@substrat-run/kernel 0.160.0 → 0.161.0

package/dist/reserved-roles.js

@@ -81,11 +81,12 @@ export function reservedRoleRefusal(role, reserved, door) {
  *   does not erase it.
  * - **A system-held definition of a key anyone but a system principal holds a seat in** is refused
  *   unless a system-held definition is stored for it. What kind of principal holds a seat is not
- *   recorded, so a seat made before any definition, under a person's definition, or under one a
- *   projection since dropped may be a person's, and relabelling the role would make it a system
- *   principal's. A K-55 host principal's seat in a system-held role a release dropped and a later
- *   one adds back cannot be told apart from that, so it is refused too. Taking the seats back first, or defining a new key, is the
- *   way. The seats decide for a role stored before the holder was recorded (#2480: no holder) too:
+ *   recorded, so a seat made before any definition, under a person's definition, or under a
+ *   person's definition a projection since dropped may be a person's, and relabelling the role
+ *   would make it a system principal's. Taking the seats back first, or defining a new key, is the
+ *   way. A system-held role a release dropped is the exception: its tombstone (#2531) is passed in
+ *   `tenantRoles` as the stored system-held definition (`reservedRoleSetRefusal`), so adding it back
+ *   is judged as if it had stayed defined. The seats decide for a role stored before the holder was recorded (#2480: no holder) too:
  *   it may be declared `holder: 'system'` only while nobody but a system principal holds a seat in
  *   it, since an upgrade admitted beside such a seat would let a later system-held definition add
  *   keys to it.
@@ -102,6 +103,13 @@ export function reservedRoleRefusal(role, reserved, door) {
  * working. A definition is never refused for a key it takes out, only for what it still holds.
  */
 export function reservedRoleDefinitionRefusal(role, host, tenantRoles, seated = false) {
+    return definitionRefusal(role, host, tenantRoles, seated)?.refusal ?? null;
+}
+/**
+ * `reservedRoleDefinitionRefusal` with why it refused (#2555): `seated`, a system-held definition of a
+ * key someone holds a seat in with no system-held definition stored; `keys`, a key the role may not hold.
+ */
+function definitionRefusal(role, host, tenantRoles, seated) {
     const stored = tenantRoles.find((r) => r.key === role.key);
     const others = tenantRoles.filter((r) => r.key !== role.key);
     const personKey = (p) => host.declared.has(p) && !host.reserved.has(p);
@@ -113,14 +121,19 @@ export function reservedRoleDefinitionRefusal(role, host, tenantRoles, seated =
                     bySystemRole.set(p, `the system-held role '${r.key}'`);
     if (role.holder === 'system') {
         // Judged against the seats of the key, whether or not a definition is stored: a projection can
-        // drop a role's row and leave its seats live, and a later definition must not relabel them.
+        // drop a role's row and leave its seats live, and a later definition must not relabel a seat
+        // made under a person's definition. A dropped SYSTEM-held row is no relabelling: its tombstone
+        // arrives here as `stored` (#2531, `storedDefinitionOf`), so its re-add passes this check.
         // A row stored before the holder was recorded (#2480) is no exception: an upgrade admitted beside
         // a person's seat would leave a system-held row a later definition widens unjudged by its seats.
         if (stored?.holder !== 'system' && seated) {
-            return (`role '${role.key}' is held by a principal (${storedAs(stored)}), so it cannot be declared holder: 'system': what kind ` +
-                `of principal holds a seat is not recorded, so the seat may be a person\'s. Take that seat back first, wherever it is ` +
-                `held (a scope, or the tenant; a host principal\'s seat can be given again after), keep the role defined across ` +
-                `releases, or define the system-held role under a new key (K-55)`);
+            return {
+                reason: 'seated',
+                refusal: `role '${role.key}' is held by a principal (${storedAs(stored)}), so it cannot be declared holder: 'system': what kind ` +
+                    `of principal holds a seat is not recorded, so the seat may be a person\'s. Take that seat back first, wherever it is ` +
+                    `held (a scope, or the tenant; a host principal\'s seat can be given again after), keep the role defined across ` +
+                    `releases, or define the system-held role under a new key (K-55)`,
+            };
         }
         const personsKeys = new Map();
         for (const r of others)
@@ -138,14 +151,20 @@ export function reservedRoleDefinitionRefusal(role, host, tenantRoles, seated =
         });
         if (offences.length === 0)
             return null;
-        return (`role '${role.key}' is declared holder: 'system' but holds ${offences.join(', ')}: a system-held role holds only ` +
-            `keys reserved to a system principal (K-55)`);
+        return {
+            reason: 'keys',
+            refusal: `role '${role.key}' is declared holder: 'system' but holds ${offences.join(', ')}: a system-held role holds only ` +
+                `keys reserved to a system principal (K-55)`,
+        };
     }
     // The stored system-held definition this one replaces is evidence too: its keys are reserved.
+    // A tombstone is no row a role listing shows (#2531), so the refusal says what it is: the role was
+    // defined system-held, and has since been dropped.
+    const evidence = stored && DROPPED.has(stored) ? 'its definition as a system-held role, since dropped' : 'its stored system-held definition';
     if (stored?.holder === 'system')
         for (const p of stored.permissions)
             if (!bySystemRole.has(p))
-                bySystemRole.set(p, `its stored system-held definition`);
+                bySystemRole.set(p, evidence);
     const held = role.permissions.flatMap((p) => {
         if (host.reserved.has(p))
             return [`${p} (${RESERVED_BY})`];
@@ -156,8 +175,11 @@ export function reservedRoleDefinitionRefusal(role, host, tenantRoles, seated =
     });
     if (held.length === 0)
         return null;
-    return (`role '${role.key}' is a person's role and would hold ${held.join(', ')}, reserved to a system principal: take the key ` +
-        `out, or declare a role made only of reserved keys holder: 'system' (K-55)`);
+    return {
+        reason: 'keys',
+        refusal: `role '${role.key}' is a person's role and would hold ${held.join(', ')}, reserved to a system principal: take the key ` +
+            `out, or declare a role made only of reserved keys holder: 'system' (K-55)`,
+    };
 }
 /** How the seated-key refusal names the stored row of the key, so it says only what is true of it. */
 function storedAs(stored) {
@@ -167,22 +189,92 @@ function storedAs(stored) {
         return 'stored with no holder, from before holders were recorded (#2480)';
     return "stored as a person's role";
 }
+/**
+ * The definition a key's stored row is judged as (#2531): its live row, or else a tombstone the
+ * projection left when it dropped a SYSTEM-held role. Such a tombstone counts as the stored
+ * system-held definition it was, in both branches: a re-add as system-held is not refused for a
+ * seat, and a re-add as a person's counts its keys as reserved. That is parity with keeping the
+ * role defined across releases, not proof the seat is a host principal's: the platform's door can
+ * seat a person in a system-held role whether its row is live or dropped. A tombstone of a person's
+ * role, or of a row with no holder, is no evidence of anything a system principal holds, so the key
+ * is judged as having no definition stored, as before.
+ */
+function storedDefinitionOf(stored, key) {
+    const live = stored?.roles.find((r) => r.key === key);
+    if (live)
+        return live;
+    const found = stored?.dropped?.find((r) => r.key === key && r.holder === 'system');
+    if (!found)
+        return undefined;
+    // A copy, so the mark is this one judgement's and never the caller's object, which it may pass
+    // again as a live role.
+    const tomb = { ...found };
+    DROPPED.add(tomb);
+    return tomb;
+}
+/** The copies of tombstones `storedDefinitionOf` handed on as a stored definition, so a refusal can name them as dropped. */
+const DROPPED = new WeakSet();
 /**
  * `reservedRoleDefinitionRefusal` over a whole role set defined at once (a provision's or a
  * restore's projection, which replaces the tenant's roles in a scope): each role judged against the
- * rest of the set and the definition of its own key stored there now (`stored`), with its seats.
- * The first refusal, or null.
+ * rest of the set and the definition of its own key stored there now (`stored`; a system-held
+ * tombstone counts, `storedDefinitionOf`), with its seats. The first refusal, or null.
  */
 export function reservedRoleSetRefusal(roles, host, stored) {
+    return firstRefusedRole(roles, host, stored)?.refusal ?? null;
+}
+/**
+ * `reservedRoleSetRefusal`'s walk: the first role of the set refused, with the refusal, or null.
+ * `judged` narrows which roles are asked about; every role of the set stays their context.
+ */
+function firstRefusedRole(roles, host, stored, judged = () => true) {
     for (const role of roles) {
-        const own = stored?.roles.find((r) => r.key === role.key);
+        if (!judged(role))
+            continue;
+        const own = storedDefinitionOf(stored, role.key);
         const tenantRoles = [...roles.filter((r) => r.key !== role.key), ...(own ? [own] : [])];
-        const refusal = reservedRoleDefinitionRefusal(role, host, tenantRoles, stored?.seated.has(role.key) ?? false);
-        if (refusal)
-            return refusal;
+        const refused = definitionRefusal(role, host, tenantRoles, stored?.seated.has(role.key) ?? false);
+        if (refused)
+            return { key: role.key, ...refused };
     }
     return null;
 }
+/**
+ * #2555: why a dump may not be loaded into a scope of a host the control plane runs (`restoreScope`,
+ * `importScope`), or null. The load brings the dump's scope-level seats, and the roles that apply to
+ * them are the tenant's roles as the directory stores them NOW (`roles`). So that set is judged as a
+ * restore's projection is (`reservedRoleSetRefusal`), against the dump's own role rows and seats for
+ * the tenant it was captured from (`dumpRoleState`). A seat the dump holds in a role the directory
+ * has since made system-held is refused, unless the dump stores that role system-held itself. A dump
+ * with no role rows (a pure-SQLite scope file, or a scope that read its roles over RPC) says nothing
+ * about the definition its seats were made under, so such a seat is judged as a person's, the rule's
+ * reading of a seat whose holder is not recorded. A scope holding a seat in a system-held role
+ * therefore cannot be restored from its own export on a host whose dump carries no role rows.
+ *
+ * Only the roles the dump seats or stores are asked about, so a directory role the dump has no part
+ * in never refuses a load (the directory's own doors judge it); the whole set stays their context.
+ *
+ * Asked before anything is replaced, so a refused load moves nothing. The answer is one of two fixed
+ * sentences naming the role key only: the rule's own wording is kept out of it, since it is read by
+ * whoever sent the dump. The second is chosen from the rule's reason, not from the dump's shape: the
+ * seat rule refused, and the dump carries no definition of the role to show its seats were made as a
+ * system principal's. A refusal over the keys the tenant's definition holds takes the first.
+ */
+export function dumpRoleRefusal(roles, host, dump, now) {
+    // #2531: the dump's tombstones come with it (`dumpRoleState`), so the walk reads a system-held one as
+    // the stored definition it was (`storedDefinitionOf`), and a role the dump keeps only as a tombstone
+    // is one it defines: judged, and answered as defined rather than as having no definition.
+    const stored = dumpRoleState(dump.tables, dump.tenantId, now);
+    const inDump = (key) => stored.roles.some((r) => r.key === key) || (stored.dropped ?? []).some((r) => r.key === key);
+    const refused = firstRefusedRole(roles, host, stored, (r) => stored.seated.has(r.key) || inDump(r.key));
+    if (!refused)
+        return null;
+    if (refused.reason === 'seated' && !inDump(refused.key)) {
+        return (`restore refused: the dump seats role '${refused.key}' but carries no definition of it, so its seats cannot be told ` +
+            `from a person's, and the tenant now defines the role for a system principal (K-55); nothing was loaded`);
+    }
+    return `restore refused: role '${refused.key}', which the dump seats or defines, cannot be applied as the tenant defines it now (K-55); nothing was loaded`;
+}
 /**
  * #2446: the reservations a pushed registry's rows mark — `reserved`, every key marked
  * `holder: 'system'`; `declared`, every key it lists. The push boundary holds those marks to the
@@ -202,7 +294,11 @@ export function registryReservations(registry) {
  * reconcile is refused instead.
  */
 export function releaseRoleSetRefusal(registry, state) {
-    return reservedRoleSetRefusal(registry.roles, registryReservations(registry), { roles: state.roles, seated: new Set(state.seated) });
+    return reservedRoleSetRefusal(registry.roles, registryReservations(registry), {
+        roles: state.roles,
+        seated: new Set(state.seated),
+        ...(state.dropped ? { dropped: state.dropped } : {}),
+    });
 }
 /**
  * #2446: whether a release's role set can be refused by any scope's stored state, so its promote
@@ -233,18 +329,20 @@ export function dumpRoleState(tables, tenantId, now) {
         return t ? t.rows.map((r) => Object.fromEntries(t.columns.map((c, i) => [c, r[i]]))) : [];
     };
     const live = (r) => r.revoked_at == null && (r.expires_at == null || String(r.expires_at) > now);
-    const roles = read('_substrat_roles')
-        .filter((r) => r.tenant_id === tenantId && r.revoked_at == null)
-        .map((r) => ({
+    const shapeOf = (r) => ({
         key: String(r.role_key),
         permissions: JSON.parse(String(r.permissions)),
         ...(r.holder === 'person' || r.holder === 'system' ? { holder: r.holder } : {}),
-    }));
+    });
+    const tenantRows = read('_substrat_roles').filter((r) => r.tenant_id === tenantId);
+    const roles = tenantRows.filter((r) => r.revoked_at == null).map(shapeOf);
+    // #2531: a dropped role's tombstone travels with the dump, as the evidence it is in the scope.
+    const dropped = tenantRows.filter((r) => r.revoked_at != null).map(shapeOf);
     const seats = read('_substrat_tuples');
     const seated = new Set(seats
         .filter((r) => String(r.relation).startsWith('role:') && !String(r.subject).startsWith('system:') && live(r))
         .map((r) => String(r.relation).slice('role:'.length)));
-    return { roles, seated };
+    return { roles, seated, dropped };
 }
 /**
  * #2447: the scope statuses whose seats count as held when a role definition is judged: every one

package/dist/reserved-roles.js.map

@@ -1 +1 @@
-{"version":3,"file":"reserved-roles.js","sourceRoot":"","sources":["../src/reserved-roles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAA0B,MAAM,yBAAyB,CAAC;AAEjF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAe,EACf,QAA6B,EAC7B,IAA2B;IAE3B,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClD,OAAO,CACL,SAAS,IAAI,CAAC,GAAG,iGAAiG;YAClH,yCAAyC,CAC1C,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO,CACL,SAAS,IAAI,CAAC,GAAG,WAAW,IAAI,yEAAyE;YACzG,gCAAgC,WAAW,GAAG,CAC/C,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,6EAA6E;QAC7E,0EAA0E;QAC1E,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACpD,OAAO,SAAS,IAAI,CAAC,GAAG,WAAW,IAAI,gIAAgI,CAAC;QAC1K,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,CACL,SAAS,IAAI,CAAC,GAAG,WAAW,IAAI,4CAA4C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB;QAChH,+EAA+E,CAChF,CAAC;AACJ,CAAC;AAmBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,MAAM,UAAU,6BAA6B,CAC3C,IAAe,EACf,IAAsB,EACtB,WAAiC,EACjC,MAAM,GAAG,KAAK;IAEd,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC/E,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,MAAM;QAAE,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ;YAAE,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW;gBAAE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;oBAAE,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,yBAAyB,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;IACnK,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC7B,+FAA+F;QAC/F,4FAA4F;QAC5F,kGAAkG;QAClG,iGAAiG;QACjG,IAAI,MAAM,EAAE,MAAM,KAAK,QAAQ,IAAI,MAAM,EAAE,CAAC;YAC1C,OAAO,CACL,SAAS,IAAI,CAAC,GAAG,6BAA6B,QAAQ,CAAC,MAAM,CAAC,0DAA0D;gBACxH,uHAAuH;gBACvH,iHAAiH;gBACjH,iEAAiE,CAClE,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC9C,KAAK,MAAM,CAAC,IAAI,MAAM;YAAE,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ;gBAAE,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW;oBAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;wBAAE,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACrI,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;YAC9C,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,OAAO,EAAE,CAAC;YACpC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAC;YAClG,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAClC,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,gCAAgC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,CAAC,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACvC,OAAO,CACL,SAAS,IAAI,CAAC,GAAG,4CAA4C,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,kCAAkC;YAClH,4CAA4C,CAC7C,CAAC;IACJ,CAAC;IACD,8FAA8F;IAC9F,IAAI,MAAM,EAAE,MAAM,KAAK,QAAQ;QAAE,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,WAAW;YAAE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,mCAAmC,CAAC,CAAC;IACxJ,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;QAC1C,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,KAAK,WAAW,GAAG,CAAC,CAAC;QAC3D,IAAI,SAAS,CAAC,CAAC,CAAC;YAAE,OAAO,EAAE,CAAC;QAC5B,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC/B,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5C,CAAC,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,CACL,SAAS,IAAI,CAAC,GAAG,uCAAuC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,iDAAiD;QACxH,2EAA2E,CAC5E,CAAC;AACJ,CAAC;AAED,sGAAsG;AACtG,SAAS,QAAQ,CAAC,MAA6B;IAC7C,IAAI,CAAC,MAAM;QAAE,OAAO,2BAA2B,CAAC;IAChD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,kEAAkE,CAAC;IAC3G,OAAO,2BAA2B,CAAC;AACrC,CAAC;AASD;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAA2B,EAAE,IAAsB,EAAE,MAAoB;IAC9G,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1D,MAAM,WAAW,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACxF,MAAM,OAAO,GAAG,6BAA6B,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC;QAC9G,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;IAC9B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAYD;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAwE;IAC3G,OAAO;QACL,QAAQ,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC9F,QAAQ,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;KAC1D,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAqG,EACrG,KAAgB;IAEhB,OAAO,sBAAsB,CAAC,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AACvI,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAkF;IACtH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACjE,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1G,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GACjC,sMAAsM,CAAC;AASzM;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,MAA4B,EAAE,QAAgB,EAAE,GAAW;IACvF,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE;QAC5B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAC9C,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAA4B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvH,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,CAA0B,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC;IAC1H,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC;SAClC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,IAAI,IAAI,CAAC;SAC/D,GAAG,CAAC,CAAC,CAAC,EAAa,EAAE,CAAC,CAAC;QACtB,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;QACvB,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAa;QAC1D,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAA6B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvG,CAAC,CAAC,CAAC;IACN,MAAM,KAAK,GAAG,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,IAAI,GAAG,CACpB,KAAK;SACF,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;SAC5G,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CACxD,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,cAAc,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,CAAU,CAAC;AAErH,qGAAqG;AACrG,MAAM,CAAC,MAAM,uBAAuB,GAClC,+NAA+N,CAAC;AAElO;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAA8B,EAAE,QAA6B;IAChG,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,8FAA8F,WAAW,GAAG,CAAC;AACxI,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAyE,EACzE,QAA6B;IAE7B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAClE,IAAI,OAAO;YAAE,OAAO,6BAA6B,KAAK,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;IAClF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,WAAW,GAAG,iIAAiI,CAAC;AAEtJ;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAqB,EAAE,QAA0B;IAChF,KAAK,MAAM,GAAG,IAAI,cAAc,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;QAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC3I,CAAC;AAED,gHAAgH;AAChH,MAAM,UAAU,gBAAgB,CAAC,QAAqB,EAAE,QAA0B;IAChF,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,WAAW,IAAI,EAAE;QAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AAClE,CAAC;AAeD;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAA4C,EAAE,QAAgB;IACjG,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,QAAQ,CAAC;QAAE,OAAO;IACxF,MAAM,IAAI,KAAK,CACb,mBAAmB,QAAQ,oFAAoF;QAC7G,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,WAAW,8BAA8B;QACxG,mGAAmG;QACnG,wEAAwE,CAC3E,CAAC;AACJ,CAAC"}
+{"version":3,"file":"reserved-roles.js","sourceRoot":"","sources":["../src/reserved-roles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAA0B,MAAM,yBAAyB,CAAC;AAEjF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAe,EACf,QAA6B,EAC7B,IAA2B;IAE3B,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClD,OAAO,CACL,SAAS,IAAI,CAAC,GAAG,iGAAiG;YAClH,yCAAyC,CAC1C,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO,CACL,SAAS,IAAI,CAAC,GAAG,WAAW,IAAI,yEAAyE;YACzG,gCAAgC,WAAW,GAAG,CAC/C,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,6EAA6E;QAC7E,0EAA0E;QAC1E,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACpD,OAAO,SAAS,IAAI,CAAC,GAAG,WAAW,IAAI,gIAAgI,CAAC;QAC1K,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,CACL,SAAS,IAAI,CAAC,GAAG,WAAW,IAAI,4CAA4C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB;QAChH,+EAA+E,CAChF,CAAC;AACJ,CAAC;AAmBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,MAAM,UAAU,6BAA6B,CAC3C,IAAe,EACf,IAAsB,EACtB,WAAiC,EACjC,MAAM,GAAG,KAAK;IAEd,OAAO,iBAAiB,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC;AAC7E,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CACxB,IAAe,EACf,IAAsB,EACtB,WAAiC,EACjC,MAAe;IAEf,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC/E,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,MAAM;QAAE,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ;YAAE,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW;gBAAE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;oBAAE,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,yBAAyB,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;IACnK,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC7B,+FAA+F;QAC/F,6FAA6F;QAC7F,+FAA+F;QAC/F,2FAA2F;QAC3F,kGAAkG;QAClG,iGAAiG;QACjG,IAAI,MAAM,EAAE,MAAM,KAAK,QAAQ,IAAI,MAAM,EAAE,CAAC;YAC1C,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,OAAO,EACL,SAAS,IAAI,CAAC,GAAG,6BAA6B,QAAQ,CAAC,MAAM,CAAC,0DAA0D;oBACxH,uHAAuH;oBACvH,iHAAiH;oBACjH,iEAAiE;aACpE,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC9C,KAAK,MAAM,CAAC,IAAI,MAAM;YAAE,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ;gBAAE,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW;oBAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;wBAAE,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACrI,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;YAC9C,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,OAAO,EAAE,CAAC;YACpC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAC;YAClG,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAClC,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,gCAAgC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,CAAC,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACvC,OAAO;YACL,MAAM,EAAE,MAAM;YACd,OAAO,EACL,SAAS,IAAI,CAAC,GAAG,4CAA4C,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,kCAAkC;gBAClH,4CAA4C;SAC/C,CAAC;IACJ,CAAC;IACD,8FAA8F;IAC9F,mGAAmG;IACnG,mDAAmD;IACnD,MAAM,QAAQ,GAAG,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,qDAAqD,CAAC,CAAC,CAAC,mCAAmC,CAAC;IAC7I,IAAI,MAAM,EAAE,MAAM,KAAK,QAAQ;QAAE,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,WAAW;YAAE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC7H,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;QAC1C,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,KAAK,WAAW,GAAG,CAAC,CAAC;QAC3D,IAAI,SAAS,CAAC,CAAC,CAAC;YAAE,OAAO,EAAE,CAAC;QAC5B,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC/B,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5C,CAAC,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO;QACL,MAAM,EAAE,MAAM;QACd,OAAO,EACL,SAAS,IAAI,CAAC,GAAG,uCAAuC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,iDAAiD;YACxH,2EAA2E;KAC9E,CAAC;AACJ,CAAC;AAED,sGAAsG;AACtG,SAAS,QAAQ,CAAC,MAA6B;IAC7C,IAAI,CAAC,MAAM;QAAE,OAAO,2BAA2B,CAAC;IAChD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,kEAAkE,CAAC;IAC3G,OAAO,2BAA2B,CAAC;AACrC,CAAC;AAeD;;;;;;;;;GASG;AACH,SAAS,kBAAkB,CAAC,MAA+B,EAAE,GAAW;IACtE,MAAM,IAAI,GAAG,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IACtD,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,KAAK,GAAG,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;IACnF,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,+FAA+F;IAC/F,wBAAwB;IACxB,MAAM,IAAI,GAAc,EAAE,GAAG,KAAK,EAAE,CAAC;IACrC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,6HAA6H;AAC7H,MAAM,OAAO,GAAG,IAAI,OAAO,EAAa,CAAC;AAEzC;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAA2B,EAAE,IAAsB,EAAE,MAAoB;IAC9G,OAAO,gBAAgB,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC;AAChE,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CACvB,KAA2B,EAC3B,IAAsB,EACtB,MAAoB,EACpB,MAAM,GAAiC,GAAG,EAAE,CAAC,IAAI;IAEjD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YAAE,SAAS;QAC5B,MAAM,GAAG,GAAG,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QACjD,MAAM,WAAW,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACxF,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC;QAClG,IAAI,OAAO;YAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;IACpD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,eAAe,CAC7B,KAA2B,EAC3B,IAAsB,EACtB,IAAwD,EACxD,GAAW;IAEX,sGAAsG;IACtG,qGAAqG;IACrG,0FAA0F;IAC1F,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IAC7H,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACxG,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACxD,OAAO,CACL,yCAAyC,OAAO,CAAC,GAAG,iEAAiE;YACrH,wGAAwG,CACzG,CAAC;IACJ,CAAC;IACD,OAAO,0BAA0B,OAAO,CAAC,GAAG,+GAA+G,CAAC;AAC9J,CAAC;AAeD;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAwE;IAC3G,OAAO;QACL,QAAQ,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC9F,QAAQ,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;KAC1D,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAqG,EACrG,KAAgB;IAEhB,OAAO,sBAAsB,CAAC,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAC,QAAQ,CAAC,EAAE;QAC5E,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,MAAM,EAAE,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC;QAC7B,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrD,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAkF;IACtH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACjE,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1G,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GACjC,sMAAsM,CAAC;AASzM;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,MAA4B,EAAE,QAAgB,EAAE,GAAW;IACvF,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE;QAC5B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAC9C,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAA4B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvH,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,CAA0B,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC;IAC1H,MAAM,OAAO,GAAG,CAAC,CAA0B,EAAa,EAAE,CAAC,CAAC;QAC1D,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;QACvB,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAa;QAC1D,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAA6B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvG,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC;IACnF,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC1E,+FAA+F;IAC/F,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC5E,MAAM,KAAK,GAAG,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,IAAI,GAAG,CACpB,KAAK;SACF,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;SAC5G,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CACxD,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AACpC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,cAAc,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,CAAU,CAAC;AAErH,qGAAqG;AACrG,MAAM,CAAC,MAAM,uBAAuB,GAClC,+NAA+N,CAAC;AAElO;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAA8B,EAAE,QAA6B;IAChG,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,8FAA8F,WAAW,GAAG,CAAC;AACxI,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAyE,EACzE,QAA6B;IAE7B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAClE,IAAI,OAAO;YAAE,OAAO,6BAA6B,KAAK,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;IAClF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,WAAW,GAAG,iIAAiI,CAAC;AAEtJ;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAqB,EAAE,QAA0B;IAChF,KAAK,MAAM,GAAG,IAAI,cAAc,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;QAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC3I,CAAC;AAED,gHAAgH;AAChH,MAAM,UAAU,gBAAgB,CAAC,QAAqB,EAAE,QAA0B;IAChF,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,WAAW,IAAI,EAAE;QAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AAClE,CAAC;AAeD;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAA4C,EAAE,QAAgB;IACjG,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,QAAQ,CAAC;QAAE,OAAO;IACxF,MAAM,IAAI,KAAK,CACb,mBAAmB,QAAQ,oFAAoF;QAC7G,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,WAAW,8BAA8B;QACxG,mGAAmG;QACnG,wEAAwE,CAC3E,CAAC;AACJ,CAAC"}

package/dist/scope-host.d.ts

@@ -6,7 +6,7 @@ import type { DeliveryRefusal } from './delivery-refusal.js';
 import type { ScopeRoleHolder } from './scope-role-admin.js';
 import type { ScopeCopyBackfillResult, SubjectErasureFence } from './scope-copy-ledger.js';
 import type { VerticalScopeStore } from './vertical-scope-stores.js';
-import type { DeploymentWireAuthFilter, DeploymentWireAuthInput } from './deployment-wire-auth.js';
+import type { DeploymentWireAuthFilter, DeploymentWireAuthInput, WireWalkAudit } from './deployment-wire-auth.js';
 import type { StoreDriverHoldMode, StoreDriverRebuildFailure, StoreDriverRebuildRecord, StoreDriverReleaseRecord, StoreDriverRolloutAction, StoreDriverRolloutRecord, StoreDriverRolloutState, StoreDriverRolloutTarget, StoreDriverState } from './store-driver-releases.js';
 import type { SubjectRedactionCounts } from './subject-redaction.js';
 import type { OnBehalfOf, ExportReadInput, ExportedBatch, ImportBatch, ImportedEvent, ImportResult, ImportState, ImportCursorMove, ImportCursorMoved, AdminAction, BecomeCapabilityInput, CapabilityExchange, CapabilityFilter, CapabilityId, CapabilityPage, MintedCapability, ListPage, ConnectLink, ConnectLinkConsume, ConnectLinkFilter, ConnectLinkKey, ConsumeConnectLinkInput, MintConnectLinkInput, Connection, ConnectionFilter, ConnectionId, ConnectionGrant, ConnectionGrantRecord, ConnectionSecret, CreateConnectionInput, OpenConnection, ProjectedConnectionGrant, ProjectedConnectionKey, AccessLogEntry, DelegatedReadRecord, OwnerTransferAudit, MemberChangeAudit, PeerBindingAudit, ConnectionBindingAudit, CopyMarkAudit, OrphanSweepAudit, BindHostnameInput, AdminLogEntry, OpsFailureEntry, PlatformRequestDrainTotalsEntry, SweepRunEntry, SweepRunKind, SweepRunOutcome, ModelUsageEntry, ModelUsageSummary, CapabilityGrant, CreateTenantInput, Decision, Instant, DomainEvent, DomainEventInput, PlatformRequestInput, PlatformRequestId, PlatformRequestEntry, PlatformRequestFilter, PlatformRequestStatus, PlatformRequestFailure, PlatformOutcomeEvent, EntitlementGrant, EntitlementGrantInput, EntitlementView, MeterReading, MeterDay, MeterDayTake, VerticalOwnerPeriod, ScopeStorageSample, RequestDay, RequestRollupDay, EntityRef, IdentityLink, IdentityPool, Jurisdiction, ModuleId, ModuleManifest, ScheduleSpec, SystemGrant, PeerGrantsStatusEntry, SystemGrantsStatusEntry, SystemSwitchRecord, SystemSwitch, SystemSwitchResult, PeerCoverage, PeerSwitch, PeerSwitchResult, VerticalCaller, VerticalResolution, PeerBinding, PeerInstanceResolution, CreateOrgInput, Node, Org, OrgId, OrgMembership, PermissionKey, PlatformActorId, ChannelName, ExportBreak, ChannelHistoryEntry, DnsRecord, HostnameBinding, HostnameStatus, PromotionAcknowledgement, BindAcknowledgement, PublishVersionInput, RegisterVerticalInput, VerticalServingState, DeploymentWireAuth, RouteTarget, DirectoryDump, IdentityMembership, PrincipalId, ResolvedIdentity, RoleAssignment, RoleDefinition, QueryScopeInput, ReadScopeTableInput, Scope, ScopeDump, ScopeDumpInput, SubjectShredReceipt, ScopeQueryResult, ScopeId, ScopeStatus, ScopeTable, DenialFilter, DenialSummary, RefusalFilter, RefusalRecord, PermissionDenial, Coverage, BeginImpersonationInput, ImpersonationFilter, ImpersonationSession, ImpersonationSessionId, ScopeTablePage, StorageShape, Tenant, TenantId, TenantRole, TenantStoreHandle, AttachmentRecord, UploadLinkView, BlobStoreHandle, Visibility, Vertical, VerticalChannel, VerticalVersion, TenantStatus, Page, CountedPage, FreshnessSpec, EntityHistoryInput, EventFacetInput, EventCauseInput, EventEffectsInput, EffectsTree, InvocationEventsInput, InvocationEvents, DeadLettersInput, DeadLetter, LifecycleFlowInput, LifecycleFlowResult, OperationSeriesInput, OperationSeriesResult, CauseChain, EventFacetResult, HistoryEntry, ErrorCode, PlatformRequestFailureOrigin, IssueEntry, IssueStatus, IssueStatusInput, FindingEntry, FindingFilter, FindingRuleEntry, FindingRuleInput, FindingStatusInput, DeclaredMigration, CheckSubject, EntityGrantShape } from '@substrat-run/contracts';
@@ -1452,6 +1452,15 @@ export interface ScopedConnectorConnection extends ConnectorConnection {
      * falls back rather than failing a dispatch over a missing file.
      */
     openAttachment(attachmentId: string): Promise<OpenedAttachment | null>;
+    /**
+     * `openAttachment`, with the bytes as a stream that is never held whole (#2514), for a connector
+     * that sends a file on to a provider. Gated the same way, before any byte is read. The sha256 is
+     * checked as the bytes flow, and a mismatch errors the stream before its last chunk is handed on
+     * (see {@link OpenedAttachmentStream}), so a connector that sends what it read must treat a stream
+     * error as "nothing was read", never as a shorter file. A stream it decides not to read is
+     * cancelled (`body.stream.getReader().cancel()`), which releases the stored object at once.
+     */
+    openAttachmentStream(attachmentId: string): Promise<OpenedAttachmentStream | null>;
     /**
      * What this connection may do in the scope this delivery is for (#726 gap 1) —
      * `connectionGrantsInScope`, narrowed to this connection.
@@ -2511,6 +2520,12 @@ export interface HostAdmin {
      * only today.
      */
     listWireAuth?(actor: PlatformActorId, filter: DeploymentWireAuthFilter): Promise<DeploymentWireAuth[]>;
+    /**
+     * Audit one pass of the fleet walk (RFC wire-signing follow-on 4) as `walkWireAuth`: a person's act,
+     * dry run or applied. Each script the pass changed writes its own `recordWireAuth` row as well, with
+     * its record, in one directory transaction.
+     */
+    recordWireWalk?(actor: PlatformActorId, entry: WireWalkAudit): Promise<void>;
     /**
      * Point a scope's ROUTING at the serving script its data now lives in. Per-scope
      * truth, deliberately not derived from the vertical: rerouting a scope whose DOs
@@ -4223,6 +4238,17 @@ export interface TenantBlobStore {
         body: Uint8Array;
         contentType?: string;
     } | null>;
+    /**
+     * The object under `key` as a stream (#2514), with the size the store holds for it, read as the
+     * consumer reads it and never collected first. Optional, so a store written before it still
+     * satisfies this interface: an open over such a store reads the object with `get` and hands it on
+     * as a stream, which works but holds the object whole.
+     */
+    getStream?(key: string): Promise<{
+        stream: ByteStream;
+        size: number;
+        contentType?: string;
+    } | null>;
     delete(key: string): Promise<void>;
     /** Keys under `prefix` — the GC/ops walk. */
     list(prefix: string): Promise<string[]>;
@@ -4267,6 +4293,19 @@ export declare function attachmentSha256(body: Uint8Array): Promise<string>;
  * its object deleted and is refused: no record may witness bytes nobody saw.
  */
 export declare function putAttachmentBytes(store: TenantBlobStore, key: string, fields: AttachmentRecordFields, body: ByteBody, sha256: () => IncrementalSha256): Promise<AttachmentRecord>;
+/**
+ * The bytes of an attachment the scope has already AUTHORIZED, as a stream held to its record (#2514):
+ * the "bytes" half of every streamed open, one path for both adapters, as {@link putAttachmentBytes}
+ * is for the write. The caller checks the read permission first and calls this only once it passed,
+ * so a refused read never reaches the store.
+ *
+ * The length is the record's `size`, which the upload took from the bytes themselves. The store's own
+ * size for the object is held to it before the first byte, so an object that is not the recorded one
+ * is refused up front. The sha256 is checked as the bytes flow ({@link verifiedStream}): a mismatch
+ * errors the stream before its last chunk is handed on. A store without `getStream` is read whole with
+ * `get` and handed on the same way.
+ */
+export declare function openAttachmentByteStream(store: TenantBlobStore, key: string, record: AttachmentRecord, sha256: () => IncrementalSha256): Promise<OpenedAttachmentStream>;
 /**
  * Who binds an operation, as the §4.3 entitlement gate needs to know it: the owning
  * module, the SKU flag its manifest declares, and the operations that module declares
@@ -4404,6 +4443,18 @@ export interface OpenedAttachment {
     body: Uint8Array;
     contentType: string;
 }
+/**
+ * An opened attachment whose bytes are a stream (#2514): the metadata fact, and its bytes at the
+ * record's `size`, read as the consumer reads them. The sha256 is checked as they pass, so a
+ * mismatch errors the stream before its last chunk instead of refusing up front: a consumer that
+ * has received all `size` bytes has received bytes that matched the record. One-shot: read it once,
+ * or cancel it, which releases the stored object; a stream that is neither holds it until collected.
+ */
+export interface OpenedAttachmentStream {
+    record: AttachmentRecord;
+    body: SizedByteStream;
+    contentType: string;
+}
 /**
  * The attachment surface a host mints per (principal, scope) — `attachmentTargets`
  * finally consumed (#473). Every method is gated INSIDE the platform by the declared
@@ -4420,6 +4471,12 @@ export interface ScopeAttachments {
     list(entity: EntityRef): Promise<AttachmentRecord[]>;
     /** Record + bytes, or null for an id this scope does not know. Gated per entity. */
     open(attachmentId: string): Promise<OpenedAttachment | null>;
+    /**
+     * `open`, with the bytes as a stream that is never held whole (#2514). The same gate, checked
+     * before the store is touched, and the same `null`; the integrity check moves to the stream (see
+     * {@link OpenedAttachmentStream}).
+     */
+    openStream(attachmentId: string): Promise<OpenedAttachmentStream | null>;
     /** Delete row (and event) first, then bytes; returns the removed record, null if unknown. */
     remove(attachmentId: string): Promise<AttachmentRecord | null>;
     /**