@haverstack/core 0.42.0 → 0.44.0

package/dist/stack/integrity.js

@@ -1,8 +1,8 @@
 /**
  * Write invariants
  * -------------------------------------------------------
- * The integrity rules a Stack write owes whoever makes it — DID and appId
- * bindings, containment, attachment metadata, `_config` ownership and a
+ * The integrity rules a Stack write owes whoever makes it — immutable
+ * fields, DID and appId bindings, containment, attachment metadata and a
  * group's admin roster. They bind every requester, the stack owner
  * included, which is why they live beneath `ScopedStack`'s permission
  * gates rather than among them. Each reads unscoped: through the Stack it
@@ -10,7 +10,7 @@
  */
 import { hasGroupAdmin, isGroupRecord } from '../access.js';
 import { ARGUMENTS_INVALID, StackConflictError, StackValidationError } from '../errors.js';
-import { bindingFieldsOf, uniqueBindingFieldsOf } from './identity-bindings.js';
+import { bindingsOf, immutableFieldsOf, isUnset } from './field-rules.js';
 import { filtersContent } from '../query-validation.js';
 import { associationIdentical } from '../associations/identity.js';
 import { validateRecordId } from './record-id.js';
@@ -18,63 +18,59 @@ import { baseIdOf } from '../schema.js';
 import { findFirstMatch } from './reads.js';
 import { SYSTEM_TYPES } from '../types/index.js';
 // -------------------------------------------------------
-// DID and appId bindings
+// Content writes
 // -------------------------------------------------------
-/** Uniqueness for every unique binding field a newly created card claims. */
-export async function checkBindingsOnCreate(stack, typeId, content) {
-    const family = baseIdOf(typeId);
-    for (const field of uniqueBindingFieldsOf(family)) {
-        await checkBindingUnique(stack, family, field, content[field]);
-    }
-}
 /**
- * Immutability for every binding field a patch touches, then uniqueness
- * for the subset that carries it. Fields absent from the patch carry no
- * new claim — a content patch is a merge, so an untouched binding is the one the
- * card already holds.
+ * Every content integrity check create, patch, restore and migrate owe: a
+ * change, judged against `prior` (absent on create), then claims, judged
+ * against other records. A claim is asked only of a value not already held
+ * in the destination family, so a claim check never finds the record itself.
+ * See docs/spec/data-model.md § Immutable fields.
  */
-export async function checkBindingsOnUpdate(stack, typeId, id, patch, existing, merged) {
+export async function checkContentWrite(stack, typeId, content, prior) {
+    if (prior)
+        checkImmutableFields(prior, content);
     const family = baseIdOf(typeId);
-    const unique = uniqueBindingFieldsOf(family);
-    for (const field of bindingFieldsOf(family)) {
-        if (!(field in patch))
+    const held = prior && baseIdOf(prior.typeId) === family ? prior.content : {};
+    for (const { field, unique } of bindingsOf(family)) {
+        if (!unique || content[field] === held[field])
             continue;
-        checkBindingImmutable(family, field, existing[field], merged[field]);
-        if (unique.includes(field)) {
-            await checkBindingUnique(stack, family, field, merged[field], id);
-        }
+        await checkBindingUnique(stack, family, field, content[field]);
+    }
+    if (family === SYSTEM_TYPES.ATTACHMENT &&
+        (content.fileId !== held.fileId || content.mimeType !== held.mimeType)) {
+        await checkAttachmentMimeType(stack, content);
     }
 }
+// -------------------------------------------------------
+// Immutable fields
+// -------------------------------------------------------
 /**
- * Bindings across a migration, whose content replaces the old wholesale.
- * Immutability is asked over both families' binding fields, so a card can
- * neither shed a DID by migrating out nor pick one up on the way in;
- * uniqueness, of the destination only. See docs/spec/identity.md § DID bindings.
+ * Refuse a write that moves or clears an immutable field the record holds.
+ * Only the family the record is in now is asked: a field of the family it
+ * enters was never held, and arriving with one is a claim, not a change.
  */
-export async function checkBindingsOnMigrate(stack, fromTypeId, toTypeId, id, existing, content) {
-    const fromFamily = baseIdOf(fromTypeId);
-    const toFamily = baseIdOf(toTypeId);
-    const checked = new Set();
-    for (const family of fromFamily === toFamily ? [fromFamily] : [fromFamily, toFamily]) {
-        for (const field of bindingFieldsOf(family)) {
-            if (checked.has(field))
-                continue;
-            checked.add(field);
-            checkBindingImmutable(family, field, existing[field], content[field]);
-        }
-    }
-    for (const field of uniqueBindingFieldsOf(toFamily)) {
-        await checkBindingUnique(stack, toFamily, field, content[field], id);
+function checkImmutableFields(existing, next) {
+    const family = baseIdOf(existing.typeId);
+    const content = existing.content;
+    for (const field of immutableFieldsOf(family)) {
+        const held = content[field];
+        if (isUnset(held) || next[field] === held)
+            continue;
+        throw new StackConflictError(`Cannot change ${family}.${field}: it is immutable once set.`);
     }
 }
+// -------------------------------------------------------
+// Claims on stored values
+// -------------------------------------------------------
 /**
  * Refuse a second card claiming a value an Actor is resolved by. A
  * property of the set rather than the value, so no schema can say it.
  * Read-then-write: two racing creates can both pass.
  * See docs/spec/identity.md § DID bindings.
  */
-async function checkBindingUnique(stack, family, field, value, excludeId) {
-    if (typeof value !== 'string' || value === '')
+async function checkBindingUnique(stack, family, field, value) {
+    if (isUnset(value))
         return;
     const clash = await findFirstMatch((q) => stack.query(q), {
         filter: {
@@ -83,34 +79,16 @@ async function checkBindingUnique(stack, family, field, value, excludeId) {
             includeUnlisted: true,
             ...(filtersContent(stack.capabilities) && { content: { [field]: value } }),
         },
-    }, (r) => r.id !== excludeId && r.content[field] === value);
+    }, (r) => r.content[field] === value);
     if (clash) {
         throw new StackConflictError(`Another ${family} record already claims the ${field} "${value}"`);
     }
 }
-/**
- * A binding is permanent once made: uniqueness stops a second card claiming
- * a value, but only immutability stops an existing card being moved onto
- * one. A subject whose key changes gets a new card.
- * See docs/spec/identity.md § DID bindings.
- */
-export function checkBindingImmutable(family, field, existing, next) {
-    if (typeof existing !== 'string' || existing === '')
-        return;
-    if (next === existing)
-        return;
-    throw new StackValidationError([
-        {
-            path: field,
-            message: `${field} is immutable once set; register a new ${family} record instead`,
-        },
-    ]);
-}
 // -------------------------------------------------------
 // Containment
 // -------------------------------------------------------
 /**
- * How far a change set's `parentId` will walk a proposed ancestor chain before refusing
+ * How far a `parentId` will walk a proposed ancestor chain before refusing
  * the move. Bounds the reads one call can cost; a hierarchy deeper than
  * this is beyond what `parentId` is for. See docs/spec/data-model.md
  * § Reparenting.
@@ -154,23 +132,14 @@ export async function assertNoParentCycle(read, id, parentId) {
 // -------------------------------------------------------
 // Attachments
 // -------------------------------------------------------
-/**
- * The `_attachment@1` fields a write may not move, each with the message it
- * is refused by. Ordered as reported. See docs/spec/attachments.md § The
- * `_attachment` record type.
- */
-const ATTACHMENT_IMMUTABLE_FIELDS = [
-    ['mimeType', 'mimeType is immutable after creation; delete and re-upload to change it'],
-    ['fileId', 'fileId is immutable'],
-    ['size', 'size is immutable'],
-];
 /**
  * mimeType belongs to the fileId: its first metadata record fixes it, and
- * a conflicting later one is refused. Best-effort against a racing first
+ * a conflicting later one is refused — a clash with stored state, as a
+ * binding's second claimant is. Best-effort against a racing first
  * upload; what survives the race is a deterministic winner. See
  * docs/spec/attachments.md § The `_attachment` record type.
  */
-export async function checkAttachmentMimeTypeOnCreate(stack, content) {
+async function checkAttachmentMimeType(stack, content) {
     const { fileId, mimeType } = content;
     if (typeof fileId !== 'string')
         return; // schema validation already rejected this
@@ -182,12 +151,7 @@ export async function checkAttachmentMimeTypeOnCreate(stack, content) {
         // Deliberately does not name the established mimeType — that would
         // confirm a guessed fileId's content type. See the anti-oracle rule
         // in docs/spec/attachments.md.
-        throw new StackValidationError([
-            {
-                path: 'mimeType',
-                message: 'mimeType conflicts with the mimeType already established for this fileId',
-            },
-        ]);
+        throw new StackConflictError('mimeType conflicts with the mimeType already established for this fileId');
     }
 }
 /**
@@ -202,7 +166,7 @@ export async function checkAttachmentAssociationPointers(read, associations, sto
         !stored.some((a) => associationIdentical(a, association))
         ? [{ fileId: association.fileId, attachmentRecordId: association.attachmentRecordId }]
         : []);
-    // One round trip per pointer, taken together: a change set carries a
+    // One round trip per pointer, taken together: a write carries a
     // whole association list, and each pointer is an independent read.
     const named = await Promise.all(pointed.map(({ attachmentRecordId }) => read(attachmentRecordId)));
     pointed.forEach(({ fileId }, i) => {
@@ -224,33 +188,9 @@ export async function checkAttachmentAssociationPointers(read, associations, sto
         ], ARGUMENTS_INVALID);
     });
 }
-/**
- * Refuse a write that moves an `_attachment@1` record's fileId, size or
- * mimeType. `violates` decides what counts as a move, since a patch names
- * only what it changes while a migration re-sends all three.
- * See docs/spec/attachments.md § The `_attachment` record type.
- */
-export function assertAttachmentImmutable(violates) {
-    const errors = ATTACHMENT_IMMUTABLE_FIELDS.filter(([field]) => violates(field)).map(([path, message]) => ({ path, message }));
-    if (errors.length > 0) {
-        throw new StackValidationError(errors);
-    }
-}
 // -------------------------------------------------------
-// Stack identity and groups
+// Groups
 // -------------------------------------------------------
-/**
- * `_config.entityId` defines stack ownership; neither patchContent() nor
- * restoreVersion() may change it. A conflict with stack integrity, not a
- * schema violation — hence StackConflictError. See docs/spec.md § The
- * `_config` record.
- */
-export function checkConfigEntityIdUnchanged(existingEntityId, newEntityId) {
-    if (newEntityId !== existingEntityId) {
-        throw new StackConflictError('Cannot change _config.entityId: it defines stack ownership. ' +
-            'Ownership transfer is not a supported operation.');
-    }
-}
 /**
  * Refuse a write that would leave a `_group` Record with no `admin`, asked
  * of the roster the write would produce. An integrity rule, not a

package/dist/stack/integrity.js.map

@@ -1 +1 @@
-{"version":3,"file":"integrity.js","sourceRoot":"","sources":["../../src/stack/integrity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE5D,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAC3F,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAChF,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAYjD,0DAA0D;AAC1D,yBAAyB;AACzB,0DAA0D;AAE1D,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAAY,EACZ,MAAc,EACd,OAAgC;IAEhC,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChC,KAAK,MAAM,KAAK,IAAI,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,MAAM,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAAY,EACZ,MAAc,EACd,EAAY,EACZ,KAAqC,EACrC,QAAiC,EACjC,MAA+B;IAE/B,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC7C,KAAK,MAAM,KAAK,IAAI,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5C,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC;YAAE,SAAS;QAChC,qBAAqB,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACrE,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAY,EACZ,UAAkB,EAClB,QAAgB,EAChB,EAAY,EACZ,QAAiC,EACjC,OAAgC;IAEhC,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAEpC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,MAAM,IAAI,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,CAAC;QACrF,KAAK,MAAM,KAAK,IAAI,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5C,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,SAAS;YACjC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACnB,qBAAqB,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,qBAAqB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,MAAM,kBAAkB,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,kBAAkB,CAC/B,KAAY,EACZ,MAAc,EACd,KAAsB,EACtB,KAAc,EACd,SAAoB;IAEpB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO;IAEtD,MAAM,KAAK,GAAG,MAAM,cAAc,CAChC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EACrB;QACE,MAAM,EAAE;YACN,MAAM,EAAE,MAAM;YACd,cAAc,EAAE,IAAI;YACpB,eAAe,EAAE,IAAI;YACrB,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;SAC3E;KACF,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,IAAK,CAAC,CAAC,OAAmC,CAAC,KAAK,CAAC,KAAK,KAAK,CACrF,CAAC;IACF,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,IAAI,kBAAkB,CAAC,WAAW,MAAM,8BAA8B,KAAK,KAAK,KAAK,GAAG,CAAC,CAAC;IAClG,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAc,EACd,KAAsB,EACtB,QAAiB,EACjB,IAAa;IAEb,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,EAAE;QAAE,OAAO;IAC5D,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO;IAC9B,MAAM,IAAI,oBAAoB,CAAC;QAC7B;YACE,IAAI,EAAE,KAAK;YACX,OAAO,EAAE,GAAG,KAAK,0CAA0C,MAAM,iBAAiB;SACnF;KACF,CAAC,CAAC;AACL,CAAC;AAED,0DAA0D;AAC1D,cAAc;AACd,0DAA0D;AAE1D;;;;;GAKG;AACH,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAE5B;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAoB,EACpB,EAAU,EACV,QAAgB;IAEhB,gBAAgB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACvC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,kBAAkB,CAC1B,yBAAyB,EAAE,SAAS,QAAQ,wCAAwC;YAClF,yBAAyB,CAC5B,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAoB,EACpB,EAAU,EACV,QAAgB;IAEhB,IAAI,MAAM,GAAuB,QAAQ,CAAC;IAC1C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,MAAM,KAAK,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC;QAClD,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;YAClB,MAAM,IAAI,kBAAkB,CAC1B,yBAAyB,EAAE,SAAS,QAAQ,6BAA6B,EAAE,KAAK;gBAC9E,sDAAsD,CACzD,CAAC;QACJ,CAAC;QACD,sEAAsE;QACtE,uEAAuE;QACvE,gEAAgE;QAChE,+DAA+D;QAC/D,IAAI,KAAK,IAAI,gBAAgB;YAAE,OAAO;QACtC,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,QAAQ,CAAC;IAC1C,CAAC;AACH,CAAC;AAED,0DAA0D;AAC1D,cAAc;AACd,0DAA0D;AAE1D;;;;GAIG;AACH,MAAM,2BAA2B,GAAG;IAClC,CAAC,UAAU,EAAE,yEAAyE,CAAC;IACvF,CAAC,QAAQ,EAAE,qBAAqB,CAAC;IACjC,CAAC,MAAM,EAAE,mBAAmB,CAAC;CACrB,CAAC;AAIX;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,KAAY,EACZ,OAA0B;IAE1B,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IACrC,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,CAAC,0CAA0C;IAElF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC1D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAElC,MAAM,mBAAmB,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IACzD,IAAI,QAAQ,KAAK,mBAAmB,EAAE,CAAC;QACrC,mEAAmE;QACnE,oEAAoE;QACpE,+BAA+B;QAC/B,MAAM,IAAI,oBAAoB,CAAC;YAC7B;gBACE,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE,0EAA0E;aACpF;SACF,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,IAAoB,EACpB,YAAuC,EACvC,SAAwB,EAAE;IAE1B,MAAM,OAAO,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE,CAC3D,WAAW,CAAC,IAAI,KAAK,YAAY;QACjC,WAAW,CAAC,kBAAkB,KAAK,SAAS;QAC5C,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,kBAAkB,EAAE,WAAW,CAAC,kBAAkB,EAAE,CAAC;QACtF,CAAC,CAAC,EAAE,CACP,CAAC;IACF,qEAAqE;IACrE,mEAAmE;IACnE,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAC7B,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,kBAAkB,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAClE,CAAC;IAEF,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE;QAChC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACxB,MAAM,OAAO,GAAG,MAAM,EAAE,OAAwC,CAAC;QACjE,IACE,MAAM;YACN,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,YAAY,CAAC,UAAU;YACnD,OAAO,EAAE,MAAM,KAAK,MAAM,EAC1B,CAAC;YACD,OAAO;QACT,CAAC;QACD,uEAAuE;QACvE,mEAAmE;QACnE,+CAA+C;QAC/C,MAAM,IAAI,oBAAoB,CAC5B;YACE;gBACE,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,sEAAsE;aAChF;SACF,EACD,iBAAiB,CAClB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAAsD;IAEtD,MAAM,MAAM,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CACjF,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CACzC,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,oBAAoB,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;AACH,CAAC;AAED,0DAA0D;AAC1D,4BAA4B;AAC5B,0DAA0D;AAE1D;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B,CAC1C,gBAA0B,EAC1B,WAAqB;IAErB,IAAI,WAAW,KAAK,gBAAgB,EAAE,CAAC;QACrC,MAAM,IAAI,kBAAkB,CAC1B,8DAA8D;YAC5D,kDAAkD,CACrD,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAmB,EAAE,IAAuB;IAClF,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;QAAE,OAAO;IACnC,IAAI,aAAa,CAAC,IAAI,CAAC;QAAE,OAAO;IAChC,MAAM,IAAI,kBAAkB,CAC1B,uBAAuB,MAAM,CAAC,EAAE,wDAAwD;QACtF,wFAAwF,CAC3F,CAAC;AACJ,CAAC"}
+{"version":3,"file":"integrity.js","sourceRoot":"","sources":["../../src/stack/integrity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE5D,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAC3F,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAUjD,0DAA0D;AAC1D,iBAAiB;AACjB,0DAA0D;AAE1D;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAY,EACZ,MAAc,EACd,OAAgC,EAChC,KAAmB;IAEnB,IAAI,KAAK;QAAE,oBAAoB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAEhD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChC,MAAM,IAAI,GACR,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,CAAC,CAAE,KAAK,CAAC,OAAmC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/F,KAAK,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC;YAAE,SAAS;QACxD,MAAM,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IACjE,CAAC;IACD,IACE,MAAM,KAAK,YAAY,CAAC,UAAU;QAClC,CAAC,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,CAAC,EACtE,CAAC;QACD,MAAM,uBAAuB,CAAC,KAAK,EAAE,OAAuC,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AAED,0DAA0D;AAC1D,mBAAmB;AACnB,0DAA0D;AAE1D;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,QAAqB,EAAE,IAA6B;IAChF,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAkC,CAAC;IAC5D,KAAK,MAAM,KAAK,IAAI,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC5B,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI;YAAE,SAAS;QACpD,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,MAAM,IAAI,KAAK,6BAA6B,CAAC,CAAC;IAC9F,CAAC;AACH,CAAC;AAED,0DAA0D;AAC1D,0BAA0B;AAC1B,0DAA0D;AAE1D;;;;;GAKG;AACH,KAAK,UAAU,kBAAkB,CAC/B,KAAY,EACZ,MAAc,EACd,KAAsB,EACtB,KAAc;IAEd,IAAI,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO;IAE3B,MAAM,KAAK,GAAG,MAAM,cAAc,CAChC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EACrB;QACE,MAAM,EAAE;YACN,MAAM,EAAE,MAAM;YACd,cAAc,EAAE,IAAI;YACpB,eAAe,EAAE,IAAI;YACrB,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;SAC3E;KACF,EACD,CAAC,CAAC,EAAE,EAAE,CAAE,CAAC,CAAC,OAAmC,CAAC,KAAK,CAAC,KAAK,KAAK,CAC/D,CAAC;IACF,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,IAAI,kBAAkB,CAAC,WAAW,MAAM,8BAA8B,KAAK,KAAK,KAAK,GAAG,CAAC,CAAC;IAClG,CAAC;AACH,CAAC;AAED,0DAA0D;AAC1D,cAAc;AACd,0DAA0D;AAE1D;;;;;GAKG;AACH,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAE5B;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAoB,EACpB,EAAU,EACV,QAAgB;IAEhB,gBAAgB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACvC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,kBAAkB,CAC1B,yBAAyB,EAAE,SAAS,QAAQ,wCAAwC;YAClF,yBAAyB,CAC5B,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAoB,EACpB,EAAU,EACV,QAAgB;IAEhB,IAAI,MAAM,GAAuB,QAAQ,CAAC;IAC1C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,MAAM,KAAK,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC;QAClD,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;YAClB,MAAM,IAAI,kBAAkB,CAC1B,yBAAyB,EAAE,SAAS,QAAQ,6BAA6B,EAAE,KAAK;gBAC9E,sDAAsD,CACzD,CAAC;QACJ,CAAC;QACD,sEAAsE;QACtE,uEAAuE;QACvE,gEAAgE;QAChE,+DAA+D;QAC/D,IAAI,KAAK,IAAI,gBAAgB;YAAE,OAAO;QACtC,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,QAAQ,CAAC;IAC1C,CAAC;AACH,CAAC;AAED,0DAA0D;AAC1D,cAAc;AACd,0DAA0D;AAE1D;;;;;;GAMG;AACH,KAAK,UAAU,uBAAuB,CAAC,KAAY,EAAE,OAA0B;IAC7E,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IACrC,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,CAAC,0CAA0C;IAElF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC1D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAElC,MAAM,mBAAmB,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IACzD,IAAI,QAAQ,KAAK,mBAAmB,EAAE,CAAC;QACrC,mEAAmE;QACnE,oEAAoE;QACpE,+BAA+B;QAC/B,MAAM,IAAI,kBAAkB,CAC1B,0EAA0E,CAC3E,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,IAAoB,EACpB,YAAuC,EACvC,SAAwB,EAAE;IAE1B,MAAM,OAAO,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE,CAC3D,WAAW,CAAC,IAAI,KAAK,YAAY;QACjC,WAAW,CAAC,kBAAkB,KAAK,SAAS;QAC5C,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,kBAAkB,EAAE,WAAW,CAAC,kBAAkB,EAAE,CAAC;QACtF,CAAC,CAAC,EAAE,CACP,CAAC;IACF,gEAAgE;IAChE,mEAAmE;IACnE,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAC7B,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,kBAAkB,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAClE,CAAC;IAEF,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE;QAChC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACxB,MAAM,OAAO,GAAG,MAAM,EAAE,OAAwC,CAAC;QACjE,IACE,MAAM;YACN,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,YAAY,CAAC,UAAU;YACnD,OAAO,EAAE,MAAM,KAAK,MAAM,EAC1B,CAAC;YACD,OAAO;QACT,CAAC;QACD,uEAAuE;QACvE,mEAAmE;QACnE,+CAA+C;QAC/C,MAAM,IAAI,oBAAoB,CAC5B;YACE;gBACE,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,sEAAsE;aAChF;SACF,EACD,iBAAiB,CAClB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,0DAA0D;AAC1D,SAAS;AACT,0DAA0D;AAE1D;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAmB,EAAE,IAAuB;IAClF,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;QAAE,OAAO;IACnC,IAAI,aAAa,CAAC,IAAI,CAAC;QAAE,OAAO;IAChC,MAAM,IAAI,kBAAkB,CAC1B,uBAAuB,MAAM,CAAC,EAAE,wDAAwD;QACtF,wFAAwF,CAC3F,CAAC;AACJ,CAAC"}

package/dist/stack/limits.d.ts

@@ -13,7 +13,7 @@
 export declare function assertAttachmentSize(byteLength: number, attachmentBytes: number | null): void;
 /**
  * The content half of the same pre-check, on Stack.create() and
- * Stack.mutate(). A `null` ceiling — every local adapter's — skips the
+ * Stack.patchContent(). A `null` ceiling — every local adapter's — skips the
  * serialization entirely.
  */
 export declare function assertContentSize(content: Record<string, unknown>, contentBytes: number | null, what: 'Content' | 'Patch'): void;

package/dist/stack/limits.js

@@ -18,7 +18,7 @@ export function assertAttachmentSize(byteLength, attachmentBytes) {
 }
 /**
  * The content half of the same pre-check, on Stack.create() and
- * Stack.mutate(). A `null` ceiling — every local adapter's — skips the
+ * Stack.patchContent(). A `null` ceiling — every local adapter's — skips the
  * serialization entirely.
  */
 export function assertContentSize(content, contentBytes, what) {

package/dist/stack/reads.d.ts

@@ -12,11 +12,7 @@
  * None of these is a public API.
  */
 import type { Stack } from './stack.js';
-import type { EntityId, GrantContent, InstallContent, QueryResult, StackQuery, StackRecord } from '../types/index.js';
-/** The page size query() answers with when the caller names none. */
-export declare const DEFAULT_QUERY_LIMIT = 50;
-/** The largest page query() returns, whatever the caller asks for. */
-export declare const MAX_QUERY_LIMIT = 1000;
+import type { EntityId, GrantContent, GroupRole, InstallContent, QueryResult, RecordId, StackQuery, StackRecord } from '../types/index.js';
 /**
  * Walks `cursor` to exhaustion for the internal call sites that need every
  * match (grant checks, attachment cleanup) — query() itself always
@@ -62,4 +58,12 @@ export declare function loadInstallRecords(stack: Stack): Promise<(StackRecord &
 export declare function loadGrantRecords(run: (query: StackQuery) => Promise<QueryResult>): Promise<(StackRecord & {
     content: GrantContent;
 })[]>;
+/**
+ * The role `entityId` holds on every roster that holds it, keyed by group
+ * id — the one reading of which rosters reach an entity. A roster is a
+ * live `_group`'s relationships: a Record outside the family or a deleted
+ * Group reaches nobody, and unlisted ones count, as for grants above. See
+ * docs/spec/access-control.md § Record-level permissions.
+ */
+export declare function loadRosterRoles(run: (query: StackQuery) => Promise<QueryResult>, entityId: EntityId): Promise<Map<RecordId, GroupRole>>;
 //# sourceMappingURL=reads.d.ts.map

package/dist/stack/reads.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reads.d.ts","sourceRoot":"","sources":["../../src/stack/reads.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,KAAK,EAGV,QAAQ,EACR,YAAY,EACZ,cAAc,EACd,WAAW,EACX,UAAU,EACV,WAAW,EACZ,MAAM,mBAAmB,CAAC;AAE3B,qEAAqE;AACrE,eAAO,MAAM,mBAAmB,KAAK,CAAC;AACtC,sEAAsE;AACtE,eAAO,MAAM,eAAe,OAAO,CAAC;AAEpC;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,WAAW,CAAC,EAChD,KAAK,EAAE,UAAU,EACjB,GAAG,SAAgB,GAClB,OAAO,CAAC,WAAW,EAAE,CAAC,CAcxB;AAKD;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,WAAW,CAAC,EAChD,KAAK,EAAE,UAAU,EACjB,SAAS,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,EAC9D,GAAG,SAAgB,GAClB,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAiBlC;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,WAAW,CAAC,EAChD,GAAG,EAAE,QAAQ,EACb,gBAAgB,EAAE,OAAO,EACzB,eAAe,EAAE,OAAO,GACvB,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAc7B;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAa9F;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,KAAK,GACX,OAAO,CAAC,CAAC,WAAW,GAAG;IAAE,OAAO,EAAE,cAAc,CAAA;CAAE,CAAC,EAAE,CAAC,CAKxD;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,WAAW,CAAC,GAC/C,OAAO,CAAC,CAAC,WAAW,GAAG;IAAE,OAAO,EAAE,YAAY,CAAA;CAAE,CAAC,EAAE,CAAC,CAKtD"}
+{"version":3,"file":"reads.d.ts","sourceRoot":"","sources":["../../src/stack/reads.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,KAAK,EAGV,QAAQ,EACR,YAAY,EACZ,SAAS,EACT,cAAc,EACd,WAAW,EACX,QAAQ,EACR,UAAU,EACV,WAAW,EACZ,MAAM,mBAAmB,CAAC;AAE3B;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,WAAW,CAAC,EAChD,KAAK,EAAE,UAAU,EACjB,GAAG,SAAgB,GAClB,OAAO,CAAC,WAAW,EAAE,CAAC,CAcxB;AAKD;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,WAAW,CAAC,EAChD,KAAK,EAAE,UAAU,EACjB,SAAS,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,EAC9D,GAAG,SAAgB,GAClB,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAiBlC;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,WAAW,CAAC,EAChD,GAAG,EAAE,QAAQ,EACb,gBAAgB,EAAE,OAAO,EACzB,eAAe,EAAE,OAAO,GACvB,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAc7B;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAa9F;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,KAAK,GACX,OAAO,CAAC,CAAC,WAAW,GAAG;IAAE,OAAO,EAAE,cAAc,CAAA;CAAE,CAAC,EAAE,CAAC,CAKxD;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,WAAW,CAAC,GAC/C,OAAO,CAAC,CAAC,WAAW,GAAG;IAAE,OAAO,EAAE,YAAY,CAAA;CAAE,CAAC,EAAE,CAAC,CAKtD;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,WAAW,CAAC,EAChD,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAcnC"}

package/dist/stack/reads.js

@@ -11,13 +11,10 @@
  *
  * None of these is a public API.
  */
+import { groupRoleFromAssociations } from '../access.js';
 import { StackBadRequestError } from '../errors.js';
 import { filtersContent } from '../query-validation.js';
 import { SYSTEM_TYPES } from '../types/index.js';
-/** The page size query() answers with when the caller names none. */
-export const DEFAULT_QUERY_LIMIT = 50;
-/** The largest page query() returns, whatever the caller asks for. */
-export const MAX_QUERY_LIMIT = 1000;
 /**
  * Walks `cursor` to exhaustion for the internal call sites that need every
  * match (grant checks, attachment cleanup) — query() itself always
@@ -118,4 +115,27 @@ export async function loadGrantRecords(run) {
     });
     return records;
 }
+/**
+ * The role `entityId` holds on every roster that holds it, keyed by group
+ * id — the one reading of which rosters reach an entity. A roster is a
+ * live `_group`'s relationships: a Record outside the family or a deleted
+ * Group reaches nobody, and unlisted ones count, as for grants above. See
+ * docs/spec/access-control.md § Record-level permissions.
+ */
+export async function loadRosterRoles(run, entityId) {
+    const groups = await queryAllPages(run, {
+        filter: {
+            baseId: SYSTEM_TYPES.GROUP,
+            relatedTo: { target: { kind: 'entity', entityId } },
+            includeUnlisted: true,
+        },
+    });
+    const roles = new Map();
+    for (const group of groups) {
+        const role = groupRoleFromAssociations(group.associations, entityId);
+        if (role)
+            roles.set(group.id, role);
+    }
+    return roles;
+}
 //# sourceMappingURL=reads.js.map

package/dist/stack/reads.js.map

@@ -1 +1 @@
-{"version":3,"file":"reads.js","sourceRoot":"","sources":["../../src/stack/reads.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAajD,qEAAqE;AACrE,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AACtC,sEAAsE;AACtE,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC;AAEpC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAgD,EAChD,KAAiB,EACjB,GAAG,GAAG,aAAa;IAEnB,MAAM,OAAO,GAAkB,EAAE,CAAC;IAClC,IAAI,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC1B,GAAG,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7C,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9B,IAAI,OAAO,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACzB,MAAM,IAAI,oBAAoB,CAC5B,kCAAkC,GAAG,wCAAwC,CAC9E,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,SAAS,CAAC;IACpC,CAAC,QAAQ,MAAM,EAAE;IACjB,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,0EAA0E;AAC1E,MAAM,aAAa,GAAG,MAAM,CAAC;AAE7B;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAgD,EAChD,KAAiB,EACjB,SAA8D,EAC9D,GAAG,GAAG,aAAa;IAEnB,IAAI,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC1B,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,GAAG,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7C,YAAY,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QACpC,IAAI,YAAY,GAAG,GAAG,EAAE,CAAC;YACvB,MAAM,IAAI,oBAAoB,CAC5B,mCAAmC,GAAG,wCAAwC,CAC/E,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,IAAI,MAAM,SAAS,CAAC,MAAM,CAAC;gBAAE,OAAO,MAAM,CAAC;QAC7C,CAAC;QACD,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,SAAS,CAAC;IACpC,CAAC,QAAQ,MAAM,EAAE;IACjB,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAgD,EAChD,GAAa,EACb,gBAAyB,EACzB,eAAwB;IAExB,MAAM,MAAM,GAAG,MAAM,cAAc,CACjC,GAAG,EACH;QACE,MAAM,EAAE;YACN,MAAM,EAAE,YAAY,CAAC,MAAM;YAC3B,cAAc,EAAE,IAAI;YACpB,GAAG,CAAC,eAAe,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;YACjD,GAAG,CAAC,gBAAgB,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC;SAC9C;KACF,EACD,CAAC,CAAC,EAAE,EAAE,CAAE,CAAC,CAAC,OAAyB,CAAC,GAAG,KAAK,GAAG,CAChD,CAAC;IACF,OAAO,MAAM,IAAI,IAAI,CAAC;AACxB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAY,EAAE,GAAa;IAC1D,OAAO,cAAc,CACnB,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EACrB;QACE,MAAM,EAAE;YACN,MAAM,EAAE,YAAY,CAAC,GAAG;YACxB,cAAc,EAAE,IAAI;YACpB,eAAe,EAAE,IAAI;YACrB,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC;SAChE;KACF,EACD,CAAC,CAAC,EAAE,EAAE,CAAE,CAAC,CAAC,OAAsB,CAAC,GAAG,KAAK,GAAG,CAC7C,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAY;IAEZ,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;QACzD,MAAM,EAAE,EAAE,MAAM,EAAE,YAAY,CAAC,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE;KACtF,CAAC,CAAC;IACH,OAAO,OAAwD,CAAC;AAClE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAgD;IAEhD,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE;QACvC,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,YAAY,CAAC,KAAK,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE;KACrE,CAAC,CAAC;IACH,OAAO,OAAsD,CAAC;AAChE,CAAC"}
+{"version":3,"file":"reads.js","sourceRoot":"","sources":["../../src/stack/reads.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAejD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAgD,EAChD,KAAiB,EACjB,GAAG,GAAG,aAAa;IAEnB,MAAM,OAAO,GAAkB,EAAE,CAAC;IAClC,IAAI,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC1B,GAAG,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7C,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9B,IAAI,OAAO,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACzB,MAAM,IAAI,oBAAoB,CAC5B,kCAAkC,GAAG,wCAAwC,CAC9E,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,SAAS,CAAC;IACpC,CAAC,QAAQ,MAAM,EAAE;IACjB,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,0EAA0E;AAC1E,MAAM,aAAa,GAAG,MAAM,CAAC;AAE7B;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAgD,EAChD,KAAiB,EACjB,SAA8D,EAC9D,GAAG,GAAG,aAAa;IAEnB,IAAI,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC1B,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,GAAG,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7C,YAAY,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QACpC,IAAI,YAAY,GAAG,GAAG,EAAE,CAAC;YACvB,MAAM,IAAI,oBAAoB,CAC5B,mCAAmC,GAAG,wCAAwC,CAC/E,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,IAAI,MAAM,SAAS,CAAC,MAAM,CAAC;gBAAE,OAAO,MAAM,CAAC;QAC7C,CAAC;QACD,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,SAAS,CAAC;IACpC,CAAC,QAAQ,MAAM,EAAE;IACjB,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAgD,EAChD,GAAa,EACb,gBAAyB,EACzB,eAAwB;IAExB,MAAM,MAAM,GAAG,MAAM,cAAc,CACjC,GAAG,EACH;QACE,MAAM,EAAE;YACN,MAAM,EAAE,YAAY,CAAC,MAAM;YAC3B,cAAc,EAAE,IAAI;YACpB,GAAG,CAAC,eAAe,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;YACjD,GAAG,CAAC,gBAAgB,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC;SAC9C;KACF,EACD,CAAC,CAAC,EAAE,EAAE,CAAE,CAAC,CAAC,OAAyB,CAAC,GAAG,KAAK,GAAG,CAChD,CAAC;IACF,OAAO,MAAM,IAAI,IAAI,CAAC;AACxB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAY,EAAE,GAAa;IAC1D,OAAO,cAAc,CACnB,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EACrB;QACE,MAAM,EAAE;YACN,MAAM,EAAE,YAAY,CAAC,GAAG;YACxB,cAAc,EAAE,IAAI;YACpB,eAAe,EAAE,IAAI;YACrB,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC;SAChE;KACF,EACD,CAAC,CAAC,EAAE,EAAE,CAAE,CAAC,CAAC,OAAsB,CAAC,GAAG,KAAK,GAAG,CAC7C,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAY;IAEZ,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;QACzD,MAAM,EAAE,EAAE,MAAM,EAAE,YAAY,CAAC,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE;KACtF,CAAC,CAAC;IACH,OAAO,OAAwD,CAAC;AAClE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAgD;IAEhD,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE;QACvC,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,YAAY,CAAC,KAAK,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE;KACrE,CAAC,CAAC;IACH,OAAO,OAAsD,CAAC;AAChE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAgD,EAChD,QAAkB;IAElB,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE;QACtC,MAAM,EAAE;YACN,MAAM,EAAE,YAAY,CAAC,KAAK;YAC1B,SAAS,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE;YACnD,eAAe,EAAE,IAAI;SACtB;KACF,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC7C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,yBAAyB,CAAC,KAAK,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QACrE,IAAI,IAAI;YAAE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}