@mulmoclaude/core 3.14.0 → 3.15.0

package/dist/{server-CQSF5fHe.js → server-jm7aGA3g.js}

@@ -170,6 +170,90 @@ function participantScope(app, cid, participantRead) {
 *  prefixes, so a single `match` covers the projection and every view. */
 var viewDocId = (stage, viewId) => `${stage}:${viewId}`;
 var VIEW_CONFIG_ID = "config";
+/** The role a member holds on one collection, by the rules' own resolution:
+*  the per-collection entry, else the `*` fallback, else none. */
+function roleOn(app, address, cid) {
+	const held = app.members[address];
+	if (held === void 0) return void 0;
+	return held[cid] ?? held["*"];
+}
+/** The addresses holding one of `roles` on `cid`.
+*
+*  Sorted, for the same reason `memberEmails` is: a second publish of an
+*  unchanged declaration must produce an unchanged document. */
+function holdersOf(app, cid, roles) {
+	return Object.keys(app.members).filter((address) => roles.includes(roleOn(app, address, cid) ?? "")).sort();
+}
+/** Who may write every row of `cid`, and who may write only their own.
+*
+*  WHY ADDRESSES ARE PUBLISHED AT ALL. One `member/config` document is read by
+*  everyone the tier admits, and the tier only establishes that somebody holds
+*  SOME role SOMEWHERE — so a `viewer`, or a stylist scoped to another
+*  collection, reads the same entry as the front desk. Without these lists the
+*  page would draw approve and reassign for all of them and the rules would
+*  refuse when pressed, which is the declaration/enforcement mismatch this
+*  whole mechanism exists to prevent.
+*
+*  It cannot be answered per principal instead: the document is written once
+*  at publish and read by many, and the reader cannot look their own role up —
+*  `apps/{aid}` is `readerOf(a, '*')`, and a stylist carrying only
+*  `{bookings: "editor"}` holds no `*` role. So the ROSTER'S ANSWER travels
+*  with the declaration and the page compares its own address to it.
+*
+*  The cost is that staff addresses are visible to staff. That is already true
+*  of the approval mail they send each other, and participants read the
+*  `roster` tier, which never carries these.
+*
+*  A SNAPSHOT, like everything else published: a member added since the last
+*  publish is absent until the next one. The rules are the authority either
+*  way — this only decides which buttons are drawn. */
+function writersOf(app, cid) {
+	return holdersOf(app, cid, ["owner", "editor"]);
+}
+/** The transition half: which table applies, and the field it moves.
+*
+*  Both halves or neither. A status field with no table would offer every
+*  value; a table with no field has nothing to write it to. */
+function transitionPart(app, audience, cid) {
+	const config = app.collections?.[cid];
+	const transitions = audience === "member" ? config?.transitions : app.public?.submit?.[cid]?.selfTransitions;
+	if (config?.statusField === void 0 || transitions === void 0) return {};
+	const part = {
+		statusField: config.statusField,
+		transitions
+	};
+	if (audience === "member" && config.mail !== void 0) part.mail = config.mail;
+	return part;
+}
+/** The assignment half. `member` only — see {@link writersOf}.
+*
+*  `rowWriters` rides here rather than beside `writers`, because the
+*  `assignee` role grants nothing at all without a field to compare against
+*  (`isAssigned` in the rules requires one, and publish refuses the pair). */
+function assignPart(app, audience, cid) {
+	const assigneeField = app.collections?.[cid]?.assigneeField;
+	if (audience !== "member" || assigneeField === void 0) return {};
+	return {
+		assigneeField,
+		rowWriters: holdersOf(app, cid, ["assignee"])
+	};
+}
+/** What `audience` may change about `cid`, or null when the answer is nothing.
+*
+*  The two audiences differ in WHICH transition table applies, in whether
+*  assignment exists at all, and in whether the roster's answer travels with
+*  it; they agree that the status field is the collection's, since the rules
+*  read one field either way. */
+function writeFor(app, audience, cid) {
+	const write = {
+		cid,
+		...transitionPart(app, audience, cid),
+		...assignPart(app, audience, cid)
+	};
+	if (Object.keys(write).length === 1) return null;
+	if (audience === "member") write.writers = writersOf(app, cid);
+	return write;
+}
 //#endregion
 //#region src/collection/server/publishManifest.ts
 /** A collection id / app id, held to the one name rule (`SAFE_SLUG_PATTERN`)
@@ -804,37 +888,59 @@ function scopeFor(authored, audience, cid, participantRead) {
 		scope: "all"
 	} : participantScope(authored, cid, participantRead);
 }
-/** Project the declaration into the per-audience documents.
+/** What this audience may CHANGE, per collection it draws.
 *
-*  Pure, like `projectApp`: the HTML is not here (the host reads the files),
-*  and neither is the clock. What is here is the answer to "what may this
-*  audience read, and how" — computed once, so the page never has to guess and
-*  never has to discover it from a denial. */
-function projectAppViews(authored, stamp, promoted) {
-	const participantRead = promoted?.participantRead ?? authored.participantRead ?? [];
+*  The `collections` config is the PROMOTED one where there is one: at publish
+*  the rules run against what deploy staged, so projecting the manifest's
+*  would advertise transitions the live rules deny. */
+function tierWrites(authored, audience, cids, promoted) {
+	const effective = promoted.collections === void 0 ? authored : {
+		...authored,
+		collections: promoted.collections
+	};
+	return cids.map((cid) => writeFor(effective, audience, cid)).filter((entry) => entry !== null);
+}
+/** What this audience may READ, and how to query for it.
+*
+*  A collection with no scope is dropped rather than published as unreachable:
+*  the gate has already refused the declaration, so reaching here with one is
+*  a programming error, and a page that queries it is denied. */
+function tierViews(authored, audience, views, participantRead) {
+	return views.map((view) => ({
+		id: view.id,
+		collections: view.collections.map((cid) => scopeFor(authored, audience, cid, participantRead)).filter((scope) => scope !== null)
+	}));
+}
+/** One tier's projection: what this audience may read, and what it may change. */
+function tierConfig(authored, audience, views, stamp, promoted) {
+	const cids = [...new Set(views.flatMap((view) => view.collections))];
+	const config = {
+		write: tierWrites(authored, audience, cids, promoted),
+		views: tierViews(authored, audience, views, promoted.participantRead ?? authored.participantRead ?? []),
+		submit: tierSubmit(authored, cids),
+		publishedAt: stamp.publishedAt
+	};
+	if (authored.name !== void 0) config.name = authored.name;
+	return config;
+}
+/** The submit declarations for the collections these views draw, so a page can
+*  show what may be sent rather than discovering it from a denial. */
+function tierSubmit(authored, cids) {
+	const declared = authored.public?.submit ?? {};
+	return Object.fromEntries(cids.flatMap((cid) => {
+		const spec = declared[cid];
+		return spec === void 0 ? [] : [[cid, projectSubmit(spec)]];
+	}));
+}
+function projectAppViews(authored, stamp, promoted = {}) {
 	const normalized = normalizeViews(authored);
 	if (!normalized.ok) throw new Error(`publish: views declaration is not publishable (${normalized.problems.join(" ")})`);
 	return ["member", "participant"].map((audience) => {
 		const views = normalized.views.filter((view) => view.audience === audience);
-		const cids = [...new Set(views.flatMap((view) => view.collections))];
-		const declaredSubmit = authored.public?.submit ?? {};
-		const submit = Object.fromEntries(cids.flatMap((cid) => {
-			const spec = declaredSubmit[cid];
-			return spec === void 0 ? [] : [[cid, projectSubmit(spec)]];
-		}));
-		const config = {
-			views: views.map((view) => ({
-				id: view.id,
-				collections: view.collections.map((cid) => scopeFor(authored, audience, cid, participantRead)).filter((scope) => scope !== null)
-			})),
-			submit,
-			publishedAt: stamp.publishedAt
-		};
-		if (authored.name !== void 0) config.name = authored.name;
 		return {
 			tier: VIEW_TIER[audience],
 			audience,
-			config,
+			config: tierConfig(authored, audience, views, stamp, promoted),
 			views
 		};
 	});
@@ -3552,6 +3658,6 @@ function makeManageCollectionTool(deps = {}) {
 	};
 }
 //#endregion
-export { stagedRuleConfig as $, runQueryOverRows as A, APPS_COLLECTION as B, STORE_UNREADABLE as C, recordFieldProblem as D, compileRecordZ as E, readCustomViewI18n as F, appSlugDoc as G, PUBLIC_CONFIG_DOC as H, readSkillTemplate as I, projectApp as J, appStagingPath as K, bindsSubmitterIdentity as L, buildCollectionActionSeedPrompt as M, promptPathsFor as N, runCollectionQuery as O, readCustomViewHtml as P, promoteSchema as Q, promotedRoleProblems as R, MAX_RECORD_ISSUES as S, validateRecordObject as T, appConfigPath as U, APP_SLUGS_COLLECTION as V, appSchemasPath as W, projectDeploy as X, projectAppViews as Y, projectPublish as Z, computeCollectionIcon as _, deleteCollection as a, RESERVED_VIEW_IDS as at, applyMutateAction as b, computeSuccessor as c, VIEW_ID_PATTERN as ct, isTriggerDue as d, participantScope as dt, viewConfigDocId as et, maybeSpawnSuccessor as f, viewDocId as ft, ONE_SECOND_MS as g, successorId as h, deleteCustomView as i, PUBLIC_VIEW_ID as it, buildActionSeedPrompt as j, enrichItems as k, daysInMonth as l, VIEW_TIER as lt, resolveEvery as m, MAX_UNSELECTIVE_ITEMS as n, AuthoredAppZ as nt, deleteCollectionRefusalMessage as o, VIEW_AUDIENCES as ot, parseCivil as p, appViewTierPath as q, makeManageCollectionTool as r, parseAuthoredApp as rt, advanceTriggerDate as s, VIEW_CONFIG_ID as st, MAX_SCHEMA_ISSUES as t, APP_ROLES as tt, formatCivil as u, normalizeViews as ut, buildWorkspaceOntology as v, validateCollectionRecords as w, firstMutateParamProblem as x, schemaRelations as y, publishProblems as z };
+export { stagedRuleConfig as $, runQueryOverRows as A, APPS_COLLECTION as B, STORE_UNREADABLE as C, recordFieldProblem as D, compileRecordZ as E, readCustomViewI18n as F, appSlugDoc as G, PUBLIC_CONFIG_DOC as H, readSkillTemplate as I, projectApp as J, appStagingPath as K, bindsSubmitterIdentity as L, buildCollectionActionSeedPrompt as M, promptPathsFor as N, runCollectionQuery as O, readCustomViewHtml as P, promoteSchema as Q, promotedRoleProblems as R, MAX_RECORD_ISSUES as S, validateRecordObject as T, appConfigPath as U, APP_SLUGS_COLLECTION as V, appSchemasPath as W, projectDeploy as X, projectAppViews as Y, projectPublish as Z, computeCollectionIcon as _, deleteCollection as a, RESERVED_VIEW_IDS as at, applyMutateAction as b, computeSuccessor as c, VIEW_ID_PATTERN as ct, isTriggerDue as d, participantScope as dt, viewConfigDocId as et, maybeSpawnSuccessor as f, viewDocId as ft, ONE_SECOND_MS as g, successorId as h, deleteCustomView as i, PUBLIC_VIEW_ID as it, buildActionSeedPrompt as j, enrichItems as k, daysInMonth as l, VIEW_TIER as lt, resolveEvery as m, MAX_UNSELECTIVE_ITEMS as n, AuthoredAppZ as nt, deleteCollectionRefusalMessage as o, VIEW_AUDIENCES as ot, parseCivil as p, writeFor as pt, appViewTierPath as q, makeManageCollectionTool as r, parseAuthoredApp as rt, advanceTriggerDate as s, VIEW_CONFIG_ID as st, MAX_SCHEMA_ISSUES as t, APP_ROLES as tt, formatCivil as u, normalizeViews as ut, buildWorkspaceOntology as v, validateCollectionRecords as w, firstMutateParamProblem as x, schemaRelations as y, publishProblems as z };
 
-//# sourceMappingURL=server-CQSF5fHe.js.map
+//# sourceMappingURL=server-jm7aGA3g.js.map