cursedbelt 2.8.0 → 3.0.0

package/dist/server/sharing/migrations.js

@@ -1,80 +0,0 @@
-export const SHARE_GRANTS_TABLE = "share_grants";
-export const SHARE_GROUPS_TABLE = "share_groups";
-export const SHARE_GROUP_MEMBERS_TABLE = "share_group_members";
-export const SHARE_EVENTS_TABLE = "share_events";
-export const SHARE_MIGRATIONS = [
-    {
-        name: "0001_share_grants",
-        up(db) {
-            db.run(`
-				CREATE TABLE IF NOT EXISTS ${SHARE_GRANTS_TABLE} (
-					grant_id    INTEGER PRIMARY KEY AUTOINCREMENT,
-					app         TEXT NOT NULL,
-					kind        TEXT NOT NULL,
-					resource_id TEXT NOT NULL,
-					subject_type TEXT NOT NULL CHECK (subject_type IN ('user', 'group')),
-					subject_id  TEXT NOT NULL,
-					level       TEXT NOT NULL CHECK (level IN ('read', 'write')),
-					granted_by  TEXT NOT NULL,
-					granted_at  TEXT NOT NULL,
-					note        TEXT NOT NULL DEFAULT '',
-					-- One grant per subject per resource. This is what makes raising
-					-- read to write an UPDATE the audit trail can describe, instead of
-					-- two rows where revoking one leaves access in place.
-					UNIQUE (app, kind, resource_id, subject_type, subject_id)
-				)
-			`);
-            // The hot read is the resolver's: "does this subject hold a grant on this
-            // row" — correlated per row of a list query, so it must be an index hit.
-            db.run(`CREATE INDEX IF NOT EXISTS idx_share_grants_subject
-				 ON ${SHARE_GRANTS_TABLE} (subject_type, subject_id, app, kind, resource_id)`);
-            // …and the panel's: "who can see this record".
-            db.run(`CREATE INDEX IF NOT EXISTS idx_share_grants_resource
-				 ON ${SHARE_GRANTS_TABLE} (app, kind, resource_id)`);
-            db.run(`
-				CREATE TABLE IF NOT EXISTS ${SHARE_GROUPS_TABLE} (
-					group_id   TEXT PRIMARY KEY,
-					name       TEXT NOT NULL,
-					created_by TEXT NOT NULL,
-					created_at TEXT NOT NULL,
-					note       TEXT NOT NULL DEFAULT ''
-				)
-			`);
-            db.run(`
-				CREATE TABLE IF NOT EXISTS ${SHARE_GROUP_MEMBERS_TABLE} (
-					group_id   TEXT NOT NULL REFERENCES ${SHARE_GROUPS_TABLE} (group_id) ON DELETE CASCADE,
-					subject_id TEXT NOT NULL,
-					added_by   TEXT NOT NULL,
-					added_at   TEXT NOT NULL,
-					PRIMARY KEY (group_id, subject_id)
-				)
-			`);
-            // "Which groups is this person in" — read by every shared-row query.
-            db.run(`CREATE INDEX IF NOT EXISTS idx_share_group_members_subject
-				 ON ${SHARE_GROUP_MEMBERS_TABLE} (subject_id)`);
-            db.run(`
-				CREATE TABLE IF NOT EXISTS ${SHARE_EVENTS_TABLE} (
-					event_id      INTEGER PRIMARY KEY AUTOINCREMENT,
-					at            TEXT NOT NULL,
-					action        TEXT NOT NULL,
-					app           TEXT,
-					kind          TEXT,
-					resource_id   TEXT,
-					subject_type  TEXT NOT NULL CHECK (subject_type IN ('user', 'group')),
-					subject_id    TEXT NOT NULL,
-					level         TEXT,
-					previous_level TEXT,
-					actor         TEXT NOT NULL,
-					note          TEXT NOT NULL DEFAULT ''
-				)
-			`);
-            // "Everything that ever happened to this record", newest first.
-            db.run(`CREATE INDEX IF NOT EXISTS idx_share_events_resource
-				 ON ${SHARE_EVENTS_TABLE} (app, kind, resource_id, event_id DESC)`);
-            // "Everything this person was ever given" — the offboarding question.
-            db.run(`CREATE INDEX IF NOT EXISTS idx_share_events_subject
-				 ON ${SHARE_EVENTS_TABLE} (subject_id, event_id DESC)`);
-        },
-    },
-];
-//# sourceMappingURL=migrations.js.map

package/dist/server/sharing/migrations.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"migrations.js","sourceRoot":"","sources":["../../../src/server/sharing/migrations.ts"],"names":[],"mappings":"AAmCA,MAAM,CAAC,MAAM,kBAAkB,GAAG,cAAc,CAAC;AACjD,MAAM,CAAC,MAAM,kBAAkB,GAAG,cAAc,CAAC;AACjD,MAAM,CAAC,MAAM,yBAAyB,GAAG,qBAAqB,CAAC;AAC/D,MAAM,CAAC,MAAM,kBAAkB,GAAG,cAAc,CAAC;AAEjD,MAAM,CAAC,MAAM,gBAAgB,GAAyB;IACrD;QACC,IAAI,EAAE,mBAAmB;QACzB,EAAE,CAAC,EAAY;YACd,EAAE,CAAC,GAAG,CAAC;iCACuB,kBAAkB;;;;;;;;;;;;;;;;IAgB/C,CAAC,CAAC;YACH,0EAA0E;YAC1E,yEAAyE;YACzE,EAAE,CAAC,GAAG,CACL;UACM,kBAAkB,qDAAqD,CAC7E,CAAC;YACF,+CAA+C;YAC/C,EAAE,CAAC,GAAG,CACL;UACM,kBAAkB,2BAA2B,CACnD,CAAC;YAEF,EAAE,CAAC,GAAG,CAAC;iCACuB,kBAAkB;;;;;;;IAO/C,CAAC,CAAC;YAEH,EAAE,CAAC,GAAG,CAAC;iCACuB,yBAAyB;2CACf,kBAAkB;;;;;;IAMzD,CAAC,CAAC;YACH,qEAAqE;YACrE,EAAE,CAAC,GAAG,CACL;UACM,yBAAyB,eAAe,CAC9C,CAAC;YAEF,EAAE,CAAC,GAAG,CAAC;iCACuB,kBAAkB;;;;;;;;;;;;;;IAc/C,CAAC,CAAC;YACH,gEAAgE;YAChE,EAAE,CAAC,GAAG,CACL;UACM,kBAAkB,0CAA0C,CAClE,CAAC;YACF,sEAAsE;YACtE,EAAE,CAAC,GAAG,CACL;UACM,kBAAkB,8BAA8B,CACtD,CAAC;QACH,CAAC;KACD;CACD,CAAC"}

package/dist/server/sharing/router.d.ts

@@ -1,112 +0,0 @@
-/**
- * `mountShareRoutes` — the three HTTP routes a shareable resource needs, once.
- *
- * ── Why this exists ─────────────────────────────────────────────────────────────────────
- * The store (`./store.ts`) was already the fleet's one sharing model; the ROUTES over it
- * were not. `apps/life` wrote them once and mounted them four times (calendars, lists,
- * to-dos, board cards) and `apps/family` wrote a fifth copy for people — five hand-rolled
- * copies of read/grant/revoke, each re-deciding the same three policy questions:
- *
- *  1. **All three routes are OWNER-only, including the READ.** "Who else can see this" is
- *     not part of what "shared with you" grants — a recipient must never reach
- *     `listForResource`, because the roster of other grantees is itself a disclosure.
- *     Five copies is five chances to write the gate on POST/DELETE and forget it on GET.
- *  2. **`group:<id>` is how a group subject travels in a URL.** A path segment cannot
- *     carry a `{type, id}` pair, so the prefix IS the type. Getting that wrong revokes a
- *     USER grant whose address happens to start with `group:` — or, worse, silently
- *     revokes nothing and reports success.
- *  3. **A grant only ever widens, and the audit trail outlives it.** Both are the store's,
- *     and both are only true if every route actually goes through the store.
- *
- * A bug in any of those has to be fixable by one commit. That is the placement test in
- * `cursedbelt/STANDARDS.md`, and it passes here.
- *
- * ── 🔴 The wire shape is LIFE's, and family's client changed to match ────────────────────
- * The two apps genuinely disagreed and one had to give:
- *
- *   · revoke — family put the subject in the QUERY (`DELETE …/shares?subject=&type=`),
- *     life in the PATH (`DELETE …/shares/:subject`, `group:` prefixed). The path wins.
- *     family's own comment argued for the query on the grounds that the target should be
- *     visible in the request line — which a path segment satisfies just as well, while
- *     also being the shape four of the five mounts already used. Changing one client beat
- *     changing four.
- *   · read — family returned `{grants, events, labels}`, life `{grants, events, groups}`.
- *     Neither extra is general: `labels` resolves addresses to names out of the family
- *     tree *inside the viewer's space*, `groups` is life's household roster. So the
- *     primitive owns `{grants, events}` and an app folds its own half in through
- *     {@link ShareRouterOptions.extra}.
- *
- * ── What stays in the app ───────────────────────────────────────────────────────────────
- * Ownership. `mustOwn` is the app's, because "who owns a calendar" and "who may curate a
- * family file" are policy this module has no business knowing — and because the 404/403
- * ORDER is policy too (family answers 404 before 403 on a person the viewer may not know
- * exists). The hook returns the refusal it wants, or null to continue.
- */
-import type { Context, Hono } from 'hono';
-import type { ShareEvent, ShareGrant } from '../../core/sharing/model';
-import type { ShareStore } from './store';
-/** The `group:` prefix that lets a group subject travel in a path segment. Exported so a
- *  client and a route cannot disagree about it. */
-export declare const GROUP_SUBJECT_PREFIX = "group:";
-/** Split a URL subject segment into the store's `{type, id}` pair. */
-export declare function parseSubjectParam(raw: string): {
-    type: 'user' | 'group';
-    id: string;
-};
-/** The inverse — what a client puts in the path. */
-export declare const subjectParam: (subject: {
-    type: "user" | "group";
-    id: string;
-}) => string;
-/** What every route needs about who is asking. Structural, so an app hands its own viewer
- *  type straight in. */
-export interface ShareRouterViewer {
-    /** The fleet address; the subject id of every `user` grant. */
-    email: string;
-}
-export interface ShareRouterOptions<V extends ShareRouterViewer> {
-    /**
-     * The resource path, with `:id` in it — e.g. `/api/calendars/:id`. The three routes
-     * hang off `${base}/shares`; revoke adds `/:subject`.
-     */
-    base: string;
-    /** The `kind` half of the store's `(app, kind, id)` triple. */
-    kind: string;
-    /** The store. A function when it is per-request (a multi-tenant app). */
-    shares: ShareStore | ((c: Context) => ShareStore);
-    /** Who is asking. Returning null refuses every route with 401. */
-    viewerOf: (c: Context) => V | null;
-    /**
-     * 🔴 The OWNER gate, run on ALL THREE routes including the read. Return a `Response` to
-     * refuse (the app owns the status AND the 404-before-403 ordering), or null to allow.
-     * `throw`ing is fine too — an app with an error middleware can keep using it.
-     */
-    mustOwn: (c: Context, id: string, viewer: V) => Response | null | Promise<Response | null>;
-    /** Extra fields folded into the READ payload beside `{grants, events}` — family's
-     *  `labels`, life's `groups`. */
-    extra?: (c: Context, id: string, viewer: V) => Record<string, unknown>;
-    /** How many audit lines the read carries. Default 50. */
-    trailLimit?: number;
-}
-/** The read payload's guaranteed half. An app's `extra` is spread in beside it. */
-export interface ShareRoutesPayload {
-    grants: ShareGrant[];
-    /** Newest first, and it OUTLIVES the grants — a revoked share still has a line. */
-    events: ShareEvent[];
-}
-/**
- * Mount GET / POST / DELETE for one `kind` on one app.
- *
- * ```ts
- * mountShareRoutes(app, {
- *   base: '/api/calendars/:id',
- *   kind: CALENDAR_KIND,
- *   shares,
- *   viewerOf,
- *   mustOwn: (c, id, viewer) => (ownsCalendar(db, viewer, id) ? null : c.json({ error: 'not found' }, 404)),
- *   extra: () => ({ groups: shares.listGroups() }),
- * });
- * ```
- */
-export declare function mountShareRoutes<V extends ShareRouterViewer>(app: Hono<any>, options: ShareRouterOptions<V>): void;
-//# sourceMappingURL=router.d.ts.map

package/dist/server/sharing/router.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../../../src/server/sharing/router.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAc,MAAM,0BAA0B,CAAC;AACnF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C;mDACmD;AACnD,eAAO,MAAM,oBAAoB,WAAW,CAAC;AAE7C,sEAAsE;AACtE,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAKrF;AAED,oDAAoD;AACpD,eAAO,MAAM,YAAY,GAAI,SAAS;IAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,KAAG,MACgB,CAAC;AAEhG;wBACwB;AACxB,MAAM,WAAW,iBAAiB;IAChC,+DAA+D;IAC/D,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,kBAAkB,CAAC,CAAC,SAAS,iBAAiB;IAC7D;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,MAAM,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO,KAAK,UAAU,CAAC,CAAC;IAClD,kEAAkE;IAClE,QAAQ,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,CAAC,GAAG,IAAI,CAAC;IACnC;;;;OAIG;IACH,OAAO,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,KAAK,QAAQ,GAAG,IAAI,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAC3F;qCACiC;IACjC,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvE,yDAAyD;IACzD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,mFAAmF;AACnF,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,UAAU,EAAE,CAAC;IACrB,mFAAmF;IACnF,MAAM,EAAE,UAAU,EAAE,CAAC;CACtB;AAID;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,SAAS,iBAAiB,EAI1D,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,EACd,OAAO,EAAE,kBAAkB,CAAC,CAAC,CAAC,GAC7B,IAAI,CAoEN"}

package/dist/server/sharing/router.js

@@ -1,94 +0,0 @@
-/** The `group:` prefix that lets a group subject travel in a path segment. Exported so a
- *  client and a route cannot disagree about it. */
-export const GROUP_SUBJECT_PREFIX = 'group:';
-/** Split a URL subject segment into the store's `{type, id}` pair. */
-export function parseSubjectParam(raw) {
-    const decoded = decodeURIComponent(raw);
-    return decoded.startsWith(GROUP_SUBJECT_PREFIX)
-        ? { type: 'group', id: decoded.slice(GROUP_SUBJECT_PREFIX.length) }
-        : { type: 'user', id: decoded };
-}
-/** The inverse — what a client puts in the path. */
-export const subjectParam = (subject) => encodeURIComponent(subject.type === 'group' ? GROUP_SUBJECT_PREFIX + subject.id : subject.id);
-const isLevel = (v) => v === 'read' || v === 'write';
-/**
- * Mount GET / POST / DELETE for one `kind` on one app.
- *
- * ```ts
- * mountShareRoutes(app, {
- *   base: '/api/calendars/:id',
- *   kind: CALENDAR_KIND,
- *   shares,
- *   viewerOf,
- *   mustOwn: (c, id, viewer) => (ownsCalendar(db, viewer, id) ? null : c.json({ error: 'not found' }, 404)),
- *   extra: () => ({ groups: shares.listGroups() }),
- * });
- * ```
- */
-export function mountShareRoutes(
-// biome-ignore lint/suspicious/noExplicitAny: the caller's Hono env is theirs, and this
-// module reads nothing off it — narrowing it would force every app to name its own Env
-// here for no gain.
-app, options) {
-    const { base, kind, viewerOf, mustOwn, extra, trailLimit = 50 } = options;
-    const storeOf = (c) => typeof options.shares === 'function' ? options.shares(c) : options.shares;
-    /** The three-step preamble every route shares: identity, id, ownership. */
-    async function enter(c) {
-        const viewer = viewerOf(c);
-        if (!viewer)
-            return { refused: c.json({ error: 'sign in first' }, 401) };
-        const id = c.req.param('id') ?? '';
-        const refused = await mustOwn(c, id, viewer);
-        if (refused)
-            return { refused };
-        return { id, viewer, shares: storeOf(c) };
-    }
-    app.get(`${base}/shares`, async (c) => {
-        const step = await enter(c);
-        if ('refused' in step)
-            return step.refused;
-        const { id, viewer, shares } = step;
-        const payload = {
-            // The store's own rows, straight through — the sharing panel consumes exactly
-            // these, and a DTO in the middle is a place for a field to go missing.
-            grants: shares.listForResource({ kind, id }),
-            events: shares.events({ kind, id, limit: trailLimit }),
-            ...(extra ? extra(c, id, viewer) : {}),
-        };
-        return c.json(payload);
-    });
-    app.post(`${base}/shares`, async (c) => {
-        const step = await enter(c);
-        if ('refused' in step)
-            return step.refused;
-        const { id, viewer, shares } = step;
-        const body = (await c.req.json().catch(() => ({})));
-        const subjectId = (body.subject?.id ?? body.email ?? '').trim();
-        if (!subjectId)
-            return c.json({ error: 'who should this be shared with?' }, 400);
-        if (body.level !== undefined && !isLevel(body.level)) {
-            return c.json({ error: "level must be 'read' or 'write'" }, 400);
-        }
-        const grant = shares.grant({
-            kind,
-            id,
-            subject: { type: body.subject?.type === 'group' ? 'group' : 'user', id: subjectId },
-            level: isLevel(body.level) ? body.level : 'read',
-            grantedBy: viewer.email,
-            ...(typeof body.note === 'string' ? { note: body.note } : {}),
-        });
-        return c.json(grant, 201);
-    });
-    app.delete(`${base}/shares/:subject`, async (c) => {
-        const step = await enter(c);
-        if ('refused' in step)
-            return step.refused;
-        const { id, viewer, shares } = step;
-        const raw = c.req.param('subject') ?? '';
-        if (!raw.trim())
-            return c.json({ error: 'which share should be removed?' }, 400);
-        shares.revoke({ kind, id, subject: parseSubjectParam(raw), revokedBy: viewer.email });
-        return c.json({ ok: true });
-    });
-}
-//# sourceMappingURL=router.js.map

package/dist/server/sharing/router.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"router.js","sourceRoot":"","sources":["../../../src/server/sharing/router.ts"],"names":[],"mappings":"AAgDA;mDACmD;AACnD,MAAM,CAAC,MAAM,oBAAoB,GAAG,QAAQ,CAAC;AAE7C,sEAAsE;AACtE,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACxC,OAAO,OAAO,CAAC,UAAU,CAAC,oBAAoB,CAAC;QAC7C,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC,MAAM,CAAC,EAAE;QACnE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;AACpC,CAAC;AAED,oDAAoD;AACpD,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAA+C,EAAU,EAAE,CACtF,kBAAkB,CAAC,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,oBAAoB,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAyChG,MAAM,OAAO,GAAG,CAAC,CAAU,EAAmB,EAAE,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,OAAO,CAAC;AAE/E;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB;AAC9B,wFAAwF;AACxF,uFAAuF;AACvF,oBAAoB;AACpB,GAAc,EACd,OAA8B;IAE9B,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC;IAC1E,MAAM,OAAO,GAAG,CAAC,CAAU,EAAc,EAAE,CACzC,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAE5E,2EAA2E;IAC3E,KAAK,UAAU,KAAK,CAClB,CAAU;QAEV,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC;QACzE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QAC7C,IAAI,OAAO;YAAE,OAAO,EAAE,OAAO,EAAE,CAAC;QAChC,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5C,CAAC;IAED,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACpC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,SAAS,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC;QAC3C,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QACpC,MAAM,OAAO,GAAiD;YAC5D,8EAA8E;YAC9E,uEAAuE;YACvE,MAAM,EAAE,MAAM,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;YAC5C,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;YACtD,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACvC,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,SAAS,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC;QAC3C,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QACpC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAOjD,CAAC;QACF,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAChE,IAAI,CAAC,SAAS;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,EAAE,GAAG,CAAC,CAAC;QACjF,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACrD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,EAAE,GAAG,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;YACzB,IAAI;YACJ,EAAE;YACF,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE;YACnF,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM;YAChD,SAAS,EAAE,MAAM,CAAC,KAAK;YACvB,GAAG,CAAC,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9D,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAChD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,SAAS,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC;QAC3C,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QACpC,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QACzC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,EAAE,GAAG,CAAC,CAAC;QACjF,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,iBAAiB,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QACtF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/server/sharing/sql.d.ts

@@ -1,68 +0,0 @@
-/**
- * The half a consuming app needs INSIDE its own queries: a SQL boolean saying
- * "this row is shared with the viewer".
- *
- * ── 🔴 Why a SQL fragment and not a list of ids ──────────────────────────────
- * The obvious API is `sharedIds(kind, viewer): string[]`, and it is wrong for the
- * consumers this exists to serve. `apps/family`'s rule, written in `people.ts`
- * before this primitive existed, is that a row the viewer may not see *"must not
- * surface as a snippet, a COUNT, or a tree node either"* — so its visibility test
- * has to be a WHERE clause that a `COUNT(*)`, a JOIN and a recursive tree walk all
- * inherit. Handing the app an array means the app writes `id IN (…)` itself, in
- * every one of those places, with its own quoting; the first one somebody forgets
- * is a disclosure, and it will be the count.
- *
- * So the primitive emits the clause. `sharedResourceSql` returns a correlated
- * `EXISTS (…)` over the grant tables that can be dropped into any query where the
- * resource's id column is in scope, including one whose only bound parameter is
- * something else entirely.
- *
- * ── 🔴 …which means this module quotes literals, so it does it in ONE place ───
- * A fragment with no bindable parameters has to inline its values. Every value
- * that reaches SQL here goes through {@link sqlLiteral} (double every apostrophe —
- * `o'brien@example.com` is an ordinary address) or {@link sqlColumn} (an
- * identifier, matched against a strict pattern and REFUSED otherwise, so a column
- * expression can never smuggle a subquery in). Both are exported and both are
- * tested with hostile input; a consumer never quotes anything itself.
- */
-import { type ShareLevel } from "../../core/sharing/model";
-/**
- * Quote a string as a SQL literal.
- *
- * SQLite escapes an apostrophe by doubling it, and that is the whole rule for a
- * TEXT literal — there is no backslash escape to worry about. A NUL byte is
- * refused rather than quoted: SQLite truncates a string at one, so a value
- * containing it would compare equal to a shorter value and silently widen a grant.
- */
-export declare function sqlLiteral(value: string): string;
-export declare function sqlColumn(column: string): string;
-export interface SharedResourceSqlOptions {
-    /** The satellite the resource belongs to — the `app` of the `(app, kind, id)`
-     *  triple. */
-    app: string;
-    /** The app's own word for this sort of record ("person", "budget"). */
-    kind: string;
-    /** The viewer's fleet address. An EMPTY id yields `0=1` — see below. */
-    subjectId: string;
-    /** The column holding the resource's id, in scope of the query being built. */
-    column: string;
-    /** Minimum level the grant must carry. Default `read`. */
-    atLeast?: ShareLevel;
-}
-/**
- * A SQL boolean: true for a row the viewer holds a grant on, at `atLeast` or
- * above, directly or through a group.
- *
- * The group half is a nested `SELECT` rather than a pre-resolved list, so a
- * membership change takes effect on the next query with no request-scoped cache to
- * invalidate — the failure mode of caching it is a relative who was removed from
- * the family group this morning and can still read until something restarts.
- *
- * 🔴 **An empty subject id yields `0=1`, never `1=1`.** An unauthenticated or
- * machine caller has no address, and the arithmetic of `subject_id = ''` against a
- * table where nothing has an empty id happens to be safe today — but a single
- * malformed row would turn that into "shared with everybody". Failing closed on the
- * missing identity is the property, not a coincidence of the data.
- */
-export declare function sharedResourceSql(options: SharedResourceSqlOptions): string;
-//# sourceMappingURL=sql.d.ts.map

package/dist/server/sharing/sql.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sql.d.ts","sourceRoot":"","sources":["../../../src/server/sharing/sql.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAAqC,KAAK,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAG9F;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAKhD;AAQD,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAQhD;AAED,MAAM,WAAW,wBAAwB;IACxC;kBACc;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,wEAAwE;IACxE,SAAS,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,MAAM,EAAE,MAAM,CAAC;IACf,0DAA0D;IAC1D,OAAO,CAAC,EAAE,UAAU,CAAC;CACrB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,GAAG,MAAM,CAkB3E"}

package/dist/server/sharing/sql.js

@@ -1,89 +0,0 @@
-/**
- * The half a consuming app needs INSIDE its own queries: a SQL boolean saying
- * "this row is shared with the viewer".
- *
- * ── 🔴 Why a SQL fragment and not a list of ids ──────────────────────────────
- * The obvious API is `sharedIds(kind, viewer): string[]`, and it is wrong for the
- * consumers this exists to serve. `apps/family`'s rule, written in `people.ts`
- * before this primitive existed, is that a row the viewer may not see *"must not
- * surface as a snippet, a COUNT, or a tree node either"* — so its visibility test
- * has to be a WHERE clause that a `COUNT(*)`, a JOIN and a recursive tree walk all
- * inherit. Handing the app an array means the app writes `id IN (…)` itself, in
- * every one of those places, with its own quoting; the first one somebody forgets
- * is a disclosure, and it will be the count.
- *
- * So the primitive emits the clause. `sharedResourceSql` returns a correlated
- * `EXISTS (…)` over the grant tables that can be dropped into any query where the
- * resource's id column is in scope, including one whose only bound parameter is
- * something else entirely.
- *
- * ── 🔴 …which means this module quotes literals, so it does it in ONE place ───
- * A fragment with no bindable parameters has to inline its values. Every value
- * that reaches SQL here goes through {@link sqlLiteral} (double every apostrophe —
- * `o'brien@example.com` is an ordinary address) or {@link sqlColumn} (an
- * identifier, matched against a strict pattern and REFUSED otherwise, so a column
- * expression can never smuggle a subquery in). Both are exported and both are
- * tested with hostile input; a consumer never quotes anything itself.
- */
-import { levelsMeeting, normalizeSubjectId } from "../../core/sharing/model";
-import { SHARE_GRANTS_TABLE, SHARE_GROUP_MEMBERS_TABLE } from "./migrations";
-/**
- * Quote a string as a SQL literal.
- *
- * SQLite escapes an apostrophe by doubling it, and that is the whole rule for a
- * TEXT literal — there is no backslash escape to worry about. A NUL byte is
- * refused rather than quoted: SQLite truncates a string at one, so a value
- * containing it would compare equal to a shorter value and silently widen a grant.
- */
-export function sqlLiteral(value) {
-    if (value.includes("\u0000")) {
-        throw new Error("[cursedbelt/sharing] a SQL literal may not contain a NUL byte");
-    }
-    return `'${value.replaceAll("'", "''")}'`;
-}
-/** A column reference — `id`, `p.id`, `"people"."id"` is NOT accepted. Anything
- *  that is not a bare (optionally table-qualified) identifier is refused, because
- *  this value is interpolated and a caller passing a computed string is how an
- *  injection reaches a fragment builder. */
-const COLUMN_PATTERN = /^[A-Za-z_][A-Za-z0-9_$]*(\.[A-Za-z_][A-Za-z0-9_$]*)?$/;
-export function sqlColumn(column) {
-    if (!COLUMN_PATTERN.test(column)) {
-        throw new Error(`[cursedbelt/sharing] ${JSON.stringify(column)} is not a plain column reference ` +
-            "(expected `id` or `alias.id`)");
-    }
-    return column;
-}
-/**
- * A SQL boolean: true for a row the viewer holds a grant on, at `atLeast` or
- * above, directly or through a group.
- *
- * The group half is a nested `SELECT` rather than a pre-resolved list, so a
- * membership change takes effect on the next query with no request-scoped cache to
- * invalidate — the failure mode of caching it is a relative who was removed from
- * the family group this morning and can still read until something restarts.
- *
- * 🔴 **An empty subject id yields `0=1`, never `1=1`.** An unauthenticated or
- * machine caller has no address, and the arithmetic of `subject_id = ''` against a
- * table where nothing has an empty id happens to be safe today — but a single
- * malformed row would turn that into "shared with everybody". Failing closed on the
- * missing identity is the property, not a coincidence of the data.
- */
-export function sharedResourceSql(options) {
-    const subjectId = normalizeSubjectId("user", options.subjectId);
-    if (!subjectId)
-        return "0=1";
-    const column = sqlColumn(options.column);
-    const levels = levelsMeeting(options.atLeast ?? "read")
-        .map((level) => sqlLiteral(level))
-        .join(", ");
-    const subject = sqlLiteral(subjectId);
-    return (`EXISTS (SELECT 1 FROM ${SHARE_GRANTS_TABLE} sg` +
-        ` WHERE sg.app = ${sqlLiteral(options.app)}` +
-        ` AND sg.kind = ${sqlLiteral(options.kind)}` +
-        ` AND sg.resource_id = ${column}` +
-        ` AND sg.level IN (${levels})` +
-        ` AND ((sg.subject_type = 'user' AND sg.subject_id = ${subject})` +
-        ` OR (sg.subject_type = 'group' AND sg.subject_id IN` +
-        ` (SELECT gm.group_id FROM ${SHARE_GROUP_MEMBERS_TABLE} gm WHERE gm.subject_id = ${subject}))))`);
-}
-//# sourceMappingURL=sql.js.map

package/dist/server/sharing/sql.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sql.js","sourceRoot":"","sources":["../../../src/server/sharing/sql.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAmB,MAAM,0BAA0B,CAAC;AAC9F,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAE7E;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAC,KAAa;IACvC,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;AAC3C,CAAC;AAED;;;4CAG4C;AAC5C,MAAM,cAAc,GAAG,uDAAuD,CAAC;AAE/E,MAAM,UAAU,SAAS,CAAC,MAAc;IACvC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACd,wBAAwB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,mCAAmC;YAChF,+BAA+B,CAChC,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAgBD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAiC;IAClE,MAAM,SAAS,GAAG,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAChE,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC;SACrD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;SACjC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,MAAM,OAAO,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;IACtC,OAAO,CACN,yBAAyB,kBAAkB,KAAK;QAChD,mBAAmB,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE;QAC5C,kBAAkB,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;QAC5C,yBAAyB,MAAM,EAAE;QACjC,qBAAqB,MAAM,GAAG;QAC9B,uDAAuD,OAAO,GAAG;QACjE,qDAAqD;QACrD,6BAA6B,yBAAyB,6BAA6B,OAAO,MAAM,CAChG,CAAC;AACH,CAAC"}

package/dist/server/sharing/store.d.ts

@@ -1,174 +0,0 @@
-/**
- * The store: grants, groups, revocation and the audit trail, over `bun:sqlite`.
- *
- * ── How an app uses it ──────────────────────────────────────────────────────
- * ```ts
- * const shares = createShareStore({ db, app: "family", onEvent: notify });
- *
- * shares.grant({ kind: "person", id, subject: user("aunt@example.com"),
- *                level: "read", grantedBy: viewer.email });
- * shares.accessFor({ kind: "person", id }, { subjectId: viewer.email }); // "read"
- * shares.revoke({ kind: "person", id, subject: user("aunt@example.com"),
- *                 revokedBy: viewer.email });
- * ```
- * …and inside the app's own queries, `sharedResourceSql` (see `./sql.ts`) is the
- * WHERE clause, so a filtered row never surfaces as a count either.
- *
- * ── 🔴 Five properties this file exists to guarantee ────────────────────────
- *  1. **Every mutation writes its own audit row, in the same transaction.** There
- *     is no `recordEvent` in the public API and no way to grant without logging.
- *     An audit trail a caller has to remember to write is a trail with holes
- *     exactly where somebody was in a hurry.
- *  2. **A revoked grant's history survives it.** Revocation deletes the grant row
- *     and appends an event; nothing here deletes an event, ever.
- *  3. **Deleting the RESOURCE is a revocation, not an orphan.** `revokeResource`
- *     exists so an app deleting a row has one call to make. A grant left behind
- *     for a deleted id silently becomes access to whatever later reuses that id.
- *  4. **The notification hook cannot break a write.** `onEvent` runs AFTER the
- *     transaction commits and its throw is swallowed with a warning: a mail server
- *     being down must not lose the grant the owner just made.
- *  5. **A subject is normalized once, here.** Callers pass whatever the form gave
- *     them; `normalizeSubjectId` is applied on the way in AND on the way to a
- *     lookup, so a grant made to `"  Ameena@Example.com "` is found by the session
- *     that signs in as `ameena@example.com`.
- */
-import type { Database } from "bun:sqlite";
-import { type ShareAccess, type ShareEvent, type ShareGrant, type ShareGroup, type ShareGroupMember, type ShareLevel, type ShareSubject, type ShareViewer } from "../../core/sharing/model";
-/** Shorthand for the common subject. `group(id)` is its sibling. */
-export declare const user: (id: string) => ShareSubject;
-export declare const group: (id: string) => ShareSubject;
-/** A resource within the store's own app — the `app` half is supplied by the
- *  store, so a caller cannot mistakenly write a grant into another app's rows. */
-export interface ShareTarget {
-    kind: string;
-    id: string;
-}
-export interface ShareStoreOptions {
-    db: Database;
-    /** The satellite this store speaks for. Fixed at construction so `app` cannot
-     *  be got wrong per call — the commonest way a grant becomes invisible. */
-    app: string;
-    /**
-     * Notified after every committed mutation — the notification hook ca's model
-     * had, as a seam rather than a dependency.
-     *
-     * 🔴 It stays a seam now that the other half EXISTS. `cursedbelt/server/
-     * notifications` landed the same day this did, so a consumer can wire the two
-     * in one line — `onEvent: (e) => notifications.notify({ userId: e.subject.id,
-     * … })` — and `describeShareEvent` in the vocabulary is the wording both the
-     * panel and that notification use. What must NOT happen is this store
-     * importing that one: an app is entitled to a sharing model with no bell (the
-     * grant is still audited), the subject of a GROUP grant is a group id and not
-     * a person to notify, and an app knows which of its users to address where
-     * this primitive only knows a subject id.
-     */
-    onEvent?: (event: ShareEvent) => void;
-    /** Injectable clock, for tests that assert ordering. ISO-8601 strings. */
-    now?: () => string;
-}
-export interface GrantInput extends ShareTarget {
-    subject: ShareSubject;
-    level: ShareLevel;
-    grantedBy: string;
-    note?: string;
-}
-export interface RevokeInput extends ShareTarget {
-    subject: ShareSubject;
-    revokedBy: string;
-    note?: string;
-}
-export interface ShareEventQuery {
-    kind?: string;
-    id?: string;
-    subject?: ShareSubject;
-    /** Newest first, capped. Default 200 — a panel shows a page, and an unbounded
-     *  audit read on a busy resource is the query that times out in production. */
-    limit?: number;
-}
-export type ShareStore = ReturnType<typeof createShareStore>;
-/**
- * Open (and migrate) the sharing tables in this database, returning the store.
- *
- * Idempotent: safe to call once per boot per `db`, and safe to call in a database
- * that already has the tables (the migration runner records what it applied).
- */
-export declare function createShareStore(options: ShareStoreOptions): {
-    /** The app this store speaks for — exposed so a consumer can build its own
-     *  `sharedResourceSql` call without re-declaring the name. */
-    app: string;
-    /**
-     * Give `subject` access to a resource, or change the access they have.
-     *
-     * An unchanged re-grant is still recorded as a `grant` event: "the owner
-     * confirmed this on Tuesday" is a fact somebody reading the trail wants, and
-     * suppressing it would make an idempotent API silently unauditable.
-     */
-    grant(input: GrantInput): ShareGrant;
-    /** Take access away. Returns the level that was removed, or null when there
-     *  was nothing to remove — in which case nothing is logged, because an audit
-     *  trail full of "revoked nothing" is one nobody reads. */
-    revoke(input: RevokeInput): ShareLevel | null;
-    /**
-     * Revoke EVERY grant on one resource — what an app calls when it deletes the
-     * record. Returns how many were removed.
-     *
-     * 🔴 Not optional housekeeping. Resource ids are app-minted, and a grant left
-     * behind for a deleted id becomes access to whatever is created with that id
-     * later. `apps/family` calls this in the same transaction as deleting a
-     * person.
-     */
-    revokeResource(target: ShareTarget, revokedBy: string): number;
-    /** Revoke everything shared with one subject, across every kind — the
-     *  offboarding call. A person losing their fleet account keeps nothing. */
-    revokeSubject(subject: ShareSubject, revokedBy: string): number;
-    /** Who can see this record, strongest first then oldest — the panel's read. */
-    listForResource(target: ShareTarget): ShareGrant[];
-    /** Everything shared with one subject — "shared with you". Group grants are
-     *  NOT expanded here; use {@link resourceIdsFor} for the resolved answer. */
-    listForSubject(subject: ShareSubject): ShareGrant[];
-    /**
-     * What may this viewer do with this resource — the resolver.
-     *
-     * The strongest of their own grant and every group they are in, computed in
-     * SQL. `resolveAccess` in `cursedbelt/sharing` is the same rule written as a
-     * pure function, and `store.spec.ts` checks the two agree.
-     */
-    accessFor(target: ShareTarget, viewer: ShareViewer): ShareAccess;
-    /** Every resource of `kind` this viewer reaches at `atLeast` or above.
-     *  For filtering rows in the app's OWN query, prefer `sharedResourceSql`. */
-    resourceIdsFor(kind: string, viewer: ShareViewer, atLeast?: ShareLevel): string[];
-    /** The WHERE-clause half, bound to this store's app. See `./sql.ts` for why
-     *  a fragment rather than a list of ids. */
-    sharedSql(input: {
-        kind: string;
-        subjectId: string;
-        column: string;
-        atLeast?: ShareLevel;
-    }): string;
-    createGroup(input: {
-        id: string;
-        name: string;
-        createdBy: string;
-        note?: string;
-    }): ShareGroup;
-    renameGroup(id: string, name: string, actor: string): void;
-    /**
-     * Delete a group — and every grant made TO it.
-     *
-     * 🔴 The grants go with it, explicitly, each with its own revoke event. The
-     * `ON DELETE CASCADE` on membership does not reach `share_grants` (a group
-     * subject is a string, not a foreign key, because the same column holds user
-     * addresses), so a group deleted without this leaves rows nobody can see in
-     * any UI and nothing can revoke.
-     */
-    deleteGroup(id: string, actor: string): void;
-    listGroups(): ShareGroup[];
-    addGroupMember(groupId: string, subjectId: string, actor: string): void;
-    removeGroupMember(groupId: string, subjectId: string, actor: string): void;
-    listGroupMembers(groupId: string): ShareGroupMember[];
-    /** Which groups is this person in — the one place membership is resolved. */
-    groupIdsFor(subjectId: string): string[];
-    /** The trail, newest first. Filter by resource, by subject, or neither. */
-    events(query?: ShareEventQuery): ShareEvent[];
-};
-//# sourceMappingURL=store.d.ts.map