primitive-admin 1.2.0-alpha.1 → 1.2.0-alpha.10

package/dist/src/lib/function-bundle.js

@@ -8,27 +8,34 @@
  * in one envelope. The server verifies the hash and stores the object; it does
  * not compile anything.
  *
- * ── The two import rules ─────────────────────────────────────────────────
+ * ── Where an imported file may come from ───────────────────────────────
  *
- * They look contradictory and are not (F-005):
+ * Every file the build read is classified by its REAL path, never by how it
+ * was imported (F-005, widened by #4502):
  *
- *   - A **filesystem import** — relative or absolute — must stay inside the
- *     config tree. `entry`, every import it reaches, and every symlink they
- *     traverse are realpath-resolved and checked against the tree root, so a
- *     push can never read a file off a developer's disk that the tree does not
- *     contain.
- *   - A **bare package specifier** is exempt. It resolves through Node into an
- *     ancestor `node_modules`, which is outside every config tree by
- *     construction; esbuild inlines it into the bundle, and it is never
- *     captured as an authored source (so `config pull` never writes
- *     `node_modules` content back).
+ *   1. Inside the config tree → a **tree source**: captured as authored bytes
+ *      and stored with the version, so `config pull` hands it back. An
+ *      in-tree `node_modules` file still builds and is not captured.
+ *   2. Inside a directory the project declares in `functionSources` → a
+ *      **shared source**: bundled, typechecked, and never captured. The
+ *      repository is its source of truth, as it is for an npm package, so it is
+ *      listed in `projectSources` for the typechecker and nowhere else.
+ *   3. Under a `node_modules` directory AND reached by a bare specifier (or
+ *      from a file one reached) → a **dependency**: inlined, never captured.
+ *   4. Anything else → an **escape**, refused. A push can never read a file
+ *      off a developer's disk that neither the tree nor a declaration admits.
  *
- * The exemption follows the specifier, not the path a file happens to sit at.
- * A resolver plugin records the files a BARE specifier reached (and the files
- * those reach in turn), so `import "../../node_modules/private/index.js"` — a
- * relative filesystem import that merely lands in a `node_modules` directory —
- * is still an escape and still refused. Deciding by path would have let that
- * one specifier read any file on the disk and upload it.
+ * Rule 3 keeps two conditions on purpose. The provenance half: a resolver
+ * plugin records the files a BARE specifier reached, so `import
+ * "../../node_modules/private/index.js"` — a relative import that merely lands
+ * in a `node_modules` directory — is still an escape. Deciding by path alone
+ * would let that one specifier read any file on the disk and upload it. The
+ * path half: a bare specifier is not a free pass either. esbuild honours each
+ * file's nearest tsconfig `paths`, so a shared file's `@/util/h` resolves into
+ * the web app's own source, and a workspace package is a symlink to a
+ * directory the repository owns. Both are bare specifiers landing on ordinary
+ * files outside `node_modules`, so both are escapes unless their directory is
+ * declared — after which they are shared sources, bundled AND typechecked.
  *
  * `primitive-functions` is the one bare specifier left EXTERNAL: the loader
  * (#3180) supplies it at invoke time, so baking a copy into every bundle would
@@ -71,8 +78,10 @@
  */
 import * as esbuild from "esbuild";
 import { createHash } from "crypto";
-import { existsSync, readFileSync, realpathSync } from "fs";
+import { existsSync, readdirSync, readFileSync, realpathSync } from "fs";
 import { isAbsolute, relative, resolve, sep } from "path";
+import { FUNCTION_SOURCES_KEY, isInsideDirectory, resolveFunctionSourceRoots, } from "./function-source-roots.js";
+import { AUTH_FIXTURES_FILE, isAuthCaseFilePath, isAuthFixturesPath } from "./auth-fixtures.js";
 /** The module the loader supplies; never bundled. */
 export const PRIMITIVE_FUNCTIONS_MODULE = "primitive-functions";
 /** What that module was called before #3209. Refused at push, by name. */
@@ -170,7 +179,41 @@ function outsideRoot(root, candidate) {
 function escapeRefusal(what, path) {
     return new FunctionBuildError(`${what} '${path}' resolves outside the config tree root. ` +
         "Filesystem imports must stay inside the config tree; npm packages are " +
-        "imported by name and inlined into the bundle.");
+        "imported by name and inlined into the bundle. To share code from " +
+        `another directory, declare it in "${FUNCTION_SOURCES_KEY}" in primitive/config.json.`);
+}
+/**
+ * The real path of each reserved file in the tree — `auth-fixtures.json` and
+ * `functions/*.auth.json` — mapped to its reserved name (#4732).
+ */
+function reservedAuthFileTargets(treeRoot) {
+    const names = [AUTH_FIXTURES_FILE];
+    try {
+        for (const entry of readdirSync(resolve(treeRoot, "functions"))) {
+            const name = `functions/${entry}`;
+            if (isAuthCaseFilePath(name))
+                names.push(name);
+        }
+    }
+    catch {
+        // No functions directory: only the fixture map can be reserved.
+    }
+    const targets = new Map();
+    for (const name of names) {
+        const absolute = resolve(treeRoot, name);
+        if (existsSync(absolute))
+            targets.set(realOrSelf(absolute), name);
+    }
+    return targets;
+}
+/** The real path, or the spelling itself when it cannot be resolved. */
+function realOrSelf(path) {
+    try {
+        return realpathSync(path);
+    }
+    catch {
+        return path;
+    }
 }
 /**
  * Build one function's bundle and collect its authored sources.
@@ -181,6 +224,8 @@ function escapeRefusal(what, path) {
 export async function buildFunctionBundle(options) {
     const { configDir, entry, functionKey } = options;
     const treeRoot = realpathSync(resolve(configDir));
+    const sourceRoots = (options.sourceRoots ??
+        resolveFunctionSourceRoots(configDir).roots.map((root) => root.absolute)).map((root) => realOrSelf(resolve(root)));
     // 1. The entry, lexically. An escaping entry is refused as an escape even
     //    when the file it names does not exist — "no such file" would be a
     //    misleading answer to `entry = "../../etc/passwd"`.
@@ -299,26 +344,41 @@ export async function buildFunctionBundle(options) {
     }
     const bundle = Buffer.from(output.contents);
     // 3. Every file the build actually read, from the metafile — the honest list,
-    //    rather than a re-parse of the imports. A file a BARE specifier reached is
-    //    an inlined dependency and is dropped; every other input is a filesystem
-    //    import, and one outside the tree is an escape esbuild followed that the
-    //    push refuses.
+    //    rather than a re-parse of the imports — classified by its real path in
+    //    the order the module note gives.
     const sources = [];
+    const projectSources = new Set();
+    const reservedTargets = reservedAuthFileTargets(treeRoot);
     for (const input of Object.keys(result.metafile?.inputs ?? {})) {
-        const path = toPosix(input);
         const absolute = resolve(treeRoot, input);
-        if (isDependencyFile(absolute))
-            continue;
-        if (path.startsWith("..") || isAbsolute(input)) {
-            throw escapeRefusal("import", path);
+        const real = realOrSelf(absolute);
+        const inNodeModules = real.split(sep).includes("node_modules");
+        // #4732 — the fixture map and the case files are never uploaded. Both
+        // direct and transitive imports appear here, so one check covers both;
+        // a reserved name that is a symlink is matched by its target, which is
+        // the path the build reports.
+        const reserved = reservedTargets.get(real) ??
+            [toPosix(relative(treeRoot, absolute)), toPosix(relative(treeRoot, real))].find((path) => isAuthFixturesPath(path) || isAuthCaseFilePath(path));
+        if (reserved !== undefined) {
+            throw new FunctionBuildError(`function '${functionKey}' failed to build:\n  ${reserved}: auth fixtures and case files are never uploaded; ` +
+                "read them with 'primitive functions authorize' instead of importing them");
         }
-        if (outsideRoot(treeRoot, realpathSync(absolute)) !== null) {
-            throw escapeRefusal("import", path);
+        if (!isInsideDirectory(treeRoot, real)) {
+            // A dependency a bare specifier reached is inlined even when it sits
+            // under a declared directory: it is a package, not shared source.
+            if (inNodeModules && isDependencyFile(absolute))
+                continue;
+            if (sourceRoots.some((root) => isInsideDirectory(root, real))) {
+                projectSources.add(toPosix(relative(treeRoot, real)));
+                continue;
+            }
+            throw escapeRefusal("import", toPosix(relative(treeRoot, real)));
         }
-        // In-tree `node_modules` reached by a filesystem import: inside the
-        // boundary, so it builds — but `config pull` refuses to write a stored
-        // `node_modules` path, so capturing it would promise a round trip that
-        // cannot be kept.
+        const path = toPosix(relative(treeRoot, real));
+        // In-tree `node_modules`, reached by a bare specifier or a filesystem
+        // import: inside the boundary, so it builds — but `config pull` refuses to
+        // write a stored `node_modules` path, so capturing it would promise a round
+        // trip that cannot be kept.
         if (isDependencyPath(path))
             continue;
         const content = readFileSync(absolute);
@@ -336,6 +396,7 @@ export async function buildFunctionBundle(options) {
         bundle,
         contentHash: createHash("sha256").update(bundle).digest("hex"),
         sources,
+        projectSources: [...projectSources].sort(),
     };
 }
 //# sourceMappingURL=function-bundle.js.map

package/dist/src/lib/function-bundle.js.map

@@ -1 +1 @@
-{"version":3,"file":"function-bundle.js","sourceRoot":"","sources":["../../../src/lib/function-bundle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsEG;AAEH,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAE1D,qDAAqD;AACrD,MAAM,CAAC,MAAM,0BAA0B,GAAG,qBAAqB,CAAC;AAEhE,0EAA0E;AAC1E,MAAM,CAAC,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAElD,0EAA0E;AAC1E,MAAM,oBAAoB,GAAG,GAAW,EAAE,CACxC,QAAQ,kBAAkB,oCAAoC;IAC9D,IAAI,0BAA0B,WAAW,CAAC;AAE5C;;;;;;GAMG;AACH,MAAM,oBAAoB,GAAa;IACrC,6EAA6E;IAC7E,0DAA0D;IAC1D,IAAI,MAAM,CACR,kEAAkE,kBAAkB,KAAK,EACzF,GAAG,CACJ;IACD,qDAAqD;IACrD,IAAI,MAAM,CACR,sCAAsC,kBAAkB,KAAK,EAC7D,GAAG,CACJ;IACD,uEAAuE;IACvE,8CAA8C;IAC9C,IAAI,MAAM,CAAC,8BAA8B,kBAAkB,KAAK,EAAE,GAAG,CAAC;CACvE,CAAC;AAEF,6EAA6E;AAC7E,MAAM,UAAU,oBAAoB,CAAC,MAAc;IACjD,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,+DAA+D;AAC/D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC;AAElD,gFAAgF;AAChF,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAoCD;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAC5C,QAAuB;IAEvB,MAAM,SAAS,GAAG;QAChB,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,OAAO,EAAE,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC;aAC3B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;aAClD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnE,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,kEAAkE;QAClE,qEAAqE;QACrE,uEAAuE;QACvE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,IAAI,IAAI;QACnC,sEAAsE;QACtE,uEAAuE;QACvE,oEAAoE;QACpE,uEAAuE;QACvE,oDAAoD;QACpD,GAAG,CAAC,OAAO,QAAQ,CAAC,cAAc,KAAK,QAAQ,IAAI,QAAQ,CAAC,cAAc;YACxE,CAAC,CAAC,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE;YAC7C,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,QAAuB;IAC1D,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,CAAC,QAAQ,CAAC,CAAC,CAAC;SAC7D,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,gFAAgF;AAChF,MAAM,OAAO,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAEtE,gEAAgE;AAChE,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;AAClD,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,IAAY,EAAE,SAAiB;IAClD,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACtC,IAAI,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3E,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;AACtB,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,IAAY;IAC/C,OAAO,IAAI,kBAAkB,CAC3B,GAAG,IAAI,KAAK,IAAI,2CAA2C;QACzD,wEAAwE;QACxE,+CAA+C,CAClD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAOzC;IACC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;IAClD,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IAElD,0EAA0E;IAC1E,uEAAuE;IACvE,wDAAwD;IACxD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAG,WAAW,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACpD,IAAI,WAAW,KAAK,IAAI;QAAE,MAAM,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAEvE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,kBAAkB,CAC1B,aAAa,WAAW,kBAAkB,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAC3E,CAAC;IACJ,CAAC;IACD,0BAA0B;IAC1B,MAAM,SAAS,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,WAAW,CAAC,QAAQ,EAAE,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC;QAC9C,MAAM,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;IAE7D,2EAA2E;IAC3E,4EAA4E;IAC5E,4EAA4E;IAC5E,gEAAgE;IAChE,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAC1C,MAAM,kBAAkB,GAAG,CAAC,IAAY,EAAQ,EAAE;QAChD,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,CAAC;YACH,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;QACtE,CAAC;IACH,CAAC,CAAC;IACF,MAAM,gBAAgB,GAAG,CAAC,IAAY,EAAW,EAAE;QACjD,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3C,IAAI,CAAC;YACH,OAAO,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,oBAAoB,GAAmB;QAC3C,IAAI,EAAE,oCAAoC;QAC1C,KAAK,CAAC,KAAK;YACT,KAAK,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBAC/C,uEAAuE;gBACvE,sCAAsC;gBACtC,IAAK,IAAI,CAAC,UAAkB,EAAE,yBAAyB;oBAAE,OAAO,IAAI,CAAC;gBACrE,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa;oBAAE,OAAO,IAAI,CAAC;gBAC7C,mEAAmE;gBACnE,sEAAsE;gBACtE,wEAAwE;gBACxE,mCAAmC;gBACnC,IAAI,IAAI,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;oBACrC,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,CAAC,EAAE,CAAC;gBACxD,CAAC;gBACD,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAClE,qEAAqE;gBACrE,4DAA4D;gBAC5D,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAC1E,IAAI,CAAC,IAAI,IAAI,CAAC,cAAc;oBAAE,OAAO,IAAI,CAAC;gBAC1C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE;oBAC9C,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,UAAU,EAAE,EAAE,yBAAyB,EAAE,IAAI,EAAE;iBAChD,CAAC,CAAC;gBACH,qEAAqE;gBACrE,iEAAiE;gBACjE,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;oBAAE,OAAO,IAAI,CAAC;gBAC5C,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;oBACxC,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBACpC,CAAC;gBACD,OAAO,QAAQ,CAAC;YAClB,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;IAEF,IAAI,MAA2B,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC;YAC3B,WAAW,EAAE,CAAC,aAAa,CAAC;YAC5B,aAAa,EAAE,QAAQ;YACvB,MAAM,EAAE,IAAI;YACZ,KAAK,EAAE,KAAK;YACZ,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,SAAS;YACnB,MAAM,EAAE,QAAQ;YAChB,+CAA+C;YAC/C,QAAQ,EAAE,CAAC,0BAA0B,CAAC;YACtC,OAAO,EAAE,CAAC,oBAAoB,CAAC;YAC/B,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAa,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;YACrD,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE;gBAC1B,MAAM,KAAK,GAAG,CAAC,EAAE,QAAQ,EAAE,IAAI;oBAC7B,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;oBAClC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBACnB,MAAM,IAAI,GAAG,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5D,OAAO,KAAK,KAAK,GAAG,IAAI,KAAK,CAAC,EAAE,IAAI,IAAI,aAAa,EAAE,CAAC;YAC1D,CAAC,CAAC;YACJ,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAChE,MAAM,IAAI,kBAAkB,CAC1B,aAAa,WAAW,uBAAuB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACrE,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,kBAAkB,CAC1B,aAAa,WAAW,wCAAwC,OAAO,CAAC,KAAK,CAAC,GAAG,CAClF,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAE5C,8EAA8E;IAC9E,+EAA+E;IAC/E,6EAA6E;IAC7E,6EAA6E;IAC7E,mBAAmB;IACnB,MAAM,OAAO,GAAyB,EAAE,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC1C,IAAI,gBAAgB,CAAC,QAAQ,CAAC;YAAE,SAAS;QACzC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/C,MAAM,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACtC,CAAC;QACD,IAAI,WAAW,CAAC,QAAQ,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC3D,MAAM,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACtC,CAAC;QACD,oEAAoE;QACpE,uEAAuE;QACvE,uEAAuE;QACvE,kBAAkB;QAClB,IAAI,gBAAgB,CAAC,IAAI,CAAC;YAAE,SAAS;QACrC,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACvC,sEAAsE;QACtE,wEAAwE;QACxE,0EAA0E;QAC1E,IAAI,oBAAoB,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,kBAAkB,CAC1B,aAAa,WAAW,yBAAyB,IAAI,KAAK,oBAAoB,EAAE,EAAE,CACnF,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEzE,OAAO;QACL,KAAK,EAAE,aAAa;QACpB,MAAM;QACN,WAAW,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QAC9D,OAAO;KACR,CAAC;AACJ,CAAC"}
+{"version":3,"file":"function-bundle.js","sourceRoot":"","sources":["../../../src/lib/function-bundle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6EG;AAEH,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AACzE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAC1D,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,0BAA0B,GAC3B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAEhG,qDAAqD;AACrD,MAAM,CAAC,MAAM,0BAA0B,GAAG,qBAAqB,CAAC;AAEhE,0EAA0E;AAC1E,MAAM,CAAC,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAElD,0EAA0E;AAC1E,MAAM,oBAAoB,GAAG,GAAW,EAAE,CACxC,QAAQ,kBAAkB,oCAAoC;IAC9D,IAAI,0BAA0B,WAAW,CAAC;AAE5C;;;;;;GAMG;AACH,MAAM,oBAAoB,GAAa;IACrC,6EAA6E;IAC7E,0DAA0D;IAC1D,IAAI,MAAM,CACR,kEAAkE,kBAAkB,KAAK,EACzF,GAAG,CACJ;IACD,qDAAqD;IACrD,IAAI,MAAM,CACR,sCAAsC,kBAAkB,KAAK,EAC7D,GAAG,CACJ;IACD,uEAAuE;IACvE,8CAA8C;IAC9C,IAAI,MAAM,CAAC,8BAA8B,kBAAkB,KAAK,EAAE,GAAG,CAAC;CACvE,CAAC;AAEF,6EAA6E;AAC7E,MAAM,UAAU,oBAAoB,CAAC,MAAc;IACjD,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,+DAA+D;AAC/D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC;AAElD,gFAAgF;AAChF,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AA2CD;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAC5C,QAAuB;IAEvB,MAAM,SAAS,GAAG;QAChB,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,OAAO,EAAE,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC;aAC3B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;aAClD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnE,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,kEAAkE;QAClE,qEAAqE;QACrE,uEAAuE;QACvE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,IAAI,IAAI;QACnC,sEAAsE;QACtE,uEAAuE;QACvE,oEAAoE;QACpE,uEAAuE;QACvE,oDAAoD;QACpD,GAAG,CAAC,OAAO,QAAQ,CAAC,cAAc,KAAK,QAAQ,IAAI,QAAQ,CAAC,cAAc;YACxE,CAAC,CAAC,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE;YAC7C,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,QAAuB;IAC1D,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,CAAC,QAAQ,CAAC,CAAC,CAAC;SAC7D,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,gFAAgF;AAChF,MAAM,OAAO,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAEtE,gEAAgE;AAChE,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;AAClD,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,IAAY,EAAE,SAAiB;IAClD,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACtC,IAAI,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3E,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;AACtB,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,IAAY;IAC/C,OAAO,IAAI,kBAAkB,CAC3B,GAAG,IAAI,KAAK,IAAI,2CAA2C;QACzD,wEAAwE;QACxE,mEAAmE;QACnE,qCAAqC,oBAAoB,6BAA6B,CACzF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,uBAAuB,CAAC,QAAgB;IAC/C,MAAM,KAAK,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACnC,IAAI,CAAC;QACH,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,GAAG,aAAa,KAAK,EAAE,CAAC;YAClC,IAAI,kBAAkB,CAAC,IAAI,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,gEAAgE;IAClE,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACzC,IAAI,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,wEAAwE;AACxE,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAazC;IACC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;IAClD,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IAClD,MAAM,WAAW,GAAG,CAClB,OAAO,CAAC,WAAW;QACnB,0BAA0B,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CACzE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAE3C,0EAA0E;IAC1E,uEAAuE;IACvE,wDAAwD;IACxD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAG,WAAW,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACpD,IAAI,WAAW,KAAK,IAAI;QAAE,MAAM,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAEvE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,kBAAkB,CAC1B,aAAa,WAAW,kBAAkB,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAC3E,CAAC;IACJ,CAAC;IACD,0BAA0B;IAC1B,MAAM,SAAS,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,WAAW,CAAC,QAAQ,EAAE,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC;QAC9C,MAAM,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;IAE7D,2EAA2E;IAC3E,4EAA4E;IAC5E,4EAA4E;IAC5E,gEAAgE;IAChE,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAC1C,MAAM,kBAAkB,GAAG,CAAC,IAAY,EAAQ,EAAE;QAChD,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,CAAC;YACH,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;QACtE,CAAC;IACH,CAAC,CAAC;IACF,MAAM,gBAAgB,GAAG,CAAC,IAAY,EAAW,EAAE;QACjD,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3C,IAAI,CAAC;YACH,OAAO,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,oBAAoB,GAAmB;QAC3C,IAAI,EAAE,oCAAoC;QAC1C,KAAK,CAAC,KAAK;YACT,KAAK,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBAC/C,uEAAuE;gBACvE,sCAAsC;gBACtC,IAAK,IAAI,CAAC,UAAkB,EAAE,yBAAyB;oBAAE,OAAO,IAAI,CAAC;gBACrE,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa;oBAAE,OAAO,IAAI,CAAC;gBAC7C,mEAAmE;gBACnE,sEAAsE;gBACtE,wEAAwE;gBACxE,mCAAmC;gBACnC,IAAI,IAAI,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;oBACrC,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,CAAC,EAAE,CAAC;gBACxD,CAAC;gBACD,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAClE,qEAAqE;gBACrE,4DAA4D;gBAC5D,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAC1E,IAAI,CAAC,IAAI,IAAI,CAAC,cAAc;oBAAE,OAAO,IAAI,CAAC;gBAC1C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE;oBAC9C,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,UAAU,EAAE,EAAE,yBAAyB,EAAE,IAAI,EAAE;iBAChD,CAAC,CAAC;gBACH,qEAAqE;gBACrE,iEAAiE;gBACjE,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;oBAAE,OAAO,IAAI,CAAC;gBAC5C,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;oBACxC,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBACpC,CAAC;gBACD,OAAO,QAAQ,CAAC;YAClB,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;IAEF,IAAI,MAA2B,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC;YAC3B,WAAW,EAAE,CAAC,aAAa,CAAC;YAC5B,aAAa,EAAE,QAAQ;YACvB,MAAM,EAAE,IAAI;YACZ,KAAK,EAAE,KAAK;YACZ,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,SAAS;YACnB,MAAM,EAAE,QAAQ;YAChB,+CAA+C;YAC/C,QAAQ,EAAE,CAAC,0BAA0B,CAAC;YACtC,OAAO,EAAE,CAAC,oBAAoB,CAAC;YAC/B,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAa,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;YACrD,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE;gBAC1B,MAAM,KAAK,GAAG,CAAC,EAAE,QAAQ,EAAE,IAAI;oBAC7B,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;oBAClC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBACnB,MAAM,IAAI,GAAG,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5D,OAAO,KAAK,KAAK,GAAG,IAAI,KAAK,CAAC,EAAE,IAAI,IAAI,aAAa,EAAE,CAAC;YAC1D,CAAC,CAAC;YACJ,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAChE,MAAM,IAAI,kBAAkB,CAC1B,aAAa,WAAW,uBAAuB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACrE,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,kBAAkB,CAC1B,aAAa,WAAW,wCAAwC,OAAO,CAAC,KAAK,CAAC,GAAG,CAClF,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAE5C,8EAA8E;IAC9E,4EAA4E;IAC5E,sCAAsC;IACtC,MAAM,OAAO,GAAyB,EAAE,CAAC;IACzC,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IACzC,MAAM,eAAe,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAC1D,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;QAC/D,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QAClC,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QAE/D,sEAAsE;QACtE,uEAAuE;QACvE,uEAAuE;QACvE,8BAA8B;QAC9B,MAAM,QAAQ,GACZ,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC;YACzB,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAC7E,CAAC,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAC/D,CAAC;QACJ,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,kBAAkB,CAC1B,aAAa,WAAW,yBAAyB,QAAQ,qDAAqD;gBAC5G,0EAA0E,CAC7E,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC;YACvC,qEAAqE;YACrE,kEAAkE;YAClE,IAAI,aAAa,IAAI,gBAAgB,CAAC,QAAQ,CAAC;gBAAE,SAAS;YAC1D,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;gBAC9D,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;gBACtD,SAAS;YACX,CAAC;YACD,MAAM,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QACnE,CAAC;QAED,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;QAC/C,sEAAsE;QACtE,2EAA2E;QAC3E,4EAA4E;QAC5E,4BAA4B;QAC5B,IAAI,gBAAgB,CAAC,IAAI,CAAC;YAAE,SAAS;QACrC,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACvC,sEAAsE;QACtE,wEAAwE;QACxE,0EAA0E;QAC1E,IAAI,oBAAoB,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,kBAAkB,CAC1B,aAAa,WAAW,yBAAyB,IAAI,KAAK,oBAAoB,EAAE,EAAE,CACnF,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEzE,OAAO;QACL,KAAK,EAAE,aAAa;QACpB,MAAM;QACN,WAAW,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QAC9D,OAAO;QACP,cAAc,EAAE,CAAC,GAAG,cAAc,CAAC,CAAC,IAAI,EAAE;KAC3C,CAAC;AACJ,CAAC"}

package/dist/src/lib/function-collect.d.ts

@@ -51,6 +51,14 @@
  */
 /** The manifest encoding, versioned with the envelope that carries it. */
 export declare const FUNCTION_MANIFEST_SCHEMA_VERSION = 2;
+/**
+ * The version a FLAGGED build emits (#4730): version 2 plus the `authorize`
+ * block and `writeFamilies`. A bare-handler build keeps emitting version 2,
+ * byte for byte, so no legacy envelope hash moves.
+ */
+export declare const FUNCTION_MANIFEST_AUTHORIZE_SCHEMA_VERSION = 3;
+/** How much of one authorize source text the families scan reads. */
+export declare const AUTHORIZE_SOURCE_SCAN_CAP: number;
 /** How long a tree's module scope may run before collection gives up. */
 export declare const COLLECT_TIMEOUT_MS = 20000;
 /** A push that cannot proceed because its manifest could not be collected. */
@@ -85,11 +93,46 @@ export interface FunctionManifest {
     families: string[];
     /** A model name the scan could not resolve; "and possibly more". */
     dynamicModels: boolean;
+    /** Version 3 only: the families a write or send verb reaches (#4730). */
+    writeFamilies?: string[];
+    /** Version 3 only: what the exported `authorize` admits (#4730). */
+    authorize?: CollectedAuthorize;
+}
+/** The `authorize` block of a version-3 manifest (#4730). */
+export interface CollectedAuthorize {
+    present: true;
+    public: boolean;
+    helper: string | null;
+    callers: {
+        webhook: boolean;
+        cron: boolean;
+        manual: boolean;
+        functions: string[];
+        agents: boolean | "rule";
+        users: false | "rule";
+        /** #4803 — present, and true, only when the `db3` door is open. */
+        db3?: true;
+    } | null;
+    families: string[];
 }
+/**
+ * The `auth.*` families a hand-written authorize's source text reaches —
+ * #4730 behavior 4.
+ *
+ * A member-access scan, on whatever the author named the parameter, plus the
+ * families of any SDK helper the text calls by name (esbuild may suffix a
+ * renamed import, `requireRole2(`). `hasRole` compares `auth.user.role` and
+ * reads no membership. Imprecise by construction, as `families[]` is: a body
+ * that delegates to a function defined elsewhere records nothing, and an
+ * unrelated `.user` in the text counts. Each text is read to
+ * {@link AUTHORIZE_SOURCE_SCAN_CAP} only.
+ */
+export declare function scanAuthorizeSources(sources: string[]): string[];
 export declare function scanBundleForManifest(bundle: string): {
     models: string[];
     families: string[];
     dynamicModels: boolean;
+    writeFamilies: string[];
 };
 /**
  * The recording stub the collect build substitutes for
@@ -99,17 +142,21 @@ export declare function scanBundleForManifest(bundle: string): {
  * every other export are inert, so a module that calls one at import time
  * neither fails nor has an effect.
  */
-export declare const COLLECT_STUB_SOURCE = "\nconst registry = (globalThis.__PRIMITIVE_COLLECT_REGISTRY__ ||= []);\n\n// The default-coercion rule the SDK applies at registration (#3281,\n// D3281-SO-005), spelled here too so a default the declared type cannot\n// coerce is refused at PUSH \u2014 this stub is what push runs \u2014 rather than at\n// the first invocation. The vendored grammar (`coerceParamDefault` in\n// generated-config-surfaces.ts) is the same rule and re-checks the manifest.\nconst SCALAR_TYPES = [\"string\", \"number\", \"boolean\", \"any\"];\nfunction coerceScalar(type, value) {\n  if (type === \"number\") {\n    const n = typeof value === \"number\" ? value : Number(value);\n    if (typeof value === \"boolean\" || value === null || value === \"\" || !Number.isFinite(n)) {\n      return { ok: false, reason: \"must be a number\" };\n    }\n    return { ok: true, value: n };\n  }\n  if (type === \"boolean\") {\n    if (typeof value === \"boolean\") return { ok: true, value };\n    if (value === \"true\") return { ok: true, value: true };\n    if (value === \"false\") return { ok: true, value: false };\n    return { ok: false, reason: \"must be a boolean\" };\n  }\n  if (type === \"string\") {\n    if (typeof value !== \"string\") return { ok: false, reason: \"must be a string\" };\n    return { ok: true, value };\n  }\n  return { ok: true, value };\n}\nfunction coerceDefault(spec, value) {\n  if (spec.type === \"array\") {\n    if (!Array.isArray(value)) return { ok: false, reason: \"must be an array\" };\n    const itemType = spec.items && spec.items.type ? String(spec.items.type) : \"any\";\n    const out = [];\n    for (const element of value) {\n      const coerced = coerceScalar(itemType, element);\n      if (!coerced.ok) return { ok: false, reason: \"every element \" + coerced.reason };\n      out.push(coerced.value);\n    }\n    return { ok: true, value: out };\n  }\n  return coerceScalar(spec.type === undefined ? \"any\" : String(spec.type), value);\n}\n\nfunction record(kind, name, config) {\n  const c = config || {};\n  const params = {};\n  for (const [key, value] of Object.entries(c.params || {})) {\n    const spec = value && typeof value === \"object\" ? value : { type: String(value) };\n    const entry = {};\n    const fail = (message) => {\n      throw new Error(\"'\" + name + \"': parameter '\" + key + \"' \" + message);\n    };\n    if (spec.type !== undefined) entry.type = String(spec.type);\n    if (entry.type === \"array\") {\n      if (spec.items !== undefined && spec.items !== null) {\n        const itemType =\n          spec.items && typeof spec.items === \"object\" ? String(spec.items.type ?? \"\") : \"\";\n        if (!SCALAR_TYPES.includes(itemType)) {\n          fail(\"declares an `items` type outside \" + SCALAR_TYPES.join(\", \") + \".\");\n        }\n        entry.items = { type: itemType };\n      }\n      if (spec.caller === true) fail(\"is an array bound to $caller; `caller` is a scalar binding.\");\n    }\n    if (spec.default !== undefined) {\n      const coerced = coerceDefault(entry, spec.default);\n      if (!coerced.ok) fail(\"has a default that \" + coerced.reason + \".\");\n      entry.default = coerced.value;\n    }\n    if (spec.caller === true || spec === \"$caller\" || spec.type === \"$caller\") {\n      entry.caller = true;\n    }\n    params[String(key)] = entry;\n  }\n  const declaredCaller = Object.values(params).some((p) => p.caller === true);\n  registry.push({\n    kind,\n    name: String(name),\n    models: Array.isArray(c.models) ? c.models.map(String) : [],\n    params,\n    cache:\n      c.cache && typeof c.cache === \"object\" && Number(c.cache.ttlMs) > 0\n        ? { ttlMs: Number(c.cache.ttlMs) }\n        : null,\n    callerScoped: declaredCaller,\n  });\n  return async () => {\n    throw new Error(\n      \"'\" + name + \"' was called during manifest collection; a registration's \" +\n        \"`run` only executes inside a real invocation.\"\n    );\n  };\n}\n\n// The PUBLIC surface, all of it. An ESM import of a name a module does not\n// export is a build error, so a stub missing one export refuses a tree the\n// sandbox would have run \u2014 collection is mandatory, so that is a valid\n// function that cannot be pushed at all (CR3187-007). The constants carry the\n// runtime's own values so a registration computed from one collects the same\n// way it will run.\nexport const SDK_STUB_VERSION = \"collect\";\nexport const MAX_QUERY_CACHE_TTL_MS = 60000;\nexport const PMAP_DEFAULT_CONCURRENCY = 8;\nexport function defineQuery(name, config) { return record(\"query\", name, config); }\nexport function defineMutation(name, config) { return record(\"mutation\", name, config); }\nexport function defineFunction(keyOrHandler, maybeHandler) {\n  // The KEYED form (#3281) returns a wrapper CARRYING its key, exactly as the\n  // baked SDK's does. That is what push reads: the child resolves the callable\n  // the bootstrap would select and compares THAT key to the file's\n  // (D3281-SO-006). The registry entry is the child's report of what the\n  // module scope did; it is not what the check consults, because a keyed\n  // handler an entry merely imports for composition registers here too.\n  if (typeof keyOrHandler === \"string\" || maybeHandler !== undefined) {\n    registry.push({ kind: \"function\", name: String(keyOrHandler) });\n    const wrapped = function (...args) {\n      return maybeHandler(...args);\n    };\n    wrapped.functionKey = String(keyOrHandler);\n    return wrapped;\n  }\n  return keyOrHandler;\n}\nexport function pMap(items, mapper) { return Promise.all((items || []).map(mapper)); }\nexport function ulid() { return \"00000000000000000000000000\"; }\nexport const stepPolicy = new Proxy({}, { get: () => ({}) });\n// #3482 \u2014 the runtime surface, and `assertRuntime` is INERT here on purpose.\n// Collection has no runtime: this child process exists to learn what a tree\n// registers, and there is nothing for an assertion to be about. A stub that\n// threw would refuse exactly the functions the assertion exists for \u2014 and the\n// placement the guide teaches is module scope, which collection runs.\nexport function assertRuntime() {}\nexport class FunctionRuntimeError extends Error {\n  constructor(message, runtime, required) {\n    super(message);\n    this.name = \"FUNCTION_RUNTIME_REFUSED\";\n    this.runtime = runtime;\n    this.required = required;\n  }\n}\nexport default {\n  SDK_STUB_VERSION,\n  defineFunction,\n  defineQuery,\n  defineMutation,\n  pMap,\n  ulid,\n  assertRuntime,\n  FunctionRuntimeError,\n};\n";
-/**
- * Collect one function's manifest.
- *
- * Throws `FunctionCollectError` for every failure — a build error, a module
- * that throws at import, a loop that outlives the bound, or output that is not
- * the framed result — because a push whose manifest could not be collected is
- * refused rather than pushed without one (D3187-SO-005: the manifest is part
- * of the envelope, so "later" would mean a different version).
- */
-export declare function collectFunctionManifest(options: {
+export declare const COLLECT_STUB_SOURCE: string;
+/** What one collect pass learns about a function. */
+export interface CollectedFunction {
+    /** The manifest the envelope carries. */
+    manifest: FunctionManifest;
+    /**
+     * Whether the callable the bootstrap would select carries `authorize` — the
+     * object form (#4717). The CLI's local answer, which decides whether
+     * `access` is sent and compared; the server records its own from the push
+     * probe, and this never travels in the push.
+     */
+    authorize: boolean;
+}
+/** What `collectFunction` and `collectFunctionManifest` take. */
+export interface CollectOptions {
     configDir: string;
     entry: string;
     functionKey: string;
@@ -120,4 +167,20 @@ export declare function collectFunctionManifest(options: {
      * runs; the real bundle is, and its literals are what the scan reads.
      */
     bundle?: string;
-}): Promise<FunctionManifest>;
+}
+/**
+ * Collect one function's manifest.
+ *
+ * Throws `FunctionCollectError` for every failure — a build error, a module
+ * that throws at import, a loop that outlives the bound, or output that is not
+ * the framed result — because a push whose manifest could not be collected is
+ * refused rather than pushed without one (D3187-SO-005: the manifest is part
+ * of the envelope, so "later" would mean a different version).
+ */
+export declare function collectFunctionManifest(options: CollectOptions): Promise<FunctionManifest>;
+/**
+ * Collect one function's manifest and its local `authorize` answer (#4717),
+ * from the one run of its module scope. Throws as `collectFunctionManifest`
+ * does.
+ */
+export declare function collectFunction(options: CollectOptions): Promise<CollectedFunction>;