@haverstack/core 0.41.0 → 0.43.0

package/dist/errors.js

@@ -7,39 +7,39 @@
  * subclass carries its wire discriminator as an instance `code`.
  *
  * Several errors sit deliberately outside that root (UseAfterCloseError,
- * InvalidAdapterError, OwnerMismatchError, RelayScopeError, and — in their own
- * modules — IdGenerationError and InvalidDidError): they report a local
- * programming error or an assembled topology, not a state a request can be
- * in, so no server ever responds with one.
+ * InvalidAdapterError, OwnerMismatchError, ElementSetMovedError, ScopeUnavailableError, and — in their own
+ * modules — IdGenerationError, InvalidDidError, InvalidAuthChallengeError,
+ * StoredVersionError and MisfitError): they report a local programming error, malformed
+ * local input or an assembled topology, not a state a request can be in, so
+ * no server ever responds with one.
  *
  * The `Stack` prefix is reserved for the taxonomy: a class named
  * `Stack…Error` extends StackError, and nothing else carries the prefix.
  */
 import { baseIdOf, parseTypeId } from './schema.js';
 /**
- * Root of the Stack error taxonomy. A single `instanceof StackError` answers
- * "is this a Stack-domain error or a bug?" — the question a server's error
- * middleware asks before serializing a wire body, and one an instanceof
- * ladder answers only by exhaustion. Every subclass carries its
- * discriminator as an instance `code`, so serialization is a lookup rather
- * than a chain of class tests.
- *
- * Membership implies a wire mapping: every code has an entry in
- * WIRE_ERROR_STATUS. Errors with no wire representation (IdGenerationError,
- * InvalidDidError) deliberately stay outside this hierarchy.
- *
- * Subclassing adds no hierarchy beyond this root — notably
- * StackVersionConflictError is a sibling of StackConflictError, not a
- * subtype. See docs/spec/wire-format.md § Error responses.
+ * Root of the taxonomy: `instanceof StackError` is the one question a
+ * server's error middleware asks, and each subclass's `code` makes
+ * serialization a lookup. Every code has a WIRE_ERROR_STATUS entry.
+ * Subclasses add no hierarchy — StackVersionConflictError is a sibling of
+ * StackConflictError. See docs/spec/wire-format.md § Error responses.
  */
 export class StackError extends Error {
 }
+const CONTENT_INVALID = 'Content validation failed';
+export const ARGUMENTS_INVALID = 'Invalid arguments';
+export const SCHEMA_INVALID = 'Schema validation failed';
+/**
+ * `header` names what was validated — record content, or the arguments a
+ * call was given — so a refusal of `editAssociations(id, [])` doesn't read as a
+ * content failure. Only the message varies: `code` is the contract.
+ */
 export class StackValidationError extends StackError {
     errors;
     static code = 'validation';
     code = StackValidationError.code;
-    constructor(errors) {
-        super(`Content validation failed:\n` + errors.map((e) => `  ${e.path}: ${e.message}`).join('\n'));
+    constructor(errors, header = CONTENT_INVALID) {
+        super(`${header}:\n` + errors.map((e) => `  ${e.path}: ${e.message}`).join('\n'));
         this.errors = errors;
         this.name = 'StackValidationError';
     }
@@ -79,6 +79,12 @@ export class StackConflictError extends StackError {
         this.name = 'StackConflictError';
     }
 }
+/**
+ * The refusal a mutation of a soft-deleted record earns, from `Stack` or
+ * from inside an adapter's aspect write: one message, wherever it is asked.
+ * See docs/spec/versioning.md § Mutations are refused, not applied to a tombstone.
+ */
+export const softDeletedRefusal = (id) => new StackConflictError(`Record "${id}" is soft-deleted; undelete it before mutating it.`);
 /**
  * Thrown when an `ifVersion` precondition doesn't match a record's current
  * version. Deliberately not a StackConflictError subtype — the two have
@@ -100,16 +106,10 @@ export class StackVersionConflictError extends StackError {
     }
 }
 /**
- * Thrown when a request is structurally malformed — not a content-validation
- * failure, but input the adapter/server can't even interpret (e.g. an
- * undecodable pagination cursor, a malformed TypeId, search text the engine
- * cannot parse, or a typeId no definition exists for). Distinct from
- * StackValidationError, which means the request was well-formed but content
- * failed schema validation.
- *
- * Naming something absent belongs here rather than under `not_found`: a
- * request whose *type* is undefined never addressed a record, so answering
- * 404 would say a record was missing when none was asked for.
+ * A request structurally malformed — an undecodable cursor, a malformed
+ * TypeId, unparseable search text — as opposed to StackValidationError's
+ * well-formed request with invalid content. Naming an undefined type is
+ * here, not `not_found`: no record was asked for, so none is missing.
  */
 export class StackBadRequestError extends StackError {
     capability;
@@ -117,12 +117,9 @@ export class StackBadRequestError extends StackError {
     code = StackBadRequestError.code;
     constructor(message, 
     /**
-     * Which declared capability the query asked for and the adapter lacks,
-     * or undefined when the query's own shape is what was wrong — a
-     * malformed content path is a caller error at every capability level.
-     * A client mapping this onto an error of its own reads the name from
-     * here rather than re-deriving it from the query, which is how one
-     * rule becomes two answers that can disagree.
+     * The declared capability the query needed and the adapter lacks, or
+     * undefined when the query's own shape was wrong. A client reads it from
+     * here rather than re-deriving it, so one rule has one answer.
      */
     capability) {
         super(message);
@@ -145,17 +142,10 @@ export class StackPayloadTooLargeError extends StackError {
     }
 }
 /**
- * Thrown when a server abandons an operation for taking too long — in
- * practice a full-text search, the one query whose cost the sanitizers
- * bound the *grammar* of but not the execution of (see
- * docs/spec/data-model.md § Capability-gated filters).
- *
- * Never produced in-process: both SQLite engines run synchronously, so
- * there is nothing to interrupt from inside the call. It exists so a
- * server that bounds query time has a class to serialize, and so the app
- * catching it can tell "too expensive, narrow it and retry" from
- * StackBadRequestError's "malformed, don't bother retrying" — the distinction
- * that would be lost if a timeout reused `bad_request`.
+ * A server abandoned an operation for taking too long — in practice a
+ * full-text search. Never produced in-process; it lets an app tell "too
+ * expensive, narrow and retry" from `bad_request`'s "malformed".
+ * See docs/spec/data-model.md § Capability-gated filters.
  */
 export class StackTimeoutError extends StackError {
     static code = 'timeout';
@@ -179,7 +169,7 @@ export class StackSchemaDriftError extends StackError {
     constructor(typeId, violations) {
         super(`Schema drift detected for type "${typeId}": the stored schema and the new definition ` +
             `differ beyond additive evolution (new optional fields only). Bump the version instead ` +
-            `of redefining "${typeId}" in place — e.g. defineType({ id: \`${baseIdOf(typeId)}@${(parseTypeId(typeId)?.version ?? 0) + 1}\`, ... }) plus registerMigration().\n` +
+            `of redefining "${typeId}" in place — e.g. defineType({ id: \`${baseIdOf(typeId)}@${(parseTypeId(typeId)?.version ?? 0) + 1}\`, ... }) plus a migration() passed to Stack.open().\n` +
             violations.map((v) => `  ${v.path || '(root)'}: ${v.message}`).join('\n'));
         this.typeId = typeId;
         this.violations = violations;
@@ -233,23 +223,29 @@ export class OwnerMismatchError extends Error {
     }
 }
 /**
- * Thrown when a scoped view is asked to observe a stack whose adapter
- * relays a remote feed. Outside the StackError taxonomy for the same
- * reason UseAfterCloseError is: it reports a topology the caller assembled,
- * not a state a request can be in.
- *
- * A relayed frame is scoped by the authority that opened the feed, and a
- * narrower scope cannot re-derive that decision — a purge leaves no record
- * to check `canRead` against. Delivering anyway would break the promise
- * that a subscriber never sees what it may not read; delivering only local
- * writes would silently drop every change made elsewhere, which is the
- * failure that looks fine in testing. So it refuses.
- * See docs/spec/events.md § Permission scoping.
+ * Thrown by an adapter's element-set write when the stored set no longer
+ * matches the `expectSet` it was handed. Outside the StackError taxonomy:
+ * Stack catches it and reads again, so no request ever answers with it.
+ * See docs/spec/versioning.md § Element-set writes compare the set they read.
+ */
+export class ElementSetMovedError extends Error {
+    recordId;
+    constructor(recordId) {
+        super(`Record "${recordId}"'s set changed since it was read`);
+        this.recordId = recordId;
+        this.name = 'ElementSetMovedError';
+    }
+}
+/**
+ * A scoped view asked of a stack that does not own its storage. A server
+ * scopes every request to the session that opened it, so such a stack is
+ * scoped by opening it with the session meant.
+ * See docs/spec/access-control.md § Enforcement: Stack.asEntity().
  */
-export class RelayScopeError extends Error {
+export class ScopeUnavailableError extends Error {
     constructor(message) {
         super(message);
-        this.name = 'RelayScopeError';
+        this.name = 'ScopeUnavailableError';
     }
 }
 //# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAuBpD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAgB,UAAW,SAAQ,KAAK;CAE7C;AAED,MAAM,OAAO,oBAAqB,SAAQ,UAAU;IAGtB;IAF5B,MAAM,CAAU,IAAI,GAAG,YAAqB,CAAC;IAC3B,IAAI,GAAG,oBAAoB,CAAC,IAAI,CAAC;IACnD,YAA4B,MAAyB;QACnD,KAAK,CACH,8BAA8B,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAC3F,CAAC;QAHwB,WAAM,GAAN,MAAM,CAAmB;QAInD,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;;AAGH,MAAM,OAAO,mBAAoB,SAAQ,UAAU;IACjD,MAAM,CAAU,IAAI,GAAG,WAAoB,CAAC;IAC1B,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC;IAClD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;;AAGH,iFAAiF;AACjF,MAAM,OAAO,oBAAqB,SAAQ,UAAU;IAClD,MAAM,CAAU,IAAI,GAAG,YAAqB,CAAC;IAC3B,IAAI,GAAG,oBAAoB,CAAC,IAAI,CAAC;IACnD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;;AAGH,iEAAiE;AACjE,MAAM,OAAO,kBAAmB,SAAQ,UAAU;IAChD,MAAM,CAAU,IAAI,GAAG,WAAoB,CAAC;IAC1B,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC;IACjD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;;AAGH,oIAAoI;AACpI,MAAM,OAAO,kBAAmB,SAAQ,UAAU;IAChD,MAAM,CAAU,IAAI,GAAG,UAAmB,CAAC;IACzB,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC;IACjD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;;AAGH;;;;;GAKG;AACH,MAAM,OAAO,yBAA0B,SAAQ,UAAU;IAK5C;IACA;IACA;IANX,MAAM,CAAU,IAAI,GAAG,kBAA2B,CAAC;IACjC,IAAI,GAAG,yBAAyB,CAAC,IAAI,CAAC;IACxD,YACE,OAAe,EACN,QAAgB,EAChB,eAAuB,EACvB,aAAqB;QAE9B,KAAK,CAAC,OAAO,CAAC,CAAC;QAJN,aAAQ,GAAR,QAAQ,CAAQ;QAChB,oBAAe,GAAf,eAAe,CAAQ;QACvB,kBAAa,GAAb,aAAa,CAAQ;QAG9B,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;;AAGH;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,oBAAqB,SAAQ,UAAU;IAahC;IAZlB,MAAM,CAAU,IAAI,GAAG,aAAsB,CAAC;IAC5B,IAAI,GAAG,oBAAoB,CAAC,IAAI,CAAC;IACnD,YACE,OAAe;IACf;;;;;;;OAOG;IACa,UAA8B;QAE9C,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,eAAU,GAAV,UAAU,CAAoB;QAG9C,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;;AAGH;;;;;GAKG;AACH,MAAM,OAAO,yBAA0B,SAAQ,UAAU;IACvD,MAAM,CAAU,IAAI,GAAG,mBAA4B,CAAC;IAClC,IAAI,GAAG,yBAAyB,CAAC,IAAI,CAAC;IACxD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;;AAGH;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,iBAAkB,SAAQ,UAAU;IAC/C,MAAM,CAAU,IAAI,GAAG,SAAkB,CAAC;IACxB,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC;IAChD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;;AAGH;;;;;GAKG;AACH,MAAM,OAAO,qBAAsB,SAAQ,UAAU;IAIjC;IACA;IAJlB,MAAM,CAAU,IAAI,GAAG,cAAuB,CAAC;IAC7B,IAAI,GAAG,qBAAqB,CAAC,IAAI,CAAC;IACpD,YACkB,MAAc,EACd,UAAkC;QAElD,KAAK,CACH,mCAAmC,MAAM,8CAA8C;YACrF,wFAAwF;YACxF,kBAAkB,MAAM,wCAAwC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,wCAAwC;YACnK,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,QAAQ,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAC5E,CAAC;QARc,WAAM,GAAN,MAAM,CAAQ;QACd,eAAU,GAAV,UAAU,CAAwB;QAQlD,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;;AAGH;;;;;;GAMG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,OAAO,GAAG,6BAA6B;QACjD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAEzB;IACA;IACA;IAHlB,YACkB,QAAkB,EAClB,MAA4B,EAC5B,KAAa;QAE7B,KAAK,CACH,MAAM;YACJ,CAAC,CAAC,eAAe,KAAK,qBAAqB,MAAM,yBAAyB,QAAQ,cAAc;YAChG,CAAC,CAAC,eAAe,KAAK,6CAA6C,QAAQ,cAAc,CAC5F,CAAC;QARc,aAAQ,GAAR,QAAQ,CAAU;QAClB,WAAM,GAAN,MAAM,CAAsB;QAC5B,UAAK,GAAL,KAAK,CAAQ;QAO7B,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAuBpD;;;;;;GAMG;AACH,MAAM,OAAgB,UAAW,SAAQ,KAAK;CAE7C;AAED,MAAM,eAAe,GAAG,2BAA2B,CAAC;AACpD,MAAM,CAAC,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;AACrD,MAAM,CAAC,MAAM,cAAc,GAAG,0BAA0B,CAAC;AAEzD;;;;GAIG;AACH,MAAM,OAAO,oBAAqB,SAAQ,UAAU;IAIhC;IAHlB,MAAM,CAAU,IAAI,GAAG,YAAqB,CAAC;IAC3B,IAAI,GAAG,oBAAoB,CAAC,IAAI,CAAC;IACnD,YACkB,MAAyB,EACzC,SAAiB,eAAe;QAEhC,KAAK,CAAC,GAAG,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAHlE,WAAM,GAAN,MAAM,CAAmB;QAIzC,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;;AAGH,MAAM,OAAO,mBAAoB,SAAQ,UAAU;IACjD,MAAM,CAAU,IAAI,GAAG,WAAoB,CAAC;IAC1B,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC;IAClD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;;AAGH,iFAAiF;AACjF,MAAM,OAAO,oBAAqB,SAAQ,UAAU;IAClD,MAAM,CAAU,IAAI,GAAG,YAAqB,CAAC;IAC3B,IAAI,GAAG,oBAAoB,CAAC,IAAI,CAAC;IACnD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;;AAGH,iEAAiE;AACjE,MAAM,OAAO,kBAAmB,SAAQ,UAAU;IAChD,MAAM,CAAU,IAAI,GAAG,WAAoB,CAAC;IAC1B,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC;IACjD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;;AAGH,oIAAoI;AACpI,MAAM,OAAO,kBAAmB,SAAQ,UAAU;IAChD,MAAM,CAAU,IAAI,GAAG,UAAmB,CAAC;IACzB,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC;IACjD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,EAAU,EAAsB,EAAE,CACnE,IAAI,kBAAkB,CAAC,WAAW,EAAE,oDAAoD,CAAC,CAAC;AAE5F;;;;;GAKG;AACH,MAAM,OAAO,yBAA0B,SAAQ,UAAU;IAK5C;IACA;IACA;IANX,MAAM,CAAU,IAAI,GAAG,kBAA2B,CAAC;IACjC,IAAI,GAAG,yBAAyB,CAAC,IAAI,CAAC;IACxD,YACE,OAAe,EACN,QAAgB,EAChB,eAAuB,EACvB,aAAqB;QAE9B,KAAK,CAAC,OAAO,CAAC,CAAC;QAJN,aAAQ,GAAR,QAAQ,CAAQ;QAChB,oBAAe,GAAf,eAAe,CAAQ;QACvB,kBAAa,GAAb,aAAa,CAAQ;QAG9B,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;;AAGH;;;;;GAKG;AACH,MAAM,OAAO,oBAAqB,SAAQ,UAAU;IAUhC;IATlB,MAAM,CAAU,IAAI,GAAG,aAAsB,CAAC;IAC5B,IAAI,GAAG,oBAAoB,CAAC,IAAI,CAAC;IACnD,YACE,OAAe;IACf;;;;OAIG;IACa,UAA8B;QAE9C,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,eAAU,GAAV,UAAU,CAAoB;QAG9C,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;;AAGH;;;;;GAKG;AACH,MAAM,OAAO,yBAA0B,SAAQ,UAAU;IACvD,MAAM,CAAU,IAAI,GAAG,mBAA4B,CAAC;IAClC,IAAI,GAAG,yBAAyB,CAAC,IAAI,CAAC;IACxD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;;AAGH;;;;;GAKG;AACH,MAAM,OAAO,iBAAkB,SAAQ,UAAU;IAC/C,MAAM,CAAU,IAAI,GAAG,SAAkB,CAAC;IACxB,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC;IAChD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;;AAGH;;;;;GAKG;AACH,MAAM,OAAO,qBAAsB,SAAQ,UAAU;IAIjC;IACA;IAJlB,MAAM,CAAU,IAAI,GAAG,cAAuB,CAAC;IAC7B,IAAI,GAAG,qBAAqB,CAAC,IAAI,CAAC;IACpD,YACkB,MAAc,EACd,UAAkC;QAElD,KAAK,CACH,mCAAmC,MAAM,8CAA8C;YACrF,wFAAwF;YACxF,kBAAkB,MAAM,wCAAwC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,yDAAyD;YACpL,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,QAAQ,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAC5E,CAAC;QARc,WAAM,GAAN,MAAM,CAAQ;QACd,eAAU,GAAV,UAAU,CAAwB;QAQlD,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;;AAGH;;;;;;GAMG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,OAAO,GAAG,6BAA6B;QACjD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAEzB;IACA;IACA;IAHlB,YACkB,QAAkB,EAClB,MAA4B,EAC5B,KAAa;QAE7B,KAAK,CACH,MAAM;YACJ,CAAC,CAAC,eAAe,KAAK,qBAAqB,MAAM,yBAAyB,QAAQ,cAAc;YAChG,CAAC,CAAC,eAAe,KAAK,6CAA6C,QAAQ,cAAc,CAC5F,CAAC;QARc,aAAQ,GAAR,QAAQ,CAAU;QAClB,WAAM,GAAN,MAAM,CAAsB;QAC5B,UAAK,GAAL,KAAK,CAAQ;QAO7B,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACjB;IAA5B,YAA4B,QAAgB;QAC1C,KAAK,CAAC,WAAW,QAAQ,mCAAmC,CAAC,CAAC;QADpC,aAAQ,GAAR,QAAQ,CAAQ;QAE1C,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF"}

package/dist/grants.d.ts

@@ -8,7 +8,8 @@
  *
  * See docs/spec/access-control.md § Type-level grants.
  */
-import type { EntityId, GrantAction, GrantContent, GrantGrantee, GroupRole, QueryResult, RecordId, StackQuery, StackRecord, TypeId } from './types.js';
+import type { RosterRoles } from './access.js';
+import type { BaseId, EntityId, GrantAction, GrantContent, GrantGrantee, GroupRole, RecordId, TypeId } from './types/index.js';
 import type { ValidationError } from './validate.js';
 /**
  * Valid GrantAction values, for runtime validation in Stack.grantType(). Built
@@ -17,33 +18,18 @@ import type { ValidationError } from './validate.js';
  */
 export declare const GRANT_ACTION_SET: ReadonlySet<GrantAction>;
 /**
- * The read actions that make a mutate action coherent, scope for scope: a
- * `-any` verb needs read over the same reach it can mutate, a `-own` verb
- * needs read over its author's own. A grant carrying neither conveys the
- * verb to nobody. `create` has no companion — writing a Record you then
- * cannot read is the drop-box, and it discloses nothing.
- * See docs/spec/access-control.md § Write implies read.
- */
-export declare const READ_COMPANIONS: ReadonlyMap<GrantAction, readonly GrantAction[]>;
-/**
- * Whether one grant's action list conveys `action`. The companion has to
- * sit in the same `_grant` Record: a grant is revoked whole, so a rule
- * satisfied across two records would let revoking the read one leave a
- * mutate-without-read grant standing.
- *
- * Takes the list grantReach() produced, never a stored field: `includes()`
- * over a string is substring matching, so one would answer for every verb
- * spelled inside it.
+ * Whether one grant's action list conveys `action`. The companion must sit
+ * in the same `_grant`: a grant is revoked whole, so a rule met across two
+ * records could leave mutate-without-read standing. Takes grantReach()'s
+ * list, never a stored field, whose `includes()` would match substrings.
  */
 export declare function grantConveys(actions: readonly GrantAction[], action: GrantAction): boolean;
 /**
  * What a stored `_grant` reaches, or null where it names nothing the
- * evaluator recognizes. Read as data, like the grantee beside it: a grant
- * Record can arrive from an import, a direct adapter write or a foreign
- * server, where no schema saw it, so both fields are asked for their shape
- * rather than taken from the type. An unknown action is dropped from the
- * list, on the same terms an unknown grantee `kind` confers nothing.
- * See docs/spec/access-control.md § Refused at the write, and again at evaluation.
+ * evaluator recognizes. Read as data — a grant can arrive from an import or
+ * a foreign server no schema saw — so an unknown action is dropped, as an
+ * unknown grantee confers nothing. See docs/spec/access-control.md
+ * § Refused at the write, and again at evaluation.
  */
 export declare function grantReach(content: unknown): {
     familyId: string;
@@ -61,6 +47,8 @@ export type GrantQuery = Exclude<GrantGrantee, {
     groupId: RecordId;
     role: GroupRole | 'any';
 };
+/** Whether two action lists name the same verbs, order and repeats aside. */
+export declare function sameActions(a: readonly GrantAction[], b: readonly GrantAction[]): boolean;
 /**
  * Direct (non-roster) match between a stored _grant's content and a target:
  * the whole grantee, `role` included. A target is the identity grantType()
@@ -69,13 +57,10 @@ export type GrantQuery = Exclude<GrantGrantee, {
  */
 export declare function matchesGrantTarget(content: GrantContent, target: GrantQuery): boolean;
 /**
- * Reject a grant target that names no tier, or whose tier names nobody. An
- * empty groupId or entityId reaches no one, so storing it would leave a
- * grant that can only ever deny while looking like a share that worked.
- * Read as data, not as the type: a target reaching Stack from a request
- * body or an import has whatever shape it arrived with, so a key its tier
- * does not define is refused too. `allowAny` admits
- * the listing-only `role: 'any'`, which grantType() and revokeType() refuse.
+ * Reject a grant target that names no tier, or whose tier names nobody: it
+ * would store a grant that can only deny while looking like a share that
+ * worked. Read as data, so a key its tier does not define is refused too.
+ * `allowAny` admits the listing-only `role: 'any'`.
  */
 export declare function validateGrantTarget(target: GrantQuery, allowAny?: boolean): void;
 /**
@@ -102,8 +87,7 @@ export declare function validateGrantBaseId(typeId: TypeId, content: unknown): V
 export declare function grantCoversGrantee(c: GrantContent, grantee: EntityId, opts: {
     allowDefault: boolean;
     allowGroup: boolean;
-    groupRoles: Map<string, GroupRole | null>;
-    resolveRecord: (id: RecordId) => Promise<StackRecord | null>;
+    roles: RosterRoles;
 }): Promise<boolean>;
 /**
  * System type families grantType() refuses to target: a grant on any of them
@@ -114,16 +98,8 @@ export declare function grantCoversGrantee(c: GrantContent, grantee: EntityId, o
  */
 export declare const UNGRANTABLE_SYSTEM_TYPES: ReadonlySet<string>;
 /**
- * Every `_grant` Record, cursor-walked. Read through an unscoped query at
- * every call site: a grant is what decides who may read, so it can never
- * itself sit behind a read check.
- *
- * `includeUnlisted`, because withholding a Record from enumeration decides
- * nothing about what it confers. Deleted grants are excluded on the
- * opposite grounds — a soft delete is how revokeType() withdraws one.
- * See docs/spec/unlisted.md.
+ * Actions must be known GrantAction values; the target is held to the
+ * same rule every `_grant` write meets — see validateGrantBaseId().
  */
-export declare function loadGrantRecords(query: (q: StackQuery) => Promise<QueryResult>): Promise<(StackRecord & {
-    content: GrantContent;
-})[]>;
+export declare function checkGrantValid(baseId: BaseId, actions: GrantAction[]): void;
 //# sourceMappingURL=grants.d.ts.map

package/dist/grants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../src/grants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAOH,OAAO,KAAK,EACV,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,SAAS,EACT,WAAW,EACX,QAAQ,EACR,UAAU,EACV,WAAW,EACX,MAAM,EACP,MAAM,YAAY,CAAC;AAEpB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,EAAE,WAAW,CAAC,WAAW,CAA0B,CAAC;AAEjF;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,WAAW,EAAE,SAAS,WAAW,EAAE,CAK3E,CAAC;AAEH;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,SAAS,WAAW,EAAE,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAI1F;AAED;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,OAAO,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,WAAW,EAAE,CAAA;CAAE,GAAG,IAAI,CAUhG;AAED;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAClB,OAAO,CAAC,YAAY,EAAE;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC,GACxC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,SAAS,GAAG,KAAK,CAAA;CAAE,CAAC;AAElE;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,GAAG,OAAO,CASrF;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,UAAQ,GAAG,IAAI,CA+B9E;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,eAAe,EAAE,CAkDnF;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,eAAe,EAAE,CAiBvF;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,CAAC,EAAE,YAAY,EACf,OAAO,EAAE,QAAQ,EACjB,IAAI,EAAE;IACJ,YAAY,EAAE,OAAO,CAAC;IACtB,UAAU,EAAE,OAAO,CAAC;IACpB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC,CAAC;IAC1C,aAAa,EAAE,CAAC,EAAE,EAAE,QAAQ,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;CAC9D,GACA,OAAO,CAAC,OAAO,CAAC,CAuBlB;AAwBD;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,EAAE,WAAW,CAAC,MAAM,CAKvD,CAAC;AAEH;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,CAAC,CAAC,EAAE,UAAU,KAAK,OAAO,CAAC,WAAW,CAAC,GAC7C,OAAO,CAAC,CAAC,WAAW,GAAG;IAAE,OAAO,EAAE,YAAY,CAAA;CAAE,CAAC,EAAE,CAAC,CAKtD"}
+{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../src/grants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAOH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EACV,MAAM,EACN,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,SAAS,EACT,QAAQ,EACR,MAAM,EACP,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,EAAE,WAAW,CAAC,WAAW,CAA0B,CAAC;AAejF;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,SAAS,WAAW,EAAE,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAI1F;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,OAAO,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,WAAW,EAAE,CAAA;CAAE,GAAG,IAAI,CAUhG;AAED;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAClB,OAAO,CAAC,YAAY,EAAE;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC,GACxC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,SAAS,GAAG,KAAK,CAAA;CAAE,CAAC;AAElE,6EAA6E;AAC7E,wBAAgB,WAAW,CAAC,CAAC,EAAE,SAAS,WAAW,EAAE,EAAE,CAAC,EAAE,SAAS,WAAW,EAAE,GAAG,OAAO,CAIzF;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,GAAG,OAAO,CASrF;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,UAAQ,GAAG,IAAI,CAa9E;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,eAAe,EAAE,CAMnF;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,eAAe,EAAE,CAiBvF;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,CAAC,EAAE,YAAY,EACf,OAAO,EAAE,QAAQ,EACjB,IAAI,EAAE;IAAE,YAAY,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,WAAW,CAAA;CAAE,GACvE,OAAO,CAAC,OAAO,CAAC,CAIlB;AAED;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,EAAE,WAAW,CAAC,MAAM,CAKvD,CAAC;AAEH;;;GAGG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,IAAI,CA2B5E"}

package/dist/grants.js

@@ -9,11 +9,10 @@
  * See docs/spec/access-control.md § Type-level grants.
  */
 import { baseIdOf, familyIdProblem } from './schema.js';
-import { StackBadRequestError } from './errors.js';
-import { assertKnownKeys, GRANTEE_KEYS, unknownKeys } from './query-validation.js';
-import { SYSTEM_TYPES, GRANT_ACTIONS } from './types.js';
-import { carriesRoster, groupRoleFromAssociations } from './access.js';
-import { queryAllPages } from './stack-reads.js';
+import { ARGUMENTS_INVALID, StackBadRequestError, StackValidationError } from './errors.js';
+import { granteeErrors } from './associations/validation.js';
+import { SYSTEM_TYPES, GRANT_ACTIONS } from './types/index.js';
+import { granteeReaches } from './access.js';
 /**
  * Valid GrantAction values, for runtime validation in Stack.grantType(). Built
  * from GRANT_ACTIONS, which GrantAction itself derives from, so the set and
@@ -21,28 +20,22 @@ import { queryAllPages } from './stack-reads.js';
  */
 export const GRANT_ACTION_SET = new Set(GRANT_ACTIONS);
 /**
- * The read actions that make a mutate action coherent, scope for scope: a
- * `-any` verb needs read over the same reach it can mutate, a `-own` verb
- * needs read over its author's own. A grant carrying neither conveys the
- * verb to nobody. `create` has no companion — writing a Record you then
- * cannot read is the drop-box, and it discloses nothing.
+ * The read actions that make a mutate action coherent, scope for scope. A
+ * grant carrying none conveys the verb to nobody. `create` has none:
+ * writing a Record you cannot read is the drop-box, and discloses nothing.
  * See docs/spec/access-control.md § Write implies read.
  */
-export const READ_COMPANIONS = new Map([
+const READ_COMPANIONS = new Map([
     ['update-own', ['read-own', 'read-any']],
     ['delete-own', ['read-own', 'read-any']],
     ['update-any', ['read-any']],
     ['delete-any', ['read-any']],
 ]);
 /**
- * Whether one grant's action list conveys `action`. The companion has to
- * sit in the same `_grant` Record: a grant is revoked whole, so a rule
- * satisfied across two records would let revoking the read one leave a
- * mutate-without-read grant standing.
- *
- * Takes the list grantReach() produced, never a stored field: `includes()`
- * over a string is substring matching, so one would answer for every verb
- * spelled inside it.
+ * Whether one grant's action list conveys `action`. The companion must sit
+ * in the same `_grant`: a grant is revoked whole, so a rule met across two
+ * records could leave mutate-without-read standing. Takes grantReach()'s
+ * list, never a stored field, whose `includes()` would match substrings.
  */
 export function grantConveys(actions, action) {
     if (!actions.includes(action))
@@ -52,12 +45,10 @@ export function grantConveys(actions, action) {
 }
 /**
  * What a stored `_grant` reaches, or null where it names nothing the
- * evaluator recognizes. Read as data, like the grantee beside it: a grant
- * Record can arrive from an import, a direct adapter write or a foreign
- * server, where no schema saw it, so both fields are asked for their shape
- * rather than taken from the type. An unknown action is dropped from the
- * list, on the same terms an unknown grantee `kind` confers nothing.
- * See docs/spec/access-control.md § Refused at the write, and again at evaluation.
+ * evaluator recognizes. Read as data — a grant can arrive from an import or
+ * a foreign server no schema saw — so an unknown action is dropped, as an
+ * unknown grantee confers nothing. See docs/spec/access-control.md
+ * § Refused at the write, and again at evaluation.
  */
 export function grantReach(content) {
     const c = content;
@@ -73,6 +64,12 @@ export function grantReach(content) {
         actions: c.actions.filter((a) => GRANT_ACTION_SET.has(a)),
     };
 }
+/** Whether two action lists name the same verbs, order and repeats aside. */
+export function sameActions(a, b) {
+    const as = new Set(a);
+    const bs = new Set(b);
+    return as.size === bs.size && [...bs].every((x) => as.has(x));
+}
 /**
  * Direct (non-roster) match between a stored _grant's content and a target:
  * the whole grantee, `role` included. A target is the identity grantType()
@@ -92,40 +89,21 @@ export function matchesGrantTarget(content, target) {
     return g.kind === 'authenticated';
 }
 /**
- * Reject a grant target that names no tier, or whose tier names nobody. An
- * empty groupId or entityId reaches no one, so storing it would leave a
- * grant that can only ever deny while looking like a share that worked.
- * Read as data, not as the type: a target reaching Stack from a request
- * body or an import has whatever shape it arrived with, so a key its tier
- * does not define is refused too. `allowAny` admits
- * the listing-only `role: 'any'`, which grantType() and revokeType() refuse.
+ * Reject a grant target that names no tier, or whose tier names nobody: it
+ * would store a grant that can only deny while looking like a share that
+ * worked. Read as data, so a key its tier does not define is refused too.
+ * `allowAny` admits the listing-only `role: 'any'`.
  */
 export function validateGrantTarget(target, allowAny = false) {
-    const t = target;
-    if (t?.kind === 'authenticated' || t?.kind === 'entity' || t?.kind === 'group')
-        assertKnownKeys(t, GRANTEE_KEYS[t.kind], 'grant target');
-    switch (t?.kind) {
-        case 'authenticated':
-            return;
-        case 'entity':
-            if (typeof t.entityId !== 'string' || t.entityId.length === 0) {
-                throw new StackBadRequestError('An entity grant target requires a non-empty entityId.');
-            }
-            return;
-        case 'group':
-            if (typeof t.groupId !== 'string' || t.groupId.length === 0) {
-                throw new StackBadRequestError('A group grant target requires a non-empty groupId.');
-            }
-            if (t.role !== 'member' && t.role !== 'admin' && !(allowAny && t.role === 'any')) {
-                throw new StackBadRequestError(allowAny
-                    ? "A group grant target requires role 'member', 'admin' or 'any'."
-                    : "A group grant target requires role 'member' or 'admin'.");
-            }
-            // No format check: groupId is a reference, like parentId or an
-            // association's recordId. One that resolves to nothing simply denies.
-            return;
-        default:
-            throw new StackBadRequestError("A grant target must name its tier: { kind: 'entity' }, { kind: 'group' } or { kind: 'authenticated' }.");
+    // No format check on a groupId: it is a reference, like parentId or an
+    // association's recordId. One that resolves to nothing simply denies.
+    const errors = granteeErrors(target, 'grant target', {
+        unknownKeys: 'throw',
+        authenticated: true,
+        anyRole: allowAny,
+    });
+    if (errors.length > 0) {
+        throw new StackBadRequestError(`Invalid grant target: ${errors.map((e) => e.message).join(' ')}`);
     }
 }
 /**
@@ -137,55 +115,11 @@ export function validateGrantTarget(target, allowAny = false) {
 export function validateGrantee(typeId, content) {
     if (baseIdOf(typeId) !== SYSTEM_TYPES.GRANT)
         return [];
-    const c = content;
-    const g = c?.grantee;
+    const g = content?.grantee;
     // An absent or non-object grantee is the schema's to refuse, and it does.
     if (!g || typeof g !== 'object')
         return [];
-    if (g.kind === 'authenticated' || g.kind === 'entity' || g.kind === 'group') {
-        const unknown = unknownKeys(g, GRANTEE_KEYS[g.kind]);
-        if (unknown.length > 0)
-            return unknown.map((key) => ({
-                path: `grantee.${key}`,
-                message: `A ${String(g.kind)} grantee does not carry ${key}`,
-            }));
-    }
-    switch (g.kind) {
-        case 'authenticated':
-            return [];
-        case 'entity':
-            return typeof g.entityId === 'string' && g.entityId.length > 0
-                ? []
-                : [
-                    {
-                        path: 'grantee.entityId',
-                        message: 'An entity grantee requires a non-empty entityId',
-                    },
-                ];
-        case 'group': {
-            const errors = [];
-            if (typeof g.groupId !== 'string' || g.groupId.length === 0) {
-                errors.push({
-                    path: 'grantee.groupId',
-                    message: 'A group grantee requires a non-empty groupId',
-                });
-            }
-            if (g.role !== 'member' && g.role !== 'admin') {
-                errors.push({
-                    path: 'grantee.role',
-                    message: "A group grantee requires role 'member' or 'admin'",
-                });
-            }
-            return errors;
-        }
-        default:
-            return [
-                {
-                    path: 'grantee.kind',
-                    message: "A grantee must name its tier: 'entity', 'group' or 'authenticated'",
-                },
-            ];
-    }
+    return granteeErrors(g, 'grantee', { unknownKeys: 'collect', authenticated: true });
 }
 /**
  * A `_grant`'s target, asked of its content on every write: a bare baseId
@@ -223,42 +157,9 @@ export function validateGrantBaseId(typeId, content) {
  */
 export async function grantCoversGrantee(c, grantee, opts) {
     const g = c.grantee;
-    if (!g || typeof g !== 'object')
-        return false;
-    switch (g.kind) {
-        case 'authenticated':
-            return opts.allowDefault;
-        case 'entity':
-            return !!g.entityId && g.entityId === grantee;
-        case 'group': {
-            if (!opts.allowGroup)
-                return false;
-            if (!g.groupId)
-                return false;
-            if (g.role !== 'member' && g.role !== 'admin')
-                return false;
-            const role = await resolveGroupRoleMemoized(g.groupId, grantee, opts.groupRoles, opts.resolveRecord);
-            return g.role === 'admin' ? role === 'admin' : role !== null;
-        }
-        default:
-            return false;
-    }
-}
-/**
- * An entity's role on a `_group` roster, memoized in the caller's
- * `groupRoles` map. That map is built per operation, so no resolved role
- * outlives the operation that resolved it — removal from a group must never
- * go stale.
- */
-async function resolveGroupRoleMemoized(groupId, entityId, groupRoles, resolveRecord) {
-    const key = `${groupId}:${entityId}`;
-    const cached = groupRoles.get(key);
-    if (cached !== undefined)
-        return cached;
-    const group = await resolveRecord(groupId);
-    const role = group && carriesRoster(group) ? groupRoleFromAssociations(group.associations, entityId) : null;
-    groupRoles.set(key, role);
-    return role;
+    if (g?.kind === 'authenticated')
+        return opts.allowDefault;
+    return granteeReaches(g, grantee, opts);
 }
 /**
  * System type families grantType() refuses to target: a grant on any of them
@@ -274,19 +175,36 @@ export const UNGRANTABLE_SYSTEM_TYPES = new Set([
     SYSTEM_TYPES.INSTALL,
 ]);
 /**
- * Every `_grant` Record, cursor-walked. Read through an unscoped query at
- * every call site: a grant is what decides who may read, so it can never
- * itself sit behind a read check.
- *
- * `includeUnlisted`, because withholding a Record from enumeration decides
- * nothing about what it confers. Deleted grants are excluded on the
- * opposite grounds — a soft delete is how revokeType() withdraws one.
- * See docs/spec/unlisted.md.
+ * Actions must be known GrantAction values; the target is held to the
+ * same rule every `_grant` write meets — see validateGrantBaseId().
  */
-export async function loadGrantRecords(query) {
-    const records = await queryAllPages(query, {
-        filter: { typeId: `${SYSTEM_TYPES.GRANT}@1`, includeUnlisted: true },
+export function checkGrantValid(baseId, actions) {
+    const errors = [];
+    actions.forEach((action, j) => {
+        if (!GRANT_ACTION_SET.has(action)) {
+            errors.push({ path: `actions[${j}]`, message: `Unknown grant action "${action}"` });
+        }
     });
-    return records;
+    const problem = familyIdProblem(baseId, 'grantType');
+    if (problem) {
+        errors.push({ path: 'baseId', message: problem });
+    }
+    else {
+        errors.push(...validateGrantBaseId(`${SYSTEM_TYPES.GRANT}@1`, { baseId }));
+    }
+    actions.forEach((action, j) => {
+        if (grantConveys(actions, action))
+            return;
+        const companions = READ_COMPANIONS.get(action);
+        if (!companions)
+            return;
+        errors.push({
+            path: `actions[${j}]`,
+            message: `"${action}" requires ${companions.map((c) => `"${c}"`).join(' or ')} in the same grant: a mutate verb reaches the record and its history, so it conveys nothing without read. Name both in one grant: actions: [${companions.map((c) => `'${c}'`).join(' | ')}, '${action}']`,
+        });
+    });
+    if (errors.length > 0) {
+        throw new StackValidationError(errors, ARGUMENTS_INVALID);
+    }
 }
 //# sourceMappingURL=grants.js.map