@graview/core 0.1.0 → 0.1.2

package/dist/ops/revisions.js

@@ -0,0 +1,97 @@
+/**
+ * WHICH OP LAST WROTE EACH FIELD (FR-05) — read off the log, never stored.
+ *
+ * A stale write is one made against a value somebody has changed since:
+ * two people open one record, both change its status, and whoever sends
+ * second used to win without knowing the first had spoken. To say so, a
+ * call carries the revision of each field it changes as its sender last
+ * saw it, and the store compares that with the field's revision now.
+ *
+ * A field's revision is the `seq` of the op that last wrote it: an op that
+ * added its record, or one that patched it. It is DERIVED from the log
+ * rather than kept beside it, so no stored format changes and every store,
+ * every client and every host that folds the same log agrees on it without
+ * being told. A field no op in the log has written (a seeded one, or one
+ * written before the log's first op) is at `NEVER_WRITTEN`.
+ */
+export const NEVER_WRITTEN = -1;
+const key = (node, field) => `${node}\u0000${field}`;
+/** The fields one primitive writes, by record. */
+export function fieldsWritten(primitive) {
+    if (primitive.op === "add-node") {
+        return Object.keys(primitive.node)
+            .filter((field) => field !== "id" && field !== "kind")
+            .map((field) => [primitive.node.id, field]);
+    }
+    if (primitive.op === "patch-node")
+        return Object.keys(primitive.after).map((field) => [primitive.id, field]);
+    return [];
+}
+/**
+ * The revision of every field a log has written, kept current as ops land.
+ * A revision only moves forward: an op noted twice, or out of order, leaves
+ * a later one standing.
+ */
+export class FieldRevisions {
+    revs = new Map();
+    /** Revisions read from a whole log (or the part of one a seat may see). */
+    static of(ops) {
+        const revisions = new FieldRevisions();
+        revisions.note(ops);
+        return revisions;
+    }
+    /** Takes in ops as they land, by the seq each carries. */
+    note(ops) {
+        for (const op of ops) {
+            for (const primitive of op.primitives) {
+                for (const [node, field] of fieldsWritten(primitive)) {
+                    const at = key(node, field);
+                    if ((this.revs.get(at) ?? NEVER_WRITTEN) < op.seq)
+                        this.revs.set(at, op.seq);
+                }
+            }
+        }
+    }
+    /** The seq of the op that last wrote this field, or `NEVER_WRITTEN`. */
+    of(node, field) {
+        return this.revs.get(key(node, field)) ?? NEVER_WRITTEN;
+    }
+    /** The base a call made of these ops would carry: each field they patch on a record they did not add, at its revision here. */
+    baseFor(ops, skip = new Set()) {
+        const created = new Set();
+        const base = new Map();
+        for (const op of ops) {
+            for (const primitive of op.primitives) {
+                if (primitive.op === "add-node")
+                    created.add(primitive.node.id);
+                if (primitive.op !== "patch-node" || created.has(primitive.id) || skip.has(primitive.id))
+                    continue;
+                for (const field of Object.keys(primitive.after)) {
+                    const at = key(primitive.id, field);
+                    if (skip.has(at) || base.has(at))
+                        continue;
+                    base.set(at, { node: primitive.id, field, rev: this.of(primitive.id, field) });
+                }
+            }
+        }
+        return [...base.values()];
+    }
+    /** The base entries that no longer hold: each field written since its sender read it. */
+    stale(base) {
+        return base.filter((entry) => this.of(entry.node, entry.field) !== entry.rev);
+    }
+}
+/** Every record and every `record\0field` these ops write: what a later call need not claim to have seen. */
+export function writtenBy(ops) {
+    const out = new Set();
+    for (const op of ops) {
+        for (const primitive of op.primitives) {
+            if (primitive.op === "add-node")
+                out.add(primitive.node.id);
+            for (const [node, field] of fieldsWritten(primitive))
+                out.add(key(node, field));
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=revisions.js.map

package/dist/ops/revisions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"revisions.js","sourceRoot":"","sources":["../../src/ops/revisions.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,CAAC;AA4BhC,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,KAAa,EAAE,EAAE,CAAC,GAAG,IAAI,SAAS,KAAK,EAAE,CAAC;AAErE,kDAAkD;AAClD,MAAM,UAAU,aAAa,CAAC,SAAoB;IAChD,IAAI,SAAS,CAAC,EAAE,KAAK,UAAU,EAAE,CAAC;QAChC,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;aAC/B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,MAAM,CAAC;aACrD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAU,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,SAAS,CAAC,EAAE,KAAK,YAAY;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,CAAU,CAAC,CAAC;IACtH,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,cAAc;IACR,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IAElD,2EAA2E;IAC3E,MAAM,CAAC,EAAE,CAAC,GAAyB;QACjC,MAAM,SAAS,GAAG,IAAI,cAAc,EAAE,CAAC;QACvC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,0DAA0D;IAC1D,IAAI,CAAC,GAAyB;QAC5B,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACrB,KAAK,MAAM,SAAS,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC;gBACtC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC;oBACrD,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;oBAC5B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,aAAa,CAAC,GAAG,EAAE,CAAC,GAAG;wBAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;gBAC/E,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,EAAE,CAAC,IAAY,EAAE,KAAa;QAC5B,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,aAAa,CAAC;IAC1D,CAAC;IAED,+HAA+H;IAC/H,OAAO,CAAC,GAAyB,EAAE,OAA4B,IAAI,GAAG,EAAE;QACtE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAyB,CAAC;QAC9C,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACrB,KAAK,MAAM,SAAS,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC;gBACtC,IAAI,SAAS,CAAC,EAAE,KAAK,UAAU;oBAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAChE,IAAI,SAAS,CAAC,EAAE,KAAK,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;oBAAE,SAAS;gBACnG,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;oBACjD,MAAM,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;oBACpC,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;wBAAE,SAAS;oBAC3C,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;gBACjF,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5B,CAAC;IAED,yFAAyF;IACzF,KAAK,CAAC,IAA8B;QAClC,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,CAAC;IAChF,CAAC;CACF;AAED,6GAA6G;AAC7G,MAAM,UAAU,SAAS,CAAC,GAAyB;IACjD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;QACrB,KAAK,MAAM,SAAS,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC;YACtC,IAAI,SAAS,CAAC,EAAE,KAAK,UAAU;gBAAE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC5D,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,aAAa,CAAC,SAAS,CAAC;gBAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/ops/types.d.ts

@@ -14,7 +14,25 @@ export interface Author {
     readonly kind: "human" | "agent" | "rule" | "system";
     readonly id?: string;
     readonly session?: string;
+    /**
+     * The author's own name, for a reader who has no record or seat to look
+     * it up in — another person in a hosted app, an agent from a chat. Said
+     * before any id is (FR-17).
+     */
+    readonly name?: string;
+    /**
+     * WHO THIS IS FOR. An agent acting for a person records both — "Claude,
+     * for Nick" — and is bounded by that person's roles as well as its own
+     * (FR-06).
+     */
+    readonly onBehalfOf?: Author;
 }
+/**
+ * THE CHANNEL an op came through: `web` (a person at the interface),
+ * `mcp:<client>` (an agent's tool call), `view:<name>` (a view acting for
+ * its viewer), `api`, `cli`. A fact in the log, beside who and for whom.
+ */
+export type Via = "web" | "api" | "cli" | `mcp:${string}` | `view:${string}` | (string & {});
 /**
  * One entry in the append-only log. The graph is a fold over these.
  *
@@ -29,8 +47,20 @@ export interface Operation {
     /** One user gesture, or one agent turn. */
     readonly batch: string;
     readonly author: Author;
-    /** Human-readable statement of what was meant, not what changed. */
+    /**
+     * Human-readable statement of what was meant, not what changed: the act's
+     * own `describe()` sentence ("Add “Book the van”"), or "Undo: …".
+     */
     readonly intent: string;
+    /**
+     * What the whole gesture was for, when its caller said ("Plan the move"),
+     * on every op of the batch. Beside `intent`, never instead of it (FR-18):
+     * an op keeps its own sentence, so a blocked undo, the record's history
+     * and an audit still say what each op did, and the batch reads as what
+     * was meant. Absent when no intent was given, and the batch reads as its
+     * ops, as it always did.
+     */
+    readonly batchIntent?: string;
     readonly mutation: MutationCall | null;
     readonly primitives: readonly Primitive[];
     readonly inverse: readonly Primitive[];
@@ -39,6 +69,24 @@ export interface Operation {
     readonly at: string;
     /** Set when this op exists to undo another one. */
     readonly undoes?: string;
+    /** What the change came through, when the caller said (FR-06). */
+    readonly via?: Via;
+    /**
+     * SOMETHING YOU CANNOT SEE HAPPENED HERE (FR-16). Set on an op a store
+     * served to a seat that may not see what it touched: it keeps its id,
+     * seq, batch and time, so the log has no hole, and nothing else of its
+     * own — its author, intent, call and inverse are withheld, and its
+     * primitives, reads and writes keep only what the seat may see. Absent
+     * on every op a store makes; an op without it reads as before.
+     */
+    readonly withheld?: true;
+    /**
+     * THE MODULES THIS OP LEAVES ON (FR-12). Set only on an op authored
+     * `system · modules`, which turns modules off or on and touches no
+     * record: the store's enabled set is the one the last such op says. An
+     * op without it reads as before, and folds the same.
+     */
+    readonly enabledModules?: readonly string[];
 }
 export interface Batch {
     readonly id: string;

package/dist/ops/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/ops/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAE1D,MAAM,WAAW,MAAM;IACrB;;;;;;;;;OASG;IACH,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAC;IACrD,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,qCAAqC;IACrC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,2CAA2C;IAC3C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,oEAAoE;IACpE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,YAAY,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,UAAU,EAAE,SAAS,SAAS,EAAE,CAAC;IAC1C,QAAQ,CAAC,OAAO,EAAE,SAAS,SAAS,EAAE,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,mDAAmD;IACnD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,GAAG,EAAE,SAAS,SAAS,EAAE,CAAC;IACnC,uEAAuE;IACvE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/ops/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAE1D,MAAM,WAAW,MAAM;IACrB;;;;;;;;;OASG;IACH,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAC;IACrD,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;GAIG;AACH,MAAM,MAAM,GAAG,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,OAAO,MAAM,EAAE,GAAG,QAAQ,MAAM,EAAE,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAE7F;;;;;;GAMG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,qCAAqC;IACrC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,2CAA2C;IAC3C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,YAAY,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,UAAU,EAAE,SAAS,SAAS,EAAE,CAAC;IAC1C,QAAQ,CAAC,OAAO,EAAE,SAAS,SAAS,EAAE,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,mDAAmD;IACnD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,kEAAkE;IAClE,QAAQ,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC;IACnB;;;;;;;OAOG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7C;AAED,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,GAAG,EAAE,SAAS,SAAS,EAAE,CAAC;IACnC,uEAAuE;IACvE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B"}

package/dist/ops/undo.d.ts

@@ -1,4 +1,5 @@
-import type { OperationLog } from "./log.js";
+import { GraphError } from "../graph/graph.js";
+import type { LogReading } from "./log.js";
 import type { Operation } from "./types.js";
 export interface UndoBlock {
     /** The op that read something the undo target wrote. */
@@ -17,13 +18,33 @@ export type UndoCheck = {
     readonly includeBatches: readonly string[];
     readonly message: string;
 };
+/** An undo check that said no. */
+export type UndoRefused = Extract<UndoCheck, {
+    readonly ok: false;
+}>;
+/**
+ * AN UNDO THAT CANNOT RUN, AND WHY (FR-18): a later op read what it wrote
+ * (`blockedBy` names each, with what it read), it would reach back across a
+ * declaration change or behind the undo horizon (FR-23), or there was
+ * nothing live to undo. `check` is the `canUndo` answer it was refused on,
+ * so a host can offer to bring the blocking batches along
+ * (`check.includeBatches`) without asking again.
+ *
+ * Still a `GraphError`: a caller that caught those before catches this.
+ */
+export declare class UndoBlockedError extends GraphError {
+    readonly check: UndoRefused;
+    constructor(check: UndoRefused);
+    /** The ops in the way, with what each read that the undo would take back. */
+    get blockedBy(): readonly UndoBlock[];
+}
 /**
  * Undoing an op out of order is legal exactly when no later live op read
  * something it wrote. That is a checkable condition rather than a policy —
  * so when it fails the framework can name the blocking op and offer to bring
  * it along, instead of refusing or corrupting state.
  */
-export declare function checkUndo(log: OperationLog, batchIds: readonly string[]): UndoCheck;
+export declare function checkUndo(log: LogReading, batchIds: readonly string[]): UndoCheck;
 /**
  * The primitives an undo would apply: each op's stored inverse, newest first,
  * so dependent writes come apart in the order they went together. (An op's

package/dist/ops/undo.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"undo.d.ts","sourceRoot":"","sources":["../../src/ops/undo.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAC7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,MAAM,WAAW,SAAS;IACxB,wDAAwD;IACxD,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC;IACvB,kDAAkD;IAClD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED,MAAM,MAAM,SAAS,GACjB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,SAAS,EAAE,CAAA;CAAE,GACzD;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,GAAG,EAAE,SAAS,SAAS,EAAE,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,SAAS,SAAS,EAAE,CAAC;IACzC,sEAAsE;IACtE,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEN;;;;;GAKG;AACH,wBAAgB,SAAS,CACvB,GAAG,EAAE,YAAY,EACjB,QAAQ,EAAE,SAAS,MAAM,EAAE,GAC1B,SAAS,CAgDX;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,SAAS,SAAS,EAAE,qCAEvD"}
+{"version":3,"file":"undo.d.ts","sourceRoot":"","sources":["../../src/ops/undo.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAG5C,MAAM,WAAW,SAAS;IACxB,wDAAwD;IACxD,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC;IACvB,kDAAkD;IAClD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED,MAAM,MAAM,SAAS,GACjB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,SAAS,EAAE,CAAA;CAAE,GACzD;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,GAAG,EAAE,SAAS,SAAS,EAAE,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,SAAS,SAAS,EAAE,CAAC;IACzC,sEAAsE;IACtE,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEN,kCAAkC;AAClC,MAAM,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,EAAE;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAA;CAAE,CAAC,CAAC;AAErE;;;;;;;;;GASG;AACH,qBAAa,gBAAiB,SAAQ,UAAU;IAClC,QAAQ,CAAC,KAAK,EAAE,WAAW;gBAAlB,KAAK,EAAE,WAAW;IAKvC,6EAA6E;IAC7E,IAAI,SAAS,IAAI,SAAS,SAAS,EAAE,CAEpC;CACF;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CACvB,GAAG,EAAE,UAAU,EACf,QAAQ,EAAE,SAAS,MAAM,EAAE,GAC1B,SAAS,CAsIX;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,SAAS,SAAS,EAAE,qCAEvD"}

package/dist/ops/undo.js

@@ -1,3 +1,27 @@
+import { GraphError } from "../graph/graph.js";
+import { isWithheld } from "./withheld.js";
+/**
+ * AN UNDO THAT CANNOT RUN, AND WHY (FR-18): a later op read what it wrote
+ * (`blockedBy` names each, with what it read), it would reach back across a
+ * declaration change or behind the undo horizon (FR-23), or there was
+ * nothing live to undo. `check` is the `canUndo` answer it was refused on,
+ * so a host can offer to bring the blocking batches along
+ * (`check.includeBatches`) without asking again.
+ *
+ * Still a `GraphError`: a caller that caught those before catches this.
+ */
+export class UndoBlockedError extends GraphError {
+    check;
+    constructor(check) {
+        super(check.message);
+        this.check = check;
+        this.name = "UndoBlockedError";
+    }
+    /** The ops in the way, with what each read that the undo would take back. */
+    get blockedBy() {
+        return this.check.blockedBy;
+    }
+}
 /**
  * Undoing an op out of order is legal exactly when no later live op read
  * something it wrote. That is a checkable condition rather than a policy —
@@ -10,6 +34,26 @@ export function checkUndo(log, batchIds) {
     const ops = log
         .all()
         .filter((op) => targets.has(op.batch) && !undone.has(op.id));
+    /*
+     * NOT BEHIND THE UNDO HORIZON (FR-23). A compacted log holds nothing
+     * before its checkpoint, so a batch it holds no op of is behind the
+     * horizon, or was never made: either way there is nothing here to put
+     * back, and the sentence names where history stops.
+     */
+    const horizon = [...log.epochs()].reverse().find((epoch) => epoch.horizon);
+    if (horizon) {
+        const held = new Set(log.all().map((op) => op.batch));
+        const behind = batchIds.filter((id) => !held.has(id));
+        if (behind.length > 0) {
+            return {
+                ok: false,
+                ops,
+                blockedBy: [],
+                includeBatches: [],
+                message: `Cannot undo ${behind.map((id) => `batch ${id}`).join(", ")}: it is not after the undo horizon at op ${horizon.seq}${horizon.at ? ` (${horizon.at})` : ""}. What was done before the horizon is archived, and undo does not reach behind it.`,
+            };
+        }
+    }
     if (ops.length === 0) {
         return {
             ok: false,
@@ -21,11 +65,58 @@ export function checkUndo(log, batchIds) {
                 : `Nothing live to undo in ${batchIds.join(", ")} — already undone, or never applied`,
         };
     }
+    /*
+     * NOT A CHANGE YOU CANNOT SEE (FR-16). A withheld op carries no inverse
+     * to put back, and taking it back is for somebody who can see it; the
+     * sentence says so without saying what it was.
+     */
+    if (ops.some(isWithheld)) {
+        return {
+            ok: false,
+            ops,
+            blockedBy: [],
+            includeBatches: [],
+            message: ops.every(isWithheld)
+                ? "Cannot undo a change you cannot see: only somebody who can see it can take it back."
+                : "Cannot undo this here: part of it is a change you cannot see, and only somebody who can see it can take it back.",
+        };
+    }
+    /*
+     * NOT A MODULE TURNED OFF OR ON (FR-12). It touches no record, so there
+     * is nothing to put back, and the workspace's set is changed by turning
+     * the module the other way — which is the host's to do.
+     */
+    if (ops.some((op) => op.enabledModules !== undefined)) {
+        return {
+            ok: false,
+            ops,
+            blockedBy: [],
+            includeBatches: [],
+            message: "Cannot undo turning a module off or on: it is changed by turning the module the other way.",
+        };
+    }
     const writes = new Set();
     for (const op of ops)
         for (const id of op.writes)
             writes.add(id);
     const earliest = Math.min(...ops.map((op) => op.seq));
+    /*
+     * NOT ACROSS A DECLARATION CHANGE (FR-27). An op from before the change
+     * carries an inverse written in the old declaration's words: putting it
+     * back would write the old shape into the new graph. The change is named,
+     * since it is what stands in the way, not anything a person did since.
+     */
+    const crossed = log.epochs().find((epoch) => epoch.change !== undefined && epoch.seq > earliest);
+    if (crossed) {
+        const before = ops.find((op) => op.seq < crossed.seq);
+        return {
+            ok: false,
+            ops,
+            blockedBy: [],
+            includeBatches: [],
+            message: `Cannot undo "${before.intent}": it was done before the declaration changed (${crossed.change}), and undo does not reach back across that change.`,
+        };
+    }
     const blockedBy = [];
     for (const op of log.all()) {
         if (op.seq <= earliest)
@@ -40,10 +131,25 @@ export function checkUndo(log, batchIds) {
     }
     if (blockedBy.length === 0)
         return { ok: true, ops };
-    const includeBatches = [...new Set(blockedBy.map((b) => b.op.batch))];
+    /*
+     * A LATER CHANGE YOU CANNOT SEE is said to be one, and nothing more: not
+     * its sentence, its id or what it read (FR-16). It cannot come along
+     * either, so no batch is offered while one stands in the way.
+     */
     const named = blockedBy
+        .filter((b) => !isWithheld(b.op))
         .map((b) => `"${b.op.intent}" (op ${b.op.id}, read ${b.overlap.join(", ")})`)
         .join("; ");
+    if (blockedBy.some((b) => isWithheld(b.op))) {
+        return {
+            ok: false,
+            ops,
+            blockedBy,
+            includeBatches: [],
+            message: `Cannot undo on its own — ${named ? `a later operation depends on it: ${named}; and ` : ""}a later change you cannot see depends on it, which only somebody who can see it can take back.`,
+        };
+    }
+    const includeBatches = [...new Set(blockedBy.map((b) => b.op.batch))];
     return {
         ok: false,
         ops,

package/dist/ops/undo.js.map

@@ -1 +1 @@
-{"version":3,"file":"undo.js","sourceRoot":"","sources":["../../src/ops/undo.ts"],"names":[],"mappings":"AAqBA;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CACvB,GAAiB,EACjB,QAA2B;IAE3B,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,GAAG,CAAC,SAAS,EAAE,CAAC;IAC/B,MAAM,GAAG,GAAG,GAAG;SACZ,GAAG,EAAE;SACL,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAE/D,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,GAAG;YACH,SAAS,EAAE,EAAE;YACb,cAAc,EAAE,EAAE;YAClB,OAAO,EACL,QAAQ,CAAC,MAAM,KAAK,CAAC;gBACnB,CAAC,CAAC,wBAAwB;gBAC1B,CAAC,CAAC,2BAA2B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,qCAAqC;SAC1F,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,KAAK,MAAM,EAAE,IAAI,GAAG;QAAE,KAAK,MAAM,EAAE,IAAI,EAAE,CAAC,MAAM;YAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAEtD,MAAM,SAAS,GAAgB,EAAE,CAAC;IAClC,KAAK,MAAM,EAAE,IAAI,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC;QAC3B,IAAI,EAAE,CAAC,GAAG,IAAI,QAAQ;YAAE,SAAS;QACjC,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC;YAAE,SAAS;QACpC,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YAAE,SAAS;QAChC,MAAM,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QACxD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IAErD,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACtE,MAAM,KAAK,GAAG,SAAS;SACpB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,MAAM,SAAS,CAAC,CAAC,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;SAC5E,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO;QACL,EAAE,EAAE,KAAK;QACT,GAAG;QACH,SAAS;QACT,cAAc;QACd,OAAO,EAAE,6DAA6D,KAAK,aAAa,cAAc;aACnG,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC;aAC1B,IAAI,CAAC,IAAI,CAAC,yBAAyB;KACvC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,GAAyB;IACtD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;AAC5E,CAAC"}
+{"version":3,"file":"undo.js","sourceRoot":"","sources":["../../src/ops/undo.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAG/C,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAuB3C;;;;;;;;;GASG;AACH,MAAM,OAAO,gBAAiB,SAAQ,UAAU;IACzB;IAArB,YAAqB,KAAkB;QACrC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QADF,UAAK,GAAL,KAAK,CAAa;QAErC,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;IAED,6EAA6E;IAC7E,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;IAC9B,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CACvB,GAAe,EACf,QAA2B;IAE3B,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,GAAG,CAAC,SAAS,EAAE,CAAC;IAC/B,MAAM,GAAG,GAAG,GAAG;SACZ,GAAG,EAAE;SACL,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAE/D;;;;;OAKG;IACH,MAAM,OAAO,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3E,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QACtD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,GAAG;gBACH,SAAS,EAAE,EAAE;gBACb,cAAc,EAAE,EAAE;gBAClB,OAAO,EAAE,eAAe,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,4CAA4C,OAAO,CAAC,GAAG,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,oFAAoF;aACvP,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,GAAG;YACH,SAAS,EAAE,EAAE;YACb,cAAc,EAAE,EAAE;YAClB,OAAO,EACL,QAAQ,CAAC,MAAM,KAAK,CAAC;gBACnB,CAAC,CAAC,wBAAwB;gBAC1B,CAAC,CAAC,2BAA2B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,qCAAqC;SAC1F,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACzB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,GAAG;YACH,SAAS,EAAE,EAAE;YACb,cAAc,EAAE,EAAE;YAClB,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC;gBAC5B,CAAC,CAAC,qFAAqF;gBACvF,CAAC,CAAC,kHAAkH;SACvH,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,cAAc,KAAK,SAAS,CAAC,EAAE,CAAC;QACtD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,GAAG;YACH,SAAS,EAAE,EAAE;YACb,cAAc,EAAE,EAAE;YAClB,OAAO,EAAE,4FAA4F;SACtG,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,KAAK,MAAM,EAAE,IAAI,GAAG;QAAE,KAAK,MAAM,EAAE,IAAI,EAAE,CAAC,MAAM;YAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAEtD;;;;;OAKG;IACH,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,GAAG,GAAG,QAAQ,CAAC,CAAC;IACjG,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAE,CAAC;QACvD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,GAAG;YACH,SAAS,EAAE,EAAE;YACb,cAAc,EAAE,EAAE;YAClB,OAAO,EAAE,gBAAgB,MAAM,CAAC,MAAM,kDAAkD,OAAO,CAAC,MAAM,qDAAqD;SAC5J,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAgB,EAAE,CAAC;IAClC,KAAK,MAAM,EAAE,IAAI,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC;QAC3B,IAAI,EAAE,CAAC,GAAG,IAAI,QAAQ;YAAE,SAAS;QACjC,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC;YAAE,SAAS;QACpC,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YAAE,SAAS;QAChC,MAAM,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QACxD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IAErD;;;;OAIG;IACH,MAAM,KAAK,GAAG,SAAS;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;SAChC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,MAAM,SAAS,CAAC,CAAC,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;SAC5E,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAC5C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,GAAG;YACH,SAAS;YACT,cAAc,EAAE,EAAE;YAClB,OAAO,EAAE,4BAA4B,KAAK,CAAC,CAAC,CAAC,oCAAoC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,gGAAgG;SACpM,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACtE,OAAO;QACL,EAAE,EAAE,KAAK;QACT,GAAG;QACH,SAAS;QACT,cAAc;QACd,OAAO,EAAE,6DAA6D,KAAK,aAAa,cAAc;aACnG,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC;aAC1B,IAAI,CAAC,IAAI,CAAC,yBAAyB;KACvC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,GAAyB;IACtD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;AAC5E,CAAC"}

package/dist/ops/withheld.d.ts

@@ -0,0 +1,37 @@
+import type { Primitive } from "../graph/primitives.js";
+import type { Author, Operation } from "./types.js";
+/**
+ * A LOG A SEAT MAY NOT FULLY SEE IS REDACTED, NOT GAPPED (FR-16).
+ *
+ * A store that keeps some records from a seat cannot simply drop the ops
+ * that touched them: a log is contiguous by construction (undo, replay and
+ * `OperationLog.from` all count on it), and a hole would also say less than
+ * the truth — something did happen there. So the op stays, as a WITHHELD
+ * op: its place in the log and nothing that says what it was.
+ */
+/** What a withheld op says it was, wherever it is read out. */
+export declare const WITHHELD_INTENT = "A change you cannot see";
+/** Who a withheld op says made it: nobody this seat may be told about. */
+export declare const WITHHELD_AUTHOR: Author;
+/** Whether an op is one a store withheld from the seat reading it. */
+export declare function isWithheld(op: Pick<Operation, "withheld">): boolean;
+/** The record ids a primitive touches. */
+export declare function touchedBy(primitive: Primitive): readonly string[];
+/**
+ * Whether an op touched, read or named anything `sees` says no to: then it
+ * is withheld whole, because its sentence ("Book a test drive for Freya")
+ * names what it touched as surely as its primitives do.
+ */
+export declare function touchesUnseen(op: Operation, sees: (id: string) => boolean): boolean;
+/**
+ * THE OP AS A SEAT THAT MAY NOT SEE IT RECEIVES IT. Its id, seq, batch and
+ * time stand; who made it, what it meant, the call and the inverse go. Its
+ * primitives keep the ones that touch only what the seat sees — a change to
+ * a record the seat can see still reaches it, or its copy of the graph
+ * would go stale — and its reads and writes keep only seen ids, so an undo
+ * the seat asks for is still blocked by it where it should be.
+ */
+export declare function withhold(op: Operation, sees: (id: string) => boolean): Operation;
+/** Every op of a log as a seat receives it: what it may see as it is, the rest withheld in place. */
+export declare function redact(ops: readonly Operation[], sees: (id: string) => boolean): Operation[];
+//# sourceMappingURL=withheld.d.ts.map

package/dist/ops/withheld.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"withheld.d.ts","sourceRoot":"","sources":["../../src/ops/withheld.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEpD;;;;;;;;GAQG;AAEH,+DAA+D;AAC/D,eAAO,MAAM,eAAe,4BAA4B,CAAC;AAEzD,0EAA0E;AAC1E,eAAO,MAAM,eAAe,EAAE,MAA4D,CAAC;AAE3F,sEAAsE;AACtE,wBAAgB,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,GAAG,OAAO,CAEnE;AAED,0CAA0C;AAC1C,wBAAgB,SAAS,CAAC,SAAS,EAAE,SAAS,GAAG,SAAS,MAAM,EAAE,CAWjE;AAUD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAInF;AAED;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,GAAG,SAAS,CAgBhF;AAED,qGAAqG;AACrG,wBAAgB,MAAM,CAAC,GAAG,EAAE,SAAS,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,GAAG,SAAS,EAAE,CAE5F"}

package/dist/ops/withheld.js

@@ -0,0 +1,84 @@
+/**
+ * A LOG A SEAT MAY NOT FULLY SEE IS REDACTED, NOT GAPPED (FR-16).
+ *
+ * A store that keeps some records from a seat cannot simply drop the ops
+ * that touched them: a log is contiguous by construction (undo, replay and
+ * `OperationLog.from` all count on it), and a hole would also say less than
+ * the truth — something did happen there. So the op stays, as a WITHHELD
+ * op: its place in the log and nothing that says what it was.
+ */
+/** What a withheld op says it was, wherever it is read out. */
+export const WITHHELD_INTENT = "A change you cannot see";
+/** Who a withheld op says made it: nobody this seat may be told about. */
+export const WITHHELD_AUTHOR = { kind: "system", id: "withheld", name: "Someone" };
+/** Whether an op is one a store withheld from the seat reading it. */
+export function isWithheld(op) {
+    return op.withheld === true;
+}
+/** The record ids a primitive touches. */
+export function touchedBy(primitive) {
+    switch (primitive.op) {
+        case "add-node":
+        case "remove-node":
+            return [primitive.node.id];
+        case "patch-node":
+            return [primitive.id];
+        case "add-edge":
+        case "remove-edge":
+            return [primitive.edge.from, primitive.edge.to];
+    }
+}
+/** Every string a call's arguments hold, at any depth: where a record's id would be. */
+function strings(value, into = []) {
+    if (typeof value === "string")
+        into.push(value);
+    else if (Array.isArray(value))
+        for (const inner of value)
+            strings(inner, into);
+    else if (value !== null && typeof value === "object")
+        for (const inner of Object.values(value))
+            strings(inner, into);
+    return into;
+}
+/**
+ * Whether an op touched, read or named anything `sees` says no to: then it
+ * is withheld whole, because its sentence ("Book a test drive for Freya")
+ * names what it touched as surely as its primitives do.
+ */
+export function touchesUnseen(op, sees) {
+    if (op.primitives.some((primitive) => touchedBy(primitive).some((id) => !sees(id))))
+        return true;
+    if (op.writes.some((id) => !sees(id)) || op.reads.some((id) => !sees(id)))
+        return true;
+    return op.mutation !== null && strings(op.mutation.args).some((value) => !sees(value));
+}
+/**
+ * THE OP AS A SEAT THAT MAY NOT SEE IT RECEIVES IT. Its id, seq, batch and
+ * time stand; who made it, what it meant, the call and the inverse go. Its
+ * primitives keep the ones that touch only what the seat sees — a change to
+ * a record the seat can see still reaches it, or its copy of the graph
+ * would go stale — and its reads and writes keep only seen ids, so an undo
+ * the seat asks for is still blocked by it where it should be.
+ */
+export function withhold(op, sees) {
+    return {
+        id: op.id,
+        seq: op.seq,
+        batch: op.batch,
+        author: WITHHELD_AUTHOR,
+        intent: WITHHELD_INTENT,
+        mutation: null,
+        primitives: op.primitives.filter((primitive) => touchedBy(primitive).every(sees)),
+        inverse: [],
+        reads: op.reads.filter(sees),
+        writes: op.writes.filter(sees),
+        at: op.at,
+        ...(op.undoes !== undefined ? { undoes: op.undoes } : {}),
+        withheld: true,
+    };
+}
+/** Every op of a log as a seat receives it: what it may see as it is, the rest withheld in place. */
+export function redact(ops, sees) {
+    return ops.map((op) => (op.withheld || !touchesUnseen(op, sees) ? op : withhold(op, sees)));
+}
+//# sourceMappingURL=withheld.js.map

package/dist/ops/withheld.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"withheld.js","sourceRoot":"","sources":["../../src/ops/withheld.ts"],"names":[],"mappings":"AAGA;;;;;;;;GAQG;AAEH,+DAA+D;AAC/D,MAAM,CAAC,MAAM,eAAe,GAAG,yBAAyB,CAAC;AAEzD,0EAA0E;AAC1E,MAAM,CAAC,MAAM,eAAe,GAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAE3F,sEAAsE;AACtE,MAAM,UAAU,UAAU,CAAC,EAA+B;IACxD,OAAO,EAAE,CAAC,QAAQ,KAAK,IAAI,CAAC;AAC9B,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,SAAS,CAAC,SAAoB;IAC5C,QAAQ,SAAS,CAAC,EAAE,EAAE,CAAC;QACrB,KAAK,UAAU,CAAC;QAChB,KAAK,aAAa;YAChB,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7B,KAAK,YAAY;YACf,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACxB,KAAK,UAAU,CAAC;QAChB,KAAK,aAAa;YAChB,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpD,CAAC;AACH,CAAC;AAED,wFAAwF;AACxF,SAAS,OAAO,CAAC,KAAc,EAAE,OAAiB,EAAE;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SAC3C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,KAAK,MAAM,KAAK,IAAI,KAAK;YAAE,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;SAC1E,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACrH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,EAAa,EAAE,IAA6B;IACxE,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACjG,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACvF,OAAO,EAAE,CAAC,QAAQ,KAAK,IAAI,IAAI,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AACzF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,QAAQ,CAAC,EAAa,EAAE,IAA6B;IACnE,OAAO;QACL,EAAE,EAAE,EAAE,CAAC,EAAE;QACT,GAAG,EAAE,EAAE,CAAC,GAAG;QACX,KAAK,EAAE,EAAE,CAAC,KAAK;QACf,MAAM,EAAE,eAAe;QACvB,MAAM,EAAE,eAAe;QACvB,QAAQ,EAAE,IAAI;QACd,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjF,OAAO,EAAE,EAAE;QACX,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC;QAC5B,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;QAC9B,EAAE,EAAE,EAAE,CAAC,EAAE;QACT,GAAG,CAAC,EAAE,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,QAAQ,EAAE,IAAI;KACf,CAAC;AACJ,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,MAAM,CAAC,GAAyB,EAAE,IAA6B;IAC7E,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,QAAQ,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AAC9F,CAAC"}

package/dist/permissions/policy.d.ts

@@ -1,6 +1,21 @@
 import type { AnyMutationDefinition } from "../mutations/types.js";
 import type { AnySchema } from "../schema/schema.js";
 import type { Policy, Principal, Refusal } from "./types.js";
+/**
+ * THE SEAT A POLICY JUDGES, delegation read through (FR-06). An agent acting
+ * for a person may do what BOTH may: its roles are the intersection of its
+ * own and theirs (an agent that declared none takes the person's), and a
+ * `self` grant — "you, on yours" — is about the person, not the agent. A
+ * principal acting for nobody is judged as itself.
+ */
+export declare function actingAs(principal: Principal): Principal;
+/**
+ * THE HOST'S OWN WORK HAS A SEAT (FR-17). A template's setup, a seed, a
+ * migration applied by the system is not a person a policy was written
+ * about, and `roles: ["*"]` matched no grant — so a host gave its system
+ * every role the policy named. `system` is a kind, not a role: it passes.
+ */
+export declare const isSystem: (principal: Principal) => boolean;
 /**
  * WHAT A REFUSAL CALLS THINGS. The policy knows acts and roles by their
  * names; a person reads "Not permitted: close-deal on a deal — sales-manager

package/dist/permissions/policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/permissions/policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,KAAK,EAAS,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAWpE;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IACxD,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;CAC1C;AAQD;;;;;;GAMG;AACH,wBAAgB,OAAO,CACrB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,SAAS,EAAE,SAAS,EACpB,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,MAAM;AACb;;;;;GAKG;AACH,GAAG,CAAC,EAAE,SAAS,MAAM,EAAE;AACvB;;;GAGG;AACH,SAAS,CAAC,EAAE,MAAM;AAClB,qFAAqF;AACrF,KAAK,GAAE,WAAgB,GACtB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CA8D3E;AAwBD;;;;;;;;;GASG;AACH,wBAAgB,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAUzF;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,MAAM,GACZ,SAAS,MAAM,EAAE,CAcnB;AAED,yEAAyE;AACzE,wBAAgB,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAQzD;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,SAAS,SAAS,EACpD,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,SAAS,EAAE,SAAS,EACpB,SAAS,EAAE,SAAS,qBAAqB,CAAC,CAAC,CAAC,EAAE,GAC7C,SAAS,qBAAqB,CAAC,CAAC,CAAC,EAAE,CAUrC"}
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/permissions/policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,KAAK,EAAS,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAKpE;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,SAAS,CAMxD;AAED;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,GAAI,WAAW,SAAS,KAAG,OAA4E,CAAC;AAQ7H;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IACxD,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;CAC1C;AAQD;;;;;;GAMG;AACH,wBAAgB,OAAO,CACrB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,SAAS,EAAE,SAAS,EACpB,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,MAAM;AACb;;;;;GAKG;AACH,GAAG,CAAC,EAAE,SAAS,MAAM,EAAE;AACvB;;;GAGG;AACH,SAAS,CAAC,EAAE,MAAM;AAClB,qFAAqF;AACrF,KAAK,GAAE,WAAgB,GACtB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAgE3E;AAwBD;;;;;;;;;GASG;AACH,wBAAgB,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAUzF;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,MAAM,GACZ,SAAS,MAAM,EAAE,CAcnB;AAED,yEAAyE;AACzE,wBAAgB,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAQzD;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,SAAS,SAAS,EACpD,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,SAAS,EAAE,SAAS,EACpB,SAAS,EAAE,SAAS,qBAAqB,CAAC,CAAC,CAAC,EAAE,GAC7C,SAAS,qBAAqB,CAAC,CAAC,CAAC,EAAE,CAYrC"}

package/dist/permissions/policy.js

@@ -1,5 +1,27 @@
 import { humaniseField, withArticle } from "../schema/define-node.js";
 const matches = (allowed, value) => allowed === "*" || allowed.includes(value);
+/**
+ * THE SEAT A POLICY JUDGES, delegation read through (FR-06). An agent acting
+ * for a person may do what BOTH may: its roles are the intersection of its
+ * own and theirs (an agent that declared none takes the person's), and a
+ * `self` grant — "you, on yours" — is about the person, not the agent. A
+ * principal acting for nobody is judged as itself.
+ */
+export function actingAs(principal) {
+    const person = principal.onBehalfOf;
+    if (!person)
+        return principal;
+    const theirs = person.roles ?? [];
+    const roles = principal.roles === undefined ? theirs : principal.roles.filter((role) => theirs.includes(role));
+    return { ...principal, ...(person.id !== undefined ? { id: person.id } : {}), roles };
+}
+/**
+ * THE HOST'S OWN WORK HAS A SEAT (FR-17). A template's setup, a seed, a
+ * migration applied by the system is not a person a policy was written
+ * about, and `roles: ["*"]` matched no grant — so a host gave its system
+ * every role the policy named. `system` is a kind, not a role: it passes.
+ */
+export const isSystem = (principal) => principal.kind === "system" && principal.onBehalfOf === undefined;
 /** Whether a grant covers a principal at all, before looking at the call. */
 function grantsTo(grant, principal) {
     if (grant.roles === "*")
@@ -36,6 +58,9 @@ words = {}) {
     // No policy means permission is not a concern in this installation.
     if (!policy)
         return { ok: true };
+    if (isSystem(principal))
+        return { ok: true };
+    principal = actingAs(principal);
     /*
      * A derived act is permitted when the policy names it (or says `*`) —
      * the grants are read first, as for any act — and otherwise when any of
@@ -185,7 +210,9 @@ export function permittedMutations(policy, principal, mutations) {
         const kinds = subject && subject.kinds !== "*" ? subject.kinds : [undefined];
         // Permitted for ANY of its subject kinds is enough to offer the tool; the
         // store still refuses the individual call that is not allowed.
-        return kinds.some((kind) => permits(policy, principal, mutation.name, kind).ok);
+        // A `self` grant is offered with the principal as its subject: "ask, on
+        // yours" is an act the principal has, though only ever on themselves.
+        return kinds.some((kind) => permits(policy, principal, mutation.name, kind, undefined, actingAs(principal).id).ok);
     });
 }
 //# sourceMappingURL=policy.js.map