@sanity-labs/client-fake-for-test 0.11.0 → 0.12.0

package/dist/index.d.cts

@@ -152,12 +152,12 @@ export declare interface CreateTestClientOptions {
    */
   token?: string;
   /**
-   * Pluggable write interceptor — runs on each write through the document
-   * mutation API (create/patch/delete/transaction; not the release/version
-   * action API) before the store changes, and may throw to reject it. The
-   * client has no opinion about the policy; callers (e.g. a workflow test bench
-   * enforcing lake mutation guards) supply it. Inherited by `withConfig`
-   * siblings. See {@link MutationGuard}.
+   * Pluggable write interceptor — runs once for each document's net change in
+   * a commit. Document publish/unpublish actions expose their underlying
+   * draft/published mutations; release/version actions remain unhooked. Return
+   * denial descriptors to reject atomically with `GuardDeniedError`; a
+   * thrown callback error propagates unchanged. The client owns no policy.
+   * Inherited by `withConfig` siblings. See {@link MutationGuard}.
    */
   mutationGuard?: MutationGuard;
   /**
@@ -246,7 +246,11 @@ export declare interface DocumentBody {
   [field: string]: unknown;
 }
 
-export declare type DocumentValuePermission = "create" | "read" | "update";
+export declare type DocumentValuePermission =
+  | "create"
+  | "manage"
+  | "read"
+  | "update";
 
 /**
  * Error helpers shared across the fake.
@@ -397,6 +401,30 @@ export declare interface GuardConfig {
   recorded?: Set<string>;
 }
 
+/** HTTP-shaped guard rejection matching the error exposed by `@sanity/client`. */
+export declare class GuardDeniedError extends Error {
+  readonly statusCode = 403;
+  readonly type = "guardDeniedError";
+  readonly denials: MutationGuardDenial[];
+  readonly details: GuardDeniedResponse["body"]["error"];
+  readonly response: GuardDeniedResponse;
+  constructor(denials: readonly MutationGuardDenial[]);
+}
+
+export declare interface GuardDeniedResponse {
+  body: {
+    error: {
+      type: "guardDeniedError";
+      denials: MutationGuardDenial[];
+    };
+  };
+  url: string;
+  method: "POST";
+  headers: Record<string, string>;
+  statusCode: 403;
+  statusMessage: "Forbidden";
+}
+
 export declare const isDraftId: (id: string) => boolean;
 
 export declare const isReleaseDocId: (id: string) => boolean;
@@ -416,67 +444,46 @@ export declare interface MultipleMutationResult {
 }
 
 /**
- * A pluggable write interceptor, configured via
- * `createTestClient({ mutationGuard })`. It runs on each write through the
- * document mutation API — `create` / `createOrReplace` / `createIfNotExists` /
- * `patch` / `delete` and the equivalent `transaction()` operations — and on the
- * document publish/unpublish actions (`sanity.action.document.publish` /
- * `.unpublish` via `client.action`) — before the store changes; **throw to
- * reject the write** (the throw propagates out of the client call, exactly as
- * a real lake rejection would). The release/version action API
- * (`client.releases.*`, `createVersion`, the `sanity.action.release.*` and
- * `*.version.*` action types) is **not** intercepted.
- *
- * The client itself has no opinion about *what* a guard is — it only provides
- * the seam and the before/after/identity context. Callers (e.g. a workflow test
- * bench) supply the policy: evaluate lake mutation guards, enforce field locks,
- * etc. Keeping the policy in the caller avoids duplicating guard-evaluation
- * logic the client has no business owning.
+ * Evaluates one net document change and returns every denying guard. Returning
+ * `void` allows observe-only hooks. A thrown value is a callback failure and
+ * propagates unchanged; only returned entries become {@link GuardDeniedError}.
  */
 export declare type MutationGuard = (
   context: MutationGuardContext,
-) => void | Promise<void>;
+) =>
+  | readonly MutationGuardDenial[]
+  | void
+  | Promise<readonly MutationGuardDenial[] | void>;
 
-/** The kind of write a {@link MutationGuard} is asked to vet. */
-export declare type MutationGuardAction =
-  | "create"
-  | "update"
-  | "delete"
-  | "publish"
-  | "unpublish";
+/** The Content Lake mutation actions that a {@link MutationGuard} can match. */
+export declare type MutationGuardAction = "create" | "update" | "delete";
 
-/**
- * The before/after image of a single document write, handed to a
- * {@link MutationGuard} before it is applied.
- *
- * - `before` is null on create and on a publish with no live published
- *   document; `after` is null on delete and unpublish.
- * - On publish/unpublish both images are of the *published* document —
- *   `after` on publish is the draft's content promoted onto the published id.
- * - `identity` is the acting user — the id bound to the client's token
- *   (its `accessControl.currentUser`), or undefined when the client has no
- *   identity configured.
- *
- * Treat `before`/`after` as read-only — they are the live store images, not
- * copies; a guard that mutates them corrupts the store.
- */
+/** The before/final-after image of one net document change in a commit. */
 export declare interface MutationGuardContext {
   action: MutationGuardAction;
-  before:
-    | (SanityDocumentLike & {
-        _id: string;
-        _type: string;
-      })
-    | null;
-  after:
-    | (SanityDocumentLike & {
-        _id: string;
-        _type: string;
-      })
-    | null;
+  /** Original live store image. Treat it as read-only; it is not a copy. */
+  before: Readonly<
+    SanityDocumentLike & {
+      _id: string;
+      _type: string;
+    }
+  > | null;
+  /** Final live store image. Treat it as read-only; it is not a copy. */
+  after: Readonly<
+    SanityDocumentLike & {
+      _id: string;
+      _type: string;
+    }
+  > | null;
+  /** Acting project identity, or `undefined` on an identity-free client. */
   identity: string | undefined;
 }
 
+export declare interface MutationGuardDenial {
+  guardID: string;
+  name?: string;
+}
+
 /** Append-only record of one committed transaction (a single mutation is a 1-entry transaction). */
 export declare interface MutationLogEntry {
   transactionId: string;
@@ -855,8 +862,9 @@ export declare interface TestClient {
    * Dispatch one or more release / version / document actions against the
    * store. Returns a synthetic `transactionId`. Multi-action arrays are
    * applied atomically — any failure rolls back the batch. The document
-   * publish/unpublish actions run through the access gate and the
-   * `mutationGuard` seam; release/version actions apply unhooked.
+   * publish/unpublish actions run through the access gate and expose their
+   * net draft/published mutations to `mutationGuard`; release/version actions
+   * apply unhooked.
    */
   action: (
     action: Action | Action[],

package/dist/index.d.ts

@@ -152,12 +152,12 @@ export declare interface CreateTestClientOptions {
    */
   token?: string;
   /**
-   * Pluggable write interceptor — runs on each write through the document
-   * mutation API (create/patch/delete/transaction; not the release/version
-   * action API) before the store changes, and may throw to reject it. The
-   * client has no opinion about the policy; callers (e.g. a workflow test bench
-   * enforcing lake mutation guards) supply it. Inherited by `withConfig`
-   * siblings. See {@link MutationGuard}.
+   * Pluggable write interceptor — runs once for each document's net change in
+   * a commit. Document publish/unpublish actions expose their underlying
+   * draft/published mutations; release/version actions remain unhooked. Return
+   * denial descriptors to reject atomically with `GuardDeniedError`; a
+   * thrown callback error propagates unchanged. The client owns no policy.
+   * Inherited by `withConfig` siblings. See {@link MutationGuard}.
    */
   mutationGuard?: MutationGuard;
   /**
@@ -246,7 +246,11 @@ export declare interface DocumentBody {
   [field: string]: unknown;
 }
 
-export declare type DocumentValuePermission = "create" | "read" | "update";
+export declare type DocumentValuePermission =
+  | "create"
+  | "manage"
+  | "read"
+  | "update";
 
 /**
  * Error helpers shared across the fake.
@@ -397,6 +401,30 @@ export declare interface GuardConfig {
   recorded?: Set<string>;
 }
 
+/** HTTP-shaped guard rejection matching the error exposed by `@sanity/client`. */
+export declare class GuardDeniedError extends Error {
+  readonly statusCode = 403;
+  readonly type = "guardDeniedError";
+  readonly denials: MutationGuardDenial[];
+  readonly details: GuardDeniedResponse["body"]["error"];
+  readonly response: GuardDeniedResponse;
+  constructor(denials: readonly MutationGuardDenial[]);
+}
+
+export declare interface GuardDeniedResponse {
+  body: {
+    error: {
+      type: "guardDeniedError";
+      denials: MutationGuardDenial[];
+    };
+  };
+  url: string;
+  method: "POST";
+  headers: Record<string, string>;
+  statusCode: 403;
+  statusMessage: "Forbidden";
+}
+
 export declare const isDraftId: (id: string) => boolean;
 
 export declare const isReleaseDocId: (id: string) => boolean;
@@ -416,67 +444,46 @@ export declare interface MultipleMutationResult {
 }
 
 /**
- * A pluggable write interceptor, configured via
- * `createTestClient({ mutationGuard })`. It runs on each write through the
- * document mutation API — `create` / `createOrReplace` / `createIfNotExists` /
- * `patch` / `delete` and the equivalent `transaction()` operations — and on the
- * document publish/unpublish actions (`sanity.action.document.publish` /
- * `.unpublish` via `client.action`) — before the store changes; **throw to
- * reject the write** (the throw propagates out of the client call, exactly as
- * a real lake rejection would). The release/version action API
- * (`client.releases.*`, `createVersion`, the `sanity.action.release.*` and
- * `*.version.*` action types) is **not** intercepted.
- *
- * The client itself has no opinion about *what* a guard is — it only provides
- * the seam and the before/after/identity context. Callers (e.g. a workflow test
- * bench) supply the policy: evaluate lake mutation guards, enforce field locks,
- * etc. Keeping the policy in the caller avoids duplicating guard-evaluation
- * logic the client has no business owning.
+ * Evaluates one net document change and returns every denying guard. Returning
+ * `void` allows observe-only hooks. A thrown value is a callback failure and
+ * propagates unchanged; only returned entries become {@link GuardDeniedError}.
  */
 export declare type MutationGuard = (
   context: MutationGuardContext,
-) => void | Promise<void>;
+) =>
+  | readonly MutationGuardDenial[]
+  | void
+  | Promise<readonly MutationGuardDenial[] | void>;
 
-/** The kind of write a {@link MutationGuard} is asked to vet. */
-export declare type MutationGuardAction =
-  | "create"
-  | "update"
-  | "delete"
-  | "publish"
-  | "unpublish";
+/** The Content Lake mutation actions that a {@link MutationGuard} can match. */
+export declare type MutationGuardAction = "create" | "update" | "delete";
 
-/**
- * The before/after image of a single document write, handed to a
- * {@link MutationGuard} before it is applied.
- *
- * - `before` is null on create and on a publish with no live published
- *   document; `after` is null on delete and unpublish.
- * - On publish/unpublish both images are of the *published* document —
- *   `after` on publish is the draft's content promoted onto the published id.
- * - `identity` is the acting user — the id bound to the client's token
- *   (its `accessControl.currentUser`), or undefined when the client has no
- *   identity configured.
- *
- * Treat `before`/`after` as read-only — they are the live store images, not
- * copies; a guard that mutates them corrupts the store.
- */
+/** The before/final-after image of one net document change in a commit. */
 export declare interface MutationGuardContext {
   action: MutationGuardAction;
-  before:
-    | (SanityDocumentLike & {
-        _id: string;
-        _type: string;
-      })
-    | null;
-  after:
-    | (SanityDocumentLike & {
-        _id: string;
-        _type: string;
-      })
-    | null;
+  /** Original live store image. Treat it as read-only; it is not a copy. */
+  before: Readonly<
+    SanityDocumentLike & {
+      _id: string;
+      _type: string;
+    }
+  > | null;
+  /** Final live store image. Treat it as read-only; it is not a copy. */
+  after: Readonly<
+    SanityDocumentLike & {
+      _id: string;
+      _type: string;
+    }
+  > | null;
+  /** Acting project identity, or `undefined` on an identity-free client. */
   identity: string | undefined;
 }
 
+export declare interface MutationGuardDenial {
+  guardID: string;
+  name?: string;
+}
+
 /** Append-only record of one committed transaction (a single mutation is a 1-entry transaction). */
 export declare interface MutationLogEntry {
   transactionId: string;
@@ -855,8 +862,9 @@ export declare interface TestClient {
    * Dispatch one or more release / version / document actions against the
    * store. Returns a synthetic `transactionId`. Multi-action arrays are
    * applied atomically — any failure rolls back the batch. The document
-   * publish/unpublish actions run through the access gate and the
-   * `mutationGuard` seam; release/version actions apply unhooked.
+   * publish/unpublish actions run through the access gate and expose their
+   * net draft/published mutations to `mutationGuard`; release/version actions
+   * apply unhooked.
    */
   action: (
     action: Action | Action[],

package/dist/index.js

@@ -151,6 +151,48 @@ function makeRequestImpl(ctx) {
     );
   };
 }
+class GuardDeniedError extends Error {
+  statusCode = 403;
+  type = "guardDeniedError";
+  denials;
+  details;
+  response;
+  constructor(denials) {
+    const unique = uniqueDenials(denials);
+    super(`Mutation denied by guard(s) [${unique.map((denial) => denial.guardID).join(", ")}]`), this.name = "GuardDeniedError", this.denials = unique, this.details = { type: this.type, denials: unique }, this.response = {
+      body: { error: this.details },
+      url: "memory://client-fake-for-test/data/mutate",
+      method: "POST",
+      headers: {},
+      statusCode: this.statusCode,
+      statusMessage: "Forbidden"
+    };
+  }
+}
+function uniqueDenials(denials) {
+  const seen = /* @__PURE__ */ new Set();
+  return denials.filter((denial) => seen.has(denial.guardID) ? !1 : (seen.add(denial.guardID), !0));
+}
+function mutationContext(images) {
+  const { before, after } = images;
+  if (before !== after)
+    return before === void 0 ? { action: "create", before: null, after: after ?? null } : after === void 0 ? { action: "delete", before, after: null } : { action: "update", before, after };
+}
+function mutationContexts(images) {
+  return [...images].flatMap((image) => {
+    const context = mutationContext(image);
+    return context === void 0 ? [] : [context];
+  });
+}
+async function enforceMutationGuards(guard, contexts) {
+  if (guard === void 0) return;
+  const denials = [];
+  for (const context of contexts) {
+    const denied = await guard(context);
+    denied !== void 0 && denials.push(...denied);
+  }
+  if (denials.length > 0) throw new GuardDeniedError(denials);
+}
 function describeType(value) {
   return value === null ? "null" : Array.isArray(value) ? "an array" : `a ${typeof value}`;
 }
@@ -684,7 +726,7 @@ async function applyAction(store, action, hooks) {
       const published = store.get(action.publishedId);
       requireRevisionMatch(action.draftId, draft._rev, action.ifDraftRevisionId), requireRevisionMatch(action.publishedId, published?._rev, action.ifPublishedRevisionId);
       const promoted = promote({ ...draft, _id: action.publishedId });
-      return published !== void 0 && (promoted._createdAt = published._createdAt), await hooks?.gate?.(promoted, published === void 0 ? "create" : "update"), await hooks?.guard?.("publish", published ?? null, promoted), store.put(promoted), store.remove(action.draftId), { transactionId: cryptoRandomKey() };
+      return published !== void 0 && (promoted._createdAt = published._createdAt), await hooks?.gate?.(promoted, published === void 0 ? "create" : "update"), store.put(promoted), store.remove(action.draftId), { transactionId: cryptoRandomKey() };
     }
     case "sanity.action.document.unpublish": {
       requireDraftOf(action);
@@ -693,7 +735,7 @@ async function applyAction(store, action, hooks) {
         throw fakeError(
           `Cannot unpublish "${action.publishedId}": no published document with that _id exists. document.unpublish retracts a live published document into "${action.draftId}".`
         );
-      if (await hooks?.gate?.(published, "update"), await hooks?.guard?.("unpublish", published, null), store.get(action.draftId) === void 0) {
+      if (await hooks?.gate?.(published, "update"), store.get(action.draftId) === void 0) {
         const draft = promote({ ...published, _id: action.draftId });
         draft._createdAt = published._createdAt, store.put(draft);
       }
@@ -714,7 +756,7 @@ function requireRevisionMatch(documentId, actualRev, expectedRev) {
     );
 }
 async function applyActions(store, actions, hooks) {
-  const list = Array.isArray(actions) ? actions : [actions], snapshot = /* @__PURE__ */ new Map(), remember = (id) => {
+  const list = Array.isArray(actions) ? actions : [actions], snapshot = /* @__PURE__ */ new Map(), guardedIds = /* @__PURE__ */ new Set(), remember = (id) => {
     snapshot.has(id) || snapshot.set(id, store.get(id));
   };
   try {
@@ -750,13 +792,18 @@ async function applyActions(store, actions, hooks) {
           remember(a.versionId);
           break;
         case "sanity.action.document.publish":
+          remember(a.draftId), remember(a.publishedId), guardedIds.add(a.publishedId), guardedIds.add(a.draftId);
+          break;
         case "sanity.action.document.unpublish":
-          remember(a.draftId), remember(a.publishedId);
+          remember(a.draftId), remember(a.publishedId), guardedIds.add(a.draftId), guardedIds.add(a.publishedId);
           break;
       }
       last = await applyAction(store, a, hooks);
     }
-    return last;
+    const contexts = mutationContexts(
+      [...guardedIds].map((id) => ({ before: snapshot.get(id), after: store.get(id) }))
+    );
+    return await hooks?.guard?.(contexts), last;
   } catch (err) {
     for (const [id, doc] of snapshot)
       doc === void 0 ? store.remove(id) : store.put(doc);
@@ -1187,11 +1234,17 @@ function makeHandle(handleArgs) {
     access !== void 0 && await enforceWriteAccess({
       document,
       grants: access.grants,
-      permission,
+      permission: document._id !== void 0 && isSystemId(document._id) ? "manage" : permission,
       userId: access.currentUser.id
     });
-  }, guardGate = async (action, before, after) => {
-    mutationGuard !== void 0 && await mutationGuard({ action, before, after, identity: activeAccess()?.currentUser.id });
+  }, guardGate = async (contexts) => {
+    const identity = activeAccess()?.currentUser.id;
+    await enforceMutationGuards(
+      mutationGuard,
+      contexts.map((context) => ({ ...context, identity }))
+    );
+  }, guardOne = async (action, before, after) => {
+    await guardGate([{ action, before, after }]);
   }, canRead = async (document) => {
     const access = activeAccess();
     return access === void 0 ? !0 : canAccess({
@@ -1200,7 +1253,7 @@ function makeHandle(handleArgs) {
       permission: "read",
       userId: access.currentUser.id
     });
-  }, applyPatch = async (documentId, ops, ifRev) => {
+  }, applyPatch = async (documentId, ops, ifRev, options = {}) => {
     const existing = store.get(documentId);
     if (existing === void 0)
       throw fakeError(
@@ -1212,7 +1265,7 @@ function makeHandle(handleArgs) {
       _rev: cryptoRandomKey(),
       _updatedAt: now
     };
-    return await guardGate("update", existing, next), store.put(next), next;
+    return options.evaluateGuard !== !1 && await guardOne("update", existing, next), store.put(next), next;
   }, applyTransaction = async (mutations, txnOptions) => {
     const transactionId = txnOptions?.transactionId ?? cryptoRandomKey(), snapshot = /* @__PURE__ */ new Map(), touchedIds = [], operations = [], remember = (id) => {
       snapshot.has(id) || snapshot.set(id, store.get(id));
@@ -1227,17 +1280,13 @@ function makeHandle(handleArgs) {
               throw fakeError(
                 `create() failed: a document with _id "${promoted._id}" already exists in dataset "${projectId}:${dataset}". Use createOrReplace() to overwrite it, or createIfNotExists() to leave the existing one untouched.`
               );
-            await gate(promoted, "create"), await guardGate("create", null, promoted), store.put(promoted), touchedIds.push(promoted._id), operations.push({ id: promoted._id, operation: "create" });
+            await gate(promoted, "create"), store.put(promoted), touchedIds.push(promoted._id), operations.push({ id: promoted._id, operation: "create" });
             break;
           }
           case "createOrReplace": {
             remember(mut.doc._id);
             const promoted = promote2(mut.doc), existing = store.get(promoted._id);
-            await gate(existing ?? promoted, existing !== void 0 ? "update" : "create"), await guardGate(
-              existing !== void 0 ? "update" : "create",
-              existing ?? null,
-              promoted
-            );
+            await gate(existing ?? promoted, existing !== void 0 ? "update" : "create");
             const wasPresent = existing !== void 0;
             store.put(promoted), touchedIds.push(promoted._id), operations.push({ id: promoted._id, operation: wasPresent ? "update" : "create" });
             break;
@@ -1245,21 +1294,25 @@ function makeHandle(handleArgs) {
           case "createIfNotExists": {
             if (remember(mut.doc._id), store.get(mut.doc._id) === void 0) {
               const promoted = promote2(mut.doc);
-              await gate(promoted, "create"), await guardGate("create", null, promoted), store.put(promoted), touchedIds.push(promoted._id), operations.push({ id: promoted._id, operation: "create" });
+              await gate(promoted, "create"), store.put(promoted), touchedIds.push(promoted._id), operations.push({ id: promoted._id, operation: "create" });
             }
             break;
           }
           case "delete": {
             remember(mut.id);
             const existing = store.get(mut.id);
-            existing !== void 0 && await gate(existing, "update"), existing !== void 0 && await guardGate("delete", existing, null), store.remove(mut.id) && (touchedIds.push(mut.id), operations.push({ id: mut.id, operation: "delete" }));
+            existing !== void 0 && await gate(existing, "update"), store.remove(mut.id) && (touchedIds.push(mut.id), operations.push({ id: mut.id, operation: "delete" }));
             break;
           }
           case "patch": {
-            remember(mut.documentId), await applyPatch(mut.documentId, mut.ops, mut.ifRev), touchedIds.push(mut.documentId), operations.push({ id: mut.documentId, operation: "update" });
+            remember(mut.documentId), await applyPatch(mut.documentId, mut.ops, mut.ifRev, { evaluateGuard: !1 }), touchedIds.push(mut.documentId), operations.push({ id: mut.documentId, operation: "update" });
             break;
           }
         }
+      const contexts = mutationContexts(
+        [...snapshot].map(([id, before]) => ({ before, after: store.get(id) }))
+      );
+      await guardGate(contexts);
     } catch (error) {
       for (const [id, doc] of snapshot)
         doc === void 0 ? store.remove(id) : store.put(doc);
@@ -1324,7 +1377,7 @@ function makeHandle(handleArgs) {
           `create() failed: a document with _id "${doc._id}" already exists in dataset "${projectId}:${dataset}". Use createOrReplace() to overwrite it, or createIfNotExists() to leave the existing one untouched.`
         );
       const promoted = promote2(doc);
-      await gate(promoted, "create"), await guardGate("create", null, promoted);
+      await gate(promoted, "create"), await guardOne("create", null, promoted);
       const transactionId = opts?.transactionId ?? cryptoRandomKey();
       return opts?.dryRun !== !0 && (store.put(promoted), record(transactionId, [{ kind: "create", doc }], opts?.tag)), writeResult(
         [promoted],
@@ -1336,7 +1389,7 @@ function makeHandle(handleArgs) {
     createOrReplace: (doc, opts) => serializeWrite(backend, async () => {
       checkRevision(doc._id, opts?.ifRevisionId);
       const promoted = promote2(doc), existing = store.get(doc._id);
-      await gate(existing ?? promoted, existing !== void 0 ? "update" : "create"), await guardGate(existing !== void 0 ? "update" : "create", existing ?? null, promoted);
+      await gate(existing ?? promoted, existing !== void 0 ? "update" : "create"), await guardOne(existing !== void 0 ? "update" : "create", existing ?? null, promoted);
       const transactionId = opts?.transactionId ?? cryptoRandomKey();
       opts?.dryRun !== !0 && (store.put(promoted), record(transactionId, [{ kind: "createOrReplace", doc }], opts?.tag));
       const operation = existing !== void 0 ? "update" : "create";
@@ -1358,7 +1411,7 @@ function makeHandle(handleArgs) {
           opts
         );
       const promoted = promote2(doc);
-      return await gate(promoted, "create"), await guardGate("create", null, promoted), opts?.dryRun !== !0 && (store.put(promoted), record(transactionId, [{ kind: "createIfNotExists", doc }], opts?.tag)), writeResult(
+      return await gate(promoted, "create"), await guardOne("create", null, promoted), opts?.dryRun !== !0 && (store.put(promoted), record(transactionId, [{ kind: "createIfNotExists", doc }], opts?.tag)), writeResult(
         [promoted],
         [{ id: promoted._id, operation: "create" }],
         transactionId,
@@ -1368,7 +1421,7 @@ function makeHandle(handleArgs) {
     delete: (id, opts) => serializeWrite(backend, async () => {
       checkRevision(id, opts?.ifRevisionId);
       const existing = store.get(id);
-      existing !== void 0 && await gate(existing, "update"), existing !== void 0 && await guardGate("delete", existing, null);
+      existing !== void 0 && await gate(existing, "update"), existing !== void 0 && await guardOne("delete", existing, null);
       const transactionId = opts?.transactionId ?? cryptoRandomKey();
       let removed = existing;
       return opts?.dryRun !== !0 && (removed = store.remove(id), removed !== void 0 && record(transactionId, [{ kind: "delete", id }], opts?.tag)), opts?.returnDocuments === void 0 && opts?.returnFirst === void 0 ? removed !== void 0 ? { _id: id } : null : formatMutationResult(
@@ -1519,6 +1572,7 @@ function makeHandle(handleArgs) {
 }
 export {
   ERR_PREFIX,
+  GuardDeniedError,
   SUPPORTED_SURFACE,
   UNSUPPORTED_MEMBERS,
   WriteAccessDeniedError,