@haverstack/core 0.40.0 → 0.42.0

package/dist/record-id.js

@@ -1,127 +0,0 @@
-/**
- * Record ID and clock-field validation
- * -------------------------------------------------------
- * The rules a caller-supplied `id`, `parentId`, `createdAt` or `updatedAt`
- * is held to before any of them reaches storage. A client may mint its own
- * id and backdate a record's clock, so both are untrusted input here even
- * when the types say otherwise.
- *
- * See docs/spec/data-model.md § Record IDs.
- */
-import { isValidIdFormat, idTimestamp, MAX_ID_TIMESTAMP } from './id.js';
-import { StackBadRequestError, StackValidationError } from './errors.js';
-// -------------------------------------------------------
-// Record ID validation
-// -------------------------------------------------------
-const RESERVED_ID_PREFIX = '_';
-export const DEFAULT_ID_TIMESTAMP_SKEW_MS = 24 * 60 * 60 * 1000;
-/**
- * The same format rule applied to a `parentId` a caller names. Separate
- * from validateRecordId() only for its message: the id under discussion is
- * the destination, not the record being written, and a shared message would
- * report the wrong one. See docs/spec/data-model.md § Reparenting.
- */
-export function validateParentId(parentId) {
-    if (parentId.startsWith(RESERVED_ID_PREFIX)) {
-        throw new StackBadRequestError(`Invalid parentId "${parentId}": uses the reserved "${RESERVED_ID_PREFIX}" prefix.`);
-    }
-    if (!isValidIdFormat(parentId)) {
-        throw new StackBadRequestError(`Invalid parentId "${parentId}": expected 12 lowercase Crockford base-32 characters.`);
-    }
-}
-/**
- * Format and reserved-prefix checks — full-trust context (Stack.create()).
- * Checked before the format check: the Crockford charset already excludes
- * "_", so a reserved-looking id (e.g. "_config") would otherwise just fail
- * as a generic format error instead of a specific, actionable one.
- *
- * Throws StackBadRequestError, not StackValidationError: a malformed id is
- * structurally bad input the request never gets past — it doesn't reach
- * type-schema validation — the same reasoning that makes an undecodable
- * pagination cursor a StackBadRequestError rather than a content-validation
- * failure. See StackBadRequestError's doc comment.
- */
-export function validateRecordId(id) {
-    if (id.startsWith(RESERVED_ID_PREFIX)) {
-        throw new StackBadRequestError(`ID "${id}" uses the reserved "${RESERVED_ID_PREFIX}" prefix.`);
-    }
-    if (!isValidIdFormat(id)) {
-        throw new StackBadRequestError(`Invalid ID "${id}": expected 12 lowercase Crockford base-32 characters.`);
-    }
-}
-/**
- * Validity and range check for the backdating options on unscoped
- * Stack.create(). A Date is only as good as what the caller parsed it
- * from, and the two failure modes both need catching here rather than
- * downstream:
- *
- * - **Invalid Date** (`new Date('13/45/2020')` off a malformed import row)
- *   has a NaN getTime(), and every comparison against NaN is false — so an
- *   unchecked Invalid Date passes the updatedAt/createdAt ordering check
- *   and the id/createdAt skew check by turning them off, mints the
- *   epoch-zero ID `000000000xxx`, and persists a record whose
- *   `createdAt.toISOString()` throws RangeError in serializeRecord() —
- *   making that record, and any wire response containing it,
- *   permanently unreadable.
- * - **Out of encodable range** — before 1970 crockford32Encode() throws a
- *   bare RangeError from deep inside the ID encoder, and past
- *   MAX_ID_TIMESTAMP the derived ID silently grows to 13 characters and
- *   fails isValidIdFormat().
- *
- * Checked at the door for both, as a StackValidationError naming the
- * field. Applies whether or not an `id` is supplied: a clock field outside
- * this range is unrepresentable regardless of where the ID came from.
- */
-export function validateClockField(value, path) {
-    if (value === undefined)
-        return [];
-    // Type-checked callers always pass a Date, but this option is
-    // reachable from the wire: JSON has no Date, so a server that forwards a
-    // parsed `POST /records` body hands us the ISO *string* it deserialized.
-    // Without this the very next line is `"2020-…".getTime()` — an unhandled
-    // TypeError, a 500 where the caller should have got a 400 naming the
-    // field.
-    if (!(value instanceof Date)) {
-        return [{ path, message: `${path} must be a Date.` }];
-    }
-    const ms = value.getTime();
-    if (Number.isNaN(ms)) {
-        return [{ path, message: `${path} is not a valid Date.` }];
-    }
-    if (ms < 0 || ms > MAX_ID_TIMESTAMP) {
-        return [
-            {
-                path,
-                message: `${path} is outside the representable range ` +
-                    `(1970-01-01T00:00:00.000Z…${new Date(MAX_ID_TIMESTAMP).toISOString()}).`,
-            },
-        ];
-    }
-    return [];
-}
-/**
- * Timestamp-prefix plausibility check, shared by callers that compare an
- * ID's embedded millisecond against a different reference each:
- * ScopedStack.create() against the current time for any non-backdated
- * create (a grantee is untrusted and could otherwise mint an ID that
- * forges its sort position, and this is the one check standing between a
- * delegated or grantee caller and doing so), and Stack.create() — reached
- * directly when unscoped, or via ScopedStack.create() when the requester
- * is the owner acting alone with an explicit `createdAt` — against that
- * `createdAt` instead (the two must agree, not silently diverge — see
- * docs/spec/data-model.md § Record IDs). Pass null to disable.
- */
-export function validateIdTimestampSkew(id, toleranceMs, referenceMs, referenceLabel) {
-    if (toleranceMs === null)
-        return;
-    const skew = Math.abs(referenceMs - idTimestamp(id));
-    if (skew > toleranceMs) {
-        throw new StackValidationError([
-            {
-                path: 'id',
-                message: `ID "${id}" timestamp disagrees with ${referenceLabel} by more than the allowed clock-skew tolerance (${toleranceMs}ms).`,
-            },
-        ]);
-    }
-}
-//# sourceMappingURL=record-id.js.map

package/dist/record-id.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"record-id.js","sourceRoot":"","sources":["../src/record-id.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAGzE,0DAA0D;AAC1D,uBAAuB;AACvB,0DAA0D;AAE1D,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAC/B,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEhE;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,IAAI,QAAQ,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,oBAAoB,CAC5B,qBAAqB,QAAQ,yBAAyB,kBAAkB,WAAW,CACpF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,oBAAoB,CAC5B,qBAAqB,QAAQ,wDAAwD,CACtF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAAU;IACzC,IAAI,EAAE,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,oBAAoB,CAAC,OAAO,EAAE,wBAAwB,kBAAkB,WAAW,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,oBAAoB,CAC5B,eAAe,EAAE,wDAAwD,CAC1E,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAuB,EAAE,IAAY;IACtE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnC,8DAA8D;IAC9D,yEAAyE;IACzE,yEAAyE;IACzE,yEAAyE;IACzE,qEAAqE;IACrE,SAAS;IACT,IAAI,CAAC,CAAC,KAAK,YAAY,IAAI,CAAC,EAAE,CAAC;QAC7B,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,kBAAkB,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;IAC3B,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;QACrB,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,uBAAuB,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,gBAAgB,EAAE,CAAC;QACpC,OAAO;YACL;gBACE,IAAI;gBACJ,OAAO,EACL,GAAG,IAAI,sCAAsC;oBAC7C,6BAA6B,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC,WAAW,EAAE,IAAI;aAC5E;SACF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB,CACrC,EAAU,EACV,WAA0B,EAC1B,WAAmB,EACnB,cAAsB;IAEtB,IAAI,WAAW,KAAK,IAAI;QAAE,OAAO;IACjC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IACrD,IAAI,IAAI,GAAG,WAAW,EAAE,CAAC;QACvB,MAAM,IAAI,oBAAoB,CAAC;YAC7B;gBACE,IAAI,EAAE,IAAI;gBACV,OAAO,EAAE,OAAO,EAAE,8BAA8B,cAAc,mDAAmD,WAAW,MAAM;aACnI;SACF,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/dist/scoped-stack.d.ts

@@ -1,532 +0,0 @@
-/**
- * ScopedStack — the permission-enforcing view
- * -------------------------------------------------------
- * A `Stack` answers every question; a `ScopedStack` answers only the ones a
- * particular requester is entitled to. It wraps a Stack rather than an
- * adapter, so every invariant the Stack layer holds is already in force by
- * the time a check here runs, and the gates below only ever narrow.
- *
- * Two identities, one rule: **the principal governs authority, the subject
- * governs attribution.** Both are DIDs and both are often equal, which is
- * what makes them easy to confuse — so the split is stated on every gate
- * that depends on it.
- *
- * Also holds the feed side of the same rule: a subscription's deliveries
- * run through the same canRead() a get() answers with, so a feed can never
- * disagree with a read about what a session sees.
- *
- * See docs/spec/access-control.md and docs/spec/events.md § Permission scoping.
- */
-import { ChangeEmitter } from './changes.js';
-import type { PutAttachmentOptions, AssociationEdit, AttachmentContent, AuthorityAssociation, DataAssociation, EntityId, FileId, QueryResult, RecordChange, RecordId, RecordVersion, RecordJournalEntry, JournalQuery, VersionsQuery, StackAdapter, StackCapabilities, IfVersionOptions, StackQuery, StackRecord, SubscribeOptions, TypeId, Unsubscribe, RecordChangeSet } from './types.js';
-import type { ContentOf, PatchOf, ReadonlyTypeSchema, TypedChange, TypedChangeSet, TypedQuery, TypedSubscribeOptions, TypedRecord, TypeHandle } from './type-handle.js';
-import type { Stack, BackdatableCreateRecordOptions, CollectAttachmentGarbageOptions, CollectAttachmentGarbageResult, DeleteAndReturnResult, DeleteRecordOptions, DeleteResult, GetRecordOptions, StackClient } from './stack.js';
-/**
- * Held by Stack alone: the index re-exports ScopedStack but not this, so
- * asEntity()/asActor() stay the only way to one, and the actor
- * normalization and open-check they run can't be skipped.
- */
-export declare const scopeToken: unique symbol;
-/** Everything a ScopedStack borrows from the Stack that scoped it. */
-export type ScopedStackInit = {
-    stack: Stack;
-    principalId: EntityId | null;
-    subjectId: EntityId | null;
-    idTimestampSkewMs: number | null;
-    /**
-     * Bytes-storage primitive for putAttachment(), which composes bytes with
-     * its own create() so the record carries the subject and principal as
-     * `createdBy` — neither of which the adapter-level atomic capability takes.
-     */
-    adapter: StackAdapter;
-    /** The stack's own unfiltered stream, which subscribe() narrows. */
-    changes: ChangeEmitter;
-    assertOpen: () => void;
-    /** Whether changes reach the stack from elsewhere — see subscribe(). */
-    relaysChanges: boolean;
-};
-/**
- * A permission-enforcing view of a Stack for a single (principal, subject)
- * pair, obtained via `stack.asEntity(entityId)`. A record the request
- * cannot read answers exactly as a missing one does — null on reads,
- * StackNotFoundError on the verbs that name one — so only a requester who
- * could have read it is told a refusal was about access.
- * See docs/spec/disclosure.md § Which refusal a Record answers with.
- *
- * Which identity each gate keys on follows the module comment's rule.
- * Grant lookup and the privilege-bearing gates no grant reaches
- * (resharing, group management, purge, widening access at create
- * time) key on `principalId`; authorship, `-own` matching,
- * record-level permission resolution and "files I uploaded" lookups key on
- * `subjectId`. Unconditional owner access splits the same way: an
- * owner subject resolves past every permission check, an owner principal
- * is not bounded by grants, and under delegation both halves apply.
- */
-export declare class ScopedStack implements StackClient {
-    #private;
-    private readonly stack;
-    private readonly idTimestampSkewMs;
-    private readonly adapter;
-    private readonly changes;
-    private readonly assertStackOpen;
-    private readonly relaysChanges;
-    /** Not callable from outside the package — see ScopedStackInit. */
-    constructor(token: typeof scopeToken, init: ScopedStackInit);
-    /**
-     * The identity whose authority this view acts with; `null` when
-     * anonymous. See docs/spec/access-control.md § Delegation: principal and subject.
-     */
-    get principalId(): EntityId | null;
-    /**
-     * The identity this view acts for and attributes writes to; `null` when
-     * anonymous. Equal to `principalId` unless an app is acting for a user.
-     */
-    get subjectId(): EntityId | null;
-    get capabilities(): StackCapabilities;
-    private resolveRecord;
-    /** Every `_grant` Record — see loadGrantRecords(). */
-    private loadGrants;
-    /** Whether a delegated app is acting for someone other than itself. */
-    private get delegated();
-    /**
-     * Whether any grant could name this request — the one question every
-     * prefetch asks before scanning the `_grant` family, since an anonymous
-     * requester is reached by none. Both identities are read: `asEntity()`
-     * refuses an anonymous principal acting for a subject, so they are null
-     * together, and saying so costs nothing.
-     */
-    private get identified();
-    /**
-     * Who this request is, for stamping onto whatever it mutates. Attribution
-     * follows record-level authorship: the subject is the actor, and the
-     * principal is named beside it only when the two differ.
-     * See docs/spec/data-model.md § Authorship and attribution.
-     */
-    private get requester();
-    private get actor();
-    /**
-     * Whether unconditional owner authority applies — the owner acting as
-     * itself. The verbs that rest on it are irreversible or disclose the
-     * sharing graph, so delegation never carries one to a subject, whichever
-     * side the owner is on. Shared with the predicate a server applies to a
-     * session, which decides the same tier one step earlier. See
-     * docs/spec/access-control.md § Delegation: principal and subject.
-     */
-    private get ownerActingAlone();
-    /** Refuse anything but the owner acting as itself — see ownerActingAlone. */
-    private requireOwnerActingAlone;
-    private checkRead;
-    private checkWrite;
-    /**
-     * Whether `grantee` holds a _grant covering one of `actions` for the
-     * type's family (grants match by baseId, so a version bump never orphans
-     * one). -own actions additionally require the author to be `grantee`,
-     * unless `matchOwn` is false — on the principal side of a delegated
-     * request the suffix reads as the bare verb, since which records are
-     * reachable is the subject's business. `allowDefault` decides whether a
-     * grant naming nobody counts.
-     *
-     * Reached only through subjectAllows()/principalAllows(), which fix those
-     * two flags per side. Call one of those instead.
-     */
-    private hasGrant;
-    /**
-     * The principal half of a delegated request's authority: does the app
-     * hold any grant permitting these verbs on this type at all. Bounds what
-     * the subject's own authority can reach through it, so a powerful app
-     * can never lend its reach to a weaker subject — nor the reverse.
-     * Vacuously true when there's no delegation, where the principal and
-     * subject checks would be the same question asked twice.
-     *
-     * Neither default nor group-targeted grants count here. "Any
-     * authenticated entity" is about people who turn up, not software the
-     * owner installed; and a roster is editable by any of the group's admins,
-     * so authority reaching a principal through one would let someone other
-     * than the owner name an app to a type.
-     */
-    private principalAllows;
-    /**
-     * The subject half: which records are reachable, answered with `-own`
-     * matching and default grants both in force — the ordinary reading of a
-     * grant, since the subject is the entity a grant is written about.
-     *
-     * Paired with principalAllows() so that the two halves of the
-     * intersection are the only callers of hasGrant(): its flags differ per
-     * side and mean nothing on their own, so no call site sets them by hand.
-     */
-    private subjectAllows;
-    /**
-     * How to refuse a record this request addressed by ID. A requester who
-     * can read the record is told it exists and the verb was refused;
-     * everyone else is told what a missing ID is told, so no one learns an ID
-     * is live who could not have learned it by reading. `message` therefore
-     * only ever reaches someone holding the record already.
-     * See docs/spec/disclosure.md § Which refusal a Record answers with.
-     */
-    private denialFor;
-    private canRead;
-    private checkCreateGrant;
-    /**
-     * `_group` records are managed, not merely written: only the owner or an
-     * `admin` roster holder may mutate them — ordinary write permissions and
-     * grants don't apply. Asked of both identities under delegation, like
-     * a reshare. See docs/spec/identity.md § Group.
-     */
-    private isGroupManager;
-    /** Whether one identity, on its own, manages `record` — see isGroupManager(). */
-    private managesGroup;
-    /**
-     * Fetch a record the subject can reach and the principal holds `update` on
-     * (via permissions or an update grant), or throw. `mutating: false` marks
-     * the history readers, which borrow this gate without changing anything —
-     * the one way through it a `_grant` Record stays open to.
-     */
-    private requireUpdatable;
-    /**
-     * The write gate both requireUpdatable() and requireDeletable() are: the
-     * subject can reach the record (record-level permission or a grant) and
-     * the principal holds the same verb, intersected — or, for a `_group`, the
-     * stricter management rule that no grant reaches.
-     * See docs/spec/access-control.md § Delegation: principal and subject.
-     */
-    private requireVerb;
-    /**
-     * Fetch a record the subject can reach and the principal holds `delete` on
-     * (via permissions or a delete grant), or throw.
-     */
-    private requireDeletable;
-    /**
-     * Whether this request may reference `recordId` (as a parentId or
-     * relationship target). Missing and unreadable both return false —
-     * indistinguishable, so this can't probe for a record's existence.
-     *
-     * The owner acting alone passes without the lookup: there is no record in
-     * their own stack they may not read, so the gate could only refuse them
-     * for absence — which is `Stack`'s to answer, with a conflict that names
-     * the problem. See docs/spec/access-control.md § Reference-creation gating.
-     */
-    private canReadReferent;
-    /**
-     * Whether this request can read some record referencing `fileId` —
-     * shared by canAccessFile() and the non-owner _attachment@1 create()
-     * carve-out, which deliberately excludes the uploader clause.
-     * `_attachment@1` records never match: the carve-out has to be satisfied
-     * by some *other* record referencing the file, or one successful guess
-     * would unlock unlimited further metadata records for the same fileId.
-     * See docs/spec/attachments.md § Creating `_attachment@1` records directly.
-     */
-    private hasReadableReference;
-    /**
-     * Whether this request may reference or download `fileId` — the dual of
-     * getAttachment()'s access rule. Nonexistent and inaccessible are
-     * indistinguishable (both false), so no confirmation oracle for guessed
-     * hashes. See docs/spec/access-control.md § Reference-creation gating.
-     */
-    private canAccessFile;
-    /** Names of the type's top-level file-ref fields — the content-reference half of referencesFileId matching. */
-    private fileRefFieldNames;
-    /**
-     * Gates file-ref content fields on file access, mirroring the
-     * attachment-association gate — a file-ref field conveys attachment
-     * access exactly like an `attachment` association. Only fields present
-     * in `content` are checked (a content patch is a merge patch; untouched fields
-     * carry no new reference).
-     */
-    private requireFileRefAccess;
-    /**
-     * Reference-creation gate for one association: `attachment` requires
-     * file access, and a `relationship` naming a record in this stack
-     * requires read access to it. `tag` is unchecked, and `_group` roster
-     * associations are gated by the stricter isGroupManager() instead.
-     *
-     * The other target arms are ungated because the gate's purpose —
-     * refusing a reference that would convey access to, or confirm the
-     * existence of, an unreadable record — has nothing to bite on: core
-     * never resolves them, so no access flows through one.
-     * See docs/spec/access-control.md § Reference-creation gating.
-     */
-    private requireAssociationAccess;
-    /**
-     * Create a record on behalf of the subject: create grant required,
-     * anonymous denied, `createdBy` set to the requester, client IDs skew-checked,
-     * reference-creating options gated, and non-owner `_attachment@1`
-     * creation refused save one carve-out. A scoped create always stamps
-     * authorship — an absent `createdBy` means an unscoped `Stack` wrote it.
-     * `createdAt`/`updatedAt` are refused to everyone but the owner acting
-     * alone, rather than dropped, so an app never believes it published
-     * something it didn't. See docs/spec/access-control.md and
-     * docs/spec/data-model.md § Record IDs.
-     */
-    create<S extends ReadonlyTypeSchema>(handle: TypeHandle<S>, content: ContentOf<S>, opts?: BackdatableCreateRecordOptions): Promise<TypedRecord<S>>;
-    create<T extends Record<string, unknown> = Record<string, unknown>>(typeId: TypeId, content: T, opts?: BackdatableCreateRecordOptions): Promise<StackRecord & {
-        content: T;
-    }>;
-    /**
-     * Whether this request may decide who else reaches a record — the rule
-     * a reshare enforces, asked at create time too so the reach it
-     * withholds can't be taken one step earlier while authoring. A delegated
-     * app is denied it: widening access is the one thing containment most
-     * needs to hold. Refused rather than silently ignored, so an app never
-     * believes it published something it didn't. Not `ownerActingAlone`:
-     * the record is the subject's own, so an owner principal grants it no
-     * reach the subject lacks.
-     * See docs/spec/access-control.md § Delegation: principal and subject.
-     */
-    private mayGrantAccess;
-    /**
-     * Whether one identity, on its own, may decide who else reaches `record`
-     * — the owner-or-creator rule a reshare enforces, asked of one
-     * side at a time. See
-     * docs/spec/access-control.md § Delegation: principal and subject.
-     */
-    private mayReshare;
-    /**
-     * A record this request may read, or null. Never throws
-     * StackPermissionError: an unreadable record answers exactly as a missing
-     * one does, so a caller learns only what it may read.
-     * See docs/spec/disclosure.md § Which refusal a Record answers with.
-     */
-    get<S extends ReadonlyTypeSchema>(handle: TypeHandle<S>, id: RecordId): Promise<TypedRecord<S> | null>;
-    get(id: RecordId, opts?: GetRecordOptions): Promise<StackRecord | null>;
-    /**
-     * Runs through this.query(), so canRead() still applies — this answers a
-     * question the caller asks on its own behalf. includeUnlisted is passed
-     * only when the request is the owner acting alone, per
-     * docs/spec/identity.md § DID bindings.
-     */
-    getEntityByDid(did: EntityId): Promise<StackRecord | null>;
-    getOwnerEntity(): Promise<StackRecord | null>;
-    /**
-     * Query records, filtered to those this request can read. Pages are
-     * filtered then refilled, so a page may slightly overshoot `limit` but
-     * never skips a record. Grants are prefetched once, cursor-walked to
-     * exhaustion.
-     */
-    query<S extends ReadonlyTypeSchema>(handle: TypeHandle<S>, query?: TypedQuery): Promise<{
-        records: TypedRecord<S>[];
-        cursor: string | null;
-    }>;
-    query(query?: StackQuery): Promise<QueryResult>;
-    /**
-     * Apply a change set on behalf of the subject. Authority is resolved
-     * **per key** and every gate reads the record as it stands, never as the
-     * change set would leave it: a widened `permissions` never satisfies the
-     * read check on a `parentId` named in the same call, and a `_group`
-     * roster never satisfies the admin check that same call has to pass.
-     * One refused key refuses the whole call, so nothing is partially
-     * applied and no key is silently dropped.
-     * See docs/spec/access-control.md § Composing a change set.
-     */
-    mutate<S extends ReadonlyTypeSchema>(handle: TypeHandle<S>, id: RecordId, changes: TypedChangeSet<S>, opts?: IfVersionOptions): Promise<TypedRecord<S>>;
-    mutate(id: RecordId, changes: RecordChangeSet, opts?: IfVersionOptions): Promise<StackRecord>;
-    patchContent<S extends ReadonlyTypeSchema>(handle: TypeHandle<S>, id: RecordId, patch: PatchOf<S>, opts?: IfVersionOptions): Promise<TypedRecord<S>>;
-    patchContent(id: RecordId, patch: Record<string, unknown | null>, opts?: IfVersionOptions): Promise<StackRecord>;
-    /**
-     * The record, having established that this request may decide who else
-     * reaches it — the owner-or-creator rule, asked of both sides of a
-     * delegation, or a Group's admin rule for a `_group`. The gate the
-     * `permissions` and `unlisted` keys carry, which the write bit
-     * deliberately does not confer.
-     */
-    private requireReshareable;
-    /**
-     * Whether a change set's `permissions` key actually moves the ACL. Read
-     * off the computed delta rather than the elements the caller supplied:
-     * a gate that inspected only what was named would miss the wholesale
-     * replacement that drops everything, which names nothing at all. Any
-     * add, remove or repoint in either direction is a reshare.
-     * See docs/spec/access-control.md § Record-level permissions.
-     */
-    private permissionsMove;
-    /** The reshare decision alone, for a record already read and write-gated. */
-    private requireReshareOf;
-    /**
-     * Whether this request may decide who else reaches `record` — the
-     * decision requireReshareOf() refuses on, without the refusal, for the
-     * read paths that project on it rather than throw.
-     *
-     * A `_group` asks management, not authorship: a creator later demoted
-     * from the admin roster shouldn't retain a side door to reassign who can
-     * read or write the group record. Everything else is intersected like
-     * every other authority here, or an owner principal would carry its
-     * subject to records the subject cannot touch.
-     */
-    private canReshare;
-    /**
-     * Naming the software behind a key is the trust decision the `_app`
-     * registry exists to record, so both halves of that binding — `did` and
-     * `appId` — belong to the owner alone. Without this, record-level `write`
-     * on a card would be a second way in: one carrying no DID yet could be
-     * pointed at a write-holder's own key, or relabelled to claim another
-     * app's `appId`. `name` and `version` stay writable — display, not lookup.
-     *
-     * Owner *acting alone*, in both directions, or the same route reopens
-     * from the subject's side. `_entity` deliberately does not get this rule:
-     * naming people is what a contacts app does, so its cards stay writable
-     * by grant. See docs/spec/identity.md § DID bindings.
-     */
-    private requireOwnerForAppIdentity;
-    /**
-     * A self-reported `appId` must agree with the `_app` card naming the
-     * principal's DID, where the owner registered one: `principalId` is
-     * verified, so letting the pair disagree would leave a verified principal
-     * claiming a name the owner gave different software. A principal with no
-     * card keeps `appId` as the bare self-report it is for every undelegated
-     * writer. See docs/spec/identity.md § Attribution and what can be trusted.
-     */
-    private requireAppIdMatchesPrincipal;
-    /**
-     * The owner's own DID is the one `_entity` binding a grantee may not claim.
-     * `ownerProfile` adopts whichever card holds it, so a card minted by
-     * someone else becomes the stack's own profile, and uniqueness then makes
-     * that permanent. Every other DID stays open to a contacts app, which is
-     * the reach `_entity` is grantable for.
-     * See docs/spec/identity.md § DID bindings.
-     */
-    private requireOwnerForOwnerDid;
-    /**
-     * A `_grant` Record *is* authority, so rewriting one is the escalation
-     * UNGRANTABLE_SYSTEM_TYPES refuses at evaluation, reached by editing an
-     * existing grant rather than minting a fresh one. `grantType()` and `revokeType()`
-     * live on `Stack`, never `StackClient`, so no scoped write is lost. Writes
-     * only: reading a grant Record and its history stays on the ordinary gate.
-     * See docs/spec/access-control.md § Type-level grants.
-     */
-    private requireOwnerForGrantRecord;
-    /**
-     * Gated on the write bit alone, which is why the list is held to its
-     * rules first: authority reached through this verb would be exactly the
-     * escalation the partition exists to stop, decided before any record is
-     * read so it cannot depend on who is asking.
-     */
-    associate(id: RecordId, associations: DataAssociation[]): Promise<StackRecord>;
-    /** See associate() — the same write gate, the same kind refusal. */
-    dissociate(id: RecordId, associations: DataAssociation[]): Promise<StackRecord>;
-    /**
-     * The write gate, plus the per-element reference gate on each add: what a
-     * remove names is already on the record, so it is gated by the write bit
-     * alone. See associate().
-     */
-    amendAssociations(id: RecordId, changes: AssociationEdit[], surface?: string): Promise<StackRecord>;
-    /**
-     * Extend who reaches a record — the reshare gate's own verb, on the
-     * owner-or-creator rule the `permissions` key carries. The write bit
-     * does not confer it: a write-holder who could grant would escalate to
-     * deciding who else reaches the record, which is the whole of what
-     * scoping access is for.
-     * See docs/spec/access-control.md § Record-level permissions.
-     */
-    grantAccess(id: RecordId, permissions: AuthorityAssociation[]): Promise<StackRecord>;
-    /** Withdraw elements of who reaches a record — see grantAccess(). */
-    revokeAccess(id: RecordId, permissions: AuthorityAssociation[]): Promise<StackRecord>;
-    /** The reshare gate over an edit list — see grantAccess(). */
-    amendAccess(id: RecordId, changes: AssociationEdit[], surface?: string): Promise<StackRecord>;
-    /**
-     * Purge is owner-only: it is irreversible and destroys version
-     * history, so neither the write bit nor delete-own/delete-any grants
-     * reach it, and delegation doesn't carry it either. Everyone else is
-     * limited to soft delete.
-     */
-    delete(id: RecordId, opts?: DeleteRecordOptions): Promise<DeleteResult>;
-    /**
-     * delete(), plus the record it acted on. Gated identically — the
-     * existence/visibility check that produces a 404 ahead of the 403
-     * permission gate still runs via requireDeletable() before either kind
-     * of delete, so this changes what a successful call reports, not the
-     * disclosure ordering a refused one follows.
-     */
-    deleteAndReturn(id: RecordId, opts?: DeleteRecordOptions): Promise<DeleteAndReturnResult>;
-    /**
-     * Reverse a soft delete. Gated the same as delete() — undelete is the
-     * inverse of soft delete, so granting one direction without the other
-     * would be backwards. Idempotent, per Stack.undelete().
-     */
-    undelete(id: RecordId, opts?: IfVersionOptions): Promise<StackRecord>;
-    /**
-     * History is the mutation/recovery surface, not a read surface — gated
-     * like patchContent(). Reading it changes nothing, so it is the one path
-     * the `_grant` write fence leaves alone: seeing how a Record you can
-     * already read got that way is not the escalation that fence exists to
-     * stop. See docs/spec/versioning.md § History access.
-     */
-    getVersions(id: RecordId, query?: VersionsQuery): Promise<RecordVersion[]>;
-    /**
-     * See getVersions() — the same mutate-surface gate, for the same reason.
-     *
-     * The journal is where a Record's sharing history lives, and that half
-     * is the resharer's: a reader who could not have moved the ACL is served
-     * the `reshare` op without the elements beneath it, so the entry
-     * still names that it moved. Asked of both identities, so delegation is
-     * no route to it either. See docs/spec/journal.md § Reading it.
-     */
-    getJournal(id: RecordId, query?: JournalQuery): Promise<RecordJournalEntry[]>;
-    /** See getVersions() — the same mutate-surface gate. */
-    getVersion(id: RecordId, version: number): Promise<RecordVersion | null>;
-    /**
-     * Re-runs the reference-creation checks against the snapshot, so a
-     * restore can't re-convey access to a file the subject can no longer
-     * reach today. Only the owner acting alone is exempt: under delegation
-     * the checks resolve against the subject, which is whose reach the
-     * restore would widen. See docs/spec/versioning.md § Restore semantics.
-     */
-    restoreVersion(id: RecordId, version: number, opts?: IfVersionOptions): Promise<StackRecord>;
-    /**
-     * Commit a per-record migration — **the owner acting alone, only**, the
-     * same restriction the bulk `migrateAll()` carries by living on `Stack`.
-     *
-     * Migrate replaces `content` and `typeId` wholesale, so a grant-based
-     * version would have to re-derive every gate `create()` applies at the
-     * destination *and* every gate `mutate()` applies over the existing
-     * content, reopening each one it missed. The sharpest is create()'s
-     * non-owner `_attachment@1` refusal: without it, a requester could
-     * migrate a record they authored into the family naming any `fileId` and
-     * read the bytes through canAccessFile()'s uploader clause. Ordinary
-     * write access to a record is not consent to move it between families.
-     * See docs/spec/data-model.md § Type migrations.
-     */
-    commitMigration(id: RecordId, toTypeId: TypeId, content: Record<string, unknown>, opts?: IfVersionOptions): Promise<StackRecord>;
-    /**
-     * Store bytes and create an _attachment@1 metadata record (create grant
-     * on `_attachment@1` required; anonymous denied), returning that record.
-     * Authorship and principal are stamped exactly as create() does.
-     */
-    putAttachment(data: Uint8Array, opts: PutAttachmentOptions): Promise<StackRecord & {
-        content: AttachmentContent;
-    }>;
-    /**
-     * Download attachment bytes. Accessible to the owner, a reader of any
-     * referencing record, or the uploader pre-association — the same
-     * predicate as the reference-creation gate (canAccessFile).
-     */
-    getAttachment(fileId: FileId): Promise<Uint8Array>;
-    /**
-     * Delete an attachment. Only the stack owner may delete attachments.
-     * Delegates to Stack.deleteAttachment(), which enforces the "not referenced" check.
-     */
-    deleteAttachment(fileId: FileId): Promise<void>;
-    /**
-     * Sweep for unreferenced attachment bytes and delete them. Only the stack
-     * owner may run this. Delegates to Stack.collectAttachmentGarbage().
-     */
-    collectAttachmentGarbage(opts?: CollectAttachmentGarbageOptions): Promise<CollectAttachmentGarbageResult>;
-    /**
-     * Observe the changes this request may read. The predicate is canRead
-     * applied per event — the same one get() and query() answer with, so a
-     * feed can't disagree with them about what this session sees.
-     *
-     * A record the subscriber cannot read produces no event at all, rather
-     * than an empty or redacted one: the existence of a change is itself a
-     * disclosure, the same reasoning that keeps a count of the whole match
-     * off a query result. See docs/spec/events.md § Permission scoping.
-     */
-    subscribe<S extends ReadonlyTypeSchema>(handle: TypeHandle<S>, handler: (change: TypedChange<S>) => void, opts?: TypedSubscribeOptions): Promise<Unsubscribe>;
-    subscribe(handler: (change: RecordChange) => void, opts?: SubscribeOptions): Promise<Unsubscribe>;
-    /**
-     * canRead for one event, through the subscription's own cache. Grants
-     * are prefetched once and refilled after an invalidation rather than
-     * re-queried per event, which would be a `_grant` scan for every change
-     * the stack makes.
-     */
-    private canReadCached;
-}
-//# sourceMappingURL=scoped-stack.d.ts.map