@mulmoclaude/core 3.11.0 → 3.12.0

package/dist/{server-zcM1ViCE.js → server-DkT40KgR.js}

@@ -19,13 +19,30 @@ var NameZ = z.string().refine(isValidCollectionName, { message: "is not a valid
 *  the rules compare it to `request.auth.token.email` verbatim, so any
 *  narrowing here would refuse addresses Firebase itself accepts. */
 var EmailZ = z.string().trim().min(3).includes("@");
-/** The four roles the deployed rules understand. `participant` is the layer
-*  that is NAMED but reads only its own rows — see `readerOf` vs `listedIn`. */
+/** The roles the deployed rules understand.
+*
+*  Two of them are row-scoped, in opposite directions, and the pair is what
+*  the four-way split could not express:
+*
+*    `participant` — the layer that is NAMED but reads only its OWN rows (the
+*    rows it submitted). See `readerOf` vs `listedIn`.
+*
+*    `assignee` — reads EVERY row and writes only the rows ASSIGNED to it. The
+*    stylist who approves their own bookings and not a colleague's; the marker
+*    who grades their own students. Which rows are theirs is
+*    `collections[cid].assigneeField`, a field on the record holding the
+*    member's address. Reads are deliberately unscoped: a stylist needs the
+*    whole day's schedule, and scoping the read makes the app unusable.
+*
+*  The names are permanent. The deployed rules compare these strings directly
+*  and they are written into `app.json` files people commit, so a rename is a
+*  migration over published apps rather than an edit. */
 var APP_ROLES = [
 	"owner",
 	"editor",
 	"viewer",
-	"participant"
+	"participant",
+	"assignee"
 ];
 var RoleZ = z.enum(APP_ROLES);
 /** `{ email: { "*" | cid: role } }`. The `"*"` key is the app-wide role; a
@@ -51,6 +68,21 @@ var CollectionConfigZ = z.object({
 	transitions: z.record(z.string().trim().min(1), z.array(z.string().trim().min(1))).optional(),
 	immutable: z.boolean().optional(),
 	submitOnly: z.boolean().optional(),
+	/** The field naming the member a row belongs to, for the `assignee` role.
+	*
+	*  Holds an ADDRESS, because that is the only thing the rules can compare
+	*  a member against (`request.auth.token.email`). A `ref` to a staff
+	*  collection stores the target's primary-key slug, not an address, so it
+	*  cannot be this field — declare a plain field beside the ref and let the
+	*  ref stay the thing the UI renders. The alternative, having the rules
+	*  `get()` the staff record to read an address off it, costs a document
+	*  access on every write and puts a second document between an
+	*  authorization decision and its answer.
+	*
+	*  Only meaningful with a member holding `assignee` on this cid; a
+	*  declaration with the role and no field is refused (`assigneeProblems`),
+	*  because that member would silently hold nothing. */
+	assigneeField: z.string().trim().min(1).optional(),
 	peerVisibility: z.enum(["public", "hidden"]).optional(),
 	revealGated: z.boolean().optional(),
 	gatedFrom: NameZ.optional(),
@@ -69,9 +101,32 @@ var CollectionConfigZ = z.object({
 *  the rules do not coerce strings, so an ISO string reaching Firestore is a
 *  type error that fails CLOSED (`inWindow` refuses every submission and the
 *  author sees "nobody can submit", not an error). */
+/** A window bound that lives on ANOTHER record, read at write time.
+*
+*  `window.from` is one absolute instant for the whole collection, which is
+*  enough for a survey and useless for anything recurring: "each class opens
+*  three days before it starts, at 08:00" is a bound PER RECORD. So the bound
+*  is not computed in the rules — they have no usable date arithmetic and
+*  `request.time` is UTC, which is the wrong answer for "08:00" — it is
+*  computed by whoever schedules the class, stored on the class record as
+*  epoch millis, and merely COMPARED here.
+*
+*  `ref` is the field on the record being written that names the target
+*  (`classId`); `collection` is the cid the target lives in, fixed in the
+*  declaration so that a path is never built out of a value a submitter wrote;
+*  `field` is the epoch-millis field on the target.
+*
+*  Not spelled `in` — that is an operator in the rules language, and
+*  `w.fromField.in` does not parse there. */
+var WindowRefZ = z.object({
+	ref: z.string().trim().min(1),
+	collection: NameZ,
+	field: z.string().trim().min(1)
+}).strict();
 var WindowZ = z.object({
 	from: z.iso.datetime().optional(),
-	until: z.iso.datetime().optional()
+	until: z.iso.datetime().optional(),
+	fromField: WindowRefZ.optional()
 }).strict();
 var ValidateZ = z.object({
 	required: z.array(z.string().trim().min(1)).optional(),
@@ -104,6 +159,19 @@ var SubmitZ = z.object({
 	idField: z.string().trim().min(1).optional(),
 	validate: ValidateZ.optional(),
 	window: WindowZ.optional(),
+	/** A field the rules PIN to the server clock on create: the record must
+	*  carry `request.time` in it, and may never change it afterwards.
+	*
+	*  What it buys is an order nobody can jump. A first-come app takes its
+	*  capacity from rank rather than from a count — the rules cannot count
+	*  documents, so "the first 8" can only ever be a reading of the rows —
+	*  and a rank is only as honest as the timestamp it sorts by. `idFrom`
+	*  stops a person holding two places; nothing else stops them writing
+	*  yesterday's date into the field that decides who got there first.
+	*
+	*  Binds EVERY create, the writer branch included, so a staff-entered row
+	*  cannot be back-dated into the queue either. */
+	stampField: z.string().trim().min(1).optional(),
 	/** Per CURRENT STATUS, never a flat list: a flat list lets a customer move
 	*  an approved booking's `startAt` without anyone re-approving it. */
 	selfUpdate: z.record(z.string().trim().min(1), z.array(z.string().trim().min(1))).optional(),
@@ -224,7 +292,11 @@ function windowMillis(window) {
 	if (window.from !== void 0) out.fromMs = Date.parse(window.from);
 	if (window.until !== void 0) out.untilMs = Date.parse(window.until);
 	if (Object.values(out).some((value) => !Number.isFinite(value))) throw new Error(`publish: window bound is not a parseable timestamp (${JSON.stringify(window)})`);
-	return Object.keys(out).length > 0 ? out : void 0;
+	const projected = {
+		...out,
+		...window.fromField === void 0 ? {} : { fromField: window.fromField }
+	};
+	return Object.keys(projected).length > 0 ? projected : void 0;
 }
 /** One `public.submit[cid]`, with its window lowered. Everything else passes
 *  through: the rules read these keys by the names the author wrote. */
@@ -651,7 +723,8 @@ function unknownCidProblems(app, collections) {
 		["collections", Object.keys(app.collections ?? {})],
 		["public.read", app.public?.read ?? []],
 		["public.submit", Object.keys(app.public?.submit ?? {})],
-		["participantRead", app.participantRead ?? []]
+		["participantRead", app.participantRead ?? []],
+		["members", [...new Set(Object.values(app.members).flatMap((roles) => Object.keys(roles)))].filter((key) => key !== "*")]
 	].flatMap(([where, cids]) => cids.filter((cid) => !known.has(cid)).map((cid) => `${where} names '${cid}', which is not a shared collection in this repository. Shared collections here: ${known.size > 0 ? [...known].sort().join(", ") : "(none - a schema needs storage.type \"firestore\")"}.`));
 }
 /** Everything publish refuses, as lines the author can act on.
@@ -668,7 +741,10 @@ function publishProblems(app, collections, publisherEmail) {
 		...mailProblems(app),
 		...submitShapeProblems(app),
 		...coherenceProblems(app),
-		...primaryKeyProblems(app, collections)
+		...primaryKeyProblems(app, collections),
+		...assigneeProblems(app),
+		...stampProblems(app),
+		...windowRefProblems(app, collections)
 	];
 }
 /** A public submission must NOT be allowed to name its own primary key.
@@ -698,6 +774,99 @@ function primaryKeyProblems(app, collections) {
 		return [`public.submit.${cid}.createFields must NOT include "${primaryKey}", the schema's primaryKey: the rules can pin the document id but not the value of a field, so a submitter could write at their own id while claiming another record's. A shared record's identity is its document id — the store fills the field from it, and a submitted value is either the same thing or a lie that is thrown away.`];
 	});
 }
+/** `assignee` without the field that says which rows are theirs.
+*
+*  A FAIL-CLOSED trap of the worst kind, because it fails closed for one
+*  person and nobody else: the rules ask `collections[cid].assigneeField` for
+*  the field to compare, find nothing, and refuse every write that member
+*  makes. The app works for the owner who set it up, and the member it was set
+*  up for is told only "permission denied".
+*
+*  `'*': "assignee"` is refused outright rather than checked against every
+*  collection. The role means "the rows assigned to you", and what counts as
+*  assigned is per collection — an app-wide one would need the same field name
+*  to be right everywhere, and where it is missing it silently means "no
+*  access to this collection" rather than "no scoping here".
+*/
+function assigneeProblems(app) {
+	return Object.entries(app.members).flatMap(([email, roles]) => Object.entries(roles).flatMap(([cid, role]) => {
+		if (role !== "assignee") return [];
+		if (cid === "*") return [`members["${email}"] holds "assignee" under "*", and the role cannot be app-wide: which rows are yours is declared per collection (\`collections.<cid>.assigneeField\`). Name the collections instead — { "bookings": "assignee" }.`];
+		if (app.collections?.[cid]?.assigneeField !== void 0) return [];
+		return [`members["${email}"] holds "assignee" on '${cid}', but collections.${cid}.assigneeField does not say which field names the member a row belongs to. Add it (assigneeField: "<a field holding an address>"), or give a role that is not row-scoped. Without it the rules have nothing to compare and refuse every write that member makes, while the app keeps working for everybody else.`];
+	}));
+}
+/** A server-stamped field the submitter cannot write, or can rewrite later.
+*
+*  Both failures are silent in opposite directions. Left out of
+*  `createFields`, the rules refuse every submission (`hasOnly(createFields)`
+*  rejects the key the stamp check requires) — an app nobody can use. Left IN
+*  a `selfUpdate` list, the field the queue is ordered by becomes editable by
+*  the person standing in the queue. */
+function stampProblems(app) {
+	return Object.entries(app.public?.submit ?? {}).flatMap(([cid, submit]) => {
+		const stamp = submit.stampField;
+		if (stamp === void 0) return [];
+		const problems = [];
+		if (!submit.createFields.includes(stamp)) problems.push(`public.submit.${cid}.stampField names '${stamp}', which is not in createFields. The rules require the record to CARRY the server time in that field, and refuse any key outside createFields — so every submission is denied. Add it to createFields; the page fills it in, not the person.`);
+		for (const [status, fields] of Object.entries(submit.selfUpdate ?? {})) {
+			if (!fields.includes(stamp)) continue;
+			problems.push(`public.submit.${cid}.selfUpdate.${status} lets the submitter write '${stamp}', which is the field stampField pins to the server clock. Whatever that field orders — a first-come queue, an audit trail — could then be rewritten by the person it ranks. Remove it from selfUpdate.`);
+		}
+		return problems;
+	});
+}
+/** A per-record window bound pointing at a collection or a field the submitter
+*  never writes.
+*
+*  `fromField` makes the rules read another record, and every part of that
+*  read is fail-closed: an unknown collection, or a `ref` the submission does
+*  not carry, means the bound can never be satisfied and the form is shut for
+*  good. */
+function windowRefProblems(app, collections) {
+	const known = new Set(collections.map((collection) => collection.cid));
+	return Object.entries(app.public?.submit ?? {}).flatMap(([cid, submit]) => {
+		const ref = submit.window?.fromField;
+		if (ref === void 0) return [];
+		const problems = [];
+		if (!known.has(ref.collection)) problems.push(`public.submit.${cid}.window.fromField.collection names '${ref.collection}', which is not a shared collection in this repository. The rules read the opening time off a record there, so nothing can ever be submitted. Shared collections here: ${known.size > 0 ? [...known].sort().join(", ") : "(none)"}.`);
+		if (!submit.createFields.includes(ref.ref)) problems.push(`public.submit.${cid}.window.fromField.ref names '${ref.ref}', which is not in createFields. The rules take the target record's id from that field ON THE SUBMISSION — if the submitter never writes it, there is nothing to look up and every submission is refused.`);
+		return problems;
+	});
+}
+/** What publish will actually promote, checked as the PAIR it becomes.
+*
+*  `publishProblems` reads the manifest, where `members` and `collections` sit
+*  side by side and agree. Publish does not write that pair. It writes the
+*  roster from the manifest and the collection configuration from what DEPLOY
+*  staged, so the app that lands is one half of each — and no check has ever
+*  looked at that combination.
+*
+*  The sequence that gets through: deploy revision A with no `assigneeField`,
+*  add the field AND the member in revision B, publish without redeploying.
+*  Every manifest-level check passes on a declaration that is internally sound,
+*  while what lands is A's field-less configuration beside B's roster — an
+*  assignee with nothing to be compared against, refused every write, in an app
+*  that keeps working for everybody else. That is the precise trap
+*  `assigneeProblems` exists to prevent, reached by the one route it cannot
+*  see.
+*
+*  Separate from `publishProblems` because it needs what deploy staged, which
+*  is a Firestore read the host makes and this package does not. It is checked
+*  against `stagedRuleConfig` — the same function the projection uses — rather
+*  than against a re-derivation, so the value validated is the value written.
+*
+*  Only the staged half can be stale, so only that half is named and the fix is
+*  "deploy again" rather than "fix the declaration". */
+function promotedRoleProblems(app, staged) {
+	const promoted = stagedRuleConfig(staged).collections ?? {};
+	const stagedCids = new Set(staged.map((entry) => entry.cid));
+	return Object.entries(app.members).flatMap(([email, roles]) => Object.entries(roles).flatMap(([cid, role]) => {
+		if (role !== "assignee" || cid === "*" || !stagedCids.has(cid)) return [];
+		if (promoted[cid]?.assigneeField !== void 0) return [];
+		return [`members["${email}"] holds "assignee" on '${cid}', and the STAGED version of '${cid}' — the one publish promotes — carries no assigneeField, even if app.json declares one now. Publish writes the roster from app.json and the collection configuration from the deploy, so that member would land with nothing to be compared against: refused every write, while the app keeps working for everybody else. Run deploy again, so the version being published is the one the declaration describes.`];
+	}));
+}
 //#endregion
 //#region src/collection/server/skillAssets.ts
 /** Read a collection's custom-view HTML, path-safely. `viewFile` is a
@@ -2768,6 +2937,6 @@ function makeManageCollectionTool(deps = {}) {
 	};
 }
 //#endregion
-export { parseAuthoredApp as $, runQueryOverRows as A, APP_SLUGS_COLLECTION as B, STORE_UNREADABLE as C, recordFieldProblem as D, compileRecordZ as E, readCustomViewI18n as F, appStagingPath as G, appConfigPath as H, readSkillTemplate as I, projectPublish as J, projectApp as K, bindsSubmitterIdentity as L, buildCollectionActionSeedPrompt as M, promptPathsFor as N, runCollectionQuery as O, readCustomViewHtml as P, AuthoredAppZ as Q, publishProblems as R, MAX_RECORD_ISSUES as S, validateRecordObject as T, appSchemasPath as U, PUBLIC_CONFIG_DOC as V, appSlugDoc as W, stagedRuleConfig as X, promoteSchema as Y, APP_ROLES as Z, computeCollectionIcon as _, deleteCollection as a, applyMutateAction as b, computeSuccessor as c, isTriggerDue as d, maybeSpawnSuccessor as f, ONE_SECOND_MS as g, successorId as h, deleteCustomView as i, buildActionSeedPrompt as j, enrichItems as k, daysInMonth as l, resolveEvery as m, MAX_UNSELECTIVE_ITEMS as n, deleteCollectionRefusalMessage as o, parseCivil as p, projectDeploy as q, makeManageCollectionTool as r, advanceTriggerDate as s, MAX_SCHEMA_ISSUES as t, formatCivil as u, buildWorkspaceOntology as v, validateCollectionRecords as w, firstMutateParamProblem as x, schemaRelations as y, APPS_COLLECTION as z };
+export { AuthoredAppZ as $, runQueryOverRows as A, APPS_COLLECTION as B, STORE_UNREADABLE as C, recordFieldProblem as D, compileRecordZ as E, readCustomViewI18n as F, appSlugDoc as G, PUBLIC_CONFIG_DOC as H, readSkillTemplate as I, projectDeploy as J, appStagingPath as K, bindsSubmitterIdentity as L, buildCollectionActionSeedPrompt as M, promptPathsFor as N, runCollectionQuery as O, readCustomViewHtml as P, APP_ROLES as Q, promotedRoleProblems as R, MAX_RECORD_ISSUES as S, validateRecordObject as T, appConfigPath as U, APP_SLUGS_COLLECTION as V, appSchemasPath as W, promoteSchema as X, projectPublish as Y, stagedRuleConfig as Z, computeCollectionIcon as _, deleteCollection as a, applyMutateAction as b, computeSuccessor as c, isTriggerDue as d, parseAuthoredApp as et, maybeSpawnSuccessor as f, ONE_SECOND_MS as g, successorId as h, deleteCustomView as i, buildActionSeedPrompt as j, enrichItems as k, daysInMonth as l, resolveEvery as m, MAX_UNSELECTIVE_ITEMS as n, deleteCollectionRefusalMessage as o, parseCivil as p, projectApp as q, makeManageCollectionTool as r, advanceTriggerDate as s, MAX_SCHEMA_ISSUES as t, formatCivil as u, buildWorkspaceOntology as v, validateCollectionRecords as w, firstMutateParamProblem as x, schemaRelations as y, publishProblems as z };
 
-//# sourceMappingURL=server-zcM1ViCE.js.map
+//# sourceMappingURL=server-DkT40KgR.js.map