@haverstack/core 0.40.0 → 0.42.0

package/dist/types/records.d.ts

@@ -0,0 +1,76 @@
+/**
+ * The Record itself and its version snapshots.
+ */
+import type { AuthorityAssociation, DataAssociation } from './associations.js';
+import type { RecordId, TypeId, AppId, Actor } from './ids.js';
+export type StackRecord = {
+    id: RecordId;
+    typeId: TypeId;
+    createdAt: Date;
+    updatedAt: Date;
+    content: Record<string, unknown>;
+    /**
+     * Ordinal of the snapshot history, not a count of changes: associations,
+     * permissions, parent and listing moves leave it alone. See
+     * docs/spec/versioning.md § Version history.
+     */
+    version: number;
+    parentId?: RecordId;
+    appId?: AppId;
+    /**
+     * The record's author, stamped once by the create. A `principalId` here
+     * is what lets `appId` be checked against the `_app` record naming that
+     * DID; without one, `appId` is an unverifiable self-report.
+     * See docs/spec/data-model.md § Authorship and attribution.
+     */
+    createdBy?: Actor;
+    /**
+     * Who performed the mutation this version records — unlike `createdBy`,
+     * it moves with every write. Absent means an unscoped `Stack` wrote it,
+     * which names no requester.
+     * See docs/spec/data-model.md § Authorship and attribution.
+     */
+    updatedBy?: Actor;
+    deletedAt?: Date;
+    /**
+     * Present when the record is withheld from enumeration: absent from
+     * `query()` and the change feed by default, but reachable by `get()` for
+     * anyone who may read it. Says nothing about who that is.
+     * See docs/spec/unlisted.md.
+     */
+    unlistedAt?: Date;
+    /**
+     * Who reaches this Record, projected from the association table's
+     * authority kinds. Absent or empty means private — readable only by the
+     * stack owner. Declarative intent; enforcement is `ScopedStack`'s.
+     * See docs/spec/access-control.md § Record-level permissions.
+     */
+    permissions?: AuthorityAssociation[];
+    associations?: DataAssociation[];
+};
+export type RecordVersion = {
+    version: number;
+    /** The record's typeId at the moment this version was snapshotted. */
+    typeId: TypeId;
+    content: Record<string, unknown>;
+    updatedAt: Date;
+    /**
+     * The record's author, carried through from `record.createdBy` — not the
+     * actor of the change this version records.
+     * See docs/spec/versioning.md § Version history.
+     */
+    createdBy?: Actor;
+    /** Who performed the mutation that produced this version. */
+    updatedBy?: Actor;
+};
+/**
+ * Window into a record's version history. Newest first, the reverse of
+ * JournalQuery; omitting both reads every version.
+ * See docs/spec/versioning.md § Version history.
+ */
+export type VersionsQuery = {
+    /** Versions strictly older than this, exclusive. */
+    beforeVersion?: number;
+    limit?: number;
+};
+//# sourceMappingURL=records.d.ts.map

package/dist/types/records.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"records.d.ts","sourceRoot":"","sources":["../../src/types/records.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAC/E,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC;AAE/D,MAAM,MAAM,WAAW,GAAG;IAExB,EAAE,EAAE,QAAQ,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC;IAGhB,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,KAAK,CAAC,EAAE,KAAK,CAAC;IACd;;;;;OAKG;IACH,SAAS,CAAC,EAAE,KAAK,CAAC;IAClB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,KAAK,CAAC;IAClB,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,IAAI,CAAC;IAClB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACrC,YAAY,CAAC,EAAE,eAAe,EAAE,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,SAAS,EAAE,IAAI,CAAC;IAChB;;;;OAIG;IACH,SAAS,CAAC,EAAE,KAAK,CAAC;IAClB,6DAA6D;IAC7D,SAAS,CAAC,EAAE,KAAK,CAAC;CACnB,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,oDAAoD;IACpD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC"}

package/dist/types/records.js

@@ -0,0 +1,5 @@
+/**
+ * The Record itself and its version snapshots.
+ */
+export {};
+//# sourceMappingURL=records.js.map

package/dist/types/records.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"records.js","sourceRoot":"","sources":["../../src/types/records.ts"],"names":[],"mappings":"AAAA;;GAEG"}

package/dist/types/schema.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Type schemas: field definitions and the registered StackType.
+ */
+import type { TypeId, BaseId } from './ids.js';
+export type ScalarFieldKind = 'string' | 'number' | 'boolean' | 'date' | 'text' | 'record-ref' | 'file-ref' | 'enum';
+/**
+ * `values` is a non-empty, duplicate-free list of the strings the field may
+ * hold. See docs/spec/data-model.md § Types.
+ */
+export type EnumFieldDef = {
+    kind: 'enum';
+    values: string[];
+    required?: boolean;
+};
+export type ScalarFieldDef = EnumFieldDef | {
+    kind: Exclude<ScalarFieldKind, 'enum'>;
+    required?: boolean;
+};
+/**
+ * A list. `open: true` leaves its elements unvalidated,
+ * which is how a heterogeneous or null-bearing list is spelled. Opacity is
+ * declared rather than inferred from a missing `items`, so a schema that
+ * forgets to describe its elements is a type error rather than a silently
+ * unchecked field. See docs/spec/data-model.md § Undeclared content fields.
+ */
+export type ArrayFieldDef = {
+    kind: 'array';
+    items: FieldDef;
+    open?: false;
+    required?: boolean;
+} | {
+    kind: 'array';
+    open: true;
+    items?: undefined;
+    required?: boolean;
+};
+/**
+ * An object. `open: true` leaves its keys unvalidated,
+ * which is the one way to store a shape a schema does not describe. Same
+ * reason as ArrayFieldDef for making it a declaration rather than an
+ * omission. See docs/spec/data-model.md § Undeclared content fields.
+ */
+export type ObjectFieldDef = {
+    kind: 'object';
+    properties: TypeSchema;
+    open?: false;
+    required?: boolean;
+} | {
+    kind: 'object';
+    open: true;
+    properties?: undefined;
+    required?: boolean;
+};
+/**
+ * A field definition in a Type schema. Supports scalars, arrays, and nested
+ * objects. Arrays and nested objects are schema-validated on write but are
+ * opaque to the query engine in v1 — only top-level scalar fields support
+ * exact-match content filtering in queries.
+ */
+export type FieldDef = ScalarFieldDef | ArrayFieldDef | ObjectFieldDef;
+export type TypeSchema = {
+    [fieldName: string]: FieldDef;
+};
+export type StackType = {
+    id: TypeId;
+    baseId: BaseId;
+    version: number;
+    name: string;
+    schema: TypeSchema;
+    schemaHash: string;
+    migratesFrom?: TypeId;
+    createdAt: Date;
+};
+//# sourceMappingURL=schema.d.ts.map

package/dist/types/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/types/schema.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAE/C,MAAM,MAAM,eAAe,GACvB,QAAQ,GACR,QAAQ,GACR,SAAS,GACT,MAAM,GACN,MAAM,GACN,YAAY,GACZ,UAAU,GACV,MAAM,CAAC;AAEX;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,cAAc,GACtB,YAAY,GACZ;IAAE,IAAI,EAAE,OAAO,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAEnE;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,QAAQ,CAAC;IAAC,IAAI,CAAC,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,GACpE;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAEzE;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,UAAU,EAAE,UAAU,CAAC;IAAC,IAAI,CAAC,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,GAC5E;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,IAAI,CAAC;IAAC,UAAU,CAAC,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAE/E;;;;;GAKG;AACH,MAAM,MAAM,QAAQ,GAAG,cAAc,GAAG,aAAa,GAAG,cAAc,CAAC;AAEvE,MAAM,MAAM,UAAU,GAAG;IACvB,CAAC,SAAS,EAAE,MAAM,GAAG,QAAQ,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,UAAU,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,IAAI,CAAC;CACjB,CAAC"}

package/dist/types/schema.js

@@ -0,0 +1,5 @@
+/**
+ * Type schemas: field definitions and the registered StackType.
+ */
+export {};
+//# sourceMappingURL=schema.js.map

package/dist/types/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/types/schema.ts"],"names":[],"mappings":"AAAA;;GAEG"}

package/dist/types/system.d.ts

@@ -0,0 +1,161 @@
+/**
+ * Content shapes for the reserved `_`-prefixed system types.
+ */
+import type { Grantee } from './associations.js';
+import type { TypeId, BaseId, FileId, AppId, EntityId } from './ids.js';
+/**
+ * Content for _entity records: a stack-local profile card *about* a DID,
+ * not the identity itself. `name`/`handle` are this owner's local labels
+ * for that DID (the petname pattern), so two stacks holding different
+ * names for the same DID is correct. See docs/spec/identity.md § Entity.
+ */
+export type EntityContent = {
+    /**
+     * The identity this profile is about. e.g. "did:key:z6Mk...". A binding,
+     * not a value — an Actor's `subjectId` resolves through it to the name
+     * this card carries, so it is unique per stack and immutable once set.
+     * See docs/spec/identity.md § DID bindings.
+     */
+    did: string;
+    /** Display name — human-friendly, not necessarily unique. May contain spaces and punctuation. e.g. "Jane Smith" */
+    name: string;
+    /**
+     * Short, conventionally URL-safe label. e.g. "janesmith". A label, not a
+     * key: duplicates are legitimate and `did` is what identifies this
+     * profile. See docs/spec/identity.md § Entity.
+     */
+    handle?: string;
+};
+/** Content for _app records */
+export type AppContent = {
+    /**
+     * The software this card is about, in reverse-DNS form — the value a
+     * Record's `appId` is checked against. Distinct from the card Record's
+     * own `appId`, which names whatever wrote the card (an admin console
+     * registering a third-party app is the ordinary case, and the two differ
+     * there). See docs/spec/identity.md § App.
+     */
+    appId: AppId;
+    /** Display name of the app e.g. "My Notes App" */
+    name: string;
+    /** Semver string e.g. "1.0.0". `appId` is the machine-readable identity, so no handle is needed here. */
+    version?: string;
+    /**
+     * The DID this app authenticates with, when it holds a key of its own —
+     * what an Actor's `principalId` resolves to, and what a self-reported
+     * `appId` is checked against. Absent for apps that ride their user's
+     * identity. Unique and immutable: docs/spec/identity.md § DID bindings.
+     */
+    did?: string;
+};
+/** Content for _group records */
+export type GroupContent = {
+    /** Display name — human-friendly, not necessarily unique. May contain spaces and punctuation. e.g. "Jane's Book Club" */
+    name: string;
+    /**
+     * Short, conventionally URL-safe label. e.g. "janes-book-club". A label,
+     * not a key: duplicates are legitimate, and a group is addressed by
+     * `stackUrl` when it has one and by its record id otherwise. See
+     * docs/spec/identity.md § Group.
+     */
+    handle?: string;
+    /** If present, this group owns a shared collaborative stack at this URL. Absent = permission-only group. */
+    stackUrl?: string;
+};
+/**
+ * Actions that can be granted via a _grant record. The array is the source
+ * of truth — GrantAction is derived from it so runtime validation (see
+ * Stack.grantType()) can't drift from the type.
+ */
+export declare const GRANT_ACTIONS: readonly ["create", "read-own", "read-any", "update-own", "update-any", "delete-own", "delete-any"];
+export type GrantAction = (typeof GRANT_ACTIONS)[number];
+/**
+ * Who a Grant reaches. `authenticated` is any authenticated entity —
+ * narrower than a Record permission's `anyone`, which reaches anonymous
+ * requesters too, so the two tiers deliberately share no word.
+ * See docs/spec/access-control.md § Type-level grants.
+ */
+export type GrantGrantee = Grantee | {
+    kind: 'authenticated';
+};
+/**
+ * What `Stack.grantType()` and `Stack.revokeType()` take beside the type they act
+ * on — the type-level counterpart of the `AuthorityAssociation`
+ * `grantAccess()` takes beside a record id.
+ */
+export type TypeGrant = {
+    actions: GrantAction[];
+    grantee: GrantGrantee;
+};
+/**
+ * Content for _grant records: a TypeGrant pinned to the type family it
+ * applies to — a bare baseId, never a versioned TypeId.
+ */
+export type GrantContent = TypeGrant & {
+    baseId: BaseId;
+};
+/**
+ * One type-level grant an app's manifest asks for. No grantee: the app's
+ * own keys are who it reaches. See docs/spec/apps.md.
+ */
+export type InstallRequest = Omit<GrantContent, 'grantee'>;
+/**
+ * Content for _install records: what the owner approved of an app's
+ * manifest, one live record per `appId`. See docs/spec/apps.md.
+ */
+export type InstallContent = {
+    /**
+     * The software this install is for. A binding: immutable, and unique
+     * among installs, so one install answers for each app.
+     */
+    appId: AppId;
+    name: string;
+    version?: string;
+    /**
+     * Every type version the owner has approved for this app. The families
+     * they name are claimed by this install and by no other.
+     */
+    defines: TypeId[];
+    /** The grants each of the app's keys holds. */
+    requests: InstallRequest[];
+};
+/** Content for _attachment records — one per upload, tracks file metadata. */
+export type AttachmentContent = {
+    /** Content-addressed file identifier (SHA-256 hex). */
+    fileId: FileId;
+    /** MIME type of the file. */
+    mimeType: string;
+    /** File size in bytes. */
+    size: number;
+    /** Original filename, if provided at upload time. */
+    filename?: string;
+};
+/** Content for _config records — one singleton per stack, created on initialization. */
+export type ConfigContent = {
+    /**
+     * DID of the stack owner. Immutable — see docs/spec.md § The `_config`
+     * record for why ownership transfer isn't a field write.
+     */
+    entityId: EntityId;
+    /**
+     * IANA timezone string e.g. "America/New_York". Optional passthrough app
+     * metadata — nothing in core reads it for behavior, and there is no
+     * default. See docs/spec.md § The `_config` record.
+     */
+    timezone?: string;
+};
+/** Reserved system type IDs */
+export declare const SYSTEM_TYPES: {
+    readonly ENTITY: "_entity";
+    readonly APP: "_app";
+    readonly GROUP: "_group";
+    /** Creation-permission grants. See GrantContent. */
+    readonly GRANT: "_grant";
+    /** Attachment metadata records. See AttachmentContent. */
+    readonly ATTACHMENT: "_attachment";
+    /** Stack-level configuration singleton. See ConfigContent. */
+    readonly CONFIG: "_config";
+    /** An owner's approval of an app's manifest. See InstallContent. */
+    readonly INSTALL: "_install";
+};
+//# sourceMappingURL=system.d.ts.map

package/dist/types/system.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"system.d.ts","sourceRoot":"","sources":["../../src/types/system.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAExE;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B;;;;;OAKG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ,mHAAmH;IACnH,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,+BAA+B;AAC/B,MAAM,MAAM,UAAU,GAAG;IACvB;;;;;;OAMG;IACH,KAAK,EAAE,KAAK,CAAC;IACb,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,yGAAyG;IACzG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,iCAAiC;AACjC,MAAM,MAAM,YAAY,GAAG;IACzB,yHAAyH;IACzH,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4GAA4G;IAC5G,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,aAAa,qGAQhB,CAAC;AAEX,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzD;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG;IAAE,IAAI,EAAE,eAAe,CAAA;CAAE,CAAC;AAE/D;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG;IACtB,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,OAAO,EAAE,YAAY,CAAC;CACvB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG;IACrC,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;AAE3D;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B;;;OAGG;IACH,KAAK,EAAE,KAAK,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,+CAA+C;IAC/C,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B,CAAC;AAEF,8EAA8E;AAC9E,MAAM,MAAM,iBAAiB,GAAG;IAC9B,uDAAuD;IACvD,MAAM,EAAE,MAAM,CAAC;IACf,6BAA6B;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,0BAA0B;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,qDAAqD;IACrD,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,wFAAwF;AACxF,MAAM,MAAM,aAAa,GAAG;IAC1B;;;OAGG;IACH,QAAQ,EAAE,QAAQ,CAAC;IACnB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,+BAA+B;AAC/B,eAAO,MAAM,YAAY;;;;IAIvB,oDAAoD;;IAEpD,0DAA0D;;IAE1D,8DAA8D;;IAE9D,oEAAoE;;CAE5D,CAAC"}

package/dist/types/system.js

@@ -0,0 +1,32 @@
+/**
+ * Content shapes for the reserved `_`-prefixed system types.
+ */
+/**
+ * Actions that can be granted via a _grant record. The array is the source
+ * of truth — GrantAction is derived from it so runtime validation (see
+ * Stack.grantType()) can't drift from the type.
+ */
+export const GRANT_ACTIONS = [
+    'create',
+    'read-own',
+    'read-any',
+    'update-own',
+    'update-any',
+    'delete-own',
+    'delete-any',
+];
+/** Reserved system type IDs */
+export const SYSTEM_TYPES = {
+    ENTITY: '_entity',
+    APP: '_app',
+    GROUP: '_group',
+    /** Creation-permission grants. See GrantContent. */
+    GRANT: '_grant',
+    /** Attachment metadata records. See AttachmentContent. */
+    ATTACHMENT: '_attachment',
+    /** Stack-level configuration singleton. See ConfigContent. */
+    CONFIG: '_config',
+    /** An owner's approval of an app's manifest. See InstallContent. */
+    INSTALL: '_install',
+};
+//# sourceMappingURL=system.js.map

package/dist/types/system.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"system.js","sourceRoot":"","sources":["../../src/types/system.ts"],"names":[],"mappings":"AAAA;;GAEG;AAmEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,QAAQ;IACR,UAAU;IACV,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,YAAY;IACZ,YAAY;CACJ,CAAC;AAoFX,+BAA+B;AAC/B,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,MAAM,EAAE,SAAS;IACjB,GAAG,EAAE,MAAM;IACX,KAAK,EAAE,QAAQ;IACf,oDAAoD;IACpD,KAAK,EAAE,QAAQ;IACf,0DAA0D;IAC1D,UAAU,EAAE,aAAa;IACzB,8DAA8D;IAC9D,MAAM,EAAE,SAAS;IACjB,oEAAoE;IACpE,OAAO,EAAE,UAAU;CACX,CAAC"}

package/dist/types/tokens.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Bearer-token issuance and lookup for server implementations.
+ */
+import type { EntityId, Actor } from './ids.js';
+/**
+ * The two identities a token establishes — an Actor whose `principalId` is
+ * always populated, equal to `subjectId` on an undelegated token, so a
+ * server reading one never has to default it. Passes to `Stack.asActor()`
+ * as is. See docs/spec/access-control.md § Delegation: principal and subject.
+ */
+export type TokenSession = Actor & {
+    principalId: EntityId;
+};
+export type TokenInfo = TokenSession & {
+    id: string;
+    label?: string;
+    createdAt: Date;
+    expiresAt?: Date;
+};
+/**
+ * Bearer-token issuance and lookup for servers — standalone, not a slot on
+ * StackAdapter. createToken() trusts its caller: the handshake verifies the
+ * principal's DID first, and a differing `subjectId` is asserted by the
+ * owner out of band. Store tokens outside the portable stack file.
+ * See docs/spec/wire-format.md § Authentication.
+ */
+export interface StackTokenStore {
+    createToken(actor: Actor, opts?: {
+        label?: string;
+        expiresAt?: Date;
+    }): Promise<{
+        id: string;
+        token: string;
+    }>;
+    lookupToken(token: string): Promise<TokenSession | null>;
+    listTokens(): Promise<TokenInfo[]>;
+    revokeToken(id: string): Promise<void>;
+}
+//# sourceMappingURL=tokens.d.ts.map

package/dist/types/tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/types/tokens.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC;AAEhD;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,KAAK,GAAG;IACjC,WAAW,EAAE,QAAQ,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG,YAAY,GAAG;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,CAAC,EAAE,IAAI,CAAC;CAClB,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,WAAW,CACT,KAAK,EAAE,KAAK,EACZ,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,IAAI,CAAA;KAAE,GAC1C,OAAO,CAAC;QACT,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;KACf,CAAC,CAAC;IACH,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IACzD,UAAU,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IACnC,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxC"}

package/dist/types/tokens.js

@@ -0,0 +1,5 @@
+/**
+ * Bearer-token issuance and lookup for server implementations.
+ */
+export {};
+//# sourceMappingURL=tokens.js.map

package/dist/types/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/types/tokens.ts"],"names":[],"mappings":"AAAA;;GAEG"}

package/dist/validate.d.ts

@@ -1,17 +1,21 @@
 /**
- * Stack — Content Validation
+ * Stack — Content and Schema Validation
  * -------------------------------------------------------
- * Validates a Record's content object against a TypeSchema.
- * Returns a list of validation errors — empty means valid.
+ * Validates a Record's content object against a TypeSchema, and a
+ * TypeSchema itself before it is defined — including the field-name rules
+ * both share, so no stored name is one a content filter cannot address.
+ * Every check returns a list of validation errors — empty means valid.
  *
  * Validates recursively for array and object field kinds.
  * Coercion is never performed — types must match exactly.
  */
-import type { TypeSchema } from './types.js';
+import type { TypeSchema } from './types/index.js';
 export type ValidationError = {
     path: string;
     message: string;
 };
+/** Shared by the 422 for a value outside the list and the 409 for removed values. */
+export declare const formatEnumValues: (values: readonly string[]) => string;
 /**
  * Validate content against a schema, collecting all errors.
  * @param content  - The record's content object
@@ -28,23 +32,11 @@ export declare const validateContent: (content: Record<string, unknown>, schema:
  */
 export declare const dropAbsentFields: (content: Record<string, unknown>, schema: TypeSchema) => Record<string, unknown>;
 /**
- * Content keys that name JavaScript's object machinery rather than a
- * field. Undeclared content fields are allowed by design, so without this
- * they reach `merged[key] = value` in applyMergePatch — where `__proto__`
- * invokes the prototype setter instead of setting a field.
- *
- * That is not a prototype-pollution gadget today: JSON.stringify writes
- * only own-enumerable properties, so a reassigned prototype never reaches
- * storage, and JSON.parse recreates `__proto__` as an own property rather
- * than invoking the setter, so a stored one round-trips inertly. The
- * defect is that the two write paths disagree — a merge patch to
- * `__proto__` silently vanishes, while the same key through create()
- * stores as an ordinary field — and that a future refactor deepening the
- * shallow merge would turn a quiet inconsistency into a real one.
- *
- * Rejecting is more honest than skipping: a caller who sends one of these
- * finds out, rather than watching a write appear to succeed and do
- * nothing. See docs/spec/data-model.md § Reserved content keys.
+ * Content keys naming JavaScript's object machinery rather than a field.
+ * Whether one survives a write would depend on how the code setting it was
+ * written — assignment drops `__proto__`, JSON.parse keeps it — so all
+ * three are refused at the write, and the caller finds out.
+ * See docs/spec/data-model.md § Reserved content keys.
  */
 export declare const RESERVED_CONTENT_KEYS: readonly string[];
 /**
@@ -52,61 +44,33 @@ export declare const RESERVED_CONTENT_KEYS: readonly string[];
  * property, so it reaches none of the machinery above.
  */
 export declare const validateReservedKeys: (content: Record<string, unknown>) => ValidationError[];
+export declare const isPlainObject: (value: unknown) => value is Record<string, unknown>;
 /**
- * Check that a schema is actually a schema, before anything reads it as
- * one. `defineType()` takes a TypeSchema, but a schema off the wire is
- * parsed JSON that TypeScript never saw, so every shape below is reachable
- * at runtime: a container declaring neither its interior nor `open` throws
- * out of hashSchema() rather than reporting anything, and a definition with
- * an unknown `kind` — or none — defines a field whose every write fails
- * against an expectation the schema never actually stated, sending the
- * caller looking through their content for a bug that is in their type.
- *
- * Refused at definition time for the reason a field name no filter could
- * address is: a schema is a promise, and one nothing can satisfy is worth
- * catching where it is written. See docs/spec/data-model.md § Types.
+ * Check that a schema is a schema before anything reads it as one: off the
+ * wire it is JSON TypeScript never saw. A container declaring neither its
+ * interior nor `open` would throw out of hashSchema(), and an unknown `kind`
+ * would define a field every write fails. See docs/spec/data-model.md § Types.
  */
 export declare const validateSchemaShape: (schema: unknown, prefix?: string, errors?: ValidationError[], depth?: number) => ValidationError[];
 /**
- * The same three names, refused where a schema declares them. Top-level
- * only, exactly matching the content rule's scope above: a nested
- * declaration names a field a record can actually carry, so refusing one
- * would deny a writable shape.
- *
- * A declaration cannot license what the content rule refuses, so accepting
- * one would define a field no record could ever hold — and, where the
- * declaration is `required`, a type no record could satisfy at all: supply
- * the field and the write is refused as a reserved key, omit it and the
- * write is refused as a missing required field. Refused at definition time
- * for the reason a field name no filter could address is
- * (validateSchemaFieldNames): a schema is a promise that a field is
- * meaningful. See docs/spec/data-model.md § Reserved content keys.
+ * The same names, refused where a schema declares them, top-level only like
+ * the content rule. A declaration cannot license what that rule refuses, so
+ * it would define a field no record could hold — and if `required`, a type
+ * no record could satisfy. See docs/spec/data-model.md § Reserved content keys.
  */
 export declare const validateSchemaReservedNames: (schema: TypeSchema) => ValidationError[];
 /**
- * `undefined` is not a value a merge patch can carry: `null` is the
- * deletion sentinel, JSON drops the key on the way to storage, and the
- * presence checks a patch runs through read the key as a claim on the
- * field it names. Top-level only, matching the shallow merge — a nested
- * one is part of a value being replaced wholesale.
+ * `undefined` is not a value a merge patch can carry: `null` deletes, JSON
+ * drops the key, and the presence checks read the key as a claim on its
+ * field. Top-level only, matching the shallow merge.
  * See docs/spec/data-model.md § Undefined values in a patch.
  */
 export declare const validatePatchValues: (patch: Record<string, unknown>) => ValidationError[];
 /**
- * Characters a content field name may not contain, because a content
- * filter key is a dot-separated path: `{ content: { 'emails.value': x } }`
- * addresses `value` inside `emails`. A field literally named `emails.value`
- * would make that filter mean two things at once, so the ambiguity is
- * removed from the write side — where it is a validation error a caller
- * can act on — rather than from the query side, where it would need an
- * escape convention that silently misreads when a caller forgets it.
- *
- * Wider than what SQLite's JSON path grammar treats as syntax today (`.`,
- * `[`, `]`, `$`, `"`): `*` and `#` are reserved against a path grammar
- * that grows a wildcard or a last-element form. Narrowing a legal charset
- * is a one-way door, so the cost of reserving a character now is nothing
- * and the cost of reserving it later is every stored record.
- *
+ * Characters a field name may not contain: a filter key is a dot-separated
+ * path, so a field named `emails.value` would make one filter mean two
+ * things. `*` and `#` are reserved ahead of the path grammar, as narrowing
+ * a legal charset later costs every stored record.
  * See docs/spec/data-model.md § Content field names.
  */
 export declare const CONTENT_KEY_PATH_METACHARACTERS: readonly [".", "[", "]", "$", "\"", "*", "#"];
@@ -124,9 +88,4 @@ export declare const validateContentKeys: (content: Record<string, unknown>) =>
  * their own beyond the object properties nested under them.
  */
 export declare const validateSchemaFieldNames: (schema: TypeSchema, prefix?: string, errors?: ValidationError[], depth?: number) => ValidationError[];
-/**
- * Returns true if the content is valid against the schema.
- * Use validateContent() directly to get error details.
- */
-export declare const isValid: (content: Record<string, unknown>, schema: TypeSchema) => boolean;
 //# sourceMappingURL=validate.d.ts.map

package/dist/validate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,UAAU,EAA6B,MAAM,YAAY,CAAC;AAmBxE,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAyKF;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,GAC1B,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,QAAQ,UAAU,EAClB,eAAW,EACX,SAAQ,eAAe,EAAO,EAC9B,cAAS,KACR,eAAe,EAsCjB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,GAC3B,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,QAAQ,UAAU,KACjB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAyC,CAAC;AA8BnE;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAA8C,CAAC;AAElG;;;GAGG;AACH,eAAO,MAAM,oBAAoB,GAAI,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,eAAe,EAIlF,CAAC;AAqHN;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,mBAAmB,GAC9B,QAAQ,OAAO,EACf,eAAW,EACX,SAAQ,eAAe,EAAO,EAC9B,cAAS,KACR,eAAe,EAmBjB,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,2BAA2B,GAAI,QAAQ,UAAU,KAAG,eAAe,EAI3E,CAAC;AAEN;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,GAAI,OAAO,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,eAAe,EAM7E,CAAC;AAER;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,+BAA+B,+CAA+C,CAAC;AAE5F;;;GAGG;AACH,eAAO,MAAM,8BAA8B,wCAE1C,CAAC;AAQF,eAAO,MAAM,wBAAwB,QAAiD,CAAC;AAqCvF,wCAAwC;AACxC,eAAO,MAAM,mBAAmB,GAAI,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,eAAe,EAIrF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,GACnC,QAAQ,UAAU,EAClB,eAAW,EACX,SAAQ,eAAe,EAAO,EAC9B,cAAS,KACR,eAAe,EAkBjB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,OAAO,GAAI,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,UAAU,KAAG,OAChC,CAAC"}
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,UAAU,EAA6B,MAAM,kBAAkB,CAAC;AAmB9E,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAMF,qFAAqF;AACrF,eAAO,MAAM,gBAAgB,GAAI,QAAQ,SAAS,MAAM,EAAE,KAAG,MACZ,CAAC;AAgLlD;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,GAC1B,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,QAAQ,UAAU,EAClB,eAAW,EACX,SAAQ,eAAe,EAAO,EAC9B,cAAS,KACR,eAAe,EAqCjB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,GAC3B,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,QAAQ,UAAU,KACjB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAyC,CAAC;AA8BnE;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAA8C,CAAC;AAElG;;;GAGG;AACH,eAAO,MAAM,oBAAoB,GAAI,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,eAAe,EAIlF,CAAC;AAiBN,eAAO,MAAM,aAAa,GAAI,OAAO,OAAO,KAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CACR,CAAC;AAqGvE;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,GAC9B,QAAQ,OAAO,EACf,eAAW,EACX,SAAQ,eAAe,EAAO,EAC9B,cAAS,KACR,eAAe,EAmBjB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,GAAI,QAAQ,UAAU,KAAG,eAAe,EAI3E,CAAC;AAEN;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,GAAI,OAAO,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,eAAe,EAM7E,CAAC;AAER;;;;;;GAMG;AACH,eAAO,MAAM,+BAA+B,+CAA+C,CAAC;AAE5F;;;GAGG;AACH,eAAO,MAAM,8BAA8B,wCAE1C,CAAC;AAQF,eAAO,MAAM,wBAAwB,QAAiD,CAAC;AAqCvF,wCAAwC;AACxC,eAAO,MAAM,mBAAmB,GAAI,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,eAAe,EAIrF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,GACnC,QAAQ,UAAU,EAClB,eAAW,EACX,SAAQ,eAAe,EAAO,EAC9B,cAAS,KACR,eAAe,EAkBjB,CAAC"}