@xnetjs/data 0.0.2 → 0.1.0

package/README.md

@@ -2,6 +2,12 @@
 
 Schema system, NodeStore, and Yjs CRDT engine for xNet. This is the central data package -- it defines how structured data and rich text documents are created, stored, and synced.
 
+> **Status:** Mixed
+> Stable entrypoints: `@xnetjs/data/schema`, `@xnetjs/data/store`, `@xnetjs/data/updates`, `@xnetjs/data/awareness`
+> Experimental entrypoints: `@xnetjs/data/database`, `@xnetjs/data/auth`
+
+The root `@xnetjs/data` barrel remains supported for compatibility, but new code should prefer the narrower entrypoints above. See [`docs/reference/api-lifecycle-matrix.md`](../../docs/reference/api-lifecycle-matrix.md) for the current matrix.
+
 ## Installation
 
 ```bash
@@ -18,6 +24,7 @@ pnpm add @xnetjs/data
 - **Blob service** -- File upload/download with content addressing
 - **Storage adapters** -- SQLite and in-memory NodeStore adapters
 - **Temp ID mapping** -- Optimistic creates with server-assigned IDs
+- **Query AST** -- Validated relation, aggregate, query-set, and saved-view descriptors
 
 ## Usage
 
@@ -95,6 +102,54 @@ const tasks = await store.list(TaskSchema)
 await store.remove(task.id)
 ```
 
+### Batch Writes
+
+Use `NodeStore.batchWrite()` for high-volume deterministic imports, restores, migrations, and other
+bulk workflows that already know stable node IDs. The store still signs one change per draft and
+preserves LWW semantics, but storage adapters can apply materialized nodes, changes, Lamport state,
+and touched secondary indexes in one owned batch.
+
+```mermaid
+sequenceDiagram
+  participant Caller as "Importer / migration"
+  participant Store as "NodeStore.batchWrite()"
+  participant Storage as "NodeStorageAdapter.applyNodeBatch()"
+  participant SQLite as "SQLite transaction"
+
+  Caller->>Store: deterministic drafts + policy
+  Store->>Storage: batch preflight
+  Store->>Store: sign changes + materialize nodes
+  Store->>Storage: apply materialized nodes and changes
+  Storage->>SQLite: write nodes, properties, changes, touched indexes
+  Store-->>Caller: counters, timings, affected schemas
+```
+
+```typescript
+const result = await store.batchWrite({
+  kind: 'deterministic-import',
+  drafts: [
+    {
+      id: 'social:content:example',
+      schemaId: 'xnet://xnet.fyi/social/Content',
+      properties: { title: 'Example post', platform: 'youtube' }
+    }
+  ],
+  policy: {
+    indexMode: 'touched',
+    notificationMode: 'batch',
+    syncMode: 'defer'
+  }
+})
+
+console.log(result.created, result.updated, result.timings.applyMs, result.storage)
+```
+
+`indexMode: 'touched'` is the import default. It avoids whole-schema rebuilds by reindexing only the
+nodes changed by the batch. `notificationMode: 'batch'` coalesces live reload work. Deferred sync is
+an advisory hint for runtimes that can coalesce outbound replication.
+`importDeterministicNodes()` remains available for existing callers and returns the same storage
+counters and phase timings while preserving its detailed `changes` array.
+
 ### Yjs Documents
 
 ```typescript
@@ -120,6 +175,62 @@ applySignedUpdate(docB, signed)
 mergeDocuments(docA, docB)
 ```
 
+### Canonical Query AST
+
+`useQuery()` remains the stable React read API. Advanced relation includes, aggregate reads, dashboards, and saved views are represented in `@xnetjs/data` as a canonical AST before they become public hook shortcuts.
+
+```mermaid
+flowchart LR
+    Helpers["queryOperators(), from(), count()"]
+    AST["QueryAST"]
+    Validate["validateQueryAST()"]
+    Plan["planQueryASTAggregates()"]
+    Indexes["getQueryASTRelationIndexRequirements()"]
+    Saved["SavedViewDescriptor / SavedViewSchema"]
+
+    Helpers --> AST
+    AST --> Validate
+    Validate --> Plan
+    Validate --> Indexes
+    AST --> Saved
+```
+
+```typescript
+import {
+  PageSchema,
+  TaskSchema,
+  count,
+  countDistinct,
+  defineNodeQueryAST,
+  defineSavedViewDescriptor,
+  from,
+  queryOperators,
+  validateSavedViewDescriptor
+} from '@xnetjs/data'
+
+const task = queryOperators<(typeof TaskSchema)['_properties']>()
+
+const query = defineNodeQueryAST(PageSchema, {
+  include: {
+    tasks: from(TaskSchema, 'page', {
+      where: task.neq('status', 'done'),
+      page: { first: 25, count: 'exact' },
+      aggregates: [count(), countDistinct('assignee', 'assigneeCount')]
+    })
+  }
+})
+
+const saved = defineSavedViewDescriptor({
+  title: 'Open task dashboard',
+  scope: 'workspace',
+  query
+})
+
+const validation = validateSavedViewDescriptor(saved)
+```
+
+The AST helpers only construct and validate descriptors. Execution of relation expansion, aggregate pushdown, and future `useFind()` pattern queries should go through planner gates before becoming stable public APIs.
+
 ## Architecture
 
 ```mermaid
@@ -206,6 +317,7 @@ All telemetry respects user consent settings and privacy buckets (no exact value
 | `schema/node.ts`          | FlatNode type (flattened properties)   |
 | `schema/registry.ts`      | Schema registry                        |
 | `store/store.ts`          | NodeStore engine                       |
+| `store/query-ast.ts`      | Canonical query AST and planner gates  |
 | `store/sqlite-adapter.ts` | SQLite NodeStore adapter (recommended) |
 | `store/memory-adapter.ts` | In-memory NodeStore adapter            |
 | `store/tempids.ts`        | Temp ID mapping for optimistic creates |

package/dist/account-MWNCH4GJ.js

@@ -0,0 +1,12 @@
+import {
+  ACCOUNT_SCHEMA_IRI,
+  AccountSchema
+} from "./chunk-XMSKJ5PV.js";
+import "./chunk-OCMSAKWV.js";
+import "./chunk-T5AZAOG5.js";
+import "./chunk-EBNMV2VO.js";
+import "./chunk-RL64OJJ5.js";
+export {
+  ACCOUNT_SCHEMA_IRI,
+  AccountSchema
+};

package/dist/account-ledger-R2GAFJL6.js

@@ -0,0 +1,38 @@
+import {
+  ACCOUNT_RECORD_SCHEMA_IRI,
+  AccountRecordSchema,
+  DEVICE_RECORD_SCHEMA_IRI,
+  DeviceRecordSchema,
+  RECOVERY_RECORD_SCHEMA_IRI,
+  REVOCATION_RECORD_SCHEMA_IRI,
+  RecoveryRecordSchema,
+  RevocationRecordSchema,
+  accountRecordId,
+  deviceRecipientExpander,
+  deviceRecordId,
+  isDeviceAuthorized,
+  recoveryRecordId,
+  resolveActiveDevices,
+  revocationRecordId,
+  revokedSubjects
+} from "./chunk-KQUALW4O.js";
+import "./chunk-EBNMV2VO.js";
+import "./chunk-RL64OJJ5.js";
+export {
+  ACCOUNT_RECORD_SCHEMA_IRI,
+  AccountRecordSchema,
+  DEVICE_RECORD_SCHEMA_IRI,
+  DeviceRecordSchema,
+  RECOVERY_RECORD_SCHEMA_IRI,
+  REVOCATION_RECORD_SCHEMA_IRI,
+  RecoveryRecordSchema,
+  RevocationRecordSchema,
+  accountRecordId,
+  deviceRecipientExpander,
+  deviceRecordId,
+  isDeviceAuthorized,
+  recoveryRecordId,
+  resolveActiveDevices,
+  revocationRecordId,
+  revokedSubjects
+};

package/dist/auth/index.d.ts

@@ -0,0 +1,420 @@
+import { AllowExpr, DenyExpr, AuthExpression, AndExpr, OrExpr, NotExpr, PublicExpr, AuthenticatedExpr, CreatorRoleResolver, PropertyRoleResolver, RelationRoleResolver, MembershipRoleResolver, AuthorizationDefinition, SerializedAuthorization, SerializedAuthExpression, DID } from '@xnetjs/core';
+export { AUTH_ACTIONS, AllowExpr, AndExpr, AuthAction, AuthCheckInput, AuthDecision, AuthDenyReason, AuthExpression, AuthTrace, AuthTraceStep, AuthenticatedExpr, AuthorizationDefinition, CreatorRoleResolver, DenyExpr, MembershipRoleResolver, NotExpr, OrExpr, PolicyEvaluator, PropertyRoleResolver, PublicExpr, RelationRoleResolver, RoleRefExpr, RoleResolver, SerializedAuthExpression, SerializedAuthorization, SerializedRoleResolver } from '@xnetjs/core';
+import { E as PropertyDefinition, a as Schema, h as NodeState, S as SchemaIRI } from '../types-S-BJAKyK.js';
+export { aX as DEFAULT_OFFLINE_POLICY, aV as GRANT_SCHEMA_IRI, b1 as Grant, w as GrantIndex, b6 as GrantIndexOptions, b5 as GrantIndexStore, b0 as GrantInput, b4 as GrantNode, aU as GrantRateLimiter, b9 as GrantRateLimiterOptions, O as OfflineAuthPolicy, b8 as RevocationConfig, b7 as RevocationConsistency, aT as StoreAuth, e as StoreAuthAPI, b2 as StoreAuthError, b3 as StoreAuthErrorCode, a$ as StoreAuthKeyManager, aZ as StoreAuthOptions, a_ as StoreAuthStore, aW as isGrantActive, aY as mergeOfflinePolicy } from '../types-S-BJAKyK.js';
+export { A as ActionPermission, m as AuthDecisionEvent, b as DecisionCache, g as DecisionCacheOptions, D as DefaultPolicyEvaluator, j as DefaultPolicyEvaluatorOptions, a as DefaultRoleResolver, i as DefaultRoleResolverOptions, k as DefinedSchemaLike, G as GrantExpirationCleaner, o as GrantExpirationCleanerOptions, n as GrantExpirationStore, H as HubPolicy, N as NodeStoreReader, P as PermissionMatrix, l as RevalidationEvent, R as RoleSummary, S as SchemaRegistryReader, c as buildPermissionMatrix, f as createPolicyEvaluator, d as describeRoleResolver, e as evaluateExpression, h as hubActionsForSpaceRole, s as schemaToHubPolicy } from '../grant-expiration-cleaner-CY6BcmlR.js';
+import { PublicKeyResolver } from '@xnetjs/crypto';
+import '@xnetjs/sqlite';
+import '@xnetjs/sync';
+import '../registry-DunPv__d.js';
+
+/**
+ * Authorization expression builders for schema definitions.
+ *
+ * These functions create typed AST nodes for authorization rules.
+ *
+ * @example
+ * ```typescript
+ * import { allow, deny, and, or, not, role, PUBLIC, AUTHENTICATED } from '@xnetjs/data/auth'
+ *
+ * const TaskSchema = defineSchema({
+ *   // ...
+ *   authorization: {
+ *     roles: {
+ *       owner: role.creator(),
+ *       editor: role.property('editors'),
+ *       admin: role.relation('project', 'admin')
+ *     },
+ *     actions: {
+ *       read: allow('editor', 'admin', 'owner'),
+ *       write: allow('editor', 'admin', 'owner'),
+ *       delete: allow('admin', 'owner'),
+ *       share: allow('admin', 'owner')
+ *     }
+ *   }
+ * })
+ * ```
+ */
+
+/**
+ * Allow access if the subject has any of the specified roles.
+ *
+ * @example
+ * ```typescript
+ * read: allow('viewer', 'editor', 'admin', 'owner')
+ * ```
+ */
+declare function allow(...roles: string[]): AllowExpr;
+/**
+ * Deny access if the subject has any of the specified roles.
+ * Deny ALWAYS takes precedence over allow.
+ *
+ * @example
+ * ```typescript
+ * read: and(allow('member'), deny('banned'))
+ * ```
+ */
+declare function deny(...roles: string[]): DenyExpr;
+/**
+ * Logical AND - all sub-expressions must be true.
+ *
+ * @example
+ * ```typescript
+ * write: and(allow('editor'), deny('readonly'))
+ * ```
+ */
+declare function and(...exprs: AuthExpression[]): AndExpr;
+/**
+ * Logical OR - any sub-expression must be true.
+ *
+ * @example
+ * ```typescript
+ * read: or(allow('owner'), PUBLIC)
+ * ```
+ */
+declare function or(...exprs: AuthExpression[]): OrExpr;
+/**
+ * Logical NOT - negate the sub-expression.
+ *
+ * @example
+ * ```typescript
+ * write: and(AUTHENTICATED, not(allow('banned')))
+ * ```
+ */
+declare function not(expr: AuthExpression): NotExpr;
+/**
+ * Public access - always allows access.
+ * Use for read-only public content.
+ *
+ * @example
+ * ```typescript
+ * read: PUBLIC
+ * ```
+ */
+declare const PUBLIC: PublicExpr;
+/**
+ * Authenticated access - allows any authenticated user.
+ * Use for open-but-not-anonymous content.
+ *
+ * @example
+ * ```typescript
+ * read: AUTHENTICATED
+ * write: AUTHENTICATED
+ * ```
+ */
+declare const AUTHENTICATED: AuthenticatedExpr;
+/**
+ * Role resolver builders.
+ *
+ * @example
+ * ```typescript
+ * roles: {
+ *   owner: role.creator(),
+ *   assignee: role.property('assignee'),
+ *   admin: role.relation('project', 'admin')
+ * }
+ * ```
+ */
+declare const role: {
+    /**
+     * Role held by the node's creator.
+     * The DID in `createdBy` holds this role.
+     */
+    creator(): CreatorRoleResolver;
+    /**
+     * Role determined by a person property on the node.
+     * The DID(s) in that property hold this role.
+     *
+     * @param propertyName - Name of the person/person[] property
+     */
+    property(propertyName: string): PropertyRoleResolver;
+    /**
+     * Role inherited from a related node.
+     * Users who hold `targetRole` on the related node hold this role.
+     *
+     * @param relationName - Name of the relation property
+     * @param targetRole - Role to check on the related node
+     */
+    relation(relationName: string, targetRole: string): RelationRoleResolver;
+    /**
+     * Role determined by membership edges that reference THIS node.
+     *
+     * Unlike `relation` (which follows a forward relation) this is a reverse-edge
+     * lookup: the subject holds the role when a `config.edgeSchema` edge points at
+     * this node (or, when `parentProp` is set, any ancestor) with the subject as
+     * `memberProp` and a `roleProp` rank `>= minRole`. This is how Space
+     * membership cascades down a nested container tree.
+     *
+     * @example
+     * ```typescript
+     * spaceMember: role.members({
+     *   edgeSchema: SPACE_MEMBERSHIP_SCHEMA_IRI, containerProp: 'space',
+     *   memberProp: 'member', roleProp: 'role', minRole: 'member',
+     *   roleOrder: SPACE_ROLES, parentProp: 'parent'
+     * })
+     * ```
+     */
+    members(config: {
+        edgeSchema: string;
+        containerProp: string;
+        memberProp: string;
+        roleProp: string;
+        minRole: string;
+        roleOrder: readonly string[];
+        parentProp?: string;
+    }): MembershipRoleResolver;
+};
+/**
+ * Alias for role.relation() for use in authorization expressions.
+ * @deprecated Use role.relation() instead
+ */
+declare const relation: (relationName: string, targetRole: string) => RelationRoleResolver;
+
+/**
+ * Authorization schema validation.
+ *
+ * Validates that authorization blocks are well-formed:
+ * - Role references in actions exist in the roles definition
+ * - Property-based roles reference existing person properties
+ * - Expression depth limits are enforced
+ */
+
+/**
+ * Result of authorization schema validation.
+ */
+interface AuthValidationResult {
+    valid: boolean;
+    errors: AuthValidationError[];
+}
+/**
+ * A single validation error.
+ */
+interface AuthValidationError {
+    /** Error code for programmatic handling */
+    code: AuthSchemaErrorCode;
+    /** Human-readable error message */
+    message: string;
+    /** JSON path to the error location */
+    path: string;
+}
+/**
+ * Error codes for authorization schema validation.
+ */
+type AuthSchemaErrorCode = 'AUTH_SCHEMA_INVALID_ROLE_REF' | 'AUTH_SCHEMA_INVALID_ACTION_REF' | 'AUTH_SCHEMA_INVALID_RELATION_PATH' | 'AUTH_SCHEMA_ROLE_CYCLE' | 'AUTH_SCHEMA_EXPR_LIMIT_EXCEEDED' | 'AUTH_SCHEMA_UNSAFE_PUBLIC_MUTATION' | 'AUTH_SCHEMA_INVALID_FIELD_REF' | 'AUTH_SCHEMA_INVALID_PUBLIC_PROP';
+/**
+ * Roles that are always available without definition.
+ */
+declare const BUILTIN_ROLES: readonly ["owner"];
+/**
+ * Extract all role references from an authorization expression.
+ */
+declare function extractRoleRefs(expr: AuthExpression): string[];
+/**
+ * Count the number of nodes in an expression tree.
+ */
+declare function countExpressionNodes(expr: AuthExpression): number;
+/**
+ * Check if an expression allows public access.
+ */
+declare function hasPublicAccess(expr: AuthExpression): boolean;
+/**
+ * Maximum allowed nodes in an expression tree.
+ */
+declare const MAX_EXPRESSION_NODES = 50;
+/**
+ * Validate an authorization definition against property definitions.
+ *
+ * Checks:
+ * 1. All role references in action expressions exist in roles
+ * 2. Property-based roles reference existing person properties
+ * 3. Relation-based roles reference existing relation properties
+ * 4. publicProps reference existing properties
+ * 5. Expression depth limits are enforced
+ * 6. Write/delete/share actions don't use PUBLIC (unsafe)
+ */
+declare function validateAuthorization(auth: AuthorizationDefinition, properties: Record<string, PropertyDefinition>): AuthValidationResult;
+
+/**
+ * Serialization and deserialization of authorization definitions.
+ *
+ * Authorization blocks in schemas need to be serialized to JSON for storage
+ * and deserialized back to typed objects for evaluation.
+ */
+
+/**
+ * Serialize an AuthExpression to its JSON-serializable form.
+ */
+declare function serializeAuthExpression(expr: AuthExpression): SerializedAuthExpression;
+/**
+ * Deserialize a SerializedAuthExpression back to its typed form.
+ */
+declare function deserializeAuthExpression(serialized: SerializedAuthExpression): AuthExpression;
+/**
+ * Serialize an AuthorizationDefinition to its JSON-serializable form.
+ */
+declare function serializeAuthorization(auth: AuthorizationDefinition): SerializedAuthorization;
+/**
+ * Deserialize a SerializedAuthorization back to its typed form.
+ */
+declare function deserializeAuthorization(serialized: SerializedAuthorization): AuthorizationDefinition;
+
+/**
+ * Authorization presets - common authorization patterns as reusable factories.
+ *
+ * @example
+ * ```typescript
+ * import { presets } from '@xnetjs/data/auth'
+ *
+ * const NoteSchema = defineSchema({
+ *   name: 'Note',
+ *   namespace: 'xnet://myapp/',
+ *   properties: { ... },
+ *   authorization: presets.private()
+ * })
+ *
+ * const PublicArticleSchema = defineSchema({
+ *   name: 'Article',
+ *   namespace: 'xnet://myapp/',
+ *   properties: { ... },
+ *   authorization: presets.publicRead()
+ * })
+ * ```
+ */
+
+/**
+ * Authorization presets for common patterns.
+ */
+declare const presets: {
+    /**
+     * Private - only the creator can access.
+     *
+     * Use for personal notes, private documents, etc.
+     */
+    private: () => AuthorizationDefinition;
+    /**
+     * Public read - anyone can read, only creator can write.
+     *
+     * Use for published content, blog posts, etc.
+     */
+    publicRead: () => AuthorizationDefinition;
+    /**
+     * Collaborative - roles inherited from a parent relation.
+     *
+     * Use for items within a workspace/project that inherits permissions.
+     *
+     * @param parentRelation - Name of the relation property to the parent node
+     */
+    collaborative: (parentRelation: string) => AuthorizationDefinition;
+    /**
+     * Open - any authenticated user can read/write, only creator can delete.
+     *
+     * Use for wiki-style collaborative content.
+     */
+    open: () => AuthorizationDefinition;
+    /**
+     * Team-based - permissions based on a team/editors property.
+     *
+     * @param editorsProperty - Name of the person[] property containing editors
+     */
+    team: (editorsProperty: string) => AuthorizationDefinition;
+};
+
+/**
+ * Authorization mode helpers for schema compatibility.
+ */
+
+type AuthMode = 'legacy' | 'compat' | 'enforce';
+/**
+ * Determine authorization mode for a schema.
+ */
+declare function getAuthMode(schema: Schema): AuthMode;
+/**
+ * Warn developers when a schema has no authorization block.
+ */
+declare function warnLegacySchema(schema: Schema): void;
+
+declare const PUBLIC_CONTENT_KEY: Uint8Array<ArrayBuffer>;
+declare const PUBLIC_RECIPIENT = "PUBLIC";
+type Recipient = DID | typeof PUBLIC_RECIPIENT;
+interface GrantRecordLike {
+    id: string;
+    properties: Record<string, unknown>;
+}
+interface GrantIndexReader {
+    findGrantsForResource(resourceId: string): GrantRecordLike[];
+}
+interface RecipientDependencies {
+    getNode: (nodeId: string) => Promise<NodeState | null>;
+    getSchema?: (schemaId: SchemaIRI) => Promise<Schema | undefined>;
+    /** Lists all nodes of a schema — required to expand membership-edge roles. */
+    listNodes?: (schemaId: string) => Promise<NodeState[]>;
+    grantIndex?: GrantIndexReader;
+    maxDepth?: number;
+    /**
+     * Account/device re-wrap (exploration 0243, P2.3). When set, each DID recipient is
+     * expanded to every active device of the account it belongs to, so a user's content
+     * is decryptable on all their devices. Build it with `deviceRecipientExpander` from
+     * the ledger records. Omitted → recipients are exactly the resolved DIDs (no change).
+     */
+    expandDeviceRecipients?: (did: DID) => readonly string[];
+}
+declare function computeRecipients(schema: Schema, node: NodeState, dependencies: RecipientDependencies): Promise<Recipient[]>;
+declare function hasRecipientsChanged(previous: Recipient[], next: Recipient[]): boolean;
+declare function canTransitionToPublic(readExpr: AuthExpression | undefined): boolean;
+
+interface AuthMigrationDependencies extends RecipientDependencies {
+    encryptExistingNode: (node: NodeState, schema: Schema) => Promise<void>;
+    rotateContentKeyForNode: (nodeId: string, recipients: Recipient[]) => Promise<void>;
+}
+declare function handleAuthMigration(oldSchema: Schema, newSchema: Schema, node: NodeState, dependencies: AuthMigrationDependencies): Promise<void>;
+
+interface EncryptionLayer {
+    encryptAndStoreNode(node: NodeState, recipientKeys: Map<DID, Uint8Array>): Promise<void>;
+}
+interface MigrationOptions {
+    batchSize?: number;
+    onProgress?: (done: number, total: number) => void;
+}
+interface MigrationError {
+    nodeId: string;
+    error: string;
+}
+interface MigrationResult {
+    total: number;
+    migrated: number;
+    failed: number;
+    errors: MigrationError[];
+}
+interface AuthMigratorStore {
+    get(nodeId: string): Promise<NodeState | null>;
+    list(options?: {
+        schemaId?: string;
+        includeDeleted?: boolean;
+    }): Promise<NodeState[]>;
+}
+interface AuthMigratorSchemaRegistry {
+    get(schemaId: SchemaIRI): Promise<{
+        schema: Schema;
+    } | undefined>;
+}
+declare class AuthMigrator {
+    private readonly store;
+    private readonly schemaRegistry;
+    private readonly publicKeyResolver;
+    private readonly grantIndex;
+    private readonly encryptionLayer;
+    constructor(store: AuthMigratorStore, schemaRegistry: AuthMigratorSchemaRegistry, publicKeyResolver: PublicKeyResolver, grantIndex: GrantIndexReader, encryptionLayer: EncryptionLayer);
+    migrateSchema(schemaIri: SchemaIRI, options?: MigrationOptions): Promise<MigrationResult>;
+    private resolveSchema;
+}
+
+interface AuthFeatureFlags {
+    enforceLocal: boolean;
+    enforceRemote: boolean;
+    enforceHub: boolean;
+    enforceEncryption: boolean;
+    logDecisions: boolean;
+}
+declare const AUTH_FEATURE_FLAGS: AuthFeatureFlags;
+
+export { AUTHENTICATED, AUTH_FEATURE_FLAGS, type AuthFeatureFlags, type AuthMigrationDependencies, AuthMigrator, type AuthMigratorSchemaRegistry, type AuthMigratorStore, type AuthMode, type AuthSchemaErrorCode, type AuthValidationError, type AuthValidationResult, BUILTIN_ROLES, type EncryptionLayer, type GrantIndexReader, type GrantRecordLike, MAX_EXPRESSION_NODES, type MigrationError, type MigrationOptions, type MigrationResult, PUBLIC, PUBLIC_CONTENT_KEY, PUBLIC_RECIPIENT, type Recipient, type RecipientDependencies, allow, and, canTransitionToPublic, computeRecipients, countExpressionNodes, deny, deserializeAuthExpression, deserializeAuthorization, extractRoleRefs, getAuthMode, handleAuthMigration, hasPublicAccess, hasRecipientsChanged, not, or, presets, relation, role, serializeAuthExpression, serializeAuthorization, validateAuthorization, warnLegacySchema };