@haverstack/core 0.34.0 → 0.36.0

package/dist/scoped-stack.d.ts

@@ -18,7 +18,7 @@
  * See docs/spec/access-control.md and docs/spec/events.md § Permission scoping.
  */
 import { ChangeEmitter } from './changes.js';
-import type { AppId, Association, AttachmentContent, EntityId, QueryResult, RecordChange, RecordVersion, RecordJournalEntry, JournalQuery, StackAdapter, StackFeatures, StackQuery, StackRecord, SubscribeOptions, TypeId, Unsubscribe, RecordChanges } from './types.js';
+import type { AppId, AttachmentContent, AuthorityAssociation, DataAssociation, EntityId, QueryResult, RecordChange, RecordVersion, RecordJournalEntry, JournalQuery, StackAdapter, StackFeatures, StackQuery, StackRecord, SubscribeOptions, TypeId, Unsubscribe, RecordChanges } from './types.js';
 import type { Stack, BackdatableCreateRecordOptions, CollectAttachmentGarbageOptions, CollectAttachmentGarbageResult, DeleteRecordOptions, DeleteResult, GetRecordOptions, IfVersionOptions, StackClient } from './stack.js';
 /**
  * A permission-enforcing view of a Stack for a single (principal, subject)
@@ -26,21 +26,16 @@ import type { Stack, BackdatableCreateRecordOptions, CollectAttachmentGarbageOpt
  * cannot read answers exactly as a missing one does — null on reads,
  * StackNotFoundError on the verbs that name one — so only a requester who
  * could have read it is told a refusal was about access.
- * See docs/spec/access-control.md § Errors and information exposure.
+ * See docs/spec/disclosure.md § Which refusal a Record answers with.
  *
- * Two identities, one rule: **the principal governs authority, the subject
- * governs attribution.** Grant lookup and the privilege-bearing gates that
- * no grant reaches (resharing, group management, hard delete, widening
- * access at create time) key on `principalEntityId`; authorship, `-own`
- * matching, record-level permission resolution, and "files I uploaded"
- * lookups key on `subjectEntityId`.
- *
- * Unconditional owner access follows that same split rather than one
- * identity: it answers *what data is reachable* for the subject (an owner
- * subject resolves past every permission check) and *who may exercise a
- * privileged verb* for the principal (an owner app is not bounded by
- * grants). Under delegation both halves apply, and a mistake on the
- * authority side is an escalation rather than a preference.
+ * Which identity each gate keys on follows the module comment's rule.
+ * Grant lookup and the privilege-bearing gates no grant reaches
+ * (resharing, group management, hard delete, widening access at create
+ * time) key on `principalEntityId`; authorship, `-own` matching,
+ * record-level permission resolution and "files I uploaded" lookups key on
+ * `subjectEntityId`. Unconditional owner access splits the same way: an
+ * owner subject resolves past every permission check, an owner principal
+ * is not bounded by grants, and under delegation both halves apply.
  */
 export declare class ScopedStack implements StackClient {
     private readonly stack;
@@ -56,6 +51,14 @@ export declare class ScopedStack implements StackClient {
     private loadGrants;
     /** Whether a delegated app is acting for someone other than itself. */
     private get delegated();
+    /**
+     * Whether any grant could name this request — the one question every
+     * prefetch asks before scanning the `_grant` family, since an anonymous
+     * requester is reached by none. Both identities are read: `asEntity()`
+     * refuses an anonymous principal acting for a subject, so they are null
+     * together, and saying so costs nothing.
+     */
+    private get identified();
     /**
      * Who this request is, for stamping onto whatever it mutates. Attribution
      * follows record-level authorship: the subject is the actor, and the
@@ -72,11 +75,7 @@ export declare class ScopedStack implements StackClient {
      * docs/spec/access-control.md § Delegation: principal and subject.
      */
     private get ownerActingAlone();
-    /**
-     * Refuse anything but the owner acting as itself. The verbs resting on
-     * this tier are irreversible or disclose the sharing graph, so delegation
-     * never carries one to a subject — see ownerActingAlone.
-     */
+    /** Refuse anything but the owner acting as itself — see ownerActingAlone. */
     private requireOwnerActingAlone;
     private checkRead;
     private checkWrite;
@@ -85,13 +84,12 @@ export declare class ScopedStack implements StackClient {
      * type's family (grants match by baseId, so a version bump never orphans
      * one). -own actions additionally require record.entityId === grantee,
      * unless `matchOwn` is false — on the principal side of a delegated
-     * request the suffix is read as the bare verb, since which records are
+     * request the suffix reads as the bare verb, since which records are
      * reachable is the subject's business. `allowDefault` decides whether a
-     * grant naming nobody counts. Anonymous grantees always return false.
+     * grant naming nobody counts.
      *
      * Reached only through subjectAllows()/principalAllows(), which fix those
-     * two flags per side of the intersection. Call one of those instead.
-     * See docs/spec/access-control.md § Type-level grants.
+     * two flags per side. Call one of those instead.
      */
     private hasGrant;
     /**
@@ -102,15 +100,11 @@ export declare class ScopedStack implements StackClient {
      * Vacuously true when there's no delegation, where the principal and
      * subject checks would be the same question asked twice.
      *
-     * Default grants don't count here. "Any authenticated entity" is about
-     * people who turn up, not software the owner installed — an app reaches
-     * only the types named to it, which is the whole of what containment
-     * promises.
-     *
-     * Group-targeted grants don't count here either, one step removed: a
-     * roster is editable by any of the group's admins, so authority reaching
-     * a principal through one would let someone other than the owner name an
-     * app to a type. See docs/spec/access-control.md § Type-level grants.
+     * Neither default nor group-targeted grants count here. "Any
+     * authenticated entity" is about people who turn up, not software the
+     * owner installed; and a roster is editable by any of the group's admins,
+     * so authority reaching a principal through one would let someone other
+     * than the owner name an app to a type.
      */
     private principalAllows;
     /**
@@ -129,7 +123,7 @@ export declare class ScopedStack implements StackClient {
      * everyone else is told what a missing ID is told, so no one learns an ID
      * is live who could not have learned it by reading. `message` therefore
      * only ever reaches someone holding the record already.
-     * See docs/spec/access-control.md § Errors and information exposure.
+     * See docs/spec/disclosure.md § Which refusal a Record answers with.
      */
     private denialFor;
     private canRead;
@@ -176,26 +170,19 @@ export declare class ScopedStack implements StackClient {
      * relationship target). Missing and unreadable both return false —
      * indistinguishable, so this can't probe for a record's existence.
      *
-     * The owner acting alone passes without the lookup, which costs nothing:
-     * there is no record in their own stack they may not read, so the gate
-     * could only ever refuse them for absence — and absence is `Stack`'s to
-     * answer, with the conflict that names the problem rather than a
-     * refusal standing in for it. The anti-oracle property is unchanged for
-     * every other requester.
-     * See docs/spec/access-control.md § Reference-creation gating.
+     * The owner acting alone passes without the lookup: there is no record in
+     * their own stack they may not read, so the gate could only refuse them
+     * for absence — which is `Stack`'s to answer, with a conflict that names
+     * the problem. See docs/spec/access-control.md § Reference-creation gating.
      */
     private canReadReferent;
     /**
      * Whether this request can read some record referencing `fileId` —
      * shared by canAccessFile() and the non-owner _attachment@1 create()
-     * carve-out, which deliberately excludes the uploader clause. Walks
-     * every referencing record, short-circuiting on the first readable one.
-     * `_attachment@1` records are excluded from matching outright: the
-     * carve-out must be satisfied by some *other* record referencing the
-     * file, never by the requester's own prior metadata record for it —
-     * allowing that would let one successful guess unlock unlimited further
-     * metadata records for the same fileId, reintroducing the circularity
-     * the carve-out's uploader-clause exclusion closes.
+     * carve-out, which deliberately excludes the uploader clause.
+     * `_attachment@1` records never match: the carve-out has to be satisfied
+     * by some *other* record referencing the file, or one successful guess
+     * would unlock unlimited further metadata records for the same fileId.
      * See docs/spec/attachments.md § Creating `_attachment@1` records directly.
      */
     private hasReadableReference;
@@ -236,8 +223,9 @@ export declare class ScopedStack implements StackClient {
      * creation refused save one carve-out. A scoped create always stamps
      * authorship — an absent entityId means an unscoped `Stack` wrote it.
      * `createdAt`/`updatedAt` are refused to everyone but the owner acting
-     * alone — see the guard below and docs/spec/data-model.md § Record IDs.
-     * See also docs/spec/access-control.md and docs/spec/attachments.md.
+     * alone, rather than dropped, so an app never believes it published
+     * something it didn't. See docs/spec/access-control.md and
+     * docs/spec/data-model.md § Record IDs.
      */
     create<T extends Record<string, unknown> = Record<string, unknown>>(typeId: TypeId, content: T, opts?: BackdatableCreateRecordOptions): Promise<StackRecord & {
         content: T;
@@ -265,7 +253,7 @@ export declare class ScopedStack implements StackClient {
      * A record this request may read, or null. Never throws
      * StackPermissionError: an unreadable record answers exactly as a missing
      * one does, so a caller learns only what it may read.
-     * See docs/spec/access-control.md § Errors and information exposure.
+     * See docs/spec/disclosure.md § Which refusal a Record answers with.
      */
     get(id: string, opts?: GetRecordOptions): Promise<StackRecord | null>;
     /**
@@ -303,38 +291,50 @@ export declare class ScopedStack implements StackClient {
      * deliberately does not confer.
      */
     private requireReshareable;
+    /**
+     * Whether a change set's `permissions` key actually moves the ACL. Read
+     * off the computed delta rather than the elements the caller supplied:
+     * a gate that inspected only what was named would miss the wholesale
+     * replacement that drops everything, which names nothing at all. Any
+     * add, remove or repoint in either direction is a reshare.
+     * See docs/spec/access-control.md § Record-level permissions.
+     */
+    private permissionsMove;
     /** The reshare decision alone, for a record already read and write-gated. */
     private requireReshareOf;
+    /**
+     * Whether this request may decide who else reaches `record` — the
+     * decision requireReshareOf() refuses on, without the refusal, for the
+     * read paths that project on it rather than throw.
+     *
+     * A `_group` asks management, not authorship: a creator later demoted
+     * from the admin roster shouldn't retain a side door to reassign who can
+     * read or write the group record. Everything else is intersected like
+     * every other authority here, or an owner principal would carry its
+     * subject to records the subject cannot touch.
+     */
+    private canReshare;
     /**
      * Naming the software behind a key is the trust decision the `_app`
      * registry exists to record, so both halves of that binding — `did` and
-     * `appId` — belong to the owner alone. Same reasoning that makes `_app`
-     * ungrantable, applied to the fields a lookup reads. Registering a card
-     * is already owner-only; without this, record-level `write` shared on a
-     * card would be a second way in: a card carrying no DID yet could be
-     * pointed at a write-holder's own key while keeping the name the owner
-     * gave it, or relabelled to claim another app's `appId`. `name` and
-     * `version` stay writable — they are display, not lookup.
+     * `appId` — belong to the owner alone. Without this, record-level `write`
+     * on a card would be a second way in: one carrying no DID yet could be
+     * pointed at a write-holder's own key, or relabelled to claim another
+     * app's `appId`. `name` and `version` stay writable — display, not lookup.
      *
-     * Owner *acting alone*, in both directions: a delegated app never holds
-     * it, and an owner principal doesn't lend it to a subject holding
-     * record-level `write` on a card — which would reopen the same route
-     * from the other side.
-     *
-     * `_entity` deliberately does not get this rule: naming people is what a
-     * contacts app does, so its cards stay writable by grant. Uniqueness and
-     * immutability still bind them. See docs/spec/identity.md § DID bindings.
+     * Owner *acting alone*, in both directions, or the same route reopens
+     * from the subject's side. `_entity` deliberately does not get this rule:
+     * naming people is what a contacts app does, so its cards stay writable
+     * by grant. See docs/spec/identity.md § DID bindings.
      */
     private requireOwnerForAppIdentity;
     /**
      * A self-reported `appId` must agree with the `_app` card naming the
-     * principal's DID, where the owner registered one. `principalId` is
+     * principal's DID, where the owner registered one: `principalId` is
      * verified, so letting the pair disagree would leave a verified principal
-     * claiming a name the owner gave different software — the cross-check the
-     * registry exists for, refused at the write instead of left to each reader.
-     * A principal with no card keeps `appId` as the bare self-report it is for
-     * every undelegated writer.
-     * See docs/spec/identity.md § Attribution and what can be trusted.
+     * claiming a name the owner gave different software. A principal with no
+     * card keeps `appId` as the bare self-report it is for every undelegated
+     * writer. See docs/spec/identity.md § Attribution and what can be trusted.
      */
     private requireAppIdMatchesPrincipal;
     /**
@@ -355,8 +355,26 @@ export declare class ScopedStack implements StackClient {
      * See docs/spec/access-control.md § Type-level grants.
      */
     private requireOwnerForGrantRecord;
-    associate(id: string, association: Association): Promise<StackRecord>;
-    dissociate(id: string, association: Association): Promise<StackRecord>;
+    /**
+     * Gated on the write bit alone, which is why the kind refusal comes
+     * first: authority reached through this verb would be exactly the
+     * escalation the partition exists to stop, decided before any record is
+     * read so it cannot depend on who is asking.
+     */
+    associate(id: string, association: DataAssociation): Promise<StackRecord>;
+    /** See associate() — the same write gate, the same kind refusal. */
+    dissociate(id: string, association: DataAssociation): Promise<StackRecord>;
+    /**
+     * Extend who reaches a record — the reshare gate's own verb, on the
+     * owner-or-creator rule the `permissions` key carries. The write bit
+     * does not confer it: a write-holder who could grant would escalate to
+     * deciding who else reaches the record, which is the whole of what
+     * scoping access is for.
+     * See docs/spec/access-control.md § Record-level permissions.
+     */
+    grantAccess(id: string, permission: AuthorityAssociation): Promise<StackRecord>;
+    /** Withdraw one element of who reaches a record — see grantAccess(). */
+    revokeAccess(id: string, permission: AuthorityAssociation): Promise<StackRecord>;
     /**
      * Hard delete is owner-only: it is irreversible and destroys version
      * history, so neither the write bit nor delete-own/delete-any grants
@@ -372,61 +390,45 @@ export declare class ScopedStack implements StackClient {
     undelete(id: string, opts?: IfVersionOptions): Promise<StackRecord>;
     /**
      * History is the mutation/recovery surface, not a read surface — gated
-     * like patchContent(), with snapshot `permissions` stripped for everyone but
-     * the owner acting alone — a snapshot's permissions are the stack's
-     * sharing graph, which delegation is not a route to. Reading history
-     * changes nothing, so it is the one path the `_grant` write fence leaves
-     * alone: seeing how a Record you can already read got that way is not
-     * the escalation that fence exists to stop, and losing it would leave a
-     * write-holder unable to audit the Record they hold.
-     * See docs/spec/versioning.md § History access.
+     * like patchContent(). Reading it changes nothing, so it is the one path
+     * the `_grant` write fence leaves alone: seeing how a Record you can
+     * already read got that way is not the escalation that fence exists to
+     * stop. See docs/spec/versioning.md § History access.
      */
     getVersions(id: string): Promise<RecordVersion[]>;
     /**
      * See getVersions() — the same mutate-surface gate, for the same reason.
-     * A journal entry carries no snapshot `permissions` to strip: it names
-     * that a permission set moved, never what it moved to.
-     * See docs/spec/journal.md § Reading it.
+     *
+     * The journal is where a Record's sharing history lives, and that half
+     * is the resharer's: a reader who could not have moved the ACL is served
+     * the `permissions` op without the elements beneath it, so the entry
+     * still names that it moved. Asked of both identities, so delegation is
+     * no route to it either. See docs/spec/journal.md § Reading it.
      */
     getJournal(id: string, query?: JournalQuery): Promise<RecordJournalEntry[]>;
-    /** See getVersions() — same mutate-surface gate, same permissions stripping. */
+    /** See getVersions() — the same mutate-surface gate. */
     getVersion(id: string, version: number): Promise<RecordVersion | null>;
     /**
      * Re-runs the reference-creation checks against the snapshot, so a
-     * restore can't re-convey access to a file or record the subject can no
-     * longer reach today — the snapshot's `parentId` among them, gated
-     * exactly as a change set's `parentId` gates a destination named directly. Only the
-     * owner acting alone is exempt: under delegation the checks resolve
-     * against the subject, which is whose reach the restore would widen.
-     * See docs/spec/versioning.md § Restore semantics.
+     * restore can't re-convey access to a file the subject can no longer
+     * reach today. Only the owner acting alone is exempt: under delegation
+     * the checks resolve against the subject, which is whose reach the
+     * restore would widen. See docs/spec/versioning.md § Restore semantics.
      */
     restoreVersion(id: string, version: number, opts?: IfVersionOptions): Promise<StackRecord>;
     /**
-     * Commit a per-record migration — **the owner acting alone, only**.
+     * Commit a per-record migration — **the owner acting alone, only**, the
+     * same restriction the bulk `migrateAll()` carries by living on `Stack`.
      *
-     * Migration is owner-driven by design: `migrateAll()`, the bulk path,
-     * lives on `Stack` and is deliberately absent from `StackClient`, the
-     * same way `grant()`/`revoke()` are. This is its per-record counterpart
-     * and carries the same restriction, rather than inventing a grant model
-     * that the bulk path deliberately doesn't have.
-     *
-     * The restriction is what makes the verb safe to expose at all. Migrate
-     * replaces `content` and `typeId` wholesale, so a grant-based version
-     * would have to re-derive every gate `create()` applies at the
+     * Migrate replaces `content` and `typeId` wholesale, so a grant-based
+     * version would have to re-derive every gate `create()` applies at the
      * destination *and* every gate `mutate()` applies over the existing
-     * content, and would reopen each one it missed. The sharpest is the
-     * non-owner `_attachment@1` refusal create() carries: without it, a
-     * requester holding a create grant on `_attachment@1` and write access
-     * to any record they authored could migrate that record into the family
-     * naming any `fileId`, then read the bytes through canAccessFile()'s
-     * uploader clause — the exact escalation that carve-out exists to refuse
-     * (see docs/spec/attachments.md § Creating `_attachment@1` records
-     * directly). Ordinary write access to a record is not consent to move it
-     * between families.
-     *
-     * A server implementing `POST /records/:id/migrate` therefore serves it
-     * to the stack owner and answers 403 otherwise. See
-     * docs/spec/data-model.md § Type migrations.
+     * content, reopening each one it missed. The sharpest is create()'s
+     * non-owner `_attachment@1` refusal: without it, a requester could
+     * migrate a record they authored into the family naming any `fileId` and
+     * read the bytes through canAccessFile()'s uploader clause. Ordinary
+     * write access to a record is not consent to move it between families.
+     * See docs/spec/data-model.md § Type migrations.
      */
     commitMigration(id: string, toTypeId: TypeId, content: Record<string, unknown>, opts?: IfVersionOptions): Promise<StackRecord>;
     /**

package/dist/scoped-stack.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scoped-stack.d.ts","sourceRoot":"","sources":["../src/scoped-stack.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAMH,OAAO,EACL,aAAa,EAKd,MAAM,cAAc,CAAC;AAGtB,OAAO,KAAK,EAGV,KAAK,EACL,WAAW,EACX,iBAAiB,EACjB,QAAQ,EAGR,WAAW,EACX,YAAY,EACZ,aAAa,EACb,kBAAkB,EAClB,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,UAAU,EACV,WAAW,EACX,gBAAgB,EAChB,MAAM,EACN,WAAW,EACX,aAAa,EACd,MAAM,YAAY,CAAC;AAyCpB,OAAO,KAAK,EACV,KAAK,EACL,8BAA8B,EAC9B,+BAA+B,EAC/B,8BAA8B,EAC9B,mBAAmB,EACnB,YAAY,EACZ,gBAAgB,EAChB,gBAAgB,EAChB,WAAW,EACZ,MAAM,YAAY,CAAC;AAkHpB;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,qBAAa,WAAY,YAAW,WAAW;IAE3C,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAClC,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAKlC,OAAO,CAAC,QAAQ,CAAC,OAAO;IAIxB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAZP,KAAK,EAAE,KAAK,EACZ,iBAAiB,EAAE,QAAQ,GAAG,IAAI,EAClC,eAAe,EAAE,QAAQ,GAAG,IAAI,EAChC,iBAAiB,EAAE,MAAM,GAAG,IAAI,EAKhC,OAAO,EAAE,YAAY,EAIrB,OAAO,EAAE,aAAa;IAGzC,IAAI,QAAQ,IAAI,aAAa,CAE5B;IAED,OAAO,CAAC,aAAa,CAAmE;IAExF,sDAAsD;IACtD,OAAO,CAAC,UAAU,CAA8E;IAEhG,uEAAuE;IACvE,OAAO,KAAK,SAAS,GAEpB;IAED;;;;;OAKG;IACH,OAAO,KAAK,KAAK,GAQhB;IAED;;;;;;;OAOG;IACH,OAAO,KAAK,gBAAgB,GAK3B;IAED;;;;OAIG;IACH,OAAO,CAAC,uBAAuB;IAI/B,OAAO,CAAC,SAAS;IAUjB,OAAO,CAAC,UAAU;IAUlB;;;;;;;;;;;;OAYG;YACW,QAAQ;IAiEtB;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,eAAe;IAgBvB;;;;;;;;OAQG;IACH,OAAO,CAAC,aAAa;IAiBrB;;;;;;;OAOG;YACW,SAAS;YAWT,OAAO;YAgBP,gBAAgB;IAS9B;;;;;OAKG;IACH,OAAO,CAAC,cAAc;IAKtB,iFAAiF;IACjF,OAAO,CAAC,YAAY;IAMpB;;;;;OAKG;YACW,gBAAgB;IAa9B;;;;;;OAMG;YACW,WAAW;IAoBzB;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;IASvB;;;OAGG;IACH,OAAO,CAAC,gBAAgB;IAMxB;;;;;;;;;;;;OAYG;YACW,eAAe;IAO7B;;;;;;;;;;;;OAYG;YACW,oBAAoB;IAgBlC;;;;;OAKG;YACW,aAAa;IAqC3B,+GAA+G;YACjG,iBAAiB;IAQ/B;;;;;;OAMG;YACW,oBAAoB;IAWlC;;;;;;;;;;;OAWG;YACW,wBAAwB;IActC;;;;;;;;;OASG;IACG,MAAM,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACtE,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,CAAC,EACV,IAAI,GAAE,8BAAmC,GACxC,OAAO,CAAC,WAAW,GAAG;QAAE,OAAO,EAAE,CAAC,CAAA;KAAE,CAAC;IAwExC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,cAAc;IAItB;;;;;OAKG;IACH,OAAO,CAAC,UAAU;IAKlB;;;;;OAKG;IACG,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAO/E;;;;;OAKG;IACG,cAAc,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAS1D,cAAc,IAAI,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAInD;;;;;OAKG;IACG,KAAK,CAAC,KAAK,GAAE,UAAe,GAAG,OAAO,CAAC,WAAW,CAAC;IAmCzD;;;;;;;;;OASG;IACG,MAAM,CACV,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,aAAa,EACtB,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,WAAW,CAAC;IAyDjB,YAAY,CAChB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC,EACrC,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,WAAW,CAAC;IAIvB;;;;;;OAMG;YACW,kBAAkB;IAWhC,6EAA6E;YAC/D,gBAAgB;IAmB9B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,0BAA0B;IASlC;;;;;;;;;OASG;YACW,4BAA4B;IAuB1C;;;;;;;OAOG;IACH,OAAO,CAAC,uBAAuB;IAM/B;;;;;;;OAOG;YACW,0BAA0B;IAMlC,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAMrE,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAK5E;;;;;OAKG;IACG,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,GAAE,mBAAwB,GAAG,OAAO,CAAC,YAAY,CAAC;IAQ/E;;;;OAIG;IACG,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAAC,WAAW,CAAC;IAK7E;;;;;;;;;;OAUG;IACG,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAMvD;;;;;OAKG;IACG,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,GAAE,YAAiB,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAKrF,gFAAgF;IAC1E,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAO5E;;;;;;;;OAQG;IACG,cAAc,CAClB,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,WAAW,CAAC;IAkCvB;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACG,eAAe,CACnB,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,WAAW,CAAC;IAKvB;;;;OAIG;IACG,aAAa,CACjB,IAAI,EAAE,UAAU,EAChB,QAAQ,EAAE,MAAM,EAChB,QAAQ,CAAC,EAAE,MAAM,EACjB,KAAK,CAAC,EAAE,KAAK,GACZ,OAAO,CAAC,WAAW,GAAG;QAAE,OAAO,EAAE,iBAAiB,CAAA;KAAE,CAAC;IA+BxD;;;;OAIG;IACG,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAKxD;;;OAGG;IACG,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKrD;;;OAGG;IACG,wBAAwB,CAC5B,IAAI,CAAC,EAAE,+BAA+B,GACrC,OAAO,CAAC,8BAA8B,CAAC;IAK1C;;;;;;;;;OASG;IACG,SAAS,CACb,OAAO,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,IAAI,EACvC,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,WAAW,CAAC;IAoBvB;;;;;OAKG;YACW,aAAa;CAI5B"}
+{"version":3,"file":"scoped-stack.d.ts","sourceRoot":"","sources":["../src/scoped-stack.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAMH,OAAO,EACL,aAAa,EAKd,MAAM,cAAc,CAAC;AAGtB,OAAO,KAAK,EAGV,KAAK,EAEL,iBAAiB,EACjB,oBAAoB,EACpB,eAAe,EACf,QAAQ,EAGR,WAAW,EACX,YAAY,EACZ,aAAa,EACb,kBAAkB,EAClB,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,UAAU,EACV,WAAW,EACX,gBAAgB,EAChB,MAAM,EACN,WAAW,EACX,aAAa,EACd,MAAM,YAAY,CAAC;AA6CpB,OAAO,KAAK,EACV,KAAK,EACL,8BAA8B,EAC9B,+BAA+B,EAC/B,8BAA8B,EAC9B,mBAAmB,EACnB,YAAY,EACZ,gBAAgB,EAChB,gBAAgB,EAChB,WAAW,EACZ,MAAM,YAAY,CAAC;AA4GpB;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,WAAY,YAAW,WAAW;IAE3C,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAClC,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAKlC,OAAO,CAAC,QAAQ,CAAC,OAAO;IAIxB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAZP,KAAK,EAAE,KAAK,EACZ,iBAAiB,EAAE,QAAQ,GAAG,IAAI,EAClC,eAAe,EAAE,QAAQ,GAAG,IAAI,EAChC,iBAAiB,EAAE,MAAM,GAAG,IAAI,EAKhC,OAAO,EAAE,YAAY,EAIrB,OAAO,EAAE,aAAa;IAGzC,IAAI,QAAQ,IAAI,aAAa,CAE5B;IAED,OAAO,CAAC,aAAa,CAAmE;IAExF,sDAAsD;IACtD,OAAO,CAAC,UAAU,CAA8E;IAEhG,uEAAuE;IACvE,OAAO,KAAK,SAAS,GAEpB;IAED;;;;;;OAMG;IACH,OAAO,KAAK,UAAU,GAErB;IAED;;;;;OAKG;IACH,OAAO,KAAK,KAAK,GAQhB;IAED;;;;;;;OAOG;IACH,OAAO,KAAK,gBAAgB,GAK3B;IAED,6EAA6E;IAC7E,OAAO,CAAC,uBAAuB;IAI/B,OAAO,CAAC,SAAS;IAUjB,OAAO,CAAC,UAAU;IAUlB;;;;;;;;;;;OAWG;YACW,QAAQ;IAkEtB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,eAAe;IAgBvB;;;;;;;;OAQG;IACH,OAAO,CAAC,aAAa;IAiBrB;;;;;;;OAOG;YACW,SAAS;YAUT,OAAO;YAgBP,gBAAgB;IAS9B;;;;;OAKG;IACH,OAAO,CAAC,cAAc;IAKtB,iFAAiF;IACjF,OAAO,CAAC,YAAY;IAMpB;;;;;OAKG;YACW,gBAAgB;IAa9B;;;;;;OAMG;YACW,WAAW;IAoBzB;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;IASvB;;;OAGG;IACH,OAAO,CAAC,gBAAgB;IAMxB;;;;;;;;;OASG;YACW,eAAe;IAO7B;;;;;;;;OAQG;YACW,oBAAoB;IAgBlC;;;;;OAKG;YACW,aAAa;IA6C3B,+GAA+G;YACjG,iBAAiB;IAQ/B;;;;;;OAMG;YACW,oBAAoB;IAWlC;;;;;;;;;;;OAWG;YACW,wBAAwB;IActC;;;;;;;;;;OAUG;IACG,MAAM,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACtE,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,CAAC,EACV,IAAI,GAAE,8BAAmC,GACxC,OAAO,CAAC,WAAW,GAAG;QAAE,OAAO,EAAE,CAAC,CAAA;KAAE,CAAC;IAgExC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,cAAc;IAItB;;;;;OAKG;IACH,OAAO,CAAC,UAAU;IAKlB;;;;;OAKG;IACG,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAO/E;;;;;OAKG;IACG,cAAc,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAS1D,cAAc,IAAI,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAInD;;;;;OAKG;IACG,KAAK,CAAC,KAAK,GAAE,UAAe,GAAG,OAAO,CAAC,WAAW,CAAC;IAmCzD;;;;;;;;;OASG;IACG,MAAM,CACV,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,aAAa,EACtB,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,WAAW,CAAC;IAuFjB,YAAY,CAChB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC,EACrC,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,WAAW,CAAC;IAIvB;;;;;;OAMG;YACW,kBAAkB;IAWhC;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe;IAKvB,6EAA6E;YAC/D,gBAAgB;IAI9B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,UAAU;IAMlB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,0BAA0B;IASlC;;;;;;;OAOG;YACW,4BAA4B;IAuB1C;;;;;;;OAOG;IACH,OAAO,CAAC,uBAAuB;IAM/B;;;;;;;OAOG;YACW,0BAA0B;IAMxC;;;;;OAKG;IACG,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,eAAe,GAAG,OAAO,CAAC,WAAW,CAAC;IAO/E,oEAAoE;IAC9D,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,eAAe,GAAG,OAAO,CAAC,WAAW,CAAC;IAMhF;;;;;;;OAOG;IACG,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,oBAAoB,GAAG,OAAO,CAAC,WAAW,CAAC;IAMrF,wEAAwE;IAClE,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,oBAAoB,GAAG,OAAO,CAAC,WAAW,CAAC;IAMtF;;;;;OAKG;IACG,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,GAAE,mBAAwB,GAAG,OAAO,CAAC,YAAY,CAAC;IAQ/E;;;;OAIG;IACG,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAAC,WAAW,CAAC;IAK7E;;;;;;OAMG;IACG,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAKvD;;;;;;;;OAQG;IACG,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,GAAE,YAAiB,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAMrF,wDAAwD;IAClD,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAK5E;;;;;;OAMG;IACG,cAAc,CAClB,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,WAAW,CAAC;IAuBvB;;;;;;;;;;;;;OAaG;IACG,eAAe,CACnB,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,WAAW,CAAC;IAKvB;;;;OAIG;IACG,aAAa,CACjB,IAAI,EAAE,UAAU,EAChB,QAAQ,EAAE,MAAM,EAChB,QAAQ,CAAC,EAAE,MAAM,EACjB,KAAK,CAAC,EAAE,KAAK,GACZ,OAAO,CAAC,WAAW,GAAG;QAAE,OAAO,EAAE,iBAAiB,CAAA;KAAE,CAAC;IA+BxD;;;;OAIG;IACG,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAKxD;;;OAGG;IACG,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKrD;;;OAGG;IACG,wBAAwB,CAC5B,IAAI,CAAC,EAAE,+BAA+B,GACrC,OAAO,CAAC,8BAA8B,CAAC;IAK1C;;;;;;;;;OASG;IACG,SAAS,CACb,OAAO,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,IAAI,EACvC,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,WAAW,CAAC;IAoBvB;;;;;OAKG;YACW,aAAa;CAI5B"}