@xnetjs/core 0.0.2 → 0.0.3

package/dist/index.d.ts

@@ -699,7 +699,7 @@ interface AuthenticatedExpr {
 /**
  * How to determine if a user holds a role.
  */
-type RoleResolver = CreatorRoleResolver | PropertyRoleResolver | RelationRoleResolver;
+type RoleResolver = CreatorRoleResolver | PropertyRoleResolver | RelationRoleResolver | MembershipRoleResolver;
 /**
  * Serialized form of RoleResolver for JSON storage.
  */
@@ -712,6 +712,15 @@ type SerializedRoleResolver = {
     _tag: 'relation';
     relationName: string;
     targetRole: string;
+} | {
+    _tag: 'membership';
+    edgeSchema: string;
+    containerProp: string;
+    memberProp: string;
+    roleProp: string;
+    minRole: string;
+    roleOrder: string[];
+    parentProp?: string;
 };
 /**
  * Role held by the node's creator.
@@ -736,6 +745,34 @@ interface RelationRoleResolver {
     readonly relationName: string;
     readonly targetRole: string;
 }
+/**
+ * Role determined by membership edges that point at THIS node (a reverse-edge
+ * lookup the forward `relation`/`property` resolvers can't express).
+ *
+ * Given a container node (e.g. a Space), the subject holds this role when an
+ * edge node of `edgeSchema` exists whose `containerProp` references this node
+ * (or, when `parentProp` is set, any of its ancestors), whose `memberProp`
+ * holds the subject DID, and whose `roleProp` rank is `>= minRole` per the
+ * `roleOrder` ladder (least → most privileged). The ancestor walk is how
+ * membership cascades down a nested container tree without fanning grants out.
+ */
+interface MembershipRoleResolver {
+    readonly _tag: 'membership';
+    /** Schema IRI of the membership edge node (e.g. SpaceMembership). */
+    readonly edgeSchema: string;
+    /** Edge property that references the container node. */
+    readonly containerProp: string;
+    /** Edge property holding the member DID. */
+    readonly memberProp: string;
+    /** Edge property holding the member's role id. */
+    readonly roleProp: string;
+    /** Minimum role rung this resolver represents. */
+    readonly minRole: string;
+    /** Role ids ordered least → most privileged (for rank comparison). */
+    readonly roleOrder: readonly string[];
+    /** Container relation to walk for ancestor inheritance (e.g. `parent`). */
+    readonly parentProp?: string;
+}
 /**
  * Input for an authorization check.
  */
@@ -777,4 +814,4 @@ interface PolicyEvaluator {
 type DID = `did:key:${string}`;
 type DocumentPath = `xnet://${DID}/workspace/${string}/doc/${string}`;
 
-export { ALL_CAPABILITIES, AUTH_ACTIONS, type ActionKey, type AllowExpr, type AndExpr, type AuthAction, type AuthCheckInput, type AuthDecision, type AuthDenyReason, type AuthExpression, type AuthTrace, type AuthTraceStep, type AuthenticatedExpr, type AuthorizationDefinition, BOOTSTRAP_PEERS, type Capability, type ChainStatus, type Condition, type ContentChunk, type ContentId, type ContentResolver, type ContentTree, type CreatorRoleResolver, DEFAULT_SNAPSHOT_TRIGGERS, DEFAULT_STREAMING_OPTIONS, DHT_CONFIG, type DID, type DIDResolution, type DIDResolver, type DataSource, type DenyExpr, type DocumentLoad, type DocumentPath, type Fork, type Group, type IPCondition, type MerkleNode, type NotExpr, type OrExpr, type PeerLocation, type PermissionEvaluator, type PermissionGrant, type PolicyEvaluator, type PropertyRoleResolver, type PublicExpr, type Query, type QueryPlan, type QueryRequest, type QueryResponse, type QueryRouter, RESOLUTION_CACHE_CONFIG, type RelationRoleResolver, type ResolutionStrategy, type ResourceScope, type Role, type RoleKey, type RoleRefExpr, type RoleResolver, STANDARD_ROLES, type SchemaAction, type SerializedAuthExpression, type SerializedAuthorization, type SerializedRoleResolver, type SignedUpdate, type Snapshot, type SnapshotTriggers, type StreamingQueryOptions, type SubQuery, type TimeCondition, type UpdateVerifier, type VectorClock, buildMerkleTree, compareVectorClocks, createChunk, createContentId, deduplicatedUnion, detectFork, estimateQueryCost, evaluateCondition, getMostPermissiveCapability, hashContent, incrementVectorClock, isLocationFresh, isValidDID, isValidProgression, mergeStateVectors, mergeVectorClocks, parseContentId, parseDID, roleHasCapability, shouldCreateSnapshot, unionAggregate, verifyContent, verifyUpdateChain };
+export { ALL_CAPABILITIES, AUTH_ACTIONS, type ActionKey, type AllowExpr, type AndExpr, type AuthAction, type AuthCheckInput, type AuthDecision, type AuthDenyReason, type AuthExpression, type AuthTrace, type AuthTraceStep, type AuthenticatedExpr, type AuthorizationDefinition, BOOTSTRAP_PEERS, type Capability, type ChainStatus, type Condition, type ContentChunk, type ContentId, type ContentResolver, type ContentTree, type CreatorRoleResolver, DEFAULT_SNAPSHOT_TRIGGERS, DEFAULT_STREAMING_OPTIONS, DHT_CONFIG, type DID, type DIDResolution, type DIDResolver, type DataSource, type DenyExpr, type DocumentLoad, type DocumentPath, type Fork, type Group, type IPCondition, type MembershipRoleResolver, type MerkleNode, type NotExpr, type OrExpr, type PeerLocation, type PermissionEvaluator, type PermissionGrant, type PolicyEvaluator, type PropertyRoleResolver, type PublicExpr, type Query, type QueryPlan, type QueryRequest, type QueryResponse, type QueryRouter, RESOLUTION_CACHE_CONFIG, type RelationRoleResolver, type ResolutionStrategy, type ResourceScope, type Role, type RoleKey, type RoleRefExpr, type RoleResolver, STANDARD_ROLES, type SchemaAction, type SerializedAuthExpression, type SerializedAuthorization, type SerializedRoleResolver, type SignedUpdate, type Snapshot, type SnapshotTriggers, type StreamingQueryOptions, type SubQuery, type TimeCondition, type UpdateVerifier, type VectorClock, buildMerkleTree, compareVectorClocks, createChunk, createContentId, deduplicatedUnion, detectFork, estimateQueryCost, evaluateCondition, getMostPermissiveCapability, hashContent, incrementVectorClock, isLocationFresh, isValidDID, isValidProgression, mergeStateVectors, mergeVectorClocks, parseContentId, parseDID, roleHasCapability, shouldCreateSnapshot, unionAggregate, verifyContent, verifyUpdateChain };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xnetjs/core",
-  "version": "0.0.2",
+  "version": "0.0.3",
   "license": "MIT",
   "repository": {
     "type": "git",