@mulmoclaude/core 3.13.0 → 3.14.0

package/dist/{server-DGjmK9vU.js → server-CQSF5fHe.js}

@@ -11,6 +11,166 @@ import path from "node:path";
 import { randomBytes, randomUUID } from "node:crypto";
 import { cp, lstat, mkdir, open, readFile, readdir, rm, rmdir, stat, unlink, writeFile } from "node:fs/promises";
 import { z } from "zod";
+//#region src/collection/server/appViews.ts
+/** The audiences a view may be written for. A CLOSED set: each one names a
+*  tier with a rule behind it, so an unknown value has nowhere to be
+*  published to and is refused before it gets there. */
+var VIEW_AUDIENCES = [
+	"public",
+	"member",
+	"participant"
+];
+/** Where each audience's documents live under `apps/{aid}`. `public` is not
+*  here: it keeps `config/public` + `config/view`, which are already published
+*  and already read by a deployed runtime. */
+var VIEW_TIER = {
+	member: "member",
+	participant: "roster"
+};
+/** The id `public.view` normalizes to. Fixed rather than derived, so two
+*  implementations of the same normalization cannot pick different ones. */
+var PUBLIC_VIEW_ID = "public";
+/** `config` is the projection's own document in every tier (`live:config`),
+*  so a view may not be called that — the two would be the same document. */
+var RESERVED_VIEW_IDS = ["config"];
+/** What an id may be.
+*
+*  Narrow on purpose: this value is written by the author, and it becomes a
+*  Firestore document id under a `live:` / `staged:` prefix. Excluding `:`
+*  keeps the prefix and the id from running together; excluding `/`, `.` and
+*  `__…__` keeps it a legal document id that addresses the path it says. */
+var VIEW_ID_PATTERN = /^[a-z0-9][a-z0-9-]{0,63}$/;
+var VIEW_ID_SHAPE = "must be lowercase letters, digits and hyphens, start with a letter or digit, and be at most 64 characters (e.g. front-desk)";
+/** Both declarations of the same thing, in one file.
+*
+*  Refused rather than merged or preferred: whichever way it were resolved,
+*  the author would have written two answers and been shown neither. */
+var BOTH_FORMS = "app.json declares both `views` and `public.view`. These are the same thing — `public.view` is the older spelling — and publishing would have to choose one silently. Move the `public.view` entry into `views` as { id: \"public\", audience: \"public\", … } and delete it.";
+/** The two declarations, as one list, or the refusal that they are both there.
+*
+*  `public.view` becomes an entry under the reserved id, so everything
+*  downstream reads one shape and "which spelling was used" is decided once. */
+function declaredViews(app) {
+	const legacy = app.public?.view;
+	const authored = app.views;
+	if (legacy !== void 0 && authored !== void 0) return {
+		ok: false,
+		problems: [BOTH_FORMS]
+	};
+	const views = (authored ?? []).map((view, index) => ({
+		id: view.id,
+		audience: view.audience,
+		path: view.path,
+		collections: view.collections,
+		where: `views[${index}]`
+	}));
+	if (legacy === void 0) return {
+		ok: true,
+		views
+	};
+	if (views.some((view) => view.id === "public")) return {
+		ok: false,
+		problems: [`views declares id '${PUBLIC_VIEW_ID}', which is reserved for the older \`public.view\` spelling. ${BOTH_FORMS}`]
+	};
+	return {
+		ok: true,
+		views: [...views, {
+			id: PUBLIC_VIEW_ID,
+			audience: "public",
+			path: legacy.path,
+			collections: legacy.collections,
+			where: "public.view"
+		}]
+	};
+}
+/** Whether one id may be used, and what to say when it may not. */
+function viewIdProblems(view) {
+	if (RESERVED_VIEW_IDS.includes(view.id)) return [`${view.where}.id is '${view.id}', which is reserved: each audience's own declaration is published at that document id.`];
+	if (!VIEW_ID_PATTERN.test(view.id)) return [`${view.where}.id is '${view.id}': a view id ${VIEW_ID_SHAPE}. It becomes the document id this view is published at.`];
+	if (view.id === "public" && view.audience !== "public") return [`${view.where}.id is '${PUBLIC_VIEW_ID}' with audience '${view.audience}': that id belongs to the public page.`];
+	return [];
+}
+/** ONE public page per app, and the reason is the wire rather than taste.
+*
+*  The public runtime reads a single `config/view` document and a single
+*  `config/public.view` declaration beside it. A second `audience: "public"`
+*  entry would pass every other check and then be published nowhere — and
+*  which of the two became the live page would depend on declaration order,
+*  silently. The member tiers have no such limit: `id` is their address, and
+*  each one gets its own document.
+*
+*  The refusal is here rather than "one day we will support it" precisely
+*  because the failure is invisible: nothing errors, and the author sees a
+*  successful publish of a page nobody is served. */
+function singlePublicProblems(views) {
+	const [first, ...rest] = views.filter((view) => view.audience === "public");
+	if (first === void 0) return [];
+	return rest.map((view) => `${view.where} is a second audience "public" view, after ${first.where}. The public page is published at ONE document (config/view), so only one of them could ever be served — and which, would depend on the order they were written in. Give the others audience "member" or "participant", which are addressed by id and may have as many as the app needs.`);
+}
+/** The one shape everything downstream reads.
+*
+*  Every caller — the publish gate, the projection, the host that writes the
+*  documents — goes through this, so "which declaration was used" is decided
+*  exactly once. */
+function normalizeViews(app) {
+	const declared = declaredViews(app);
+	if (!declared.ok) return declared;
+	const problems = [...singlePublicProblems(declared.views)];
+	const seen = /* @__PURE__ */ new Map();
+	for (const view of declared.views) {
+		problems.push(...viewIdProblems(view));
+		const first = seen.get(view.id);
+		if (first === void 0) {
+			seen.set(view.id, view.where);
+			continue;
+		}
+		problems.push(`${view.where}.id is '${view.id}', which ${first} already uses. The id is the document a view is published at, so two of them are one page — whichever was written second would silently replace the first, in staging and again at publish.`);
+	}
+	return problems.length > 0 ? {
+		ok: false,
+		problems
+	} : {
+		ok: true,
+		views: declared.views
+	};
+}
+/** How a participant reaches `cid`, or null if they cannot.
+*
+*  Mirrors the rules' read branches for someone holding no role:
+*  `partRead` (the whole collection) and `ownRow` (their own record, found
+*  by the submit declaration's `emailField` or by a uid-derived id).
+*
+*  `participantRead` is a PARAMETER rather than read off the manifest, and
+*  that is the whole point of the signature. Publish does not promote the
+*  manifest's value: `projectPublish` overwrites `participantRead` with what
+*  the STAGED schemas carry, so a cid added since the last deploy is in the
+*  manifest and not in the rules. Deriving the scope from the manifest would
+*  publish `scope: "all"` for a collection the promoted rules then deny —
+*  and removing one gives the mirror-image false refusal. The caller passes
+*  the set that will actually be in force. */
+function participantScope(app, cid, participantRead) {
+	if (participantRead.includes(cid)) return {
+		cid,
+		scope: "all"
+	};
+	const submit = app.public?.submit?.[cid];
+	if (submit?.emailField !== void 0) return {
+		cid,
+		scope: "own",
+		emailField: submit.emailField
+	};
+	if (submit?.idFrom === "auth.uid") return {
+		cid,
+		scope: "own",
+		ownDocId: "auth.uid"
+	};
+	return null;
+}
+/** The document ids one tier uses. `live:` and `staged:` are the only two
+*  prefixes, so a single `match` covers the projection and every view. */
+var viewDocId = (stage, viewId) => `${stage}:${viewId}`;
+var VIEW_CONFIG_ID = "config";
+//#endregion
 //#region src/collection/server/publishManifest.ts
 /** A collection id / app id, held to the one name rule (`SAFE_SLUG_PATTERN`)
 *  that `sharedCollectionKey` applies. Stated once so a path built later
@@ -264,6 +424,28 @@ var PublicZ = z.object({
 	}).strict().optional(),
 	submit: z.record(NameZ, SubmitZ).optional()
 }).strict();
+/** One page the app shows, and who it is for.
+*
+*  Generalised from `public.view` (which is still accepted, and normalizes
+*  into this — see `appViews.ts`). The audience is what decides which document
+*  the HTML is published to, and therefore who may read it: a rule cannot hide
+*  a field, so "the front desk sees this" is a place, not a filter.
+*
+*  `id` is not decoration. It becomes the document id the page is published
+*  at, which is what lets one audience have more than one page — the front
+*  desk and the stock room — and what lets a withdrawn view be found and
+*  deleted. Its grammar is enforced at the gate, not here, so the refusal can
+*  say what the value is used for.
+*
+*  `collections` is declared rather than inferred, for the reason `public.view`
+*  gives: an inferred list renders a perfect page with no data in it, and
+*  nothing anywhere says why. */
+var ViewZ = z.object({
+	id: z.string().trim().min(1),
+	audience: z.enum(VIEW_AUDIENCES),
+	path: z.string().trim().min(1),
+	collections: z.array(NameZ).min(1)
+}).strict();
 /** The URL name an app is handed out under: `https://<host>/{slug}`.
 *
 *  A SEPARATE name from the `aid`, and that separation is the point (design
@@ -312,7 +494,10 @@ var AuthoredAppZ = z.object({
 	members: MembersZ,
 	collections: z.record(NameZ, CollectionConfigZ).optional(),
 	participantRead: z.array(NameZ).optional(),
-	public: PublicZ.optional()
+	public: PublicZ.optional(),
+	/** The app's pages, per audience. See {@link ViewZ}; `public.view` is the
+	*  older spelling of the `public` one and normalizes into this list. */
+	views: z.array(ViewZ).optional()
 }).strict();
 /** Parse the authored declaration out of `app.json`'s text.
 *
@@ -441,11 +626,14 @@ function projectApp(authored, schemas, stamp, existing) {
 		publishedDirty: stamp.dirty === true ? true : void 0,
 		previousPublished: previousOf(existing)
 	});
+	const normalized = normalizeViews(authored);
+	if (!normalized.ok) throw new Error(`publish: views declaration is not publishable (${normalized.problems.join(" ")})`);
+	const publicView = normalized.views.find((view) => view.audience === "public");
 	const config = {
 		enabled: authored.public?.enabled === true,
 		read: authored.public?.read ?? [],
 		submit,
-		...authored.public?.view === void 0 ? {} : { view: { collections: authored.public.view.collections } },
+		...publicView === void 0 ? {} : { view: { collections: publicView.collections } },
 		publishedAt: stamp.publishedAt
 	};
 	if (authored.name !== void 0) config.name = authored.name;
@@ -596,6 +784,64 @@ var appSlugDoc = (aid, published) => ({
 var appStagingPath = (aid) => `apps/${aid}/staging`;
 /** The public-config documents' parent path. */
 var appConfigPath = (aid) => `apps/${aid}/config`;
+/** Where one audience's pages live. `member` is read by anyone holding a role;
+*  `roster` by anyone on the roster, participants included. */
+var appViewTierPath = (aid, tier) => `apps/${aid}/${tier}`;
+/** What one audience may see of one collection.
+*
+*  For `member` this is always the whole collection: every read branch a role
+*  opens (`readerOf`) is unscoped. Whether THIS member holds the role is not
+*  knowable here — one projection is read by every member of the tier — and is
+*  settled where it can be, by the entrance trying the read.
+*
+*  For `participant` it is the rules' own answer, which is why it can be null:
+*  a participant with neither `participantRead` nor an own-row submit path
+*  cannot read the collection at all, and a page handed it would fail rather
+*  than render less. */
+function scopeFor(authored, audience, cid, participantRead) {
+	return audience === "member" ? {
+		cid,
+		scope: "all"
+	} : participantScope(authored, cid, participantRead);
+}
+/** Project the declaration into the per-audience documents.
+*
+*  Pure, like `projectApp`: the HTML is not here (the host reads the files),
+*  and neither is the clock. What is here is the answer to "what may this
+*  audience read, and how" — computed once, so the page never has to guess and
+*  never has to discover it from a denial. */
+function projectAppViews(authored, stamp, promoted) {
+	const participantRead = promoted?.participantRead ?? authored.participantRead ?? [];
+	const normalized = normalizeViews(authored);
+	if (!normalized.ok) throw new Error(`publish: views declaration is not publishable (${normalized.problems.join(" ")})`);
+	return ["member", "participant"].map((audience) => {
+		const views = normalized.views.filter((view) => view.audience === audience);
+		const cids = [...new Set(views.flatMap((view) => view.collections))];
+		const declaredSubmit = authored.public?.submit ?? {};
+		const submit = Object.fromEntries(cids.flatMap((cid) => {
+			const spec = declaredSubmit[cid];
+			return spec === void 0 ? [] : [[cid, projectSubmit(spec)]];
+		}));
+		const config = {
+			views: views.map((view) => ({
+				id: view.id,
+				collections: view.collections.map((cid) => scopeFor(authored, audience, cid, participantRead)).filter((scope) => scope !== null)
+			})),
+			submit,
+			publishedAt: stamp.publishedAt
+		};
+		if (authored.name !== void 0) config.name = authored.name;
+		return {
+			tier: VIEW_TIER[audience],
+			audience,
+			config,
+			views
+		};
+	});
+}
+/** The document a tier's projection is published at. Beside the views
+*  themselves, under one `match` — see `firestore.rules`. */
+var viewConfigDocId = (stage) => viewDocId(stage, VIEW_CONFIG_ID);
 //#endregion
 //#region src/collection/server/publishChecks.ts
 /** Does this submit declaration bind a record to the submitter's identity?
@@ -871,7 +1117,7 @@ function publishProblems(app, collections, publisherEmail) {
 		...windowRefProblems(app, collections),
 		...idTargetProblems(app, collections),
 		...mirrorProblems(app, collections),
-		...publicViewProblems(app, collections)
+		...viewProblems(app, collections)
 	];
 }
 /** A public submission must NOT be allowed to name its own primary key.
@@ -1002,24 +1248,56 @@ function mirrorOfProblems(app, cid, collection, known, names) {
 	if (app.public?.submit?.[authority]?.mirror !== cid) return [`collections.${cid}.mirrorOf names '${authority}', but public.submit.${authority} does not declare mirror: "${cid}". Only the pair keeps the projection honest: without the other half a record can be created without moving this one, and the public page goes on offering something that is already taken.`];
 	return [];
 }
-/** What the public view is handed. Declared, never inferred — a view whose
-*  datasets were guessed from `public.read` renders perfectly and draws an
-*  empty grid, with nothing in the page, the rules or the log to say why. */
-function publicViewProblems(app, collections) {
-	const view = app.public?.view;
-	if (view === void 0) return [];
+/** What each view is handed, and whether its audience can actually read it.
+*
+*  Declared, never inferred — a view whose datasets were guessed from
+*  `public.read` renders perfectly and draws an empty grid, with nothing in
+*  the page, the rules or the log to say why.
+*
+*  The reachability check below is that same failure, once per audience. A
+*  `public` view naming a collection outside `public.read` draws nothing; a
+*  `participant` view naming one the participant reaches by neither
+*  `participantRead` nor their own row is worse, because an unscoped list on
+*  an own-row collection is DENIED rather than narrowed — the page does not
+*  render less, it fails.
+*
+*  There is deliberately no such check for `member`. Every read a role opens
+*  is unscoped, and WHICH role a given member holds is not a property of the
+*  declaration: a stylist scoped to `bookings` and an owner read the same
+*  projection. That one is settled at the entrance, by trying the read. */
+/** The path, for one view. The SAME validator the host's own custom views use,
+*  rather than a second opinion about what a safe view path is.
+*
+*  Two ad-hoc attempts were wrong here in the same afternoon: a prefix-and-
+*  suffix test let `views/../../secrets.html` through, and `views/[^/]+\.html`
+*  still let `views/..\..\secrets.html` through, because a backslash is not a
+*  slash on this side of the check and IS a separator on Windows. This one
+*  rejects `..`, backslashes, leading slashes and anything outside
+*  `[A-Za-z0-9._-]` per segment.
+*
+*  It matters more here than for a host view: the host reads this path to
+*  decide which file to copy onto a document other people read — for a public
+*  view, a document whose rule is `allow read: if true`, so the blast radius of
+*  a bad path is the world rather than the author's own iframe. Nested paths
+*  ARE allowed by the shared validator; the extra `views/<one name>.html` shape
+*  is this publisher's own narrowing, kept because there is no reason for a
+*  published view to live in a subdirectory. */
+function viewPathProblems(view) {
+	if (isSafeCustomViewPath(view.path) && view.path.split("/").length === 2) return [];
+	return [`${view.where}.path is '${view.path}': a published view is exactly one HTML file directly inside the collection's own views/ directory (e.g. views/booking.html) — no sub-directories, and no segments that climb out of it. The host reads this as a file to publish.`];
+}
+/** One dataset, for one view: does it exist here, and can the audience it is
+*  handed to actually read it? */
+function viewCollectionProblems(app, view, cid, known) {
+	if (!known.has(cid)) return [`${view.where}.collections names '${cid}', which is not a shared collection in this repository. Shared collections here: ${known.size > 0 ? [...known].sort().join(", ") : "(none)"}.`];
+	if (view.audience === "public" && !(app.public?.read ?? []).includes(cid)) return [`${view.where}.collections names '${cid}', which is not in public.read: the page reads these with the VISITOR's permissions, so the rules refuse the read and the view draws an empty page. Nothing errors — this is the failure that looks like a working view with no data.`];
+	return [];
+}
+function viewProblems(app, collections) {
+	const normalized = normalizeViews(app);
+	if (!normalized.ok) return normalized.problems;
 	const known = new Set(collections.map((collection) => collection.cid));
-	const readable = new Set(app.public?.read ?? []);
-	const problems = [];
-	if (!isSafeCustomViewPath(view.path) || view.path.split("/").length !== 2) problems.push(`public.view.path is '${view.path}': a published view is exactly one HTML file directly inside the collection's own views/ directory (e.g. views/booking.html) — no sub-directories, and no segments that climb out of it. The host reads this as a file to publish, and what it publishes is world-readable.`);
-	for (const cid of view.collections) {
-		if (!known.has(cid)) {
-			problems.push(`public.view.collections names '${cid}', which is not a shared collection in this repository. Shared collections here: ${known.size > 0 ? [...known].sort().join(", ") : "(none)"}.`);
-			continue;
-		}
-		if (!readable.has(cid)) problems.push(`public.view.collections names '${cid}', which is not in public.read: the page reads these with the VISITOR's permissions, so the rules refuse the read and the view draws an empty page. Nothing errors — this is the failure that looks like a working view with no data.`);
-	}
-	return problems;
+	return normalized.views.flatMap((view) => [...viewPathProblems(view), ...view.collections.flatMap((cid) => viewCollectionProblems(app, view, cid, known))]);
 }
 /** What publish will actually promote, checked as the PAIR it becomes.
 *
@@ -1051,9 +1329,25 @@ function promotedRoleProblems(app, staged) {
 	return [
 		...promotedAssigneeProblems(app, promoted, stagedCids),
 		...promotedMirrorProblems(app, promoted, stagedCids),
-		...promotedRefFieldProblems(app, staged)
+		...promotedRefFieldProblems(app, staged),
+		...promotedParticipantViewProblems(app, staged)
 	];
 }
+/** A participant's page, checked against the `participantRead` publish will
+*  actually PROMOTE.
+*
+*  Not against the manifest's. `projectPublish` overwrites `participantRead`
+*  with what the staged schemas carry, so a cid added to the manifest since the
+*  last deploy is not in the rules — and a page written for it would be
+*  published, offered, and then refused the read. The manifest half of this
+*  file cannot see that; the promoted half can, which is why the check lives
+*  here rather than beside the other view checks. */
+function promotedParticipantViewProblems(app, staged) {
+	const normalized = normalizeViews(app);
+	if (!normalized.ok) return [];
+	const participantRead = stagedRuleConfig(staged).participantRead ?? [];
+	return normalized.views.filter((view) => view.audience === "participant").flatMap((view) => view.collections.filter((cid) => participantScope(app, cid, participantRead) === null).map((cid) => `${view.where}.collections names '${cid}', which a participant cannot read once this publishes: it is not in the participantRead that DEPLOY staged, and public.submit.${cid} declares neither an emailField nor idFrom "auth.uid", so there is no row the rules would call theirs. The page would be refused the read, not handed fewer records. (Adding it to participantRead in app.json is not enough — deploy first.)`));
+}
 /** The FIELDS a rule reads off another record — `idIn.where.field` and the two
 *  window bounds — checked against the schema publish is about to promote.
 *
@@ -3258,6 +3552,6 @@ function makeManageCollectionTool(deps = {}) {
 	};
 }
 //#endregion
-export { AuthoredAppZ as $, runQueryOverRows as A, APPS_COLLECTION as B, STORE_UNREADABLE as C, recordFieldProblem as D, compileRecordZ as E, readCustomViewI18n as F, appSlugDoc as G, PUBLIC_CONFIG_DOC as H, readSkillTemplate as I, projectDeploy as J, appStagingPath as K, bindsSubmitterIdentity as L, buildCollectionActionSeedPrompt as M, promptPathsFor as N, runCollectionQuery as O, readCustomViewHtml as P, APP_ROLES as Q, promotedRoleProblems as R, MAX_RECORD_ISSUES as S, validateRecordObject as T, appConfigPath as U, APP_SLUGS_COLLECTION as V, appSchemasPath as W, promoteSchema as X, projectPublish as Y, stagedRuleConfig as Z, computeCollectionIcon as _, deleteCollection as a, applyMutateAction as b, computeSuccessor as c, isTriggerDue as d, parseAuthoredApp as et, maybeSpawnSuccessor as f, ONE_SECOND_MS as g, successorId as h, deleteCustomView as i, buildActionSeedPrompt as j, enrichItems as k, daysInMonth as l, resolveEvery as m, MAX_UNSELECTIVE_ITEMS as n, deleteCollectionRefusalMessage as o, parseCivil as p, projectApp as q, makeManageCollectionTool as r, advanceTriggerDate as s, MAX_SCHEMA_ISSUES as t, formatCivil as u, buildWorkspaceOntology as v, validateCollectionRecords as w, firstMutateParamProblem as x, schemaRelations as y, publishProblems as z };
+export { stagedRuleConfig as $, runQueryOverRows as A, APPS_COLLECTION as B, STORE_UNREADABLE as C, recordFieldProblem as D, compileRecordZ as E, readCustomViewI18n as F, appSlugDoc as G, PUBLIC_CONFIG_DOC as H, readSkillTemplate as I, projectApp as J, appStagingPath as K, bindsSubmitterIdentity as L, buildCollectionActionSeedPrompt as M, promptPathsFor as N, runCollectionQuery as O, readCustomViewHtml as P, promoteSchema as Q, promotedRoleProblems as R, MAX_RECORD_ISSUES as S, validateRecordObject as T, appConfigPath as U, APP_SLUGS_COLLECTION as V, appSchemasPath as W, projectDeploy as X, projectAppViews as Y, projectPublish as Z, computeCollectionIcon as _, deleteCollection as a, RESERVED_VIEW_IDS as at, applyMutateAction as b, computeSuccessor as c, VIEW_ID_PATTERN as ct, isTriggerDue as d, participantScope as dt, viewConfigDocId as et, maybeSpawnSuccessor as f, viewDocId as ft, ONE_SECOND_MS as g, successorId as h, deleteCustomView as i, PUBLIC_VIEW_ID as it, buildActionSeedPrompt as j, enrichItems as k, daysInMonth as l, VIEW_TIER as lt, resolveEvery as m, MAX_UNSELECTIVE_ITEMS as n, AuthoredAppZ as nt, deleteCollectionRefusalMessage as o, VIEW_AUDIENCES as ot, parseCivil as p, appViewTierPath as q, makeManageCollectionTool as r, parseAuthoredApp as rt, advanceTriggerDate as s, VIEW_CONFIG_ID as st, MAX_SCHEMA_ISSUES as t, APP_ROLES as tt, formatCivil as u, normalizeViews as ut, buildWorkspaceOntology as v, validateCollectionRecords as w, firstMutateParamProblem as x, schemaRelations as y, publishProblems as z };
 
-//# sourceMappingURL=server-DGjmK9vU.js.map
+//# sourceMappingURL=server-CQSF5fHe.js.map