@aglyn/aglyn 1.0.0-beta.143

package/src/lib/foundation/definitions/write-deny-coverage.util.js

@@ -0,0 +1,499 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * Shared parsing for the write-deny coverage guards (AGL-1355, AGL-1361).
+ *
+ * Extracted from `org-write-deny-coverage.spec.ts` when the same property was
+ * extended to `hosts/{hostId}` and `marketplaceListings/{listingId}`. Three
+ * documents, three different rule shapes, one parser — a second copy of this
+ * would be a second thing to keep true, which is the disease these guards
+ * exist to treat.
+ *
+ * Deliberately PURE: every function takes source text and returns data, with
+ * no file I/O and no imports. That keeps the module free of `node:fs` (this
+ * lib is bundled for the browser) and makes each helper testable on a string
+ * literal. The specs own the reading.
+ *
+ * Not exported from the foundation barrel — nothing at runtime should reach
+ * for it.
+ */ /**
+ * Comments are stripped from every source before parsing. Prose in this repo
+ * quotes rules fragments and field names constantly — the org block's own
+ * comment names all four AGL-1354 keys, and the listing block's names half its
+ * deny-list — so parsing with comments in place would read the explanation of
+ * a hole as the fix for it.
+ *
+ * A single left-to-right scan, NOT two regex passes, and that distinction is
+ * load-bearing (AGL-2004). The previous version removed block comments first
+ * and line comments second, so a line comment that merely QUOTED a path opened
+ * a block comment that was never meant to exist:
+ *
+ *     // the name, so `hosts/<hostId>/datasets/*` stayed a client-writable
+ *
+ * The `/` before `*` reads as an opening delimiter, and the strip then ran to
+ * the next closing delimiter 571 lines away, swallowing real rule text — and
+ * with it two closing braces, which left the block walker unable to find the
+ * end of the root `match` and threw `never closes`. Every deny-coverage guard
+ * in this directory failed to RUN, which is the worst way for a guard to fail:
+ * the suite is red, so nobody reads it as coverage, but the thing it protects
+ * (the AGL-1775 `registers` deny-list) is unwatched until someone does.
+ *
+ * Scanning once fixes it in both directions: whichever delimiter appears first
+ * wins, so `/*` inside a line comment is just text, and `//` inside a block
+ * comment cannot eat the block's own terminator.
+ */ export function stripComments(source) {
+    let out = '';
+    let index = 0;
+    while(index < source.length){
+        const pair = source.slice(index, index + 2);
+        if (pair === '/*') {
+            const end = source.indexOf('*/', index + 2);
+            index = end < 0 ? source.length : end + 2;
+            continue;
+        }
+        if (pair === '//') {
+            const end = source.indexOf('\n', index + 2);
+            if (end < 0) break;
+            // Keep the newline: line numbers and statement separation survive.
+            out += '\n';
+            index = end + 1;
+            continue;
+        }
+        out += source[index];
+        index += 1;
+    }
+    return out;
+}
+/**
+ * Quoted strings, blanked. `org-permissions.ts` declares permission KEYS
+ * spelled `'org.settings'` and `'org.auditLog'`, which read exactly like a
+ * field access — the first run of the org guard demanded the rules deny two
+ * fields that do not exist. Template literals are left alone: a real read can
+ * legitimately live inside `${…}`.
+ */ export function stripQuotedStrings(source) {
+    return source.replace(/'(?:\\.|[^'\\\n])*'/g, "''").replace(/"(?:\\.|[^"\\\n])*"/g, '""');
+}
+/**
+ * Firestore path variables (`{orgId}`, `{document=**}`) carry braces that a
+ * block-depth walker reads as nesting. Rewriting them to angle brackets makes
+ * the rules parseable by brace counting without losing the path text — which
+ * matters, because `{document=**}` IS the wildcard these guards have to see.
+ */ export function normalizePathVariables(rules) {
+    return rules.replace(/\{([A-Za-z_][A-Za-z0-9_]*(?:=\*\*)?)\}/g, '<$1>');
+}
+/**
+ * The text of a `{ … }` block, keeping only what sits at the block's own
+ * depth. Nested blocks — sub-`match` rules, inline object types — are dropped,
+ * so a nested `allow` or a nested property can never be mistaken for one
+ * belonging to the block asked for.
+ *
+ * `header` must end with the opening brace.
+ */ export function topLevelBody(source, header) {
+    const at = source.indexOf(header);
+    if (at < 0) throw new Error(`Guard cannot parse: no \`${header}\` found.`);
+    let depth = 1;
+    let out = '';
+    for(let index = at + header.length; index < source.length; index += 1){
+        const character = source[index];
+        if (character === '{') {
+            depth += 1;
+            continue;
+        }
+        if (character === '}') {
+            depth -= 1;
+            if (depth === 0) return out;
+            continue;
+        }
+        if (depth === 1) out += character;
+    }
+    throw new Error(`Guard cannot parse: \`${header}\` never closes.`);
+}
+/**
+ * The FULL text of a `{ … }` block, nested blocks INCLUDED.
+ *
+ * The opposite of `topLevelBody`, and needed for the opposite question. That
+ * one answers "what does THIS block say", so it drops nested bodies — which is
+ * exactly right for a deny-list on one document, and exactly wrong for
+ * `hosts/{hostId}`, whose subcollection rules all live in nested `match`
+ * blocks. AGL-1367 lived in one of them.
+ *
+ * `header` must end with the opening brace.
+ */ export function rawBlockBody(source, header) {
+    const at = source.indexOf(header);
+    if (at < 0) throw new Error(`Guard cannot parse: no \`${header}\` found.`);
+    let depth = 1;
+    let out = '';
+    for(let index = at + header.length; index < source.length; index += 1){
+        const character = source[index];
+        if (character === '{') depth += 1;
+        else if (character === '}') {
+            depth -= 1;
+            if (depth === 0) return out;
+        }
+        out += character;
+    }
+    throw new Error(`Guard cannot parse: \`${header}\` never closes.`);
+}
+/**
+ * Parse the host catch-all's three exclusion lists (AGL-1367).
+ *
+ * Membership in ONE list is not denial and never was — `variables` is
+ * create-excluded and freely updatable, `webhooks` is create-excluded and
+ * freely updatable on purpose (the soft delete is how a capped site frees a
+ * slot). And a dedicated `match` block RE-GRANTS, because Firestore ORs its
+ * allows and the LOOSER one wins: `screens`, `layouts` and `collections` all
+ * sit in three lists and stay editor-writable through the blocks above.
+ *
+ * So "denied outright" is the intersection of the three lists MINUS everything
+ * with a block of its own. That subtraction is the reason a dedicated
+ * `allow write: if false` block would not have closed AGL-1367 — a deny can
+ * never win an OR.
+ */ export function parseHostSubcollectionRules(rulesSource) {
+    const rules = normalizePathVariables(stripComments(rulesSource));
+    const host = rawBlockBody(rules, 'match /hosts/<hostId> {');
+    const catchAllHeader = 'match /<subcollection>/<document=**> {';
+    const occurrences = host.split(catchAllHeader).length - 1;
+    if (occurrences !== 1) {
+        throw new Error(`Expected exactly one \`${catchAllHeader}\` under match /hosts/{hostId}, ` + `found ${occurrences}. A second one would OR another set of allows ` + `onto every subcollection, so these lists would be half the answer.`);
+    }
+    const catchAll = rawBlockBody(host, catchAllHeader);
+    const listFor = (operation)=>{
+        const statement = catchAll.split(';').find((entry)=>new RegExp(`\\ballow\\b[^:]*\\b${operation}\\b`).test(entry));
+        if (!statement) {
+            throw new Error(`No \`allow … ${operation}\` in the host catch-all. The block has been ` + `restructured; re-read it before trusting this guard.`);
+        }
+        const list = statement.match(/subcollection\s+in\s+\[([^\]]*)\]/);
+        if (!list) {
+            throw new Error(`The host catch-all's \`allow ${operation}\` has no ` + `\`subcollection in […]\` exclusion list. Every server-owned host ` + `subcollection is denied by NAME in that list and nowhere else, so ` + `this guard cannot see what is protected any more.`);
+        }
+        return [
+            ...list[1].matchAll(/'([^']+)'/g)
+        ].map((entry)=>entry[1]);
+    };
+    const excluded = {
+        create: listFor('create'),
+        update: listFor('update'),
+        delete: listFor('delete')
+    };
+    // Named `match` blocks only. After `normalizePathVariables` a wildcard
+    // segment starts with `<`, so a leading letter is what distinguishes a
+    // collection block from `match /<subcollection>/…` or the nested
+    // `match /<sub>/…` inside the screens/layouts/components blocks.
+    const dedicated = [
+        ...new Set([
+            ...host.matchAll(/match\s+\/([A-Za-z][A-Za-z0-9]*)\//g)
+        ].map((entry)=>entry[1]))
+    ];
+    const serverOnly = excluded.create.filter((name)=>excluded.update.includes(name) && excluded.delete.includes(name) && !dedicated.includes(name));
+    return {
+        excluded,
+        dedicated,
+        serverOnly
+    };
+}
+/**
+ * Split an expression on `||` at parenthesis depth 0 only.
+ *
+ * A naive `split('||')` tears a branch apart at any nested alternation, and
+ * both of the documents AGL-1361 added have one. The host rule's client branch
+ * is `(… && !hasAny(L1) && (role == 'admin' || !hasAny(L2)))` — its deny-list
+ * is TIERED, six keys no site member may touch plus `disabledPlugins` which
+ * only a site admin may — and a naive split drops L2 into a branch of its own
+ * where nothing looks for it. The listing block's `function listingManager()`
+ * produces the mirror problem, matching two branches instead of one.
+ */ export function splitTopLevelOr(expression) {
+    const parts = [];
+    let depth = 0;
+    let current = '';
+    for(let index = 0; index < expression.length; index += 1){
+        const character = expression[index];
+        if (character === '(') depth += 1;
+        if (character === ')') depth -= 1;
+        if (depth === 0 && character === '|' && expression[index + 1] === '|') {
+            parts.push(current);
+            current = '';
+            index += 1;
+            continue;
+        }
+        current += character;
+    }
+    parts.push(current);
+    return parts.map((part)=>part.trim()).filter(Boolean);
+}
+/** The keys of the FIRST `hasAny([...])` literal in a rules branch. */ export function hasAnyKeys(branch) {
+    const list = branch.match(/hasAny\(\s*\[([^\]]*)\]/);
+    if (!list) return [];
+    return [
+        ...list[1].matchAll(/'([^']+)'/g)
+    ].map((entry)=>entry[1]);
+}
+/**
+ * The keys of EVERY `hasAny([...])` literal in a branch, flattened.
+ *
+ * The org rule has one list per branch; the host rule has two in a single
+ * branch, because its deny-list is TIERED — six keys no site member may
+ * touch, and `disabledPlugins` which only a site admin may. `hasAnyKeys`
+ * returns the first list alone, so a host guard built on it would have
+ * silently believed `disabledPlugins` was unprotected.
+ */ export function allHasAnyKeys(branch) {
+    return [
+        ...branch.matchAll(/hasAny\(\s*\[([^\]]*)\]/g)
+    ].flatMap((list)=>[
+            ...list[1].matchAll(/'([^']+)'/g)
+        ].map((entry)=>entry[1]));
+}
+/**
+ * Top-level property names declared on an interface.
+ *
+ * `header` is the full declaration line up to and including the brace, because
+ * the three documents do not share a shape: `AglynOrgBilling` and `AglynHost`
+ * both `extends AglynDocument`, while `MarketplaceListing` extends nothing.
+ */ export function declaredFields(source, header) {
+    const body = topLevelBody(stripComments(source), header);
+    return [
+        ...body.matchAll(/(?:^|\n)\s*(\$?[A-Za-z_][A-Za-z0-9_$]*)\s*\??\s*:/g)
+    ].map((entry)=>entry[1]);
+}
+/**
+ * Parse the single `allow update` of one top-level document block.
+ *
+ * `matchHeader` is post-`normalizePathVariables`, e.g.
+ * `match /hosts/<hostId> {`. `clientPredicate` names the branch that a CLIENT
+ * reaches — `canManageOrg()`, `canWriteHostContent(hostId)`, `listingManager()`
+ * — as opposed to the staff branches, which are trusted by design.
+ */ export function parseUpdateRule(rulesSource, matchHeader, clientPredicate) {
+    const rules = normalizePathVariables(stripComments(rulesSource));
+    const root = topLevelBody(rules, 'match /databases/<database>/documents {');
+    const topLevelMatches = [
+        ...root.matchAll(/match\s+(\/\S*)/g)
+    ].map((entry)=>entry[1]);
+    const block = topLevelBody(rules, matchHeader);
+    const statements = block.split(';').map((statement)=>statement.trim()).filter(Boolean);
+    // ONE `allow` statement may mention `update`. Firestore ORs every allow
+    // across sibling statements AND sibling match blocks, and the LOOSER one
+    // wins — so a second statement would mean this guard is reasoning about a
+    // deny-list that some other statement quietly overrides.
+    const updates = statements.filter((statement)=>/\ballow\b[^:]*\bupdate\b/.test(statement));
+    if (updates.length !== 1) {
+        throw new Error(`Expected exactly one \`allow … update\` statement under ` + `${matchHeader}, found ${updates.length}. Firestore ORs them and the ` + `LOOSER wins, so the deny-list this guard reads would no longer be ` + `the whole answer. Fold the branches back into one statement, or ` + `teach this guard how they combine.`);
+    }
+    // Start at the `allow` keyword. `topLevelBody` drops a nested block's BODY
+    // but leaves its header text at depth 1, so the listing block's
+    // `function listingManager()` declaration survives as an orphan with no
+    // semicolon of its own — it merges into the following statement and makes
+    // `listingManager()` appear in two branches instead of one. Slicing to
+    // `allow` removes the remnant without pretending the function is not there.
+    const statement = updates[0].slice(updates[0].indexOf('allow'));
+    const branches = splitTopLevelOr(statement);
+    const found = branches.filter((branch)=>branch.includes(clientPredicate));
+    if (found.length !== 1) {
+        throw new Error(`Expected exactly one \`allow update\` branch guarded by ` + `${clientPredicate} under ${matchHeader}, found ${found.length}. The ` + `rule has been restructured; re-read it before trusting this guard.`);
+    }
+    return {
+        denied: allHasAnyKeys(found[0]),
+        branches,
+        statements,
+        topLevelMatches
+    };
+}
+/**
+ * Field names in an object literal a document is seeded with.
+ *
+ * `anchor` is a regex source locating the write; the literal's own braces are
+ * matched by depth rather than `[^}]*`, because a seed can legitimately carry
+ * a nested object (the host seed writes `screens: {}`) and a lazy class would
+ * truncate the field list at the first inner brace — silently shrinking one of
+ * the guard's sources rather than failing.
+ */ export function seedFields(source, anchor) {
+    const at = stripComments(source).search(anchor);
+    if (at < 0) return null;
+    const text = stripComments(source);
+    const open = text.indexOf('{', at);
+    if (open < 0) return null;
+    let depth = 1;
+    let body = '';
+    for(let index = open + 1; index < text.length; index += 1){
+        const character = text[index];
+        if (character === '{') depth += 1;
+        else if (character === '}') {
+            depth -= 1;
+            if (depth === 0) break;
+        }
+        if (depth === 1) body += character;
+    }
+    return [
+        ...body.matchAll(/(?:^|,|\n)\s*([A-Za-z_$][A-Za-z0-9_$]*)\s*[,:]/g)
+    ].map((entry)=>entry[1]);
+}
+/**
+ * Field names a document of `collection` is seeded with, in either shape a
+ * seed write takes in this codebase (AGL-2100).
+ *
+ * The original parser understood only the CHAINED form —
+ * `collection('hosts').doc(id).set({ … })` — because that is what every seed
+ * route looked like when it was written. AGL-2063 rewrote the host create into
+ * a transactional claim, which necessarily splits the chain: the ref has to be
+ * built BEFORE `runTransaction` opens so the transaction body can both read
+ * and write it, leaving `const hostRef = …doc(hostId)` in one statement and
+ * `tx.set(hostRef, { … })` in another. The chained anchor then matched
+ * nothing, `seedFields` returned null, and the guard threw — asserting nothing
+ * about any of the four sources of the host field set until it was fixed.
+ *
+ * So resolve the REF BINDING rather than teaching the guard one more literal
+ * spelling. Any `set`/`create` whose first argument is a ref bound to this
+ * collection is a seed write, which covers `tx.`, `batch.` and a bare
+ * `ref.set()` alike, and does not care what wraps them.
+ *
+ * Anchoring on the WRITE and not on the binding matters: the binding is
+ * followed by the transaction callback's own `{`, so a binding-anchored parse
+ * would happily return the arrow body's contents as the field list — a
+ * silently wrong answer, which is worse than the throw.
+ *
+ * Returns null when neither shape is present, so the caller still throws.
+ */ export function seedFieldsOfCollection(source, collection) {
+    const name = collection.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const chained = seedFields(source, new RegExp(`collection\\('${name}'\\)\\s*\\.doc\\([^)]*\\)\\s*\\.\\s*(?:set|create)\\s*\\(`));
+    if (chained) return chained;
+    const text = stripComments(source);
+    const bindings = [
+        ...text.matchAll(new RegExp(`(?:const|let|var)\\s+([A-Za-z_$][A-Za-z0-9_$]*)\\s*=\\s*[^;\\n]*collection\\('${name}'\\)\\s*\\.doc\\(`, 'g'))
+    ].map((entry)=>entry[1]);
+    for (const binding of bindings){
+        const fields = seedFields(source, new RegExp(`\\b(?:set|create)\\s*\\(\\s*${binding}\\s*,\\s*\\{`));
+        if (fields) return fields;
+    }
+    return null;
+}
+/**
+ * Whether the property access ending at `index` is being CALLED (AGL-1719).
+ *
+ * The guard reads `hosts/{hostId}` fields by scanning for `host.<name>` across
+ * a whole directory, which means it matches on the identifier NAME and cannot
+ * see the type. `media-ref.ts` has `isFirstPartyHost(host: string)` whose body
+ * is `host.toLowerCase()` — a hostname string, not the host document — so
+ * `toLowerCase` entered the field universe and the guard demanded that a
+ * `String.prototype` method be classified as server-owned or client-writable.
+ *
+ * Dropping method calls removes that whole class rather than that one name,
+ * and it is sound in the only direction that matters. Firestore document data
+ * is JSON: string, number, boolean, null, array, map, timestamp, geopoint,
+ * reference. **No field of a document can be callable**, so `binding.X(` is
+ * provably never a field read and this can never introduce a false negative —
+ * which is the single failure mode a coverage guard has (AGL-1420).
+ *
+ * A chained read is untouched: in `host.disabledPlugins.includes(x)` the
+ * character after the captured name is `.`, so `disabledPlugins` is still
+ * collected and only `includes` is dropped. Optional calls (`host.foo?.()`)
+ * and generic ones (`host.foo<T>()`) are calls too.
+ *
+ * An exclusion list of known method names was rejected: it would silence the
+ * symptom, need tending forever, and still say nothing about the next method
+ * on the next same-named local.
+ */ function isMethodCallAt(source, index) {
+    const rest = source.slice(index);
+    return /^\s*(?:\?\.)?\s*(?:<[^<>()]*>\s*)?\(/.test(rest);
+}
+/**
+ * Top-level fields of `binding` that the modules in `sources` read.
+ *
+ * Directory-wide on purpose. A per-file list would be one more thing to keep
+ * up to date, and a NEW resolver reading a NEW field is covered the moment it
+ * is written — the only way this stays true without anyone tending it.
+ *
+ * The document is identified by IDENTIFIER NAME, not by type — this is a text
+ * scan, and it has no way to know what a local called `host` actually holds.
+ * So an unrelated binding of the same name contributes its property reads too.
+ * That direction is safe (a spurious field fails loudly and gets classified by
+ * a human, and can never HIDE a real one), and it is deliberately left alone,
+ * because the filter that would suppress it is the filter that could suppress
+ * a real read. See {@link isMethodCallAt} for the one case that is not safe to
+ * leave — it produced a name no human could classify.
+ */ export function readFieldsOf(sources, binding) {
+    const found = new Set();
+    for (const raw of sources){
+        const source = stripQuotedStrings(stripComments(raw));
+        // `host?.field` / `host.field` — the ordinary read.
+        for (const hit of source.matchAll(new RegExp(`\\b${binding}\\s*\\??\\.\\s*([A-Za-z_$][A-Za-z0-9_$]*)`, 'g'))){
+            // `host.toLowerCase()` is a method INVOCATION, not a field (AGL-1719).
+            if (isMethodCallAt(source, hit.index + hit[0].length)) continue;
+            // A lone `$` is the head of a `${…}` interpolation, not a field: it
+            // comes from token-name construction like `` `{{host.${key}}}` ``.
+            // Template literals are left unstripped on purpose — a real read can
+            // live inside one — so this is the price, and a field named `$` cannot
+            // exist. Anything else, including `$id`, is kept and must be classified.
+            if (hit[1] !== '$') found.add(hit[1]);
+        }
+        // `(host as { cname?: unknown })?.cname` — the cast a field that is real
+        // but was undeclared gets read through.
+        for (const hit of source.matchAll(new RegExp(`\\b${binding}\\s+as\\s*\\{\\s*([A-Za-z_$][A-Za-z0-9_$]*)\\s*\\??\\s*:`, 'g'))){
+            found.add(hit[1]);
+        }
+    }
+    return [
+        ...found
+    ].sort();
+}
+/**
+ * Comments stripped from a TYPESCRIPT source, with string literals respected.
+ *
+ * `stripComments` above scans rules files, where no string ever contains a
+ * comment delimiter. TypeScript sources are not that: `apps/console/app/api/
+ * media/upload-url/route.ts` builds a download URL from a template literal
+ * containing `https://`, and a scan that does not know it is inside a string
+ * reads that `//` as a line comment and deletes the rest of the line. On a
+ * guard that parses an object literal out of a route, that is not a crash —
+ * it is a SHORTER field list, silently, which is the failure mode AGL-2004
+ * described one level down.
+ *
+ * A separate function rather than a widened `stripComments`, because the two
+ * inputs have genuinely different grammars and three shipped guards depend on
+ * the rules-file behaviour exactly as it is. Same single left-to-right scan,
+ * with quotes as a third state.
+ */ export function stripTypeScriptComments(source) {
+    let out = '';
+    let index = 0;
+    while(index < source.length){
+        const pair = source.slice(index, index + 2);
+        if (pair === '/*') {
+            const end = source.indexOf('*/', index + 2);
+            index = end < 0 ? source.length : end + 2;
+            continue;
+        }
+        if (pair === '//') {
+            const end = source.indexOf('\n', index + 2);
+            if (end < 0) break;
+            // Keep the newline so line-oriented reasoning downstream survives.
+            out += '\n';
+            index = end + 1;
+            continue;
+        }
+        const character = source[index];
+        if (character === "'" || character === '"' || character === '`') {
+            let cursor = index + 1;
+            while(cursor < source.length && source[cursor] !== character){
+                cursor += source[cursor] === '\\' ? 2 : 1;
+            }
+            out += source.slice(index, Math.min(cursor + 1, source.length));
+            index = cursor + 1;
+            continue;
+        }
+        out += character;
+        index += 1;
+    }
+    return out;
+}
+
+//# sourceMappingURL=write-deny-coverage.util.js.map

package/src/lib/foundation/definitions/write-deny-coverage.util.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/aglyn/src/lib/foundation/definitions/write-deny-coverage.util.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Shared parsing for the write-deny coverage guards (AGL-1355, AGL-1361).\n *\n * Extracted from `org-write-deny-coverage.spec.ts` when the same property was\n * extended to `hosts/{hostId}` and `marketplaceListings/{listingId}`. Three\n * documents, three different rule shapes, one parser — a second copy of this\n * would be a second thing to keep true, which is the disease these guards\n * exist to treat.\n *\n * Deliberately PURE: every function takes source text and returns data, with\n * no file I/O and no imports. That keeps the module free of `node:fs` (this\n * lib is bundled for the browser) and makes each helper testable on a string\n * literal. The specs own the reading.\n *\n * Not exported from the foundation barrel — nothing at runtime should reach\n * for it.\n */\n\n/**\n * Comments are stripped from every source before parsing. Prose in this repo\n * quotes rules fragments and field names constantly — the org block's own\n * comment names all four AGL-1354 keys, and the listing block's names half its\n * deny-list — so parsing with comments in place would read the explanation of\n * a hole as the fix for it.\n *\n * A single left-to-right scan, NOT two regex passes, and that distinction is\n * load-bearing (AGL-2004). The previous version removed block comments first\n * and line comments second, so a line comment that merely QUOTED a path opened\n * a block comment that was never meant to exist:\n *\n *     // the name, so `hosts/<hostId>/datasets/*` stayed a client-writable\n *\n * The `/` before `*` reads as an opening delimiter, and the strip then ran to\n * the next closing delimiter 571 lines away, swallowing real rule text — and\n * with it two closing braces, which left the block walker unable to find the\n * end of the root `match` and threw `never closes`. Every deny-coverage guard\n * in this directory failed to RUN, which is the worst way for a guard to fail:\n * the suite is red, so nobody reads it as coverage, but the thing it protects\n * (the AGL-1775 `registers` deny-list) is unwatched until someone does.\n *\n * Scanning once fixes it in both directions: whichever delimiter appears first\n * wins, so `/*` inside a line comment is just text, and `//` inside a block\n * comment cannot eat the block's own terminator.\n */\nexport function stripComments(source: string): string {\n  let out = ''\n  let index = 0\n  while (index < source.length) {\n    const pair = source.slice(index, index + 2)\n    if (pair === '/*') {\n      const end = source.indexOf('*/', index + 2)\n      index = end < 0 ? source.length : end + 2\n      continue\n    }\n    if (pair === '//') {\n      const end = source.indexOf('\\n', index + 2)\n      if (end < 0) break\n      // Keep the newline: line numbers and statement separation survive.\n      out += '\\n'\n      index = end + 1\n      continue\n    }\n    out += source[index]\n    index += 1\n  }\n  return out\n}\n\n/**\n * Quoted strings, blanked. `org-permissions.ts` declares permission KEYS\n * spelled `'org.settings'` and `'org.auditLog'`, which read exactly like a\n * field access — the first run of the org guard demanded the rules deny two\n * fields that do not exist. Template literals are left alone: a real read can\n * legitimately live inside `${…}`.\n */\nexport function stripQuotedStrings(source: string): string {\n  return source\n    .replace(/'(?:\\\\.|[^'\\\\\\n])*'/g, \"''\")\n    .replace(/\"(?:\\\\.|[^\"\\\\\\n])*\"/g, '\"\"')\n}\n\n/**\n * Firestore path variables (`{orgId}`, `{document=**}`) carry braces that a\n * block-depth walker reads as nesting. Rewriting them to angle brackets makes\n * the rules parseable by brace counting without losing the path text — which\n * matters, because `{document=**}` IS the wildcard these guards have to see.\n */\nexport function normalizePathVariables(rules: string): string {\n  return rules.replace(/\\{([A-Za-z_][A-Za-z0-9_]*(?:=\\*\\*)?)\\}/g, '<$1>')\n}\n\n/**\n * The text of a `{ … }` block, keeping only what sits at the block's own\n * depth. Nested blocks — sub-`match` rules, inline object types — are dropped,\n * so a nested `allow` or a nested property can never be mistaken for one\n * belonging to the block asked for.\n *\n * `header` must end with the opening brace.\n */\nexport function topLevelBody(source: string, header: string): string {\n  const at = source.indexOf(header)\n  if (at < 0) throw new Error(`Guard cannot parse: no \\`${header}\\` found.`)\n  let depth = 1\n  let out = ''\n  for (let index = at + header.length; index < source.length; index += 1) {\n    const character = source[index]\n    if (character === '{') {\n      depth += 1\n      continue\n    }\n    if (character === '}') {\n      depth -= 1\n      if (depth === 0) return out\n      continue\n    }\n    if (depth === 1) out += character\n  }\n  throw new Error(`Guard cannot parse: \\`${header}\\` never closes.`)\n}\n\n/**\n * The FULL text of a `{ … }` block, nested blocks INCLUDED.\n *\n * The opposite of `topLevelBody`, and needed for the opposite question. That\n * one answers \"what does THIS block say\", so it drops nested bodies — which is\n * exactly right for a deny-list on one document, and exactly wrong for\n * `hosts/{hostId}`, whose subcollection rules all live in nested `match`\n * blocks. AGL-1367 lived in one of them.\n *\n * `header` must end with the opening brace.\n */\nexport function rawBlockBody(source: string, header: string): string {\n  const at = source.indexOf(header)\n  if (at < 0) throw new Error(`Guard cannot parse: no \\`${header}\\` found.`)\n  let depth = 1\n  let out = ''\n  for (let index = at + header.length; index < source.length; index += 1) {\n    const character = source[index]\n    if (character === '{') depth += 1\n    else if (character === '}') {\n      depth -= 1\n      if (depth === 0) return out\n    }\n    out += character\n  }\n  throw new Error(`Guard cannot parse: \\`${header}\\` never closes.`)\n}\n\n/** The subcollection write rules of `hosts/{hostId}`, as the rules state them. */\nexport interface ParsedSubcollectionRules {\n  /** The `subcollection in […]` exclusion list of each catch-all allow. */\n  excluded: { create: string[]; update: string[]; delete: string[] }\n  /** Collections with a dedicated `match` block, which can RE-GRANT. */\n  dedicated: string[]\n  /** Excluded from all three AND re-granted by nothing: denied outright. */\n  serverOnly: string[]\n}\n\n/**\n * Parse the host catch-all's three exclusion lists (AGL-1367).\n *\n * Membership in ONE list is not denial and never was — `variables` is\n * create-excluded and freely updatable, `webhooks` is create-excluded and\n * freely updatable on purpose (the soft delete is how a capped site frees a\n * slot). And a dedicated `match` block RE-GRANTS, because Firestore ORs its\n * allows and the LOOSER one wins: `screens`, `layouts` and `collections` all\n * sit in three lists and stay editor-writable through the blocks above.\n *\n * So \"denied outright\" is the intersection of the three lists MINUS everything\n * with a block of its own. That subtraction is the reason a dedicated\n * `allow write: if false` block would not have closed AGL-1367 — a deny can\n * never win an OR.\n */\nexport function parseHostSubcollectionRules(\n  rulesSource: string,\n): ParsedSubcollectionRules {\n  const rules = normalizePathVariables(stripComments(rulesSource))\n  const host = rawBlockBody(rules, 'match /hosts/<hostId> {')\n\n  const catchAllHeader = 'match /<subcollection>/<document=**> {'\n  const occurrences = host.split(catchAllHeader).length - 1\n  if (occurrences !== 1) {\n    throw new Error(\n      `Expected exactly one \\`${catchAllHeader}\\` under match /hosts/{hostId}, ` +\n        `found ${occurrences}. A second one would OR another set of allows ` +\n        `onto every subcollection, so these lists would be half the answer.`,\n    )\n  }\n  const catchAll = rawBlockBody(host, catchAllHeader)\n\n  const listFor = (operation: 'create' | 'update' | 'delete'): string[] => {\n    const statement = catchAll\n      .split(';')\n      .find((entry) =>\n        new RegExp(`\\\\ballow\\\\b[^:]*\\\\b${operation}\\\\b`).test(entry),\n      )\n    if (!statement) {\n      throw new Error(\n        `No \\`allow … ${operation}\\` in the host catch-all. The block has been ` +\n          `restructured; re-read it before trusting this guard.`,\n      )\n    }\n    const list = statement.match(/subcollection\\s+in\\s+\\[([^\\]]*)\\]/)\n    if (!list) {\n      throw new Error(\n        `The host catch-all's \\`allow ${operation}\\` has no ` +\n          `\\`subcollection in […]\\` exclusion list. Every server-owned host ` +\n          `subcollection is denied by NAME in that list and nowhere else, so ` +\n          `this guard cannot see what is protected any more.`,\n      )\n    }\n    return [...list[1].matchAll(/'([^']+)'/g)].map((entry) => entry[1])\n  }\n\n  const excluded = {\n    create: listFor('create'),\n    update: listFor('update'),\n    delete: listFor('delete'),\n  }\n  // Named `match` blocks only. After `normalizePathVariables` a wildcard\n  // segment starts with `<`, so a leading letter is what distinguishes a\n  // collection block from `match /<subcollection>/…` or the nested\n  // `match /<sub>/…` inside the screens/layouts/components blocks.\n  const dedicated = [\n    ...new Set(\n      [...host.matchAll(/match\\s+\\/([A-Za-z][A-Za-z0-9]*)\\//g)].map(\n        (entry) => entry[1],\n      ),\n    ),\n  ]\n  const serverOnly = excluded.create.filter(\n    (name) =>\n      excluded.update.includes(name) &&\n      excluded.delete.includes(name) &&\n      !dedicated.includes(name),\n  )\n  return { excluded, dedicated, serverOnly }\n}\n\n/**\n * Split an expression on `||` at parenthesis depth 0 only.\n *\n * A naive `split('||')` tears a branch apart at any nested alternation, and\n * both of the documents AGL-1361 added have one. The host rule's client branch\n * is `(… && !hasAny(L1) && (role == 'admin' || !hasAny(L2)))` — its deny-list\n * is TIERED, six keys no site member may touch plus `disabledPlugins` which\n * only a site admin may — and a naive split drops L2 into a branch of its own\n * where nothing looks for it. The listing block's `function listingManager()`\n * produces the mirror problem, matching two branches instead of one.\n */\nexport function splitTopLevelOr(expression: string): string[] {\n  const parts: string[] = []\n  let depth = 0\n  let current = ''\n  for (let index = 0; index < expression.length; index += 1) {\n    const character = expression[index]\n    if (character === '(') depth += 1\n    if (character === ')') depth -= 1\n    if (depth === 0 && character === '|' && expression[index + 1] === '|') {\n      parts.push(current)\n      current = ''\n      index += 1\n      continue\n    }\n    current += character\n  }\n  parts.push(current)\n  return parts.map((part) => part.trim()).filter(Boolean)\n}\n\n/** The keys of the FIRST `hasAny([...])` literal in a rules branch. */\nexport function hasAnyKeys(branch: string): string[] {\n  const list = branch.match(/hasAny\\(\\s*\\[([^\\]]*)\\]/)\n  if (!list) return []\n  return [...list[1].matchAll(/'([^']+)'/g)].map((entry) => entry[1])\n}\n\n/**\n * The keys of EVERY `hasAny([...])` literal in a branch, flattened.\n *\n * The org rule has one list per branch; the host rule has two in a single\n * branch, because its deny-list is TIERED — six keys no site member may\n * touch, and `disabledPlugins` which only a site admin may. `hasAnyKeys`\n * returns the first list alone, so a host guard built on it would have\n * silently believed `disabledPlugins` was unprotected.\n */\nexport function allHasAnyKeys(branch: string): string[] {\n  return [...branch.matchAll(/hasAny\\(\\s*\\[([^\\]]*)\\]/g)].flatMap((list) =>\n    [...list[1].matchAll(/'([^']+)'/g)].map((entry) => entry[1]),\n  )\n}\n\n/**\n * Top-level property names declared on an interface.\n *\n * `header` is the full declaration line up to and including the brace, because\n * the three documents do not share a shape: `AglynOrgBilling` and `AglynHost`\n * both `extends AglynDocument`, while `MarketplaceListing` extends nothing.\n */\nexport function declaredFields(source: string, header: string): string[] {\n  const body = topLevelBody(stripComments(source), header)\n  return [\n    ...body.matchAll(/(?:^|\\n)\\s*(\\$?[A-Za-z_][A-Za-z0-9_$]*)\\s*\\??\\s*:/g),\n  ].map((entry) => entry[1])\n}\n\n/** A parsed `allow update` rule for one document. */\nexport interface ParsedUpdateRule {\n  /** Every key denied to the client branch, across all its `hasAny` lists. */\n  denied: string[]\n  /** Every OR'd branch of the single `allow update` statement. */\n  branches: string[]\n  /** Depth-0 statements of the document's `match` block. */\n  statements: string[]\n  /** Depth-0 `match` headers under `/databases/{database}/documents`. */\n  topLevelMatches: string[]\n}\n\n/**\n * Parse the single `allow update` of one top-level document block.\n *\n * `matchHeader` is post-`normalizePathVariables`, e.g.\n * `match /hosts/<hostId> {`. `clientPredicate` names the branch that a CLIENT\n * reaches — `canManageOrg()`, `canWriteHostContent(hostId)`, `listingManager()`\n * — as opposed to the staff branches, which are trusted by design.\n */\nexport function parseUpdateRule(\n  rulesSource: string,\n  matchHeader: string,\n  clientPredicate: string,\n): ParsedUpdateRule {\n  const rules = normalizePathVariables(stripComments(rulesSource))\n  const root = topLevelBody(rules, 'match /databases/<database>/documents {')\n  const topLevelMatches = [...root.matchAll(/match\\s+(\\/\\S*)/g)].map(\n    (entry) => entry[1],\n  )\n\n  const block = topLevelBody(rules, matchHeader)\n  const statements = block\n    .split(';')\n    .map((statement) => statement.trim())\n    .filter(Boolean)\n\n  // ONE `allow` statement may mention `update`. Firestore ORs every allow\n  // across sibling statements AND sibling match blocks, and the LOOSER one\n  // wins — so a second statement would mean this guard is reasoning about a\n  // deny-list that some other statement quietly overrides.\n  const updates = statements.filter((statement) =>\n    /\\ballow\\b[^:]*\\bupdate\\b/.test(statement),\n  )\n  if (updates.length !== 1) {\n    throw new Error(\n      `Expected exactly one \\`allow … update\\` statement under ` +\n        `${matchHeader}, found ${updates.length}. Firestore ORs them and the ` +\n        `LOOSER wins, so the deny-list this guard reads would no longer be ` +\n        `the whole answer. Fold the branches back into one statement, or ` +\n        `teach this guard how they combine.`,\n    )\n  }\n\n  // Start at the `allow` keyword. `topLevelBody` drops a nested block's BODY\n  // but leaves its header text at depth 1, so the listing block's\n  // `function listingManager()` declaration survives as an orphan with no\n  // semicolon of its own — it merges into the following statement and makes\n  // `listingManager()` appear in two branches instead of one. Slicing to\n  // `allow` removes the remnant without pretending the function is not there.\n  const statement = updates[0].slice(updates[0].indexOf('allow'))\n  const branches = splitTopLevelOr(statement)\n  const found = branches.filter((branch) => branch.includes(clientPredicate))\n  if (found.length !== 1) {\n    throw new Error(\n      `Expected exactly one \\`allow update\\` branch guarded by ` +\n        `${clientPredicate} under ${matchHeader}, found ${found.length}. The ` +\n        `rule has been restructured; re-read it before trusting this guard.`,\n    )\n  }\n\n  return {\n    denied: allHasAnyKeys(found[0]),\n    branches,\n    statements,\n    topLevelMatches,\n  }\n}\n\n/**\n * Field names in an object literal a document is seeded with.\n *\n * `anchor` is a regex source locating the write; the literal's own braces are\n * matched by depth rather than `[^}]*`, because a seed can legitimately carry\n * a nested object (the host seed writes `screens: {}`) and a lazy class would\n * truncate the field list at the first inner brace — silently shrinking one of\n * the guard's sources rather than failing.\n */\nexport function seedFields(source: string, anchor: RegExp): string[] | null {\n  const at = stripComments(source).search(anchor)\n  if (at < 0) return null\n  const text = stripComments(source)\n  const open = text.indexOf('{', at)\n  if (open < 0) return null\n  let depth = 1\n  let body = ''\n  for (let index = open + 1; index < text.length; index += 1) {\n    const character = text[index]\n    if (character === '{') depth += 1\n    else if (character === '}') {\n      depth -= 1\n      if (depth === 0) break\n    }\n    if (depth === 1) body += character\n  }\n  return [\n    ...body.matchAll(/(?:^|,|\\n)\\s*([A-Za-z_$][A-Za-z0-9_$]*)\\s*[,:]/g),\n  ].map((entry) => entry[1])\n}\n\n/**\n * Field names a document of `collection` is seeded with, in either shape a\n * seed write takes in this codebase (AGL-2100).\n *\n * The original parser understood only the CHAINED form —\n * `collection('hosts').doc(id).set({ … })` — because that is what every seed\n * route looked like when it was written. AGL-2063 rewrote the host create into\n * a transactional claim, which necessarily splits the chain: the ref has to be\n * built BEFORE `runTransaction` opens so the transaction body can both read\n * and write it, leaving `const hostRef = …doc(hostId)` in one statement and\n * `tx.set(hostRef, { … })` in another. The chained anchor then matched\n * nothing, `seedFields` returned null, and the guard threw — asserting nothing\n * about any of the four sources of the host field set until it was fixed.\n *\n * So resolve the REF BINDING rather than teaching the guard one more literal\n * spelling. Any `set`/`create` whose first argument is a ref bound to this\n * collection is a seed write, which covers `tx.`, `batch.` and a bare\n * `ref.set()` alike, and does not care what wraps them.\n *\n * Anchoring on the WRITE and not on the binding matters: the binding is\n * followed by the transaction callback's own `{`, so a binding-anchored parse\n * would happily return the arrow body's contents as the field list — a\n * silently wrong answer, which is worse than the throw.\n *\n * Returns null when neither shape is present, so the caller still throws.\n */\nexport function seedFieldsOfCollection(\n  source: string,\n  collection: string,\n): string[] | null {\n  const name = collection.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&')\n  const chained = seedFields(\n    source,\n    new RegExp(\n      `collection\\\\('${name}'\\\\)\\\\s*\\\\.doc\\\\([^)]*\\\\)\\\\s*\\\\.\\\\s*(?:set|create)\\\\s*\\\\(`,\n    ),\n  )\n  if (chained) return chained\n\n  const text = stripComments(source)\n  const bindings = [\n    ...text.matchAll(\n      new RegExp(\n        `(?:const|let|var)\\\\s+([A-Za-z_$][A-Za-z0-9_$]*)\\\\s*=\\\\s*[^;\\\\n]*collection\\\\('${name}'\\\\)\\\\s*\\\\.doc\\\\(`,\n        'g',\n      ),\n    ),\n  ].map((entry) => entry[1])\n\n  for (const binding of bindings) {\n    const fields = seedFields(\n      source,\n      new RegExp(\n        `\\\\b(?:set|create)\\\\s*\\\\(\\\\s*${binding}\\\\s*,\\\\s*\\\\{`,\n      ),\n    )\n    if (fields) return fields\n  }\n  return null\n}\n\n/**\n * Whether the property access ending at `index` is being CALLED (AGL-1719).\n *\n * The guard reads `hosts/{hostId}` fields by scanning for `host.<name>` across\n * a whole directory, which means it matches on the identifier NAME and cannot\n * see the type. `media-ref.ts` has `isFirstPartyHost(host: string)` whose body\n * is `host.toLowerCase()` — a hostname string, not the host document — so\n * `toLowerCase` entered the field universe and the guard demanded that a\n * `String.prototype` method be classified as server-owned or client-writable.\n *\n * Dropping method calls removes that whole class rather than that one name,\n * and it is sound in the only direction that matters. Firestore document data\n * is JSON: string, number, boolean, null, array, map, timestamp, geopoint,\n * reference. **No field of a document can be callable**, so `binding.X(` is\n * provably never a field read and this can never introduce a false negative —\n * which is the single failure mode a coverage guard has (AGL-1420).\n *\n * A chained read is untouched: in `host.disabledPlugins.includes(x)` the\n * character after the captured name is `.`, so `disabledPlugins` is still\n * collected and only `includes` is dropped. Optional calls (`host.foo?.()`)\n * and generic ones (`host.foo<T>()`) are calls too.\n *\n * An exclusion list of known method names was rejected: it would silence the\n * symptom, need tending forever, and still say nothing about the next method\n * on the next same-named local.\n */\nfunction isMethodCallAt(source: string, index: number): boolean {\n  const rest = source.slice(index)\n  return /^\\s*(?:\\?\\.)?\\s*(?:<[^<>()]*>\\s*)?\\(/.test(rest)\n}\n\n/**\n * Top-level fields of `binding` that the modules in `sources` read.\n *\n * Directory-wide on purpose. A per-file list would be one more thing to keep\n * up to date, and a NEW resolver reading a NEW field is covered the moment it\n * is written — the only way this stays true without anyone tending it.\n *\n * The document is identified by IDENTIFIER NAME, not by type — this is a text\n * scan, and it has no way to know what a local called `host` actually holds.\n * So an unrelated binding of the same name contributes its property reads too.\n * That direction is safe (a spurious field fails loudly and gets classified by\n * a human, and can never HIDE a real one), and it is deliberately left alone,\n * because the filter that would suppress it is the filter that could suppress\n * a real read. See {@link isMethodCallAt} for the one case that is not safe to\n * leave — it produced a name no human could classify.\n */\nexport function readFieldsOf(\n  sources: Array<string>,\n  binding: string,\n): string[] {\n  const found = new Set<string>()\n  for (const raw of sources) {\n    const source = stripQuotedStrings(stripComments(raw))\n    // `host?.field` / `host.field` — the ordinary read.\n    for (const hit of source.matchAll(\n      new RegExp(`\\\\b${binding}\\\\s*\\\\??\\\\.\\\\s*([A-Za-z_$][A-Za-z0-9_$]*)`, 'g'),\n    )) {\n      // `host.toLowerCase()` is a method INVOCATION, not a field (AGL-1719).\n      if (isMethodCallAt(source, hit.index + hit[0].length)) continue\n      // A lone `$` is the head of a `${…}` interpolation, not a field: it\n      // comes from token-name construction like `` `{{host.${key}}}` ``.\n      // Template literals are left unstripped on purpose — a real read can\n      // live inside one — so this is the price, and a field named `$` cannot\n      // exist. Anything else, including `$id`, is kept and must be classified.\n      if (hit[1] !== '$') found.add(hit[1])\n    }\n    // `(host as { cname?: unknown })?.cname` — the cast a field that is real\n    // but was undeclared gets read through.\n    for (const hit of source.matchAll(\n      new RegExp(\n        `\\\\b${binding}\\\\s+as\\\\s*\\\\{\\\\s*([A-Za-z_$][A-Za-z0-9_$]*)\\\\s*\\\\??\\\\s*:`,\n        'g',\n      ),\n    )) {\n      found.add(hit[1])\n    }\n  }\n  return [...found].sort()\n}\n\n/**\n * Comments stripped from a TYPESCRIPT source, with string literals respected.\n *\n * `stripComments` above scans rules files, where no string ever contains a\n * comment delimiter. TypeScript sources are not that: `apps/console/app/api/\n * media/upload-url/route.ts` builds a download URL from a template literal\n * containing `https://`, and a scan that does not know it is inside a string\n * reads that `//` as a line comment and deletes the rest of the line. On a\n * guard that parses an object literal out of a route, that is not a crash —\n * it is a SHORTER field list, silently, which is the failure mode AGL-2004\n * described one level down.\n *\n * A separate function rather than a widened `stripComments`, because the two\n * inputs have genuinely different grammars and three shipped guards depend on\n * the rules-file behaviour exactly as it is. Same single left-to-right scan,\n * with quotes as a third state.\n */\nexport function stripTypeScriptComments(source: string): string {\n  let out = ''\n  let index = 0\n  while (index < source.length) {\n    const pair = source.slice(index, index + 2)\n    if (pair === '/*') {\n      const end = source.indexOf('*/', index + 2)\n      index = end < 0 ? source.length : end + 2\n      continue\n    }\n    if (pair === '//') {\n      const end = source.indexOf('\\n', index + 2)\n      if (end < 0) break\n      // Keep the newline so line-oriented reasoning downstream survives.\n      out += '\\n'\n      index = end + 1\n      continue\n    }\n    const character = source[index]\n    if (character === \"'\" || character === '\"' || character === '`') {\n      let cursor = index + 1\n      while (cursor < source.length && source[cursor] !== character) {\n        cursor += source[cursor] === '\\\\' ? 2 : 1\n      }\n      out += source.slice(index, Math.min(cursor + 1, source.length))\n      index = cursor + 1\n      continue\n    }\n    out += character\n    index += 1\n  }\n  return out\n}\n"],"names":["stripComments","source","out","index","length","pair","slice","end","indexOf","stripQuotedStrings","replace","normalizePathVariables","rules","topLevelBody","header","at","Error","depth","character","rawBlockBody","parseHostSubcollectionRules","rulesSource","host","catchAllHeader","occurrences","split","catchAll","listFor","operation","statement","find","entry","RegExp","test","list","match","matchAll","map","excluded","create","update","delete","dedicated","Set","serverOnly","filter","name","includes","splitTopLevelOr","expression","parts","current","push","part","trim","Boolean","hasAnyKeys","branch","allHasAnyKeys","flatMap","declaredFields","body","parseUpdateRule","matchHeader","clientPredicate","root","topLevelMatches","block","statements","updates","branches","found","denied","seedFields","anchor","search","text","open","seedFieldsOfCollection","collection","chained","bindings","binding","fields","isMethodCallAt","rest","readFieldsOf","sources","raw","hit","add","sort","stripTypeScriptComments","cursor","Math","min"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;CAgBC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;CAyBC,GACD,OAAO,SAASA,cAAcC,MAAc;IAC1C,IAAIC,MAAM;IACV,IAAIC,QAAQ;IACZ,MAAOA,QAAQF,OAAOG,MAAM,CAAE;QAC5B,MAAMC,OAAOJ,OAAOK,KAAK,CAACH,OAAOA,QAAQ;QACzC,IAAIE,SAAS,MAAM;YACjB,MAAME,MAAMN,OAAOO,OAAO,CAAC,MAAML,QAAQ;YACzCA,QAAQI,MAAM,IAAIN,OAAOG,MAAM,GAAGG,MAAM;YACxC;QACF;QACA,IAAIF,SAAS,MAAM;YACjB,MAAME,MAAMN,OAAOO,OAAO,CAAC,MAAML,QAAQ;YACzC,IAAII,MAAM,GAAG;YACb,mEAAmE;YACnEL,OAAO;YACPC,QAAQI,MAAM;YACd;QACF;QACAL,OAAOD,MAAM,CAACE,MAAM;QACpBA,SAAS;IACX;IACA,OAAOD;AACT;AAEA;;;;;;CAMC,GACD,OAAO,SAASO,mBAAmBR,MAAc;IAC/C,OAAOA,OACJS,OAAO,CAAC,wBAAwB,MAChCA,OAAO,CAAC,wBAAwB;AACrC;AAEA;;;;;CAKC,GACD,OAAO,SAASC,uBAAuBC,KAAa;IAClD,OAAOA,MAAMF,OAAO,CAAC,2CAA2C;AAClE;AAEA;;;;;;;CAOC,GACD,OAAO,SAASG,aAAaZ,MAAc,EAAEa,MAAc;IACzD,MAAMC,KAAKd,OAAOO,OAAO,CAACM;IAC1B,IAAIC,KAAK,GAAG,MAAM,IAAIC,MAAM,CAAC,yBAAyB,EAAEF,OAAO,SAAS,CAAC;IACzE,IAAIG,QAAQ;IACZ,IAAIf,MAAM;IACV,IAAK,IAAIC,QAAQY,KAAKD,OAAOV,MAAM,EAAED,QAAQF,OAAOG,MAAM,EAAED,SAAS,EAAG;QACtE,MAAMe,YAAYjB,MAAM,CAACE,MAAM;QAC/B,IAAIe,cAAc,KAAK;YACrBD,SAAS;YACT;QACF;QACA,IAAIC,cAAc,KAAK;YACrBD,SAAS;YACT,IAAIA,UAAU,GAAG,OAAOf;YACxB;QACF;QACA,IAAIe,UAAU,GAAGf,OAAOgB;IAC1B;IACA,MAAM,IAAIF,MAAM,CAAC,sBAAsB,EAAEF,OAAO,gBAAgB,CAAC;AACnE;AAEA;;;;;;;;;;CAUC,GACD,OAAO,SAASK,aAAalB,MAAc,EAAEa,MAAc;IACzD,MAAMC,KAAKd,OAAOO,OAAO,CAACM;IAC1B,IAAIC,KAAK,GAAG,MAAM,IAAIC,MAAM,CAAC,yBAAyB,EAAEF,OAAO,SAAS,CAAC;IACzE,IAAIG,QAAQ;IACZ,IAAIf,MAAM;IACV,IAAK,IAAIC,QAAQY,KAAKD,OAAOV,MAAM,EAAED,QAAQF,OAAOG,MAAM,EAAED,SAAS,EAAG;QACtE,MAAMe,YAAYjB,MAAM,CAACE,MAAM;QAC/B,IAAIe,cAAc,KAAKD,SAAS;aAC3B,IAAIC,cAAc,KAAK;YAC1BD,SAAS;YACT,IAAIA,UAAU,GAAG,OAAOf;QAC1B;QACAA,OAAOgB;IACT;IACA,MAAM,IAAIF,MAAM,CAAC,sBAAsB,EAAEF,OAAO,gBAAgB,CAAC;AACnE;AAYA;;;;;;;;;;;;;;CAcC,GACD,OAAO,SAASM,4BACdC,WAAmB;IAEnB,MAAMT,QAAQD,uBAAuBX,cAAcqB;IACnD,MAAMC,OAAOH,aAAaP,OAAO;IAEjC,MAAMW,iBAAiB;IACvB,MAAMC,cAAcF,KAAKG,KAAK,CAACF,gBAAgBnB,MAAM,GAAG;IACxD,IAAIoB,gBAAgB,GAAG;QACrB,MAAM,IAAIR,MACR,CAAC,uBAAuB,EAAEO,eAAe,gCAAgC,CAAC,GACxE,CAAC,MAAM,EAAEC,YAAY,8CAA8C,CAAC,GACpE,CAAC,kEAAkE,CAAC;IAE1E;IACA,MAAME,WAAWP,aAAaG,MAAMC;IAEpC,MAAMI,UAAU,CAACC;QACf,MAAMC,YAAYH,SACfD,KAAK,CAAC,KACNK,IAAI,CAAC,CAACC,QACL,IAAIC,OAAO,CAAC,mBAAmB,EAAEJ,UAAU,GAAG,CAAC,EAAEK,IAAI,CAACF;QAE1D,IAAI,CAACF,WAAW;YACd,MAAM,IAAIb,MACR,CAAC,aAAa,EAAEY,UAAU,6CAA6C,CAAC,GACtE,CAAC,oDAAoD,CAAC;QAE5D;QACA,MAAMM,OAAOL,UAAUM,KAAK,CAAC;QAC7B,IAAI,CAACD,MAAM;YACT,MAAM,IAAIlB,MACR,CAAC,6BAA6B,EAAEY,UAAU,UAAU,CAAC,GACnD,CAAC,iEAAiE,CAAC,GACnE,CAAC,kEAAkE,CAAC,GACpE,CAAC,iDAAiD,CAAC;QAEzD;QACA,OAAO;eAAIM,IAAI,CAAC,EAAE,CAACE,QAAQ,CAAC;SAAc,CAACC,GAAG,CAAC,CAACN,QAAUA,KAAK,CAAC,EAAE;IACpE;IAEA,MAAMO,WAAW;QACfC,QAAQZ,QAAQ;QAChBa,QAAQb,QAAQ;QAChBc,QAAQd,QAAQ;IAClB;IACA,uEAAuE;IACvE,uEAAuE;IACvE,iEAAiE;IACjE,iEAAiE;IACjE,MAAMe,YAAY;WACb,IAAIC,IACL;eAAIrB,KAAKc,QAAQ,CAAC;SAAuC,CAACC,GAAG,CAC3D,CAACN,QAAUA,KAAK,CAAC,EAAE;KAGxB;IACD,MAAMa,aAAaN,SAASC,MAAM,CAACM,MAAM,CACvC,CAACC,OACCR,SAASE,MAAM,CAACO,QAAQ,CAACD,SACzBR,SAASG,MAAM,CAACM,QAAQ,CAACD,SACzB,CAACJ,UAAUK,QAAQ,CAACD;IAExB,OAAO;QAAER;QAAUI;QAAWE;IAAW;AAC3C;AAEA;;;;;;;;;;CAUC,GACD,OAAO,SAASI,gBAAgBC,UAAkB;IAChD,MAAMC,QAAkB,EAAE;IAC1B,IAAIjC,QAAQ;IACZ,IAAIkC,UAAU;IACd,IAAK,IAAIhD,QAAQ,GAAGA,QAAQ8C,WAAW7C,MAAM,EAAED,SAAS,EAAG;QACzD,MAAMe,YAAY+B,UAAU,CAAC9C,MAAM;QACnC,IAAIe,cAAc,KAAKD,SAAS;QAChC,IAAIC,cAAc,KAAKD,SAAS;QAChC,IAAIA,UAAU,KAAKC,cAAc,OAAO+B,UAAU,CAAC9C,QAAQ,EAAE,KAAK,KAAK;YACrE+C,MAAME,IAAI,CAACD;YACXA,UAAU;YACVhD,SAAS;YACT;QACF;QACAgD,WAAWjC;IACb;IACAgC,MAAME,IAAI,CAACD;IACX,OAAOD,MAAMb,GAAG,CAAC,CAACgB,OAASA,KAAKC,IAAI,IAAIT,MAAM,CAACU;AACjD;AAEA,qEAAqE,GACrE,OAAO,SAASC,WAAWC,MAAc;IACvC,MAAMvB,OAAOuB,OAAOtB,KAAK,CAAC;IAC1B,IAAI,CAACD,MAAM,OAAO,EAAE;IACpB,OAAO;WAAIA,IAAI,CAAC,EAAE,CAACE,QAAQ,CAAC;KAAc,CAACC,GAAG,CAAC,CAACN,QAAUA,KAAK,CAAC,EAAE;AACpE;AAEA;;;;;;;;CAQC,GACD,OAAO,SAAS2B,cAAcD,MAAc;IAC1C,OAAO;WAAIA,OAAOrB,QAAQ,CAAC;KAA4B,CAACuB,OAAO,CAAC,CAACzB,OAC/D;eAAIA,IAAI,CAAC,EAAE,CAACE,QAAQ,CAAC;SAAc,CAACC,GAAG,CAAC,CAACN,QAAUA,KAAK,CAAC,EAAE;AAE/D;AAEA;;;;;;CAMC,GACD,OAAO,SAAS6B,eAAe3D,MAAc,EAAEa,MAAc;IAC3D,MAAM+C,OAAOhD,aAAab,cAAcC,SAASa;IACjD,OAAO;WACF+C,KAAKzB,QAAQ,CAAC;KAClB,CAACC,GAAG,CAAC,CAACN,QAAUA,KAAK,CAAC,EAAE;AAC3B;AAcA;;;;;;;CAOC,GACD,OAAO,SAAS+B,gBACdzC,WAAmB,EACnB0C,WAAmB,EACnBC,eAAuB;IAEvB,MAAMpD,QAAQD,uBAAuBX,cAAcqB;IACnD,MAAM4C,OAAOpD,aAAaD,OAAO;IACjC,MAAMsD,kBAAkB;WAAID,KAAK7B,QAAQ,CAAC;KAAoB,CAACC,GAAG,CAChE,CAACN,QAAUA,KAAK,CAAC,EAAE;IAGrB,MAAMoC,QAAQtD,aAAaD,OAAOmD;IAClC,MAAMK,aAAaD,MAChB1C,KAAK,CAAC,KACNY,GAAG,CAAC,CAACR,YAAcA,UAAUyB,IAAI,IACjCT,MAAM,CAACU;IAEV,wEAAwE;IACxE,yEAAyE;IACzE,0EAA0E;IAC1E,yDAAyD;IACzD,MAAMc,UAAUD,WAAWvB,MAAM,CAAC,CAAChB,YACjC,2BAA2BI,IAAI,CAACJ;IAElC,IAAIwC,QAAQjE,MAAM,KAAK,GAAG;QACxB,MAAM,IAAIY,MACR,CAAC,wDAAwD,CAAC,GACxD,GAAG+C,YAAY,QAAQ,EAAEM,QAAQjE,MAAM,CAAC,6BAA6B,CAAC,GACtE,CAAC,kEAAkE,CAAC,GACpE,CAAC,gEAAgE,CAAC,GAClE,CAAC,kCAAkC,CAAC;IAE1C;IAEA,2EAA2E;IAC3E,gEAAgE;IAChE,wEAAwE;IACxE,0EAA0E;IAC1E,uEAAuE;IACvE,4EAA4E;IAC5E,MAAMyB,YAAYwC,OAAO,CAAC,EAAE,CAAC/D,KAAK,CAAC+D,OAAO,CAAC,EAAE,CAAC7D,OAAO,CAAC;IACtD,MAAM8D,WAAWtB,gBAAgBnB;IACjC,MAAM0C,QAAQD,SAASzB,MAAM,CAAC,CAACY,SAAWA,OAAOV,QAAQ,CAACiB;IAC1D,IAAIO,MAAMnE,MAAM,KAAK,GAAG;QACtB,MAAM,IAAIY,MACR,CAAC,wDAAwD,CAAC,GACxD,GAAGgD,gBAAgB,OAAO,EAAED,YAAY,QAAQ,EAAEQ,MAAMnE,MAAM,CAAC,MAAM,CAAC,GACtE,CAAC,kEAAkE,CAAC;IAE1E;IAEA,OAAO;QACLoE,QAAQd,cAAca,KAAK,CAAC,EAAE;QAC9BD;QACAF;QACAF;IACF;AACF;AAEA;;;;;;;;CAQC,GACD,OAAO,SAASO,WAAWxE,MAAc,EAAEyE,MAAc;IACvD,MAAM3D,KAAKf,cAAcC,QAAQ0E,MAAM,CAACD;IACxC,IAAI3D,KAAK,GAAG,OAAO;IACnB,MAAM6D,OAAO5E,cAAcC;IAC3B,MAAM4E,OAAOD,KAAKpE,OAAO,CAAC,KAAKO;IAC/B,IAAI8D,OAAO,GAAG,OAAO;IACrB,IAAI5D,QAAQ;IACZ,IAAI4C,OAAO;IACX,IAAK,IAAI1D,QAAQ0E,OAAO,GAAG1E,QAAQyE,KAAKxE,MAAM,EAAED,SAAS,EAAG;QAC1D,MAAMe,YAAY0D,IAAI,CAACzE,MAAM;QAC7B,IAAIe,cAAc,KAAKD,SAAS;aAC3B,IAAIC,cAAc,KAAK;YAC1BD,SAAS;YACT,IAAIA,UAAU,GAAG;QACnB;QACA,IAAIA,UAAU,GAAG4C,QAAQ3C;IAC3B;IACA,OAAO;WACF2C,KAAKzB,QAAQ,CAAC;KAClB,CAACC,GAAG,CAAC,CAACN,QAAUA,KAAK,CAAC,EAAE;AAC3B;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;CAyBC,GACD,OAAO,SAAS+C,uBACd7E,MAAc,EACd8E,UAAkB;IAElB,MAAMjC,OAAOiC,WAAWrE,OAAO,CAAC,uBAAuB;IACvD,MAAMsE,UAAUP,WACdxE,QACA,IAAI+B,OACF,CAAC,cAAc,EAAEc,KAAK,yDAAyD,CAAC;IAGpF,IAAIkC,SAAS,OAAOA;IAEpB,MAAMJ,OAAO5E,cAAcC;IAC3B,MAAMgF,WAAW;WACZL,KAAKxC,QAAQ,CACd,IAAIJ,OACF,CAAC,8EAA8E,EAAEc,KAAK,iBAAiB,CAAC,EACxG;KAGL,CAACT,GAAG,CAAC,CAACN,QAAUA,KAAK,CAAC,EAAE;IAEzB,KAAK,MAAMmD,WAAWD,SAAU;QAC9B,MAAME,SAASV,WACbxE,QACA,IAAI+B,OACF,CAAC,4BAA4B,EAAEkD,QAAQ,YAAY,CAAC;QAGxD,IAAIC,QAAQ,OAAOA;IACrB;IACA,OAAO;AACT;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;CAyBC,GACD,SAASC,eAAenF,MAAc,EAAEE,KAAa;IACnD,MAAMkF,OAAOpF,OAAOK,KAAK,CAACH;IAC1B,OAAO,uCAAuC8B,IAAI,CAACoD;AACrD;AAEA;;;;;;;;;;;;;;;CAeC,GACD,OAAO,SAASC,aACdC,OAAsB,EACtBL,OAAe;IAEf,MAAMX,QAAQ,IAAI5B;IAClB,KAAK,MAAM6C,OAAOD,QAAS;QACzB,MAAMtF,SAASQ,mBAAmBT,cAAcwF;QAChD,oDAAoD;QACpD,KAAK,MAAMC,OAAOxF,OAAOmC,QAAQ,CAC/B,IAAIJ,OAAO,CAAC,GAAG,EAAEkD,QAAQ,yCAAyC,CAAC,EAAE,MACpE;YACD,uEAAuE;YACvE,IAAIE,eAAenF,QAAQwF,IAAItF,KAAK,GAAGsF,GAAG,CAAC,EAAE,CAACrF,MAAM,GAAG;YACvD,oEAAoE;YACpE,mEAAmE;YACnE,qEAAqE;YACrE,uEAAuE;YACvE,yEAAyE;YACzE,IAAIqF,GAAG,CAAC,EAAE,KAAK,KAAKlB,MAAMmB,GAAG,CAACD,GAAG,CAAC,EAAE;QACtC;QACA,yEAAyE;QACzE,wCAAwC;QACxC,KAAK,MAAMA,OAAOxF,OAAOmC,QAAQ,CAC/B,IAAIJ,OACF,CAAC,GAAG,EAAEkD,QAAQ,wDAAwD,CAAC,EACvE,MAED;YACDX,MAAMmB,GAAG,CAACD,GAAG,CAAC,EAAE;QAClB;IACF;IACA,OAAO;WAAIlB;KAAM,CAACoB,IAAI;AACxB;AAEA;;;;;;;;;;;;;;;;CAgBC,GACD,OAAO,SAASC,wBAAwB3F,MAAc;IACpD,IAAIC,MAAM;IACV,IAAIC,QAAQ;IACZ,MAAOA,QAAQF,OAAOG,MAAM,CAAE;QAC5B,MAAMC,OAAOJ,OAAOK,KAAK,CAACH,OAAOA,QAAQ;QACzC,IAAIE,SAAS,MAAM;YACjB,MAAME,MAAMN,OAAOO,OAAO,CAAC,MAAML,QAAQ;YACzCA,QAAQI,MAAM,IAAIN,OAAOG,MAAM,GAAGG,MAAM;YACxC;QACF;QACA,IAAIF,SAAS,MAAM;YACjB,MAAME,MAAMN,OAAOO,OAAO,CAAC,MAAML,QAAQ;YACzC,IAAII,MAAM,GAAG;YACb,mEAAmE;YACnEL,OAAO;YACPC,QAAQI,MAAM;YACd;QACF;QACA,MAAMW,YAAYjB,MAAM,CAACE,MAAM;QAC/B,IAAIe,cAAc,OAAOA,cAAc,OAAOA,cAAc,KAAK;YAC/D,IAAI2E,SAAS1F,QAAQ;YACrB,MAAO0F,SAAS5F,OAAOG,MAAM,IAAIH,MAAM,CAAC4F,OAAO,KAAK3E,UAAW;gBAC7D2E,UAAU5F,MAAM,CAAC4F,OAAO,KAAK,OAAO,IAAI;YAC1C;YACA3F,OAAOD,OAAOK,KAAK,CAACH,OAAO2F,KAAKC,GAAG,CAACF,SAAS,GAAG5F,OAAOG,MAAM;YAC7DD,QAAQ0F,SAAS;YACjB;QACF;QACA3F,OAAOgB;QACPf,SAAS;IACX;IACA,OAAOD;AACT"}

package/src/lib/foundation/index.d.ts

@@ -0,0 +1,32 @@
+/**
+ * @license
+ * Copyright 2022 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+export * from './definitions/components.types';
+export * from './definitions/contact.types';
+export * from './definitions/host-content-collections';
+export * from './definitions/organization.types';
+export * from './definitions/property-kinds';
+export * from './definitions/shared';
+export { HOST_ERROR_SCREEN_SLOTS, HOST_UNPERSISTED_FIELDS, HostEntityType, HostRedirectParams, HostScreenStatus, HostScreenVisibility, HostViewFormat, HostViewType, } from './definitions/platform.types';
+export { ORG_CLIENT_WRITABLE_FIELDS, ORG_UNPERSISTED_FIELDS, } from './definitions/org-billing.types';
+export type { AglynOrgBilling, CoreOrgEntitlements, CoreOrgFeatureFlags, OrgBandwidthCap, OrgBrandingProfile, OrgCrmAssignmentRule, OrgCrmHostSettings, OrgCrmInbound, OrgCrmRoundRobin, OrgCrmSettings, OrgDiscount, OrgEntitlements, OrgFeatureFlags, OrgPlan, OrgPlanComp, OrgSeatAddons, OrgSubscription, OrgUid, } from './definitions/org-billing.types';
+export type { AglynDocument, AglynHost, AglynHostComponent, AglynHostComponentVersion, AglynHostMedia, AglynHostMediaFolder, AglynHostTheme, AglynLayout, AglynRedirect, AglynScreen, AglynTemplate, AglynUser, ComponentDefUid, HostAnnouncementBar, HostErrorScreens, HostErrorScreenSlot, HostPopup, HostMediaUid, HostPath, HostUid, LayoutUid, LegacyNamedFieldKind, NonValueFieldKind, ProjectNumber, ProjectUid, PublishSchedule, RedirectUid, ReusableComponentIcon, ReusableComponentProp, ReusableComponentPropCondition, ReusableComponentPropOption, ReusableComponentPropRule, ReusableComponentPropType, ReusableComponentPropValue, ScopeToken, ScreenSlug, ScreenUid, TemplateKind, TemplatePlaceholder, TemplateSource, TemplateUid, UserUid, VersionUid, } from './definitions/platform.types';
+export * from './constants/_internal';
+export * from './constants/app';
+export * from './constants/canvas';
+export * from './constants/components';
+export * from './constants/shared';
+export * from './constants/symbol';