@xnetjs/data 0.0.2 → 0.1.0

package/dist/{chunk-SZC345Z2.js → chunk-RL64OJJ5.js}

@@ -1,255 +1,236 @@
-// src/schema/node.ts
-import { nanoid } from "nanoid";
-var DEFAULT_SCHEMA_VERSION = "1.0.0";
-function parseSchemaIRI(iri) {
-  const match = iri.match(/^(xnet:\/\/[^/]+\/)([^@]+)(?:@(.+))?$/);
-  if (!match) {
-    return {
-      iri,
-      baseIRI: iri,
-      namespace: "",
-      name: iri,
-      version: DEFAULT_SCHEMA_VERSION,
-      hasExplicitVersion: false
-    };
-  }
-  const [, namespace, name, version] = match;
-  const hasExplicitVersion = version !== void 0;
-  const resolvedVersion = version ?? DEFAULT_SCHEMA_VERSION;
-  const baseIRI = `${namespace}${name}`;
-  return {
-    iri: hasExplicitVersion ? iri : `${baseIRI}@${resolvedVersion}`,
-    baseIRI,
-    namespace,
-    name,
-    version: resolvedVersion,
-    hasExplicitVersion
-  };
+// src/auth/index.ts
+import { AUTH_ACTIONS as AUTH_ACTIONS2 } from "@xnetjs/core";
+
+// src/auth/builders.ts
+function allow(...roles) {
+  return { _tag: "allow", roles };
 }
-function normalizeSchemaIRI(iri) {
-  const parsed = parseSchemaIRI(iri);
-  return parsed.iri;
+function deny(...roles) {
+  return { _tag: "deny", roles };
 }
-function getBaseSchemaIRI(iri) {
-  return parseSchemaIRI(iri).baseIRI;
+function and(...exprs) {
+  return { _tag: "and", exprs };
 }
-function isNode(value) {
-  if (typeof value !== "object" || value === null) return false;
-  const obj = value;
-  return typeof obj.id === "string" && typeof obj.schemaId === "string" && obj.schemaId.startsWith("xnet://") && typeof obj.createdAt === "number" && typeof obj.createdBy === "string" && obj.createdBy.startsWith("did:key:");
+function or(...exprs) {
+  return { _tag: "or", exprs };
 }
-function createNodeId(length) {
-  return nanoid(length);
+function not(expr) {
+  return { _tag: "not", expr };
 }
-
-// src/auth/grants.ts
-var GRANT_SCHEMA_IRI = "xnet://xnet.fyi/Grant";
-function isGrantActive(grant, now = Date.now()) {
-  const revokedAt = asNumber(grant.properties.revokedAt);
-  if (revokedAt > 0) {
-    return false;
+var PUBLIC = { _tag: "public" };
+var AUTHENTICATED = { _tag: "authenticated" };
+var role = {
+  /**
+   * Role held by the node's creator.
+   * The DID in `createdBy` holds this role.
+   */
+  creator() {
+    return { _tag: "creator" };
+  },
+  /**
+   * Role determined by a person property on the node.
+   * The DID(s) in that property hold this role.
+   *
+   * @param propertyName - Name of the person/person[] property
+   */
+  property(propertyName) {
+    return { _tag: "property", propertyName };
+  },
+  /**
+   * Role inherited from a related node.
+   * Users who hold `targetRole` on the related node hold this role.
+   *
+   * @param relationName - Name of the relation property
+   * @param targetRole - Role to check on the related node
+   */
+  relation(relationName, targetRole) {
+    return { _tag: "relation", relationName, targetRole };
+  },
+  /**
+   * Role determined by membership edges that reference THIS node.
+   *
+   * Unlike `relation` (which follows a forward relation) this is a reverse-edge
+   * lookup: the subject holds the role when a `config.edgeSchema` edge points at
+   * this node (or, when `parentProp` is set, any ancestor) with the subject as
+   * `memberProp` and a `roleProp` rank `>= minRole`. This is how Space
+   * membership cascades down a nested container tree.
+   *
+   * @example
+   * ```typescript
+   * spaceMember: role.members({
+   *   edgeSchema: SPACE_MEMBERSHIP_SCHEMA_IRI, containerProp: 'space',
+   *   memberProp: 'member', roleProp: 'role', minRole: 'member',
+   *   roleOrder: SPACE_ROLES, parentProp: 'parent'
+   * })
+   * ```
+   */
+  members(config) {
+    return {
+      _tag: "membership",
+      edgeSchema: config.edgeSchema,
+      containerProp: config.containerProp,
+      memberProp: config.memberProp,
+      roleProp: config.roleProp,
+      minRole: config.minRole,
+      roleOrder: config.roleOrder,
+      parentProp: config.parentProp
+    };
   }
-  const expiresAt = asNumber(grant.properties.expiresAt);
-  if (expiresAt > 0 && expiresAt <= now) {
-    return false;
+};
+var relation = role.relation;
+
+// src/auth/validate.ts
+var BUILTIN_ROLES = ["owner"];
+function extractRoleRefs(expr) {
+  const roles = [];
+  function visit(e) {
+    switch (e._tag) {
+      case "allow":
+      case "deny":
+        roles.push(...e.roles);
+        break;
+      case "and":
+      case "or":
+        for (const sub of e.exprs) visit(sub);
+        break;
+      case "not":
+        visit(e.expr);
+        break;
+      case "roleRef":
+        roles.push(e.role);
+        break;
+      case "public":
+      case "authenticated":
+        break;
+    }
   }
-  return true;
+  visit(expr);
+  return roles;
 }
-var GrantIndex = class {
-  constructor(store, options = {}) {
-    this.store = store;
-    this.schemaId = options.schemaId ?? GRANT_SCHEMA_IRI;
-    this.clock = options.clock ?? Date.now;
-  }
-  byResourceAndGrantee = /* @__PURE__ */ new Map();
-  byResource = /* @__PURE__ */ new Map();
-  grantsById = /* @__PURE__ */ new Map();
-  unsubscribe = null;
-  schemaId;
-  clock;
-  async initialize() {
-    const grants = await this.loadGrantNodes();
-    for (const grant of grants) {
-      this.indexGrant(grant);
-    }
-    this.unsubscribe = this.store.subscribe((event) => {
-      const node = event.node;
-      if (!node || !this.isGrantSchema(node.schemaId)) {
-        return;
-      }
-      this.removeGrant(node.id);
-      if (!node.deleted) {
-        this.indexGrant(node);
+function countExpressionNodes(expr) {
+  let count = 1;
+  switch (expr._tag) {
+    case "and":
+    case "or":
+      for (const sub of expr.exprs) {
+        count += countExpressionNodes(sub);
       }
-    });
+      break;
+    case "not":
+      count += countExpressionNodes(expr.expr);
+      break;
   }
-  findGrants(resource, grantee) {
-    const grantsByGrantee = this.byResourceAndGrantee.get(resource);
-    if (!grantsByGrantee) return [];
-    const grantIds = grantsByGrantee.get(grantee);
-    if (!grantIds) return [];
-    const now = this.clock();
-    const grants = [];
-    for (const grantId of grantIds) {
-      const grant = this.grantsById.get(grantId);
-      if (grant && isGrantActive(grant, now)) {
-        grants.push(grant);
+  return count;
+}
+function hasPublicAccess(expr) {
+  if (expr._tag === "public") return true;
+  if (expr._tag === "or") return expr.exprs.some(hasPublicAccess);
+  if (expr._tag === "and") return expr.exprs.every(hasPublicAccess);
+  if (expr._tag === "not") return false;
+  return false;
+}
+var MAX_EXPRESSION_NODES = 50;
+function validateAuthorization(auth, properties) {
+  const errors = [];
+  for (const [actionName, expr] of Object.entries(auth.actions)) {
+    const referencedRoles = extractRoleRefs(expr);
+    for (const ref of referencedRoles) {
+      if (!(ref in auth.roles) && !BUILTIN_ROLES.includes(ref)) {
+        errors.push({
+          code: "AUTH_SCHEMA_INVALID_ROLE_REF",
+          message: `Action '${actionName}' references unknown role '${ref}'`,
+          path: `authorization.actions.${actionName}`
+        });
       }
     }
-    return grants;
   }
-  findGrantsForResource(resource) {
-    const grantIds = this.byResource.get(resource);
-    if (!grantIds) return [];
-    const now = this.clock();
-    const grants = [];
-    for (const grantId of grantIds) {
-      const grant = this.grantsById.get(grantId);
-      if (grant && isGrantActive(grant, now)) {
-        grants.push(grant);
+  for (const [roleName, resolver] of Object.entries(auth.roles)) {
+    if (resolver._tag === "property") {
+      const propDef = properties[resolver.propertyName];
+      if (!propDef) {
+        errors.push({
+          code: "AUTH_SCHEMA_INVALID_RELATION_PATH",
+          message: `Role '${roleName}' references non-existent property '${resolver.propertyName}'`,
+          path: `authorization.roles.${roleName}`
+        });
+      } else if (propDef.type !== "person") {
+        errors.push({
+          code: "AUTH_SCHEMA_INVALID_RELATION_PATH",
+          message: `Role '${roleName}' references property '${resolver.propertyName}' which is not a person type (got '${propDef.type}')`,
+          path: `authorization.roles.${roleName}`
+        });
       }
     }
-    return grants;
-  }
-  findAllGrantsForResource(resource) {
-    const grantIds = this.byResource.get(resource);
-    if (!grantIds) return [];
-    const grants = [];
-    for (const grantId of grantIds) {
-      const grant = this.grantsById.get(grantId);
-      if (grant) {
-        grants.push(grant);
+    if (resolver._tag === "relation") {
+      const propDef = properties[resolver.relationName];
+      if (!propDef) {
+        errors.push({
+          code: "AUTH_SCHEMA_INVALID_RELATION_PATH",
+          message: `Role '${roleName}' references non-existent relation '${resolver.relationName}'`,
+          path: `authorization.roles.${roleName}`
+        });
+      } else if (propDef.type !== "relation") {
+        errors.push({
+          code: "AUTH_SCHEMA_INVALID_RELATION_PATH",
+          message: `Role '${roleName}' references property '${resolver.relationName}' which is not a relation type (got '${propDef.type}')`,
+          path: `authorization.roles.${roleName}`
+        });
       }
     }
-    return grants;
-  }
-  findGrantsForGrantee(grantee) {
-    const grants = [];
-    const now = this.clock();
-    for (const grantsByGrantee of this.byResourceAndGrantee.values()) {
-      const grantIds = grantsByGrantee.get(grantee);
-      if (!grantIds) continue;
-      for (const grantId of grantIds) {
-        const grant = this.grantsById.get(grantId);
-        if (grant && isGrantActive(grant, now)) {
-          grants.push(grant);
-        }
+    if (resolver._tag === "membership") {
+      if (!resolver.roleOrder.includes(resolver.minRole)) {
+        errors.push({
+          code: "AUTH_SCHEMA_INVALID_ROLE_REF",
+          message: `Role '${roleName}' membership minRole '${resolver.minRole}' is not in its roleOrder`,
+          path: `authorization.roles.${roleName}`
+        });
       }
     }
-    return grants;
-  }
-  dispose() {
-    this.unsubscribe?.();
-    this.unsubscribe = null;
-    this.byResourceAndGrantee.clear();
-    this.byResource.clear();
-    this.grantsById.clear();
   }
-  async loadGrantNodes() {
-    const directMatches = await this.store.list({ schemaId: this.schemaId, includeDeleted: false });
-    if (directMatches.length > 0 || this.schemaId.includes("@")) {
-      return directMatches;
+  if (auth.publicProps) {
+    for (const prop of auth.publicProps) {
+      if (!(prop in properties)) {
+        errors.push({
+          code: "AUTH_SCHEMA_INVALID_PUBLIC_PROP",
+          message: `publicProps references non-existent property '${prop}'`,
+          path: `authorization.publicProps`
+        });
+      }
     }
-    const allNodes = await this.store.list({ includeDeleted: false });
-    return allNodes.filter((node) => this.isGrantSchema(node.schemaId));
-  }
-  isGrantSchema(schemaId) {
-    return schemaId === this.schemaId || schemaId.startsWith(`${this.schemaId}@`);
   }
-  indexGrant(node) {
-    const resource = asString(node.properties.resource);
-    const grantee = asDid(node.properties.grantee);
-    if (!resource || !grantee) {
-      return;
-    }
-    const grant = {
-      id: node.id,
-      properties: node.properties,
-      deleted: node.deleted
-    };
-    this.grantsById.set(node.id, grant);
-    let byGrantee = this.byResourceAndGrantee.get(resource);
-    if (!byGrantee) {
-      byGrantee = /* @__PURE__ */ new Map();
-      this.byResourceAndGrantee.set(resource, byGrantee);
-    }
-    let grantIdsForGrantee = byGrantee.get(grantee);
-    if (!grantIdsForGrantee) {
-      grantIdsForGrantee = /* @__PURE__ */ new Set();
-      byGrantee.set(grantee, grantIdsForGrantee);
-    }
-    grantIdsForGrantee.add(node.id);
-    let grantIdsForResource = this.byResource.get(resource);
-    if (!grantIdsForResource) {
-      grantIdsForResource = /* @__PURE__ */ new Set();
-      this.byResource.set(resource, grantIdsForResource);
+  for (const [actionName, expr] of Object.entries(auth.actions)) {
+    const nodeCount = countExpressionNodes(expr);
+    if (nodeCount > MAX_EXPRESSION_NODES) {
+      errors.push({
+        code: "AUTH_SCHEMA_EXPR_LIMIT_EXCEEDED",
+        message: `Action '${actionName}' expression has ${nodeCount} nodes (max ${MAX_EXPRESSION_NODES})`,
+        path: `authorization.actions.${actionName}`
+      });
     }
-    grantIdsForResource.add(node.id);
   }
-  removeGrant(grantId) {
-    const existing = this.grantsById.get(grantId);
-    if (!existing) {
-      return;
-    }
-    const resource = asString(existing.properties.resource);
-    const grantee = asDid(existing.properties.grantee);
-    this.grantsById.delete(grantId);
-    if (!resource || !grantee) {
-      return;
-    }
-    const byGrantee = this.byResourceAndGrantee.get(resource);
-    if (byGrantee) {
-      const grantIds = byGrantee.get(grantee);
-      if (grantIds) {
-        grantIds.delete(grantId);
-        if (grantIds.size === 0) {
-          byGrantee.delete(grantee);
-        }
-      }
-      if (byGrantee.size === 0) {
-        this.byResourceAndGrantee.delete(resource);
-      }
-    }
-    const byResource = this.byResource.get(resource);
-    if (byResource) {
-      byResource.delete(grantId);
-      if (byResource.size === 0) {
-        this.byResource.delete(resource);
+  if (auth.fieldRules) {
+    for (const fieldName of Object.keys(auth.fieldRules)) {
+      if (!(fieldName in properties)) {
+        errors.push({
+          code: "AUTH_SCHEMA_INVALID_FIELD_REF",
+          message: `fieldRules references non-existent property '${fieldName}'`,
+          path: `authorization.fieldRules.${fieldName}`
+        });
       }
     }
   }
-};
-function asDid(value) {
-  if (typeof value === "string" && value.startsWith("did:key:")) {
-    return value;
+  const mutationActions = ["write", "delete", "share"];
+  for (const actionName of mutationActions) {
+    const expr = auth.actions[actionName];
+    if (expr && hasPublicAccess(expr)) {
+      errors.push({
+        code: "AUTH_SCHEMA_UNSAFE_PUBLIC_MUTATION",
+        message: `Action '${actionName}' allows PUBLIC access, which is unsafe for mutation operations`,
+        path: `authorization.actions.${actionName}`
+      });
+    }
   }
-  return null;
-}
-function asString(value) {
-  return typeof value === "string" ? value : null;
-}
-function asNumber(value) {
-  return typeof value === "number" && Number.isFinite(value) ? value : 0;
-}
-
-// src/auth/offline-policy.ts
-var DEFAULT_OFFLINE_POLICY = {
-  decisionCacheTTL: 5 * 60 * 1e3,
-  maxStaleness: 60 * 60 * 1e3,
-  revalidation: "hybrid",
-  allowOfflineGrants: true
-};
-function mergeOfflinePolicy(current, patch) {
-  return {
-    ...current,
-    ...patch
-  };
-}
-
-// src/auth/mode.ts
-function getAuthMode(schema) {
-  if (!schema.authorization) return "legacy";
-  return "enforce";
+  return { valid: errors.length === 0, errors };
 }
 
 // src/auth/serialize.ts
@@ -305,6 +286,17 @@ function serializeRoleResolver(resolver) {
         relationName: resolver.relationName,
         targetRole: resolver.targetRole
       };
+    case "membership":
+      return {
+        _tag: "membership",
+        edgeSchema: resolver.edgeSchema,
+        containerProp: resolver.containerProp,
+        memberProp: resolver.memberProp,
+        roleProp: resolver.roleProp,
+        minRole: resolver.minRole,
+        roleOrder: [...resolver.roleOrder],
+        parentProp: resolver.parentProp
+      };
   }
 }
 function deserializeRoleResolver(serialized) {
@@ -319,6 +311,17 @@ function deserializeRoleResolver(serialized) {
         relationName: serialized.relationName,
         targetRole: serialized.targetRole
       };
+    case "membership":
+      return {
+        _tag: "membership",
+        edgeSchema: serialized.edgeSchema,
+        containerProp: serialized.containerProp,
+        memberProp: serialized.memberProp,
+        roleProp: serialized.roleProp,
+        minRole: serialized.minRole,
+        roleOrder: [...serialized.roleOrder],
+        parentProp: serialized.parentProp
+      };
   }
 }
 function serializeAuthorization(auth) {
@@ -384,152 +387,632 @@ function deserializeAuthorization(serialized) {
   return auth;
 }
 
-// src/auth/validate.ts
-var BUILTIN_ROLES = ["owner"];
-function extractRoleRefs(expr) {
-  const roles = [];
-  function visit(e) {
-    switch (e._tag) {
-      case "allow":
-      case "deny":
-        roles.push(...e.roles);
-        break;
-      case "and":
-      case "or":
-        for (const sub of e.exprs) visit(sub);
-        break;
-      case "not":
-        visit(e.expr);
-        break;
-      case "roleRef":
-        roles.push(e.role);
-        break;
-      case "public":
-      case "authenticated":
-        break;
+// src/auth/presets.ts
+var presets = {
+  /**
+   * Private - only the creator can access.
+   *
+   * Use for personal notes, private documents, etc.
+   */
+  private: () => ({
+    roles: {
+      owner: role.creator()
+    },
+    actions: {
+      read: allow("owner"),
+      write: allow("owner"),
+      delete: allow("owner"),
+      share: allow("owner")
     }
-  }
-  visit(expr);
-  return roles;
-}
-function countExpressionNodes(expr) {
-  let count = 1;
+  }),
+  /**
+   * Public read - anyone can read, only creator can write.
+   *
+   * Use for published content, blog posts, etc.
+   */
+  publicRead: () => ({
+    roles: {
+      owner: role.creator()
+    },
+    actions: {
+      read: PUBLIC,
+      write: allow("owner"),
+      delete: allow("owner"),
+      share: allow("owner")
+    }
+  }),
+  /**
+   * Collaborative - roles inherited from a parent relation.
+   *
+   * Use for items within a workspace/project that inherits permissions.
+   *
+   * @param parentRelation - Name of the relation property to the parent node
+   */
+  collaborative: (parentRelation) => ({
+    roles: {
+      owner: role.creator(),
+      admin: role.relation(parentRelation, "admin"),
+      editor: role.relation(parentRelation, "editor"),
+      viewer: role.relation(parentRelation, "viewer")
+    },
+    actions: {
+      read: allow("viewer", "editor", "admin", "owner"),
+      write: allow("editor", "admin", "owner"),
+      delete: allow("admin", "owner"),
+      share: allow("admin", "owner")
+    }
+  }),
+  /**
+   * Open - any authenticated user can read/write, only creator can delete.
+   *
+   * Use for wiki-style collaborative content.
+   */
+  open: () => ({
+    roles: {
+      owner: role.creator()
+    },
+    actions: {
+      read: AUTHENTICATED,
+      write: AUTHENTICATED,
+      delete: allow("owner"),
+      share: allow("owner")
+    }
+  }),
+  /**
+   * Team-based - permissions based on a team/editors property.
+   *
+   * @param editorsProperty - Name of the person[] property containing editors
+   */
+  team: (editorsProperty) => ({
+    roles: {
+      owner: role.creator(),
+      editor: role.property(editorsProperty)
+    },
+    actions: {
+      read: allow("editor", "owner"),
+      write: allow("editor", "owner"),
+      delete: allow("owner"),
+      share: allow("owner")
+    }
+  })
+};
+
+// src/auth/permission-matrix.ts
+import { AUTH_ACTIONS } from "@xnetjs/core";
+function collect(expr, polarity, acc) {
   switch (expr._tag) {
+    case "allow":
+      for (const role2 of expr.roles) (polarity ? acc.allow : acc.deny).add(role2);
+      return;
+    case "roleRef": {
+      const bucket = polarity ? acc.allow : acc.deny;
+      bucket.add(expr.role);
+      return;
+    }
+    case "deny":
+      for (const role2 of expr.roles) (polarity ? acc.deny : acc.allow).add(role2);
+      return;
+    case "public":
+      if (polarity) acc.public = true;
+      return;
+    case "authenticated":
+      if (polarity) acc.authenticated = true;
+      return;
     case "and":
     case "or":
-      for (const sub of expr.exprs) {
-        count += countExpressionNodes(sub);
+      for (const sub of expr.exprs) collect(sub, polarity, acc);
+      return;
+    case "not":
+      collect(expr.expr, !polarity, acc);
+      return;
+  }
+}
+function summarizeAction(action, expr) {
+  const acc = { allow: /* @__PURE__ */ new Set(), deny: /* @__PURE__ */ new Set(), public: false, authenticated: false };
+  if (expr) collect(expr, true, acc);
+  return {
+    action,
+    roles: [...acc.allow],
+    denied: [...acc.deny],
+    public: acc.public,
+    authenticated: acc.authenticated
+  };
+}
+function describeRoleResolver(resolver) {
+  switch (resolver._tag) {
+    case "creator":
+      return "Node creator";
+    case "property":
+      return `Listed in "${resolver.propertyName}"`;
+    case "relation":
+      return `Inherited from "${resolver.relationName}" (as ${resolver.targetRole})`;
+    case "membership":
+      return `Member of "${resolver.containerProp}" (\u2265 ${resolver.minRole})`;
+  }
+}
+function buildPermissionMatrix(authorization) {
+  if (!authorization) {
+    return {
+      roles: [],
+      actions: AUTH_ACTIONS.map((action) => ({
+        action,
+        roles: [],
+        denied: [],
+        public: true,
+        authenticated: false
+      }))
+    };
+  }
+  const roles = Object.entries(authorization.roles).map(([role2, resolver]) => ({
+    role: role2,
+    kind: resolver._tag,
+    provenance: describeRoleResolver(resolver)
+  }));
+  const actionKeys = [
+    ...AUTH_ACTIONS.filter((action) => action in authorization.actions),
+    ...Object.keys(authorization.actions).filter(
+      (action) => !AUTH_ACTIONS.includes(action)
+    )
+  ];
+  return {
+    roles,
+    actions: actionKeys.map((action) => summarizeAction(action, authorization.actions[action]))
+  };
+}
+
+// src/auth/mode.ts
+function getAuthMode(schema) {
+  if (!schema.authorization) return "legacy";
+  return "enforce";
+}
+function warnLegacySchema(schema) {
+  if (!schema.authorization) {
+    console.warn(
+      `[xnet:auth] Schema '${schema.name}' has no authorization block - data will be owner-only in legacy mode. Add an 'authorization' block to enable explicit access control.`
+    );
+  }
+}
+
+// src/auth/hub-policy.ts
+var SCHEMA_ACTION_TO_HUB = {
+  read: "read",
+  write: "write",
+  share: "share",
+  delete: "admin"
+};
+function schemaToHubPolicy(schema) {
+  if (!schema.authorization) {
+    return { roleActions: {}, public: false };
+  }
+  const auth = deserializeAuthorization(schema.authorization);
+  const roleActions = {};
+  let isPublic = false;
+  for (const [action, expr] of Object.entries(auth.actions)) {
+    if (!expr) continue;
+    if (action === "read" && hasPublicAccess(expr)) {
+      isPublic = true;
+    }
+    const hubAction = SCHEMA_ACTION_TO_HUB[action];
+    if (!hubAction) continue;
+    for (const roleName of extractRoleRefs(expr)) {
+      const actions = roleActions[roleName] ??= /* @__PURE__ */ new Set();
+      actions.add(hubAction);
+    }
+  }
+  return {
+    roleActions: Object.fromEntries(
+      Object.entries(roleActions).map(([role2, actions]) => [role2, [...actions].sort()])
+    ),
+    public: isPublic
+  };
+}
+function capitalize(value) {
+  return value.length === 0 ? value : `${value[0].toUpperCase()}${value.slice(1)}`;
+}
+function hubActionsForSpaceRole(schema, spaceRole) {
+  const cascadeRole = `space${capitalize(spaceRole)}`;
+  return schemaToHubPolicy(schema).roleActions[cascadeRole] ?? [];
+}
+
+// src/auth/recipients.ts
+var PUBLIC_CONTENT_KEY = new Uint8Array(32);
+var PUBLIC_RECIPIENT = "PUBLIC";
+var MAX_CONTAINER_DEPTH = 32;
+function finalizeRecipients(recipients, dependencies) {
+  const expand = dependencies.expandDeviceRecipients;
+  if (!expand) return [...recipients];
+  const out = new Set(recipients);
+  for (const recipient of recipients) {
+    if (recipient === PUBLIC_RECIPIENT) continue;
+    for (const did of expand(recipient)) out.add(did);
+  }
+  return [...out];
+}
+async function computeRecipients(schema, node, dependencies) {
+  const recipients = /* @__PURE__ */ new Set();
+  recipients.add(node.createdBy);
+  const addGrantRecipients = () => {
+    const grants = dependencies.grantIndex?.findGrantsForResource(node.id) ?? [];
+    for (const grant of grants) {
+      const actions = parseGrantActions(grant.properties.actions);
+      if (actions.includes("read") || actions.includes("write")) {
+        const grantee = grant.properties.grantee;
+        if (typeof grantee === "string" && grantee.startsWith("did:key:")) {
+          recipients.add(grantee);
+        }
+      }
+    }
+  };
+  if (!schema.authorization) {
+    addGrantRecipients();
+    return finalizeRecipients(recipients, dependencies);
+  }
+  const auth = deserializeAuthorization(schema.authorization);
+  const readExpr = auth.actions.read;
+  if (!readExpr) {
+    addGrantRecipients();
+    return finalizeRecipients(recipients, dependencies);
+  }
+  if (hasPublicAccess(readExpr)) {
+    return [PUBLIC_RECIPIENT];
+  }
+  const readRoles = extractRoleRefs(readExpr);
+  for (const roleName of readRoles) {
+    const resolver = auth.roles[roleName];
+    if (!resolver) continue;
+    const members = await resolveRoleMembers(resolver, node, schema, dependencies, 0);
+    for (const did of members) {
+      recipients.add(did);
+    }
+  }
+  addGrantRecipients();
+  return finalizeRecipients(recipients, dependencies);
+}
+async function resolveRoleMembers(resolver, node, _schema, dependencies, depth) {
+  if (depth > (dependencies.maxDepth ?? 3)) {
+    return [];
+  }
+  switch (resolver._tag) {
+    case "creator":
+      return [node.createdBy];
+    case "property":
+      return readDidProperty(node.properties[resolver.propertyName]);
+    case "relation": {
+      const targetId = node.properties[resolver.relationName];
+      if (typeof targetId !== "string") {
+        return [];
+      }
+      const targetNode = await dependencies.getNode(targetId);
+      if (!targetNode || !dependencies.getSchema) {
+        return [];
+      }
+      const targetSchema = await dependencies.getSchema(targetNode.schemaId);
+      if (!targetSchema?.authorization) {
+        return [];
+      }
+      const targetAuth = deserializeAuthorization(targetSchema.authorization);
+      const targetResolver = targetAuth.roles[resolver.targetRole];
+      if (!targetResolver) {
+        return [];
+      }
+      return resolveRoleMembers(targetResolver, targetNode, targetSchema, dependencies, depth + 1);
+    }
+    case "membership": {
+      if (!dependencies.listNodes) {
+        return [];
+      }
+      const containerIds = await collectContainerIds(node, resolver.parentProp, dependencies);
+      const edges = await dependencies.listNodes(resolver.edgeSchema);
+      const members = /* @__PURE__ */ new Set();
+      for (const edge of edges) {
+        if (edge.deleted) continue;
+        const container = edge.properties[resolver.containerProp];
+        if (typeof container !== "string" || !containerIds.has(container)) continue;
+        const edgeRole = edge.properties[resolver.roleProp];
+        if (typeof edgeRole !== "string") continue;
+        const have = resolver.roleOrder.indexOf(edgeRole);
+        const need = resolver.roleOrder.indexOf(resolver.minRole);
+        if (have < 0 || need < 0 || have < need) continue;
+        for (const did of readDidProperty(edge.properties[resolver.memberProp])) {
+          members.add(did);
+        }
+      }
+      return [...members];
+    }
+  }
+}
+async function collectContainerIds(node, parentProp, dependencies) {
+  const ids = /* @__PURE__ */ new Set([node.id]);
+  if (!parentProp) {
+    return ids;
+  }
+  let current = node;
+  let depth = 0;
+  while (current && depth < MAX_CONTAINER_DEPTH) {
+    const parentId = current.properties[parentProp];
+    if (typeof parentId !== "string" || ids.has(parentId)) {
+      break;
+    }
+    ids.add(parentId);
+    current = await dependencies.getNode(parentId);
+    depth += 1;
+  }
+  return ids;
+}
+function readDidProperty(value) {
+  if (Array.isArray(value)) {
+    return value.filter(isDid);
+  }
+  if (isDid(value)) {
+    return [value];
+  }
+  return [];
+}
+function isDid(value) {
+  return typeof value === "string" && value.startsWith("did:key:");
+}
+function parseGrantActions(value) {
+  if (Array.isArray(value)) {
+    return value.filter((entry) => typeof entry === "string");
+  }
+  if (typeof value !== "string") {
+    return [];
+  }
+  try {
+    const parsed = JSON.parse(value);
+    if (!Array.isArray(parsed)) {
+      return [];
+    }
+    return parsed.filter((entry) => typeof entry === "string");
+  } catch {
+    return [];
+  }
+}
+function hasRecipientsChanged(previous, next) {
+  if (previous.length !== next.length) {
+    return true;
+  }
+  const nextSet = new Set(next);
+  return previous.some((recipient) => !nextSet.has(recipient));
+}
+function canTransitionToPublic(readExpr) {
+  if (!readExpr) {
+    return false;
+  }
+  return hasPublicAccess(readExpr);
+}
+
+// src/auth/migration.ts
+async function handleAuthMigration(oldSchema, newSchema, node, dependencies) {
+  const oldAuth = oldSchema.authorization;
+  const newAuth = newSchema.authorization;
+  if (!oldAuth && newAuth) {
+    await dependencies.encryptExistingNode(node, newSchema);
+    return;
+  }
+  if (oldAuth && !newAuth) {
+    console.warn(
+      `[xnet:auth] Schema '${newSchema.name}' removed authorization block. Existing nodes remain encrypted until manually migrated.`
+    );
+    return;
+  }
+  if (!oldAuth || !newAuth) {
+    return;
+  }
+  const oldRecipients = await computeRecipients(oldSchema, node, dependencies);
+  const newRecipients = await computeRecipients(newSchema, node, dependencies);
+  if (!hasRecipientsChanged(oldRecipients, newRecipients)) {
+    return;
+  }
+  await dependencies.rotateContentKeyForNode(node.id, newRecipients);
+}
+
+// src/auth/grants.ts
+var GRANT_SCHEMA_IRI = "xnet://xnet.fyi/Grant";
+function isGrantActive(grant, now = Date.now()) {
+  const revokedAt = asNumber(grant.properties.revokedAt);
+  if (revokedAt > 0) {
+    return false;
+  }
+  const expiresAt = asNumber(grant.properties.expiresAt);
+  if (expiresAt > 0 && expiresAt <= now) {
+    return false;
+  }
+  return true;
+}
+var GrantIndex = class {
+  constructor(store, options = {}) {
+    this.store = store;
+    this.schemaId = options.schemaId ?? GRANT_SCHEMA_IRI;
+    this.clock = options.clock ?? Date.now;
+  }
+  byResourceAndGrantee = /* @__PURE__ */ new Map();
+  byResource = /* @__PURE__ */ new Map();
+  grantsById = /* @__PURE__ */ new Map();
+  unsubscribe = null;
+  schemaId;
+  clock;
+  async initialize() {
+    const grants = await this.loadGrantNodes();
+    for (const grant of grants) {
+      this.indexGrant(grant);
+    }
+    this.unsubscribe = this.store.subscribe((event) => {
+      const node = event.node;
+      if (!node || !this.isGrantSchema(node.schemaId)) {
+        return;
+      }
+      this.removeGrant(node.id);
+      if (!node.deleted) {
+        this.indexGrant(node);
+      }
+    });
+  }
+  findGrants(resource, grantee) {
+    const grantsByGrantee = this.byResourceAndGrantee.get(resource);
+    if (!grantsByGrantee) return [];
+    const grantIds = grantsByGrantee.get(grantee);
+    if (!grantIds) return [];
+    const now = this.clock();
+    const grants = [];
+    for (const grantId of grantIds) {
+      const grant = this.grantsById.get(grantId);
+      if (grant && isGrantActive(grant, now)) {
+        grants.push(grant);
       }
-      break;
-    case "not":
-      count += countExpressionNodes(expr.expr);
-      break;
+    }
+    return grants;
   }
-  return count;
-}
-function hasPublicAccess(expr) {
-  if (expr._tag === "public") return true;
-  if (expr._tag === "or") return expr.exprs.some(hasPublicAccess);
-  if (expr._tag === "and") return expr.exprs.every(hasPublicAccess);
-  if (expr._tag === "not") return false;
-  return false;
-}
-var MAX_EXPRESSION_NODES = 50;
-function validateAuthorization(auth, properties) {
-  const errors = [];
-  for (const [actionName, expr] of Object.entries(auth.actions)) {
-    const referencedRoles = extractRoleRefs(expr);
-    for (const ref of referencedRoles) {
-      if (!(ref in auth.roles) && !BUILTIN_ROLES.includes(ref)) {
-        errors.push({
-          code: "AUTH_SCHEMA_INVALID_ROLE_REF",
-          message: `Action '${actionName}' references unknown role '${ref}'`,
-          path: `authorization.actions.${actionName}`
-        });
+  findGrantsForResource(resource) {
+    const grantIds = this.byResource.get(resource);
+    if (!grantIds) return [];
+    const now = this.clock();
+    const grants = [];
+    for (const grantId of grantIds) {
+      const grant = this.grantsById.get(grantId);
+      if (grant && isGrantActive(grant, now)) {
+        grants.push(grant);
       }
     }
+    return grants;
   }
-  for (const [roleName, resolver] of Object.entries(auth.roles)) {
-    if (resolver._tag === "property") {
-      const propDef = properties[resolver.propertyName];
-      if (!propDef) {
-        errors.push({
-          code: "AUTH_SCHEMA_INVALID_RELATION_PATH",
-          message: `Role '${roleName}' references non-existent property '${resolver.propertyName}'`,
-          path: `authorization.roles.${roleName}`
-        });
-      } else if (propDef.type !== "person") {
-        errors.push({
-          code: "AUTH_SCHEMA_INVALID_RELATION_PATH",
-          message: `Role '${roleName}' references property '${resolver.propertyName}' which is not a person type (got '${propDef.type}')`,
-          path: `authorization.roles.${roleName}`
-        });
+  findAllGrantsForResource(resource) {
+    const grantIds = this.byResource.get(resource);
+    if (!grantIds) return [];
+    const grants = [];
+    for (const grantId of grantIds) {
+      const grant = this.grantsById.get(grantId);
+      if (grant) {
+        grants.push(grant);
       }
     }
-    if (resolver._tag === "relation") {
-      const propDef = properties[resolver.relationName];
-      if (!propDef) {
-        errors.push({
-          code: "AUTH_SCHEMA_INVALID_RELATION_PATH",
-          message: `Role '${roleName}' references non-existent relation '${resolver.relationName}'`,
-          path: `authorization.roles.${roleName}`
-        });
-      } else if (propDef.type !== "relation") {
-        errors.push({
-          code: "AUTH_SCHEMA_INVALID_RELATION_PATH",
-          message: `Role '${roleName}' references property '${resolver.relationName}' which is not a relation type (got '${propDef.type}')`,
-          path: `authorization.roles.${roleName}`
-        });
+    return grants;
+  }
+  findGrantsForGrantee(grantee) {
+    const grants = [];
+    const now = this.clock();
+    for (const grantsByGrantee of this.byResourceAndGrantee.values()) {
+      const grantIds = grantsByGrantee.get(grantee);
+      if (!grantIds) continue;
+      for (const grantId of grantIds) {
+        const grant = this.grantsById.get(grantId);
+        if (grant && isGrantActive(grant, now)) {
+          grants.push(grant);
+        }
       }
     }
+    return grants;
   }
-  if (auth.publicProps) {
-    for (const prop of auth.publicProps) {
-      if (!(prop in properties)) {
-        errors.push({
-          code: "AUTH_SCHEMA_INVALID_PUBLIC_PROP",
-          message: `publicProps references non-existent property '${prop}'`,
-          path: `authorization.publicProps`
-        });
-      }
+  dispose() {
+    this.unsubscribe?.();
+    this.unsubscribe = null;
+    this.byResourceAndGrantee.clear();
+    this.byResource.clear();
+    this.grantsById.clear();
+  }
+  async loadGrantNodes() {
+    const directMatches = await this.store.list({ schemaId: this.schemaId, includeDeleted: false });
+    if (directMatches.length > 0 || this.schemaId.includes("@")) {
+      return directMatches;
     }
+    const allNodes = await this.store.list({ includeDeleted: false });
+    return allNodes.filter((node) => this.isGrantSchema(node.schemaId));
   }
-  for (const [actionName, expr] of Object.entries(auth.actions)) {
-    const nodeCount = countExpressionNodes(expr);
-    if (nodeCount > MAX_EXPRESSION_NODES) {
-      errors.push({
-        code: "AUTH_SCHEMA_EXPR_LIMIT_EXCEEDED",
-        message: `Action '${actionName}' expression has ${nodeCount} nodes (max ${MAX_EXPRESSION_NODES})`,
-        path: `authorization.actions.${actionName}`
-      });
+  isGrantSchema(schemaId) {
+    return schemaId === this.schemaId || schemaId.startsWith(`${this.schemaId}@`);
+  }
+  indexGrant(node) {
+    const resource = asString(node.properties.resource);
+    const grantee = asDid(node.properties.grantee);
+    if (!resource || !grantee) {
+      return;
+    }
+    const grant = {
+      id: node.id,
+      properties: node.properties,
+      deleted: node.deleted
+    };
+    this.grantsById.set(node.id, grant);
+    let byGrantee = this.byResourceAndGrantee.get(resource);
+    if (!byGrantee) {
+      byGrantee = /* @__PURE__ */ new Map();
+      this.byResourceAndGrantee.set(resource, byGrantee);
+    }
+    let grantIdsForGrantee = byGrantee.get(grantee);
+    if (!grantIdsForGrantee) {
+      grantIdsForGrantee = /* @__PURE__ */ new Set();
+      byGrantee.set(grantee, grantIdsForGrantee);
+    }
+    grantIdsForGrantee.add(node.id);
+    let grantIdsForResource = this.byResource.get(resource);
+    if (!grantIdsForResource) {
+      grantIdsForResource = /* @__PURE__ */ new Set();
+      this.byResource.set(resource, grantIdsForResource);
     }
+    grantIdsForResource.add(node.id);
   }
-  if (auth.fieldRules) {
-    for (const fieldName of Object.keys(auth.fieldRules)) {
-      if (!(fieldName in properties)) {
-        errors.push({
-          code: "AUTH_SCHEMA_INVALID_FIELD_REF",
-          message: `fieldRules references non-existent property '${fieldName}'`,
-          path: `authorization.fieldRules.${fieldName}`
-        });
+  removeGrant(grantId) {
+    const existing = this.grantsById.get(grantId);
+    if (!existing) {
+      return;
+    }
+    const resource = asString(existing.properties.resource);
+    const grantee = asDid(existing.properties.grantee);
+    this.grantsById.delete(grantId);
+    if (!resource || !grantee) {
+      return;
+    }
+    const byGrantee = this.byResourceAndGrantee.get(resource);
+    if (byGrantee) {
+      const grantIds = byGrantee.get(grantee);
+      if (grantIds) {
+        grantIds.delete(grantId);
+        if (grantIds.size === 0) {
+          byGrantee.delete(grantee);
+        }
+      }
+      if (byGrantee.size === 0) {
+        this.byResourceAndGrantee.delete(resource);
       }
     }
-  }
-  const mutationActions = ["write", "delete", "share"];
-  for (const actionName of mutationActions) {
-    const expr = auth.actions[actionName];
-    if (expr && hasPublicAccess(expr)) {
-      errors.push({
-        code: "AUTH_SCHEMA_UNSAFE_PUBLIC_MUTATION",
-        message: `Action '${actionName}' allows PUBLIC access, which is unsafe for mutation operations`,
-        path: `authorization.actions.${actionName}`
-      });
+    const byResource = this.byResource.get(resource);
+    if (byResource) {
+      byResource.delete(grantId);
+      if (byResource.size === 0) {
+        this.byResource.delete(resource);
+      }
     }
   }
-  return { valid: errors.length === 0, errors };
+};
+function asDid(value) {
+  if (typeof value === "string" && value.startsWith("did:key:")) {
+    return value;
+  }
+  return null;
+}
+function asString(value) {
+  return typeof value === "string" ? value : null;
+}
+function asNumber(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : 0;
+}
+
+// src/auth/offline-policy.ts
+var DEFAULT_OFFLINE_POLICY = {
+  decisionCacheTTL: 5 * 60 * 1e3,
+  maxStaleness: 60 * 60 * 1e3,
+  revalidation: "hybrid",
+  allowOfflineGrants: true
+};
+function mergeOfflinePolicy(current, patch) {
+  return {
+    ...current,
+    ...patch
+  };
 }
 
 // src/auth/evaluator.ts
+var MAX_CONTAINER_DEPTH2 = 32;
 var DecisionCache = class {
   cache = /* @__PURE__ */ new Map();
   ttlMs;
@@ -632,7 +1115,7 @@ var DefaultRoleResolver = class {
       case "creator":
         return [node.createdBy];
       case "property":
-        return readDidProperty(node.properties[resolver.propertyName]);
+        return readDidProperty2(node.properties[resolver.propertyName]);
       case "relation": {
         const relatedNodes = await this.loadRelatedNodes(node, resolver.relationName);
         if (relatedNodes.length === 0) {
@@ -661,6 +1144,20 @@ var DefaultRoleResolver = class {
         }
         return [...members];
       }
+      case "membership": {
+        const containerIds = await this.collectContainerIds(node, resolver.parentProp);
+        const edges = await this.store.list({ schemaId: resolver.edgeSchema });
+        const members = /* @__PURE__ */ new Set();
+        for (const edge of edges) {
+          if (edge.deleted) continue;
+          if (!this.membershipMatchesContainer(edge, resolver, containerIds)) continue;
+          if (!membershipRoleAtLeast(edge.properties[resolver.roleProp], resolver)) continue;
+          for (const did of readDidProperty2(edge.properties[resolver.memberProp])) {
+            members.add(did);
+          }
+        }
+        return [...members];
+      }
     }
   }
   async checkRole(did, resolver, node, depth, visited) {
@@ -676,7 +1173,7 @@ var DefaultRoleResolver = class {
       case "creator":
         return did === node.createdBy;
       case "property":
-        return readDidProperty(node.properties[resolver.propertyName]).includes(did);
+        return readDidProperty2(node.properties[resolver.propertyName]).includes(did);
       case "relation": {
         const relatedNodes = await this.loadRelatedNodes(node, resolver.relationName);
         for (const relatedNode of relatedNodes) {
@@ -696,7 +1193,47 @@ var DefaultRoleResolver = class {
         }
         return false;
       }
+      case "membership": {
+        const containerIds = await this.collectContainerIds(node, resolver.parentProp);
+        const edges = await this.store.list({ schemaId: resolver.edgeSchema });
+        for (const edge of edges) {
+          if (edge.deleted) continue;
+          if (!this.membershipMatchesContainer(edge, resolver, containerIds)) continue;
+          if (!readDidProperty2(edge.properties[resolver.memberProp]).includes(did)) continue;
+          if (membershipRoleAtLeast(edge.properties[resolver.roleProp], resolver)) {
+            return true;
+          }
+        }
+        return false;
+      }
+    }
+  }
+  membershipMatchesContainer(edge, resolver, containerIds) {
+    const value = edge.properties[resolver.containerProp];
+    return typeof value === "string" && containerIds.has(value);
+  }
+  /**
+   * The node's own id plus the ids of every ancestor reachable by walking
+   * `parentProp`. Cycle- and depth-bounded. When `parentProp` is undefined the
+   * set is just the node itself (no inheritance).
+   */
+  async collectContainerIds(node, parentProp) {
+    const ids = /* @__PURE__ */ new Set([node.id]);
+    if (!parentProp) {
+      return ids;
+    }
+    let current = node;
+    let depth = 0;
+    while (current && depth < MAX_CONTAINER_DEPTH2) {
+      const parentId = current.properties[parentProp];
+      if (typeof parentId !== "string" || ids.has(parentId)) {
+        break;
+      }
+      ids.add(parentId);
+      current = await this.store.get(parentId);
+      depth += 1;
     }
+    return ids;
   }
   async loadRelatedNodes(node, relationName) {
     const value = node.properties[relationName];
@@ -766,7 +1303,8 @@ var DefaultPolicyEvaluator = class {
       this.emitDecision(decision2);
       return decision2;
     }
-    const cached = this.cache.get(input.subject, input.action, input.nodeId);
+    const useCache = !input.patch;
+    const cached = useCache ? this.cache.get(input.subject, input.action, input.nodeId) : void 0;
     if (cached) {
       const decision2 = {
         ...cached,
@@ -789,15 +1327,24 @@ var DefaultPolicyEvaluator = class {
       return decision2;
     }
     const mode = getAuthMode(schema.schema);
-    if (mode === "legacy") {
-      const allowed = node.createdBy === input.subject;
-      const decision2 = this.decision(input, allowed, allowed ? ["owner"] : [], start);
-      this.cache.set(input.subject, input.action, input.nodeId, decision2);
-      this.emitDecision(decision2);
-      return decision2;
-    }
-    if (!schema.schema.authorization) {
-      const decision2 = this.deny(input, ["DENY_NO_ROLE_MATCH"], start);
+    if (mode === "legacy" || !schema.schema.authorization) {
+      if (node.createdBy === input.subject) {
+        const decision3 = this.decision(input, true, ["owner"], start);
+        if (useCache) this.cache.set(input.subject, input.action, input.nodeId, decision3);
+        this.emitDecision(decision3);
+        return decision3;
+      }
+      const grant2 = this.findMatchingGrant(
+        input,
+        this.grantIndex?.findGrants(input.nodeId, input.subject) ?? []
+      );
+      if (grant2) {
+        const decision3 = this.decision(input, true, [], start, [grant2.id]);
+        if (useCache) this.cache.set(input.subject, input.action, input.nodeId, decision3);
+        this.emitDecision(decision3);
+        return decision3;
+      }
+      const decision2 = this.deny(input, ["DENY_NO_ROLE_MATCH", "DENY_NO_GRANT"], start);
       this.emitDecision(decision2);
       return decision2;
     }
@@ -823,7 +1370,7 @@ var DefaultPolicyEvaluator = class {
     const allowedByRole = evaluateExpression(actionExpr, roles, true);
     if (allowedByRole) {
       const decision2 = this.decision(input, true, [...roles], start);
-      this.cache.set(input.subject, input.action, input.nodeId, decision2);
+      if (useCache) this.cache.set(input.subject, input.action, input.nodeId, decision2);
       this.emitDecision(decision2);
       return decision2;
     }
@@ -833,7 +1380,7 @@ var DefaultPolicyEvaluator = class {
     );
     if (grant) {
       const decision2 = this.decision(input, true, [...roles], start, [grant.id]);
-      this.cache.set(input.subject, input.action, input.nodeId, decision2);
+      if (useCache) this.cache.set(input.subject, input.action, input.nodeId, decision2);
       this.emitDecision(decision2);
       return decision2;
     }
@@ -1050,16 +1597,24 @@ function matchesDenyExpression(expr, roles, isAuthenticated) {
       return false;
   }
 }
-function readDidProperty(value) {
+function readDidProperty2(value) {
   if (Array.isArray(value)) {
-    return value.filter(isDid);
+    return value.filter(isDid2);
   }
-  if (isDid(value)) {
+  if (isDid2(value)) {
     return [value];
   }
   return [];
 }
-function isDid(value) {
+function membershipRoleAtLeast(edgeRole, resolver) {
+  if (typeof edgeRole !== "string") {
+    return false;
+  }
+  const have = resolver.roleOrder.indexOf(edgeRole);
+  const need = resolver.roleOrder.indexOf(resolver.minRole);
+  return have >= 0 && need >= 0 && have >= need;
+}
+function isDid2(value) {
   return typeof value === "string" && value.startsWith("did:key:");
 }
 function parseActions(value) {
@@ -1079,6 +1634,20 @@ function parseActions(value) {
     return [];
   }
 }
+async function createPolicyEvaluator(options) {
+  const grantIndex = new GrantIndex(options.store, {
+    schemaId: options.grantSchemaId
+  });
+  await grantIndex.initialize();
+  return new DefaultPolicyEvaluator({
+    store: options.store,
+    schemaRegistry: options.schemaRegistry,
+    grantIndex,
+    cache: options.cache,
+    maxDepth: options.maxDepth,
+    maxNodes: options.maxNodes
+  });
+}
 
 // src/auth/grant-expiration-cleaner.ts
 var GrantExpirationCleaner = class _GrantExpirationCleaner {
@@ -1261,7 +1830,7 @@ var StoreAuth = class {
       expiresAt,
       parentUcanToken: parseString(parentGrant?.properties.ucanToken) ?? void 0
     });
-    const created2 = await this.options.store.create({
+    const created = await this.options.store.create({
       schemaId: GRANT_SCHEMA_IRI,
       properties: {
         issuer: this.options.actorDid,
@@ -1292,7 +1861,7 @@ var StoreAuth = class {
     }
     this.options.evaluator.invalidateSubject(input.to);
     this.options.evaluator.invalidate(input.resource);
-    const node = await this.getGrantNodeOrThrow(created2.id);
+    const node = await this.getGrantNodeOrThrow(created.id);
     return toGrant(node);
   }
   async revoke(input) {
@@ -1578,743 +2147,101 @@ function parseDuration(value) {
   }
 }
 
-// src/auth/index.ts
-import { AUTH_ACTIONS } from "@xnetjs/core";
-
-// src/auth/builders.ts
-var role = {
-  /**
-   * Role held by the node's creator.
-   * The DID in `createdBy` holds this role.
-   */
-  creator() {
-    return { _tag: "creator" };
-  },
-  /**
-   * Role determined by a person property on the node.
-   * The DID(s) in that property hold this role.
-   *
-   * @param propertyName - Name of the person/person[] property
-   */
-  property(propertyName) {
-    return { _tag: "property", propertyName };
-  },
-  /**
-   * Role inherited from a related node.
-   * Users who hold `targetRole` on the related node hold this role.
-   *
-   * @param relationName - Name of the relation property
-   * @param targetRole - Role to check on the related node
-   */
-  relation(relationName, targetRole) {
-    return { _tag: "relation", relationName, targetRole };
-  }
-};
-var relation = role.relation;
-
-// src/auth/recipients.ts
-var PUBLIC_CONTENT_KEY = new Uint8Array(32);
-
-// src/schema/define.ts
-var DEFAULT_SCHEMA_VERSION2 = "1.0.0";
-function defineSchema(options) {
-  const version = options.version ?? DEFAULT_SCHEMA_VERSION2;
-  const schemaId = `${options.namespace}${options.name}@${version}`;
-  if (process.env.NODE_ENV !== "production") {
-    const REF_NAME_PATTERN = /(?:^target$|^inReplyTo$|^replyTo[A-Z].*(?:Id|Node)$|(?:parent|node|comment|task|page|database)(?:Id|Ref)$)/;
-    for (const [name, builder] of Object.entries(options.properties)) {
-      if (builder.definition.type === "text" && REF_NAME_PATTERN.test(name)) {
-        console.warn(
-          `[xNet Schema] "${options.name}.${name}" is a text() property whose name suggests it stores a reference. Consider using relation() for node references or person() for DIDs.`
-        );
-      }
-    }
-  }
-  const properties = Object.entries(options.properties).map(
-    ([name, builder]) => ({
-      "@id": `${schemaId}#${name}`,
-      name,
-      ...builder.definition
-    })
-  );
-  const propertyMap = Object.fromEntries(properties.map((property) => [property.name, property]));
-  if (options.authorization) {
-    const authResult = validateAuthorization(options.authorization, propertyMap);
-    if (!authResult.valid) {
-      const message = authResult.errors.map((error) => `${error.path}: [${error.code}] ${error.message}`).join(", ");
-      throw new Error(`Invalid authorization in schema '${options.name}': ${message}`);
-    }
-  }
-  const schema = {
-    "@id": schemaId,
-    "@type": "xnet://xnet.fyi/Schema",
-    name: options.name,
-    namespace: options.namespace,
-    version,
-    migrateFrom: options.migrateFrom,
-    properties,
-    extends: options.extends?.schema["@id"],
-    document: options.document,
-    authorization: options.authorization ? serializeAuthorization(options.authorization) : void 0
-  };
-  function validate(node) {
+// src/auth/auth-migrator.ts
+var AuthMigrator = class {
+  constructor(store, schemaRegistry, publicKeyResolver, grantIndex, encryptionLayer) {
+    this.store = store;
+    this.schemaRegistry = schemaRegistry;
+    this.publicKeyResolver = publicKeyResolver;
+    this.grantIndex = grantIndex;
+    this.encryptionLayer = encryptionLayer;
+  }
+  async migrateSchema(schemaIri, options = {}) {
+    const schema = await this.schemaRegistry.get(schemaIri);
+    if (!schema?.schema.authorization) {
+      throw new Error(`Schema ${schemaIri} has no authorization block`);
+    }
+    const nodes = await this.store.list({ schemaId: schemaIri, includeDeleted: false });
+    const total = nodes.length;
+    const batchSize = Math.max(1, options.batchSize ?? 100);
+    let migrated = 0;
+    let failed = 0;
     const errors = [];
-    if (typeof node !== "object" || node === null) {
-      return { valid: false, errors: [{ path: "", message: "Node must be an object" }] };
-    }
-    const obj = node;
-    if (typeof obj.id !== "string") {
-      errors.push({ path: "id", message: "id is required and must be a string" });
-    }
-    if (obj.schemaId !== schemaId) {
-      errors.push({
-        path: "schemaId",
-        message: `schemaId must be '${schemaId}'`,
-        value: obj.schemaId
-      });
-    }
-    if (typeof obj.createdAt !== "number") {
-      errors.push({ path: "createdAt", message: "createdAt is required and must be a number" });
-    }
-    if (typeof obj.createdBy !== "string" || !obj.createdBy.startsWith("did:key:")) {
-      errors.push({ path: "createdBy", message: "createdBy must be a valid DID" });
-    }
-    for (const [name, builder] of Object.entries(options.properties)) {
-      const value = obj[name];
-      const isRequired = builder.definition.required;
-      if (value === void 0 || value === null) {
-        if (isRequired) {
-          errors.push({ path: name, message: `${name} is required` });
+    for (let index = 0; index < nodes.length; index += batchSize) {
+      const batch = nodes.slice(index, index + batchSize);
+      for (const node of batch) {
+        try {
+          const recipients = await computeRecipients(schema.schema, node, {
+            getNode: (nodeId) => this.store.get(nodeId),
+            getSchema: (schemaId) => this.resolveSchema(schemaId),
+            grantIndex: this.grantIndex
+          });
+          const didRecipients = recipients.filter(
+            (recipient) => recipient !== "PUBLIC"
+          );
+          const recipientKeys = await this.publicKeyResolver.resolveBatch(didRecipients);
+          await this.encryptionLayer.encryptAndStoreNode(node, recipientKeys);
+          migrated++;
+        } catch (error) {
+          failed++;
+          errors.push({
+            nodeId: node.id,
+            error: error instanceof Error ? error.message : String(error)
+          });
         }
-      } else if (!builder.validate(value)) {
-        errors.push({ path: name, message: `${name} has invalid value`, value });
-      }
-    }
-    return { valid: errors.length === 0, errors };
-  }
-  function create(props, createOptions) {
-    const now = createOptions.createdAt ?? Date.now();
-    const id = createOptions.id ?? createNodeId();
-    const node = {
-      id,
-      schemaId,
-      createdAt: now,
-      createdBy: createOptions.createdBy
-    };
-    for (const [name, builder] of Object.entries(options.properties)) {
-      const rawValue = props[name];
-      const coerced = builder.coerce(rawValue);
-      if (coerced !== null) {
-        node[name] = coerced;
       }
+      options.onProgress?.(migrated + failed, total);
     }
-    return node;
+    return { total, migrated, failed, errors };
   }
-  function is(node) {
-    return node.schemaId === schemaId;
-  }
-  return {
-    schema,
-    validate,
-    create,
-    is,
-    _schemaId: schemaId,
-    _properties: options.properties
-  };
-}
-
-// src/schema/properties/text.ts
-function text(options = {}) {
-  return {
-    definition: {
-      type: "text",
-      required: options.required ?? false,
-      config: {
-        minLength: options.minLength,
-        maxLength: options.maxLength,
-        pattern: options.pattern?.source,
-        placeholder: options.placeholder
-      }
-    },
-    validate(value) {
-      if (value === null || value === void 0) {
-        return !options.required;
-      }
-      if (typeof value !== "string") return false;
-      if (options.minLength !== void 0 && value.length < options.minLength) return false;
-      if (options.maxLength !== void 0 && value.length > options.maxLength) return false;
-      if (options.pattern && !options.pattern.test(value)) return false;
-      return true;
-    },
-    coerce(value) {
-      if (value === null || value === void 0) return null;
-      return String(value);
-    },
-    _type: ""
-  };
-}
-
-// src/schema/properties/number.ts
-function number(options = {}) {
-  return {
-    definition: {
-      type: "number",
-      required: options.required ?? false,
-      config: {
-        min: options.min,
-        max: options.max,
-        integer: options.integer
-      }
-    },
-    validate(value) {
-      if (value === null || value === void 0) {
-        return !options.required;
-      }
-      if (typeof value !== "number" || isNaN(value)) return false;
-      if (options.min !== void 0 && value < options.min) return false;
-      if (options.max !== void 0 && value > options.max) return false;
-      if (options.integer && !Number.isInteger(value)) return false;
-      return true;
-    },
-    coerce(value) {
-      if (value === null || value === void 0) return null;
-      const num = Number(value);
-      if (isNaN(num)) return null;
-      if (options.integer) return Math.round(num);
-      return num;
-    },
-    _type: 0
-  };
-}
-
-// src/schema/properties/checkbox.ts
-function checkbox(options = {}) {
-  return {
-    definition: {
-      type: "checkbox",
-      required: options.required ?? false,
-      config: {
-        default: options.default
-      }
-    },
-    validate(value) {
-      if (value === null || value === void 0) {
-        return !options.required;
-      }
-      return typeof value === "boolean";
-    },
-    coerce(value) {
-      if (value === null || value === void 0) {
-        return options.default ?? null;
-      }
-      if (typeof value === "boolean") return value;
-      if (value === "true" || value === 1) return true;
-      if (value === "false" || value === 0) return false;
-      return Boolean(value);
-    },
-    _type: false
-  };
-}
-
-// src/schema/properties/date.ts
-function date(options = {}) {
-  return {
-    definition: {
-      type: "date",
-      required: options.required ?? false,
-      config: {
-        includeTime: options.includeTime ?? false
-      }
-    },
-    validate(value) {
-      if (value === null || value === void 0) {
-        return !options.required;
-      }
-      if (typeof value !== "number") return false;
-      return value >= 0 && value < 3250368e7;
-    },
-    coerce(value) {
-      if (value === null || value === void 0) return null;
-      if (typeof value === "number") {
-        return value;
-      }
-      if (value instanceof Date) {
-        return value.getTime();
-      }
-      if (typeof value === "string") {
-        const parsed = Date.parse(value);
-        if (!isNaN(parsed)) return parsed;
-      }
-      return null;
-    },
-    _type: 0
-  };
-}
-
-// src/schema/properties/dateRange.ts
-function isValidDateRange(value) {
-  if (typeof value !== "object" || value === null) return false;
-  const obj = value;
-  if (typeof obj.start !== "string") return false;
-  if (!isValidDateString(obj.start)) return false;
-  if (obj.end !== void 0) {
-    if (typeof obj.end !== "string") return false;
-    if (!isValidDateString(obj.end)) return false;
+  async resolveSchema(schemaId) {
+    const schema = await this.schemaRegistry.get(schemaId);
+    return schema?.schema;
   }
-  return true;
-}
-function isValidDateString(str) {
-  const d = new Date(str);
-  return !isNaN(d.getTime());
-}
-function dateRange(options = {}) {
-  return {
-    definition: {
-      type: "dateRange",
-      required: options.required ?? false,
-      config: {
-        includeTime: options.includeTime ?? false
-      }
-    },
-    validate(value) {
-      if (value === null || value === void 0) {
-        return !options.required;
-      }
-      return isValidDateRange(value);
-    },
-    coerce(value) {
-      if (value === null || value === void 0) return null;
-      if (isValidDateRange(value)) {
-        return value;
-      }
-      if (typeof value === "object" && value !== null) {
-        const obj = value;
-        if (obj.start) {
-          const start = new Date(obj.start);
-          if (!isNaN(start.getTime())) {
-            const result = { start: start.toISOString() };
-            if (obj.end) {
-              const end = new Date(obj.end);
-              if (!isNaN(end.getTime())) {
-                result.end = end.toISOString();
-              }
-            }
-            return result;
-          }
-        }
-      }
-      return null;
-    },
-    _type: {}
-  };
-}
-
-// src/schema/properties/select.ts
-function select(options) {
-  const validIds = new Set(options.options.map((o) => o.id));
-  return {
-    definition: {
-      type: "select",
-      required: options.required ?? false,
-      config: {
-        options: options.options,
-        default: options.default
-      }
-    },
-    validate(value) {
-      if (value === null || value === void 0) {
-        return !options.required;
-      }
-      return typeof value === "string" && validIds.has(value);
-    },
-    coerce(value) {
-      if (value === null || value === void 0) {
-        return options.default ?? null;
-      }
-      if (typeof value === "string" && validIds.has(value)) {
-        return value;
-      }
-      const byName = options.options.find(
-        (o) => o.name.toLowerCase() === String(value).toLowerCase()
-      );
-      if (byName) return byName.id;
-      return null;
-    },
-    _type: ""
-  };
-}
-
-// src/schema/properties/multiSelect.ts
-function multiSelect(options) {
-  const validIds = new Set(options.options.map((o) => o.id));
-  return {
-    definition: {
-      type: "multiSelect",
-      required: options.required ?? false,
-      config: {
-        options: options.options,
-        default: options.default
-      }
-    },
-    validate(value) {
-      if (value === null || value === void 0) {
-        return !options.required;
-      }
-      if (!Array.isArray(value)) return false;
-      return value.every((v) => typeof v === "string" && validIds.has(v));
-    },
-    coerce(value) {
-      if (value === null || value === void 0) {
-        return options.default ?? [];
-      }
-      if (!Array.isArray(value)) {
-        if (typeof value === "string" && validIds.has(value)) {
-          return [value];
-        }
-        return null;
-      }
-      const result = [];
-      for (const v of value) {
-        if (typeof v === "string" && validIds.has(v)) {
-          result.push(v);
-        } else {
-          const byName = options.options.find(
-            (o) => o.name.toLowerCase() === String(v).toLowerCase()
-          );
-          if (byName) result.push(byName.id);
-        }
-      }
-      return result;
-    },
-    _type: []
-  };
-}
-
-// src/schema/properties/person.ts
-var DID_PATTERN = /^did:[a-z]+:[a-zA-Z0-9._:-]+$/;
-function person(options = {}) {
-  const isMultiple = options.multiple ?? false;
-  return {
-    definition: {
-      type: "person",
-      required: options.required ?? false,
-      config: {
-        multiple: isMultiple
-      }
-    },
-    validate(value) {
-      if (value === null || value === void 0) {
-        return !options.required;
-      }
-      if (isMultiple) {
-        if (!Array.isArray(value)) return false;
-        return value.every((v) => typeof v === "string" && DID_PATTERN.test(v));
-      } else {
-        return typeof value === "string" && DID_PATTERN.test(value);
-      }
-    },
-    coerce(value) {
-      if (value === null || value === void 0) {
-        return isMultiple ? [] : null;
-      }
-      if (isMultiple) {
-        const arr = Array.isArray(value) ? value : [value];
-        return arr.filter((v) => typeof v === "string" && DID_PATTERN.test(v));
-      } else {
-        if (typeof value === "string" && DID_PATTERN.test(value)) {
-          return value;
-        }
-        return null;
-      }
-    },
-    _type: isMultiple ? [] : ""
-  };
-}
-
-// src/schema/properties/relation.ts
-function relation2(options = {}) {
-  const isMultiple = options.multiple ?? false;
-  return {
-    definition: {
-      type: "relation",
-      required: options.required ?? false,
-      config: {
-        ...options.target !== void 0 && { target: options.target },
-        multiple: isMultiple
-      }
-    },
-    validate(value) {
-      if (value === null || value === void 0) {
-        return !options.required;
-      }
-      if (isMultiple) {
-        if (!Array.isArray(value)) return false;
-        return value.every((v) => typeof v === "string" && v.length > 0);
-      } else {
-        return typeof value === "string" && value.length > 0;
-      }
-    },
-    coerce(value) {
-      if (value === null || value === void 0) {
-        return isMultiple ? [] : null;
-      }
-      if (isMultiple) {
-        const arr = Array.isArray(value) ? value : [value];
-        return arr.filter((v) => typeof v === "string" && v.length > 0);
-      } else {
-        if (typeof value === "string" && value.length > 0) {
-          return value;
-        }
-        return null;
-      }
-    },
-    _type: isMultiple ? [] : ""
-  };
-}
-
-// src/schema/properties/url.ts
-var URL_PATTERN = /^https?:\/\/.+/i;
-function url(options = {}) {
-  return {
-    definition: {
-      type: "url",
-      required: options.required ?? false,
-      config: {
-        placeholder: options.placeholder
-      }
-    },
-    validate(value) {
-      if (value === null || value === void 0 || value === "") {
-        return !options.required;
-      }
-      if (typeof value !== "string") return false;
-      return URL_PATTERN.test(value);
-    },
-    coerce(value) {
-      if (value === null || value === void 0 || value === "") return null;
-      const str = String(value).trim();
-      if (str && !str.match(/^https?:\/\//i)) {
-        return `https://${str}`;
-      }
-      return str || null;
-    },
-    _type: ""
-  };
-}
-
-// src/schema/properties/email.ts
-var EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
-function email(options = {}) {
-  return {
-    definition: {
-      type: "email",
-      required: options.required ?? false,
-      config: {
-        placeholder: options.placeholder
-      }
-    },
-    validate(value) {
-      if (value === null || value === void 0 || value === "") {
-        return !options.required;
-      }
-      if (typeof value !== "string") return false;
-      return EMAIL_PATTERN.test(value);
-    },
-    coerce(value) {
-      if (value === null || value === void 0 || value === "") return null;
-      const str = String(value).trim().toLowerCase();
-      return str || null;
-    },
-    _type: ""
-  };
-}
-
-// src/schema/properties/phone.ts
-var PHONE_PATTERN = /^[+]?[(]?[0-9]{1,4}[)]?[-\s./0-9]*$/;
-function phone(options = {}) {
-  return {
-    definition: {
-      type: "phone",
-      required: options.required ?? false,
-      config: {
-        placeholder: options.placeholder
-      }
-    },
-    validate(value) {
-      if (value === null || value === void 0 || value === "") {
-        return !options.required;
-      }
-      if (typeof value !== "string") return false;
-      const digitCount = value.replace(/\D/g, "").length;
-      return PHONE_PATTERN.test(value) && digitCount >= 7;
-    },
-    coerce(value) {
-      if (value === null || value === void 0 || value === "") return null;
-      const str = String(value).trim().replace(/\s+/g, " ");
-      return str || null;
-    },
-    _type: ""
-  };
-}
-
-// src/schema/properties/file.ts
-function isValidFileRef(value) {
-  if (typeof value !== "object" || value === null) return false;
-  const obj = value;
-  return typeof obj.cid === "string" && typeof obj.name === "string" && typeof obj.mimeType === "string" && typeof obj.size === "number";
-}
-function file(options = {}) {
-  const isMultiple = options.multiple ?? false;
-  return {
-    definition: {
-      type: "file",
-      required: options.required ?? false,
-      config: {
-        multiple: isMultiple,
-        accept: options.accept,
-        maxSize: options.maxSize
-      }
-    },
-    validate(value) {
-      if (value === null || value === void 0) {
-        return !options.required;
-      }
-      if (isMultiple) {
-        if (!Array.isArray(value)) return false;
-        return value.every(isValidFileRef);
-      } else {
-        return isValidFileRef(value);
-      }
-    },
-    coerce(value) {
-      if (value === null || value === void 0) {
-        return isMultiple ? [] : null;
-      }
-      if (isMultiple) {
-        const arr = Array.isArray(value) ? value : [value];
-        return arr.filter(isValidFileRef);
-      } else {
-        if (isValidFileRef(value)) {
-          return value;
-        }
-        return null;
-      }
-    },
-    _type: isMultiple ? [] : {}
-  };
-}
-
-// src/schema/properties/created.ts
-function created(options = {}) {
-  return {
-    definition: {
-      type: "created",
-      required: false,
-      // Auto-populated, not user-required
-      config: {
-        label: options.label,
-        auto: true,
-        readonly: true
-      }
-    },
-    validate(value) {
-      if (value === null || value === void 0) {
-        return true;
-      }
-      return typeof value === "number" && value > 0 && Number.isFinite(value);
-    },
-    coerce(value) {
-      if (value === null || value === void 0) {
-        return Date.now();
-      }
-      if (typeof value === "number" && value > 0) {
-        return value;
-      }
-      if (typeof value === "string") {
-        const parsed = Date.parse(value);
-        if (!isNaN(parsed)) return parsed;
-      }
-      return Date.now();
-    },
-    _type: 0
-  };
-}
-
-// src/schema/properties/updated.ts
-function updated(options = {}) {
-  return {
-    definition: {
-      type: "updated",
-      required: false,
-      // Auto-populated, not user-required
-      config: {
-        label: options.label,
-        auto: true,
-        readonly: true
-      }
-    },
-    validate(value) {
-      if (value === null || value === void 0) {
-        return true;
-      }
-      return typeof value === "number" && value > 0 && Number.isFinite(value);
-    },
-    coerce(value) {
-      if (value === null || value === void 0) {
-        return Date.now();
-      }
-      if (typeof value === "number" && value > 0) {
-        return value;
-      }
-      if (typeof value === "string") {
-        const parsed = Date.parse(value);
-        if (!isNaN(parsed)) return parsed;
-      }
-      return Date.now();
-    },
-    _type: 0
-  };
-}
+};
 
-// src/schema/properties/createdBy.ts
-var DID_PATTERN2 = /^did:[a-z]+:[a-zA-Z0-9._:-]+$/;
-function createdBy(options = {}) {
-  return {
-    definition: {
-      type: "createdBy",
-      required: false,
-      // Auto-populated, not user-required
-      config: {
-        label: options.label,
-        auto: true,
-        readonly: true
-      }
-    },
-    validate(value) {
-      if (value === null || value === void 0) {
-        return true;
-      }
-      return typeof value === "string" && DID_PATTERN2.test(value);
-    },
-    coerce(value) {
-      if (value === null || value === void 0) {
-        return null;
-      }
-      if (typeof value === "string" && DID_PATTERN2.test(value)) {
-        return value;
-      }
-      return null;
-    },
-    _type: ""
-  };
-}
+// src/auth/rollout.ts
+var AUTH_FEATURE_FLAGS = {
+  enforceLocal: false,
+  enforceRemote: false,
+  enforceHub: false,
+  enforceEncryption: false,
+  logDecisions: true
+};
 
 export {
-  parseSchemaIRI,
-  normalizeSchemaIRI,
-  getBaseSchemaIRI,
-  isNode,
-  createNodeId,
+  allow,
+  deny,
+  and,
+  or,
+  not,
+  PUBLIC,
+  AUTHENTICATED,
+  role,
+  relation,
+  BUILTIN_ROLES,
+  extractRoleRefs,
+  countExpressionNodes,
+  hasPublicAccess,
+  MAX_EXPRESSION_NODES,
+  validateAuthorization,
+  serializeAuthExpression,
+  deserializeAuthExpression,
+  serializeAuthorization,
+  deserializeAuthorization,
+  presets,
+  describeRoleResolver,
+  buildPermissionMatrix,
+  getAuthMode,
+  warnLegacySchema,
+  schemaToHubPolicy,
+  hubActionsForSpaceRole,
+  PUBLIC_CONTENT_KEY,
+  PUBLIC_RECIPIENT,
+  computeRecipients,
+  hasRecipientsChanged,
+  canTransitionToPublic,
+  handleAuthMigration,
   GRANT_SCHEMA_IRI,
   isGrantActive,
   GrantIndex,
@@ -2322,26 +2249,14 @@ export {
   mergeOfflinePolicy,
   DecisionCache,
   DefaultRoleResolver,
+  evaluateExpression,
   DefaultPolicyEvaluator,
+  createPolicyEvaluator,
   GrantExpirationCleaner,
   GrantRateLimiter,
   StoreAuthError,
   StoreAuth,
-  defineSchema,
-  text,
-  number,
-  checkbox,
-  date,
-  dateRange,
-  select,
-  multiSelect,
-  person,
-  relation2 as relation,
-  url,
-  email,
-  phone,
-  file,
-  created,
-  updated,
-  createdBy
+  AuthMigrator,
+  AUTH_FEATURE_FLAGS,
+  AUTH_ACTIONS2 as AUTH_ACTIONS
 };