@substrat-run/kernel 0.158.0 → 0.160.0

package/dist/reserved-roles.js

@@ -21,13 +21,22 @@ import { reservedKeysOf } from '@substrat-run/contracts';
  *   admitted only when its stored holder is `system`. A legacy row with no holder keeps the
  *   old key-only behavior until its definition is written again.
  *
- * Never asked on a provisioning seat or the owner hand-over, and nothing already held is revoked:
- * a seat that exists keeps working whatever a later engine declares.
+ * A person's door also refuses a role whose stored holder is `system` (#2447), whatever this host
+ * knows: the holder a role definition carries is the reservation delivered with the role, so a
+ * host that registers no module (and so reserves nothing) still keeps a system-held role from a
+ * person. The provisioning owner seat and the owner hand-over are person doors too (#2447).
+ *
+ * Nothing already held is revoked: a seat that exists keeps working whatever a later engine
+ * declares. A refusal is of the write it was asked for, and writes nothing.
  *
  * The person's refusal is also `canAssign`'s, which is the bound on taking a role away as well as
  * on giving it, so it is worded for both: no person's bound covers such a role.
  */
 export function reservedRoleRefusal(role, reserved, door) {
+    if (door === 'person' && role.holder === 'system') {
+        return (`role '${role.key}' is declared holder: 'system', a role for a system principal: no person's bound covers it, to ` +
+            `give the role or to take it back (K-55)`);
+    }
     const held = role.permissions.filter((p) => reserved.has(p));
     if (held.length === 0)
         return null;
@@ -48,6 +57,206 @@ export function reservedRoleRefusal(role, reserved, door) {
     return (`role '${role.key}' holds ${keys}, reserved to a system principal, beside ${others.join(', ')}: a role carries ` +
         `a reserved key only when every key it holds is one (a system-held role, K-55)`);
 }
+/**
+ * Why `role` may not be DEFINED for a tenant whose roles are stored as `tenantRoles`, or null (#2447):
+ * the write a role definition makes, judged before it is made, so a role that passed a door when
+ * it was assigned cannot be widened afterwards with a key no person may hold. `tenantRoles` is
+ * what the host stores for the tenant now, the definition this one replaces included; `seated`
+ * says whether anyone but a system principal holds a live seat in the role's key, whether or not a
+ * definition of it is stored
+ * (`SCOPE_SEATED_ROLES_SQL`, `TENANT_SEATED_ROLES_SQL`).
+ *
+ * The keys judged reserved are the host's, plus every key one of the tenant's system-held roles
+ * holds: K-55 lets a system-held role hold reserved keys only, so its keys are reserved, and the
+ * stored holder (#2444) is how a host that registers no modules learns the reservation at all. A
+ * key the host's own modules declare unmarked is a person's, whatever a stored role says.
+ *
+ * - **A first definition** of a key: a person's role (holder omitted or `person`) carrying a
+ *   reserved key is refused, and so is a system-held role carrying a key a person may hold (one
+ *   the host's modules declare unmarked, or one a person's role of the tenant holds).
+ * - **A redefinition** is judged as that new definition, against the stored roles, so a key added
+ *   to a role whose seats were made through a person's door meets the person's rule.
+ * - **A stored system-held role redefined as a person's** is judged as a person's role with the
+ *   stored role's keys counted as reserved: the stored holder is the evidence, and a redefinition
+ *   does not erase it.
+ * - **A system-held definition of a key anyone but a system principal holds a seat in** is refused
+ *   unless a system-held definition is stored for it. What kind of principal holds a seat is not
+ *   recorded, so a seat made before any definition, under a person's definition, or under one a
+ *   projection since dropped may be a person's, and relabelling the role would make it a system
+ *   principal's. A K-55 host principal's seat in a system-held role a release dropped and a later
+ *   one adds back cannot be told apart from that, so it is refused too. Taking the seats back first, or defining a new key, is the
+ *   way. The seats decide for a role stored before the holder was recorded (#2480: no holder) too:
+ *   it may be declared `holder: 'system'` only while nobody but a system principal holds a seat in
+ *   it, since an upgrade admitted beside such a seat would let a later system-held definition add
+ *   keys to it.
+ *
+ * **A key the host knows nothing about is admitted, deliberately (fail-open).** A host judges only
+ * the reservations of modules it knows and of the tenant's system-held roles. Refusing every key it
+ * cannot place would refuse every role a module-less host is given; the push (`substrat push`, the
+ * registry boundary) is where the vertical's whole surface is judged. So a key reserved only
+ * through a schedule's `permissions`, which no system-held role of the tenant holds, is not caught
+ * on a host that does not register its module (the control plane verifying a pushed registry's
+ * marks is #2446).
+ *
+ * A refusal writes nothing, and so revokes nothing: a seat of the role as it was stored keeps
+ * working. A definition is never refused for a key it takes out, only for what it still holds.
+ */
+export function reservedRoleDefinitionRefusal(role, host, tenantRoles, seated = false) {
+    const stored = tenantRoles.find((r) => r.key === role.key);
+    const others = tenantRoles.filter((r) => r.key !== role.key);
+    const personKey = (p) => host.declared.has(p) && !host.reserved.has(p);
+    const bySystemRole = new Map();
+    for (const r of others)
+        if (r.holder === 'system')
+            for (const p of r.permissions)
+                if (!bySystemRole.has(p))
+                    bySystemRole.set(p, `the system-held role '${r.key}'`);
+    if (role.holder === 'system') {
+        // Judged against the seats of the key, whether or not a definition is stored: a projection can
+        // drop a role's row and leave its seats live, and a later definition must not relabel them.
+        // A row stored before the holder was recorded (#2480) is no exception: an upgrade admitted beside
+        // a person's seat would leave a system-held row a later definition widens unjudged by its seats.
+        if (stored?.holder !== 'system' && seated) {
+            return (`role '${role.key}' is held by a principal (${storedAs(stored)}), so it cannot be declared holder: 'system': what kind ` +
+                `of principal holds a seat is not recorded, so the seat may be a person\'s. Take that seat back first, wherever it is ` +
+                `held (a scope, or the tenant; a host principal\'s seat can be given again after), keep the role defined across ` +
+                `releases, or define the system-held role under a new key (K-55)`);
+        }
+        const personsKeys = new Map();
+        for (const r of others)
+            if (r.holder !== 'system')
+                for (const p of r.permissions)
+                    if (!personsKeys.has(p))
+                        personsKeys.set(p, r.key);
+        const offences = role.permissions.flatMap((p) => {
+            if (host.reserved.has(p))
+                return [];
+            if (host.declared.has(p))
+                return [`${p} (declared for a person by a module this host registers)`];
+            const holder = personsKeys.get(p);
+            return holder ? [`${p} (held by the person's role '${holder}')`] : [];
+        });
+        if (offences.length === 0)
+            return null;
+        return (`role '${role.key}' is declared holder: 'system' but holds ${offences.join(', ')}: a system-held role holds only ` +
+            `keys reserved to a system principal (K-55)`);
+    }
+    // The stored system-held definition this one replaces is evidence too: its keys are reserved.
+    if (stored?.holder === 'system')
+        for (const p of stored.permissions)
+            if (!bySystemRole.has(p))
+                bySystemRole.set(p, `its stored system-held definition`);
+    const held = role.permissions.flatMap((p) => {
+        if (host.reserved.has(p))
+            return [`${p} (${RESERVED_BY})`];
+        if (personKey(p))
+            return [];
+        const by = bySystemRole.get(p);
+        return by ? [`${p} (held by ${by})`] : [];
+    });
+    if (held.length === 0)
+        return null;
+    return (`role '${role.key}' is a person's role and would hold ${held.join(', ')}, reserved to a system principal: take the key ` +
+        `out, or declare a role made only of reserved keys holder: 'system' (K-55)`);
+}
+/** How the seated-key refusal names the stored row of the key, so it says only what is true of it. */
+function storedAs(stored) {
+    if (!stored)
+        return 'with no definition stored';
+    if (stored.holder === undefined)
+        return 'stored with no holder, from before holders were recorded (#2480)';
+    return "stored as a person's role";
+}
+/**
+ * `reservedRoleDefinitionRefusal` over a whole role set defined at once (a provision's or a
+ * restore's projection, which replaces the tenant's roles in a scope): each role judged against the
+ * rest of the set and the definition of its own key stored there now (`stored`), with its seats.
+ * The first refusal, or null.
+ */
+export function reservedRoleSetRefusal(roles, host, stored) {
+    for (const role of roles) {
+        const own = stored?.roles.find((r) => r.key === role.key);
+        const tenantRoles = [...roles.filter((r) => r.key !== role.key), ...(own ? [own] : [])];
+        const refusal = reservedRoleDefinitionRefusal(role, host, tenantRoles, stored?.seated.has(role.key) ?? false);
+        if (refusal)
+            return refusal;
+    }
+    return null;
+}
+/**
+ * #2446: the reservations a pushed registry's rows mark — `reserved`, every key marked
+ * `holder: 'system'`; `declared`, every key it lists. The push boundary holds those marks to the
+ * module declarations shipped beside them (`pushedModuleRegistryProblems`), so they are what the
+ * incoming version's modules reserve and declare, the reservation its reconcile judges with.
+ */
+export function registryReservations(registry) {
+    return {
+        reserved: new Set(registry.permissions.filter((p) => p.holder === 'system').map((p) => p.key)),
+        declared: new Set(registry.permissions.map((p) => p.key)),
+    };
+}
+/**
+ * #2446: why a release's role set would be refused where a scope stores `state`, or null: the
+ * question that scope's reconcile asks (`reservedRoleSetRefusal`, with the incoming version's
+ * reservations), asked before a promote moves it. A promote that would hold a seated scope's
+ * reconcile is refused instead.
+ */
+export function releaseRoleSetRefusal(registry, state) {
+    return reservedRoleSetRefusal(registry.roles, registryReservations(registry), { roles: state.roles, seated: new Set(state.seated) });
+}
+/**
+ * #2446: whether a release's role set can be refused by any scope's stored state, so its promote
+ * must ask the scopes it moves. A system-held role meets the seat rule and the stored definitions
+ * (`reservedRoleDefinitionRefusal`). A person's role is judged against stored state only for a key
+ * its registry does not declare: every declared key is a reserved one, refused at push, or a
+ * person's, which no stored row overrides. A release with neither asks no scope.
+ */
+export function releaseRolesAskScopes(registry) {
+    const declared = new Set(registry.permissions.map((p) => p.key));
+    return registry.roles.some((r) => r.holder === 'system' || r.permissions.some((p) => !declared.has(p)));
+}
+/**
+ * #2447: the role keys a scope's own tuples seat anyone but a system principal in, live now — what
+ * a role set defined on the scope is judged against. One parameter: now (ISO text).
+ */
+export const SCOPE_SEATED_ROLES_SQL = "SELECT DISTINCT substr(relation, 6) AS role_key FROM _substrat_tuples WHERE relation LIKE 'role:%' AND subject NOT LIKE 'system:%' AND revoked_at IS NULL AND (expires_at IS NULL OR expires_at > ?)";
+/**
+ * #2447: what a scope dump stores for a tenant's roles, and the role keys anyone but a system
+ * principal holds a live scope-level seat in there — `SCOPE_SEATED_ROLES_SQL`'s reading, over a dump's
+ * rows instead of a table. A dump's projected tenant-level tuples are not seats here: the repair a
+ * restore runs projects none, so they do not survive it, and the tenant's own seats are the
+ * directory's. A restore judges the role set its repair defines against it before it imports the dump.
+ */
+export function dumpRoleState(tables, tenantId, now) {
+    const read = (name) => {
+        const t = tables.find((x) => x.name === name);
+        return t ? t.rows.map((r) => Object.fromEntries(t.columns.map((c, i) => [c, r[i]]))) : [];
+    };
+    const live = (r) => r.revoked_at == null && (r.expires_at == null || String(r.expires_at) > now);
+    const roles = read('_substrat_roles')
+        .filter((r) => r.tenant_id === tenantId && r.revoked_at == null)
+        .map((r) => ({
+        key: String(r.role_key),
+        permissions: JSON.parse(String(r.permissions)),
+        ...(r.holder === 'person' || r.holder === 'system' ? { holder: r.holder } : {}),
+    }));
+    const seats = read('_substrat_tuples');
+    const seated = new Set(seats
+        .filter((r) => String(r.relation).startsWith('role:') && !String(r.subject).startsWith('system:') && live(r))
+        .map((r) => String(r.relation).slice('role:'.length)));
+    return { roles, seated };
+}
+/**
+ * #2447: the scope statuses whose seats count as held when a role definition is judged: every one
+ * but `reaped` (whose storage is gone), a scope archived straight from `provisioning` included: it
+ * can hold a seat (the platform's door seats into a provisioning scope), and unarchive brings it back.
+ * Each adapter reads such a scope without creating storage it never had, and where it cannot, fails
+ * closed. An archived scope comes back on unarchive with its seats, so
+ * a definition judged without them would relabel those seats; both adapters read this one list.
+ */
+export const SEAT_HOLDING_SCOPE_STATUSES = ['provisioning', 'active', 'suspended', 'archiving', 'archived'];
+/** #2447: `SCOPE_SEATED_ROLES_SQL` for a tenant's tenant-level tuples. Parameters: tenantId, now. */
+export const TENANT_SEATED_ROLES_SQL = "SELECT DISTINCT substr(relation, 6) AS role_key FROM _substrat_tenant_tuples WHERE tenant_id = ? AND relation LIKE 'role:%' AND subject NOT LIKE 'system:%' AND revoked_at IS NULL AND (expires_at IS NULL OR expires_at > ?)";
 /**
  * Why `permissions` may not be granted directly to a principal, an org or a connection, or null
  * (#2430): a raw grant (`HostAdmin.grant`, `grantToOrg`, `grantEntityShape`, `ctx.grant`) names a
@@ -91,6 +300,11 @@ export function noteReservedKeys(reserved, manifest) {
     for (const key of reservedKeysOf([{ manifest: { id: manifest.id, permissions: manifest.permissions ?? [] } }]).keys())
         reserved.add(key);
 }
+/** #2447: add every key `manifest` declares, marked or not, to a host's `declared` set (`HostReservations`). */
+export function noteDeclaredKeys(declared, manifest) {
+    for (const p of manifest.permissions ?? [])
+        declared.add(p.key);
+}
 /**
  * A host given its vertical's `permissions` refuses to register a module that list leaves out
  * (#2430). Every check `lint:permissions` and `substrat push` make reads that list, so a module

package/dist/reserved-roles.js.map

@@ -1 +1 @@
-{"version":3,"file":"reserved-roles.js","sourceRoot":"","sources":["../src/reserved-roles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAA0B,MAAM,yBAAyB,CAAC;AAEjF;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAmF,EACnF,QAA6B,EAC7B,IAA2B;IAE3B,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO,CACL,SAAS,IAAI,CAAC,GAAG,WAAW,IAAI,yEAAyE;YACzG,gCAAgC,WAAW,GAAG,CAC/C,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,6EAA6E;QAC7E,0EAA0E;QAC1E,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACpD,OAAO,SAAS,IAAI,CAAC,GAAG,WAAW,IAAI,gIAAgI,CAAC;QAC1K,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,CACL,SAAS,IAAI,CAAC,GAAG,WAAW,IAAI,4CAA4C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB;QAChH,+EAA+E,CAChF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAA8B,EAAE,QAA6B;IAChG,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,8FAA8F,WAAW,GAAG,CAAC;AACxI,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAyE,EACzE,QAA6B;IAE7B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAClE,IAAI,OAAO;YAAE,OAAO,6BAA6B,KAAK,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;IAClF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,WAAW,GAAG,iIAAiI,CAAC;AAEtJ;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAqB,EAAE,QAA0B;IAChF,KAAK,MAAM,GAAG,IAAI,cAAc,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;QAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC3I,CAAC;AAeD;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAA4C,EAAE,QAAgB;IACjG,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,QAAQ,CAAC;QAAE,OAAO;IACxF,MAAM,IAAI,KAAK,CACb,mBAAmB,QAAQ,oFAAoF;QAC7G,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,WAAW,8BAA8B;QACxG,mGAAmG;QACnG,wEAAwE,CAC3E,CAAC;AACJ,CAAC"}
+{"version":3,"file":"reserved-roles.js","sourceRoot":"","sources":["../src/reserved-roles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAA0B,MAAM,yBAAyB,CAAC;AAEjF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAe,EACf,QAA6B,EAC7B,IAA2B;IAE3B,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClD,OAAO,CACL,SAAS,IAAI,CAAC,GAAG,iGAAiG;YAClH,yCAAyC,CAC1C,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO,CACL,SAAS,IAAI,CAAC,GAAG,WAAW,IAAI,yEAAyE;YACzG,gCAAgC,WAAW,GAAG,CAC/C,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,6EAA6E;QAC7E,0EAA0E;QAC1E,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACpD,OAAO,SAAS,IAAI,CAAC,GAAG,WAAW,IAAI,gIAAgI,CAAC;QAC1K,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,CACL,SAAS,IAAI,CAAC,GAAG,WAAW,IAAI,4CAA4C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB;QAChH,+EAA+E,CAChF,CAAC;AACJ,CAAC;AAmBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,MAAM,UAAU,6BAA6B,CAC3C,IAAe,EACf,IAAsB,EACtB,WAAiC,EACjC,MAAM,GAAG,KAAK;IAEd,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC/E,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,MAAM;QAAE,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ;YAAE,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW;gBAAE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;oBAAE,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,yBAAyB,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;IACnK,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC7B,+FAA+F;QAC/F,4FAA4F;QAC5F,kGAAkG;QAClG,iGAAiG;QACjG,IAAI,MAAM,EAAE,MAAM,KAAK,QAAQ,IAAI,MAAM,EAAE,CAAC;YAC1C,OAAO,CACL,SAAS,IAAI,CAAC,GAAG,6BAA6B,QAAQ,CAAC,MAAM,CAAC,0DAA0D;gBACxH,uHAAuH;gBACvH,iHAAiH;gBACjH,iEAAiE,CAClE,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC9C,KAAK,MAAM,CAAC,IAAI,MAAM;YAAE,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ;gBAAE,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW;oBAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;wBAAE,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACrI,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;YAC9C,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,OAAO,EAAE,CAAC;YACpC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAC;YAClG,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAClC,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,gCAAgC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,CAAC,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACvC,OAAO,CACL,SAAS,IAAI,CAAC,GAAG,4CAA4C,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,kCAAkC;YAClH,4CAA4C,CAC7C,CAAC;IACJ,CAAC;IACD,8FAA8F;IAC9F,IAAI,MAAM,EAAE,MAAM,KAAK,QAAQ;QAAE,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,WAAW;YAAE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,mCAAmC,CAAC,CAAC;IACxJ,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;QAC1C,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,KAAK,WAAW,GAAG,CAAC,CAAC;QAC3D,IAAI,SAAS,CAAC,CAAC,CAAC;YAAE,OAAO,EAAE,CAAC;QAC5B,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC/B,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5C,CAAC,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,CACL,SAAS,IAAI,CAAC,GAAG,uCAAuC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,iDAAiD;QACxH,2EAA2E,CAC5E,CAAC;AACJ,CAAC;AAED,sGAAsG;AACtG,SAAS,QAAQ,CAAC,MAA6B;IAC7C,IAAI,CAAC,MAAM;QAAE,OAAO,2BAA2B,CAAC;IAChD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,kEAAkE,CAAC;IAC3G,OAAO,2BAA2B,CAAC;AACrC,CAAC;AASD;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAA2B,EAAE,IAAsB,EAAE,MAAoB;IAC9G,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1D,MAAM,WAAW,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACxF,MAAM,OAAO,GAAG,6BAA6B,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC;QAC9G,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;IAC9B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAYD;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAwE;IAC3G,OAAO;QACL,QAAQ,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC9F,QAAQ,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;KAC1D,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAqG,EACrG,KAAgB;IAEhB,OAAO,sBAAsB,CAAC,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AACvI,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAkF;IACtH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACjE,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1G,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GACjC,sMAAsM,CAAC;AASzM;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,MAA4B,EAAE,QAAgB,EAAE,GAAW;IACvF,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE;QAC5B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAC9C,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAA4B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvH,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,CAA0B,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC;IAC1H,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC;SAClC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,IAAI,IAAI,CAAC;SAC/D,GAAG,CAAC,CAAC,CAAC,EAAa,EAAE,CAAC,CAAC;QACtB,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;QACvB,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAa;QAC1D,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAA6B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvG,CAAC,CAAC,CAAC;IACN,MAAM,KAAK,GAAG,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,IAAI,GAAG,CACpB,KAAK;SACF,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;SAC5G,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CACxD,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,cAAc,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,CAAU,CAAC;AAErH,qGAAqG;AACrG,MAAM,CAAC,MAAM,uBAAuB,GAClC,+NAA+N,CAAC;AAElO;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAA8B,EAAE,QAA6B;IAChG,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,8FAA8F,WAAW,GAAG,CAAC;AACxI,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAyE,EACzE,QAA6B;IAE7B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAClE,IAAI,OAAO;YAAE,OAAO,6BAA6B,KAAK,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;IAClF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,WAAW,GAAG,iIAAiI,CAAC;AAEtJ;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAqB,EAAE,QAA0B;IAChF,KAAK,MAAM,GAAG,IAAI,cAAc,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;QAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC3I,CAAC;AAED,gHAAgH;AAChH,MAAM,UAAU,gBAAgB,CAAC,QAAqB,EAAE,QAA0B;IAChF,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,WAAW,IAAI,EAAE;QAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AAClE,CAAC;AAeD;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAA4C,EAAE,QAAgB;IACjG,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,QAAQ,CAAC;QAAE,OAAO;IACxF,MAAM,IAAI,KAAK,CACb,mBAAmB,QAAQ,oFAAoF;QAC7G,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,WAAW,8BAA8B;QACxG,mGAAmG;QACnG,wEAAwE,CAC3E,CAAC;AACJ,CAAC"}

package/dist/schedule-state.d.ts

@@ -92,5 +92,10 @@ export interface ScheduleSweepReport {
      * `ScheduleRunReport.platformRequests`. Absent when none did.
      */
     platformRequests?: number;
+    /**
+     * #2517: purge runs deferred to the next tick because the tick's earlier purges filled the queue,
+     * summed from each pass's `ScheduleRunReport.deferred`. Already counted in `skipped`. Absent when none.
+     */
+    deferred?: number;
 }
 //# sourceMappingURL=schedule-state.d.ts.map

package/dist/schedule-state.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schedule-state.d.ts","sourceRoot":"","sources":["../src/schedule-state.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,WAAW,CAAC;AAEzD;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,48EAqC9B,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,6FACsD,CAAC;AAE7F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,eAAO,MAAM,sBAAsB,QAclC,CAAC;AAEF;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,kEAAkE;IAClE,MAAM,EAAE,MAAM,CAAC;IACf,sDAAsD;IACtD,KAAK,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,OAAO,EAAE,MAAM,CAAC;IAChB,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B"}
+{"version":3,"file":"schedule-state.d.ts","sourceRoot":"","sources":["../src/schedule-state.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,WAAW,CAAC;AAEzD;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,48EAqC9B,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,6FACsD,CAAC;AAE7F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,eAAO,MAAM,sBAAsB,QAclC,CAAC;AAEF;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,kEAAkE;IAClE,MAAM,EAAE,MAAM,CAAC;IACf,sDAAsD;IACtD,KAAK,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,OAAO,EAAE,MAAM,CAAC;IAChB,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB"}