@mulmoclaude/core 3.15.0 → 4.0.0

package/dist/collection/server/appViews.d.ts

@@ -1,136 +0,0 @@
-import { AuthoredApp, AuthoredMail } from './publishManifest';
-/** The audiences a view may be written for. A CLOSED set: each one names a
- *  tier with a rule behind it, so an unknown value has nowhere to be
- *  published to and is refused before it gets there. */
-export declare const VIEW_AUDIENCES: readonly ["public", "member", "participant"];
-export type ViewAudience = (typeof VIEW_AUDIENCES)[number];
-/** Where each audience's documents live under `apps/{aid}`. `public` is not
- *  here: it keeps `config/public` + `config/view`, which are already published
- *  and already read by a deployed runtime. */
-export declare const VIEW_TIER: Readonly<Record<Exclude<ViewAudience, "public">, "member" | "roster">>;
-/** The id `public.view` normalizes to. Fixed rather than derived, so two
- *  implementations of the same normalization cannot pick different ones. */
-export declare const PUBLIC_VIEW_ID = "public";
-/** `config` is the projection's own document in every tier (`live:config`),
- *  so a view may not be called that — the two would be the same document. */
-export declare const RESERVED_VIEW_IDS: readonly string[];
-/** What an id may be.
- *
- *  Narrow on purpose: this value is written by the author, and it becomes a
- *  Firestore document id under a `live:` / `staged:` prefix. Excluding `:`
- *  keeps the prefix and the id from running together; excluding `/`, `.` and
- *  `__…__` keeps it a legal document id that addresses the path it says. */
-export declare const VIEW_ID_PATTERN: RegExp;
-/** A view as the author wrote it, once normalized: one shape, whichever of
- *  the two declarations it came from. `where` is the path it was written at,
- *  carried only so a refusal names the key the author can go and edit. */
-export interface NormalizedView {
-    id: string;
-    audience: ViewAudience;
-    path: string;
-    collections: string[];
-    where: string;
-}
-export type NormalizedViewsResult = {
-    ok: true;
-    views: NormalizedView[];
-} | {
-    ok: false;
-    problems: string[];
-};
-/** The one shape everything downstream reads.
- *
- *  Every caller — the publish gate, the projection, the host that writes the
- *  documents — goes through this, so "which declaration was used" is decided
- *  exactly once. */
-export declare function normalizeViews(app: AuthoredApp): NormalizedViewsResult;
-/** How one audience reaches one collection's records.
- *
- *  The parent page builds the query from this; the view never touches
- *  Firestore. `own` is not a filter the rules apply for the reader — an
- *  unscoped `list` on an own-row collection is DENIED, not narrowed — so the
- *  scope has to travel with the declaration or the page fails. */
-export interface ProjectedViewCollection {
-    cid: string;
-    scope: "all" | "own";
-    /** `scope: "own"` — the field carrying the reader's verified address. */
-    emailField?: string;
-    /** `scope: "own"` — the row is the document whose id is the reader's uid. */
-    ownDocId?: "auth.uid";
-}
-/** How a participant reaches `cid`, or null if they cannot.
- *
- *  Mirrors the rules' read branches for someone holding no role:
- *  `partRead` (the whole collection) and `ownRow` (their own record, found
- *  by the submit declaration's `emailField` or by a uid-derived id).
- *
- *  `participantRead` is a PARAMETER rather than read off the manifest, and
- *  that is the whole point of the signature. Publish does not promote the
- *  manifest's value: `projectPublish` overwrites `participantRead` with what
- *  the STAGED schemas carry, so a cid added since the last deploy is in the
- *  manifest and not in the rules. Deriving the scope from the manifest would
- *  publish `scope: "all"` for a collection the promoted rules then deny —
- *  and removing one gives the mirror-image false refusal. The caller passes
- *  the set that will actually be in force. */
-export declare function participantScope(app: AuthoredApp, cid: string, participantRead: readonly string[]): ProjectedViewCollection | null;
-/** The declaration as one non-public audience may see it — the document
- *  published at `apps/{aid}/{tier}/live:config`, and deployed at
- *  `staged:config`.
- *
- *  The roster is NOT here, and neither is anything about another member: this
- *  is read by everyone the tier admits, which for `roster` includes every
- *  participant. */
-export interface AppViewConfigDoc extends Record<string, unknown> {
-    name?: string;
-    views: {
-        id: string;
-        collections: ProjectedViewCollection[];
-    }[];
-    /** The submit declarations for the collections these views draw, so the page
-     *  can show what may be sent rather than discovering it from a denial. */
-    submit: Record<string, Record<string, unknown>>;
-    /** What this audience may CHANGE about those collections — see
-     *  {@link writeFor}. One entry per collection that has anything writable, in
-     *  the order the views declare them; absent entries mean "read only", which
-     *  is what a page with no buttons is drawn from. */
-    write: ProjectedViewWrite[];
-    publishedAt: number;
-}
-/** The document ids one tier uses. `live:` and `staged:` are the only two
- *  prefixes, so a single `match` covers the projection and every view. */
-export declare const viewDocId: (stage: "live" | "staged", viewId: string) => string;
-export declare const VIEW_CONFIG_ID = "config";
-/** What one audience may change about one collection.
- *
- *  An entry exists only where something is actually writable; a collection a
- *  tier may only read is absent rather than present and empty. */
-export interface ProjectedViewWrite {
-    cid: string;
-    /** The field a transition moves. Without it there are no transitions. */
-    statusField?: string;
-    /** `{ <current status>: [<status>...] }`, for THIS audience. */
-    transitions?: Record<string, string[]>;
-    /** The field naming the member a row belongs to. `member` tier only. */
-    assigneeField?: string;
-    /** Who may write EVERY row here — the `owner` / `editor` holders. `member`
-     *  tier only, and it is what makes the tier's one shared document honest:
-     *  see {@link writersOf}. */
-    writers?: string[];
-    /** Who may write only the rows ASSIGNED to them — the `assignee` holders.
-     *  Present with `assigneeField`, since without one the role grants nothing.
-     *
-     *  The assignment CANDIDATES are these two lists together, and are left to
-     *  be derived rather than published a third time: a separate list would be
-     *  one more thing that can disagree with the two the rules actually read. */
-    rowWriters?: string[];
-    /** `member` tier only: the rules let only a writer (or the row's own
-     *  assignee) queue mail, so a participant handed this could only be refused. */
-    mail?: AuthoredMail;
-}
-/** What `audience` may change about `cid`, or null when the answer is nothing.
- *
- *  The two audiences differ in WHICH transition table applies, in whether
- *  assignment exists at all, and in whether the roster's answer travels with
- *  it; they agree that the status field is the collection's, since the rules
- *  read one field either way. */
-export declare function writeFor(app: AuthoredApp, audience: Exclude<ViewAudience, "public">, cid: string): ProjectedViewWrite | null;

package/dist/collection/server/publishChecks.d.ts

@@ -1,58 +0,0 @@
-import { AuthoredApp, AuthoredSubmit } from './publishManifest';
-import { StagedSchemaDoc } from './publishProject';
-/** What publish knows about a shared collection in this repository, as far as
- *  these checks are concerned: its cid and the schema key its records are
- *  identified by. The whole schema is deliberately not threaded in — these
- *  checks are about the DECLARATION, and the primary key is the one part of
- *  the schema the declaration can contradict. */
-export interface PublishableCollection {
-    cid: string;
-    primaryKey: string;
-}
-/** Does this submit declaration bind a record to the submitter's identity?
- *
- *  The condition for requiring `submitOnly`, and deliberately NOT "declares an
- *  `audience`": `audience` appears only in the rules' public-create branch, so
- *  an owner or editor never meets it and can add records freely. `immutable`
- *  is the wrong condition too — a survey's responses are not immutable and
- *  can be padded exactly the same way.
- *
- *  What these four have in common is that each one makes the record MEAN "the
- *  person who submitted it said this": a per-uid id, a per-uid+field id, a
- *  row stamped with the submitter's verified address, or a submission
- *  restricted to a named participant. A record created through the writer
- *  branch carries the same shape and none of that meaning. */
-export declare function bindsSubmitterIdentity(submit: AuthoredSubmit): boolean;
-/** Everything publish refuses, as lines the author can act on.
- *
- *  All of them, every time. Publish is a manual step with a human waiting on
- *  it; stopping at the first problem turns one review into five. */
-export declare function publishProblems(app: AuthoredApp, collections: readonly PublishableCollection[], publisherEmail: string): string[];
-/** What publish will actually promote, checked as the PAIR it becomes.
- *
- *  `publishProblems` reads the manifest, where `members` and `collections` sit
- *  side by side and agree. Publish does not write that pair. It writes the
- *  roster from the manifest and the collection configuration from what DEPLOY
- *  staged, so the app that lands is one half of each — and no check has ever
- *  looked at that combination.
- *
- *  The sequence that gets through: deploy revision A with no `assigneeField`,
- *  add the field AND the member in revision B, publish without redeploying.
- *  Every manifest-level check passes on a declaration that is internally sound,
- *  while what lands is A's field-less configuration beside B's roster — an
- *  assignee with nothing to be compared against, refused every write, in an app
- *  that keeps working for everybody else. That is the precise trap
- *  `assigneeProblems` exists to prevent, reached by the one route it cannot
- *  see.
- *
- *  Separate from `publishProblems` because it needs what deploy staged, which
- *  is a Firestore read the host makes and this package does not. It is checked
- *  against `stagedRuleConfig` — the same function the projection uses — rather
- *  than against a re-derivation, so the value validated is the value written.
- *
- *  Only the staged half can be stale, so only that half is named and the fix is
- *  "deploy again" rather than "fix the declaration". */
-export declare function promotedRoleProblems(app: AuthoredApp, staged: {
-    cid: string;
-    doc: StagedSchemaDoc;
-}[]): string[];

package/dist/collection/server/publishManifest.d.ts

@@ -1,257 +0,0 @@
-import { z } from 'zod';
-/** The roles the deployed rules understand.
- *
- *  Two of them are row-scoped, in opposite directions, and the pair is what
- *  the four-way split could not express:
- *
- *    `participant` — the layer that is NAMED but reads only its OWN rows (the
- *    rows it submitted). See `readerOf` vs `listedIn`.
- *
- *    `assignee` — reads EVERY row and writes only the rows ASSIGNED to it. The
- *    stylist who approves their own bookings and not a colleague's; the marker
- *    who grades their own students. Which rows are theirs is
- *    `collections[cid].assigneeField`, a field on the record holding the
- *    member's address. Reads are deliberately unscoped: a stylist needs the
- *    whole day's schedule, and scoping the read makes the app unusable.
- *
- *  The names are permanent. The deployed rules compare these strings directly
- *  and they are written into `app.json` files people commit, so a rename is a
- *  migration over published apps rather than an edit. */
-export declare const APP_ROLES: readonly ["owner", "editor", "viewer", "participant", "assignee"];
-/** The declarative mail queue, as the rules re-derive it: a transition of the
- *  status field, a recipient read off the RECORD, and a fixed template. */
-declare const MailZ: z.ZodObject<{
-    toField: z.ZodString;
-    on: z.ZodRecord<z.ZodString, z.ZodObject<{
-        from: z.ZodArray<z.ZodString>;
-        to: z.ZodString;
-    }, z.core.$strict>>;
-    dataFields: z.ZodOptional<z.ZodArray<z.ZodString>>;
-}, z.core.$strict>;
-/** What the rules read out of `collections[cid]`. NOT the schema — the schema
- *  is published beside it, untouched, for clients to render from. */
-declare const CollectionConfigZ: z.ZodObject<{
-    statusField: z.ZodOptional<z.ZodString>;
-    transitions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>;
-    immutable: z.ZodOptional<z.ZodBoolean>;
-    submitOnly: z.ZodOptional<z.ZodBoolean>;
-    assigneeField: z.ZodOptional<z.ZodString>;
-    mirrorOf: z.ZodOptional<z.ZodString>;
-    peerVisibility: z.ZodOptional<z.ZodEnum<{
-        public: "public";
-        hidden: "hidden";
-    }>>;
-    revealGated: z.ZodOptional<z.ZodBoolean>;
-    gatedFrom: z.ZodOptional<z.ZodString>;
-    revealBy: z.ZodOptional<z.ZodString>;
-    mail: z.ZodOptional<z.ZodObject<{
-        toField: z.ZodString;
-        on: z.ZodRecord<z.ZodString, z.ZodObject<{
-            from: z.ZodArray<z.ZodString>;
-            to: z.ZodString;
-        }, z.core.$strict>>;
-        dataFields: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    }, z.core.$strict>>;
-    aggregate: z.ZodOptional<z.ZodObject<{
-        by: z.ZodArray<z.ZodString>;
-    }, z.core.$strict>>;
-}, z.core.$strict>;
-declare const SubmitZ: z.ZodObject<{
-    auth: z.ZodEnum<{
-        none: "none";
-        anonymous: "anonymous";
-        verifiedEmail: "verifiedEmail";
-    }>;
-    emailField: z.ZodOptional<z.ZodString>;
-    createFields: z.ZodArray<z.ZodString>;
-    initialStatus: z.ZodOptional<z.ZodString>;
-    idFrom: z.ZodOptional<z.ZodEnum<{
-        field: "field";
-        auto: "auto";
-        "auth.uid": "auth.uid";
-        "auth.uid+field": "auth.uid+field";
-    }>>;
-    idField: z.ZodOptional<z.ZodString>;
-    idIn: z.ZodOptional<z.ZodObject<{
-        collection: z.ZodString;
-        where: z.ZodOptional<z.ZodObject<{
-            field: z.ZodString;
-            equals: z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>;
-        }, z.core.$strict>>;
-    }, z.core.$strict>>;
-    mirror: z.ZodOptional<z.ZodString>;
-    validate: z.ZodOptional<z.ZodObject<{
-        required: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        keyFields: z.ZodOptional<z.ZodArray<z.ZodObject<{
-            field: z.ZodString;
-            values: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
-        }, z.core.$strict>>>;
-    }, z.core.$strict>>;
-    window: z.ZodOptional<z.ZodObject<{
-        from: z.ZodOptional<z.ZodISODateTime>;
-        until: z.ZodOptional<z.ZodISODateTime>;
-        fromField: z.ZodOptional<z.ZodObject<{
-            ref: z.ZodString;
-            collection: z.ZodString;
-            field: z.ZodString;
-        }, z.core.$strict>>;
-        untilField: z.ZodOptional<z.ZodObject<{
-            ref: z.ZodString;
-            collection: z.ZodString;
-            field: z.ZodString;
-        }, z.core.$strict>>;
-    }, z.core.$strict>>;
-    stampField: z.ZodOptional<z.ZodString>;
-    selfUpdate: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>;
-    selfTransitions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>;
-    finalize: z.ZodOptional<z.ZodBoolean>;
-    audience: z.ZodOptional<z.ZodLiteral<"participant">>;
-    gateOn: z.ZodOptional<z.ZodObject<{
-        phase: z.ZodString;
-        match: z.ZodString;
-    }, z.core.$strict>>;
-}, z.core.$strict>;
-/** The whole authored declaration.
- *
- *  `owner` is accepted but is NOT the published value — publish stamps the
- *  publisher's uid (or carries the existing one forward, which is what the
- *  rules require on update) and refuses a declaration that disagrees. It is
- *  accepted rather than banned because the sample app.json in the design note
- *  shows it, and a hard refusal on a key the samples contain would be a worse
- *  first experience than a message naming the mismatch. */
-export declare const AuthoredAppZ: z.ZodObject<{
-    aid: z.ZodString;
-    name: z.ZodOptional<z.ZodString>;
-    slug: z.ZodOptional<z.ZodString>;
-    aidEnv: z.ZodOptional<z.ZodString>;
-    owner: z.ZodOptional<z.ZodString>;
-    members: z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodUnion<readonly [z.ZodLiteral<"*">, z.ZodString]>, z.ZodEnum<{
-        participant: "participant";
-        owner: "owner";
-        editor: "editor";
-        viewer: "viewer";
-        assignee: "assignee";
-    }>>>;
-    collections: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
-        statusField: z.ZodOptional<z.ZodString>;
-        transitions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>;
-        immutable: z.ZodOptional<z.ZodBoolean>;
-        submitOnly: z.ZodOptional<z.ZodBoolean>;
-        assigneeField: z.ZodOptional<z.ZodString>;
-        mirrorOf: z.ZodOptional<z.ZodString>;
-        peerVisibility: z.ZodOptional<z.ZodEnum<{
-            public: "public";
-            hidden: "hidden";
-        }>>;
-        revealGated: z.ZodOptional<z.ZodBoolean>;
-        gatedFrom: z.ZodOptional<z.ZodString>;
-        revealBy: z.ZodOptional<z.ZodString>;
-        mail: z.ZodOptional<z.ZodObject<{
-            toField: z.ZodString;
-            on: z.ZodRecord<z.ZodString, z.ZodObject<{
-                from: z.ZodArray<z.ZodString>;
-                to: z.ZodString;
-            }, z.core.$strict>>;
-            dataFields: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        }, z.core.$strict>>;
-        aggregate: z.ZodOptional<z.ZodObject<{
-            by: z.ZodArray<z.ZodString>;
-        }, z.core.$strict>>;
-    }, z.core.$strict>>>;
-    participantRead: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    public: z.ZodOptional<z.ZodObject<{
-        enabled: z.ZodOptional<z.ZodBoolean>;
-        read: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        view: z.ZodOptional<z.ZodObject<{
-            path: z.ZodString;
-            collections: z.ZodArray<z.ZodString>;
-        }, z.core.$strict>>;
-        submit: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
-            auth: z.ZodEnum<{
-                none: "none";
-                anonymous: "anonymous";
-                verifiedEmail: "verifiedEmail";
-            }>;
-            emailField: z.ZodOptional<z.ZodString>;
-            createFields: z.ZodArray<z.ZodString>;
-            initialStatus: z.ZodOptional<z.ZodString>;
-            idFrom: z.ZodOptional<z.ZodEnum<{
-                field: "field";
-                auto: "auto";
-                "auth.uid": "auth.uid";
-                "auth.uid+field": "auth.uid+field";
-            }>>;
-            idField: z.ZodOptional<z.ZodString>;
-            idIn: z.ZodOptional<z.ZodObject<{
-                collection: z.ZodString;
-                where: z.ZodOptional<z.ZodObject<{
-                    field: z.ZodString;
-                    equals: z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>;
-                }, z.core.$strict>>;
-            }, z.core.$strict>>;
-            mirror: z.ZodOptional<z.ZodString>;
-            validate: z.ZodOptional<z.ZodObject<{
-                required: z.ZodOptional<z.ZodArray<z.ZodString>>;
-                keyFields: z.ZodOptional<z.ZodArray<z.ZodObject<{
-                    field: z.ZodString;
-                    values: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
-                }, z.core.$strict>>>;
-            }, z.core.$strict>>;
-            window: z.ZodOptional<z.ZodObject<{
-                from: z.ZodOptional<z.ZodISODateTime>;
-                until: z.ZodOptional<z.ZodISODateTime>;
-                fromField: z.ZodOptional<z.ZodObject<{
-                    ref: z.ZodString;
-                    collection: z.ZodString;
-                    field: z.ZodString;
-                }, z.core.$strict>>;
-                untilField: z.ZodOptional<z.ZodObject<{
-                    ref: z.ZodString;
-                    collection: z.ZodString;
-                    field: z.ZodString;
-                }, z.core.$strict>>;
-            }, z.core.$strict>>;
-            stampField: z.ZodOptional<z.ZodString>;
-            selfUpdate: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>;
-            selfTransitions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>;
-            finalize: z.ZodOptional<z.ZodBoolean>;
-            audience: z.ZodOptional<z.ZodLiteral<"participant">>;
-            gateOn: z.ZodOptional<z.ZodObject<{
-                phase: z.ZodString;
-                match: z.ZodString;
-            }, z.core.$strict>>;
-        }, z.core.$strict>>>;
-    }, z.core.$strict>>;
-    views: z.ZodOptional<z.ZodArray<z.ZodObject<{
-        id: z.ZodString;
-        audience: z.ZodEnum<{
-            public: "public";
-            member: "member";
-            participant: "participant";
-        }>;
-        path: z.ZodString;
-        collections: z.ZodArray<z.ZodString>;
-    }, z.core.$strict>>>;
-}, z.core.$strict>;
-export type AuthoredApp = z.infer<typeof AuthoredAppZ>;
-export type AuthoredCollectionConfig = z.infer<typeof CollectionConfigZ>;
-export type AuthoredSubmit = z.infer<typeof SubmitZ>;
-export type AuthoredMail = z.infer<typeof MailZ>;
-export type AuthoredAppResult = {
-    ok: true;
-    app: AuthoredApp;
-} | {
-    ok: false;
-    problems: string[];
-};
-/** Parse the authored declaration out of `app.json`'s text.
- *
- *  Returns a LIST of problems rather than throwing, for the same reason
- *  `loadAppManifest` returns a failure: the caller is a gate whose entire job
- *  is to hand the author something to act on. Every problem is reported at
- *  once — publish is a manual step, and a parser that stops at the first key
- *  makes it N round trips. */
-export declare function parseAuthoredApp(raw: string): AuthoredAppResult;
-/** zod issues as one actionable line each: `public.submit.responses.auth: …`. */
-export declare function authoredProblems(error: z.ZodError): string[];
-export {};