@xnetjs/data 0.12.0 → 1.0.0

package/dist/{chunk-PNESGUH5.js → chunk-D4EVJN2P.js}

@@ -1,6 +1,6 @@
 import {
   spaceCascadeAuthorization
-} from "./chunk-OCMSAKWV.js";
+} from "./chunk-JA56EQJO.js";
 import {
   created,
   createdBy,
@@ -11,7 +11,7 @@ import {
   select,
   text,
   url
-} from "./chunk-EBNMV2VO.js";
+} from "./chunk-RRXJNZX5.js";
 
 // src/schema/schemas/external-item.ts
 var EXTERNAL_ITEM_SCHEMA_IRI = "xnet://xnet.fyi/ExternalItem@1.0.0";

package/dist/{chunk-RL64OJJ5.js → chunk-D4LUUZYD.js}

@@ -219,7 +219,7 @@ function validateAuthorization(auth, properties) {
       }
     }
   }
-  const mutationActions = ["write", "delete", "share"];
+  const mutationActions = ["create", "update", "write", "delete", "share"];
   for (const actionName of mutationActions) {
     const expr = auth.actions[actionName];
     if (expr && hasPublicAccess(expr)) {
@@ -230,6 +230,16 @@ function validateAuthorization(auth, properties) {
       });
     }
   }
+  const hasCreate = Boolean(auth.actions.create);
+  const hasUpdate = Boolean(auth.actions.update);
+  if (hasCreate !== hasUpdate && !auth.actions.write) {
+    const missing = hasCreate ? "update" : "create";
+    errors.push({
+      code: "AUTH_SCHEMA_INCOMPLETE_MUTATION_ACTIONS",
+      message: `Action '${missing}' has no expression and no 'write' fallback \u2014 define '${missing}' or add a 'write' action`,
+      path: `authorization.actions.${missing}`
+    });
+  }
   return { valid: errors.length === 0, errors };
 }
 
@@ -576,6 +586,8 @@ function warnLegacySchema(schema) {
 // src/auth/hub-policy.ts
 var SCHEMA_ACTION_TO_HUB = {
   read: "read",
+  create: "write",
+  update: "write",
   write: "write",
   share: "share",
   delete: "admin"
@@ -635,7 +647,7 @@ async function computeRecipients(schema, node, dependencies) {
     const grants = dependencies.grantIndex?.findGrantsForResource(node.id) ?? [];
     for (const grant of grants) {
       const actions = parseGrantActions(grant.properties.actions);
-      if (actions.includes("read") || actions.includes("write")) {
+      if (actions.includes("read") || actions.includes("write") || actions.includes("update")) {
         const grantee = grant.properties.grantee;
         if (typeof grantee === "string" && grantee.startsWith("did:key:")) {
           recipients.add(grantee);
@@ -807,6 +819,12 @@ async function handleAuthMigration(oldSchema, newSchema, node, dependencies) {
   await dependencies.rotateContentKeyForNode(node.id, newRecipients);
 }
 
+// src/auth/evaluator.ts
+import {
+  actionExpressionOrder,
+  grantActionSatisfies
+} from "@xnetjs/core";
+
 // src/auth/grants.ts
 var GRANT_SCHEMA_IRI = "xnet://xnet.fyi/Grant";
 function isGrantActive(grant, now = Date.now()) {
@@ -1303,7 +1321,7 @@ var DefaultPolicyEvaluator = class {
       this.emitDecision(decision2);
       return decision2;
     }
-    const useCache = !input.patch;
+    const useCache = !input.patch && !input.node;
     const cached = useCache ? this.cache.get(input.subject, input.action, input.nodeId) : void 0;
     if (cached) {
       const decision2 = {
@@ -1356,7 +1374,7 @@ var DefaultPolicyEvaluator = class {
       this.emitDecision(decision2);
       return decision2;
     }
-    const actionExpr = auth.actions[input.action];
+    const actionExpr = resolveActionExpression(auth.actions, input.action);
     if (!actionExpr) {
       const decision2 = this.deny(input, ["DENY_NO_ROLE_MATCH"], start, [...roles]);
       this.emitDecision(decision2);
@@ -1414,7 +1432,7 @@ var DefaultPolicyEvaluator = class {
           duration: performance.now() - roleStart
         });
         const auth = deserializeAuthorization(schema.schema.authorization);
-        actionExpr = auth.actions[input.action];
+        actionExpr = resolveActionExpression(auth.actions, input.action);
         const evalStart = performance.now();
         const requiredRoles = actionExpr ? extractRoleRefs(actionExpr) : [];
         const allowed = actionExpr ? evaluateExpression(actionExpr, roles, true) : false;
@@ -1488,14 +1506,15 @@ var DefaultPolicyEvaluator = class {
         continue;
       }
       const actions = parseActions(grant.properties.actions);
-      if (actions.includes(input.action)) {
+      if (actions.some((granted) => grantActionSatisfies(granted, input.action))) {
         return grant;
       }
     }
     return null;
   }
   checkFieldRules(input, fieldRules, roles) {
-    if (input.action !== "write" || !input.patch || !fieldRules) {
+    const isMutation = input.action === "write" || input.action === "update" || input.action === "create";
+    if (!isMutation || !input.patch || !fieldRules) {
       return false;
     }
     for (const fieldName of Object.keys(input.patch)) {
@@ -1617,6 +1636,13 @@ function membershipRoleAtLeast(edgeRole, resolver) {
 function isDid2(value) {
   return typeof value === "string" && value.startsWith("did:key:");
 }
+function resolveActionExpression(actions, action) {
+  for (const candidate of actionExpressionOrder(action)) {
+    const expr = actions[candidate];
+    if (expr) return expr;
+  }
+  return void 0;
+}
 function parseActions(value) {
   if (Array.isArray(value)) {
     return value.filter((entry) => typeof entry === "string");
@@ -1770,7 +1796,8 @@ var StoreAuth = class {
       subject: this.options.actorDid,
       action: input.action,
       nodeId: input.nodeId,
-      patch: input.patch
+      patch: input.patch,
+      node: input.node ? { ...input.node, createdBy: input.node.createdBy ?? this.options.actorDid } : void 0
     });
   }
   async explain(input) {
@@ -2107,7 +2134,7 @@ function parseActions2(value) {
   }
 }
 function isAuthAction(value) {
-  return value === "read" || value === "write" || value === "delete" || value === "share" || value === "admin";
+  return value === "read" || value === "create" || value === "update" || value === "write" || value === "delete" || value === "share" || value === "admin";
 }
 function parseDid(value) {
   if (typeof value === "string" && value.startsWith("did:key:")) {

package/dist/{chunk-W7EBL7ZU.js → chunk-DP4Q2HMO.js}

@@ -1,6 +1,6 @@
 import {
   spaceCascadeAuthorization
-} from "./chunk-OCMSAKWV.js";
+} from "./chunk-JA56EQJO.js";
 import {
   date,
   defineSchema,
@@ -9,7 +9,7 @@ import {
   relation,
   select,
   text
-} from "./chunk-EBNMV2VO.js";
+} from "./chunk-RRXJNZX5.js";
 
 // src/schema/schemas/observation.ts
 var ObservationSchema = defineSchema({

package/dist/{chunk-5EXHNXPL.js → chunk-DPJ4T2LQ.js}

@@ -1,6 +1,6 @@
 import {
   spaceCascadeAuthorization
-} from "./chunk-OCMSAKWV.js";
+} from "./chunk-JA56EQJO.js";
 import {
   created,
   createdBy,
@@ -9,7 +9,7 @@ import {
   relation,
   text,
   url
-} from "./chunk-EBNMV2VO.js";
+} from "./chunk-RRXJNZX5.js";
 
 // src/schema/schemas/feed-item.ts
 var FEED_ITEM_SCHEMA_IRI = "xnet://xnet.fyi/FeedItem@1.0.0";

package/dist/{chunk-BQLQSWKZ.js → chunk-EN6XTVLZ.js}

@@ -1,6 +1,6 @@
 import {
   spaceCascadeAuthorization
-} from "./chunk-OCMSAKWV.js";
+} from "./chunk-JA56EQJO.js";
 import {
   date,
   defineSchema,
@@ -11,7 +11,7 @@ import {
   relation,
   select,
   text
-} from "./chunk-EBNMV2VO.js";
+} from "./chunk-RRXJNZX5.js";
 
 // src/schema/schemas/game.ts
 var GAME_NAMESPACE = "xnet://xnet.fyi/";

package/dist/{chunk-Q67VT5XL.js → chunk-ENA6NEFY.js}

@@ -5,7 +5,7 @@ import {
   ExtensionFieldSchema,
   SchemaExtensionSchema,
   schemaExtensionId
-} from "./chunk-WEPK7SZF.js";
+} from "./chunk-KTPSQJ5L.js";
 import {
   MAX_KEY_LENGTH,
   compareSortKeys,
@@ -16,16 +16,16 @@ import {
 } from "./chunk-QWFTRZQT.js";
 import {
   DatabaseRowSchema
-} from "./chunk-FB63TZVI.js";
+} from "./chunk-OF6455OV.js";
 import {
   DatabaseFieldSchema
-} from "./chunk-KQAT4XBL.js";
+} from "./chunk-WWQO7QKV.js";
 import {
   DatabaseSelectOptionSchema
-} from "./chunk-6OMG4I7M.js";
+} from "./chunk-OIWW5TG3.js";
 import {
   DatabaseViewSchema
-} from "./chunk-MD553LDL.js";
+} from "./chunk-TRPXLCND.js";
 import {
   createNodeQueryDescriptor
 } from "./chunk-S5RP5RKY.js";

package/dist/{chunk-TORDOOJ5.js → chunk-EYRZ6ZUB.js}

@@ -4,7 +4,7 @@ import {
   defineSchema,
   person,
   text
-} from "./chunk-EBNMV2VO.js";
+} from "./chunk-RRXJNZX5.js";
 
 // src/schema/schemas/profile.ts
 var ProfileSchema = defineSchema({

package/dist/{chunk-NI4FHG2K.js → chunk-EZTBWWMS.js}

@@ -1,13 +1,13 @@
 import {
   spaceCascadeAuthorization
-} from "./chunk-OCMSAKWV.js";
+} from "./chunk-JA56EQJO.js";
 import {
   defineSchema,
   json,
   relation,
   select,
   text
-} from "./chunk-EBNMV2VO.js";
+} from "./chunk-RRXJNZX5.js";
 
 // src/schema/schemas/map.ts
 var MapSchema = defineSchema({

package/dist/{chunk-UQM3G5A2.js → chunk-FWCM2TKJ.js}

@@ -1,6 +1,6 @@
 import {
   spaceCascadeAuthorization
-} from "./chunk-OCMSAKWV.js";
+} from "./chunk-JA56EQJO.js";
 import {
   checkbox,
   date,
@@ -9,7 +9,7 @@ import {
   relation,
   select,
   text
-} from "./chunk-EBNMV2VO.js";
+} from "./chunk-RRXJNZX5.js";
 
 // src/schema/schemas/task.ts
 var TaskSchema = defineSchema({

package/dist/{chunk-OSAWNZVM.js → chunk-GCTONBF6.js}

@@ -3,7 +3,7 @@ import {
   number,
   person,
   text
-} from "./chunk-EBNMV2VO.js";
+} from "./chunk-RRXJNZX5.js";
 
 // src/schema/schemas/grant.ts
 var GrantSchema = defineSchema({

package/dist/{chunk-2ZNJWIQG.js → chunk-HPUXHSKR.js}

@@ -1,6 +1,6 @@
 import {
   spaceCascadeAuthorization
-} from "./chunk-OCMSAKWV.js";
+} from "./chunk-JA56EQJO.js";
 import {
   defineSchema,
   file,
@@ -8,7 +8,7 @@ import {
   relation,
   select,
   text
-} from "./chunk-EBNMV2VO.js";
+} from "./chunk-RRXJNZX5.js";
 
 // src/schema/schemas/transcription.ts
 var TRANSCRIPTION_SCHEMA_IRI = "xnet://xnet.fyi/Transcription@1.0.0";

package/dist/{chunk-ZPZ7XDA6.js → chunk-HTZTBXKL.js}

@@ -1,13 +1,13 @@
 import {
   spaceCascadeAuthorization
-} from "./chunk-OCMSAKWV.js";
+} from "./chunk-JA56EQJO.js";
 import {
   defineSchema,
   money,
   relation,
   select,
   text
-} from "./chunk-EBNMV2VO.js";
+} from "./chunk-RRXJNZX5.js";
 
 // src/schema/schemas/budget.ts
 var BUDGET_SCHEMA_IRI = "xnet://xnet.fyi/Budget@1.0.0";

package/dist/{chunk-MCKP4F72.js → chunk-I7JMGCV6.js}

@@ -1,6 +1,6 @@
 import {
-  spaceCascadeAuthorization
-} from "./chunk-OCMSAKWV.js";
+  spaceContributorAuthorization
+} from "./chunk-JA56EQJO.js";
 import {
   checkbox,
   created,
@@ -13,7 +13,11 @@ import {
   relation,
   select,
   text
-} from "./chunk-EBNMV2VO.js";
+} from "./chunk-RRXJNZX5.js";
+import {
+  allow,
+  role
+} from "./chunk-D4LUUZYD.js";
 
 // src/schema/schemas/comment.ts
 var CommentSchema = defineSchema({
@@ -83,9 +87,26 @@ var CommentSchema = defineSchema({
   },
   // Comments are plain text + markdown, no collaborative Y.Doc needed
   document: void 0,
-  // Inherits access from its home Space (exploration 0181/0192).
-  authorization: spaceCascadeAuthorization("target")
+  // Inherits access from the target's Space (exploration 0181/0192), with
+  // author-owned mutation semantics (0304): space folk down to the commenter
+  // rung — plus the target's own author — may add comments, but only the
+  // comment's author (or space admins) may edit one afterwards.
+  authorization: commentAuthorization()
 });
+function commentAuthorization() {
+  const contributor = spaceContributorAuthorization("target");
+  return {
+    ...contributor,
+    roles: {
+      ...contributor.roles,
+      targetOwner: role.relation("target", "owner")
+    },
+    actions: {
+      ...contributor.actions,
+      create: allow("targetOwner", "spaceCommenter", "spaceMember", "spaceAdmin", "spaceOwner")
+    }
+  };
+}
 
 export {
   CommentSchema

package/dist/{chunk-OGJCRNGE.js → chunk-IA23CLGV.js}

@@ -1,13 +1,13 @@
 import {
   spaceCascadeAuthorization
-} from "./chunk-OCMSAKWV.js";
+} from "./chunk-JA56EQJO.js";
 import {
   date,
   defineSchema,
   relation,
   select,
   text
-} from "./chunk-EBNMV2VO.js";
+} from "./chunk-RRXJNZX5.js";
 
 // src/schema/schemas/milestone.ts
 var MILESTONE_SCHEMA_IRI = "xnet://xnet.fyi/Milestone@1.0.0";

package/dist/{chunk-YEFKQYKA.js → chunk-IKGUBSZP.js}

@@ -4,10 +4,10 @@ import {
   defineSchema,
   json,
   person
-} from "./chunk-EBNMV2VO.js";
+} from "./chunk-RRXJNZX5.js";
 import {
   presets
-} from "./chunk-RL64OJJ5.js";
+} from "./chunk-D4LUUZYD.js";
 
 // src/schema/schemas/inbox-state.ts
 var DEFAULT_CHANNEL_TIER = "mentions";

package/dist/{chunk-XMSKJ5PV.js → chunk-IKI5FBNO.js}

@@ -1,13 +1,13 @@
 import {
   spaceCascadeAuthorization
-} from "./chunk-OCMSAKWV.js";
+} from "./chunk-JA56EQJO.js";
 import {
   checkbox,
   defineSchema,
   relation,
   select,
   text
-} from "./chunk-EBNMV2VO.js";
+} from "./chunk-RRXJNZX5.js";
 
 // src/schema/schemas/account.ts
 var ACCOUNT_SCHEMA_IRI = "xnet://xnet.fyi/Account@1.0.0";

package/dist/{chunk-OCMSAKWV.js → chunk-JA56EQJO.js}

@@ -1,10 +1,10 @@
 import {
   SPACE_MEMBERSHIP_SCHEMA_IRI
-} from "./chunk-T5AZAOG5.js";
+} from "./chunk-LK5ZIAIE.js";
 import {
   allow,
   role
-} from "./chunk-RL64OJJ5.js";
+} from "./chunk-D4LUUZYD.js";
 
 // src/schema/schemas/space-authorization.ts
 var ROLE_ORDER = ["viewer", "commenter", "member", "admin", "owner"];
@@ -71,8 +71,20 @@ function spaceCascadeAuthorization(relationName = "space") {
     }
   };
 }
+function spaceContributorAuthorization(relationName = "space") {
+  const cascade = spaceCascadeAuthorization(relationName);
+  return {
+    ...cascade,
+    actions: {
+      ...cascade.actions,
+      create: allow("spaceOwner", "spaceAdmin", "spaceMember"),
+      update: allow("owner", "spaceOwner", "spaceAdmin")
+    }
+  };
+}
 
 export {
   spaceOwnAuthorization,
-  spaceCascadeAuthorization
+  spaceCascadeAuthorization,
+  spaceContributorAuthorization
 };

package/dist/{chunk-TCTZW4A6.js → chunk-JLUFPUIL.js}

@@ -1,6 +1,6 @@
 import {
   spaceCascadeAuthorization
-} from "./chunk-OCMSAKWV.js";
+} from "./chunk-JA56EQJO.js";
 import {
   created,
   createdBy,
@@ -9,7 +9,7 @@ import {
   relation,
   text,
   url
-} from "./chunk-EBNMV2VO.js";
+} from "./chunk-RRXJNZX5.js";
 
 // src/schema/schemas/feed.ts
 var FEED_SCHEMA_IRI = "xnet://xnet.fyi/Feed@1.0.0";

package/dist/{chunk-WEPK7SZF.js → chunk-KTPSQJ5L.js}

@@ -1,13 +1,13 @@
 import {
   spaceCascadeAuthorization
-} from "./chunk-OCMSAKWV.js";
+} from "./chunk-JA56EQJO.js";
 import {
   defineSchema,
   json,
   number,
   relation,
   text
-} from "./chunk-EBNMV2VO.js";
+} from "./chunk-RRXJNZX5.js";
 
 // src/schema/schemas/schema-extension.ts
 var SCHEMA_EXTENSION_SCHEMA_IRI = "xnet://xnet.fyi/SchemaExtension@1.0.0";

package/dist/{chunk-T5AZAOG5.js → chunk-LK5ZIAIE.js}

@@ -6,7 +6,7 @@ import {
   person,
   relation,
   select
-} from "./chunk-EBNMV2VO.js";
+} from "./chunk-RRXJNZX5.js";
 
 // src/schema/schemas/space-membership.ts
 var SPACE_MEMBERSHIP_SCHEMA_IRI = "xnet://xnet.fyi/SpaceMembership@1.0.0";

package/dist/{chunk-XROI44ZP.js → chunk-M4KGY2PC.js}

@@ -1,6 +1,6 @@
 import {
   spaceCascadeAuthorization
-} from "./chunk-OCMSAKWV.js";
+} from "./chunk-JA56EQJO.js";
 import {
   date,
   defineSchema,
@@ -8,7 +8,7 @@ import {
   relation,
   select,
   text
-} from "./chunk-EBNMV2VO.js";
+} from "./chunk-RRXJNZX5.js";
 
 // src/schema/schemas/project.ts
 var ProjectSchema = defineSchema({

package/dist/{chunk-QJW5LDP4.js → chunk-NSMSOIEW.js}

@@ -1,13 +1,13 @@
 import {
   spaceCascadeAuthorization
-} from "./chunk-OCMSAKWV.js";
+} from "./chunk-JA56EQJO.js";
 import {
   defineSchema,
   json,
   relation,
   select,
   text
-} from "./chunk-EBNMV2VO.js";
+} from "./chunk-RRXJNZX5.js";
 
 // src/schema/schemas/dashboard.ts
 var DashboardSchema = defineSchema({

package/dist/{chunk-FB63TZVI.js → chunk-OF6455OV.js}

@@ -1,12 +1,12 @@
 import {
   spaceCascadeAuthorization
-} from "./chunk-OCMSAKWV.js";
+} from "./chunk-JA56EQJO.js";
 import {
   defineSchema,
   json,
   relation,
   text
-} from "./chunk-EBNMV2VO.js";
+} from "./chunk-RRXJNZX5.js";
 
 // src/schema/schemas/database-row.ts
 var DatabaseRowSchema = defineSchema({

package/dist/{chunk-6OMG4I7M.js → chunk-OIWW5TG3.js}

@@ -1,11 +1,11 @@
 import {
   spaceCascadeAuthorization
-} from "./chunk-OCMSAKWV.js";
+} from "./chunk-JA56EQJO.js";
 import {
   defineSchema,
   relation,
   text
-} from "./chunk-EBNMV2VO.js";
+} from "./chunk-RRXJNZX5.js";
 
 // src/schema/schemas/database-select-option.ts
 var DatabaseSelectOptionSchema = defineSchema({

package/dist/{chunk-6KLGA6IR.js → chunk-Q6VTTPG4.js}

@@ -4,10 +4,10 @@ import {
   createdBy,
   defineSchema,
   text
-} from "./chunk-EBNMV2VO.js";
+} from "./chunk-RRXJNZX5.js";
 import {
   presets
-} from "./chunk-RL64OJJ5.js";
+} from "./chunk-D4LUUZYD.js";
 
 // src/schema/schemas/tag.ts
 var TAG_SCHEMA_IRI = "xnet://xnet.fyi/Tag@1.0.0";

package/dist/{chunk-J4ANIXIV.js → chunk-QDLWTOII.js}

@@ -1,6 +1,6 @@
 import {
   spaceCascadeAuthorization
-} from "./chunk-OCMSAKWV.js";
+} from "./chunk-JA56EQJO.js";
 import {
   checkbox,
   date,
@@ -13,7 +13,7 @@ import {
   select,
   text,
   url
-} from "./chunk-EBNMV2VO.js";
+} from "./chunk-RRXJNZX5.js";
 
 // src/schema/schemas/crm.ts
 var CRM_NAMESPACE = "xnet://xnet.fyi/";

package/dist/{chunk-EBNMV2VO.js → chunk-RRXJNZX5.js}

@@ -2,7 +2,7 @@ import {
   serializeAuthorization,
   validateAuthorization,
   warnLegacySchema
-} from "./chunk-RL64OJJ5.js";
+} from "./chunk-D4LUUZYD.js";
 
 // src/schema/node.ts
 import { nanoid } from "nanoid";

package/dist/{chunk-FVEACSKE.js → chunk-RXBLWQQI.js}

@@ -1,6 +1,6 @@
 import {
   spaceCascadeAuthorization
-} from "./chunk-OCMSAKWV.js";
+} from "./chunk-JA56EQJO.js";
 import {
   date,
   defineSchema,
@@ -8,7 +8,7 @@ import {
   relation,
   select,
   text
-} from "./chunk-EBNMV2VO.js";
+} from "./chunk-RRXJNZX5.js";
 
 // src/schema/schemas/experiment.ts
 var ExperimentSchema = defineSchema({

package/dist/{chunk-L7NRPLE5.js → chunk-S6JWYPVW.js}

@@ -1,6 +1,6 @@
 import {
   spaceCascadeAuthorization
-} from "./chunk-OCMSAKWV.js";
+} from "./chunk-JA56EQJO.js";
 import {
   defineSchema,
   file,
@@ -9,7 +9,7 @@ import {
   relation,
   select,
   text
-} from "./chunk-EBNMV2VO.js";
+} from "./chunk-RRXJNZX5.js";
 
 // src/schema/schemas/meeting.ts
 var MEETING_SCHEMA_IRI = "xnet://xnet.fyi/Meeting@1.0.0";

package/dist/{chunk-JDFNMFOZ.js → chunk-SOXXBQ4P.js}

@@ -1,13 +1,13 @@
 import {
   spaceCascadeAuthorization
-} from "./chunk-OCMSAKWV.js";
+} from "./chunk-JA56EQJO.js";
 import {
   defineSchema,
   money,
   relation,
   select,
   text
-} from "./chunk-EBNMV2VO.js";
+} from "./chunk-RRXJNZX5.js";
 
 // src/schema/schemas/posting.ts
 var POSTING_SCHEMA_IRI = "xnet://xnet.fyi/Posting@1.0.0";