@mulmoclaude/core 3.13.0 → 3.14.0

package/dist/{server-_g1rW-Uc.cjs → server-DknYbXBo.cjs}

@@ -13,6 +13,166 @@ node_path = require_rolldown_runtime.__toESM(node_path, 1);
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 let zod = require("zod");
+//#region src/collection/server/appViews.ts
+/** The audiences a view may be written for. A CLOSED set: each one names a
+*  tier with a rule behind it, so an unknown value has nowhere to be
+*  published to and is refused before it gets there. */
+var VIEW_AUDIENCES = [
+	"public",
+	"member",
+	"participant"
+];
+/** Where each audience's documents live under `apps/{aid}`. `public` is not
+*  here: it keeps `config/public` + `config/view`, which are already published
+*  and already read by a deployed runtime. */
+var VIEW_TIER = {
+	member: "member",
+	participant: "roster"
+};
+/** The id `public.view` normalizes to. Fixed rather than derived, so two
+*  implementations of the same normalization cannot pick different ones. */
+var PUBLIC_VIEW_ID = "public";
+/** `config` is the projection's own document in every tier (`live:config`),
+*  so a view may not be called that — the two would be the same document. */
+var RESERVED_VIEW_IDS = ["config"];
+/** What an id may be.
+*
+*  Narrow on purpose: this value is written by the author, and it becomes a
+*  Firestore document id under a `live:` / `staged:` prefix. Excluding `:`
+*  keeps the prefix and the id from running together; excluding `/`, `.` and
+*  `__…__` keeps it a legal document id that addresses the path it says. */
+var VIEW_ID_PATTERN = /^[a-z0-9][a-z0-9-]{0,63}$/;
+var VIEW_ID_SHAPE = "must be lowercase letters, digits and hyphens, start with a letter or digit, and be at most 64 characters (e.g. front-desk)";
+/** Both declarations of the same thing, in one file.
+*
+*  Refused rather than merged or preferred: whichever way it were resolved,
+*  the author would have written two answers and been shown neither. */
+var BOTH_FORMS = "app.json declares both `views` and `public.view`. These are the same thing — `public.view` is the older spelling — and publishing would have to choose one silently. Move the `public.view` entry into `views` as { id: \"public\", audience: \"public\", … } and delete it.";
+/** The two declarations, as one list, or the refusal that they are both there.
+*
+*  `public.view` becomes an entry under the reserved id, so everything
+*  downstream reads one shape and "which spelling was used" is decided once. */
+function declaredViews(app) {
+	const legacy = app.public?.view;
+	const authored = app.views;
+	if (legacy !== void 0 && authored !== void 0) return {
+		ok: false,
+		problems: [BOTH_FORMS]
+	};
+	const views = (authored ?? []).map((view, index) => ({
+		id: view.id,
+		audience: view.audience,
+		path: view.path,
+		collections: view.collections,
+		where: `views[${index}]`
+	}));
+	if (legacy === void 0) return {
+		ok: true,
+		views
+	};
+	if (views.some((view) => view.id === "public")) return {
+		ok: false,
+		problems: [`views declares id '${PUBLIC_VIEW_ID}', which is reserved for the older \`public.view\` spelling. ${BOTH_FORMS}`]
+	};
+	return {
+		ok: true,
+		views: [...views, {
+			id: PUBLIC_VIEW_ID,
+			audience: "public",
+			path: legacy.path,
+			collections: legacy.collections,
+			where: "public.view"
+		}]
+	};
+}
+/** Whether one id may be used, and what to say when it may not. */
+function viewIdProblems(view) {
+	if (RESERVED_VIEW_IDS.includes(view.id)) return [`${view.where}.id is '${view.id}', which is reserved: each audience's own declaration is published at that document id.`];
+	if (!VIEW_ID_PATTERN.test(view.id)) return [`${view.where}.id is '${view.id}': a view id ${VIEW_ID_SHAPE}. It becomes the document id this view is published at.`];
+	if (view.id === "public" && view.audience !== "public") return [`${view.where}.id is '${PUBLIC_VIEW_ID}' with audience '${view.audience}': that id belongs to the public page.`];
+	return [];
+}
+/** ONE public page per app, and the reason is the wire rather than taste.
+*
+*  The public runtime reads a single `config/view` document and a single
+*  `config/public.view` declaration beside it. A second `audience: "public"`
+*  entry would pass every other check and then be published nowhere — and
+*  which of the two became the live page would depend on declaration order,
+*  silently. The member tiers have no such limit: `id` is their address, and
+*  each one gets its own document.
+*
+*  The refusal is here rather than "one day we will support it" precisely
+*  because the failure is invisible: nothing errors, and the author sees a
+*  successful publish of a page nobody is served. */
+function singlePublicProblems(views) {
+	const [first, ...rest] = views.filter((view) => view.audience === "public");
+	if (first === void 0) return [];
+	return rest.map((view) => `${view.where} is a second audience "public" view, after ${first.where}. The public page is published at ONE document (config/view), so only one of them could ever be served — and which, would depend on the order they were written in. Give the others audience "member" or "participant", which are addressed by id and may have as many as the app needs.`);
+}
+/** The one shape everything downstream reads.
+*
+*  Every caller — the publish gate, the projection, the host that writes the
+*  documents — goes through this, so "which declaration was used" is decided
+*  exactly once. */
+function normalizeViews(app) {
+	const declared = declaredViews(app);
+	if (!declared.ok) return declared;
+	const problems = [...singlePublicProblems(declared.views)];
+	const seen = /* @__PURE__ */ new Map();
+	for (const view of declared.views) {
+		problems.push(...viewIdProblems(view));
+		const first = seen.get(view.id);
+		if (first === void 0) {
+			seen.set(view.id, view.where);
+			continue;
+		}
+		problems.push(`${view.where}.id is '${view.id}', which ${first} already uses. The id is the document a view is published at, so two of them are one page — whichever was written second would silently replace the first, in staging and again at publish.`);
+	}
+	return problems.length > 0 ? {
+		ok: false,
+		problems
+	} : {
+		ok: true,
+		views: declared.views
+	};
+}
+/** How a participant reaches `cid`, or null if they cannot.
+*
+*  Mirrors the rules' read branches for someone holding no role:
+*  `partRead` (the whole collection) and `ownRow` (their own record, found
+*  by the submit declaration's `emailField` or by a uid-derived id).
+*
+*  `participantRead` is a PARAMETER rather than read off the manifest, and
+*  that is the whole point of the signature. Publish does not promote the
+*  manifest's value: `projectPublish` overwrites `participantRead` with what
+*  the STAGED schemas carry, so a cid added since the last deploy is in the
+*  manifest and not in the rules. Deriving the scope from the manifest would
+*  publish `scope: "all"` for a collection the promoted rules then deny —
+*  and removing one gives the mirror-image false refusal. The caller passes
+*  the set that will actually be in force. */
+function participantScope(app, cid, participantRead) {
+	if (participantRead.includes(cid)) return {
+		cid,
+		scope: "all"
+	};
+	const submit = app.public?.submit?.[cid];
+	if (submit?.emailField !== void 0) return {
+		cid,
+		scope: "own",
+		emailField: submit.emailField
+	};
+	if (submit?.idFrom === "auth.uid") return {
+		cid,
+		scope: "own",
+		ownDocId: "auth.uid"
+	};
+	return null;
+}
+/** The document ids one tier uses. `live:` and `staged:` are the only two
+*  prefixes, so a single `match` covers the projection and every view. */
+var viewDocId = (stage, viewId) => `${stage}:${viewId}`;
+var VIEW_CONFIG_ID = "config";
+//#endregion
 //#region src/collection/server/publishManifest.ts
 /** A collection id / app id, held to the one name rule (`SAFE_SLUG_PATTERN`)
 *  that `sharedCollectionKey` applies. Stated once so a path built later
@@ -266,6 +426,28 @@ var PublicZ = zod.z.object({
 	}).strict().optional(),
 	submit: zod.z.record(NameZ, SubmitZ).optional()
 }).strict();
+/** One page the app shows, and who it is for.
+*
+*  Generalised from `public.view` (which is still accepted, and normalizes
+*  into this — see `appViews.ts`). The audience is what decides which document
+*  the HTML is published to, and therefore who may read it: a rule cannot hide
+*  a field, so "the front desk sees this" is a place, not a filter.
+*
+*  `id` is not decoration. It becomes the document id the page is published
+*  at, which is what lets one audience have more than one page — the front
+*  desk and the stock room — and what lets a withdrawn view be found and
+*  deleted. Its grammar is enforced at the gate, not here, so the refusal can
+*  say what the value is used for.
+*
+*  `collections` is declared rather than inferred, for the reason `public.view`
+*  gives: an inferred list renders a perfect page with no data in it, and
+*  nothing anywhere says why. */
+var ViewZ = zod.z.object({
+	id: zod.z.string().trim().min(1),
+	audience: zod.z.enum(VIEW_AUDIENCES),
+	path: zod.z.string().trim().min(1),
+	collections: zod.z.array(NameZ).min(1)
+}).strict();
 /** The URL name an app is handed out under: `https://<host>/{slug}`.
 *
 *  A SEPARATE name from the `aid`, and that separation is the point (design
@@ -314,7 +496,10 @@ var AuthoredAppZ = zod.z.object({
 	members: MembersZ,
 	collections: zod.z.record(NameZ, CollectionConfigZ).optional(),
 	participantRead: zod.z.array(NameZ).optional(),
-	public: PublicZ.optional()
+	public: PublicZ.optional(),
+	/** The app's pages, per audience. See {@link ViewZ}; `public.view` is the
+	*  older spelling of the `public` one and normalizes into this list. */
+	views: zod.z.array(ViewZ).optional()
 }).strict();
 /** Parse the authored declaration out of `app.json`'s text.
 *
@@ -443,11 +628,14 @@ function projectApp(authored, schemas, stamp, existing) {
 		publishedDirty: stamp.dirty === true ? true : void 0,
 		previousPublished: previousOf(existing)
 	});
+	const normalized = normalizeViews(authored);
+	if (!normalized.ok) throw new Error(`publish: views declaration is not publishable (${normalized.problems.join(" ")})`);
+	const publicView = normalized.views.find((view) => view.audience === "public");
 	const config = {
 		enabled: authored.public?.enabled === true,
 		read: authored.public?.read ?? [],
 		submit,
-		...authored.public?.view === void 0 ? {} : { view: { collections: authored.public.view.collections } },
+		...publicView === void 0 ? {} : { view: { collections: publicView.collections } },
 		publishedAt: stamp.publishedAt
 	};
 	if (authored.name !== void 0) config.name = authored.name;
@@ -598,6 +786,64 @@ var appSlugDoc = (aid, published) => ({
 var appStagingPath = (aid) => `apps/${aid}/staging`;
 /** The public-config documents' parent path. */
 var appConfigPath = (aid) => `apps/${aid}/config`;
+/** Where one audience's pages live. `member` is read by anyone holding a role;
+*  `roster` by anyone on the roster, participants included. */
+var appViewTierPath = (aid, tier) => `apps/${aid}/${tier}`;
+/** What one audience may see of one collection.
+*
+*  For `member` this is always the whole collection: every read branch a role
+*  opens (`readerOf`) is unscoped. Whether THIS member holds the role is not
+*  knowable here — one projection is read by every member of the tier — and is
+*  settled where it can be, by the entrance trying the read.
+*
+*  For `participant` it is the rules' own answer, which is why it can be null:
+*  a participant with neither `participantRead` nor an own-row submit path
+*  cannot read the collection at all, and a page handed it would fail rather
+*  than render less. */
+function scopeFor(authored, audience, cid, participantRead) {
+	return audience === "member" ? {
+		cid,
+		scope: "all"
+	} : participantScope(authored, cid, participantRead);
+}
+/** Project the declaration into the per-audience documents.
+*
+*  Pure, like `projectApp`: the HTML is not here (the host reads the files),
+*  and neither is the clock. What is here is the answer to "what may this
+*  audience read, and how" — computed once, so the page never has to guess and
+*  never has to discover it from a denial. */
+function projectAppViews(authored, stamp, promoted) {
+	const participantRead = promoted?.participantRead ?? authored.participantRead ?? [];
+	const normalized = normalizeViews(authored);
+	if (!normalized.ok) throw new Error(`publish: views declaration is not publishable (${normalized.problems.join(" ")})`);
+	return ["member", "participant"].map((audience) => {
+		const views = normalized.views.filter((view) => view.audience === audience);
+		const cids = [...new Set(views.flatMap((view) => view.collections))];
+		const declaredSubmit = authored.public?.submit ?? {};
+		const submit = Object.fromEntries(cids.flatMap((cid) => {
+			const spec = declaredSubmit[cid];
+			return spec === void 0 ? [] : [[cid, projectSubmit(spec)]];
+		}));
+		const config = {
+			views: views.map((view) => ({
+				id: view.id,
+				collections: view.collections.map((cid) => scopeFor(authored, audience, cid, participantRead)).filter((scope) => scope !== null)
+			})),
+			submit,
+			publishedAt: stamp.publishedAt
+		};
+		if (authored.name !== void 0) config.name = authored.name;
+		return {
+			tier: VIEW_TIER[audience],
+			audience,
+			config,
+			views
+		};
+	});
+}
+/** The document a tier's projection is published at. Beside the views
+*  themselves, under one `match` — see `firestore.rules`. */
+var viewConfigDocId = (stage) => viewDocId(stage, VIEW_CONFIG_ID);
 //#endregion
 //#region src/collection/server/publishChecks.ts
 /** Does this submit declaration bind a record to the submitter's identity?
@@ -873,7 +1119,7 @@ function publishProblems(app, collections, publisherEmail) {
 		...windowRefProblems(app, collections),
 		...idTargetProblems(app, collections),
 		...mirrorProblems(app, collections),
-		...publicViewProblems(app, collections)
+		...viewProblems(app, collections)
 	];
 }
 /** A public submission must NOT be allowed to name its own primary key.
@@ -1004,24 +1250,56 @@ function mirrorOfProblems(app, cid, collection, known, names) {
 	if (app.public?.submit?.[authority]?.mirror !== cid) return [`collections.${cid}.mirrorOf names '${authority}', but public.submit.${authority} does not declare mirror: "${cid}". Only the pair keeps the projection honest: without the other half a record can be created without moving this one, and the public page goes on offering something that is already taken.`];
 	return [];
 }
-/** What the public view is handed. Declared, never inferred — a view whose
-*  datasets were guessed from `public.read` renders perfectly and draws an
-*  empty grid, with nothing in the page, the rules or the log to say why. */
-function publicViewProblems(app, collections) {
-	const view = app.public?.view;
-	if (view === void 0) return [];
+/** What each view is handed, and whether its audience can actually read it.
+*
+*  Declared, never inferred — a view whose datasets were guessed from
+*  `public.read` renders perfectly and draws an empty grid, with nothing in
+*  the page, the rules or the log to say why.
+*
+*  The reachability check below is that same failure, once per audience. A
+*  `public` view naming a collection outside `public.read` draws nothing; a
+*  `participant` view naming one the participant reaches by neither
+*  `participantRead` nor their own row is worse, because an unscoped list on
+*  an own-row collection is DENIED rather than narrowed — the page does not
+*  render less, it fails.
+*
+*  There is deliberately no such check for `member`. Every read a role opens
+*  is unscoped, and WHICH role a given member holds is not a property of the
+*  declaration: a stylist scoped to `bookings` and an owner read the same
+*  projection. That one is settled at the entrance, by trying the read. */
+/** The path, for one view. The SAME validator the host's own custom views use,
+*  rather than a second opinion about what a safe view path is.
+*
+*  Two ad-hoc attempts were wrong here in the same afternoon: a prefix-and-
+*  suffix test let `views/../../secrets.html` through, and `views/[^/]+\.html`
+*  still let `views/..\..\secrets.html` through, because a backslash is not a
+*  slash on this side of the check and IS a separator on Windows. This one
+*  rejects `..`, backslashes, leading slashes and anything outside
+*  `[A-Za-z0-9._-]` per segment.
+*
+*  It matters more here than for a host view: the host reads this path to
+*  decide which file to copy onto a document other people read — for a public
+*  view, a document whose rule is `allow read: if true`, so the blast radius of
+*  a bad path is the world rather than the author's own iframe. Nested paths
+*  ARE allowed by the shared validator; the extra `views/<one name>.html` shape
+*  is this publisher's own narrowing, kept because there is no reason for a
+*  published view to live in a subdirectory. */
+function viewPathProblems(view) {
+	if (require_templatePath.isSafeCustomViewPath(view.path) && view.path.split("/").length === 2) return [];
+	return [`${view.where}.path is '${view.path}': a published view is exactly one HTML file directly inside the collection's own views/ directory (e.g. views/booking.html) — no sub-directories, and no segments that climb out of it. The host reads this as a file to publish.`];
+}
+/** One dataset, for one view: does it exist here, and can the audience it is
+*  handed to actually read it? */
+function viewCollectionProblems(app, view, cid, known) {
+	if (!known.has(cid)) return [`${view.where}.collections names '${cid}', which is not a shared collection in this repository. Shared collections here: ${known.size > 0 ? [...known].sort().join(", ") : "(none)"}.`];
+	if (view.audience === "public" && !(app.public?.read ?? []).includes(cid)) return [`${view.where}.collections names '${cid}', which is not in public.read: the page reads these with the VISITOR's permissions, so the rules refuse the read and the view draws an empty page. Nothing errors — this is the failure that looks like a working view with no data.`];
+	return [];
+}
+function viewProblems(app, collections) {
+	const normalized = normalizeViews(app);
+	if (!normalized.ok) return normalized.problems;
 	const known = new Set(collections.map((collection) => collection.cid));
-	const readable = new Set(app.public?.read ?? []);
-	const problems = [];
-	if (!require_templatePath.isSafeCustomViewPath(view.path) || view.path.split("/").length !== 2) problems.push(`public.view.path is '${view.path}': a published view is exactly one HTML file directly inside the collection's own views/ directory (e.g. views/booking.html) — no sub-directories, and no segments that climb out of it. The host reads this as a file to publish, and what it publishes is world-readable.`);
-	for (const cid of view.collections) {
-		if (!known.has(cid)) {
-			problems.push(`public.view.collections names '${cid}', which is not a shared collection in this repository. Shared collections here: ${known.size > 0 ? [...known].sort().join(", ") : "(none)"}.`);
-			continue;
-		}
-		if (!readable.has(cid)) problems.push(`public.view.collections names '${cid}', which is not in public.read: the page reads these with the VISITOR's permissions, so the rules refuse the read and the view draws an empty page. Nothing errors — this is the failure that looks like a working view with no data.`);
-	}
-	return problems;
+	return normalized.views.flatMap((view) => [...viewPathProblems(view), ...view.collections.flatMap((cid) => viewCollectionProblems(app, view, cid, known))]);
 }
 /** What publish will actually promote, checked as the PAIR it becomes.
 *
@@ -1053,9 +1331,25 @@ function promotedRoleProblems(app, staged) {
 	return [
 		...promotedAssigneeProblems(app, promoted, stagedCids),
 		...promotedMirrorProblems(app, promoted, stagedCids),
-		...promotedRefFieldProblems(app, staged)
+		...promotedRefFieldProblems(app, staged),
+		...promotedParticipantViewProblems(app, staged)
 	];
 }
+/** A participant's page, checked against the `participantRead` publish will
+*  actually PROMOTE.
+*
+*  Not against the manifest's. `projectPublish` overwrites `participantRead`
+*  with what the staged schemas carry, so a cid added to the manifest since the
+*  last deploy is not in the rules — and a page written for it would be
+*  published, offered, and then refused the read. The manifest half of this
+*  file cannot see that; the promoted half can, which is why the check lives
+*  here rather than beside the other view checks. */
+function promotedParticipantViewProblems(app, staged) {
+	const normalized = normalizeViews(app);
+	if (!normalized.ok) return [];
+	const participantRead = stagedRuleConfig(staged).participantRead ?? [];
+	return normalized.views.filter((view) => view.audience === "participant").flatMap((view) => view.collections.filter((cid) => participantScope(app, cid, participantRead) === null).map((cid) => `${view.where}.collections names '${cid}', which a participant cannot read once this publishes: it is not in the participantRead that DEPLOY staged, and public.submit.${cid} declares neither an emailField nor idFrom "auth.uid", so there is no row the rules would call theirs. The page would be refused the read, not handed fewer records. (Adding it to participantRead in app.json is not enough — deploy first.)`));
+}
 /** The FIELDS a rule reads off another record — `idIn.where.field` and the two
 *  window bounds — checked against the schema publish is about to promote.
 *
@@ -3314,12 +3608,48 @@ Object.defineProperty(exports, "PUBLIC_CONFIG_DOC", {
 		return PUBLIC_CONFIG_DOC;
 	}
 });
+Object.defineProperty(exports, "PUBLIC_VIEW_ID", {
+	enumerable: true,
+	get: function() {
+		return PUBLIC_VIEW_ID;
+	}
+});
+Object.defineProperty(exports, "RESERVED_VIEW_IDS", {
+	enumerable: true,
+	get: function() {
+		return RESERVED_VIEW_IDS;
+	}
+});
 Object.defineProperty(exports, "STORE_UNREADABLE", {
 	enumerable: true,
 	get: function() {
 		return STORE_UNREADABLE;
 	}
 });
+Object.defineProperty(exports, "VIEW_AUDIENCES", {
+	enumerable: true,
+	get: function() {
+		return VIEW_AUDIENCES;
+	}
+});
+Object.defineProperty(exports, "VIEW_CONFIG_ID", {
+	enumerable: true,
+	get: function() {
+		return VIEW_CONFIG_ID;
+	}
+});
+Object.defineProperty(exports, "VIEW_ID_PATTERN", {
+	enumerable: true,
+	get: function() {
+		return VIEW_ID_PATTERN;
+	}
+});
+Object.defineProperty(exports, "VIEW_TIER", {
+	enumerable: true,
+	get: function() {
+		return VIEW_TIER;
+	}
+});
 Object.defineProperty(exports, "advanceTriggerDate", {
 	enumerable: true,
 	get: function() {
@@ -3350,6 +3680,12 @@ Object.defineProperty(exports, "appStagingPath", {
 		return appStagingPath;
 	}
 });
+Object.defineProperty(exports, "appViewTierPath", {
+	enumerable: true,
+	get: function() {
+		return appViewTierPath;
+	}
+});
 Object.defineProperty(exports, "applyMutateAction", {
 	enumerable: true,
 	get: function() {
@@ -3458,6 +3794,12 @@ Object.defineProperty(exports, "maybeSpawnSuccessor", {
 		return maybeSpawnSuccessor;
 	}
 });
+Object.defineProperty(exports, "normalizeViews", {
+	enumerable: true,
+	get: function() {
+		return normalizeViews;
+	}
+});
 Object.defineProperty(exports, "parseAuthoredApp", {
 	enumerable: true,
 	get: function() {
@@ -3470,12 +3812,24 @@ Object.defineProperty(exports, "parseCivil", {
 		return parseCivil;
 	}
 });
+Object.defineProperty(exports, "participantScope", {
+	enumerable: true,
+	get: function() {
+		return participantScope;
+	}
+});
 Object.defineProperty(exports, "projectApp", {
 	enumerable: true,
 	get: function() {
 		return projectApp;
 	}
 });
+Object.defineProperty(exports, "projectAppViews", {
+	enumerable: true,
+	get: function() {
+		return projectAppViews;
+	}
+});
 Object.defineProperty(exports, "projectDeploy", {
 	enumerable: true,
 	get: function() {
@@ -3584,5 +3938,17 @@ Object.defineProperty(exports, "validateRecordObject", {
 		return validateRecordObject;
 	}
 });
+Object.defineProperty(exports, "viewConfigDocId", {
+	enumerable: true,
+	get: function() {
+		return viewConfigDocId;
+	}
+});
+Object.defineProperty(exports, "viewDocId", {
+	enumerable: true,
+	get: function() {
+		return viewDocId;
+	}
+});
 
-//# sourceMappingURL=server-_g1rW-Uc.cjs.map
+//# sourceMappingURL=server-DknYbXBo.cjs.map