@graview/core 0.1.0 → 0.1.3

package/dist/permissions/policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/permissions/policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,KAAK,EAAS,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAWpE;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IACxD,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;CAC1C;AAQD;;;;;;GAMG;AACH,wBAAgB,OAAO,CACrB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,SAAS,EAAE,SAAS,EACpB,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,MAAM;AACb;;;;;GAKG;AACH,GAAG,CAAC,EAAE,SAAS,MAAM,EAAE;AACvB;;;GAGG;AACH,SAAS,CAAC,EAAE,MAAM;AAClB,qFAAqF;AACrF,KAAK,GAAE,WAAgB,GACtB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CA8D3E;AAwBD;;;;;;;;;GASG;AACH,wBAAgB,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAUzF;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,MAAM,GACZ,SAAS,MAAM,EAAE,CAcnB;AAED,yEAAyE;AACzE,wBAAgB,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAQzD;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,SAAS,SAAS,EACpD,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,SAAS,EAAE,SAAS,EACpB,SAAS,EAAE,SAAS,qBAAqB,CAAC,CAAC,CAAC,EAAE,GAC7C,SAAS,qBAAqB,CAAC,CAAC,CAAC,EAAE,CAUrC"}
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/permissions/policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,KAAK,EAAS,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAKpE;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,SAAS,CAMxD;AAED;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,GAAI,WAAW,SAAS,KAAG,OAA4E,CAAC;AAQ7H;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IACxD,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;CAC1C;AAQD;;;;;;GAMG;AACH,wBAAgB,OAAO,CACrB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,SAAS,EAAE,SAAS,EACpB,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,MAAM;AACb;;;;;GAKG;AACH,GAAG,CAAC,EAAE,SAAS,MAAM,EAAE;AACvB;;;GAGG;AACH,SAAS,CAAC,EAAE,MAAM;AAClB,qFAAqF;AACrF,KAAK,GAAE,WAAgB,GACtB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAgE3E;AAwBD;;;;;;;;;GASG;AACH,wBAAgB,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAUzF;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,MAAM,GACZ,SAAS,MAAM,EAAE,CAcnB;AAED,yEAAyE;AACzE,wBAAgB,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAQzD;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,SAAS,SAAS,EACpD,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,SAAS,EAAE,SAAS,EACpB,SAAS,EAAE,SAAS,qBAAqB,CAAC,CAAC,CAAC,EAAE,GAC7C,SAAS,qBAAqB,CAAC,CAAC,CAAC,EAAE,CAYrC"}

package/dist/permissions/policy.js

@@ -1,5 +1,27 @@
 import { humaniseField, withArticle } from "../schema/define-node.js";
 const matches = (allowed, value) => allowed === "*" || allowed.includes(value);
+/**
+ * THE SEAT A POLICY JUDGES, delegation read through (FR-06). An agent acting
+ * for a person may do what BOTH may: its roles are the intersection of its
+ * own and theirs (an agent that declared none takes the person's), and a
+ * `self` grant — "you, on yours" — is about the person, not the agent. A
+ * principal acting for nobody is judged as itself.
+ */
+export function actingAs(principal) {
+    const person = principal.onBehalfOf;
+    if (!person)
+        return principal;
+    const theirs = person.roles ?? [];
+    const roles = principal.roles === undefined ? theirs : principal.roles.filter((role) => theirs.includes(role));
+    return { ...principal, ...(person.id !== undefined ? { id: person.id } : {}), roles };
+}
+/**
+ * THE HOST'S OWN WORK HAS A SEAT (FR-17). A template's setup, a seed, a
+ * migration applied by the system is not a person a policy was written
+ * about, and `roles: ["*"]` matched no grant — so a host gave its system
+ * every role the policy named. `system` is a kind, not a role: it passes.
+ */
+export const isSystem = (principal) => principal.kind === "system" && principal.onBehalfOf === undefined;
 /** Whether a grant covers a principal at all, before looking at the call. */
 function grantsTo(grant, principal) {
     if (grant.roles === "*")
@@ -36,6 +58,9 @@ words = {}) {
     // No policy means permission is not a concern in this installation.
     if (!policy)
         return { ok: true };
+    if (isSystem(principal))
+        return { ok: true };
+    principal = actingAs(principal);
     /*
      * A derived act is permitted when the policy names it (or says `*`) —
      * the grants are read first, as for any act — and otherwise when any of
@@ -185,7 +210,9 @@ export function permittedMutations(policy, principal, mutations) {
         const kinds = subject && subject.kinds !== "*" ? subject.kinds : [undefined];
         // Permitted for ANY of its subject kinds is enough to offer the tool; the
         // store still refuses the individual call that is not allowed.
-        return kinds.some((kind) => permits(policy, principal, mutation.name, kind).ok);
+        // A `self` grant is offered with the principal as its subject: "ask, on
+        // yours" is an act the principal has, though only ever on themselves.
+        return kinds.some((kind) => permits(policy, principal, mutation.name, kind, undefined, actingAs(principal).id).ok);
     });
 }
 //# sourceMappingURL=policy.js.map

package/dist/permissions/policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/permissions/policy.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGtE,MAAM,OAAO,GAAG,CAAC,OAAgC,EAAE,KAAa,EAAW,EAAE,CAC3E,OAAO,KAAK,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAE7C,6EAA6E;AAC7E,SAAS,QAAQ,CAAC,KAAY,EAAE,SAAoB;IAClD,IAAI,KAAK,CAAC,KAAK,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AAC5E,CAAC;AAcD,6DAA6D;AAC7D,SAAS,SAAS,CAAC,KAAwB;IACzC,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACnF,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;AACtH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,OAAO,CACrB,MAA0B,EAC1B,SAAoB,EACpB,QAAgB,EAChB,IAAa;AACb;;;;;GAKG;AACH,GAAuB;AACvB;;;GAGG;AACH,SAAkB;AAClB,qFAAqF;AACrF,QAAqB,EAAE;IAEvB,oEAAoE;IACpE,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAEjC;;;;OAIG;IACH,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,IAAI,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QAC7F,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QAC7G;;;;;;WAMG;QACH,MAAM,KAAK,GAAG,CAAC,QAAQ,EAAE,GAAG,GAAG,CAAC,CAAC;QACjC,MAAM,SAAS,GAAG;YAChB,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;SACvE,CAAC,IAAI,EAAE,CAAC;QACT,MAAM,GAAG,GACP,SAAS,CAAC,MAAM,KAAK,CAAC;YACpB,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC;gBAChB,CAAC,CAAC,uDAAuD;gBACzD,CAAC,CAAC,aAAa;YACjB,CAAC,CAAC,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC;QACpC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,QAAQ;gBACR,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;gBACvC,SAAS;gBACT,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC;aAC/C;SACF,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;YAAE,SAAS;QAC1C,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC;YAAE,SAAS;QAClD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,GAAG,EAAE,CAAC;YACrD,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,SAAS;QAClE,CAAC;QACD,uEAAuE;QACvE,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,EAAE,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,CAAC,EAAE,CAAC;YAAE,SAAS;QAClH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC;IACnF,OAAO;QACL,EAAE,EAAE,KAAK;QACT,OAAO,EAAE;YACP,QAAQ;YACR,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;YACvC,SAAS;YACT,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC;SACpD;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,IAAI,CACX,MAAc,EACd,KAAwB,EACxB,IAAwB,EACxB,GAAW,EACX,KAAkB;IAElB,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAClF,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IACnC,OAAO,CACL,kBAAkB,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,GAAG,GAAG;QACxH,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACpD,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,MAAM,CAAC,MAAc,EAAE,QAAgB,EAAE,IAAa;IACpE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC;YAAE,SAAS;QAClD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,GAAG,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAC3E,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,SAAS;QAC5C,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ;YAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,MAAc,EACd,QAAgB,EAChB,IAAa;IAEb,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC;YAAE,SAAS;QAClD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,GAAG,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAC3E,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,SAAS;QAC5C,CAAC;QACD,IAAI,KAAK,CAAC,KAAK,KAAK,GAAG,EAAE,CAAC;YACxB,0DAA0D;YAC1D,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,OAAO,CAAC,MAAc;IACpC,IAAI,MAAM,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClC,IAAI,KAAK,CAAC,KAAK,KAAK,GAAG;YAAE,SAAS;QAClC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAA0B,EAC1B,SAAoB,EACpB,SAA8C;IAE9C,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE;QACnC,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;QACjC,MAAM,KAAK,GACT,OAAO,IAAI,OAAO,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC,CAAE,OAAO,CAAC,KAA2B,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACxF,0EAA0E;QAC1E,+DAA+D;QAC/D,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/permissions/policy.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGtE,MAAM,OAAO,GAAG,CAAC,OAAgC,EAAE,KAAa,EAAW,EAAE,CAC3E,OAAO,KAAK,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAE7C;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ,CAAC,SAAoB;IAC3C,MAAM,MAAM,GAAG,SAAS,CAAC,UAAU,CAAC;IACpC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;IAClC,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/G,OAAO,EAAE,GAAG,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;AACxF,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,SAAoB,EAAW,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,QAAQ,IAAI,SAAS,CAAC,UAAU,KAAK,SAAS,CAAC;AAE7H,6EAA6E;AAC7E,SAAS,QAAQ,CAAC,KAAY,EAAE,SAAoB;IAClD,IAAI,KAAK,CAAC,KAAK,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AAC5E,CAAC;AAcD,6DAA6D;AAC7D,SAAS,SAAS,CAAC,KAAwB;IACzC,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACnF,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;AACtH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,OAAO,CACrB,MAA0B,EAC1B,SAAoB,EACpB,QAAgB,EAChB,IAAa;AACb;;;;;GAKG;AACH,GAAuB;AACvB;;;GAGG;AACH,SAAkB;AAClB,qFAAqF;AACrF,QAAqB,EAAE;IAEvB,oEAAoE;IACpE,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACjC,IAAI,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAC7C,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;IAEhC;;;;OAIG;IACH,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,IAAI,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QAC7F,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QAC7G;;;;;;WAMG;QACH,MAAM,KAAK,GAAG,CAAC,QAAQ,EAAE,GAAG,GAAG,CAAC,CAAC;QACjC,MAAM,SAAS,GAAG;YAChB,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;SACvE,CAAC,IAAI,EAAE,CAAC;QACT,MAAM,GAAG,GACP,SAAS,CAAC,MAAM,KAAK,CAAC;YACpB,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC;gBAChB,CAAC,CAAC,uDAAuD;gBACzD,CAAC,CAAC,aAAa;YACjB,CAAC,CAAC,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC;QACpC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,QAAQ;gBACR,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;gBACvC,SAAS;gBACT,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC;aAC/C;SACF,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;YAAE,SAAS;QAC1C,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC;YAAE,SAAS;QAClD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,GAAG,EAAE,CAAC;YACrD,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,SAAS;QAClE,CAAC;QACD,uEAAuE;QACvE,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,EAAE,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,CAAC,EAAE,CAAC;YAAE,SAAS;QAClH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC;IACnF,OAAO;QACL,EAAE,EAAE,KAAK;QACT,OAAO,EAAE;YACP,QAAQ;YACR,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;YACvC,SAAS;YACT,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC;SACpD;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,IAAI,CACX,MAAc,EACd,KAAwB,EACxB,IAAwB,EACxB,GAAW,EACX,KAAkB;IAElB,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAClF,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IACnC,OAAO,CACL,kBAAkB,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,GAAG,GAAG;QACxH,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACpD,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,MAAM,CAAC,MAAc,EAAE,QAAgB,EAAE,IAAa;IACpE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC;YAAE,SAAS;QAClD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,GAAG,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAC3E,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,SAAS;QAC5C,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ;YAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,MAAc,EACd,QAAgB,EAChB,IAAa;IAEb,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC;YAAE,SAAS;QAClD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,GAAG,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAC3E,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,SAAS;QAC5C,CAAC;QACD,IAAI,KAAK,CAAC,KAAK,KAAK,GAAG,EAAE,CAAC;YACxB,0DAA0D;YAC1D,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,OAAO,CAAC,MAAc;IACpC,IAAI,MAAM,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClC,IAAI,KAAK,CAAC,KAAK,KAAK,GAAG;YAAE,SAAS;QAClC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAA0B,EAC1B,SAAoB,EACpB,SAA8C;IAE9C,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE;QACnC,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;QACjC,MAAM,KAAK,GACT,OAAO,IAAI,OAAO,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC,CAAE,OAAO,CAAC,KAA2B,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACxF,0EAA0E;QAC1E,+DAA+D;QAC/D,wEAAwE;QACxE,sEAAsE;QACtE,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IACrH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/permissions/sight.d.ts

@@ -0,0 +1,66 @@
+import type { Operation } from "../ops/types.js";
+import type { Policy, Principal } from "./types.js";
+/** The edges a graph can be asked about, to say what is joined to whom. */
+interface Joined {
+    out(id: string): readonly {
+        readonly id: string;
+    }[];
+    in(id: string): readonly {
+        readonly id: string;
+    }[];
+}
+/** The kinds a policy keeps to those its sights name. */
+export declare function sightedKinds(policy: Policy | undefined): ReadonlySet<string>;
+/**
+ * WHAT THE LOG KNOWS ABOUT A RECORD that the graph may no longer: its kind
+ * (a record since removed is still judged as what it was) and who made it.
+ */
+export interface Records {
+    kindOf(id: string): string | undefined;
+    /** The id of the seat that first added it — the person, for an agent acting for one. */
+    creatorOf(id: string): string | undefined;
+}
+/** A log as `recordsOf` reads it: its ops, and, for an `OperationLog`, the seq it has reached (FR-23). */
+export interface RecordedLog {
+    all(): readonly Operation[];
+    /** The seq the next op takes, counting what a compaction archived; without it, the ops it holds. */
+    readonly length?: number;
+}
+/**
+ * The records a log names, read from its add- and remove-node primitives.
+ * The first op that added a record made it: putting one back by an undo is
+ * not a new author.
+ *
+ * KEPT AS THE LOG GOES (FR-51), as the label index follows the graph: a
+ * call reads only the ops appended since the last one, so a commit costs
+ * its own ops, not the log's. A log cut back (`truncate`, under a rebase)
+ * is noticed by its ops no longer being the ones read, and what they wrote
+ * is taken out, back to where the log and the index still agree. A log
+ * compacted behind its horizon (FR-23) keeps what the index had already
+ * read of the archived ops, so a record made behind the horizon is still
+ * known by its maker for as long as this log is open; a log OPENED
+ * compacted never read them, and knows its makers from the horizon on.
+ * The `Records` returned is the same object every time, and answers as of
+ * the last call.
+ */
+export declare function recordsOf(log: RecordedLog): Records;
+/**
+ * Whether a principal may see one record.
+ *
+ * ONE MEANING, the document's and the framework's alike (FR-02). With no
+ * `sees`, everybody sees everything. Once a policy says who sees what, it
+ * says it for every kind: a kind no sight names is seen by nobody but the
+ * system — the host's own seat — which is how a store fails closed when a
+ * kind is added and nobody said who sees it. A kind a sight names is seen
+ * by the roles it lists, and with `own` only the principal's own records:
+ * their record itself, what an edge joins to it ("a shopper sees their own
+ * test drives" without a field naming the owner), and what they made.
+ */
+export declare function sees(policy: Policy | undefined, principal: Principal, node: {
+    readonly id: string;
+    readonly kind: string;
+}, graph: Joined, 
+/** Who made a record, from the log; without it, `own` reads the graph alone. */
+records?: Pick<Records, "creatorOf">): boolean;
+export {};
+//# sourceMappingURL=sight.d.ts.map

package/dist/permissions/sight.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sight.d.ts","sourceRoot":"","sources":["../../src/permissions/sight.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,OAAO,KAAK,EAAE,MAAM,EAAE,SAAS,EAAS,MAAM,YAAY,CAAC;AAE3D,2EAA2E;AAC3E,UAAU,MAAM;IACd,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACpD,EAAE,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACpD;AAKD,yDAAyD;AACzD,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,CAE5E;AAED;;;GAGG;AACH,MAAM,WAAW,OAAO;IACtB,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IACvC,wFAAwF;IACxF,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED,0GAA0G;AAC1G,MAAM,WAAW,WAAW;IAC1B,GAAG,IAAI,SAAS,SAAS,EAAE,CAAC;IAC5B,oGAAoG;IACpG,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AA0DD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAwBnD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,IAAI,CAClB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,SAAS,EAAE,SAAS,EACpB,IAAI,EAAE;IAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EACpD,KAAK,EAAE,MAAM;AACb,gFAAgF;AAChF,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,GACnC,OAAO,CAmBT"}

package/dist/permissions/sight.js

@@ -0,0 +1,131 @@
+import { actingAs, isSystem } from "./policy.js";
+const sightGrantsTo = (sight, principal) => sight.roles === "*" || (principal.roles ?? []).some((role) => sight.roles.includes(role));
+/** The kinds a policy keeps to those its sights name. */
+export function sightedKinds(policy) {
+    return new Set((policy?.sees ?? []).flatMap((sight) => sight.kinds));
+}
+const INDEXES = new WeakMap();
+function indexFrom(base) {
+    const kinds = new Map();
+    const creators = new Map();
+    return { base, end: base, read: [], kinds, creators, entries: [], records: { kindOf: (id) => kinds.get(id), creatorOf: (id) => creators.get(id) } };
+}
+/** Reads one op into the index: the kind of each record it first adds or removes, and who first made one. */
+function readInto(index, op) {
+    const seq = index.end;
+    for (const primitive of op.primitives) {
+        if (primitive.op !== "add-node" && primitive.op !== "remove-node")
+            continue;
+        const { id, kind } = primitive.node;
+        if (!index.kinds.has(id)) {
+            index.kinds.set(id, kind);
+            index.entries.push({ seq, id, creator: false });
+        }
+        if (primitive.op !== "add-node" || index.creators.has(id) || op.undoes !== undefined)
+            continue;
+        const by = actingAs(op.author).id;
+        if (by === undefined)
+            continue;
+        index.creators.set(id, by);
+        index.entries.push({ seq, id, creator: true });
+    }
+    index.read.push(op);
+    index.end++;
+}
+/** Takes out what the ops from `seq` on wrote: the log was cut back there. */
+function cutBack(index, seq) {
+    while (index.entries.length > 0 && index.entries.at(-1).seq >= seq) {
+        const entry = index.entries.pop();
+        (entry.creator ? index.creators : index.kinds).delete(entry.id);
+    }
+    index.read.length = seq - index.base;
+    index.end = seq;
+}
+/**
+ * The records a log names, read from its add- and remove-node primitives.
+ * The first op that added a record made it: putting one back by an undo is
+ * not a new author.
+ *
+ * KEPT AS THE LOG GOES (FR-51), as the label index follows the graph: a
+ * call reads only the ops appended since the last one, so a commit costs
+ * its own ops, not the log's. A log cut back (`truncate`, under a rebase)
+ * is noticed by its ops no longer being the ones read, and what they wrote
+ * is taken out, back to where the log and the index still agree. A log
+ * compacted behind its horizon (FR-23) keeps what the index had already
+ * read of the archived ops, so a record made behind the horizon is still
+ * known by its maker for as long as this log is open; a log OPENED
+ * compacted never read them, and knows its makers from the horizon on.
+ * The `Records` returned is the same object every time, and answers as of
+ * the last call.
+ */
+export function recordsOf(log) {
+    const ops = log.all();
+    const end = typeof log.length === "number" ? log.length : ops.length;
+    const first = end - ops.length;
+    let index = INDEXES.get(log);
+    if (index && index.base <= first && first <= index.end) {
+        // Back to the last seq where the log still holds the op the index read: a log is only ever cut from its end.
+        let agreed = Math.min(index.end, end);
+        while (agreed > first && ops[agreed - 1 - first] !== index.read[agreed - 1 - index.base])
+            agreed--;
+        if (agreed === first && first > index.base && agreed < index.end) {
+            // It disagrees all the way back to its horizon: not the log this index read.
+            index = undefined;
+        }
+        else {
+            if (agreed < index.end)
+                cutBack(index, agreed);
+            // What a compaction archived is no longer held here to compare against (FR-23).
+            if (first > index.base) {
+                index.read = index.read.slice(first - index.base);
+                index.base = first;
+            }
+        }
+    }
+    else
+        index = undefined;
+    if (!index)
+        INDEXES.set(log, (index = indexFrom(first)));
+    for (let seq = index.end; seq < end; seq++)
+        readInto(index, ops[seq - first]);
+    return index.records;
+}
+/**
+ * Whether a principal may see one record.
+ *
+ * ONE MEANING, the document's and the framework's alike (FR-02). With no
+ * `sees`, everybody sees everything. Once a policy says who sees what, it
+ * says it for every kind: a kind no sight names is seen by nobody but the
+ * system — the host's own seat — which is how a store fails closed when a
+ * kind is added and nobody said who sees it. A kind a sight names is seen
+ * by the roles it lists, and with `own` only the principal's own records:
+ * their record itself, what an edge joins to it ("a shopper sees their own
+ * test drives" without a field naming the owner), and what they made.
+ */
+export function sees(policy, principal, node, graph, 
+/** Who made a record, from the log; without it, `own` reads the graph alone. */
+records) {
+    if (!policy?.sees?.length)
+        return true;
+    // The system sees what it keeps; an agent sees what it AND its person may (FR-06, FR-17).
+    if (isSystem(principal))
+        return true;
+    const sights = policy.sees.filter((sight) => sight.kinds.includes(node.kind));
+    if (sights.length === 0)
+        return false;
+    principal = actingAs(principal);
+    return sights.some((sight) => {
+        if (!sightGrantsTo(sight, principal))
+            return false;
+        if (!sight.own)
+            return true;
+        const me = principal.id;
+        if (me === undefined)
+            return false;
+        return (node.id === me ||
+            graph.out(node.id).some((other) => other.id === me) ||
+            graph.in(node.id).some((other) => other.id === me) ||
+            records?.creatorOf(node.id) === me);
+    });
+}
+//# sourceMappingURL=sight.js.map

package/dist/permissions/sight.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sight.js","sourceRoot":"","sources":["../../src/permissions/sight.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AASjD,MAAM,aAAa,GAAG,CAAC,KAAY,EAAE,SAAoB,EAAW,EAAE,CACpE,KAAK,CAAC,KAAK,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAE,KAAK,CAAC,KAA2B,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AAEnH,yDAAyD;AACzD,MAAM,UAAU,YAAY,CAAC,MAA0B;IACrD,OAAO,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;AACvE,CAAC;AAqCD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAiB,CAAC;AAE7C,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;AACtJ,CAAC;AAED,6GAA6G;AAC7G,SAAS,QAAQ,CAAC,KAAY,EAAE,EAAa;IAC3C,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACtB,KAAK,MAAM,SAAS,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC;QACtC,IAAI,SAAS,CAAC,EAAE,KAAK,UAAU,IAAI,SAAS,CAAC,EAAE,KAAK,aAAa;YAAE,SAAS;QAC5E,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC;QACpC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YACzB,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YAC1B,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,SAAS,CAAC,EAAE,KAAK,UAAU,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,SAAS;YAAE,SAAS;QAC/F,MAAM,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAC,MAAmB,CAAC,CAAC,EAAE,CAAC;QAC/C,IAAI,EAAE,KAAK,SAAS;YAAE,SAAS;QAC/B,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3B,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpB,KAAK,CAAC,GAAG,EAAE,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,SAAS,OAAO,CAAC,KAAY,EAAE,GAAW;IACxC,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC;QACpE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,EAAG,CAAC;QACnC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC;IACrC,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,SAAS,CAAC,GAAgB;IACxC,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,EAAE,CAAC;IACtB,MAAM,GAAG,GAAG,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;IACrE,MAAM,KAAK,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC;IAC/B,IAAI,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,IAAI,KAAK,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;QACvD,6GAA6G;QAC7G,IAAI,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACtC,OAAO,MAAM,GAAG,KAAK,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC;YAAE,MAAM,EAAE,CAAC;QACnG,IAAI,MAAM,KAAK,KAAK,IAAI,KAAK,GAAG,KAAK,CAAC,IAAI,IAAI,MAAM,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;YACjE,6EAA6E;YAC7E,KAAK,GAAG,SAAS,CAAC;QACpB,CAAC;aAAM,CAAC;YACN,IAAI,MAAM,GAAG,KAAK,CAAC,GAAG;gBAAE,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAC/C,gFAAgF;YAChF,IAAI,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;gBACvB,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;gBAClD,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC;YACrB,CAAC;QACH,CAAC;IACH,CAAC;;QAAM,KAAK,GAAG,SAAS,CAAC;IACzB,IAAI,CAAC,KAAK;QAAE,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACzD,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,GAAG,KAAK,CAAE,CAAC,CAAC;IAC/E,OAAO,KAAK,CAAC,OAAO,CAAC;AACvB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,IAAI,CAClB,MAA0B,EAC1B,SAAoB,EACpB,IAAoD,EACpD,KAAa;AACb,gFAAgF;AAChF,OAAoC;IAEpC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM;QAAE,OAAO,IAAI,CAAC;IACvC,0FAA0F;IAC1F,IAAI,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9E,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;IAChC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;QAC3B,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,SAAS,CAAC;YAAE,OAAO,KAAK,CAAC;QACnD,IAAI,CAAC,KAAK,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QAC5B,MAAM,EAAE,GAAG,SAAS,CAAC,EAAE,CAAC;QACxB,IAAI,EAAE,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACnC,OAAO,CACL,IAAI,CAAC,EAAE,KAAK,EAAE;YACd,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC;YACnD,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC;YAClD,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CACnC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/permissions/types.d.ts

@@ -10,6 +10,8 @@ import type { Author } from "../ops/types.js";
  */
 export interface Principal extends Author {
     readonly roles?: readonly string[];
+    /** The person an agent acts for: its roles bound the agent's, and a `self` grant reads their id. */
+    readonly onBehalfOf?: Principal;
 }
 /**
  * One permission: these roles may run these mutations, optionally only
@@ -43,8 +45,32 @@ export interface Grant {
  * a store where nothing works, it is a store where permission is not a
  * concern yet. An app opts in by declaring one.
  */
+/**
+ * WHO MAY SEE WHAT. A grant says who may DO an act; a sight says who may
+ * see the records of a kind at all. Like grants, sights are deny by
+ * default once there are any (FR-02): a kind no sight names is seen by
+ * nobody but the system, so a kind added tomorrow is kept from everybody
+ * until somebody says who sees it, rather than shown to everybody. A kind
+ * a sight names is seen by the roles it lists (`"*"`: everybody), and with
+ * `own` only when it is theirs: their own record, one joined to it by an
+ * edge (a shopper's test drive, their enquiry), or one they made.
+ */
+export interface Sight {
+    readonly roles: readonly string[] | "*";
+    readonly kinds: readonly string[];
+    /** Only the principal's own records: their own record, what an edge joins to it, and what they made. */
+    readonly own?: boolean;
+    readonly describe?: string;
+}
 export interface Policy {
     readonly grants: readonly Grant[];
+    /**
+     * Who may see the records of which kinds. Absent, everybody sees
+     * everything — a storefront that declares none shows every customer's
+     * name, email and finance question to whoever opens it. Present, every
+     * kind is kept from everybody but the system until a sight names it.
+     */
+    readonly sees?: readonly Sight[];
     /**
      * Roles the policy knows about, so `graview check` can report a role that
      * may do nothing. Derived from the grants when absent.

package/dist/permissions/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/permissions/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAE9C;;;;;;;;GAQG;AACH,MAAM,WAAW,SAAU,SAAQ,MAAM;IACvC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,KAAK;IACpB,gFAAgF;IAChF,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,GAAG,CAAC;IACxC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,GAAG,CAAC;IAC5C,+EAA+E;IAC/E,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,GAAG,CAAC;IACzC,+EAA+E;IAC/E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,MAAM,EAAE,SAAS,KAAK,EAAE,CAAC;IAClC;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED,mEAAmE;AACnE,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,kEAAkE;IAClE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;CACvC;AAED;;;;;;;GAOG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;gBACd,OAAO,EAAE,OAAO;CAK7B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/permissions/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAE9C;;;;;;;;GAQG;AACH,MAAM,WAAW,SAAU,SAAQ,MAAM;IACvC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,oGAAoG;IACpG,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,CAAC;CACjC;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,KAAK;IACpB,gFAAgF;IAChF,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,GAAG,CAAC;IACxC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,GAAG,CAAC;IAC5C,+EAA+E;IAC/E,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,GAAG,CAAC;IACzC,+EAA+E;IAC/E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;GAMG;AACH;;;;;;;;;GASG;AACH,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,GAAG,CAAC;IACxC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,wGAAwG;IACxG,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,MAAM,EAAE,SAAS,KAAK,EAAE,CAAC;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,KAAK,EAAE,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED,mEAAmE;AACnE,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,kEAAkE;IAClE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;CACvC;AAED;;;;;;;GAOG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;gBACd,OAAO,EAAE,OAAO;CAK7B"}

package/dist/permissions/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/permissions/types.ts"],"names":[],"mappings":"AAsEA;;;;;;;GAOG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IACrC,OAAO,CAAU;IAC1B,YAAY,OAAgB;QAC1B,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/permissions/types.ts"],"names":[],"mappings":"AAiGA;;;;;;;GAOG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IACrC,OAAO,CAAU;IAC1B,YAAY,OAAgB;QAC1B,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF"}

package/dist/persistence/memory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"memory.d.ts","sourceRoot":"","sources":["../../src/persistence/memory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEvD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD;gDACgD;AAChD,wBAAgB,mBAAmB,CACjC,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAM,GACvC,kBAAkB,CAAC,MAAM,CAAC,CA2B5B"}
+{"version":3,"file":"memory.d.ts","sourceRoot":"","sources":["../../src/persistence/memory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGvD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD;gDACgD;AAChD,wBAAgB,mBAAmB,CACjC,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAM,GACvC,kBAAkB,CAAC,MAAM,CAAC,CAoD5B"}

package/dist/persistence/memory.js

@@ -3,6 +3,9 @@
 export function createMemoryAdapter(seed = {}) {
     const graphs = new Map(Object.entries(seed).map(([k, v]) => [k, clone(v)]));
     const logs = new Map();
+    const epochs = new Map();
+    // What a compaction moved behind the undo horizon (FR-23): kept, never loaded on open.
+    const archives = new Map();
     return {
         name: "memory",
         async load(scope) {
@@ -15,6 +18,8 @@ export function createMemoryAdapter(seed = {}) {
         async delete(scope) {
             graphs.delete(scope);
             logs.delete(scope);
+            epochs.delete(scope);
+            archives.delete(scope);
         },
         async loadLog(scope) {
             return clone(logs.get(scope) ?? []);
@@ -23,6 +28,26 @@ export function createMemoryAdapter(seed = {}) {
             const existing = logs.get(scope) ?? [];
             logs.set(scope, [...existing, ...clone([...ops])]);
         },
+        async loadEpochs(scope) {
+            return clone(epochs.get(scope) ?? []);
+        },
+        async saveEpochs(scope, list) {
+            epochs.set(scope, clone([...list]));
+        },
+        async compact(scope, checkpoint) {
+            const log = logs.get(scope) ?? [];
+            const marks = epochs.get(scope) ?? [];
+            const held = archives.get(scope) ?? { ops: [], epochs: [] };
+            archives.set(scope, {
+                ops: [...held.ops, ...clone(log.filter((op) => op.seq < checkpoint.seq))],
+                epochs: [...held.epochs, ...clone(marks.filter((epoch) => epoch.seq < checkpoint.seq))],
+            });
+            logs.set(scope, log.filter((op) => op.seq >= checkpoint.seq));
+            epochs.set(scope, [clone({ ...checkpoint, horizon: true }), ...marks.filter((epoch) => epoch.seq > checkpoint.seq)]);
+        },
+        async loadArchive(scope) {
+            return clone(archives.get(scope) ?? { ops: [], epochs: [] });
+        },
     };
 }
 function clone(value) {

package/dist/persistence/memory.js.map

@@ -1 +1 @@
-{"version":3,"file":"memory.js","sourceRoot":"","sources":["../../src/persistence/memory.ts"],"names":[],"mappings":"AAIA;gDACgD;AAChD,MAAM,UAAU,mBAAmB,CACjC,OAAsC,EAAE;IAExC,MAAM,MAAM,GAAG,IAAI,GAAG,CACpB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CACpD,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAuB,CAAC;IAE5C,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,KAAK,CAAC,IAAI,CAAC,KAAK;YACd,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAChC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACrC,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ;YACxB,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QACrC,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,KAAK;YAChB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACrB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,KAAK;YACjB,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACtC,CAAC;QACD,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG;YACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACvC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,QAAQ,EAAE,GAAG,KAAK,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACrD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAI,KAAQ;IACxB,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC"}
+{"version":3,"file":"memory.js","sourceRoot":"","sources":["../../src/persistence/memory.ts"],"names":[],"mappings":"AAKA;gDACgD;AAChD,MAAM,UAAU,mBAAmB,CACjC,OAAsC,EAAE;IAExC,MAAM,MAAM,GAAG,IAAI,GAAG,CACpB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CACpD,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC5C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC1C,uFAAuF;IACvF,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAsB,CAAC;IAE/C,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,KAAK,CAAC,IAAI,CAAC,KAAK;YACd,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAChC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACrC,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ;YACxB,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QACrC,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,KAAK;YAChB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACrB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACrB,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,KAAK;YACjB,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACtC,CAAC;QACD,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG;YACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACvC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,QAAQ,EAAE,GAAG,KAAK,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACrD,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,KAAK;YACpB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACxC,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,IAAI;YAC1B,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACtC,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU;YAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;YAC5D,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE;gBAClB,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;gBACzE,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;aACxF,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;YAC9D,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,GAAG,UAAU,EAAE,OAAO,EAAE,IAAa,EAAE,CAAC,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAChI,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,KAAK;YACrB,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/D,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAI,KAAQ;IACxB,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC"}

package/dist/persistence/sql.d.ts

@@ -0,0 +1,43 @@
+import type { PersistenceAdapter } from "./types.js";
+/**
+ * PERSISTENCE OVER PLAIN SQL — one synchronous `exec` (FR-09).
+ *
+ * The shape a Durable Object's storage already has (`ctx.storage.sql`
+ * passes as it is) and better-sqlite3 has once `sqlFromDatabase` wraps it:
+ * one statement in, its rows out. Nothing else is asked of the database, so
+ * the adapter runs wherever SQLite does — a Worker, Node, Deno — and no
+ * native module is ever imported here.
+ */
+export interface SqlExec {
+    /** Runs ONE statement with `?` parameters; the rows, iterable, when it reads any. */
+    exec(sql: string, ...params: unknown[]): Iterable<unknown>;
+}
+export interface SqlAdapterOptions {
+    readonly sql: SqlExec;
+    /**
+     * Runs `fn` as one transaction, so a snapshot is rewritten all or nothing.
+     * A Durable Object passes `(fn) => ctx.storage.transactionSync(fn)`;
+     * `sqlFromDatabase` supplies better-sqlite3's. Absent, `fn` simply runs.
+     */
+    readonly transaction?: <T>(fn: () => T) => T;
+    /** Defaults match the household example's existing tables exactly. */
+    readonly nodeTable?: string;
+    readonly edgeTable?: string;
+    readonly opTable?: string;
+    /** The framework's epochs (FR-27), live and archived: `graview_epochs`. */
+    readonly epochTable?: string;
+    /** The ops a compaction moved behind the undo horizon (FR-23): `graview_ops_archive`. */
+    readonly archiveTable?: string;
+    /** Column holding the scope key (the household example: `household_id`). */
+    readonly scopeColumn?: string;
+    /** Creates the tables when absent. Off by default: never touch an app's schema. */
+    readonly createTables?: boolean;
+}
+/**
+ * Reads and writes an app's `graph_nodes` / `graph_edges` tables, and the
+ * framework's own op table, through `exec` alone. `data` is schemaless JSON
+ * on disk and becomes a typed node on the way in, validated by the schema
+ * registry when the snapshot is loaded into a Graph.
+ */
+export declare function createSqlAdapter(options: SqlAdapterOptions): PersistenceAdapter<string>;
+//# sourceMappingURL=sql.d.ts.map

package/dist/persistence/sql.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql.d.ts","sourceRoot":"","sources":["../../src/persistence/sql.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD;;;;;;;;GAQG;AACH,MAAM,WAAW,OAAO;IACtB,qFAAqF;IACrF,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;CAC5D;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7C,sEAAsE;IACtE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,yFAAyF;IACzF,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,mFAAmF;IACnF,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;CACjC;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAyJvF"}

package/dist/persistence/sql.js

@@ -0,0 +1,154 @@
+/**
+ * Reads and writes an app's `graph_nodes` / `graph_edges` tables, and the
+ * framework's own op table, through `exec` alone. `data` is schemaless JSON
+ * on disk and becomes a typed node on the way in, validated by the schema
+ * registry when the snapshot is loaded into a Graph.
+ */
+export function createSqlAdapter(options) {
+    const { sql } = options;
+    const transaction = options.transaction ?? ((fn) => fn());
+    const nodeTable = options.nodeTable ?? "graph_nodes";
+    const edgeTable = options.edgeTable ?? "graph_edges";
+    const opTable = options.opTable ?? "graview_ops";
+    const epochTable = options.epochTable ?? "graview_epochs";
+    const archiveTable = options.archiveTable ?? "graview_ops_archive";
+    const scope = options.scopeColumn ?? "household_id";
+    const rows = (statement, ...params) => [...sql.exec(statement, ...params)];
+    const run = (statement, ...params) => {
+        // Drained, so a lazy cursor (a Durable Object's) has really run.
+        for (const _ of sql.exec(statement, ...params))
+            void _;
+    };
+    const createOpTable = `CREATE TABLE IF NOT EXISTS ${opTable} (
+    ${scope} TEXT NOT NULL, seq INTEGER NOT NULL, data TEXT NOT NULL,
+    PRIMARY KEY (${scope}, seq))`;
+    /*
+     * THE FRAMEWORK'S OTHER TABLES, beside the op table and as much its own:
+     * the epochs the log folds from (`archived` 0), the epochs and ops a
+     * compaction moved behind the undo horizon (`archived` 1, and the archive
+     * table, shaped like the op table). A normal open reads neither archive.
+     */
+    const createEpochTable = `CREATE TABLE IF NOT EXISTS ${epochTable} (
+    ${scope} TEXT NOT NULL, archived INTEGER NOT NULL, position INTEGER NOT NULL, data TEXT NOT NULL,
+    PRIMARY KEY (${scope}, archived, position))`;
+    const createArchiveTable = `CREATE TABLE IF NOT EXISTS ${archiveTable} (
+    ${scope} TEXT NOT NULL, seq INTEGER NOT NULL, data TEXT NOT NULL,
+    PRIMARY KEY (${scope}, seq))`;
+    if (options.createTables) {
+        run(`CREATE TABLE IF NOT EXISTS ${nodeTable} (
+      ${scope} TEXT NOT NULL, id TEXT NOT NULL,
+      kind TEXT NOT NULL, data TEXT NOT NULL,
+      PRIMARY KEY (${scope}, id))`);
+        run(`CREATE TABLE IF NOT EXISTS ${edgeTable} (
+      ${scope} TEXT NOT NULL, position INTEGER NOT NULL,
+      kind TEXT NOT NULL, from_id TEXT NOT NULL, to_id TEXT NOT NULL,
+      PRIMARY KEY (${scope}, position))`);
+        run(createOpTable);
+        run(createEpochTable);
+        run(createArchiveTable);
+    }
+    /**
+     * The op table is the framework's own, not the app's, so it is created on
+     * demand. The node and edge tables are the app's and are never touched
+     * unless `createTables` explicitly asks for them.
+     */
+    let opTableReady = false;
+    function ensureOpTable() {
+        if (opTableReady)
+            return;
+        run(createOpTable);
+        run(createEpochTable);
+        run(createArchiveTable);
+        opTableReady = true;
+    }
+    const epochsOf = (key, archived) => rows(`SELECT data FROM ${epochTable} WHERE ${scope} = ? AND archived = ? ORDER BY position ASC`, key, archived).map((row) => JSON.parse(row.data));
+    const writeEpochs = (key, archived, epochs, from = 0) => {
+        epochs.forEach((epoch, index) => {
+            run(`INSERT INTO ${epochTable} (${scope}, archived, position, data) VALUES (?, ?, ?, ?)`, key, archived, from + index, JSON.stringify(epoch));
+        });
+    };
+    const clear = (key) => {
+        run(`DELETE FROM ${edgeTable} WHERE ${scope} = ?`, key);
+        run(`DELETE FROM ${nodeTable} WHERE ${scope} = ?`, key);
+    };
+    return {
+        name: "sqlite",
+        async load(key) {
+            const nodeRows = rows(`SELECT id, kind, data FROM ${nodeTable} WHERE ${scope} = ?`, key);
+            if (nodeRows.length === 0)
+                return null;
+            const edgeRows = rows(`SELECT kind, from_id, to_id FROM ${edgeTable} WHERE ${scope} = ? ORDER BY position ASC`, key);
+            const nodes = nodeRows.map((row) => {
+                const parsed = JSON.parse(row.data);
+                // `id` and `kind` live in columns as well as the JSON blob; the
+                // columns win so a row is never internally inconsistent.
+                return { ...parsed, id: row.id, kind: row.kind };
+            });
+            const edges = edgeRows.map((row) => ({ kind: row.kind, from: row.from_id, to: row.to_id }));
+            return { nodes, edges };
+        },
+        async save(key, snapshot) {
+            transaction(() => {
+                clear(key);
+                for (const node of snapshot.nodes) {
+                    run(`INSERT INTO ${nodeTable} (${scope}, id, kind, data) VALUES (?, ?, ?, ?)`, key, node.id, node.kind, JSON.stringify(node));
+                }
+                snapshot.edges.forEach((edge, position) => {
+                    run(`INSERT INTO ${edgeTable} (${scope}, position, kind, from_id, to_id) VALUES (?, ?, ?, ?, ?)`, key, position, edge.kind, edge.from, edge.to);
+                });
+            });
+        },
+        async delete(key) {
+            ensureOpTable();
+            transaction(() => {
+                clear(key);
+                // A deleted scope is gone with its history, as in every other adapter.
+                for (const table of [opTable, epochTable, archiveTable])
+                    run(`DELETE FROM ${table} WHERE ${scope} = ?`, key);
+            });
+        },
+        async loadLog(key) {
+            ensureOpTable();
+            return rows(`SELECT data FROM ${opTable} WHERE ${scope} = ? ORDER BY seq ASC`, key).map((row) => JSON.parse(row.data));
+        },
+        async appendOps(key, ops) {
+            if (ops.length === 0)
+                return;
+            ensureOpTable();
+            transaction(() => {
+                for (const op of ops)
+                    run(`INSERT OR REPLACE INTO ${opTable} (${scope}, seq, data) VALUES (?, ?, ?)`, key, op.seq, JSON.stringify(op));
+            });
+        },
+        async loadEpochs(key) {
+            ensureOpTable();
+            return epochsOf(key, 0);
+        },
+        async saveEpochs(key, epochs) {
+            ensureOpTable();
+            transaction(() => {
+                run(`DELETE FROM ${epochTable} WHERE ${scope} = ? AND archived = 0`, key);
+                writeEpochs(key, 0, epochs);
+            });
+        },
+        async compact(key, checkpoint) {
+            ensureOpTable();
+            transaction(() => {
+                run(`INSERT OR REPLACE INTO ${archiveTable} (${scope}, seq, data) SELECT ${scope}, seq, data FROM ${opTable} WHERE ${scope} = ? AND seq < ?`, key, checkpoint.seq);
+                run(`DELETE FROM ${opTable} WHERE ${scope} = ? AND seq < ?`, key, checkpoint.seq);
+                const live = epochsOf(key, 0);
+                writeEpochs(key, 1, live.filter((epoch) => epoch.seq < checkpoint.seq), epochsOf(key, 1).length);
+                run(`DELETE FROM ${epochTable} WHERE ${scope} = ? AND archived = 0`, key);
+                writeEpochs(key, 0, [{ ...checkpoint, horizon: true }, ...live.filter((epoch) => epoch.seq > checkpoint.seq)]);
+            });
+        },
+        async loadArchive(key) {
+            ensureOpTable();
+            return {
+                ops: rows(`SELECT data FROM ${archiveTable} WHERE ${scope} = ? ORDER BY seq ASC`, key).map((row) => JSON.parse(row.data)),
+                epochs: epochsOf(key, 1),
+            };
+        },
+    };
+}
+//# sourceMappingURL=sql.js.map