@graview/core 0.1.58 → 0.1.60

package/dist/store.js

@@ -10,9 +10,11 @@ import { nodeRefArgs } from "./mutations/node-ref.js";
 import { verifyFold } from "./integrity.js";
 import { evaluate } from "./invariants/engine.js";
 import { compileMutation } from "./mutations/define-mutation.js";
+import { wouldRun } from "./mutations/would-run.js";
 import { actSpelledAs, nearestAct } from "./mutations/act-spelling.js";
 import { InvalidArguments } from "./mutations/invalid-arguments.js";
-import { deriveMutations, derivedVia } from "./mutations/derive-edits.js";
+import { deriveMutations, derivedVia, removeVia } from "./mutations/derive-edits.js";
+import { repeatingFields, repeatMakes } from "./mutations/derive-repeats.js";
 import { namesMade, resolveMade } from "./mutations/made.js";
 import { OperationLog } from "./ops/log.js";
 import { lineageOf } from "./ops/lineage.js";
@@ -24,7 +26,7 @@ import { actingAs, grantsTo, isSystem, permits, permittedMutations, subjectKinds
 import { namesUnseen, redact } from "./ops/withheld.js";
 import { writersBehind } from "./ops/writers.js";
 import { nounOf } from "./schema/define-node.js";
-import { behind, fieldsJudged, partialSight, recordsOf } from "./permissions/sight.js";
+import { behind, fieldsJudged, mayKeepField, partialSight, recordsOf } from "./permissions/sight.js";
 import { PermissionDeniedError } from "./permissions/types.js";
 import { checkUndo, UndoBlockedError, undoneInverses, undoPrimitives } from "./ops/undo.js";
 import { validateGraph } from "./validate-graph.js";
@@ -406,6 +408,8 @@ export class Store {
                 break;
             }
         }
+        // No op in the tail says a set: the one the checkpoint kept stands, since the op that said it was archived with it (FR-12, FR-23).
+        said ??= this.log.horizonEpoch()?.enabledModules;
         const projection = held && said === held.said ? held.projection : resolveModules(this.declaredModules, said ?? this.startingModules);
         this.projected = { projection, length: all.length, last, said };
         return projection;
@@ -503,8 +507,12 @@ export class Store {
             return [...new Set(all.filter((one) => one.derived?.relation === call?.args["kind"]).flatMap((one) => derivedVia(this.schema, all, one) ?? []))];
         }
         // Typing into a field: whoever may run an act that writes that field of that record.
-        if (mutation !== undefined && mutation === this.typer)
-            return TYPING.via(this.schema, [...this.mutations.values()], this.subjectKindOf(call, principal), call?.args["field"]);
+        if (mutation !== undefined && mutation === this.typer) {
+            // Through an act that could run on this record now: its module on, its own rule holding for the record as this principal is served it (`wouldRun`).
+            const served = principal === undefined || isSystem(principal) ? this.graph : seenBy(this, principal).graph;
+            const allows = (writer) => !this.mutationDisabled(writer) && wouldRun(writer, this.schema, served, call?.args["node"], call?.args["field"], principal && actingAs(principal).id);
+            return TYPING.via(this.schema, [...this.mutations.values()], this.subjectKindOf(call, principal), call?.args["field"], allows);
+        }
         if (!mutation?.derived)
             return undefined;
         return derivedVia(this.schema, [...this.mutations.values()], mutation);
@@ -557,7 +565,14 @@ export class Store {
         // Publishing is the declaration's `publishers`, not a grant's.
         if (mutation && mutation === this.publisher)
             return PUBLISHING.verdict(this, principal);
-        const id = mutation?.subject && call.args[mutation.subject.arg];
+        /*
+         * KEEPING A LINK ONLY THE DERIVED ACTS MAKE is judged as they are: on
+         * the record it leaves, so riding everybody's grant it reaches only the
+         * links of records this principal made (W-201). A link a declared act
+         * makes or breaks is that act's, which carries no such rule.
+         */
+        const keeping = mutation !== undefined && mutation === this.keeper && keepLinkVia(this.mutations.values(), call.args["kind"]).length === 0;
+        const id = keeping ? call.args["from"] : mutation?.subject && call.args[mutation.subject.arg];
         /*
          * An own-end grant holds the records the call names at the far end of
          * what it links, and every link the act would make or break: a connect
@@ -565,7 +580,8 @@ export class Store {
          * names. A call that cannot be compiled is refused by `apply`, in its
          * own words.
          */
-        return permits(this.policy, principal, call.name, this.subjectKindOf(call, principal), this.viaOf(mutation, call, principal), typeof id === "string" ? id : undefined, this.words, () => {
+        const kind = this.subjectKindOf(call, principal);
+        const verdict = permits(this.policy, principal, call.name, kind, this.viaOf(mutation, call, principal), typeof id === "string" ? id : undefined, this.words, () => {
             const me = actingAs(principal).id;
             const far = this.namedIn(call, false);
             try {
@@ -579,9 +595,43 @@ export class Store {
             return far;
         }, 
         // Who made the record a derived act is about: riding only everybody's grant, it reaches what this principal made (W-201).
-        mutation !== undefined && (mutation.derived !== undefined || mutation === this.typer) ? () => recordsOf(this.log).creatorOf(id) : undefined, 
+        mutation !== undefined && (mutation.derived !== undefined || mutation === this.typer || keeping) ? () => this.madeBy(mutation, call, id) : undefined, 
         // Taking a record out, or folding it away, rides the making of the kind only over what this principal made (W-201).
         mutation?.derived !== undefined && UNMAKING.has(mutation.derived.act));
+        if (!verdict.ok || !mutation?.derived || !this.repeatMakes(mutation, call, id, principal))
+            return verdict;
+        /*
+         * AND A CHANGE TO ONE DAY THAT MAKES A RECORD ("change just this one",
+         * "change from here" past the first day) rides the kind's edit for the
+         * series, and the making of the kind for the record it makes: who may
+         * retitle a shift has not been trusted with making one.
+         */
+        return permits(this.policy, principal, call.name, kind, removeVia([...this.mutations.values()], mutation.derived.kind), typeof id === "string" ? id : undefined, this.words);
+    }
+    /** Whether a call of a repeat act makes a record (`repeatMakes`), read off the series as this principal is served it. */
+    repeatMakes(mutation, call, id, principal) {
+        const act = mutation.derived.act;
+        if (act !== "detach" && act !== "split")
+            return false;
+        const definition = this.schema.tryDefinition(mutation.derived.kind);
+        if (!definition)
+            return false;
+        const node = typeof id === "string" ? (isSystem(principal) ? this.graph : seenBy(this, principal).graph).getNode(id) : undefined;
+        return repeatMakes(act, call.args, node, repeatingFields(definition));
+    }
+    /**
+     * WHO MADE WHAT A DERIVED ACT CHANGES (W-201): its subject — and, for a
+     * merge, the record it folds into too, which takes every tie of the one
+     * folded away. Both are to be one principal's for the merge to be theirs;
+     * asked before that one is chosen, the subject alone.
+     */
+    madeBy(mutation, call, id) {
+        const records = recordsOf(this.log);
+        const by = records.creatorOf(id);
+        const into = call.args["into"];
+        if (mutation.derived?.act === "merge" && typeof into === "string" && records.creatorOf(into) !== by)
+            return undefined;
+        return by;
     }
     /** The ids a call names in its record arguments: its subject's too, unless `subject` is false (the far ends of what it links). */
     namedIn(call, subject = true) {
@@ -661,7 +711,11 @@ export class Store {
      */
     sighted(author) {
         // Who `$me` is: the person, for an agent acting for one (Roadmap f-act-as-me).
-        const me = { me: author && actingAs(author).id };
+        const me = {
+            me: author && actingAs(author).id,
+            everHeld: (id) => recordsOf(this.log).kindOf(id) !== undefined,
+            keeps: (kind, field) => mayKeepField(this.policy?.sees, kind, field),
+        };
         if (author === undefined || !hidesFrom(this, author))
             return me;
         // And a seat that writes a value naming what it may not see has written its own words, though the store held them already.
@@ -841,8 +895,15 @@ export class Store {
          */
         if (typeof id !== "string")
             return subject.kinds !== "*" && subject.kinds.length === 1 ? subject.kinds[0] : undefined;
-        // A record the principal may not see is judged as one that is not there: its kind is not the policy's to read aloud (FR-55).
-        if (!isSystem(principal) && !seesId(this, principal)(id))
+        /*
+         * A record the principal is not served is judged as one that is not
+         * there: its kind is not the policy's to read aloud (FR-55). Served,
+         * not only in sight, as `missingFor` reads it: a record withheld whole
+         * for a field it cannot do without answered a grant drawn by kind as
+         * its kind, and an absent id as no kind, so the refusal told the two
+         * apart.
+         */
+        if (!isSystem(principal) && !seenBy(this, principal).graph.has(id))
             return undefined;
         return this.graph.getNode(id)?.kind;
     }
@@ -1546,25 +1607,9 @@ export class Store {
          * what you may have done — the mutation each operation ran, judged
          * again now.
          */
-        if (this.policy || this.publisher) {
-            for (const target of check.ops) {
-                if (!target.mutation)
-                    continue;
-                /*
-                 * AND AN ACT DONE AS ITS AUTHOR (`$me`, `ctx.me`) IS THEIRS TO TAKE
-                 * BACK: it wrote their own record where its call never named it, so
-                 * the same call by another would have done something else. "Vote for
-                 * it" is everybody's to run, and undoing Ann's was taking back her vote.
-                 */
-                const by = actingAs(target.author).id;
-                const names = (value) => JSON.stringify(value).includes(JSON.stringify(by));
-                const verdict = by !== undefined && by !== actingAs(author).id && !isSystem(author) && !names(target.mutation.args) && names(target.primitives)
-                    ? { ok: false, refusal: { mutation: target.mutation.name, wouldNeed: [], message: "it was done as somebody else." } }
-                    : this.permits(target.mutation, author);
-                if (!verdict.ok)
-                    this.refuse({ ...verdict.refusal, message: `Not permitted to undo "${target.intent}": ${verdict.refusal.message}` }, author.id, true);
-            }
-        }
+        const refused = this.undoRefusal(check.ops, author);
+        if (refused)
+            this.refuse(refused, author.id, true);
         const rollback = this.graph.snapshot();
         const before = this.violations();
         const ops = [];
@@ -1608,6 +1653,75 @@ export class Store {
             violationsAfter: after,
         };
     }
+    /**
+     * Whether this principal may take these batches back: the log's answer
+     * (`canUndo`) and the policy's, the same judgment `undo` makes. What a
+     * page offers to take back is asked here, so an undo it shows is never
+     * one the store refuses.
+     */
+    mayUndo(batchIds, principal = this.by) {
+        const check = this.canUndo(batchIds);
+        if (!check.ok)
+            return { ok: false, check };
+        const refusal = this.undoRefusal(check.ops, principal);
+        return refusal ? { ok: false, refusal } : { ok: true };
+    }
+    /** What refuses `author` taking these ops back, or nothing: what you may undo is what you may have done. */
+    undoRefusal(ops, author) {
+        if (this.policy || this.publisher) {
+            for (const target of ops) {
+                /*
+                 * AN UNDO OF AN UNDO PUTS BACK THE CHANGE IT TOOK BACK, and is judged
+                 * as that change — redo is one, and let through unasked it put back
+                 * an act its seat was refused. Undoing that again takes the change
+                 * back once more, judged as it again: however long the chain, the
+                 * change at its root.
+                 */
+                const judged = this.rootOf(target);
+                const by = actingAs(judged.author).id;
+                if (!judged.mutation) {
+                    // A change that changed nothing (a suggestion, an announcement) is anybody's who sees it to take back: declining a suggestion is one.
+                    if (judged.primitives.length === 0)
+                        continue;
+                    /*
+                     * A CHANGE NO ACT MADE — an import, a sync, a connection, a host's
+                     * repair (`applyPrimitives`) — has no act to judge it as, and its
+                     * author was its authority. It is taken back by the system, by
+                     * whoever made it, or by a seat the policy grants every act.
+                     */
+                    if (this.policy && !isSystem(author) && by !== actingAs(author).id && !this.grantsEveryAct(author)) {
+                        return { mutation: "undo", wouldNeed: [], message: `Not permitted to undo "${target.intent}": no act made it, so only whoever did may take it back.` };
+                    }
+                    continue;
+                }
+                /*
+                 * AND AN ACT DONE AS ITS AUTHOR (`$me`, `ctx.me`) IS THEIRS TO TAKE
+                 * BACK: it wrote their own record where its call never named it, so
+                 * the same call by another would have done something else. "Vote for
+                 * it" is everybody's to run, and undoing Ann's was taking back her vote.
+                 */
+                const names = (value) => JSON.stringify(value).includes(JSON.stringify(by));
+                const verdict = by !== undefined && by !== actingAs(author).id && !isSystem(author) && !names(judged.mutation.args) && names(judged.primitives)
+                    ? { ok: false, refusal: { mutation: judged.mutation.name, wouldNeed: [], message: "it was done as somebody else." } }
+                    : this.permits(judged.mutation, author);
+                if (!verdict.ok)
+                    return { ...verdict.refusal, message: `Not permitted to undo "${target.intent}": ${verdict.refusal.message}` };
+            }
+        }
+        return undefined;
+    }
+    /** The change an undo of an undo puts back: the op at the root of its chain, or the last undo the log still holds of it. */
+    rootOf(op) {
+        let at = op;
+        for (let undone = at.undoes === undefined ? undefined : this.log.get(at.undoes); undone !== undefined; undone = at.undoes === undefined ? undefined : this.log.get(at.undoes))
+            at = undone;
+        return at;
+    }
+    /** Whether the policy grants this principal every act, on every record: what taking back a change no act made asks of anybody but its author. */
+    grantsEveryAct(principal) {
+        const acting = actingAs(principal);
+        return (this.policy?.grants ?? []).some((grant) => grantsTo(grant, acting) && grant.mutations === "*" && (grant.kinds === undefined || grant.kinds === "*") && !grant.self && !grant.ownEnd);
+    }
     /** An author named as Activity names one, for a sentence that refuses them. */
     authorName(author) {
         return nameOfAuthor(author, { graph: this.graph, schema: this.schema });
@@ -1933,8 +2047,9 @@ export class Store {
             seq = Math.min(byOps, byDays);
         }
         // Never past a seq somebody is served at: a reader's past (`pastOf`) folds from the log, so the lowest pin is the furthest it goes.
-        // And readers' own (Roadmap f-publishing-lifecycle): what was published — or, before the first publish, where the log begins.
-        const readers = onPublish(this.publishing) ? [this.publishedSeq ?? 0] : [];
+        // Readers of an app that publishes are served the app as each publish behind it left it, which it keeps (`published`, Roadmap
+        // f-publishing-lifecycle); before the first publish — or with nothing loaded to say one — they are served where the log begins.
+        const readers = onPublish(this.publishing) && this.publishedSeq === undefined ? [0] : [];
         const pinned = [...(options.pins ?? []), ...readers].filter((pin) => Number.isInteger(pin));
         if (pinned.length > 0)
             seq = Math.min(seq, ...pinned);
@@ -1947,8 +2062,19 @@ export class Store {
         const verified = this.verify();
         if (!verified.ok)
             throw new GraphError(`Cannot compact a store that does not verify: ${verified.reason}`);
+        /*
+         * And the app as readers were served it at each published seq behind it they may be served again: folded here where the
+         * log still holds it, carried from the checkpoint before where it does not, so a horizon past old publishes loses none.
+         */
+        const carried = this.log.horizonEpoch()?.published ?? [];
+        const published = (PUBLISHING.behind?.(this, seq) ?? []).flatMap((at) => (at >= this.log.horizon ? [this.epochAt(at)] : carried.filter((one) => one.seq === at)));
+        return { ...this.epochAt(seq), ...(published.length > 0 && { published }) };
+    }
+    /** The checkpoint at `seq`, which the log holds, and what it keeps of the ops behind it — but for the published seqs behind it. */
+    epochAt(seq) {
+        const ops = this.log.all();
         // What the store keeps of who made what and what was removed is written here, from the log, never carried over from an epoch.
-        const { creators: _creators, removed: _removed, writers: _writers, ...checkpoint } = this.log.checkpointAt(this.schema, seq, { validate: this.validate });
+        const { creators: _creators, removed: _removed, writers: _writers, published: _published, ...checkpoint } = this.log.checkpointAt(this.schema, seq, { validate: this.validate });
         /*
          * Who made each record behind it, so a store opened on it still knows (an `own` sight reads the log for it);
          * what each record removed behind it was, so a field naming one is still judged as naming it; and who wrote
@@ -1959,7 +2085,19 @@ export class Store {
         const records = recordsOf(this.log);
         const writers = writersBehind(this.log, seq, checkpoint.base.nodes, (value) => namesUnseen(value, (id) => !base.has(id) && records.kindOf(id) === undefined));
         const kept = (map) => map && Object.keys(map).length > 0;
-        return { ...checkpoint, ...(kept(creators) && { creators }), ...(removed && { removed }), ...(kept(writers) && { writers }) };
+        /*
+         * The modules on at its seq and how far readers were served there, which the ops before it said and which go to the
+         * archive with them: so a module off stays off (FR-12) and a store whose publish ops were archived still knows what
+         * stood published (Roadmap f-publishing-lifecycle).
+         */
+        return {
+            ...checkpoint,
+            ...(kept(creators) && { creators }),
+            ...(removed && { removed }),
+            ...(kept(writers) && { writers }),
+            ...given("enabledModules", ops.slice(0, seq - this.log.horizon).reverse().find((op) => op.enabledModules)?.enabledModules ?? this.log.horizonEpoch()?.enabledModules),
+            ...given("publishedThrough", PUBLISHING.seq?.(this, seq)),
+        };
     }
     /**
      * MOVES THE UNDO HORIZON TO `checkpoint` (FR-23): the ops and epochs