@haverstack/core 0.42.0 → 0.43.0

package/dist/scoped-stack/authority.js

@@ -8,30 +8,70 @@
  * writes. See docs/spec/access-control.md § Delegation: principal and
  * subject.
  */
-import { checkAccess, groupRoleFromAssociations, isGroupRecord, isOwnerActingAlone, } from '../access.js';
+import { groupRoleFromAssociations, isOwnerActingAlone, readCompanions, roleSatisfies, } from '../access.js';
+import { inReach } from '../adapter/reach.js';
 import { StackError, StackNotFoundError, StackPermissionError } from '../errors.js';
 import { UNGRANTABLE_SYSTEM_TYPES, grantConveys, grantCoversGrantee, grantReach, } from '../grants.js';
-import { filtersContent } from '../query-validation.js';
+import { filtersContent, splitQuery } from '../query-validation.js';
 import { baseIdOf, fileRefFields } from '../schema.js';
+import { familyPolicy } from './family-policy.js';
 import { claimedFamilies, familyStanding, INSTALL_APP_LABEL, linkedIds } from '../install.js';
-import { findFirstMatch, loadGrantRecords, loadInstallRecords, queryAllPages, } from '../stack/reads.js';
+import { findFirstMatch, loadGrantRecords, loadInstallRecords, loadRosterRoles, queryAllPages, } from '../stack/reads.js';
+import { AuthoritySnapshot } from './authority-snapshot.js';
 import { SYSTEM_TYPES } from '../types/index.js';
+/**
+ * How each side of a request reads a grant. The subject is the entity a
+ * grant is written about, so every tier counts; on the principal's side
+ * only a grant naming it directly counts. See
+ * docs/spec/access-control.md § Delegation: principal and subject.
+ */
+const SUBJECT_SIDE = { allowDefault: true, allowGroup: true };
+const PRINCIPAL_SIDE = { allowDefault: false, allowGroup: false };
+/**
+ * What each verb is granted by: the grant action reaching a family whole,
+ * the one reaching the subject's own Records in it, and the permission bit
+ * reaching one Record. See docs/spec/access-control.md § Reach.
+ */
+const VERBS = {
+    create: { any: 'create' },
+    read: { any: 'read-any', own: 'read-own', bit: 'read' },
+    update: { any: 'update-any', own: 'update-own', bit: 'write' },
+    delete: { any: 'delete-any', own: 'delete-own', bit: 'write' },
+};
+const ANYONE = { kind: 'anyone', label: 'read' };
 export class ScopeAuthority {
     stack;
     principalId;
     subjectId;
+    queryReadable;
     constructor(stack, 
     /** Whose grants bound what this request may do — see ScopedStack.principalId. */
     principalId, 
     /** Whom this request acts for and attributes writes to — see ScopedStack.subjectId. */
-    subjectId) {
+    subjectId, 
+    /** Stack.query() within a reach — see ScopedStack.query(). */
+    queryReadable) {
         this.stack = stack;
         this.principalId = principalId;
         this.subjectId = subjectId;
+        this.queryReadable = queryReadable;
+    }
+    /**
+     * The authority this request acts with, for one operation: pass it to
+     * each check the operation makes, so the grants, the rosters and each
+     * verb's reach are read at most once. An anonymous request is named by no
+     * grant and held by no roster, so it reads neither.
+     */
+    snapshot() {
+        const subject = this.subjectId;
+        return new AuthoritySnapshot({
+            grants: () => this.identified ? loadGrantRecords((q) => this.stack.query(q)) : Promise.resolve([]),
+            roles: () => subject === null
+                ? Promise.resolve(new Map())
+                : loadRosterRoles((q) => this.stack.query(q), subject),
+            reach: (verb, snapshot) => this.buildReach(verb, snapshot),
+        });
     }
-    resolveRecord = (id) => this.stack.get(id, { includeDeleted: true });
-    /** Every `_grant` Record — see loadGrantRecords(). */
-    loadGrants = () => loadGrantRecords((q) => this.stack.query(q));
     /** Whether a delegated app is acting for someone other than itself. */
     get delegated() {
         return this.subjectId !== this.principalId;
@@ -68,105 +108,116 @@ export class ScopeAuthority {
     get ownerActingAlone() {
         return isOwnerActingAlone({ principalId: this.principalId, subjectId: this.subjectId }, this.stack.ownerEntityId);
     }
-    /** Whether the record's own permissions let the subject `mode` it. */
-    recordPermits(record, mode) {
-        return checkAccess(record, this.subjectId, this.stack.ownerEntityId, mode, this.resolveRecord);
+    /**
+     * Whether no grant bounds the principal: undelegated, it is the subject
+     * itself, and the owner as principal is the owner's own software.
+     * See docs/spec/access-control.md § Delegation: principal and subject.
+     */
+    get principalUnbounded() {
+        return !this.delegated || this.principalId === this.stack.ownerEntityId;
     }
     /**
-     * Whether `grantee` holds a _grant covering one of `actions` on the type's
-     * family. The flags are fixed per side of a delegation and mean nothing
-     * alone, so this is reached only through subjectAllows() and
-     * principalHolds(). See docs/spec/access-control.md § Who a grant reaches.
+     * The families `grantee`'s grants convey one of `actions` on, read the way
+     * `side` reads a grant. Only the subject's side counts a group, so the
+     * rosters read are always the subject's.
+     * See docs/spec/access-control.md § Who a grant reaches.
      */
-    async hasGrant(typeId, actions, opts) {
-        const { grantee, record, prefetchedGrants, matchOwn = true, allowDefault = true, allowGroup = true, } = opts;
+    async familiesConveying(grantee, side, actions, snapshot) {
         if (!grantee)
-            return false;
-        // Absent when the caller has no operation-scoped map to share — one
-        // call's worth of memoization, which is still every grant record in
-        // this loop naming the same group.
-        const groupRoles = opts.groupRoles ?? new Map();
-        const familyId = baseIdOf(typeId);
-        // grantType() refuses to write these, but a _grant record is an ordinary
-        // Record: an unscoped Stack, an import, or a server mapping a request
-        // body onto Stack can mint one anyway. Refusing at the point of use is
-        // what makes the rule hold regardless of how the record got there.
-        if (UNGRANTABLE_SYSTEM_TYPES.has(familyId))
-            return false;
-        let grantRecords;
-        if (prefetchedGrants !== undefined) {
-            grantRecords = prefetchedGrants;
-        }
-        else {
-            // Cursor-walked to see grants past page one. A stored baseId is
-            // judged by grantReach(), which refuses a versioned one.
-            grantRecords = await this.loadGrants();
-        }
-        for (const r of grantRecords) {
+            return [];
+        const families = new Set();
+        for (const r of await snapshot.grants()) {
             const c = r.content;
+            // A stored baseId is judged by grantReach(), which refuses a
+            // versioned one.
             const reach = grantReach(c);
-            if (!reach || reach.familyId !== familyId)
+            if (!reach || families.has(reach.familyId))
                 continue;
-            const covers = await grantCoversGrantee(c, grantee, {
-                allowDefault,
-                allowGroup,
-                groupRoles,
-                resolveRecord: this.resolveRecord,
-            });
-            if (!covers)
+            // grantType() refuses to write these, but a _grant record is an
+            // ordinary Record: an unscoped Stack, an import, or a server mapping
+            // a request body onto Stack can mint one anyway. Refusing at the
+            // point of use is what makes the rule hold regardless of how the
+            // record got there.
+            if (UNGRANTABLE_SYSTEM_TYPES.has(reach.familyId))
                 continue;
-            const matches = actions.some((action) => {
-                if (!grantConveys(reach.actions, action))
-                    return false;
-                if (matchOwn && action.endsWith('-own'))
-                    return record?.createdBy?.subjectId === grantee;
-                return true;
-            });
-            if (matches)
-                return true;
+            if (!actions.some((a) => grantConveys(reach.actions, a)))
+                continue;
+            if (await grantCoversGrantee(c, grantee, { ...side, roles: snapshot.roles })) {
+                families.add(reach.familyId);
+            }
         }
-        return false;
+        return [...families];
     }
     /**
-     * The principal half of a delegated request's authority, which bounds
-     * what the subject's reaches so neither lends its reach to the other.
-     * Vacuously true without delegation. Default and group grants do not
-     * count — see docs/spec/access-control.md § Who a grant reaches.
+     * What this request may do with `verb` — that verb's rules, built whole
+     * even where a Record's own permissions would settle it, since every gate
+     * asks one value at a flat cost. The principal's grants fence it; within,
+     * the subject reaches what grants and permissions give it, an owner
+     * subject everything. See docs/spec/access-control.md § Reach.
      */
-    principalAllows(typeId, actions, prefetchedGrants) {
-        if (!this.delegated)
-            return Promise.resolve(true);
-        if (this.principalId === this.stack.ownerEntityId)
-            return Promise.resolve(true);
-        return this.principalHolds(typeId, actions, prefetchedGrants);
+    async buildReach(verb, snapshot) {
+        const { any, own, bit } = VERBS[verb];
+        const reach = this.principalUnbounded
+            ? {}
+            : {
+                fence: await this.familiesConveying(this.principalId, PRINCIPAL_SIDE, own ? [any, own] : [any], snapshot),
+            };
+        const subject = this.subjectId;
+        if (subject === this.stack.ownerEntityId)
+            return reach;
+        const families = (action) => this.familiesConveying(subject, SUBJECT_SIDE, [action], snapshot);
+        reach.within = {
+            baseIds: await families(any),
+            ...(subject !== null &&
+                own && { authored: { subjectId: subject, baseIds: await families(own) } }),
+            permissions: bit ? await this.elementSets(bit, snapshot) : [],
+        };
+        return reach;
     }
     /**
-     * principalAllows() without its shortcuts: whether the principal itself
-     * holds a grant naming it for these verbs, read the principal-side way.
-     * Also what an installed app's own migration authority rests on — see
-     * installMayMigrate().
+     * The permission elements carrying `bit` to the subject, as the sets a
+     * Record must hold whole. A `read` stands alone, as does `anyone`; a
+     * `write` stands beside one of its readCompanions().
      */
-    principalHolds(typeId, actions, prefetchedGrants) {
-        return this.hasGrant(typeId, actions, {
-            grantee: this.principalId,
-            prefetchedGrants,
-            matchOwn: false,
-            allowDefault: false,
-            allowGroup: false,
+    async elementSets(bit, snapshot) {
+        const grantees = [];
+        const subject = this.subjectId;
+        if (subject !== null) {
+            grantees.push({ kind: 'entity', entityId: subject });
+            for (const [groupId, held] of await snapshot.roles()) {
+                for (const role of ['member', 'admin']) {
+                    if (roleSatisfies(held, role))
+                        grantees.push({ kind: 'group', groupId, role });
+                }
+            }
+        }
+        const element = (label, grantee) => ({
+            kind: 'permission',
+            label,
+            grantee,
         });
+        if (bit === 'read')
+            return [[ANYONE], ...grantees.map((g) => [element('read', g)])];
+        return grantees.flatMap((g) => readCompanions(g).map((c) => [element('write', g), c]));
+    }
+    /** Whether this request may `verb` the Record: its reach, asked of one Record. */
+    async may(verb, record, snapshot) {
+        return inReach(record, await snapshot.reach(verb));
     }
     /**
-     * The subject half: which records are reachable, with `-own` matching and
-     * default grants in force — the ordinary reading of a grant, since the
-     * subject is the entity a grant is written about.
+     * may() with the principal's fence set aside — whether the subject alone
+     * reaches the Record, for a refusal that says which side lacked the verb.
      */
-    subjectAllows(typeId, actions, opts = {}) {
-        return this.hasGrant(typeId, actions, {
-            grantee: this.subjectId,
-            record: opts.record,
-            prefetchedGrants: opts.prefetchedGrants,
-            groupRoles: opts.groupRoles,
-        });
+    async subjectMay(verb, record, snapshot) {
+        const { within } = await snapshot.reach(verb);
+        return inReach(record, within ? { within } : {});
+    }
+    canRead(record, snapshot) {
+        return this.may('read', record, snapshot);
+    }
+    /** Whether this request may create a Record of the type, asked of the Record it would make. */
+    canCreate(typeId, snapshot) {
+        return this.may('create', { typeId, createdBy: this.requester }, snapshot);
     }
     /**
      * How to refuse a record this request addressed by ID: a permission error
@@ -174,35 +225,11 @@ export class ScopeAuthority {
      * `message` only reaches someone holding the record already.
      * See docs/spec/disclosure.md § Which refusal a Record answers with.
      */
-    async denialFor(record, message) {
-        // Prefetched here rather than threaded down from the gate: a write
-        // carried by a record-level permission settles without reading a grant
-        // at all, and that path must not pay for this one. Both halves of
-        // canRead share the one scan.
-        const grants = this.identified ? await this.loadGrants() : undefined;
-        if (await this.canRead(record, grants))
+    async denialFor(record, message, snapshot) {
+        if (await this.canRead(record, snapshot))
             return new StackPermissionError(message);
         return new StackNotFoundError(`Record not found: "${record.id}"`);
     }
-    async canRead(record, prefetchedGrants, groupRoles) {
-        const reachable = (await this.recordPermits(record, 'read')) ||
-            (await this.subjectAllows(record.typeId, ['read-own', 'read-any'], {
-                record,
-                prefetchedGrants,
-                groupRoles,
-            }));
-        if (!reachable)
-            return false;
-        return this.principalAllows(record.typeId, ['read-own', 'read-any'], prefetchedGrants);
-    }
-    async checkCreateGrant(typeId) {
-        if (this.ownerActingAlone)
-            return true;
-        const reachable = this.subjectId === this.stack.ownerEntityId || (await this.subjectAllows(typeId, ['create']));
-        if (!reachable)
-            return false;
-        return this.principalAllows(typeId, ['create']);
-    }
     /**
      * `_group` records are managed, not merely written: only the owner or an
      * `admin` roster holder may mutate them — ordinary write permissions and
@@ -228,13 +255,13 @@ export class ScopeAuthority {
      * owner acting alone skips the lookup and leaves absence to `Stack`.
      * See docs/spec/access-control.md § Reference-creation gating.
      */
-    async canReadReferent(recordId) {
+    async canReadReferent(recordId, snapshot) {
         if (this.ownerActingAlone)
             return true;
         const record = await this.stack.get(recordId, { includeDeleted: true });
         if (!record)
             return false;
-        return this.canRead(record);
+        return this.canRead(record, snapshot);
     }
     /**
      * Whether this request can read some record referencing `fileId`, other
@@ -242,14 +269,12 @@ export class ScopeAuthority {
      * unlock unlimited further metadata records for the file.
      * See docs/spec/attachments.md § Creating `_attachment@1` records directly.
      */
-    async hasReadableReference(fileId) {
-        const prefetchedGrants = this.identified ? await this.loadGrants() : undefined;
-        const groupRoles = new Map();
-        const match = await findFirstMatch((q) => this.stack.query(q), 
+    async hasReadableReference(fileId, snapshot) {
+        const reach = await snapshot.reach('read');
+        const match = await findFirstMatch((q) => this.queryReadable(splitQuery(q), reach), 
         // Reach, not enumeration: a record readable by ID conveys the file it
         // references. See docs/spec/unlisted.md.
-        { filter: { referencesFileId: fileId, includeUnlisted: true } }, (record) => baseIdOf(record.typeId) !== SYSTEM_TYPES.ATTACHMENT &&
-            this.canRead(record, prefetchedGrants, groupRoles));
+        { filter: { referencesFileId: fileId, includeUnlisted: true } }, (record) => baseIdOf(record.typeId) !== SYSTEM_TYPES.ATTACHMENT);
         return match !== undefined;
     }
     /**
@@ -258,22 +283,22 @@ export class ScopeAuthority {
      * indistinguishable (both false), so no confirmation oracle for guessed
      * hashes. See docs/spec/access-control.md § Reference-creation gating.
      */
-    async canAccessFile(fileId) {
+    async canAccessFile(fileId, snapshot) {
         if (this.ownerActingAlone)
             return true;
         // Reaching a file through a record this request can read is already
-        // fully intersected — canRead() applied the principal's mask against
-        // that record's own type, which is the type the reference lives on.
-        if (await this.hasReadableReference(fileId))
+        // fully intersected — the reach fences that record's own type, which
+        // is the type the reference lives on.
+        if (await this.hasReadableReference(fileId, snapshot))
             return true;
         if (!this.subjectId)
             return false;
         // The remaining paths are authorship facts about the subject, so they
         // decide *which* files match — they are not themselves a grant, and the
         // principal still needs one of its own on the attachment type.
-        if (!(await this.principalAllows(`${SYSTEM_TYPES.ATTACHMENT}@1`, ['read-own', 'read-any']))) {
+        const { fence } = await snapshot.reach('read');
+        if (fence && !fence.includes(SYSTEM_TYPES.ATTACHMENT))
             return false;
-        }
         if (this.subjectId === this.stack.ownerEntityId)
             return true;
         // `includeUnlisted`, as hasReadableReference() above: withholding a
@@ -303,7 +328,7 @@ export class ScopeAuthority {
      * owner approved, holding `update-any` on each directly.
      * See docs/spec/apps.md § Migrating an installed app's types.
      */
-    async installMayMigrate(record, toTypeId) {
+    async installMayMigrate(record, toTypeId, snapshot) {
         const principal = this.principalId;
         if (!principal || this.delegated)
             return false;
@@ -335,12 +360,10 @@ export class ScopeAuthority {
         }
         if (!linked)
             return false;
-        const grants = await this.loadGrants();
-        for (const family of families) {
-            if (!(await this.principalHolds(`${family}@1`, ['update-any'], grants)))
-                return false;
-        }
-        return true;
+        // Grants naming the app itself: an install reaches only families the
+        // owner named it to, whoever else holds them.
+        const held = await this.familiesConveying(principal, PRINCIPAL_SIDE, ['update-any'], snapshot);
+        return [...families].every((family) => held.includes(family));
     }
     /** Names of the type's top-level file-ref fields — the content-reference half of referencesFileId matching. */
     async fileRefFieldNames(typeId) {
@@ -354,7 +377,7 @@ export class ScopeAuthority {
      * See docs/spec/access-control.md § Delegation: principal and subject.
      */
     mayGrantAccess() {
-        return !this.delegated || this.principalId === this.stack.ownerEntityId;
+        return this.principalUnbounded;
     }
     /**
      * Whether one identity, on its own, may decide who else reaches `record`
@@ -374,8 +397,9 @@ export class ScopeAuthority {
      * See docs/spec/access-control.md § Record-level permissions.
      */
     canReshare(record) {
-        if (isGroupRecord(record))
+        if (familyPolicy(record.typeId).writers === 'group-managers') {
             return this.isGroupManager(record);
+        }
         if (!this.mayReshare(this.principalId, record))
             return false;
         return !this.delegated || this.mayReshare(this.subjectId, record);

package/dist/scoped-stack/authority.js.map

@@ -1 +1 @@
-{"version":3,"file":"authority.js","sourceRoot":"","sources":["../../src/scoped-stack/authority.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,WAAW,EACX,yBAAyB,EACzB,aAAa,EACb,kBAAkB,GACnB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpF,OAAO,EACL,wBAAwB,EACxB,YAAY,EACZ,kBAAkB,EAClB,UAAU,GACX,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC9F,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,aAAa,GACd,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAejD,MAAM,OAAO,cAAc;IAEN;IAER;IAEA;IALX,YACmB,KAAY;IAC7B,iFAAiF;IACxE,WAA4B;IACrC,uFAAuF;IAC9E,SAA0B;QAJlB,UAAK,GAAL,KAAK,CAAO;QAEpB,gBAAW,GAAX,WAAW,CAAiB;QAE5B,cAAS,GAAT,SAAS,CAAiB;IAClC,CAAC;IAEa,aAAa,GAAG,CAAC,EAAU,EAA+B,EAAE,CAC3E,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;IAE/C,sDAAsD;IAC7C,UAAU,GAAG,GAA2B,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAEjG,uEAAuE;IACvE,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,WAAW,CAAC;IAC7C,CAAC;IAED;;;;;;OAMG;IACH,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,WAAW,KAAK,IAAI,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC;IAC9D,CAAC;IAED;;;;;OAKG;IACH,IAAI,SAAS;QACX,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QAC9C,OAAO,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI;YAChD,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE;YAC9D,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;IACpC,CAAC;IAED;;;;;OAKG;IACH,IAAI,gBAAgB;QAClB,OAAO,kBAAkB,CACvB,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,EAC5D,IAAI,CAAC,KAAK,CAAC,aAAa,CACzB,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,aAAa,CAAC,MAAmB,EAAE,IAAgB;QACjD,OAAO,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;IACjG,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,QAAQ,CACpB,MAAc,EACd,OAAsB,EACtB,IAQC;QAED,MAAM,EACJ,OAAO,EACP,MAAM,EACN,gBAAgB,EAChB,QAAQ,GAAG,IAAI,EACf,YAAY,GAAG,IAAI,EACnB,UAAU,GAAG,IAAI,GAClB,GAAG,IAAI,CAAC;QACT,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAC3B,oEAAoE;QACpE,oEAAoE;QACpE,mCAAmC;QACnC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,GAAG,EAA4B,CAAC;QAE1E,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAElC,yEAAyE;QACzE,sEAAsE;QACtE,uEAAuE;QACvE,mEAAmE;QACnE,IAAI,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAC;QAEzD,IAAI,YAA2B,CAAC;QAChC,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACnC,YAAY,GAAG,gBAAgB,CAAC;QAClC,CAAC;aAAM,CAAC;YACN,gEAAgE;YAChE,yDAAyD;YACzD,YAAY,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACzC,CAAC;QAED,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;YAC7B,MAAM,CAAC,GAAG,CAAC,CAAC,OAAuB,CAAC;YACpC,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YAC5B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ;gBAAE,SAAS;YACpD,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,CAAC,EAAE,OAAO,EAAE;gBAClD,YAAY;gBACZ,UAAU;gBACV,UAAU;gBACV,aAAa,EAAE,IAAI,CAAC,aAAa;aAClC,CAAC,CAAC;YACH,IAAI,CAAC,MAAM;gBAAE,SAAS;YACtB,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;gBACtC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC;oBAAE,OAAO,KAAK,CAAC;gBACvD,IAAI,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAAE,OAAO,MAAM,EAAE,SAAS,EAAE,SAAS,KAAK,OAAO,CAAC;gBACzF,OAAO,IAAI,CAAC;YACd,CAAC,CAAC,CAAC;YACH,IAAI,OAAO;gBAAE,OAAO,IAAI,CAAC;QAC3B,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;OAKG;IACH,eAAe,CACb,MAAc,EACd,OAAsB,EACtB,gBAAgC;QAEhC,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,KAAK,CAAC,aAAa;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAChF,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAChE,CAAC;IAED;;;;;OAKG;IACH,cAAc,CACZ,MAAc,EACd,OAAsB,EACtB,gBAAgC;QAEhC,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE;YACpC,OAAO,EAAE,IAAI,CAAC,WAAW;YACzB,gBAAgB;YAChB,QAAQ,EAAE,KAAK;YACf,YAAY,EAAE,KAAK;YACnB,UAAU,EAAE,KAAK;SAClB,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,aAAa,CACX,MAAc,EACd,OAAsB,EACtB,OAII,EAAE;QAEN,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE;YACpC,OAAO,EAAE,IAAI,CAAC,SAAS;YACvB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,SAAS,CAAC,MAAmB,EAAE,OAAe;QAClD,mEAAmE;QACnE,uEAAuE;QACvE,kEAAkE;QAClE,8BAA8B;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC;YAAE,OAAO,IAAI,oBAAoB,CAAC,OAAO,CAAC,CAAC;QACjF,OAAO,IAAI,kBAAkB,CAAC,sBAAsB,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,OAAO,CACX,MAAmB,EACnB,gBAAgC,EAChC,UAA0C;QAE1C,MAAM,SAAS,GACb,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC1C,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE;gBACjE,MAAM;gBACN,gBAAgB;gBAChB,UAAU;aACX,CAAC,CAAC,CAAC;QACN,IAAI,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAC7B,OAAO,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,gBAAgB,CAAC,CAAC;IACzF,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,MAAc;QACnC,IAAI,IAAI,CAAC,gBAAgB;YAAE,OAAO,IAAI,CAAC;QACvC,MAAM,SAAS,GACb,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAChG,IAAI,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAC7B,OAAO,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IAClD,CAAC;IAED;;;;;OAKG;IACH,cAAc,CAAC,MAAmB;QAChC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACtE,CAAC;IAED,iFAAiF;IACzE,YAAY,CAAC,QAAyB,EAAE,MAAmB;QACjE,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5B,IAAI,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC;QACvD,OAAO,yBAAyB,CAAC,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,KAAK,OAAO,CAAC;IAC9E,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,eAAe,CAAC,QAAgB;QACpC,IAAI,IAAI,CAAC,gBAAgB;YAAE,OAAO,IAAI,CAAC;QACvC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,oBAAoB,CAAC,MAAc;QACvC,MAAM,gBAAgB,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/E,MAAM,UAAU,GAAG,IAAI,GAAG,EAA4B,CAAC;QAEvD,MAAM,KAAK,GAAG,MAAM,cAAc,CAChC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1B,sEAAsE;QACtE,yCAAyC;QACzC,EAAE,MAAM,EAAE,EAAE,gBAAgB,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,EAC/D,CAAC,MAAM,EAAE,EAAE,CACT,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,YAAY,CAAC,UAAU;YACnD,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAgB,EAAE,UAAU,CAAC,CACrD,CAAC;QACF,OAAO,KAAK,KAAK,SAAS,CAAC;IAC7B,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CAAC,MAAc;QAChC,IAAI,IAAI,CAAC,gBAAgB;YAAE,OAAO,IAAI,CAAC;QAEvC,oEAAoE;QACpE,qEAAqE;QACrE,oEAAoE;QACpE,IAAI,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QAEzD,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAElC,sEAAsE;QACtE,wEAAwE;QACxE,+DAA+D;QAC/D,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,YAAY,CAAC,UAAU,IAAI,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5F,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,KAAK,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC;QAE7D,oEAAoE;QACpE,qEAAqE;QACrE,iEAAiE;QACjE,OAAO,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;YAC5C,CAAC,CAAC,CACE,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;gBACrB,MAAM,EAAE;oBACN,MAAM,EAAE,GAAG,YAAY,CAAC,UAAU,IAAI;oBACtC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;oBACxC,OAAO,EAAE,EAAE,MAAM,EAAE;oBACnB,eAAe,EAAE,IAAI;iBACtB;gBACD,KAAK,EAAE,CAAC;aACT,CAAC,CACH,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;YACtB,CAAC,CAAC,CACE,MAAM,aAAa,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;gBAC9C,MAAM,EAAE;oBACN,MAAM,EAAE,GAAG,YAAY,CAAC,UAAU,IAAI;oBACtC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;oBACxC,eAAe,EAAE,IAAI;iBACtB;aACF,CAAC,CACH,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAC,CAAC,OAA6B,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IACxE,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,iBAAiB,CAAC,MAAmB,EAAE,QAAgB;QAC3D,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC;QACnC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAC/C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAExE,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtD,IAAI,OAAgE,CAAC;QACrE,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;YAC9B,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;YACjF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YACzC,IAAI,cAAc,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK;gBAAE,OAAO,KAAK,CAAC;YAChF,IAAI,OAAO,IAAI,OAAO,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAE,CAAC,EAAE;gBAAE,OAAO,KAAK,CAAC;YAC7D,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QACzB,CAAC;QACD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3F,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,OAAO,EAAE,iBAAiB,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC1C,IAAI,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,YAAY,CAAC,GAAG,EAAE,CAAC;gBACvD,IAAK,IAAI,CAAC,OAAsB,CAAC,GAAG,KAAK,SAAS;oBAAE,MAAM,GAAG,IAAI,CAAC;YACpE,CAAC;QACH,CAAC;QACD,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAE1B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACvC,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;YAC9B,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,MAAM,IAAI,EAAE,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC;QACxF,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,+GAA+G;IAC/G,KAAK,CAAC,iBAAiB,CAAC,MAAc;QACpC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChD,CAAC;IAED;;;;;OAKG;IACH,cAAc;QACZ,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC;IAC1E,CAAC;IAED;;;;;OAKG;IACK,UAAU,CAAC,QAAyB,EAAE,MAAmB;QAC/D,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5B,OAAO,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,aAAa,IAAI,QAAQ,KAAK,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC;IAC3F,CAAC;IAED;;;;;OAKG;IACH,UAAU,CAAC,MAAmB;QAC5B,IAAI,aAAa,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC9D,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QAC7D,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACpE,CAAC;CACF"}
+{"version":3,"file":"authority.js","sourceRoot":"","sources":["../../src/scoped-stack/authority.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,yBAAyB,EACzB,kBAAkB,EAClB,cAAc,EACd,aAAa,GACd,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAE9C,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpF,OAAO,EACL,wBAAwB,EACxB,YAAY,EACZ,kBAAkB,EAClB,UAAU,GACX,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEpE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC9F,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,aAAa,GACd,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAmBjD;;;;;GAKG;AACH,MAAM,YAAY,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAW,CAAC;AACvE,MAAM,cAAc,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAW,CAAC;AAG3E;;;;GAIG;AACH,MAAM,KAAK,GAAuF;IAChG,MAAM,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE;IACzB,IAAI,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE;IACvD,MAAM,EAAE,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,OAAO,EAAE;IAC9D,MAAM,EAAE,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,OAAO,EAAE;CAC/D,CAAC;AAEF,MAAM,MAAM,GAAyB,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAEvE,MAAM,OAAO,cAAc;IAEN;IAER;IAEA;IAEQ;IAPnB,YACmB,KAAY;IAC7B,iFAAiF;IACxE,WAA4B;IACrC,uFAAuF;IAC9E,SAA0B;IACnC,8DAA8D;IAC7C,aAAwE;QANxE,UAAK,GAAL,KAAK,CAAO;QAEpB,gBAAW,GAAX,WAAW,CAAiB;QAE5B,cAAS,GAAT,SAAS,CAAiB;QAElB,kBAAa,GAAb,aAAa,CAA2D;IACxF,CAAC;IAEJ;;;;;OAKG;IACH,QAAQ;QACN,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC;QAC/B,OAAO,IAAI,iBAAiB,CAAC;YAC3B,MAAM,EAAE,GAAG,EAAE,CACX,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACtF,KAAK,EAAE,GAAG,EAAE,CACV,OAAO,KAAK,IAAI;gBACd,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,GAAG,EAAE,CAAC;gBAC5B,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC;YAC1D,KAAK,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC;SAC3D,CAAC,CAAC;IACL,CAAC;IAED,uEAAuE;IACvE,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,WAAW,CAAC;IAC7C,CAAC;IAED;;;;;;OAMG;IACH,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,WAAW,KAAK,IAAI,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC;IAC9D,CAAC;IAED;;;;;OAKG;IACH,IAAI,SAAS;QACX,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QAC9C,OAAO,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI;YAChD,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE;YAC9D,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;IACpC,CAAC;IAED;;;;;OAKG;IACH,IAAI,gBAAgB;QAClB,OAAO,kBAAkB,CACvB,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,EAC5D,IAAI,CAAC,KAAK,CAAC,aAAa,CACzB,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,IAAY,kBAAkB;QAC5B,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC;IAC1E,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,iBAAiB,CAC7B,OAAwB,EACxB,IAAe,EACf,OAA+B,EAC/B,QAA2B;QAE3B,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;QACnC,KAAK,MAAM,CAAC,IAAI,MAAM,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YACxC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAuB,CAAC;YACpC,6DAA6D;YAC7D,iBAAiB;YACjB,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YAC5B,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC;gBAAE,SAAS;YACrD,gEAAgE;YAChE,qEAAqE;YACrE,iEAAiE;YACjE,iEAAiE;YACjE,oBAAoB;YACpB,IAAI,wBAAwB,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC;gBAAE,SAAS;YAC3D,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;gBAAE,SAAS;YACnE,IAAI,MAAM,kBAAkB,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC;gBAC7E,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;QACD,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC;IACvB,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,UAAU,CAAC,IAAe,EAAE,QAA2B;QACnE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,KAAK,GAAU,IAAI,CAAC,kBAAkB;YAC1C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,KAAK,EAAE,MAAM,IAAI,CAAC,iBAAiB,CACjC,IAAI,CAAC,WAAW,EAChB,cAAc,EACd,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EACxB,QAAQ,CACT;aACF,CAAC;QACN,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC;QAC/B,IAAI,OAAO,KAAK,IAAI,CAAC,KAAK,CAAC,aAAa;YAAE,OAAO,KAAK,CAAC;QAEvD,MAAM,QAAQ,GAAG,CAAC,MAAmB,EAAE,EAAE,CACvC,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC;QACpE,KAAK,CAAC,MAAM,GAAG;YACb,OAAO,EAAE,MAAM,QAAQ,CAAC,GAAG,CAAC;YAC5B,GAAG,CAAC,OAAO,KAAK,IAAI;gBAClB,GAAG,IAAI,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YAC5E,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;SAC9D,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,WAAW,CACvB,GAAqB,EACrB,QAA2B;QAE3B,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC;QAC/B,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;YACrD,KAAK,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,MAAM,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC;gBACrD,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAU,EAAE,CAAC;oBAChD,IAAI,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC;wBAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;gBACjF,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GAAG,CAAC,KAAuB,EAAE,OAAgB,EAAwB,EAAE,CAAC,CAAC;YACpF,IAAI,EAAE,YAAY;YAClB,KAAK;YACL,OAAO;SACR,CAAC,CAAC;QACH,IAAI,GAAG,KAAK,MAAM;YAAE,OAAO,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpF,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACzF,CAAC;IAED,kFAAkF;IAClF,KAAK,CAAC,GAAG,CAAC,IAAe,EAAE,MAAqB,EAAE,QAA2B;QAC3E,OAAO,OAAO,CAAC,MAAM,EAAE,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACrD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU,CACd,IAAe,EACf,MAAqB,EACrB,QAA2B;QAE3B,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC9C,OAAO,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,OAAO,CAAC,MAAmB,EAAE,QAA2B;QACtD,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAED,+FAA+F;IAC/F,SAAS,CAAC,MAAc,EAAE,QAA2B;QACnD,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC7E,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,SAAS,CACb,MAAmB,EACnB,OAAe,EACf,QAA2B;QAE3B,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC;YAAE,OAAO,IAAI,oBAAoB,CAAC,OAAO,CAAC,CAAC;QACnF,OAAO,IAAI,kBAAkB,CAAC,sBAAsB,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;IACpE,CAAC;IAED;;;;;OAKG;IACH,cAAc,CAAC,MAAmB;QAChC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACtE,CAAC;IAED,iFAAiF;IACzE,YAAY,CAAC,QAAyB,EAAE,MAAmB;QACjE,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5B,IAAI,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC;QACvD,OAAO,yBAAyB,CAAC,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,KAAK,OAAO,CAAC;IAC9E,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,eAAe,CAAC,QAAgB,EAAE,QAA2B;QACjE,IAAI,IAAI,CAAC,gBAAgB;YAAE,OAAO,IAAI,CAAC;QACvC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,oBAAoB,CAAC,MAAc,EAAE,QAA2B;QACpE,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,MAAM,cAAc,CAChC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;QAC/C,sEAAsE;QACtE,yCAAyC;QACzC,EAAE,MAAM,EAAE,EAAE,gBAAgB,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,EAC/D,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,YAAY,CAAC,UAAU,CAChE,CAAC;QACF,OAAO,KAAK,KAAK,SAAS,CAAC;IAC7B,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CAAC,MAAc,EAAE,QAA2B;QAC7D,IAAI,IAAI,CAAC,gBAAgB;YAAE,OAAO,IAAI,CAAC;QAEvC,oEAAoE;QACpE,qEAAqE;QACrE,sCAAsC;QACtC,IAAI,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAEnE,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAElC,sEAAsE;QACtE,wEAAwE;QACxE,+DAA+D;QAC/D,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,UAAU,CAAC;YAAE,OAAO,KAAK,CAAC;QAEpE,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,KAAK,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC;QAE7D,oEAAoE;QACpE,qEAAqE;QACrE,iEAAiE;QACjE,OAAO,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;YAC5C,CAAC,CAAC,CACE,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;gBACrB,MAAM,EAAE;oBACN,MAAM,EAAE,GAAG,YAAY,CAAC,UAAU,IAAI;oBACtC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;oBACxC,OAAO,EAAE,EAAE,MAAM,EAAE;oBACnB,eAAe,EAAE,IAAI;iBACtB;gBACD,KAAK,EAAE,CAAC;aACT,CAAC,CACH,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;YACtB,CAAC,CAAC,CACE,MAAM,aAAa,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;gBAC9C,MAAM,EAAE;oBACN,MAAM,EAAE,GAAG,YAAY,CAAC,UAAU,IAAI;oBACtC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;oBACxC,eAAe,EAAE,IAAI;iBACtB;aACF,CAAC,CACH,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAC,CAAC,OAA6B,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IACxE,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,iBAAiB,CACrB,MAAmB,EACnB,QAAgB,EAChB,QAA2B;QAE3B,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC;QACnC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAC/C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAExE,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtD,IAAI,OAAgE,CAAC;QACrE,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;YAC9B,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;YACjF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YACzC,IAAI,cAAc,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK;gBAAE,OAAO,KAAK,CAAC;YAChF,IAAI,OAAO,IAAI,OAAO,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAE,CAAC,EAAE;gBAAE,OAAO,KAAK,CAAC;YAC7D,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QACzB,CAAC;QACD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3F,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,OAAO,EAAE,iBAAiB,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC1C,IAAI,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,YAAY,CAAC,GAAG,EAAE,CAAC;gBACvD,IAAK,IAAI,CAAC,OAAsB,CAAC,GAAG,KAAK,SAAS;oBAAE,MAAM,GAAG,IAAI,CAAC;YACpE,CAAC;QACH,CAAC;QACD,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAE1B,qEAAqE;QACrE,8CAA8C;QAC9C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,cAAc,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC/F,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,+GAA+G;IAC/G,KAAK,CAAC,iBAAiB,CAAC,MAAc;QACpC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChD,CAAC;IAED;;;;;OAKG;IACH,cAAc;QACZ,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACjC,CAAC;IAED;;;;;OAKG;IACK,UAAU,CAAC,QAAyB,EAAE,MAAmB;QAC/D,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5B,OAAO,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,aAAa,IAAI,QAAQ,KAAK,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC;IAC3F,CAAC;IAED;;;;;OAKG;IACH,UAAU,CAAC,MAAmB;QAC5B,IAAI,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,KAAK,gBAAgB,EAAE,CAAC;YAC7D,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QAC7D,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACpE,CAAC;CACF"}

package/dist/scoped-stack/family-policy.d.ts

@@ -0,0 +1,59 @@
+/**
+ * System family policies
+ * -------------------------------------------------------
+ * The rules a system family holds a scoped writer to on top of the
+ * ordinary gates: who may write its Records at all, which content values
+ * are the owner's alone to set, and what a create must already be able to
+ * reach. One entry per family, read by every verb through the questions
+ * below, so a rule reaches each verb that writes what it governs — create,
+ * patchContent(), restoreVersion() and commitMigration() alike — rather
+ * than only the ones that remembered to ask it.
+ *
+ * A family with no entry is ordinary. Grants on a family are refused
+ * separately, at the write and at evaluation (UNGRANTABLE_SYSTEM_TYPES in
+ * grants.ts), since a grant is not a scoped write.
+ *
+ * See docs/spec/access-control.md § Per-verb gates.
+ */
+import type { EntityId, TypeId } from '../types/index.js';
+/**
+ * Who may write a Record of a family, whatever its own `permissions` and
+ * any grant say: anyone the ordinary write gate admits, the owner acting
+ * alone, or the Group's admins and the owner.
+ */
+export type FamilyWriters = 'ordinary' | 'owner-alone' | 'group-managers';
+type FamilyPolicy = {
+    writers: FamilyWriters;
+    /**
+     * Content fields only the owner acting alone may set, and when: `any`
+     * change, or only a value naming the owner's own DID.
+     */
+    ownerFields?: {
+        fields: readonly string[];
+        when: 'any' | 'owner-did';
+        message: string;
+    };
+    /**
+     * A content field naming a file a non-owner create must already be able
+     * to read through some other Record — see docs/spec/attachments.md
+     * § Creating `_attachment@1` records directly.
+     */
+    createNamesFile?: string;
+    /**
+     * Whether `relationship` associations are a roster naming Entities
+     * rather than references to readable Records, and so carry no
+     * reference gate — see docs/spec/access-control.md § Reference-creation gating.
+     */
+    rosterAssociations?: boolean;
+};
+/** The policy a Record of `typeId` is held to. */
+export declare const familyPolicy: (typeId: TypeId) => FamilyPolicy;
+/**
+ * The refusal a write owes when it moves content only the owner acting
+ * alone may set, or null when it moves none. Compared value-wise between
+ * `before` (absent at create) and `after`, so re-sending a value a Record
+ * already holds claims nothing.
+ */
+export declare const ownerFieldRefusal: (typeId: TypeId, before: Record<string, unknown> | undefined, after: Record<string, unknown>, ownerEntityId: EntityId) => string | null;
+export {};
+//# sourceMappingURL=family-policy.d.ts.map

package/dist/scoped-stack/family-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"family-policy.d.ts","sourceRoot":"","sources":["../../src/scoped-stack/family-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAE1D;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,aAAa,GAAG,gBAAgB,CAAC;AAE1E,KAAK,YAAY,GAAG;IAClB,OAAO,EAAE,aAAa,CAAC;IACvB;;;OAGG;IACH,WAAW,CAAC,EAAE;QAAE,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,IAAI,EAAE,KAAK,GAAG,WAAW,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACxF;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AAoCF,kDAAkD;AAClD,eAAO,MAAM,YAAY,GAAI,QAAQ,MAAM,KAAG,YACF,CAAC;AAE7C;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,GAC5B,QAAQ,MAAM,EACd,QAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC3C,OAAO,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,eAAe,QAAQ,KACtB,MAAM,GAAG,IAQX,CAAC"}

package/dist/scoped-stack/family-policy.js

@@ -0,0 +1,68 @@
+/**
+ * System family policies
+ * -------------------------------------------------------
+ * The rules a system family holds a scoped writer to on top of the
+ * ordinary gates: who may write its Records at all, which content values
+ * are the owner's alone to set, and what a create must already be able to
+ * reach. One entry per family, read by every verb through the questions
+ * below, so a rule reaches each verb that writes what it governs — create,
+ * patchContent(), restoreVersion() and commitMigration() alike — rather
+ * than only the ones that remembered to ask it.
+ *
+ * A family with no entry is ordinary. Grants on a family are refused
+ * separately, at the write and at evaluation (UNGRANTABLE_SYSTEM_TYPES in
+ * grants.ts), since a grant is not a scoped write.
+ *
+ * See docs/spec/access-control.md § Per-verb gates.
+ */
+import { baseIdOf } from '../schema.js';
+import { bindingFieldsOf } from '../stack/identity-bindings.js';
+import { SYSTEM_TYPES } from '../types/index.js';
+const ORDINARY = { writers: 'ordinary' };
+const POLICIES = new Map([
+    // Authority itself: see docs/spec/access-control.md § What a grant covers.
+    [SYSTEM_TYPES.GRANT, { writers: 'owner-alone' }],
+    [SYSTEM_TYPES.INSTALL, { writers: 'owner-alone' }],
+    // Managed, not merely written: see docs/spec/identity.md § Group.
+    [SYSTEM_TYPES.GROUP, { writers: 'group-managers', rosterAssociations: true }],
+    // See docs/spec/identity.md § DID bindings.
+    [
+        SYSTEM_TYPES.APP,
+        {
+            writers: 'ordinary',
+            ownerFields: {
+                fields: bindingFieldsOf(SYSTEM_TYPES.APP),
+                when: 'any',
+                message: 'Only the stack owner may set an _app record’s did or appId',
+            },
+        },
+    ],
+    [
+        SYSTEM_TYPES.ENTITY,
+        {
+            writers: 'ordinary',
+            ownerFields: {
+                fields: ['did'],
+                when: 'owner-did',
+                message: 'Only the stack owner may claim the owner’s own did',
+            },
+        },
+    ],
+    [SYSTEM_TYPES.ATTACHMENT, { writers: 'ordinary', createNamesFile: 'fileId' }],
+]);
+/** The policy a Record of `typeId` is held to. */
+export const familyPolicy = (typeId) => POLICIES.get(baseIdOf(typeId)) ?? ORDINARY;
+/**
+ * The refusal a write owes when it moves content only the owner acting
+ * alone may set, or null when it moves none. Compared value-wise between
+ * `before` (absent at create) and `after`, so re-sending a value a Record
+ * already holds claims nothing.
+ */
+export const ownerFieldRefusal = (typeId, before, after, ownerEntityId) => {
+    const rule = familyPolicy(typeId).ownerFields;
+    if (!rule)
+        return null;
+    const moved = rule.fields.some((field) => after[field] !== before?.[field] && (rule.when === 'any' || after[field] === ownerEntityId));
+    return moved ? rule.message : null;
+};
+//# sourceMappingURL=family-policy.js.map

package/dist/scoped-stack/family-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"family-policy.js","sourceRoot":"","sources":["../../src/scoped-stack/family-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AA+BjD,MAAM,QAAQ,GAAiB,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AAEvD,MAAM,QAAQ,GAAsC,IAAI,GAAG,CAAuB;IAChF,2EAA2E;IAC3E,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;IAChD,CAAC,YAAY,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;IAClD,kEAAkE;IAClE,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC;IAC7E,4CAA4C;IAC5C;QACE,YAAY,CAAC,GAAG;QAChB;YACE,OAAO,EAAE,UAAU;YACnB,WAAW,EAAE;gBACX,MAAM,EAAE,eAAe,CAAC,YAAY,CAAC,GAAG,CAAC;gBACzC,IAAI,EAAE,KAAK;gBACX,OAAO,EAAE,4DAA4D;aACtE;SACF;KACF;IACD;QACE,YAAY,CAAC,MAAM;QACnB;YACE,OAAO,EAAE,UAAU;YACnB,WAAW,EAAE;gBACX,MAAM,EAAE,CAAC,KAAK,CAAC;gBACf,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,oDAAoD;aAC9D;SACF;KACF;IACD,CAAC,YAAY,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC;CAC9E,CAAC,CAAC;AAEH,kDAAkD;AAClD,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAc,EAAgB,EAAE,CAC3D,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,QAAQ,CAAC;AAE7C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,MAAc,EACd,MAA2C,EAC3C,KAA8B,EAC9B,aAAuB,EACR,EAAE;IACjB,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC;IAC9C,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAC5B,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,KAAK,CAAC,KAAK,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,aAAa,CAAC,CAC9F,CAAC;IACF,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AACrC,CAAC,CAAC"}