@haverstack/core 0.41.0 → 0.42.0

package/dist/scoped-stack.d.ts

@@ -1,549 +0,0 @@
-/**
- * ScopedStack — the permission-enforcing view
- * -------------------------------------------------------
- * A `Stack` answers every question; a `ScopedStack` answers only the ones a
- * particular requester is entitled to. It wraps a Stack rather than an
- * adapter, so every invariant the Stack layer holds is already in force by
- * the time a check here runs, and the gates below only ever narrow.
- *
- * Two identities, one rule: **the principal governs authority, the subject
- * governs attribution.** Both are DIDs and both are often equal, which is
- * what makes them easy to confuse — so the split is stated on every gate
- * that depends on it.
- *
- * Also holds the feed side of the same rule: a subscription's deliveries
- * run through the same canRead() a get() answers with, so a feed can never
- * disagree with a read about what a session sees.
- *
- * See docs/spec/access-control.md and docs/spec/events.md § Permission scoping.
- */
-import { ChangeEmitter } from './changes.js';
-import type { PutAttachmentOptions, AssociationEdit, AttachmentContent, AuthorityAssociation, DataAssociation, EntityId, FileId, QueryResult, RecordChange, RecordId, RecordVersion, RecordJournalEntry, JournalQuery, VersionsQuery, StackAdapter, StackCapabilities, IfVersionOptions, StackQuery, StackRecord, SubscribeOptions, TypeId, Unsubscribe, RecordChangeSet } from './types.js';
-import type { ContentOf, PatchOf, ReadonlyTypeSchema, TypedChange, TypedChangeSet, TypedQuery, TypedSubscribeOptions, TypedRecord, TypeHandle } from './type-handle.js';
-import type { Stack, BackdatableCreateRecordOptions, CollectAttachmentGarbageOptions, CollectAttachmentGarbageResult, DeleteAndReturnResult, DeleteRecordOptions, DeleteResult, GetRecordOptions, StackClient } from './stack.js';
-/**
- * Held by Stack alone: the index re-exports ScopedStack but not this, so
- * asEntity()/asActor() stay the only way to one, and the actor
- * normalization and open-check they run can't be skipped.
- */
-export declare const scopeToken: unique symbol;
-/** Everything a ScopedStack borrows from the Stack that scoped it. */
-export type ScopedStackInit = {
-    stack: Stack;
-    principalId: EntityId | null;
-    subjectId: EntityId | null;
-    idTimestampSkewMs: number | null;
-    /**
-     * Bytes-storage primitive for putAttachment(), which composes bytes with
-     * its own create() so the record carries the subject and principal as
-     * `createdBy` — neither of which the adapter-level atomic capability takes.
-     */
-    adapter: StackAdapter;
-    /** The stack's own unfiltered stream, which subscribe() narrows. */
-    changes: ChangeEmitter;
-    assertOpen: () => void;
-    /** Whether changes reach the stack from elsewhere — see subscribe(). */
-    relaysChanges: boolean;
-};
-/**
- * A permission-enforcing view of a Stack for a single (principal, subject)
- * pair, obtained via `stack.asEntity(entityId)`. A record the request
- * cannot read answers exactly as a missing one does — null on reads,
- * StackNotFoundError on the verbs that name one — so only a requester who
- * could have read it is told a refusal was about access.
- * See docs/spec/disclosure.md § Which refusal a Record answers with.
- *
- * Which identity each gate keys on follows the module comment's rule.
- * Grant lookup and the privilege-bearing gates no grant reaches
- * (resharing, group management, purge, widening access at create
- * time) key on `principalId`; authorship, `-own` matching,
- * record-level permission resolution and "files I uploaded" lookups key on
- * `subjectId`. Unconditional owner access splits the same way: an
- * owner subject resolves past every permission check, an owner principal
- * is not bounded by grants, and under delegation both halves apply.
- */
-export declare class ScopedStack implements StackClient {
-    #private;
-    private readonly stack;
-    private readonly idTimestampSkewMs;
-    private readonly adapter;
-    private readonly changes;
-    private readonly assertStackOpen;
-    private readonly relaysChanges;
-    /** Not callable from outside the package — see ScopedStackInit. */
-    constructor(token: typeof scopeToken, init: ScopedStackInit);
-    /**
-     * The identity whose authority this view acts with; `null` when
-     * anonymous. See docs/spec/access-control.md § Delegation: principal and subject.
-     */
-    get principalId(): EntityId | null;
-    /**
-     * The identity this view acts for and attributes writes to; `null` when
-     * anonymous. Equal to `principalId` unless an app is acting for a user.
-     */
-    get subjectId(): EntityId | null;
-    get capabilities(): StackCapabilities;
-    private resolveRecord;
-    /** Every `_grant` Record — see loadGrantRecords(). */
-    private loadGrants;
-    /** Whether a delegated app is acting for someone other than itself. */
-    private get delegated();
-    /**
-     * Whether any grant could name this request — the one question every
-     * prefetch asks before scanning the `_grant` family, since an anonymous
-     * requester is reached by none. Both identities are read: `asEntity()`
-     * refuses an anonymous principal acting for a subject, so they are null
-     * together, and saying so costs nothing.
-     */
-    private get identified();
-    /**
-     * Who this request is, for stamping onto whatever it mutates. Attribution
-     * follows record-level authorship: the subject is the actor, and the
-     * principal is named beside it only when the two differ.
-     * See docs/spec/data-model.md § Authorship and attribution.
-     */
-    private get requester();
-    private get actor();
-    /**
-     * Whether unconditional owner authority applies — the owner acting as
-     * itself. The verbs that rest on it are irreversible or disclose the
-     * sharing graph, so delegation never carries one to a subject, whichever
-     * side the owner is on. Shared with the predicate a server applies to a
-     * session, which decides the same tier one step earlier. See
-     * docs/spec/access-control.md § Delegation: principal and subject.
-     */
-    private get ownerActingAlone();
-    /** Refuse anything but the owner acting as itself — see ownerActingAlone. */
-    private requireOwnerActingAlone;
-    private checkRead;
-    private checkWrite;
-    /**
-     * Whether `grantee` holds a _grant covering one of `actions` for the
-     * type's family (grants match by baseId, so a version bump never orphans
-     * one). -own actions additionally require the author to be `grantee`,
-     * unless `matchOwn` is false — on the principal side of a delegated
-     * request the suffix reads as the bare verb, since which records are
-     * reachable is the subject's business. `allowDefault` decides whether a
-     * grant naming nobody counts.
-     *
-     * Reached only through subjectAllows()/principalAllows(), which fix those
-     * two flags per side. Call one of those instead.
-     */
-    private hasGrant;
-    /**
-     * The principal half of a delegated request's authority: does the app
-     * hold any grant permitting these verbs on this type at all. Bounds what
-     * the subject's own authority can reach through it, so a powerful app
-     * can never lend its reach to a weaker subject — nor the reverse.
-     * Vacuously true when there's no delegation, where the principal and
-     * subject checks would be the same question asked twice.
-     *
-     * Neither default nor group-targeted grants count here. "Any
-     * authenticated entity" is about people who turn up, not software the
-     * owner installed; and a roster is editable by any of the group's admins,
-     * so authority reaching a principal through one would let someone other
-     * than the owner name an app to a type.
-     */
-    private principalAllows;
-    /**
-     * The subject half: which records are reachable, answered with `-own`
-     * matching and default grants both in force — the ordinary reading of a
-     * grant, since the subject is the entity a grant is written about.
-     *
-     * Paired with principalAllows() so that the two halves of the
-     * intersection are the only callers of hasGrant(): its flags differ per
-     * side and mean nothing on their own, so no call site sets them by hand.
-     */
-    private subjectAllows;
-    /**
-     * How to refuse a record this request addressed by ID. A requester who
-     * can read the record is told it exists and the verb was refused;
-     * everyone else is told what a missing ID is told, so no one learns an ID
-     * is live who could not have learned it by reading. `message` therefore
-     * only ever reaches someone holding the record already.
-     * See docs/spec/disclosure.md § Which refusal a Record answers with.
-     */
-    private denialFor;
-    private canRead;
-    private checkCreateGrant;
-    /**
-     * `_group` records are managed, not merely written: only the owner or an
-     * `admin` roster holder may mutate them — ordinary write permissions and
-     * grants don't apply. Asked of both identities under delegation, like
-     * a reshare. See docs/spec/identity.md § Group.
-     */
-    private isGroupManager;
-    /** Whether one identity, on its own, manages `record` — see isGroupManager(). */
-    private managesGroup;
-    /**
-     * Fetch a record the subject can reach and the principal holds `update` on
-     * (via permissions or an update grant), or throw. `mutating: false` marks
-     * the history readers, which borrow this gate without changing anything —
-     * the one way through it a `_grant` Record stays open to.
-     */
-    private requireUpdatable;
-    /**
-     * The write gate both requireUpdatable() and requireDeletable() are: the
-     * subject can reach the record (record-level permission or a grant) and
-     * the principal holds the same verb, intersected — or, for a `_group`, the
-     * stricter management rule that no grant reaches.
-     * See docs/spec/access-control.md § Delegation: principal and subject.
-     */
-    private requireVerb;
-    /**
-     * Fetch a record the subject can reach and the principal holds `delete` on
-     * (via permissions or a delete grant), or throw.
-     */
-    private requireDeletable;
-    /**
-     * Whether this request may reference `recordId` (as a parentId or
-     * relationship target). Missing and unreadable both return false —
-     * indistinguishable, so this can't probe for a record's existence.
-     *
-     * The owner acting alone passes without the lookup: there is no record in
-     * their own stack they may not read, so the gate could only refuse them
-     * for absence — which is `Stack`'s to answer, with a conflict that names
-     * the problem. See docs/spec/access-control.md § Reference-creation gating.
-     */
-    private canReadReferent;
-    /**
-     * Whether this request can read some record referencing `fileId` —
-     * shared by canAccessFile() and the non-owner _attachment@1 create()
-     * carve-out, which deliberately excludes the uploader clause.
-     * `_attachment@1` records never match: the carve-out has to be satisfied
-     * by some *other* record referencing the file, or one successful guess
-     * would unlock unlimited further metadata records for the same fileId.
-     * See docs/spec/attachments.md § Creating `_attachment@1` records directly.
-     */
-    private hasReadableReference;
-    /**
-     * Whether this request may reference or download `fileId` — the dual of
-     * getAttachment()'s access rule. Nonexistent and inaccessible are
-     * indistinguishable (both false), so no confirmation oracle for guessed
-     * hashes. See docs/spec/access-control.md § Reference-creation gating.
-     */
-    private canAccessFile;
-    /** Names of the type's top-level file-ref fields — the content-reference half of referencesFileId matching. */
-    private fileRefFieldNames;
-    /**
-     * Gates file-ref content fields on file access, mirroring the
-     * attachment-association gate — a file-ref field conveys attachment
-     * access exactly like an `attachment` association. Only fields present
-     * in `content` are checked (a content patch is a merge patch; untouched fields
-     * carry no new reference).
-     */
-    private requireFileRefAccess;
-    /**
-     * Reference-creation gate for one association: `attachment` requires
-     * file access, and a `relationship` naming a record in this stack
-     * requires read access to it. `tag` is unchecked, and `_group` roster
-     * associations are gated by the stricter isGroupManager() instead.
-     *
-     * The other target arms are ungated because the gate's purpose —
-     * refusing a reference that would convey access to, or confirm the
-     * existence of, an unreadable record — has nothing to bite on: core
-     * never resolves them, so no access flows through one.
-     * See docs/spec/access-control.md § Reference-creation gating.
-     */
-    private requireAssociationAccess;
-    /**
-     * Create a record on behalf of the subject: create grant required,
-     * anonymous denied, `createdBy` set to the requester, client IDs skew-checked,
-     * reference-creating options gated, and non-owner `_attachment@1`
-     * creation refused save one carve-out. A scoped create always stamps
-     * authorship — an absent `createdBy` means an unscoped `Stack` wrote it.
-     * `createdAt`/`updatedAt` are refused to everyone but the owner acting
-     * alone, rather than dropped, so an app never believes it published
-     * something it didn't. See docs/spec/access-control.md and
-     * docs/spec/data-model.md § Record IDs.
-     */
-    create<S extends ReadonlyTypeSchema>(handle: TypeHandle<S>, content: ContentOf<S>, opts?: BackdatableCreateRecordOptions): Promise<TypedRecord<S>>;
-    create<T extends Record<string, unknown> = Record<string, unknown>>(typeId: TypeId, content: T, opts?: BackdatableCreateRecordOptions): Promise<StackRecord & {
-        content: T;
-    }>;
-    /**
-     * Whether this request may decide who else reaches a record — the rule
-     * a reshare enforces, asked at create time too so the reach it
-     * withholds can't be taken one step earlier while authoring. A delegated
-     * app is denied it: widening access is the one thing containment most
-     * needs to hold. Refused rather than silently ignored, so an app never
-     * believes it published something it didn't. Not `ownerActingAlone`:
-     * the record is the subject's own, so an owner principal grants it no
-     * reach the subject lacks.
-     * See docs/spec/access-control.md § Delegation: principal and subject.
-     */
-    private mayGrantAccess;
-    /**
-     * Whether one identity, on its own, may decide who else reaches `record`
-     * — the owner-or-creator rule a reshare enforces, asked of one
-     * side at a time. See
-     * docs/spec/access-control.md § Delegation: principal and subject.
-     */
-    private mayReshare;
-    /**
-     * A record this request may read, or null. Never throws
-     * StackPermissionError: an unreadable record answers exactly as a missing
-     * one does, so a caller learns only what it may read.
-     * See docs/spec/disclosure.md § Which refusal a Record answers with.
-     */
-    get<S extends ReadonlyTypeSchema>(handle: TypeHandle<S>, id: RecordId): Promise<TypedRecord<S> | null>;
-    get(id: RecordId, opts?: GetRecordOptions): Promise<StackRecord | null>;
-    /**
-     * Runs through this.query(), so canRead() still applies — this answers a
-     * question the caller asks on its own behalf. includeUnlisted is passed
-     * only when the request is the owner acting alone, per
-     * docs/spec/identity.md § DID bindings.
-     */
-    getEntityByDid(did: EntityId): Promise<StackRecord | null>;
-    getOwnerEntity(): Promise<StackRecord | null>;
-    /**
-     * Query records, filtered to those this request can read. Pages are
-     * filtered then refilled, so a page may slightly overshoot `limit` but
-     * never skips a record. Grants are prefetched once, cursor-walked to
-     * exhaustion.
-     */
-    query<S extends ReadonlyTypeSchema>(handle: TypeHandle<S>, query?: TypedQuery): Promise<{
-        records: TypedRecord<S>[];
-        cursor: string | null;
-    }>;
-    query(query?: StackQuery): Promise<QueryResult>;
-    /**
-     * Apply a change set on behalf of the subject. Authority is resolved
-     * **per key** and every gate reads the record as it stands, never as the
-     * change set would leave it: a widened `permissions` never satisfies the
-     * read check on a `parentId` named in the same call, and a `_group`
-     * roster never satisfies the admin check that same call has to pass.
-     * One refused key refuses the whole call, so nothing is partially
-     * applied and no key is silently dropped.
-     * See docs/spec/access-control.md § Composing a change set.
-     */
-    mutate<S extends ReadonlyTypeSchema>(handle: TypeHandle<S>, id: RecordId, changes: TypedChangeSet<S>, opts?: IfVersionOptions): Promise<TypedRecord<S>>;
-    mutate(id: RecordId, changes: RecordChangeSet, opts?: IfVersionOptions): Promise<StackRecord>;
-    patchContent<S extends ReadonlyTypeSchema>(handle: TypeHandle<S>, id: RecordId, patch: PatchOf<S>, opts?: IfVersionOptions): Promise<TypedRecord<S>>;
-    patchContent(id: RecordId, patch: Record<string, unknown | null>, opts?: IfVersionOptions): Promise<StackRecord>;
-    /**
-     * The record, having established that this request may decide who else
-     * reaches it — the owner-or-creator rule, asked of both sides of a
-     * delegation, or a Group's admin rule for a `_group`. The gate the
-     * `permissions` and `unlisted` keys carry, which the write bit
-     * deliberately does not confer.
-     */
-    private requireReshareable;
-    /**
-     * Whether a change set's `permissions` key actually moves the ACL. Read
-     * off the computed delta rather than the elements the caller supplied:
-     * a gate that inspected only what was named would miss the wholesale
-     * replacement that drops everything, which names nothing at all. Any
-     * add, remove or repoint in either direction is a reshare.
-     * See docs/spec/access-control.md § Record-level permissions.
-     */
-    private permissionsMove;
-    /** The reshare decision alone, for a record already read and write-gated. */
-    private requireReshareOf;
-    /**
-     * Whether this request may decide who else reaches `record` — the
-     * decision requireReshareOf() refuses on, without the refusal, for the
-     * read paths that project on it rather than throw.
-     *
-     * A `_group` asks management, not authorship: a creator later demoted
-     * from the admin roster shouldn't retain a side door to reassign who can
-     * read or write the group record. Everything else is intersected like
-     * every other authority here, or an owner principal would carry its
-     * subject to records the subject cannot touch.
-     */
-    private canReshare;
-    /**
-     * Naming the software behind a key is the trust decision the `_app`
-     * registry exists to record, so both halves of that binding — `did` and
-     * `appId` — belong to the owner alone. Without this, record-level `write`
-     * on a card would be a second way in: one carrying no DID yet could be
-     * pointed at a write-holder's own key, or relabelled to claim another
-     * app's `appId`. `name` and `version` stay writable — display, not lookup.
-     *
-     * Owner *acting alone*, in both directions, or the same route reopens
-     * from the subject's side. `_entity` deliberately does not get this rule:
-     * naming people is what a contacts app does, so its cards stay writable
-     * by grant. See docs/spec/identity.md § DID bindings.
-     */
-    private requireOwnerForAppIdentity;
-    /**
-     * A self-reported `appId` must agree with the `_app` card naming the
-     * principal's DID, where the owner registered one: `principalId` is
-     * verified, so letting the pair disagree would leave a verified principal
-     * claiming a name the owner gave different software. A principal with no
-     * card keeps `appId` as the bare self-report it is for every undelegated
-     * writer. See docs/spec/identity.md § Attribution and what can be trusted.
-     */
-    private requireAppIdMatchesPrincipal;
-    /**
-     * The owner's own DID is the one `_entity` binding a grantee may not claim.
-     * `ownerProfile` adopts whichever card holds it, so a card minted by
-     * someone else becomes the stack's own profile, and uniqueness then makes
-     * that permanent. Every other DID stays open to a contacts app, which is
-     * the reach `_entity` is grantable for.
-     * See docs/spec/identity.md § DID bindings.
-     */
-    private requireOwnerForOwnerDid;
-    /**
-     * A `_grant` Record *is* authority, so rewriting one is the escalation
-     * UNGRANTABLE_SYSTEM_TYPES refuses at evaluation, reached by editing an
-     * existing grant rather than minting a fresh one. An `_install` decides
-     * grants and migration authority, so it is fenced the same way. The verbs
-     * that write either live on `Stack`, never `StackClient`, so no scoped
-     * write is lost. Writes only: reading one and its history stays on the
-     * ordinary gate. See docs/spec/access-control.md § Type-level grants.
-     */
-    private requireOwnerForGrantRecord;
-    /**
-     * Gated on the write bit alone, which is why the list is held to its
-     * rules first: authority reached through this verb would be exactly the
-     * escalation the partition exists to stop, decided before any record is
-     * read so it cannot depend on who is asking.
-     */
-    associate(id: RecordId, associations: DataAssociation[]): Promise<StackRecord>;
-    /** See associate() — the same write gate, the same kind refusal. */
-    dissociate(id: RecordId, associations: DataAssociation[]): Promise<StackRecord>;
-    /**
-     * The write gate, plus the per-element reference gate on each add: what a
-     * remove names is already on the record, so it is gated by the write bit
-     * alone. See associate().
-     */
-    amendAssociations(id: RecordId, changes: AssociationEdit[], surface?: string): Promise<StackRecord>;
-    /**
-     * Extend who reaches a record — the reshare gate's own verb, on the
-     * owner-or-creator rule the `permissions` key carries. The write bit
-     * does not confer it: a write-holder who could grant would escalate to
-     * deciding who else reaches the record, which is the whole of what
-     * scoping access is for.
-     * See docs/spec/access-control.md § Record-level permissions.
-     */
-    grantAccess(id: RecordId, permissions: AuthorityAssociation[]): Promise<StackRecord>;
-    /** Withdraw elements of who reaches a record — see grantAccess(). */
-    revokeAccess(id: RecordId, permissions: AuthorityAssociation[]): Promise<StackRecord>;
-    /** The reshare gate over an edit list — see grantAccess(). */
-    amendAccess(id: RecordId, changes: AssociationEdit[], surface?: string): Promise<StackRecord>;
-    /**
-     * Purge is owner-only: it is irreversible and destroys version
-     * history, so neither the write bit nor delete-own/delete-any grants
-     * reach it, and delegation doesn't carry it either. Everyone else is
-     * limited to soft delete.
-     */
-    delete(id: RecordId, opts?: DeleteRecordOptions): Promise<DeleteResult>;
-    /**
-     * delete(), plus the record it acted on. Gated identically — the
-     * existence/visibility check that produces a 404 ahead of the 403
-     * permission gate still runs via requireDeletable() before either kind
-     * of delete, so this changes what a successful call reports, not the
-     * disclosure ordering a refused one follows.
-     */
-    deleteAndReturn(id: RecordId, opts?: DeleteRecordOptions): Promise<DeleteAndReturnResult>;
-    /**
-     * Reverse a soft delete. Gated the same as delete() — undelete is the
-     * inverse of soft delete, so granting one direction without the other
-     * would be backwards. Idempotent, per Stack.undelete().
-     */
-    undelete(id: RecordId, opts?: IfVersionOptions): Promise<StackRecord>;
-    /**
-     * History is the mutation/recovery surface, not a read surface — gated
-     * like patchContent(). Reading it changes nothing, so it is the one path
-     * the `_grant` write fence leaves alone: seeing how a Record you can
-     * already read got that way is not the escalation that fence exists to
-     * stop. See docs/spec/versioning.md § History access.
-     */
-    getVersions(id: RecordId, query?: VersionsQuery): Promise<RecordVersion[]>;
-    /**
-     * See getVersions() — the same mutate-surface gate, for the same reason.
-     *
-     * The journal is where a Record's sharing history lives, and that half
-     * is the resharer's: a reader who could not have moved the ACL is served
-     * the `reshare` op without the elements beneath it, so the entry
-     * still names that it moved. Asked of both identities, so delegation is
-     * no route to it either. See docs/spec/journal.md § Reading it.
-     */
-    getJournal(id: RecordId, query?: JournalQuery): Promise<RecordJournalEntry[]>;
-    /** See getVersions() — the same mutate-surface gate. */
-    getVersion(id: RecordId, version: number): Promise<RecordVersion | null>;
-    /**
-     * Re-runs the reference-creation checks against the snapshot, so a
-     * restore can't re-convey access to a file the subject can no longer
-     * reach today. Only the owner acting alone is exempt: under delegation
-     * the checks resolve against the subject, which is whose reach the
-     * restore would widen. See docs/spec/versioning.md § Restore semantics.
-     */
-    restoreVersion(id: RecordId, version: number, opts?: IfVersionOptions): Promise<StackRecord>;
-    /**
-     * Commit a per-record migration — **the owner acting alone**, the same
-     * restriction the bulk `migrateAll()` carries by living on `Stack`, with
-     * one exception: an installed app migrating within its own families (see
-     * installMayMigrate()).
-     *
-     * Migrate replaces `content` and `typeId` wholesale, so a grant-based
-     * version would have to re-derive every gate `create()` applies at the
-     * destination *and* every gate `mutate()` applies over the existing
-     * content, reopening each one it missed. The sharpest is create()'s
-     * non-owner `_attachment@1` refusal: without it, a requester could
-     * migrate a record they authored into the family naming any `fileId` and
-     * read the bytes through canAccessFile()'s uploader clause. Ordinary
-     * write access to a record is not consent to move it between families.
-     * See docs/spec/data-model.md § Type migrations.
-     */
-    commitMigration(id: RecordId, toTypeId: TypeId, content: Record<string, unknown>, opts?: IfVersionOptions): Promise<StackRecord>;
-    /**
-     * Whether this request is an installed app migrating a record within its
-     * own families: the app acting as itself, its key linked to the one live
-     * install claiming both families in its own namespace, `toTypeId` a version the owner
-     * approved, and an `update-any` grant on each family made out to the key
-     * directly. Read as data, so a family two installs claim — however that
-     * came to be — confers nothing.
-     *
-     * The reasons migration is otherwise owner-only do not reach this case:
-     * no install can claim a system family, so neither an `_attachment` nor
-     * a DID binding is in reach, and the owner's approval of the version is
-     * the consent. See docs/spec/apps.md § Migrating an installed app's types.
-     */
-    private installMayMigrate;
-    /**
-     * Store bytes and create an _attachment@1 metadata record (create grant
-     * on `_attachment@1` required; anonymous denied), returning that record.
-     * Authorship and principal are stamped exactly as create() does.
-     */
-    putAttachment(data: Uint8Array, opts: PutAttachmentOptions): Promise<StackRecord & {
-        content: AttachmentContent;
-    }>;
-    /**
-     * Download attachment bytes. Accessible to the owner, a reader of any
-     * referencing record, or the uploader pre-association — the same
-     * predicate as the reference-creation gate (canAccessFile).
-     */
-    getAttachment(fileId: FileId): Promise<Uint8Array>;
-    /**
-     * Delete an attachment. Only the stack owner may delete attachments.
-     * Delegates to Stack.deleteAttachment(), which enforces the "not referenced" check.
-     */
-    deleteAttachment(fileId: FileId): Promise<void>;
-    /**
-     * Sweep for unreferenced attachment bytes and delete them. Only the stack
-     * owner may run this. Delegates to Stack.collectAttachmentGarbage().
-     */
-    collectAttachmentGarbage(opts?: CollectAttachmentGarbageOptions): Promise<CollectAttachmentGarbageResult>;
-    /**
-     * Observe the changes this request may read. The predicate is canRead
-     * applied per event — the same one get() and query() answer with, so a
-     * feed can't disagree with them about what this session sees.
-     *
-     * A record the subscriber cannot read produces no event at all, rather
-     * than an empty or redacted one: the existence of a change is itself a
-     * disclosure, the same reasoning that keeps a count of the whole match
-     * off a query result. See docs/spec/events.md § Permission scoping.
-     */
-    subscribe<S extends ReadonlyTypeSchema>(handle: TypeHandle<S>, handler: (change: TypedChange<S>) => void, opts?: TypedSubscribeOptions): Promise<Unsubscribe>;
-    subscribe(handler: (change: RecordChange) => void, opts?: SubscribeOptions): Promise<Unsubscribe>;
-    /**
-     * canRead for one event, through the subscription's own cache. Grants
-     * are prefetched once and refilled after an invalidation rather than
-     * re-queried per event, which would be a `_grant` scan for every change
-     * the stack makes.
-     */
-    private canReadCached;
-}
-//# sourceMappingURL=scoped-stack.d.ts.map

package/dist/scoped-stack.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"scoped-stack.d.ts","sourceRoot":"","sources":["../src/scoped-stack.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAKH,OAAO,EACL,aAAa,EAKd,MAAM,cAAc,CAAC;AAGtB,OAAO,KAAK,EAMV,oBAAoB,EAEpB,eAAe,EACf,iBAAiB,EACjB,oBAAoB,EACpB,eAAe,EACf,QAAQ,EACR,MAAM,EAIN,WAAW,EACX,YAAY,EACZ,QAAQ,EACR,aAAa,EACb,kBAAkB,EAClB,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,UAAU,EACV,WAAW,EACX,gBAAgB,EAChB,MAAM,EACN,WAAW,EACX,eAAe,EAChB,MAAM,YAAY,CAAC;AAwDpB,OAAO,KAAK,EACV,SAAS,EACT,OAAO,EACP,kBAAkB,EAClB,WAAW,EACX,cAAc,EACd,UAAU,EACV,qBAAqB,EACrB,WAAW,EACX,UAAU,EACX,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EACV,KAAK,EACL,8BAA8B,EAC9B,+BAA+B,EAC/B,8BAA8B,EAC9B,qBAAqB,EACrB,mBAAmB,EACnB,YAAY,EACZ,gBAAgB,EAChB,WAAW,EACZ,MAAM,YAAY,CAAC;AA4GpB;;;;GAIG;AACH,eAAO,MAAM,UAAU,EAAE,OAAO,MAA8B,CAAC;AAE/D,sEAAsE;AACtE,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,EAAE,KAAK,CAAC;IACb,WAAW,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC3B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC;;;;OAIG;IACH,OAAO,EAAE,YAAY,CAAC;IACtB,oEAAoE;IACpE,OAAO,EAAE,aAAa,CAAC;IACvB,UAAU,EAAE,MAAM,IAAI,CAAC;IACvB,wEAAwE;IACxE,aAAa,EAAE,OAAO,CAAC;CACxB,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,WAAY,YAAW,WAAW;;IAG7C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAC9B,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAgB;IAClD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAe;IACvC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgB;IACxC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAa;IAC7C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAU;IAExC,mEAAmE;gBACvD,KAAK,EAAE,OAAO,UAAU,EAAE,IAAI,EAAE,eAAe;IAc3D;;;OAGG;IACH,IAAI,WAAW,IAAI,QAAQ,GAAG,IAAI,CAEjC;IAED;;;OAGG;IACH,IAAI,SAAS,IAAI,QAAQ,GAAG,IAAI,CAE/B;IAED,IAAI,YAAY,IAAI,iBAAiB,CAEpC;IAED,OAAO,CAAC,aAAa,CAC0B;IAE/C,sDAAsD;IACtD,OAAO,CAAC,UAAU,CAA8E;IAEhG,uEAAuE;IACvE,OAAO,KAAK,SAAS,GAEpB;IAED;;;;;;OAMG;IACH,OAAO,KAAK,UAAU,GAErB;IAED;;;;;OAKG;IACH,OAAO,KAAK,SAAS,GAKpB;IAED,OAAO,KAAK,KAAK,GAKhB;IAED;;;;;;;OAOG;IACH,OAAO,KAAK,gBAAgB,GAK3B;IAED,6EAA6E;IAC7E,OAAO,CAAC,uBAAuB;IAI/B,OAAO,CAAC,SAAS;IAUjB,OAAO,CAAC,UAAU;IAUlB;;;;;;;;;;;OAWG;YACW,QAAQ;IAiEtB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,eAAe;IAgBvB;;;;;;;;OAQG;IACH,OAAO,CAAC,aAAa;IAiBrB;;;;;;;OAOG;YACW,SAAS;YAUT,OAAO;YAgBP,gBAAgB;IAS9B;;;;;OAKG;IACH,OAAO,CAAC,cAAc;IAKtB,iFAAiF;IACjF,OAAO,CAAC,YAAY;IAMpB;;;;;OAKG;YACW,gBAAgB;IAW9B;;;;;;OAMG;YACW,WAAW;IAkCzB;;;OAGG;IACH,OAAO,CAAC,gBAAgB;IAMxB;;;;;;;;;OASG;YACW,eAAe;IAO7B;;;;;;;;OAQG;YACW,oBAAoB;IAgBlC;;;;;OAKG;YACW,aAAa;IA6C3B,+GAA+G;YACjG,iBAAiB;IAQ/B;;;;;;OAMG;YACW,oBAAoB;IAelC;;;;;;;;;;;OAWG;YACW,wBAAwB;IAsBtC;;;;;;;;;;OAUG;IACG,MAAM,CAAC,CAAC,SAAS,kBAAkB,EACvC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,EACrB,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,EACrB,IAAI,CAAC,EAAE,8BAA8B,GACpC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACpB,MAAM,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACtE,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,CAAC,EACV,IAAI,CAAC,EAAE,8BAA8B,GACpC,OAAO,CAAC,WAAW,GAAG;QAAE,OAAO,EAAE,CAAC,CAAA;KAAE,CAAC;IA4ExC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,cAAc;IAItB;;;;;OAKG;IACH,OAAO,CAAC,UAAU;IAKlB;;;;;OAKG;IACG,GAAG,CAAC,CAAC,SAAS,kBAAkB,EACpC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,EACrB,EAAE,EAAE,QAAQ,GACX,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IAC3B,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAc7E;;;;;OAKG;IACG,cAAc,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAS1D,cAAc,IAAI,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAInD;;;;;OAKG;IACG,KAAK,CAAC,CAAC,SAAS,kBAAkB,EACtC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,EACrB,KAAK,CAAC,EAAE,UAAU,GACjB,OAAO,CAAC;QAAE,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAC1D,KAAK,CAAC,KAAK,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC;IA0CrD;;;;;;;;;OASG;IACG,MAAM,CAAC,CAAC,SAAS,kBAAkB,EACvC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,EACrB,EAAE,EAAE,QAAQ,EACZ,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,EAC1B,IAAI,CAAC,EAAE,gBAAgB,GACtB,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACpB,MAAM,CACV,EAAE,EAAE,QAAQ,EACZ,OAAO,EAAE,eAAe,EACxB,IAAI,CAAC,EAAE,gBAAgB,GACtB,OAAO,CAAC,WAAW,CAAC;IA2GjB,YAAY,CAAC,CAAC,SAAS,kBAAkB,EAC7C,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,EACrB,EAAE,EAAE,QAAQ,EACZ,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,EACjB,IAAI,CAAC,EAAE,gBAAgB,GACtB,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACpB,YAAY,CAChB,EAAE,EAAE,QAAQ,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC,EACrC,IAAI,CAAC,EAAE,gBAAgB,GACtB,OAAO,CAAC,WAAW,CAAC;IAavB;;;;;;OAMG;YACW,kBAAkB;IAQhC;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe;IAKvB,6EAA6E;YAC/D,gBAAgB;IAS9B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,UAAU;IAMlB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,0BAA0B;IASlC;;;;;;;OAOG;YACW,4BAA4B;IAuB1C;;;;;;;OAOG;IACH,OAAO,CAAC,uBAAuB;IAM/B;;;;;;;;OAQG;YACW,0BAA0B;IAOxC;;;;;OAKG;IACG,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC;IAQpF,oEAAoE;IAC9D,UAAU,CAAC,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC;IAQrF;;;;OAIG;IACG,iBAAiB,CACrB,EAAE,EAAE,QAAQ,EACZ,OAAO,EAAE,eAAe,EAAE,EAC1B,OAAO,SAAwB,GAC9B,OAAO,CAAC,WAAW,CAAC;IAUvB;;;;;;;OAOG;IACG,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,oBAAoB,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC;IAQ1F,qEAAqE;IAC/D,YAAY,CAAC,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,oBAAoB,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC;IAQ3F,8DAA8D;IACxD,WAAW,CACf,EAAE,EAAE,QAAQ,EACZ,OAAO,EAAE,eAAe,EAAE,EAC1B,OAAO,SAAkB,GACxB,OAAO,CAAC,WAAW,CAAC;IAMvB;;;;;OAKG;IACG,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,GAAE,mBAAwB,GAAG,OAAO,CAAC,YAAY,CAAC;IAKjF;;;;;;OAMG;IACG,eAAe,CACnB,EAAE,EAAE,QAAQ,EACZ,IAAI,GAAE,mBAAwB,GAC7B,OAAO,CAAC,qBAAqB,CAAC;IAQjC;;;;OAIG;IACG,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAAC,WAAW,CAAC;IAK/E;;;;;;OAMG;IACG,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,GAAE,aAAkB,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAKpF;;;;;;;;OAQG;IACG,UAAU,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,GAAE,YAAiB,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAMvF,wDAAwD;IAClD,UAAU,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAK9E;;;;;;OAMG;IACG,cAAc,CAClB,EAAE,EAAE,QAAQ,EACZ,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,WAAW,CAAC;IAuBvB;;;;;;;;;;;;;;;OAeG;IACG,eAAe,CACnB,EAAE,EAAE,QAAQ,EACZ,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,WAAW,CAAC;IAavB;;;;;;;;;;;;OAYG;YACW,iBAAiB;IAsD/B;;;;OAIG;IACG,aAAa,CACjB,IAAI,EAAE,UAAU,EAChB,IAAI,EAAE,oBAAoB,GACzB,OAAO,CAAC,WAAW,GAAG;QAAE,OAAO,EAAE,iBAAiB,CAAA;KAAE,CAAC;IA4BxD;;;;OAIG;IACG,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IASxD;;;OAGG;IACG,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKrD;;;OAGG;IACG,wBAAwB,CAC5B,IAAI,CAAC,EAAE,+BAA+B,GACrC,OAAO,CAAC,8BAA8B,CAAC;IAK1C;;;;;;;;;OASG;IACG,SAAS,CAAC,CAAC,SAAS,kBAAkB,EAC1C,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,EACrB,OAAO,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,KAAK,IAAI,EACzC,IAAI,CAAC,EAAE,qBAAqB,GAC3B,OAAO,CAAC,WAAW,CAAC;IACjB,SAAS,CACb,OAAO,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,IAAI,EACvC,IAAI,CAAC,EAAE,gBAAgB,GACtB,OAAO,CAAC,WAAW,CAAC;IAoCvB;;;;;OAKG;YACW,aAAa;CAI5B"}