@substrat-run/kernel 0.149.0 → 0.151.0

package/dist/attachment-sweep.d.ts

@@ -37,7 +37,9 @@ import type { ScopedSql, TenantBlobStore } from './scope-host.js';
  * The instant a pass judges age and the fence against is the HOST's clock, never a caller's
  * (`OrphanSweepRequest` carries none), so no caller can step past guard 2 or guard 3.
  *
- * A dry run condemns nothing and deletes nothing: it reports what a pass would condemn.
+ * A dry run condemns nothing and deletes nothing: it reports what a pass would condemn, and the
+ * scope records that as its licence (#2350). A destructive pass needs one in force, and deletes only
+ * what it lists (`ATTACHMENT_SWEEP_LICENCE_DDL`).
  */
 /** The tombstone table, shared by both adapters so the two cannot part company. */
 export declare const ATTACHMENT_CONDEMNED_DDL = "\n  CREATE TABLE IF NOT EXISTS _substrat_attachment_condemned (\n    -- The attachment id whose object the sweep deleted, or is about to. No row may ever be\n    -- inserted for it again: the insert path refuses it (#2314).\n    id TEXT PRIMARY KEY,\n    condemned_at TEXT NOT NULL\n  );\n";
@@ -92,6 +94,60 @@ export declare function rowlessAttachmentIds(sql: ScopedSql, ids: readonly strin
  * tombstone of an id this pass is about to delete.
  */
 export declare function condemnOrphanAttachments(sql: ScopedSql, ids: readonly string[], now: string): string[];
+/**
+ * The dry-run-first licence (#2350), held by the scope's own storage so the rule holds whoever asks
+ * for a pass: one row per attachment id the scope's last dry run listed, stamped with the host's
+ * clock at that run. A destructive pass is refused without one in force
+ * (`refuseUnlicensedOrphanSweep`), condemns only ids it lists (`condemnLicensedOrphanAttachments`),
+ * and takes each id it deleted out of it (`consumeOrphanSweepLicence`).
+ *
+ * It only ever NARROWS what a pass may delete: every guard of the pass still runs on the ids it
+ * lists. So a licence that a rewind brought back, or that outlived the rows it was judged against,
+ * can permit nothing the pass would not permit without it. A dump never carries its rows and every
+ * load drops them, so a restore, a carry or a fork leaves the next pass a dry run.
+ */
+export declare const ATTACHMENT_SWEEP_LICENCE_DDL = "\n  CREATE TABLE IF NOT EXISTS _substrat_attachment_sweep_licence (\n    -- An attachment id the scope's last orphan-sweep dry run listed, and that no destructive\n    -- pass has deleted since (#2350). Store-local: never dumped, and cleared by every load.\n    id TEXT PRIMARY KEY,\n    licensed_at TEXT NOT NULL\n  );\n";
+/** The licence table's name, for the dump export that leaves its rows out and the load that drops them. */
+export declare const ATTACHMENT_SWEEP_LICENCE_TABLE = "_substrat_attachment_sweep_licence";
+/** The refusal reason a destructive pass meets when the scope holds no dry-run licence in force. */
+export declare const ORPHAN_SWEEP_UNLICENSED = "orphan_sweep_unlicensed";
+/** How long a scope's dry-run licence stays in force, judged against the host's clock: seven days. */
+export declare const ORPHAN_SWEEP_DRY_RUN_WINDOW_MS: number;
+/** The most ids one licence holds. A dry run that lists more licenses its first this many. */
+export declare const ORPHAN_SWEEP_LICENCE_CAP = 1000;
+/**
+ * When the scope's licence was recorded, if it holds one in force at `now`, else null. A licence
+ * stamped more than a minute later than `now` (a clock that went back) is not in force: the next
+ * pass is a dry run.
+ */
+export declare function orphanSweepLicensedAt(sql: ScopedSql, now: string): string | null;
+/** Refuse a destructive pass over a scope that holds no dry-run licence in force at `now`. */
+export declare function refuseUnlicensedOrphanSweep(sql: ScopedSql, now: string): void;
+/**
+ * Record what a dry run found as the scope's licence, inside the caller's scope transaction: the
+ * first `ORPHAN_SWEEP_LICENCE_CAP` of `ids`, stamped `now`. Writes only when that set differs from
+ * the one held, or the one held is older than half the window, so a dry run that keeps finding the
+ * same orphans moves no write revision (a carry and a kept-copy release are fenced on it). An empty
+ * set clears a held licence, and writes nothing when there is none. Returns whether it wrote.
+ */
+export declare function recordOrphanSweepLicence(sql: ScopedSql, ids: readonly string[], now: string): boolean;
+/**
+ * `condemnOrphanAttachments` over only the ids in `ids` the scope's licence lists, while it is in
+ * force at `now`: a destructive pass deletes nothing its dry run did not list. Inside the caller's
+ * scope transaction, so a load that dropped the licence meanwhile leaves nothing to condemn.
+ */
+export declare function condemnLicensedOrphanAttachments(sql: ScopedSql, ids: readonly string[], now: string): string[];
+/** The ids the scope's licence lists, held or expired: at most `ORPHAN_SWEEP_LICENCE_CAP`. */
+export declare function licensedOrphanIds(sql: ScopedSql): string[];
+/**
+ * Take ids out of the licence: the ones a destructive pass deleted, and the ones whose objects are
+ * gone some other way, so its next pass in the window goes on with the ids it has not reached and
+ * never back to what is gone. A licence left with nothing is no licence, so the next destructive
+ * pass is refused and the scope is dry-run again. Writes only when one of `ids` is held.
+ */
+export declare function consumeOrphanSweepLicence(sql: ScopedSql, ids: readonly string[]): void;
+/** Drop the whole licence: every dump load does, so a restored, carried or forked store starts with none. */
+export declare function clearOrphanSweepLicence(sql: ScopedSql): void;
 /**
  * The copy-ledger states (#1722) in which another script's copy of a scope can no longer hold a
  * row the serving copy lacks, nor discover one. An ALLOWLIST: every other state, a future one
@@ -185,6 +241,13 @@ export interface OrphanSweepReport {
     keys: string[];
     /** Set when the restore fence held the pass: the instant until which it holds. */
     fencedUntil?: string;
+    /**
+     * Set when a destructive pass could not bring the scope's dry-run licence up to date afterwards
+     * (#2350): take out what it deleted, and what is gone some other way. Any deletes stand and `keys`
+     * names them. The licence keeps rows for ids that are gone, which license nothing a pass could
+     * delete, and which the next pass that settles the licence takes out.
+     */
+    consumeFailed?: true;
     dryRun: boolean;
     /**
      * `'none'` when the deployment holds no attachment store for the tenant at all, so nothing was
@@ -193,10 +256,20 @@ export interface OrphanSweepReport {
      */
     bucket?: 'none';
 }
-/** What the scope side of a pass is: the read for a dry run, the condemnation otherwise. */
+/**
+ * What the scope side of a pass is: the read for a dry run, and the licence it records; the
+ * licensed condemnation otherwise, and the consumption of the licence by what was deleted.
+ */
 export interface OrphanSweepScope {
     rowless(ids: readonly string[]): Promise<string[]>;
+    /** Condemn the ids the scope's licence lists (`condemnLicensedOrphanAttachments`). */
     condemn(ids: readonly string[], now: string): Promise<string[]>;
+    /** Record what a dry run found as the scope's licence (`recordOrphanSweepLicence`). */
+    license(ids: readonly string[], now: string): Promise<void>;
+    /** The ids the scope's licence lists (`licensedOrphanIds`). */
+    licensed(): Promise<string[]>;
+    /** Take ids out of the licence (`consumeOrphanSweepLicence`). */
+    consume(ids: readonly string[]): Promise<void>;
 }
 /**
  * One pass over one scope's attachment bytes. The host supplies the store and the scope side;

package/dist/attachment-sweep.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"attachment-sweep.d.ts","sourceRoot":"","sources":["../src/attachment-sweep.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAQlE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,mFAAmF;AACnF,eAAO,MAAM,wBAAwB,sSAOpC,CAAC;AAEF,gGAAgG;AAChG,eAAO,MAAM,oBAAoB,yBAAyB,CAAC;AAE3D,mFAAmF;AACnF,eAAO,MAAM,qBAAqB,QAAiB,CAAC;AAEpD;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,QAAkB,CAAC;AAErD,qDAAqD;AACrD,eAAO,MAAM,kBAAkB,MAAM,CAAC;AAEtC,+FAA+F;AAC/F,eAAO,MAAM,oBAAoB,MAAM,CAAC;AAExC;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,QAAkB,CAAC;AAE7D;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CASpF;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,SAAS,EACd,MAAM,EAAE,SAAS;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,IAAI,EAAE,SAAS,CAAC,SAAS,OAAO,EAAE,CAAC,EAAE,CAAA;CAAE,EAAE,GACrG,IAAI,CA4BN;AAED,6EAA6E;AAC7E,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAUrF;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAoBtG;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAAa,CAAC;AAE/D,kGAAkG;AAClG,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,EAAE,GAAG,KAAK,GAAG,IAAI,CAQ3H;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,KAAK,CAK/E;AAED,mGAAmG;AACnG,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE9G;AAcD;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,uEAAuE;IACvE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,EAAE,WAAW,EAAE,OAAO,GAAG,KAAK,GAAG,IAAI,CAenI;AAED,4FAA4F;AAC5F,MAAM,WAAW,kBAAkB;IACjC,iGAAiG;IACjG,GAAG,EAAE,MAAM,CAAC;IACZ,uEAAuE;IACvE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,uFAAuF;IACvF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oFAAoF;IACpF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,uCAAuC;IACvC,UAAU,EAAE,MAAM,CAAC;IACnB,kFAAkF;IAClF,OAAO,EAAE,MAAM,CAAC;IAChB,gEAAgE;IAChE,OAAO,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,kFAAkF;IAClF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,OAAO,CAAC;IAChB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,4FAA4F;AAC5F,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACnD,OAAO,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CACjE;AAOD;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,eAAe,EACtB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,gBAAgB,EACvB,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,iBAAiB,CAAC,CA+D5B"}
+{"version":3,"file":"attachment-sweep.d.ts","sourceRoot":"","sources":["../src/attachment-sweep.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AASlE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,mFAAmF;AACnF,eAAO,MAAM,wBAAwB,sSAOpC,CAAC;AAEF,gGAAgG;AAChG,eAAO,MAAM,oBAAoB,yBAAyB,CAAC;AAE3D,mFAAmF;AACnF,eAAO,MAAM,qBAAqB,QAAiB,CAAC;AAEpD;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,QAAkB,CAAC;AAErD,qDAAqD;AACrD,eAAO,MAAM,kBAAkB,MAAM,CAAC;AAEtC,+FAA+F;AAC/F,eAAO,MAAM,oBAAoB,MAAM,CAAC;AAExC;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,QAAkB,CAAC;AAE7D;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CASpF;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,SAAS,EACd,MAAM,EAAE,SAAS;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,IAAI,EAAE,SAAS,CAAC,SAAS,OAAO,EAAE,CAAC,EAAE,CAAA;CAAE,EAAE,GACrG,IAAI,CA4BN;AAED,6EAA6E;AAC7E,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAUrF;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAoBtG;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,4BAA4B,sUAOxC,CAAC;AAEF,2GAA2G;AAC3G,eAAO,MAAM,8BAA8B,uCAAuC,CAAC;AAEnF,oGAAoG;AACpG,eAAO,MAAM,uBAAuB,4BAA4B,CAAC;AAEjE,sGAAsG;AACtG,eAAO,MAAM,8BAA8B,QAAiB,CAAC;AAE7D,8FAA8F;AAC9F,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAW7C;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAShF;AAED,8FAA8F;AAC9F,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAQ7E;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAmBrG;AAED;;;;GAIG;AACH,wBAAgB,gCAAgC,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAW9G;AAED,8FAA8F;AAC9F,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,EAAE,CAG1D;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAStF;AAED,6GAA6G;AAC7G,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,SAAS,GAAG,IAAI,CAE5D;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAAa,CAAC;AAE/D,kGAAkG;AAClG,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,EAAE,GAAG,KAAK,GAAG,IAAI,CAQ3H;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,KAAK,CAK/E;AAED,mGAAmG;AACnG,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE9G;AAcD;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,uEAAuE;IACvE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,EAAE,WAAW,EAAE,OAAO,GAAG,KAAK,GAAG,IAAI,CAenI;AAED,4FAA4F;AAC5F,MAAM,WAAW,kBAAkB;IACjC,iGAAiG;IACjG,GAAG,EAAE,MAAM,CAAC;IACZ,uEAAuE;IACvE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,uFAAuF;IACvF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oFAAoF;IACpF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,uCAAuC;IACvC,UAAU,EAAE,MAAM,CAAC;IACnB,kFAAkF;IAClF,OAAO,EAAE,MAAM,CAAC;IAChB,gEAAgE;IAChE,OAAO,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,kFAAkF;IAClF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,IAAI,CAAC;IACrB,MAAM,EAAE,OAAO,CAAC;IAChB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACnD,sFAAsF;IACtF,OAAO,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAChE,uFAAuF;IACvF,OAAO,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,+DAA+D;IAC/D,QAAQ,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9B,iEAAiE;IACjE,OAAO,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChD;AAOD;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,eAAe,EACtB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,gBAAgB,EACvB,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,iBAAiB,CAAC,CAmG5B"}

package/dist/attachment-sweep.js

@@ -39,7 +39,9 @@ import { ulidTime } from './ulid.js';
  * The instant a pass judges age and the fence against is the HOST's clock, never a caller's
  * (`OrphanSweepRequest` carries none), so no caller can step past guard 2 or guard 3.
  *
- * A dry run condemns nothing and deletes nothing: it reports what a pass would condemn.
+ * A dry run condemns nothing and deletes nothing: it reports what a pass would condemn, and the
+ * scope records that as its licence (#2350). A destructive pass needs one in force, and deletes only
+ * what it lists (`ATTACHMENT_SWEEP_LICENCE_DDL`).
  */
 /** The tombstone table, shared by both adapters so the two cannot part company. */
 export const ATTACHMENT_CONDEMNED_DDL = `
@@ -151,6 +153,132 @@ export function condemnOrphanAttachments(sql, ids, now) {
     }
     return rowless;
 }
+/**
+ * The dry-run-first licence (#2350), held by the scope's own storage so the rule holds whoever asks
+ * for a pass: one row per attachment id the scope's last dry run listed, stamped with the host's
+ * clock at that run. A destructive pass is refused without one in force
+ * (`refuseUnlicensedOrphanSweep`), condemns only ids it lists (`condemnLicensedOrphanAttachments`),
+ * and takes each id it deleted out of it (`consumeOrphanSweepLicence`).
+ *
+ * It only ever NARROWS what a pass may delete: every guard of the pass still runs on the ids it
+ * lists. So a licence that a rewind brought back, or that outlived the rows it was judged against,
+ * can permit nothing the pass would not permit without it. A dump never carries its rows and every
+ * load drops them, so a restore, a carry or a fork leaves the next pass a dry run.
+ */
+export const ATTACHMENT_SWEEP_LICENCE_DDL = `
+  CREATE TABLE IF NOT EXISTS _substrat_attachment_sweep_licence (
+    -- An attachment id the scope's last orphan-sweep dry run listed, and that no destructive
+    -- pass has deleted since (#2350). Store-local: never dumped, and cleared by every load.
+    id TEXT PRIMARY KEY,
+    licensed_at TEXT NOT NULL
+  );
+`;
+/** The licence table's name, for the dump export that leaves its rows out and the load that drops them. */
+export const ATTACHMENT_SWEEP_LICENCE_TABLE = '_substrat_attachment_sweep_licence';
+/** The refusal reason a destructive pass meets when the scope holds no dry-run licence in force. */
+export const ORPHAN_SWEEP_UNLICENSED = 'orphan_sweep_unlicensed';
+/** How long a scope's dry-run licence stays in force, judged against the host's clock: seven days. */
+export const ORPHAN_SWEEP_DRY_RUN_WINDOW_MS = 7 * 86_400_000;
+/** The most ids one licence holds. A dry run that lists more licenses its first this many. */
+export const ORPHAN_SWEEP_LICENCE_CAP = 1000;
+/**
+ * How far past `now` a licence's stamp may read and still be in force: the jitter between two
+ * reads of a host's clock. Beyond it the clock went back, and the licence is not in force.
+ */
+const LICENCE_SKEW_MS = 60_000;
+const hasLicenceTable = (sql) => sql.query(`SELECT 1 AS hit FROM sqlite_master WHERE type = 'table' AND name = '_substrat_attachment_sweep_licence'`).length > 0;
+/**
+ * When the scope's licence was recorded, if it holds one in force at `now`, else null. A licence
+ * stamped more than a minute later than `now` (a clock that went back) is not in force: the next
+ * pass is a dry run.
+ */
+export function orphanSweepLicensedAt(sql, now) {
+    if (!hasLicenceTable(sql))
+        return null;
+    const [row] = sql.query(`SELECT MIN(licensed_at) AS at FROM _substrat_attachment_sweep_licence`);
+    const at = row?.at ?? null;
+    if (at === null)
+        return null;
+    const atMs = Date.parse(at);
+    const nowMs = Date.parse(now);
+    if (!Number.isFinite(atMs) || atMs > nowMs + LICENCE_SKEW_MS || nowMs - atMs > ORPHAN_SWEEP_DRY_RUN_WINDOW_MS)
+        return null;
+    return at;
+}
+/** Refuse a destructive pass over a scope that holds no dry-run licence in force at `now`. */
+export function refuseUnlicensedOrphanSweep(sql, now) {
+    if (orphanSweepLicensedAt(sql, now) !== null)
+        return;
+    throw substratError('conflict', `refused: this scope holds no orphan-sweep dry run from the last ` +
+        `${ORPHAN_SWEEP_DRY_RUN_WINDOW_MS / 86_400_000} days, so a destructive pass has nothing it may delete. Run a dry run first`, { reason: ORPHAN_SWEEP_UNLICENSED });
+}
+/**
+ * Record what a dry run found as the scope's licence, inside the caller's scope transaction: the
+ * first `ORPHAN_SWEEP_LICENCE_CAP` of `ids`, stamped `now`. Writes only when that set differs from
+ * the one held, or the one held is older than half the window, so a dry run that keeps finding the
+ * same orphans moves no write revision (a carry and a kept-copy release are fenced on it). An empty
+ * set clears a held licence, and writes nothing when there is none. Returns whether it wrote.
+ */
+export function recordOrphanSweepLicence(sql, ids, now) {
+    const next = [...new Set(ids)].slice(0, ORPHAN_SWEEP_LICENCE_CAP);
+    const held = sql.query(`SELECT id, licensed_at FROM _substrat_attachment_sweep_licence`);
+    if (held.length === 0 && next.length === 0)
+        return false;
+    if (held.length === next.length && held.length > 0) {
+        const heldIds = new Set(held.map((r) => r.id));
+        const oldest = Math.min(...held.map((r) => Date.parse(r.licensed_at)));
+        const age = Date.parse(now) - oldest;
+        const fresh = Number.isFinite(age) && age >= -LICENCE_SKEW_MS && age <= ORPHAN_SWEEP_DRY_RUN_WINDOW_MS / 2;
+        if (fresh && next.every((id) => heldIds.has(id)))
+            return false;
+    }
+    sql.exec(`DELETE FROM _substrat_attachment_sweep_licence`);
+    if (next.length > 0) {
+        sql.exec(`INSERT INTO _substrat_attachment_sweep_licence (id, licensed_at) SELECT value, ? FROM json_each(?)`, [now, JSON.stringify(next)]);
+    }
+    return true;
+}
+/**
+ * `condemnOrphanAttachments` over only the ids in `ids` the scope's licence lists, while it is in
+ * force at `now`: a destructive pass deletes nothing its dry run did not list. Inside the caller's
+ * scope transaction, so a load that dropped the licence meanwhile leaves nothing to condemn.
+ */
+export function condemnLicensedOrphanAttachments(sql, ids, now) {
+    if (ids.length === 0 || orphanSweepLicensedAt(sql, now) === null)
+        return [];
+    const licensed = sql
+        .query(`SELECT j.value AS value FROM json_each(?) AS j
+        WHERE EXISTS (SELECT 1 FROM _substrat_attachment_sweep_licence l WHERE l.id = j.value)
+        ORDER BY j.value`, [JSON.stringify(ids)])
+        .map((r) => r.value);
+    return condemnOrphanAttachments(sql, licensed, now);
+}
+/** The ids the scope's licence lists, held or expired: at most `ORPHAN_SWEEP_LICENCE_CAP`. */
+export function licensedOrphanIds(sql) {
+    if (!hasLicenceTable(sql))
+        return [];
+    return sql.query(`SELECT id FROM _substrat_attachment_sweep_licence ORDER BY id`).map((r) => r.id);
+}
+/**
+ * Take ids out of the licence: the ones a destructive pass deleted, and the ones whose objects are
+ * gone some other way, so its next pass in the window goes on with the ids it has not reached and
+ * never back to what is gone. A licence left with nothing is no licence, so the next destructive
+ * pass is refused and the scope is dry-run again. Writes only when one of `ids` is held.
+ */
+export function consumeOrphanSweepLicence(sql, ids) {
+    if (ids.length === 0 || !hasLicenceTable(sql))
+        return;
+    const json = JSON.stringify(ids);
+    const held = sql.query(`SELECT 1 AS hit FROM _substrat_attachment_sweep_licence WHERE id IN (SELECT value FROM json_each(?)) LIMIT 1`, [json]);
+    if (held.length === 0)
+        return;
+    sql.exec(`DELETE FROM _substrat_attachment_sweep_licence WHERE id IN (SELECT value FROM json_each(?))`, [json]);
+}
+/** Drop the whole licence: every dump load does, so a restored, carried or forked store starts with none. */
+export function clearOrphanSweepLicence(sql) {
+    if (hasLicenceTable(sql))
+        sql.exec(`DELETE FROM _substrat_attachment_sweep_licence`);
+}
 /**
  * The copy-ledger states (#1722) in which another script's copy of a scope can no longer hold a
  * row the serving copy lacks, nor discover one. An ALLOWLIST: every other state, a future one
@@ -286,6 +414,8 @@ export async function sweepOrphanAttachments(store, scopeId, scope, opts) {
             candidates.push(id);
     }
     report.candidates = candidates.length;
+    // Every id this scope's prefix still holds, whatever its age: a licensed id not among them is gone.
+    const present = new Set(keys.map((key) => key.slice(prefix.length)));
     const orphans = [];
     for (let i = 0; i < candidates.length && orphans.length < limit; i += ORPHAN_CONDEMN_BATCH) {
         const batch = candidates.slice(i, i + ORPHAN_CONDEMN_BATCH);
@@ -300,19 +430,51 @@ export async function sweepOrphanAttachments(store, scopeId, scope, opts) {
     const doomed = orphans.slice(0, limit);
     if (dryRun) {
         report.keys = doomed.map((id) => attachmentBlobKey(scopeId, id));
+        // The licence a destructive pass needs (#2350): what this run listed, nothing more.
+        await scope.license(doomed, opts.now);
         return report;
     }
-    if (doomed.length === 0)
+    /**
+     * Bring the licence up to date once the pass is done (#2350): take out the ids it deleted, so a
+     * backlog past `limit` drains over the next passes in the window, and every licensed id whose
+     * object is gone some other way, so a licence that lists nothing deletable does not hold the
+     * scope away from its next dry run until it expires. Taking ids out only narrows the licence.
+     *
+     * The bytes may be gone by now, so a failure here (the scope suspended or carried away mid-pass)
+     * must not cost the report: it is the only record of which keys were deleted. A licence row left
+     * for a gone id licenses nothing a pass could delete.
+     */
+    const settleLicence = async (gone) => {
+        try {
+            const stale = (await scope.licensed()).filter((id) => !present.has(id));
+            const drop = [...gone, ...stale];
+            if (drop.length > 0)
+                await scope.consume(drop);
+        }
+        catch (err) {
+            report.consumeFailed = true;
+            console.error(`orphan-attachment sweep: scope ${scopeId} deleted ${report.deleted} object(s) but could not bring its ` +
+                `dry-run licence up to date (${err instanceof Error ? err.name : 'Error'}); the report names the deleted keys`);
+        }
+    };
+    if (doomed.length === 0) {
+        await settleLicence([]);
         return report;
+    }
     // Guard 3 again, after the condemnation: a rewind that armed mid-pass wrote its fence first.
     if (await fenced())
         return report;
+    const gone = [];
     for (const id of doomed) {
         const key = attachmentBlobKey(scopeId, id);
         await store.delete(key);
+        gone.push(id);
         report.keys.push(key);
         report.deleted++;
     }
+    // A delete that throws ends the pass before this, so every id stays licensed and condemned, and
+    // the next pass deletes them again (a delete of what is gone is a no-op).
+    await settleLicence(gone);
     return report;
 }
 //# sourceMappingURL=attachment-sweep.js.map

package/dist/attachment-sweep.js.map

@@ -1 +1 @@
-{"version":3,"file":"attachment-sweep.js","sourceRoot":"","sources":["../src/attachment-sweep.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAExD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAMrC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,mFAAmF;AACnF,MAAM,CAAC,MAAM,wBAAwB,GAAG;;;;;;;CAOvC,CAAC;AAEF,gGAAgG;AAChG,MAAM,CAAC,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AAE3D,mFAAmF;AACnF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,GAAG,UAAU,CAAC;AAEpD;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,GAAG,UAAU,CAAC;AAErD,qDAAqD;AACrD,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAEtC,+FAA+F;AAC/F,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAExC;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,GAAG,UAAU,CAAC;AAE7D;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,GAAc,EAAE,YAAoB;IAC5E,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,kEAAkE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;IAChH,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,aAAa,CACjB,UAAU,EACV,cAAc,YAAY,yFAAyF,EACnH,EAAE,MAAM,EAAE,oBAAoB,EAAE,CACjC,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAAc,EACd,MAAsG;IAEtG,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CACnB,qGAAqG,CACtG,CAAC;IACF,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC7B,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,uBAAuB;YAAE,SAAS;QACnE,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,EAAE,GAAG,CAAC;YAAE,SAAS;QACrB,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI;YAAE,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC,KAAK,QAAQ;gBAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAW,CAAC,CAAC;IAC7F,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,GAAG,EAAE,CAAC;QACzC,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CACnB;6EACuE,EACvE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CACxC,CAAC;QACF,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnB,MAAM,aAAa,CACjB,UAAU,EACV,iGAAiG;gBAC/F,UAAU,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,yDAAyD;gBAClG,2DAA2D,EAC7D,EAAE,MAAM,EAAE,oBAAoB,EAAE,CACjC,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,oBAAoB,CAAC,GAAc,EAAE,GAAsB;IACzE,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,OAAO,GAAG;SACP,KAAK,CACJ;;yBAEmB,EACnB,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CACtB;SACA,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AACzB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAc,EAAE,GAAsB,EAAE,GAAW;IAC1F,IAAI,GAAG,CAAC,MAAM,GAAG,oBAAoB,EAAE,CAAC;QACtC,MAAM,IAAI,UAAU,CAAC,WAAW,oBAAoB,mCAAmC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACvG,CAAC;IACD,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC/C,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACzB,GAAG,CAAC,IAAI,CACN;6EACuE,EACvE,CAAC,EAAE,EAAE,GAAG,CAAC,CACV,CAAC;IACJ,CAAC;IACD,8FAA8F;IAC9F,kGAAkG;IAClG,gGAAgG;IAChG,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,6BAA6B,CAAC,CAAC,WAAW,EAAE,CAAC;QACxF,GAAG,CAAC,IAAI,CAAC,mEAAmE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAsB,CAAC,MAAM,CAAC,CAAC;AAE/D,kGAAkG;AAClG,MAAM,UAAU,oBAAoB,CAAC,OAAe,EAAE,MAAuD;IAC3G,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/E,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,aAAa,CAClB,UAAU,EACV,kBAAkB,OAAO,mEAAmE;QAC1F,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,iDAAiD,CACrH,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAgB,EAAE,OAAe;IACtE,OAAO,IAAI,KAAK,CACd,SAAS,OAAO,oFAAoF,QAAQ,IAAI;QAC9G,+FAA+F,CAClG,CAAC;AACJ,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,OAAO,SAAS,OAAO,cAAc,CAAC;AACxC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAAsB,EAAE,OAAe,EAAE,GAAW;IAC7F,MAAM,KAAK,CAAC,GAAG,CAAC,uBAAuB,CAAC,OAAO,CAAC,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC;AAClH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,WAAW,CAAC,KAAsB,EAAE,OAAe,EAAE,OAAe;IACjF,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC;IAChE,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAAE,OAAO,MAAM,CAAC,iBAAiB,CAAC;IAC1D,OAAO,EAAE,GAAG,OAAO,CAAC;AACtB,CAAC;AA0BD;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,QAAuB,EAAE,QAA4B,EAAE,WAAoB;IACnH,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,WAAW;YAChB,CAAC,CAAC,aAAa,CACX,UAAU,EACV,oGAAoG;gBAClG,8BAA8B,QAAQ,qCAAqC,CAC9E;YACH,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IACD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,aAAa,CAAC,UAAU,EAAE,qCAAqC,QAAQ,SAAS,QAAQ,4CAA4C,CAAC,CAAC;IAC/I,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AA4CD,sFAAsF;AACtF,MAAM,YAAY,GAAG,UAAU,CAAC;AAChC,2EAA2E;AAC3E,MAAM,YAAY,GAAG,EAAE,GAAG,UAAU,CAAC;AAErC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAsB,EACtB,OAAe,EACf,KAAuB,EACvB,IAAwB;IAExB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,mBAAmB,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACjF,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,qBAAqB,CAAC;IACtD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,qBAAqB,CAAC;IACtD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,kBAAkB,CAAC;IAC/C,IAAI,CAAC,CAAC,OAAO,IAAI,YAAY,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,4BAA4B,YAAY,SAAS,OAAO,EAAE,CAAC,CAAC;IACjH,IAAI,CAAC,CAAC,OAAO,IAAI,YAAY,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,4BAA4B,YAAY,SAAS,OAAO,EAAE,CAAC,CAAC;IACjH,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,6CAA6C,KAAK,EAAE,CAAC,CAAC;IAC1H,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC;IACpC,MAAM,MAAM,GAAsB,EAAE,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;IAEzG,MAAM,MAAM,GAAG,KAAK,IAAsB,EAAE;QAC1C,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACzD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;QACnD,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;QACtF,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IACF,IAAI,MAAM,MAAM,EAAE;QAAE,OAAO,MAAM,CAAC;IAElC,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC5B,MAAM,MAAM,GAAG,KAAK,GAAG,OAAO,CAAC;IAC/B,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACpC,2FAA2F;QAC3F,IAAI,GAAG,KAAK,iBAAiB,CAAC,OAAO,EAAE,EAAE,CAAC;YAAE,SAAS;QACrD,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,MAAM,IAAI,MAAM;YAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,CAAC,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC;IAEtC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC,IAAI,oBAAoB,EAAE,CAAC;QAC3F,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,oBAAoB,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1F,8DAA8D;QAC9D,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC7B,KAAK,MAAM,EAAE,IAAI,MAAM;YAAE,IAAI,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAChC,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACvC,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,iBAAiB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;QACjE,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IACvC,6FAA6F;IAC7F,IAAI,MAAM,MAAM,EAAE;QAAE,OAAO,MAAM,CAAC;IAClC,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,iBAAiB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC3C,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtB,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"attachment-sweep.js","sourceRoot":"","sources":["../src/attachment-sweep.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAExD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAOrC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,mFAAmF;AACnF,MAAM,CAAC,MAAM,wBAAwB,GAAG;;;;;;;CAOvC,CAAC;AAEF,gGAAgG;AAChG,MAAM,CAAC,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AAE3D,mFAAmF;AACnF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,GAAG,UAAU,CAAC;AAEpD;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,GAAG,UAAU,CAAC;AAErD,qDAAqD;AACrD,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAEtC,+FAA+F;AAC/F,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAExC;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,GAAG,UAAU,CAAC;AAE7D;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,GAAc,EAAE,YAAoB;IAC5E,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,kEAAkE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;IAChH,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,aAAa,CACjB,UAAU,EACV,cAAc,YAAY,yFAAyF,EACnH,EAAE,MAAM,EAAE,oBAAoB,EAAE,CACjC,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAAc,EACd,MAAsG;IAEtG,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CACnB,qGAAqG,CACtG,CAAC;IACF,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC7B,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,uBAAuB;YAAE,SAAS;QACnE,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,EAAE,GAAG,CAAC;YAAE,SAAS;QACrB,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI;YAAE,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC,KAAK,QAAQ;gBAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAW,CAAC,CAAC;IAC7F,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,GAAG,EAAE,CAAC;QACzC,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CACnB;6EACuE,EACvE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CACxC,CAAC;QACF,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnB,MAAM,aAAa,CACjB,UAAU,EACV,iGAAiG;gBAC/F,UAAU,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,yDAAyD;gBAClG,2DAA2D,EAC7D,EAAE,MAAM,EAAE,oBAAoB,EAAE,CACjC,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,oBAAoB,CAAC,GAAc,EAAE,GAAsB;IACzE,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,OAAO,GAAG;SACP,KAAK,CACJ;;yBAEmB,EACnB,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CACtB;SACA,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AACzB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAc,EAAE,GAAsB,EAAE,GAAW;IAC1F,IAAI,GAAG,CAAC,MAAM,GAAG,oBAAoB,EAAE,CAAC;QACtC,MAAM,IAAI,UAAU,CAAC,WAAW,oBAAoB,mCAAmC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACvG,CAAC;IACD,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC/C,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACzB,GAAG,CAAC,IAAI,CACN;6EACuE,EACvE,CAAC,EAAE,EAAE,GAAG,CAAC,CACV,CAAC;IACJ,CAAC;IACD,8FAA8F;IAC9F,kGAAkG;IAClG,gGAAgG;IAChG,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,6BAA6B,CAAC,CAAC,WAAW,EAAE,CAAC;QACxF,GAAG,CAAC,IAAI,CAAC,mEAAmE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG;;;;;;;CAO3C,CAAC;AAEF,2GAA2G;AAC3G,MAAM,CAAC,MAAM,8BAA8B,GAAG,oCAAoC,CAAC;AAEnF,oGAAoG;AACpG,MAAM,CAAC,MAAM,uBAAuB,GAAG,yBAAyB,CAAC;AAEjE,sGAAsG;AACtG,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,GAAG,UAAU,CAAC;AAE7D,8FAA8F;AAC9F,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAC;AAE7C;;;GAGG;AACH,MAAM,eAAe,GAAG,MAAM,CAAC;AAE/B,MAAM,eAAe,GAAG,CAAC,GAAc,EAAW,EAAE,CAClD,GAAG,CAAC,KAAK,CAAC,yGAAyG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AAElI;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAc,EAAE,GAAW;IAC/D,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,KAAK,CAAwB,uEAAuE,CAAC,CAAC;IACxH,MAAM,EAAE,GAAG,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC;IAC3B,IAAI,EAAE,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,KAAK,GAAG,eAAe,IAAI,KAAK,GAAG,IAAI,GAAG,8BAA8B;QAAE,OAAO,IAAI,CAAC;IAC3H,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,2BAA2B,CAAC,GAAc,EAAE,GAAW;IACrE,IAAI,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,IAAI;QAAE,OAAO;IACrD,MAAM,aAAa,CACjB,UAAU,EACV,kEAAkE;QAChE,GAAG,8BAA8B,GAAG,UAAU,6EAA6E,EAC7H,EAAE,MAAM,EAAE,uBAAuB,EAAE,CACpC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAc,EAAE,GAAsB,EAAE,GAAW;IAC1F,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,wBAAwB,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAsC,gEAAgE,CAAC,CAAC;IAC9H,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACzD,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QACvE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC;QACrC,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,eAAe,IAAI,GAAG,IAAI,8BAA8B,GAAG,CAAC,CAAC;QAC3G,IAAI,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IACjE,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;IAC3D,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,GAAG,CAAC,IAAI,CACN,oGAAoG,EACpG,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAC5B,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gCAAgC,CAAC,GAAc,EAAE,GAAsB,EAAE,GAAW;IAClG,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAC5E,MAAM,QAAQ,GAAG,GAAG;SACjB,KAAK,CACJ;;yBAEmB,EACnB,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CACtB;SACA,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACvB,OAAO,wBAAwB,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;AACtD,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,iBAAiB,CAAC,GAAc;IAC9C,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,GAAG,CAAC,KAAK,CAAiB,+DAA+D,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACrH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,GAAc,EAAE,GAAsB;IAC9E,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC;QAAE,OAAO;IACtD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CACpB,8GAA8G,EAC9G,CAAC,IAAI,CAAC,CACP,CAAC;IACF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC9B,GAAG,CAAC,IAAI,CAAC,6FAA6F,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;AAClH,CAAC;AAED,6GAA6G;AAC7G,MAAM,UAAU,uBAAuB,CAAC,GAAc;IACpD,IAAI,eAAe,CAAC,GAAG,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;AACvF,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAsB,CAAC,MAAM,CAAC,CAAC;AAE/D,kGAAkG;AAClG,MAAM,UAAU,oBAAoB,CAAC,OAAe,EAAE,MAAuD;IAC3G,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/E,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,aAAa,CAClB,UAAU,EACV,kBAAkB,OAAO,mEAAmE;QAC1F,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,iDAAiD,CACrH,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAgB,EAAE,OAAe;IACtE,OAAO,IAAI,KAAK,CACd,SAAS,OAAO,oFAAoF,QAAQ,IAAI;QAC9G,+FAA+F,CAClG,CAAC;AACJ,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,OAAO,SAAS,OAAO,cAAc,CAAC;AACxC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAAsB,EAAE,OAAe,EAAE,GAAW;IAC7F,MAAM,KAAK,CAAC,GAAG,CAAC,uBAAuB,CAAC,OAAO,CAAC,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC;AAClH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,WAAW,CAAC,KAAsB,EAAE,OAAe,EAAE,OAAe;IACjF,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC;IAChE,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAAE,OAAO,MAAM,CAAC,iBAAiB,CAAC;IAC1D,OAAO,EAAE,GAAG,OAAO,CAAC;AACtB,CAAC;AA0BD;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,QAAuB,EAAE,QAA4B,EAAE,WAAoB;IACnH,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,WAAW;YAChB,CAAC,CAAC,aAAa,CACX,UAAU,EACV,oGAAoG;gBAClG,8BAA8B,QAAQ,qCAAqC,CAC9E;YACH,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IACD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,aAAa,CAAC,UAAU,EAAE,qCAAqC,QAAQ,SAAS,QAAQ,4CAA4C,CAAC,CAAC;IAC/I,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AA6DD,sFAAsF;AACtF,MAAM,YAAY,GAAG,UAAU,CAAC;AAChC,2EAA2E;AAC3E,MAAM,YAAY,GAAG,EAAE,GAAG,UAAU,CAAC;AAErC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAsB,EACtB,OAAe,EACf,KAAuB,EACvB,IAAwB;IAExB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,mBAAmB,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACjF,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,qBAAqB,CAAC;IACtD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,qBAAqB,CAAC;IACtD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,kBAAkB,CAAC;IAC/C,IAAI,CAAC,CAAC,OAAO,IAAI,YAAY,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,4BAA4B,YAAY,SAAS,OAAO,EAAE,CAAC,CAAC;IACjH,IAAI,CAAC,CAAC,OAAO,IAAI,YAAY,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,4BAA4B,YAAY,SAAS,OAAO,EAAE,CAAC,CAAC;IACjH,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,6CAA6C,KAAK,EAAE,CAAC,CAAC;IAC1H,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC;IACpC,MAAM,MAAM,GAAsB,EAAE,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;IAEzG,MAAM,MAAM,GAAG,KAAK,IAAsB,EAAE;QAC1C,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACzD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;QACnD,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;QACtF,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IACF,IAAI,MAAM,MAAM,EAAE;QAAE,OAAO,MAAM,CAAC;IAElC,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC5B,MAAM,MAAM,GAAG,KAAK,GAAG,OAAO,CAAC;IAC/B,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACpC,2FAA2F;QAC3F,IAAI,GAAG,KAAK,iBAAiB,CAAC,OAAO,EAAE,EAAE,CAAC;YAAE,SAAS;QACrD,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,MAAM,IAAI,MAAM;YAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,CAAC,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC;IACtC,oGAAoG;IACpG,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAErE,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC,IAAI,oBAAoB,EAAE,CAAC;QAC3F,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,oBAAoB,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1F,8DAA8D;QAC9D,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC7B,KAAK,MAAM,EAAE,IAAI,MAAM;YAAE,IAAI,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAChC,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACvC,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,iBAAiB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;QACjE,oFAAoF;QACpF,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QACtC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;OASG;IACH,MAAM,aAAa,GAAG,KAAK,EAAE,IAAuB,EAAiB,EAAE;QACrE,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,CAAC,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YACxE,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC;YACjC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC;YAC5B,OAAO,CAAC,KAAK,CACX,kCAAkC,OAAO,YAAY,MAAM,CAAC,OAAO,qCAAqC;gBACtG,+BAA+B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,sCAAsC,CACjH,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,aAAa,CAAC,EAAE,CAAC,CAAC;QACxB,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,6FAA6F;IAC7F,IAAI,MAAM,MAAM,EAAE;QAAE,OAAO,MAAM,CAAC;IAClC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,iBAAiB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC3C,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACd,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtB,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;IACD,gGAAgG;IAChG,0EAA0E;IAC1E,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;IAC1B,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/check-tally.d.ts

@@ -0,0 +1,89 @@
+/**
+ * Did the operation ask? (#2387)
+ *
+ * Every operation checks a permission: its first line is `assertAllowed(await ctx.check(PERM))`.
+ * The gates around that rule read declarations — `lint:permissions` the surface,
+ * `entityCheckConformanceSuite` an operation that declares `{ key, entity, idFrom }`. None of them
+ * sees an operation that declares a bare scope-wide key and whose handler checks nothing, because
+ * no declaration tells it apart from a correct one, and a static read of the handler cannot
+ * follow the check into the helper it usually delegates to.
+ *
+ * The host can see it directly. It builds one context per invocation, and every check goes
+ * through that context's `check`. So each adapter counts the calls on it ({@link countChecks}),
+ * and when the handler returns having made none, the host writes a line saying so
+ * ({@link noteUncheckedCompletion}).
+ *
+ * ## What counts as a check
+ *
+ * A CALL, not a pass. A refused check counts, so does one the handler caught, and so does one
+ * that threw (a malformed key): each is the operation asking, which is the whole question. A
+ * check made inside a helper, an engine function or a kernel verb (`ctx.grant` re-checks the
+ * caller's own decision, `ctx.archive` checks the declared key) counts too, because it went
+ * through the same `ctx.check`.
+ *
+ * Only checks made while the HANDLER runs count: each adapter resets the tally just before it
+ * calls the handler. A guard (K-17) runs on the same context first, and may ask any key it likes
+ * without asserting it, so its check says nothing about the handler. The host's trashed-target
+ * refusal also checks before the handler, but it always ends the invocation when it does, so the
+ * handler never runs behind it.
+ *
+ * The tally is the context's, and a context belongs to one invocation, so two invocations in one
+ * request are counted apart.
+ *
+ * ## Which operations are held to it
+ *
+ * Those that declare a `permission` and whose handler is authored (`checkHeldOperationsOf`): a
+ * declared key is a promise that the handler asks for it. Left out, each for a reason the
+ * declaration states:
+ *
+ * - a **derived** handler (#1773) — the kernel wrote it from the declaration, check included;
+ * - a **`narrows`** walk — it checks row by row, so a walk over nothing asks nothing and is right
+ *   to. `narrows: { reason, checks: [], unchecked: true }` is the one way to declare an operation
+ *   that checks nothing at all; the reason is required and the conformance receipt lists it;
+ * - a module bound with **`undeclaredOperations`** — it declares no key, so it promised none.
+ *
+ * ## Recorded, and refused only where a test asks
+ *
+ * The line is a `warn` through the context's own `ctx.log`, so it carries the tenant, scope,
+ * operation and invocation every other line does and lands wherever the host sends them. Its
+ * template is a constant, so every such line groups into one pattern. In production that is all
+ * it does: no error, no rollback.
+ *
+ * A node test run can turn it into a refusal: `tools/vitest/unchecked-operations.cjs`, preloaded
+ * by the root `pnpm test` and CI's test step beside the LIKE and SQL-limit preloads, sets
+ * {@link REFUSE_UNCHECKED_OPERATIONS_KEY}, and the operation then throws {@link UncheckedOperation}
+ * after the line is written, so it rolls back like any other failure. That makes every scenario
+ * suite the gate, without a production scope failing over a diagnostic.
+ */
+import type { OperationContext } from './scope-host.js';
+/** How many checks one invocation's context has been asked for. */
+export interface CheckTally {
+    calls: number;
+}
+/**
+ * The context's `check`, counted. The count moves BEFORE the check runs, so a check that throws
+ * or is refused is still one the operation made.
+ */
+export declare function countChecks(check: OperationContext['check'], tally: CheckTally): OperationContext['check'];
+/** The template of the line — constant, so every one of them is the same pattern. */
+export declare const UNCHECKED_OPERATION_TEMPLATE = "operation completed without a permission check";
+/** The `finding` field on that line, for a reader filtering on fields rather than templates. */
+export declare const UNCHECKED_OPERATION_FINDING = "unchecked-operation";
+/**
+ * The registered key a test run sets on `globalThis` to have an unchecked completion refused
+ * instead of only recorded. Registered, so the copy of the kernel an adapter bundled reads the
+ * flag the preload set.
+ */
+export declare const REFUSE_UNCHECKED_OPERATIONS_KEY = "substrat.refuseUncheckedOperations";
+/** An operation held to a check completed without one, under a run that refuses it. */
+export declare class UncheckedOperation extends Error {
+    readonly operation: string;
+    constructor(operation: string);
+}
+/**
+ * Called once, right after the handler returns. Writes the line when an operation `held` to a
+ * check made none, and throws {@link UncheckedOperation} after it when the run refuses them.
+ * Returns whether a line was written.
+ */
+export declare function noteUncheckedCompletion(ctx: OperationContext, operation: string, tally: CheckTally, held: boolean): boolean;
+//# sourceMappingURL=check-tally.d.ts.map

package/dist/check-tally.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-tally.d.ts","sourceRoot":"","sources":["../src/check-tally.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAExD,mEAAmE;AACnE,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,UAAU,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAK1G;AAED,qFAAqF;AACrF,eAAO,MAAM,4BAA4B,mDAAmD,CAAC;AAE7F,gGAAgG;AAChG,eAAO,MAAM,2BAA2B,wBAAwB,CAAC;AAEjE;;;;GAIG;AACH,eAAO,MAAM,+BAA+B,uCAAuC,CAAC;AAMpF,uFAAuF;AACvF,qBAAa,kBAAmB,SAAQ,KAAK;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM;IAAtC,YAAqB,SAAS,EAAE,MAAM,EAOrC;CACF;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,gBAAgB,EACrB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,UAAU,EACjB,IAAI,EAAE,OAAO,GACZ,OAAO,CAKT"}

package/dist/check-tally.js

@@ -0,0 +1,48 @@
+/**
+ * The context's `check`, counted. The count moves BEFORE the check runs, so a check that throws
+ * or is refused is still one the operation made.
+ */
+export function countChecks(check, tally) {
+    return (permission, entity) => {
+        tally.calls += 1;
+        return check(permission, entity);
+    };
+}
+/** The template of the line — constant, so every one of them is the same pattern. */
+export const UNCHECKED_OPERATION_TEMPLATE = 'operation completed without a permission check';
+/** The `finding` field on that line, for a reader filtering on fields rather than templates. */
+export const UNCHECKED_OPERATION_FINDING = 'unchecked-operation';
+/**
+ * The registered key a test run sets on `globalThis` to have an unchecked completion refused
+ * instead of only recorded. Registered, so the copy of the kernel an adapter bundled reads the
+ * flag the preload set.
+ */
+export const REFUSE_UNCHECKED_OPERATIONS_KEY = 'substrat.refuseUncheckedOperations';
+function refusing() {
+    return globalThis[Symbol.for(REFUSE_UNCHECKED_OPERATIONS_KEY)] === true;
+}
+/** An operation held to a check completed without one, under a run that refuses it. */
+export class UncheckedOperation extends Error {
+    operation;
+    constructor(operation) {
+        super(`${operation} declares a permission but its handler returned without calling ctx.check — ` +
+            'check the declared key, or declare `narrows: { reason, checks: [], unchecked: true }` if it ' +
+            'deliberately checks nothing');
+        this.operation = operation;
+        this.name = 'UncheckedOperation';
+    }
+}
+/**
+ * Called once, right after the handler returns. Writes the line when an operation `held` to a
+ * check made none, and throws {@link UncheckedOperation} after it when the run refuses them.
+ * Returns whether a line was written.
+ */
+export function noteUncheckedCompletion(ctx, operation, tally, held) {
+    if (!held || tally.calls > 0)
+        return false;
+    ctx.log.warn(UNCHECKED_OPERATION_TEMPLATE, { finding: UNCHECKED_OPERATION_FINDING });
+    if (refusing())
+        throw new UncheckedOperation(operation);
+    return true;
+}
+//# sourceMappingURL=check-tally.js.map

package/dist/check-tally.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-tally.js","sourceRoot":"","sources":["../src/check-tally.ts"],"names":[],"mappings":"AAgEA;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,KAAgC,EAAE,KAAiB;IAC7E,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE;QAC5B,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;QACjB,OAAO,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,MAAM,4BAA4B,GAAG,gDAAgD,CAAC;AAE7F,gGAAgG;AAChG,MAAM,CAAC,MAAM,2BAA2B,GAAG,qBAAqB,CAAC;AAEjE;;;;GAIG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,oCAAoC,CAAC;AAEpF,SAAS,QAAQ;IACf,OAAQ,UAAsC,CAAC,MAAM,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC,KAAK,IAAI,CAAC;AACvG,CAAC;AAED,uFAAuF;AACvF,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IACtB,SAAS;IAA9B,YAAqB,SAAiB;QACpC,KAAK,CACH,GAAG,SAAS,8EAA8E;YACxF,8FAA8F;YAC9F,6BAA6B,CAChC,CAAC;yBALiB,SAAS;QAM5B,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CACrC,GAAqB,EACrB,SAAiB,EACjB,KAAiB,EACjB,IAAa;IAEb,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC,CAAC;IACrF,IAAI,QAAQ,EAAE;QAAE,MAAM,IAAI,kBAAkB,CAAC,SAAS,CAAC,CAAC;IACxD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/index.d.ts

@@ -9,7 +9,8 @@ export type { OutcomeEventStamp, PlatformRequestSettle } from './email-intent.js
 export type { MailAddress, MailSender, MailSendResult, OutboundMail, OutboundMailAttachment, } from './mail-sender.js';
 export { COPY_CLAIM_SQL, COPY_RESTORE_FENCE_LAPSED, copyRestoreFence, copyRestoreFenceLapsed, type CopyRestoreFence, BACKFILL_MOVE_ID, COPY_BACKFILL_SCOPE_SQL, COPY_BACKFILL_SQL, COPY_BACKFILL_SUPERSEDE_SQL, copyBackfillParams, copyBackfillRefusal, type ScopeCopyBackfillResult, type CopyBackfillScopeRow, type ErasureEpochStamp, SUBJECT_ERASURE_CLAIM_SQL, subjectErasureClaimParams, type SubjectErasureFence, COPY_EXPIRED_SQL, COPY_MOVE_CONFIRM_SQL, COPY_MOVE_LIVE_PREDICATE, SCOPE_SCRIPT_COPY_COLUMNS, copyMoveConfirmParams, copyMoveLiveParams, scopeScriptCopyOf, type ScopeScriptCopyRow, } from './scope-copy-ledger.js';
 export { SCOPE_COPY_LEASE_MS, assertRedrainWindow, attachmentBlobKey, attachmentSha256, consumersFor, entitlementDenial, requiredEntitlementFor, backoffAt, globalFetch, executorOutcomeOf, parseValidationRecords, resolveRetryPolicy, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, SWEEP_RUNS_INTENT_INDEX, sweepRunsIntentHasKind, ISSUE_RETENTION_DAYS, telemetryRetentionStatements, assertRowLimit, assertRowOffset, EMITTED_REPORT_CAP, isUpgradeRequest, isVouchedWithin, vouchedWithin, type VouchedWithin, checkedWithin, isCheckedWithin, type CheckedWithin, } from './scope-host.js';
-export { assertBoundOperations, operationsFor, undeclaredOperations, type BoundOperations, type HandlerMap, } from './module-operations.js';
+export { assertBoundOperations, checkHeldOperationsOf, operationsFor, undeclaredOperations, type BoundOperations, type HandlerMap, } from './module-operations.js';
+export { countChecks, noteUncheckedCompletion, REFUSE_UNCHECKED_OPERATIONS_KEY, UncheckedOperation, UNCHECKED_OPERATION_FINDING, UNCHECKED_OPERATION_TEMPLATE, type CheckTally, } from './check-tally.js';
 export { isSecretBoxConfigured, SecretBoxUnconfiguredError, unconfiguredSecretBox, webCryptoSecretBox, } from './secret-box.js';
 export type { SealedSecret, SecretBox } from './secret-box.js';
 export { visibleContinuation, CONTINUATION_POSITION_CAP } from './visible-continuation.js';
@@ -45,7 +46,7 @@ export { createAtomic } from './sub-transaction.js';
 export type { RunSub, AtomicMarks } from './sub-transaction.js';
 export { DEFAULT_SEARCH_LIMIT, MAX_SEARCH_LIMIT, NotSearchable, SearchTermTooShort, isSearchIndexTable, searchIndexMigrations, searchIndexPlans, searchLimit, searchMatchExpression, searchQuery, } from './search-index.js';
 export type { SearchHit, SearchIndexPlan, SearchOptions, SearchTokenizer, SearchableDeclaration, } from './search-index.js';
-export { ATTACHMENT_CONDEMNED, ATTACHMENT_CONDEMNED_DDL, ORPHAN_SWEEP_FENCE_MS, ORPHAN_SWEEP_GRACE_MS, SETTLED_COPY_STATES, attachmentSweepFenceKey, condemnOrphanAttachments, fenceAttachmentSweep, refuseCondemnedAttachment, refuseCondemnedInDump, rowlessAttachmentIds, sweepOrphanAttachments, unsettledCopyRefusal, missingAttachmentStore, orphanSweepVersionRefusal, } from './attachment-sweep.js';
+export { ATTACHMENT_CONDEMNED, ATTACHMENT_CONDEMNED_DDL, ATTACHMENT_SWEEP_LICENCE_DDL, ATTACHMENT_SWEEP_LICENCE_TABLE, ORPHAN_SWEEP_LICENCE_CAP, ORPHAN_SWEEP_UNLICENSED, clearOrphanSweepLicence, condemnLicensedOrphanAttachments, consumeOrphanSweepLicence, licensedOrphanIds, orphanSweepLicensedAt, recordOrphanSweepLicence, refuseUnlicensedOrphanSweep, ORPHAN_SWEEP_FENCE_MS, ORPHAN_SWEEP_GRACE_MS, SETTLED_COPY_STATES, attachmentSweepFenceKey, condemnOrphanAttachments, fenceAttachmentSweep, refuseCondemnedAttachment, refuseCondemnedInDump, rowlessAttachmentIds, sweepOrphanAttachments, unsettledCopyRefusal, missingAttachmentStore, orphanSweepVersionRefusal, } from './attachment-sweep.js';
 export type { OrphanSweepOptions, OrphanSweepReport, OrphanSweepRequest, OrphanSweepScope } from './attachment-sweep.js';
 export { ATTACHMENT_SEARCH_OWNER_MAX, ATTACHMENT_SEARCH_OWNERS_SQL, ATTACHMENT_SEARCH_SQL, ATTACHMENT_SEARCH_TOO_MANY_OWNERS, ATTACHMENT_TEXT_BACKFILL_BATCH, ATTACHMENT_TEXT_BACKFILL_JOB, ATTACHMENT_TEXT_DDL, ATTACHMENT_TEXT_JOB, ATTACHMENT_TEXT_MODULE, assertJobRegistrable, attachmentRecordOfRow, attachmentTextBackfillJob, attachmentTextJob, enqueueAttachmentText, kernelJobFor, queueAttachmentTextBackfill, readAttachmentText, reconcileAttachmentText, recordAttachmentText, searchAttachments, startAttachmentTextBackfill, } from './attachment-text.js';
 export type { AttachmentRowShape, AttachmentTextBackfillBatch, KernelJobHandlers, AttachmentSearchGate, AttachmentTextSource, AttachmentTextState, AttachmentTextStatus, } from './attachment-text.js';