@haverstack/core 0.40.0 → 0.42.0

package/dist/grants.d.ts

@@ -8,7 +8,7 @@
  *
  * See docs/spec/access-control.md § Type-level grants.
  */
-import type { EntityId, GrantAction, GrantContent, GrantGrantee, GroupRole, QueryResult, RecordId, StackQuery, StackRecord, TypeId } from './types.js';
+import type { BaseId, EntityId, GrantAction, GrantContent, GrantGrantee, GroupRole, RecordId, StackRecord, TypeId } from './types/index.js';
 import type { ValidationError } from './validate.js';
 /**
  * Valid GrantAction values, for runtime validation in Stack.grantType(). Built
@@ -17,33 +17,18 @@ import type { ValidationError } from './validate.js';
  */
 export declare const GRANT_ACTION_SET: ReadonlySet<GrantAction>;
 /**
- * The read actions that make a mutate action coherent, scope for scope: a
- * `-any` verb needs read over the same reach it can mutate, a `-own` verb
- * needs read over its author's own. A grant carrying neither conveys the
- * verb to nobody. `create` has no companion — writing a Record you then
- * cannot read is the drop-box, and it discloses nothing.
- * See docs/spec/access-control.md § Write implies read.
- */
-export declare const READ_COMPANIONS: ReadonlyMap<GrantAction, readonly GrantAction[]>;
-/**
- * Whether one grant's action list conveys `action`. The companion has to
- * sit in the same `_grant` Record: a grant is revoked whole, so a rule
- * satisfied across two records would let revoking the read one leave a
- * mutate-without-read grant standing.
- *
- * Takes the list grantReach() produced, never a stored field: `includes()`
- * over a string is substring matching, so one would answer for every verb
- * spelled inside it.
+ * Whether one grant's action list conveys `action`. The companion must sit
+ * in the same `_grant`: a grant is revoked whole, so a rule met across two
+ * records could leave mutate-without-read standing. Takes grantReach()'s
+ * list, never a stored field, whose `includes()` would match substrings.
  */
 export declare function grantConveys(actions: readonly GrantAction[], action: GrantAction): boolean;
 /**
  * What a stored `_grant` reaches, or null where it names nothing the
- * evaluator recognizes. Read as data, like the grantee beside it: a grant
- * Record can arrive from an import, a direct adapter write or a foreign
- * server, where no schema saw it, so both fields are asked for their shape
- * rather than taken from the type. An unknown action is dropped from the
- * list, on the same terms an unknown grantee `kind` confers nothing.
- * See docs/spec/access-control.md § Refused at the write, and again at evaluation.
+ * evaluator recognizes. Read as data — a grant can arrive from an import or
+ * a foreign server no schema saw — so an unknown action is dropped, as an
+ * unknown grantee confers nothing. See docs/spec/access-control.md
+ * § Refused at the write, and again at evaluation.
  */
 export declare function grantReach(content: unknown): {
     familyId: string;
@@ -61,6 +46,8 @@ export type GrantQuery = Exclude<GrantGrantee, {
     groupId: RecordId;
     role: GroupRole | 'any';
 };
+/** Whether two action lists name the same verbs, order and repeats aside. */
+export declare function sameActions(a: readonly GrantAction[], b: readonly GrantAction[]): boolean;
 /**
  * Direct (non-roster) match between a stored _grant's content and a target:
  * the whole grantee, `role` included. A target is the identity grantType()
@@ -69,13 +56,10 @@ export type GrantQuery = Exclude<GrantGrantee, {
  */
 export declare function matchesGrantTarget(content: GrantContent, target: GrantQuery): boolean;
 /**
- * Reject a grant target that names no tier, or whose tier names nobody. An
- * empty groupId or entityId reaches no one, so storing it would leave a
- * grant that can only ever deny while looking like a share that worked.
- * Read as data, not as the type: a target reaching Stack from a request
- * body or an import has whatever shape it arrived with, so a key its tier
- * does not define is refused too. `allowAny` admits
- * the listing-only `role: 'any'`, which grantType() and revokeType() refuse.
+ * Reject a grant target that names no tier, or whose tier names nobody: it
+ * would store a grant that can only deny while looking like a share that
+ * worked. Read as data, so a key its tier does not define is refused too.
+ * `allowAny` admits the listing-only `role: 'any'`.
  */
 export declare function validateGrantTarget(target: GrantQuery, allowAny?: boolean): void;
 /**
@@ -109,20 +93,13 @@ export declare function grantCoversGrantee(c: GrantContent, grantee: EntityId, o
  * System type families grantType() refuses to target: a grant on any of them
  * would let the grantee mint their own grants, touch stack config, or
  * register an app card claiming a DID that isn't theirs — the last of which
- * is what verified app attribution rests on.
+ * is what verified app attribution rests on — or approve an install, which
+ * decides grants and migration authority.
  */
 export declare const UNGRANTABLE_SYSTEM_TYPES: ReadonlySet<string>;
 /**
- * Every `_grant` Record, cursor-walked. Read through an unscoped query at
- * every call site: a grant is what decides who may read, so it can never
- * itself sit behind a read check.
- *
- * `includeUnlisted`, because withholding a Record from enumeration decides
- * nothing about what it confers. Deleted grants are excluded on the
- * opposite grounds — a soft delete is how revokeType() withdraws one.
- * See docs/spec/unlisted.md.
+ * Actions must be known GrantAction values; the target is held to the
+ * same rule every `_grant` write meets — see validateGrantBaseId().
  */
-export declare function loadGrantRecords(query: (q: StackQuery) => Promise<QueryResult>): Promise<(StackRecord & {
-    content: GrantContent;
-})[]>;
+export declare function checkGrantValid(baseId: BaseId, actions: GrantAction[]): void;
 //# sourceMappingURL=grants.d.ts.map

package/dist/grants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../src/grants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAOH,OAAO,KAAK,EACV,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,SAAS,EACT,WAAW,EACX,QAAQ,EACR,UAAU,EACV,WAAW,EACX,MAAM,EACP,MAAM,YAAY,CAAC;AAEpB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,EAAE,WAAW,CAAC,WAAW,CAA0B,CAAC;AAEjF;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,WAAW,EAAE,SAAS,WAAW,EAAE,CAK3E,CAAC;AAEH;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,SAAS,WAAW,EAAE,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAI1F;AAED;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,OAAO,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,WAAW,EAAE,CAAA;CAAE,GAAG,IAAI,CAUhG;AAED;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAClB,OAAO,CAAC,YAAY,EAAE;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC,GACxC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,SAAS,GAAG,KAAK,CAAA;CAAE,CAAC;AAElE;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,GAAG,OAAO,CASrF;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,UAAQ,GAAG,IAAI,CA+B9E;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,eAAe,EAAE,CAkDnF;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,eAAe,EAAE,CAiBvF;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,CAAC,EAAE,YAAY,EACf,OAAO,EAAE,QAAQ,EACjB,IAAI,EAAE;IACJ,YAAY,EAAE,OAAO,CAAC;IACtB,UAAU,EAAE,OAAO,CAAC;IACpB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC,CAAC;IAC1C,aAAa,EAAE,CAAC,EAAE,EAAE,QAAQ,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;CAC9D,GACA,OAAO,CAAC,OAAO,CAAC,CAuBlB;AAwBD;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,EAAE,WAAW,CAAC,MAAM,CAIvD,CAAC;AAEH;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,CAAC,CAAC,EAAE,UAAU,KAAK,OAAO,CAAC,WAAW,CAAC,GAC7C,OAAO,CAAC,CAAC,WAAW,GAAG;IAAE,OAAO,EAAE,YAAY,CAAA;CAAE,CAAC,EAAE,CAAC,CAKtD"}
+{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../src/grants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAOH,OAAO,KAAK,EACV,MAAM,EACN,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,SAAS,EACT,QAAQ,EACR,WAAW,EACX,MAAM,EACP,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,EAAE,WAAW,CAAC,WAAW,CAA0B,CAAC;AAejF;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,SAAS,WAAW,EAAE,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAI1F;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,OAAO,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,WAAW,EAAE,CAAA;CAAE,GAAG,IAAI,CAUhG;AAED;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAClB,OAAO,CAAC,YAAY,EAAE;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC,GACxC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,SAAS,GAAG,KAAK,CAAA;CAAE,CAAC;AAElE,6EAA6E;AAC7E,wBAAgB,WAAW,CAAC,CAAC,EAAE,SAAS,WAAW,EAAE,EAAE,CAAC,EAAE,SAAS,WAAW,EAAE,GAAG,OAAO,CAIzF;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,GAAG,OAAO,CASrF;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,UAAQ,GAAG,IAAI,CAa9E;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,eAAe,EAAE,CAMnF;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,eAAe,EAAE,CAiBvF;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,CAAC,EAAE,YAAY,EACf,OAAO,EAAE,QAAQ,EACjB,IAAI,EAAE;IACJ,YAAY,EAAE,OAAO,CAAC;IACtB,UAAU,EAAE,OAAO,CAAC;IACpB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC,CAAC;IAC1C,aAAa,EAAE,CAAC,EAAE,EAAE,QAAQ,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;CAC9D,GACA,OAAO,CAAC,OAAO,CAAC,CAkBlB;AAED;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,EAAE,WAAW,CAAC,MAAM,CAKvD,CAAC;AAEH;;;GAGG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,IAAI,CA2B5E"}

package/dist/grants.js

@@ -9,11 +9,10 @@
  * See docs/spec/access-control.md § Type-level grants.
  */
 import { baseIdOf, familyIdProblem } from './schema.js';
-import { StackBadRequestError } from './errors.js';
-import { assertKnownKeys, GRANTEE_KEYS, unknownKeys } from './query-validation.js';
-import { SYSTEM_TYPES, GRANT_ACTIONS } from './types.js';
-import { carriesRoster, groupRoleFromAssociations } from './access.js';
-import { queryAllPages } from './stack-reads.js';
+import { ARGUMENTS_INVALID, StackBadRequestError, StackValidationError } from './errors.js';
+import { granteeErrors } from './associations/validation.js';
+import { SYSTEM_TYPES, GRANT_ACTIONS } from './types/index.js';
+import { resolveGroupRole, roleSatisfies } from './access.js';
 /**
  * Valid GrantAction values, for runtime validation in Stack.grantType(). Built
  * from GRANT_ACTIONS, which GrantAction itself derives from, so the set and
@@ -21,28 +20,22 @@ import { queryAllPages } from './stack-reads.js';
  */
 export const GRANT_ACTION_SET = new Set(GRANT_ACTIONS);
 /**
- * The read actions that make a mutate action coherent, scope for scope: a
- * `-any` verb needs read over the same reach it can mutate, a `-own` verb
- * needs read over its author's own. A grant carrying neither conveys the
- * verb to nobody. `create` has no companion — writing a Record you then
- * cannot read is the drop-box, and it discloses nothing.
+ * The read actions that make a mutate action coherent, scope for scope. A
+ * grant carrying none conveys the verb to nobody. `create` has none:
+ * writing a Record you cannot read is the drop-box, and discloses nothing.
  * See docs/spec/access-control.md § Write implies read.
  */
-export const READ_COMPANIONS = new Map([
+const READ_COMPANIONS = new Map([
     ['update-own', ['read-own', 'read-any']],
     ['delete-own', ['read-own', 'read-any']],
     ['update-any', ['read-any']],
     ['delete-any', ['read-any']],
 ]);
 /**
- * Whether one grant's action list conveys `action`. The companion has to
- * sit in the same `_grant` Record: a grant is revoked whole, so a rule
- * satisfied across two records would let revoking the read one leave a
- * mutate-without-read grant standing.
- *
- * Takes the list grantReach() produced, never a stored field: `includes()`
- * over a string is substring matching, so one would answer for every verb
- * spelled inside it.
+ * Whether one grant's action list conveys `action`. The companion must sit
+ * in the same `_grant`: a grant is revoked whole, so a rule met across two
+ * records could leave mutate-without-read standing. Takes grantReach()'s
+ * list, never a stored field, whose `includes()` would match substrings.
  */
 export function grantConveys(actions, action) {
     if (!actions.includes(action))
@@ -52,12 +45,10 @@ export function grantConveys(actions, action) {
 }
 /**
  * What a stored `_grant` reaches, or null where it names nothing the
- * evaluator recognizes. Read as data, like the grantee beside it: a grant
- * Record can arrive from an import, a direct adapter write or a foreign
- * server, where no schema saw it, so both fields are asked for their shape
- * rather than taken from the type. An unknown action is dropped from the
- * list, on the same terms an unknown grantee `kind` confers nothing.
- * See docs/spec/access-control.md § Refused at the write, and again at evaluation.
+ * evaluator recognizes. Read as data — a grant can arrive from an import or
+ * a foreign server no schema saw — so an unknown action is dropped, as an
+ * unknown grantee confers nothing. See docs/spec/access-control.md
+ * § Refused at the write, and again at evaluation.
  */
 export function grantReach(content) {
     const c = content;
@@ -73,6 +64,12 @@ export function grantReach(content) {
         actions: c.actions.filter((a) => GRANT_ACTION_SET.has(a)),
     };
 }
+/** Whether two action lists name the same verbs, order and repeats aside. */
+export function sameActions(a, b) {
+    const as = new Set(a);
+    const bs = new Set(b);
+    return as.size === bs.size && [...bs].every((x) => as.has(x));
+}
 /**
  * Direct (non-roster) match between a stored _grant's content and a target:
  * the whole grantee, `role` included. A target is the identity grantType()
@@ -92,40 +89,21 @@ export function matchesGrantTarget(content, target) {
     return g.kind === 'authenticated';
 }
 /**
- * Reject a grant target that names no tier, or whose tier names nobody. An
- * empty groupId or entityId reaches no one, so storing it would leave a
- * grant that can only ever deny while looking like a share that worked.
- * Read as data, not as the type: a target reaching Stack from a request
- * body or an import has whatever shape it arrived with, so a key its tier
- * does not define is refused too. `allowAny` admits
- * the listing-only `role: 'any'`, which grantType() and revokeType() refuse.
+ * Reject a grant target that names no tier, or whose tier names nobody: it
+ * would store a grant that can only deny while looking like a share that
+ * worked. Read as data, so a key its tier does not define is refused too.
+ * `allowAny` admits the listing-only `role: 'any'`.
  */
 export function validateGrantTarget(target, allowAny = false) {
-    const t = target;
-    if (t?.kind === 'authenticated' || t?.kind === 'entity' || t?.kind === 'group')
-        assertKnownKeys(t, GRANTEE_KEYS[t.kind], 'grant target');
-    switch (t?.kind) {
-        case 'authenticated':
-            return;
-        case 'entity':
-            if (typeof t.entityId !== 'string' || t.entityId.length === 0) {
-                throw new StackBadRequestError('An entity grant target requires a non-empty entityId.');
-            }
-            return;
-        case 'group':
-            if (typeof t.groupId !== 'string' || t.groupId.length === 0) {
-                throw new StackBadRequestError('A group grant target requires a non-empty groupId.');
-            }
-            if (t.role !== 'member' && t.role !== 'admin' && !(allowAny && t.role === 'any')) {
-                throw new StackBadRequestError(allowAny
-                    ? "A group grant target requires role 'member', 'admin' or 'any'."
-                    : "A group grant target requires role 'member' or 'admin'.");
-            }
-            // No format check: groupId is a reference, like parentId or an
-            // association's recordId. One that resolves to nothing simply denies.
-            return;
-        default:
-            throw new StackBadRequestError("A grant target must name its tier: { kind: 'entity' }, { kind: 'group' } or { kind: 'authenticated' }.");
+    // No format check on a groupId: it is a reference, like parentId or an
+    // association's recordId. One that resolves to nothing simply denies.
+    const errors = granteeErrors(target, 'grant target', {
+        unknownKeys: 'throw',
+        authenticated: true,
+        anyRole: allowAny,
+    });
+    if (errors.length > 0) {
+        throw new StackBadRequestError(`Invalid grant target: ${errors.map((e) => e.message).join(' ')}`);
     }
 }
 /**
@@ -137,55 +115,11 @@ export function validateGrantTarget(target, allowAny = false) {
 export function validateGrantee(typeId, content) {
     if (baseIdOf(typeId) !== SYSTEM_TYPES.GRANT)
         return [];
-    const c = content;
-    const g = c?.grantee;
+    const g = content?.grantee;
     // An absent or non-object grantee is the schema's to refuse, and it does.
     if (!g || typeof g !== 'object')
         return [];
-    if (g.kind === 'authenticated' || g.kind === 'entity' || g.kind === 'group') {
-        const unknown = unknownKeys(g, GRANTEE_KEYS[g.kind]);
-        if (unknown.length > 0)
-            return unknown.map((key) => ({
-                path: `grantee.${key}`,
-                message: `A ${String(g.kind)} grantee does not carry ${key}`,
-            }));
-    }
-    switch (g.kind) {
-        case 'authenticated':
-            return [];
-        case 'entity':
-            return typeof g.entityId === 'string' && g.entityId.length > 0
-                ? []
-                : [
-                    {
-                        path: 'grantee.entityId',
-                        message: 'An entity grantee requires a non-empty entityId',
-                    },
-                ];
-        case 'group': {
-            const errors = [];
-            if (typeof g.groupId !== 'string' || g.groupId.length === 0) {
-                errors.push({
-                    path: 'grantee.groupId',
-                    message: 'A group grantee requires a non-empty groupId',
-                });
-            }
-            if (g.role !== 'member' && g.role !== 'admin') {
-                errors.push({
-                    path: 'grantee.role',
-                    message: "A group grantee requires role 'member' or 'admin'",
-                });
-            }
-            return errors;
-        }
-        default:
-            return [
-                {
-                    path: 'grantee.kind',
-                    message: "A grantee must name its tier: 'entity', 'group' or 'authenticated'",
-                },
-            ];
-    }
+    return granteeErrors(g, 'grantee', { unknownKeys: 'collect', authenticated: true });
 }
 /**
  * A `_grant`'s target, asked of its content on every write: a bare baseId
@@ -237,54 +171,57 @@ export async function grantCoversGrantee(c, grantee, opts) {
                 return false;
             if (g.role !== 'member' && g.role !== 'admin')
                 return false;
-            const role = await resolveGroupRoleMemoized(g.groupId, grantee, opts.groupRoles, opts.resolveRecord);
-            return g.role === 'admin' ? role === 'admin' : role !== null;
+            const role = await resolveGroupRole(g.groupId, grantee, opts.resolveRecord, opts.groupRoles);
+            return roleSatisfies(role, g.role);
         }
         default:
             return false;
     }
 }
-/**
- * An entity's role on a `_group` roster, memoized in the caller's
- * `groupRoles` map. That map is built per operation, so no resolved role
- * outlives the operation that resolved it — removal from a group must never
- * go stale.
- */
-async function resolveGroupRoleMemoized(groupId, entityId, groupRoles, resolveRecord) {
-    const key = `${groupId}:${entityId}`;
-    const cached = groupRoles.get(key);
-    if (cached !== undefined)
-        return cached;
-    const group = await resolveRecord(groupId);
-    const role = group && carriesRoster(group) ? groupRoleFromAssociations(group.associations, entityId) : null;
-    groupRoles.set(key, role);
-    return role;
-}
 /**
  * System type families grantType() refuses to target: a grant on any of them
  * would let the grantee mint their own grants, touch stack config, or
  * register an app card claiming a DID that isn't theirs — the last of which
- * is what verified app attribution rests on.
+ * is what verified app attribution rests on — or approve an install, which
+ * decides grants and migration authority.
  */
 export const UNGRANTABLE_SYSTEM_TYPES = new Set([
     SYSTEM_TYPES.GRANT,
     SYSTEM_TYPES.CONFIG,
     SYSTEM_TYPES.APP,
+    SYSTEM_TYPES.INSTALL,
 ]);
 /**
- * Every `_grant` Record, cursor-walked. Read through an unscoped query at
- * every call site: a grant is what decides who may read, so it can never
- * itself sit behind a read check.
- *
- * `includeUnlisted`, because withholding a Record from enumeration decides
- * nothing about what it confers. Deleted grants are excluded on the
- * opposite grounds — a soft delete is how revokeType() withdraws one.
- * See docs/spec/unlisted.md.
+ * Actions must be known GrantAction values; the target is held to the
+ * same rule every `_grant` write meets — see validateGrantBaseId().
  */
-export async function loadGrantRecords(query) {
-    const records = await queryAllPages(query, {
-        filter: { typeId: `${SYSTEM_TYPES.GRANT}@1`, includeUnlisted: true },
+export function checkGrantValid(baseId, actions) {
+    const errors = [];
+    actions.forEach((action, j) => {
+        if (!GRANT_ACTION_SET.has(action)) {
+            errors.push({ path: `actions[${j}]`, message: `Unknown grant action "${action}"` });
+        }
     });
-    return records;
+    const problem = familyIdProblem(baseId, 'grantType');
+    if (problem) {
+        errors.push({ path: 'baseId', message: problem });
+    }
+    else {
+        errors.push(...validateGrantBaseId(`${SYSTEM_TYPES.GRANT}@1`, { baseId }));
+    }
+    actions.forEach((action, j) => {
+        if (grantConveys(actions, action))
+            return;
+        const companions = READ_COMPANIONS.get(action);
+        if (!companions)
+            return;
+        errors.push({
+            path: `actions[${j}]`,
+            message: `"${action}" requires ${companions.map((c) => `"${c}"`).join(' or ')} in the same grant: a mutate verb reaches the record and its history, so it conveys nothing without read. Name both in one grant: actions: [${companions.map((c) => `'${c}'`).join(' | ')}, '${action}']`,
+        });
+    });
+    if (errors.length > 0) {
+        throw new StackValidationError(errors, ARGUMENTS_INVALID);
+    }
 }
 //# sourceMappingURL=grants.js.map

package/dist/grants.js.map

@@ -1 +1 @@
-{"version":3,"file":"grants.js","sourceRoot":"","sources":["../src/grants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACnF,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAavE,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAGjD;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAA6B,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;AAEjF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAqD,IAAI,GAAG,CAAC;IACvF,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IACxC,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IACxC,CAAC,YAAY,EAAE,CAAC,UAAU,CAAC,CAAC;IAC5B,CAAC,YAAY,EAAE,CAAC,UAAU,CAAC,CAAC;CAC7B,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAAC,OAA+B,EAAE,MAAmB;IAC/E,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,UAAU,GAAG,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/C,OAAO,CAAC,UAAU,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CAAC,OAAgB;IACzC,MAAM,CAAC,GAAG,OAAyD,CAAC;IACpE,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC7C,kFAAkF;IAClF,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACjG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,OAAO;QACL,QAAQ,EAAE,CAAC,CAAC,MAAM;QAClB,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAoB,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAgB,CAAC,CAAC;KAC3F,CAAC;AACJ,CAAC;AAWD;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAqB,EAAE,MAAkB;IAC1E,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAC1B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC,QAAQ,KAAM,MAAiC,CAAC,QAAQ,CAAC;IAC3F,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,MAA6C,CAAC;QACxD,OAAO,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC;AACpC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAkB,EAAE,QAAQ,GAAG,KAAK;IACtE,MAAM,CAAC,GAAG,MAAmF,CAAC;IAC9F,IAAI,CAAC,EAAE,IAAI,KAAK,eAAe,IAAI,CAAC,EAAE,IAAI,KAAK,QAAQ,IAAI,CAAC,EAAE,IAAI,KAAK,OAAO;QAC5E,eAAe,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,cAAc,CAAC,CAAC;IAC3D,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC;QAChB,KAAK,eAAe;YAClB,OAAO;QACT,KAAK,QAAQ;YACX,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC9D,MAAM,IAAI,oBAAoB,CAAC,uDAAuD,CAAC,CAAC;YAC1F,CAAC;YACD,OAAO;QACT,KAAK,OAAO;YACV,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC5D,MAAM,IAAI,oBAAoB,CAAC,oDAAoD,CAAC,CAAC;YACvF,CAAC;YACD,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;gBACjF,MAAM,IAAI,oBAAoB,CAC5B,QAAQ;oBACN,CAAC,CAAC,gEAAgE;oBAClE,CAAC,CAAC,yDAAyD,CAC9D,CAAC;YACJ,CAAC;YACD,+DAA+D;YAC/D,sEAAsE;YACtE,OAAO;QACT;YACE,MAAM,IAAI,oBAAoB,CAC5B,wGAAwG,CACzG,CAAC;IACN,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,OAAgB;IAC9D,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,YAAY,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACvD,MAAM,CAAC,GAAG,OAAuC,CAAC;IAClD,MAAM,CAAC,GAAG,CAAC,EAAE,OAAoF,CAAC;IAClG,0EAA0E;IAC1E,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IAC3C,IAAI,CAAC,CAAC,IAAI,KAAK,eAAe,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC5E,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACrD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YACpB,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBAC3B,IAAI,EAAE,WAAW,GAAG,EAAE;gBACtB,OAAO,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,2BAA2B,GAAG,EAAE;aAC7D,CAAC,CAAC,CAAC;IACR,CAAC;IACD,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,KAAK,eAAe;YAClB,OAAO,EAAE,CAAC;QACZ,KAAK,QAAQ;YACX,OAAO,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;gBAC5D,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC;oBACE;wBACE,IAAI,EAAE,kBAAkB;wBACxB,OAAO,EAAE,iDAAiD;qBAC3D;iBACF,CAAC;QACR,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,MAAM,GAAsB,EAAE,CAAC;YACrC,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC5D,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,iBAAiB;oBACvB,OAAO,EAAE,8CAA8C;iBACxD,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC9C,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,cAAc;oBACpB,OAAO,EAAE,mDAAmD;iBAC7D,CAAC,CAAC;YACL,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QACD;YACE,OAAO;gBACL;oBACE,IAAI,EAAE,cAAc;oBACpB,OAAO,EAAE,oEAAoE;iBAC9E;aACF,CAAC;IACN,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAc,EAAE,OAAgB;IAClE,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,YAAY,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACvD,MAAM,MAAM,GAAI,OAAuC,EAAE,MAAM,CAAC;IAChE,4DAA4D;IAC5D,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IAC1C,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAClD,IAAI,OAAO;QAAE,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3D,IAAI,wBAAwB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,CAAC,GAAG,wBAAwB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzD,OAAO;YACL;gBACE,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,oBAAoB,MAAM,gBAAgB,OAAO,8CAA8C;aACzG;SACF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,CAAe,EACf,OAAiB,EACjB,IAKC;IAED,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;IACpB,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,KAAK,eAAe;YAClB,OAAO,IAAI,CAAC,YAAY,CAAC;QAC3B,KAAK,QAAQ;YACX,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC;QAChD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,UAAU;gBAAE,OAAO,KAAK,CAAC;YACnC,IAAI,CAAC,CAAC,CAAC,OAAO;gBAAE,OAAO,KAAK,CAAC;YAC7B,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO;gBAAE,OAAO,KAAK,CAAC;YAC5D,MAAM,IAAI,GAAG,MAAM,wBAAwB,CACzC,CAAC,CAAC,OAAO,EACT,OAAO,EACP,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,aAAa,CACnB,CAAC;YACF,OAAO,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC;QAC/D,CAAC;QACD;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,wBAAwB,CACrC,OAAiB,EACjB,QAAkB,EAClB,UAAyC,EACzC,aAA4D;IAE5D,MAAM,GAAG,GAAG,GAAG,OAAO,IAAI,QAAQ,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACxC,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,IAAI,GACR,KAAK,IAAI,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,yBAAyB,CAAC,KAAK,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjG,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC1B,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAwB,IAAI,GAAG,CAAC;IACnE,YAAY,CAAC,KAAK;IAClB,YAAY,CAAC,MAAM;IACnB,YAAY,CAAC,GAAG;CACjB,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAA8C;IAE9C,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE;QACzC,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,YAAY,CAAC,KAAK,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE;KACrE,CAAC,CAAC;IACH,OAAO,OAAsD,CAAC;AAChE,CAAC"}
+{"version":3,"file":"grants.js","sourceRoot":"","sources":["../src/grants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAC5F,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAc9D;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAA6B,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;AAEjF;;;;;GAKG;AACH,MAAM,eAAe,GAAqD,IAAI,GAAG,CAAC;IAChF,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IACxC,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IACxC,CAAC,YAAY,EAAE,CAAC,UAAU,CAAC,CAAC;IAC5B,CAAC,YAAY,EAAE,CAAC,UAAU,CAAC,CAAC;CAC7B,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,OAA+B,EAAE,MAAmB;IAC/E,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,UAAU,GAAG,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/C,OAAO,CAAC,UAAU,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,OAAgB;IACzC,MAAM,CAAC,GAAG,OAAyD,CAAC;IACpE,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC7C,kFAAkF;IAClF,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACjG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,OAAO;QACL,QAAQ,EAAE,CAAC,CAAC,MAAM;QAClB,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAoB,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAgB,CAAC,CAAC;KAC3F,CAAC;AACJ,CAAC;AAWD,6EAA6E;AAC7E,MAAM,UAAU,WAAW,CAAC,CAAyB,EAAE,CAAyB;IAC9E,MAAM,EAAE,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;IACtB,MAAM,EAAE,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;IACtB,OAAO,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAqB,EAAE,MAAkB;IAC1E,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAC1B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC,QAAQ,KAAM,MAAiC,CAAC,QAAQ,CAAC;IAC3F,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,MAA6C,CAAC;QACxD,OAAO,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAkB,EAAE,QAAQ,GAAG,KAAK;IACtE,uEAAuE;IACvE,sEAAsE;IACtE,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,EAAE,cAAc,EAAE;QACnD,WAAW,EAAE,OAAO;QACpB,aAAa,EAAE,IAAI;QACnB,OAAO,EAAE,QAAQ;KAClB,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,oBAAoB,CAC5B,yBAAyB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAClE,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,OAAgB;IAC9D,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,YAAY,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACvD,MAAM,CAAC,GAAI,OAAwC,EAAE,OAAO,CAAC;IAC7D,0EAA0E;IAC1E,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IAC3C,OAAO,aAAa,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;AACtF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAc,EAAE,OAAgB;IAClE,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,YAAY,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACvD,MAAM,MAAM,GAAI,OAAuC,EAAE,MAAM,CAAC;IAChE,4DAA4D;IAC5D,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IAC1C,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAClD,IAAI,OAAO;QAAE,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3D,IAAI,wBAAwB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,CAAC,GAAG,wBAAwB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzD,OAAO;YACL;gBACE,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,oBAAoB,MAAM,gBAAgB,OAAO,8CAA8C;aACzG;SACF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,CAAe,EACf,OAAiB,EACjB,IAKC;IAED,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;IACpB,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,KAAK,eAAe;YAClB,OAAO,IAAI,CAAC,YAAY,CAAC;QAC3B,KAAK,QAAQ;YACX,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC;QAChD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,UAAU;gBAAE,OAAO,KAAK,CAAC;YACnC,IAAI,CAAC,CAAC,CAAC,OAAO;gBAAE,OAAO,KAAK,CAAC;YAC7B,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO;gBAAE,OAAO,KAAK,CAAC;YAC5D,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YAC7F,OAAO,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACrC,CAAC;QACD;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAwB,IAAI,GAAG,CAAC;IACnE,YAAY,CAAC,KAAK;IAClB,YAAY,CAAC,MAAM;IACnB,YAAY,CAAC,GAAG;IAChB,YAAY,CAAC,OAAO;CACrB,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,OAAsB;IACpE,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;QAC5B,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,yBAAyB,MAAM,GAAG,EAAE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACrD,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACpD,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,GAAG,YAAY,CAAC,KAAK,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAC7E,CAAC;IAED,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;QAC5B,IAAI,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC;YAAE,OAAO;QAC1C,MAAM,UAAU,GAAG,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,CAAC,UAAU;YAAE,OAAO;QACxB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,WAAW,CAAC,GAAG;YACrB,OAAO,EAAE,IAAI,MAAM,cAAc,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,+IAA+I,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,MAAM,IAAI;SACxR,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,oBAAoB,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC"}

package/dist/id.d.ts

@@ -23,43 +23,25 @@ export declare const _setLastTimestamp: (timestamp: number) => void;
 /** Resets all module-level generator state. For test isolation only. */
 export declare const _resetIdState: () => void;
 /**
- * Largest timestamp (ms since epoch) that still encodes to the
- * 9-character prefix an ID's format requires: 32^9 - 1, i.e.
- * 3084-12-12T12:41:28.831Z. One millisecond past it the prefix grows to 10
- * characters and the ID no longer passes isValidIdFormat() — the library
- * would be minting an ID it rejects on the way back in. generateId() can't
- * reach this, since it encodes Date.now(); generateIdForTimestamp() takes
- * whatever timestamp the caller asks for, so it is the one that has to
- * check.
+ * Largest timestamp that still encodes to the 9-character prefix an ID's
+ * format requires (32^9 - 1, 3084-12-12T12:41:28.831Z); past it the library
+ * would mint an ID it rejects. Only generateIdForTimestamp() can reach it,
+ * since generateId() encodes Date.now().
  */
 export declare const MAX_ID_TIMESTAMP: number;
 /**
- * Generate a new Stack record ID. Time-sortable: lexicographic order
- * matches creation order, with same-millisecond IDs monotonically
- * incremented.
- *
- * A millisecond whose suffix space is spent carries into the next one
- * rather than failing, so how many IDs a millisecond holds never depends
- * on where its random suffix happened to start — which is what keeps the
- * order total and the call free of a capacity a caller cannot see.
- * See docs/spec/data-model.md § Record IDs.
- *
- * @param timestamp - Override the timestamp (ms since epoch). Defaults to Date.now().
+ * Generate a new record ID, `timestamp` defaulting to now; lexicographic
+ * order matches creation order. A spent millisecond carries into the next
+ * rather than failing, so capacity never depends on where the random suffix
+ * started. See docs/spec/data-model.md § Record IDs.
  */
 export declare const generateId: (timestamp?: number) => string;
 /**
- * Mint an ID for an arbitrary (typically past) timestamp — used by
- * Stack.create() to derive an ID from an explicit `createdAt` when
- * importing historical records. Deliberately bypasses generateId()'s
- * monotonic `lastTimestamp` floor: that floor exists to protect *live* ID
- * generation from a backward clock step (NTP correction, suspend/resume),
- * and would otherwise clamp a deliberately historical timestamp forward to
- * "now" the moment the process has minted any live ID past it — silently
- * defeating the backdate it was asked for. Same-millisecond uniqueness for
- * a historical timestamp is therefore left to a fresh random suffix each
- * call rather than the live incrementing scheme; a collision surfaces the
- * same way any client-supplied id collision does, as StackConflictError
- * from the adapter.
+ * Mint an ID for an arbitrary, typically past, timestamp — Stack.create()'s
+ * backdated import. Bypasses generateId()'s monotonic floor, which guards
+ * live minting from clock steps but would clamp a historical timestamp to
+ * now. Uniqueness rests on a fresh random suffix; a collision surfaces as
+ * the adapter's StackConflictError.
  */
 export declare const generateIdForTimestamp: (timestamp: number) => string;
 /**

package/dist/id.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"id.d.ts","sourceRoot":"","sources":["../src/id.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,eAAO,MAAM,IAAI,QAAoB,CAAC;AAGtC,eAAO,MAAM,kBAAkB,IAAI,CAAC;AAcpC,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,OAAO,SAAK;CAIzB;AAMD,eAAO,MAAM,iBAAiB,GAAI,GAAG,MAAM,KAAG,MAiB7C,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAAI,GAAG,MAAM,KAAG,MAe7C,CAAC;AAkCF,eAAO,MAAM,aAAa,GAAI,OAAO,MAAM,KAAG,IAK7C,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAAI,OAAO,MAAM,KAAG,IAKjD,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAAI,WAAW,MAAM,KAAG,IAErD,CAAC;AAEF,wEAAwE;AACxE,eAAO,MAAM,aAAa,QAAO,IAIhC,CAAC;AAMF;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,QAA2C,CAAC;AAEzE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,UAAU,GAAI,YAAW,MAAmB,KAAG,MAgB3D,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,sBAAsB,GAAI,WAAW,MAAM,KAAG,MAS1D,CAAC;AASF;;;;GAIG;AACH,eAAO,MAAM,eAAe,GAAI,IAAI,MAAM,KAAG,OAA6B,CAAC;AAE3E;;;GAGG;AACH,eAAO,MAAM,WAAW,GAAI,IAAI,MAAM,KAAG,MACa,CAAC"}
+{"version":3,"file":"id.d.ts","sourceRoot":"","sources":["../src/id.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,eAAO,MAAM,IAAI,QAAoB,CAAC;AAGtC,eAAO,MAAM,kBAAkB,IAAI,CAAC;AAcpC,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,OAAO,SAAK;CAIzB;AAMD,eAAO,MAAM,iBAAiB,GAAI,GAAG,MAAM,KAAG,MAiB7C,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAAI,GAAG,MAAM,KAAG,MAe7C,CAAC;AAkCF,eAAO,MAAM,aAAa,GAAI,OAAO,MAAM,KAAG,IAK7C,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAAI,OAAO,MAAM,KAAG,IAKjD,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAAI,WAAW,MAAM,KAAG,IAErD,CAAC;AAEF,wEAAwE;AACxE,eAAO,MAAM,aAAa,QAAO,IAIhC,CAAC;AAMF;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,QAA2C,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,UAAU,GAAI,YAAW,MAAmB,KAAG,MAgB3D,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,GAAI,WAAW,MAAM,KAAG,MAS1D,CAAC;AASF;;;;GAIG;AACH,eAAO,MAAM,eAAe,GAAI,IAAI,MAAM,KAAG,OAA6B,CAAC;AAE3E;;;GAGG;AACH,eAAO,MAAM,WAAW,GAAI,IAAI,MAAM,KAAG,MACa,CAAC"}

package/dist/id.js

@@ -115,28 +115,17 @@ export const _resetIdState = () => {
 // Public API
 // -------------------------------------------------------
 /**
- * Largest timestamp (ms since epoch) that still encodes to the
- * 9-character prefix an ID's format requires: 32^9 - 1, i.e.
- * 3084-12-12T12:41:28.831Z. One millisecond past it the prefix grows to 10
- * characters and the ID no longer passes isValidIdFormat() — the library
- * would be minting an ID it rejects on the way back in. generateId() can't
- * reach this, since it encodes Date.now(); generateIdForTimestamp() takes
- * whatever timestamp the caller asks for, so it is the one that has to
- * check.
+ * Largest timestamp that still encodes to the 9-character prefix an ID's
+ * format requires (32^9 - 1, 3084-12-12T12:41:28.831Z); past it the library
+ * would mint an ID it rejects. Only generateIdForTimestamp() can reach it,
+ * since generateId() encodes Date.now().
  */
 export const MAX_ID_TIMESTAMP = Math.pow(BASE, MIN_TIMESTAMP_LENGTH) - 1;
 /**
- * Generate a new Stack record ID. Time-sortable: lexicographic order
- * matches creation order, with same-millisecond IDs monotonically
- * incremented.
- *
- * A millisecond whose suffix space is spent carries into the next one
- * rather than failing, so how many IDs a millisecond holds never depends
- * on where its random suffix happened to start — which is what keeps the
- * order total and the call free of a capacity a caller cannot see.
- * See docs/spec/data-model.md § Record IDs.
- *
- * @param timestamp - Override the timestamp (ms since epoch). Defaults to Date.now().
+ * Generate a new record ID, `timestamp` defaulting to now; lexicographic
+ * order matches creation order. A spent millisecond carries into the next
+ * rather than failing, so capacity never depends on where the random suffix
+ * started. See docs/spec/data-model.md § Record IDs.
  */
 export const generateId = (timestamp = Date.now()) => {
     let effectiveTimestamp = Math.max(timestamp, lastTimestamp);
@@ -153,18 +142,11 @@ export const generateId = (timestamp = Date.now()) => {
     return nowId + randChars;
 };
 /**
- * Mint an ID for an arbitrary (typically past) timestamp — used by
- * Stack.create() to derive an ID from an explicit `createdAt` when
- * importing historical records. Deliberately bypasses generateId()'s
- * monotonic `lastTimestamp` floor: that floor exists to protect *live* ID
- * generation from a backward clock step (NTP correction, suspend/resume),
- * and would otherwise clamp a deliberately historical timestamp forward to
- * "now" the moment the process has minted any live ID past it — silently
- * defeating the backdate it was asked for. Same-millisecond uniqueness for
- * a historical timestamp is therefore left to a fresh random suffix each
- * call rather than the live incrementing scheme; a collision surfaces the
- * same way any client-supplied id collision does, as StackConflictError
- * from the adapter.
+ * Mint an ID for an arbitrary, typically past, timestamp — Stack.create()'s
+ * backdated import. Bypasses generateId()'s monotonic floor, which guards
+ * live minting from clock steps but would clamp a historical timestamp to
+ * now. Uniqueness rests on a fresh random suffix; a collision surfaces as
+ * the adapter's StackConflictError.
  */
 export const generateIdForTimestamp = (timestamp) => {
     if (!Number.isFinite(timestamp) || timestamp < 0 || timestamp > MAX_ID_TIMESTAMP) {

package/dist/id.js.map

@@ -1 +1 @@
-{"version":3,"file":"id.js","sourceRoot":"","sources":["../src/id.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,UAAU,GAAG,kCAAkC,CAAC;AAEtD,MAAM,CAAC,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC;AAEtC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAC/B,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAEpC,kEAAkE;AAClE,IAAI,SAAS,GAAG,EAAE,CAAC;AACnB,IAAI,aAAa,GAAG,EAAE,CAAC;AACvB,wEAAwE;AACxE,uEAAuE;AACvE,uDAAuD;AACvD,IAAI,aAAa,GAAG,CAAC,CAAC;AAEtB,0DAA0D;AAC1D,SAAS;AACT,0DAA0D;AAE1D,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C,YAAY,OAAO,GAAG,EAAE;QACtB,KAAK,CAAC,OAAO,IAAI,+BAA+B,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED,0DAA0D;AAC1D,sBAAsB;AACtB,0DAA0D;AAE1D,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAS,EAAU,EAAE;IACrD,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACV,MAAM,IAAI,UAAU,CAAC,mCAAmC,CAAC,CAAC;IAC5D,CAAC;IAED,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAElB,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACZ,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC;IAED,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,GAAG,UAAU,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC;QACvC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAS,EAAU,EAAE;IACrD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,UAAU,CAAC,2BAA2B,CAAC,CAAC;IACpD,CAAC;IAED,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IACpB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACpD,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;YACZ,MAAM,IAAI,UAAU,CAAC,mCAAmC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;QAClF,CAAC;QACD,CAAC,IAAI,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC,CAAC;AAEF,0DAA0D;AAC1D,mBAAmB;AACnB,0DAA0D;AAE1D,MAAM,GAAG,GAAG,CAAC,KAAa,EAAE,MAAc,EAAU,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AAE7F;;;GAGG;AACH,MAAM,iBAAiB,GAAG,GAAW,EAAE;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC;IAC/B,0CAA0C;IAC1C,IAAI,KAAa,CAAC;IAClB,GAAG,CAAC;QACF,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QAC5B,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC,QAAQ,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,OAAO,CAAC,GAAG,OAAO,EAAE;IAC7D,OAAO,GAAG,CAAC,iBAAiB,CAAC,KAAK,GAAG,OAAO,CAAC,EAAE,kBAAkB,CAAC,CAAC;AACrE,CAAC,CAAC;AAEF,0EAA0E;AAC1E,MAAM,kBAAkB,GAAG,CAAC,SAAiB,EAAiB,EAAE;IAC9D,MAAM,IAAI,GAAG,iBAAiB,CAAC,iBAAiB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACjE,OAAO,IAAI,CAAC,MAAM,GAAG,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;AACjF,CAAC,CAAC;AAEF,0DAA0D;AAC1D,+BAA+B;AAC/B,0DAA0D;AAE1D,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,KAAa,EAAQ,EAAE;IACnD,IAAI,KAAK,CAAC,MAAM,GAAG,oBAAoB,EAAE,CAAC;QACxC,MAAM,IAAI,UAAU,CAAC,gCAAgC,oBAAoB,cAAc,CAAC,CAAC;IAC3F,CAAC;IACD,SAAS,GAAG,KAAK,CAAC;AACpB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,KAAa,EAAQ,EAAE;IACvD,IAAI,KAAK,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;QACxC,MAAM,IAAI,UAAU,CAAC,mCAAmC,kBAAkB,cAAc,CAAC,CAAC;IAC5F,CAAC;IACD,aAAa,GAAG,KAAK,CAAC;AACxB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,SAAiB,EAAQ,EAAE;IAC3D,aAAa,GAAG,SAAS,CAAC;AAC5B,CAAC,CAAC;AAEF,wEAAwE;AACxE,MAAM,CAAC,MAAM,aAAa,GAAG,GAAS,EAAE;IACtC,SAAS,GAAG,EAAE,CAAC;IACf,aAAa,GAAG,EAAE,CAAC;IACnB,aAAa,GAAG,CAAC,CAAC;AACpB,CAAC,CAAC;AAEF,0DAA0D;AAC1D,aAAa;AACb,0DAA0D;AAE1D;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,oBAAoB,CAAC,GAAG,CAAC,CAAC;AAEzE;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,YAAoB,IAAI,CAAC,GAAG,EAAE,EAAU,EAAE;IACnE,IAAI,kBAAkB,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IAC5D,IAAI,KAAK,GAAG,GAAG,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,EAAE,oBAAoB,CAAC,CAAC;IAC7E,IAAI,SAAS,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC;IAE9F,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,kBAAkB,IAAI,CAAC,CAAC;QACxB,KAAK,GAAG,GAAG,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,EAAE,oBAAoB,CAAC,CAAC;QACzE,SAAS,GAAG,iBAAiB,EAAE,CAAC;IAClC,CAAC;IAED,aAAa,GAAG,kBAAkB,CAAC;IACnC,SAAS,GAAG,KAAK,CAAC;IAClB,aAAa,GAAG,SAAS,CAAC;IAE1B,OAAO,KAAK,GAAG,SAAS,CAAC;AAC3B,CAAC,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,SAAiB,EAAU,EAAE;IAClE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,IAAI,SAAS,GAAG,gBAAgB,EAAE,CAAC;QACjF,MAAM,IAAI,iBAAiB,CACzB,aAAa,SAAS,2CAA2C,gBAAgB,GAAG;YAClF,6BAA6B,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC,WAAW,EAAE,IAAI,CAC5E,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,oBAAoB,CAAC,CAAC;IACtE,OAAO,KAAK,GAAG,iBAAiB,EAAE,CAAC;AACrC,CAAC,CAAC;AAEF,0DAA0D;AAC1D,oBAAoB;AACpB,0DAA0D;AAE1D,MAAM,SAAS,GAAG,oBAAoB,GAAG,kBAAkB,CAAC;AAC5D,MAAM,SAAS,GAAG,IAAI,MAAM,CAAC,KAAK,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC;AAEhE;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,EAAU,EAAW,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAE3E;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,EAAU,EAAU,EAAE,CAChD,iBAAiB,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"id.js","sourceRoot":"","sources":["../src/id.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,UAAU,GAAG,kCAAkC,CAAC;AAEtD,MAAM,CAAC,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC;AAEtC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAC/B,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAEpC,kEAAkE;AAClE,IAAI,SAAS,GAAG,EAAE,CAAC;AACnB,IAAI,aAAa,GAAG,EAAE,CAAC;AACvB,wEAAwE;AACxE,uEAAuE;AACvE,uDAAuD;AACvD,IAAI,aAAa,GAAG,CAAC,CAAC;AAEtB,0DAA0D;AAC1D,SAAS;AACT,0DAA0D;AAE1D,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C,YAAY,OAAO,GAAG,EAAE;QACtB,KAAK,CAAC,OAAO,IAAI,+BAA+B,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED,0DAA0D;AAC1D,sBAAsB;AACtB,0DAA0D;AAE1D,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAS,EAAU,EAAE;IACrD,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACV,MAAM,IAAI,UAAU,CAAC,mCAAmC,CAAC,CAAC;IAC5D,CAAC;IAED,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAElB,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACZ,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC;IAED,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,GAAG,UAAU,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC;QACvC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAS,EAAU,EAAE;IACrD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,UAAU,CAAC,2BAA2B,CAAC,CAAC;IACpD,CAAC;IAED,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IACpB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACpD,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;YACZ,MAAM,IAAI,UAAU,CAAC,mCAAmC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;QAClF,CAAC;QACD,CAAC,IAAI,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC,CAAC;AAEF,0DAA0D;AAC1D,mBAAmB;AACnB,0DAA0D;AAE1D,MAAM,GAAG,GAAG,CAAC,KAAa,EAAE,MAAc,EAAU,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AAE7F;;;GAGG;AACH,MAAM,iBAAiB,GAAG,GAAW,EAAE;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC;IAC/B,0CAA0C;IAC1C,IAAI,KAAa,CAAC;IAClB,GAAG,CAAC;QACF,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QAC5B,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC,QAAQ,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,OAAO,CAAC,GAAG,OAAO,EAAE;IAC7D,OAAO,GAAG,CAAC,iBAAiB,CAAC,KAAK,GAAG,OAAO,CAAC,EAAE,kBAAkB,CAAC,CAAC;AACrE,CAAC,CAAC;AAEF,0EAA0E;AAC1E,MAAM,kBAAkB,GAAG,CAAC,SAAiB,EAAiB,EAAE;IAC9D,MAAM,IAAI,GAAG,iBAAiB,CAAC,iBAAiB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACjE,OAAO,IAAI,CAAC,MAAM,GAAG,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;AACjF,CAAC,CAAC;AAEF,0DAA0D;AAC1D,+BAA+B;AAC/B,0DAA0D;AAE1D,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,KAAa,EAAQ,EAAE;IACnD,IAAI,KAAK,CAAC,MAAM,GAAG,oBAAoB,EAAE,CAAC;QACxC,MAAM,IAAI,UAAU,CAAC,gCAAgC,oBAAoB,cAAc,CAAC,CAAC;IAC3F,CAAC;IACD,SAAS,GAAG,KAAK,CAAC;AACpB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,KAAa,EAAQ,EAAE;IACvD,IAAI,KAAK,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;QACxC,MAAM,IAAI,UAAU,CAAC,mCAAmC,kBAAkB,cAAc,CAAC,CAAC;IAC5F,CAAC;IACD,aAAa,GAAG,KAAK,CAAC;AACxB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,SAAiB,EAAQ,EAAE;IAC3D,aAAa,GAAG,SAAS,CAAC;AAC5B,CAAC,CAAC;AAEF,wEAAwE;AACxE,MAAM,CAAC,MAAM,aAAa,GAAG,GAAS,EAAE;IACtC,SAAS,GAAG,EAAE,CAAC;IACf,aAAa,GAAG,EAAE,CAAC;IACnB,aAAa,GAAG,CAAC,CAAC;AACpB,CAAC,CAAC;AAEF,0DAA0D;AAC1D,aAAa;AACb,0DAA0D;AAE1D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,oBAAoB,CAAC,GAAG,CAAC,CAAC;AAEzE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,YAAoB,IAAI,CAAC,GAAG,EAAE,EAAU,EAAE;IACnE,IAAI,kBAAkB,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IAC5D,IAAI,KAAK,GAAG,GAAG,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,EAAE,oBAAoB,CAAC,CAAC;IAC7E,IAAI,SAAS,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC;IAE9F,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,kBAAkB,IAAI,CAAC,CAAC;QACxB,KAAK,GAAG,GAAG,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,EAAE,oBAAoB,CAAC,CAAC;QACzE,SAAS,GAAG,iBAAiB,EAAE,CAAC;IAClC,CAAC;IAED,aAAa,GAAG,kBAAkB,CAAC;IACnC,SAAS,GAAG,KAAK,CAAC;IAClB,aAAa,GAAG,SAAS,CAAC;IAE1B,OAAO,KAAK,GAAG,SAAS,CAAC;AAC3B,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,SAAiB,EAAU,EAAE;IAClE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,IAAI,SAAS,GAAG,gBAAgB,EAAE,CAAC;QACjF,MAAM,IAAI,iBAAiB,CACzB,aAAa,SAAS,2CAA2C,gBAAgB,GAAG;YAClF,6BAA6B,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC,WAAW,EAAE,IAAI,CAC5E,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,oBAAoB,CAAC,CAAC;IACtE,OAAO,KAAK,GAAG,iBAAiB,EAAE,CAAC;AACrC,CAAC,CAAC;AAEF,0DAA0D;AAC1D,oBAAoB;AACpB,0DAA0D;AAE1D,MAAM,SAAS,GAAG,oBAAoB,GAAG,kBAAkB,CAAC;AAC5D,MAAM,SAAS,GAAG,IAAI,MAAM,CAAC,KAAK,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC;AAEhE;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,EAAU,EAAW,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAE3E;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,EAAU,EAAU,EAAE,CAChD,iBAAiB,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAC,CAAC"}