the rows whose column names the subject or that are
+ * the subject. Read BEFORE any declared blank, delete or hook runs, so a row a module's erasure
+ * deletes is still known. A scope that binds nothing pays the one read of its shape records.
+ */
+export function captureBoundOf(sql, subjectId) {
+    const out = { holders: [], columns: [] };
+    const bindings = new Map(entityBindingsOf(sql).map((b) => [b.entityType, b]));
+    // Every type that binds now, and every type that ever bound here (`shape-bound`, sticky).
+    const types = new Set([
+        ...bindings.keys(),
+        ...sql
+            .query(`SELECT subject FROM _substrat_tuples WHERE subject >= 'shape:' AND subject < 'shape;' AND relation = ?`, [
+            BOUND_EVER_RELATION,
+        ])
+            .map((r) => r.subject.slice('shape:'.length)),
+    ]);
+    for (const entityType of types) {
+        const prefix = `${entityType}:`;
+        out.holders.push({ object: `${prefix}${subjectId}` });
+        for (const { object } of sql.query(`SELECT object FROM _substrat_tuples
+        WHERE subject = ? AND relation = '${ENTITY_SHAPE_MARKER_RELATION}' AND revoked_at IS NULL AND object >= ? AND object < ?`, [`${PRINCIPAL}${subjectId}`, prefix, `${entityType};`])) {
+            out.holders.push({ object, only: subjectId });
+        }
+        // The column only where the holder is still recorded: a type a later version stopped binding
+        // has no column the kernel still knows, and its holders are released from the spine alone.
+        const binding = bindings.get(entityType);
+        if (!binding || !tableExists(switchSqlOf(sql), binding.table))
+            continue;
+        for (const r of sql.query(`SELECT "${binding.idColumn}" AS id, "${binding.principalColumn}" AS principal FROM "${binding.table}"
+        WHERE ("${binding.idColumn}" = ? OR "${binding.principalColumn}" = ?) AND "${binding.principalColumn}" IS NOT NULL`, [subjectId, subjectId])) {
+            out.columns.push({ binding, entityId: String(r.id), principal: r.principal });
+        }
+    }
+    return out;
+}
+/**
+ * The erasure's unbind, after the module hooks: each captured column cleared where the row survived
+ * and still names that person, and each captured holder released from the spine whether or not
+ * its row survived. No event: an event naming the erased subject would be a new copy of what is
+ * being erased.
+ */
+export function releaseBound(sql, captured, now) {
+    for (const { binding, entityId, principal } of captured.columns)
+        clearColumn(sql, binding, entityId, principal);
+    for (const { object, only } of captured.holders)
+        releaseHolders(sql, object, now, only);
+}
+//# sourceMappingURL=entity-binding.js.map

package/dist/entity-binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entity-binding.js","sourceRoot":"","sources":["../src/entity-binding.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,4BAA4B,EAC5B,eAAe,EACf,aAAa,EACb,aAAa,GAUd,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AACrJ,OAAO,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AAEjE,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAwCjD,MAAM,SAAS,GAAG,YAAY,CAAC;AAC/B,MAAM,OAAO,GAAG,UAAU,CAAC;AAC3B,MAAM,iBAAiB,GAAG,CAAC,oBAAoB,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,4BAA4B,CAAU,CAAC;AAErI,kFAAkF;AAClF,SAAS,WAAW,CAAC,UAAkB,EAAE,IAAqD;IAC5F,MAAM,EAAE,GAAG,CAAC,QAAgB,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAClG,MAAM,MAAM,GAAG,EAAE,CAAC,oBAAoB,CAAC,CAAC;IACxC,MAAM,UAAU,GAAG,EAAE,CAAC,wBAAwB,CAAC,CAAC;IAChD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9D,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,eAAe,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACzD,mBAAmB,CAAC,eAAe,EAAE,eAAe,EAAE,CAAC,EAAE,4BAA4B,UAAU,GAAG,CAAC,CACxE,CAAC;IAC9B,MAAM,IAAI,GAAG,CAAC,QAAgB,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAChH,OAAO;QACL,UAAU;QACV,KAAK;QACL,QAAQ;QACR,eAAe;QACf,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACnF,IAAI,EAAE,IAAI,CAAC,iBAAiB,CAAC;QAC7B,KAAK,EAAE,IAAI,CAAC,4BAA4B,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,GAAc,EAAE,UAAkB;IACzD,MAAM,OAAO,GAAG,WAAW,CACzB,UAAU,EACV,GAAG,CAAC,KAAK,CACP,8FAA8F,EAC9F,CAAC,SAAS,UAAU,EAAE,EAAE,GAAG,iBAAiB,CAAC,CAC9C,CACF,CAAC;IACF,OAAO,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACrF,CAAC;AAED,uHAAuH;AACvH,SAAS,gBAAgB,CAAC,GAAc;IACtC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkD,CAAC;IAC5E,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CACzB;oFACgF,EAChF,CAAC,GAAG,iBAAiB,CAAC,CACvB,EAAE,CAAC;QACF,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,CAAC,GAAG,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;AAC9G,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,GAAc,EAAE,CAAgB,EAAE,QAAgB;IACrE,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACjF,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CACpB,WAAW,CAAC,CAAC,eAAe,wBAAwB,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC,QAAQ,OAAO,EACxF,CAAC,QAAQ,CAAC,CACX,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,EAAE,SAAS,IAAI,IAAI,EAAE,CAAC;AACrG,CAAC;AAED,wDAAwD;AACxD,MAAM,aAAa,GAAG,CAAC,GAAc,EAAE,MAAc,EAAW,EAAE,CAChE,GAAG,CAAC,KAAK,CACP,mEAAmE,4BAA4B;0BACzE,SAAS,sCAAsC,EACrE,CAAC,MAAM,CAAC,CACT,CAAC,MAAM,GAAG,CAAC,CAAC;AAEf,0FAA0F;AAC1F,MAAM,OAAO,GAAG,CAAC,UAAyB,EAAkE,EAAE,CAAC,CAAC;IAC9G,EAAE,EAAE,KAAK;IACT,QAAQ,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,UAAU,CAAC,EAAE;CACpD,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAc,EACd,OAA2E,EAC3E,MAAiB;IAMjB,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IACxD,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC;IACjE,8FAA8F;IAC9F,iGAAiG;IACjG,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACrF,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC1D,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC;IAC5E,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC;IAClF,gGAAgG;IAChG,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC;IAC5E,+FAA+F;IAC/F,gGAAgG;IAChG,mEAAmE;IACnE,IAAI,aAAa,CAAC,GAAG,EAAE,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC3G,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,MAAM,CACpB,GAAc,EACd,OAAsB,EACtB,MAAiB,EACjB,SAAsB,EACtB,IAA2D,EAC3D,IAAuC;IAEvC,6FAA6F;IAC7F,kGAAkG;IAClG,8FAA8F;IAC9F,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CACnB,WAAW,OAAO,CAAC,KAAK,UAAU,OAAO,CAAC,eAAe,gBAAgB,OAAO,CAAC,QAAQ,cAAc,OAAO,CAAC,eAAe,8BAA8B,EAC5J,CAAC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,CAC7B,CAAC;IACF,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,aAAa,CAAC,UAAU,EAAE,cAAc,IAAI,CAAC,YAAY,iBAAiB,MAAM,CAAC,UAAU,kCAAkC,CAAC,CAAC;IACvI,CAAC;IACD,kBAAkB,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,iGAAiG;IACjG,6CAA6C;IAC7C,GAAG,CAAC,IAAI,CAAC,qFAAqF,EAAE;QAC9F,SAAS,MAAM,CAAC,UAAU,EAAE;QAC5B,mBAAmB;QACnB,OAAO;KACR,CAAC,CAAC;IACH,MAAM,OAAO,GAA6B,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IAChG,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,aAAa,EAAE,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;AAC3F,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,cAAc,CAAC,GAAc,EAAE,MAAc,EAAE,GAAW,EAAE,IAAa;IAChF,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CACvB;yCACqC,4BAA4B;0BAC3C,SAAS,+BAA+B,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,kBAAkB,EAAE,EAC5G,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,SAAS,GAAG,IAAI,EAAE,CAAC,CAChE,CAAC;IACF,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QACnC,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAgB;QACzD,OAAO,EAAE,GAAG;aACT,KAAK,CACJ;;+BAEuB,4BAA4B,sBAAsB,OAAO;6BAC3D,EACrB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CACvB;aACA,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,4BAA4B,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;aAC5H,IAAI,EAAE;KACV,CAAC,CAAC,CAAC;AACN,CAAC;AAED,uGAAuG;AACvG,SAAS,WAAW,CAAC,GAAc,EAAE,OAAsB,EAAE,QAAgB,EAAE,SAAkB;IAC/F,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO;IAC1D,GAAG,CAAC,IAAI,CACN,WAAW,OAAO,CAAC,KAAK,UAAU,OAAO,CAAC,eAAe,mBAAmB,OAAO,CAAC,QAAQ,aAC1F,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,eAAe,eAAe,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,eAAe,OACpG,EAAE,EACF,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAC7D,CAAC;AACJ,CAAC;AAED,mGAAmG;AACnG,MAAM,CAAC,MAAM,uBAAuB,GAAG,iBAAiB,CAAC;AAEzD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,IAKC,EACD,MAAiB;IAEjB,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IAC7D,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC;IACjE,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC1F,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5D,KAAK,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC9C,MAAM,OAAO,GAA+B,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;QAC3E,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,aAAa,EAAE,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;AACjE,CAAC;AAUD;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,GAAc,EAAE,SAAiB;IAC9D,MAAM,GAAG,GAAoB,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC1D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,0FAA0F;IAC1F,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC;QACpB,GAAG,QAAQ,CAAC,IAAI,EAAE;QAClB,GAAG,GAAG;aACH,KAAK,CAAsB,wGAAwG,EAAE;YACpI,mBAAmB;SACpB,CAAC;aACD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;KAChD,CAAC,CAAC;IACH,KAAK,MAAM,UAAU,IAAI,KAAK,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,GAAG,UAAU,GAAG,CAAC;QAChC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,EAAE,EAAE,CAAC,CAAC;QACtD,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,GAAG,CAAC,KAAK,CAChC;4CACsC,4BAA4B,yDAAyD,EAC3H,CAAC,GAAG,SAAS,GAAG,SAAS,EAAE,EAAE,MAAM,EAAE,GAAG,UAAU,GAAG,CAAC,CACvD,EAAE,CAAC;YACF,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAChD,CAAC;QACD,6FAA6F;QAC7F,2FAA2F;QAC3F,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC;YAAE,SAAS;QACxE,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK,CACvB,WAAW,OAAO,CAAC,QAAQ,aAAa,OAAO,CAAC,eAAe,wBAAwB,OAAO,CAAC,KAAK;kBACxF,OAAO,CAAC,QAAQ,aAAa,OAAO,CAAC,eAAe,eAAe,OAAO,CAAC,eAAe,eAAe,EACrH,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,EAAE,CAAC;YACF,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,GAAc,EAAE,QAAyB,EAAE,GAAW;IACjF,KAAK,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,QAAQ,CAAC,OAAO;QAAE,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IAChH,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC,OAAO;QAAE,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;AAC1F,CAAC"}