@haverstack/core 0.42.0 → 0.44.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (185) hide show
  1. package/README.md +6 -9
  2. package/dist/access.d.ts +36 -34
  3. package/dist/access.d.ts.map +1 -1
  4. package/dist/access.js +51 -100
  5. package/dist/access.js.map +1 -1
  6. package/dist/adapter/combine.d.ts.map +1 -1
  7. package/dist/adapter/combine.js +14 -7
  8. package/dist/adapter/combine.js.map +1 -1
  9. package/dist/adapter/copy.d.ts +27 -0
  10. package/dist/adapter/copy.d.ts.map +1 -0
  11. package/dist/adapter/copy.js +105 -0
  12. package/dist/adapter/copy.js.map +1 -0
  13. package/dist/adapter/index.d.ts +9 -4
  14. package/dist/adapter/index.d.ts.map +1 -1
  15. package/dist/adapter/index.js +6 -3
  16. package/dist/adapter/index.js.map +1 -1
  17. package/dist/adapter/reach.d.ts +14 -0
  18. package/dist/adapter/reach.d.ts.map +1 -0
  19. package/dist/adapter/reach.js +31 -0
  20. package/dist/adapter/reach.js.map +1 -0
  21. package/dist/adapter/seed.d.ts +13 -0
  22. package/dist/adapter/seed.d.ts.map +1 -0
  23. package/dist/adapter/seed.js +26 -0
  24. package/dist/adapter/seed.js.map +1 -0
  25. package/dist/associations/identity.d.ts +18 -42
  26. package/dist/associations/identity.d.ts.map +1 -1
  27. package/dist/associations/identity.js +60 -84
  28. package/dist/associations/identity.js.map +1 -1
  29. package/dist/associations/validation.d.ts +1 -8
  30. package/dist/associations/validation.d.ts.map +1 -1
  31. package/dist/associations/validation.js +3 -30
  32. package/dist/associations/validation.js.map +1 -1
  33. package/dist/collection.d.ts +7 -11
  34. package/dist/collection.d.ts.map +1 -1
  35. package/dist/collection.js +24 -34
  36. package/dist/collection.js.map +1 -1
  37. package/dist/content-match.d.ts +2 -2
  38. package/dist/content-match.js +2 -2
  39. package/dist/errors.d.ts +41 -12
  40. package/dist/errors.d.ts.map +1 -1
  41. package/dist/errors.js +56 -15
  42. package/dist/errors.js.map +1 -1
  43. package/dist/grants.d.ts +18 -6
  44. package/dist/grants.d.ts.map +1 -1
  45. package/dist/grants.js +48 -37
  46. package/dist/grants.js.map +1 -1
  47. package/dist/hash.d.ts +8 -0
  48. package/dist/hash.d.ts.map +1 -0
  49. package/dist/hash.js +14 -0
  50. package/dist/hash.js.map +1 -0
  51. package/dist/index.d.ts +6 -6
  52. package/dist/index.d.ts.map +1 -1
  53. package/dist/index.js +2 -2
  54. package/dist/index.js.map +1 -1
  55. package/dist/install.d.ts +29 -5
  56. package/dist/install.d.ts.map +1 -1
  57. package/dist/install.js +69 -44
  58. package/dist/install.js.map +1 -1
  59. package/dist/lazy.d.ts +13 -0
  60. package/dist/lazy.d.ts.map +1 -0
  61. package/dist/lazy.js +27 -0
  62. package/dist/lazy.js.map +1 -0
  63. package/dist/merge.d.ts +1 -1
  64. package/dist/merge.js +1 -1
  65. package/dist/query-validation.d.ts +41 -28
  66. package/dist/query-validation.d.ts.map +1 -1
  67. package/dist/query-validation.js +85 -71
  68. package/dist/query-validation.js.map +1 -1
  69. package/dist/record-changes.d.ts +12 -36
  70. package/dist/record-changes.d.ts.map +1 -1
  71. package/dist/record-changes.js +9 -98
  72. package/dist/record-changes.js.map +1 -1
  73. package/dist/schema.d.ts.map +1 -1
  74. package/dist/schema.js +2 -5
  75. package/dist/schema.js.map +1 -1
  76. package/dist/scoped-stack/authority-snapshot.d.ts +37 -0
  77. package/dist/scoped-stack/authority-snapshot.d.ts.map +1 -0
  78. package/dist/scoped-stack/authority-snapshot.js +49 -0
  79. package/dist/scoped-stack/authority-snapshot.js.map +1 -0
  80. package/dist/scoped-stack/authority.d.ts +69 -51
  81. package/dist/scoped-stack/authority.d.ts.map +1 -1
  82. package/dist/scoped-stack/authority.js +189 -153
  83. package/dist/scoped-stack/authority.js.map +1 -1
  84. package/dist/scoped-stack/family-policy.d.ts +59 -0
  85. package/dist/scoped-stack/family-policy.d.ts.map +1 -0
  86. package/dist/scoped-stack/family-policy.js +68 -0
  87. package/dist/scoped-stack/family-policy.js.map +1 -0
  88. package/dist/scoped-stack/scoped-stack.d.ts +73 -86
  89. package/dist/scoped-stack/scoped-stack.d.ts.map +1 -1
  90. package/dist/scoped-stack/scoped-stack.js +279 -337
  91. package/dist/scoped-stack/scoped-stack.js.map +1 -1
  92. package/dist/scoped-stack/subscription.d.ts +14 -33
  93. package/dist/scoped-stack/subscription.d.ts.map +1 -1
  94. package/dist/scoped-stack/subscription.js +16 -57
  95. package/dist/scoped-stack/subscription.js.map +1 -1
  96. package/dist/stack/arguments.d.ts +27 -0
  97. package/dist/stack/arguments.d.ts.map +1 -0
  98. package/dist/stack/arguments.js +53 -0
  99. package/dist/stack/arguments.js.map +1 -0
  100. package/dist/stack/attachments.d.ts +1 -1
  101. package/dist/stack/attachments.js +1 -1
  102. package/dist/stack/changes.d.ts +4 -10
  103. package/dist/stack/changes.d.ts.map +1 -1
  104. package/dist/stack/changes.js +8 -8
  105. package/dist/stack/changes.js.map +1 -1
  106. package/dist/stack/client.d.ts +34 -58
  107. package/dist/stack/client.d.ts.map +1 -1
  108. package/dist/stack/field-rules.d.ts +27 -0
  109. package/dist/stack/field-rules.d.ts.map +1 -0
  110. package/dist/stack/field-rules.js +50 -0
  111. package/dist/stack/field-rules.js.map +1 -0
  112. package/dist/stack/install-app.d.ts +2 -2
  113. package/dist/stack/install-app.d.ts.map +1 -1
  114. package/dist/stack/install-app.js +16 -14
  115. package/dist/stack/install-app.js.map +1 -1
  116. package/dist/stack/integrity.d.ts +9 -53
  117. package/dist/stack/integrity.d.ts.map +1 -1
  118. package/dist/stack/integrity.js +47 -107
  119. package/dist/stack/integrity.js.map +1 -1
  120. package/dist/stack/limits.d.ts +1 -1
  121. package/dist/stack/limits.js +1 -1
  122. package/dist/stack/reads.d.ts +9 -5
  123. package/dist/stack/reads.d.ts.map +1 -1
  124. package/dist/stack/reads.js +24 -4
  125. package/dist/stack/reads.js.map +1 -1
  126. package/dist/stack/stack.d.ts +84 -79
  127. package/dist/stack/stack.d.ts.map +1 -1
  128. package/dist/stack/stack.js +236 -306
  129. package/dist/stack/stack.js.map +1 -1
  130. package/dist/stack/system-types.d.ts.map +1 -1
  131. package/dist/stack/system-types.js +1 -3
  132. package/dist/stack/system-types.js.map +1 -1
  133. package/dist/stack/type-grants.d.ts.map +1 -1
  134. package/dist/stack/type-grants.js +9 -6
  135. package/dist/stack/type-grants.js.map +1 -1
  136. package/dist/stack/write-expectation.d.ts +13 -12
  137. package/dist/stack/write-expectation.d.ts.map +1 -1
  138. package/dist/stack/write-expectation.js.map +1 -1
  139. package/dist/stack/write-gate.d.ts +23 -0
  140. package/dist/stack/write-gate.d.ts.map +1 -0
  141. package/dist/stack/write-gate.js +17 -0
  142. package/dist/stack/write-gate.js.map +1 -0
  143. package/dist/testing.d.ts +37 -24
  144. package/dist/testing.d.ts.map +1 -1
  145. package/dist/testing.js +176 -153
  146. package/dist/testing.js.map +1 -1
  147. package/dist/types/adapter.d.ts +115 -43
  148. package/dist/types/adapter.d.ts.map +1 -1
  149. package/dist/types/associations.d.ts +1 -17
  150. package/dist/types/associations.d.ts.map +1 -1
  151. package/dist/types/associations.js +1 -8
  152. package/dist/types/associations.js.map +1 -1
  153. package/dist/types/capabilities.d.ts +8 -8
  154. package/dist/types/capabilities.d.ts.map +1 -1
  155. package/dist/types/events.d.ts +3 -8
  156. package/dist/types/events.d.ts.map +1 -1
  157. package/dist/types/query.d.ts +4 -4
  158. package/dist/types/system.d.ts +2 -8
  159. package/dist/types/system.d.ts.map +1 -1
  160. package/dist/types/system.js.map +1 -1
  161. package/dist/validate.d.ts +2 -0
  162. package/dist/validate.d.ts.map +1 -1
  163. package/dist/validate.js +2 -1
  164. package/dist/validate.js.map +1 -1
  165. package/dist/wire/body.d.ts +32 -9
  166. package/dist/wire/body.d.ts.map +1 -1
  167. package/dist/wire/body.js +69 -8
  168. package/dist/wire/body.js.map +1 -1
  169. package/dist/wire/index.d.ts +4 -4
  170. package/dist/wire/index.d.ts.map +1 -1
  171. package/dist/wire/index.js +3 -3
  172. package/dist/wire/index.js.map +1 -1
  173. package/dist/wire/record.d.ts +1 -8
  174. package/dist/wire/record.d.ts.map +1 -1
  175. package/dist/wire/record.js +0 -48
  176. package/dist/wire/record.js.map +1 -1
  177. package/dist/wire/request.d.ts +18 -18
  178. package/dist/wire/request.d.ts.map +1 -1
  179. package/dist/wire/request.js +41 -36
  180. package/dist/wire/request.js.map +1 -1
  181. package/package.json +1 -1
  182. package/dist/stack/identity-bindings.d.ts +0 -13
  183. package/dist/stack/identity-bindings.d.ts.map +0 -1
  184. package/dist/stack/identity-bindings.js +0 -36
  185. package/dist/stack/identity-bindings.js.map +0 -1
@@ -0,0 +1,68 @@
1
+ /**
2
+ * System family policies
3
+ * -------------------------------------------------------
4
+ * The rules a system family holds a scoped writer to on top of the
5
+ * ordinary gates: who may write its Records at all, which content values
6
+ * are the owner's alone to set, and what a create must already be able to
7
+ * reach. One entry per family, read by every verb through the questions
8
+ * below, so a rule reaches each verb that writes what it governs — create,
9
+ * patchContent(), restoreVersion() and commitMigration() alike — rather
10
+ * than only the ones that remembered to ask it.
11
+ *
12
+ * A family with no entry is ordinary. Grants on a family are refused
13
+ * separately, at the write and at evaluation (UNGRANTABLE_SYSTEM_TYPES in
14
+ * grants.ts), since a grant is not a scoped write.
15
+ *
16
+ * See docs/spec/access-control.md § Per-verb gates.
17
+ */
18
+ import { baseIdOf } from '../schema.js';
19
+ import { bindingFieldsOf } from '../stack/field-rules.js';
20
+ import { SYSTEM_TYPES } from '../types/index.js';
21
+ const ORDINARY = { writers: 'ordinary' };
22
+ const POLICIES = new Map([
23
+ // Authority itself: see docs/spec/access-control.md § What a grant covers.
24
+ [SYSTEM_TYPES.GRANT, { writers: 'owner-alone' }],
25
+ [SYSTEM_TYPES.INSTALL, { writers: 'owner-alone' }],
26
+ // Managed, not merely written: see docs/spec/identity.md § Group.
27
+ [SYSTEM_TYPES.GROUP, { writers: 'group-managers', rosterAssociations: true }],
28
+ // See docs/spec/identity.md § DID bindings.
29
+ [
30
+ SYSTEM_TYPES.APP,
31
+ {
32
+ writers: 'ordinary',
33
+ ownerFields: {
34
+ fields: bindingFieldsOf(SYSTEM_TYPES.APP),
35
+ when: 'any',
36
+ message: 'Only the stack owner may set an _app record’s did or appId',
37
+ },
38
+ },
39
+ ],
40
+ [
41
+ SYSTEM_TYPES.ENTITY,
42
+ {
43
+ writers: 'ordinary',
44
+ ownerFields: {
45
+ fields: ['did'],
46
+ when: 'owner-did',
47
+ message: 'Only the stack owner may claim the owner’s own did',
48
+ },
49
+ },
50
+ ],
51
+ [SYSTEM_TYPES.ATTACHMENT, { writers: 'ordinary', createNamesFile: 'fileId' }],
52
+ ]);
53
+ /** The policy a Record of `typeId` is held to. */
54
+ export const familyPolicy = (typeId) => POLICIES.get(baseIdOf(typeId)) ?? ORDINARY;
55
+ /**
56
+ * The refusal a write owes when it moves content only the owner acting
57
+ * alone may set, or null when it moves none. Compared value-wise between
58
+ * `before` (absent at create) and `after`, so re-sending a value a Record
59
+ * already holds claims nothing.
60
+ */
61
+ export const ownerFieldRefusal = (typeId, before, after, ownerEntityId) => {
62
+ const rule = familyPolicy(typeId).ownerFields;
63
+ if (!rule)
64
+ return null;
65
+ const moved = rule.fields.some((field) => after[field] !== before?.[field] && (rule.when === 'any' || after[field] === ownerEntityId));
66
+ return moved ? rule.message : null;
67
+ };
68
+ //# sourceMappingURL=family-policy.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"family-policy.js","sourceRoot":"","sources":["../../src/scoped-stack/family-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AA+BjD,MAAM,QAAQ,GAAiB,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AAEvD,MAAM,QAAQ,GAAsC,IAAI,GAAG,CAAuB;IAChF,2EAA2E;IAC3E,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;IAChD,CAAC,YAAY,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;IAClD,kEAAkE;IAClE,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC;IAC7E,4CAA4C;IAC5C;QACE,YAAY,CAAC,GAAG;QAChB;YACE,OAAO,EAAE,UAAU;YACnB,WAAW,EAAE;gBACX,MAAM,EAAE,eAAe,CAAC,YAAY,CAAC,GAAG,CAAC;gBACzC,IAAI,EAAE,KAAK;gBACX,OAAO,EAAE,4DAA4D;aACtE;SACF;KACF;IACD;QACE,YAAY,CAAC,MAAM;QACnB;YACE,OAAO,EAAE,UAAU;YACnB,WAAW,EAAE;gBACX,MAAM,EAAE,CAAC,KAAK,CAAC;gBACf,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,oDAAoD;aAC9D;SACF;KACF;IACD,CAAC,YAAY,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC;CAC9E,CAAC,CAAC;AAEH,kDAAkD;AAClD,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAc,EAAgB,EAAE,CAC3D,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,QAAQ,CAAC;AAE7C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,MAAc,EACd,MAA2C,EAC3C,KAA8B,EAC9B,aAAuB,EACR,EAAE;IACjB,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC;IAC9C,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAC5B,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,KAAK,CAAC,KAAK,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,aAAa,CAAC,CAC9F,CAAC;IACF,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AACrC,CAAC,CAAC"}
@@ -20,19 +20,20 @@
20
20
  * refusals.
21
21
  *
22
22
  * Also holds the feed side of the same rule: a subscription's deliveries
23
- * run through the same canRead() a get() answers with, so a feed can never
24
- * disagree with a read about what a session sees.
23
+ * ask the same read reach a get() does, so a feed can never disagree with
24
+ * a read about what a session sees.
25
25
  *
26
26
  * See docs/spec/access-control.md and docs/spec/events.md § Permission scoping.
27
27
  */
28
28
  import { ChangeEmitter } from '../stack/changes.js';
29
- import type { PutAttachmentOptions, AssociationEdit, AttachmentContent, AuthorityAssociation, DataAssociation, EntityId, FileId, QueryResult, RecordChange, RecordId, RecordVersion, RecordJournalEntry, JournalQuery, VersionsQuery, StackAdapter, StackCapabilities, IfVersionOptions, StackQuery, StackRecord, SubscribeOptions, TypeId, Unsubscribe, RecordChangeSet } from '../types/index.js';
29
+ import type { PutAttachmentOptions, AssociationEdit, AttachmentContent, AuthorityAssociation, DataAssociation, EntityId, FileId, QueryResult, Reach, RecordChange, RecordId, RecordVersion, RecordJournalEntry, JournalQuery, VersionsQuery, StackAdapter, StackCapabilities, IfVersionOptions, StackQuery, StackRecord, SubscribeOptions, TypeId, Unsubscribe } from '../types/index.js';
30
+ import type { SplitQuery } from '../query-validation.js';
30
31
  import type { ExpectationOptions } from '../stack/write-expectation.js';
31
32
  import type { ContentOf, ReadonlyTypeSchema, TypeHandle } from '../type-handle.js';
32
33
  import type { Collection } from '../collection.js';
33
34
  import type { MigrationRegistry } from '../stack/migrations.js';
34
35
  import type { Stack } from '../stack/stack.js';
35
- import type { BackdatableCreateRecordOptions, CollectAttachmentGarbageOptions, CollectAttachmentGarbageResult, DeleteAndReturnResult, DeleteRecordOptions, DeleteResult, GetRecordOptions, StackClient } from '../stack/client.js';
36
+ import type { BackdatableCreateRecordOptions, CollectAttachmentGarbageOptions, CollectAttachmentGarbageResult, DeleteRecordOptions, DeleteResult, GetRecordOptions, StackClient } from '../stack/client.js';
36
37
  /**
37
38
  * Held by Stack alone: the index re-exports ScopedStack but not this, so
38
39
  * asEntity()/asActor() stay the only way to one, and the actor
@@ -54,10 +55,10 @@ export type ScopedStackInit = {
54
55
  /** The stack's own unfiltered stream, which subscribe() narrows. */
55
56
  changes: ChangeEmitter;
56
57
  assertOpen: () => void;
57
- /** Whether changes reach the stack from elsewhere — see subscribe(). */
58
- relaysChanges: boolean;
59
58
  /** The app's migrations, which collection() migrates records through. */
60
59
  migrations: MigrationRegistry;
60
+ /** Stack.query() within a reach over type families — see query(). */
61
+ queryReadable: (split: SplitQuery, reach: Reach) => Promise<QueryResult>;
61
62
  };
62
63
  /**
63
64
  * A permission-enforcing view of a Stack for one (principal, subject) pair,
@@ -72,8 +73,8 @@ export declare class ScopedStack implements StackClient {
72
73
  private readonly adapter;
73
74
  private readonly changes;
74
75
  private readonly assertStackOpen;
75
- private readonly relaysChanges;
76
76
  private readonly migrations;
77
+ private readonly queryReadable;
77
78
  /** Not callable from outside the package — see ScopedStackInit. */
78
79
  constructor(token: typeof scopeToken, init: ScopedStackInit);
79
80
  collection<S extends ReadonlyTypeSchema>(handle: TypeHandle<S>): Collection<ContentOf<S>>;
@@ -89,7 +90,7 @@ export declare class ScopedStack implements StackClient {
89
90
  get subjectId(): EntityId | null;
90
91
  get capabilities(): StackCapabilities;
91
92
  private get actor();
92
- /** Refuse a create this request holds no grant for — see ScopeAuthority.checkCreateGrant(). */
93
+ /** Refuse a create outside this request's reach — see ScopeAuthority.canCreate(). */
93
94
  private requireCreateGrant;
94
95
  /** Refuse anything but the owner acting as itself — see ScopeAuthority.ownerActingAlone. */
95
96
  private requireOwnerActingAlone;
@@ -108,6 +109,8 @@ export declare class ScopedStack implements StackClient {
108
109
  * See docs/spec/access-control.md § Delegation: principal and subject.
109
110
  */
110
111
  private requireVerb;
112
+ /** requireVerb()'s gate, asked of a record already found in its family. */
113
+ private gateVerb;
111
114
  /**
112
115
  * Fetch a record the subject can reach and the principal holds `delete` on
113
116
  * (via permissions or a delete grant), or throw.
@@ -146,96 +149,95 @@ export declare class ScopedStack implements StackClient {
146
149
  */
147
150
  get(id: RecordId, opts?: GetRecordOptions): Promise<StackRecord | null>;
148
151
  /**
149
- * Runs through this.query(), so canRead() still applies — this answers a
150
- * question the caller asks on its own behalf. includeUnlisted is passed
151
- * only when the request is the owner acting alone, per
152
+ * Runs through this.query(), so the read reach still applies — this
153
+ * answers a question the caller asks on its own behalf. includeUnlisted
154
+ * is passed only when the request is the owner acting alone, per
152
155
  * docs/spec/identity.md § DID bindings.
153
156
  */
154
157
  getEntityByDid(did: EntityId): Promise<StackRecord | null>;
155
158
  getOwnerEntity(): Promise<StackRecord | null>;
156
159
  /**
157
- * Query records, filtered to those this request can read. Pages are
158
- * filtered then refilled, so a page may slightly overshoot `limit` but
159
- * never skips a record. Grants are prefetched once, cursor-walked to
160
- * exhaustion.
160
+ * Query records, among those this request can read: the adapter matches
161
+ * the request's read reach as one more condition of the query, so a page,
162
+ * its cursor and whether one comes back are decided among readable
163
+ * Records alone. See docs/spec/disclosure.md § What a query reveals.
161
164
  */
162
165
  query(query?: StackQuery): Promise<QueryResult>;
163
166
  /**
164
- * Apply a change set on behalf of the subject. Each key is gated against
165
- * the record as it stands, never as the set would leave it, and one
166
- * refused key refuses the call. See docs/spec/access-control.md
167
- * § Composing a change set.
167
+ * Patch content on behalf of the subject, on the write gate, plus the
168
+ * gates a content value can carry: a card's binding fields and the files
169
+ * a `file-ref` field names. See docs/spec/access-control.md § Per-verb gates.
168
170
  */
169
- mutate(id: RecordId, changes: RecordChangeSet, opts?: IfVersionOptions & ExpectationOptions): Promise<StackRecord>;
170
171
  patchContent(id: RecordId, patch: Record<string, unknown | null>, opts?: IfVersionOptions & ExpectationOptions): Promise<StackRecord>;
171
172
  /**
172
- * The record, having established that this request may decide who else
173
- * reaches it — the owner-or-creator rule, asked of both sides of a
174
- * delegation, or a Group's admin rule for a `_group`. The gate the
175
- * `permissions` and `unlisted` keys carry, which the write bit
176
- * deliberately does not confer.
173
+ * The write gate, plus read access to the destination: a container is a
174
+ * reference the requester has to be allowed to create.
177
175
  */
178
- private requireReshareable;
176
+ setParent(id: RecordId, parentId: RecordId | null, opts?: IfVersionOptions & ExpectationOptions): Promise<StackRecord>;
179
177
  /**
180
- * Whether a change set's `permissions` key moves the ACL, read off the
181
- * computed delta so a replacement that drops everything — naming nothing
182
- * — still counts. See docs/spec/access-control.md § Record-level permissions.
178
+ * Listing decides who can enumerate a record, so it carries the reshare
179
+ * gate rather than the write bit. See docs/spec/unlisted.md.
183
180
  */
184
- private permissionsMove;
185
- /** The reshare decision alone, for a record already read and write-gated. */
186
- private requireReshareOf;
181
+ setUnlisted(id: RecordId, unlisted: boolean, opts?: IfVersionOptions & ExpectationOptions): Promise<StackRecord>;
187
182
  /**
188
- * An `_app` card's `did` and `appId` are the owner's alone to set, or
189
- * record-level `write` would be a second way to name the software behind
190
- * a key. `_entity` cards stay writable by grant, as a contacts app needs.
191
- * See docs/spec/identity.md § DID bindings.
183
+ * The write gate, plus the reference gate on each add new to the record:
184
+ * a remove, or an add of an identity already held, names a reference the
185
+ * record carries, so it is gated by the write bit alone.
192
186
  */
193
- private requireOwnerForAppIdentity;
187
+ editAssociations(id: RecordId, edits: AssociationEdit[], opts?: IfVersionOptions & ExpectationOptions): Promise<StackRecord>;
188
+ /** editAssociations()'s gates, with every element new to the set an add. */
189
+ setAssociations(id: RecordId, associations: DataAssociation[], opts?: IfVersionOptions & ExpectationOptions): Promise<StackRecord>;
194
190
  /**
195
- * A delegated write's `appId` must match the `_app` card the owner
196
- * registered for the principal's DID, if there is one: a verified
197
- * principal may not claim a name the owner gave other software.
198
- * See docs/spec/identity.md § Attribution and what can be trusted.
191
+ * The write gate, then the reference gate over the elements a write adds,
192
+ * asked against the stored set so an association the record already
193
+ * carries is not re-gated. `Stack` asks it of each read it writes from,
194
+ * so a retried write is gated on the set it lands on.
199
195
  */
200
- private requireAppIdMatchesPrincipal;
196
+ private gateAssociationWrite;
201
197
  /**
202
- * The owner's own DID is the one `_entity` binding a grantee may not
203
- * claim: `ownerProfile` adopts whichever card holds it.
204
- * See docs/spec/identity.md § DID bindings.
198
+ * Extend or withdraw who reaches a record, on the reshare gate. The write
199
+ * bit does not confer it, or a write-holder could decide who else reaches
200
+ * the record. See docs/spec/access-control.md § Record-level permissions.
205
201
  */
206
- private requireOwnerForOwnerDid;
202
+ editAccess(id: RecordId, edits: AssociationEdit[], opts?: IfVersionOptions & ExpectationOptions): Promise<StackRecord>;
203
+ /** See editAccess() — the same gate. */
204
+ setAccess(id: RecordId, permissions: AuthorityAssociation[], opts?: IfVersionOptions & ExpectationOptions): Promise<StackRecord>;
207
205
  /**
208
- * `_grant` and `_install` Records are authority, so only the owner acting
209
- * alone may write one; reading them stays on the ordinary gate.
210
- * See docs/spec/access-control.md § What a grant covers.
206
+ * The record, having established that this request may decide who else
207
+ * reaches it — the owner-or-creator rule, asked of both sides of a
208
+ * delegation, or a Group's admin rule for a `_group`. The gate the access
209
+ * and listing verbs carry, which the write bit deliberately does not confer.
211
210
  */
212
- private requireOwnerForGrantRecord;
211
+ private requireReshareable;
213
212
  /**
214
- * Gated on the write bit alone, which is why the list is held to its
215
- * rules first: authority reached through this verb would be exactly the
216
- * escalation the partition exists to stop, decided before any record is
217
- * read so it cannot depend on who is asking.
213
+ * Authority a create writes — a Group's roster, the Record's permissions
214
+ * and listing — gated as a later write of it would be, asked of the
215
+ * Record the create would make. That Record carries none of the authority
216
+ * being written, so no call can satisfy its own gate.
217
+ * See docs/spec/access-control.md § Write implies read.
218
218
  */
219
- associate(id: RecordId, associations: DataAssociation[], opts?: ExpectationOptions): Promise<StackRecord>;
220
- /** See associate() — the same write gate, the same kind refusal. */
221
- dissociate(id: RecordId, associations: DataAssociation[], opts?: ExpectationOptions): Promise<StackRecord>;
219
+ private requireAuthorityAtCreate;
220
+ /** requireReshareable()'s gate, asked of a record already found in its family. */
221
+ private gateReshare;
222
222
  /**
223
- * The write gate, plus the per-element reference gate on each add: what a
224
- * remove names is already on the record, so it is gated by the write bit
225
- * alone. See associate().
223
+ * Refuse a write moving content its family reserves to the owner acting
224
+ * alone — an `_app` card's bindings, the owner's own DID on an `_entity`
225
+ * — whichever verb carries it. See docs/spec/identity.md § DID bindings.
226
226
  */
227
- amendAssociations(id: RecordId, changes: AssociationEdit[], opts?: ExpectationOptions, surface?: string): Promise<StackRecord>;
227
+ private requireOwnerFields;
228
228
  /**
229
- * Extend who reaches a record, on the reshare gate the `permissions` key
230
- * carries. The write bit does not confer it, or a write-holder could
231
- * decide who else reaches the record.
232
- * See docs/spec/access-control.md § Record-level permissions.
229
+ * A delegated write's `appId` must match the `_app` card the owner
230
+ * registered for the principal's DID, if there is one: a verified
231
+ * principal may not claim a name the owner gave other software.
232
+ * See docs/spec/identity.md § Attribution and what can be trusted.
233
233
  */
234
- grantAccess(id: RecordId, permissions: AuthorityAssociation[], opts?: ExpectationOptions): Promise<StackRecord>;
235
- /** Withdraw elements of who reaches a record — see grantAccess(). */
236
- revokeAccess(id: RecordId, permissions: AuthorityAssociation[], opts?: ExpectationOptions): Promise<StackRecord>;
237
- /** The reshare gate over an edit list — see grantAccess(). */
238
- amendAccess(id: RecordId, changes: AssociationEdit[], opts?: ExpectationOptions, surface?: string): Promise<StackRecord>;
234
+ private requireAppIdMatchesPrincipal;
235
+ /**
236
+ * Refuse a write its family fences off — see
237
+ * ScopeAuthority.passesWriterFence() — with the refusal an unreadable
238
+ * Record answers with.
239
+ */
240
+ private requireFamilyWriter;
239
241
  /**
240
242
  * Purge is owner-only: it is irreversible and destroys version
241
243
  * history, so neither the write bit nor delete-own/delete-any grants
@@ -243,14 +245,6 @@ export declare class ScopedStack implements StackClient {
243
245
  * limited to soft delete.
244
246
  */
245
247
  delete(id: RecordId, opts?: DeleteRecordOptions & ExpectationOptions): Promise<DeleteResult>;
246
- /**
247
- * delete(), plus the record it acted on. Gated identically — the
248
- * existence/visibility check that produces a 404 ahead of the 403
249
- * permission gate still runs via requireDeletable() before either kind
250
- * of delete, so this changes what a successful call reports, not the
251
- * disclosure ordering a refused one follows.
252
- */
253
- deleteAndReturn(id: RecordId, opts?: DeleteRecordOptions & ExpectationOptions): Promise<DeleteAndReturnResult>;
254
248
  /**
255
249
  * Reverse a soft delete. Gated the same as delete() — undelete is the
256
250
  * inverse of soft delete, so granting one direction without the other
@@ -322,17 +316,10 @@ export declare class ScopedStack implements StackClient {
322
316
  collectAttachmentGarbage(opts?: CollectAttachmentGarbageOptions): Promise<CollectAttachmentGarbageResult>;
323
317
  /**
324
318
  * Observe the changes this request may read, decided per event by the
325
- * same canRead() that get() and query() use. An unreadable record yields
319
+ * same read reach that get() and query() ask. An unreadable record yields
326
320
  * no event at all, since a change's existence is itself a disclosure.
327
321
  * See docs/spec/events.md § Permission scoping.
328
322
  */
329
323
  subscribe(handler: (change: RecordChange) => void, opts?: SubscribeOptions): Promise<Unsubscribe>;
330
- /**
331
- * canRead for one event, through the subscription's own cache. Grants
332
- * are prefetched once and refilled after an invalidation rather than
333
- * re-queried per event, which would be a `_grant` scan for every change
334
- * the stack makes.
335
- */
336
- private canReadCached;
337
324
  }
338
325
  //# sourceMappingURL=scoped-stack.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"scoped-stack.d.ts","sourceRoot":"","sources":["../../src/scoped-stack/scoped-stack.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAIH,OAAO,EAAE,aAAa,EAAqB,MAAM,qBAAqB,CAAC;AAEvE,OAAO,KAAK,EAIV,oBAAoB,EAEpB,eAAe,EACf,iBAAiB,EACjB,oBAAoB,EACpB,eAAe,EACf,QAAQ,EACR,MAAM,EAGN,WAAW,EACX,YAAY,EACZ,QAAQ,EACR,aAAa,EACb,kBAAkB,EAClB,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,UAAU,EACV,WAAW,EACX,gBAAgB,EAChB,MAAM,EACN,WAAW,EACX,eAAe,EAChB,MAAM,mBAAmB,CAAC;AA6B3B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAcxE,OAAO,KAAK,EAAE,SAAS,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEnF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAIhE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAI/C,OAAO,KAAK,EACV,8BAA8B,EAC9B,+BAA+B,EAC/B,8BAA8B,EAC9B,qBAAqB,EACrB,mBAAmB,EACnB,YAAY,EACZ,gBAAgB,EAChB,WAAW,EACZ,MAAM,oBAAoB,CAAC;AAE5B;;;;GAIG;AACH,eAAO,MAAM,UAAU,EAAE,OAAO,MAA8B,CAAC;AAE/D,sEAAsE;AACtE,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,EAAE,KAAK,CAAC;IACb,WAAW,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC3B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC;;;;OAIG;IACH,OAAO,EAAE,YAAY,CAAC;IACtB,oEAAoE;IACpE,OAAO,EAAE,aAAa,CAAC;IACvB,UAAU,EAAE,MAAM,IAAI,CAAC;IACvB,wEAAwE;IACxE,aAAa,EAAE,OAAO,CAAC;IACvB,yEAAyE;IACzE,UAAU,EAAE,iBAAiB,CAAC;CAC/B,CAAC;AAEF;;;;;GAKG;AACH,qBAAa,WAAY,YAAW,WAAW;;IAE7C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAC9B,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAgB;IAClD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAe;IACvC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgB;IACxC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAa;IAC7C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAU;IACxC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAoB;IAE/C,mEAAmE;gBACvD,KAAK,EAAE,OAAO,UAAU,EAAE,IAAI,EAAE,eAAe;IAc3D,UAAU,CAAC,CAAC,SAAS,kBAAkB,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAKzF;;;OAGG;IACH,IAAI,WAAW,IAAI,QAAQ,GAAG,IAAI,CAEjC;IAED;;;OAGG;IACH,IAAI,SAAS,IAAI,QAAQ,GAAG,IAAI,CAE/B;IAED,IAAI,YAAY,IAAI,iBAAiB,CAEpC;IAED,OAAO,KAAK,KAAK,GAKhB;IAED,+FAA+F;YACjF,kBAAkB;IAMhC,4FAA4F;IAC5F,OAAO,CAAC,uBAAuB;IAI/B;;;;;OAKG;YACW,gBAAgB;IAY9B;;;;;;OAMG;YACW,WAAW;IAqCzB;;;OAGG;IACH,OAAO,CAAC,gBAAgB;IAMxB;;;;;;OAMG;YACW,oBAAoB;IAelC;;;;;;OAMG;YACW,wBAAwB;IAsBtC;;;;;OAKG;IACG,MAAM,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACtE,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,CAAC,EACV,IAAI,GAAE,8BAAmC,GACxC,OAAO,CAAC,WAAW,GAAG;QAAE,OAAO,EAAE,CAAC,CAAA;KAAE,CAAC;IAiExC;;;;;OAKG;IACG,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAOjF;;;;;OAKG;IACG,cAAc,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAS1D,cAAc,IAAI,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAInD;;;;;OAKG;IACG,KAAK,CAAC,KAAK,GAAE,UAAe,GAAG,OAAO,CAAC,WAAW,CAAC;IAsCzD;;;;;OAKG;IACG,MAAM,CACV,EAAE,EAAE,QAAQ,EACZ,OAAO,EAAE,eAAe,EACxB,IAAI,GAAE,gBAAgB,GAAG,kBAAuB,GAC/C,OAAO,CAAC,WAAW,CAAC;IA0FjB,YAAY,CAChB,EAAE,EAAE,QAAQ,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC,EACrC,IAAI,CAAC,EAAE,gBAAgB,GAAG,kBAAkB,GAC3C,OAAO,CAAC,WAAW,CAAC;IAIvB;;;;;;OAMG;YACW,kBAAkB;IAShC;;;;OAIG;IACH,OAAO,CAAC,eAAe;IAKvB,6EAA6E;YAC/D,gBAAgB;IAS9B;;;;;OAKG;IACH,OAAO,CAAC,0BAA0B;IASlC;;;;;OAKG;YACW,4BAA4B;IAW1C;;;;OAIG;IACH,OAAO,CAAC,uBAAuB;IAM/B;;;;OAIG;YACW,0BAA0B;IAUxC;;;;;OAKG;IACG,SAAS,CACb,EAAE,EAAE,QAAQ,EACZ,YAAY,EAAE,eAAe,EAAE,EAC/B,IAAI,GAAE,kBAAuB,GAC5B,OAAO,CAAC,WAAW,CAAC;IAKvB,oEAAoE;IAC9D,UAAU,CACd,EAAE,EAAE,QAAQ,EACZ,YAAY,EAAE,eAAe,EAAE,EAC/B,IAAI,GAAE,kBAAuB,GAC5B,OAAO,CAAC,WAAW,CAAC;IAKvB;;;;OAIG;IACG,iBAAiB,CACrB,EAAE,EAAE,QAAQ,EACZ,OAAO,EAAE,eAAe,EAAE,EAC1B,IAAI,GAAE,kBAAuB,EAC7B,OAAO,SAAwB,GAC9B,OAAO,CAAC,WAAW,CAAC;IAUvB;;;;;OAKG;IACG,WAAW,CACf,EAAE,EAAE,QAAQ,EACZ,WAAW,EAAE,oBAAoB,EAAE,EACnC,IAAI,GAAE,kBAAuB,GAC5B,OAAO,CAAC,WAAW,CAAC;IAKvB,qEAAqE;IAC/D,YAAY,CAChB,EAAE,EAAE,QAAQ,EACZ,WAAW,EAAE,oBAAoB,EAAE,EACnC,IAAI,GAAE,kBAAuB,GAC5B,OAAO,CAAC,WAAW,CAAC;IAKvB,8DAA8D;IACxD,WAAW,CACf,EAAE,EAAE,QAAQ,EACZ,OAAO,EAAE,eAAe,EAAE,EAC1B,IAAI,GAAE,kBAAuB,EAC7B,OAAO,SAAkB,GACxB,OAAO,CAAC,WAAW,CAAC;IAMvB;;;;;OAKG;IACG,MAAM,CACV,EAAE,EAAE,QAAQ,EACZ,IAAI,GAAE,mBAAmB,GAAG,kBAAuB,GAClD,OAAO,CAAC,YAAY,CAAC;IAKxB;;;;;;OAMG;IACG,eAAe,CACnB,EAAE,EAAE,QAAQ,EACZ,IAAI,GAAE,mBAAmB,GAAG,kBAAuB,GAClD,OAAO,CAAC,qBAAqB,CAAC;IAgBjC;;;;OAIG;IACG,QAAQ,CACZ,EAAE,EAAE,QAAQ,EACZ,IAAI,GAAE,gBAAgB,GAAG,kBAAuB,GAC/C,OAAO,CAAC,WAAW,CAAC;IAKvB;;;;;;OAMG;IACG,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,GAAE,aAAkB,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAKpF;;;;OAIG;IACG,UAAU,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,GAAE,YAAiB,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAMvF,wDAAwD;IAClD,UAAU,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAK9E;;;;;;OAMG;IACG,cAAc,CAClB,EAAE,EAAE,QAAQ,EACZ,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,gBAAgB,GAAG,kBAAuB,GAC/C,OAAO,CAAC,WAAW,CAAC;IAuBvB;;;;;OAKG;IACG,eAAe,CACnB,EAAE,EAAE,QAAQ,EACZ,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,WAAW,CAAC;IASvB;;;;;;OAMG;YACW,uBAAuB;IAcrC;;;;OAIG;IACG,aAAa,CACjB,IAAI,EAAE,UAAU,EAChB,IAAI,EAAE,oBAAoB,GACzB,OAAO,CAAC,WAAW,GAAG;QAAE,OAAO,EAAE,iBAAiB,CAAA;KAAE,CAAC;IAqBxD;;;;OAIG;IACG,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IASxD;;;OAGG;IACG,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKrD;;;OAGG;IACG,wBAAwB,CAC5B,IAAI,CAAC,EAAE,+BAA+B,GACrC,OAAO,CAAC,8BAA8B,CAAC;IAK1C;;;;;OAKG;IACG,SAAS,CACb,OAAO,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,IAAI,EACvC,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,WAAW,CAAC;IAqBvB;;;;;OAKG;YACW,aAAa;CAM5B"}
1
+ {"version":3,"file":"scoped-stack.d.ts","sourceRoot":"","sources":["../../src/scoped-stack/scoped-stack.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAKH,OAAO,EAAE,aAAa,EAAqB,MAAM,qBAAqB,CAAC;AAEvE,OAAO,KAAK,EAIV,oBAAoB,EAEpB,eAAe,EACf,iBAAiB,EACjB,oBAAoB,EACpB,eAAe,EACf,QAAQ,EACR,MAAM,EACN,WAAW,EACX,KAAK,EACL,YAAY,EACZ,QAAQ,EACR,aAAa,EACb,kBAAkB,EAClB,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,UAAU,EACV,WAAW,EACX,gBAAgB,EAChB,MAAM,EACN,WAAW,EACZ,MAAM,mBAAmB,CAAC;AAe3B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAMzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAMxE,OAAO,KAAK,EAAE,SAAS,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEnF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAUhE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAK/C,OAAO,KAAK,EACV,8BAA8B,EAC9B,+BAA+B,EAC/B,8BAA8B,EAC9B,mBAAmB,EACnB,YAAY,EACZ,gBAAgB,EAChB,WAAW,EACZ,MAAM,oBAAoB,CAAC;AAE5B;;;;GAIG;AACH,eAAO,MAAM,UAAU,EAAE,OAAO,MAA8B,CAAC;AAE/D,sEAAsE;AACtE,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,EAAE,KAAK,CAAC;IACb,WAAW,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC3B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC;;;;OAIG;IACH,OAAO,EAAE,YAAY,CAAC;IACtB,oEAAoE;IACpE,OAAO,EAAE,aAAa,CAAC;IACvB,UAAU,EAAE,MAAM,IAAI,CAAC;IACvB,yEAAyE;IACzE,UAAU,EAAE,iBAAiB,CAAC;IAC9B,qEAAqE;IACrE,aAAa,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;CAC1E,CAAC;AAEF;;;;;GAKG;AACH,qBAAa,WAAY,YAAW,WAAW;;IAE7C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAC9B,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAgB;IAClD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAe;IACvC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgB;IACxC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAa;IAC7C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAoB;IAC/C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAmC;IAEjE,mEAAmE;gBACvD,KAAK,EAAE,OAAO,UAAU,EAAE,IAAI,EAAE,eAAe;IAmB3D,UAAU,CAAC,CAAC,SAAS,kBAAkB,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAKzF;;;OAGG;IACH,IAAI,WAAW,IAAI,QAAQ,GAAG,IAAI,CAEjC;IAED;;;OAGG;IACH,IAAI,SAAS,IAAI,QAAQ,GAAG,IAAI,CAE/B;IAED,IAAI,YAAY,IAAI,iBAAiB,CAEpC;IAED,OAAO,KAAK,KAAK,GAKhB;IAED,qFAAqF;YACvE,kBAAkB;IAMhC,4FAA4F;IAC5F,OAAO,CAAC,uBAAuB;IAI/B;;;;;OAKG;YACW,gBAAgB;IAe9B;;;;;;OAMG;YACW,WAAW;IAezB,2EAA2E;YAC7D,QAAQ;IA0BtB;;;OAGG;IACH,OAAO,CAAC,gBAAgB;IAUxB;;;;;;OAMG;YACW,oBAAoB;IAgBlC;;;;;;OAMG;YACW,wBAAwB;IA0BtC;;;;;OAKG;IACG,MAAM,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACtE,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,CAAC,EACV,IAAI,GAAE,8BAAmC,GACxC,OAAO,CAAC,WAAW,GAAG;QAAE,OAAO,EAAE,CAAC,CAAA;KAAE,CAAC;IAgExC;;;;;OAKG;IACG,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAOjF;;;;;OAKG;IACG,cAAc,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAS1D,cAAc,IAAI,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAInD;;;;;OAKG;IACG,KAAK,CAAC,KAAK,GAAE,UAAe,GAAG,OAAO,CAAC,WAAW,CAAC;IAczD;;;;OAIG;IACG,YAAY,CAChB,EAAE,EAAE,QAAQ,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC,EACrC,IAAI,GAAE,gBAAgB,GAAG,kBAAuB,GAC/C,OAAO,CAAC,WAAW,CAAC;IA4BvB;;;OAGG;IACG,SAAS,CACb,EAAE,EAAE,QAAQ,EACZ,QAAQ,EAAE,QAAQ,GAAG,IAAI,EACzB,IAAI,GAAE,gBAAgB,GAAG,kBAAuB,GAC/C,OAAO,CAAC,WAAW,CAAC;IAgBvB;;;OAGG;IACG,WAAW,CACf,EAAE,EAAE,QAAQ,EACZ,QAAQ,EAAE,OAAO,EACjB,IAAI,GAAE,gBAAgB,GAAG,kBAAuB,GAC/C,OAAO,CAAC,WAAW,CAAC;IAMvB;;;;OAIG;IACG,gBAAgB,CACpB,EAAE,EAAE,QAAQ,EACZ,KAAK,EAAE,eAAe,EAAE,EACxB,IAAI,GAAE,gBAAgB,GAAG,kBAAuB,GAC/C,OAAO,CAAC,WAAW,CAAC;IAUvB,4EAA4E;IACtE,eAAe,CACnB,EAAE,EAAE,QAAQ,EACZ,YAAY,EAAE,eAAe,EAAE,EAC/B,IAAI,GAAE,gBAAgB,GAAG,kBAAuB,GAC/C,OAAO,CAAC,WAAW,CAAC;IAUvB;;;;;OAKG;YACW,oBAAoB;IAYlC;;;;OAIG;IACG,UAAU,CACd,EAAE,EAAE,QAAQ,EACZ,KAAK,EAAE,eAAe,EAAE,EACxB,IAAI,GAAE,gBAAgB,GAAG,kBAAuB,GAC/C,OAAO,CAAC,WAAW,CAAC;IAUvB,wCAAwC;IAClC,SAAS,CACb,EAAE,EAAE,QAAQ,EACZ,WAAW,EAAE,oBAAoB,EAAE,EACnC,IAAI,GAAE,gBAAgB,GAAG,kBAAuB,GAC/C,OAAO,CAAC,WAAW,CAAC;IAUvB;;;;;OAKG;YACW,kBAAkB;IAYhC;;;;;;OAMG;YACW,wBAAwB;IAwBtC,kFAAkF;YACpE,WAAW;IAWzB;;;;OAIG;IACH,OAAO,CAAC,kBAAkB;IAU1B;;;;;OAKG;YACW,4BAA4B;IAW1C;;;;OAIG;YACW,mBAAmB;IAYjC;;;;;OAKG;IACG,MAAM,CACV,EAAE,EAAE,QAAQ,EACZ,IAAI,GAAE,mBAAmB,GAAG,kBAAuB,GAClD,OAAO,CAAC,YAAY,CAAC;IAqBxB;;;;OAIG;IACG,QAAQ,CACZ,EAAE,EAAE,QAAQ,EACZ,IAAI,GAAE,gBAAgB,GAAG,kBAAuB,GAC/C,OAAO,CAAC,WAAW,CAAC;IAKvB;;;;;;OAMG;IACG,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,GAAE,aAAkB,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAKpF;;;;OAIG;IACG,UAAU,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,GAAE,YAAiB,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IASvF,wDAAwD;IAClD,UAAU,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAK9E;;;;;;OAMG;IACG,cAAc,CAClB,EAAE,EAAE,QAAQ,EACZ,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,gBAAgB,GAAG,kBAAuB,GAC/C,OAAO,CAAC,WAAW,CAAC;IAuBvB;;;;;OAKG;IACG,eAAe,CACnB,EAAE,EAAE,QAAQ,EACZ,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,WAAW,CAAC;IAavB;;;;;;OAMG;YACW,uBAAuB;IAmBrC;;;;OAIG;IACG,aAAa,CACjB,IAAI,EAAE,UAAU,EAChB,IAAI,EAAE,oBAAoB,GACzB,OAAO,CAAC,WAAW,GAAG;QAAE,OAAO,EAAE,iBAAiB,CAAA;KAAE,CAAC;IAqBxD;;;;OAIG;IACG,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IASxD;;;OAGG;IACG,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKrD;;;OAGG;IACG,wBAAwB,CAC5B,IAAI,CAAC,EAAE,+BAA+B,GACrC,OAAO,CAAC,8BAA8B,CAAC;IAK1C;;;;;OAKG;IACG,SAAS,CACb,OAAO,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,IAAI,EACvC,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,WAAW,CAAC;CAkBxB"}