@xnetjs/data 0.0.3 → 0.1.0

package/dist/chunk-KQUALW4O.js

@@ -0,0 +1,183 @@
+import {
+  created,
+  createdBy,
+  defineSchema,
+  json,
+  number,
+  person,
+  select,
+  text
+} from "./chunk-EBNMV2VO.js";
+
+// src/schema/schemas/account-ledger.ts
+var NS = "xnet://xnet.fyi/";
+var ACCOUNT_RECORD_SCHEMA_IRI = "xnet://xnet.fyi/AccountRecord@1.0.0";
+var DEVICE_RECORD_SCHEMA_IRI = "xnet://xnet.fyi/DeviceRecord@1.0.0";
+var RECOVERY_RECORD_SCHEMA_IRI = "xnet://xnet.fyi/RecoveryRecord@1.0.0";
+var REVOCATION_RECORD_SCHEMA_IRI = "xnet://xnet.fyi/RevocationRecord@1.0.0";
+var ledgerStatus = () => select({
+  options: [
+    { id: "active", name: "Active", color: "green" },
+    { id: "revoked", name: "Revoked", color: "red" }
+  ],
+  required: true,
+  default: "active"
+});
+var AccountRecordSchema = defineSchema({
+  name: "AccountRecord",
+  namespace: NS,
+  properties: {
+    /** Stable subject, e.g. `xnet:account:<hash>`. Appears in grants + the cloud binding. */
+    accountId: text({ required: true }),
+    label: text({}),
+    /** Device DIDs allowed to sign ledger changes (admit/revoke). JSON array of DIDs. */
+    controllers: json({}),
+    /** Monotonic epoch, bumped on every revocation so stale authorizations are detectable. */
+    epoch: number({}),
+    createdAt: created(),
+    createdBy: createdBy()
+  },
+  document: void 0
+});
+var DeviceRecordSchema = defineSchema({
+  name: "DeviceRecord",
+  namespace: NS,
+  properties: {
+    /** The owning account subject (id, for portability across hub mirrors). */
+    account: text({ required: true }),
+    /** The device's data identity (`did:key`). */
+    deviceDid: person({ required: true }),
+    label: text({}),
+    /** WebAuthn relying-party id the gating passkey is scoped to. */
+    rpId: text({}),
+    /** Hash of the WebAuthn credential id (never the credential itself). */
+    credentialIdHash: text({}),
+    /** Capability hints (JSON), e.g. which scopes this device may exercise. */
+    capabilities: json({}),
+    status: ledgerStatus(),
+    /** The controller DID that admitted this device. */
+    addedBy: person({}),
+    addedAt: number({}),
+    lastSeenAt: number({}),
+    /** Epoch at which this device was admitted. */
+    epoch: number({}),
+    createdAt: created(),
+    createdBy: createdBy()
+  },
+  document: void 0
+});
+var RecoveryRecordSchema = defineSchema({
+  name: "RecoveryRecord",
+  namespace: NS,
+  properties: {
+    account: text({ required: true }),
+    method: select({
+      options: [
+        { id: "phrase", name: "Recovery phrase", color: "blue" },
+        { id: "social", name: "Social recovery", color: "purple" },
+        { id: "hardware", name: "Hardware key", color: "gray" },
+        { id: "admin", name: "Enterprise admin", color: "yellow" },
+        { id: "backup-passkey", name: "Backup passkey", color: "green" }
+      ],
+      required: true,
+      default: "phrase"
+    }),
+    label: text({}),
+    /** Public commitment to the recovery key (e.g. the recovery DID), not the secret. */
+    publicKeyHash: text({}),
+    status: ledgerStatus(),
+    addedBy: person({}),
+    addedAt: number({}),
+    createdAt: created(),
+    createdBy: createdBy()
+  },
+  document: void 0
+});
+var RevocationRecordSchema = defineSchema({
+  name: "RevocationRecord",
+  namespace: NS,
+  properties: {
+    account: text({ required: true }),
+    subjectKind: select({
+      options: [
+        { id: "device", name: "Device", color: "blue" },
+        { id: "recovery", name: "Recovery method", color: "purple" }
+      ],
+      required: true,
+      default: "device"
+    }),
+    /** The revoked subject: a device DID or a recovery record id. */
+    subject: text({ required: true }),
+    reason: text({}),
+    effectiveAt: number({}),
+    /** Epoch this revocation takes effect at. */
+    epoch: number({}),
+    /** The controller DID that signed the revocation. */
+    signedBy: person({}),
+    createdAt: created(),
+    createdBy: createdBy()
+  },
+  document: void 0
+});
+function accountRecordId(accountId) {
+  return `account:${accountId}`;
+}
+function deviceRecordId(accountId, deviceDid) {
+  return `device:${accountId}:${deviceDid}`;
+}
+function recoveryRecordId(accountId, recoveryKey) {
+  return `recovery:${accountId}:${recoveryKey}`;
+}
+function revocationRecordId(accountId, subject) {
+  return `revocation:${accountId}:${subject}`;
+}
+function revokedSubjects(revocations) {
+  return new Set(revocations.map((r) => r.subject));
+}
+function resolveActiveDevices(devices, revocations) {
+  const revoked = revokedSubjects(revocations);
+  return devices.filter((d) => d.status !== "revoked" && !revoked.has(d.deviceDid));
+}
+function isDeviceAuthorized(accountId, deviceDid, devices, revocations) {
+  const revoked = revokedSubjects(revocations);
+  if (revoked.has(deviceDid)) return false;
+  return devices.some(
+    (d) => d.account === accountId && d.deviceDid === deviceDid && d.status !== "revoked"
+  );
+}
+function deviceRecipientExpander(devices, revocations) {
+  const active = resolveActiveDevices(devices, revocations);
+  const activeByAccount = /* @__PURE__ */ new Map();
+  for (const d of active) {
+    const list = activeByAccount.get(d.account);
+    if (list) list.push(d.deviceDid);
+    else activeByAccount.set(d.account, [d.deviceDid]);
+  }
+  const accountOf = /* @__PURE__ */ new Map();
+  for (const d of devices) accountOf.set(d.deviceDid, d.account);
+  return (did) => {
+    const account = accountOf.get(did);
+    if (!account) return [did];
+    const siblings = activeByAccount.get(account);
+    return siblings && siblings.length > 0 ? [.../* @__PURE__ */ new Set([did, ...siblings])] : [did];
+  };
+}
+
+export {
+  ACCOUNT_RECORD_SCHEMA_IRI,
+  DEVICE_RECORD_SCHEMA_IRI,
+  RECOVERY_RECORD_SCHEMA_IRI,
+  REVOCATION_RECORD_SCHEMA_IRI,
+  AccountRecordSchema,
+  DeviceRecordSchema,
+  RecoveryRecordSchema,
+  RevocationRecordSchema,
+  accountRecordId,
+  deviceRecordId,
+  recoveryRecordId,
+  revocationRecordId,
+  revokedSubjects,
+  resolveActiveDevices,
+  isDeviceAuthorized,
+  deviceRecipientExpander
+};

package/dist/{chunk-KPVBKKZS.js → chunk-LYSWLCOI.js}

@@ -1,12 +1,12 @@
 import {
   spaceCascadeAuthorization
-} from "./chunk-6OPZJ7MG.js";
+} from "./chunk-OCMSAKWV.js";
 import {
   defineSchema,
   relation,
   select,
   text
-} from "./chunk-O64EK5FK.js";
+} from "./chunk-EBNMV2VO.js";
 
 // src/schema/schemas/canvas.ts
 var CanvasSchema = defineSchema({

package/dist/{chunk-YXZGYLKV.js → chunk-MBTUO3ZL.js}

@@ -1,13 +1,13 @@
 import {
   spaceCascadeAuthorization
-} from "./chunk-6OPZJ7MG.js";
+} from "./chunk-OCMSAKWV.js";
 import {
   date,
   defineSchema,
   relation,
   select,
   text
-} from "./chunk-O64EK5FK.js";
+} from "./chunk-EBNMV2VO.js";
 
 // src/schema/schemas/transaction.ts
 var TRANSACTION_SCHEMA_IRI = "xnet://xnet.fyi/Transaction@1.0.0";

package/dist/{chunk-7GMJOAPF.js → chunk-NI4FHG2K.js}

@@ -1,13 +1,13 @@
 import {
   spaceCascadeAuthorization
-} from "./chunk-6OPZJ7MG.js";
+} from "./chunk-OCMSAKWV.js";
 import {
   defineSchema,
   json,
   relation,
   select,
   text
-} from "./chunk-O64EK5FK.js";
+} from "./chunk-EBNMV2VO.js";
 
 // src/schema/schemas/map.ts
 var MapSchema = defineSchema({

package/dist/{chunk-6OPZJ7MG.js → chunk-OCMSAKWV.js}

@@ -1,10 +1,10 @@
 import {
   SPACE_MEMBERSHIP_SCHEMA_IRI
-} from "./chunk-ZICIXDEE.js";
+} from "./chunk-T5AZAOG5.js";
 import {
   allow,
   role
-} from "./chunk-JESSJ5CZ.js";
+} from "./chunk-RL64OJJ5.js";
 
 // src/schema/schemas/space-authorization.ts
 var ROLE_ORDER = ["viewer", "commenter", "member", "admin", "owner"];

package/dist/{chunk-IP4BEVVD.js → chunk-OGJCRNGE.js}

@@ -1,13 +1,13 @@
 import {
   spaceCascadeAuthorization
-} from "./chunk-6OPZJ7MG.js";
+} from "./chunk-OCMSAKWV.js";
 import {
   date,
   defineSchema,
   relation,
   select,
   text
-} from "./chunk-O64EK5FK.js";
+} from "./chunk-EBNMV2VO.js";
 
 // src/schema/schemas/milestone.ts
 var MILESTONE_SCHEMA_IRI = "xnet://xnet.fyi/Milestone@1.0.0";

package/dist/{chunk-6CN53PON.js → chunk-OPPHF3TF.js}

@@ -4,10 +4,10 @@ import {
   folderAncestorIds,
   folderPathIds,
   wouldCreateFolderCycle
-} from "./chunk-DTPSTMUD.js";
+} from "./chunk-YSUIXD2Y.js";
 import {
   spaceOwnAuthorization
-} from "./chunk-6OPZJ7MG.js";
+} from "./chunk-OCMSAKWV.js";
 import {
   checkbox,
   created,
@@ -17,7 +17,7 @@ import {
   relation,
   select,
   text
-} from "./chunk-O64EK5FK.js";
+} from "./chunk-EBNMV2VO.js";
 
 // src/schema/schemas/space.ts
 var SPACE_SCHEMA_IRI = "xnet://xnet.fyi/Space@1.0.0";

package/dist/{chunk-77UDLVQY.js → chunk-OSAWNZVM.js}

@@ -3,7 +3,7 @@ import {
   number,
   person,
   text
-} from "./chunk-O64EK5FK.js";
+} from "./chunk-EBNMV2VO.js";
 
 // src/schema/schemas/grant.ts
 var GrantSchema = defineSchema({

package/dist/{chunk-GWYVY2K4.js → chunk-PNESGUH5.js}

@@ -1,6 +1,6 @@
 import {
   spaceCascadeAuthorization
-} from "./chunk-6OPZJ7MG.js";
+} from "./chunk-OCMSAKWV.js";
 import {
   created,
   createdBy,
@@ -11,7 +11,7 @@ import {
   select,
   text,
   url
-} from "./chunk-O64EK5FK.js";
+} from "./chunk-EBNMV2VO.js";
 
 // src/schema/schemas/external-item.ts
 var EXTERNAL_ITEM_SCHEMA_IRI = "xnet://xnet.fyi/ExternalItem@1.0.0";

package/dist/{chunk-RSSZXCLL.js → chunk-Q3IEGH4B.js}

@@ -1,6 +1,6 @@
 import {
   spaceCascadeAuthorization
-} from "./chunk-6OPZJ7MG.js";
+} from "./chunk-OCMSAKWV.js";
 import {
   checkbox,
   created,
@@ -11,7 +11,7 @@ import {
   json,
   relation,
   text
-} from "./chunk-O64EK5FK.js";
+} from "./chunk-EBNMV2VO.js";
 
 // src/schema/schemas/chat-message.ts
 var ChatMessageSchema = defineSchema({

package/dist/{chunk-2DSDH2ZH.js → chunk-QJW5LDP4.js}

@@ -1,13 +1,13 @@
 import {
   spaceCascadeAuthorization
-} from "./chunk-6OPZJ7MG.js";
+} from "./chunk-OCMSAKWV.js";
 import {
   defineSchema,
   json,
   relation,
   select,
   text
-} from "./chunk-O64EK5FK.js";
+} from "./chunk-EBNMV2VO.js";
 
 // src/schema/schemas/dashboard.ts
 var DashboardSchema = defineSchema({

package/dist/{chunk-JESSJ5CZ.js → chunk-RL64OJJ5.js}

@@ -618,6 +618,16 @@ function hubActionsForSpaceRole(schema, spaceRole) {
 var PUBLIC_CONTENT_KEY = new Uint8Array(32);
 var PUBLIC_RECIPIENT = "PUBLIC";
 var MAX_CONTAINER_DEPTH = 32;
+function finalizeRecipients(recipients, dependencies) {
+  const expand = dependencies.expandDeviceRecipients;
+  if (!expand) return [...recipients];
+  const out = new Set(recipients);
+  for (const recipient of recipients) {
+    if (recipient === PUBLIC_RECIPIENT) continue;
+    for (const did of expand(recipient)) out.add(did);
+  }
+  return [...out];
+}
 async function computeRecipients(schema, node, dependencies) {
   const recipients = /* @__PURE__ */ new Set();
   recipients.add(node.createdBy);
@@ -635,13 +645,13 @@ async function computeRecipients(schema, node, dependencies) {
   };
   if (!schema.authorization) {
     addGrantRecipients();
-    return [...recipients];
+    return finalizeRecipients(recipients, dependencies);
   }
   const auth = deserializeAuthorization(schema.authorization);
   const readExpr = auth.actions.read;
   if (!readExpr) {
     addGrantRecipients();
-    return [...recipients];
+    return finalizeRecipients(recipients, dependencies);
   }
   if (hasPublicAccess(readExpr)) {
     return [PUBLIC_RECIPIENT];
@@ -656,7 +666,7 @@ async function computeRecipients(schema, node, dependencies) {
     }
   }
   addGrantRecipients();
-  return [...recipients];
+  return finalizeRecipients(recipients, dependencies);
 }
 async function resolveRoleMembers(resolver, node, _schema, dependencies, depth) {
   if (depth > (dependencies.maxDepth ?? 3)) {

package/dist/{chunk-S4B5OPZU.js → chunk-S5RP5RKY.js}

@@ -395,6 +395,7 @@ function withoutNodeQueryPagination(descriptor) {
 function withoutNodeQueryMaterializedView(descriptor) {
   const next = { ...descriptor };
   delete next.materializedView;
+  delete next.authFingerprint;
   return next;
 }
 

package/dist/{chunk-4UQTURCD.js → chunk-S6U6TCMN.js}

@@ -12,11 +12,11 @@ import {
   text,
   updated,
   url
-} from "./chunk-O64EK5FK.js";
+} from "./chunk-EBNMV2VO.js";
 import {
   allow,
   role
-} from "./chunk-JESSJ5CZ.js";
+} from "./chunk-RL64OJJ5.js";
 
 // src/schema/schemas/moderation.ts
 var withOperators = (roles = []) => [

package/dist/{chunk-C5IRSEEZ.js → chunk-SVNGSZZA.js}

@@ -3,10 +3,10 @@ import {
   select,
   text,
   url
-} from "./chunk-O64EK5FK.js";
+} from "./chunk-EBNMV2VO.js";
 import {
   presets
-} from "./chunk-JESSJ5CZ.js";
+} from "./chunk-RL64OJJ5.js";
 
 // src/schema/schemas/external-reference.ts
 var ExternalReferenceSchema = defineSchema({

package/dist/{chunk-ZICIXDEE.js → chunk-T5AZAOG5.js}

@@ -6,7 +6,7 @@ import {
   person,
   relation,
   select
-} from "./chunk-O64EK5FK.js";
+} from "./chunk-EBNMV2VO.js";
 
 // src/schema/schemas/space-membership.ts
 var SPACE_MEMBERSHIP_SCHEMA_IRI = "xnet://xnet.fyi/SpaceMembership@1.0.0";

package/dist/{chunk-IJ675GJR.js → chunk-TCTZW4A6.js}

@@ -1,6 +1,6 @@
 import {
   spaceCascadeAuthorization
-} from "./chunk-6OPZJ7MG.js";
+} from "./chunk-OCMSAKWV.js";
 import {
   created,
   createdBy,
@@ -9,7 +9,7 @@ import {
   relation,
   text,
   url
-} from "./chunk-O64EK5FK.js";
+} from "./chunk-EBNMV2VO.js";
 
 // src/schema/schemas/feed.ts
 var FEED_SCHEMA_IRI = "xnet://xnet.fyi/Feed@1.0.0";

package/dist/{chunk-54Y7QRZN.js → chunk-U64CW73O.js}

@@ -1,6 +1,6 @@
 import {
   spaceCascadeAuthorization
-} from "./chunk-6OPZJ7MG.js";
+} from "./chunk-OCMSAKWV.js";
 import {
   defineSchema,
   json,
@@ -8,7 +8,7 @@ import {
   relation,
   select,
   text
-} from "./chunk-O64EK5FK.js";
+} from "./chunk-EBNMV2VO.js";
 
 // src/schema/schemas/metric.ts
 var MetricSchema = defineSchema({