@haverstack/core 0.28.0 → 0.30.0

package/dist/errors.js

@@ -0,0 +1,208 @@
+/**
+ * Stack errors — the error taxonomy
+ * -------------------------------------------------------
+ * Every error a Stack operation can raise, in one place. The hierarchy has
+ * a single root so a server's error middleware can ask one question —
+ * `instanceof StackError` — before serializing a wire body, and each
+ * subclass carries its wire discriminator as an instance `code`.
+ *
+ * Three errors sit deliberately outside that root (StackClosedError,
+ * StackRelayScopeError, and — in their own modules — IdGenerationError and
+ * InvalidDidError): they report a local programming error or an assembled
+ * topology, not a state a request can be in, so no server ever responds
+ * with one.
+ */
+import { baseIdOf, parseTypeId } from './schema.js';
+/**
+ * Root of the Stack error taxonomy. A single `instanceof StackError` answers
+ * "is this a Stack-domain error or a bug?" — the question a server's error
+ * middleware asks before serializing a wire body, and one a nine-arm
+ * instanceof ladder answers only by exhaustion. Every subclass carries its
+ * discriminator as an instance `code`, so serialization is a lookup rather
+ * than a chain of class tests.
+ *
+ * Membership implies a wire mapping: every code has an entry in
+ * WIRE_ERROR_STATUS. Errors with no wire representation (IdGenerationError,
+ * InvalidDidError) deliberately stay outside this hierarchy.
+ *
+ * Subclassing adds no hierarchy beyond this root — notably
+ * StackVersionConflictError is a sibling of StackConflictError, not a
+ * subtype. See docs/spec/wire-format.md § Error responses.
+ */
+export class StackError extends Error {
+}
+export class StackValidationError extends StackError {
+    errors;
+    static code = 'validation';
+    code = StackValidationError.code;
+    constructor(errors) {
+        super(`Content validation failed:\n` + errors.map((e) => `  ${e.path}: ${e.message}`).join('\n'));
+        this.errors = errors;
+        this.name = 'StackValidationError';
+    }
+}
+export class StackMigrationError extends StackError {
+    static code = 'migration';
+    code = StackMigrationError.code;
+    constructor(message) {
+        super(message);
+        this.name = 'StackMigrationError';
+    }
+}
+/** Thrown by ScopedStack when a requester lacks permission for the operation. */
+export class StackPermissionError extends StackError {
+    static code = 'permission';
+    code = StackPermissionError.code;
+    constructor(message = 'Permission denied') {
+        super(message);
+        this.name = 'StackPermissionError';
+    }
+}
+/** Thrown when a record (or specific version) does not exist. */
+export class StackNotFoundError extends StackError {
+    static code = 'not_found';
+    code = StackNotFoundError.code;
+    constructor(message) {
+        super(message);
+        this.name = 'StackNotFoundError';
+    }
+}
+/** Thrown when an operation cannot proceed due to a constraint violation (e.g. deleting an attachment that is still referenced). */
+export class StackConflictError extends StackError {
+    static code = 'conflict';
+    code = StackConflictError.code;
+    constructor(message) {
+        super(message);
+        this.name = 'StackConflictError';
+    }
+}
+/**
+ * Thrown when an `ifVersion` precondition doesn't match a record's current
+ * version. Deliberately not a StackConflictError subtype — the two have
+ * different recovery stories and HTTP statuses (409 vs. 412). See
+ * docs/spec/versioning.md § Optimistic concurrency (`ifVersion`).
+ */
+export class StackVersionConflictError extends StackError {
+    recordId;
+    expectedVersion;
+    actualVersion;
+    static code = 'version_conflict';
+    code = StackVersionConflictError.code;
+    constructor(message, recordId, expectedVersion, actualVersion) {
+        super(message);
+        this.recordId = recordId;
+        this.expectedVersion = expectedVersion;
+        this.actualVersion = actualVersion;
+        this.name = 'StackVersionConflictError';
+    }
+}
+/**
+ * Thrown when a request is structurally malformed — not a content-validation
+ * failure, but input the adapter/server can't even interpret (e.g. an
+ * undecodable pagination cursor, a malformed TypeId, search text the engine
+ * cannot parse, or a typeId no definition exists for). Distinct from
+ * StackValidationError, which means the request was well-formed but content
+ * failed schema validation.
+ *
+ * Naming something absent belongs here rather than under `not_found`: a
+ * request whose *type* is undefined never addressed a record, so answering
+ * 404 would say a record was missing when none was asked for.
+ */
+export class StackQueryError extends StackError {
+    static code = 'bad_request';
+    code = StackQueryError.code;
+    constructor(message) {
+        super(message);
+        this.name = 'StackQueryError';
+    }
+}
+/**
+ * Thrown when an attachment upload exceeds the adapter's declared
+ * `limits.attachmentBytes` ceiling — checked client-side before any bytes
+ * are sent; a server still enforces 413 authoritatively regardless. See
+ * docs/spec/wire-format.md § Attachments.
+ */
+export class StackPayloadTooLargeError extends StackError {
+    static code = 'payload_too_large';
+    code = StackPayloadTooLargeError.code;
+    constructor(message) {
+        super(message);
+        this.name = 'StackPayloadTooLargeError';
+    }
+}
+/**
+ * Thrown when a server abandons an operation for taking too long — in
+ * practice a full-text search, the one query whose cost the sanitizers
+ * bound the *grammar* of but not the execution of (see
+ * docs/spec/data-model.md § Capability-gated filters).
+ *
+ * Never produced in-process: both SQLite engines run synchronously, so
+ * there is nothing to interrupt from inside the call. It exists so a
+ * server that bounds query time has a class to serialize, and so the app
+ * catching it can tell "too expensive, narrow it and retry" from
+ * StackQueryError's "malformed, don't bother retrying" — the distinction
+ * that would be lost if a timeout reused `bad_request`.
+ */
+export class StackTimeoutError extends StackError {
+    static code = 'timeout';
+    code = StackTimeoutError.code;
+    constructor(message) {
+        super(message);
+        this.name = 'StackTimeoutError';
+    }
+}
+/**
+ * Thrown by defineType() when redefining an existing typeId with a schema
+ * change beyond additive evolution. The remedy is a new version, never an
+ * in-place redefinition. See docs/spec/data-model.md § Schema drift
+ * detection.
+ */
+export class StackSchemaDriftError extends StackError {
+    typeId;
+    violations;
+    static code = 'schema_drift';
+    code = StackSchemaDriftError.code;
+    constructor(typeId, violations) {
+        super(`Schema drift detected for type "${typeId}": the stored schema and the new definition ` +
+            `differ beyond additive evolution (new optional fields only). Bump the version instead ` +
+            `of redefining "${typeId}" in place — e.g. defineType(\`${baseIdOf(typeId)}@${(parseTypeId(typeId)?.version ?? 0) + 1}\`, ...) plus registerMigration().\n` +
+            violations.map((v) => `  ${v.path || '(root)'}: ${v.message}`).join('\n'));
+        this.typeId = typeId;
+        this.violations = violations;
+        this.name = 'StackSchemaDriftError';
+    }
+}
+/**
+ * Thrown when a Stack or ScopedStack is used after close(). Deliberately
+ * outside the StackError taxonomy, alongside IdGenerationError and
+ * InvalidDidError: a caller holding a closed client is a local programming
+ * error with no wire representation — no server ever responds with it.
+ * See docs/spec/adapters.md § Lifecycle.
+ */
+export class StackClosedError extends Error {
+    constructor(message = 'This Stack has been closed.') {
+        super(message);
+        this.name = 'StackClosedError';
+    }
+}
+/**
+ * Thrown when a scoped view is asked to observe a stack whose adapter
+ * relays a remote feed. Outside the StackError taxonomy for the same
+ * reason StackClosedError is: it reports a topology the caller assembled,
+ * not a state a request can be in.
+ *
+ * A relayed frame is scoped by the authority that opened the feed, and a
+ * narrower scope cannot re-derive that decision — a purge leaves no record
+ * to check `canRead` against. Delivering anyway would break the promise
+ * that a subscriber never sees what it may not read; delivering only local
+ * writes would silently drop every change made elsewhere, which is the
+ * failure that looks fine in testing. So it refuses.
+ * See docs/spec/events.md § Permission scoping.
+ */
+export class StackRelayScopeError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'StackRelayScopeError';
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAuBpD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAgB,UAAW,SAAQ,KAAK;CAE7C;AAED,MAAM,OAAO,oBAAqB,SAAQ,UAAU;IAGtB;IAF5B,MAAM,CAAU,IAAI,GAAG,YAAqB,CAAC;IAC3B,IAAI,GAAG,oBAAoB,CAAC,IAAI,CAAC;IACnD,YAA4B,MAAyB;QACnD,KAAK,CACH,8BAA8B,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAC3F,CAAC;QAHwB,WAAM,GAAN,MAAM,CAAmB;QAInD,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;;AAGH,MAAM,OAAO,mBAAoB,SAAQ,UAAU;IACjD,MAAM,CAAU,IAAI,GAAG,WAAoB,CAAC;IAC1B,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC;IAClD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;;AAGH,iFAAiF;AACjF,MAAM,OAAO,oBAAqB,SAAQ,UAAU;IAClD,MAAM,CAAU,IAAI,GAAG,YAAqB,CAAC;IAC3B,IAAI,GAAG,oBAAoB,CAAC,IAAI,CAAC;IACnD,YAAY,OAAO,GAAG,mBAAmB;QACvC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;;AAGH,iEAAiE;AACjE,MAAM,OAAO,kBAAmB,SAAQ,UAAU;IAChD,MAAM,CAAU,IAAI,GAAG,WAAoB,CAAC;IAC1B,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC;IACjD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;;AAGH,oIAAoI;AACpI,MAAM,OAAO,kBAAmB,SAAQ,UAAU;IAChD,MAAM,CAAU,IAAI,GAAG,UAAmB,CAAC;IACzB,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC;IACjD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;;AAGH;;;;;GAKG;AACH,MAAM,OAAO,yBAA0B,SAAQ,UAAU;IAK5C;IACA;IACA;IANX,MAAM,CAAU,IAAI,GAAG,kBAA2B,CAAC;IACjC,IAAI,GAAG,yBAAyB,CAAC,IAAI,CAAC;IACxD,YACE,OAAe,EACN,QAAgB,EAChB,eAAuB,EACvB,aAAqB;QAE9B,KAAK,CAAC,OAAO,CAAC,CAAC;QAJN,aAAQ,GAAR,QAAQ,CAAQ;QAChB,oBAAe,GAAf,eAAe,CAAQ;QACvB,kBAAa,GAAb,aAAa,CAAQ;QAG9B,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;;AAGH;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,eAAgB,SAAQ,UAAU;IAC7C,MAAM,CAAU,IAAI,GAAG,aAAsB,CAAC;IAC5B,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC;IAC9C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;;AAGH;;;;;GAKG;AACH,MAAM,OAAO,yBAA0B,SAAQ,UAAU;IACvD,MAAM,CAAU,IAAI,GAAG,mBAA4B,CAAC;IAClC,IAAI,GAAG,yBAAyB,CAAC,IAAI,CAAC;IACxD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;;AAGH;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,iBAAkB,SAAQ,UAAU;IAC/C,MAAM,CAAU,IAAI,GAAG,SAAkB,CAAC;IACxB,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC;IAChD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;;AAGH;;;;;GAKG;AACH,MAAM,OAAO,qBAAsB,SAAQ,UAAU;IAIjC;IACA;IAJlB,MAAM,CAAU,IAAI,GAAG,cAAuB,CAAC;IAC7B,IAAI,GAAG,qBAAqB,CAAC,IAAI,CAAC;IACpD,YACkB,MAAc,EACd,UAAkC;QAElD,KAAK,CACH,mCAAmC,MAAM,8CAA8C;YACrF,wFAAwF;YACxF,kBAAkB,MAAM,kCAAkC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,sCAAsC;YAC3J,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,QAAQ,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAC5E,CAAC;QARc,WAAM,GAAN,MAAM,CAAQ;QACd,eAAU,GAAV,UAAU,CAAwB;QAQlD,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;;AAGH;;;;;;GAMG;AACH,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzC,YAAY,OAAO,GAAG,6BAA6B;QACjD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF"}

package/dist/grants.d.ts

@@ -0,0 +1,84 @@
+/**
+ * Grant vocabulary and coverage
+ * -------------------------------------------------------
+ * What a `_grant` Record says, and who it says it about. The coverage
+ * question — does this grant reach this grantee — is answered here rather
+ * than at each call site so that the access checks and listGrants() cannot
+ * drift apart about it.
+ *
+ * See docs/spec/access-control.md § Type-level grants.
+ */
+import type { GroupRole } from './access.js';
+import type { EntityId, GrantAction, GrantContent, QueryResult, RecordId, StackQuery, StackRecord } from './types.js';
+/**
+ * Valid GrantAction values, for runtime validation in Stack.grant().
+ * Built from GRANT_ACTIONS (types.ts), the source of truth GrantAction is
+ * itself derived from — so this can't drift from the type.
+ */
+export declare const GRANT_ACTION_SET: ReadonlySet<GrantAction>;
+/**
+ * The read actions that make a mutate action coherent, scope for scope: a
+ * `-any` verb needs read over the same reach it can mutate, a `-own` verb
+ * needs read over its author's own. A grant carrying neither conveys the
+ * verb to nobody. `create` has no companion — writing a Record you then
+ * cannot read is the drop-box, and it discloses nothing.
+ * See docs/spec/access-control.md § Write implies read.
+ */
+export declare const READ_COMPANIONS: ReadonlyMap<GrantAction, readonly GrantAction[]>;
+/**
+ * Whether one grant's action list conveys `action`. The companion has to
+ * sit in the same `_grant` Record, not merely somewhere in the grantee's
+ * set: a grant is revoked whole, so a rule satisfied across two records
+ * would let revoking the read one leave a mutate-without-read grant
+ * standing — the configuration this rule exists to refuse, arrived at
+ * without anyone writing it.
+ */
+export declare function grantConveys(actions: readonly string[], action: GrantAction): boolean;
+/**
+ * Who a grant() / revoke() / listGrants() call targets: a specific entity
+ * (DID), a `_group` Record's roster (by ID), or `null` for the default
+ * grant / default-only listing. See docs/spec/access-control.md § Type-level
+ * grants.
+ */
+export type GrantTarget = EntityId | {
+    groupId: RecordId;
+} | null;
+/** Direct (non-roster) match between a stored _grant's content and a GrantTarget. */
+export declare function matchesGrantTarget(content: GrantContent, target: GrantTarget): boolean;
+/**
+ * Reject a grant target that names nobody. An empty groupId or entityId is
+ * falsy, so a stored record carrying one reads as a *default* grant — every
+ * authenticated entity — instead of the target the caller meant. `null` is
+ * the only way to say "default".
+ */
+export declare function validateGrantTarget(target: GrantTarget): void;
+/**
+ * Whether a stored _grant covers `grantee`: a direct DID match, roster
+ * membership when `allowGroup`, or a default when `allowDefault`. Presence
+ * decides the tier, never truthiness — an empty grantee field names nobody.
+ * Module-level so the access checks and listGrants() cannot drift apart.
+ * See docs/spec/access-control.md § Type-level grants.
+ */
+export declare function grantCoversGrantee(c: GrantContent, grantee: EntityId, opts: {
+    allowDefault: boolean;
+    allowGroup: boolean;
+    groupRoles: Map<string, GroupRole | null>;
+    resolveRecord: (id: RecordId) => Promise<StackRecord | null>;
+}): Promise<boolean>;
+/**
+ * System type families grant() refuses to target: a grant on any of them
+ * would let the grantee mint their own grants, touch stack config, or
+ * register an app card claiming a DID that isn't theirs — the last of
+ * which is what verified app attribution rests on. See
+ * docs/spec/access-control.md § Type-level grants.
+ */
+export declare const UNGRANTABLE_SYSTEM_TYPES: ReadonlySet<string>;
+/**
+ * Every `_grant` Record, cursor-walked. Read through an unscoped query at
+ * every call site: a grant is what decides who may read, so it can never
+ * itself sit behind a read check. No content prefilter — a stored grant's
+ * typeId may be a bare baseId or versioned, so exact matching would wrongly
+ * exclude family versions.
+ */
+export declare function loadGrantRecords(query: (q: StackQuery) => Promise<QueryResult>): Promise<StackRecord[]>;
+//# sourceMappingURL=grants.d.ts.map

package/dist/grants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../src/grants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,KAAK,EACV,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,WAAW,EACX,QAAQ,EACR,UAAU,EACV,WAAW,EACZ,MAAM,YAAY,CAAC;AAGpB;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,EAAE,WAAW,CAAC,WAAW,CAA0B,CAAC;AAEjF;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,WAAW,EAAE,SAAS,WAAW,EAAE,CAK3E,CAAC;AAEH;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAIrF;AAED;;;;;GAKG;AACH,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG;IAAE,OAAO,EAAE,QAAQ,CAAA;CAAE,GAAG,IAAI,CAAC;AAElE,qFAAqF;AACrF,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAYtF;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,CAgB7D;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,CAAC,EAAE,YAAY,EACf,OAAO,EAAE,QAAQ,EACjB,IAAI,EAAE;IACJ,YAAY,EAAE,OAAO,CAAC;IACtB,UAAU,EAAE,OAAO,CAAC;IACpB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC,CAAC;IAC1C,aAAa,EAAE,CAAC,EAAE,EAAE,QAAQ,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;CAC9D,GACA,OAAO,CAAC,OAAO,CAAC,CAiBlB;AA+BD;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,EAAE,WAAW,CAAC,MAAM,CAIvD,CAAC;AAEH;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,CAAC,CAAC,EAAE,UAAU,KAAK,OAAO,CAAC,WAAW,CAAC,GAC7C,OAAO,CAAC,WAAW,EAAE,CAAC,CAExB"}

package/dist/grants.js

@@ -0,0 +1,157 @@
+/**
+ * Grant vocabulary and coverage
+ * -------------------------------------------------------
+ * What a `_grant` Record says, and who it says it about. The coverage
+ * question — does this grant reach this grantee — is answered here rather
+ * than at each call site so that the access checks and listGrants() cannot
+ * drift apart about it.
+ *
+ * See docs/spec/access-control.md § Type-level grants.
+ */
+import { baseIdOf } from './schema.js';
+import { StackQueryError } from './errors.js';
+import { SYSTEM_TYPES, GRANT_ACTIONS } from './types.js';
+import { groupRoleFromAssociations } from './access.js';
+import { queryAllPages } from './stack-reads.js';
+/**
+ * Valid GrantAction values, for runtime validation in Stack.grant().
+ * Built from GRANT_ACTIONS (types.ts), the source of truth GrantAction is
+ * itself derived from — so this can't drift from the type.
+ */
+export const GRANT_ACTION_SET = new Set(GRANT_ACTIONS);
+/**
+ * The read actions that make a mutate action coherent, scope for scope: a
+ * `-any` verb needs read over the same reach it can mutate, a `-own` verb
+ * needs read over its author's own. A grant carrying neither conveys the
+ * verb to nobody. `create` has no companion — writing a Record you then
+ * cannot read is the drop-box, and it discloses nothing.
+ * See docs/spec/access-control.md § Write implies read.
+ */
+export const READ_COMPANIONS = new Map([
+    ['update-own', ['read-own', 'read-any']],
+    ['delete-own', ['read-own', 'read-any']],
+    ['update-any', ['read-any']],
+    ['delete-any', ['read-any']],
+]);
+/**
+ * Whether one grant's action list conveys `action`. The companion has to
+ * sit in the same `_grant` Record, not merely somewhere in the grantee's
+ * set: a grant is revoked whole, so a rule satisfied across two records
+ * would let revoking the read one leave a mutate-without-read grant
+ * standing — the configuration this rule exists to refuse, arrived at
+ * without anyone writing it.
+ */
+export function grantConveys(actions, action) {
+    if (!actions.includes(action))
+        return false;
+    const companions = READ_COMPANIONS.get(action);
+    return !companions || companions.some((c) => actions.includes(c));
+}
+/** Direct (non-roster) match between a stored _grant's content and a GrantTarget. */
+export function matchesGrantTarget(content, target) {
+    if (target !== null && typeof target === 'object') {
+        // Guarded so an absent groupId can't match the absent granteeGroupId on
+        // every entity-targeted and default grant — `undefined === undefined`
+        // would otherwise sweep them all into a revoke aimed at one group.
+        if (!target.groupId)
+            return false;
+        return content.granteeGroupId === target.groupId;
+    }
+    if (target === null) {
+        return !content.granteeEntityId && !content.granteeGroupId;
+    }
+    return content.granteeEntityId === target;
+}
+/**
+ * Reject a grant target that names nobody. An empty groupId or entityId is
+ * falsy, so a stored record carrying one reads as a *default* grant — every
+ * authenticated entity — instead of the target the caller meant. `null` is
+ * the only way to say "default".
+ */
+export function validateGrantTarget(target) {
+    if (target === null)
+        return;
+    if (typeof target === 'string') {
+        if (target.length === 0) {
+            throw new StackQueryError('A grant target entityId cannot be empty. Pass null for a default grant.');
+        }
+        return;
+    }
+    if (typeof target.groupId !== 'string' || target.groupId.length === 0) {
+        throw new StackQueryError('A group grant target requires a non-empty groupId.');
+    }
+    // Not a format check: granteeGroupId is a reference to an existing
+    // Record, like parentId or an association's recordId, and none of those
+    // are parsed either. One that resolves to nothing simply denies.
+}
+/**
+ * Whether a stored _grant covers `grantee`: a direct DID match, roster
+ * membership when `allowGroup`, or a default when `allowDefault`. Presence
+ * decides the tier, never truthiness — an empty grantee field names nobody.
+ * Module-level so the access checks and listGrants() cannot drift apart.
+ * See docs/spec/access-control.md § Type-level grants.
+ */
+export async function grantCoversGrantee(c, grantee, opts) {
+    const namesEntity = c.granteeEntityId !== undefined;
+    const namesGroup = c.granteeGroupId !== undefined;
+    if (!namesEntity && !namesGroup)
+        return opts.allowDefault;
+    if (namesEntity && c.granteeEntityId !== grantee)
+        return false;
+    if (namesGroup) {
+        if (!opts.allowGroup)
+            return false;
+        if (!c.granteeGroupId)
+            return false;
+        const role = await resolveGroupRoleMemoized(c.granteeGroupId, grantee, opts.groupRoles, opts.resolveRecord);
+        if (role === null)
+            return false;
+    }
+    return true;
+}
+/**
+ * An entity's role on a `_group` roster, memoized in the caller's
+ * `groupRoles` map. That map is built per operation and threaded alongside
+ * `prefetchedGrants`, so no resolved role outlives the operation that
+ * resolved it — removal from a group must never go stale.
+ * See docs/spec/access-control.md § Type-level grants.
+ */
+async function resolveGroupRoleMemoized(groupId, entityId, groupRoles, resolveRecord) {
+    const key = `${groupId}:${entityId}`;
+    const cached = groupRoles.get(key);
+    if (cached !== undefined)
+        return cached;
+    const group = await resolveRecord(groupId);
+    // Only a real `_group` Record carries a roster. Without the family check
+    // any Record's relationship associations would serve as one, and a group
+    // migrated out of the family would keep resolving after it had stopped
+    // being a group.
+    const role = group && baseIdOf(group.typeId) === SYSTEM_TYPES.GROUP
+        ? groupRoleFromAssociations(group.associations, entityId)
+        : null;
+    groupRoles.set(key, role);
+    return role;
+}
+/**
+ * System type families grant() refuses to target: a grant on any of them
+ * would let the grantee mint their own grants, touch stack config, or
+ * register an app card claiming a DID that isn't theirs — the last of
+ * which is what verified app attribution rests on. See
+ * docs/spec/access-control.md § Type-level grants.
+ */
+export const UNGRANTABLE_SYSTEM_TYPES = new Set([
+    SYSTEM_TYPES.GRANT,
+    SYSTEM_TYPES.CONFIG,
+    SYSTEM_TYPES.APP,
+]);
+/**
+ * Every `_grant` Record, cursor-walked. Read through an unscoped query at
+ * every call site: a grant is what decides who may read, so it can never
+ * itself sit behind a read check. No content prefilter — a stored grant's
+ * typeId may be a bare baseId or versioned, so exact matching would wrongly
+ * exclude family versions.
+ */
+export function loadGrantRecords(query) {
+    return queryAllPages(query, { filter: { typeId: `${SYSTEM_TYPES.GRANT}@1` } });
+}
+//# sourceMappingURL=grants.js.map

package/dist/grants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants.js","sourceRoot":"","sources":["../src/grants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AACzD,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAWxD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAA6B,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;AAEjF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAqD,IAAI,GAAG,CAAC;IACvF,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IACxC,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IACxC,CAAC,YAAY,EAAE,CAAC,UAAU,CAAC,CAAC;IAC5B,CAAC,YAAY,EAAE,CAAC,UAAU,CAAC,CAAC;CAC7B,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,OAA0B,EAAE,MAAmB;IAC1E,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,UAAU,GAAG,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/C,OAAO,CAAC,UAAU,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AACpE,CAAC;AAUD,qFAAqF;AACrF,MAAM,UAAU,kBAAkB,CAAC,OAAqB,EAAE,MAAmB;IAC3E,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClD,wEAAwE;QACxE,sEAAsE;QACtE,mEAAmE;QACnE,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAClC,OAAO,OAAO,CAAC,cAAc,KAAK,MAAM,CAAC,OAAO,CAAC;IACnD,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,CAAC,OAAO,CAAC,eAAe,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;IAC7D,CAAC;IACD,OAAO,OAAO,CAAC,eAAe,KAAK,MAAM,CAAC;AAC5C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAmB;IACrD,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO;IAC5B,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,eAAe,CACvB,yEAAyE,CAC1E,CAAC;QACJ,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,eAAe,CAAC,oDAAoD,CAAC,CAAC;IAClF,CAAC;IACD,mEAAmE;IACnE,wEAAwE;IACxE,iEAAiE;AACnE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,CAAe,EACf,OAAiB,EACjB,IAKC;IAED,MAAM,WAAW,GAAG,CAAC,CAAC,eAAe,KAAK,SAAS,CAAC;IACpD,MAAM,UAAU,GAAG,CAAC,CAAC,cAAc,KAAK,SAAS,CAAC;IAClD,IAAI,CAAC,WAAW,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC,YAAY,CAAC;IAC1D,IAAI,WAAW,IAAI,CAAC,CAAC,eAAe,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAC/D,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,OAAO,KAAK,CAAC;QACnC,IAAI,CAAC,CAAC,CAAC,cAAc;YAAE,OAAO,KAAK,CAAC;QACpC,MAAM,IAAI,GAAG,MAAM,wBAAwB,CACzC,CAAC,CAAC,cAAc,EAChB,OAAO,EACP,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,aAAa,CACnB,CAAC;QACF,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;IAClC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,wBAAwB,CACrC,OAAiB,EACjB,QAAkB,EAClB,UAAyC,EACzC,aAA4D;IAE5D,MAAM,GAAG,GAAG,GAAG,OAAO,IAAI,QAAQ,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACxC,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;IAC3C,yEAAyE;IACzE,yEAAyE;IACzE,uEAAuE;IACvE,iBAAiB;IACjB,MAAM,IAAI,GACR,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,YAAY,CAAC,KAAK;QACpD,CAAC,CAAC,yBAAyB,CAAC,KAAK,CAAC,YAAY,EAAE,QAAQ,CAAC;QACzD,CAAC,CAAC,IAAI,CAAC;IACX,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC1B,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAwB,IAAI,GAAG,CAAC;IACnE,YAAY,CAAC,KAAK;IAClB,YAAY,CAAC,MAAM;IACnB,YAAY,CAAC,GAAG;CACjB,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAC9B,KAA8C;IAE9C,OAAO,aAAa,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,YAAY,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC;AACjF,CAAC"}

package/dist/id.d.ts

@@ -15,9 +15,6 @@ export declare const RAND_SUFFIX_LENGTH = 3;
 export declare class IdGenerationError extends Error {
     constructor(message?: string);
 }
-export declare class IdGenerationOverflowError extends IdGenerationError {
-    constructor(message?: string);
-}
 export declare const crockford32Encode: (n: number) => string;
 export declare const crockford32Decode: (s: string) => number;
 export declare const _setLastNowId: (chars: string) => void;
@@ -39,8 +36,13 @@ export declare const MAX_ID_TIMESTAMP: number;
 /**
  * Generate a new Stack record ID. Time-sortable: lexicographic order
  * matches creation order, with same-millisecond IDs monotonically
- * incremented. Throws IdGenerationOverflowError past 32^3 IDs in one
- * millisecond.
+ * incremented.
+ *
+ * A millisecond whose suffix space is spent carries into the next one
+ * rather than failing, so how many IDs a millisecond holds never depends
+ * on where its random suffix happened to start — which is what keeps the
+ * order total and the call free of a capacity a caller cannot see.
+ * See docs/spec/data-model.md § Record IDs.
  *
  * @param timestamp - Override the timestamp (ms since epoch). Defaults to Date.now().
  */

package/dist/id.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"id.d.ts","sourceRoot":"","sources":["../src/id.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,eAAO,MAAM,IAAI,QAAoB,CAAC;AAGtC,eAAO,MAAM,kBAAkB,IAAI,CAAC;AAcpC,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,OAAO,SAAK;CAIzB;AAED,qBAAa,yBAA0B,SAAQ,iBAAiB;gBAClD,OAAO,SAAK;CAIzB;AAMD,eAAO,MAAM,iBAAiB,GAAI,GAAG,MAAM,KAAG,MAiB7C,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAAI,GAAG,MAAM,KAAG,MAe7C,CAAC;AAoCF,eAAO,MAAM,aAAa,GAAI,OAAO,MAAM,KAAG,IAK7C,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAAI,OAAO,MAAM,KAAG,IAKjD,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAAI,WAAW,MAAM,KAAG,IAErD,CAAC;AAEF,wEAAwE;AACxE,eAAO,MAAM,aAAa,QAAO,IAIhC,CAAC;AAMF;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,QAA2C,CAAC;AAEzE;;;;;;;GAOG;AACH,eAAO,MAAM,UAAU,GAAI,YAAW,MAAmB,KAAG,MAU3D,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,sBAAsB,GAAI,WAAW,MAAM,KAAG,MAS1D,CAAC;AASF;;;;GAIG;AACH,eAAO,MAAM,eAAe,GAAI,IAAI,MAAM,KAAG,OAA6B,CAAC;AAE3E;;;GAGG;AACH,eAAO,MAAM,WAAW,GAAI,IAAI,MAAM,KAAG,MACa,CAAC"}
+{"version":3,"file":"id.d.ts","sourceRoot":"","sources":["../src/id.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,eAAO,MAAM,IAAI,QAAoB,CAAC;AAGtC,eAAO,MAAM,kBAAkB,IAAI,CAAC;AAcpC,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,OAAO,SAAK;CAIzB;AAMD,eAAO,MAAM,iBAAiB,GAAI,GAAG,MAAM,KAAG,MAiB7C,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAAI,GAAG,MAAM,KAAG,MAe7C,CAAC;AAkCF,eAAO,MAAM,aAAa,GAAI,OAAO,MAAM,KAAG,IAK7C,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAAI,OAAO,MAAM,KAAG,IAKjD,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAAI,WAAW,MAAM,KAAG,IAErD,CAAC;AAEF,wEAAwE;AACxE,eAAO,MAAM,aAAa,QAAO,IAIhC,CAAC;AAMF;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,QAA2C,CAAC;AAEzE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,UAAU,GAAI,YAAW,MAAmB,KAAG,MAgB3D,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,sBAAsB,GAAI,WAAW,MAAM,KAAG,MAS1D,CAAC;AASF;;;;GAIG;AACH,eAAO,MAAM,eAAe,GAAI,IAAI,MAAM,KAAG,OAA6B,CAAC;AAE3E;;;GAGG;AACH,eAAO,MAAM,WAAW,GAAI,IAAI,MAAM,KAAG,MACa,CAAC"}

package/dist/id.js

@@ -30,12 +30,6 @@ export class IdGenerationError extends Error {
         this.name = 'IdGenerationError';
     }
 }
-export class IdGenerationOverflowError extends IdGenerationError {
-    constructor(message = '') {
-        super(message || 'Too many IDs have been generated in the same millisecond.');
-        this.name = 'IdGenerationOverflowError';
-    }
-}
 // -------------------------------------------------------
 // Encoding / decoding
 // -------------------------------------------------------
@@ -88,12 +82,10 @@ const generateRandChars = () => {
     } while (value > Math.floor(0xffffffff / modulus) * modulus);
     return pad(crockford32Encode(value % modulus), RAND_SUFFIX_LENGTH);
 };
+/** The next suffix after `randChars`, or null once the space is spent. */
 const incrementRandChars = (randChars) => {
     const next = crockford32Encode(crockford32Decode(randChars) + 1);
-    if (next.length > RAND_SUFFIX_LENGTH) {
-        throw new IdGenerationOverflowError();
-    }
-    return pad(next, RAND_SUFFIX_LENGTH);
+    return next.length > RAND_SUFFIX_LENGTH ? null : pad(next, RAND_SUFFIX_LENGTH);
 };
 // -------------------------------------------------------
 // Test hooks (package-private)
@@ -136,15 +128,25 @@ export const MAX_ID_TIMESTAMP = Math.pow(BASE, MIN_TIMESTAMP_LENGTH) - 1;
 /**
  * Generate a new Stack record ID. Time-sortable: lexicographic order
  * matches creation order, with same-millisecond IDs monotonically
- * incremented. Throws IdGenerationOverflowError past 32^3 IDs in one
- * millisecond.
+ * incremented.
+ *
+ * A millisecond whose suffix space is spent carries into the next one
+ * rather than failing, so how many IDs a millisecond holds never depends
+ * on where its random suffix happened to start — which is what keeps the
+ * order total and the call free of a capacity a caller cannot see.
+ * See docs/spec/data-model.md § Record IDs.
  *
  * @param timestamp - Override the timestamp (ms since epoch). Defaults to Date.now().
  */
 export const generateId = (timestamp = Date.now()) => {
-    const effectiveTimestamp = Math.max(timestamp, lastTimestamp);
-    const nowId = pad(crockford32Encode(effectiveTimestamp), MIN_TIMESTAMP_LENGTH);
-    const randChars = nowId !== lastNowId ? generateRandChars() : incrementRandChars(lastRandChars);
+    let effectiveTimestamp = Math.max(timestamp, lastTimestamp);
+    let nowId = pad(crockford32Encode(effectiveTimestamp), MIN_TIMESTAMP_LENGTH);
+    let randChars = nowId === lastNowId ? incrementRandChars(lastRandChars) : generateRandChars();
+    if (randChars === null) {
+        effectiveTimestamp += 1;
+        nowId = pad(crockford32Encode(effectiveTimestamp), MIN_TIMESTAMP_LENGTH);
+        randChars = generateRandChars();
+    }
     lastTimestamp = effectiveTimestamp;
     lastNowId = nowId;
     lastRandChars = randChars;

package/dist/id.js.map

@@ -1 +1 @@
-{"version":3,"file":"id.js","sourceRoot":"","sources":["../src/id.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,UAAU,GAAG,kCAAkC,CAAC;AAEtD,MAAM,CAAC,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC;AAEtC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAC/B,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAEpC,kEAAkE;AAClE,IAAI,SAAS,GAAG,EAAE,CAAC;AACnB,IAAI,aAAa,GAAG,EAAE,CAAC;AACvB,wEAAwE;AACxE,uEAAuE;AACvE,uDAAuD;AACvD,IAAI,aAAa,GAAG,CAAC,CAAC;AAEtB,0DAA0D;AAC1D,SAAS;AACT,0DAA0D;AAE1D,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C,YAAY,OAAO,GAAG,EAAE;QACtB,KAAK,CAAC,OAAO,IAAI,+BAA+B,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED,MAAM,OAAO,yBAA0B,SAAQ,iBAAiB;IAC9D,YAAY,OAAO,GAAG,EAAE;QACtB,KAAK,CAAC,OAAO,IAAI,2DAA2D,CAAC,CAAC;QAC9E,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAED,0DAA0D;AAC1D,sBAAsB;AACtB,0DAA0D;AAE1D,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAS,EAAU,EAAE;IACrD,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACV,MAAM,IAAI,UAAU,CAAC,mCAAmC,CAAC,CAAC;IAC5D,CAAC;IAED,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAElB,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACZ,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC;IAED,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,GAAG,UAAU,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC;QACvC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAS,EAAU,EAAE;IACrD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,UAAU,CAAC,2BAA2B,CAAC,CAAC;IACpD,CAAC;IAED,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IACpB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACpD,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;YACZ,MAAM,IAAI,UAAU,CAAC,mCAAmC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;QAClF,CAAC;QACD,CAAC,IAAI,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC,CAAC;AAEF,0DAA0D;AAC1D,mBAAmB;AACnB,0DAA0D;AAE1D,MAAM,GAAG,GAAG,CAAC,KAAa,EAAE,MAAc,EAAU,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AAE7F;;;GAGG;AACH,MAAM,iBAAiB,GAAG,GAAW,EAAE;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC;IAC/B,0CAA0C;IAC1C,IAAI,KAAa,CAAC;IAClB,GAAG,CAAC;QACF,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QAC5B,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC,QAAQ,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,OAAO,CAAC,GAAG,OAAO,EAAE;IAC7D,OAAO,GAAG,CAAC,iBAAiB,CAAC,KAAK,GAAG,OAAO,CAAC,EAAE,kBAAkB,CAAC,CAAC;AACrE,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,CAAC,SAAiB,EAAU,EAAE;IACvD,MAAM,IAAI,GAAG,iBAAiB,CAAC,iBAAiB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACjE,IAAI,IAAI,CAAC,MAAM,GAAG,kBAAkB,EAAE,CAAC;QACrC,MAAM,IAAI,yBAAyB,EAAE,CAAC;IACxC,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;AACvC,CAAC,CAAC;AAEF,0DAA0D;AAC1D,+BAA+B;AAC/B,0DAA0D;AAE1D,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,KAAa,EAAQ,EAAE;IACnD,IAAI,KAAK,CAAC,MAAM,GAAG,oBAAoB,EAAE,CAAC;QACxC,MAAM,IAAI,UAAU,CAAC,gCAAgC,oBAAoB,cAAc,CAAC,CAAC;IAC3F,CAAC;IACD,SAAS,GAAG,KAAK,CAAC;AACpB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,KAAa,EAAQ,EAAE;IACvD,IAAI,KAAK,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;QACxC,MAAM,IAAI,UAAU,CAAC,mCAAmC,kBAAkB,cAAc,CAAC,CAAC;IAC5F,CAAC;IACD,aAAa,GAAG,KAAK,CAAC;AACxB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,SAAiB,EAAQ,EAAE;IAC3D,aAAa,GAAG,SAAS,CAAC;AAC5B,CAAC,CAAC;AAEF,wEAAwE;AACxE,MAAM,CAAC,MAAM,aAAa,GAAG,GAAS,EAAE;IACtC,SAAS,GAAG,EAAE,CAAC;IACf,aAAa,GAAG,EAAE,CAAC;IACnB,aAAa,GAAG,CAAC,CAAC;AACpB,CAAC,CAAC;AAEF,0DAA0D;AAC1D,aAAa;AACb,0DAA0D;AAE1D;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,oBAAoB,CAAC,GAAG,CAAC,CAAC;AAEzE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,YAAoB,IAAI,CAAC,GAAG,EAAE,EAAU,EAAE;IACnE,MAAM,kBAAkB,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,GAAG,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,EAAE,oBAAoB,CAAC,CAAC;IAC/E,MAAM,SAAS,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAEhG,aAAa,GAAG,kBAAkB,CAAC;IACnC,SAAS,GAAG,KAAK,CAAC;IAClB,aAAa,GAAG,SAAS,CAAC;IAE1B,OAAO,KAAK,GAAG,SAAS,CAAC;AAC3B,CAAC,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,SAAiB,EAAU,EAAE;IAClE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,IAAI,SAAS,GAAG,gBAAgB,EAAE,CAAC;QACjF,MAAM,IAAI,iBAAiB,CACzB,aAAa,SAAS,2CAA2C,gBAAgB,GAAG;YAClF,6BAA6B,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC,WAAW,EAAE,IAAI,CAC5E,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,oBAAoB,CAAC,CAAC;IACtE,OAAO,KAAK,GAAG,iBAAiB,EAAE,CAAC;AACrC,CAAC,CAAC;AAEF,0DAA0D;AAC1D,oBAAoB;AACpB,0DAA0D;AAE1D,MAAM,SAAS,GAAG,oBAAoB,GAAG,kBAAkB,CAAC;AAC5D,MAAM,SAAS,GAAG,IAAI,MAAM,CAAC,KAAK,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC;AAEhE;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,EAAU,EAAW,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAE3E;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,EAAU,EAAU,EAAE,CAChD,iBAAiB,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"id.js","sourceRoot":"","sources":["../src/id.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,UAAU,GAAG,kCAAkC,CAAC;AAEtD,MAAM,CAAC,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC;AAEtC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAC/B,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAEpC,kEAAkE;AAClE,IAAI,SAAS,GAAG,EAAE,CAAC;AACnB,IAAI,aAAa,GAAG,EAAE,CAAC;AACvB,wEAAwE;AACxE,uEAAuE;AACvE,uDAAuD;AACvD,IAAI,aAAa,GAAG,CAAC,CAAC;AAEtB,0DAA0D;AAC1D,SAAS;AACT,0DAA0D;AAE1D,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C,YAAY,OAAO,GAAG,EAAE;QACtB,KAAK,CAAC,OAAO,IAAI,+BAA+B,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED,0DAA0D;AAC1D,sBAAsB;AACtB,0DAA0D;AAE1D,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAS,EAAU,EAAE;IACrD,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACV,MAAM,IAAI,UAAU,CAAC,mCAAmC,CAAC,CAAC;IAC5D,CAAC;IAED,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAElB,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACZ,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC;IAED,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,GAAG,UAAU,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC;QACvC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAS,EAAU,EAAE;IACrD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,UAAU,CAAC,2BAA2B,CAAC,CAAC;IACpD,CAAC;IAED,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IACpB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACpD,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;YACZ,MAAM,IAAI,UAAU,CAAC,mCAAmC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;QAClF,CAAC;QACD,CAAC,IAAI,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC,CAAC;AAEF,0DAA0D;AAC1D,mBAAmB;AACnB,0DAA0D;AAE1D,MAAM,GAAG,GAAG,CAAC,KAAa,EAAE,MAAc,EAAU,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AAE7F;;;GAGG;AACH,MAAM,iBAAiB,GAAG,GAAW,EAAE;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC;IAC/B,0CAA0C;IAC1C,IAAI,KAAa,CAAC;IAClB,GAAG,CAAC;QACF,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QAC5B,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC,QAAQ,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,OAAO,CAAC,GAAG,OAAO,EAAE;IAC7D,OAAO,GAAG,CAAC,iBAAiB,CAAC,KAAK,GAAG,OAAO,CAAC,EAAE,kBAAkB,CAAC,CAAC;AACrE,CAAC,CAAC;AAEF,0EAA0E;AAC1E,MAAM,kBAAkB,GAAG,CAAC,SAAiB,EAAiB,EAAE;IAC9D,MAAM,IAAI,GAAG,iBAAiB,CAAC,iBAAiB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACjE,OAAO,IAAI,CAAC,MAAM,GAAG,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;AACjF,CAAC,CAAC;AAEF,0DAA0D;AAC1D,+BAA+B;AAC/B,0DAA0D;AAE1D,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,KAAa,EAAQ,EAAE;IACnD,IAAI,KAAK,CAAC,MAAM,GAAG,oBAAoB,EAAE,CAAC;QACxC,MAAM,IAAI,UAAU,CAAC,gCAAgC,oBAAoB,cAAc,CAAC,CAAC;IAC3F,CAAC;IACD,SAAS,GAAG,KAAK,CAAC;AACpB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,KAAa,EAAQ,EAAE;IACvD,IAAI,KAAK,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;QACxC,MAAM,IAAI,UAAU,CAAC,mCAAmC,kBAAkB,cAAc,CAAC,CAAC;IAC5F,CAAC;IACD,aAAa,GAAG,KAAK,CAAC;AACxB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,SAAiB,EAAQ,EAAE;IAC3D,aAAa,GAAG,SAAS,CAAC;AAC5B,CAAC,CAAC;AAEF,wEAAwE;AACxE,MAAM,CAAC,MAAM,aAAa,GAAG,GAAS,EAAE;IACtC,SAAS,GAAG,EAAE,CAAC;IACf,aAAa,GAAG,EAAE,CAAC;IACnB,aAAa,GAAG,CAAC,CAAC;AACpB,CAAC,CAAC;AAEF,0DAA0D;AAC1D,aAAa;AACb,0DAA0D;AAE1D;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,oBAAoB,CAAC,GAAG,CAAC,CAAC;AAEzE;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,YAAoB,IAAI,CAAC,GAAG,EAAE,EAAU,EAAE;IACnE,IAAI,kBAAkB,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IAC5D,IAAI,KAAK,GAAG,GAAG,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,EAAE,oBAAoB,CAAC,CAAC;IAC7E,IAAI,SAAS,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC;IAE9F,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,kBAAkB,IAAI,CAAC,CAAC;QACxB,KAAK,GAAG,GAAG,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,EAAE,oBAAoB,CAAC,CAAC;QACzE,SAAS,GAAG,iBAAiB,EAAE,CAAC;IAClC,CAAC;IAED,aAAa,GAAG,kBAAkB,CAAC;IACnC,SAAS,GAAG,KAAK,CAAC;IAClB,aAAa,GAAG,SAAS,CAAC;IAE1B,OAAO,KAAK,GAAG,SAAS,CAAC;AAC3B,CAAC,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,SAAiB,EAAU,EAAE;IAClE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,IAAI,SAAS,GAAG,gBAAgB,EAAE,CAAC;QACjF,MAAM,IAAI,iBAAiB,CACzB,aAAa,SAAS,2CAA2C,gBAAgB,GAAG;YAClF,6BAA6B,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC,WAAW,EAAE,IAAI,CAC5E,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,oBAAoB,CAAC,CAAC;IACtE,OAAO,KAAK,GAAG,iBAAiB,EAAE,CAAC;AACrC,CAAC,CAAC;AAEF,0DAA0D;AAC1D,oBAAoB;AACpB,0DAA0D;AAE1D,MAAM,SAAS,GAAG,oBAAoB,GAAG,kBAAkB,CAAC;AAC5D,MAAM,SAAS,GAAG,IAAI,MAAM,CAAC,KAAK,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC;AAEhE;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,EAAU,EAAW,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAE3E;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,EAAU,EAAU,EAAE,CAChD,iBAAiB,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAC,CAAC"}

package/dist/identity-bindings.d.ts

@@ -0,0 +1,13 @@
+/**
+ * DID bindings
+ * -------------------------------------------------------
+ * Which content fields are lookup keys rather than display values, and
+ * which of those a stack resolves *by*. Every one is immutable once set;
+ * the unique subset is additionally one-per-stack, because a lookup with
+ * two answers is all an impersonating card needs.
+ *
+ * See docs/spec/identity.md § DID bindings.
+ */
+export declare const bindingFieldsOf: (family: string) => readonly ("did" | "appId")[];
+export declare const uniqueBindingFieldsOf: (family: string) => readonly ("did" | "appId")[];
+//# sourceMappingURL=identity-bindings.d.ts.map

package/dist/identity-bindings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-bindings.d.ts","sourceRoot":"","sources":["../src/identity-bindings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAkCH,eAAO,MAAM,eAAe,GAAI,QAAQ,MAAM,KAAG,SAAS,CAAC,KAAK,GAAG,OAAO,CAAC,EACzC,CAAC;AAEnC,eAAO,MAAM,qBAAqB,GAAI,QAAQ,MAAM,KAAG,SAAS,CAAC,KAAK,GAAG,OAAO,CAAC,EACxC,CAAC"}

package/dist/identity-bindings.js

@@ -0,0 +1,42 @@
+/**
+ * DID bindings
+ * -------------------------------------------------------
+ * Which content fields are lookup keys rather than display values, and
+ * which of those a stack resolves *by*. Every one is immutable once set;
+ * the unique subset is additionally one-per-stack, because a lookup with
+ * two answers is all an impersonating card needs.
+ *
+ * See docs/spec/identity.md § DID bindings.
+ */
+import { SYSTEM_TYPES } from './types.js';
+/**
+ * Content fields that are lookup keys rather than display values: a card
+ * claims one, and something later resolves through it. Every one of them is
+ * immutable once set. See docs/spec/identity.md § DID bindings.
+ */
+const BINDING_FIELDS = new Map([
+    [SYSTEM_TYPES.APP, ['did', 'appId']],
+    [SYSTEM_TYPES.ENTITY, ['did']],
+]);
+/**
+ * The subset that is additionally unique per stack: the fields something
+ * resolves *by*. A Record's `principalId` finds its card by `_app.did` and
+ * its `entityId` by `_entity.did`, so a second card claiming either leaves
+ * that lookup without a single answer — and ambiguity is all an
+ * impersonating card needs.
+ *
+ * `_app.appId` is deliberately absent. Nothing resolves a card by it — the
+ * cross-check reaches the card by `did` and only compares `appId` — so
+ * uniqueness would buy no disambiguation, while forbidding the second card
+ * key rotation is supposed to produce: `appId` is required, so a
+ * replacement card for the same software necessarily repeats it. Moving one
+ * card onto another's `appId` is what immutability already refuses.
+ * See docs/spec/identity.md § DID bindings.
+ */
+const UNIQUE_BINDING_FIELDS = new Map([
+    [SYSTEM_TYPES.APP, ['did']],
+    [SYSTEM_TYPES.ENTITY, ['did']],
+]);
+export const bindingFieldsOf = (family) => BINDING_FIELDS.get(family) ?? [];
+export const uniqueBindingFieldsOf = (family) => UNIQUE_BINDING_FIELDS.get(family) ?? [];
+//# sourceMappingURL=identity-bindings.js.map

package/dist/identity-bindings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-bindings.js","sourceRoot":"","sources":["../src/identity-bindings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1C;;;;GAIG;AACH,MAAM,cAAc,GAAsD,IAAI,GAAG,CAAC;IAChF,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,OAAO,CAAU,CAAC;IAC7C,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,KAAK,CAAU,CAAC;CACxC,CAAC,CAAC;AAEH;;;;;;;;;;;;;;GAcG;AACH,MAAM,qBAAqB,GAAsD,IAAI,GAAG,CAAC;IACvF,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,KAAK,CAAU,CAAC;IACpC,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,KAAK,CAAU,CAAC;CACxC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,MAAc,EAAgC,EAAE,CAC9E,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;AAEnC,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,MAAc,EAAgC,EAAE,CACpF,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC"}