@xnetjs/data 0.0.2

package/dist/chunk-SZC345Z2.js

@@ -0,0 +1,2347 @@
+// src/schema/node.ts
+import { nanoid } from "nanoid";
+var DEFAULT_SCHEMA_VERSION = "1.0.0";
+function parseSchemaIRI(iri) {
+  const match = iri.match(/^(xnet:\/\/[^/]+\/)([^@]+)(?:@(.+))?$/);
+  if (!match) {
+    return {
+      iri,
+      baseIRI: iri,
+      namespace: "",
+      name: iri,
+      version: DEFAULT_SCHEMA_VERSION,
+      hasExplicitVersion: false
+    };
+  }
+  const [, namespace, name, version] = match;
+  const hasExplicitVersion = version !== void 0;
+  const resolvedVersion = version ?? DEFAULT_SCHEMA_VERSION;
+  const baseIRI = `${namespace}${name}`;
+  return {
+    iri: hasExplicitVersion ? iri : `${baseIRI}@${resolvedVersion}`,
+    baseIRI,
+    namespace,
+    name,
+    version: resolvedVersion,
+    hasExplicitVersion
+  };
+}
+function normalizeSchemaIRI(iri) {
+  const parsed = parseSchemaIRI(iri);
+  return parsed.iri;
+}
+function getBaseSchemaIRI(iri) {
+  return parseSchemaIRI(iri).baseIRI;
+}
+function isNode(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const obj = value;
+  return typeof obj.id === "string" && typeof obj.schemaId === "string" && obj.schemaId.startsWith("xnet://") && typeof obj.createdAt === "number" && typeof obj.createdBy === "string" && obj.createdBy.startsWith("did:key:");
+}
+function createNodeId(length) {
+  return nanoid(length);
+}
+
+// src/auth/grants.ts
+var GRANT_SCHEMA_IRI = "xnet://xnet.fyi/Grant";
+function isGrantActive(grant, now = Date.now()) {
+  const revokedAt = asNumber(grant.properties.revokedAt);
+  if (revokedAt > 0) {
+    return false;
+  }
+  const expiresAt = asNumber(grant.properties.expiresAt);
+  if (expiresAt > 0 && expiresAt <= now) {
+    return false;
+  }
+  return true;
+}
+var GrantIndex = class {
+  constructor(store, options = {}) {
+    this.store = store;
+    this.schemaId = options.schemaId ?? GRANT_SCHEMA_IRI;
+    this.clock = options.clock ?? Date.now;
+  }
+  byResourceAndGrantee = /* @__PURE__ */ new Map();
+  byResource = /* @__PURE__ */ new Map();
+  grantsById = /* @__PURE__ */ new Map();
+  unsubscribe = null;
+  schemaId;
+  clock;
+  async initialize() {
+    const grants = await this.loadGrantNodes();
+    for (const grant of grants) {
+      this.indexGrant(grant);
+    }
+    this.unsubscribe = this.store.subscribe((event) => {
+      const node = event.node;
+      if (!node || !this.isGrantSchema(node.schemaId)) {
+        return;
+      }
+      this.removeGrant(node.id);
+      if (!node.deleted) {
+        this.indexGrant(node);
+      }
+    });
+  }
+  findGrants(resource, grantee) {
+    const grantsByGrantee = this.byResourceAndGrantee.get(resource);
+    if (!grantsByGrantee) return [];
+    const grantIds = grantsByGrantee.get(grantee);
+    if (!grantIds) return [];
+    const now = this.clock();
+    const grants = [];
+    for (const grantId of grantIds) {
+      const grant = this.grantsById.get(grantId);
+      if (grant && isGrantActive(grant, now)) {
+        grants.push(grant);
+      }
+    }
+    return grants;
+  }
+  findGrantsForResource(resource) {
+    const grantIds = this.byResource.get(resource);
+    if (!grantIds) return [];
+    const now = this.clock();
+    const grants = [];
+    for (const grantId of grantIds) {
+      const grant = this.grantsById.get(grantId);
+      if (grant && isGrantActive(grant, now)) {
+        grants.push(grant);
+      }
+    }
+    return grants;
+  }
+  findAllGrantsForResource(resource) {
+    const grantIds = this.byResource.get(resource);
+    if (!grantIds) return [];
+    const grants = [];
+    for (const grantId of grantIds) {
+      const grant = this.grantsById.get(grantId);
+      if (grant) {
+        grants.push(grant);
+      }
+    }
+    return grants;
+  }
+  findGrantsForGrantee(grantee) {
+    const grants = [];
+    const now = this.clock();
+    for (const grantsByGrantee of this.byResourceAndGrantee.values()) {
+      const grantIds = grantsByGrantee.get(grantee);
+      if (!grantIds) continue;
+      for (const grantId of grantIds) {
+        const grant = this.grantsById.get(grantId);
+        if (grant && isGrantActive(grant, now)) {
+          grants.push(grant);
+        }
+      }
+    }
+    return grants;
+  }
+  dispose() {
+    this.unsubscribe?.();
+    this.unsubscribe = null;
+    this.byResourceAndGrantee.clear();
+    this.byResource.clear();
+    this.grantsById.clear();
+  }
+  async loadGrantNodes() {
+    const directMatches = await this.store.list({ schemaId: this.schemaId, includeDeleted: false });
+    if (directMatches.length > 0 || this.schemaId.includes("@")) {
+      return directMatches;
+    }
+    const allNodes = await this.store.list({ includeDeleted: false });
+    return allNodes.filter((node) => this.isGrantSchema(node.schemaId));
+  }
+  isGrantSchema(schemaId) {
+    return schemaId === this.schemaId || schemaId.startsWith(`${this.schemaId}@`);
+  }
+  indexGrant(node) {
+    const resource = asString(node.properties.resource);
+    const grantee = asDid(node.properties.grantee);
+    if (!resource || !grantee) {
+      return;
+    }
+    const grant = {
+      id: node.id,
+      properties: node.properties,
+      deleted: node.deleted
+    };
+    this.grantsById.set(node.id, grant);
+    let byGrantee = this.byResourceAndGrantee.get(resource);
+    if (!byGrantee) {
+      byGrantee = /* @__PURE__ */ new Map();
+      this.byResourceAndGrantee.set(resource, byGrantee);
+    }
+    let grantIdsForGrantee = byGrantee.get(grantee);
+    if (!grantIdsForGrantee) {
+      grantIdsForGrantee = /* @__PURE__ */ new Set();
+      byGrantee.set(grantee, grantIdsForGrantee);
+    }
+    grantIdsForGrantee.add(node.id);
+    let grantIdsForResource = this.byResource.get(resource);
+    if (!grantIdsForResource) {
+      grantIdsForResource = /* @__PURE__ */ new Set();
+      this.byResource.set(resource, grantIdsForResource);
+    }
+    grantIdsForResource.add(node.id);
+  }
+  removeGrant(grantId) {
+    const existing = this.grantsById.get(grantId);
+    if (!existing) {
+      return;
+    }
+    const resource = asString(existing.properties.resource);
+    const grantee = asDid(existing.properties.grantee);
+    this.grantsById.delete(grantId);
+    if (!resource || !grantee) {
+      return;
+    }
+    const byGrantee = this.byResourceAndGrantee.get(resource);
+    if (byGrantee) {
+      const grantIds = byGrantee.get(grantee);
+      if (grantIds) {
+        grantIds.delete(grantId);
+        if (grantIds.size === 0) {
+          byGrantee.delete(grantee);
+        }
+      }
+      if (byGrantee.size === 0) {
+        this.byResourceAndGrantee.delete(resource);
+      }
+    }
+    const byResource = this.byResource.get(resource);
+    if (byResource) {
+      byResource.delete(grantId);
+      if (byResource.size === 0) {
+        this.byResource.delete(resource);
+      }
+    }
+  }
+};
+function asDid(value) {
+  if (typeof value === "string" && value.startsWith("did:key:")) {
+    return value;
+  }
+  return null;
+}
+function asString(value) {
+  return typeof value === "string" ? value : null;
+}
+function asNumber(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : 0;
+}
+
+// src/auth/offline-policy.ts
+var DEFAULT_OFFLINE_POLICY = {
+  decisionCacheTTL: 5 * 60 * 1e3,
+  maxStaleness: 60 * 60 * 1e3,
+  revalidation: "hybrid",
+  allowOfflineGrants: true
+};
+function mergeOfflinePolicy(current, patch) {
+  return {
+    ...current,
+    ...patch
+  };
+}
+
+// src/auth/mode.ts
+function getAuthMode(schema) {
+  if (!schema.authorization) return "legacy";
+  return "enforce";
+}
+
+// src/auth/serialize.ts
+function serializeAuthExpression(expr) {
+  switch (expr._tag) {
+    case "allow":
+      return { _tag: "allow", roles: [...expr.roles] };
+    case "deny":
+      return { _tag: "deny", roles: [...expr.roles] };
+    case "and":
+      return { _tag: "and", exprs: expr.exprs.map(serializeAuthExpression) };
+    case "or":
+      return { _tag: "or", exprs: expr.exprs.map(serializeAuthExpression) };
+    case "not":
+      return { _tag: "not", expr: serializeAuthExpression(expr.expr) };
+    case "roleRef":
+      return { _tag: "roleRef", role: expr.role };
+    case "public":
+      return { _tag: "public" };
+    case "authenticated":
+      return { _tag: "authenticated" };
+  }
+}
+function deserializeAuthExpression(serialized) {
+  switch (serialized._tag) {
+    case "allow":
+      return { _tag: "allow", roles: serialized.roles };
+    case "deny":
+      return { _tag: "deny", roles: serialized.roles };
+    case "and":
+      return { _tag: "and", exprs: serialized.exprs.map(deserializeAuthExpression) };
+    case "or":
+      return { _tag: "or", exprs: serialized.exprs.map(deserializeAuthExpression) };
+    case "not":
+      return { _tag: "not", expr: deserializeAuthExpression(serialized.expr) };
+    case "roleRef":
+      return { _tag: "roleRef", role: serialized.role };
+    case "public":
+      return { _tag: "public" };
+    case "authenticated":
+      return { _tag: "authenticated" };
+  }
+}
+function serializeRoleResolver(resolver) {
+  switch (resolver._tag) {
+    case "creator":
+      return { _tag: "creator" };
+    case "property":
+      return { _tag: "property", propertyName: resolver.propertyName };
+    case "relation":
+      return {
+        _tag: "relation",
+        relationName: resolver.relationName,
+        targetRole: resolver.targetRole
+      };
+  }
+}
+function deserializeRoleResolver(serialized) {
+  switch (serialized._tag) {
+    case "creator":
+      return { _tag: "creator" };
+    case "property":
+      return { _tag: "property", propertyName: serialized.propertyName };
+    case "relation":
+      return {
+        _tag: "relation",
+        relationName: serialized.relationName,
+        targetRole: serialized.targetRole
+      };
+  }
+}
+function serializeAuthorization(auth) {
+  const serialized = {
+    roles: {},
+    actions: {}
+  };
+  for (const [name, resolver] of Object.entries(auth.roles)) {
+    serialized.roles[name] = serializeRoleResolver(resolver);
+  }
+  for (const [name, expr] of Object.entries(auth.actions)) {
+    serialized.actions[name] = serializeAuthExpression(expr);
+  }
+  if (auth.publicProps) {
+    serialized.publicProps = [...auth.publicProps];
+  }
+  if (auth.fieldRules) {
+    serialized.fieldRules = {};
+    for (const [fieldName, rule] of Object.entries(auth.fieldRules)) {
+      serialized.fieldRules[fieldName] = {
+        allow: serializeAuthExpression(rule.allow),
+        deny: rule.deny ? serializeAuthExpression(rule.deny) : void 0
+      };
+    }
+  }
+  if (auth.nodePolicy) {
+    serialized.nodePolicy = {
+      mode: auth.nodePolicy.mode,
+      allow: [...auth.nodePolicy.allow]
+    };
+  }
+  return serialized;
+}
+function deserializeAuthorization(serialized) {
+  const auth = {
+    roles: {},
+    actions: {}
+  };
+  for (const [name, resolver] of Object.entries(serialized.roles)) {
+    auth.roles[name] = deserializeRoleResolver(resolver);
+  }
+  for (const [name, expr] of Object.entries(serialized.actions)) {
+    auth.actions[name] = deserializeAuthExpression(expr);
+  }
+  if (serialized.publicProps) {
+    auth.publicProps = [...serialized.publicProps];
+  }
+  if (serialized.fieldRules) {
+    auth.fieldRules = {};
+    for (const [fieldName, rule] of Object.entries(serialized.fieldRules)) {
+      auth.fieldRules[fieldName] = {
+        allow: deserializeAuthExpression(rule.allow),
+        deny: rule.deny ? deserializeAuthExpression(rule.deny) : void 0
+      };
+    }
+  }
+  if (serialized.nodePolicy) {
+    auth.nodePolicy = {
+      mode: serialized.nodePolicy.mode,
+      allow: serialized.nodePolicy.allow
+    };
+  }
+  return auth;
+}
+
+// src/auth/validate.ts
+var BUILTIN_ROLES = ["owner"];
+function extractRoleRefs(expr) {
+  const roles = [];
+  function visit(e) {
+    switch (e._tag) {
+      case "allow":
+      case "deny":
+        roles.push(...e.roles);
+        break;
+      case "and":
+      case "or":
+        for (const sub of e.exprs) visit(sub);
+        break;
+      case "not":
+        visit(e.expr);
+        break;
+      case "roleRef":
+        roles.push(e.role);
+        break;
+      case "public":
+      case "authenticated":
+        break;
+    }
+  }
+  visit(expr);
+  return roles;
+}
+function countExpressionNodes(expr) {
+  let count = 1;
+  switch (expr._tag) {
+    case "and":
+    case "or":
+      for (const sub of expr.exprs) {
+        count += countExpressionNodes(sub);
+      }
+      break;
+    case "not":
+      count += countExpressionNodes(expr.expr);
+      break;
+  }
+  return count;
+}
+function hasPublicAccess(expr) {
+  if (expr._tag === "public") return true;
+  if (expr._tag === "or") return expr.exprs.some(hasPublicAccess);
+  if (expr._tag === "and") return expr.exprs.every(hasPublicAccess);
+  if (expr._tag === "not") return false;
+  return false;
+}
+var MAX_EXPRESSION_NODES = 50;
+function validateAuthorization(auth, properties) {
+  const errors = [];
+  for (const [actionName, expr] of Object.entries(auth.actions)) {
+    const referencedRoles = extractRoleRefs(expr);
+    for (const ref of referencedRoles) {
+      if (!(ref in auth.roles) && !BUILTIN_ROLES.includes(ref)) {
+        errors.push({
+          code: "AUTH_SCHEMA_INVALID_ROLE_REF",
+          message: `Action '${actionName}' references unknown role '${ref}'`,
+          path: `authorization.actions.${actionName}`
+        });
+      }
+    }
+  }
+  for (const [roleName, resolver] of Object.entries(auth.roles)) {
+    if (resolver._tag === "property") {
+      const propDef = properties[resolver.propertyName];
+      if (!propDef) {
+        errors.push({
+          code: "AUTH_SCHEMA_INVALID_RELATION_PATH",
+          message: `Role '${roleName}' references non-existent property '${resolver.propertyName}'`,
+          path: `authorization.roles.${roleName}`
+        });
+      } else if (propDef.type !== "person") {
+        errors.push({
+          code: "AUTH_SCHEMA_INVALID_RELATION_PATH",
+          message: `Role '${roleName}' references property '${resolver.propertyName}' which is not a person type (got '${propDef.type}')`,
+          path: `authorization.roles.${roleName}`
+        });
+      }
+    }
+    if (resolver._tag === "relation") {
+      const propDef = properties[resolver.relationName];
+      if (!propDef) {
+        errors.push({
+          code: "AUTH_SCHEMA_INVALID_RELATION_PATH",
+          message: `Role '${roleName}' references non-existent relation '${resolver.relationName}'`,
+          path: `authorization.roles.${roleName}`
+        });
+      } else if (propDef.type !== "relation") {
+        errors.push({
+          code: "AUTH_SCHEMA_INVALID_RELATION_PATH",
+          message: `Role '${roleName}' references property '${resolver.relationName}' which is not a relation type (got '${propDef.type}')`,
+          path: `authorization.roles.${roleName}`
+        });
+      }
+    }
+  }
+  if (auth.publicProps) {
+    for (const prop of auth.publicProps) {
+      if (!(prop in properties)) {
+        errors.push({
+          code: "AUTH_SCHEMA_INVALID_PUBLIC_PROP",
+          message: `publicProps references non-existent property '${prop}'`,
+          path: `authorization.publicProps`
+        });
+      }
+    }
+  }
+  for (const [actionName, expr] of Object.entries(auth.actions)) {
+    const nodeCount = countExpressionNodes(expr);
+    if (nodeCount > MAX_EXPRESSION_NODES) {
+      errors.push({
+        code: "AUTH_SCHEMA_EXPR_LIMIT_EXCEEDED",
+        message: `Action '${actionName}' expression has ${nodeCount} nodes (max ${MAX_EXPRESSION_NODES})`,
+        path: `authorization.actions.${actionName}`
+      });
+    }
+  }
+  if (auth.fieldRules) {
+    for (const fieldName of Object.keys(auth.fieldRules)) {
+      if (!(fieldName in properties)) {
+        errors.push({
+          code: "AUTH_SCHEMA_INVALID_FIELD_REF",
+          message: `fieldRules references non-existent property '${fieldName}'`,
+          path: `authorization.fieldRules.${fieldName}`
+        });
+      }
+    }
+  }
+  const mutationActions = ["write", "delete", "share"];
+  for (const actionName of mutationActions) {
+    const expr = auth.actions[actionName];
+    if (expr && hasPublicAccess(expr)) {
+      errors.push({
+        code: "AUTH_SCHEMA_UNSAFE_PUBLIC_MUTATION",
+        message: `Action '${actionName}' allows PUBLIC access, which is unsafe for mutation operations`,
+        path: `authorization.actions.${actionName}`
+      });
+    }
+  }
+  return { valid: errors.length === 0, errors };
+}
+
+// src/auth/evaluator.ts
+var DecisionCache = class {
+  cache = /* @__PURE__ */ new Map();
+  ttlMs;
+  maxSize;
+  now;
+  constructor(options = {}) {
+    this.ttlMs = options.ttlMs ?? 3e4;
+    this.maxSize = options.maxSize ?? 1e4;
+    this.now = options.now ?? Date.now;
+  }
+  get(subject, action, nodeId) {
+    const key = this.key(subject, action, nodeId);
+    const entry = this.cache.get(key);
+    if (!entry) {
+      return null;
+    }
+    if (entry.expiresAt <= this.now()) {
+      this.cache.delete(key);
+      return null;
+    }
+    this.cache.delete(key);
+    this.cache.set(key, entry);
+    return entry.decision;
+  }
+  set(subject, action, nodeId, decision) {
+    const key = this.key(subject, action, nodeId);
+    this.cache.delete(key);
+    this.cache.set(key, {
+      decision,
+      expiresAt: this.now() + this.ttlMs
+    });
+    if (this.cache.size > this.maxSize) {
+      const oldestKey = this.cache.keys().next().value;
+      if (oldestKey) {
+        this.cache.delete(oldestKey);
+      }
+    }
+  }
+  invalidateNode(nodeId) {
+    for (const key of this.cache.keys()) {
+      if (key.endsWith(`:${nodeId}`)) {
+        this.cache.delete(key);
+      }
+    }
+  }
+  invalidateSubject(did) {
+    for (const key of this.cache.keys()) {
+      if (key.startsWith(`${did}:`)) {
+        this.cache.delete(key);
+      }
+    }
+  }
+  clear() {
+    this.cache.clear();
+  }
+  setTTL(ttlMs) {
+    this.ttlMs = Math.max(0, ttlMs);
+  }
+  key(subject, action, nodeId) {
+    return `${subject}:${action}:${nodeId}`;
+  }
+};
+var DefaultRoleResolver = class {
+  constructor(store, schemaRegistry, options = {}) {
+    this.store = store;
+    this.schemaRegistry = schemaRegistry;
+    this.maxDepth = options.maxDepth ?? 3;
+    this.maxNodes = options.maxNodes ?? 100;
+  }
+  maxDepth;
+  maxNodes;
+  async resolveRoles(did, node, schema) {
+    const roles = /* @__PURE__ */ new Set();
+    if (!schema.authorization) {
+      return roles;
+    }
+    const auth = deserializeAuthorization(schema.authorization);
+    for (const [roleName, resolver] of Object.entries(auth.roles)) {
+      const visited = /* @__PURE__ */ new Set();
+      const hasRole = await this.checkRole(did, resolver, node, 0, visited);
+      if (hasRole) {
+        roles.add(roleName);
+      }
+    }
+    return roles;
+  }
+  async resolveRoleMembers(resolver, node) {
+    return this.resolveRoleMembersInner(resolver, node, 0, /* @__PURE__ */ new Set());
+  }
+  async resolveRoleMembersInner(resolver, node, depth, visited) {
+    if (depth > this.maxDepth || visited.size >= this.maxNodes) {
+      return [];
+    }
+    const visitKey = `${node.id}:${resolver._tag}`;
+    if (visited.has(visitKey)) {
+      return [];
+    }
+    visited.add(visitKey);
+    switch (resolver._tag) {
+      case "creator":
+        return [node.createdBy];
+      case "property":
+        return readDidProperty(node.properties[resolver.propertyName]);
+      case "relation": {
+        const relatedNodes = await this.loadRelatedNodes(node, resolver.relationName);
+        if (relatedNodes.length === 0) {
+          return [];
+        }
+        const members = /* @__PURE__ */ new Set();
+        for (const relatedNode of relatedNodes) {
+          const relatedSchema = await this.schemaRegistry.get(relatedNode.schemaId);
+          const relatedAuth = relatedSchema?.schema.authorization;
+          if (!relatedAuth) {
+            continue;
+          }
+          const targetResolver = deserializeAuthorization(relatedAuth).roles[resolver.targetRole];
+          if (!targetResolver) {
+            continue;
+          }
+          const targetMembers = await this.resolveRoleMembersInner(
+            targetResolver,
+            relatedNode,
+            depth + 1,
+            visited
+          );
+          for (const member of targetMembers) {
+            members.add(member);
+          }
+        }
+        return [...members];
+      }
+    }
+  }
+  async checkRole(did, resolver, node, depth, visited) {
+    if (depth > this.maxDepth || visited.size >= this.maxNodes) {
+      return false;
+    }
+    const visitKey = `${node.id}:${resolver._tag}:${depth}`;
+    if (visited.has(visitKey)) {
+      return false;
+    }
+    visited.add(visitKey);
+    switch (resolver._tag) {
+      case "creator":
+        return did === node.createdBy;
+      case "property":
+        return readDidProperty(node.properties[resolver.propertyName]).includes(did);
+      case "relation": {
+        const relatedNodes = await this.loadRelatedNodes(node, resolver.relationName);
+        for (const relatedNode of relatedNodes) {
+          const relatedSchema = await this.schemaRegistry.get(relatedNode.schemaId);
+          const relatedAuth = relatedSchema?.schema.authorization;
+          if (!relatedAuth) {
+            continue;
+          }
+          const targetResolver = deserializeAuthorization(relatedAuth).roles[resolver.targetRole];
+          if (!targetResolver) {
+            continue;
+          }
+          const hasRole = await this.checkRole(did, targetResolver, relatedNode, depth + 1, visited);
+          if (hasRole) {
+            return true;
+          }
+        }
+        return false;
+      }
+    }
+  }
+  async loadRelatedNodes(node, relationName) {
+    const value = node.properties[relationName];
+    const relationIds = Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : typeof value === "string" ? [value] : [];
+    const nodes = [];
+    for (const relationId of relationIds) {
+      const relatedNode = await this.store.get(relationId);
+      if (relatedNode) {
+        nodes.push(relatedNode);
+      }
+    }
+    return nodes;
+  }
+};
+function evaluateExpression(expr, roles, isAuthenticated) {
+  switch (expr._tag) {
+    case "allow":
+      return expr.roles.some((role2) => roles.has(role2));
+    case "deny":
+      return expr.roles.some((role2) => roles.has(role2));
+    case "and":
+      return expr.exprs.every((entry) => evaluateExpression(entry, roles, isAuthenticated));
+    case "or":
+      return expr.exprs.some((entry) => evaluateExpression(entry, roles, isAuthenticated));
+    case "not":
+      return !evaluateExpression(expr.expr, roles, isAuthenticated);
+    case "roleRef":
+      return roles.has(expr.role);
+    case "public":
+      return true;
+    case "authenticated":
+      return isAuthenticated;
+  }
+}
+var DefaultPolicyEvaluator = class {
+  constructor(options) {
+    this.options = options;
+    this.grantIndex = options.grantIndex;
+    this.cache = options.cache ?? new DecisionCache();
+    this.roleResolver = options.roleResolver ?? new DefaultRoleResolver(options.store, options.schemaRegistry, {
+      maxDepth: options.maxDepth,
+      maxNodes: options.maxNodes
+    });
+    this.now = options.now ?? Date.now;
+    this.offlinePolicy = mergeOfflinePolicy(DEFAULT_OFFLINE_POLICY, options.offlinePolicy ?? {});
+    this.getLastSyncedAt = options.getLastSyncedAt;
+    this.isOnline = options.isOnline ?? (() => true);
+    this.onRevalidation = options.onRevalidation;
+    this.onDecision = options.onDecision;
+    this.lastConnectivityOnline = this.isOnline();
+  }
+  grantIndex;
+  cache;
+  roleResolver;
+  now;
+  offlinePolicy;
+  getLastSyncedAt;
+  isOnline;
+  onRevalidation;
+  onDecision;
+  lastConnectivityOnline;
+  async can(input) {
+    const start = performance.now();
+    this.cache.setTTL(this.offlinePolicy.decisionCacheTTL);
+    if (this.isAuthStateStale()) {
+      const decision2 = this.deny(input, ["DENY_STALE_OFFLINE"], start);
+      this.emitDecision(decision2);
+      return decision2;
+    }
+    const cached = this.cache.get(input.subject, input.action, input.nodeId);
+    if (cached) {
+      const decision2 = {
+        ...cached,
+        cached: true,
+        duration: performance.now() - start
+      };
+      this.emitDecision(decision2);
+      return decision2;
+    }
+    const node = input.node ? await this.loadNodeFromInput(input) : await this.options.store.get(input.nodeId);
+    if (!node) {
+      const decision2 = this.deny(input, ["DENY_NOT_AUTHENTICATED"], start);
+      this.emitDecision(decision2);
+      return decision2;
+    }
+    const schema = await this.options.schemaRegistry.get(node.schemaId);
+    if (!schema) {
+      const decision2 = this.deny(input, ["DENY_NOT_AUTHENTICATED"], start);
+      this.emitDecision(decision2);
+      return decision2;
+    }
+    const mode = getAuthMode(schema.schema);
+    if (mode === "legacy") {
+      const allowed = node.createdBy === input.subject;
+      const decision2 = this.decision(input, allowed, allowed ? ["owner"] : [], start);
+      this.cache.set(input.subject, input.action, input.nodeId, decision2);
+      this.emitDecision(decision2);
+      return decision2;
+    }
+    if (!schema.schema.authorization) {
+      const decision2 = this.deny(input, ["DENY_NO_ROLE_MATCH"], start);
+      this.emitDecision(decision2);
+      return decision2;
+    }
+    const auth = deserializeAuthorization(schema.schema.authorization);
+    const roles = await this.roleResolver.resolveRoles(input.subject, node, schema.schema);
+    const fieldRuleDenied = this.checkFieldRules(input, auth.fieldRules, roles);
+    if (fieldRuleDenied) {
+      const decision2 = this.deny(input, ["DENY_FIELD_RESTRICTED"], start, [...roles]);
+      this.emitDecision(decision2);
+      return decision2;
+    }
+    const actionExpr = auth.actions[input.action];
+    if (!actionExpr) {
+      const decision2 = this.deny(input, ["DENY_NO_ROLE_MATCH"], start, [...roles]);
+      this.emitDecision(decision2);
+      return decision2;
+    }
+    if (matchesDenyExpression(actionExpr, roles, true)) {
+      const decision2 = this.deny(input, ["DENY_NODE_POLICY"], start, [...roles]);
+      this.emitDecision(decision2);
+      return decision2;
+    }
+    const allowedByRole = evaluateExpression(actionExpr, roles, true);
+    if (allowedByRole) {
+      const decision2 = this.decision(input, true, [...roles], start);
+      this.cache.set(input.subject, input.action, input.nodeId, decision2);
+      this.emitDecision(decision2);
+      return decision2;
+    }
+    const grant = this.findMatchingGrant(
+      input,
+      this.grantIndex?.findGrants(input.nodeId, input.subject) ?? []
+    );
+    if (grant) {
+      const decision2 = this.decision(input, true, [...roles], start, [grant.id]);
+      this.cache.set(input.subject, input.action, input.nodeId, decision2);
+      this.emitDecision(decision2);
+      return decision2;
+    }
+    const reasons = roles.size > 0 ? ["DENY_NO_ROLE_MATCH"] : ["DENY_NO_ROLE_MATCH", "DENY_NO_GRANT"];
+    const decision = this.deny(input, reasons, start, [...roles]);
+    this.emitDecision(decision);
+    return decision;
+  }
+  async explain(input) {
+    const steps = [];
+    const start = performance.now();
+    const nodeStart = performance.now();
+    const node = input.node ? await this.loadNodeFromInput(input) : await this.options.store.get(input.nodeId);
+    steps.push({
+      phase: "node-deny",
+      input: { nodeId: input.nodeId },
+      output: { nodeFound: Boolean(node) },
+      duration: performance.now() - nodeStart
+    });
+    let roles = /* @__PURE__ */ new Set();
+    let actionExpr;
+    if (node) {
+      const schema = await this.options.schemaRegistry.get(node.schemaId);
+      if (schema?.schema.authorization) {
+        const roleStart = performance.now();
+        roles = await this.roleResolver.resolveRoles(input.subject, node, schema.schema);
+        steps.push({
+          phase: "role-resolve",
+          input: { subject: input.subject, nodeId: node.id },
+          output: { roles: [...roles] },
+          duration: performance.now() - roleStart
+        });
+        const auth = deserializeAuthorization(schema.schema.authorization);
+        actionExpr = auth.actions[input.action];
+        const evalStart = performance.now();
+        const requiredRoles = actionExpr ? extractRoleRefs(actionExpr) : [];
+        const allowed = actionExpr ? evaluateExpression(actionExpr, roles, true) : false;
+        steps.push({
+          phase: "schema-eval",
+          input: {
+            action: input.action,
+            requiredRoles
+          },
+          output: {
+            allowed,
+            userRoles: [...roles]
+          },
+          duration: performance.now() - evalStart
+        });
+        const grantStart = performance.now();
+        const grants = this.grantIndex?.findGrants(input.nodeId, input.subject) ?? [];
+        steps.push({
+          phase: "grant-check",
+          input: {
+            subject: input.subject,
+            action: input.action,
+            nodeId: input.nodeId
+          },
+          output: {
+            grantCount: grants.length,
+            grantIds: grants.map((grant) => grant.id)
+          },
+          duration: performance.now() - grantStart
+        });
+      }
+    }
+    const decision = await this.can(input);
+    return {
+      ...decision,
+      steps,
+      duration: performance.now() - start
+    };
+  }
+  invalidate(nodeId) {
+    this.cache.invalidateNode(nodeId);
+  }
+  invalidateSubject(did) {
+    this.cache.invalidateSubject(did);
+  }
+  getOfflinePolicy() {
+    return { ...this.offlinePolicy };
+  }
+  setOfflinePolicy(patch) {
+    this.offlinePolicy = mergeOfflinePolicy(this.offlinePolicy, patch);
+  }
+  handleConnectivityChange(isOnline) {
+    const cameOnline = !this.lastConnectivityOnline && isOnline;
+    this.lastConnectivityOnline = isOnline;
+    if (!cameOnline) {
+      return;
+    }
+    if (this.offlinePolicy.revalidation === "hybrid") {
+      this.cache.clear();
+      this.onRevalidation?.({
+        type: "hybrid-revalidation",
+        at: this.now(),
+        invalidated: "all"
+      });
+    }
+  }
+  findMatchingGrant(input, grants) {
+    const now = this.now();
+    for (const grant of grants) {
+      if (!isGrantActive(grant, now)) {
+        continue;
+      }
+      const actions = parseActions(grant.properties.actions);
+      if (actions.includes(input.action)) {
+        return grant;
+      }
+    }
+    return null;
+  }
+  checkFieldRules(input, fieldRules, roles) {
+    if (input.action !== "write" || !input.patch || !fieldRules) {
+      return false;
+    }
+    for (const fieldName of Object.keys(input.patch)) {
+      const fieldRule = fieldRules[fieldName];
+      if (!fieldRule) {
+        continue;
+      }
+      const denied = fieldRule.deny ? evaluateExpression(fieldRule.deny, roles, true) : false;
+      const allowed = evaluateExpression(fieldRule.allow, roles, true);
+      if (denied || !allowed) {
+        return true;
+      }
+    }
+    return false;
+  }
+  decision(input, allowed, roles, start, grants = []) {
+    return {
+      allowed,
+      action: input.action,
+      subject: input.subject,
+      resource: input.nodeId,
+      roles,
+      grants,
+      reasons: [],
+      cached: false,
+      evaluatedAt: this.now(),
+      duration: performance.now() - start
+    };
+  }
+  deny(input, reasons, start, roles = []) {
+    return {
+      allowed: false,
+      action: input.action,
+      subject: input.subject,
+      resource: input.nodeId,
+      roles,
+      grants: [],
+      reasons,
+      cached: false,
+      evaluatedAt: this.now(),
+      duration: performance.now() - start
+    };
+  }
+  async loadNodeFromInput(input) {
+    if (!input.node) {
+      return this.options.store.get(input.nodeId);
+    }
+    const existing = await this.options.store.get(input.nodeId);
+    if (existing) {
+      return existing;
+    }
+    return {
+      id: input.nodeId,
+      schemaId: input.node.schemaId,
+      properties: input.node.properties ?? {},
+      timestamps: {},
+      deleted: false,
+      createdAt: this.now(),
+      createdBy: input.node.createdBy,
+      updatedAt: this.now(),
+      updatedBy: input.node.createdBy
+    };
+  }
+  isAuthStateStale() {
+    if (!this.getLastSyncedAt || !this.isOnline()) {
+      return false;
+    }
+    const lastSyncedAt = this.getLastSyncedAt();
+    if (!Number.isFinite(lastSyncedAt) || lastSyncedAt <= 0) {
+      return false;
+    }
+    return this.now() - lastSyncedAt > this.offlinePolicy.maxStaleness;
+  }
+  emitDecision(decision) {
+    this.onDecision?.({
+      type: "auth:decision",
+      timestamp: this.now(),
+      subject: decision.subject,
+      action: decision.action,
+      resource: decision.resource,
+      allowed: decision.allowed,
+      cached: decision.cached,
+      roles: decision.roles,
+      reasons: decision.reasons,
+      duration: decision.duration
+    });
+  }
+};
+function matchesDenyExpression(expr, roles, isAuthenticated) {
+  switch (expr._tag) {
+    case "deny":
+      return evaluateExpression(expr, roles, isAuthenticated);
+    case "and":
+    case "or":
+      return expr.exprs.some((entry) => matchesDenyExpression(entry, roles, isAuthenticated));
+    case "not":
+      return matchesDenyExpression(expr.expr, roles, isAuthenticated);
+    default:
+      return false;
+  }
+}
+function readDidProperty(value) {
+  if (Array.isArray(value)) {
+    return value.filter(isDid);
+  }
+  if (isDid(value)) {
+    return [value];
+  }
+  return [];
+}
+function isDid(value) {
+  return typeof value === "string" && value.startsWith("did:key:");
+}
+function parseActions(value) {
+  if (Array.isArray(value)) {
+    return value.filter((entry) => typeof entry === "string");
+  }
+  if (typeof value !== "string") {
+    return [];
+  }
+  try {
+    const parsed = JSON.parse(value);
+    if (!Array.isArray(parsed)) {
+      return [];
+    }
+    return parsed.filter((entry) => typeof entry === "string");
+  } catch {
+    return [];
+  }
+}
+
+// src/auth/grant-expiration-cleaner.ts
+var GrantExpirationCleaner = class _GrantExpirationCleaner {
+  constructor(store, options = {}) {
+    this.store = store;
+    this.clock = options.clock ?? Date.now;
+    this.cleanupIntervalMs = options.cleanupIntervalMs ?? _GrantExpirationCleaner.DEFAULT_CLEANUP_INTERVAL_MS;
+    this.clockSkewToleranceMs = options.clockSkewToleranceMs ?? _GrantExpirationCleaner.DEFAULT_CLOCK_SKEW_TOLERANCE_MS;
+    this.systemRevoker = options.systemRevoker ?? "SYSTEM";
+  }
+  static DEFAULT_CLOCK_SKEW_TOLERANCE_MS = 6e4;
+  static DEFAULT_CLEANUP_INTERVAL_MS = 6 * 60 * 60 * 1e3;
+  clock;
+  cleanupIntervalMs;
+  clockSkewToleranceMs;
+  systemRevoker;
+  timer = null;
+  start() {
+    if (this.timer) {
+      return;
+    }
+    this.timer = setInterval(() => {
+      void this.cleanup();
+    }, this.cleanupIntervalMs);
+  }
+  stop() {
+    if (!this.timer) {
+      return;
+    }
+    clearInterval(this.timer);
+    this.timer = null;
+  }
+  async cleanup() {
+    const now = this.clock() - this.clockSkewToleranceMs;
+    const grants = await this.store.list({
+      schemaId: GRANT_SCHEMA_IRI,
+      includeDeleted: false
+    });
+    let pruned = 0;
+    for (const grant of grants) {
+      const expiresAt = asNumber2(grant.properties.expiresAt);
+      const revokedAt = asNumber2(grant.properties.revokedAt);
+      if (revokedAt > 0) {
+        continue;
+      }
+      if (expiresAt > 0 && expiresAt < now) {
+        await this.store.update(grant.id, {
+          properties: {
+            revokedAt: now,
+            revokedBy: this.systemRevoker
+          }
+        });
+        pruned += 1;
+      }
+    }
+    return { pruned };
+  }
+};
+function asNumber2(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : 0;
+}
+
+// src/auth/grant-rate-limit.ts
+var GrantRateLimiter = class {
+  limitPerMinute;
+  windowMs;
+  now;
+  attemptsByPeer = /* @__PURE__ */ new Map();
+  constructor(options = {}) {
+    this.limitPerMinute = options.limitPerMinute ?? 10;
+    this.windowMs = options.windowMs ?? 6e4;
+    this.now = options.now ?? Date.now;
+  }
+  allow(peerDid) {
+    const cutoff = this.now() - this.windowMs;
+    const attempts = this.attemptsByPeer.get(peerDid) ?? [];
+    const recent = attempts.filter((timestamp) => timestamp > cutoff);
+    if (recent.length >= this.limitPerMinute) {
+      this.attemptsByPeer.set(peerDid, recent);
+      return false;
+    }
+    recent.push(this.now());
+    this.attemptsByPeer.set(peerDid, recent);
+    return true;
+  }
+  reset(peerDid) {
+    if (peerDid) {
+      this.attemptsByPeer.delete(peerDid);
+      return;
+    }
+    this.attemptsByPeer.clear();
+  }
+};
+
+// src/auth/store-auth.ts
+import { createUCAN } from "@xnetjs/identity";
+var MAX_PROOF_DEPTH = 4;
+var StoreAuthError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "StoreAuthError";
+    this.code = code;
+  }
+};
+var StoreAuth = class {
+  constructor(options) {
+    this.options = options;
+    this.rateLimiter = options.rateLimiter ?? new GrantRateLimiter();
+    this.now = options.now ?? Date.now;
+    this.maxProofDepth = options.maxProofDepth ?? MAX_PROOF_DEPTH;
+    this.offlinePolicy = { ...DEFAULT_OFFLINE_POLICY };
+  }
+  rateLimiter;
+  now;
+  maxProofDepth;
+  offlinePolicy;
+  async can(input) {
+    return this.options.evaluator.can({
+      subject: this.options.actorDid,
+      action: input.action,
+      nodeId: input.nodeId,
+      patch: input.patch
+    });
+  }
+  async explain(input) {
+    return this.options.evaluator.explain({
+      subject: this.options.actorDid,
+      action: input.action,
+      nodeId: input.nodeId
+    });
+  }
+  async grant(input) {
+    if (input.to === this.options.actorDid) {
+      throw new Error("Cannot grant access to yourself");
+    }
+    if (!this.rateLimiter.allow(this.options.actorDid)) {
+      throw new StoreAuthError("AUTH_RATE_LIMIT_EXCEEDED", "Grant rate limit exceeded");
+    }
+    const canShare = await this.options.evaluator.can({
+      subject: this.options.actorDid,
+      action: "share",
+      nodeId: input.resource
+    });
+    if (!canShare.allowed) {
+      throw new StoreAuthError(
+        "AUTH_PERMISSION_DENIED",
+        "Permission denied: cannot share this resource"
+      );
+    }
+    for (const action of input.actions) {
+      const canAction = await this.options.evaluator.can({
+        subject: this.options.actorDid,
+        action,
+        nodeId: input.resource
+      });
+      if (!canAction.allowed) {
+        throw new StoreAuthError(
+          "AUTH_PERMISSION_DENIED",
+          `Permission denied: cannot delegate action '${action}'`
+        );
+      }
+    }
+    const resourceNode = await this.options.store.get(input.resource);
+    if (!resourceNode) {
+      throw new Error(`Resource not found: ${input.resource}`);
+    }
+    const parentGrant = input.parentGrantId ? await this.getGrantNodeOrThrow(input.parentGrantId) : null;
+    const proofDepth = this.computeProofDepth(parentGrant);
+    if (proofDepth > this.maxProofDepth) {
+      throw new StoreAuthError(
+        "AUTH_DELEGATION_DEPTH_EXCEEDED",
+        `Delegation proof depth exceeds max ${this.maxProofDepth}`
+      );
+    }
+    const expiresAt = this.computeExpiration(input.expiresIn);
+    this.assertDelegationAttenuation(input, parentGrant, expiresAt);
+    const ucanToken = this.createDelegationUCAN({
+      ...input,
+      expiresAt,
+      parentUcanToken: parseString(parentGrant?.properties.ucanToken) ?? void 0
+    });
+    const created2 = await this.options.store.create({
+      schemaId: GRANT_SCHEMA_IRI,
+      properties: {
+        issuer: this.options.actorDid,
+        grantee: input.to,
+        resource: input.resource,
+        resourceSchema: resourceNode.schemaId,
+        actions: JSON.stringify(input.actions),
+        expiresAt,
+        revokedAt: 0,
+        revokedBy: "",
+        ucanToken,
+        proofDepth,
+        parentGrantId: parentGrant?.id ?? ""
+      }
+    });
+    if (this.options.keyManager && this.options.publicKeyResolver) {
+      const contentKey = await this.options.keyManager.getContentKey(input.resource);
+      const granteePublicKey = await this.options.publicKeyResolver.resolve(input.to);
+      if (!granteePublicKey) {
+        throw new Error(`Cannot resolve public key for ${input.to}`);
+      }
+      await this.options.keyManager.addRecipient({
+        resourceId: input.resource,
+        recipient: input.to,
+        contentKey,
+        recipientPublicKey: granteePublicKey
+      });
+    }
+    this.options.evaluator.invalidateSubject(input.to);
+    this.options.evaluator.invalidate(input.resource);
+    const node = await this.getGrantNodeOrThrow(created2.id);
+    return toGrant(node);
+  }
+  async revoke(input) {
+    const grantNode = await this.getGrantNodeOrThrow(input.grantId);
+    const grant = toGrant(grantNode);
+    const canRevoke = grant.issuer === this.options.actorDid || (await this.options.evaluator.can({
+      subject: this.options.actorDid,
+      action: "share",
+      nodeId: grant.resource
+    })).allowed;
+    if (!canRevoke) {
+      throw new Error("Permission denied: cannot revoke this grant");
+    }
+    await this.validateRevocation(grantNode);
+    const revokedAt = this.now();
+    await this.options.store.update(input.grantId, {
+      properties: {
+        revokedAt,
+        revokedBy: this.options.actorDid
+      }
+    });
+    await this.cascadeRevocation(input.grantId);
+    if (this.options.keyManager) {
+      await this.options.keyManager.rotateContentKey(grant.resource, grant.grantee);
+    }
+    this.options.evaluator.invalidateSubject(grant.grantee);
+    this.options.evaluator.invalidate(grant.resource);
+  }
+  async listGrants(input) {
+    const status = input.status ?? "all";
+    const grants = await this.loadGrantNodes();
+    return grants.filter((grant) => parseString(grant.properties.resource) === input.nodeId).map(toGrant).filter((grant) => this.matchesStatus(grant, status));
+  }
+  async listIssuedGrants() {
+    const grants = await this.loadGrantNodes();
+    return grants.map(toGrant).filter((grant) => grant.issuer === this.options.actorDid);
+  }
+  async listReceivedGrants() {
+    const grants = await this.loadGrantNodes();
+    return grants.map(toGrant).filter((grant) => grant.grantee === this.options.actorDid);
+  }
+  getOfflinePolicy() {
+    return { ...this.offlinePolicy };
+  }
+  setOfflinePolicy(policy) {
+    this.offlinePolicy = mergeOfflinePolicy(this.offlinePolicy, policy);
+    const evaluator = this.options.evaluator;
+    evaluator.setOfflinePolicy?.(policy);
+  }
+  matchesStatus(grant, status) {
+    if (status === "all") {
+      return true;
+    }
+    const now = this.now();
+    const revoked = grant.revokedAt > 0;
+    const expired = !revoked && grant.expiresAt > 0 && grant.expiresAt <= now;
+    if (status === "active") {
+      return !revoked && !expired;
+    }
+    if (status === "expired") {
+      return expired;
+    }
+    return revoked;
+  }
+  async validateRevocation(grant) {
+    const resource = parseString(grant.properties.resource);
+    const grantee = parseDid(grant.properties.grantee);
+    if (!resource || !grantee) {
+      return;
+    }
+    const resourceNode = await this.options.store.get(resource);
+    const shareHolders = /* @__PURE__ */ new Set();
+    if (resourceNode) {
+      shareHolders.add(resourceNode.createdBy);
+    }
+    const grants = this.options.grantIndex ? this.options.grantIndex.findAllGrantsForResource(resource) : (await this.loadGrantNodes()).filter(
+      (entry) => parseString(entry.properties.resource) === resource
+    );
+    for (const entry of grants) {
+      if (entry.id === grant.id) {
+        continue;
+      }
+      const grantActions = parseActions2(entry.properties.actions);
+      if (!grantActions.includes("share") || !isGrantActive(entry, this.now())) {
+        continue;
+      }
+      const holderDid = parseDid(entry.properties.grantee);
+      if (holderDid) {
+        shareHolders.add(holderDid);
+      }
+    }
+    shareHolders.delete(grantee);
+    if (shareHolders.size === 0) {
+      throw new Error(
+        `Cannot revoke: this would leave zero users with 'share' access on ${resource}.`
+      );
+    }
+  }
+  assertDelegationAttenuation(input, parentGrant, expiresAt) {
+    if (!parentGrant) {
+      return;
+    }
+    const parentActions = parseActions2(parentGrant.properties.actions);
+    for (const action of input.actions) {
+      if (!parentActions.includes(action)) {
+        throw new StoreAuthError(
+          "AUTH_DELEGATION_ESCALATION",
+          `Delegation escalation blocked for action '${action}'`
+        );
+      }
+    }
+    const parentExpiresAt = parseNumber(parentGrant.properties.expiresAt);
+    if (parentExpiresAt > 0 && expiresAt > 0 && expiresAt > parentExpiresAt) {
+      throw new StoreAuthError(
+        "AUTH_DELEGATION_ESCALATION",
+        "Delegation expiration exceeds parent grant expiration"
+      );
+    }
+  }
+  computeProofDepth(parentGrant) {
+    if (!parentGrant) {
+      return 0;
+    }
+    return parseNumber(parentGrant.properties.proofDepth) + 1;
+  }
+  async cascadeRevocation(revokedGrantId) {
+    const now = this.now();
+    const grants = await this.loadGrantNodes();
+    const queue = [revokedGrantId];
+    const visited = new Set(queue);
+    while (queue.length > 0) {
+      const parentId = queue.shift();
+      if (!parentId) {
+        break;
+      }
+      for (const grant of grants) {
+        const parentGrantId = parseString(grant.properties.parentGrantId);
+        if (!parentGrantId || parentGrantId !== parentId) {
+          continue;
+        }
+        if (!isGrantActive(grant, now) || visited.has(grant.id)) {
+          continue;
+        }
+        await this.options.store.update(grant.id, {
+          properties: {
+            revokedAt: now,
+            revokedBy: this.options.actorDid
+          }
+        });
+        const childGrantee = parseDid(grant.properties.grantee);
+        const childResource = parseString(grant.properties.resource);
+        if (childGrantee && childResource) {
+          this.options.evaluator.invalidateSubject(childGrantee);
+          this.options.evaluator.invalidate(childResource);
+        }
+        queue.push(grant.id);
+        visited.add(grant.id);
+      }
+    }
+  }
+  async getGrantNodeOrThrow(grantId) {
+    const node = await this.options.store.get(grantId);
+    if (!node || !isGrantSchema(node.schemaId)) {
+      throw new Error(`Grant not found: ${grantId}`);
+    }
+    return {
+      id: node.id,
+      properties: node.properties,
+      deleted: false
+    };
+  }
+  async loadGrantNodes() {
+    const nodes = await this.options.store.list({
+      schemaId: GRANT_SCHEMA_IRI,
+      includeDeleted: false
+    });
+    return nodes.filter((node) => isGrantSchema(node.schemaId)).map((node) => ({
+      id: node.id,
+      properties: node.properties,
+      deleted: false
+    }));
+  }
+  createDelegationUCAN(input) {
+    return createUCAN({
+      issuer: this.options.actorDid,
+      issuerKey: this.options.signingKey,
+      audience: input.to,
+      capabilities: input.actions.map((action) => ({
+        with: `xnet://${this.options.actorDid}/node/${input.resource}`,
+        can: `xnet/${action}`
+      })),
+      expiration: Math.floor(input.expiresAt / 1e3),
+      proofs: input.parentUcanToken ? [input.parentUcanToken] : []
+    });
+  }
+  computeExpiration(expiresIn) {
+    if (typeof expiresIn === "number") {
+      return expiresIn;
+    }
+    if (typeof expiresIn === "string") {
+      const parsed = parseDuration(expiresIn);
+      if (parsed !== null) {
+        return this.now() + parsed;
+      }
+    }
+    return this.now() + 7 * 24 * 60 * 60 * 1e3;
+  }
+};
+function toGrant(node) {
+  return {
+    id: node.id,
+    issuer: parseDid(node.properties.issuer) ?? "did:key:unknown",
+    grantee: parseDid(node.properties.grantee) ?? "did:key:unknown",
+    resource: parseString(node.properties.resource) ?? "",
+    resourceSchema: parseString(node.properties.resourceSchema) ?? "",
+    actions: parseActions2(node.properties.actions),
+    expiresAt: parseNumber(node.properties.expiresAt),
+    revokedAt: parseNumber(node.properties.revokedAt),
+    revokedBy: parseDid(node.properties.revokedBy) ?? void 0,
+    ucanToken: parseString(node.properties.ucanToken) ?? void 0,
+    proofDepth: parseNumber(node.properties.proofDepth),
+    parentGrantId: parseString(node.properties.parentGrantId) ?? void 0
+  };
+}
+function isGrantSchema(schemaId) {
+  return schemaId === GRANT_SCHEMA_IRI || schemaId.startsWith(`${GRANT_SCHEMA_IRI}@`);
+}
+function parseActions2(value) {
+  if (Array.isArray(value)) {
+    return value.filter(isAuthAction);
+  }
+  if (typeof value !== "string") {
+    return [];
+  }
+  try {
+    const parsed = JSON.parse(value);
+    if (!Array.isArray(parsed)) {
+      return [];
+    }
+    return parsed.filter(isAuthAction);
+  } catch {
+    return [];
+  }
+}
+function isAuthAction(value) {
+  return value === "read" || value === "write" || value === "delete" || value === "share" || value === "admin";
+}
+function parseDid(value) {
+  if (typeof value === "string" && value.startsWith("did:key:")) {
+    return value;
+  }
+  return null;
+}
+function parseString(value) {
+  return typeof value === "string" && value.length > 0 ? value : null;
+}
+function parseNumber(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : 0;
+}
+function parseDuration(value) {
+  const match = value.match(/^(\d+)([smhdw])$/);
+  if (!match) {
+    return null;
+  }
+  const amount = Number(match[1]);
+  if (!Number.isFinite(amount) || amount <= 0) {
+    return null;
+  }
+  const unit = match[2];
+  switch (unit) {
+    case "s":
+      return amount * 1e3;
+    case "m":
+      return amount * 60 * 1e3;
+    case "h":
+      return amount * 60 * 60 * 1e3;
+    case "d":
+      return amount * 24 * 60 * 60 * 1e3;
+    case "w":
+      return amount * 7 * 24 * 60 * 60 * 1e3;
+    default:
+      return null;
+  }
+}
+
+// src/auth/index.ts
+import { AUTH_ACTIONS } from "@xnetjs/core";
+
+// src/auth/builders.ts
+var role = {
+  /**
+   * Role held by the node's creator.
+   * The DID in `createdBy` holds this role.
+   */
+  creator() {
+    return { _tag: "creator" };
+  },
+  /**
+   * Role determined by a person property on the node.
+   * The DID(s) in that property hold this role.
+   *
+   * @param propertyName - Name of the person/person[] property
+   */
+  property(propertyName) {
+    return { _tag: "property", propertyName };
+  },
+  /**
+   * Role inherited from a related node.
+   * Users who hold `targetRole` on the related node hold this role.
+   *
+   * @param relationName - Name of the relation property
+   * @param targetRole - Role to check on the related node
+   */
+  relation(relationName, targetRole) {
+    return { _tag: "relation", relationName, targetRole };
+  }
+};
+var relation = role.relation;
+
+// src/auth/recipients.ts
+var PUBLIC_CONTENT_KEY = new Uint8Array(32);
+
+// src/schema/define.ts
+var DEFAULT_SCHEMA_VERSION2 = "1.0.0";
+function defineSchema(options) {
+  const version = options.version ?? DEFAULT_SCHEMA_VERSION2;
+  const schemaId = `${options.namespace}${options.name}@${version}`;
+  if (process.env.NODE_ENV !== "production") {
+    const REF_NAME_PATTERN = /(?:^target$|^inReplyTo$|^replyTo[A-Z].*(?:Id|Node)$|(?:parent|node|comment|task|page|database)(?:Id|Ref)$)/;
+    for (const [name, builder] of Object.entries(options.properties)) {
+      if (builder.definition.type === "text" && REF_NAME_PATTERN.test(name)) {
+        console.warn(
+          `[xNet Schema] "${options.name}.${name}" is a text() property whose name suggests it stores a reference. Consider using relation() for node references or person() for DIDs.`
+        );
+      }
+    }
+  }
+  const properties = Object.entries(options.properties).map(
+    ([name, builder]) => ({
+      "@id": `${schemaId}#${name}`,
+      name,
+      ...builder.definition
+    })
+  );
+  const propertyMap = Object.fromEntries(properties.map((property) => [property.name, property]));
+  if (options.authorization) {
+    const authResult = validateAuthorization(options.authorization, propertyMap);
+    if (!authResult.valid) {
+      const message = authResult.errors.map((error) => `${error.path}: [${error.code}] ${error.message}`).join(", ");
+      throw new Error(`Invalid authorization in schema '${options.name}': ${message}`);
+    }
+  }
+  const schema = {
+    "@id": schemaId,
+    "@type": "xnet://xnet.fyi/Schema",
+    name: options.name,
+    namespace: options.namespace,
+    version,
+    migrateFrom: options.migrateFrom,
+    properties,
+    extends: options.extends?.schema["@id"],
+    document: options.document,
+    authorization: options.authorization ? serializeAuthorization(options.authorization) : void 0
+  };
+  function validate(node) {
+    const errors = [];
+    if (typeof node !== "object" || node === null) {
+      return { valid: false, errors: [{ path: "", message: "Node must be an object" }] };
+    }
+    const obj = node;
+    if (typeof obj.id !== "string") {
+      errors.push({ path: "id", message: "id is required and must be a string" });
+    }
+    if (obj.schemaId !== schemaId) {
+      errors.push({
+        path: "schemaId",
+        message: `schemaId must be '${schemaId}'`,
+        value: obj.schemaId
+      });
+    }
+    if (typeof obj.createdAt !== "number") {
+      errors.push({ path: "createdAt", message: "createdAt is required and must be a number" });
+    }
+    if (typeof obj.createdBy !== "string" || !obj.createdBy.startsWith("did:key:")) {
+      errors.push({ path: "createdBy", message: "createdBy must be a valid DID" });
+    }
+    for (const [name, builder] of Object.entries(options.properties)) {
+      const value = obj[name];
+      const isRequired = builder.definition.required;
+      if (value === void 0 || value === null) {
+        if (isRequired) {
+          errors.push({ path: name, message: `${name} is required` });
+        }
+      } else if (!builder.validate(value)) {
+        errors.push({ path: name, message: `${name} has invalid value`, value });
+      }
+    }
+    return { valid: errors.length === 0, errors };
+  }
+  function create(props, createOptions) {
+    const now = createOptions.createdAt ?? Date.now();
+    const id = createOptions.id ?? createNodeId();
+    const node = {
+      id,
+      schemaId,
+      createdAt: now,
+      createdBy: createOptions.createdBy
+    };
+    for (const [name, builder] of Object.entries(options.properties)) {
+      const rawValue = props[name];
+      const coerced = builder.coerce(rawValue);
+      if (coerced !== null) {
+        node[name] = coerced;
+      }
+    }
+    return node;
+  }
+  function is(node) {
+    return node.schemaId === schemaId;
+  }
+  return {
+    schema,
+    validate,
+    create,
+    is,
+    _schemaId: schemaId,
+    _properties: options.properties
+  };
+}
+
+// src/schema/properties/text.ts
+function text(options = {}) {
+  return {
+    definition: {
+      type: "text",
+      required: options.required ?? false,
+      config: {
+        minLength: options.minLength,
+        maxLength: options.maxLength,
+        pattern: options.pattern?.source,
+        placeholder: options.placeholder
+      }
+    },
+    validate(value) {
+      if (value === null || value === void 0) {
+        return !options.required;
+      }
+      if (typeof value !== "string") return false;
+      if (options.minLength !== void 0 && value.length < options.minLength) return false;
+      if (options.maxLength !== void 0 && value.length > options.maxLength) return false;
+      if (options.pattern && !options.pattern.test(value)) return false;
+      return true;
+    },
+    coerce(value) {
+      if (value === null || value === void 0) return null;
+      return String(value);
+    },
+    _type: ""
+  };
+}
+
+// src/schema/properties/number.ts
+function number(options = {}) {
+  return {
+    definition: {
+      type: "number",
+      required: options.required ?? false,
+      config: {
+        min: options.min,
+        max: options.max,
+        integer: options.integer
+      }
+    },
+    validate(value) {
+      if (value === null || value === void 0) {
+        return !options.required;
+      }
+      if (typeof value !== "number" || isNaN(value)) return false;
+      if (options.min !== void 0 && value < options.min) return false;
+      if (options.max !== void 0 && value > options.max) return false;
+      if (options.integer && !Number.isInteger(value)) return false;
+      return true;
+    },
+    coerce(value) {
+      if (value === null || value === void 0) return null;
+      const num = Number(value);
+      if (isNaN(num)) return null;
+      if (options.integer) return Math.round(num);
+      return num;
+    },
+    _type: 0
+  };
+}
+
+// src/schema/properties/checkbox.ts
+function checkbox(options = {}) {
+  return {
+    definition: {
+      type: "checkbox",
+      required: options.required ?? false,
+      config: {
+        default: options.default
+      }
+    },
+    validate(value) {
+      if (value === null || value === void 0) {
+        return !options.required;
+      }
+      return typeof value === "boolean";
+    },
+    coerce(value) {
+      if (value === null || value === void 0) {
+        return options.default ?? null;
+      }
+      if (typeof value === "boolean") return value;
+      if (value === "true" || value === 1) return true;
+      if (value === "false" || value === 0) return false;
+      return Boolean(value);
+    },
+    _type: false
+  };
+}
+
+// src/schema/properties/date.ts
+function date(options = {}) {
+  return {
+    definition: {
+      type: "date",
+      required: options.required ?? false,
+      config: {
+        includeTime: options.includeTime ?? false
+      }
+    },
+    validate(value) {
+      if (value === null || value === void 0) {
+        return !options.required;
+      }
+      if (typeof value !== "number") return false;
+      return value >= 0 && value < 3250368e7;
+    },
+    coerce(value) {
+      if (value === null || value === void 0) return null;
+      if (typeof value === "number") {
+        return value;
+      }
+      if (value instanceof Date) {
+        return value.getTime();
+      }
+      if (typeof value === "string") {
+        const parsed = Date.parse(value);
+        if (!isNaN(parsed)) return parsed;
+      }
+      return null;
+    },
+    _type: 0
+  };
+}
+
+// src/schema/properties/dateRange.ts
+function isValidDateRange(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const obj = value;
+  if (typeof obj.start !== "string") return false;
+  if (!isValidDateString(obj.start)) return false;
+  if (obj.end !== void 0) {
+    if (typeof obj.end !== "string") return false;
+    if (!isValidDateString(obj.end)) return false;
+  }
+  return true;
+}
+function isValidDateString(str) {
+  const d = new Date(str);
+  return !isNaN(d.getTime());
+}
+function dateRange(options = {}) {
+  return {
+    definition: {
+      type: "dateRange",
+      required: options.required ?? false,
+      config: {
+        includeTime: options.includeTime ?? false
+      }
+    },
+    validate(value) {
+      if (value === null || value === void 0) {
+        return !options.required;
+      }
+      return isValidDateRange(value);
+    },
+    coerce(value) {
+      if (value === null || value === void 0) return null;
+      if (isValidDateRange(value)) {
+        return value;
+      }
+      if (typeof value === "object" && value !== null) {
+        const obj = value;
+        if (obj.start) {
+          const start = new Date(obj.start);
+          if (!isNaN(start.getTime())) {
+            const result = { start: start.toISOString() };
+            if (obj.end) {
+              const end = new Date(obj.end);
+              if (!isNaN(end.getTime())) {
+                result.end = end.toISOString();
+              }
+            }
+            return result;
+          }
+        }
+      }
+      return null;
+    },
+    _type: {}
+  };
+}
+
+// src/schema/properties/select.ts
+function select(options) {
+  const validIds = new Set(options.options.map((o) => o.id));
+  return {
+    definition: {
+      type: "select",
+      required: options.required ?? false,
+      config: {
+        options: options.options,
+        default: options.default
+      }
+    },
+    validate(value) {
+      if (value === null || value === void 0) {
+        return !options.required;
+      }
+      return typeof value === "string" && validIds.has(value);
+    },
+    coerce(value) {
+      if (value === null || value === void 0) {
+        return options.default ?? null;
+      }
+      if (typeof value === "string" && validIds.has(value)) {
+        return value;
+      }
+      const byName = options.options.find(
+        (o) => o.name.toLowerCase() === String(value).toLowerCase()
+      );
+      if (byName) return byName.id;
+      return null;
+    },
+    _type: ""
+  };
+}
+
+// src/schema/properties/multiSelect.ts
+function multiSelect(options) {
+  const validIds = new Set(options.options.map((o) => o.id));
+  return {
+    definition: {
+      type: "multiSelect",
+      required: options.required ?? false,
+      config: {
+        options: options.options,
+        default: options.default
+      }
+    },
+    validate(value) {
+      if (value === null || value === void 0) {
+        return !options.required;
+      }
+      if (!Array.isArray(value)) return false;
+      return value.every((v) => typeof v === "string" && validIds.has(v));
+    },
+    coerce(value) {
+      if (value === null || value === void 0) {
+        return options.default ?? [];
+      }
+      if (!Array.isArray(value)) {
+        if (typeof value === "string" && validIds.has(value)) {
+          return [value];
+        }
+        return null;
+      }
+      const result = [];
+      for (const v of value) {
+        if (typeof v === "string" && validIds.has(v)) {
+          result.push(v);
+        } else {
+          const byName = options.options.find(
+            (o) => o.name.toLowerCase() === String(v).toLowerCase()
+          );
+          if (byName) result.push(byName.id);
+        }
+      }
+      return result;
+    },
+    _type: []
+  };
+}
+
+// src/schema/properties/person.ts
+var DID_PATTERN = /^did:[a-z]+:[a-zA-Z0-9._:-]+$/;
+function person(options = {}) {
+  const isMultiple = options.multiple ?? false;
+  return {
+    definition: {
+      type: "person",
+      required: options.required ?? false,
+      config: {
+        multiple: isMultiple
+      }
+    },
+    validate(value) {
+      if (value === null || value === void 0) {
+        return !options.required;
+      }
+      if (isMultiple) {
+        if (!Array.isArray(value)) return false;
+        return value.every((v) => typeof v === "string" && DID_PATTERN.test(v));
+      } else {
+        return typeof value === "string" && DID_PATTERN.test(value);
+      }
+    },
+    coerce(value) {
+      if (value === null || value === void 0) {
+        return isMultiple ? [] : null;
+      }
+      if (isMultiple) {
+        const arr = Array.isArray(value) ? value : [value];
+        return arr.filter((v) => typeof v === "string" && DID_PATTERN.test(v));
+      } else {
+        if (typeof value === "string" && DID_PATTERN.test(value)) {
+          return value;
+        }
+        return null;
+      }
+    },
+    _type: isMultiple ? [] : ""
+  };
+}
+
+// src/schema/properties/relation.ts
+function relation2(options = {}) {
+  const isMultiple = options.multiple ?? false;
+  return {
+    definition: {
+      type: "relation",
+      required: options.required ?? false,
+      config: {
+        ...options.target !== void 0 && { target: options.target },
+        multiple: isMultiple
+      }
+    },
+    validate(value) {
+      if (value === null || value === void 0) {
+        return !options.required;
+      }
+      if (isMultiple) {
+        if (!Array.isArray(value)) return false;
+        return value.every((v) => typeof v === "string" && v.length > 0);
+      } else {
+        return typeof value === "string" && value.length > 0;
+      }
+    },
+    coerce(value) {
+      if (value === null || value === void 0) {
+        return isMultiple ? [] : null;
+      }
+      if (isMultiple) {
+        const arr = Array.isArray(value) ? value : [value];
+        return arr.filter((v) => typeof v === "string" && v.length > 0);
+      } else {
+        if (typeof value === "string" && value.length > 0) {
+          return value;
+        }
+        return null;
+      }
+    },
+    _type: isMultiple ? [] : ""
+  };
+}
+
+// src/schema/properties/url.ts
+var URL_PATTERN = /^https?:\/\/.+/i;
+function url(options = {}) {
+  return {
+    definition: {
+      type: "url",
+      required: options.required ?? false,
+      config: {
+        placeholder: options.placeholder
+      }
+    },
+    validate(value) {
+      if (value === null || value === void 0 || value === "") {
+        return !options.required;
+      }
+      if (typeof value !== "string") return false;
+      return URL_PATTERN.test(value);
+    },
+    coerce(value) {
+      if (value === null || value === void 0 || value === "") return null;
+      const str = String(value).trim();
+      if (str && !str.match(/^https?:\/\//i)) {
+        return `https://${str}`;
+      }
+      return str || null;
+    },
+    _type: ""
+  };
+}
+
+// src/schema/properties/email.ts
+var EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+function email(options = {}) {
+  return {
+    definition: {
+      type: "email",
+      required: options.required ?? false,
+      config: {
+        placeholder: options.placeholder
+      }
+    },
+    validate(value) {
+      if (value === null || value === void 0 || value === "") {
+        return !options.required;
+      }
+      if (typeof value !== "string") return false;
+      return EMAIL_PATTERN.test(value);
+    },
+    coerce(value) {
+      if (value === null || value === void 0 || value === "") return null;
+      const str = String(value).trim().toLowerCase();
+      return str || null;
+    },
+    _type: ""
+  };
+}
+
+// src/schema/properties/phone.ts
+var PHONE_PATTERN = /^[+]?[(]?[0-9]{1,4}[)]?[-\s./0-9]*$/;
+function phone(options = {}) {
+  return {
+    definition: {
+      type: "phone",
+      required: options.required ?? false,
+      config: {
+        placeholder: options.placeholder
+      }
+    },
+    validate(value) {
+      if (value === null || value === void 0 || value === "") {
+        return !options.required;
+      }
+      if (typeof value !== "string") return false;
+      const digitCount = value.replace(/\D/g, "").length;
+      return PHONE_PATTERN.test(value) && digitCount >= 7;
+    },
+    coerce(value) {
+      if (value === null || value === void 0 || value === "") return null;
+      const str = String(value).trim().replace(/\s+/g, " ");
+      return str || null;
+    },
+    _type: ""
+  };
+}
+
+// src/schema/properties/file.ts
+function isValidFileRef(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const obj = value;
+  return typeof obj.cid === "string" && typeof obj.name === "string" && typeof obj.mimeType === "string" && typeof obj.size === "number";
+}
+function file(options = {}) {
+  const isMultiple = options.multiple ?? false;
+  return {
+    definition: {
+      type: "file",
+      required: options.required ?? false,
+      config: {
+        multiple: isMultiple,
+        accept: options.accept,
+        maxSize: options.maxSize
+      }
+    },
+    validate(value) {
+      if (value === null || value === void 0) {
+        return !options.required;
+      }
+      if (isMultiple) {
+        if (!Array.isArray(value)) return false;
+        return value.every(isValidFileRef);
+      } else {
+        return isValidFileRef(value);
+      }
+    },
+    coerce(value) {
+      if (value === null || value === void 0) {
+        return isMultiple ? [] : null;
+      }
+      if (isMultiple) {
+        const arr = Array.isArray(value) ? value : [value];
+        return arr.filter(isValidFileRef);
+      } else {
+        if (isValidFileRef(value)) {
+          return value;
+        }
+        return null;
+      }
+    },
+    _type: isMultiple ? [] : {}
+  };
+}
+
+// src/schema/properties/created.ts
+function created(options = {}) {
+  return {
+    definition: {
+      type: "created",
+      required: false,
+      // Auto-populated, not user-required
+      config: {
+        label: options.label,
+        auto: true,
+        readonly: true
+      }
+    },
+    validate(value) {
+      if (value === null || value === void 0) {
+        return true;
+      }
+      return typeof value === "number" && value > 0 && Number.isFinite(value);
+    },
+    coerce(value) {
+      if (value === null || value === void 0) {
+        return Date.now();
+      }
+      if (typeof value === "number" && value > 0) {
+        return value;
+      }
+      if (typeof value === "string") {
+        const parsed = Date.parse(value);
+        if (!isNaN(parsed)) return parsed;
+      }
+      return Date.now();
+    },
+    _type: 0
+  };
+}
+
+// src/schema/properties/updated.ts
+function updated(options = {}) {
+  return {
+    definition: {
+      type: "updated",
+      required: false,
+      // Auto-populated, not user-required
+      config: {
+        label: options.label,
+        auto: true,
+        readonly: true
+      }
+    },
+    validate(value) {
+      if (value === null || value === void 0) {
+        return true;
+      }
+      return typeof value === "number" && value > 0 && Number.isFinite(value);
+    },
+    coerce(value) {
+      if (value === null || value === void 0) {
+        return Date.now();
+      }
+      if (typeof value === "number" && value > 0) {
+        return value;
+      }
+      if (typeof value === "string") {
+        const parsed = Date.parse(value);
+        if (!isNaN(parsed)) return parsed;
+      }
+      return Date.now();
+    },
+    _type: 0
+  };
+}
+
+// src/schema/properties/createdBy.ts
+var DID_PATTERN2 = /^did:[a-z]+:[a-zA-Z0-9._:-]+$/;
+function createdBy(options = {}) {
+  return {
+    definition: {
+      type: "createdBy",
+      required: false,
+      // Auto-populated, not user-required
+      config: {
+        label: options.label,
+        auto: true,
+        readonly: true
+      }
+    },
+    validate(value) {
+      if (value === null || value === void 0) {
+        return true;
+      }
+      return typeof value === "string" && DID_PATTERN2.test(value);
+    },
+    coerce(value) {
+      if (value === null || value === void 0) {
+        return null;
+      }
+      if (typeof value === "string" && DID_PATTERN2.test(value)) {
+        return value;
+      }
+      return null;
+    },
+    _type: ""
+  };
+}
+
+export {
+  parseSchemaIRI,
+  normalizeSchemaIRI,
+  getBaseSchemaIRI,
+  isNode,
+  createNodeId,
+  GRANT_SCHEMA_IRI,
+  isGrantActive,
+  GrantIndex,
+  DEFAULT_OFFLINE_POLICY,
+  mergeOfflinePolicy,
+  DecisionCache,
+  DefaultRoleResolver,
+  DefaultPolicyEvaluator,
+  GrantExpirationCleaner,
+  GrantRateLimiter,
+  StoreAuthError,
+  StoreAuth,
+  defineSchema,
+  text,
+  number,
+  checkbox,
+  date,
+  dateRange,
+  select,
+  multiSelect,
+  person,
+  relation2 as relation,
+  url,
+  email,
+  phone,
+  file,
+  created,
+  updated,
+  createdBy
+};