@haverstack/core 0.39.0 → 0.40.0

package/dist/scoped-stack.d.ts

@@ -18,7 +18,8 @@
  * See docs/spec/access-control.md and docs/spec/events.md § Permission scoping.
  */
 import { ChangeEmitter } from './changes.js';
-import type { PutAttachmentOptions, AttachmentContent, AuthorityAssociation, DataAssociation, EntityId, FileId, QueryResult, RecordChange, RecordId, RecordVersion, RecordJournalEntry, JournalQuery, StackAdapter, StackCapabilities, IfVersionOptions, StackQuery, StackRecord, SubscribeOptions, TypeId, Unsubscribe, RecordChangeSet } from './types.js';
+import type { PutAttachmentOptions, AssociationEdit, AttachmentContent, AuthorityAssociation, DataAssociation, EntityId, FileId, QueryResult, RecordChange, RecordId, RecordVersion, RecordJournalEntry, JournalQuery, VersionsQuery, StackAdapter, StackCapabilities, IfVersionOptions, StackQuery, StackRecord, SubscribeOptions, TypeId, Unsubscribe, RecordChangeSet } from './types.js';
+import type { ContentOf, PatchOf, ReadonlyTypeSchema, TypedChange, TypedChangeSet, TypedQuery, TypedSubscribeOptions, TypedRecord, TypeHandle } from './type-handle.js';
 import type { Stack, BackdatableCreateRecordOptions, CollectAttachmentGarbageOptions, CollectAttachmentGarbageResult, DeleteAndReturnResult, DeleteRecordOptions, DeleteResult, GetRecordOptions, StackClient } from './stack.js';
 /**
  * Held by Stack alone: the index re-exports ScopedStack but not this, so
@@ -189,14 +190,6 @@ export declare class ScopedStack implements StackClient {
      * See docs/spec/access-control.md § Delegation: principal and subject.
      */
     private requireVerb;
-    /**
-     * Refuse a mutation aimed at a soft-deleted Record. Asked only of a
-     * mutating caller, so the history readers borrowing this gate still work,
-     * and only after the authority decision, so "exists but deleted" is never
-     * a probe a stranger can run. See docs/spec/versioning.md § Mutations are
-     * refused, not applied to a tombstone.
-     */
-    private refuseIfDeleted;
     /**
      * Fetch a record the subject can reach and the principal holds `delete` on
      * (via permissions or a delete grant), or throw.
@@ -264,6 +257,7 @@ export declare class ScopedStack implements StackClient {
      * something it didn't. See docs/spec/access-control.md and
      * docs/spec/data-model.md § Record IDs.
      */
+    create<S extends ReadonlyTypeSchema>(handle: TypeHandle<S>, content: ContentOf<S>, opts?: BackdatableCreateRecordOptions): Promise<TypedRecord<S>>;
     create<T extends Record<string, unknown> = Record<string, unknown>>(typeId: TypeId, content: T, opts?: BackdatableCreateRecordOptions): Promise<StackRecord & {
         content: T;
     }>;
@@ -292,6 +286,7 @@ export declare class ScopedStack implements StackClient {
      * one does, so a caller learns only what it may read.
      * See docs/spec/disclosure.md § Which refusal a Record answers with.
      */
+    get<S extends ReadonlyTypeSchema>(handle: TypeHandle<S>, id: RecordId): Promise<TypedRecord<S> | null>;
     get(id: RecordId, opts?: GetRecordOptions): Promise<StackRecord | null>;
     /**
      * Runs through this.query(), so canRead() still applies — this answers a
@@ -307,6 +302,10 @@ export declare class ScopedStack implements StackClient {
      * never skips a record. Grants are prefetched once, cursor-walked to
      * exhaustion.
      */
+    query<S extends ReadonlyTypeSchema>(handle: TypeHandle<S>, query?: TypedQuery): Promise<{
+        records: TypedRecord<S>[];
+        cursor: string | null;
+    }>;
     query(query?: StackQuery): Promise<QueryResult>;
     /**
      * Apply a change set on behalf of the subject. Authority is resolved
@@ -318,7 +317,9 @@ export declare class ScopedStack implements StackClient {
      * applied and no key is silently dropped.
      * See docs/spec/access-control.md § Composing a change set.
      */
+    mutate<S extends ReadonlyTypeSchema>(handle: TypeHandle<S>, id: RecordId, changes: TypedChangeSet<S>, opts?: IfVersionOptions): Promise<TypedRecord<S>>;
     mutate(id: RecordId, changes: RecordChangeSet, opts?: IfVersionOptions): Promise<StackRecord>;
+    patchContent<S extends ReadonlyTypeSchema>(handle: TypeHandle<S>, id: RecordId, patch: PatchOf<S>, opts?: IfVersionOptions): Promise<TypedRecord<S>>;
     patchContent(id: RecordId, patch: Record<string, unknown | null>, opts?: IfVersionOptions): Promise<StackRecord>;
     /**
      * The record, having established that this request may decide who else
@@ -393,14 +394,20 @@ export declare class ScopedStack implements StackClient {
      */
     private requireOwnerForGrantRecord;
     /**
-     * Gated on the write bit alone, which is why the kind refusal comes
-     * first: authority reached through this verb would be exactly the
+     * Gated on the write bit alone, which is why the list is held to its
+     * rules first: authority reached through this verb would be exactly the
      * escalation the partition exists to stop, decided before any record is
      * read so it cannot depend on who is asking.
      */
-    associate(id: RecordId, association: DataAssociation): Promise<StackRecord>;
+    associate(id: RecordId, associations: DataAssociation[]): Promise<StackRecord>;
     /** See associate() — the same write gate, the same kind refusal. */
-    dissociate(id: RecordId, association: DataAssociation): Promise<StackRecord>;
+    dissociate(id: RecordId, associations: DataAssociation[]): Promise<StackRecord>;
+    /**
+     * The write gate, plus the per-element reference gate on each add: what a
+     * remove names is already on the record, so it is gated by the write bit
+     * alone. See associate().
+     */
+    amendAssociations(id: RecordId, changes: AssociationEdit[], surface?: string): Promise<StackRecord>;
     /**
      * Extend who reaches a record — the reshare gate's own verb, on the
      * owner-or-creator rule the `permissions` key carries. The write bit
@@ -409,9 +416,11 @@ export declare class ScopedStack implements StackClient {
      * scoping access is for.
      * See docs/spec/access-control.md § Record-level permissions.
      */
-    grantAccess(id: RecordId, permission: AuthorityAssociation): Promise<StackRecord>;
-    /** Withdraw one element of who reaches a record — see grantAccess(). */
-    revokeAccess(id: RecordId, permission: AuthorityAssociation): Promise<StackRecord>;
+    grantAccess(id: RecordId, permissions: AuthorityAssociation[]): Promise<StackRecord>;
+    /** Withdraw elements of who reaches a record — see grantAccess(). */
+    revokeAccess(id: RecordId, permissions: AuthorityAssociation[]): Promise<StackRecord>;
+    /** The reshare gate over an edit list — see grantAccess(). */
+    amendAccess(id: RecordId, changes: AssociationEdit[], surface?: string): Promise<StackRecord>;
     /**
      * Purge is owner-only: it is irreversible and destroys version
      * history, so neither the write bit nor delete-own/delete-any grants
@@ -440,7 +449,7 @@ export declare class ScopedStack implements StackClient {
      * already read got that way is not the escalation that fence exists to
      * stop. See docs/spec/versioning.md § History access.
      */
-    getVersions(id: RecordId): Promise<RecordVersion[]>;
+    getVersions(id: RecordId, query?: VersionsQuery): Promise<RecordVersion[]>;
     /**
      * See getVersions() — the same mutate-surface gate, for the same reason.
      *
@@ -510,6 +519,7 @@ export declare class ScopedStack implements StackClient {
      * disclosure, the same reasoning that keeps a count of the whole match
      * off a query result. See docs/spec/events.md § Permission scoping.
      */
+    subscribe<S extends ReadonlyTypeSchema>(handle: TypeHandle<S>, handler: (change: TypedChange<S>) => void, opts?: TypedSubscribeOptions): Promise<Unsubscribe>;
     subscribe(handler: (change: RecordChange) => void, opts?: SubscribeOptions): Promise<Unsubscribe>;
     /**
      * canRead for one event, through the subscription's own cache. Grants

package/dist/scoped-stack.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scoped-stack.d.ts","sourceRoot":"","sources":["../src/scoped-stack.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAKH,OAAO,EACL,aAAa,EAKd,MAAM,cAAc,CAAC;AAGtB,OAAO,KAAK,EAKV,oBAAoB,EAEpB,iBAAiB,EACjB,oBAAoB,EACpB,eAAe,EACf,QAAQ,EACR,MAAM,EAIN,WAAW,EACX,YAAY,EACZ,QAAQ,EACR,aAAa,EACb,kBAAkB,EAClB,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,UAAU,EACV,WAAW,EACX,gBAAgB,EAChB,MAAM,EACN,WAAW,EACX,eAAe,EAChB,MAAM,YAAY,CAAC;AA6CpB,OAAO,KAAK,EACV,KAAK,EACL,8BAA8B,EAC9B,+BAA+B,EAC/B,8BAA8B,EAC9B,qBAAqB,EACrB,mBAAmB,EACnB,YAAY,EACZ,gBAAgB,EAChB,WAAW,EACZ,MAAM,YAAY,CAAC;AA4GpB;;;;GAIG;AACH,eAAO,MAAM,UAAU,EAAE,OAAO,MAA8B,CAAC;AAE/D,sEAAsE;AACtE,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,EAAE,KAAK,CAAC;IACb,WAAW,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC3B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC;;;;OAIG;IACH,OAAO,EAAE,YAAY,CAAC;IACtB,oEAAoE;IACpE,OAAO,EAAE,aAAa,CAAC;IACvB,UAAU,EAAE,MAAM,IAAI,CAAC;IACvB,wEAAwE;IACxE,aAAa,EAAE,OAAO,CAAC;CACxB,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,WAAY,YAAW,WAAW;;IAG7C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAC9B,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAgB;IAClD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAe;IACvC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgB;IACxC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAa;IAC7C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAU;IAExC,mEAAmE;gBACvD,KAAK,EAAE,OAAO,UAAU,EAAE,IAAI,EAAE,eAAe;IAc3D;;;OAGG;IACH,IAAI,WAAW,IAAI,QAAQ,GAAG,IAAI,CAEjC;IAED;;;OAGG;IACH,IAAI,SAAS,IAAI,QAAQ,GAAG,IAAI,CAE/B;IAED,IAAI,YAAY,IAAI,iBAAiB,CAEpC;IAED,OAAO,CAAC,aAAa,CAAmE;IAExF,sDAAsD;IACtD,OAAO,CAAC,UAAU,CAA8E;IAEhG,uEAAuE;IACvE,OAAO,KAAK,SAAS,GAEpB;IAED;;;;;;OAMG;IACH,OAAO,KAAK,UAAU,GAErB;IAED;;;;;OAKG;IACH,OAAO,KAAK,SAAS,GAKpB;IAED,OAAO,KAAK,KAAK,GAKhB;IAED;;;;;;;OAOG;IACH,OAAO,KAAK,gBAAgB,GAK3B;IAED,6EAA6E;IAC7E,OAAO,CAAC,uBAAuB;IAI/B,OAAO,CAAC,SAAS;IAUjB,OAAO,CAAC,UAAU;IAUlB;;;;;;;;;;;OAWG;YACW,QAAQ;IAkEtB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,eAAe;IAgBvB;;;;;;;;OAQG;IACH,OAAO,CAAC,aAAa;IAiBrB;;;;;;;OAOG;YACW,SAAS;YAUT,OAAO;YAgBP,gBAAgB;IAS9B;;;;;OAKG;IACH,OAAO,CAAC,cAAc;IAKtB,iFAAiF;IACjF,OAAO,CAAC,YAAY;IAMpB;;;;;OAKG;YACW,gBAAgB;IAa9B;;;;;;OAMG;YACW,WAAW;IAoBzB;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;IASvB;;;OAGG;IACH,OAAO,CAAC,gBAAgB;IAMxB;;;;;;;;;OASG;YACW,eAAe;IAO7B;;;;;;;;OAQG;YACW,oBAAoB;IAgBlC;;;;;OAKG;YACW,aAAa;IA6C3B,+GAA+G;YACjG,iBAAiB;IAQ/B;;;;;;OAMG;YACW,oBAAoB;IAWlC;;;;;;;;;;;OAWG;YACW,wBAAwB;IActC;;;;;;;;;;OAUG;IACG,MAAM,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACtE,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,CAAC,EACV,IAAI,GAAE,8BAAmC,GACxC,OAAO,CAAC,WAAW,GAAG;QAAE,OAAO,EAAE,CAAC,CAAA;KAAE,CAAC;IA+DxC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,cAAc;IAItB;;;;;OAKG;IACH,OAAO,CAAC,UAAU;IAKlB;;;;;OAKG;IACG,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAOjF;;;;;OAKG;IACG,cAAc,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAS1D,cAAc,IAAI,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAInD;;;;;OAKG;IACG,KAAK,CAAC,KAAK,GAAE,UAAe,GAAG,OAAO,CAAC,WAAW,CAAC;IAmCzD;;;;;;;;;OASG;IACG,MAAM,CACV,EAAE,EAAE,QAAQ,EACZ,OAAO,EAAE,eAAe,EACxB,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,WAAW,CAAC;IAuFjB,YAAY,CAChB,EAAE,EAAE,QAAQ,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC,EACrC,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,WAAW,CAAC;IAIvB;;;;;;OAMG;YACW,kBAAkB;IAWhC;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe;IAKvB,6EAA6E;YAC/D,gBAAgB;IAI9B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,UAAU;IAMlB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,0BAA0B;IASlC;;;;;;;OAOG;YACW,4BAA4B;IAuB1C;;;;;;;OAOG;IACH,OAAO,CAAC,uBAAuB;IAM/B;;;;;;;OAOG;YACW,0BAA0B;IAMxC;;;;;OAKG;IACG,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,eAAe,GAAG,OAAO,CAAC,WAAW,CAAC;IAOjF,oEAAoE;IAC9D,UAAU,CAAC,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,eAAe,GAAG,OAAO,CAAC,WAAW,CAAC;IAMlF;;;;;;;OAOG;IACG,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,oBAAoB,GAAG,OAAO,CAAC,WAAW,CAAC;IAMvF,wEAAwE;IAClE,YAAY,CAAC,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,oBAAoB,GAAG,OAAO,CAAC,WAAW,CAAC;IAMxF;;;;;OAKG;IACG,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,GAAE,mBAAwB,GAAG,OAAO,CAAC,YAAY,CAAC;IAKjF;;;;;;OAMG;IACG,eAAe,CACnB,EAAE,EAAE,QAAQ,EACZ,IAAI,GAAE,mBAAwB,GAC7B,OAAO,CAAC,qBAAqB,CAAC;IAQjC;;;;OAIG;IACG,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAAC,WAAW,CAAC;IAK/E;;;;;;OAMG;IACG,WAAW,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAKzD;;;;;;;;OAQG;IACG,UAAU,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,GAAE,YAAiB,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAMvF,wDAAwD;IAClD,UAAU,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAK9E;;;;;;OAMG;IACG,cAAc,CAClB,EAAE,EAAE,QAAQ,EACZ,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,WAAW,CAAC;IAuBvB;;;;;;;;;;;;;OAaG;IACG,eAAe,CACnB,EAAE,EAAE,QAAQ,EACZ,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,WAAW,CAAC;IAKvB;;;;OAIG;IACG,aAAa,CACjB,IAAI,EAAE,UAAU,EAChB,IAAI,EAAE,oBAAoB,GACzB,OAAO,CAAC,WAAW,GAAG;QAAE,OAAO,EAAE,iBAAiB,CAAA;KAAE,CAAC;IA4BxD;;;;OAIG;IACG,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAKxD;;;OAGG;IACG,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKrD;;;OAGG;IACG,wBAAwB,CAC5B,IAAI,CAAC,EAAE,+BAA+B,GACrC,OAAO,CAAC,8BAA8B,CAAC;IAK1C;;;;;;;;;OASG;IACG,SAAS,CACb,OAAO,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,IAAI,EACvC,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,WAAW,CAAC;IAoBvB;;;;;OAKG;YACW,aAAa;CAI5B"}
+{"version":3,"file":"scoped-stack.d.ts","sourceRoot":"","sources":["../src/scoped-stack.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAKH,OAAO,EACL,aAAa,EAKd,MAAM,cAAc,CAAC;AAGtB,OAAO,KAAK,EAKV,oBAAoB,EAEpB,eAAe,EACf,iBAAiB,EACjB,oBAAoB,EACpB,eAAe,EACf,QAAQ,EACR,MAAM,EAIN,WAAW,EACX,YAAY,EACZ,QAAQ,EACR,aAAa,EACb,kBAAkB,EAClB,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,UAAU,EACV,WAAW,EACX,gBAAgB,EAChB,MAAM,EACN,WAAW,EACX,eAAe,EAChB,MAAM,YAAY,CAAC;AAsDpB,OAAO,KAAK,EACV,SAAS,EACT,OAAO,EACP,kBAAkB,EAClB,WAAW,EACX,cAAc,EACd,UAAU,EACV,qBAAqB,EACrB,WAAW,EACX,UAAU,EACX,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EACV,KAAK,EACL,8BAA8B,EAC9B,+BAA+B,EAC/B,8BAA8B,EAC9B,qBAAqB,EACrB,mBAAmB,EACnB,YAAY,EACZ,gBAAgB,EAChB,WAAW,EACZ,MAAM,YAAY,CAAC;AA4GpB;;;;GAIG;AACH,eAAO,MAAM,UAAU,EAAE,OAAO,MAA8B,CAAC;AAE/D,sEAAsE;AACtE,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,EAAE,KAAK,CAAC;IACb,WAAW,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC3B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC;;;;OAIG;IACH,OAAO,EAAE,YAAY,CAAC;IACtB,oEAAoE;IACpE,OAAO,EAAE,aAAa,CAAC;IACvB,UAAU,EAAE,MAAM,IAAI,CAAC;IACvB,wEAAwE;IACxE,aAAa,EAAE,OAAO,CAAC;CACxB,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,WAAY,YAAW,WAAW;;IAG7C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAC9B,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAgB;IAClD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAe;IACvC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgB;IACxC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAa;IAC7C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAU;IAExC,mEAAmE;gBACvD,KAAK,EAAE,OAAO,UAAU,EAAE,IAAI,EAAE,eAAe;IAc3D;;;OAGG;IACH,IAAI,WAAW,IAAI,QAAQ,GAAG,IAAI,CAEjC;IAED;;;OAGG;IACH,IAAI,SAAS,IAAI,QAAQ,GAAG,IAAI,CAE/B;IAED,IAAI,YAAY,IAAI,iBAAiB,CAEpC;IAED,OAAO,CAAC,aAAa,CAC0B;IAE/C,sDAAsD;IACtD,OAAO,CAAC,UAAU,CAA8E;IAEhG,uEAAuE;IACvE,OAAO,KAAK,SAAS,GAEpB;IAED;;;;;;OAMG;IACH,OAAO,KAAK,UAAU,GAErB;IAED;;;;;OAKG;IACH,OAAO,KAAK,SAAS,GAKpB;IAED,OAAO,KAAK,KAAK,GAKhB;IAED;;;;;;;OAOG;IACH,OAAO,KAAK,gBAAgB,GAK3B;IAED,6EAA6E;IAC7E,OAAO,CAAC,uBAAuB;IAI/B,OAAO,CAAC,SAAS;IAUjB,OAAO,CAAC,UAAU;IAUlB;;;;;;;;;;;OAWG;YACW,QAAQ;IAiEtB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,eAAe;IAgBvB;;;;;;;;OAQG;IACH,OAAO,CAAC,aAAa;IAiBrB;;;;;;;OAOG;YACW,SAAS;YAUT,OAAO;YAgBP,gBAAgB;IAS9B;;;;;OAKG;IACH,OAAO,CAAC,cAAc;IAKtB,iFAAiF;IACjF,OAAO,CAAC,YAAY;IAMpB;;;;;OAKG;YACW,gBAAgB;IAW9B;;;;;;OAMG;YACW,WAAW;IAkCzB;;;OAGG;IACH,OAAO,CAAC,gBAAgB;IAMxB;;;;;;;;;OASG;YACW,eAAe;IAO7B;;;;;;;;OAQG;YACW,oBAAoB;IAgBlC;;;;;OAKG;YACW,aAAa;IA6C3B,+GAA+G;YACjG,iBAAiB;IAQ/B;;;;;;OAMG;YACW,oBAAoB;IAelC;;;;;;;;;;;OAWG;YACW,wBAAwB;IAsBtC;;;;;;;;;;OAUG;IACG,MAAM,CAAC,CAAC,SAAS,kBAAkB,EACvC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,EACrB,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,EACrB,IAAI,CAAC,EAAE,8BAA8B,GACpC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACpB,MAAM,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACtE,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,CAAC,EACV,IAAI,CAAC,EAAE,8BAA8B,GACpC,OAAO,CAAC,WAAW,GAAG;QAAE,OAAO,EAAE,CAAC,CAAA;KAAE,CAAC;IA4ExC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,cAAc;IAItB;;;;;OAKG;IACH,OAAO,CAAC,UAAU;IAKlB;;;;;OAKG;IACG,GAAG,CAAC,CAAC,SAAS,kBAAkB,EACpC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,EACrB,EAAE,EAAE,QAAQ,GACX,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IAC3B,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAc7E;;;;;OAKG;IACG,cAAc,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAS1D,cAAc,IAAI,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAInD;;;;;OAKG;IACG,KAAK,CAAC,CAAC,SAAS,kBAAkB,EACtC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,EACrB,KAAK,CAAC,EAAE,UAAU,GACjB,OAAO,CAAC;QAAE,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAC1D,KAAK,CAAC,KAAK,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC;IA0CrD;;;;;;;;;OASG;IACG,MAAM,CAAC,CAAC,SAAS,kBAAkB,EACvC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,EACrB,EAAE,EAAE,QAAQ,EACZ,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,EAC1B,IAAI,CAAC,EAAE,gBAAgB,GACtB,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACpB,MAAM,CACV,EAAE,EAAE,QAAQ,EACZ,OAAO,EAAE,eAAe,EACxB,IAAI,CAAC,EAAE,gBAAgB,GACtB,OAAO,CAAC,WAAW,CAAC;IA2GjB,YAAY,CAAC,CAAC,SAAS,kBAAkB,EAC7C,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,EACrB,EAAE,EAAE,QAAQ,EACZ,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,EACjB,IAAI,CAAC,EAAE,gBAAgB,GACtB,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACpB,YAAY,CAChB,EAAE,EAAE,QAAQ,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC,EACrC,IAAI,CAAC,EAAE,gBAAgB,GACtB,OAAO,CAAC,WAAW,CAAC;IAavB;;;;;;OAMG;YACW,kBAAkB;IAQhC;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe;IAKvB,6EAA6E;YAC/D,gBAAgB;IAS9B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,UAAU;IAMlB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,0BAA0B;IASlC;;;;;;;OAOG;YACW,4BAA4B;IAuB1C;;;;;;;OAOG;IACH,OAAO,CAAC,uBAAuB;IAM/B;;;;;;;OAOG;YACW,0BAA0B;IAMxC;;;;;OAKG;IACG,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC;IAQpF,oEAAoE;IAC9D,UAAU,CAAC,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC;IAQrF;;;;OAIG;IACG,iBAAiB,CACrB,EAAE,EAAE,QAAQ,EACZ,OAAO,EAAE,eAAe,EAAE,EAC1B,OAAO,SAAwB,GAC9B,OAAO,CAAC,WAAW,CAAC;IAUvB;;;;;;;OAOG;IACG,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,oBAAoB,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC;IAQ1F,qEAAqE;IAC/D,YAAY,CAAC,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,oBAAoB,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC;IAQ3F,8DAA8D;IACxD,WAAW,CACf,EAAE,EAAE,QAAQ,EACZ,OAAO,EAAE,eAAe,EAAE,EAC1B,OAAO,SAAkB,GACxB,OAAO,CAAC,WAAW,CAAC;IAMvB;;;;;OAKG;IACG,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,GAAE,mBAAwB,GAAG,OAAO,CAAC,YAAY,CAAC;IAKjF;;;;;;OAMG;IACG,eAAe,CACnB,EAAE,EAAE,QAAQ,EACZ,IAAI,GAAE,mBAAwB,GAC7B,OAAO,CAAC,qBAAqB,CAAC;IAQjC;;;;OAIG;IACG,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAAC,WAAW,CAAC;IAK/E;;;;;;OAMG;IACG,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,GAAE,aAAkB,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAKpF;;;;;;;;OAQG;IACG,UAAU,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,GAAE,YAAiB,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAMvF,wDAAwD;IAClD,UAAU,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAK9E;;;;;;OAMG;IACG,cAAc,CAClB,EAAE,EAAE,QAAQ,EACZ,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,WAAW,CAAC;IAuBvB;;;;;;;;;;;;;OAaG;IACG,eAAe,CACnB,EAAE,EAAE,QAAQ,EACZ,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,WAAW,CAAC;IAKvB;;;;OAIG;IACG,aAAa,CACjB,IAAI,EAAE,UAAU,EAChB,IAAI,EAAE,oBAAoB,GACzB,OAAO,CAAC,WAAW,GAAG;QAAE,OAAO,EAAE,iBAAiB,CAAA;KAAE,CAAC;IA4BxD;;;;OAIG;IACG,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IASxD;;;OAGG;IACG,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKrD;;;OAGG;IACG,wBAAwB,CAC5B,IAAI,CAAC,EAAE,+BAA+B,GACrC,OAAO,CAAC,8BAA8B,CAAC;IAK1C;;;;;;;;;OASG;IACG,SAAS,CAAC,CAAC,SAAS,kBAAkB,EAC1C,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,EACrB,OAAO,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,KAAK,IAAI,EACzC,IAAI,CAAC,EAAE,qBAAqB,GAC3B,OAAO,CAAC,WAAW,CAAC;IACjB,SAAS,CACb,OAAO,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,IAAI,EACvC,IAAI,CAAC,EAAE,gBAAgB,GACtB,OAAO,CAAC,WAAW,CAAC;IAoCvB;;;;;OAKG;YACW,aAAa;CAI5B"}

package/dist/scoped-stack.js

@@ -22,14 +22,18 @@ import { validatePatchValues } from './validate.js';
 import { checkAccess, groupRoleFromAssociations, isOwnerActingAlone } from './access.js';
 import { ChangeEmitter, Subscription, matchesFilter, passesUnlistedBoundary, assertSinceUsable, } from './changes.js';
 import { SYSTEM_TYPES } from './types.js';
-import { StackConflictError, StackError, StackNotFoundError, StackPermissionError, RelayScopeError, StackValidationError, } from './errors.js';
-import { assertAuthorityAssociations, assertDataAssociations, assertSortCapability, assertValidAssociationFilters, assertValidSort, filtersContent, } from './query-validation.js';
+import { StackError, StackNotFoundError, StackPermissionError, RelayScopeError, StackValidationError, } from './errors.js';
+import { assertAssociationEdits, assertAuthorityAssociations, assertDataAssociations, assertSortCapability, assertValidAssociationFilters, assertValidBaseIdFilter, assertValidSort, filtersContent, } from './query-validation.js';
 import { grantConveys, grantCoversGrantee, grantReach, loadGrantRecords, UNGRANTABLE_SYSTEM_TYPES, } from './grants.js';
 import { bindingFieldsOf } from './identity-bindings.js';
 import { assertAttachmentSize } from './limits.js';
 import { validateIdTimestampSkew, validateRecordId } from './record-id.js';
 import { DEFAULT_QUERY_LIMIT, MAX_QUERY_LIMIT, findFirstMatch, lookupEntityByDid, queryAllPages, } from './stack-reads.js';
 import { associationDelta, associationEqual, isGroupRecord, presentDeleted, withoutAuthorityChanges, assertNonEmptyChangeSet, } from './record-changes.js';
+// Every import from stack.js is type-only: a ScopedStack never constructs
+// a Stack, so nothing here closes a runtime cycle with stack.ts, which does
+// construct a ScopedStack.
+import { isTypeHandle, typedCreate, typedGet, typedMutate, typedQuery, typedSubscribe, } from './type-handle.js';
 /**
  * The authority lookups canRead needs, held for the life of one
  * subscription. A subscription is long-lived where a query is not, so the
@@ -196,7 +200,7 @@ export class ScopedStack {
     get capabilities() {
         return this.stack.capabilities;
     }
-    resolveRecord = (id) => this.stack.get(id);
+    resolveRecord = (id) => this.stack.get(id, { includeDeleted: true });
     /** Every `_grant` Record — see loadGrantRecords(). */
     loadGrants = () => loadGrantRecords((q) => this.stack.query(q));
     /** Whether a delegated app is acting for someone other than itself. */
@@ -286,9 +290,8 @@ export class ScopedStack {
             grantRecords = prefetchedGrants;
         }
         else {
-            // No content-field prefilter: a stored grant's typeId may be a bare
-            // baseId or versioned, so exact matching would wrongly exclude family
-            // versions. Cursor-walked to see grants past page one.
+            // Cursor-walked to see grants past page one. A stored baseId is
+            // judged by grantReach(), which refuses a versioned one.
             grantRecords = await this.loadGrants();
         }
         for (const r of grantRecords) {
@@ -424,13 +427,11 @@ export class ScopedStack {
      * the one way through it a `_grant` Record stays open to.
      */
     async requireUpdatable(id, opts = {}) {
-        const mutating = opts.mutating ?? true;
         // The `_grant` write fence applies to mutating callers only: reading a
         // grant Record's history is not the escalation that fence exists to stop.
-        const record = await this.requireVerb(id, ['update-own', 'update-any'], {
-            fenceGrantRecord: mutating,
+        return this.requireVerb(id, ['update-own', 'update-any'], {
+            fenceGrantRecord: opts.mutating ?? true,
         });
-        return this.refuseIfDeleted(record, mutating);
     }
     /**
      * The write gate both requireUpdatable() and requireDeletable() are: the
@@ -440,33 +441,26 @@ export class ScopedStack {
      * See docs/spec/access-control.md § Delegation: principal and subject.
      */
     async requireVerb(id, actions, opts) {
-        const record = await this.stack.get(id);
+        const record = await this.stack.get(id, { includeDeleted: true });
         if (!record)
             throw new StackNotFoundError(`Record not found: "${id}"`);
         if (opts.fenceGrantRecord)
             await this.requireOwnerForGrantRecord(record);
         if (isGroupRecord(record)) {
-            if (!this.isGroupManager(record))
-                throw await this.denialFor(record);
+            if (!this.isGroupManager(record)) {
+                throw await this.denialFor(record, `Cannot change group "${id}": only its admins can manage it`);
+            }
             return record;
         }
-        const allowed = ((await this.checkWrite(record)) ||
-            (await this.subjectAllows(record.typeId, actions, { record }))) &&
-            (await this.principalAllows(record.typeId, actions));
-        if (!allowed)
-            throw await this.denialFor(record);
-        return record;
-    }
-    /**
-     * Refuse a mutation aimed at a soft-deleted Record. Asked only of a
-     * mutating caller, so the history readers borrowing this gate still work,
-     * and only after the authority decision, so "exists but deleted" is never
-     * a probe a stranger can run. See docs/spec/versioning.md § Mutations are
-     * refused, not applied to a tombstone.
-     */
-    refuseIfDeleted(record, mutating) {
-        if (mutating && record.deletedAt) {
-            throw new StackConflictError(`Record "${record.id}" is soft-deleted; undelete it before mutating it.`);
+        const subjectReaches = (await this.checkWrite(record)) ||
+            (await this.subjectAllows(record.typeId, actions, { record }));
+        const principalHolds = await this.principalAllows(record.typeId, actions);
+        if (!subjectReaches || !principalHolds) {
+            const verb = actions[0].split('-')[0];
+            const what = `Cannot ${verb} "${id}" (${record.typeId})`;
+            throw await this.denialFor(record, subjectReaches
+                ? `${what}: the app acting for this entity holds no ${verb} grant`
+                : `${what}: requires ${actions.join(' or ')}`);
         }
         return record;
     }
@@ -492,7 +486,7 @@ export class ScopedStack {
     async canReadReferent(recordId) {
         if (this.ownerActingAlone)
             return true;
-        const record = await this.stack.get(recordId);
+        const record = await this.stack.get(recordId, { includeDeleted: true });
         if (!record)
             return false;
         return this.canRead(record);
@@ -582,8 +576,9 @@ export class ScopedStack {
             const value = content[field];
             if (typeof value !== 'string')
                 continue;
-            if (!(await this.canAccessFile(value)))
-                throw new StackPermissionError();
+            if (!(await this.canAccessFile(value))) {
+                throw new StackPermissionError(`Cannot reference file "${value}" in field "${field}": it does not exist or you cannot read it`);
+            }
         }
     }
     /**
@@ -600,8 +595,9 @@ export class ScopedStack {
      */
     async requireAssociationAccess(typeId, association) {
         if (association.kind === 'attachment') {
-            if (!(await this.canAccessFile(association.fileId)))
-                throw new StackPermissionError();
+            if (!(await this.canAccessFile(association.fileId))) {
+                throw new StackPermissionError(`Cannot reference file "${association.fileId}": it does not exist or you cannot read it`);
+            }
         }
         else if (association.kind === 'relationship' && baseIdOf(typeId) !== SYSTEM_TYPES.GROUP) {
             const { target } = association;
@@ -611,22 +607,16 @@ export class ScopedStack {
             // leave one spelling of a local Record ungated.
             if (target.kind !== 'record' || target.stackUrl)
                 return;
-            if (!(await this.canReadReferent(target.recordId)))
-                throw new StackPermissionError();
+            if (!(await this.canReadReferent(target.recordId))) {
+                throw new StackPermissionError(`Cannot reference record "${target.recordId}": it does not exist or you cannot read it`);
+            }
         }
     }
-    /**
-     * Create a record on behalf of the subject: create grant required,
-     * anonymous denied, `createdBy` set to the requester, client IDs skew-checked,
-     * reference-creating options gated, and non-owner `_attachment@1`
-     * creation refused save one carve-out. A scoped create always stamps
-     * authorship — an absent `createdBy` means an unscoped `Stack` wrote it.
-     * `createdAt`/`updatedAt` are refused to everyone but the owner acting
-     * alone, rather than dropped, so an app never believes it published
-     * something it didn't. See docs/spec/access-control.md and
-     * docs/spec/data-model.md § Record IDs.
-     */
-    async create(typeId, content, opts = {}) {
+    async create(typeIdOrHandle, content, opts = {}) {
+        if (isTypeHandle(typeIdOrHandle)) {
+            return typedCreate(this, typeIdOrHandle, content, opts);
+        }
+        const typeId = typeIdOrHandle;
         const principal = this.#principalId;
         if (!principal)
             throw new StackPermissionError('Anonymous requesters cannot create records');
@@ -648,7 +638,7 @@ export class ScopedStack {
         if (!this.ownerActingAlone && baseIdOf(typeId) === SYSTEM_TYPES.ATTACHMENT) {
             const fileId = content.fileId;
             if (typeof fileId !== 'string' || !(await this.hasReadableReference(fileId))) {
-                throw new StackPermissionError();
+                throw new StackPermissionError(`Cannot reference file "${String(fileId)}": it does not exist or you cannot read it`);
             }
         }
         if (opts.permissions?.length && !this.mayGrantAccess()) {
@@ -672,7 +662,7 @@ export class ScopedStack {
             }
         }
         if (opts.parentId !== undefined && !(await this.canReadReferent(opts.parentId))) {
-            throw new StackPermissionError();
+            throw new StackPermissionError(`Cannot reference record "${opts.parentId}" as parent: it does not exist or you cannot read it`);
         }
         for (const assoc of opts.associations ?? []) {
             await this.requireAssociationAccess(typeId, assoc);
@@ -708,13 +698,11 @@ export class ScopedStack {
             return false;
         return entityId === this.stack.ownerEntityId || entityId === record.createdBy?.subjectId;
     }
-    /**
-     * A record this request may read, or null. Never throws
-     * StackPermissionError: an unreadable record answers exactly as a missing
-     * one does, so a caller learns only what it may read.
-     * See docs/spec/disclosure.md § Which refusal a Record answers with.
-     */
-    async get(id, opts = {}) {
+    async get(idOrHandle, idOrOpts = {}) {
+        if (isTypeHandle(idOrHandle))
+            return typedGet(this, idOrHandle, idOrOpts);
+        const id = idOrHandle;
+        const opts = idOrOpts;
         const record = await this.stack.get(id, opts);
         if (!record)
             return null;
@@ -734,16 +722,14 @@ export class ScopedStack {
     async getOwnerEntity() {
         return this.getEntityByDid(this.stack.ownerEntityId);
     }
-    /**
-     * Query records, filtered to those this request can read. Pages are
-     * filtered then refilled, so a page may slightly overshoot `limit` but
-     * never skips a record. Grants are prefetched once, cursor-walked to
-     * exhaustion.
-     */
-    async query(query = {}) {
+    async query(first = {}, typedQueryArg) {
+        if (isTypeHandle(first))
+            return typedQuery(this, first, typedQueryArg);
+        const query = first;
         assertValidSort(query.sort);
         assertSortCapability(query.sort, this.stack.capabilities);
         assertValidAssociationFilters(query.filter);
+        assertValidBaseIdFilter(query.filter);
         if (query.filter?.includeUnlisted && !this.ownerActingAlone) {
             throw new StackPermissionError('includeUnlisted is owner-only');
         }
@@ -771,17 +757,13 @@ export class ScopedStack {
         } while (records.length < limit && page.cursor && totalFetched < maxFetched);
         return { records, cursor: page.cursor };
     }
-    /**
-     * Apply a change set on behalf of the subject. Authority is resolved
-     * **per key** and every gate reads the record as it stands, never as the
-     * change set would leave it: a widened `permissions` never satisfies the
-     * read check on a `parentId` named in the same call, and a `_group`
-     * roster never satisfies the admin check that same call has to pass.
-     * One refused key refuses the whole call, so nothing is partially
-     * applied and no key is silently dropped.
-     * See docs/spec/access-control.md § Composing a change set.
-     */
-    async mutate(id, changes, opts = {}) {
+    async mutate(first, second, third, fourth = {}) {
+        if (isTypeHandle(first)) {
+            return typedMutate(this, first, second, third, fourth);
+        }
+        const id = first;
+        const changes = second;
+        const opts = (third ?? {});
         // Ahead of every gate: a malformed change set is a validation error
         // for every requester, rather than one for the owner and a permission
         // refusal for everyone else.
@@ -856,12 +838,15 @@ export class ScopedStack {
             await this.requireAssociationAccess(record.typeId, assoc);
         }
         if (changes.parentId != null && !(await this.canReadReferent(changes.parentId))) {
-            throw new StackPermissionError();
+            throw new StackPermissionError(`Cannot reference record "${changes.parentId}" as parent: it does not exist or you cannot read it`);
         }
         return this.stack.mutate(id, authorized, { ...opts, ...this.actor });
     }
-    async patchContent(id, patch, opts = {}) {
-        return this.mutate(id, { contentPatch: patch }, opts);
+    async patchContent(first, second, third, fourth) {
+        if (isTypeHandle(first)) {
+            return this.mutate(first, second, { contentPatch: third }, fourth);
+        }
+        return this.mutate(first, { contentPatch: second }, third);
     }
     /**
      * The record, having established that this request may decide who else
@@ -871,15 +856,12 @@ export class ScopedStack {
      * deliberately does not confer.
      */
     async requireReshareable(id) {
-        const record = await this.stack.get(id);
+        const record = await this.stack.get(id, { includeDeleted: true });
         if (!record)
             throw new StackNotFoundError(`Record not found: "${id}"`);
         await this.requireOwnerForGrantRecord(record);
         await this.requireReshareOf(record);
-        // Reached through its own gate rather than requireUpdatable(), so the
-        // soft-delete refusal has to be asked here too — after the authority
-        // decision above, for the reason refuseIfDeleted() gives.
-        return this.refuseIfDeleted(record, true);
+        return record;
     }
     /**
      * Whether a change set's `permissions` key actually moves the ACL. Read
@@ -896,8 +878,9 @@ export class ScopedStack {
     }
     /** The reshare decision alone, for a record already read and write-gated. */
     async requireReshareOf(record) {
-        if (!this.canReshare(record))
-            throw await this.denialFor(record);
+        if (!this.canReshare(record)) {
+            throw await this.denialFor(record, `Cannot change permissions on "${record.id}": only its author or the stack owner can reshare it`);
+        }
     }
     /**
      * Whether this request may decide who else reaches `record` — the
@@ -993,22 +976,31 @@ export class ScopedStack {
         throw await this.denialFor(record, 'Only the stack owner may write a _grant record');
     }
     /**
-     * Gated on the write bit alone, which is why the kind refusal comes
-     * first: authority reached through this verb would be exactly the
+     * Gated on the write bit alone, which is why the list is held to its
+     * rules first: authority reached through this verb would be exactly the
      * escalation the partition exists to stop, decided before any record is
      * read so it cannot depend on who is asking.
      */
-    async associate(id, association) {
-        assertDataAssociations([association], 'associate()');
-        const record = await this.requireUpdatable(id);
-        await this.requireAssociationAccess(record.typeId, association);
-        return this.stack.associate(id, association, this.actor);
+    async associate(id, associations) {
+        return this.amendAssociations(id, associations.map((association) => ({ op: 'add', association })), 'associate()');
     }
     /** See associate() — the same write gate, the same kind refusal. */
-    async dissociate(id, association) {
-        assertDataAssociations([association], 'dissociate()');
-        await this.requireUpdatable(id);
-        return this.stack.dissociate(id, association, this.actor);
+    async dissociate(id, associations) {
+        return this.amendAssociations(id, associations.map((association) => ({ op: 'remove', association })), 'dissociate()');
+    }
+    /**
+     * The write gate, plus the per-element reference gate on each add: what a
+     * remove names is already on the record, so it is gated by the write bit
+     * alone. See associate().
+     */
+    async amendAssociations(id, changes, surface = 'amendAssociations()') {
+        assertAssociationEdits(changes, surface, 'data');
+        const record = await this.requireUpdatable(id);
+        for (const change of changes) {
+            if (change.op === 'add')
+                await this.requireAssociationAccess(record.typeId, change.association);
+        }
+        return this.stack.amendAssociations(id, changes, this.actor, surface);
     }
     /**
      * Extend who reaches a record — the reshare gate's own verb, on the
@@ -1018,16 +1010,18 @@ export class ScopedStack {
      * scoping access is for.
      * See docs/spec/access-control.md § Record-level permissions.
      */
-    async grantAccess(id, permission) {
-        assertAuthorityAssociations([permission], 'grantAccess()');
-        await this.requireReshareable(id);
-        return this.stack.grantAccess(id, permission, this.actor);
+    async grantAccess(id, permissions) {
+        return this.amendAccess(id, permissions.map((association) => ({ op: 'add', association })), 'grantAccess()');
     }
-    /** Withdraw one element of who reaches a record — see grantAccess(). */
-    async revokeAccess(id, permission) {
-        assertAuthorityAssociations([permission], 'revokeAccess()');
+    /** Withdraw elements of who reaches a record — see grantAccess(). */
+    async revokeAccess(id, permissions) {
+        return this.amendAccess(id, permissions.map((association) => ({ op: 'remove', association })), 'revokeAccess()');
+    }
+    /** The reshare gate over an edit list — see grantAccess(). */
+    async amendAccess(id, changes, surface = 'amendAccess()') {
+        assertAssociationEdits(changes, surface, 'authority');
         await this.requireReshareable(id);
-        return this.stack.revokeAccess(id, permission, this.actor);
+        return this.stack.amendAccess(id, changes, this.actor, surface);
     }
     /**
      * Purge is owner-only: it is irreversible and destroys version
@@ -1069,9 +1063,9 @@ export class ScopedStack {
      * already read got that way is not the escalation that fence exists to
      * stop. See docs/spec/versioning.md § History access.
      */
-    async getVersions(id) {
+    async getVersions(id, query = {}) {
         await this.requireUpdatable(id, { mutating: false });
-        return this.stack.getVersions(id);
+        return this.stack.getVersions(id, query);
     }
     /**
      * See getVersions() — the same mutate-surface gate, for the same reason.
@@ -1169,8 +1163,9 @@ export class ScopedStack {
      * predicate as the reference-creation gate (canAccessFile).
      */
     async getAttachment(fileId) {
-        if (!(await this.canAccessFile(fileId)))
-            throw new StackPermissionError();
+        if (!(await this.canAccessFile(fileId))) {
+            throw new StackPermissionError(`Cannot read file "${fileId}": it does not exist or you cannot read it`);
+        }
         return this.stack.getAttachment(fileId);
     }
     /**
@@ -1189,17 +1184,12 @@ export class ScopedStack {
         this.requireOwnerActingAlone('Only the stack owner can collect attachment garbage');
         return this.stack.collectAttachmentGarbage({ ...opts, ...this.actor });
     }
-    /**
-     * Observe the changes this request may read. The predicate is canRead
-     * applied per event — the same one get() and query() answer with, so a
-     * feed can't disagree with them about what this session sees.
-     *
-     * A record the subscriber cannot read produces no event at all, rather
-     * than an empty or redacted one: the existence of a change is itself a
-     * disclosure, the same reasoning that keeps a count of the whole match
-     * off a query result. See docs/spec/events.md § Permission scoping.
-     */
-    async subscribe(handler, opts = {}) {
+    async subscribe(first, second, third) {
+        if (isTypeHandle(first)) {
+            return typedSubscribe(this, first, second, third);
+        }
+        const handler = first;
+        const opts = (second ?? {});
         this.assertStackOpen();
         if (this.relaysChanges) {
             throw new RelayScopeError('This stack relays changes from elsewhere, and a scoped view cannot narrow that feed: ' +
@@ -1209,6 +1199,7 @@ export class ScopedStack {
         // A relaying stack was already refused above, so relaysChanges is
         // always false here — `since` never has a cursor to mean anything by.
         assertSinceUsable(opts.since, false);
+        assertValidBaseIdFilter(opts.filter);
         if (opts.includeUnlisted && !this.ownerActingAlone) {
             throw new StackPermissionError('includeUnlisted is owner-only');
         }