@substrat-run/kernel 0.146.0 → 0.148.0

package/dist/upload-link.d.ts

@@ -0,0 +1,89 @@
+import { type AttachmentRecord, type CheckSubject, type Decision, type DomainEventInput, type EntityRef, type Instant, type MintedUploadLink, type PermissionKey, type PrincipalId, type UploadLinkMintInput, type UploadLinkPolicy, type UploadLinkRecord, type UploadLinkView } from '@substrat-run/contracts';
+import type { ScopedSql } from './scope-host.js';
+export declare const UPLOAD_LINK_DDL = "\n  CREATE TABLE IF NOT EXISTS _substrat_upload_links (\n    id TEXT PRIMARY KEY,\n    -- SHA-256 hex of the secret. The secret itself is stored NOWHERE.\n    token_hash TEXT NOT NULL UNIQUE,\n    entity_type TEXT NOT NULL,\n    entity_id TEXT NOT NULL,\n    -- NULL = the uploader names the file.\n    filename TEXT,\n    max_bytes INTEGER NOT NULL,\n    -- JSON array of media types / families, or NULL = any type.\n    content_types TEXT,\n    visibility TEXT NOT NULL,\n    -- The principal the attachment is written AS: its author, and whose `writePermission`\n    -- is checked again at redemption.\n    minted_by TEXT NOT NULL,\n    minted_at TEXT NOT NULL,\n    expires_at TEXT NOT NULL,\n    redeemed_at TEXT,\n    -- The attachment this link produced.\n    attachment_id TEXT,\n    -- Tombstone, never a delete: a link that was minted is evidence of why a file arrived.\n    revoked_at TEXT,\n    revoked_by TEXT\n  );\n  CREATE INDEX IF NOT EXISTS _substrat_upload_links_entity\n    ON _substrat_upload_links (entity_type, entity_id);\n";
+/** The tables `UPLOAD_LINK_DDL` builds — what a copy of a scope leaves behind. */
+export declare const UPLOAD_LINK_TABLE_NAMES: readonly ['_substrat_upload_links'];
+/** `reason` slugs a redemption refuses with, so the HTTP route can answer 410/413/415 and a client can act. */
+export declare const UPLOAD_LINK_GONE = "upload_link_gone";
+export declare const UPLOAD_LINK_TOO_LARGE = "upload_link_too_large";
+export declare const UPLOAD_LINK_TYPE_REFUSED = "upload_link_type_refused";
+export declare const UPLOAD_LINK_WRONG_TARGET = "upload_link_wrong_target";
+/** A fresh link secret: 256 bits, base64url, prefixed. Only its hash is ever stored. */
+export declare function mintUploadLinkSecret(): string;
+/** Is `type` (already stripped of parameters, lowercase) admitted by `allowed`? `null` admits anything. */
+export declare function uploadContentTypeAllowed(allowed: readonly string[] | null, type: string): boolean;
+/** What an operation handler sees as `ctx.attachments`. */
+export interface AttachmentVerbs {
+    /**
+     * Mint a single-use URL that lets its holder upload ONE file to `entity` — and return the
+     * secret and the path that carries it, once.
+     *
+     * The target must declare `uploadLinks` in its `attachmentTargets` entry, and the caller
+     * must hold the target's `writePermission` on the entity (the check an upload makes);
+     * it is made again, as the same principal, when the link is redeemed. Only a principal may
+     * mint. The operation's own guards — an entity lock, a state check — run in the operation,
+     * before this; they are not re-run at redemption, so keep `ttlSeconds` short.
+     *
+     * ```ts
+     * assertAllowed(await ctx.check('contract:write', ref));
+     * const link = await ctx.attachments.mintUploadUrl({ entity: ref, filename: 'signed.pdf' });
+     * return { url: `${origin}${link.path}`, expiresAt: link.expiresAt };
+     * ```
+     *
+     * The same tripwire `ctx.capabilities.mint` has applies: while this invocation runs,
+     * `ctx.emit` and `ctx.sql` refuse a record carrying the secret verbatim. Transactional with
+     * the operation: a mint whose operation throws never happened.
+     */
+    mintUploadUrl(input: UploadLinkMintInput): Promise<MintedUploadLink>;
+    /** Revoke a link that has not been redeemed. Allowed to anyone who could have minted it. Idempotent. */
+    revokeUploadLink(id: string): Promise<void>;
+    /** This scope's upload links, newest first — never the secret. What a follow-up operation reads to find the attachment a link produced. */
+    uploadLinks(filter?: {
+        entity?: EntityRef;
+        limit?: number;
+    }): UploadLinkRecord[];
+}
+/** What the verbs need of the target's declaration: its write key and its link policy. */
+export interface UploadTarget {
+    write: PermissionKey;
+    uploadLinks?: UploadLinkPolicy;
+}
+export interface AttachmentVerbDeps {
+    /** RAW spine access inside the operation's own transaction. */
+    sql: ScopedSql;
+    subject: CheckSubject;
+    now: Instant;
+    /** The operation's OWN check. */
+    check: (permission: PermissionKey, entity?: EntityRef) => Promise<Decision>;
+    emit: (event: DomainEventInput) => void;
+    assertWrites: (verb: string) => void;
+    /** This invocation's minted secrets — appended to by `mint`, read by the secret guards. */
+    minted: string[];
+    /** The declared attachment target for an entity type, if any module declares one. */
+    targetOf: (entityType: string) => UploadTarget | undefined;
+}
+export declare function createAttachmentVerbs(deps: AttachmentVerbDeps): AttachmentVerbs;
+/** What the route needs before it reads a byte, and who the write is made as. */
+export interface UploadLinkInspection {
+    view: UploadLinkView;
+    mintedBy: PrincipalId;
+}
+/**
+ * Look a secret up without spending it: `not_found` for one that names nothing, `conflict`
+ * with reason `upload_link_gone` for one that is used, expired or revoked.
+ */
+export declare function inspectUploadLink(deps: {
+    sql: ScopedSql;
+    now: Instant;
+}, secret: unknown): Promise<UploadLinkInspection>;
+/**
+ * Spend the link for `record`, INSIDE the transaction that inserts the attachment row — so a
+ * refusal anywhere rolls the spend back. Judges the record against the link, never the other
+ * way round: the target, the author, the size and the type are all the link's to refuse.
+ */
+export declare function redeemUploadLinkInTransaction(deps: {
+    sql: ScopedSql;
+    now: Instant;
+    emit: (event: DomainEventInput) => void;
+}, secret: unknown, record: AttachmentRecord): Promise<void>;
+//# sourceMappingURL=upload-link.d.ts.map

package/dist/upload-link.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upload-link.d.ts","sourceRoot":"","sources":["../src/upload-link.ts"],"names":[],"mappings":"AAAA,OAAO,EAWL,KAAK,gBAAgB,EAIrB,KAAK,YAAY,EACjB,KAAK,QAAQ,EACb,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACd,KAAK,OAAO,EACZ,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EAEpB,MAAM,yBAAyB,CAAC;AAIjC,OAAO,KAAK,EAAE,SAAS,EAAY,MAAM,iBAAiB,CAAC;AAmC3D,eAAO,MAAM,eAAe,4hCA2B3B,CAAC;AAEF,kFAAkF;AAClF,eAAO,MAAM,uBAAuB,YAAI,wBAAwB,CAAU,CAAC;AAE3E,+GAA+G;AAC/G,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AACnD,eAAO,MAAM,qBAAqB,0BAA0B,CAAC;AAC7D,eAAO,MAAM,wBAAwB,6BAA6B,CAAC;AACnE,eAAO,MAAM,wBAAwB,6BAA6B,CAAC;AAuBnE,wFAAwF;AACxF,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAMD,2GAA2G;AAC3G,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAIjG;AA0BD,2DAA2D;AAC3D,MAAM,WAAW,eAAe;IAC9B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,aAAa,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACrE,wGAAwG;IACxG,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,2IAA2I;IAC3I,WAAW,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,SAAS,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,gBAAgB,EAAE,CAAC;CAClF;AAED,0FAA0F;AAC1F,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,aAAa,CAAC;IACrB,WAAW,CAAC,EAAE,gBAAgB,CAAC;CAChC;AAED,MAAM,WAAW,kBAAkB;IACjC,+DAA+D;IAC/D,GAAG,EAAE,SAAS,CAAC;IACf,OAAO,EAAE,YAAY,CAAC;IACtB,GAAG,EAAE,OAAO,CAAC;IACb,iCAAiC;IACjC,KAAK,EAAE,CAAC,UAAU,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,SAAS,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5E,IAAI,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,CAAC;IACxC,YAAY,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACrC,2FAA2F;IAC3F,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,qFAAqF;IACrF,QAAQ,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,YAAY,GAAG,SAAS,CAAC;CAC5D;AAgBD,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,kBAAkB,GAAG,eAAe,CAkI/E;AAuBD,iFAAiF;AACjF,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,cAAc,CAAC;IACrB,QAAQ,EAAE,WAAW,CAAC;CACvB;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE;IAAE,GAAG,EAAE,SAAS,CAAC;IAAC,GAAG,EAAE,OAAO,CAAA;CAAE,EACtC,MAAM,EAAE,OAAO,GACd,OAAO,CAAC,oBAAoB,CAAC,CAa/B;AAED;;;;GAIG;AACH,wBAAsB,6BAA6B,CACjD,IAAI,EAAE;IACJ,GAAG,EAAE,SAAS,CAAC;IACf,GAAG,EAAE,OAAO,CAAC;IACb,IAAI,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,CAAC;CACzC,EACD,MAAM,EAAE,OAAO,EACf,MAAM,EAAE,gBAAgB,GACvB,OAAO,CAAC,IAAI,CAAC,CA8Cf"}

package/dist/upload-link.js

@@ -0,0 +1,277 @@
+import { ATTACHMENT_UPLOAD_LINK_MINTED, ATTACHMENT_UPLOAD_LINK_REDEEMED, ATTACHMENT_UPLOAD_LINK_REVOKED, UPLOAD_LINK_DEFAULT_TTL_SECONDS, UPLOAD_LINK_MAX_BYTES_CEILING, UPLOAD_LINK_SECRET_PREFIX, principalId as principalIdSchema, substratError, uploadLinkMintInput, uploadLinkPath, } from '@substrat-run/contracts';
+import { toBase64url } from './base64url.js';
+import { capabilityTokenHash } from './capability.js';
+import { assertAllowed } from './permission-checker.js';
+import { ulid } from './ulid.js';
+export const UPLOAD_LINK_DDL = `
+  CREATE TABLE IF NOT EXISTS _substrat_upload_links (
+    id TEXT PRIMARY KEY,
+    -- SHA-256 hex of the secret. The secret itself is stored NOWHERE.
+    token_hash TEXT NOT NULL UNIQUE,
+    entity_type TEXT NOT NULL,
+    entity_id TEXT NOT NULL,
+    -- NULL = the uploader names the file.
+    filename TEXT,
+    max_bytes INTEGER NOT NULL,
+    -- JSON array of media types / families, or NULL = any type.
+    content_types TEXT,
+    visibility TEXT NOT NULL,
+    -- The principal the attachment is written AS: its author, and whose \`writePermission\`
+    -- is checked again at redemption.
+    minted_by TEXT NOT NULL,
+    minted_at TEXT NOT NULL,
+    expires_at TEXT NOT NULL,
+    redeemed_at TEXT,
+    -- The attachment this link produced.
+    attachment_id TEXT,
+    -- Tombstone, never a delete: a link that was minted is evidence of why a file arrived.
+    revoked_at TEXT,
+    revoked_by TEXT
+  );
+  CREATE INDEX IF NOT EXISTS _substrat_upload_links_entity
+    ON _substrat_upload_links (entity_type, entity_id);
+`;
+/** The tables `UPLOAD_LINK_DDL` builds — what a copy of a scope leaves behind. */
+export const UPLOAD_LINK_TABLE_NAMES = ['_substrat_upload_links'];
+/** `reason` slugs a redemption refuses with, so the HTTP route can answer 410/413/415 and a client can act. */
+export const UPLOAD_LINK_GONE = 'upload_link_gone';
+export const UPLOAD_LINK_TOO_LARGE = 'upload_link_too_large';
+export const UPLOAD_LINK_TYPE_REFUSED = 'upload_link_type_refused';
+export const UPLOAD_LINK_WRONG_TARGET = 'upload_link_wrong_target';
+const COLUMNS = 'id, entity_type, entity_id, filename, max_bytes, content_types, visibility, minted_by, minted_at, ' +
+    'expires_at, redeemed_at, attachment_id, revoked_at, revoked_by';
+/** A fresh link secret: 256 bits, base64url, prefixed. Only its hash is ever stored. */
+export function mintUploadLinkSecret() {
+    return UPLOAD_LINK_SECRET_PREFIX + toBase64url(crypto.getRandomValues(new Uint8Array(32)));
+}
+/** A secret that cannot be one of ours is refused before it is hashed. */
+const plausibleSecret = (secret) => typeof secret === 'string' && secret.startsWith(UPLOAD_LINK_SECRET_PREFIX) && secret.length <= 128;
+/** Is `type` (already stripped of parameters, lowercase) admitted by `allowed`? `null` admits anything. */
+export function uploadContentTypeAllowed(allowed, type) {
+    if (allowed === null)
+        return true;
+    const t = type.toLowerCase();
+    return allowed.some((a) => (a.endsWith('/*') ? t.startsWith(a.slice(0, -1)) : a === t));
+}
+const stateOf = (row, now) => row.revoked_at !== null ? 'revoked' : row.redeemed_at !== null ? 'redeemed' : row.expires_at <= now ? 'expired' : 'pending';
+function recordOf(row, now) {
+    return {
+        id: row.id,
+        entity: { entityType: row.entity_type, entityId: row.entity_id },
+        filename: row.filename,
+        maxBytes: row.max_bytes,
+        contentTypes: row.content_types === null ? null : JSON.parse(row.content_types),
+        visibility: row.visibility,
+        mintedBy: principalIdSchema.parse(row.minted_by),
+        mintedAt: row.minted_at,
+        expiresAt: row.expires_at,
+        state: stateOf(row, now),
+        redeemedAt: row.redeemed_at,
+        attachmentId: row.attachment_id,
+    };
+}
+const MS_PER_SECOND = 1000;
+function principalOf(subject, verb) {
+    if (subject.kind !== 'principal') {
+        throw substratError('forbidden', `${verb}: only a principal may mint or revoke an upload link — a ${subject.kind} actor has no ` +
+            'authorship to lend an attachment', { reason: 'upload_link_delegation' });
+    }
+    return subject.id;
+}
+export function createAttachmentVerbs(deps) {
+    const readRow = (id) => deps.sql.query(`SELECT ${COLUMNS} FROM _substrat_upload_links WHERE id = ?`, [id])[0];
+    return {
+        async mintUploadUrl(raw) {
+            deps.assertWrites('ctx.attachments.mintUploadUrl');
+            const minter = principalOf(deps.subject, 'ctx.attachments.mintUploadUrl');
+            const input = uploadLinkMintInput.parse(raw);
+            const target = deps.targetOf(input.entity.entityType);
+            if (!target) {
+                throw substratError('validation_failed', `ctx.attachments.mintUploadUrl: '${input.entity.entityType}' is not a declared attachment target`);
+            }
+            const policy = target.uploadLinks;
+            if (!policy) {
+                throw substratError('forbidden', `ctx.attachments.mintUploadUrl: '${input.entity.entityType}' does not declare uploadLinks in its attachmentTargets entry`, { reason: 'upload_links_not_declared' });
+            }
+            const maxBytes = input.maxBytes ?? policy.maxBytes;
+            if (maxBytes > policy.maxBytes || maxBytes > UPLOAD_LINK_MAX_BYTES_CEILING) {
+                throw substratError('validation_failed', `ctx.attachments.mintUploadUrl: maxBytes ${maxBytes} is above the target's ${policy.maxBytes} — a link narrows its target's policy, never widens it`);
+            }
+            // Delegation, never elevation: the key an upload checks, on the entity, as the caller.
+            assertAllowed(await deps.check(target.write, input.entity));
+            const id = ulid();
+            const secret = mintUploadLinkSecret();
+            const expiresAt = new Date(Date.parse(deps.now) + (input.ttlSeconds ?? UPLOAD_LINK_DEFAULT_TTL_SECONDS) * MS_PER_SECOND).toISOString();
+            const visibility = input.visibility ?? 'internal';
+            const contentTypes = policy.contentTypes ?? null;
+            deps.sql.exec(`INSERT INTO _substrat_upload_links
+           (id, token_hash, entity_type, entity_id, filename, max_bytes, content_types, visibility,
+            minted_by, minted_at, expires_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
+                id,
+                await capabilityTokenHash(secret),
+                input.entity.entityType,
+                input.entity.entityId,
+                input.filename ?? null,
+                maxBytes,
+                contentTypes === null ? null : JSON.stringify(contentTypes),
+                visibility,
+                minter,
+                deps.now,
+                expiresAt,
+            ]);
+            deps.minted.push(secret);
+            const payload = {
+                linkId: id,
+                entity: input.entity,
+                filename: input.filename ?? null,
+                maxBytes,
+                contentTypes,
+                visibility,
+                expiresAt,
+                mintedBy: minter,
+            };
+            deps.emit({
+                type: ATTACHMENT_UPLOAD_LINK_MINTED,
+                schemaVersion: 1,
+                entity: input.entity,
+                piiClass: 'none',
+                payload,
+            });
+            return {
+                id,
+                secret,
+                path: uploadLinkPath(input.entity, secret),
+                expiresAt,
+                maxBytes,
+                filename: input.filename ?? null,
+            };
+        },
+        async revokeUploadLink(id) {
+            deps.assertWrites('ctx.attachments.revokeUploadLink');
+            const revoker = principalOf(deps.subject, 'ctx.attachments.revokeUploadLink');
+            const row = readRow(id);
+            if (!row)
+                throw substratError('not_found', `no upload link ${id} in this scope`);
+            const entity = { entityType: row.entity_type, entityId: row.entity_id };
+            const target = deps.targetOf(row.entity_type);
+            if (target)
+                assertAllowed(await deps.check(target.write, entity));
+            // A spent or already-revoked link has nothing left to take back.
+            if (row.revoked_at !== null || row.redeemed_at !== null)
+                return;
+            deps.sql.exec(`UPDATE _substrat_upload_links SET revoked_at = ?, revoked_by = ? WHERE id = ?`, [
+                deps.now,
+                revoker,
+                id,
+            ]);
+            const payload = { linkId: id, entity, revokedBy: revoker };
+            deps.emit({
+                type: ATTACHMENT_UPLOAD_LINK_REVOKED,
+                schemaVersion: 1,
+                entity,
+                piiClass: 'none',
+                payload,
+            });
+        },
+        uploadLinks(filter) {
+            const params = [];
+            let where = '';
+            if (filter?.entity) {
+                where = 'WHERE entity_type = ? AND entity_id = ?';
+                params.push(filter.entity.entityType, filter.entity.entityId);
+            }
+            const limit = Math.min(Math.max(Math.trunc(filter?.limit ?? 50), 1), 200);
+            params.push(limit);
+            return deps.sql
+                .query(`SELECT ${COLUMNS} FROM _substrat_upload_links ${where} ORDER BY id DESC LIMIT ?`, params)
+                .map((r) => recordOf(r, deps.now));
+        },
+    };
+}
+// ---------------------------------------------------------------------------
+// Redemption — the host's half. A secret in, an attachment out.
+// ---------------------------------------------------------------------------
+/** One answer for every secret that is not ours or names nothing, so a probe learns nothing it can act on. */
+const unknownLink = () => substratError('not_found', 'This upload link is not valid.');
+/** The 410: it was ours, and it is spent, expired or revoked. Said only to a holder of the secret. */
+const goneLink = () => substratError('conflict', 'This upload link has been used, has expired or was revoked.', { reason: UPLOAD_LINK_GONE });
+async function liveRow(sql, now, secret) {
+    if (!plausibleSecret(secret))
+        throw unknownLink();
+    const row = sql.query(`SELECT ${COLUMNS} FROM _substrat_upload_links WHERE token_hash = ?`, [await capabilityTokenHash(secret)])[0];
+    if (!row)
+        throw unknownLink();
+    if (stateOf(row, now) !== 'pending')
+        throw goneLink();
+    return row;
+}
+/**
+ * Look a secret up without spending it: `not_found` for one that names nothing, `conflict`
+ * with reason `upload_link_gone` for one that is used, expired or revoked.
+ */
+export async function inspectUploadLink(deps, secret) {
+    const row = await liveRow(deps.sql, deps.now, secret);
+    const r = recordOf(row, deps.now);
+    return {
+        view: {
+            entity: r.entity,
+            filename: r.filename,
+            maxBytes: r.maxBytes,
+            contentTypes: r.contentTypes,
+            visibility: r.visibility,
+        },
+        mintedBy: r.mintedBy,
+    };
+}
+/**
+ * Spend the link for `record`, INSIDE the transaction that inserts the attachment row — so a
+ * refusal anywhere rolls the spend back. Judges the record against the link, never the other
+ * way round: the target, the author, the size and the type are all the link's to refuse.
+ */
+export async function redeemUploadLinkInTransaction(deps, secret, record) {
+    const row = await liveRow(deps.sql, deps.now, secret);
+    if (row.entity_type !== record.entity.entityType || row.entity_id !== record.entity.entityId) {
+        // The path named another entity than the link was minted for: nothing is spent.
+        throw substratError('not_found', 'This upload link is not valid for that target.', {
+            reason: UPLOAD_LINK_WRONG_TARGET,
+        });
+    }
+    if (record.createdBy !== row.minted_by) {
+        throw substratError('internal', 'an upload link was redeemed as someone other than its minter');
+    }
+    if (record.size > row.max_bytes) {
+        throw substratError('validation_failed', `The file is ${record.size} bytes; this link admits at most ${row.max_bytes}.`, {
+            reason: UPLOAD_LINK_TOO_LARGE,
+        });
+    }
+    const allowed = row.content_types === null ? null : JSON.parse(row.content_types);
+    if (!uploadContentTypeAllowed(allowed, record.contentType)) {
+        throw substratError('validation_failed', `A file of type ${record.contentType} is not admitted by this link.`, {
+            reason: UPLOAD_LINK_TYPE_REFUSED,
+        });
+    }
+    if (row.filename !== null && record.filename !== row.filename) {
+        throw substratError('internal', 'an upload link with a fixed file name was redeemed under another');
+    }
+    const spent = deps.sql.exec(`UPDATE _substrat_upload_links SET redeemed_at = ?, attachment_id = ?
+     WHERE id = ? AND redeemed_at IS NULL AND revoked_at IS NULL`, [deps.now, record.id, row.id]);
+    if (spent.changes !== 1)
+        throw goneLink();
+    const payload = {
+        linkId: row.id,
+        entity: record.entity,
+        attachmentId: record.id,
+        size: record.size,
+        sha256: record.sha256,
+        mintedBy: principalIdSchema.parse(row.minted_by),
+    };
+    deps.emit({
+        type: ATTACHMENT_UPLOAD_LINK_REDEEMED,
+        schemaVersion: 1,
+        entity: record.entity,
+        piiClass: 'none',
+        payload,
+    });
+}
+//# sourceMappingURL=upload-link.js.map

package/dist/upload-link.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upload-link.js","sourceRoot":"","sources":["../src/upload-link.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,6BAA6B,EAC7B,+BAA+B,EAC/B,8BAA8B,EAC9B,+BAA+B,EAC/B,6BAA6B,EAC7B,yBAAyB,EACzB,WAAW,IAAI,iBAAiB,EAChC,aAAa,EACb,mBAAmB,EACnB,cAAc,GAkBf,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAExD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAkCjC,MAAM,CAAC,MAAM,eAAe,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2B9B,CAAC;AAEF,kFAAkF;AAClF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,wBAAwB,CAAU,CAAC;AAE3E,+GAA+G;AAC/G,MAAM,CAAC,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AACnD,MAAM,CAAC,MAAM,qBAAqB,GAAG,uBAAuB,CAAC;AAC7D,MAAM,CAAC,MAAM,wBAAwB,GAAG,0BAA0B,CAAC;AACnE,MAAM,CAAC,MAAM,wBAAwB,GAAG,0BAA0B,CAAC;AAmBnE,MAAM,OAAO,GACX,oGAAoG;IACpG,gEAAgE,CAAC;AAEnE,wFAAwF;AACxF,MAAM,UAAU,oBAAoB;IAClC,OAAO,yBAAyB,GAAG,WAAW,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAC7F,CAAC;AAED,0EAA0E;AAC1E,MAAM,eAAe,GAAG,CAAC,MAAe,EAAoB,EAAE,CAC5D,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,yBAAyB,CAAC,IAAI,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC;AAErG,2GAA2G;AAC3G,MAAM,UAAU,wBAAwB,CAAC,OAAiC,EAAE,IAAY;IACtF,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAC7B,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC1F,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,GAAkB,EAAE,GAAY,EAA6B,EAAE,CAC9E,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AAE9H,SAAS,QAAQ,CAAC,GAAkB,EAAE,GAAY;IAChD,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,MAAM,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,WAAW,EAAE,QAAQ,EAAE,GAAG,CAAC,SAAS,EAAE;QAChE,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,QAAQ,EAAE,GAAG,CAAC,SAAS;QACvB,YAAY,EAAE,GAAG,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAc;QAC7F,UAAU,EAAE,GAAG,CAAC,UAAwB;QACxC,QAAQ,EAAE,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;QAChD,QAAQ,EAAE,GAAG,CAAC,SAAoB;QAClC,SAAS,EAAE,GAAG,CAAC,UAAqB;QACpC,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC;QACxB,UAAU,EAAE,GAAG,CAAC,WAA6B;QAC7C,YAAY,EAAE,GAAG,CAAC,aAAa;KAChC,CAAC;AACJ,CAAC;AAwDD,MAAM,aAAa,GAAG,IAAI,CAAC;AAE3B,SAAS,WAAW,CAAC,OAAqB,EAAE,IAAY;IACtD,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QACjC,MAAM,aAAa,CACjB,WAAW,EACX,GAAG,IAAI,4DAA4D,OAAO,CAAC,IAAI,gBAAgB;YAC7F,kCAAkC,EACpC,EAAE,MAAM,EAAE,wBAAwB,EAAE,CACrC,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC,EAAE,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAwB;IAC5D,MAAM,OAAO,GAAG,CAAC,EAAU,EAA6B,EAAE,CACxD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAgB,UAAU,OAAO,2CAA2C,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEvG,OAAO;QACL,KAAK,CAAC,aAAa,CAAC,GAAG;YACrB,IAAI,CAAC,YAAY,CAAC,+BAA+B,CAAC,CAAC;YACnD,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,+BAA+B,CAAC,CAAC;YAC1E,MAAM,KAAK,GAAG,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YACtD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,aAAa,CACjB,mBAAmB,EACnB,mCAAmC,KAAK,CAAC,MAAM,CAAC,UAAU,uCAAuC,CAClG,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC;YAClC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,aAAa,CACjB,WAAW,EACX,mCAAmC,KAAK,CAAC,MAAM,CAAC,UAAU,+DAA+D,EACzH,EAAE,MAAM,EAAE,2BAA2B,EAAE,CACxC,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC;YACnD,IAAI,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,QAAQ,GAAG,6BAA6B,EAAE,CAAC;gBAC3E,MAAM,aAAa,CACjB,mBAAmB,EACnB,2CAA2C,QAAQ,0BAA0B,MAAM,CAAC,QAAQ,wDAAwD,CACrJ,CAAC;YACJ,CAAC;YACD,uFAAuF;YACvF,aAAa,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAE5D,MAAM,EAAE,GAAG,IAAI,EAAE,CAAC;YAClB,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAC;YACtC,MAAM,SAAS,GAAG,IAAI,IAAI,CACxB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,+BAA+B,CAAC,GAAG,aAAa,CAC7F,CAAC,WAAW,EAAa,CAAC;YAC3B,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,UAAU,CAAC;YAClD,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,IAAI,CAAC;YACjD,IAAI,CAAC,GAAG,CAAC,IAAI,CACX;;;kDAG0C,EAC1C;gBACE,EAAE;gBACF,MAAM,mBAAmB,CAAC,MAAM,CAAC;gBACjC,KAAK,CAAC,MAAM,CAAC,UAAU;gBACvB,KAAK,CAAC,MAAM,CAAC,QAAQ;gBACrB,KAAK,CAAC,QAAQ,IAAI,IAAI;gBACtB,QAAQ;gBACR,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC;gBAC3D,UAAU;gBACV,MAAM;gBACN,IAAI,CAAC,GAAG;gBACR,SAAS;aACV,CACF,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACzB,MAAM,OAAO,GAAsC;gBACjD,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;gBAChC,QAAQ;gBACR,YAAY;gBACZ,UAAU;gBACV,SAAS;gBACT,QAAQ,EAAE,MAAM;aACjB,CAAC;YACF,IAAI,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE,6BAA6B;gBACnC,aAAa,EAAE,CAAC;gBAChB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,QAAQ,EAAE,MAAM;gBAChB,OAAO;aACR,CAAC,CAAC;YACH,OAAO;gBACL,EAAE;gBACF,MAAM;gBACN,IAAI,EAAE,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC;gBAC1C,SAAS;gBACT,QAAQ;gBACR,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;aACjC,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,gBAAgB,CAAC,EAAE;YACvB,IAAI,CAAC,YAAY,CAAC,kCAAkC,CAAC,CAAC;YACtD,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,kCAAkC,CAAC,CAAC;YAC9E,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;YACxB,IAAI,CAAC,GAAG;gBAAE,MAAM,aAAa,CAAC,WAAW,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,CAAC;YACjF,MAAM,MAAM,GAAG,EAAE,UAAU,EAAE,GAAG,CAAC,WAAW,EAAE,QAAQ,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;YACxE,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC9C,IAAI,MAAM;gBAAE,aAAa,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;YAClE,iEAAiE;YACjE,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI,IAAI,GAAG,CAAC,WAAW,KAAK,IAAI;gBAAE,OAAO;YAChE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,+EAA+E,EAAE;gBAC7F,IAAI,CAAC,GAAG;gBACR,OAAO;gBACP,EAAE;aACH,CAAC,CAAC;YACH,MAAM,OAAO,GAAuC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;YAC/F,IAAI,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE,8BAA8B;gBACpC,aAAa,EAAE,CAAC;gBAChB,MAAM;gBACN,QAAQ,EAAE,MAAM;gBAChB,OAAO;aACR,CAAC,CAAC;QACL,CAAC;QAED,WAAW,CAAC,MAAM;YAChB,MAAM,MAAM,GAAe,EAAE,CAAC;YAC9B,IAAI,KAAK,GAAG,EAAE,CAAC;YACf,IAAI,MAAM,EAAE,MAAM,EAAE,CAAC;gBACnB,KAAK,GAAG,yCAAyC,CAAC;gBAClD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAChE,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAC1E,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnB,OAAO,IAAI,CAAC,GAAG;iBACZ,KAAK,CACJ,UAAU,OAAO,gCAAgC,KAAK,2BAA2B,EACjF,MAAM,CACP;iBACA,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACvC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,gEAAgE;AAChE,8EAA8E;AAE9E,8GAA8G;AAC9G,MAAM,WAAW,GAAG,GAAG,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,gCAAgC,CAAC,CAAC;AACvF,sGAAsG;AACtG,MAAM,QAAQ,GAAG,GAAG,EAAE,CACpB,aAAa,CAAC,UAAU,EAAE,6DAA6D,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;AAEzH,KAAK,UAAU,OAAO,CAAC,GAAc,EAAE,GAAY,EAAE,MAAe;IAClE,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC;QAAE,MAAM,WAAW,EAAE,CAAC;IAClD,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CACnB,UAAU,OAAO,mDAAmD,EACpE,CAAC,MAAM,mBAAmB,CAAC,MAAM,CAAC,CAAC,CACpC,CAAC,CAAC,CAAC,CAAC;IACL,IAAI,CAAC,GAAG;QAAE,MAAM,WAAW,EAAE,CAAC;IAC9B,IAAI,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,SAAS;QAAE,MAAM,QAAQ,EAAE,CAAC;IACtD,OAAO,GAAG,CAAC;AACb,CAAC;AAQD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAsC,EACtC,MAAe;IAEf,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACtD,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO;QACL,IAAI,EAAE;YACJ,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,YAAY,EAAE,CAAC,CAAC,YAAY;YAC5B,UAAU,EAAE,CAAC,CAAC,UAAU;SACzB;QACD,QAAQ,EAAE,CAAC,CAAC,QAAQ;KACrB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,IAIC,EACD,MAAe,EACf,MAAwB;IAExB,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACtD,IAAI,GAAG,CAAC,WAAW,KAAK,MAAM,CAAC,MAAM,CAAC,UAAU,IAAI,GAAG,CAAC,SAAS,KAAK,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC7F,gFAAgF;QAChF,MAAM,aAAa,CAAC,WAAW,EAAE,gDAAgD,EAAE;YACjF,MAAM,EAAE,wBAAwB;SACjC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,KAAK,GAAG,CAAC,SAAS,EAAE,CAAC;QACvC,MAAM,aAAa,CAAC,UAAU,EAAE,8DAA8D,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,GAAG,GAAG,CAAC,SAAS,EAAE,CAAC;QAChC,MAAM,aAAa,CAAC,mBAAmB,EAAE,eAAe,MAAM,CAAC,IAAI,oCAAoC,GAAG,CAAC,SAAS,GAAG,EAAE;YACvH,MAAM,EAAE,qBAAqB;SAC9B,CAAC,CAAC;IACL,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAc,CAAC;IAChG,IAAI,CAAC,wBAAwB,CAAC,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3D,MAAM,aAAa,CAAC,mBAAmB,EAAE,kBAAkB,MAAM,CAAC,WAAW,gCAAgC,EAAE;YAC7G,MAAM,EAAE,wBAAwB;SACjC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC9D,MAAM,aAAa,CAAC,UAAU,EAAE,kEAAkE,CAAC,CAAC;IACtG,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CACzB;iEAC6D,EAC7D,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAC9B,CAAC;IACF,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC;QAAE,MAAM,QAAQ,EAAE,CAAC;IAC1C,MAAM,OAAO,GAAwC;QACnD,MAAM,EAAE,GAAG,CAAC,EAAE;QACd,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,YAAY,EAAE,MAAM,CAAC,EAAE;QACvB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;KACjD,CAAC;IACF,IAAI,CAAC,IAAI,CAAC;QACR,IAAI,EAAE,+BAA+B;QACrC,aAAa,EAAE,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,MAAM;QAChB,OAAO;KACR,CAAC,CAAC;AACL,CAAC"}

package/dist/vertical-scope-stores.d.ts

@@ -0,0 +1,43 @@
+import type { SwitchSql } from './system-switch.js';
+/** Interpolated into both adapters' directory DDL, so `lint:spine-ddl` sees one spelling on each side. */
+export declare const VERTICAL_SCOPE_STORES_DDL = "\n  CREATE TABLE IF NOT EXISTS vertical_scope_stores (\n    vertical_slug    TEXT NOT NULL,\n    binding          TEXT NOT NULL,\n    kind             TEXT NOT NULL,\n    -- The version that declared the binding first.\n    first_version_id TEXT NOT NULL,\n    PRIMARY KEY (vertical_slug, binding)\n  );\n  CREATE TABLE IF NOT EXISTS vertical_scope_store_versions (\n    version_id    TEXT PRIMARY KEY,\n    vertical_slug TEXT NOT NULL,\n    -- 0: the manifest could not be read, so the version may declare a store nobody can name.\n    readable      INTEGER NOT NULL\n  );\n  CREATE INDEX IF NOT EXISTS vertical_scope_store_versions_slug\n    ON vertical_scope_store_versions (vertical_slug, readable);\n  -- A vertical every version of which is indexed above.\n  CREATE TABLE IF NOT EXISTS vertical_scope_store_indexed (\n    vertical_slug TEXT PRIMARY KEY\n  );\n";
+/** One declared binding. */
+export interface VerticalScopeStore {
+    readonly binding: string;
+    readonly kind: string;
+}
+/**
+ * Index a version `publishVersion` is inserting, in the insert's transaction, after its row. The
+ * vertical's older versions are indexed first when it is not marked yet, so a re-kind is judged
+ * against every version, not only those a read reached. Refuses (`conflict`) a binding the vertical
+ * already declared as another kind, or one declared twice, and then nothing is written.
+ */
+export declare function indexVersionScopeStores(db: SwitchSql, verticalSlug: string, versionId: string, manifestJson: string | null): void;
+/**
+ * Every binding any version of the vertical declared, in binding order. An unmarked vertical is
+ * indexed first (the caller runs this in one transaction). Refuses (`unavailable`) when a version's
+ * manifest cannot be read, or when versions stored before the record re-kinded a binding: the
+ * lifecycle cannot name every store the vertical may hold.
+ */
+export declare function verticalScopeStoresOf(db: SwitchSql, verticalSlug: string): VerticalScopeStore[];
+/**
+ * Every vertical whose any version declared a binding of `kind`, with those bindings (#2300): the
+ * store scripts a release rollout of the kind reaches, including a vertical whose serving version
+ * dropped the store while a pinned or preview scope still runs one that declares it. Every vertical
+ * not indexed yet is indexed first (the caller runs this in one transaction).
+ *
+ * `unreadable` names the verticals that cannot say: a version whose manifest cannot be read, or
+ * versions stored before the record that re-kinded a binding. Any of them may declare the kind, so
+ * a caller that must reach every script (a rollout) refuses while the list is not empty, rather
+ * than leave a script on another release without saying so.
+ */
+export declare function kindDeclarationsOf(db: SwitchSql, kind: string): {
+    verticals: {
+        vertical: string;
+        stores: VerticalScopeStore[];
+    }[];
+    unreadable: string[];
+};
+/** A deleted vertical's declarations go with its versions, so a slug registered again starts clean. */
+export declare function forgetVerticalScopeStores(db: SwitchSql, verticalSlug: string): void;
+//# sourceMappingURL=vertical-scope-stores.d.ts.map

package/dist/vertical-scope-stores.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vertical-scope-stores.d.ts","sourceRoot":"","sources":["../src/vertical-scope-stores.ts"],"names":[],"mappings":"AA6BA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAEpD,0GAA0G;AAC1G,eAAO,MAAM,yBAAyB,u2BAqBrC,CAAC;AAEF,4BAA4B;AAC5B,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAiFD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,EAAE,EAAE,SAAS,EACb,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GAAG,IAAI,GAC1B,IAAI,CAGN;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,GAAG,kBAAkB,EAAE,CAa/F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAChC,EAAE,EAAE,SAAS,EACb,IAAI,EAAE,MAAM,GACX;IAAE,SAAS,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,kBAAkB,EAAE,CAAA;KAAE,EAAE,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAE,CA6B3F;AAED,uGAAuG;AACvG,wBAAgB,yBAAyB,CAAC,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAInF"}

package/dist/vertical-scope-stores.js

@@ -0,0 +1,195 @@
+/**
+ * Every scope-store binding a vertical has declared, by any version (#2286, RFC scope-stores L17),
+ * shared by both adapters.
+ *
+ * A store object is named by (tenant, vertical, scope, binding) and carries no version, so a later
+ * version that drops a binding leaves the old object holding data. The lifecycle (export, wipe,
+ * erasure, the meter) reaches the union of every binding any version declared, which this keeps as
+ * a directory table, read by its keys, instead of reading every version's manifest per call.
+ *
+ * A binding keeps its kind for the life of its vertical. The kind names the store script, so a
+ * re-kinded binding would point the same name at another script's object, and the union would have
+ * to hold both. `publishVersion` refuses it instead (`conflict`), in the transaction that inserts
+ * the version: one door, where the push can still be told to pick a new binding name. A manifest
+ * that declares one binding twice is refused there too.
+ *
+ * Each version is indexed once, and marked in `vertical_scope_store_versions`; a vertical whose
+ * versions are all indexed is marked in `vertical_scope_store_indexed`, so a read of it is three
+ * keyed lookups and no per-version work. A version stored before these tables, or loaded by a
+ * directory restore from an older dump, leaves its vertical unmarked. Whichever comes first, a read
+ * or a publish, then indexes all of the vertical's versions, oldest first, in its own transaction:
+ * nothing runs on a constructor's path, a restore needs no backfill of its own, and a publish judges
+ * a re-kind against every older version, not only those indexed so far. A version whose manifest
+ * cannot be read is marked unreadable, and a read of its vertical refuses: it may declare a store
+ * nobody can name.
+ *
+ * Nothing here retires a binding: the record never shrinks (K-50 forbids it as a side effect of a
+ * push). The explicit retire step is an open item of the RFC (§10.8).
+ */
+import { substratError } from '@substrat-run/contracts';
+/** Interpolated into both adapters' directory DDL, so `lint:spine-ddl` sees one spelling on each side. */
+export const VERTICAL_SCOPE_STORES_DDL = `
+  CREATE TABLE IF NOT EXISTS vertical_scope_stores (
+    vertical_slug    TEXT NOT NULL,
+    binding          TEXT NOT NULL,
+    kind             TEXT NOT NULL,
+    -- The version that declared the binding first.
+    first_version_id TEXT NOT NULL,
+    PRIMARY KEY (vertical_slug, binding)
+  );
+  CREATE TABLE IF NOT EXISTS vertical_scope_store_versions (
+    version_id    TEXT PRIMARY KEY,
+    vertical_slug TEXT NOT NULL,
+    -- 0: the manifest could not be read, so the version may declare a store nobody can name.
+    readable      INTEGER NOT NULL
+  );
+  CREATE INDEX IF NOT EXISTS vertical_scope_store_versions_slug
+    ON vertical_scope_store_versions (vertical_slug, readable);
+  -- A vertical every version of which is indexed above.
+  CREATE TABLE IF NOT EXISTS vertical_scope_store_indexed (
+    vertical_slug TEXT PRIMARY KEY
+  );
+`;
+/**
+ * The bindings a stored manifest declares, or null when the manifest cannot be read. No manifest
+ * declares none. Read for its shape only, `{ binding, kind }` strings as the router reads them:
+ * whether a kind is one the platform runs is the push's question, and a record that refused to
+ * hold a kind it did not know could not refuse that kind's re-kind either.
+ */
+function declaredIn(manifestJson) {
+    if (manifestJson === null)
+        return [];
+    let raw;
+    try {
+        raw = JSON.parse(manifestJson);
+    }
+    catch {
+        return null;
+    }
+    if (typeof raw !== 'object' || raw === null || Array.isArray(raw))
+        return null;
+    const stores = raw.scopeStores;
+    if (stores === undefined)
+        return [];
+    if (!Array.isArray(stores))
+        return null;
+    const declared = [];
+    for (const store of stores) {
+        const { binding, kind } = (store ?? {});
+        if (typeof binding !== 'string' || typeof kind !== 'string')
+            return null;
+        declared.push({ binding, kind });
+    }
+    return declared;
+}
+/** One version, judged and written; a version already indexed is left as it is. */
+function indexOne(db, verticalSlug, versionId, manifestJson) {
+    if (db.all('SELECT 1 AS present FROM vertical_scope_store_versions WHERE version_id = ?', versionId).length > 0)
+        return;
+    const declared = declaredIn(manifestJson);
+    // Every binding is judged before any is written, so a refusal writes nothing.
+    const fresh = [];
+    const seen = new Set();
+    for (const { binding, kind } of declared ?? []) {
+        if (seen.has(binding)) {
+            throw substratError('conflict', `a version of '${verticalSlug}' declares scope store '${binding}' twice`);
+        }
+        seen.add(binding);
+        const [held] = db.all('SELECT kind FROM vertical_scope_stores WHERE vertical_slug = ? AND binding = ?', verticalSlug, binding);
+        if (held && held.kind !== kind) {
+            throw substratError('conflict', `scope store '${binding}' of '${verticalSlug}' is a '${held.kind}', and a binding keeps its kind for ` +
+                `the life of its vertical: objects of the old kind may still hold data under that name. ` +
+                `Declare the '${kind}' store under a new binding name`);
+        }
+        if (!held)
+            fresh.push({ binding, kind });
+    }
+    for (const { binding, kind } of fresh) {
+        db.run('INSERT INTO vertical_scope_stores (vertical_slug, binding, kind, first_version_id) VALUES (?, ?, ?, ?)', verticalSlug, binding, kind, versionId);
+    }
+    db.run('INSERT INTO vertical_scope_store_versions (version_id, vertical_slug, readable) VALUES (?, ?, ?)', versionId, verticalSlug, declared === null ? 0 : 1);
+}
+/** Index every version of the vertical not indexed yet, oldest first, then mark the vertical. */
+function indexVertical(db, verticalSlug) {
+    if (db.all('SELECT 1 AS present FROM vertical_scope_store_indexed WHERE vertical_slug = ?', verticalSlug).length > 0)
+        return;
+    const unindexed = db.all(`SELECT v.id, v.manifest_json FROM vertical_versions AS v
+      WHERE v.vertical_slug = ?
+        AND NOT EXISTS (SELECT 1 FROM vertical_scope_store_versions AS s WHERE s.version_id = v.id)
+      ORDER BY v.created_at, v.id`, verticalSlug);
+    for (const { id, manifest_json } of unindexed)
+        indexOne(db, verticalSlug, id, manifest_json);
+    db.run('INSERT OR IGNORE INTO vertical_scope_store_indexed (vertical_slug) VALUES (?)', verticalSlug);
+}
+/**
+ * Index a version `publishVersion` is inserting, in the insert's transaction, after its row. The
+ * vertical's older versions are indexed first when it is not marked yet, so a re-kind is judged
+ * against every version, not only those a read reached. Refuses (`conflict`) a binding the vertical
+ * already declared as another kind, or one declared twice, and then nothing is written.
+ */
+export function indexVersionScopeStores(db, verticalSlug, versionId, manifestJson) {
+    indexVertical(db, verticalSlug);
+    indexOne(db, verticalSlug, versionId, manifestJson);
+}
+/**
+ * Every binding any version of the vertical declared, in binding order. An unmarked vertical is
+ * indexed first (the caller runs this in one transaction). Refuses (`unavailable`) when a version's
+ * manifest cannot be read, or when versions stored before the record re-kinded a binding: the
+ * lifecycle cannot name every store the vertical may hold.
+ */
+export function verticalScopeStoresOf(db, verticalSlug) {
+    try {
+        indexVertical(db, verticalSlug);
+    }
+    catch (error) {
+        throw substratError('unavailable', `the scope stores of '${verticalSlug}' cannot be named: ${String(error.message ?? error)}`);
+    }
+    if (db.all('SELECT 1 AS present FROM vertical_scope_store_versions WHERE vertical_slug = ? AND readable = 0 LIMIT 1', verticalSlug).length > 0) {
+        throw substratError('unavailable', `a version of '${verticalSlug}' has a manifest that cannot be read, so its scope stores cannot be named`);
+    }
+    return db.all('SELECT binding, kind FROM vertical_scope_stores WHERE vertical_slug = ? ORDER BY binding', verticalSlug).map(({ binding, kind }) => ({ binding, kind }));
+}
+/**
+ * Every vertical whose any version declared a binding of `kind`, with those bindings (#2300): the
+ * store scripts a release rollout of the kind reaches, including a vertical whose serving version
+ * dropped the store while a pinned or preview scope still runs one that declares it. Every vertical
+ * not indexed yet is indexed first (the caller runs this in one transaction).
+ *
+ * `unreadable` names the verticals that cannot say: a version whose manifest cannot be read, or
+ * versions stored before the record that re-kinded a binding. Any of them may declare the kind, so
+ * a caller that must reach every script (a rollout) refuses while the list is not empty, rather
+ * than leave a script on another release without saying so.
+ */
+export function kindDeclarationsOf(db, kind) {
+    const slugs = db.all('SELECT DISTINCT vertical_slug FROM vertical_versions ORDER BY vertical_slug');
+    const unreadable = new Set();
+    for (const { vertical_slug } of slugs) {
+        try {
+            indexVertical(db, vertical_slug);
+        }
+        catch {
+            unreadable.add(vertical_slug);
+        }
+    }
+    for (const { vertical_slug } of db.all('SELECT DISTINCT vertical_slug FROM vertical_scope_store_versions WHERE readable = 0')) {
+        unreadable.add(vertical_slug);
+    }
+    const rows = db.all('SELECT vertical_slug, binding FROM vertical_scope_stores WHERE kind = ? ORDER BY vertical_slug, binding', kind);
+    const byVertical = new Map();
+    for (const { vertical_slug, binding } of rows) {
+        const stores = byVertical.get(vertical_slug) ?? [];
+        stores.push({ binding, kind });
+        byVertical.set(vertical_slug, stores);
+    }
+    return {
+        verticals: [...byVertical].map(([vertical, stores]) => ({ vertical, stores })),
+        unreadable: [...unreadable].sort(),
+    };
+}
+/** A deleted vertical's declarations go with its versions, so a slug registered again starts clean. */
+export function forgetVerticalScopeStores(db, verticalSlug) {
+    db.run('DELETE FROM vertical_scope_stores WHERE vertical_slug = ?', verticalSlug);
+    db.run('DELETE FROM vertical_scope_store_versions WHERE vertical_slug = ?', verticalSlug);
+    db.run('DELETE FROM vertical_scope_store_indexed WHERE vertical_slug = ?', verticalSlug);
+}
+//# sourceMappingURL=vertical-scope-stores.js.map

package/dist/vertical-scope-stores.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vertical-scope-stores.js","sourceRoot":"","sources":["../src/vertical-scope-stores.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAGxD,0GAA0G;AAC1G,MAAM,CAAC,MAAM,yBAAyB,GAAG;;;;;;;;;;;;;;;;;;;;;CAqBxC,CAAC;AAQF;;;;;GAKG;AACH,SAAS,UAAU,CAAC,YAA2B;IAC7C,IAAI,YAAY,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACrC,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,MAAM,MAAM,GAAI,GAAiC,CAAC,WAAW,CAAC;IAC9D,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACpC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,QAAQ,GAAyB,EAAE,CAAC;IAC1C,KAAK,MAAM,KAAK,IAAI,MAAmB,EAAE,CAAC;QACxC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,IAAI,EAAE,CAA0C,CAAC;QACjF,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACzE,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,mFAAmF;AACnF,SAAS,QAAQ,CAAC,EAAa,EAAE,YAAoB,EAAE,SAAiB,EAAE,YAA2B;IACnG,IAAI,EAAE,CAAC,GAAG,CAAC,6EAA6E,EAAE,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO;IACxH,MAAM,QAAQ,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;IAC1C,8EAA8E;IAC9E,MAAM,KAAK,GAAyB,EAAE,CAAC;IACvC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,QAAQ,IAAI,EAAE,EAAE,CAAC;QAC/C,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACtB,MAAM,aAAa,CAAC,UAAU,EAAE,iBAAiB,YAAY,2BAA2B,OAAO,SAAS,CAAC,CAAC;QAC5G,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClB,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CACnB,gFAAgF,EAChF,YAAY,EAAE,OAAO,CACA,CAAC;QACxB,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC/B,MAAM,aAAa,CACjB,UAAU,EACV,gBAAgB,OAAO,SAAS,YAAY,WAAW,IAAI,CAAC,IAAI,sCAAsC;gBACpG,yFAAyF;gBACzF,gBAAgB,IAAI,kCAAkC,CACzD,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3C,CAAC;IACD,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,KAAK,EAAE,CAAC;QACtC,EAAE,CAAC,GAAG,CACJ,wGAAwG,EACxG,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,CACvC,CAAC;IACJ,CAAC;IACD,EAAE,CAAC,GAAG,CACJ,kGAAkG,EAClG,SAAS,EAAE,YAAY,EAAE,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CACnD,CAAC;AACJ,CAAC;AAED,iGAAiG;AACjG,SAAS,aAAa,CAAC,EAAa,EAAE,YAAoB;IACxD,IAAI,EAAE,CAAC,GAAG,CAAC,+EAA+E,EAAE,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO;IAC7H,MAAM,SAAS,GAAG,EAAE,CAAC,GAAG,CACtB;;;kCAG8B,EAC9B,YAAY,CACqC,CAAC;IACpD,KAAK,MAAM,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,SAAS;QAAE,QAAQ,CAAC,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,aAAa,CAAC,CAAC;IAC7F,EAAE,CAAC,GAAG,CAAC,+EAA+E,EAAE,YAAY,CAAC,CAAC;AACxG,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,EAAa,EACb,YAAoB,EACpB,SAAiB,EACjB,YAA2B;IAE3B,aAAa,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;IAChC,QAAQ,CAAC,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;AACtD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,EAAa,EAAE,YAAoB;IACvE,IAAI,CAAC;QACH,aAAa,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,aAAa,CAAC,aAAa,EAAE,wBAAwB,YAAY,sBAAsB,MAAM,CAAE,KAAe,CAAC,OAAO,IAAI,KAAK,CAAC,EAAE,CAAC,CAAC;IAC5I,CAAC;IACD,IAAI,EAAE,CAAC,GAAG,CAAC,yGAAyG,EAAE,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/I,MAAM,aAAa,CAAC,aAAa,EAAE,iBAAiB,YAAY,2EAA2E,CAAC,CAAC;IAC/I,CAAC;IACD,OAAQ,EAAE,CAAC,GAAG,CACZ,0FAA0F,EAC1F,YAAY,CAC2B,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CAChC,EAAa,EACb,IAAY;IAEZ,MAAM,KAAK,GAAG,EAAE,CAAC,GAAG,CAAC,6EAA6E,CAAgC,CAAC;IACnI,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,KAAK,MAAM,EAAE,aAAa,EAAE,IAAI,KAAK,EAAE,CAAC;QACtC,IAAI,CAAC;YACH,aAAa,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,UAAU,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IACD,KAAK,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,GAAG,CACpC,qFAAqF,CACvD,EAAE,CAAC;QACjC,UAAU,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAChC,CAAC;IACD,MAAM,IAAI,GAAG,EAAE,CAAC,GAAG,CACjB,yGAAyG,EACzG,IAAI,CAC2C,CAAC;IAClD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAgC,CAAC;IAC3D,KAAK,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;QACnD,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/B,UAAU,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IACD,OAAO;QACL,SAAS,EAAE,CAAC,GAAG,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9E,UAAU,EAAE,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,EAAE;KACnC,CAAC;AACJ,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,yBAAyB,CAAC,EAAa,EAAE,YAAoB;IAC3E,EAAE,CAAC,GAAG,CAAC,2DAA2D,EAAE,YAAY,CAAC,CAAC;IAClF,EAAE,CAAC,GAAG,CAAC,mEAAmE,EAAE,YAAY,CAAC,CAAC;IAC1F,EAAE,CAAC,GAAG,CAAC,kEAAkE,EAAE,YAAY,CAAC,CAAC;AAC3F,CAAC"}