@xnetjs/data 2.1.0 → 2.3.0

package/dist/{account-ZD3HMRY6.js → account-LYZ3VDC4.js}

@@ -1,10 +1,10 @@
 import {
   ACCOUNT_SCHEMA_IRI,
   AccountSchema
-} from "./chunk-IKI5FBNO.js";
-import "./chunk-JA56EQJO.js";
-import "./chunk-LK5ZIAIE.js";
-import "./chunk-RRXJNZX5.js";
+} from "./chunk-L6DF76E2.js";
+import "./chunk-RLRAWZJE.js";
+import "./chunk-GSLOK5KV.js";
+import "./chunk-NH6OLO3X.js";
 import "./chunk-D4LUUZYD.js";
 export {
   ACCOUNT_SCHEMA_IRI,

package/dist/{account-ledger-ZHBNVREV.js → account-ledger-7VF5SHTT.js}

@@ -15,8 +15,8 @@ import {
   resolveActiveDevices,
   revocationRecordId,
   revokedSubjects
-} from "./chunk-4KJ4NAMC.js";
-import "./chunk-RRXJNZX5.js";
+} from "./chunk-5ECIKN6Z.js";
+import "./chunk-NH6OLO3X.js";
 import "./chunk-D4LUUZYD.js";
 export {
   ACCOUNT_RECORD_SCHEMA_IRI,

package/dist/{agent-OFQJQMNB.js → agent-IJLOS2LA.js}

@@ -24,10 +24,10 @@ import {
   agentPassportId,
   agentSessionId,
   redactInstruction
-} from "./chunk-JWGS7JMA.js";
-import "./chunk-JA56EQJO.js";
-import "./chunk-LK5ZIAIE.js";
-import "./chunk-RRXJNZX5.js";
+} from "./chunk-2K6BLSNC.js";
+import "./chunk-RLRAWZJE.js";
+import "./chunk-GSLOK5KV.js";
+import "./chunk-NH6OLO3X.js";
 import "./chunk-D4LUUZYD.js";
 export {
   AGENT_ACTION_SCHEMA_IRI,

package/dist/auth/index.d.ts

@@ -1,12 +1,12 @@
 import { AllowExpr, DenyExpr, AuthExpression, AndExpr, OrExpr, NotExpr, PublicExpr, AuthenticatedExpr, CreatorRoleResolver, PropertyRoleResolver, RelationRoleResolver, MembershipRoleResolver, AuthorizationDefinition, SerializedAuthorization, SerializedAuthExpression, DID } from '@xnetjs/core';
 export { AUTH_ACTIONS, AllowExpr, AndExpr, AuthAction, AuthCheckInput, AuthDecision, AuthDenyReason, AuthExpression, AuthTrace, AuthTraceStep, AuthenticatedExpr, AuthorizationDefinition, CreatorRoleResolver, DenyExpr, MembershipRoleResolver, NotExpr, OrExpr, PolicyEvaluator, PropertyRoleResolver, PublicExpr, RelationRoleResolver, RoleRefExpr, RoleResolver, SerializedAuthExpression, SerializedAuthorization, SerializedRoleResolver } from '@xnetjs/core';
-import { F as PropertyDefinition, a as Schema, h as NodeState, S as SchemaIRI } from '../types-C64g-IXg.js';
-export { a_ as DEFAULT_OFFLINE_POLICY, aY as GRANT_SCHEMA_IRI, b4 as Grant, x as GrantIndex, b9 as GrantIndexOptions, b8 as GrantIndexStore, b3 as GrantInput, b7 as GrantNode, aX as GrantRateLimiter, bc as GrantRateLimiterOptions, O as OfflineAuthPolicy, bb as RevocationConfig, ba as RevocationConsistency, aW as StoreAuth, e as StoreAuthAPI, b5 as StoreAuthError, b6 as StoreAuthErrorCode, b2 as StoreAuthKeyManager, b0 as StoreAuthOptions, b1 as StoreAuthStore, aZ as isGrantActive, a$ as mergeOfflinePolicy } from '../types-C64g-IXg.js';
-export { A as ActionPermission, m as AuthDecisionEvent, b as DecisionCache, g as DecisionCacheOptions, D as DefaultPolicyEvaluator, j as DefaultPolicyEvaluatorOptions, a as DefaultRoleResolver, i as DefaultRoleResolverOptions, k as DefinedSchemaLike, G as GrantExpirationCleaner, o as GrantExpirationCleanerOptions, n as GrantExpirationStore, H as HubPolicy, N as NodeStoreReader, P as PermissionMatrix, l as RevalidationEvent, R as RoleSummary, S as SchemaRegistryReader, c as buildPermissionMatrix, f as createPolicyEvaluator, d as describeRoleResolver, e as evaluateExpression, h as hubActionsForSpaceRole, s as schemaToHubPolicy } from '../grant-expiration-cleaner-1by9wRlb.js';
+import { F as PropertyDefinition, a as Schema, h as NodeState, S as SchemaIRI } from '../types-gws1tSf-.js';
+export { a_ as DEFAULT_OFFLINE_POLICY, aY as GRANT_SCHEMA_IRI, b4 as Grant, x as GrantIndex, b9 as GrantIndexOptions, b8 as GrantIndexStore, b3 as GrantInput, b7 as GrantNode, aX as GrantRateLimiter, bc as GrantRateLimiterOptions, O as OfflineAuthPolicy, bb as RevocationConfig, ba as RevocationConsistency, aW as StoreAuth, e as StoreAuthAPI, b5 as StoreAuthError, b6 as StoreAuthErrorCode, b2 as StoreAuthKeyManager, b0 as StoreAuthOptions, b1 as StoreAuthStore, aZ as isGrantActive, a$ as mergeOfflinePolicy } from '../types-gws1tSf-.js';
+export { A as ActionPermission, m as AuthDecisionEvent, b as DecisionCache, g as DecisionCacheOptions, D as DefaultPolicyEvaluator, j as DefaultPolicyEvaluatorOptions, a as DefaultRoleResolver, i as DefaultRoleResolverOptions, k as DefinedSchemaLike, G as GrantExpirationCleaner, o as GrantExpirationCleanerOptions, n as GrantExpirationStore, H as HubPolicy, N as NodeStoreReader, P as PermissionMatrix, l as RevalidationEvent, R as RoleSummary, S as SchemaRegistryReader, c as buildPermissionMatrix, f as createPolicyEvaluator, d as describeRoleResolver, e as evaluateExpression, h as hubActionsForSpaceRole, s as schemaToHubPolicy } from '../grant-expiration-cleaner-CRS9OyhV.js';
 import { PublicKeyResolver } from '@xnetjs/crypto';
 import '@xnetjs/sqlite';
 import '@xnetjs/sync';
-import '../registry-s1fYgCSj.js';
+import '../registry-C9IRLLeR.js';
 
 /**
  * Authorization expression builders for schema definitions.

package/dist/{budget-FTGZEXX6.js → budget-WXX7PAWQ.js}

@@ -1,10 +1,10 @@
 import {
   BUDGET_SCHEMA_IRI,
   BudgetSchema
-} from "./chunk-HTZTBXKL.js";
-import "./chunk-JA56EQJO.js";
-import "./chunk-LK5ZIAIE.js";
-import "./chunk-RRXJNZX5.js";
+} from "./chunk-KHLOVRMQ.js";
+import "./chunk-RLRAWZJE.js";
+import "./chunk-GSLOK5KV.js";
+import "./chunk-NH6OLO3X.js";
 import "./chunk-D4LUUZYD.js";
 export {
   BUDGET_SCHEMA_IRI,

package/dist/canvas-64KGRYXI.js

@@ -0,0 +1,10 @@
+import {
+  CanvasSchema
+} from "./chunk-O34JPX6Q.js";
+import "./chunk-RLRAWZJE.js";
+import "./chunk-GSLOK5KV.js";
+import "./chunk-NH6OLO3X.js";
+import "./chunk-D4LUUZYD.js";
+export {
+  CanvasSchema
+};

package/dist/channel-DXLP6PEJ.js

@@ -0,0 +1,12 @@
+import {
+  CHANNEL_KINDS,
+  ChannelSchema
+} from "./chunk-7MSSPUMC.js";
+import "./chunk-RLRAWZJE.js";
+import "./chunk-GSLOK5KV.js";
+import "./chunk-NH6OLO3X.js";
+import "./chunk-D4LUUZYD.js";
+export {
+  CHANNEL_KINDS,
+  ChannelSchema
+};

package/dist/chat-message-EZW77LY3.js

@@ -0,0 +1,10 @@
+import {
+  ChatMessageSchema
+} from "./chunk-57AT2DT2.js";
+import "./chunk-RLRAWZJE.js";
+import "./chunk-GSLOK5KV.js";
+import "./chunk-NH6OLO3X.js";
+import "./chunk-D4LUUZYD.js";
+export {
+  ChatMessageSchema
+};

package/dist/{checkpoint-MZHJ7PCZ.js → checkpoint-SAKNGDI3.js}

@@ -1,10 +1,10 @@
 import {
   CHECKPOINT_SCHEMA_IRI,
   CheckpointSchema
-} from "./chunk-6ZUJID52.js";
-import "./chunk-JA56EQJO.js";
-import "./chunk-LK5ZIAIE.js";
-import "./chunk-RRXJNZX5.js";
+} from "./chunk-TOQ2LBAN.js";
+import "./chunk-RLRAWZJE.js";
+import "./chunk-GSLOK5KV.js";
+import "./chunk-NH6OLO3X.js";
 import "./chunk-D4LUUZYD.js";
 export {
   CHECKPOINT_SCHEMA_IRI,

package/dist/{chunk-4S73XDWH.js → chunk-27AF2RSY.js}

@@ -3,16 +3,26 @@ import {
   getNodeQuerySearchTokens,
   withoutNodeQueryMaterializedView,
   withoutNodeQueryPagination
-} from "./chunk-S5RP5RKY.js";
+} from "./chunk-WOEFYS7Y.js";
+import {
+  evaluateLedgerWrite,
+  foldAccountRecord,
+  ledgerAccountId,
+  ledgerWriteKind
+} from "./chunk-3UOUVEZW.js";
+import {
+  accountRecordId,
+  revocationRecordId
+} from "./chunk-5ECIKN6Z.js";
 import {
   SYSTEM_SCHEMA_BASE_IRIS,
   isSystemNamespaceResource,
   isSystemSchemaIri
-} from "./chunk-XJBDESCX.js";
+} from "./chunk-ZNHLH7SC.js";
 import {
   createNodeId,
   getBaseSchemaIRI
-} from "./chunk-RRXJNZX5.js";
+} from "./chunk-NH6OLO3X.js";
 
 // src/store/query-ast.ts
 var QUERY_AST_VERSION = 1;
@@ -2642,6 +2652,53 @@ var NodeStore = class {
    *
    * @throws Error if signature verification fails
    */
+  /**
+   * Account-ledger enforcement for inbound changes (0149/0243, wired by 0337):
+   * hydrate the account's controllers/epoch and the author's revocation status
+   * from local storage, then require the write to pass `evaluateLedgerWrite`.
+   * Mirrors the hub's `enforceLedgerWrite` so a hostile or auth-less hub still
+   * cannot push unauthorized ledger records into a client.
+   */
+  async enforceRemoteLedgerWrite(change) {
+    const schemaId = change.payload.schemaId;
+    const kind = ledgerWriteKind(schemaId);
+    if (!kind) return;
+    const properties = change.payload.properties ?? {};
+    const accountId = ledgerAccountId(kind, properties);
+    let account = null;
+    let authorRevoked = false;
+    if (accountId) {
+      const accountNode = await this.storage.getNode(accountRecordId(accountId));
+      if (accountNode) {
+        account = foldAccountRecord(accountNode.properties);
+      }
+      const revocationNode = await this.storage.getNode(
+        revocationRecordId(accountId, change.authorDID)
+      );
+      authorRevoked = revocationNode !== null && revocationNode !== void 0;
+    }
+    const decision = evaluateLedgerWrite({
+      schemaId,
+      authorDid: change.authorDID,
+      properties,
+      state: { account, authorRevoked }
+    });
+    if (!decision.allowed) {
+      this.telemetry?.reportSecurityEvent("data.ledger_write_rejected", "high");
+      throw new PermissionError({
+        allowed: false,
+        action: "update",
+        subject: change.authorDID,
+        resource: change.payload.nodeId,
+        roles: [],
+        grants: [],
+        reasons: ["DENY_NODE_POLICY"],
+        cached: false,
+        evaluatedAt: Date.now(),
+        duration: 0
+      });
+    }
+  }
   async applyRemoteChange(change) {
     const start = this.telemetry ? Date.now() : 0;
     try {
@@ -2669,6 +2726,7 @@ var NodeStore = class {
           `[NodeStore] Remote change ${change.id} failed verification: ${err instanceof Error ? err.message : String(err)}`
         );
       }
+      await this.enforceRemoteLedgerWrite(change);
       if (this.authEvaluator) {
         const stored = await this.storage.getNode(change.payload.nodeId);
         const action = this.inferActionFromChange(change, stored);
@@ -4792,7 +4850,22 @@ CREATE INDEX IF NOT EXISTS idx_node_spatial_ids_schema
       return null;
     }
     const value = node.properties[key];
-    return typeof value === "number" && Number.isFinite(value) ? value : null;
+    if (typeof value === "number" && Number.isFinite(value)) {
+      return value;
+    }
+    if (value === void 0) {
+      const dot = key.indexOf(".");
+      if (dot > 0) {
+        const parent = node.properties[key.slice(0, dot)];
+        if (typeof parent === "object" && parent !== null && !Array.isArray(parent)) {
+          const sub = parent[key.slice(dot + 1)];
+          if (typeof sub === "number" && Number.isFinite(sub)) {
+            return sub;
+          }
+        }
+      }
+    }
+    return null;
   }
 };
 

package/dist/{chunk-ZKMWJNDQ.js → chunk-2DAVPHDV.js}

@@ -5,7 +5,7 @@ import {
   relation,
   select,
   text
-} from "./chunk-RRXJNZX5.js";
+} from "./chunk-NH6OLO3X.js";
 import {
   presets
 } from "./chunk-D4LUUZYD.js";

package/dist/{chunk-KTPSQJ5L.js → chunk-2JROE7ML.js}

@@ -1,13 +1,13 @@
 import {
   spaceCascadeAuthorization
-} from "./chunk-JA56EQJO.js";
+} from "./chunk-RLRAWZJE.js";
 import {
   defineSchema,
   json,
   number,
   relation,
   text
-} from "./chunk-RRXJNZX5.js";
+} from "./chunk-NH6OLO3X.js";
 
 // src/schema/schemas/schema-extension.ts
 var SCHEMA_EXTENSION_SCHEMA_IRI = "xnet://xnet.fyi/SchemaExtension@1.0.0";

package/dist/{chunk-JWGS7JMA.js → chunk-2K6BLSNC.js}

@@ -1,6 +1,6 @@
 import {
   spaceCascadeAuthorization
-} from "./chunk-JA56EQJO.js";
+} from "./chunk-RLRAWZJE.js";
 import {
   created,
   createdBy,
@@ -11,7 +11,7 @@ import {
   relation,
   select,
   text
-} from "./chunk-RRXJNZX5.js";
+} from "./chunk-NH6OLO3X.js";
 
 // src/schema/schemas/agent.ts
 var AGENT_PASSPORT_SCHEMA_IRI = "xnet://xnet.fyi/AgentPassport@1.0.0";