@haverstack/core 0.33.0 → 0.36.0

package/README.md

@@ -66,7 +66,7 @@ await stack.associate(note.id, { kind: 'tag', label: 'favourite' });
 // Or change several things at once — one version, one atomic write
 await stack.mutate(note.id, {
   contentPatch: { title: 'Final title' },
-  permissions: [{ access: 'public' }],
+  permissions: [{ kind: 'anyone', label: 'read' }],
   unlisted: false,
 });
 

package/dist/access.d.ts

@@ -3,10 +3,16 @@
  * -------------------------------------------------------
  * Implements the Permissions model from the spec: a pure predicate over a
  * Record's `permissions` field, with no dependency on a transport layer or
- * storage backend. Used by ScopedStack (see stack.ts) to enforce access
- * control; exported standalone for callers that want the raw predicate.
+ * storage backend. Used by ScopedStack (see scoped-stack.ts) to enforce
+ * access control; exported standalone for callers that want the raw
+ * predicate.
+ *
+ * A permission set is read as data throughout, never as the type: it can
+ * arrive from an import or a foreign server, where no compiler has seen
+ * it. Every tier is affirmative, so an element read past its own kind —
+ * or carrying no kind at all — confers nothing.
  */
-import type { Association, EntityId, Permission, RecordId, StackRecord } from './types.js';
+import type { Association, AuthorityAssociation, DataAssociation, EntityId, RecordId, StackRecord } from './types.js';
 import type { ValidationError } from './validate.js';
 export type AccessMode = 'read' | 'write';
 /** An entity's standing within a `_group` Record's roster. `admin` implies `member` for ACL purposes. */
@@ -17,64 +23,63 @@ export type GroupRole = 'member' | 'admin';
  */
 export type RecordResolver = (id: RecordId) => Promise<StackRecord | null>;
 /**
- * Check whether an entity has read or write access to a Record: absent
- * permissions = owner only; public = anyone reads; entity = direct match;
- * group = walk the _group Record's roster associations. See
- * docs/spec/access-control.md § Record-level permissions.
+ * Whether an entity has read or write access to a Record.
  *
  * The entity here is the **subject** — record-level permissions are written
  * about who data is for, never about the software that carried the request.
  * A delegated app's own authority is a separate question, asked of the
- * principal. See docs/spec/access-control.md § Delegation: principal and
- * subject.
+ * principal. See docs/spec/access-control.md § Record-level permissions and
+ * § Delegation: principal and subject.
  */
 export declare function checkAccess(record: StackRecord, subjectEntityId: EntityId | null, ownerEntityId: EntityId | null, mode: AccessMode, resolveRecord: RecordResolver): Promise<boolean>;
 /**
- * Rejects permission entries that convey write without read — the shape
- * entryConveys() refuses to honor, caught at the point of storage so an
- * owner writing one is told rather than left with a bit that does nothing.
+ * Rejects a permission set where some grantee holds `write` with no `read`
+ * beside it — the shape checkAccess() refuses to honor. A cross-element
+ * invariant, so it is asked of the set the write would *produce*, the same
+ * way hasGroupAdmin() reads its post-state below.
  * See docs/spec/access-control.md § Write implies read.
  */
-export declare function validatePermissions(permissions: Permission[] | undefined, path?: string): ValidationError[];
+export declare function validatePermissions(permissions: AuthorityAssociation[] | undefined, path?: string): ValidationError[];
+/**
+ * Whether a Record is a roster anything may resolve against, on two counts.
+ * The family check: without it an app modelling its own `member` links
+ * would turn every record it points a permission at into an ACL. The
+ * tombstone check: deleting a Group is how a Group is withdrawn. Shared
+ * with the grant path, so the two layers cannot disagree about which Groups
+ * still reach anyone. See docs/spec/identity.md § Group.
+ */
+export declare function carriesRoster(record: StackRecord): boolean;
 /**
- * Determine an entity's role within a `_group` Record's roster from its
- * relationship associations. `admin` short-circuits — it's strictly more
- * privileged than `member`, so a matching admin association wins regardless
- * of association order.
+ * An entity's role within a `_group` Record's roster. `admin`
+ * short-circuits, so a matching admin association wins regardless of order.
  *
- * Reads associations alone and cannot tell whose they are: every caller
- * must first establish that the Record is in the `_group` family, or an
- * app's own `member` relationships become a roster.
+ * Reads associations alone and cannot tell whose they are: callers pass
+ * carriesRoster() first, or an app's own `member` relationships become a
+ * roster.
  */
-export declare function groupRoleFromAssociations(associations: Association[] | undefined, entityId: EntityId): GroupRole | null;
+export declare function groupRoleFromAssociations(associations: DataAssociation[] | undefined, entityId: EntityId): GroupRole | null;
 /**
  * Whether a roster carries at least one `admin` — the invariant every write
  * to a `_group` Record must leave standing. Asked of the roster a write
  * would *produce*, never the one it started from: that is what lets an
  * admin remove themselves while another remains, and refuses the same
  * removal when they are the last, without either case naming who is going.
- *
  * Reads associations alone, on the same terms as
- * groupRoleFromAssociations() above: the caller must have established that
- * the Record is in the `_group` family first. See docs/spec/identity.md
- * § Group.
+ * groupRoleFromAssociations() above.
  */
-export declare function hasGroupAdmin(associations: Association[] | undefined): boolean;
+export declare function hasGroupAdmin(associations: DataAssociation[] | undefined): boolean;
 /**
  * Whether one association is an `admin` roster entry. The `entity` scope is
- * what makes a roster entry a roster entry — a `record` target carrying the
- * same label confers nothing, so it must not count toward the invariant
- * either. See docs/spec/data-model.md § Relationship targets.
+ * what makes it one — a `record` target carrying the same label confers
+ * nothing, so it must not count toward the invariant either.
+ * See docs/spec/data-model.md § Relationship targets.
  */
 export declare function isGroupAdminAssociation(association: Association): boolean;
 /**
  * Whether a request is the stack owner acting alone — the tier behind every
  * unconditional owner authority. Being the owner is never sufficient on its
- * own, whichever side of a delegation the owner is on. Both identities are
- * asked about by value rather than compared to each other, so a caller
- * holding a session and `ScopedStack`, which holds the pair separately, get
- * one answer. See docs/spec/access-control.md § Delegation: principal and
- * subject.
+ * own, whichever side of a delegation the owner is on.
+ * See docs/spec/access-control.md § Delegation: principal and subject.
  */
 export declare function isOwnerActingAlone(session: {
     principalId: EntityId | null;

package/dist/access.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../src/access.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE3F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,OAAO,CAAC;AAE1C,yGAAyG;AACzG,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE3C;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,EAAE,EAAE,QAAQ,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;AAE3E;;;;;;;;;;;GAWG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,WAAW,EACnB,eAAe,EAAE,QAAQ,GAAG,IAAI,EAChC,aAAa,EAAE,QAAQ,GAAG,IAAI,EAC9B,IAAI,EAAE,UAAU,EAChB,aAAa,EAAE,cAAc,GAC5B,OAAO,CAAC,OAAO,CAAC,CAwBlB;AAeD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,UAAU,EAAE,GAAG,SAAS,EACrC,IAAI,SAAgB,GACnB,eAAe,EAAE,CAanB;AAqBD;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACvC,YAAY,EAAE,WAAW,EAAE,GAAG,SAAS,EACvC,QAAQ,EAAE,QAAQ,GACjB,SAAS,GAAG,IAAI,CAalB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,YAAY,EAAE,WAAW,EAAE,GAAG,SAAS,GAAG,OAAO,CAE9E;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAMzE;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE;IAAE,WAAW,EAAE,QAAQ,GAAG,IAAI,CAAC;IAAC,SAAS,EAAE,QAAQ,GAAG,IAAI,CAAA;CAAE,EACrE,aAAa,EAAE,QAAQ,GACtB,OAAO,CAET"}
+{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../src/access.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EACV,WAAW,EACX,oBAAoB,EACpB,eAAe,EACf,QAAQ,EAER,QAAQ,EACR,WAAW,EACZ,MAAM,YAAY,CAAC;AAGpB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,OAAO,CAAC;AAE1C,yGAAyG;AACzG,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE3C;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,EAAE,EAAE,QAAQ,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;AAE3E;;;;;;;;GAQG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,WAAW,EACnB,eAAe,EAAE,QAAQ,GAAG,IAAI,EAChC,aAAa,EAAE,QAAQ,GAAG,IAAI,EAC9B,IAAI,EAAE,UAAU,EAChB,aAAa,EAAE,cAAc,GAC5B,OAAO,CAAC,OAAO,CAAC,CAyBlB;AAyCD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,oBAAoB,EAAE,GAAG,SAAS,EAC/C,IAAI,SAAgB,GACnB,eAAe,EAAE,CAanB;AAaD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAE1D;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CACvC,YAAY,EAAE,eAAe,EAAE,GAAG,SAAS,EAC3C,QAAQ,EAAE,QAAQ,GACjB,SAAS,GAAG,IAAI,CAalB;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,YAAY,EAAE,eAAe,EAAE,GAAG,SAAS,GAAG,OAAO,CAElF;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAMzE;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE;IAAE,WAAW,EAAE,QAAQ,GAAG,IAAI,CAAC;IAAC,SAAS,EAAE,QAAQ,GAAG,IAAI,CAAA;CAAE,EACrE,aAAa,EAAE,QAAQ,GACtB,OAAO,CAET"}

package/dist/access.js

@@ -3,25 +3,28 @@
  * -------------------------------------------------------
  * Implements the Permissions model from the spec: a pure predicate over a
  * Record's `permissions` field, with no dependency on a transport layer or
- * storage backend. Used by ScopedStack (see stack.ts) to enforce access
- * control; exported standalone for callers that want the raw predicate.
+ * storage backend. Used by ScopedStack (see scoped-stack.ts) to enforce
+ * access control; exported standalone for callers that want the raw
+ * predicate.
+ *
+ * A permission set is read as data throughout, never as the type: it can
+ * arrive from an import or a foreign server, where no compiler has seen
+ * it. Every tier is affirmative, so an element read past its own kind —
+ * or carrying no kind at all — confers nothing.
  */
 import { SYSTEM_TYPES } from './types.js';
+import { granteeEqual } from './record-changes.js';
 import { baseIdOf } from './schema.js';
 /**
- * Check whether an entity has read or write access to a Record: absent
- * permissions = owner only; public = anyone reads; entity = direct match;
- * group = walk the _group Record's roster associations. See
- * docs/spec/access-control.md § Record-level permissions.
+ * Whether an entity has read or write access to a Record.
  *
  * The entity here is the **subject** — record-level permissions are written
  * about who data is for, never about the software that carried the request.
  * A delegated app's own authority is a separate question, asked of the
- * principal. See docs/spec/access-control.md § Delegation: principal and
- * subject.
+ * principal. See docs/spec/access-control.md § Record-level permissions and
+ * § Delegation: principal and subject.
  */
 export async function checkAccess(record, subjectEntityId, ownerEntityId, mode, resolveRecord) {
-    // Owner always has full access.
     if (subjectEntityId && subjectEntityId === ownerEntityId)
         return true;
     const perms = record.permissions;
@@ -29,77 +32,106 @@ export async function checkAccess(record, subjectEntityId, ownerEntityId, mode,
     if (!perms || perms.length === 0)
         return false;
     for (const p of perms) {
-        if (p.access === 'public' && mode === 'read')
-            return true;
-        if (p.access === 'entity' && p.entityId === subjectEntityId) {
-            if (entryConveys(p, mode))
-                return true;
-        }
-        if (p.access === 'group' && subjectEntityId) {
-            const role = await resolveGroupRole(p.groupId, subjectEntityId, resolveRecord);
-            const satisfiesRole = p.role === 'admin' ? role === 'admin' : role !== null;
-            if (satisfiesRole && entryConveys(p, mode))
+        if (p?.kind === 'anyone') {
+            if (mode === 'read' && isWorldRead(p))
                 return true;
+            continue;
         }
+        if (p?.kind !== 'permission' || !p.grantee)
+            continue;
+        if (p.label !== mode)
+            continue;
+        // The write bit is inert without read alongside it: the mutate surface
+        // hands back the record it wrote and opens its whole history, so a
+        // write element standing alone would withhold nothing. Refused at the
+        // write by validatePermissions() and again here.
+        // See docs/spec/access-control.md § Write implies read.
+        if (mode === 'write' && !holdsRead(perms, p.grantee))
+            continue;
+        if (await granteeCovers(p.grantee, subjectEntityId, resolveRecord))
+            return true;
     }
     return false;
 }
 /**
- * Whether an entry the requester already matches conveys `mode`. The write
- * bit is inert without read alongside it: the mutate surface hands back the
- * record it wrote and opens its whole history, so a write bit without read
- * would disclose exactly what withholding read asks to withhold. Refused at
- * the write by validatePermissions() and again here, since a `permissions`
- * array can also arrive from an import or a foreign server. See
- * docs/spec/access-control.md § Write implies read.
+ * Whether the set conveys read to this grantee — a `read` of its own, or
+ * an `anyone` that already reaches everyone. Demanding a second, redundant
+ * `read` beside the write would refuse a set that withholds nothing;
+ * revoking the `anyone` is what the invariant catches instead.
+ * See docs/spec/access-control.md § Write implies read.
  */
-function entryConveys(p, mode) {
-    return mode === 'read' ? p.read : p.write && p.read;
+function holdsRead(permissions, grantee) {
+    return permissions.some((p) => p?.kind === 'anyone'
+        ? isWorldRead(p)
+        : p?.kind === 'permission' && p.label === 'read' && granteeEqual(p.grantee, grantee));
 }
 /**
- * Rejects permission entries that convey write without read — the shape
- * entryConveys() refuses to honor, caught at the point of storage so an
- * owner writing one is told rather than left with a bit that does nothing.
+ * Whether an `anyone` element reaches the world. `read` is the only bit it
+ * can carry, so one labelled otherwise names no reach — refused at the
+ * write by validateAssociation() and read as nothing here.
+ */
+function isWorldRead(association) {
+    return association.label === 'read';
+}
+/**
+ * Whether a grantee reaches this subject. `role: 'member'` is the wider
+ * set — an admin satisfies it — and `role: 'admin'` the narrower.
+ */
+async function granteeCovers(grantee, subjectEntityId, resolveRecord) {
+    if (!subjectEntityId)
+        return false;
+    if (grantee.scope === 'entity')
+        return grantee.entityId === subjectEntityId;
+    const role = await resolveGroupRole(grantee.groupId, subjectEntityId, resolveRecord);
+    return grantee.role === 'admin' ? role === 'admin' : role !== null;
+}
+/**
+ * Rejects a permission set where some grantee holds `write` with no `read`
+ * beside it — the shape checkAccess() refuses to honor. A cross-element
+ * invariant, so it is asked of the set the write would *produce*, the same
+ * way hasGroupAdmin() reads its post-state below.
  * See docs/spec/access-control.md § Write implies read.
  */
 export function validatePermissions(permissions, path = 'permissions') {
+    const list = permissions ?? [];
     const errors = [];
-    (permissions ?? []).forEach((p, i) => {
-        if (p.access === 'public')
+    list.forEach((p, i) => {
+        if (p?.kind !== 'permission' || p.label !== 'write')
             return;
-        if (p.write && !p.read) {
-            errors.push({
-                path: `${path}[${i}]`,
-                message: 'write requires read: a write-holder reaches the record and its history through the mutate surface, so `write: true, read: false` withholds nothing',
-            });
-        }
+        if (holdsRead(list, p.grantee))
+            return;
+        errors.push({
+            path: `${path}[${i}]`,
+            message: 'write requires read: a write-holder reaches the record and its history through the mutate surface, so a `write` element with no `read` for the same grantee withholds nothing',
+        });
     });
     return errors;
 }
-/**
- * Resolve a role from the `_group` Record a permission's `groupId` names.
- * Only a real `_group` Record carries a roster: without the family check
- * any Record's relationship associations would serve as one, so an app
- * modelling its own `member` links would silently turn every record it
- * points a permission at into an ACL. The same rule the grant path applies
- * (see resolveGroupRoleMemoized in stack.ts). See
- * docs/spec/access-control.md § Record-level permissions.
- */
+/** Resolve a role from the `_group` Record a permission's `groupId` names. */
 async function resolveGroupRole(groupRecordId, entityId, resolveRecord) {
     const group = await resolveRecord(groupRecordId);
-    if (!group || baseIdOf(group.typeId) !== SYSTEM_TYPES.GROUP)
+    if (!group || !carriesRoster(group))
         return null;
     return groupRoleFromAssociations(group.associations, entityId);
 }
 /**
- * Determine an entity's role within a `_group` Record's roster from its
- * relationship associations. `admin` short-circuits — it's strictly more
- * privileged than `member`, so a matching admin association wins regardless
- * of association order.
+ * Whether a Record is a roster anything may resolve against, on two counts.
+ * The family check: without it an app modelling its own `member` links
+ * would turn every record it points a permission at into an ACL. The
+ * tombstone check: deleting a Group is how a Group is withdrawn. Shared
+ * with the grant path, so the two layers cannot disagree about which Groups
+ * still reach anyone. See docs/spec/identity.md § Group.
+ */
+export function carriesRoster(record) {
+    return baseIdOf(record.typeId) === SYSTEM_TYPES.GROUP && !record.deletedAt;
+}
+/**
+ * An entity's role within a `_group` Record's roster. `admin`
+ * short-circuits, so a matching admin association wins regardless of order.
  *
- * Reads associations alone and cannot tell whose they are: every caller
- * must first establish that the Record is in the `_group` family, or an
- * app's own `member` relationships become a roster.
+ * Reads associations alone and cannot tell whose they are: callers pass
+ * carriesRoster() first, or an app's own `member` relationships become a
+ * roster.
  */
 export function groupRoleFromAssociations(associations, entityId) {
     let role = null;
@@ -121,20 +153,17 @@ export function groupRoleFromAssociations(associations, entityId) {
  * would *produce*, never the one it started from: that is what lets an
  * admin remove themselves while another remains, and refuses the same
  * removal when they are the last, without either case naming who is going.
- *
  * Reads associations alone, on the same terms as
- * groupRoleFromAssociations() above: the caller must have established that
- * the Record is in the `_group` family first. See docs/spec/identity.md
- * § Group.
+ * groupRoleFromAssociations() above.
  */
 export function hasGroupAdmin(associations) {
     return (associations ?? []).some(isGroupAdminAssociation);
 }
 /**
  * Whether one association is an `admin` roster entry. The `entity` scope is
- * what makes a roster entry a roster entry — a `record` target carrying the
- * same label confers nothing, so it must not count toward the invariant
- * either. See docs/spec/data-model.md § Relationship targets.
+ * what makes it one — a `record` target carrying the same label confers
+ * nothing, so it must not count toward the invariant either.
+ * See docs/spec/data-model.md § Relationship targets.
  */
 export function isGroupAdminAssociation(association) {
     return (association.kind === 'relationship' &&
@@ -144,11 +173,8 @@ export function isGroupAdminAssociation(association) {
 /**
  * Whether a request is the stack owner acting alone — the tier behind every
  * unconditional owner authority. Being the owner is never sufficient on its
- * own, whichever side of a delegation the owner is on. Both identities are
- * asked about by value rather than compared to each other, so a caller
- * holding a session and `ScopedStack`, which holds the pair separately, get
- * one answer. See docs/spec/access-control.md § Delegation: principal and
- * subject.
+ * own, whichever side of a delegation the owner is on.
+ * See docs/spec/access-control.md § Delegation: principal and subject.
  */
 export function isOwnerActingAlone(session, ownerEntityId) {
     return session.principalId === ownerEntityId && session.subjectId === ownerEntityId;

package/dist/access.js.map

@@ -1 +1 @@
-{"version":3,"file":"access.js","sourceRoot":"","sources":["../src/access.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1C,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAcvC;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAmB,EACnB,eAAgC,EAChC,aAA8B,EAC9B,IAAgB,EAChB,aAA6B;IAE7B,gCAAgC;IAChC,IAAI,eAAe,IAAI,eAAe,KAAK,aAAa;QAAE,OAAO,IAAI,CAAC;IAEtE,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC;IAEjC,4BAA4B;IAC5B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAE/C,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;QAE1D,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,eAAe,EAAE,CAAC;YAC5D,IAAI,YAAY,CAAC,CAAC,EAAE,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;QACzC,CAAC;QAED,IAAI,CAAC,CAAC,MAAM,KAAK,OAAO,IAAI,eAAe,EAAE,CAAC;YAC5C,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,CAAC,CAAC,OAAO,EAAE,eAAe,EAAE,aAAa,CAAC,CAAC;YAC/E,MAAM,aAAa,GAAG,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC;YAC5E,IAAI,aAAa,IAAI,YAAY,CAAC,CAAC,EAAE,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,YAAY,CAAC,CAAoC,EAAE,IAAgB;IAC1E,OAAO,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC;AACtD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,WAAqC,EACrC,IAAI,GAAG,aAAa;IAEpB,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACnC,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO;QAClC,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG;gBACrB,OAAO,EACL,oJAAoJ;aACvJ,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,gBAAgB,CAC7B,aAAuB,EACvB,QAAkB,EAClB,aAA6B;IAE7B,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,aAAa,CAAC,CAAC;IACjD,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,YAAY,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACzE,OAAO,yBAAyB,CAAC,KAAK,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,yBAAyB,CACvC,YAAuC,EACvC,QAAkB;IAElB,IAAI,IAAI,GAAqB,IAAI,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,YAAY,IAAI,EAAE,EAAE,CAAC;QACnC,IACE,CAAC,CAAC,IAAI,KAAK,cAAc;YACzB,CAAC,CAAC,MAAM,CAAC,KAAK,KAAK,QAAQ;YAC3B,CAAC,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAC9B,CAAC;YACD,IAAI,CAAC,CAAC,KAAK,KAAK,OAAO;gBAAE,OAAO,OAAO,CAAC;YACxC,IAAI,CAAC,CAAC,KAAK,KAAK,QAAQ;gBAAE,IAAI,GAAG,QAAQ,CAAC;QAC5C,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAAC,YAAuC;IACnE,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,WAAwB;IAC9D,OAAO,CACL,WAAW,CAAC,IAAI,KAAK,cAAc;QACnC,WAAW,CAAC,KAAK,KAAK,OAAO;QAC7B,WAAW,CAAC,MAAM,CAAC,KAAK,KAAK,QAAQ,CACtC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAqE,EACrE,aAAuB;IAEvB,OAAO,OAAO,CAAC,WAAW,KAAK,aAAa,IAAI,OAAO,CAAC,SAAS,KAAK,aAAa,CAAC;AACtF,CAAC"}
+{"version":3,"file":"access.js","sourceRoot":"","sources":["../src/access.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAU1C,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAcvC;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAmB,EACnB,eAAgC,EAChC,aAA8B,EAC9B,IAAgB,EAChB,aAA6B;IAE7B,IAAI,eAAe,IAAI,eAAe,KAAK,aAAa;QAAE,OAAO,IAAI,CAAC;IAEtE,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC;IAEjC,4BAA4B;IAC5B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAE/C,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;YACzB,IAAI,IAAI,KAAK,MAAM,IAAI,WAAW,CAAC,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;YACnD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,EAAE,IAAI,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,OAAO;YAAE,SAAS;QACrD,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI;YAAE,SAAS;QAC/B,uEAAuE;QACvE,mEAAmE;QACnE,sEAAsE;QACtE,iDAAiD;QACjD,wDAAwD;QACxD,IAAI,IAAI,KAAK,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC;YAAE,SAAS;QAC/D,IAAI,MAAM,aAAa,CAAC,CAAC,CAAC,OAAO,EAAE,eAAe,EAAE,aAAa,CAAC;YAAE,OAAO,IAAI,CAAC;IAClF,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,SAAS,SAAS,CAAC,WAAmC,EAAE,OAA0B;IAChF,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAC5B,CAAC,EAAE,IAAI,KAAK,QAAQ;QAClB,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC,EAAE,IAAI,KAAK,YAAY,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,IAAI,YAAY,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CACvF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,WAAiC;IACpD,OAAO,WAAW,CAAC,KAAK,KAAK,MAAM,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,aAAa,CAC1B,OAA0B,EAC1B,eAAgC,EAChC,aAA6B;IAE7B,IAAI,CAAC,eAAe;QAAE,OAAO,KAAK,CAAC;IACnC,IAAI,OAAO,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC,QAAQ,KAAK,eAAe,CAAC;IAC5E,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,OAAO,EAAE,eAAe,EAAE,aAAa,CAAC,CAAC;IACrF,OAAO,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC;AACrE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,WAA+C,EAC/C,IAAI,GAAG,aAAa;IAEpB,MAAM,IAAI,GAAG,WAAW,IAAI,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACpB,IAAI,CAAC,EAAE,IAAI,KAAK,YAAY,IAAI,CAAC,CAAC,KAAK,KAAK,OAAO;YAAE,OAAO;QAC5D,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC;YAAE,OAAO;QACvC,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG;YACrB,OAAO,EACL,+KAA+K;SAClL,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,KAAK,UAAU,gBAAgB,CAC7B,aAAuB,EACvB,QAAkB,EAClB,aAA6B;IAE7B,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,aAAa,CAAC,CAAC;IACjD,IAAI,CAAC,KAAK,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,OAAO,yBAAyB,CAAC,KAAK,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,MAAmB;IAC/C,OAAO,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,YAAY,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;AAC7E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CACvC,YAA2C,EAC3C,QAAkB;IAElB,IAAI,IAAI,GAAqB,IAAI,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,YAAY,IAAI,EAAE,EAAE,CAAC;QACnC,IACE,CAAC,CAAC,IAAI,KAAK,cAAc;YACzB,CAAC,CAAC,MAAM,CAAC,KAAK,KAAK,QAAQ;YAC3B,CAAC,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAC9B,CAAC;YACD,IAAI,CAAC,CAAC,KAAK,KAAK,OAAO;gBAAE,OAAO,OAAO,CAAC;YACxC,IAAI,CAAC,CAAC,KAAK,KAAK,QAAQ;gBAAE,IAAI,GAAG,QAAQ,CAAC;QAC5C,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,YAA2C;IACvE,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,WAAwB;IAC9D,OAAO,CACL,WAAW,CAAC,IAAI,KAAK,cAAc;QACnC,WAAW,CAAC,KAAK,KAAK,OAAO;QAC7B,WAAW,CAAC,MAAM,CAAC,KAAK,KAAK,QAAQ,CACtC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAqE,EACrE,aAAuB;IAEvB,OAAO,OAAO,CAAC,WAAW,KAAK,aAAa,IAAI,OAAO,CAAC,SAAS,KAAK,aAAa,CAAC;AACtF,CAAC"}

package/dist/changes.d.ts

@@ -13,7 +13,7 @@
  * property of one function here, not a convention every emission site has
  * to remember. See docs/spec/events.md.
  */
-import type { Association, ChangeActor, JournalEntryInput, ChangeFilter, ChangeKind, ChangeOp, RecordChange, StackRecord, SubscribeOptions, Unsubscribe } from './types.js';
+import type { AssociationChange, ChangeActor, JournalEntryInput, ChangeFilter, ChangeKind, ChangeOp, RecordChange, StackRecord, SubscribeOptions, Unsubscribe } from './types.js';
 /**
  * What the emitter knows: the envelope, plus the record it describes.
  * `record` is the filtering input and is never delivered unprojected —
@@ -46,15 +46,10 @@ export type EmittedChange = {
 export declare function matchesFilter(emitted: EmittedChange, filter?: ChangeFilter): boolean;
 /**
  * Whether an emission passes the unlisted-enumeration boundary for one
- * subscription. Unlisted records are excluded from the feed by default,
- * exactly as they are from an unfiltered `query()` — with one exception:
- * the `unlist` transition itself must still reach a subscriber lacking
- * `includeUnlisted`, despite its post-change record (`unlistedAt` now set)
- * otherwise failing this very check. Without that exception a subscriber
- * who already knows the record would never be told to drop it. Every other
- * transition (create-unlisted, an edit while already unlisted, a purge of
- * a record that was never listed, the `list` transition itself) needs no
- * special-casing: it falls out of checking the record's current state.
+ * subscription. The `unlist` transition is the one exception to the
+ * default exclusion: without it a subscriber who already knows the record
+ * would never be told to drop it. Every other transition falls out of
+ * checking the record's current state.
  * See docs/spec/events.md § The unlisted transition.
  */
 export declare function passesUnlistedBoundary(emitted: EmittedChange, includeUnlisted?: boolean): boolean;
@@ -67,9 +62,7 @@ export declare function passesUnlistedBoundary(emitted: EmittedChange, includeUn
  * nothing.
  *
  * The record rides by reference, shared across every frame projected from
- * one emission: handlers are contractually read-only over it, and copying
- * per subscriber would charge every consumer for a defect none of them
- * have. See docs/spec/events.md § The event shape.
+ * one emission: handlers are contractually read-only over it.
  */
 export declare function emitted(emission: EmittedChange, includeRecords: boolean): RecordChange;
 /**
@@ -87,12 +80,7 @@ export declare abstract class Subscription {
     abstract accept(emission: EmittedChange): void;
     get isClosed(): boolean;
     close(): void;
-    /**
-     * Hand a frame to the handler. A handler that throws cannot fail the
-     * write it is being told about — the write is already durable — so the
-     * error goes to onError, or is rethrown asynchronously so that it
-     * surfaces as an unhandled error rather than vanishing.
-     */
+    /** Hand a frame to the handler; anything it throws goes to reportError(). */
     protected deliver(emission: EmittedChange): void;
     protected reportError(err: unknown): void;
 }
@@ -117,42 +105,70 @@ export declare class RelayDelivery {
     close(): void;
 }
 /**
- * Assemble what the emitter knows about one mutation.
+ * One change, held between the two halves it is written in.
  *
- * The actor is read off the record for every version-bumping op, because
- * `updatedBy`/`updatedVia` were stamped by that same write and so agree
- * with what was persisted by construction. `associate`/`dissociate` don't
- * bump, so they stamp nothing on the record either — their actor travels
- * as `opts.actor` instead, the same way hard delete's does, since reading
- * the record would report whoever's *last version-bumping write* this is,
- * not who just changed the association. Hard delete stamps nothing and
- * leaves nothing to read, so its actor is the requester, passed in. A
- * purge also drops `parentId` and the create-time `appId`: the frame says
- * that a record of some type was destroyed, and nothing further about
- * whose it was. See docs/spec/events.md § Purged records carry nothing.
+ * A change lands twice: the durable half travels into the adapter's
+ * transaction ahead of the write, and the live half is built from the
+ * record that write produced. Naming the change once — its ops, its kind,
+ * its actor, what it moved — is what makes "the entry set is the event
+ * set" true by construction rather than by convention. No verb can journal
+ * one thing and announce another, and a verb that writes only one half has
+ * to say so where it does it. See docs/spec/journal.md § The entry set is
+ * the event set.
  */
-export declare function buildEmission(ops: ChangeOp | ChangeOp[], record: StackRecord, opts?: {
-    actor?: ChangeActor;
-    at?: Date;
-    previousParentId?: string | null;
-    associationsAdded?: Association[];
-    associationsRemoved?: Association[];
-}): EmittedChange;
-/**
- * The durable half of a change, built before the write that it describes
- * — where an emission is built after one. The two carry the same facts
- * about what moved and who moved it; they differ in what they can read
- * off the record, which at this point has not been written yet. So the
- * adapter stamps the record-derived fields and this names the rest.
- * See docs/spec/versioning.md § The change journal.
- */
-export declare function buildJournalEntry(ops: ChangeOp | ChangeOp[], opts?: {
-    actor?: ChangeActor;
-    previousParentId?: string | null;
-    associationsAdded?: Association[];
-    associationsRemoved?: Association[];
-    associationsReplaced?: Association[];
-}): JournalEntryInput;
+export declare class PendingChange {
+    private readonly moved;
+    readonly ops: ChangeOp[];
+    readonly kind: ChangeKind;
+    constructor(ops: ChangeOp | ChangeOp[], moved?: {
+        /**
+         * The requester behind a write that stamps nothing on the record
+         * itself. A version-bumping write stamps `updatedBy`/`updatedVia`,
+         * so its emission reads them back instead — see emission() below.
+         */
+        actor?: ChangeActor;
+        previousParentId?: string | null;
+        /**
+         * What the write moved, association by association. One list for
+         * both halves: the journal takes it as it stands and the feed is
+         * flattened out of it, so neither can report an edit the other
+         * doesn't.
+         */
+        associations?: AssociationChange[];
+    });
+    /**
+     * The durable half, handed to the adapter as `journal` so that it lands
+     * in the same write as the mutation it describes.
+     *
+     * Absent for a purge, which destroys the log an entry would be appended
+     * to. The rule lives here rather than at each call site that would
+     * otherwise have to remember it. See docs/spec/journal.md § A hard
+     * delete destroys the journal.
+     */
+    get journal(): JournalEntryInput | undefined;
+    /**
+     * The live half, built from the record the write produced — for a purge,
+     * from the record as it stood immediately before destruction.
+     *
+     * The actor is read off the record for every version-bumping op, so it
+     * agrees with what was persisted by construction. A no-bump op stamps
+     * nothing, so the requester travels here instead — reading the record
+     * would report whoever's last version-bumping write this is. A purged
+     * frame drops `parentId` and the create-time `appId` too: it says a
+     * record of some type was destroyed and nothing about whose it was.
+     */
+    emission(record: StackRecord, at?: Date): EmittedChange;
+    /**
+     * The frame's two flat lists, flattened out of the one the journal
+     * takes. Present only where non-empty.
+     *
+     * The data half alone: the `permissions` op is what announces an ACL
+     * move, so a subscriber watching tags is never handed the sharing graph
+     * as a side effect of the partition sharing one delta.
+     * See docs/spec/events.md § The event shape.
+     */
+    private associationDeltas;
+}
 /**
  * The subscriber registry. One per `Stack`; `ScopedStack` filters the same
  * stream rather than opening its own, so a scoped view can never observe a
@@ -166,6 +182,7 @@ export declare class ChangeEmitter {
     /** Ends every subscription — a closed stack emits nothing further. */
     closeAll(): void;
 }
+/** The kind each op produces. See docs/spec/events.md § The event shape. */
 export declare const CHANGE_KINDS: Record<ChangeOp, ChangeKind>;
 /**
  * `since` only means something where a relay exists: a stack with no
@@ -174,11 +191,10 @@ export declare const CHANGE_KINDS: Record<ChangeOp, ChangeKind>;
  * caller believe it resumed when it did not, so a stack that cannot honor
  * `since` refuses it rather than ignoring it.
  *
- * Its shape is checked here rather than left to the adapter, so that a
- * malformed cursor is the same error whoever is underneath — the posture
- * query() already takes with a filter no adapter declared. The value stays
- * opaque: this asks whether it is framable, never what it means. See
- * docs/spec/events.md § Subscribing.
+ * Its shape is checked here rather than left to the adapter, so a malformed
+ * cursor is the same error whoever is underneath. The value stays opaque:
+ * this asks whether it is framable, never what it means.
+ * See docs/spec/events.md § Subscribing.
  */
 export declare function assertSinceUsable(since: string | undefined, relaysChanges: boolean): void;
 //# sourceMappingURL=changes.d.ts.map

package/dist/changes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"changes.d.ts","sourceRoot":"","sources":["../src/changes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EACV,WAAW,EACX,WAAW,EACX,iBAAiB,EACjB,YAAY,EACZ,UAAU,EACV,QAAQ,EACR,YAAY,EACZ,WAAW,EACX,gBAAgB,EAChB,WAAW,EACZ,MAAM,YAAY,CAAC;AAIpB;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IACrC;;;;OAIG;IACH,MAAM,EAAE,WAAW,CAAC;IACpB;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC,CAAC;AAKF;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,YAAY,GAAG,OAAO,CA0BpF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,aAAa,EAAE,eAAe,CAAC,EAAE,OAAO,GAAG,OAAO,CAIjG;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,OAAO,CAAC,QAAQ,EAAE,aAAa,EAAE,cAAc,EAAE,OAAO,GAAG,YAAY,CAItF;AAED;;;;;GAKG;AACH,8BAAsB,YAAY;IAI9B,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,IAAI;IAC1D,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,gBAAgB;IAJ3C,OAAO,CAAC,MAAM,CAAS;gBAGF,OAAO,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,IAAI,EACvC,IAAI,EAAE,gBAAgB;IAG3C,+DAA+D;IAC/D,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,aAAa,GAAG,IAAI;IAE9C,IAAI,QAAQ,IAAI,OAAO,CAEtB;IAED,KAAK,IAAI,IAAI;IAIb;;;;;OAKG;IACH,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,aAAa,GAAG,IAAI;IAShD,SAAS,CAAC,WAAW,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI;CAG1C;AAuBD;;;;;;;;;;;GAWG;AACH,qBAAa,aAAa;IAItB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAJvB,OAAO,CAAC,MAAM,CAAS;gBAGJ,OAAO,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,IAAI,EACvC,IAAI,EAAE,gBAAgB;IAGzC,OAAO,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI;IASnC,KAAK,IAAI,IAAI;CAGd;AAcD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,CAC3B,GAAG,EAAE,QAAQ,GAAG,QAAQ,EAAE,EAC1B,MAAM,EAAE,WAAW,EACnB,IAAI,GAAE;IACJ,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,EAAE,CAAC,EAAE,IAAI,CAAC;IACV,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,iBAAiB,CAAC,EAAE,WAAW,EAAE,CAAC;IAClC,mBAAmB,CAAC,EAAE,WAAW,EAAE,CAAC;CAChC,GACL,aAAa,CA0Cf;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,QAAQ,GAAG,QAAQ,EAAE,EAC1B,IAAI,GAAE;IACJ,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,iBAAiB,CAAC,EAAE,WAAW,EAAE,CAAC;IAClC,mBAAmB,CAAC,EAAE,WAAW,EAAE,CAAC;IACpC,oBAAoB,CAAC,EAAE,WAAW,EAAE,CAAC;CACjC,GACL,iBAAiB,CAcnB;AAiBD;;;;GAIG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA2B;IAEzD,IAAI,CAAC,QAAQ,EAAE,aAAa,GAAG,IAAI;IAQnC,GAAG,CAAC,YAAY,EAAE,YAAY,GAAG,WAAW;IAQ5C,SAAS,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,IAAI,EAAE,IAAI,EAAE,gBAAgB,GAAG,WAAW;IAIvF,sEAAsE;IACtE,QAAQ,IAAI,IAAI;CAIjB;AAmBD,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,QAAQ,EAAE,UAAU,CAcrD,CAAC;AAUF;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,aAAa,EAAE,OAAO,GAAG,IAAI,CAgBzF"}
+{"version":3,"file":"changes.d.ts","sourceRoot":"","sources":["../src/changes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EACV,iBAAiB,EACjB,WAAW,EACX,iBAAiB,EACjB,YAAY,EACZ,UAAU,EACV,QAAQ,EACR,YAAY,EACZ,WAAW,EACX,gBAAgB,EAChB,WAAW,EACZ,MAAM,YAAY,CAAC;AAIpB;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IACrC;;;;OAIG;IACH,MAAM,EAAE,WAAW,CAAC;IACpB;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC,CAAC;AAKF;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,YAAY,GAAG,OAAO,CA0BpF;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,aAAa,EAAE,eAAe,CAAC,EAAE,OAAO,GAAG,OAAO,CAIjG;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,OAAO,CAAC,QAAQ,EAAE,aAAa,EAAE,cAAc,EAAE,OAAO,GAAG,YAAY,CAItF;AAED;;;;;GAKG;AACH,8BAAsB,YAAY;IAI9B,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,IAAI;IAC1D,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,gBAAgB;IAJ3C,OAAO,CAAC,MAAM,CAAS;gBAGF,OAAO,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,IAAI,EACvC,IAAI,EAAE,gBAAgB;IAG3C,+DAA+D;IAC/D,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,aAAa,GAAG,IAAI;IAE9C,IAAI,QAAQ,IAAI,OAAO,CAEtB;IAED,KAAK,IAAI,IAAI;IAIb,6EAA6E;IAC7E,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,aAAa,GAAG,IAAI;IAShD,SAAS,CAAC,WAAW,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI;CAG1C;AAuBD;;;;;;;;;;;GAWG;AACH,qBAAa,aAAa;IAItB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAJvB,OAAO,CAAC,MAAM,CAAS;gBAGJ,OAAO,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,IAAI,EACvC,IAAI,EAAE,gBAAgB;IAGzC,OAAO,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI;IASnC,KAAK,IAAI,IAAI;CAGd;AAcD;;;;;;;;;;;GAWG;AACH,qBAAa,aAAa;IAMtB,OAAO,CAAC,QAAQ,CAAC,KAAK;IALxB,QAAQ,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;gBAGxB,GAAG,EAAE,QAAQ,GAAG,QAAQ,EAAE,EACT,KAAK,GAAE;QACtB;;;;WAIG;QACH,KAAK,CAAC,EAAE,WAAW,CAAC;QACpB,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC;;;;;WAKG;QACH,YAAY,CAAC,EAAE,iBAAiB,EAAE,CAAC;KAC/B;IAUR;;;;;;;;OAQG;IACH,IAAI,OAAO,IAAI,iBAAiB,GAAG,SAAS,CAU3C;IAED;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,CAAC,EAAE,IAAI,GAAG,aAAa;IAoCvD;;;;;;;;OAQG;IACH,OAAO,CAAC,iBAAiB;CAS1B;AAiBD;;;;GAIG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA2B;IAEzD,IAAI,CAAC,QAAQ,EAAE,aAAa,GAAG,IAAI;IAQnC,GAAG,CAAC,YAAY,EAAE,YAAY,GAAG,WAAW;IAQ5C,SAAS,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,IAAI,EAAE,IAAI,EAAE,gBAAgB,GAAG,WAAW;IAIvF,sEAAsE;IACtE,QAAQ,IAAI,IAAI;CAIjB;AAgBD,4EAA4E;AAC5E,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,QAAQ,EAAE,UAAU,CAcrD,CAAC;AAUF;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,aAAa,EAAE,OAAO,GAAG,IAAI,CAgBzF"}