@north-light/cli 0.3.549 → 0.3.550

package/dist/core/graph/spaces/index.d.ts

@@ -1,18 +0,0 @@
-import type { ObjectRow, Reader } from '../types.js';
-import type { CanvasDb } from '../../canvas/db.js';
-export interface IdentityRow {
-    object: string;
-    scheme: string;
-    external_id: string;
-}
-export type SpaceType = 'person' | 'app' | 'repo';
-/** The top of an owner chain. Only a space decides access and sync for what it owns.
- *  `path` is the owner chain below the space, top first, ending at the object
- *  (e.g. `[node, document]`); it is empty when the object is the space itself. */
-export interface Space {
-    sync: 'runtime' | 'repo-ref';
-    canRead(db: CanvasDb, reader: Reader, space: ObjectRow, path: ObjectRow[], object: ObjectRow): Promise<boolean>;
-    canChange(db: CanvasDb, reader: Reader, space: ObjectRow, path: ObjectRow[], object: ObjectRow): Promise<boolean>;
-}
-export declare const SPACES: Record<SpaceType, Space>;
-export declare function identityOf(db: CanvasDb, object: ObjectRow): Promise<IdentityRow>;

package/dist/core/graph/spaces/index.js

@@ -1 +0,0 @@
-var p=Object.defineProperty;var o=(r,e)=>p(r,"name",{value:e,configurable:!0});import{appSpace as i}from"./app.js";import{personSpace as n}from"./person.js";import{repoSpace as a}from"./repo.js";const f={person:n,app:i,repo:a};async function E(r,e){const t=await r.prepare("SELECT object, scheme, external_id FROM identities WHERE object = ?").get(e.id);if(!t)throw new Error(`${e.type} ${e.id} has no identity`);return t}o(E,"identityOf");export{f as SPACES,E as identityOf};

package/dist/core/graph/spaces/own-memory.d.ts

@@ -1,18 +0,0 @@
-import type { ObjectRow, Reader } from '../types.js';
-import type { CanvasDb } from '../../canvas/db.js';
-type Path = ObjectRow[];
-/** The scope a run launched with a `scopes` list lacks to read (`read`) or change (`rw`) one of its own app's documents, or null.
- *  Own-app memory needs no grant scope, but a launched list narrows it (identity MEM-2): reading needs `crtr:memory:read:app:<A>`,
- *  writing `crtr:memory:rw:app:<A>` (profile forms for a profile's documents). Only documents are gated — never a node, job or
- *  lifecycle object — and a run with no list, an app's server and the person keep full access. A report is readable inside its
- *  own run (a run hears its children through them); writing one is the runtime's own act (see `asRuntimeWriter`). */
-export declare function missingOwnMemoryScope(db: CanvasDb, reader: Reader, space: ObjectRow, path: Path, object: {
-    type: string;
-    kind: string | null;
-} | null, access: 'read' | 'rw'): Promise<string | null>;
-/** The same reader with its launched list lifted, for the runtime's own writes inside a narrowed run: a `crtr push` report and the
- *  scaffolded roadmap of a promoted node. Wrap only the one call that creates the document the runtime names. */
-export declare function asRuntimeWriter<R extends Reader>(reader: R): R;
-/** `crtr:memory:<access>:app:<B>` for an app document, or its profile form for a profile and what it owns. */
-export declare function memoryScope(db: CanvasDb, app: string, access: 'read' | 'rw', path: Path): Promise<string>;
-export {};

package/dist/core/graph/spaces/own-memory.js

@@ -1 +0,0 @@
-var m=Object.defineProperty;var o=(n,t)=>m(n,"name",{value:t,configurable:!0});import{covers as f}from"@north-light/identity";import{runPlace as s}from"../../runs/confinement.js";const a=o(async(n,t)=>(await n.prepare("SELECT external_id FROM identities WHERE object = ?").get(t.id)).external_id,"externalId");async function $(n,t,l,e,r,u){if(t.class==="person"||e.length===0||r!==null&&r.type!=="document")return null;const i=t.launched;if(i==null||u==="read"&&r?.kind==="report"&&e[0].type==="node"&&await y(n,t,e[0].id))return null;const c=await d(n,await a(n,l),u,e);return i.some(p=>f(p,c))?null:c}o($,"missingOwnMemoryScope");async function y(n,t,l){const e=t.class==="node"?await s(t.node.id,n):t.class==="person"?null:t.place??null,r=await s(l,n);return e!==null&&r!==null&&e.run===r.run}o(y,"inReadersRun");function g(n){return n.class==="person"?n:{...n,launched:null}}o(g,"asRuntimeWriter");async function d(n,t,l,e){const r=e[0];return r.type!=="profile"?`crtr:memory:${l}:${t}`:`crtr:memory:${l}:${t}:profile:${await a(n,r)}`}o(d,"memoryScope");export{g as asRuntimeWriter,d as memoryScope,$ as missingOwnMemoryScope};

package/dist/core/graph/spaces/person.d.ts

@@ -1,5 +0,0 @@
-import type { Space } from './index.js';
-/** You: your documents, and nodes started with your own authority. Reads and
- *  changes use the runtime-spaces memory permission strings; a change also
- *  requires the document's grantee — the app of the node that wrote its first revision. */
-export declare const personSpace: Space;

package/dist/core/graph/spaces/person.js

@@ -1,3 +0,0 @@
-import{covers as t}from"@north-light/identity";const f={sync:"runtime",async canRead(a,e,n,s,i){return e.class==="person"||e.class==="object"&&e.owner.id===n.id?!0:e.scopes===null?!1:e.app.id===n.id||s.length===0?!0:s[0].type!=="document"?!1:e.scopes.some(o=>t(o,"crtr:memory:manage:user"))||i.privacy==="public"?!0:i.privacy==="private"&&e.scopes.some(o=>t(o,"crtr:memory:read_private:user"))},async canChange(a,e,n,s,i){if(e.class==="person"||e.class==="object"&&e.owner.id===n.id||e.app.id===n.id||e.scopes?.some(r=>t(r,"crtr:memory:manage:user")))return!0;if(s.length===0)return e.scopes?.some(r=>t(r,"crtr:memory:rw:user"))??!1;if(s[0].type!=="document")return!1;const o=`crtr:memory:rw:user:${i.name}`;if(e.scopes===null||!e.scopes.some(r=>t(r,o)))return!1;const u=await a.prepare(`SELECT author.type, author.owner AS app FROM revisions r JOIN objects author ON author.id = r.author
-      WHERE r.document = ? ORDER BY r.number, r.created_at LIMIT 1`).get(s[0].id);return u?u.type==="person"||u.app===e.app.id?!0:(await a.prepare(`SELECT g.resolved_scopes_json FROM grants g JOIN identities i ON i.external_id = g.grantee
-      WHERE i.object = ? AND i.scheme = 'app'`).all(u.app)).some(({resolved_scopes_json:r})=>JSON.parse(r).some(({scope:c,mode:p})=>p==="always"&&t(c,"crtr:memory:manage:user"))):!1}};export{f as personSpace};

package/dist/core/graph/spaces/repo.d.ts

@@ -1,14 +0,0 @@
-import type { Reader } from '../types.js';
-import type { Space } from './index.js';
-/** Whether a node has a checkout of `repo` that its file permissions reach: read to read the
- *  repo's documents, rw to change them. A checkout is one enclosing the node's cwd or one of its
- *  profile's project paths; the cwd alone never lets a run in, since a node may be started in any
- *  directory. A repo's documents change iff its files do. A repo-owned custom object is inside its
- *  own repo. A Mac terminal node reaches every path. */
-export declare function insideRepo(db: Parameters<Space['canRead']>[0], reader: Reader, repo: {
-    id: string;
-}, access: 'read' | 'rw'): Promise<boolean>;
-/** A repo: read and changed by a run with a checkout of it (enclosing its cwd or one of its
- *  profile's project paths) that its file permissions reach (see `insideRepo`). It owns only public documents, so a
- *  non-public one is never changed. */
-export declare const repoSpace: Space;

package/dist/core/graph/spaces/repo.js

@@ -1 +0,0 @@
-var p=Object.defineProperty;var i=(e,t)=>p(e,"name",{value:t,configurable:!0});import{fileRoot as l}from"../../spaces/file-root.js";import{identityOf as u}from"./index.js";async function r(e,t,n,s){if(t.class==="object")return t.repos.some(o=>o.id===n.id);if(t.class!=="node")return!1;const c=[...t.checkouts,...t.projectCheckouts].filter(o=>o.repo.id===n.id);if(c.length===0)return!1;const a={app:(await u(e,t.app)).external_id,resolved:t.scopes??[],launched:null};return c.some(o=>"root"in l(a,o.root,s))}i(r,"insideRepo");const y={sync:"repo-ref",async canRead(e,t,n,s){return t.class==="person"||s.length===0?!0:await r(e,t,n,"read")},async canChange(e,t,n,s,c){return c.privacy!=="public"?!1:t.class==="person"?!0:await r(e,t,n,"rw")}};export{r as insideRepo,y as repoSpace};

package/dist/core/runs/confinement.d.ts

@@ -1,25 +0,0 @@
-import { type CanvasDb } from '../canvas/db.js';
-/** A node's run and whether that run is isolated (the node's own flag or its root's). */
-export interface RunPlace {
-    run: string;
-    isolated: boolean;
-}
-/** The run a node belongs to: its `run_id`, or the node itself when it has none.
- *  A deleted node of an isolated run keeps its run through `deleted_isolated_nodes`,
- *  so what it leaves behind stays confined; any other node without a row is null. */
-export declare function runPlace(nodeId: string, db?: CanvasDb): Promise<RunPlace | null>;
-/** Record, before a node's row is deleted, the run of a node of an isolated run. */
-export declare function rememberDeletedIsolated(nodeId: string, db?: CanvasDb): Promise<void>;
-/** The place of the node that registered a custom object, which is where that object
- *  reads from; null when the person or the app's server registered it. */
-export declare function objectPlace(objectId: string, db?: CanvasDb): Promise<RunPlace | null>;
-/** The confinement predicate: two places see each other when they are the same
- *  run, or when neither run is isolated. */
-export declare function runsSeeEachOther(a: RunPlace, b: RunPlace): boolean;
-/** Whether a node caller of `app` may reach `target` (a node id) under run confinement.
- *  Confinement applies only within one app; cross-app reach stays with the scope rules. */
-export declare function nodeMayReach(callerNode: string, callerApp: string, targetNode: string, targetApp: string | null, db?: CanvasDb): Promise<boolean>;
-/** The same question for a caller that has a place but no node (a cron command: its origin run). */
-export declare function placeMayReach(caller: RunPlace, callerApp: string, targetNode: string, targetApp: string | null, db?: CanvasDb): Promise<boolean>;
-/** The node ids of one run (its root and every node carrying its `run_id`). */
-export declare function runNodeIds(run: string, db?: CanvasDb): Promise<string[]>;

package/dist/core/runs/confinement.js

@@ -1,2 +0,0 @@
-var s=Object.defineProperty;var n=(t,e)=>s(t,"name",{value:e,configurable:!0});import{openDb as o}from"../canvas/db.js";async function u(t,e){e??=await o();const r=await e.prepare(`SELECT n.run_id, n.isolated, r.isolated AS root_isolated FROM nodes n
-    LEFT JOIN nodes r ON r.node_id = n.run_id WHERE n.node_id = ?`).get(t);if(!r){const a=await e.prepare("SELECT run_id FROM deleted_isolated_nodes WHERE node_id = ?").get(t);return a?{run:a.run_id,isolated:!0}:null}return{run:r.run_id??t,isolated:r.isolated===1||r.root_isolated===1}}n(u,"runPlace");async function E(t,e){e??=await o();const r=await u(t,e);r?.isolated&&await e.prepare("INSERT INTO deleted_isolated_nodes (node_id, run_id) VALUES (?, ?) ON CONFLICT (node_id) DO UPDATE SET run_id = excluded.run_id").run(t,r.run)}n(E,"rememberDeletedIsolated");async function w(t,e){e??=await o();const r=await e.prepare("SELECT registered_by FROM custom_objects WHERE object = ?").get(t);return r?.registered_by?await u(r.registered_by,e)??{run:r.registered_by,isolated:!1}:null}n(w,"objectPlace");function l(t,e){return t.run===e.run||!t.isolated&&!e.isolated}n(l,"runsSeeEachOther");async function f(t,e,r,a,i){i??=await o();const d=await u(t,i);return d===null?!0:await c(d,e,r,a,i)}n(f,"nodeMayReach");async function c(t,e,r,a,i){if(i??=await o(),(a??"app:terminal")!==e)return!0;const d=await u(r,i);return d===null?!t.isolated:l(t,d)}n(c,"placeMayReach");async function y(t,e){return e??=await o(),(await e.prepare("SELECT node_id FROM nodes WHERE run_id = ? OR node_id = ?").all(t,t)).map(r=>r.node_id)}n(y,"runNodeIds");export{f as nodeMayReach,w as objectPlace,c as placeMayReach,E as rememberDeletedIsolated,y as runNodeIds,u as runPlace,l as runsSeeEachOther};