@jwilleke/ngdpbase-types 5.42.0 → 5.44.0

package/lib/src/managers/PolicyEvaluator.d.ts

@@ -1,6 +1,8 @@
 import BaseManager from './BaseManager.js';
-import type { Policy, PolicySubject, PolicyResource } from '../types/Policy.js';
+import type { Policy, PolicySubject, PolicyResource, PolicyCondition } from '../types/Policy.js';
+import { type DeclaredEnvironmentAttribute, type DeclaredSubjectAttribute } from '../utils/policyAttributes.js';
 import { WikiEngine } from '../types/WikiEngine.js';
+import type { ActorContext } from '../context/ActorContext.js';
 /**
  * User context for policy evaluation
  */
@@ -17,15 +19,61 @@ interface UserContext {
  * PIP (#1504): today a page's `system-category`.
  */
 export type ResourceAttributes = Record<string, unknown>;
+/**
+ * Reads one attribute a condition names, `subject:id` or `resource:owner`
+ * (#2255). Supplied by the PDP from the PIP; `undefined` or `null` is a
+ * missing attribute. Asked only when a matching policy has a condition. A
+ * reader may be async (an identity is resolved through IdentityManager), and
+ * the evaluator awaits every read.
+ */
+export type AttributeReader = (name: string) => unknown | Promise<unknown>;
 /**
  * Access evaluation context
  */
 interface AccessContext {
     pageName: string;
+    /**
+     * The action asked. `actions` widens it: a policy granting any of them
+     * matches (#2255: a page write is `page-edit` or `pushed-pages-edit`).
+     */
     action: string;
+    actions?: readonly string[];
     userContext?: UserContext;
     attributes?: ResourceAttributes;
+    /** For a policy's `condition`; without one every condition is unknown. */
+    readAttribute?: AttributeReader;
 }
+/**
+ * What is wrong with a policy's condition, one sentence each (#2255, #2261,
+ * #2330); empty when it is fine. Each sentence says what is wrong, then what to
+ * change. A node is one XACML function in lowercase: a comparison such as
+ * `string-equal` over two arguments, or `and`, `or` or `not` over other
+ * conditions, nested at most {@link MAX_CONDITION_DEPTH} deep, at most
+ * {@link MAX_CONDITION_NODES} function nodes in all, an `is-in` list of at most
+ * {@link MAX_IN_ITEMS} and an `and` or `or` of at most {@link MAX_GROUP_CHILDREN}.
+ * An argument is an attribute (`attributeid`, `datatype`) or a literal (`value`,
+ * `datatype`); `datatype` is required, must be the type the attribute is declared with
+ * and the type the function takes. Each attribute must be declared: a
+ * `subject:<name>` in `ngdpbase.access.subject-attributes` (`id` always, `aal`
+ * as shipped), or a `resource:<name>` declared on the resource type the policy names (the
+ * `page` type when it names a page, or that add-on's type when it names only
+ * that type, #1823), or an `environment:<name>` in `ngdpbase.access.environment-attributes`. The old
+ * shape (`attribute` with `equals` and the like) is a problem that shows the
+ * new one. A condition with a problem never holds: an allow with it does not
+ * apply and a deny with it does, as for a missing attribute.
+ */
+export declare function conditionProblems(condition: unknown, pageAttributes: Record<string, {
+    type?: string;
+}>, subjectAttributes?: Record<string, DeclaredSubjectAttribute>, environmentAttributes?: Record<string, DeclaredEnvironmentAttribute>, resourceTypeLabel?: string): string[];
+/**
+ * Is the condition true, false or unknown (#2255, #2261)? `true` or `false`,
+ * or `undefined` when it cannot be told because an attribute it reads is
+ * missing, or an argument lacks the datatype its function takes; the caller
+ * fails closed on that. Each node is judged on its own: a missing attribute
+ * makes its comparison unknown, a true branch decides `or`, a false branch
+ * decides `and`, and `not` of unknown is unknown.
+ */
+export declare function conditionHolds(condition: PolicyCondition | undefined, read: AttributeReader | undefined, depth?: number): Promise<boolean | undefined>;
 /**
  * How each policy resource type matches (#1504). The TYPES are declared in
  * configuration, `ngdpbase.access.resource-types`, and read through
@@ -40,7 +88,31 @@ export declare const RESOURCE_MATCHERS: Record<string, (pattern: string, pageNam
  * PolicyValidator accepts: a type with no matcher here would be a policy that
  * grants nothing.
  */
-export declare const SUBJECT_MATCHERS: Record<string, (value: string, userContext: UserContext | undefined) => boolean>;
+export declare const SUBJECT_MATCHERS: Record<string, (value: string | undefined, userContext: UserContext | undefined) => boolean>;
+/**
+ * The subject types that take no `value` (#2261), for the validator. A value
+ * on one is refused rather than ignored.
+ */
+export declare const VALUELESS_SUBJECT_TYPES: readonly string[];
+/**
+ * Which resource attributes a policy's condition may read (#1823).
+ *
+ * A policy that names exactly one add-on type (no page matcher) uses that
+ * type's attributes. A policy on a core type, including `system-category`,
+ * still reads the `page` attributes: those conditions are about the page.
+ */
+export declare function conditionAttributeSource(resources: readonly {
+    type?: string;
+}[] | undefined, types: Record<string, {
+    attributes?: Record<string, {
+        type?: string;
+    }>;
+}> | null): {
+    attributes: Record<string, {
+        type?: string;
+    }>;
+    label: string;
+};
 /**
  * The resource types configuration declares (#1504), for the evaluator and the
  * validator alike. When the key is not set at all — a configuration older than
@@ -56,14 +128,19 @@ interface EvaluationResult {
     allowed: boolean;
     reason: string;
     policyName: string | null;
+    /** The deciding policies' ids (#2255): the denies that matched, else the allows. Empty when none matched. */
+    policyIds: string[];
+    /** Allows that matched subject, resource and action but whose condition was false or unknown (#2288). Absent when none. */
+    conditionNotMet?: string[];
 }
 /**
  * PolicyEvaluator - Evaluates access policies against a given context.
  *
  * PolicyEvaluator mimics how JSPWiki uses Java's built-in security framework
  * (java.security) to load and evaluate security policies from a policy file.
- * It evaluates policies in priority order and returns the first matching policy's
- * decision.
+ * Among the policies that match, a deny overrides any allow, the
+ * rule-combining algorithm `deny-overrides` (#2330), and no match is a deny (#2255). Each decision names the policies
+ * that decided it.
  *
  * @class PolicyEvaluator
  * @extends BaseManager
@@ -85,6 +162,17 @@ interface EvaluationResult {
  */
 declare class PolicyEvaluator extends BaseManager {
     private configManager;
+    /** The headline of the access-policies item now up, so marking the last deny takes down this one and no other (#2355). */
+    private reportedReason;
+    /**
+     * Each condition checked and compiled, by the condition object configuration
+     * holds (#2279), kept while `ConfigurationManager.getRevision()` is
+     * `revision`. Any change to the configuration (a save, a reload, a reset, a
+     * restore, an add-on's runtime value) changes the revision, and the next
+     * decision starts again from nothing. The policies themselves are still read
+     * live for every decision; only a condition's compiled form is reused.
+     */
+    private preparedConditions;
     /**
      * The policies in force NOW. Only the PDP interprets them (#1431 step 14b);
      * this evaluator is the PDP's matching engine and asks it for the list, read
@@ -112,24 +200,73 @@ declare class PolicyEvaluator extends BaseManager {
      */
     initialize(): Promise<void>;
     /**
-     * Evaluates all relevant policies to make an access decision.
-     *
-     * Policies are evaluated in priority order (highest first). The first matching
-     * policy determines the access decision. If no policies match, access is denied.
-     *
-     * @async
-     * @param {AccessContext} context - The context of the access request
-     * @returns {Promise<EvaluationResult>} Evaluation result with decision and reason
+     * Say at boot what a developer should look at in the policies after #2255,
+     * one warning each: stored policies the upgrade rewrote, policies it left
+     * that now decide differently (a deny) or reach pushed pages, and conditions
+     * that never hold. These are log lines only; categories no policy lets anyone
+     * change are an upgrade check (`upgradeChecks/uneditablePages.ts`).
+     */
+    private reportPageWritePolicies;
+    /** The stored marks whose rule is still a deny in force (#2355). A mark for a rule since removed is not kept: the same rule added later must be shown again. */
+    private marksOfExistingDenies;
+    /** Save the marks without those of rules that are gone (#2355); nothing is written when none is. */
+    private dropMarksOfGoneRules;
+    /**
+     * An administrator marks a deny as checked (#2355). Kept as the rule's id and a fingerprint of
+     * its content in `ngdpbase.access.checked-denies`, written through ConfigurationManager with the
+     * person's context, which records the change. It hides the item and nothing else: no decision
+     * reads it. Answers `changed` when the rule is no longer what the page showed (nothing is
+     * saved) and `missing` when no deny has that id.
+     */
+    markDenyChecked(ctx: ActorContext, id: string, fingerprint: string): Promise<'checked' | 'changed' | 'missing'>;
+    /**
+     * Evaluates all relevant policies to make an access decision (#2255).
      *
-     * @example
-     * const result = await evaluator.evaluateAccess({
-     *   pageName: 'AdminPanel',
-     *   action: 'page:edit',
-     *   userContext: { username: 'user', roles: ['editor'] }
-     * });
-     * console.log('Allowed:', result.allowed, 'Reason:', result.reason);
+     * Deny overrides allow (the rule-combining algorithm, #2330): if any matching
+     * deny applies, the answer is deny; otherwise any matching allow permits;
+     * otherwise no policy decided. A policy with a `condition` applies only when it holds;
+     * an unknown condition (a missing attribute) keeps an allow from applying
+     * and lets a deny apply, so a missing attribute fails closed.
      */
     evaluateAccess(context: AccessContext): Promise<EvaluationResult>;
+    /**
+     * The policies with their conditions checked and compiled (#2279): a
+     * condition already compiled under the configuration in force is reused,
+     * and `prepare` runs only for the rest. With no configuration revision to
+     * key on, everything is prepared again.
+     */
+    private prepared;
+    /**
+     * Checks and compiles each policy's condition (#2261). `prepared()` keeps
+     * the result until the configuration changes (#2279).
+     */
+    private prepare;
+    /**
+     * Decide one add-on record type by id (#1823).
+     *
+     * Only policies that name this type are considered, and a policy with no
+     * resources does not match: a page grant cannot cover the type, and a
+     * blanket policy cannot either. The id is matched with the same globs as a
+     * page name, a leading dot included. A core type (`page`, `system-category`, `vault`,
+     * `shared-folder`) is not decided here.
+     */
+    evaluateDeclaredResource(context: {
+        resourceType: string;
+        id: string;
+        action: string;
+        actions?: readonly string[];
+        userContext?: UserContext;
+        readAttribute?: AttributeReader;
+    }): Promise<EvaluationResult>;
+    /** True when a policy resource names this type and its pattern covers the id. No resources is not a match. */
+    private namesDeclaredType;
+    private resourceTypeMap;
+    /**
+     * Deny overrides allow, over policies that already match subject, resource
+     * and action (#2255). Every matching deny whose condition is true or
+     * unknown decides; failing that, every allow whose condition is true.
+     */
+    private combine;
     /**
      * Checks if a single policy matches the given context.
      *
@@ -189,12 +326,33 @@ declare class PolicyEvaluator extends BaseManager {
      * `filter` shape, compiled once and applied to many resources.
      *
      * Policies that cannot match this subject or this action are dropped here,
-     * once; the predicate matches resources only, in the same order as
-     * `evaluateAccess` so first-match-wins gives the same answer. No log line
-     * per call: a listing asks this ~18k times, and the per-policy INFO line
-     * `evaluateAccess` writes is right for one decision and wrong for a filter.
+     * once; the predicate matches resources only and combines them exactly as
+     * `evaluateAccess` does (deny overrides allow, #2255), so a list and a
+     * single decision agree. No log line per call: a listing asks this ~18k
+     * times, and the INFO line `evaluateAccess` writes is right for one
+     * decision and wrong for a filter.
+     */
+    compile(userContext: UserContext | undefined, action: string, actions?: readonly string[]): (pageName: string, attributes?: ResourceAttributes, readAttribute?: AttributeReader) => Promise<EvaluationResult>;
+    /** The attributes declared on the `page` resource type (#2255), for checking a condition. */
+    declaredPageAttributes(): Record<string, {
+        type?: string;
+    }>;
+    /** The subject attributes a condition may read (#2261): `id` always, and those declared in `ngdpbase.access.subject-attributes`. */
+    declaredSubjectAttributes(): Record<string, DeclaredSubjectAttribute>;
+    /** The environment attributes a condition may read (#2261): those declared in `ngdpbase.access.environment-attributes`. */
+    declaredEnvironmentAttributes(): Record<string, DeclaredEnvironmentAttribute>;
+    /**
+     * One line for each declared `schedule:` attribute whose schedule is not in
+     * `ngdpbase.schedules` (the attribute is missing and a condition on it fails
+     * closed) or has no rules (it reads as always open), for the boot warning.
      */
-    compile(userContext: UserContext | undefined, action: string): (pageName: string, attributes?: ResourceAttributes) => EvaluationResult;
+    private scheduleProblems;
+    /** Each policy in force whose condition has a problem, with the problems (#2255): for the boot warning. */
+    conditionProblemsInForce(): Array<{
+        id: string;
+        effect: Policy['effect'];
+        problems: string[];
+    }>;
     matchesResource(resources: PolicyResource[] | undefined, pageName: string, attributes?: ResourceAttributes): boolean;
     /**
      * Checks if the action matches the policy's actions.

package/lib/src/managers/ShareManager.d.ts

@@ -219,8 +219,9 @@ export default class ShareManager extends BaseManager {
      * True when a page must never appear in any share:
      *   - `private: true` (decision 1)
      *   - `owner-only` in user-keywords (decision 1)
-     *   - `audience` or per-action `access` frontmatter (decision 3 — a share
-     *     must not silently widen an author's chosen audience)
+     *   - `audience` frontmatter (decision 3 — a share must not silently widen
+     *     an author's chosen audience). A page's `access` field is not read
+     *     since #2255.
      */
     private isPageExcluded;
     /** Prepare and lock everything a link to an encrypted vault covers. `ownerCtx` must hold the vault's key. */

package/lib/src/managers/ThemeManager.d.ts

@@ -5,6 +5,12 @@ export interface ThemeInfo {
     author: string;
     /** Optional Google Fonts (or other) stylesheet URLs to inject in <head> */
     fonts?: string[];
+    /**
+     * Optional CSS filenames in this theme's css/ directory. Loaded after
+     * core.css so a site theme can adjust layout without editing the shared
+     * sheet. Basenames only; paths are rejected.
+     */
+    stylesheets?: string[];
 }
 export interface ThemePaths {
     /** Active theme name (folder name under themes/) */
@@ -23,6 +29,8 @@ export interface ThemePaths {
     themeInfo: ThemeInfo | null;
     /** Optional font stylesheet URLs from theme.json fonts[] */
     fontUrls: string[];
+    /** Theme CSS files to load after core.css. Public URLs. */
+    themeStylesheets: string[];
 }
 /**
  * Returns a cached ThemeManager for the given active theme + themes directory.
@@ -44,11 +52,22 @@ export declare class ThemeManager {
     constructor(activeTheme: string, themesDir: string);
     private loadThemeInfo;
     private buildPaths;
+    /**
+     * Publish theme.json stylesheets[] as /themes/<theme>/css/<file>.
+     * Only a basename ending in .css that exists in that directory is kept,
+     * so a theme cannot point the browser at another path.
+     */
+    private resolveThemeStylesheets;
     /** Resolve variables.css path — falls back to empty placeholder if theme has no custom vars */
     private resolveVariablesCssPath;
     /** Resolve favicon path: prefer favicon.svg → favicon.png → public fallback */
     private resolveFaviconPath;
-    /** Resolve logo path: prefer logo.svg → logo.png → favicon.svg → favicon.png → public fallback */
+    /**
+     * Resolve the header logo path: prefer logo-header.svg → logo-header.png →
+     * logo.svg → logo.png → favicon.svg → favicon.png → public fallback.
+     * logo-header.* lets a theme show a different copy in the header than the
+     * logo.* file that pages may link to.
+     */
     private resolveLogoPath;
     get paths(): ThemePaths;
     /** List all available themes (subdirs of themes/ that have a theme.json) */

package/lib/src/managers/UserManager.d.ts

@@ -19,6 +19,12 @@ export interface AgentTokenGrant {
     id: string;
     name: string;
     scopes: string[];
+    /**
+     * The assurance level stored with the token when it was made (#2261): the
+     * level of the minting session at that moment, never higher. Absent on a
+     * token made before it was stored, which then has no `subject:aal`.
+     */
+    aal?: 1 | 2 | 3;
 }
 /**
  * A person acting for another under a proxy grant (#1762 slice 2), as a
@@ -112,6 +118,12 @@ export interface PermissionSubject {
      * account's cap, since it is the actor who signs in (#1762).
      */
     aalCap?: import('../providers/BaseAuthProvider.js').Aal;
+    /**
+     * Set by the bearer middleware on a subject authenticated by a JWT that
+     * records no sign-in level (Authentik, #2287): its `subject:aal` is missing,
+     * not AAL 1. Set from the verified result, never from a request field.
+     */
+    bearerWithoutLevel?: true;
 }
 /**
  * The subject of work with no request behind it (#631, #1212).
@@ -134,6 +146,8 @@ export interface JobSubject {
     viaProxy?: ProxyClaim;
     /** #1999: the scheduled job a run acts as (`JobContext.job`). */
     job?: string;
+    /** #2261: the level stored with the job's request (`JobContext.aal`); absent when it stored none. */
+    grantedAal?: 1 | 2 | 3;
 }
 /**
  * User creation input data
@@ -426,11 +440,11 @@ declare class UserManager extends BaseManager {
     /**
      * Create a user page for a new user.
      *
-     * The page is written AS the new user (#1462): it is their page, and the
-     * door takes a new page's author from who is acting. Written as the admin
-     * who created the account — or as whoever ran self-registration — the
-     * profile would be authored by them, and `author-lock` would leave the
-     * account's own owner unable to edit it.
+     * The page is the new user's (#1462): they are its author. Authored by the
+     * admin who created the account — or by whoever ran self-registration —
+     * `author-lock` would leave the account's own owner unable to edit it.
+     * It is written by a system job through the write door (#1815), with the
+     * new user named as the one it is made for.
      *
      * @param {User} user - User object
      * @param ctx - Who created the account, for the log line only

package/lib/src/managers/ValidationManager.d.ts

@@ -48,8 +48,10 @@ export declare const DEFAULT_SHARE_MAX_DAYS = 15;
  * - `public`: a `storageLocation` without a vault; its pages can never be
  *   private.
  * - `vault`: a `storageLocation.privatestore`; its pages may be private.
+ * - `shared-folder`: `storageLocation.sharedfolder: true` (#2255); its pages
+ *   live in shared folders (the `shared` category).
  */
-export type CategoryStored = 'none' | 'public' | 'vault';
+export type CategoryStored = 'none' | 'public' | 'vault' | 'shared-folder';
 /**
  * Where an entry's pages are stored. The one rule every reader of "is this
  * system-category stored here, and can it be private" goes through. A

package/lib/src/providers/AgentTokenAuthProvider.js

@@ -39,7 +39,7 @@ export class AgentTokenAuthProvider {
             return null;
         return {
             username: record.owner,
-            viaToken: { id: record.id, name: record.name, scopes: record.scopes }
+            viaToken: { id: record.id, name: record.name, scopes: record.scopes, ...(record.aal ? { aal: record.aal } : {}) }
         };
     }
 }

package/lib/src/providers/BaseAuthProvider.d.ts

@@ -74,6 +74,8 @@ export interface ViaToken {
     name: string;
     /** Scope ceiling this token may act within */
     scopes: string[];
+    /** The assurance level stored with the token when it was made (#2261); absent on an older token. */
+    aal?: 1 | 2 | 3;
 }
 /**
  * Returned by verify() on success.

package/lib/src/providers/FileLoggingProvider.d.ts

@@ -21,6 +21,15 @@ declare class FileLoggingProvider extends BaseLoggingProvider {
      */
     createTransports(config: LoggingProviderConfig): Transport[];
     createFormat(): Logform.Format;
+    /** CR and LF as the visible two-character sequences `\r` and `\n`, so a value cannot start a line of its own (#2294). */
+    private static oneLine;
+    /**
+     * A stack keeps one frame per line, but its message portion (`Name: message`, which can span lines and can
+     * hold a caller-sent value) must not start a log line of its own (#2294). Only a line that begins with
+     * optional whitespace and `at ` starts a new output line; every other line is joined to the one before it
+     * with a visible `\n`.
+     */
+    private static stackLines;
     /**
      * Render whatever a caller passed as the second argument to `logger.*`.
      *
@@ -30,7 +39,9 @@ declare class FileLoggingProvider extends BaseLoggingProvider {
      * line would be noise at best.
      *
      * A `stack` is emitted on its own lines because a one-line stack is
-     * unreadable, and reading the stack is the entire reason this exists.
+     * unreadable, and reading the stack is the entire reason this exists. Its
+     * frames keep their own lines; CR and LF in its message portion are escaped,
+     * as are those in the other keys and their string values.
      *
      * @param info - The winston info object for one log record
      * @returns The rendered metadata, or an empty string when there is none

package/lib/src/providers/FileLoggingProvider.js

@@ -45,7 +45,17 @@ class FileLoggingProvider extends BaseLoggingProvider {
         // #1461: private page titles never reach a log line or /admin/logs.
         redactPrivateNamesFormat(), format.printf((info) => {
             const ts = typeof info.timestamp === 'string' ? info.timestamp : JSON.stringify(info.timestamp);
-            const msg = typeof info.message === 'string' ? info.message : JSON.stringify(info.message);
+            // #2294: a caller-sent value (a page name) in the message could carry a CR or LF and start a log line of
+            // its own. Escaped here, once, for every transport and every call site; the escape is visible, not removed.
+            // Never throws: a logger that throws breaks its caller. Any non-string message (undefined, symbol, function,
+            // a circular object) is coerced with String(), and a formatting error falls back to a fixed marker.
+            let msg;
+            try {
+                msg = FileLoggingProvider.oneLine(typeof info.message === 'string' ? info.message : String(info.message));
+            }
+            catch {
+                msg = '[unprintable log message]';
+            }
             // #1141: render the metadata too. This printf used to emit only
             // timestamp/level/message, so the second argument of every
             // `logger.error(msg, { error, stack })` call in the codebase was
@@ -57,6 +67,27 @@ class FileLoggingProvider extends BaseLoggingProvider {
             return meta ? `${ts} [${info.level}]: ${msg} ${meta}` : `${ts} [${info.level}]: ${msg}`;
         }));
     }
+    /** CR and LF as the visible two-character sequences `\r` and `\n`, so a value cannot start a line of its own (#2294). */
+    static oneLine(text) {
+        return text.replace(/[\r\n]/g, (c) => (c === '\r' ? '\\r' : '\\n'));
+    }
+    /**
+     * A stack keeps one frame per line, but its message portion (`Name: message`, which can span lines and can
+     * hold a caller-sent value) must not start a log line of its own (#2294). Only a line that begins with
+     * optional whitespace and `at ` starts a new output line; every other line is joined to the one before it
+     * with a visible `\n`.
+     */
+    static stackLines(stack) {
+        const out = [];
+        stack.split('\n').forEach((raw, i) => {
+            const line = FileLoggingProvider.oneLine(raw);
+            if (i === 0 || /^\s*at /.test(raw))
+                out.push(line);
+            else
+                out[out.length - 1] += `\\n${line}`;
+        });
+        return out.join('\n');
+    }
     /**
      * Render whatever a caller passed as the second argument to `logger.*`.
      *
@@ -66,7 +97,9 @@ class FileLoggingProvider extends BaseLoggingProvider {
      * line would be noise at best.
      *
      * A `stack` is emitted on its own lines because a one-line stack is
-     * unreadable, and reading the stack is the entire reason this exists.
+     * unreadable, and reading the stack is the entire reason this exists. Its
+     * frames keep their own lines; CR and LF in its message portion are escaped,
+     * as are those in the other keys and their string values.
      *
      * @param info - The winston info object for one log record
      * @returns The rendered metadata, or an empty string when there is none
@@ -82,10 +115,10 @@ class FileLoggingProvider extends BaseLoggingProvider {
             if (value === undefined)
                 continue;
             if (key === 'stack' && typeof value === 'string') {
-                stack = value;
+                stack = FileLoggingProvider.stackLines(value);
                 continue;
             }
-            parts.push(`${key}=${typeof value === 'string' ? value : JSON.stringify(value)}`);
+            parts.push(`${FileLoggingProvider.oneLine(key)}=${typeof value === 'string' ? FileLoggingProvider.oneLine(value) : JSON.stringify(value)}`);
         }
         const inline = parts.length > 0 ? parts.join(' ') : '';
         if (stack) {