@pathmx/core 0.5.0

package/authority/access.ts

@@ -0,0 +1,820 @@
+import { publicPath } from "../server/router.ts"
+import type { Plugin } from "../plugins/types.ts"
+import { SourceDiagnosticError } from "../source-diagnostic.ts"
+import type { Repository } from "../repository.ts"
+import type { Source } from "../source/index.ts"
+import type { Actor, KnownActorIndex, Principal } from "./model.ts"
+import { canonicalPath, canonicalSourceId } from "../canonical.ts"
+import { isActorSource } from "./actors.ts"
+
+export type SourceCapability = "read" | "write" | "execute"
+
+export type SharedSourceGrant = Readonly<{
+  actor: string
+  can: readonly SourceCapability[]
+}>
+
+type CapabilityMask = number
+
+type SharedSourceMember = Readonly<{
+  actor: string
+  capabilities: CapabilityMask
+}>
+
+type SharedSourceAccess = Readonly<{
+  type: "shared"
+  owner: string
+  members: readonly SharedSourceMember[]
+  capabilitiesByActor: ReadonlyMap<string, CapabilityMask>
+}>
+
+export type SourceAccessBasis =
+  | Readonly<{
+      type: "exact-grant"
+      sourceId: string
+      actorId: string
+      owner: boolean
+    }>
+  | Readonly<{
+      type: "home-owner"
+      sourceId: string
+      actorId: string
+      home: string
+    }>
+  | Readonly<{
+      type: "staff-review"
+      sourceId: string
+      actorId: string
+    }>
+  | Readonly<{ type: "public-source"; sourceId: string }>
+  | Readonly<{
+      type: "denied"
+      sourceId: string
+      reason:
+        | "actor-source"
+        | "authentication-required"
+        | "invalid-access"
+        | "not-granted"
+        | "private-home"
+        | "stale-actor"
+        | "unknown-source"
+    }>
+
+export type SourceAccessInspection = Readonly<{
+  visibility: ReadAccess
+  capabilities: readonly SourceCapability[]
+  basis: SourceAccessBasis
+}>
+
+export type SourcePermissionRecord = SourceAccessInspection &
+  Readonly<{
+    sourceId: string
+    actorId: string | null
+  }>
+
+type ResolvedSourceAccess = Readonly<{
+  visibility: ReadAccess
+  capabilities: CapabilityMask
+  basis?: SourceAccessBasis
+}>
+
+export type ProposedSourceChange = Readonly<
+  | { type: "create"; sourceId: string; after: Source }
+  | {
+      type: "update"
+      operation: "content" | "grants" | "attachments"
+      sourceId: string
+      before: Source
+      after: Source
+    }
+  | { type: "delete"; sourceId: string; before: Source }
+>
+
+export type AccessDecision =
+  Readonly<{ type: "allowed" }> | Readonly<{ type: "denied"; code: string }>
+
+export type ReadAccess = "public" | "private" | "denied"
+
+export type SourceAccessPolicy = Readonly<{
+  readAccess(principal: Principal, target: string | Source): ReadAccess
+  inspect(principal: Principal, target: string | Source): SourceAccessInspection
+  hasCapability(
+    principal: Principal,
+    target: string | Source,
+    capability: SourceCapability,
+  ): boolean
+  authorizeChange(actor: Actor, change: ProposedSourceChange): AccessDecision
+  canEmbed(container: string, dependency: string): boolean
+  diagnostics?(): readonly Readonly<{ sourceId: string; message: string }>[]
+}>
+
+export class SourceAccessError extends SourceDiagnosticError {
+  readonly sourceId: string
+  readonly detail: string
+
+  constructor(source: Source, message: string) {
+    super({
+      source: source.path,
+      plugin: "source-access",
+      message: `Invalid shared access on ${source.id}: ${message}`,
+    })
+    this.name = "SourceAccessError"
+    this.sourceId = source.id
+    this.detail = message
+  }
+}
+
+export class AccessDeniedError extends Error {
+  readonly code: string
+
+  constructor(code = "access-denied") {
+    super("Source access denied.")
+    this.name = "AccessDeniedError"
+    this.code = code
+  }
+}
+
+function record(value: unknown): Record<string, unknown> | undefined {
+  return value != null && typeof value === "object" && !Array.isArray(value)
+    ? (value as Record<string, unknown>)
+    : undefined
+}
+
+const capabilityBits = {
+  read: 1,
+  write: 2,
+  execute: 4,
+} as const satisfies Record<SourceCapability, number>
+
+const READ = capabilityBits.read
+const WRITE = capabilityBits.write
+const EXECUTE = capabilityBits.execute
+const ALL_CAPABILITIES = READ | WRITE | EXECUTE
+const capabilities = Object.freeze([
+  "read",
+  "write",
+  "execute",
+] as const satisfies readonly SourceCapability[])
+
+function capabilitiesFor(mask: CapabilityMask) {
+  return capabilities.filter((capability) => mask & capabilityBits[capability])
+}
+
+function retainBasis(basis: SourceAccessBasis) {
+  return basis
+}
+
+function deniedAccess(
+  sourceId: string,
+  reason: Extract<SourceAccessBasis, { type: "denied" }>["reason"],
+  explain?: typeof retainBasis,
+): ResolvedSourceAccess {
+  return {
+    visibility: "denied",
+    capabilities: 0,
+    basis: explain?.({ type: "denied", sourceId, reason }),
+  }
+}
+
+function isSourceCapability(value: unknown): value is SourceCapability {
+  return typeof value === "string" && Object.hasOwn(capabilityBits, value)
+}
+
+function capabilityMask(value: unknown, source: Source, actor: string) {
+  if (!Array.isArray(value) || !value.length) {
+    throw new SourceAccessError(
+      source,
+      `member ${actor} must declare a non-empty can list`,
+    )
+  }
+  let mask = 0
+  for (const capability of value) {
+    if (!isSourceCapability(capability)) {
+      throw new SourceAccessError(
+        source,
+        `member ${actor} has an invalid capability: ${String(capability)}`,
+      )
+    }
+    const bit = capabilityBits[capability]
+    if (mask & bit) {
+      throw new SourceAccessError(
+        source,
+        `member ${actor} capabilities must be unique`,
+      )
+    }
+    mask |= bit
+  }
+  if (!(mask & READ)) {
+    throw new SourceAccessError(source, `member ${actor} must be readable`)
+  }
+  return mask
+}
+
+function sharedMember(source: Source, value: unknown): SharedSourceMember {
+  const member = record(value)
+  if (!member) {
+    throw new SourceAccessError(
+      source,
+      `members must contain actor capability grants`,
+    )
+  }
+  const actor = typeof member.actor === "string" ? member.actor.trim() : ""
+  if (!actor) {
+    throw new SourceAccessError(source, `member actor is required`)
+  }
+  try {
+    canonicalSourceId(actor)
+  } catch {
+    throw new SourceAccessError(
+      source,
+      `member actor must be a canonical Source id`,
+    )
+  }
+  return Object.freeze({
+    actor,
+    capabilities: capabilityMask(member.can, source, actor),
+  })
+}
+
+function memberCapabilities(access: SharedSourceAccess, actorId: string) {
+  return access.capabilitiesByActor.get(actorId) ?? 0
+}
+
+function sharedAccess(source: Source): SharedSourceAccess | undefined {
+  if (source.data.access == null) return
+  const access = record(source.data.access)
+  if (!access || access.type !== "shared") {
+    throw new SourceAccessError(source, `access.type must be shared`)
+  }
+  const owner = typeof access.owner === "string" ? access.owner.trim() : ""
+  if (!owner) throw new SourceAccessError(source, `owner is required`)
+  if (!Array.isArray(access.members) || !access.members.length) {
+    throw new SourceAccessError(source, `members must be a non-empty list`)
+  }
+  const members = access.members.map((member) => sharedMember(source, member))
+  const actors = members.map((member) => member.actor)
+  try {
+    canonicalSourceId(owner)
+  } catch {
+    throw new SourceAccessError(source, `owner must be a canonical Source id`)
+  }
+  if (new Set(actors).size !== actors.length) {
+    throw new SourceAccessError(source, `members must be unique`)
+  }
+  if (!actors.includes(owner)) {
+    throw new SourceAccessError(source, `owner must also be a member`)
+  }
+  const ownerCapabilities =
+    members.find((member) => member.actor === owner)?.capabilities ?? 0
+  if (!(ownerCapabilities & WRITE)) {
+    throw new SourceAccessError(source, `owner ${owner} must be writable`)
+  }
+  return Object.freeze({
+    type: "shared",
+    owner,
+    members: Object.freeze(members),
+    capabilitiesByActor: new Map(
+      members.map((member) => [member.actor, member.capabilities]),
+    ),
+  })
+}
+
+function attachmentPaths(source: Source) {
+  const authored = source.data.attachments
+  if (authored == null) return []
+  if (!Array.isArray(authored)) {
+    throw new SourceAccessError(source, `attachments must be a list`)
+  }
+  const attachments = authored.map((item) =>
+    typeof item === "string" ? item.trim() : "",
+  )
+  if (attachments.some((attachment) => !attachment)) {
+    throw new SourceAccessError(source, `attachments must contain paths`)
+  }
+  try {
+    for (const attachment of attachments) {
+      canonicalPath(attachment)
+      if (attachment.endsWith(".md")) throw new Error()
+    }
+  } catch {
+    throw new SourceAccessError(
+      source,
+      `attachments must be canonical non-Source paths`,
+    )
+  }
+  if (new Set(attachments).size !== attachments.length) {
+    throw new SourceAccessError(source, `attachments must be unique`)
+  }
+  return attachments
+}
+
+function within(path: string, root: string) {
+  return path === root || path.startsWith(`${root}/`)
+}
+
+/** Orphaned Homes stay private after their Actor Source is removed. */
+function reservedHomePath(path: string) {
+  const segments = path.split("/").filter(Boolean)
+  return (
+    segments.length >= 3 &&
+    (segments[0] === "users" || segments[0] === "agents")
+  )
+}
+
+function sameAccess(before: Source, after: Source) {
+  return (
+    JSON.stringify(before.data.access) === JSON.stringify(after.data.access)
+  )
+}
+
+function sameAttachments(before: Source, after: Source) {
+  return (
+    JSON.stringify(before.data.attachments) ===
+    JSON.stringify(after.data.attachments)
+  )
+}
+
+function sameExceptAttachments(before: Source, after: Source) {
+  const { attachments: _before, ...beforeData } = before.data
+  const { attachments: _after, ...afterData } = after.data
+  return (
+    before.id === after.id &&
+    before.body === after.body &&
+    JSON.stringify(beforeData) === JSON.stringify(afterData)
+  )
+}
+
+const allowed: AccessDecision = Object.freeze({ type: "allowed" })
+
+function denied(code: string): AccessDecision {
+  return { type: "denied", code }
+}
+
+export class SourceAccessIndex implements SourceAccessPolicy {
+  private sharedById = new Map<string, SharedSourceAccess>()
+  private sourcePaths = new Map<string, string>()
+  private actorSources = new Map<string, Set<string>>()
+  private invalidIds = new Set<string>()
+  private invalidMessages = new Map<string, string>()
+  private attachments = new Map<string, string>()
+  private sourceAttachments = new Map<string, readonly string[]>()
+
+  constructor(
+    private repo: Repository,
+    private actors: KnownActorIndex,
+  ) {}
+
+  index(source: Source) {
+    try {
+      const bound = attachmentPaths(source)
+      for (const attachment of bound) {
+        const existing = this.attachments.get(attachment)
+        if (existing && existing !== source.id) {
+          throw new SourceAccessError(
+            source,
+            `attachment already belongs to ${existing}: ${attachment}`,
+          )
+        }
+      }
+      for (const attachment of bound)
+        this.attachments.set(attachment, source.id)
+      if (bound.length) this.sourceAttachments.set(source.id, bound)
+      if (bound.length || source.data.access != null) {
+        this.sourcePaths.set(source.path, source.id)
+      }
+      if (source.data.access == null) return
+      const access = sharedAccess(source)
+      if (!access) return
+      this.sharedById.set(source.id, access)
+      this.sourcePaths.set(source.path, source.id)
+      this.invalidIds.delete(source.id)
+      this.invalidMessages.delete(source.id)
+      for (const { actor: actorId } of access.members) {
+        const sources = this.actorSources.get(actorId) ?? new Set<string>()
+        sources.add(source.id)
+        this.actorSources.set(actorId, sources)
+      }
+    } catch (error) {
+      this.invalidIds.add(source.id)
+      this.invalidMessages.set(
+        source.id,
+        error instanceof SourceAccessError
+          ? error.detail
+          : error instanceof Error
+            ? error.message
+            : String(error),
+      )
+      this.sourcePaths.set(source.path, source.id)
+      throw error
+    }
+  }
+
+  unindex(sourcePath: string) {
+    const sourceId = this.sourcePaths.get(sourcePath)
+    if (!sourceId) return
+    const access = this.sharedById.get(sourceId)
+    if (access) {
+      for (const { actor: actorId } of access.members) {
+        const sources = this.actorSources.get(actorId)
+        sources?.delete(sourceId)
+        if (!sources?.size) this.actorSources.delete(actorId)
+      }
+    }
+    for (const attachment of this.sourceAttachments.get(sourceId) ?? []) {
+      this.attachments.delete(attachment)
+    }
+    this.sourceAttachments.delete(sourceId)
+    this.sharedById.delete(sourceId)
+    this.sourcePaths.delete(sourcePath)
+    this.invalidIds.delete(sourceId)
+    this.invalidMessages.delete(sourceId)
+  }
+
+  validate() {
+    const diagnostic = this.diagnostics()[0]
+    if (diagnostic) {
+      const source = this.repo.get(diagnostic.sourceId)
+      if (source) throw new SourceAccessError(source, diagnostic.message)
+    }
+  }
+
+  diagnostics() {
+    const diagnostics = [...this.invalidMessages].map(
+      ([sourceId, message]) => ({ sourceId, message }),
+    )
+    for (const [sourceId, access] of this.sharedById) {
+      if (!this.actors.findActorById(access.owner)) {
+        diagnostics.push({
+          sourceId,
+          message: `owner does not resolve: ${access.owner}`,
+        })
+        continue
+      }
+      for (const member of access.members) {
+        if (!this.actors.findActorById(member.actor)) {
+          diagnostics.push({
+            sourceId,
+            message: `member does not resolve: ${member.actor}`,
+          })
+        }
+      }
+    }
+    return diagnostics.sort(
+      (a, b) =>
+        a.sourceId.localeCompare(b.sourceId) ||
+        a.message.localeCompare(b.message),
+    )
+  }
+
+  sharedSourcesFor(actorId: string) {
+    return [...(this.actorSources.get(actorId) ?? [])]
+  }
+
+  sourceForId(sourceId: string) {
+    return this.repo.get(sourceId)
+  }
+
+  private resolvedAccess(
+    principal: Principal,
+    target: string | Source,
+    inspect = false,
+  ): ResolvedSourceAccess {
+    // Optional calls below avoid allocating provenance objects on HTTP/Action checks.
+    const explain = inspect ? retainBasis : undefined
+    const source = typeof target === "string" ? this.sourceFor(target) : target
+    let sourceId: string
+    try {
+      sourceId =
+        source?.id ??
+        canonicalPath(typeof target === "string" ? target : target.id)
+    } catch {
+      return deniedAccess(
+        String(typeof target === "string" ? target : target.id),
+        "unknown-source",
+        explain,
+      )
+    }
+    if (!source) {
+      const ownerId = this.attachments.get(sourceId)
+      const owner = ownerId ? this.repo.get(ownerId) : undefined
+      if (owner) return this.resolvedAccess(principal, owner, inspect)
+    }
+    if (this.invalidIds.has(sourceId)) {
+      return deniedAccess(sourceId, "invalid-access", explain)
+    }
+    if (source && isActorSource(source)) {
+      return deniedAccess(sourceId, "actor-source", explain)
+    }
+
+    const actor =
+      principal.type === "actor" &&
+      this.actors.findActorById(principal.actor.id) === principal.actor
+        ? principal.actor
+        : undefined
+
+    const shared = this.sharedById.get(sourceId)
+    if (shared) {
+      if (!this.actors.findActorById(shared.owner)) {
+        return deniedAccess(sourceId, "invalid-access", explain)
+      }
+      if (!actor) {
+        return deniedAccess(
+          sourceId,
+          principal.type === "actor"
+            ? "stale-actor"
+            : "authentication-required",
+          explain,
+        )
+      }
+      const capabilities = memberCapabilities(shared, actor.id)
+      if (capabilities) {
+        return {
+          visibility: "private",
+          capabilities,
+          basis: explain?.({
+            type: "exact-grant",
+            sourceId,
+            actorId: actor.id,
+            owner: shared.owner === actor.id,
+          }),
+        }
+      }
+      if (actor.type === "user" && actor.role === "staff") {
+        return {
+          visibility: "private",
+          capabilities: READ,
+          basis: explain?.({
+            type: "staff-review",
+            sourceId,
+            actorId: actor.id,
+          }),
+        }
+      }
+      return deniedAccess(sourceId, "not-granted", explain)
+    }
+
+    const path = source?.id ?? sourceId
+    const homeOwner = this.homeOwner(path)
+    if (homeOwner) {
+      if (!actor) {
+        return deniedAccess(
+          sourceId,
+          principal.type === "actor"
+            ? "stale-actor"
+            : "authentication-required",
+          explain,
+        )
+      }
+      if (actor.id === homeOwner.id) {
+        return {
+          visibility: "private",
+          capabilities: ALL_CAPABILITIES,
+          basis: explain?.({
+            type: "home-owner",
+            sourceId,
+            actorId: actor.id,
+            home: homeOwner.home,
+          }),
+        }
+      }
+      if (actor.type === "user" && actor.role === "staff") {
+        return {
+          visibility: "private",
+          capabilities: READ,
+          basis: explain?.({
+            type: "staff-review",
+            sourceId,
+            actorId: actor.id,
+          }),
+        }
+      }
+      return deniedAccess(sourceId, "private-home", explain)
+    }
+    if (reservedHomePath(path)) {
+      return deniedAccess(sourceId, "private-home", explain)
+    }
+    return {
+      visibility: "public",
+      capabilities: actor ? READ | EXECUTE : READ,
+      basis: explain?.({ type: "public-source", sourceId }),
+    }
+  }
+
+  readAccess(principal: Principal, target: string | Source): ReadAccess {
+    const access = this.resolvedAccess(principal, target)
+    if (!(access.capabilities & READ)) return "denied"
+    return access.visibility
+  }
+
+  inspect(
+    principal: Principal,
+    target: string | Source,
+  ): SourceAccessInspection {
+    const access = this.resolvedAccess(principal, target, true)
+    if (!access.basis) throw new Error("Permission inspection basis missing")
+    return {
+      visibility: access.visibility,
+      capabilities: capabilitiesFor(access.capabilities),
+      basis: access.basis,
+    }
+  }
+
+  hasCapability(
+    principal: Principal,
+    target: string | Source,
+    capability: SourceCapability,
+  ) {
+    const access = this.resolvedAccess(principal, target)
+    return Boolean(access.capabilities & capabilityBits[capability])
+  }
+
+  authorizeChange(actor: Actor, change: ProposedSourceChange): AccessDecision {
+    if (this.actors.findActorById(actor.id) !== actor) {
+      return denied("actor-not-current")
+    }
+    if (change.type === "create")
+      return this.authorizeCreate(actor, change.after)
+
+    const beforeAccess = this.accessFromSource(change.before)
+    if (change.type === "delete") {
+      if (beforeAccess) {
+        return beforeAccess.owner === actor.id
+          ? allowed
+          : denied("shared-delete-owner-only")
+      }
+      return this.ownsHome(actor, change.before.id)
+        ? allowed
+        : denied("home-owner-only")
+    }
+
+    if (change.operation === "grants") {
+      if (!sameAttachments(change.before, change.after)) {
+        return denied("attachment-change-requires-attachment-operation")
+      }
+      const afterAccess = this.validShared(change.after)
+      const owner = beforeAccess?.owner ?? actor.id
+      if (owner !== actor.id || afterAccess.owner !== owner) {
+        return denied("shared-grants-owner-only")
+      }
+      return this.membersResolve(afterAccess)
+        ? allowed
+        : denied("shared-member-not-found")
+    }
+
+    if (change.operation === "attachments") {
+      if (
+        !sameAccess(change.before, change.after) ||
+        !sameExceptAttachments(change.before, change.after)
+      ) {
+        return denied("attachment-operation-may-only-change-attachments")
+      }
+      attachmentPaths(change.after)
+      if (!this.attachmentsAvailable(change.after)) {
+        return denied("attachment-already-bound")
+      }
+      if (beforeAccess) {
+        return beforeAccess.owner === actor.id
+          ? allowed
+          : denied("shared-attachment-owner-only")
+      }
+      return this.ownsHome(actor, change.before.id)
+        ? allowed
+        : denied("home-owner-only")
+    }
+
+    if (!sameAccess(change.before, change.after)) {
+      return denied("access-change-requires-grants-operation")
+    }
+    if (!sameAttachments(change.before, change.after)) {
+      return denied("attachment-change-requires-attachment-operation")
+    }
+    return this.hasCapability({ type: "actor", actor }, change.before, "write")
+      ? allowed
+      : denied("source-write-required")
+  }
+
+  canEmbed(container: string, dependency: string) {
+    const containerSource = this.sourceFor(container)
+    const dependencySource = this.sourceFor(dependency)
+    if (!containerSource || !dependencySource) return false
+    if (isActorSource(dependencySource)) {
+      return false
+    }
+    const containerAccess = this.sharedById.get(containerSource.id)
+    const dependencyAccess = this.sharedById.get(dependencySource.id)
+    if (containerAccess) {
+      if (!dependencyAccess) return !this.homeProtected(dependencySource.id)
+      return containerAccess.members.every((member) =>
+        Boolean(memberCapabilities(dependencyAccess, member.actor) & READ),
+      )
+    }
+    const containerOwner = this.homeOwner(containerSource.id)
+    if (containerOwner) {
+      if (!this.homeProtected(dependencySource.id)) return !dependencyAccess
+      return within(dependencySource.id, containerOwner.home)
+    }
+    if (reservedHomePath(containerSource.id)) return false
+    return !dependencyAccess && !this.homeProtected(dependencySource.id)
+  }
+
+  private authorizeCreate(actor: Actor, source: Source): AccessDecision {
+    attachmentPaths(source)
+    if (!this.attachmentsAvailable(source)) {
+      return denied("attachment-already-bound")
+    }
+    const access = this.accessFromSource(source)
+    if (access) {
+      if (
+        access.owner !== actor.id ||
+        !(memberCapabilities(access, actor.id) & WRITE)
+      ) {
+        return denied("shared-create-owner-required")
+      }
+      return this.membersResolve(access)
+        ? allowed
+        : denied("shared-member-not-found")
+    }
+    return this.ownsHome(actor, source.id) ? allowed : denied("home-owner-only")
+  }
+
+  private membersResolve(access: SharedSourceAccess) {
+    return access.members.every((member) =>
+      this.actors.findActorById(member.actor),
+    )
+  }
+
+  private attachmentsAvailable(source: Source) {
+    return attachmentPaths(source).every((attachment) => {
+      const owner = this.attachments.get(attachment)
+      return owner == null || owner === source.id
+    })
+  }
+
+  private validShared(source: Source) {
+    const access = sharedAccess(source)
+    if (!access)
+      throw new SourceAccessError(source, `shared access is required`)
+    return access
+  }
+
+  private accessFromSource(source: Source) {
+    return source.data.access == null ? undefined : this.validShared(source)
+  }
+
+  private sourceFor(target: string) {
+    return this.repo.get(target) ?? this.repo.atPath(target)
+  }
+
+  private homeOwner(path: string) {
+    return this.actors.findHomeOwner(path)
+  }
+
+  private homeProtected(path: string) {
+    return this.homeOwner(path) != null || reservedHomePath(path)
+  }
+
+  private ownsHome(actor: Actor, path: string) {
+    return within(path, actor.home)
+  }
+}
+
+export function SourceAccessPlugin(index: SourceAccessIndex): Plugin {
+  return {
+    id: "source-access",
+    name: "SourceAccessPlugin",
+    index(source) {
+      index.index(source)
+    },
+    unindex(sourcePath) {
+      index.unindex(sourcePath)
+    },
+    lint(report) {
+      for (const diagnostic of index.diagnostics()) {
+        const source = index.sourceForId(diagnostic.sourceId)
+        if (!source) continue
+        report(
+          source,
+          `Invalid shared access on ${source.id}: ${diagnostic.message}`,
+        )
+      }
+    },
+    invalidate(transition) {
+      const targets: { type: "route"; route: string }[] = []
+      const routes = new Set<string>()
+      for (const source of [transition.before, transition.after]) {
+        if (!source) continue
+        if (source.data.access != null || source.data.attachments != null) {
+          routes.add(publicPath(source))
+        }
+        if (isActorSource(source)) {
+          for (const sourceId of index.sharedSourcesFor(source.id)) {
+            const shared = index.sourceForId(sourceId)
+            if (shared) routes.add(publicPath(shared))
+          }
+        }
+      }
+      for (const route of routes) targets.push({ type: "route", route })
+      return targets.length ? { targets } : undefined
+    },
+  }
+}