@mpfrontend/access-core 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -1,3 +1,32 @@
-# Temporary Holding Version
+# @mpfrontend/access-core
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Local development package. Runtime: universal. Public API is exported from src/index.ts and compiled
+into dist. Nx owns build, typecheck, lint and test targets. Consumer applications install packed artifacts.
+See ../../docs/IMPLEMENTATION-STATUS.md for observed evidence and remaining work.
+
+`AuthorityFence` aborts in-flight browser work and rejects stale publication after a consumer-owned
+authority identity changes. Capture before starting a request and assert again immediately before
+publishing its result. Identical context refreshes preserve work; switching away and back does not
+resurrect an old response. Consumers choose the identity (subject, tenant, role revision/session).
+This is a UI isolation guard, not permission enforcement; it cannot recall an upstream mutation.
+
+## Snapshot validation and field state
+
+`parsePageAccess(value, {now, contextRef, keys})` validates a snapshot at run time before anything reads it:
+exactly the five members (so no identity or token data rides along), a bounded context reference and revision,
+a finite expiry, boolean grants and field access, the context the caller expects and, when given, the known keys.
+A malformed, expired or mismatched snapshot is refused whole (`MALFORMED`, `EXPIRED`, `CONTEXT_MISMATCH`,
+`UNKNOWN_KEY`) and grants nothing. `pickPageAccess` keeps only the listed keys. `fieldState` returns `hidden`,
+`disabled` or `enabled`; a control that is already disabled or busy stays disabled. `accessReader(snapshot)`
+reads one snapshot for components and is closed without one. `can`, `fieldAccess`, `projectFields` and
+`dirtyPatch` are unchanged.
+
+## Page manifest
+
+`definePageManifest` lists every route of an app once: the capability its page needs, the capability of its menu
+entry, its elements and the field keys its components read, and the navigation groups. `buildNavigation` shows a
+page when the snapshot grants its menu and its page capability, and a group when it grants the group's menu and
+at least one child shows: a parent grants no child, and a group with no visible child is pruned.
+`checkPageManifest` and `assertPageManifest` report a duplicate id, an id the app uses that the manifest does not
+register and a route with no entry. `pageKeys`, `navigationKeys` and `manifestKeys` give the keys a provider
+needs and the keys a snapshot is checked against. The React bindings are `@mpfrontend/access-react`.

package/dist/authority-fence.d.ts

@@ -0,0 +1,10 @@
+/** A UI publication fence, never an authorization decision. Servers still enforce every request. */
+export declare class AuthorityFence {
+    private identity;
+    private controller;
+    update(identity: string | null): void;
+    capture(expectedIdentity: string): Readonly<{
+        signal: AbortSignal;
+        assertCurrent: () => void;
+    }>;
+}

package/dist/authority-fence.js

@@ -0,0 +1,22 @@
+/** A UI publication fence, never an authorization decision. Servers still enforce every request. */
+export class AuthorityFence {
+    identity = null;
+    controller = new AbortController();
+    update(identity) {
+        if (identity === this.identity)
+            return;
+        this.controller.abort(new DOMException('AUTHORITY_CHANGED', 'AbortError'));
+        this.controller = new AbortController();
+        this.identity = identity;
+    }
+    capture(expectedIdentity) {
+        const controller = this.controller;
+        const assertCurrent = () => {
+            if (!this.identity || this.identity !== expectedIdentity || controller !== this.controller || controller.signal.aborted)
+                throw new DOMException('AUTHORITY_CHANGED', 'AbortError');
+        };
+        assertCurrent();
+        return { signal: controller.signal, assertCurrent };
+    }
+}
+//# sourceMappingURL=authority-fence.js.map

package/dist/authority-fence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authority-fence.js","sourceRoot":"","sources":["../src/authority-fence.ts"],"names":[],"mappings":"AAAA,oGAAoG;AACpG,MAAM,OAAO,cAAc;IACjB,QAAQ,GAAa,IAAI,CAAC;IAC1B,UAAU,GAAC,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,CAAC,QAAoB;QACzB,IAAG,QAAQ,KAAG,IAAI,CAAC,QAAQ;YAAC,OAAO;QACnC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC,mBAAmB,EAAC,YAAY,CAAC,CAAC,CAAC;QAC1E,IAAI,CAAC,UAAU,GAAC,IAAI,eAAe,EAAE,CAAC;QAAA,IAAI,CAAC,QAAQ,GAAC,QAAQ,CAAC;IAC/D,CAAC;IACD,OAAO,CAAC,gBAAuB;QAC7B,MAAM,UAAU,GAAC,IAAI,CAAC,UAAU,CAAC;QACjC,MAAM,aAAa,GAAC,GAAE,EAAE;YACtB,IAAG,CAAC,IAAI,CAAC,QAAQ,IAAE,IAAI,CAAC,QAAQ,KAAG,gBAAgB,IAAE,UAAU,KAAG,IAAI,CAAC,UAAU,IAAE,UAAU,CAAC,MAAM,CAAC,OAAO;gBAC1G,MAAM,IAAI,YAAY,CAAC,mBAAmB,EAAC,YAAY,CAAC,CAAC;QAC7D,CAAC,CAAC;QACF,aAAa,EAAE,CAAC;QAAA,OAAO,EAAC,MAAM,EAAC,UAAU,CAAC,MAAM,EAAC,aAAa,EAAC,CAAC;IAClE,CAAC;CACF"}

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+export { AuthorityFence } from './authority-fence.js';
+export { DENIED, can, fieldAccess, projectFields, dirtyPatch, type FieldAccess, type PageAccess } from './page-access.js';
+export { parsePageAccess, pickPageAccess, fieldState, accessReader, type AccessKeys, type AccessExpectation, type AccessRefusal, type AccessCheck, type FieldPresentation, type ControlState, type AccessReader } from './snapshot.js';
+export { definePageManifest, elementCapability, pageKeys, navigationKeys, manifestKeys, buildNavigation, checkPageManifest, assertPageManifest, type ManifestElement, type ManifestPage, type ManifestGroup, type PageManifest, type NavigationEntry, type ManifestProblem } from './manifest.js';

package/dist/index.js

@@ -0,0 +1,5 @@
+export { AuthorityFence } from './authority-fence.js';
+export { DENIED, can, fieldAccess, projectFields, dirtyPatch } from './page-access.js';
+export { parsePageAccess, pickPageAccess, fieldState, accessReader } from './snapshot.js';
+export { definePageManifest, elementCapability, pageKeys, navigationKeys, manifestKeys, buildNavigation, checkPageManifest, assertPageManifest } from './manifest.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,cAAc,EAAC,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAC,MAAM,EAAC,GAAG,EAAC,WAAW,EAAC,aAAa,EAAC,UAAU,EAAkC,MAAM,kBAAkB,CAAC;AAClH,OAAO,EAAC,eAAe,EAAC,cAAc,EAAC,UAAU,EAAC,YAAY,EAC0E,MAAM,eAAe,CAAC;AAC9J,OAAO,EAAC,kBAAkB,EAAC,iBAAiB,EAAC,QAAQ,EAAC,cAAc,EAAC,YAAY,EAAC,eAAe,EAAC,iBAAiB,EAAC,kBAAkB,EACd,MAAM,eAAe,CAAC"}

package/dist/manifest.d.ts

@@ -0,0 +1,73 @@
+import { type PageAccess } from './page-access.js';
+import type { AccessKeys } from './snapshot.js';
+/** An element of a page. Without `capability` its own id is its capability key. */
+export type ManifestElement = Readonly<{
+    id: string;
+    capability?: string;
+}>;
+/**
+ * One route. `page` is the capability the page needs; `menu`, when set, is the capability its menu entry needs.
+ * `fields` lists the field keys the page's components read.
+ */
+export type ManifestPage = Readonly<{
+    id: string;
+    route: string;
+    page: string;
+    menu?: string;
+    elements?: readonly ManifestElement[];
+    fields?: readonly string[];
+}>;
+/** A navigation group: its own menu capability and its children, page or group ids, in order. */
+export type ManifestGroup = Readonly<{
+    id: string;
+    menu: string;
+    children: readonly string[];
+}>;
+/** Every route of an app, its navigation groups and the order of the top level of its navigation. */
+export type PageManifest = Readonly<{
+    pages: readonly ManifestPage[];
+    groups?: readonly ManifestGroup[];
+    navigation?: readonly string[];
+}>;
+export type NavigationEntry = Readonly<{
+    kind: 'page';
+    id: string;
+    route: string;
+}> | Readonly<{
+    kind: 'group';
+    id: string;
+    children: readonly NavigationEntry[];
+}>;
+export type ManifestProblem = Readonly<{
+    code: 'DUPLICATE_ID' | 'UNREGISTERED_ID' | 'UNLISTED_ROUTE' | 'UNKNOWN_CHILD' | 'NO_MENU' | 'NAVIGATION_CYCLE';
+    id: string;
+}>;
+/** Defines the manifest once, frozen. Ids are stable strings; checkPageManifest finds duplicates and gaps. */
+export declare function definePageManifest<const M extends PageManifest>(manifest: M): M;
+export declare function elementCapability(element: ManifestElement): string;
+/** The keys one page's components read: its page and menu capabilities, its elements' capabilities and its fields. */
+export declare function pageKeys(manifest: PageManifest, pageId: string): AccessKeys;
+/** The keys navigation reads: every group's menu capability and the menu and page capability of every page with a menu. */
+export declare function navigationKeys(manifest: PageManifest): AccessKeys;
+/** Every key the manifest declares: the known keys a snapshot is checked against. */
+export declare function manifestKeys(manifest: PageManifest): AccessKeys;
+/**
+ * Navigation from the manifest and the snapshot. A page shows when the snapshot grants both its menu and its page
+ * capability; a group shows when it grants the group's menu and at least one child shows. A parent's visibility
+ * grants no child, and a group with no visible child is pruned.
+ */
+export declare function buildNavigation(manifest: PageManifest, access: PageAccess | undefined, now?: number): NavigationEntry[];
+/**
+ * The problems a test reports: an id defined twice, an id the app uses that the manifest does not register (ids and
+ * capability keys are registered), an app route without a page entry, a navigation child that is neither a page nor
+ * a group, a page in navigation without a menu capability, and a group that contains itself.
+ */
+export declare function checkPageManifest(manifest: PageManifest, input?: Readonly<{
+    routes?: Iterable<string>;
+    ids?: Iterable<string>;
+}>): ManifestProblem[];
+/** Throws PAGE_MANIFEST_INVALID with every problem, for a test of the consumer's manifest. */
+export declare function assertPageManifest(manifest: PageManifest, input?: Readonly<{
+    routes?: Iterable<string>;
+    ids?: Iterable<string>;
+}>): void;

package/dist/manifest.js

@@ -0,0 +1,120 @@
+import { can } from './page-access.js';
+function deepFreeze(value) {
+    if (value && typeof value === 'object' && !Object.isFrozen(value)) {
+        for (const child of Object.values(value))
+            deepFreeze(child);
+        Object.freeze(value);
+    }
+    return value;
+}
+/** Defines the manifest once, frozen. Ids are stable strings; checkPageManifest finds duplicates and gaps. */
+export function definePageManifest(manifest) { return deepFreeze(manifest); }
+export function elementCapability(element) { return element.capability ?? element.id; }
+const unique = (values) => [...new Set(values)];
+/** The keys one page's components read: its page and menu capabilities, its elements' capabilities and its fields. */
+export function pageKeys(manifest, pageId) {
+    const page = manifest.pages.find(entry => entry.id === pageId);
+    if (!page)
+        return { capabilities: [], fields: [] };
+    return { capabilities: unique([page.page, ...(page.menu ? [page.menu] : []), ...(page.elements ?? []).map(elementCapability)]), fields: unique(page.fields ?? []) };
+}
+/** The keys navigation reads: every group's menu capability and the menu and page capability of every page with a menu. */
+export function navigationKeys(manifest) {
+    return { capabilities: unique([...(manifest.groups ?? []).map(group => group.menu),
+            ...manifest.pages.flatMap(page => page.menu ? [page.menu, page.page] : [])]), fields: [] };
+}
+/** Every key the manifest declares: the known keys a snapshot is checked against. */
+export function manifestKeys(manifest) {
+    const pages = manifest.pages.map(page => pageKeys(manifest, page.id));
+    return { capabilities: unique([...navigationKeys(manifest).capabilities, ...pages.flatMap(keys => keys.capabilities)]),
+        fields: unique(pages.flatMap(keys => keys.fields)) };
+}
+/**
+ * Navigation from the manifest and the snapshot. A page shows when the snapshot grants both its menu and its page
+ * capability; a group shows when it grants the group's menu and at least one child shows. A parent's visibility
+ * grants no child, and a group with no visible child is pruned.
+ */
+export function buildNavigation(manifest, access, now = Date.now()) {
+    const pages = new Map(manifest.pages.map(page => [page.id, page])), groups = new Map((manifest.groups ?? []).map(group => [group.id, group]));
+    const visit = (id, path) => {
+        if (path.has(id))
+            return undefined;
+        const page = pages.get(id);
+        if (page)
+            return page.menu && can(access, page.menu, now) && can(access, page.page, now) ? Object.freeze({ kind: 'page', id, route: page.route }) : undefined;
+        const group = groups.get(id);
+        if (!group || !can(access, group.menu, now))
+            return undefined;
+        const inner = new Set(path).add(id);
+        const children = group.children.map(child => visit(child, inner)).filter((entry) => entry !== undefined);
+        return children.length ? Object.freeze({ kind: 'group', id, children: Object.freeze(children) }) : undefined;
+    };
+    return (manifest.navigation ?? []).map(id => visit(id, new Set())).filter((entry) => entry !== undefined);
+}
+/**
+ * The problems a test reports: an id defined twice, an id the app uses that the manifest does not register (ids and
+ * capability keys are registered), an app route without a page entry, a navigation child that is neither a page nor
+ * a group, a page in navigation without a menu capability, and a group that contains itself.
+ */
+export function checkPageManifest(manifest, input = {}) {
+    const problems = [], seen = new Set();
+    const ids = [...manifest.pages.map(page => page.id), ...(manifest.groups ?? []).map(group => group.id),
+        ...manifest.pages.flatMap(page => (page.elements ?? []).map(element => element.id))];
+    for (const id of ids) {
+        if (seen.has(id))
+            problems.push({ code: 'DUPLICATE_ID', id });
+        seen.add(id);
+    }
+    const registered = new Set([...ids, ...manifestKeys(manifest).capabilities]);
+    for (const id of unique(input.ids ?? []))
+        if (!registered.has(id))
+            problems.push({ code: 'UNREGISTERED_ID', id });
+    const routes = new Set(manifest.pages.map(page => page.route));
+    for (const route of unique(input.routes ?? []))
+        if (!routes.has(route))
+            problems.push({ code: 'UNLISTED_ROUTE', id: route });
+    const pages = new Map(manifest.pages.map(page => [page.id, page])), groups = new Map((manifest.groups ?? []).map(group => [group.id, group]));
+    const reported = new Set();
+    const walk = (id, path) => {
+        if (path.includes(id)) {
+            if (!reported.has('cycle:' + id)) {
+                reported.add('cycle:' + id);
+                problems.push({ code: 'NAVIGATION_CYCLE', id });
+            }
+            return;
+        }
+        const page = pages.get(id), group = groups.get(id);
+        if (page) {
+            if (!page.menu && !reported.has('menu:' + id)) {
+                reported.add('menu:' + id);
+                problems.push({ code: 'NO_MENU', id });
+            }
+            return;
+        }
+        if (!group) {
+            if (!reported.has('child:' + id)) {
+                reported.add('child:' + id);
+                problems.push({ code: 'UNKNOWN_CHILD', id });
+            }
+            return;
+        }
+        for (const child of group.children)
+            walk(child, [...path, id]);
+    };
+    for (const id of manifest.navigation ?? [])
+        walk(id, []);
+    for (const group of manifest.groups ?? [])
+        for (const child of group.children)
+            if (!pages.has(child) && !groups.has(child) && !reported.has('child:' + child)) {
+                reported.add('child:' + child);
+                problems.push({ code: 'UNKNOWN_CHILD', id: child });
+            }
+    return problems;
+}
+/** Throws PAGE_MANIFEST_INVALID with every problem, for a test of the consumer's manifest. */
+export function assertPageManifest(manifest, input = {}) {
+    const problems = checkPageManifest(manifest, input);
+    if (problems.length)
+        throw new Error('PAGE_MANIFEST_INVALID ' + problems.map(problem => problem.code + ':' + problem.id).join(' '));
+}
+//# sourceMappingURL=manifest.js.map

package/dist/manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,GAAG,EAAiB,MAAM,kBAAkB,CAAC;AAsBrD,SAAS,UAAU,CAAI,KAAO;IAC5B,IAAG,KAAK,IAAE,OAAO,KAAK,KAAG,QAAQ,IAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAC,CAAC;QAAA,KAAI,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;YAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAAA,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAAA,CAAC;IAC5I,OAAO,KAAK,CAAC;AACf,CAAC;AACD,8GAA8G;AAC9G,MAAM,UAAU,kBAAkB,CAA+B,QAAU,IAAI,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAA,CAAC;AAC5G,MAAM,UAAU,iBAAiB,CAAC,OAAuB,IAAS,OAAO,OAAO,CAAC,UAAU,IAAE,OAAO,CAAC,EAAE,CAAC,CAAA,CAAC;AAEzG,MAAM,MAAM,GAAC,CAAC,MAAuB,EAAC,EAAE,CAAA,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC7D,sHAAsH;AACtH,MAAM,UAAU,QAAQ,CAAC,QAAqB,EAAC,MAAa;IAC1D,MAAM,IAAI,GAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAA,EAAE,CAAA,KAAK,CAAC,EAAE,KAAG,MAAM,CAAC,CAAC;IACzD,IAAG,CAAC,IAAI;QAAC,OAAO,EAAC,YAAY,EAAC,EAAE,EAAC,MAAM,EAAC,EAAE,EAAC,CAAC;IAC5C,OAAO,EAAC,YAAY,EAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,EAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAA,CAAC,CAAA,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA,CAAC,CAAA,EAAE,CAAC,EAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAE,EAAE,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAC,MAAM,EAAC,MAAM,CAAC,IAAI,CAAC,MAAM,IAAE,EAAE,CAAC,EAAC,CAAC;AACvJ,CAAC;AACD,2HAA2H;AAC3H,MAAM,UAAU,cAAc,CAAC,QAAqB;IAClD,OAAO,EAAC,YAAY,EAAC,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,IAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAA,EAAE,CAAA,KAAK,CAAC,IAAI,CAAC;YAC1E,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAA,EAAE,CAAA,IAAI,CAAC,IAAI,CAAA,CAAC,CAAA,CAAC,IAAI,CAAC,IAAI,EAAC,IAAI,CAAC,IAAI,CAAC,CAAA,CAAC,CAAA,EAAE,CAAC,CAAC,CAAC,EAAC,MAAM,EAAC,EAAE,EAAC,CAAC;AACrF,CAAC;AACD,qFAAqF;AACrF,MAAM,UAAU,YAAY,CAAC,QAAqB;IAChD,MAAM,KAAK,GAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAA,EAAE,CAAA,QAAQ,CAAC,QAAQ,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACjE,OAAO,EAAC,YAAY,EAAC,MAAM,CAAC,CAAC,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC,YAAY,EAAC,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAA,EAAE,CAAA,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;QAC/G,MAAM,EAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAA,EAAE,CAAA,IAAI,CAAC,MAAM,CAAC,CAAC,EAAC,CAAC;AACrD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,QAAqB,EAAC,MAA2B,EAAC,GAAG,GAAC,IAAI,CAAC,GAAG,EAAE;IAC9F,MAAM,KAAK,GAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAA,EAAE,CAAA,CAAC,IAAI,CAAC,EAAE,EAAC,IAAI,CAAC,CAAC,CAAC,EAAC,MAAM,GAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAA,EAAE,CAAA,CAAC,KAAK,CAAC,EAAE,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACjI,MAAM,KAAK,GAAC,CAAC,EAAS,EAAC,IAAwB,EAA2B,EAAE;QAC1E,IAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAC,OAAO,SAAS,CAAC;QACjC,MAAM,IAAI,GAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACzB,IAAG,IAAI;YAAC,OAAO,IAAI,CAAC,IAAI,IAAE,GAAG,CAAC,MAAM,EAAC,IAAI,CAAC,IAAI,EAAC,GAAG,CAAC,IAAE,GAAG,CAAC,MAAM,EAAC,IAAI,CAAC,IAAI,EAAC,GAAG,CAAC,CAAA,CAAC,CAAA,MAAM,CAAC,MAAM,CAAC,EAAC,IAAI,EAAC,MAAM,EAAC,EAAE,EAAC,KAAK,EAAC,IAAI,CAAC,KAAK,EAAC,CAAC,CAAA,CAAC,CAAA,SAAS,CAAC;QAC1I,MAAM,KAAK,GAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3B,IAAG,CAAC,KAAK,IAAE,CAAC,GAAG,CAAC,MAAM,EAAC,KAAK,CAAC,IAAI,EAAC,GAAG,CAAC;YAAC,OAAO,SAAS,CAAC;QACxD,MAAM,KAAK,GAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClC,MAAM,QAAQ,GAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAA,EAAE,CAAA,KAAK,CAAC,KAAK,EAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAA0B,EAAE,CAAA,KAAK,KAAG,SAAS,CAAC,CAAC;QACzH,OAAO,QAAQ,CAAC,MAAM,CAAA,CAAC,CAAA,MAAM,CAAC,MAAM,CAAC,EAAC,IAAI,EAAC,OAAO,EAAC,EAAE,EAAC,QAAQ,EAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAC,CAAC,CAAA,CAAC,CAAA,SAAS,CAAC;IACrG,CAAC,CAAC;IACF,OAAO,CAAC,QAAQ,CAAC,UAAU,IAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAA,EAAE,CAAA,KAAK,CAAC,EAAE,EAAC,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAA0B,EAAE,CAAA,KAAK,KAAG,SAAS,CAAC,CAAC;AAC5H,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAqB,EAAC,QAAiE,EAAE;IACzH,MAAM,QAAQ,GAAmB,EAAE,EAAC,IAAI,GAAC,IAAI,GAAG,EAAU,CAAC;IAC3D,MAAM,GAAG,GAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAA,EAAE,CAAA,IAAI,CAAC,EAAE,CAAC,EAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,IAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAA,EAAE,CAAA,KAAK,CAAC,EAAE,CAAC;QAC3F,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAA,EAAE,CAAA,CAAC,IAAI,CAAC,QAAQ,IAAE,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAA,EAAE,CAAA,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACjF,KAAI,MAAM,EAAE,IAAI,GAAG,EAAC,CAAC;QAAA,IAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAC,QAAQ,CAAC,IAAI,CAAC,EAAC,IAAI,EAAC,cAAc,EAAC,EAAE,EAAC,CAAC,CAAC;QAAA,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAAA,CAAC;IAC3F,MAAM,UAAU,GAAC,IAAI,GAAG,CAAC,CAAC,GAAG,GAAG,EAAC,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;IAC1E,KAAI,MAAM,EAAE,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,IAAE,EAAE,CAAC;QAAC,IAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAAC,QAAQ,CAAC,IAAI,CAAC,EAAC,IAAI,EAAC,iBAAiB,EAAC,EAAE,EAAC,CAAC,CAAC;IACxG,MAAM,MAAM,GAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAA,EAAE,CAAA,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3D,KAAI,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,IAAE,EAAE,CAAC;QAAC,IAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;YAAC,QAAQ,CAAC,IAAI,CAAC,EAAC,IAAI,EAAC,gBAAgB,EAAC,EAAE,EAAC,KAAK,EAAC,CAAC,CAAC;IAClH,MAAM,KAAK,GAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAA,EAAE,CAAA,CAAC,IAAI,CAAC,EAAE,EAAC,IAAI,CAAC,CAAC,CAAC,EAAC,MAAM,GAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAA,EAAE,CAAA,CAAC,KAAK,CAAC,EAAE,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACjI,MAAM,QAAQ,GAAC,IAAI,GAAG,EAAU,CAAC;IACjC,MAAM,IAAI,GAAC,CAAC,EAAS,EAAC,IAAsB,EAAC,EAAE;QAC7C,IAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAC,CAAC;YAAA,IAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,GAAC,EAAE,CAAC,EAAC,CAAC;gBAAA,QAAQ,CAAC,GAAG,CAAC,QAAQ,GAAC,EAAE,CAAC,CAAC;gBAAA,QAAQ,CAAC,IAAI,CAAC,EAAC,IAAI,EAAC,kBAAkB,EAAC,EAAE,EAAC,CAAC,CAAC;YAAA,CAAC;YAAA,OAAO;QAAA,CAAC;QACpI,MAAM,IAAI,GAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,EAAC,KAAK,GAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9C,IAAG,IAAI,EAAC,CAAC;YAAA,IAAG,CAAC,IAAI,CAAC,IAAI,IAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,GAAC,EAAE,CAAC,EAAC,CAAC;gBAAA,QAAQ,CAAC,GAAG,CAAC,OAAO,GAAC,EAAE,CAAC,CAAC;gBAAA,QAAQ,CAAC,IAAI,CAAC,EAAC,IAAI,EAAC,SAAS,EAAC,EAAE,EAAC,CAAC,CAAC;YAAA,CAAC;YAAA,OAAO;QAAA,CAAC;QACxH,IAAG,CAAC,KAAK,EAAC,CAAC;YAAA,IAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,GAAC,EAAE,CAAC,EAAC,CAAC;gBAAA,QAAQ,CAAC,GAAG,CAAC,QAAQ,GAAC,EAAE,CAAC,CAAC;gBAAA,QAAQ,CAAC,IAAI,CAAC,EAAC,IAAI,EAAC,eAAe,EAAC,EAAE,EAAC,CAAC,CAAC;YAAA,CAAC;YAAA,OAAO;QAAA,CAAC;QACtH,KAAI,MAAM,KAAK,IAAI,KAAK,CAAC,QAAQ;YAAC,IAAI,CAAC,KAAK,EAAC,CAAC,GAAG,IAAI,EAAC,EAAE,CAAC,CAAC,CAAC;IAC7D,CAAC,CAAC;IACF,KAAI,MAAM,EAAE,IAAI,QAAQ,CAAC,UAAU,IAAE,EAAE;QAAC,IAAI,CAAC,EAAE,EAAC,EAAE,CAAC,CAAC;IACpD,KAAI,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,IAAE,EAAE;QAAC,KAAI,MAAM,KAAK,IAAI,KAAK,CAAC,QAAQ;YAAC,IAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,GAAC,KAAK,CAAC,EAAC,CAAC;gBAChJ,QAAQ,CAAC,GAAG,CAAC,QAAQ,GAAC,KAAK,CAAC,CAAC;gBAAA,QAAQ,CAAC,IAAI,CAAC,EAAC,IAAI,EAAC,eAAe,EAAC,EAAE,EAAC,KAAK,EAAC,CAAC,CAAC;YAC9E,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AACD,8FAA8F;AAC9F,MAAM,UAAU,kBAAkB,CAAC,QAAqB,EAAC,QAAiE,EAAE;IAC1H,MAAM,QAAQ,GAAC,iBAAiB,CAAC,QAAQ,EAAC,KAAK,CAAC,CAAC;IACjD,IAAG,QAAQ,CAAC,MAAM;QAAC,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAA,EAAE,CAAA,OAAO,CAAC,IAAI,GAAC,GAAG,GAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC5H,CAAC"}

package/dist/page-access.d.ts

@@ -0,0 +1,16 @@
+export type FieldAccess = Readonly<{
+    view: boolean;
+    edit: boolean;
+}>;
+export type PageAccess = Readonly<{
+    contextRef: string;
+    revision: string;
+    expiresAt: number;
+    capabilities: Readonly<Record<string, boolean>>;
+    fields: Readonly<Record<string, FieldAccess>>;
+}>;
+export declare const DENIED: FieldAccess;
+export declare function fieldAccess(access: PageAccess | undefined, key: string, now?: number): FieldAccess;
+export declare function can(access: PageAccess | undefined, capability: string, now?: number): boolean;
+export declare function projectFields(data: Readonly<Record<string, unknown>>, access: PageAccess, now?: number): Record<string, unknown>;
+export declare function dirtyPatch(original: Readonly<Record<string, unknown>>, draft: Readonly<Record<string, unknown>>, access: PageAccess, now?: number): Record<string, unknown>;

package/dist/page-access.js

@@ -0,0 +1,25 @@
+export const DENIED = Object.freeze({ view: false, edit: false });
+export function fieldAccess(access, key, now = Date.now()) {
+    if (!access || access.expiresAt <= now)
+        return DENIED;
+    const field = access.fields[key];
+    return field?.view ? { view: true, edit: field.edit === true } : DENIED;
+}
+export function can(access, capability, now = Date.now()) {
+    return !!access && access.expiresAt > now && access.capabilities[capability] === true;
+}
+export function projectFields(data, access, now = Date.now()) {
+    return Object.fromEntries(Object.entries(data).filter(([key]) => fieldAccess(access, key, now).view));
+}
+export function dirtyPatch(original, draft, access, now = Date.now()) {
+    const patch = {};
+    for (const [key, value] of Object.entries(draft)) {
+        if (Object.is(original[key], value))
+            continue;
+        if (!fieldAccess(access, key, now).edit)
+            throw new Error('FORBIDDEN_FIELD');
+        patch[key] = value;
+    }
+    return patch;
+}
+//# sourceMappingURL=page-access.js.map

package/dist/page-access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"page-access.js","sourceRoot":"","sources":["../src/page-access.ts"],"names":[],"mappings":"AAMA,MAAM,CAAC,MAAM,MAAM,GAAgB,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC/E,MAAM,UAAU,WAAW,CAAC,MAA8B,EAAE,GAAW,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IACvF,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG;QAAE,OAAO,MAAM,CAAC;IACtD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjC,OAAO,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;AAC1E,CAAC;AACD,MAAM,UAAU,GAAG,CAAC,MAA8B,EAAE,UAAkB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IACtF,OAAO,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC;AACxF,CAAC;AACD,MAAM,UAAU,aAAa,CAAC,IAAuC,EAAE,MAAkB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IACzG,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AACxG,CAAC;AACD,MAAM,UAAU,UAAU,CAAC,QAA2C,EAAE,KAAwC,EAAE,MAAkB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IACpJ,MAAM,KAAK,GAA4B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC;YAAE,SAAS;QAC9C,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAC5E,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACrB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/snapshot.d.ts

@@ -0,0 +1,48 @@
+import { type FieldAccess, type PageAccess } from './page-access.js';
+/** The capability and field keys a consumer knows; a snapshot that names another key is refused. */
+export type AccessKeys = Readonly<{
+    capabilities: readonly string[];
+    fields: readonly string[];
+}>;
+/** What a snapshot must match to be used: the current time, the context the request is in, the known keys. */
+export type AccessExpectation = Readonly<{
+    now?: number;
+    contextRef?: string;
+    keys?: AccessKeys;
+}>;
+/** Why a snapshot was refused. A refused snapshot is never used: every entry stays closed. */
+export type AccessRefusal = 'MALFORMED' | 'EXPIRED' | 'CONTEXT_MISMATCH' | 'UNKNOWN_KEY';
+export type AccessCheck = Readonly<{
+    ok: true;
+    access: PageAccess;
+}> | Readonly<{
+    ok: false;
+    reason: AccessRefusal;
+}>;
+/** How a field is presented: not rendered, rendered and not editable, or editable. */
+export type FieldPresentation = 'hidden' | 'disabled' | 'enabled';
+/** A state the control already has; either one keeps it disabled whatever the snapshot grants. */
+export type ControlState = Readonly<{
+    disabled?: boolean;
+    busy?: boolean;
+}>;
+/**
+ * Validates an access snapshot at run time before anything reads it: its shape (exactly the five members, no
+ * identity or token data beside them), its context reference and revision, its expiry, the context the caller
+ * expects and, when given, the known keys. The result is a frozen copy; a refused snapshot grants nothing.
+ */
+export declare function parsePageAccess(value: unknown, expected?: AccessExpectation): AccessCheck;
+/** The part of a snapshot that some components need: only the listed keys, never more than the snapshot grants. */
+export declare function pickPageAccess(access: PageAccess, keys: AccessKeys): PageAccess;
+/** Hidden when the field may not be viewed, disabled when it may not be edited or the control is disabled or busy. */
+export declare function fieldState(access: PageAccess | undefined, key: string, state?: ControlState, now?: number): FieldPresentation;
+/** One snapshot read for components. Without a snapshot every entry is closed. Each read uses the current time. */
+export type AccessReader = Readonly<{
+    snapshot: PageAccess | undefined;
+    can: (capability: string) => boolean;
+    field: (key: string) => FieldAccess;
+    fieldState: (key: string, state?: ControlState) => FieldPresentation;
+    /** The changed fields that may be edited (dirtyPatch); a change to any other field throws FORBIDDEN_FIELD. */
+    patch: (original: Readonly<Record<string, unknown>>, draft: Readonly<Record<string, unknown>>) => Record<string, unknown>;
+}>;
+export declare function accessReader(snapshot: PageAccess | undefined, now?: () => number): AccessReader;

package/dist/snapshot.js

@@ -0,0 +1,95 @@
+import { can, dirtyPatch, fieldAccess } from './page-access.js';
+const SNAPSHOT_KEYS = ['capabilities', 'contextRef', 'expiresAt', 'fields', 'revision'];
+const REFERENCE = /^[A-Za-z0-9._:~-]{1,128}$/;
+const KEY = /^[A-Za-z0-9_.:/~-]{1,200}$/;
+// Records are plain objects, so that a server component can pass a snapshot to a client component; a key that
+// would name the prototype is refused.
+const key = (value) => KEY.test(value) && value !== '__proto__';
+const MAX_KEYS = 4096;
+function plainObject(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        return false;
+    const prototype = Object.getPrototypeOf(value);
+    return prototype === Object.prototype || prototype === null;
+}
+function exactKeys(value, keys) {
+    const own = Object.keys(value).sort();
+    return own.length === keys.length && own.every((key, index) => key === keys[index]);
+}
+/**
+ * Validates an access snapshot at run time before anything reads it: its shape (exactly the five members, no
+ * identity or token data beside them), its context reference and revision, its expiry, the context the caller
+ * expects and, when given, the known keys. The result is a frozen copy; a refused snapshot grants nothing.
+ */
+export function parsePageAccess(value, expected = {}) {
+    const refuse = (reason) => ({ ok: false, reason });
+    if (!plainObject(value) || !exactKeys(value, SNAPSHOT_KEYS))
+        return refuse('MALFORMED');
+    const { contextRef, revision, expiresAt, capabilities, fields } = value;
+    if (typeof contextRef !== 'string' || !REFERENCE.test(contextRef))
+        return refuse('MALFORMED');
+    if (typeof revision !== 'string' || !REFERENCE.test(revision))
+        return refuse('MALFORMED');
+    if (typeof expiresAt !== 'number' || !Number.isFinite(expiresAt))
+        return refuse('MALFORMED');
+    if (!plainObject(capabilities) || !plainObject(fields))
+        return refuse('MALFORMED');
+    const capabilityEntries = Object.entries(capabilities), fieldEntries = Object.entries(fields);
+    if (capabilityEntries.length > MAX_KEYS || fieldEntries.length > MAX_KEYS)
+        return refuse('MALFORMED');
+    const grants = [];
+    for (const [name, granted] of capabilityEntries) {
+        if (!key(name) || typeof granted !== 'boolean')
+            return refuse('MALFORMED');
+        grants.push([name, granted]);
+    }
+    const access = [];
+    for (const [name, field] of fieldEntries) {
+        if (!key(name) || !plainObject(field) || !exactKeys(field, ['edit', 'view']) || typeof field.view !== 'boolean' || typeof field.edit !== 'boolean')
+            return refuse('MALFORMED');
+        access.push([name, Object.freeze({ view: field.view, edit: field.edit })]);
+    }
+    if (expiresAt <= (expected.now ?? Date.now()))
+        return refuse('EXPIRED');
+    if (expected.contextRef !== undefined && expected.contextRef !== contextRef)
+        return refuse('CONTEXT_MISMATCH');
+    if (expected.keys) {
+        const knownCapabilities = new Set(expected.keys.capabilities), knownFields = new Set(expected.keys.fields);
+        if (capabilityEntries.some(([key]) => !knownCapabilities.has(key)) || fieldEntries.some(([key]) => !knownFields.has(key)))
+            return refuse('UNKNOWN_KEY');
+    }
+    return { ok: true, access: Object.freeze({ contextRef, revision, expiresAt,
+            capabilities: Object.freeze(Object.fromEntries(grants)), fields: Object.freeze(Object.fromEntries(access)) }) };
+}
+/** The part of a snapshot that some components need: only the listed keys, never more than the snapshot grants. */
+export function pickPageAccess(access, keys) {
+    const capabilities = [], fields = [];
+    for (const name of new Set(keys.capabilities))
+        if (Object.hasOwn(access.capabilities, name))
+            capabilities.push([name, access.capabilities[name] === true]);
+    for (const name of new Set(keys.fields)) {
+        const field = Object.hasOwn(access.fields, name) ? access.fields[name] : undefined;
+        if (field)
+            fields.push([name, Object.freeze({ view: field.view === true, edit: field.edit === true })]);
+    }
+    return Object.freeze({ contextRef: access.contextRef, revision: access.revision, expiresAt: access.expiresAt,
+        capabilities: Object.freeze(Object.fromEntries(capabilities)), fields: Object.freeze(Object.fromEntries(fields)) });
+}
+/** Hidden when the field may not be viewed, disabled when it may not be edited or the control is disabled or busy. */
+export function fieldState(access, key, state = {}, now = Date.now()) {
+    const field = fieldAccess(access, key, now);
+    if (!field.view)
+        return 'hidden';
+    return field.edit && !state.disabled && !state.busy ? 'enabled' : 'disabled';
+}
+const CLOSED = Object.freeze({ contextRef: 'closed', revision: 'closed', expiresAt: 0, capabilities: Object.freeze({}), fields: Object.freeze({}) });
+export function accessReader(snapshot, now = Date.now) {
+    return Object.freeze({
+        snapshot,
+        can: (capability) => can(snapshot, capability, now()),
+        field: (key) => fieldAccess(snapshot, key, now()),
+        fieldState: (key, state = {}) => fieldState(snapshot, key, state, now()),
+        patch: (original, draft) => dirtyPatch(original, draft, snapshot ?? CLOSED, now()),
+    });
+}
+//# sourceMappingURL=snapshot.js.map

package/dist/snapshot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"snapshot.js","sourceRoot":"","sources":["../src/snapshot.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,GAAG,EAAC,UAAU,EAAC,WAAW,EAAkC,MAAM,kBAAkB,CAAC;AAc7F,MAAM,aAAa,GAAC,CAAC,cAAc,EAAC,YAAY,EAAC,WAAW,EAAC,QAAQ,EAAC,UAAU,CAAC,CAAC;AAClF,MAAM,SAAS,GAAC,2BAA2B,CAAC;AAC5C,MAAM,GAAG,GAAC,4BAA4B,CAAC;AACvC,8GAA8G;AAC9G,uCAAuC;AACvC,MAAM,GAAG,GAAC,CAAC,KAAY,EAAC,EAAE,CAAA,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAE,KAAK,KAAG,WAAW,CAAC;AAC/D,MAAM,QAAQ,GAAC,IAAI,CAAC;AAEpB,SAAS,WAAW,CAAC,KAAa;IAChC,IAAG,OAAO,KAAK,KAAG,QAAQ,IAAE,KAAK,KAAG,IAAI,IAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAC,OAAO,KAAK,CAAC;IAC5E,MAAM,SAAS,GAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC7C,OAAO,SAAS,KAAG,MAAM,CAAC,SAAS,IAAE,SAAS,KAAG,IAAI,CAAC;AACxD,CAAC;AACD,SAAS,SAAS,CAAC,KAA4B,EAAC,IAAsB;IACpE,MAAM,GAAG,GAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,OAAO,GAAG,CAAC,MAAM,KAAG,IAAI,CAAC,MAAM,IAAE,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,EAAC,KAAK,EAAC,EAAE,CAAA,GAAG,KAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa,EAAC,WAA2B,EAAE;IACzE,MAAM,MAAM,GAAC,CAAC,MAAoB,EAAa,EAAE,CAAA,CAAC,EAAC,EAAE,EAAC,KAAK,EAAC,MAAM,EAAC,CAAC,CAAC;IACrE,IAAG,CAAC,WAAW,CAAC,KAAK,CAAC,IAAE,CAAC,SAAS,CAAC,KAAK,EAAC,aAAa,CAAC;QAAC,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC;IACnF,MAAM,EAAC,UAAU,EAAC,QAAQ,EAAC,SAAS,EAAC,YAAY,EAAC,MAAM,EAAC,GAAC,KAAK,CAAC;IAChE,IAAG,OAAO,UAAU,KAAG,QAAQ,IAAE,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC;QAAC,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC;IACxF,IAAG,OAAO,QAAQ,KAAG,QAAQ,IAAE,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAC,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC;IACpF,IAAG,OAAO,SAAS,KAAG,QAAQ,IAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAC,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC;IACvF,IAAG,CAAC,WAAW,CAAC,YAAY,CAAC,IAAE,CAAC,WAAW,CAAC,MAAM,CAAC;QAAC,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC;IAC/E,MAAM,iBAAiB,GAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAC,YAAY,GAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACzF,IAAG,iBAAiB,CAAC,MAAM,GAAC,QAAQ,IAAE,YAAY,CAAC,MAAM,GAAC,QAAQ;QAAC,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC;IAC9F,MAAM,MAAM,GAAyB,EAAE,CAAC;IACxC,KAAI,MAAM,CAAC,IAAI,EAAC,OAAO,CAAC,IAAI,iBAAiB,EAAC,CAAC;QAC7C,IAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAE,OAAO,OAAO,KAAG,SAAS;YAAC,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC;QACrE,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAC,OAAO,CAAC,CAAC,CAAC;IAC9B,CAAC;IACD,MAAM,MAAM,GAA6B,EAAE,CAAC;IAC5C,KAAI,MAAM,CAAC,IAAI,EAAC,KAAK,CAAC,IAAI,YAAY,EAAC,CAAC;QACtC,IAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAE,CAAC,WAAW,CAAC,KAAK,CAAC,IAAE,CAAC,SAAS,CAAC,KAAK,EAAC,CAAC,MAAM,EAAC,MAAM,CAAC,CAAC,IAAE,OAAO,KAAK,CAAC,IAAI,KAAG,SAAS,IAAE,OAAO,KAAK,CAAC,IAAI,KAAG,SAAS;YACjI,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAC,MAAM,CAAC,MAAM,CAAC,EAAC,IAAI,EAAC,KAAK,CAAC,IAAI,EAAC,IAAI,EAAC,KAAK,CAAC,IAAI,EAAC,CAAC,CAAC,CAAC,CAAC;IACvE,CAAC;IACD,IAAG,SAAS,IAAE,CAAC,QAAQ,CAAC,GAAG,IAAE,IAAI,CAAC,GAAG,EAAE,CAAC;QAAC,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC;IAClE,IAAG,QAAQ,CAAC,UAAU,KAAG,SAAS,IAAE,QAAQ,CAAC,UAAU,KAAG,UAAU;QAAC,OAAO,MAAM,CAAC,kBAAkB,CAAC,CAAC;IACvG,IAAG,QAAQ,CAAC,IAAI,EAAC,CAAC;QAChB,MAAM,iBAAiB,GAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,EAAC,WAAW,GAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtG,IAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAC,EAAE,CAAA,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAE,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAC,EAAE,CAAA,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAAC,OAAO,MAAM,CAAC,aAAa,CAAC,CAAC;IAClJ,CAAC;IACD,OAAO,EAAC,EAAE,EAAC,IAAI,EAAC,MAAM,EAAC,MAAM,CAAC,MAAM,CAAC,EAAC,UAAU,EAAC,QAAQ,EAAC,SAAS;YACjE,YAAY,EAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,EAAC,MAAM,EAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,EAAC,CAAC,EAAC,CAAC;AAC/G,CAAC;AAED,mHAAmH;AACnH,MAAM,UAAU,cAAc,CAAC,MAAiB,EAAC,IAAe;IAC9D,MAAM,YAAY,GAAyB,EAAE,EAAC,MAAM,GAA6B,EAAE,CAAC;IACpF,KAAI,MAAM,IAAI,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC;QAAC,IAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,EAAC,IAAI,CAAC;YAAC,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,KAAG,IAAI,CAAC,CAAC,CAAC;IACnJ,KAAI,MAAM,IAAI,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAC,CAAC;QACtC,MAAM,KAAK,GAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAC,IAAI,CAAC,CAAA,CAAC,CAAA,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA,CAAC,CAAA,SAAS,CAAC;QAC5E,IAAG,KAAK;YAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAC,MAAM,CAAC,MAAM,CAAC,EAAC,IAAI,EAAC,KAAK,CAAC,IAAI,KAAG,IAAI,EAAC,IAAI,EAAC,KAAK,CAAC,IAAI,KAAG,IAAI,EAAC,CAAC,CAAC,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAC,UAAU,EAAC,MAAM,CAAC,UAAU,EAAC,QAAQ,EAAC,MAAM,CAAC,QAAQ,EAAC,SAAS,EAAC,MAAM,CAAC,SAAS;QACpG,YAAY,EAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,EAAC,MAAM,EAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,EAAC,CAAC,CAAC;AACpH,CAAC;AAED,sHAAsH;AACtH,MAAM,UAAU,UAAU,CAAC,MAA2B,EAAC,GAAU,EAAC,QAAmB,EAAE,EAAC,GAAG,GAAC,IAAI,CAAC,GAAG,EAAE;IACpG,MAAM,KAAK,GAAC,WAAW,CAAC,MAAM,EAAC,GAAG,EAAC,GAAG,CAAC,CAAC;IACxC,IAAG,CAAC,KAAK,CAAC,IAAI;QAAC,OAAO,QAAQ,CAAC;IAC/B,OAAO,KAAK,CAAC,IAAI,IAAE,CAAC,KAAK,CAAC,QAAQ,IAAE,CAAC,KAAK,CAAC,IAAI,CAAA,CAAC,CAAA,SAAS,CAAA,CAAC,CAAA,UAAU,CAAC;AACvE,CAAC;AAWD,MAAM,MAAM,GAAY,MAAM,CAAC,MAAM,CAAC,EAAC,UAAU,EAAC,QAAQ,EAAC,QAAQ,EAAC,QAAQ,EAAC,SAAS,EAAC,CAAC,EAAC,YAAY,EAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAC,MAAM,EAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAC,CAAC,CAAC;AACnJ,MAAM,UAAU,YAAY,CAAC,QAA6B,EAAC,MAAe,IAAI,CAAC,GAAG;IAChF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,QAAQ;QACR,GAAG,EAAC,CAAC,UAAiB,EAAC,EAAE,CAAA,GAAG,CAAC,QAAQ,EAAC,UAAU,EAAC,GAAG,EAAE,CAAC;QACvD,KAAK,EAAC,CAAC,GAAU,EAAC,EAAE,CAAA,WAAW,CAAC,QAAQ,EAAC,GAAG,EAAC,GAAG,EAAE,CAAC;QACnD,UAAU,EAAC,CAAC,GAAU,EAAC,QAAmB,EAAE,EAAC,EAAE,CAAA,UAAU,CAAC,QAAQ,EAAC,GAAG,EAAC,KAAK,EAAC,GAAG,EAAE,CAAC;QACnF,KAAK,EAAC,CAAC,QAAyC,EAAC,KAAsC,EAAC,EAAE,CAAA,UAAU,CAAC,QAAQ,EAAC,KAAK,EAAC,QAAQ,IAAE,MAAM,EAAC,GAAG,EAAE,CAAC;KAC5I,CAAC,CAAC;AACL,CAAC"}

package/package.json

@@ -1,6 +1,28 @@
 {
   "name": "@mpfrontend/access-core",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.0",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/panahister/mpfrontend.git",
+    "directory": "packages/access-core"
+  },
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "dependencies": {}
 }