@haverstack/core 0.41.0 → 0.43.0

package/dist/scoped-stack/authority.js

@@ -0,0 +1,408 @@
+/**
+ * Scope authority
+ * -------------------------------------------------------
+ * What one (principal, subject) pair may do, as questions with yes-or-no
+ * answers: may this request read the record, create this type, reshare,
+ * reach this file. ScopedStack turns the answers into refusals and
+ * forwards what passes to its Stack; nothing here throws a refusal or
+ * writes. See docs/spec/access-control.md § Delegation: principal and
+ * subject.
+ */
+import { groupRoleFromAssociations, isOwnerActingAlone, readCompanions, roleSatisfies, } from '../access.js';
+import { inReach } from '../adapter/reach.js';
+import { StackError, StackNotFoundError, StackPermissionError } from '../errors.js';
+import { UNGRANTABLE_SYSTEM_TYPES, grantConveys, grantCoversGrantee, grantReach, } from '../grants.js';
+import { filtersContent, splitQuery } from '../query-validation.js';
+import { baseIdOf, fileRefFields } from '../schema.js';
+import { familyPolicy } from './family-policy.js';
+import { claimedFamilies, familyStanding, INSTALL_APP_LABEL, linkedIds } from '../install.js';
+import { findFirstMatch, loadGrantRecords, loadInstallRecords, loadRosterRoles, queryAllPages, } from '../stack/reads.js';
+import { AuthoritySnapshot } from './authority-snapshot.js';
+import { SYSTEM_TYPES } from '../types/index.js';
+/**
+ * How each side of a request reads a grant. The subject is the entity a
+ * grant is written about, so every tier counts; on the principal's side
+ * only a grant naming it directly counts. See
+ * docs/spec/access-control.md § Delegation: principal and subject.
+ */
+const SUBJECT_SIDE = { allowDefault: true, allowGroup: true };
+const PRINCIPAL_SIDE = { allowDefault: false, allowGroup: false };
+/**
+ * What each verb is granted by: the grant action reaching a family whole,
+ * the one reaching the subject's own Records in it, and the permission bit
+ * reaching one Record. See docs/spec/access-control.md § Reach.
+ */
+const VERBS = {
+    create: { any: 'create' },
+    read: { any: 'read-any', own: 'read-own', bit: 'read' },
+    update: { any: 'update-any', own: 'update-own', bit: 'write' },
+    delete: { any: 'delete-any', own: 'delete-own', bit: 'write' },
+};
+const ANYONE = { kind: 'anyone', label: 'read' };
+export class ScopeAuthority {
+    stack;
+    principalId;
+    subjectId;
+    queryReadable;
+    constructor(stack, 
+    /** Whose grants bound what this request may do — see ScopedStack.principalId. */
+    principalId, 
+    /** Whom this request acts for and attributes writes to — see ScopedStack.subjectId. */
+    subjectId, 
+    /** Stack.query() within a reach — see ScopedStack.query(). */
+    queryReadable) {
+        this.stack = stack;
+        this.principalId = principalId;
+        this.subjectId = subjectId;
+        this.queryReadable = queryReadable;
+    }
+    /**
+     * The authority this request acts with, for one operation: pass it to
+     * each check the operation makes, so the grants, the rosters and each
+     * verb's reach are read at most once. An anonymous request is named by no
+     * grant and held by no roster, so it reads neither.
+     */
+    snapshot() {
+        const subject = this.subjectId;
+        return new AuthoritySnapshot({
+            grants: () => this.identified ? loadGrantRecords((q) => this.stack.query(q)) : Promise.resolve([]),
+            roles: () => subject === null
+                ? Promise.resolve(new Map())
+                : loadRosterRoles((q) => this.stack.query(q), subject),
+            reach: (verb, snapshot) => this.buildReach(verb, snapshot),
+        });
+    }
+    /** Whether a delegated app is acting for someone other than itself. */
+    get delegated() {
+        return this.subjectId !== this.principalId;
+    }
+    /**
+     * Whether any grant could name this request — the one question every
+     * prefetch asks before scanning the `_grant` family, since an anonymous
+     * requester is reached by none. Both identities are read: `asEntity()`
+     * refuses an anonymous principal acting for a subject, so they are null
+     * together, and saying so costs nothing.
+     */
+    get identified() {
+        return this.principalId !== null || this.subjectId !== null;
+    }
+    /**
+     * Who this request is, for stamping onto whatever it mutates. Attribution
+     * follows record-level authorship: the subject is the actor, and the
+     * principal is named beside it only when the two differ.
+     * See docs/spec/data-model.md § Authorship and attribution.
+     */
+    get requester() {
+        if (this.subjectId === null)
+            return undefined;
+        return this.delegated && this.principalId !== null
+            ? { subjectId: this.subjectId, principalId: this.principalId }
+            : { subjectId: this.subjectId };
+    }
+    /**
+     * Whether unconditional owner authority applies — the owner acting as
+     * itself. The verbs resting on it are irreversible or disclose the sharing
+     * graph, so delegation never carries it, whichever side the owner is on.
+     * See docs/spec/access-control.md § Delegation: principal and subject.
+     */
+    get ownerActingAlone() {
+        return isOwnerActingAlone({ principalId: this.principalId, subjectId: this.subjectId }, this.stack.ownerEntityId);
+    }
+    /**
+     * Whether no grant bounds the principal: undelegated, it is the subject
+     * itself, and the owner as principal is the owner's own software.
+     * See docs/spec/access-control.md § Delegation: principal and subject.
+     */
+    get principalUnbounded() {
+        return !this.delegated || this.principalId === this.stack.ownerEntityId;
+    }
+    /**
+     * The families `grantee`'s grants convey one of `actions` on, read the way
+     * `side` reads a grant. Only the subject's side counts a group, so the
+     * rosters read are always the subject's.
+     * See docs/spec/access-control.md § Who a grant reaches.
+     */
+    async familiesConveying(grantee, side, actions, snapshot) {
+        if (!grantee)
+            return [];
+        const families = new Set();
+        for (const r of await snapshot.grants()) {
+            const c = r.content;
+            // A stored baseId is judged by grantReach(), which refuses a
+            // versioned one.
+            const reach = grantReach(c);
+            if (!reach || families.has(reach.familyId))
+                continue;
+            // grantType() refuses to write these, but a _grant record is an
+            // ordinary Record: an unscoped Stack, an import, or a server mapping
+            // a request body onto Stack can mint one anyway. Refusing at the
+            // point of use is what makes the rule hold regardless of how the
+            // record got there.
+            if (UNGRANTABLE_SYSTEM_TYPES.has(reach.familyId))
+                continue;
+            if (!actions.some((a) => grantConveys(reach.actions, a)))
+                continue;
+            if (await grantCoversGrantee(c, grantee, { ...side, roles: snapshot.roles })) {
+                families.add(reach.familyId);
+            }
+        }
+        return [...families];
+    }
+    /**
+     * What this request may do with `verb` — that verb's rules, built whole
+     * even where a Record's own permissions would settle it, since every gate
+     * asks one value at a flat cost. The principal's grants fence it; within,
+     * the subject reaches what grants and permissions give it, an owner
+     * subject everything. See docs/spec/access-control.md § Reach.
+     */
+    async buildReach(verb, snapshot) {
+        const { any, own, bit } = VERBS[verb];
+        const reach = this.principalUnbounded
+            ? {}
+            : {
+                fence: await this.familiesConveying(this.principalId, PRINCIPAL_SIDE, own ? [any, own] : [any], snapshot),
+            };
+        const subject = this.subjectId;
+        if (subject === this.stack.ownerEntityId)
+            return reach;
+        const families = (action) => this.familiesConveying(subject, SUBJECT_SIDE, [action], snapshot);
+        reach.within = {
+            baseIds: await families(any),
+            ...(subject !== null &&
+                own && { authored: { subjectId: subject, baseIds: await families(own) } }),
+            permissions: bit ? await this.elementSets(bit, snapshot) : [],
+        };
+        return reach;
+    }
+    /**
+     * The permission elements carrying `bit` to the subject, as the sets a
+     * Record must hold whole. A `read` stands alone, as does `anyone`; a
+     * `write` stands beside one of its readCompanions().
+     */
+    async elementSets(bit, snapshot) {
+        const grantees = [];
+        const subject = this.subjectId;
+        if (subject !== null) {
+            grantees.push({ kind: 'entity', entityId: subject });
+            for (const [groupId, held] of await snapshot.roles()) {
+                for (const role of ['member', 'admin']) {
+                    if (roleSatisfies(held, role))
+                        grantees.push({ kind: 'group', groupId, role });
+                }
+            }
+        }
+        const element = (label, grantee) => ({
+            kind: 'permission',
+            label,
+            grantee,
+        });
+        if (bit === 'read')
+            return [[ANYONE], ...grantees.map((g) => [element('read', g)])];
+        return grantees.flatMap((g) => readCompanions(g).map((c) => [element('write', g), c]));
+    }
+    /** Whether this request may `verb` the Record: its reach, asked of one Record. */
+    async may(verb, record, snapshot) {
+        return inReach(record, await snapshot.reach(verb));
+    }
+    /**
+     * may() with the principal's fence set aside — whether the subject alone
+     * reaches the Record, for a refusal that says which side lacked the verb.
+     */
+    async subjectMay(verb, record, snapshot) {
+        const { within } = await snapshot.reach(verb);
+        return inReach(record, within ? { within } : {});
+    }
+    canRead(record, snapshot) {
+        return this.may('read', record, snapshot);
+    }
+    /** Whether this request may create a Record of the type, asked of the Record it would make. */
+    canCreate(typeId, snapshot) {
+        return this.may('create', { typeId, createdBy: this.requester }, snapshot);
+    }
+    /**
+     * How to refuse a record this request addressed by ID: a permission error
+     * to a requester who can read it, the not-found answer to anyone else, so
+     * `message` only reaches someone holding the record already.
+     * See docs/spec/disclosure.md § Which refusal a Record answers with.
+     */
+    async denialFor(record, message, snapshot) {
+        if (await this.canRead(record, snapshot))
+            return new StackPermissionError(message);
+        return new StackNotFoundError(`Record not found: "${record.id}"`);
+    }
+    /**
+     * `_group` records are managed, not merely written: only the owner or an
+     * `admin` roster holder may mutate them — ordinary write permissions and
+     * grants don't apply. Asked of both identities under delegation, like
+     * a reshare. See docs/spec/identity.md § Group.
+     */
+    isGroupManager(record) {
+        if (!this.managesGroup(this.principalId, record))
+            return false;
+        return !this.delegated || this.managesGroup(this.subjectId, record);
+    }
+    /** Whether one identity, on its own, manages `record` — see isGroupManager(). */
+    managesGroup(entityId, record) {
+        if (!entityId)
+            return false;
+        if (entityId === this.stack.ownerEntityId)
+            return true;
+        return groupRoleFromAssociations(record.associations, entityId) === 'admin';
+    }
+    /**
+     * Whether this request may reference `recordId` as a parent or target.
+     * Missing and unreadable are both false, so this probes nothing. The
+     * owner acting alone skips the lookup and leaves absence to `Stack`.
+     * See docs/spec/access-control.md § Reference-creation gating.
+     */
+    async canReadReferent(recordId, snapshot) {
+        if (this.ownerActingAlone)
+            return true;
+        const record = await this.stack.get(recordId, { includeDeleted: true });
+        if (!record)
+            return false;
+        return this.canRead(record, snapshot);
+    }
+    /**
+     * Whether this request can read some record referencing `fileId`, other
+     * than an `_attachment@1` record — otherwise one correct guess would
+     * unlock unlimited further metadata records for the file.
+     * See docs/spec/attachments.md § Creating `_attachment@1` records directly.
+     */
+    async hasReadableReference(fileId, snapshot) {
+        const reach = await snapshot.reach('read');
+        const match = await findFirstMatch((q) => this.queryReadable(splitQuery(q), reach), 
+        // Reach, not enumeration: a record readable by ID conveys the file it
+        // references. See docs/spec/unlisted.md.
+        { filter: { referencesFileId: fileId, includeUnlisted: true } }, (record) => baseIdOf(record.typeId) !== SYSTEM_TYPES.ATTACHMENT);
+        return match !== undefined;
+    }
+    /**
+     * Whether this request may reference or download `fileId` — the dual of
+     * getAttachment()'s access rule. Nonexistent and inaccessible are
+     * indistinguishable (both false), so no confirmation oracle for guessed
+     * hashes. See docs/spec/access-control.md § Reference-creation gating.
+     */
+    async canAccessFile(fileId, snapshot) {
+        if (this.ownerActingAlone)
+            return true;
+        // Reaching a file through a record this request can read is already
+        // fully intersected — the reach fences that record's own type, which
+        // is the type the reference lives on.
+        if (await this.hasReadableReference(fileId, snapshot))
+            return true;
+        if (!this.subjectId)
+            return false;
+        // The remaining paths are authorship facts about the subject, so they
+        // decide *which* files match — they are not themselves a grant, and the
+        // principal still needs one of its own on the attachment type.
+        const { fence } = await snapshot.reach('read');
+        if (fence && !fence.includes(SYSTEM_TYPES.ATTACHMENT))
+            return false;
+        if (this.subjectId === this.stack.ownerEntityId)
+            return true;
+        // `includeUnlisted`, as hasReadableReference() above: withholding a
+        // record from enumeration decides nothing about what it conveys, and
+        // the uploader clause does not lapse. See docs/spec/unlisted.md.
+        return filtersContent(this.stack.capabilities)
+            ? (await this.stack.query({
+                filter: {
+                    typeId: `${SYSTEM_TYPES.ATTACHMENT}@1`,
+                    createdBy: { subjectId: this.subjectId },
+                    content: { fileId },
+                    includeUnlisted: true,
+                },
+                limit: 1,
+            })).records.length > 0
+            : (await queryAllPages((q) => this.stack.query(q), {
+                filter: {
+                    typeId: `${SYSTEM_TYPES.ATTACHMENT}@1`,
+                    createdBy: { subjectId: this.subjectId },
+                    includeUnlisted: true,
+                },
+            })).some((r) => r.content.fileId === fileId);
+    }
+    /**
+     * Whether this request is an installed app, acting as itself, migrating
+     * `record` within families its one live install claims, to a version the
+     * owner approved, holding `update-any` on each directly.
+     * See docs/spec/apps.md § Migrating an installed app's types.
+     */
+    async installMayMigrate(record, toTypeId, snapshot) {
+        const principal = this.principalId;
+        if (!principal || this.delegated)
+            return false;
+        const families = new Set([baseIdOf(record.typeId), baseIdOf(toTypeId)]);
+        const installs = await loadInstallRecords(this.stack);
+        let install;
+        for (const family of families) {
+            const claimants = installs.filter((r) => claimedFamilies(r.content).has(family));
+            if (claimants.length !== 1)
+                return false;
+            if (familyStanding(family, claimants[0].content.appId) !== 'own')
+                return false;
+            if (install && install.id !== claimants[0].id)
+                return false;
+            install = claimants[0];
+        }
+        if (!install || install.deletedAt)
+            return false;
+        if (!Array.isArray(install.content.defines) || !install.content.defines.includes(toTypeId)) {
+            return false;
+        }
+        let linked = false;
+        for (const cardId of linkedIds(install, INSTALL_APP_LABEL)) {
+            const card = await this.stack.get(cardId);
+            if (card && baseIdOf(card.typeId) === SYSTEM_TYPES.APP) {
+                if (card.content.did === principal)
+                    linked = true;
+            }
+        }
+        if (!linked)
+            return false;
+        // Grants naming the app itself: an install reaches only families the
+        // owner named it to, whoever else holds them.
+        const held = await this.familiesConveying(principal, PRINCIPAL_SIDE, ['update-any'], snapshot);
+        return [...families].every((family) => held.includes(family));
+    }
+    /** Names of the type's top-level file-ref fields — the content-reference half of referencesFileId matching. */
+    async fileRefFieldNames(typeId) {
+        const type = await this.stack.getType(typeId);
+        return type ? fileRefFields(type.schema) : [];
+    }
+    /**
+     * Whether this request may widen who reaches a record, at create time or
+     * after. A delegated app may not, unless the owner is its principal:
+     * widening access is what containment most needs to hold.
+     * See docs/spec/access-control.md § Delegation: principal and subject.
+     */
+    mayGrantAccess() {
+        return this.principalUnbounded;
+    }
+    /**
+     * Whether one identity, on its own, may decide who else reaches `record`
+     * — the owner-or-creator rule a reshare enforces, asked of one
+     * side at a time. See
+     * docs/spec/access-control.md § Delegation: principal and subject.
+     */
+    mayReshare(entityId, record) {
+        if (!entityId)
+            return false;
+        return entityId === this.stack.ownerEntityId || entityId === record.createdBy?.subjectId;
+    }
+    /**
+     * Whether this request may decide who else reaches `record`: management
+     * for a `_group`, so a demoted creator keeps no side door; otherwise the
+     * owner-or-author rule, asked of both sides of a delegation.
+     * See docs/spec/access-control.md § Record-level permissions.
+     */
+    canReshare(record) {
+        if (familyPolicy(record.typeId).writers === 'group-managers') {
+            return this.isGroupManager(record);
+        }
+        if (!this.mayReshare(this.principalId, record))
+            return false;
+        return !this.delegated || this.mayReshare(this.subjectId, record);
+    }
+}
+//# sourceMappingURL=authority.js.map

package/dist/scoped-stack/authority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authority.js","sourceRoot":"","sources":["../../src/scoped-stack/authority.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,yBAAyB,EACzB,kBAAkB,EAClB,cAAc,EACd,aAAa,GACd,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAE9C,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpF,OAAO,EACL,wBAAwB,EACxB,YAAY,EACZ,kBAAkB,EAClB,UAAU,GACX,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEpE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC9F,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,aAAa,GACd,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAmBjD;;;;;GAKG;AACH,MAAM,YAAY,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAW,CAAC;AACvE,MAAM,cAAc,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAW,CAAC;AAG3E;;;;GAIG;AACH,MAAM,KAAK,GAAuF;IAChG,MAAM,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE;IACzB,IAAI,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE;IACvD,MAAM,EAAE,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,OAAO,EAAE;IAC9D,MAAM,EAAE,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,OAAO,EAAE;CAC/D,CAAC;AAEF,MAAM,MAAM,GAAyB,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAEvE,MAAM,OAAO,cAAc;IAEN;IAER;IAEA;IAEQ;IAPnB,YACmB,KAAY;IAC7B,iFAAiF;IACxE,WAA4B;IACrC,uFAAuF;IAC9E,SAA0B;IACnC,8DAA8D;IAC7C,aAAwE;QANxE,UAAK,GAAL,KAAK,CAAO;QAEpB,gBAAW,GAAX,WAAW,CAAiB;QAE5B,cAAS,GAAT,SAAS,CAAiB;QAElB,kBAAa,GAAb,aAAa,CAA2D;IACxF,CAAC;IAEJ;;;;;OAKG;IACH,QAAQ;QACN,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC;QAC/B,OAAO,IAAI,iBAAiB,CAAC;YAC3B,MAAM,EAAE,GAAG,EAAE,CACX,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACtF,KAAK,EAAE,GAAG,EAAE,CACV,OAAO,KAAK,IAAI;gBACd,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,GAAG,EAAE,CAAC;gBAC5B,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC;YAC1D,KAAK,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC;SAC3D,CAAC,CAAC;IACL,CAAC;IAED,uEAAuE;IACvE,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,WAAW,CAAC;IAC7C,CAAC;IAED;;;;;;OAMG;IACH,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,WAAW,KAAK,IAAI,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC;IAC9D,CAAC;IAED;;;;;OAKG;IACH,IAAI,SAAS;QACX,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QAC9C,OAAO,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI;YAChD,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE;YAC9D,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;IACpC,CAAC;IAED;;;;;OAKG;IACH,IAAI,gBAAgB;QAClB,OAAO,kBAAkB,CACvB,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,EAC5D,IAAI,CAAC,KAAK,CAAC,aAAa,CACzB,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,IAAY,kBAAkB;QAC5B,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC;IAC1E,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,iBAAiB,CAC7B,OAAwB,EACxB,IAAe,EACf,OAA+B,EAC/B,QAA2B;QAE3B,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;QACnC,KAAK,MAAM,CAAC,IAAI,MAAM,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YACxC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAuB,CAAC;YACpC,6DAA6D;YAC7D,iBAAiB;YACjB,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YAC5B,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC;gBAAE,SAAS;YACrD,gEAAgE;YAChE,qEAAqE;YACrE,iEAAiE;YACjE,iEAAiE;YACjE,oBAAoB;YACpB,IAAI,wBAAwB,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC;gBAAE,SAAS;YAC3D,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;gBAAE,SAAS;YACnE,IAAI,MAAM,kBAAkB,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC;gBAC7E,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;QACD,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC;IACvB,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,UAAU,CAAC,IAAe,EAAE,QAA2B;QACnE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,KAAK,GAAU,IAAI,CAAC,kBAAkB;YAC1C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,KAAK,EAAE,MAAM,IAAI,CAAC,iBAAiB,CACjC,IAAI,CAAC,WAAW,EAChB,cAAc,EACd,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EACxB,QAAQ,CACT;aACF,CAAC;QACN,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC;QAC/B,IAAI,OAAO,KAAK,IAAI,CAAC,KAAK,CAAC,aAAa;YAAE,OAAO,KAAK,CAAC;QAEvD,MAAM,QAAQ,GAAG,CAAC,MAAmB,EAAE,EAAE,CACvC,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC;QACpE,KAAK,CAAC,MAAM,GAAG;YACb,OAAO,EAAE,MAAM,QAAQ,CAAC,GAAG,CAAC;YAC5B,GAAG,CAAC,OAAO,KAAK,IAAI;gBAClB,GAAG,IAAI,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YAC5E,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;SAC9D,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,WAAW,CACvB,GAAqB,EACrB,QAA2B;QAE3B,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC;QAC/B,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;YACrD,KAAK,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,MAAM,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC;gBACrD,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAU,EAAE,CAAC;oBAChD,IAAI,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC;wBAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;gBACjF,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GAAG,CAAC,KAAuB,EAAE,OAAgB,EAAwB,EAAE,CAAC,CAAC;YACpF,IAAI,EAAE,YAAY;YAClB,KAAK;YACL,OAAO;SACR,CAAC,CAAC;QACH,IAAI,GAAG,KAAK,MAAM;YAAE,OAAO,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpF,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACzF,CAAC;IAED,kFAAkF;IAClF,KAAK,CAAC,GAAG,CAAC,IAAe,EAAE,MAAqB,EAAE,QAA2B;QAC3E,OAAO,OAAO,CAAC,MAAM,EAAE,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACrD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU,CACd,IAAe,EACf,MAAqB,EACrB,QAA2B;QAE3B,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC9C,OAAO,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,OAAO,CAAC,MAAmB,EAAE,QAA2B;QACtD,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAED,+FAA+F;IAC/F,SAAS,CAAC,MAAc,EAAE,QAA2B;QACnD,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC7E,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,SAAS,CACb,MAAmB,EACnB,OAAe,EACf,QAA2B;QAE3B,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC;YAAE,OAAO,IAAI,oBAAoB,CAAC,OAAO,CAAC,CAAC;QACnF,OAAO,IAAI,kBAAkB,CAAC,sBAAsB,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;IACpE,CAAC;IAED;;;;;OAKG;IACH,cAAc,CAAC,MAAmB;QAChC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACtE,CAAC;IAED,iFAAiF;IACzE,YAAY,CAAC,QAAyB,EAAE,MAAmB;QACjE,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5B,IAAI,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC;QACvD,OAAO,yBAAyB,CAAC,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,KAAK,OAAO,CAAC;IAC9E,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,eAAe,CAAC,QAAgB,EAAE,QAA2B;QACjE,IAAI,IAAI,CAAC,gBAAgB;YAAE,OAAO,IAAI,CAAC;QACvC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,oBAAoB,CAAC,MAAc,EAAE,QAA2B;QACpE,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,MAAM,cAAc,CAChC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;QAC/C,sEAAsE;QACtE,yCAAyC;QACzC,EAAE,MAAM,EAAE,EAAE,gBAAgB,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,EAC/D,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,YAAY,CAAC,UAAU,CAChE,CAAC;QACF,OAAO,KAAK,KAAK,SAAS,CAAC;IAC7B,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CAAC,MAAc,EAAE,QAA2B;QAC7D,IAAI,IAAI,CAAC,gBAAgB;YAAE,OAAO,IAAI,CAAC;QAEvC,oEAAoE;QACpE,qEAAqE;QACrE,sCAAsC;QACtC,IAAI,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAEnE,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAElC,sEAAsE;QACtE,wEAAwE;QACxE,+DAA+D;QAC/D,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,UAAU,CAAC;YAAE,OAAO,KAAK,CAAC;QAEpE,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,KAAK,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC;QAE7D,oEAAoE;QACpE,qEAAqE;QACrE,iEAAiE;QACjE,OAAO,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;YAC5C,CAAC,CAAC,CACE,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;gBACrB,MAAM,EAAE;oBACN,MAAM,EAAE,GAAG,YAAY,CAAC,UAAU,IAAI;oBACtC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;oBACxC,OAAO,EAAE,EAAE,MAAM,EAAE;oBACnB,eAAe,EAAE,IAAI;iBACtB;gBACD,KAAK,EAAE,CAAC;aACT,CAAC,CACH,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;YACtB,CAAC,CAAC,CACE,MAAM,aAAa,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;gBAC9C,MAAM,EAAE;oBACN,MAAM,EAAE,GAAG,YAAY,CAAC,UAAU,IAAI;oBACtC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;oBACxC,eAAe,EAAE,IAAI;iBACtB;aACF,CAAC,CACH,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAC,CAAC,OAA6B,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IACxE,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,iBAAiB,CACrB,MAAmB,EACnB,QAAgB,EAChB,QAA2B;QAE3B,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC;QACnC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAC/C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAExE,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtD,IAAI,OAAgE,CAAC;QACrE,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;YAC9B,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;YACjF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YACzC,IAAI,cAAc,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK;gBAAE,OAAO,KAAK,CAAC;YAChF,IAAI,OAAO,IAAI,OAAO,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAE,CAAC,EAAE;gBAAE,OAAO,KAAK,CAAC;YAC7D,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QACzB,CAAC;QACD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3F,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,OAAO,EAAE,iBAAiB,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC1C,IAAI,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,YAAY,CAAC,GAAG,EAAE,CAAC;gBACvD,IAAK,IAAI,CAAC,OAAsB,CAAC,GAAG,KAAK,SAAS;oBAAE,MAAM,GAAG,IAAI,CAAC;YACpE,CAAC;QACH,CAAC;QACD,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAE1B,qEAAqE;QACrE,8CAA8C;QAC9C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,cAAc,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC/F,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,+GAA+G;IAC/G,KAAK,CAAC,iBAAiB,CAAC,MAAc;QACpC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChD,CAAC;IAED;;;;;OAKG;IACH,cAAc;QACZ,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACjC,CAAC;IAED;;;;;OAKG;IACK,UAAU,CAAC,QAAyB,EAAE,MAAmB;QAC/D,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5B,OAAO,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,aAAa,IAAI,QAAQ,KAAK,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC;IAC3F,CAAC;IAED;;;;;OAKG;IACH,UAAU,CAAC,MAAmB;QAC5B,IAAI,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,KAAK,gBAAgB,EAAE,CAAC;YAC7D,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QAC7D,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACpE,CAAC;CACF"}

package/dist/scoped-stack/family-policy.d.ts

@@ -0,0 +1,59 @@
+/**
+ * System family policies
+ * -------------------------------------------------------
+ * The rules a system family holds a scoped writer to on top of the
+ * ordinary gates: who may write its Records at all, which content values
+ * are the owner's alone to set, and what a create must already be able to
+ * reach. One entry per family, read by every verb through the questions
+ * below, so a rule reaches each verb that writes what it governs — create,
+ * patchContent(), restoreVersion() and commitMigration() alike — rather
+ * than only the ones that remembered to ask it.
+ *
+ * A family with no entry is ordinary. Grants on a family are refused
+ * separately, at the write and at evaluation (UNGRANTABLE_SYSTEM_TYPES in
+ * grants.ts), since a grant is not a scoped write.
+ *
+ * See docs/spec/access-control.md § Per-verb gates.
+ */
+import type { EntityId, TypeId } from '../types/index.js';
+/**
+ * Who may write a Record of a family, whatever its own `permissions` and
+ * any grant say: anyone the ordinary write gate admits, the owner acting
+ * alone, or the Group's admins and the owner.
+ */
+export type FamilyWriters = 'ordinary' | 'owner-alone' | 'group-managers';
+type FamilyPolicy = {
+    writers: FamilyWriters;
+    /**
+     * Content fields only the owner acting alone may set, and when: `any`
+     * change, or only a value naming the owner's own DID.
+     */
+    ownerFields?: {
+        fields: readonly string[];
+        when: 'any' | 'owner-did';
+        message: string;
+    };
+    /**
+     * A content field naming a file a non-owner create must already be able
+     * to read through some other Record — see docs/spec/attachments.md
+     * § Creating `_attachment@1` records directly.
+     */
+    createNamesFile?: string;
+    /**
+     * Whether `relationship` associations are a roster naming Entities
+     * rather than references to readable Records, and so carry no
+     * reference gate — see docs/spec/access-control.md § Reference-creation gating.
+     */
+    rosterAssociations?: boolean;
+};
+/** The policy a Record of `typeId` is held to. */
+export declare const familyPolicy: (typeId: TypeId) => FamilyPolicy;
+/**
+ * The refusal a write owes when it moves content only the owner acting
+ * alone may set, or null when it moves none. Compared value-wise between
+ * `before` (absent at create) and `after`, so re-sending a value a Record
+ * already holds claims nothing.
+ */
+export declare const ownerFieldRefusal: (typeId: TypeId, before: Record<string, unknown> | undefined, after: Record<string, unknown>, ownerEntityId: EntityId) => string | null;
+export {};
+//# sourceMappingURL=family-policy.d.ts.map

package/dist/scoped-stack/family-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"family-policy.d.ts","sourceRoot":"","sources":["../../src/scoped-stack/family-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAE1D;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,aAAa,GAAG,gBAAgB,CAAC;AAE1E,KAAK,YAAY,GAAG;IAClB,OAAO,EAAE,aAAa,CAAC;IACvB;;;OAGG;IACH,WAAW,CAAC,EAAE;QAAE,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,IAAI,EAAE,KAAK,GAAG,WAAW,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACxF;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AAoCF,kDAAkD;AAClD,eAAO,MAAM,YAAY,GAAI,QAAQ,MAAM,KAAG,YACF,CAAC;AAE7C;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,GAC5B,QAAQ,MAAM,EACd,QAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC3C,OAAO,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,eAAe,QAAQ,KACtB,MAAM,GAAG,IAQX,CAAC"}

package/dist/scoped-stack/family-policy.js

@@ -0,0 +1,68 @@
+/**
+ * System family policies
+ * -------------------------------------------------------
+ * The rules a system family holds a scoped writer to on top of the
+ * ordinary gates: who may write its Records at all, which content values
+ * are the owner's alone to set, and what a create must already be able to
+ * reach. One entry per family, read by every verb through the questions
+ * below, so a rule reaches each verb that writes what it governs — create,
+ * patchContent(), restoreVersion() and commitMigration() alike — rather
+ * than only the ones that remembered to ask it.
+ *
+ * A family with no entry is ordinary. Grants on a family are refused
+ * separately, at the write and at evaluation (UNGRANTABLE_SYSTEM_TYPES in
+ * grants.ts), since a grant is not a scoped write.
+ *
+ * See docs/spec/access-control.md § Per-verb gates.
+ */
+import { baseIdOf } from '../schema.js';
+import { bindingFieldsOf } from '../stack/identity-bindings.js';
+import { SYSTEM_TYPES } from '../types/index.js';
+const ORDINARY = { writers: 'ordinary' };
+const POLICIES = new Map([
+    // Authority itself: see docs/spec/access-control.md § What a grant covers.
+    [SYSTEM_TYPES.GRANT, { writers: 'owner-alone' }],
+    [SYSTEM_TYPES.INSTALL, { writers: 'owner-alone' }],
+    // Managed, not merely written: see docs/spec/identity.md § Group.
+    [SYSTEM_TYPES.GROUP, { writers: 'group-managers', rosterAssociations: true }],
+    // See docs/spec/identity.md § DID bindings.
+    [
+        SYSTEM_TYPES.APP,
+        {
+            writers: 'ordinary',
+            ownerFields: {
+                fields: bindingFieldsOf(SYSTEM_TYPES.APP),
+                when: 'any',
+                message: 'Only the stack owner may set an _app record’s did or appId',
+            },
+        },
+    ],
+    [
+        SYSTEM_TYPES.ENTITY,
+        {
+            writers: 'ordinary',
+            ownerFields: {
+                fields: ['did'],
+                when: 'owner-did',
+                message: 'Only the stack owner may claim the owner’s own did',
+            },
+        },
+    ],
+    [SYSTEM_TYPES.ATTACHMENT, { writers: 'ordinary', createNamesFile: 'fileId' }],
+]);
+/** The policy a Record of `typeId` is held to. */
+export const familyPolicy = (typeId) => POLICIES.get(baseIdOf(typeId)) ?? ORDINARY;
+/**
+ * The refusal a write owes when it moves content only the owner acting
+ * alone may set, or null when it moves none. Compared value-wise between
+ * `before` (absent at create) and `after`, so re-sending a value a Record
+ * already holds claims nothing.
+ */
+export const ownerFieldRefusal = (typeId, before, after, ownerEntityId) => {
+    const rule = familyPolicy(typeId).ownerFields;
+    if (!rule)
+        return null;
+    const moved = rule.fields.some((field) => after[field] !== before?.[field] && (rule.when === 'any' || after[field] === ownerEntityId));
+    return moved ? rule.message : null;
+};
+//# sourceMappingURL=family-policy.js.map

package/dist/scoped-stack/family-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"family-policy.js","sourceRoot":"","sources":["../../src/scoped-stack/family-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AA+BjD,MAAM,QAAQ,GAAiB,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AAEvD,MAAM,QAAQ,GAAsC,IAAI,GAAG,CAAuB;IAChF,2EAA2E;IAC3E,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;IAChD,CAAC,YAAY,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;IAClD,kEAAkE;IAClE,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC;IAC7E,4CAA4C;IAC5C;QACE,YAAY,CAAC,GAAG;QAChB;YACE,OAAO,EAAE,UAAU;YACnB,WAAW,EAAE;gBACX,MAAM,EAAE,eAAe,CAAC,YAAY,CAAC,GAAG,CAAC;gBACzC,IAAI,EAAE,KAAK;gBACX,OAAO,EAAE,4DAA4D;aACtE;SACF;KACF;IACD;QACE,YAAY,CAAC,MAAM;QACnB;YACE,OAAO,EAAE,UAAU;YACnB,WAAW,EAAE;gBACX,MAAM,EAAE,CAAC,KAAK,CAAC;gBACf,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,oDAAoD;aAC9D;SACF;KACF;IACD,CAAC,YAAY,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC;CAC9E,CAAC,CAAC;AAEH,kDAAkD;AAClD,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAc,EAAgB,EAAE,CAC3D,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,QAAQ,CAAC;AAE7C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,MAAc,EACd,MAA2C,EAC3C,KAA8B,EAC9B,aAAuB,EACR,EAAE;IACjB,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC;IAC9C,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAC5B,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,KAAK,CAAC,KAAK,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,aAAa,CAAC,CAC9F,CAAC;IACF,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AACrC,CAAC,CAAC"}