@substrat-run/kernel 0.159.0 → 0.160.0

package/dist/request-rollup.js

@@ -0,0 +1,273 @@
+import { requestDay, requestRollupDay, } from '@substrat-run/contracts';
+import { assertRowLimit } from './scope-host.js';
+import { assertUtcDay, pruneBillingDays, pushDayWindow, utcDayOf } from './billing-retention.js';
+/**
+ * The daily request rollup (#2501), as statements both adapters run against their directory:
+ * the SQLite host over better-sqlite3, the hosted one inside ControlPlaneDO. Written once so the
+ * two cannot keep different histories of the same fleet.
+ *
+ * The router writes one Analytics Engine datapoint per request it dispatches, and Analytics
+ * Engine keeps them three months, sampled under load. This keeps one row per (UTC day, tenant,
+ * vertical, scope) holding that day's count, so the history outlives the datapoints. The count
+ * is `sum(_sample_interval)` over the day's datapoints, an ESTIMATE: an exact counter at the
+ * router comes only when pricing uses requests as a unit (#39).
+ *
+ * `_substrat_request_day_reads` keeps one row per day the rollup tried: when, whether a read
+ * succeeded, and why the last one failed. A day is rolled up once a read succeeds and is never
+ * read again. A day without a successful read has no rows to say anything with, so the read row
+ * is what tells "no traffic" from "not rolled up yet". A failed attempt also carries the run of
+ * identical failures it belongs to (`failing_since`, `failing_count`), handed on from the attempt
+ * before it, because a day keeps only its last attempt and the run's start would be lost.
+ *
+ * `vertical` is `''` when a request resolved to no vertical: a primary key cannot hold a NULL
+ * that compares equal to itself. The read maps it back to null.
+ *
+ * Beside the total, each row keeps the split by status class and the 429s, from the status the
+ * router writes on each datapoint. Which of them a price counts is a later decision; once the
+ * datapoints age out the split could not be recovered, so it is kept now.
+ */
+export const REQUEST_ROLLUP_DDL = `
+  CREATE TABLE IF NOT EXISTS _substrat_request_days (
+    day TEXT NOT NULL,
+    tenant_id TEXT NOT NULL,
+    vertical TEXT NOT NULL,
+    scope_id TEXT NOT NULL,
+    requests INTEGER NOT NULL,
+    class2xx INTEGER NOT NULL,
+    class3xx INTEGER NOT NULL,
+    class4xx INTEGER NOT NULL,
+    class5xx INTEGER NOT NULL,
+    rate_limited INTEGER NOT NULL,
+    sampled INTEGER NOT NULL,
+    PRIMARY KEY (day, tenant_id, vertical, scope_id)
+  );
+  CREATE INDEX IF NOT EXISTS _substrat_request_days_tenant ON _substrat_request_days (tenant_id, day);
+  CREATE TABLE IF NOT EXISTS _substrat_request_day_reads (
+    day TEXT PRIMARY KEY,
+    attempted_at TEXT NOT NULL,
+    read_at TEXT,
+    row_count INTEGER,
+    error TEXT,
+    saturated INTEGER NOT NULL DEFAULT 0,
+    failing_since TEXT,
+    failing_count INTEGER
+  );
+`;
+/**
+ * What a reader throws when a day holds more (tenant, vertical, scope) groups than one query may
+ * answer: the answer would be part of the day, so it is refused. A saturated day is a standing
+ * state rather than a failure. It is recorded as such (`saturated` on the day's record), is not
+ * read again, and does not end the pass's reads, so the days after it are still rolled up.
+ * Recognised by its `saturated` flag rather than `instanceof`, so a copy of the kernel bundled
+ * elsewhere still matches.
+ */
+export class RequestRollupSaturated extends Error {
+    saturated = true;
+}
+/** Whether `err` is a `RequestRollupSaturated`. */
+export const isRequestRollupSaturated = (err) => typeof err === 'object' && err !== null && err.saturated === true;
+/**
+ * How many days back the rollup reaches: inside Analytics Engine's three months, with a margin,
+ * so the oldest day read is never one the store has started to age out.
+ */
+export const REQUEST_ROLLUP_LOOKBACK_DAYS = 85;
+/**
+ * The furthest back a lookback may reach. Analytics Engine keeps three months, which is 89 days
+ * when February is among them, and the first day read starts at midnight before `now − lookback`,
+ * up to a day earlier still. At 88 that first day starts within 89 days. A day the store has begun
+ * to age out would be read in part and recorded as whole, or as a day without traffic, and then
+ * never read again.
+ */
+export const REQUEST_ROLLUP_MAX_LOOKBACK_DAYS = 88;
+/** How long after a day ends it may be read, so the datapoints written at its last instant have landed. */
+export const REQUEST_ROLLUP_SETTLE_MS = 3_600_000;
+/** How long a day whose read failed waits before it is tried again. */
+export const REQUEST_ROLLUP_RETRY_MS = 3_600_000;
+/**
+ * How long one day's read may take before it counts as failed. A fleet-wide query over a day
+ * answers in seconds; this is the bound that keeps a stalled one from holding the pass.
+ */
+export const REQUEST_ROLLUP_READ_TIMEOUT_MS = 30_000;
+/** The most days one pass reads, one Analytics Engine query each. A first pass backfills over several. */
+export const REQUEST_ROLLUP_DAYS_PER_PASS = 7;
+/** How many rows one `pruneRequestDays` call deletes, by default. */
+export const REQUEST_ROLLUP_PRUNE_BATCH = 500;
+/** The most rows one `listRequestDays` call returns, and its default. */
+export const REQUEST_ROLLUP_LIMIT_MAX = 10_000;
+export const REQUEST_ROLLUP_LIMIT_DEFAULT = 1_000;
+const DAY_MS = 86_400_000;
+/**
+ * Record one attempt. A successful read replaces the day's rows with what it counted, in the
+ * caller's transaction, and marks the day read. A failed one records only the attempt and its
+ * error: the day's rows and its last successful read stay as they were.
+ *
+ * Every count is parsed before anything is written, so a malformed one (a tenant id that is not
+ * an id, a negative count) refuses the whole day rather than writing part of it. Returns how many
+ * rows were written.
+ */
+export function recordRequestDayRows(sql, input) {
+    const day = assertUtcDay('day', input.day);
+    const attemptedAt = new Date(input.attemptedAt).toISOString();
+    if ('error' in input) {
+        const saturated = input.saturated === true;
+        const since = saturated ? null : new Date(input.failingSince ?? attemptedAt).toISOString();
+        const count = saturated ? null : input.failingCount ?? 1;
+        if (count !== null && !(Number.isInteger(count) && count >= 1)) {
+            throw new Error(`failingCount must be a whole number, at least one, got ${String(count)}`);
+        }
+        sql(`INSERT INTO _substrat_request_day_reads
+         (day, attempted_at, read_at, row_count, error, saturated, failing_since, failing_count)
+       VALUES (?, ?, NULL, NULL, ?, ?, ?, ?)
+       ON CONFLICT (day) DO UPDATE SET
+         attempted_at = excluded.attempted_at, error = excluded.error, saturated = excluded.saturated,
+         failing_since = excluded.failing_since, failing_count = excluded.failing_count`, [day, attemptedAt, input.error || 'the read failed', saturated ? 1 : 0, since, count]);
+        return 0;
+    }
+    const rows = input.counts.map((c) => requestDay.parse({
+        day,
+        tenantId: c.tenantId,
+        vertical: c.vertical === '' ? null : c.vertical,
+        scopeId: c.scopeId,
+        requests: c.requests,
+        class2xx: c.class2xx,
+        class3xx: c.class3xx,
+        class4xx: c.class4xx,
+        class5xx: c.class5xx,
+        rateLimited: c.rateLimited,
+        sampled: c.sampled,
+        estimated: true,
+    }));
+    sql('DELETE FROM _substrat_request_days WHERE day = ?', [day]);
+    for (const r of rows) {
+        // Two counts for one key are one key's count: summed, never one dropped.
+        sql(`INSERT INTO _substrat_request_days
+         (day, tenant_id, vertical, scope_id, requests, class2xx, class3xx, class4xx, class5xx, rate_limited, sampled)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+       ON CONFLICT (day, tenant_id, vertical, scope_id) DO UPDATE SET
+         requests = _substrat_request_days.requests + excluded.requests,
+         class2xx = _substrat_request_days.class2xx + excluded.class2xx,
+         class3xx = _substrat_request_days.class3xx + excluded.class3xx,
+         class4xx = _substrat_request_days.class4xx + excluded.class4xx,
+         class5xx = _substrat_request_days.class5xx + excluded.class5xx,
+         rate_limited = _substrat_request_days.rate_limited + excluded.rate_limited,
+         sampled = MAX(_substrat_request_days.sampled, excluded.sampled)`, [
+            day,
+            r.tenantId,
+            r.vertical ?? '',
+            r.scopeId,
+            r.requests,
+            r.class2xx,
+            r.class3xx,
+            r.class4xx,
+            r.class5xx,
+            r.rateLimited,
+            r.sampled ? 1 : 0,
+        ]);
+    }
+    const written = sql('SELECT COUNT(*) AS n FROM _substrat_request_days WHERE day = ?', [day])[0]?.n ?? 0;
+    sql(`INSERT INTO _substrat_request_day_reads
+       (day, attempted_at, read_at, row_count, error, saturated, failing_since, failing_count)
+     VALUES (?, ?, ?, ?, NULL, 0, NULL, NULL)
+     ON CONFLICT (day) DO UPDATE SET
+       attempted_at = excluded.attempted_at, read_at = excluded.read_at, row_count = excluded.row_count,
+       error = NULL, saturated = 0, failing_since = NULL, failing_count = NULL`, [day, attemptedAt, attemptedAt, written]);
+    return written;
+}
+/** Read stored day counts — see `RequestDayFilter`. Every row is parsed on the way out. */
+export function listRequestDayRows(sql, filter = {}) {
+    const where = [];
+    const params = [];
+    if (filter.tenantId !== undefined) {
+        where.push('tenant_id = ?');
+        params.push(filter.tenantId);
+    }
+    if (filter.vertical !== undefined) {
+        where.push('vertical = ?');
+        params.push(filter.vertical);
+    }
+    if (filter.scopeId !== undefined) {
+        where.push('scope_id = ?');
+        params.push(filter.scopeId);
+    }
+    pushDayWindow(filter, where, params);
+    const limit = Math.min(assertRowLimit('limit', filter.limit ?? REQUEST_ROLLUP_LIMIT_DEFAULT), REQUEST_ROLLUP_LIMIT_MAX);
+    params.push(limit);
+    const rows = sql(`SELECT day, tenant_id, vertical, scope_id, requests, class2xx, class3xx, class4xx, class5xx, rate_limited, sampled
+       FROM _substrat_request_days
+      ${where.length ? `WHERE ${where.join(' AND ')}` : ''}
+      ORDER BY day, tenant_id, vertical, scope_id LIMIT ?`, params);
+    return rows.map((r) => requestDay.parse({
+        day: r.day,
+        tenantId: r.tenant_id,
+        vertical: r.vertical === '' ? null : r.vertical,
+        scopeId: r.scope_id,
+        requests: r.requests,
+        class2xx: r.class2xx,
+        class3xx: r.class3xx,
+        class4xx: r.class4xx,
+        class5xx: r.class5xx,
+        rateLimited: r.rate_limited,
+        sampled: r.sampled === 1,
+        estimated: true,
+    }));
+}
+/** The rollup's record of each day it tried, in day order — see `RequestRollupDayFilter`. */
+export function listRequestRollupDayRows(sql, filter = {}) {
+    const where = [];
+    const params = [];
+    pushDayWindow(filter, where, params);
+    const rows = sql(`SELECT day, attempted_at, read_at, row_count, error, saturated, failing_since, failing_count
+       FROM _substrat_request_day_reads
+      ${where.length ? `WHERE ${where.join(' AND ')}` : ''}
+      ORDER BY day`, params);
+    return rows.map((r) => requestRollupDay.parse({
+        day: r.day,
+        attemptedAt: r.attempted_at,
+        readAt: r.read_at,
+        rows: r.row_count,
+        error: r.error,
+        saturated: r.saturated === 1,
+        failingSince: r.failing_since,
+        failingCount: r.failing_count,
+    }));
+}
+/**
+ * Delete at most `limit` day rows older than a retention of `months`, oldest first, then the
+ * read rows of the days that are gone (`pruneBillingDays`). `months` null deletes nothing. A read
+ * row outlives a day still being pruned, so that day is not rolled up again in between. Returns
+ * how many day rows went.
+ */
+export function pruneRequestDayRows(sql, nowMs, limit, months) {
+    return pruneBillingDays(sql, { rows: '_substrat_request_days', records: '_substrat_request_day_reads' }, nowMs, limit, months);
+}
+/**
+ * The days the rollup should read now, oldest first: every day from `lookbackDays` ago to the
+ * last day that ended at least `settleMs` ago, without a successful read, not saturated, and either
+ * never tried or last tried at least `retryMs` ago. A day before `horizon` (the retention's first kept day)
+ * is not read, so a prune and a rollup never take turns on the same day. Oldest first, because the
+ * oldest day is the next one Analytics Engine ages out.
+ */
+export function requestRollupDueDays(input) {
+    const byDay = new Map(input.reads.map((r) => [r.day, r]));
+    const retryBefore = new Date(input.nowMs - input.retryMs).toISOString();
+    const last = utcDayOf(input.nowMs - input.settleMs - DAY_MS);
+    let first = utcDayOf(input.nowMs - input.lookbackDays * DAY_MS);
+    if (input.horizon !== null && input.horizon > first)
+        first = input.horizon;
+    const due = [];
+    for (let ms = Date.parse(`${first}T00:00:00Z`); utcDayOf(ms) <= last; ms += DAY_MS) {
+        const day = utcDayOf(ms);
+        const read = byDay.get(day);
+        if (read?.readAt)
+            continue;
+        // Saturated is a standing state: the day's group count will not shrink, so reading it again
+        // would spend a query on the same refusal.
+        if (read?.saturated)
+            continue;
+        if (read && read.attemptedAt > retryBefore)
+            continue;
+        due.push(day);
+    }
+    return due;
+}
+//# sourceMappingURL=request-rollup.js.map

package/dist/request-rollup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-rollup.js","sourceRoot":"","sources":["../src/request-rollup.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,gBAAgB,GAKjB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAEjG;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;CA0BjC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IACtC,SAAS,GAAG,IAAa,CAAC;CACpC;AAED,mDAAmD;AACnD,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,GAAY,EAAW,EAAE,CAChE,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAK,GAA+B,CAAC,SAAS,KAAK,IAAI,CAAC;AAEjG;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,CAAC;AAE/C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,EAAE,CAAC;AAEnD,2GAA2G;AAC3G,MAAM,CAAC,MAAM,wBAAwB,GAAG,SAAS,CAAC;AAElD,uEAAuE;AACvE,MAAM,CAAC,MAAM,uBAAuB,GAAG,SAAS,CAAC;AAEjD;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,MAAM,CAAC;AAErD,0GAA0G;AAC1G,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC;AAE9C,qEAAqE;AACrE,MAAM,CAAC,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAE9C,yEAAyE;AACzE,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAC/C,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,CAAC;AAElD,MAAM,MAAM,GAAG,UAAU,CAAC;AA8C1B;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAiB,EAAE,KAA0B;IAChF,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3C,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9D,IAAI,OAAO,IAAI,KAAK,EAAE,CAAC;QACrB,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC;QAC3C,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,YAAY,IAAI,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC;QAC3F,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,CAAC;QACzD,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CAAC,0DAA0D,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,GAAG,CACD;;;;;wFAKkF,EAClF,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,CAAC,KAAK,IAAI,iBAAiB,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CACtF,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAClC,UAAU,CAAC,KAAK,CAAC;QACf,GAAG;QACH,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ;QAC/C,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,SAAS,EAAE,IAAI;KAChB,CAAC,CACH,CAAC;IACF,GAAG,CAAC,kDAAkD,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/D,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,yEAAyE;QACzE,GAAG,CACD;;;;;;;;;;yEAUmE,EACnE;YACE,GAAG;YACH,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,QAAQ,IAAI,EAAE;YAChB,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,WAAW;YACb,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAClB,CACF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAI,GAAG,CAAC,gEAAgE,EAAE,CAAC,GAAG,CAAC,CAAqB,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;IAC7H,GAAG,CACD;;;;;+EAK2E,EAC3E,CAAC,GAAG,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CACzC,CAAC;IACF,OAAO,OAAO,CAAC;AACjB,CAAC;AAgBD,2FAA2F;AAC3F,MAAM,UAAU,kBAAkB,CAAC,GAAiB,EAAE,MAAM,GAAqB,EAAE;IACjF,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAwB,EAAE,CAAC;IACvC,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC3B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC3B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IACD,aAAa,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,IAAI,4BAA4B,CAAC,EAAE,wBAAwB,CAAC,CAAC;IACxH,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnB,MAAM,IAAI,GAAG,GAAG,CACd;;QAEI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;0DACA,EACtD,MAAM,CACY,CAAC;IACrB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACpB,UAAU,CAAC,KAAK,CAAC;QACf,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,QAAQ,EAAE,CAAC,CAAC,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ;QAC/C,OAAO,EAAE,CAAC,CAAC,QAAQ;QACnB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,WAAW,EAAE,CAAC,CAAC,YAAY;QAC3B,OAAO,EAAE,CAAC,CAAC,OAAO,KAAK,CAAC;QACxB,SAAS,EAAE,IAAI;KAChB,CAAC,CACH,CAAC;AACJ,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,wBAAwB,CAAC,GAAiB,EAAE,MAAM,GAA2B,EAAE;IAC7F,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAwB,EAAE,CAAC;IACvC,aAAa,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,GAAG,CACd;;QAEI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;mBACvC,EACf,MAAM,CAUL,CAAC;IACJ,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACpB,gBAAgB,CAAC,KAAK,CAAC;QACrB,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,WAAW,EAAE,CAAC,CAAC,YAAY;QAC3B,MAAM,EAAE,CAAC,CAAC,OAAO;QACjB,IAAI,EAAE,CAAC,CAAC,SAAS;QACjB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,SAAS,EAAE,CAAC,CAAC,SAAS,KAAK,CAAC;QAC5B,YAAY,EAAE,CAAC,CAAC,aAAa;QAC7B,YAAY,EAAE,CAAC,CAAC,aAAa;KAC9B,CAAC,CACH,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAiB,EAAE,KAAa,EAAE,KAAa,EAAE,MAAqB;IACxG,OAAO,gBAAgB,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,6BAA6B,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AACjI,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAOpC;IACC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;IACxE,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,QAAQ,GAAG,MAAM,CAAC,CAAC;IAC7D,IAAI,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,YAAY,GAAG,MAAM,CAAC,CAAC;IAChE,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,GAAG,KAAK;QAAE,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC;IAC3E,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,IAAI,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,KAAK,YAAY,CAAC,EAAE,QAAQ,CAAC,EAAE,CAAC,IAAI,IAAI,EAAE,EAAE,IAAI,MAAM,EAAE,CAAC;QACnF,MAAM,GAAG,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;QACzB,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,IAAI,EAAE,MAAM;YAAE,SAAS;QAC3B,4FAA4F;QAC5F,2CAA2C;QAC3C,IAAI,IAAI,EAAE,SAAS;YAAE,SAAS;QAC9B,IAAI,IAAI,IAAI,IAAI,CAAC,WAAW,GAAG,WAAW;YAAE,SAAS;QACrD,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/reserved-roles.d.ts

@@ -21,17 +21,168 @@ import { type ReservedKeySource } from '@substrat-run/contracts';
  *   admitted only when its stored holder is `system`. A legacy row with no holder keeps the
  *   old key-only behavior until its definition is written again.
  *
- * Never asked on a provisioning seat or the owner hand-over, and nothing already held is revoked:
- * a seat that exists keeps working whatever a later engine declares.
+ * A person's door also refuses a role whose stored holder is `system` (#2447), whatever this host
+ * knows: the holder a role definition carries is the reservation delivered with the role, so a
+ * host that registers no module (and so reserves nothing) still keeps a system-held role from a
+ * person. The provisioning owner seat and the owner hand-over are person doors too (#2447).
+ *
+ * Nothing already held is revoked: a seat that exists keeps working whatever a later engine
+ * declares. A refusal is of the write it was asked for, and writes nothing.
  *
  * The person's refusal is also `canAssign`'s, which is the bound on taking a role away as well as
  * on giving it, so it is worded for both: no person's bound covers such a role.
  */
-export declare function reservedRoleRefusal(role: {
+export declare function reservedRoleRefusal(role: RoleShape, reserved: ReadonlySet<string>, door: 'person' | 'platform'): string | null;
+/** A role as the reserved-key rule reads it: a definition, a stored row, or a projected one. */
+export interface RoleShape {
     key: string;
     permissions: readonly string[];
     holder?: 'person' | 'system';
-}, reserved: ReadonlySet<string>, door: 'person' | 'platform'): string | null;
+}
+/**
+ * What a host knows about keys (#2447): `reserved`, every key a module it registers or lists (and,
+ * at a Cloudflare scope node, the scope class's) marks `holder: 'system'`; `declared`, every key
+ * those modules declare at all. A declared key that is not reserved is a person's key.
+ */
+export interface HostReservations {
+    reserved: ReadonlySet<string>;
+    declared: ReadonlySet<string>;
+}
+/**
+ * Why `role` may not be DEFINED for a tenant whose roles are stored as `tenantRoles`, or null (#2447):
+ * the write a role definition makes, judged before it is made, so a role that passed a door when
+ * it was assigned cannot be widened afterwards with a key no person may hold. `tenantRoles` is
+ * what the host stores for the tenant now, the definition this one replaces included; `seated`
+ * says whether anyone but a system principal holds a live seat in the role's key, whether or not a
+ * definition of it is stored
+ * (`SCOPE_SEATED_ROLES_SQL`, `TENANT_SEATED_ROLES_SQL`).
+ *
+ * The keys judged reserved are the host's, plus every key one of the tenant's system-held roles
+ * holds: K-55 lets a system-held role hold reserved keys only, so its keys are reserved, and the
+ * stored holder (#2444) is how a host that registers no modules learns the reservation at all. A
+ * key the host's own modules declare unmarked is a person's, whatever a stored role says.
+ *
+ * - **A first definition** of a key: a person's role (holder omitted or `person`) carrying a
+ *   reserved key is refused, and so is a system-held role carrying a key a person may hold (one
+ *   the host's modules declare unmarked, or one a person's role of the tenant holds).
+ * - **A redefinition** is judged as that new definition, against the stored roles, so a key added
+ *   to a role whose seats were made through a person's door meets the person's rule.
+ * - **A stored system-held role redefined as a person's** is judged as a person's role with the
+ *   stored role's keys counted as reserved: the stored holder is the evidence, and a redefinition
+ *   does not erase it.
+ * - **A system-held definition of a key anyone but a system principal holds a seat in** is refused
+ *   unless a system-held definition is stored for it. What kind of principal holds a seat is not
+ *   recorded, so a seat made before any definition, under a person's definition, or under one a
+ *   projection since dropped may be a person's, and relabelling the role would make it a system
+ *   principal's. A K-55 host principal's seat in a system-held role a release dropped and a later
+ *   one adds back cannot be told apart from that, so it is refused too. Taking the seats back first, or defining a new key, is the
+ *   way. The seats decide for a role stored before the holder was recorded (#2480: no holder) too:
+ *   it may be declared `holder: 'system'` only while nobody but a system principal holds a seat in
+ *   it, since an upgrade admitted beside such a seat would let a later system-held definition add
+ *   keys to it.
+ *
+ * **A key the host knows nothing about is admitted, deliberately (fail-open).** A host judges only
+ * the reservations of modules it knows and of the tenant's system-held roles. Refusing every key it
+ * cannot place would refuse every role a module-less host is given; the push (`substrat push`, the
+ * registry boundary) is where the vertical's whole surface is judged. So a key reserved only
+ * through a schedule's `permissions`, which no system-held role of the tenant holds, is not caught
+ * on a host that does not register its module (the control plane verifying a pushed registry's
+ * marks is #2446).
+ *
+ * A refusal writes nothing, and so revokes nothing: a seat of the role as it was stored keeps
+ * working. A definition is never refused for a key it takes out, only for what it still holds.
+ */
+export declare function reservedRoleDefinitionRefusal(role: RoleShape, host: HostReservations, tenantRoles: readonly RoleShape[], seated?: boolean): string | null;
+/** What a host stores for a tenant's roles where a role set is defined, and which of them are seated. */
+export interface StoredRoles {
+    roles: readonly RoleShape[];
+    /** Role keys anyone but a system principal holds a live seat in, defined or not. */
+    seated: ReadonlySet<string>;
+}
+/**
+ * `reservedRoleDefinitionRefusal` over a whole role set defined at once (a provision's or a
+ * restore's projection, which replaces the tenant's roles in a scope): each role judged against the
+ * rest of the set and the definition of its own key stored there now (`stored`), with its seats.
+ * The first refusal, or null.
+ */
+export declare function reservedRoleSetRefusal(roles: readonly RoleShape[], host: HostReservations, stored?: StoredRoles): string | null;
+/**
+ * #2446: a scope's stored roles and seated role keys as they cross the wire (`roleStateLocal`, the
+ * vertical's `/internal/role-state`): what `StoredRoles` holds, with the set as a list. Role keys,
+ * permissions and holders only; no principal is named.
+ */
+export interface RoleState {
+    roles: RoleShape[];
+    seated: string[];
+}
+/**
+ * #2446: the reservations a pushed registry's rows mark — `reserved`, every key marked
+ * `holder: 'system'`; `declared`, every key it lists. The push boundary holds those marks to the
+ * module declarations shipped beside them (`pushedModuleRegistryProblems`), so they are what the
+ * incoming version's modules reserve and declare, the reservation its reconcile judges with.
+ */
+export declare function registryReservations(registry: {
+    permissions: readonly {
+        key: string;
+        holder?: 'system';
+    }[];
+}): HostReservations;
+/**
+ * #2446: why a release's role set would be refused where a scope stores `state`, or null: the
+ * question that scope's reconcile asks (`reservedRoleSetRefusal`, with the incoming version's
+ * reservations), asked before a promote moves it. A promote that would hold a seated scope's
+ * reconcile is refused instead.
+ */
+export declare function releaseRoleSetRefusal(registry: {
+    permissions: readonly {
+        key: string;
+        holder?: 'system';
+    }[];
+    roles: readonly RoleShape[];
+}, state: RoleState): string | null;
+/**
+ * #2446: whether a release's role set can be refused by any scope's stored state, so its promote
+ * must ask the scopes it moves. A system-held role meets the seat rule and the stored definitions
+ * (`reservedRoleDefinitionRefusal`). A person's role is judged against stored state only for a key
+ * its registry does not declare: every declared key is a reserved one, refused at push, or a
+ * person's, which no stored row overrides. A release with neither asks no scope.
+ */
+export declare function releaseRolesAskScopes(registry: {
+    permissions: readonly {
+        key: string;
+    }[];
+    roles: readonly RoleShape[];
+}): boolean;
+/**
+ * #2447: the role keys a scope's own tuples seat anyone but a system principal in, live now — what
+ * a role set defined on the scope is judged against. One parameter: now (ISO text).
+ */
+export declare const SCOPE_SEATED_ROLES_SQL = "SELECT DISTINCT substr(relation, 6) AS role_key FROM _substrat_tuples WHERE relation LIKE 'role:%' AND subject NOT LIKE 'system:%' AND revoked_at IS NULL AND (expires_at IS NULL OR expires_at > ?)";
+/** A scope dump's table, as a restore carries it: its name, its columns, and its rows in that order. */
+export interface DumpTable {
+    name: string;
+    columns: readonly string[];
+    rows: readonly (readonly unknown[])[];
+}
+/**
+ * #2447: what a scope dump stores for a tenant's roles, and the role keys anyone but a system
+ * principal holds a live scope-level seat in there — `SCOPE_SEATED_ROLES_SQL`'s reading, over a dump's
+ * rows instead of a table. A dump's projected tenant-level tuples are not seats here: the repair a
+ * restore runs projects none, so they do not survive it, and the tenant's own seats are the
+ * directory's. A restore judges the role set its repair defines against it before it imports the dump.
+ */
+export declare function dumpRoleState(tables: readonly DumpTable[], tenantId: string, now: string): StoredRoles;
+/**
+ * #2447: the scope statuses whose seats count as held when a role definition is judged: every one
+ * but `reaped` (whose storage is gone), a scope archived straight from `provisioning` included: it
+ * can hold a seat (the platform's door seats into a provisioning scope), and unarchive brings it back.
+ * Each adapter reads such a scope without creating storage it never had, and where it cannot, fails
+ * closed. An archived scope comes back on unarchive with its seats, so
+ * a definition judged without them would relabel those seats; both adapters read this one list.
+ */
+export declare const SEAT_HOLDING_SCOPE_STATUSES: readonly ['provisioning', 'active', 'suspended', 'archiving', 'archived'];
+/** #2447: `SCOPE_SEATED_ROLES_SQL` for a tenant's tenant-level tuples. Parameters: tenantId, now. */
+export declare const TENANT_SEATED_ROLES_SQL = "SELECT DISTINCT substr(relation, 6) AS role_key FROM _substrat_tenant_tuples WHERE tenant_id = ? AND relation LIKE 'role:%' AND subject NOT LIKE 'system:%' AND revoked_at IS NULL AND (expires_at IS NULL OR expires_at > ?)";
 /**
  * Why `permissions` may not be granted directly to a principal, an org or a connection, or null
  * (#2430): a raw grant (`HostAdmin.grant`, `grantToOrg`, `grantEntityShape`, `ctx.grant`) names a
@@ -57,6 +208,8 @@ export declare function reservedShapeRefusal(shapes: readonly {
  * module its declared `permissions` lists (a manifest there with no permission list adds nothing).
  */
 export declare function noteReservedKeys(reserved: Set<string>, manifest: DeclaredManifest): void;
+/** #2447: add every key `manifest` declares, marked or not, to a host's `declared` set (`HostReservations`). */
+export declare function noteDeclaredKeys(declared: Set<string>, manifest: DeclaredManifest): void;
 /** A manifest as far as a reservation and the declared-module check read it. */
 export type DeclaredManifest = Omit<ReservedKeySource['manifest'], 'permissions'> & {
     permissions?: ReservedKeySource['manifest']['permissions'];

package/dist/reserved-roles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reserved-roles.d.ts","sourceRoot":"","sources":["../src/reserved-roles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAEjF;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,MAAM,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAA;CAAE,EACnF,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,EAC7B,IAAI,EAAE,QAAQ,GAAG,UAAU,GAC1B,MAAM,GAAG,IAAI,CAuBf;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,EAAE,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,MAAM,GAAG,IAAI,CAIjH;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,SAAS;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,EAAE,EACzE,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,GAC5B,MAAM,GAAG,IAAI,CAMf;AASD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,gBAAgB,GAAG,IAAI,CAExF;AAED,gFAAgF;AAChF,MAAM,MAAM,gBAAgB,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,aAAa,CAAC,GAAG;IAAE,WAAW,CAAC,EAAE,iBAAiB,CAAC,UAAU,CAAC,CAAC,aAAa,CAAC,CAAA;CAAE,CAAC;AAEnJ;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,SAAS;QAAE,QAAQ,EAAE,gBAAgB,CAAA;KAAE,EAAE,CAAC;CACpD;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,mBAAmB,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAQzG"}
+{"version":3,"file":"reserved-roles.d.ts","sourceRoot":"","sources":["../src/reserved-roles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAEjF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,SAAS,EACf,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,EAC7B,IAAI,EAAE,QAAQ,GAAG,UAAU,GAC1B,MAAM,GAAG,IAAI,CA6Bf;AAED,gGAAgG;AAChG,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,MAAM,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;CAC9B;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC9B,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC/B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,SAAS,EACf,IAAI,EAAE,gBAAgB,EACtB,WAAW,EAAE,SAAS,SAAS,EAAE,EACjC,MAAM,UAAQ,GACb,MAAM,GAAG,IAAI,CA8Cf;AASD,yGAAyG;AACzG,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,SAAS,SAAS,EAAE,CAAC;IAC5B,oFAAoF;IACpF,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC7B;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,SAAS,SAAS,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,MAAM,GAAG,IAAI,CAQ/H;AAED;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE;IAAE,WAAW,EAAE,SAAS;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,QAAQ,CAAA;KAAE,EAAE,CAAA;CAAE,GAAG,gBAAgB,CAK/H;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE;IAAE,WAAW,EAAE,SAAS;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,QAAQ,CAAA;KAAE,EAAE,CAAC;IAAC,KAAK,EAAE,SAAS,SAAS,EAAE,CAAA;CAAE,EACrG,KAAK,EAAE,SAAS,GACf,MAAM,GAAG,IAAI,CAEf;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE;IAAE,WAAW,EAAE,SAAS;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAAC,KAAK,EAAE,SAAS,SAAS,EAAE,CAAA;CAAE,GAAG,OAAO,CAGjI;AAED;;;GAGG;AACH,eAAO,MAAM,sBAAsB,yMACqK,CAAC;AAEzM,wGAAwG;AACxG,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,IAAI,EAAE,SAAS,CAAC,SAAS,OAAO,EAAE,CAAC,EAAE,CAAC;CACvC;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,SAAS,SAAS,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,WAAW,CAoBtG;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,YAAI,cAAc,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,CAAU,CAAC;AAErH,qGAAqG;AACrG,eAAO,MAAM,uBAAuB,kOAC6L,CAAC;AAElO;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,EAAE,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,MAAM,GAAG,IAAI,CAIjH;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,SAAS;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,EAAE,EACzE,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,GAC5B,MAAM,GAAG,IAAI,CAMf;AASD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,gBAAgB,GAAG,IAAI,CAExF;AAED,gHAAgH;AAChH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,gBAAgB,GAAG,IAAI,CAExF;AAED,gFAAgF;AAChF,MAAM,MAAM,gBAAgB,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,aAAa,CAAC,GAAG;IAAE,WAAW,CAAC,EAAE,iBAAiB,CAAC,UAAU,CAAC,CAAC,aAAa,CAAC,CAAA;CAAE,CAAC;AAEnJ;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,SAAS;QAAE,QAAQ,EAAE,gBAAgB,CAAA;KAAE,EAAE,CAAC;CACpD;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,mBAAmB,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAQzG"}