@substrat-run/kernel 0.143.0 → 0.145.0

package/dist/derived-handlers.js.map

@@ -1 +1 @@
-{"version":3,"file":"derived-handlers.js","sourceRoot":"","sources":["../src/derived-handlers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EACL,aAAa,EACb,aAAa,GAId,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAMxD,2GAA2G;AAC3G,MAAM,MAAM,GAAG,CAAC,UAAkB,EAAU,EAAE,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;AAErF,oCAAoC;AACpC,MAAM,UAAU,cAAc,CAAC,IAAoB;IACjD,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,UAAU,OAAO,SAAS,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;IACnG,MAAM,GAAG,GAAG,CAAC,EAAU,EAAa,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;IAEnF,MAAM,UAAU,GAAG,CAAC,GAAqB,EAAE,EAAU,EAAO,EAAE;QAC5D,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAM,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChD,IAAI,CAAC,GAAG;YAAE,MAAM,aAAa,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,MAAM,eAAe,EAAE,EAAE,CAAC,CAAC;QAC9E,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IAEF,uFAAuF;IACvF,MAAM,KAAK,GAAG,KAAK,EAAE,GAAqB,EAAE,KAAY,EAAiB,EAAE;QACzE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC;QAC3C,MAAM,QAAQ,GACZ,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS;YAC1C,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC;YACtB,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;QACtF,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;IAC3C,OAAO,CAAC,KAAK,EAAE,GAAqB,EAAE,KAAY,EAAE,EAAE;QACpD,MAAM,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACxB,OAAO,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC1B,CAAC,CAAqC,CAAC;AACzC,CAAC;AAED,uDAAuD;AACvD,SAAS,MAAM,CACb,IAAoB,EACpB,UAAsD,EACtD,GAA8B;IAE9B,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,KAAK;YACR,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAEvE,KAAK,MAAM;YACT,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;gBACpB,MAAM,OAAO,GAAQ,EAAE,CAAC;gBACxB,KAAK,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;oBAC7C,IAAI,KAAK,EAAE,CAAC,KAAK,CAAC,KAAK,SAAS;wBAAE,OAAO,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;gBACnE,CAAC;gBACD,OAAO,GAAG,CAAC,IAAI,CAAM,IAAI,CAAC,MAAM,EAAE;oBAChC,KAAK,EAAE,KAAK,EAAE,KAA2B;oBACzC,MAAM,EAAE,KAAK,EAAE,MAA4B;oBAC3C,IAAI,EAAE,KAAK,EAAE,IAA0B;oBACvC,KAAK,EAAE,KAAK,EAAE,KAAmC;oBACjD,OAAO;oBACP,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACvC,CAAC,CAAC;YACL,CAAC,CAAC;QAEJ,KAAK,QAAQ;YACX,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;gBACpB,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;gBACxC,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBACrC,mFAAmF;gBACnF,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,KAAK,SAAS,CAAC,CAAC;gBAC7E,gFAAgF;gBAChF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAO,QAAQ,CAAC;gBACvC,GAAG,CAAC,GAAG,CAAC,IAAI,CACV,UAAU,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;oBACjG,SAAS,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM;gBACxC,8FAA8F;gBAC9F,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,CAAa,CAAC,EAAE,EAAE,CAAC,CAC7D,CAAC;gBACF,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBAChC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;gBAC3C,OAAO,GAAG,CAAC;YACb,CAAC,CAAC;QAEJ,KAAK,QAAQ;YACX,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;gBACpB,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;gBACxC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBACpB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC7F,MAAM,MAAM,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;gBACrC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;gBAC9C,OAAO,MAAM,CAAC;YAChB,CAAC,CAAC;IACN,CAAC;AACH,CAAC;AAED,8FAA8F;AAC9F,SAAS,OAAO,CAAC,IAAiB,EAAE,MAAiB,EAAE,MAAW;IAChE,MAAM,OAAO,GAAQ,EAAE,CAAC;IACxB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACjE,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,MAAM;QACN,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9E,OAAO;KACmC,CAAC;AAC/C,CAAC"}
+{"version":3,"file":"derived-handlers.js","sourceRoot":"","sources":["../src/derived-handlers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EACL,aAAa,EACb,aAAa,GAMd,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAExD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAKjC,2GAA2G;AAC3G,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,UAAkB,EAAU,EAAE,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;AAE5F,oCAAoC;AACpC,MAAM,UAAU,cAAc,CAAC,IAAoB;IACjD,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,CAAC,EAAU,EAAa,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;IACnF,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAEzG,uFAAuF;IACvF,MAAM,KAAK,GAAG,KAAK,EAAE,GAAqB,EAAE,KAAY,EAAiB,EAAE;QACzE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC;QAC3C,MAAM,QAAQ,GACZ,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS;YAC1C,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC;YACtB,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;QACtF,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;IAC3C,+FAA+F;IAC/F,gGAAgG;IAChG,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,IAAwC,CAAC;IAC7E,OAAO,CAAC,KAAK,EAAE,GAAqB,EAAE,KAAY,EAAE,EAAE;QACpD,MAAM,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACxB,OAAO,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC1B,CAAC,CAAqC,CAAC;AACzC,CAAC;AAED,uDAAuD;AACvD,SAAS,MAAM,CACb,IAAoB,EACpB,UAAsD,EACtD,GAA8B;IAE9B,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,KAAK;YACR,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAEvE,KAAK,MAAM,EAAE,CAAC;YACZ,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC/D,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;gBACpB,4FAA4F;gBAC5F,aAAa,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBAC5B,OAAO,GAAG,CAAC,IAAI,CAAM,IAAI,CAAC,MAAM,EAAE;oBAChC,GAAG,MAAM,CAAC,KAAK,CAAC;oBAChB,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC;oBACvC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtC,sEAAsE;oBACtE,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,SAAS;wBACrE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAuB,EAAE;wBACtD,CAAC,CAAC,EAAE,CAAC;iBACR,CAAC,CAAC;YACL,CAAC,CAAC;QACJ,CAAC;QAED,KAAK,QAAQ;YACX,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;gBACpB,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;gBACxC,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBACrC,mFAAmF;gBACnF,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,KAAK,SAAS,CAAC,CAAC;gBAC7E,gFAAgF;gBAChF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAO,QAAQ,CAAC;gBACvC,2EAA2E;gBAC3E,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC9F,GAAG,CAAC,GAAG,CAAC,IAAI,CACV,UAAU,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;oBAC5F,SAAS,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM;gBACxC,8FAA8F;gBAC9F,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,CAAa,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAC3F,CAAC;gBACF,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBAChC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;gBAC3C,OAAO,GAAG,CAAC;YACb,CAAC,CAAC;QAEJ,KAAK,QAAQ;YACX,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;gBACpB,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;gBACxC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBACpB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC7F,MAAM,MAAM,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;gBACrC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;gBAC9C,OAAO,MAAM,CAAC;YAChB,CAAC,CAAC;QAEJ,KAAK,QAAQ,EAAE,CAAC;YACd,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC/D,+FAA+F;YAC/F,MAAM,OAAO,GAAG;gBACd,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5C,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC;gBAC1C,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC;aAC3C,CAAC;YACF,MAAM,MAAM,GACV,eAAe,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;gBAC9F,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;YAC5D,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;YAChE,MAAM,KAAK,GACT,UAAU,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS;gBACjF,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACnE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;gBACpB,MAAM,QAAQ,GAAG,aAAa,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBAC7C,MAAM,MAAM,GAAe;oBACzB,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC7C,wFAAwF;oBACxF,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,IAAI,IAAI,CAAa,CAAC;oBACvE,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC;iBAC7B,CAAC;gBACF,yFAAyF;gBACzF,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACrB,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAM,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;oBACvF,IAAI,QAAQ;wBAAE,OAAO,QAAQ,CAAC;gBAChC,CAAC;gBACD,MAAM,EAAE,GAAG,IAAI,EAAE,CAAC;gBAClB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC;gBACtC,yFAAyF;gBACzF,IAAI,IAAI,CAAC,MAAM;oBAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBACnG,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBACpC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;gBAC/C,OAAO,OAAO,CAAC;YACjB,CAAC,CAAC;QACJ,CAAC;QAED,2FAA2F;QAC3F,kFAAkF;QAClF,KAAK,SAAS,CAAC;QACf,KAAK,WAAW,CAAC;QACjB,KAAK,OAAO,CAAC;QACb,KAAK,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;YACvB,OAAO,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;gBAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;gBACxC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YACjD,CAAC,CAAC;QACJ,CAAC;QAED,KAAK,SAAS;YACZ,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,CAAM,IAAI,CAAC,MAAM,EAAE,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IAC5H,CAAC;AACH,CAAC;AAED,4FAA4F;AAC5F,SAAS,MAAM,CAAC,MAAc,EAAE,KAAa,EAAE,UAAkB,EAAE,OAAe;IAChF,MAAM,MAAM,GAAG,UAAU,OAAO,SAAS,MAAM,CAAC,KAAK,CAAC,UAAU,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;IACzF,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE;QACjB,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAM,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChD,IAAI,CAAC,GAAG;YAAE,MAAM,aAAa,CAAC,WAAW,EAAE,GAAG,MAAM,eAAe,EAAE,EAAE,CAAC,CAAC;QACzE,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;AACJ,CAAC;AAED,mGAAmG;AACnG,SAAS,YAAY,CAAC,MAAqB;IACzC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACpF,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;QACpB,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAChB,OAAO,EAAE,CAAC;IACZ,CAAC,CAAC;AACJ,CAAC;AAED,4FAA4F;AAC5F,SAAS,OAAO,CAAC,GAAqB,EAAE,MAA+B;IACrE,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,EAAE,CAAC;IACtB,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACrC,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AACjG,CAAC;AAED,0FAA0F;AAC1F,SAAS,MAAM,CAAC,KAAY;IAC1B,OAAO;QACL,KAAK,EAAE,KAAK,EAAE,KAA2B;QACzC,MAAM,EAAE,KAAK,EAAE,MAA4B;QAC3C,IAAI,EAAE,KAAK,EAAE,IAA0B;QACvC,KAAK,EAAE,KAAK,EAAE,KAAmC;KAClD,CAAC;AACJ,CAAC;AAED,uDAAuD;AACvD,SAAS,SAAS,CAAC,OAAuE,EAAE,KAAY;IACtG,MAAM,GAAG,GAAQ,EAAE,CAAC;IACpB,KAAK,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACxC,IAAI,KAAK,EAAE,CAAC,KAAK,CAAC,KAAK,SAAS;YAAE,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8FAA8F;AAC9F,SAAS,OAAO,CAAC,IAAiB,EAAE,MAAiB,EAAE,MAAW;IAChE,MAAM,OAAO,GAAQ,EAAE,CAAC;IACxB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACjE,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,MAAM;QACN,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9E,OAAO;KACmC,CAAC;AAC/C,CAAC"}

package/dist/entity-binding.d.ts

@@ -0,0 +1,121 @@
+import { type BoundedUnbind, type CapabilityId, type Coverage, type DomainEventInput, type EntityRef, type PermissionKey, type PrincipalId } from '@substrat-run/contracts';
+import type { ScopedSql } from './scope-host.js';
+/**
+ * A BINDING shape (#1686): a record names its own person in a declared column, and the person
+ * it names holds the record's declared shape there. What makes a customer invite a binding
+ * rather than a delegation: the link names WHICH record, the reviewed registry says WHAT the
+ * person bound to it holds, and the minter vouches for the record with an ordinary key.
+ *
+ * Three writes, each one statement set shared by both adapters:
+ * - {@link bindIn}: inside a `become` exchange's transaction, once {@link judgeBind} said yes and
+ *   the use is taken — the column set to the claimant, the shape granted (marker and keys), and
+ *   `entity.holder-bound` emitted.
+ * - {@link unbindEntityHolderBounded}: the column cleared, and every holder of the shape on the
+ *   record released from the SPINE — their marker and everything they hold there tombstoned (K-21).
+ * - {@link captureBoundOf} / {@link releaseBound}: the erasure's half — on every type that binds or
+ *   ever bound here, the holders on the erased record and the erased person's own markers, read
+ *   before any module erasure runs and released after the hooks whether or not a row survived.
+ *
+ * People already bound keep the shape until they are released — an unbind (while the shape still
+ * binds), an erasure, or the retirement of its keys — whatever a later version declares.
+ *
+ * Read from the scope's record of its reconciled registry (`shape-bind-*` tuples), never from the
+ * vertical's code: a scope not yet reconciled with a binding declaration binds nothing.
+ */
+interface EntityBinding {
+    entityType: string;
+    table: string;
+    idColumn: string;
+    principalColumn: string;
+    /**
+     * Who holds this on a record may bind its person with a link, and unbind them — null once a
+     * version dropped `bind` and kept the shape: nobody may, and an erasure still releases.
+     */
+    permission: PermissionKey | null;
+    /** The shape's current keys — what a claim gives. */
+    keys: PermissionKey[];
+    /** Every key of the shape, current and retired — what an unbind takes back. */
+    every: PermissionKey[];
+}
+/** The bind key's refusal, in the shape every bounded verb answers a missing key with. */
+declare const lacking: (permission: PermissionKey) => {
+    ok: false;
+    coverage: Extract<Coverage, {
+        covered: false;
+    }>;
+};
+/**
+ * May `entity` be bound by a link its minter vouches for, now? The scope's recorded binding for
+ * the type, the record present, its column naming nobody, nobody holding its shape there on the
+ * spine (`bind-record-held`: unbind them first), and the minter holding the binding's
+ * permission on it (`allowed`, the checker's `check` for the minter). The same judgement at mint
+ * and at the exchange, so a link whose minter has since lost the key, or left, is refused.
+ */
+export declare function judgeBind(sql: ScopedSql, allowed: (permission: PermissionKey, entity: EntityRef) => Promise<boolean>, entity: EntityRef): Promise<{
+    ok: true;
+    binding: EntityBinding;
+} | {
+    ok: false;
+    refused: 'bind-not-declared' | 'bind-record-missing' | 'bind-record-ambiguous' | 'bind-record-bound' | 'bind-record-held';
+} | ReturnType<typeof lacking>>;
+/**
+ * The claim's write, inside the exchange's transaction once {@link judgeBind} has said yes there
+ * and the use is taken: the record's column set to `principal` — only while it still names nobody —
+ * the shape's current keys given with its marker, and `entity.holder-bound` emitted with the
+ * capability as actor. Nothing can have moved since the judgement inside one transaction, so a
+ * column that no longer reads empty is a fault: thrown, so the use rolls back with it.
+ */
+export declare function bindIn(sql: ScopedSql, binding: EntityBinding, entity: EntityRef, principal: PrincipalId, link: {
+    capabilityId: CapabilityId;
+    mintedBy: PrincipalId;
+}, emit: (event: DomainEventInput) => void): void;
+/** The pseudo-operation an unbind's spine event names, on `capabilities.mint-become`'s pattern. */
+export declare const ENTITY_UNBIND_OPERATION = "entities.unbind";
+/**
+ * A principal's unbind of `entity` (#1686) — the lever beside a binding invite, run by a host in one
+ * scope task and transaction. Bounded here: the caller must hold the binding's key on the record
+ * (`allowed`, the checker's `check` for the caller). Clears the record's column (every row with
+ * its id) and releases every holder of the shape on it from the spine — whoever a link bound,
+ * whatever the column says now, and a holder given the shape before the column was written —
+ * with one `entity.holder-unbound` event each through `emit`, whose actor the host stamps as the
+ * caller. `unbound` names everyone released; a refusal writes nothing.
+ */
+export declare function unbindEntityHolderBounded(deps: {
+    sql: ScopedSql;
+    now: string;
+    allowed: (permission: PermissionKey, entity: EntityRef) => Promise<boolean>;
+    emit: (event: DomainEventInput) => void;
+}, entity: EntityRef): Promise<BoundedUnbind>;
+/** What an erasure releases, read before any of it runs. */
+export interface ErasureBindings {
+    /** Shape holders to release: on a record that IS the subject (any holder), or the subject's own markers. */
+    holders: {
+        object: string;
+        only?: string;
+    }[];
+    /** Rows whose column names someone the erasure reaches, to clear where they survive. */
+    columns: {
+        binding: EntityBinding;
+        entityId: string;
+        principal: string;
+    }[];
+}
+/**
+ * Every binding the erasure of `subjectId` reaches, by the spine and by the column: on each type the
+ * scope binds or has ever bound (`shape-bound`) — the id matched against every such type, as a
+ * module's declared erasure matches its subject columns whatever the type, so ids that are not
+ * ULIDs (an integer, say) can collide across types — the record that IS the subject (every holder on it) and every record the subject
+ * holds the shape on (their own marker), plus the rows whose column names the subject or that are
+ * the subject. Read BEFORE any declared blank, delete or hook runs, so a row a module's erasure
+ * deletes is still known. A scope that binds nothing pays the one read of its shape records.
+ */
+export declare function captureBoundOf(sql: ScopedSql, subjectId: string): ErasureBindings;
+/**
+ * The erasure's unbind, after the module hooks: each captured column cleared where the row survived
+ * and still names that person, and each captured holder released from the spine whether or not
+ * its row survived. No event: an event naming the erased subject would be a new copy of what is
+ * being erased.
+ */
+export declare function releaseBound(sql: ScopedSql, captured: ErasureBindings, now: string): void;
+export {};
+//# sourceMappingURL=entity-binding.d.ts.map

package/dist/entity-binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entity-binding.d.ts","sourceRoot":"","sources":["../src/entity-binding.ts"],"names":[],"mappings":"AAAA,OAAO,EAOL,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,QAAQ,EACb,KAAK,gBAAgB,EAGrB,KAAK,SAAS,EACd,KAAK,aAAa,EAClB,KAAK,WAAW,EACjB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAIjD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,UAAU,aAAa;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,UAAU,EAAE,aAAa,GAAG,IAAI,CAAC;IACjC,qDAAqD;IACrD,IAAI,EAAE,aAAa,EAAE,CAAC;IACtB,+EAA+E;IAC/E,KAAK,EAAE,aAAa,EAAE,CAAC;CACxB;AA+ED,0FAA0F;AAC1F,QAAA,MAAM,OAAO,eAAgB,aAAa,KAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;QAAE,OAAO,EAAE,KAAK,CAAA;KAAE,CAAC,CAAA;CAGvG,CAAC;AAEH;;;;;;GAMG;AACH,wBAAsB,SAAS,CAC7B,GAAG,EAAE,SAAS,EACd,OAAO,EAAE,CAAC,UAAU,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,KAAK,OAAO,CAAC,OAAO,CAAC,EAC3E,MAAM,EAAE,SAAS,GAChB,OAAO,CACN;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,aAAa,CAAA;CAAE,GACpC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,mBAAmB,GAAG,qBAAqB,GAAG,uBAAuB,GAAG,mBAAmB,GAAG,kBAAkB,CAAA;CAAE,GACxI,UAAU,CAAC,OAAO,OAAO,CAAC,CAC7B,CAiBA;AAED;;;;;;GAMG;AACH,wBAAgB,MAAM,CACpB,GAAG,EAAE,SAAS,EACd,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,SAAS,EACjB,SAAS,EAAE,WAAW,EACtB,IAAI,EAAE;IAAE,YAAY,EAAE,YAAY,CAAC;IAAC,QAAQ,EAAE,WAAW,CAAA;CAAE,EAC3D,IAAI,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,GACtC,IAAI,CAqBN;AA+CD,mGAAmG;AACnG,eAAO,MAAM,uBAAuB,oBAAoB,CAAC;AAEzD;;;;;;;;GAQG;AACH,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE;IACJ,GAAG,EAAE,SAAS,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,CAAC,UAAU,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5E,IAAI,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,CAAC;CACzC,EACD,MAAM,EAAE,SAAS,GAChB,OAAO,CAAC,aAAa,CAAC,CAYxB;AAED,4DAA4D;AAC5D,MAAM,WAAW,eAAe;IAC9B,4GAA4G;IAC5G,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC7C,wFAAwF;IACxF,OAAO,EAAE;QAAE,OAAO,EAAE,aAAa,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC5E;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,GAAG,eAAe,CAmCjF;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAGzF"}

package/dist/entity-binding.js

@@ -0,0 +1,235 @@
+import { ENTITY_HOLDER_BOUND, ENTITY_HOLDER_UNBOUND, ENTITY_SHAPE_MARKER_RELATION, entityObjectRef, permissionKey, substratError, } from '@substrat-run/contracts';
+import { BIND_HOLDER_RELATION, BIND_KEY_RELATION, BIND_PERMISSION_RELATION, BOUND_EVER_RELATION, grantEntityShapeIn } from './entity-grant-shape.js';
+import { SHAPE_PROTECTED_KEY_RELATION } from './entity-grant.js';
+import { assertSqlIdentifier, tableExists } from './sql-identifier.js';
+import { switchSqlOf } from './system-switch.js';
+const PRINCIPAL = 'principal:';
+const GRANTED = 'granted:';
+const BINDING_RELATIONS = [BIND_HOLDER_RELATION, BIND_PERMISSION_RELATION, BIND_KEY_RELATION, SHAPE_PROTECTED_KEY_RELATION];
+/** One shape's recorded facts as a binding, or null when they do not make one. */
+function bindingFrom(entityType, rows) {
+    const of = (relation) => rows.filter((r) => r.relation === relation).map((r) => r.object);
+    const holder = of(BIND_HOLDER_RELATION);
+    const permission = of(BIND_PERMISSION_RELATION);
+    if (holder.length !== 1 || permission.length > 1)
+        return null;
+    const parts = holder[0].split('.');
+    if (parts.length !== 3)
+        return null;
+    const [table, idColumn, principalColumn] = parts.map((n) => assertSqlIdentifier('entityBinding', 'an identifier', n, `the recorded binding of '${entityType}'`));
+    const keys = (relation) => of(relation).map((o) => permissionKey.parse(o.slice(GRANTED.length))).sort();
+    return {
+        entityType,
+        table,
+        idColumn,
+        principalColumn,
+        permission: permission[0] === undefined ? null : permissionKey.parse(permission[0]),
+        keys: keys(BIND_KEY_RELATION),
+        every: keys(SHAPE_PROTECTED_KEY_RELATION),
+    };
+}
+/**
+ * The scope's recorded binding for `entityType` that still declares its bind key — what a mint, a
+ * claim and an unbind need — or null when its reconciled registry binds nothing there.
+ */
+function entityBindingOf(sql, entityType) {
+    const binding = bindingFrom(entityType, sql.query(`SELECT relation, object FROM _substrat_tuples WHERE subject = ? AND relation IN (?, ?, ?, ?)`, [`shape:${entityType}`, ...BINDING_RELATIONS]));
+    return binding?.permission ? { ...binding, permission: binding.permission } : null;
+}
+/** Every binding the scope's reconciled registry records, bind key or not — what an erasure releases — in one read. */
+function entityBindingsOf(sql) {
+    const bySubject = new Map();
+    for (const row of sql.query(`SELECT subject, relation, object FROM _substrat_tuples
+      WHERE subject >= 'shape:' AND subject < 'shape;' AND relation IN (?, ?, ?, ?)`, [...BINDING_RELATIONS])) {
+        bySubject.set(row.subject, [...(bySubject.get(row.subject) ?? []), row]);
+    }
+    return [...bySubject].flatMap(([subject, rows]) => bindingFrom(subject.slice('shape:'.length), rows) ?? []);
+}
+/**
+ * The record as the binding sees it: how many rows carry its id, and whom the first row that names
+ * someone names. Every row is read: the id column should be unique, and a record any of whose rows
+ * names someone is bound.
+ */
+function boundRecord(sql, b, entityId) {
+    if (!tableExists(switchSqlOf(sql), b.table))
+        return { rows: 0, principal: null };
+    const rows = sql.query(`SELECT "${b.principalColumn}" AS principal FROM "${b.table}" WHERE "${b.idColumn}" = ?`, [entityId]);
+    return { rows: rows.length, principal: rows.find((r) => r.principal !== null)?.principal ?? null };
+}
+/** Does anyone hold a live shape marker on `object`? */
+const heldBySomeone = (sql, object) => sql.query(`SELECT 1 FROM _substrat_tuples WHERE object = ? AND relation = '${ENTITY_SHAPE_MARKER_RELATION}' AND revoked_at IS NULL
+        AND subject >= '${PRINCIPAL}' AND subject < 'principal;' LIMIT 1`, [object]).length > 0;
+/** The bind key's refusal, in the shape every bounded verb answers a missing key with. */
+const lacking = (permission) => ({
+    ok: false,
+    coverage: { covered: false, missing: [permission] },
+});
+/**
+ * May `entity` be bound by a link its minter vouches for, now? The scope's recorded binding for
+ * the type, the record present, its column naming nobody, nobody holding its shape there on the
+ * spine (`bind-record-held`: unbind them first), and the minter holding the binding's
+ * permission on it (`allowed`, the checker's `check` for the minter). The same judgement at mint
+ * and at the exchange, so a link whose minter has since lost the key, or left, is refused.
+ */
+export async function judgeBind(sql, allowed, entity) {
+    entityObjectRef(entity, 'bind');
+    const binding = entityBindingOf(sql, entity.entityType);
+    if (!binding)
+        return { ok: false, refused: 'bind-not-declared' };
+    // The key before anything about the record: a minter without it on this record learns nothing
+    // of whether it exists, names someone, or is held — the same refusal for every record they lack.
+    if (!(await allowed(binding.permission, entity)))
+        return lacking(binding.permission);
+    const record = boundRecord(sql, binding, entity.entityId);
+    if (record.rows === 0)
+        return { ok: false, refused: 'bind-record-missing' };
+    if (record.principal !== null)
+        return { ok: false, refused: 'bind-record-bound' };
+    // Two rows carrying one id are no one record: there is nothing a claim could bind exactly once.
+    if (record.rows > 1)
+        return { ok: false, refused: 'bind-record-ambiguous' };
+    // The spine as well as the column: someone already holding the record's shape there — given it
+    // before the column was written, or left by a holder column a later version moved — is a holder
+    // a new link would bind a second person beside. Unbind them first.
+    if (heldBySomeone(sql, entityObjectRef(entity, 'bind')))
+        return { ok: false, refused: 'bind-record-held' };
+    return { ok: true, binding };
+}
+/**
+ * The claim's write, inside the exchange's transaction once {@link judgeBind} has said yes there
+ * and the use is taken: the record's column set to `principal` — only while it still names nobody —
+ * the shape's current keys given with its marker, and `entity.holder-bound` emitted with the
+ * capability as actor. Nothing can have moved since the judgement inside one transaction, so a
+ * column that no longer reads empty is a fault: thrown, so the use rolls back with it.
+ */
+export function bindIn(sql, binding, entity, principal, link, emit) {
+    // Counted by RETURNING, never by `changes`: on a Durable Object that is `rowsWritten`, which
+    // counts index entries too, so an index on the principal column reads one row as two. Exactly one
+    // row: an id two rows carry is no one record, and the claim refuses it rather than bind both.
+    const set = sql.query(`UPDATE "${binding.table}" SET "${binding.principalColumn}" = ? WHERE "${binding.idColumn}" = ? AND "${binding.principalColumn}" IS NULL RETURNING 1 AS one`, [principal, entity.entityId]);
+    if (set.length !== 1) {
+        throw substratError('internal', `capability ${link.capabilityId}: its bind on ${entity.entityType} was refused after it was judged`);
+    }
+    grantEntityShapeIn(switchSqlOf(sql), principal, entity, binding.keys);
+    // Sticky (the reconcile that recorded the binding wrote it too): an erasure releases this type's
+    // holders whatever a later version declares.
+    sql.exec('INSERT OR IGNORE INTO _substrat_tuples (subject, relation, object) VALUES (?, ?, ?)', [
+        `shape:${entity.entityType}`,
+        BOUND_EVER_RELATION,
+        'bound',
+    ]);
+    const payload = { entity, principal, ...link, granted: binding.keys };
+    emit({ type: ENTITY_HOLDER_BOUND, schemaVersion: 1, entity, piiClass: 'none', payload });
+}
+/**
+ * Release the record's shape holders from the SPINE: every principal holding a live marker on
+ * `object` (or only `only`), and with each marker everything that principal holds on the record —
+ * every `granted:` tuple there, whatever the shape's keys are now. A binding shape's marker and its
+ * keys come only from its own grant (its keys are refused to every direct grant on a record of the
+ * type), so the marker is the person's holding of the record, and what they hold on it goes with it:
+ * a key the shape has since dropped without retiring it included. That is broader than the shape:
+ * it ALSO revokes a direct grant of a key the shape does not declare, made to the same holder on the
+ * same record (a `bind:member` granted to a bound person goes with the unbind) — reported in
+ * `removed`, never silent. Judged by the spine, never the column, so a column module code rewrote
+ * cannot strand the person a link bound. One tombstone statement per holder (K-21).
+ */
+function releaseHolders(sql, object, now, only) {
+    const holders = sql.query(`SELECT subject FROM _substrat_tuples
+      WHERE object = ? AND relation = '${ENTITY_SHAPE_MARKER_RELATION}' AND revoked_at IS NULL
+        AND subject >= '${PRINCIPAL}' AND subject < 'principal;'${only === undefined ? '' : ' AND subject = ?'}`, only === undefined ? [object] : [object, `${PRINCIPAL}${only}`]);
+    return holders.map(({ subject }) => ({
+        principal: subject.slice(PRINCIPAL.length),
+        removed: sql
+            .query(`UPDATE _substrat_tuples SET revoked_at = ?
+          WHERE subject = ? AND object = ? AND revoked_at IS NULL
+            AND (relation = '${ENTITY_SHAPE_MARKER_RELATION}' OR (relation >= '${GRANTED}' AND relation < 'granted;'))
+          RETURNING relation`, [now, subject, object])
+            .flatMap((r) => (r.relation === ENTITY_SHAPE_MARKER_RELATION ? [] : [permissionKey.parse(r.relation.slice(GRANTED.length))]))
+            .sort(),
+    }));
+}
+/** Clear the record's column — every row carrying its id, or only where it still names `principal`. */
+function clearColumn(sql, binding, entityId, principal) {
+    if (!tableExists(switchSqlOf(sql), binding.table))
+        return;
+    sql.exec(`UPDATE "${binding.table}" SET "${binding.principalColumn}" = NULL WHERE "${binding.idColumn}" = ? AND ${principal === undefined ? `"${binding.principalColumn}" IS NOT NULL` : `"${binding.principalColumn}" = ?`}`, principal === undefined ? [entityId] : [entityId, principal]);
+}
+/** The pseudo-operation an unbind's spine event names, on `capabilities.mint-become`'s pattern. */
+export const ENTITY_UNBIND_OPERATION = 'entities.unbind';
+/**
+ * A principal's unbind of `entity` (#1686) — the lever beside a binding invite, run by a host in one
+ * scope task and transaction. Bounded here: the caller must hold the binding's key on the record
+ * (`allowed`, the checker's `check` for the caller). Clears the record's column (every row with
+ * its id) and releases every holder of the shape on it from the spine — whoever a link bound,
+ * whatever the column says now, and a holder given the shape before the column was written —
+ * with one `entity.holder-unbound` event each through `emit`, whose actor the host stamps as the
+ * caller. `unbound` names everyone released; a refusal writes nothing.
+ */
+export async function unbindEntityHolderBounded(deps, entity) {
+    const object = entityObjectRef(entity, 'unbind');
+    const binding = entityBindingOf(deps.sql, entity.entityType);
+    if (!binding)
+        return { ok: false, refused: 'bind-not-declared' };
+    if (!(await deps.allowed(binding.permission, entity)))
+        return lacking(binding.permission);
+    clearColumn(deps.sql, binding, entity.entityId);
+    const released = releaseHolders(deps.sql, object, deps.now);
+    for (const { principal, removed } of released) {
+        const payload = { entity, principal, removed };
+        deps.emit({ type: ENTITY_HOLDER_UNBOUND, schemaVersion: 1, entity, piiClass: 'none', payload });
+    }
+    return { ok: true, unbound: released.map((r) => r.principal) };
+}
+/**
+ * Every binding the erasure of `subjectId` reaches, by the spine and by the column: on each type the
+ * scope binds or has ever bound (`shape-bound`) — the id matched against every such type, as a
+ * module's declared erasure matches its subject columns whatever the type, so ids that are not
+ * ULIDs (an integer, say) can collide across types — the record that IS the subject (every holder on it) and every record the subject
+ * holds the shape on (their own marker), plus the rows whose column names the subject or that are
+ * the subject. Read BEFORE any declared blank, delete or hook runs, so a row a module's erasure
+ * deletes is still known. A scope that binds nothing pays the one read of its shape records.
+ */
+export function captureBoundOf(sql, subjectId) {
+    const out = { holders: [], columns: [] };
+    const bindings = new Map(entityBindingsOf(sql).map((b) => [b.entityType, b]));
+    // Every type that binds now, and every type that ever bound here (`shape-bound`, sticky).
+    const types = new Set([
+        ...bindings.keys(),
+        ...sql
+            .query(`SELECT subject FROM _substrat_tuples WHERE subject >= 'shape:' AND subject < 'shape;' AND relation = ?`, [
+            BOUND_EVER_RELATION,
+        ])
+            .map((r) => r.subject.slice('shape:'.length)),
+    ]);
+    for (const entityType of types) {
+        const prefix = `${entityType}:`;
+        out.holders.push({ object: `${prefix}${subjectId}` });
+        for (const { object } of sql.query(`SELECT object FROM _substrat_tuples
+        WHERE subject = ? AND relation = '${ENTITY_SHAPE_MARKER_RELATION}' AND revoked_at IS NULL AND object >= ? AND object < ?`, [`${PRINCIPAL}${subjectId}`, prefix, `${entityType};`])) {
+            out.holders.push({ object, only: subjectId });
+        }
+        // The column only where the holder is still recorded: a type a later version stopped binding
+        // has no column the kernel still knows, and its holders are released from the spine alone.
+        const binding = bindings.get(entityType);
+        if (!binding || !tableExists(switchSqlOf(sql), binding.table))
+            continue;
+        for (const r of sql.query(`SELECT "${binding.idColumn}" AS id, "${binding.principalColumn}" AS principal FROM "${binding.table}"
+        WHERE ("${binding.idColumn}" = ? OR "${binding.principalColumn}" = ?) AND "${binding.principalColumn}" IS NOT NULL`, [subjectId, subjectId])) {
+            out.columns.push({ binding, entityId: String(r.id), principal: r.principal });
+        }
+    }
+    return out;
+}
+/**
+ * The erasure's unbind, after the module hooks: each captured column cleared where the row survived
+ * and still names that person, and each captured holder released from the spine whether or not
+ * its row survived. No event: an event naming the erased subject would be a new copy of what is
+ * being erased.
+ */
+export function releaseBound(sql, captured, now) {
+    for (const { binding, entityId, principal } of captured.columns)
+        clearColumn(sql, binding, entityId, principal);
+    for (const { object, only } of captured.holders)
+        releaseHolders(sql, object, now, only);
+}
+//# sourceMappingURL=entity-binding.js.map

package/dist/entity-binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entity-binding.js","sourceRoot":"","sources":["../src/entity-binding.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,4BAA4B,EAC5B,eAAe,EACf,aAAa,EACb,aAAa,GAUd,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AACrJ,OAAO,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AAEjE,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAwCjD,MAAM,SAAS,GAAG,YAAY,CAAC;AAC/B,MAAM,OAAO,GAAG,UAAU,CAAC;AAC3B,MAAM,iBAAiB,GAAG,CAAC,oBAAoB,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,4BAA4B,CAAU,CAAC;AAErI,kFAAkF;AAClF,SAAS,WAAW,CAAC,UAAkB,EAAE,IAAqD;IAC5F,MAAM,EAAE,GAAG,CAAC,QAAgB,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAClG,MAAM,MAAM,GAAG,EAAE,CAAC,oBAAoB,CAAC,CAAC;IACxC,MAAM,UAAU,GAAG,EAAE,CAAC,wBAAwB,CAAC,CAAC;IAChD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9D,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,eAAe,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACzD,mBAAmB,CAAC,eAAe,EAAE,eAAe,EAAE,CAAC,EAAE,4BAA4B,UAAU,GAAG,CAAC,CACxE,CAAC;IAC9B,MAAM,IAAI,GAAG,CAAC,QAAgB,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAChH,OAAO;QACL,UAAU;QACV,KAAK;QACL,QAAQ;QACR,eAAe;QACf,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACnF,IAAI,EAAE,IAAI,CAAC,iBAAiB,CAAC;QAC7B,KAAK,EAAE,IAAI,CAAC,4BAA4B,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,GAAc,EAAE,UAAkB;IACzD,MAAM,OAAO,GAAG,WAAW,CACzB,UAAU,EACV,GAAG,CAAC,KAAK,CACP,8FAA8F,EAC9F,CAAC,SAAS,UAAU,EAAE,EAAE,GAAG,iBAAiB,CAAC,CAC9C,CACF,CAAC;IACF,OAAO,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACrF,CAAC;AAED,uHAAuH;AACvH,SAAS,gBAAgB,CAAC,GAAc;IACtC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkD,CAAC;IAC5E,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CACzB;oFACgF,EAChF,CAAC,GAAG,iBAAiB,CAAC,CACvB,EAAE,CAAC;QACF,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,CAAC,GAAG,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;AAC9G,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,GAAc,EAAE,CAAgB,EAAE,QAAgB;IACrE,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACjF,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CACpB,WAAW,CAAC,CAAC,eAAe,wBAAwB,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC,QAAQ,OAAO,EACxF,CAAC,QAAQ,CAAC,CACX,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,EAAE,SAAS,IAAI,IAAI,EAAE,CAAC;AACrG,CAAC;AAED,wDAAwD;AACxD,MAAM,aAAa,GAAG,CAAC,GAAc,EAAE,MAAc,EAAW,EAAE,CAChE,GAAG,CAAC,KAAK,CACP,mEAAmE,4BAA4B;0BACzE,SAAS,sCAAsC,EACrE,CAAC,MAAM,CAAC,CACT,CAAC,MAAM,GAAG,CAAC,CAAC;AAEf,0FAA0F;AAC1F,MAAM,OAAO,GAAG,CAAC,UAAyB,EAAkE,EAAE,CAAC,CAAC;IAC9G,EAAE,EAAE,KAAK;IACT,QAAQ,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,UAAU,CAAC,EAAE;CACpD,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAc,EACd,OAA2E,EAC3E,MAAiB;IAMjB,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IACxD,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC;IACjE,8FAA8F;IAC9F,iGAAiG;IACjG,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACrF,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC1D,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC;IAC5E,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC;IAClF,gGAAgG;IAChG,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC;IAC5E,+FAA+F;IAC/F,gGAAgG;IAChG,mEAAmE;IACnE,IAAI,aAAa,CAAC,GAAG,EAAE,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC3G,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,MAAM,CACpB,GAAc,EACd,OAAsB,EACtB,MAAiB,EACjB,SAAsB,EACtB,IAA2D,EAC3D,IAAuC;IAEvC,6FAA6F;IAC7F,kGAAkG;IAClG,8FAA8F;IAC9F,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CACnB,WAAW,OAAO,CAAC,KAAK,UAAU,OAAO,CAAC,eAAe,gBAAgB,OAAO,CAAC,QAAQ,cAAc,OAAO,CAAC,eAAe,8BAA8B,EAC5J,CAAC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,CAC7B,CAAC;IACF,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,aAAa,CAAC,UAAU,EAAE,cAAc,IAAI,CAAC,YAAY,iBAAiB,MAAM,CAAC,UAAU,kCAAkC,CAAC,CAAC;IACvI,CAAC;IACD,kBAAkB,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,iGAAiG;IACjG,6CAA6C;IAC7C,GAAG,CAAC,IAAI,CAAC,qFAAqF,EAAE;QAC9F,SAAS,MAAM,CAAC,UAAU,EAAE;QAC5B,mBAAmB;QACnB,OAAO;KACR,CAAC,CAAC;IACH,MAAM,OAAO,GAA6B,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IAChG,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,aAAa,EAAE,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;AAC3F,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,cAAc,CAAC,GAAc,EAAE,MAAc,EAAE,GAAW,EAAE,IAAa;IAChF,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CACvB;yCACqC,4BAA4B;0BAC3C,SAAS,+BAA+B,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,kBAAkB,EAAE,EAC5G,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,SAAS,GAAG,IAAI,EAAE,CAAC,CAChE,CAAC;IACF,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QACnC,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAgB;QACzD,OAAO,EAAE,GAAG;aACT,KAAK,CACJ;;+BAEuB,4BAA4B,sBAAsB,OAAO;6BAC3D,EACrB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CACvB;aACA,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,4BAA4B,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;aAC5H,IAAI,EAAE;KACV,CAAC,CAAC,CAAC;AACN,CAAC;AAED,uGAAuG;AACvG,SAAS,WAAW,CAAC,GAAc,EAAE,OAAsB,EAAE,QAAgB,EAAE,SAAkB;IAC/F,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO;IAC1D,GAAG,CAAC,IAAI,CACN,WAAW,OAAO,CAAC,KAAK,UAAU,OAAO,CAAC,eAAe,mBAAmB,OAAO,CAAC,QAAQ,aAC1F,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,eAAe,eAAe,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,eAAe,OACpG,EAAE,EACF,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAC7D,CAAC;AACJ,CAAC;AAED,mGAAmG;AACnG,MAAM,CAAC,MAAM,uBAAuB,GAAG,iBAAiB,CAAC;AAEzD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,IAKC,EACD,MAAiB;IAEjB,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IAC7D,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC;IACjE,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC1F,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5D,KAAK,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC9C,MAAM,OAAO,GAA+B,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;QAC3E,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,aAAa,EAAE,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;AACjE,CAAC;AAUD;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,GAAc,EAAE,SAAiB;IAC9D,MAAM,GAAG,GAAoB,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC1D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,0FAA0F;IAC1F,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC;QACpB,GAAG,QAAQ,CAAC,IAAI,EAAE;QAClB,GAAG,GAAG;aACH,KAAK,CAAsB,wGAAwG,EAAE;YACpI,mBAAmB;SACpB,CAAC;aACD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;KAChD,CAAC,CAAC;IACH,KAAK,MAAM,UAAU,IAAI,KAAK,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,GAAG,UAAU,GAAG,CAAC;QAChC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,EAAE,EAAE,CAAC,CAAC;QACtD,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,GAAG,CAAC,KAAK,CAChC;4CACsC,4BAA4B,yDAAyD,EAC3H,CAAC,GAAG,SAAS,GAAG,SAAS,EAAE,EAAE,MAAM,EAAE,GAAG,UAAU,GAAG,CAAC,CACvD,EAAE,CAAC;YACF,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAChD,CAAC;QACD,6FAA6F;QAC7F,2FAA2F;QAC3F,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC;YAAE,SAAS;QACxE,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK,CACvB,WAAW,OAAO,CAAC,QAAQ,aAAa,OAAO,CAAC,eAAe,wBAAwB,OAAO,CAAC,KAAK;kBACxF,OAAO,CAAC,QAAQ,aAAa,OAAO,CAAC,eAAe,eAAe,OAAO,CAAC,eAAe,eAAe,EACrH,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,EAAE,CAAC;YACF,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,GAAc,EAAE,QAAyB,EAAE,GAAW;IACjF,KAAK,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,QAAQ,CAAC,OAAO;QAAE,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IAChH,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC,OAAO;QAAE,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;AAC1F,CAAC"}

package/dist/entity-grant-shape.d.ts

@@ -36,13 +36,25 @@ import type { SwitchSql } from './system-switch.js';
  *   the principal; a table column naming the principal), and a person is marked only on their
  *   own record, and only when they hold a row there (live or tombstoned) for some key of the
  *   shape — evidence they were given it. Someone `ctx.grant`ed even the whole shape on another
- *   person's record is never marked. A shape with no `holder` gets no backfill. Each batch marks
- *   at most what the pass's budget allows; the markers are the progress, since a marked pair is
- *   no longer a candidate, and a record tuple (`shape:<type>`, `shape-backfilled`, `scope:<id>`)
- *   ends it once a batch comes back short.
+ *   person's record is never marked. A shape with no `holder` gets no backfill. It is read in
+ *   windows like the walks (#2154): each pass reads at most its read budget of rows, in an index
+ *   order, marks at most its write budget, and hands back the last row it read as the cursor's
+ *   `row`, so the next pass seeks past it rather than re-reading from the start. A record tuple
+ *   (`shape:<type>`, `shape-backfilled`, `scope:<id>`) ends it once a read reaches the end of the
+ *   range, and never before. A table holder's read is keyed on `idColumn` and then the row's own
+ *   identity (its `rowid`, or a `WITHOUT ROWID` table's primary key), because nothing makes
+ *   `idColumn` unique or the principal non-NULL, and a key that ties lets a window's edge skip a row.
+ *
+ *   The cut-off is the cursor. Evidence that lands behind it while the backfill runs (a direct
+ *   grant of a shape key to the person on their own record, for `'self'` or a table holder) is not
+ *   marked, and once the record is written nothing is: the same accepted gap as a grant landing
+ *   after the record. There is deliberately no confirming walk, as a retirement has: it would
+ *   double every first backfill's reads to catch a grant that a shape grant should have made. For
+ *   `'grantee'` nothing can land at all, since the first pass records the grantee keys and the
+ *   tuple writer refuses them to every other grant from then on.
  * - `holder: 'grantee'` (#2083), for a record that names no principal (a portal customer, a
  *   contact): whoever holds a live current or retired key of the shape on such an entity was given it.
- *   Each pass records current and retired keys (`shape-grantee-key`), and the explicit tuple
+ *   Each reconcile records current and retired keys (`shape-grantee-key`), and the explicit tuple
  *   writer makes non-shape grants refuse them on that entity type. A tuple from before the
  *   first such pass cannot be told apart. A marker already written by a shape grant persists
  *   through retirement, so its holder receives the new keys even if their old key was K alone.
@@ -65,7 +77,8 @@ export declare const SHAPE_MARKER_INDEX_DDL = "CREATE INDEX IF NOT EXISTS _subst
 /** Holders topped up per pass — one transaction each, so a large scope never holds one long. */
 export declare const SHAPE_TOP_UP_BATCH = 500;
 /**
- * Markers a pass may READ, per row of work it may write. The budget bounds writes, but finding
+ * Rows a pass may READ, per row of work it may write: markers on a walk, and the tuples or table
+ * rows the backfill reads for candidates (#2154). The budget bounds writes, but finding
  * the holders who need one means reading past the ones who do not, and on a scope where nobody
  * does (the common reconcile: nothing changed) that is every marker. Ten per row keeps a pass at
  * 5000 index rows by default, short on any scope, while a rollout still spends most of each pass
@@ -121,6 +134,15 @@ export interface ShapeCursor {
         object: string;
         subject: string;
     } | null;
+    /**
+     * The backfill only (#2154): the sort key of the last row its read reached, `[object, relation,
+     * subject]` of a tuple for a `'self'` or `'grantee'` holder, `[id, rowid]` for a table holder
+     * (`[id, …primary key]` for a `WITHOUT ROWID` table). Absent
+     * or `null` reads the backfill from its start, which is always safe: a pair it already marked
+     * is no longer a candidate, so a cursor from before this field (or one a rollback ignores) only
+     * costs a re-read.
+     */
+    row?: readonly (string | number)[] | null;
     /**
      * A confirming retire walk only: whether it has taken nothing so far, and how many confirming
      * walks before it, on this shape in this reconcile, took keys.
@@ -148,12 +170,15 @@ export interface ShapePass {
 }
 /**
  * One pass of the reconcile over one scope, at most `limit` rows of work and
- * `limit × SHAPE_MARKER_READS_PER_ROW` markers read: backfill marks for any shape whose backfill
+ * `limit × SHAPE_MARKER_READS_PER_ROW` rows read (markers, and the backfill's tuples or table
+ * rows): backfill marks for any shape whose backfill
  * is not done here, then holders whose retired keys are taken back, each with its
  * `entity.grants-retired` event, then holders topped up, each with its `entity.grants-topped-up`
  * event. `next` is `null` once the scope is done; otherwise the caller runs another pass with it
  * as `after`. `retirementsLeftOpen` counts the shapes whose retirement this pass gave up on at
- * `SHAPE_RETIRE_CONFIRMS_MAX`, for the next reconcile to run again. Run it inside ONE
+ * `SHAPE_RETIRE_CONFIRMS_MAX`, for the next reconcile to run again. The last pass (`next: null`)
+ * also answers `boundEver` (#2184): every type this scope has ever bound (`shape-bound`), read
+ * after this reconcile recorded its facts, for the platform's binding-shape gate. Run it inside ONE
  * transaction, so the keys and their events commit together. Re-running a finished scope writes
  * nothing.
  */
@@ -162,5 +187,26 @@ export declare function topUpEntityGrantShapes(db: SwitchSql, pass: ShapePass):
     retired: number;
     retirementsLeftOpen: number;
     next: ShapeCursor | null;
+    boundEver?: string[];
 };
+/**
+ * A BINDING shape's record (#1686), on the scope's tuple spine beside the grantee keys: which
+ * table column names the record's person (`<table>.<idColumn>.<principalColumn>`), the key that
+ * lets someone bind or unbind them, and the shape's current keys — what a binding invite's claim
+ * gives. The claim and an unbind read these, never the vertical's code: the shape is the reviewed
+ * registry the platform last reconciled this scope with. Each identifier is a SQL identifier, so
+ * `.` cannot occur inside one.
+ */
+export declare const BIND_HOLDER_RELATION = "shape-bind-holder";
+export declare const BIND_PERMISSION_RELATION = "shape-bind-permission";
+export declare const BIND_KEY_RELATION = "shape-bind-key";
+/**
+ * `(shape:<type>, shape-bound, bound)`: this scope has declared a binding for `<type>` (#1686).
+ * Written by the first reconcile that records the binding (and by every claim, to the same effect)
+ * and STICKY — no reconcile removes it, whatever later
+ * versions declare — so an erasure keeps releasing that type's holders after a version drops the
+ * shape, drops its `bind` or moves its holder column. A spine tuple like the others here, so
+ * module code can never write one (`ctx.sql` refuses every `_substrat_*` write).
+ */
+export declare const BOUND_EVER_RELATION = "shape-bound";
 //# sourceMappingURL=entity-grant-shape.d.ts.map

package/dist/entity-grant-shape.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"entity-grant-shape.d.ts","sourceRoot":"","sources":["../src/entity-grant-shape.ts"],"names":[],"mappings":"AAAA,OAAO,EAUL,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACd,KAAK,WAAW,EACjB,MAAM,yBAAyB,CAAC;AAMjC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAEpD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,gIAAsJ,CAAC;AAE1L,gGAAgG;AAChG,eAAO,MAAM,kBAAkB,MAAM,CAAC;AACtC;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAC7C;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,IAAI,CAAC;AAC3C,2GAA2G;AAC3G,eAAO,MAAM,sBAAsB,OAAO,CAAC;AAE3C,iGAAiG;AACjG,wBAAgB,eAAe,CAAC,KAAK,GAAE,MAA2B,GAAG,MAAM,CAS1E;AAuBD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CASjI;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,UAAU,GAAG,QAAQ,GAAG,OAAO,CAAC;IACtC,2EAA2E;IAC3E,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACnD;;;OAGG;IACH,OAAO,CAAC,EAAE;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7C;AAED,2FAA2F;AAC3F,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,SAAS,gBAAgB,EAAE,CAAC;IACpC,8EAA8E;IAC9E,GAAG,EAAE,MAAM,CAAC;IACZ,kFAAkF;IAClF,KAAK,EAAE,MAAM,CAAC;IACd,4FAA4F;IAC5F,KAAK,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAC3B,sEAAsE;IACtE,WAAW,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,MAAM,CAAC;IACpC,sEAAsE;IACtE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CACpC,EAAE,EAAE,SAAS,EACb,IAAI,EAAE,SAAS,GACd;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,mBAAmB,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,WAAW,GAAG,IAAI,CAAA;CAAE,CA8D9F"}
+{"version":3,"file":"entity-grant-shape.d.ts","sourceRoot":"","sources":["../src/entity-grant-shape.ts"],"names":[],"mappings":"AAAA,OAAO,EAWL,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACd,KAAK,WAAW,EACjB,MAAM,yBAAyB,CAAC;AAMjC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAMpD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,gIAAsJ,CAAC;AAE1L,gGAAgG;AAChG,eAAO,MAAM,kBAAkB,MAAM,CAAC;AACtC;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAC7C;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,IAAI,CAAC;AAC3C,2GAA2G;AAC3G,eAAO,MAAM,sBAAsB,OAAO,CAAC;AAE3C,iGAAiG;AACjG,wBAAgB,eAAe,CAAC,KAAK,GAAE,MAA2B,GAAG,MAAM,CAS1E;AAuBD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CASjI;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,UAAU,GAAG,QAAQ,GAAG,OAAO,CAAC;IACtC,2EAA2E;IAC3E,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACnD;;;;;;;OAOG;IACH,GAAG,CAAC,EAAE,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,IAAI,CAAC;IAC1C;;;OAGG;IACH,OAAO,CAAC,EAAE;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7C;AAED,2FAA2F;AAC3F,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,SAAS,gBAAgB,EAAE,CAAC;IACpC,8EAA8E;IAC9E,GAAG,EAAE,MAAM,CAAC;IACZ,kFAAkF;IAClF,KAAK,EAAE,MAAM,CAAC;IACd,4FAA4F;IAC5F,KAAK,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAC3B,sEAAsE;IACtE,WAAW,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,MAAM,CAAC;IACpC,sEAAsE;IACtE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CACpC,EAAE,EAAE,SAAS,EACb,IAAI,EAAE,SAAS,GACd;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,mBAAmB,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,WAAW,GAAG,IAAI,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CA+DpH;AAmaD;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,sBAAsB,CAAC;AACxD,eAAO,MAAM,wBAAwB,0BAA0B,CAAC;AAChE,eAAO,MAAM,iBAAiB,mBAAmB,CAAC;AAClD;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,gBAAgB,CAAC"}