@north-light/cli 0.3.548 → 0.3.550

package/docs/concepts/documents.md

@@ -33,7 +33,7 @@ An installed plugin is an app named after the plugin, and the documentation that
 
 ## Who may read
 
-Each document is `public` (the default), `friends` or `private`. The person reads everything, a repo owns only public documents, and a reader that cannot see a document gets the same answer as for one that does not exist. A node's own owner space is open to it; an app's access to the person's documents is by privacy level and the scopes its grant holds (see [Scopes and trust](./scopes-and-trust.md)).
+Each document is `public` (the default) or `private`. The person reads everything, a repo owns only public documents, and a reader that cannot see a document gets the same answer as for one that does not exist. A node's own owner space is open to it; an app's access to the person's documents is by privacy level and the scopes its grant holds (see [Scopes and trust](./scopes-and-trust.md)).
 
 ```mermaid
 flowchart LR

package/docs/concepts/scopes-and-trust.md

@@ -15,7 +15,7 @@ Scope strings are prefixed with `crtr:`. These are the ones the daemon and CLI c
 | `crtr:act` | Creating, forking, reviving, closing and messaging nodes; `bash` and `files`; creating a human request or review (the `crtr human` commands are hidden from a run without it) |
 | `crtr:schedule` | Creating, pausing, resuming, running and deleting crons (the `crtr cron` commands are hidden without it) |
 | `crtr:memory:read:user[:path]`, `crtr:memory:rw:user[:path]`, `crtr:memory:manage:user` | The person's documents: reading, writing (`crtr doc`), and `manage` for every privacy level and every document |
-| `crtr:memory:read_private:user` | Read-only access to the person's `public` and `private` documents, never `friends`; no path suffix; an optional permission the person switches on; `manage:user` covers it, `read:user` and `rw:user` do not |
+| `crtr:memory:read_private:user` | Read-only access to the person's `public` and `private` documents; no path suffix; an optional permission the person switches on; `manage:user` covers it, `read:user` and `rw:user` do not |
 | `crtr:memory:read:app:<id>`, `crtr:memory:rw:app:<id>` | An app's documents; `…:profile:<profile>` narrows to one of its profiles. A run with no `scopes` list, and an app's own server, reads and writes its own app's space freely; a run started with a `scopes` list needs these for its own app too |
 | `crtr:files:read\|rw:user:<dir>`, `crtr:files:read\|rw:app:<id>:<dir>`, `crtr:files:share` | Host files the run may mount, and sharing files beyond the app's own space |
 | `crtr:conversations:read:app:<id>`, `crtr:objects:read:app:<id>` | Reading another app's conversations or node objects |
@@ -23,7 +23,7 @@ Scope strings are prefixed with `crtr:`. These are the ones the daemon and CLI c
 
 The `memory` in `crtr:memory:*` is the scope family's name for access to **documents** (see [Documents](./documents.md)); there is no separate memory store. The older short names (`ask`, `act`, `schedule`, `memory:read`, `memory:write`, `llm`) are not accepted by `crtr sys connect --scopes`. A node's own documents, and an app's documents for its own nodes, need no `crtr:memory` scope.
 
-This is an allow-list, not a claim that code will behave. The daemon checks the scope at the route that performs the action and rejects an unavailable one. The SDK’s [`nodes.create`](../sdk/nodes.md) `scopes` field narrows a run: a run's list must stay inside what its creator and grant hold, and `crtr:act` requires `crtr:llm`. `client.memory` is not scope-gated: it lists and reads the person's `knowledge` and `preference` documents, and the answer is filtered by privacy — an app sees `public` documents, a grant holding `crtr:memory:read_private:user` also sees `private` ones, and a grant holding `crtr:memory:manage:user` sees `friends` and `private` ones. Who may read any document is the owner-and-privacy model, not a per-call scope. The exception is a run started with a `scopes` list: it reads its own app's documents (including automatic delivery of them at boot) only with `crtr:memory:read:app:<id>` and writes or edits them only with `crtr:memory:rw:app:<id>`; a refused write answers `scope_missing` naming the scope. Such a run still publishes its own reports with `crtr push` and its promoted node still gets a roadmap, but cannot edit any other document through that path, and a child never regains a scope its parent's list dropped.
+This is an allow-list, not a claim that code will behave. The daemon checks the scope at the route that performs the action and rejects an unavailable one. The SDK’s [`nodes.create`](../sdk/nodes.md) `scopes` field narrows a run: a run's list must stay inside what its creator and grant hold, and `crtr:act` requires `crtr:llm`. `client.memory` is not scope-gated: it lists and reads the person's `knowledge` and `preference` documents, and the answer is filtered by privacy, which is `public` or `private`. An app's ceiling is `public` documents; a grant holding `crtr:memory:read_private:user` or `crtr:memory:manage:user` widens it to `private` ones. Within that ceiling, the app's registered schema and the relation facts it writes decide who may read a document, not a per-call scope. The exception is a run started with a `scopes` list: it reads its own app's documents (including automatic delivery of them at boot) only with `crtr:memory:read:app:<id>` and writes or edits them only with `crtr:memory:rw:app:<id>`; a refused write answers `scope_missing` naming the scope. Such a run still publishes its own reports with `crtr push` and its promoted node still gets a roadmap, but cannot edit any other document through that path, and a child never regains a scope its parent's list dropped.
 
 ```mermaid
 flowchart LR

package/docs/sdk/release-notes.md

@@ -7,6 +7,17 @@ description: Behavior changes in @north-light/sdk that an app must act on, newes
 
 Changes to `@north-light/sdk` that can change what an existing app sees. Newest first.
 
+## 0.3.550
+
+An app registers a permission schema for its own object types and decides who may read each object with relations. Additive, except that `friends` leaves the privacy levels and nodes move under their profile.
+
+- **Schemas, relations, check.** `client.schemas.register({ namespace, source })` (`POST /v1/schemas`) registers the schema for a namespace the app first claims; `client.relations.write | replace | list` (`/v1/relations`) writes and reads facts such as `firstlight/memory:<id>  editor  user:<id>`; `client.check(subject, permission, resource)` (`POST /v1/check`) answers whether a person may act. A type or relation outside the app's own namespace is refused `403 not_schema_owner`; a namespace another app registered first is refused `namespace_taken`.
+- **Typed documents.** `docs.write` takes `schema_type` (the app type the document is an instance of) and `relations` (facts written in the same transaction), and `owner: 'user'` writes under the person the call token names. `docs.get` returns `extensions` and `schema_type`. `docs.delete(ref)`, `docs.list(params)` and `docs.search(params)` are new; `list` and `search` filter by `schema_type` and by `extensions` inside the permission-filtered query, before the page limit. Document history entries carry `acting_app` and `acting_for`.
+- **`friends` is removed.** Privacy is `public` or `private`. A write naming `friends` is refused `400 invalid_request`. Existing `friends` documents became `private`; a `friends` value that arrives from an older source (a peer on an older release, a plugin package, a legacy canvas) is read as `private`.
+- **Nodes are owned by their profile.** A node started under a profile now has that profile object as its `owner`, where it used to have the app: `owner` on list, search, read and event payloads names the profile, and listing with `owner=<app>&type=node` no longer returns those nodes; list them with `owner=<profile>`. Events carry the node's app as `app`. A node with no profile stays under its app.
+- **A fields-only edit records a revision.** `docs.edit` with only fields (preview, summary, privacy, rules, …) now records a revision with the body unchanged, attributed to the editor with the rationale: the returned `revision` advances and `docs.history` lists it. Before, it changed the fields and left the revision alone.
+- **FakeCloud** serves the new routes in memory: it parses and validates a registered schema source, refuses facts the schema does not declare, and evaluates `check`, `list` and `search` against the schema the way the runtime does. Deleting a typed document removes the facts that name it.
+
 ## 0.3.548
 
 `canvas.watch` with a `watcher` that is a node of your own app now works under `crtr:objects:link:node`. It answered `404 not_found` (`watcher not found`) before. The node must be reachable from the caller under run confinement and must itself be able to read the object. A watch on a node of another machine now forwards every event level, and that node's own listening config decides how each is delivered, where an event below level 3 was dropped before it left the object's machine.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@north-light/cli",
-  "version": "0.3.548",
+  "version": "0.3.550",
   "description": "crtr — agent runtime with memory, plugins, and marketplaces",
   "type": "module",
   "main": "dist/index.js",
@@ -140,7 +140,7 @@
   },
   "license": "UNLICENSED",
   "dependencies": {
-    "@north-light/identity": "0.3.548",
+    "@north-light/identity": "0.3.550",
     "@earendil-works/pi-agent-core": "1.1.0",
     "@earendil-works/pi-ai": "1.1.0",
     "@earendil-works/pi-coding-agent": "1.1.0",

package/packages/crouter-identity/dist/index.js

@@ -14,14 +14,27 @@ function validPath(path, directoryOnly = false) {
         !path.split('/').some((part, index, parts) => part === '.' || (part === '' && index !== parts.length - 1)) &&
         (!directoryOnly || !path.endsWith('/'));
 }
+// `covers` parses both sides on every call, and a grant can hold thousands of scopes: parse each string once. A parse is pure; a throw is not cached.
+const selectorCache = new Map();
+const SELECTOR_CACHE_MAX = 20_000;
 function selector(value) {
+    let s = selectorCache.get(value);
+    if (s === undefined) {
+        s = parseSelector(value);
+        if (selectorCache.size >= SELECTOR_CACHE_MAX)
+            selectorCache.clear();
+        selectorCache.set(value, s);
+    }
+    return s;
+}
+function parseSelector(value) {
     if (value === 'crtr:llm' || value === 'crtr:act' || value === 'crtr:schedule')
         return { kind: value.slice(5), value };
     if (value === 'crtr:files:share')
         return { kind: 'share', value };
     if (value === 'crtr:memory:manage:user')
         return { kind: 'memory', access: 'manage', holder: 'user' };
-    // Read-only access to the person's `public` and `private` memory (never `friends`). It names no document path.
+    // Read-only access to the person's `public` and `private` memory. It names no document path.
     if (value === 'crtr:memory:read_private:user')
         return { kind: 'memory', access: 'read_private', holder: 'user' };
     let match = /^crtr:memory:(read|rw):user(?::(.+))?$/.exec(value);

package/packages/crouter-identity/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@north-light/identity",
-  "version": "0.3.548",
+  "version": "0.3.550",
   "description": "Northlight access-token verification and scope rules",
   "type": "module",
   "main": "./dist/index.js",

package/runtime.lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@north-light/cli",
-  "version": "0.3.548",
+  "version": "0.3.550",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@north-light/cli",
-      "version": "0.3.548",
+      "version": "0.3.550",
       "hasInstallScript": true,
       "license": "UNLICENSED",
       "workspaces": [
@@ -24,7 +24,7 @@
         "@milkdown/preset-gfm": "^7.22.3",
         "@milkdown/prose": "^7.22.3",
         "@milkdown/utils": "^7.22.3",
-        "@north-light/identity": "0.3.548",
+        "@north-light/identity": "0.3.550",
         "cron-parser": "^5.6.0",
         "esbuild": "^0.27.7",
         "jose": "^6.2.12",
@@ -12455,17 +12455,17 @@
     },
     "packages/crouter-api": {
       "name": "@north-light/api",
-      "version": "0.3.548",
+      "version": "0.3.550",
       "license": "UNLICENSED"
     },
     "packages/crouter-env-docker": {
       "name": "@north-light/env-docker",
-      "version": "0.3.548",
+      "version": "0.3.550",
       "license": "UNLICENSED"
     },
     "packages/crouter-identity": {
       "name": "@north-light/identity",
-      "version": "0.3.548",
+      "version": "0.3.550",
       "license": "UNLICENSED",
       "dependencies": {
         "jose": "^6.2.1"
@@ -12473,21 +12473,21 @@
     },
     "packages/crouter-plugin": {
       "name": "@north-light/plugin",
-      "version": "0.3.548",
+      "version": "0.3.550",
       "license": "UNLICENSED",
       "dependencies": {
-        "@north-light/api": "0.3.548",
-        "@north-light/identity": "0.3.548"
+        "@north-light/api": "0.3.550",
+        "@north-light/identity": "0.3.550"
       }
     },
     "packages/crouter-sdk": {
       "name": "@north-light/sdk",
-      "version": "0.3.548",
+      "version": "0.3.550",
       "license": "UNLICENSED",
       "dependencies": {
-        "@north-light/api": "0.3.548",
-        "@north-light/identity": "0.3.548",
-        "@north-light/plugin": "0.3.548",
+        "@north-light/api": "0.3.550",
+        "@north-light/identity": "0.3.550",
+        "@north-light/plugin": "0.3.550",
         "jose": "^6.2.1"
       },
       "bin": {

package/dist/core/graph/spaces/app.d.ts

@@ -1,3 +0,0 @@
-import type { Space } from './index.js';
-/** An app: its nodes (with their documents and jobs), its profiles and its app documents. */
-export declare const appSpace: Space;

package/dist/core/graph/spaces/app.js

@@ -1 +0,0 @@
-var S=Object.defineProperty;var l=(i,n)=>S(i,"name",{value:n,configurable:!0});import{covers as u}from"@north-light/identity";import{identityOf as a}from"./index.js";import{memoryScope as r,missingOwnMemoryScope as p}from"./own-memory.js";import{objectPlace as x,runPlace as f,runsSeeEachOther as O}from"../../runs/confinement.js";const M={sync:"runtime",async canRead(i,n,e,t,o){if(n.class==="person"||t.length===0)return!0;if(n.app.id===e.id)return await w(i,n,t)&&await p(i,n,e,t,o,"read")===null;const s=(await a(i,e)).external_id,c=l(y=>n.scopes!==null&&n.scopes.some(g=>u(g,y)),"held");return t[0].type==="node"?c(`crtr:objects:read:${s}`)||o.type==="document"&&o.kind==="report"&&c(`crtr:conversations:read:${s}`):c(await r(i,s,"read",t))},async canChange(i,n,e,t,o){if(n.class==="person")return!0;if(n.app.id===e.id)return t.length===0||await w(i,n,t)&&await p(i,n,e,t,o,"rw")===null;if(t.length===0||t[0].type==="node")return!1;const s=await r(i,(await a(i,e)).external_id,"rw",t);return n.scopes!==null&&n.scopes.some(c=>u(c,s))}},m=new WeakMap;async function w(i,n,e){if(n.class==="person"||e.length===0||e[0].type!=="node"||n.class==="app"&&n.place===void 0)return!0;let t=m.get(n);if(t===void 0&&(t=n.class==="app"?n.place:n.class==="node"?await f(n.node.id,i):n.place??await x(n.object.id,i),m.set(n,t)),t===null)return!0;const o=await f(e[0].id,i);return o===null?!t.isolated:O(t,o)}l(w,"runConfined");export{M as appSpace};

package/dist/core/graph/spaces/index.d.ts

@@ -1,18 +0,0 @@
-import type { ObjectRow, Reader } from '../types.js';
-import type { CanvasDb } from '../../canvas/db.js';
-export interface IdentityRow {
-    object: string;
-    scheme: string;
-    external_id: string;
-}
-export type SpaceType = 'person' | 'app' | 'repo';
-/** The top of an owner chain. Only a space decides access and sync for what it owns.
- *  `path` is the owner chain below the space, top first, ending at the object
- *  (e.g. `[node, document]`); it is empty when the object is the space itself. */
-export interface Space {
-    sync: 'runtime' | 'repo-ref';
-    canRead(db: CanvasDb, reader: Reader, space: ObjectRow, path: ObjectRow[], object: ObjectRow): Promise<boolean>;
-    canChange(db: CanvasDb, reader: Reader, space: ObjectRow, path: ObjectRow[], object: ObjectRow): Promise<boolean>;
-}
-export declare const SPACES: Record<SpaceType, Space>;
-export declare function identityOf(db: CanvasDb, object: ObjectRow): Promise<IdentityRow>;

package/dist/core/graph/spaces/index.js

@@ -1 +0,0 @@
-var p=Object.defineProperty;var o=(r,e)=>p(r,"name",{value:e,configurable:!0});import{appSpace as i}from"./app.js";import{personSpace as n}from"./person.js";import{repoSpace as a}from"./repo.js";const f={person:n,app:i,repo:a};async function E(r,e){const t=await r.prepare("SELECT object, scheme, external_id FROM identities WHERE object = ?").get(e.id);if(!t)throw new Error(`${e.type} ${e.id} has no identity`);return t}o(E,"identityOf");export{f as SPACES,E as identityOf};

package/dist/core/graph/spaces/own-memory.d.ts

@@ -1,18 +0,0 @@
-import type { ObjectRow, Reader } from '../types.js';
-import type { CanvasDb } from '../../canvas/db.js';
-type Path = ObjectRow[];
-/** The scope a run launched with a `scopes` list lacks to read (`read`) or change (`rw`) one of its own app's documents, or null.
- *  Own-app memory needs no grant scope, but a launched list narrows it (identity MEM-2): reading needs `crtr:memory:read:app:<A>`,
- *  writing `crtr:memory:rw:app:<A>` (profile forms for a profile's documents). Only documents are gated — never a node, job or
- *  lifecycle object — and a run with no list, an app's server and the person keep full access. A report is readable inside its
- *  own run (a run hears its children through them); writing one is the runtime's own act (see `asRuntimeWriter`). */
-export declare function missingOwnMemoryScope(db: CanvasDb, reader: Reader, space: ObjectRow, path: Path, object: {
-    type: string;
-    kind: string | null;
-} | null, access: 'read' | 'rw'): Promise<string | null>;
-/** The same reader with its launched list lifted, for the runtime's own writes inside a narrowed run: a `crtr push` report and the
- *  scaffolded roadmap of a promoted node. Wrap only the one call that creates the document the runtime names. */
-export declare function asRuntimeWriter<R extends Reader>(reader: R): R;
-/** `crtr:memory:<access>:app:<B>` for an app document, or its profile form for a profile and what it owns. */
-export declare function memoryScope(db: CanvasDb, app: string, access: 'read' | 'rw', path: Path): Promise<string>;
-export {};

package/dist/core/graph/spaces/own-memory.js

@@ -1 +0,0 @@
-var m=Object.defineProperty;var o=(n,t)=>m(n,"name",{value:t,configurable:!0});import{covers as f}from"@north-light/identity";import{runPlace as s}from"../../runs/confinement.js";const a=o(async(n,t)=>(await n.prepare("SELECT external_id FROM identities WHERE object = ?").get(t.id)).external_id,"externalId");async function $(n,t,l,e,r,u){if(t.class==="person"||e.length===0||r!==null&&r.type!=="document")return null;const i=t.launched;if(i==null||u==="read"&&r?.kind==="report"&&e[0].type==="node"&&await y(n,t,e[0].id))return null;const c=await d(n,await a(n,l),u,e);return i.some(p=>f(p,c))?null:c}o($,"missingOwnMemoryScope");async function y(n,t,l){const e=t.class==="node"?await s(t.node.id,n):t.class==="person"?null:t.place??null,r=await s(l,n);return e!==null&&r!==null&&e.run===r.run}o(y,"inReadersRun");function g(n){return n.class==="person"?n:{...n,launched:null}}o(g,"asRuntimeWriter");async function d(n,t,l,e){const r=e[0];return r.type!=="profile"?`crtr:memory:${l}:${t}`:`crtr:memory:${l}:${t}:profile:${await a(n,r)}`}o(d,"memoryScope");export{g as asRuntimeWriter,d as memoryScope,$ as missingOwnMemoryScope};

package/dist/core/graph/spaces/person.d.ts

@@ -1,5 +0,0 @@
-import type { Space } from './index.js';
-/** You: your documents, and nodes started with your own authority. Reads and
- *  changes use the runtime-spaces memory permission strings; a change also
- *  requires the document's grantee — the app of the node that wrote its first revision. */
-export declare const personSpace: Space;

package/dist/core/graph/spaces/person.js

@@ -1,3 +0,0 @@
-import{covers as t}from"@north-light/identity";const f={sync:"runtime",async canRead(a,e,n,s,i){return e.class==="person"||e.class==="object"&&e.owner.id===n.id?!0:e.scopes===null?!1:e.app.id===n.id||s.length===0?!0:s[0].type!=="document"?!1:e.scopes.some(o=>t(o,"crtr:memory:manage:user"))||i.privacy==="public"?!0:i.privacy==="private"&&e.scopes.some(o=>t(o,"crtr:memory:read_private:user"))},async canChange(a,e,n,s,i){if(e.class==="person"||e.class==="object"&&e.owner.id===n.id||e.app.id===n.id||e.scopes?.some(r=>t(r,"crtr:memory:manage:user")))return!0;if(s.length===0)return e.scopes?.some(r=>t(r,"crtr:memory:rw:user"))??!1;if(s[0].type!=="document")return!1;const o=`crtr:memory:rw:user:${i.name}`;if(e.scopes===null||!e.scopes.some(r=>t(r,o)))return!1;const u=await a.prepare(`SELECT author.type, author.owner AS app FROM revisions r JOIN objects author ON author.id = r.author
-      WHERE r.document = ? ORDER BY r.number, r.created_at LIMIT 1`).get(s[0].id);return u?u.type==="person"||u.app===e.app.id?!0:(await a.prepare(`SELECT g.resolved_scopes_json FROM grants g JOIN identities i ON i.external_id = g.grantee
-      WHERE i.object = ? AND i.scheme = 'app'`).all(u.app)).some(({resolved_scopes_json:r})=>JSON.parse(r).some(({scope:c,mode:p})=>p==="always"&&t(c,"crtr:memory:manage:user"))):!1}};export{f as personSpace};

package/dist/core/graph/spaces/repo.d.ts

@@ -1,14 +0,0 @@
-import type { Reader } from '../types.js';
-import type { Space } from './index.js';
-/** Whether a node has a checkout of `repo` that its file permissions reach: read to read the
- *  repo's documents, rw to change them. A checkout is one enclosing the node's cwd or one of its
- *  profile's project paths; the cwd alone never lets a run in, since a node may be started in any
- *  directory. A repo's documents change iff its files do. A repo-owned custom object is inside its
- *  own repo. A Mac terminal node reaches every path. */
-export declare function insideRepo(db: Parameters<Space['canRead']>[0], reader: Reader, repo: {
-    id: string;
-}, access: 'read' | 'rw'): Promise<boolean>;
-/** A repo: read and changed by a run with a checkout of it (enclosing its cwd or one of its
- *  profile's project paths) that its file permissions reach (see `insideRepo`). It owns only public documents, so a
- *  non-public one is never changed. */
-export declare const repoSpace: Space;

package/dist/core/graph/spaces/repo.js

@@ -1 +0,0 @@
-var p=Object.defineProperty;var i=(e,t)=>p(e,"name",{value:t,configurable:!0});import{fileRoot as l}from"../../spaces/file-root.js";import{identityOf as u}from"./index.js";async function r(e,t,n,s){if(t.class==="object")return t.repos.some(o=>o.id===n.id);if(t.class!=="node")return!1;const c=[...t.checkouts,...t.projectCheckouts].filter(o=>o.repo.id===n.id);if(c.length===0)return!1;const a={app:(await u(e,t.app)).external_id,resolved:t.scopes??[],launched:null};return c.some(o=>"root"in l(a,o.root,s))}i(r,"insideRepo");const y={sync:"repo-ref",async canRead(e,t,n,s){return t.class==="person"||s.length===0?!0:await r(e,t,n,"read")},async canChange(e,t,n,s,c){return c.privacy!=="public"?!1:t.class==="person"?!0:await r(e,t,n,"rw")}};export{r as insideRepo,y as repoSpace};

package/dist/core/runs/confinement.d.ts

@@ -1,25 +0,0 @@
-import { type CanvasDb } from '../canvas/db.js';
-/** A node's run and whether that run is isolated (the node's own flag or its root's). */
-export interface RunPlace {
-    run: string;
-    isolated: boolean;
-}
-/** The run a node belongs to: its `run_id`, or the node itself when it has none.
- *  A deleted node of an isolated run keeps its run through `deleted_isolated_nodes`,
- *  so what it leaves behind stays confined; any other node without a row is null. */
-export declare function runPlace(nodeId: string, db?: CanvasDb): Promise<RunPlace | null>;
-/** Record, before a node's row is deleted, the run of a node of an isolated run. */
-export declare function rememberDeletedIsolated(nodeId: string, db?: CanvasDb): Promise<void>;
-/** The place of the node that registered a custom object, which is where that object
- *  reads from; null when the person or the app's server registered it. */
-export declare function objectPlace(objectId: string, db?: CanvasDb): Promise<RunPlace | null>;
-/** The confinement predicate: two places see each other when they are the same
- *  run, or when neither run is isolated. */
-export declare function runsSeeEachOther(a: RunPlace, b: RunPlace): boolean;
-/** Whether a node caller of `app` may reach `target` (a node id) under run confinement.
- *  Confinement applies only within one app; cross-app reach stays with the scope rules. */
-export declare function nodeMayReach(callerNode: string, callerApp: string, targetNode: string, targetApp: string | null, db?: CanvasDb): Promise<boolean>;
-/** The same question for a caller that has a place but no node (a cron command: its origin run). */
-export declare function placeMayReach(caller: RunPlace, callerApp: string, targetNode: string, targetApp: string | null, db?: CanvasDb): Promise<boolean>;
-/** The node ids of one run (its root and every node carrying its `run_id`). */
-export declare function runNodeIds(run: string, db?: CanvasDb): Promise<string[]>;

package/dist/core/runs/confinement.js

@@ -1,2 +0,0 @@
-var s=Object.defineProperty;var n=(t,e)=>s(t,"name",{value:e,configurable:!0});import{openDb as o}from"../canvas/db.js";async function u(t,e){e??=await o();const r=await e.prepare(`SELECT n.run_id, n.isolated, r.isolated AS root_isolated FROM nodes n
-    LEFT JOIN nodes r ON r.node_id = n.run_id WHERE n.node_id = ?`).get(t);if(!r){const a=await e.prepare("SELECT run_id FROM deleted_isolated_nodes WHERE node_id = ?").get(t);return a?{run:a.run_id,isolated:!0}:null}return{run:r.run_id??t,isolated:r.isolated===1||r.root_isolated===1}}n(u,"runPlace");async function E(t,e){e??=await o();const r=await u(t,e);r?.isolated&&await e.prepare("INSERT INTO deleted_isolated_nodes (node_id, run_id) VALUES (?, ?) ON CONFLICT (node_id) DO UPDATE SET run_id = excluded.run_id").run(t,r.run)}n(E,"rememberDeletedIsolated");async function w(t,e){e??=await o();const r=await e.prepare("SELECT registered_by FROM custom_objects WHERE object = ?").get(t);return r?.registered_by?await u(r.registered_by,e)??{run:r.registered_by,isolated:!1}:null}n(w,"objectPlace");function l(t,e){return t.run===e.run||!t.isolated&&!e.isolated}n(l,"runsSeeEachOther");async function f(t,e,r,a,i){i??=await o();const d=await u(t,i);return d===null?!0:await c(d,e,r,a,i)}n(f,"nodeMayReach");async function c(t,e,r,a,i){if(i??=await o(),(a??"app:terminal")!==e)return!0;const d=await u(r,i);return d===null?!t.isolated:l(t,d)}n(c,"placeMayReach");async function y(t,e){return e??=await o(),(await e.prepare("SELECT node_id FROM nodes WHERE run_id = ? OR node_id = ?").all(t,t)).map(r=>r.node_id)}n(y,"runNodeIds");export{f as nodeMayReach,w as objectPlace,c as placeMayReach,E as rememberDeletedIsolated,y as runNodeIds,u as runPlace,l as runsSeeEachOther};