@xnetjs/data 0.12.0 → 2.0.0

package/dist/{chunk-U64CW73O.js → chunk-52DR23IW.js}

@@ -1,6 +1,6 @@
 import {
   spaceCascadeAuthorization
-} from "./chunk-OCMSAKWV.js";
+} from "./chunk-JA56EQJO.js";
 import {
   defineSchema,
   json,
@@ -8,7 +8,7 @@ import {
   relation,
   select,
   text
-} from "./chunk-EBNMV2VO.js";
+} from "./chunk-RRXJNZX5.js";
 
 // src/schema/schemas/metric.ts
 var MetricSchema = defineSchema({

package/dist/{chunk-SVNGSZZA.js → chunk-57UZYV3L.js}

@@ -3,10 +3,10 @@ import {
   select,
   text,
   url
-} from "./chunk-EBNMV2VO.js";
+} from "./chunk-RRXJNZX5.js";
 import {
   presets
-} from "./chunk-RL64OJJ5.js";
+} from "./chunk-D4LUUZYD.js";
 
 // src/schema/schemas/external-reference.ts
 var ExternalReferenceSchema = defineSchema({

package/dist/{chunk-QVQVKZ3U.js → chunk-5UJMY3AH.js}

@@ -1,6 +1,6 @@
 import {
-  spaceCascadeAuthorization
-} from "./chunk-OCMSAKWV.js";
+  spaceContributorAuthorization
+} from "./chunk-JA56EQJO.js";
 import {
   checkbox,
   created,
@@ -11,7 +11,7 @@ import {
   json,
   relation,
   text
-} from "./chunk-EBNMV2VO.js";
+} from "./chunk-RRXJNZX5.js";
 
 // src/schema/schemas/chat-message.ts
 var ChatMessageSchema = defineSchema({
@@ -44,8 +44,9 @@ var ChatMessageSchema = defineSchema({
     createdBy: createdBy()
   },
   document: void 0,
-  // Inherits access from its home Space (exploration 0181/0192).
-  authorization: spaceCascadeAuthorization("channel")
+  // Inherits access from its home Space (exploration 0181/0192); members may
+  // post but only the author (or space admins) may edit a message (0304).
+  authorization: spaceContributorAuthorization("channel")
 });
 
 export {

package/dist/chunk-6ZUJID52.js

@@ -0,0 +1,41 @@
+import {
+  spaceContributorAuthorization
+} from "./chunk-JA56EQJO.js";
+import {
+  created,
+  createdBy,
+  defineSchema,
+  json,
+  relation,
+  text
+} from "./chunk-RRXJNZX5.js";
+
+// src/schema/schemas/checkpoint.ts
+var CHECKPOINT_SCHEMA_IRI = "xnet://xnet.fyi/Checkpoint@1.0.0";
+var CheckpointSchema = defineSchema({
+  name: "Checkpoint",
+  namespace: "xnet://xnet.fyi/",
+  properties: {
+    /** User-given version name ("Draft sent to review", "Before the rewrite") */
+    name: text({ required: true, maxLength: 200 }),
+    /** Optional longer note shown in the Time Machine */
+    note: text({ maxLength: 2e3 }),
+    /** Per-node frontier: nodeId -> { hash, yjsSnapshotRef? } */
+    frontier: json({}),
+    /** The scope this checkpoint was taken over (page, database, space, …) */
+    scope: relation({}),
+    /** Space containment (single-valued) — drives the authorization roles */
+    space: relation({ target: "xnet://xnet.fyi/Space@1.0.0" }),
+    createdAt: created(),
+    createdBy: createdBy()
+  },
+  document: void 0,
+  // Checkpoints of shared content are visible to the space that content
+  // lives in; contributors can create their own.
+  authorization: spaceContributorAuthorization()
+});
+
+export {
+  CHECKPOINT_SCHEMA_IRI,
+  CheckpointSchema
+};

package/dist/{chunk-3J3HILXO.js → chunk-7PCMTV6J.js}

@@ -4,10 +4,10 @@ import {
   number,
   select,
   text
-} from "./chunk-EBNMV2VO.js";
+} from "./chunk-RRXJNZX5.js";
 import {
   presets
-} from "./chunk-RL64OJJ5.js";
+} from "./chunk-D4LUUZYD.js";
 
 // src/schema/schemas/media-asset.ts
 var MediaAssetSchema = defineSchema({

package/dist/{chunk-YSUIXD2Y.js → chunk-C4CQH7UD.js}

@@ -7,10 +7,10 @@ import {
   defineSchema,
   relation,
   text
-} from "./chunk-EBNMV2VO.js";
+} from "./chunk-RRXJNZX5.js";
 import {
   presets
-} from "./chunk-RL64OJJ5.js";
+} from "./chunk-D4LUUZYD.js";
 
 // src/schema/schemas/folder.ts
 var FOLDER_SCHEMA_IRI = "xnet://xnet.fyi/Folder@1.0.0";

package/dist/{chunk-PNESGUH5.js → chunk-D4EVJN2P.js}

@@ -1,6 +1,6 @@
 import {
   spaceCascadeAuthorization
-} from "./chunk-OCMSAKWV.js";
+} from "./chunk-JA56EQJO.js";
 import {
   created,
   createdBy,
@@ -11,7 +11,7 @@ import {
   select,
   text,
   url
-} from "./chunk-EBNMV2VO.js";
+} from "./chunk-RRXJNZX5.js";
 
 // src/schema/schemas/external-item.ts
 var EXTERNAL_ITEM_SCHEMA_IRI = "xnet://xnet.fyi/ExternalItem@1.0.0";

package/dist/{chunk-RL64OJJ5.js → chunk-D4LUUZYD.js}

@@ -219,7 +219,7 @@ function validateAuthorization(auth, properties) {
       }
     }
   }
-  const mutationActions = ["write", "delete", "share"];
+  const mutationActions = ["create", "update", "write", "delete", "share"];
   for (const actionName of mutationActions) {
     const expr = auth.actions[actionName];
     if (expr && hasPublicAccess(expr)) {
@@ -230,6 +230,16 @@ function validateAuthorization(auth, properties) {
       });
     }
   }
+  const hasCreate = Boolean(auth.actions.create);
+  const hasUpdate = Boolean(auth.actions.update);
+  if (hasCreate !== hasUpdate && !auth.actions.write) {
+    const missing = hasCreate ? "update" : "create";
+    errors.push({
+      code: "AUTH_SCHEMA_INCOMPLETE_MUTATION_ACTIONS",
+      message: `Action '${missing}' has no expression and no 'write' fallback \u2014 define '${missing}' or add a 'write' action`,
+      path: `authorization.actions.${missing}`
+    });
+  }
   return { valid: errors.length === 0, errors };
 }
 
@@ -576,6 +586,8 @@ function warnLegacySchema(schema) {
 // src/auth/hub-policy.ts
 var SCHEMA_ACTION_TO_HUB = {
   read: "read",
+  create: "write",
+  update: "write",
   write: "write",
   share: "share",
   delete: "admin"
@@ -635,7 +647,7 @@ async function computeRecipients(schema, node, dependencies) {
     const grants = dependencies.grantIndex?.findGrantsForResource(node.id) ?? [];
     for (const grant of grants) {
       const actions = parseGrantActions(grant.properties.actions);
-      if (actions.includes("read") || actions.includes("write")) {
+      if (actions.includes("read") || actions.includes("write") || actions.includes("update")) {
         const grantee = grant.properties.grantee;
         if (typeof grantee === "string" && grantee.startsWith("did:key:")) {
           recipients.add(grantee);
@@ -807,6 +819,12 @@ async function handleAuthMigration(oldSchema, newSchema, node, dependencies) {
   await dependencies.rotateContentKeyForNode(node.id, newRecipients);
 }
 
+// src/auth/evaluator.ts
+import {
+  actionExpressionOrder,
+  grantActionSatisfies
+} from "@xnetjs/core";
+
 // src/auth/grants.ts
 var GRANT_SCHEMA_IRI = "xnet://xnet.fyi/Grant";
 function isGrantActive(grant, now = Date.now()) {
@@ -1303,7 +1321,7 @@ var DefaultPolicyEvaluator = class {
       this.emitDecision(decision2);
       return decision2;
     }
-    const useCache = !input.patch;
+    const useCache = !input.patch && !input.node;
     const cached = useCache ? this.cache.get(input.subject, input.action, input.nodeId) : void 0;
     if (cached) {
       const decision2 = {
@@ -1356,7 +1374,7 @@ var DefaultPolicyEvaluator = class {
       this.emitDecision(decision2);
       return decision2;
     }
-    const actionExpr = auth.actions[input.action];
+    const actionExpr = resolveActionExpression(auth.actions, input.action);
     if (!actionExpr) {
       const decision2 = this.deny(input, ["DENY_NO_ROLE_MATCH"], start, [...roles]);
       this.emitDecision(decision2);
@@ -1414,7 +1432,7 @@ var DefaultPolicyEvaluator = class {
           duration: performance.now() - roleStart
         });
         const auth = deserializeAuthorization(schema.schema.authorization);
-        actionExpr = auth.actions[input.action];
+        actionExpr = resolveActionExpression(auth.actions, input.action);
         const evalStart = performance.now();
         const requiredRoles = actionExpr ? extractRoleRefs(actionExpr) : [];
         const allowed = actionExpr ? evaluateExpression(actionExpr, roles, true) : false;
@@ -1488,14 +1506,15 @@ var DefaultPolicyEvaluator = class {
         continue;
       }
       const actions = parseActions(grant.properties.actions);
-      if (actions.includes(input.action)) {
+      if (actions.some((granted) => grantActionSatisfies(granted, input.action))) {
         return grant;
       }
     }
     return null;
   }
   checkFieldRules(input, fieldRules, roles) {
-    if (input.action !== "write" || !input.patch || !fieldRules) {
+    const isMutation = input.action === "write" || input.action === "update" || input.action === "create";
+    if (!isMutation || !input.patch || !fieldRules) {
       return false;
     }
     for (const fieldName of Object.keys(input.patch)) {
@@ -1617,6 +1636,13 @@ function membershipRoleAtLeast(edgeRole, resolver) {
 function isDid2(value) {
   return typeof value === "string" && value.startsWith("did:key:");
 }
+function resolveActionExpression(actions, action) {
+  for (const candidate of actionExpressionOrder(action)) {
+    const expr = actions[candidate];
+    if (expr) return expr;
+  }
+  return void 0;
+}
 function parseActions(value) {
   if (Array.isArray(value)) {
     return value.filter((entry) => typeof entry === "string");
@@ -1770,7 +1796,8 @@ var StoreAuth = class {
       subject: this.options.actorDid,
       action: input.action,
       nodeId: input.nodeId,
-      patch: input.patch
+      patch: input.patch,
+      node: input.node ? { ...input.node, createdBy: input.node.createdBy ?? this.options.actorDid } : void 0
     });
   }
   async explain(input) {
@@ -2107,7 +2134,7 @@ function parseActions2(value) {
   }
 }
 function isAuthAction(value) {
-  return value === "read" || value === "write" || value === "delete" || value === "share" || value === "admin";
+  return value === "read" || value === "create" || value === "update" || value === "write" || value === "delete" || value === "share" || value === "admin";
 }
 function parseDid(value) {
   if (typeof value === "string" && value.startsWith("did:key:")) {

package/dist/{chunk-Q67VT5XL.js → chunk-DESSPQBS.js}

@@ -1,3 +1,6 @@
+import {
+  createNodeQueryDescriptor
+} from "./chunk-S5RP5RKY.js";
 import {
   extKey
 } from "./chunk-PMUQACPY.js";
@@ -5,7 +8,7 @@ import {
   ExtensionFieldSchema,
   SchemaExtensionSchema,
   schemaExtensionId
-} from "./chunk-WEPK7SZF.js";
+} from "./chunk-KTPSQJ5L.js";
 import {
   MAX_KEY_LENGTH,
   compareSortKeys,
@@ -16,19 +19,16 @@ import {
 } from "./chunk-QWFTRZQT.js";
 import {
   DatabaseRowSchema
-} from "./chunk-FB63TZVI.js";
+} from "./chunk-OF6455OV.js";
 import {
   DatabaseFieldSchema
-} from "./chunk-KQAT4XBL.js";
+} from "./chunk-WWQO7QKV.js";
 import {
   DatabaseSelectOptionSchema
-} from "./chunk-6OMG4I7M.js";
+} from "./chunk-OIWW5TG3.js";
 import {
   DatabaseViewSchema
-} from "./chunk-MD553LDL.js";
-import {
-  createNodeQueryDescriptor
-} from "./chunk-S5RP5RKY.js";
+} from "./chunk-TRPXLCND.js";
 
 // src/database/cell-types.ts
 var CELL_PREFIX = "cell_";
@@ -264,6 +264,30 @@ function getRichTextPlainText(doc, columnId) {
   const fragment = doc.getXmlFragment(`${RICHTEXT_PREFIX}${columnId}`);
   return extractPlainText(fragment);
 }
+var BLOCK_ELEMENT_NAMES = /* @__PURE__ */ new Set([
+  // HTML-ish / legacy names
+  "p",
+  "h1",
+  "h2",
+  "h3",
+  "h4",
+  "h5",
+  "h6",
+  "li",
+  "blockquote",
+  // TipTap / BlockNote shared names
+  "paragraph",
+  "heading",
+  "codeBlock",
+  "listItem",
+  "taskItem",
+  // BlockNote (v4) block-content names
+  "bulletListItem",
+  "numberedListItem",
+  "checkListItem",
+  "toggleListItem",
+  "quote"
+]);
 function extractPlainText(fragment) {
   const parts = [];
   for (let i = 0; i < fragment.length; i++) {
@@ -276,7 +300,33 @@ function extractPlainText(fragment) {
   }
   return parts.join("");
 }
+function inlineAtomText(element) {
+  const attr = (key) => {
+    const value = element.getAttribute(key);
+    return typeof value === "string" ? value : "";
+  };
+  switch (element.nodeName) {
+    case "mention": {
+      const label = attr("label") || attr("id");
+      return label ? `@${label}` : "";
+    }
+    case "hashtag": {
+      const name = attr("name");
+      return name ? `#${name}` : "";
+    }
+    case "wikilink":
+      return element.length === 0 ? attr("title") : null;
+    case "inlineMath":
+      return attr("latex");
+    default:
+      return null;
+  }
+}
 function extractPlainTextFromElement(element) {
+  const atomText = inlineAtomText(element);
+  if (atomText !== null) {
+    return atomText;
+  }
   const parts = [];
   for (let i = 0; i < element.length; i++) {
     const item = element.get(i);
@@ -286,8 +336,7 @@ function extractPlainTextFromElement(element) {
       parts.push(extractPlainTextFromElement(item));
     }
   }
-  const blockElements = ["p", "h1", "h2", "h3", "h4", "h5", "h6", "li", "blockquote"];
-  if (blockElements.includes(element.nodeName)) {
+  if (BLOCK_ELEMENT_NAMES.has(element.nodeName)) {
     parts.push("\n");
   }
   return parts.join("");

package/dist/{chunk-W7EBL7ZU.js → chunk-DP4Q2HMO.js}

@@ -1,6 +1,6 @@
 import {
   spaceCascadeAuthorization
-} from "./chunk-OCMSAKWV.js";
+} from "./chunk-JA56EQJO.js";
 import {
   date,
   defineSchema,
@@ -9,7 +9,7 @@ import {
   relation,
   select,
   text
-} from "./chunk-EBNMV2VO.js";
+} from "./chunk-RRXJNZX5.js";
 
 // src/schema/schemas/observation.ts
 var ObservationSchema = defineSchema({

package/dist/{chunk-5EXHNXPL.js → chunk-DPJ4T2LQ.js}

@@ -1,6 +1,6 @@
 import {
   spaceCascadeAuthorization
-} from "./chunk-OCMSAKWV.js";
+} from "./chunk-JA56EQJO.js";
 import {
   created,
   createdBy,
@@ -9,7 +9,7 @@ import {
   relation,
   text,
   url
-} from "./chunk-EBNMV2VO.js";
+} from "./chunk-RRXJNZX5.js";
 
 // src/schema/schemas/feed-item.ts
 var FEED_ITEM_SCHEMA_IRI = "xnet://xnet.fyi/FeedItem@1.0.0";

package/dist/{chunk-BQLQSWKZ.js → chunk-EN6XTVLZ.js}

@@ -1,6 +1,6 @@
 import {
   spaceCascadeAuthorization
-} from "./chunk-OCMSAKWV.js";
+} from "./chunk-JA56EQJO.js";
 import {
   date,
   defineSchema,
@@ -11,7 +11,7 @@ import {
   relation,
   select,
   text
-} from "./chunk-EBNMV2VO.js";
+} from "./chunk-RRXJNZX5.js";
 
 // src/schema/schemas/game.ts
 var GAME_NAMESPACE = "xnet://xnet.fyi/";

package/dist/{chunk-TORDOOJ5.js → chunk-EYRZ6ZUB.js}

@@ -4,7 +4,7 @@ import {
   defineSchema,
   person,
   text
-} from "./chunk-EBNMV2VO.js";
+} from "./chunk-RRXJNZX5.js";
 
 // src/schema/schemas/profile.ts
 var ProfileSchema = defineSchema({

package/dist/{chunk-NI4FHG2K.js → chunk-EZTBWWMS.js}

@@ -1,13 +1,13 @@
 import {
   spaceCascadeAuthorization
-} from "./chunk-OCMSAKWV.js";
+} from "./chunk-JA56EQJO.js";
 import {
   defineSchema,
   json,
   relation,
   select,
   text
-} from "./chunk-EBNMV2VO.js";
+} from "./chunk-RRXJNZX5.js";
 
 // src/schema/schemas/map.ts
 var MapSchema = defineSchema({

package/dist/{chunk-UQM3G5A2.js → chunk-FWCM2TKJ.js}

@@ -1,6 +1,6 @@
 import {
   spaceCascadeAuthorization
-} from "./chunk-OCMSAKWV.js";
+} from "./chunk-JA56EQJO.js";
 import {
   checkbox,
   date,
@@ -9,7 +9,7 @@ import {
   relation,
   select,
   text
-} from "./chunk-EBNMV2VO.js";
+} from "./chunk-RRXJNZX5.js";
 
 // src/schema/schemas/task.ts
 var TaskSchema = defineSchema({

package/dist/{chunk-OSAWNZVM.js → chunk-GCTONBF6.js}

@@ -3,7 +3,7 @@ import {
   number,
   person,
   text
-} from "./chunk-EBNMV2VO.js";
+} from "./chunk-RRXJNZX5.js";
 
 // src/schema/schemas/grant.ts
 var GrantSchema = defineSchema({

package/dist/{chunk-2ZNJWIQG.js → chunk-HPUXHSKR.js}

@@ -1,6 +1,6 @@
 import {
   spaceCascadeAuthorization
-} from "./chunk-OCMSAKWV.js";
+} from "./chunk-JA56EQJO.js";
 import {
   defineSchema,
   file,
@@ -8,7 +8,7 @@ import {
   relation,
   select,
   text
-} from "./chunk-EBNMV2VO.js";
+} from "./chunk-RRXJNZX5.js";
 
 // src/schema/schemas/transcription.ts
 var TRANSCRIPTION_SCHEMA_IRI = "xnet://xnet.fyi/Transcription@1.0.0";

package/dist/{chunk-ZPZ7XDA6.js → chunk-HTZTBXKL.js}

@@ -1,13 +1,13 @@
 import {
   spaceCascadeAuthorization
-} from "./chunk-OCMSAKWV.js";
+} from "./chunk-JA56EQJO.js";
 import {
   defineSchema,
   money,
   relation,
   select,
   text
-} from "./chunk-EBNMV2VO.js";
+} from "./chunk-RRXJNZX5.js";
 
 // src/schema/schemas/budget.ts
 var BUDGET_SCHEMA_IRI = "xnet://xnet.fyi/Budget@1.0.0";

package/dist/{chunk-MCKP4F72.js → chunk-I7JMGCV6.js}

@@ -1,6 +1,6 @@
 import {
-  spaceCascadeAuthorization
-} from "./chunk-OCMSAKWV.js";
+  spaceContributorAuthorization
+} from "./chunk-JA56EQJO.js";
 import {
   checkbox,
   created,
@@ -13,7 +13,11 @@ import {
   relation,
   select,
   text
-} from "./chunk-EBNMV2VO.js";
+} from "./chunk-RRXJNZX5.js";
+import {
+  allow,
+  role
+} from "./chunk-D4LUUZYD.js";
 
 // src/schema/schemas/comment.ts
 var CommentSchema = defineSchema({
@@ -83,9 +87,26 @@ var CommentSchema = defineSchema({
   },
   // Comments are plain text + markdown, no collaborative Y.Doc needed
   document: void 0,
-  // Inherits access from its home Space (exploration 0181/0192).
-  authorization: spaceCascadeAuthorization("target")
+  // Inherits access from the target's Space (exploration 0181/0192), with
+  // author-owned mutation semantics (0304): space folk down to the commenter
+  // rung — plus the target's own author — may add comments, but only the
+  // comment's author (or space admins) may edit one afterwards.
+  authorization: commentAuthorization()
 });
+function commentAuthorization() {
+  const contributor = spaceContributorAuthorization("target");
+  return {
+    ...contributor,
+    roles: {
+      ...contributor.roles,
+      targetOwner: role.relation("target", "owner")
+    },
+    actions: {
+      ...contributor.actions,
+      create: allow("targetOwner", "spaceCommenter", "spaceMember", "spaceAdmin", "spaceOwner")
+    }
+  };
+}
 
 export {
   CommentSchema

package/dist/{chunk-OGJCRNGE.js → chunk-IA23CLGV.js}

@@ -1,13 +1,13 @@
 import {
   spaceCascadeAuthorization
-} from "./chunk-OCMSAKWV.js";
+} from "./chunk-JA56EQJO.js";
 import {
   date,
   defineSchema,
   relation,
   select,
   text
-} from "./chunk-EBNMV2VO.js";
+} from "./chunk-RRXJNZX5.js";
 
 // src/schema/schemas/milestone.ts
 var MILESTONE_SCHEMA_IRI = "xnet://xnet.fyi/Milestone@1.0.0";

package/dist/{chunk-YEFKQYKA.js → chunk-IKGUBSZP.js}

@@ -4,10 +4,10 @@ import {
   defineSchema,
   json,
   person
-} from "./chunk-EBNMV2VO.js";
+} from "./chunk-RRXJNZX5.js";
 import {
   presets
-} from "./chunk-RL64OJJ5.js";
+} from "./chunk-D4LUUZYD.js";
 
 // src/schema/schemas/inbox-state.ts
 var DEFAULT_CHANNEL_TIER = "mentions";

package/dist/{chunk-XMSKJ5PV.js → chunk-IKI5FBNO.js}

@@ -1,13 +1,13 @@
 import {
   spaceCascadeAuthorization
-} from "./chunk-OCMSAKWV.js";
+} from "./chunk-JA56EQJO.js";
 import {
   checkbox,
   defineSchema,
   relation,
   select,
   text
-} from "./chunk-EBNMV2VO.js";
+} from "./chunk-RRXJNZX5.js";
 
 // src/schema/schemas/account.ts
 var ACCOUNT_SCHEMA_IRI = "xnet://xnet.fyi/Account@1.0.0";

package/dist/{chunk-OCMSAKWV.js → chunk-JA56EQJO.js}

@@ -1,10 +1,10 @@
 import {
   SPACE_MEMBERSHIP_SCHEMA_IRI
-} from "./chunk-T5AZAOG5.js";
+} from "./chunk-LK5ZIAIE.js";
 import {
   allow,
   role
-} from "./chunk-RL64OJJ5.js";
+} from "./chunk-D4LUUZYD.js";
 
 // src/schema/schemas/space-authorization.ts
 var ROLE_ORDER = ["viewer", "commenter", "member", "admin", "owner"];
@@ -71,8 +71,20 @@ function spaceCascadeAuthorization(relationName = "space") {
     }
   };
 }
+function spaceContributorAuthorization(relationName = "space") {
+  const cascade = spaceCascadeAuthorization(relationName);
+  return {
+    ...cascade,
+    actions: {
+      ...cascade.actions,
+      create: allow("spaceOwner", "spaceAdmin", "spaceMember"),
+      update: allow("owner", "spaceOwner", "spaceAdmin")
+    }
+  };
+}
 
 export {
   spaceOwnAuthorization,
-  spaceCascadeAuthorization
+  spaceCascadeAuthorization,
+  spaceContributorAuthorization
 };