primitive-admin 1.2.0-alpha.1 → 1.2.0-alpha.11

package/dist/src/lib/function-authorize-check.d.ts

@@ -0,0 +1,142 @@
+/**
+ * `primitive functions authorize` without the I/O — #4732, project
+ * `function-authorize` phase 3.
+ *
+ * The verb asks the admin endpoint `POST functions/{id}/authorize` to run a
+ * function's `authorize` alone, and reports what it decided: one check from
+ * flags, or every case in the function's case file. This module is the part
+ * a test can pin without a server: the `--trigger` and `--runtime` grammar,
+ * fixture aliases, the case file, the verdict on a case, and the rendering.
+ */
+/** The door kinds `--trigger` names, as the server spells them. */
+export declare const TRIGGER_FLAG_KINDS: readonly ["http", "webhook", "cron", "function", "manual", "tool", "context", "history", "db3"];
+/** What the endpoint's `trigger` field is built from. */
+export type CheckTrigger = {
+    kind: string;
+    functionKey?: string;
+    toolName?: string;
+};
+/**
+ * `--trigger` (and a case's `trigger`): a door kind, `function:<key>` for a
+ * nested start from the parent `<key>`, or `tool[:<name>]`. A bare `function`
+ * names no parent, so it is refused.
+ */
+export declare function parseTriggerFlag(text: string): {
+    ok: true;
+    trigger: CheckTrigger;
+} | {
+    ok: false;
+    error: string;
+};
+/** `--runtime` (and a case's `runtime`): the isolate `authorize` loads in. */
+export declare function parseRuntimeFlag(text: string): {
+    ok: true;
+    runtime: "request" | "task";
+} | {
+    ok: false;
+    error: string;
+};
+/** A resolved value, or the first alias the map lacks. */
+export type AliasResolution = {
+    ok: true;
+    value: unknown;
+} | {
+    ok: false;
+    alias: string;
+    path: string;
+    error: string;
+};
+/**
+ * Replace every string that is exactly `@<name>` with the fixture `<name>`,
+ * in objects and arrays at any depth. `@@…` is a literal `@…`; every other
+ * string, a lone `@` included, is kept as it is.
+ */
+export declare function resolveAliases(value: unknown, fixtures: Record<string, unknown>, fixturesPath: string, path?: string): AliasResolution;
+/** The codes a case may expect of a deny. */
+export declare const CASE_DENY_CODES: readonly ["FORBIDDEN", "NOT_FOUND", "INVALID"];
+/** One case of a case file, with its defaults filled in. */
+export interface AuthorizeCase {
+    name: string;
+    /** An id, an `@alias`, or null. */
+    user: string | null;
+    role: string | null;
+    /** In the `--trigger` grammar. */
+    trigger: string;
+    /** Null leaves the endpoint's per-kind default. */
+    runtime: "request" | "task" | null;
+    input: unknown;
+    expect: "allow" | "deny";
+    code: (typeof CASE_DENY_CODES)[number] | null;
+}
+/**
+ * A case file: a JSON array of `{ name, user?, role?, trigger?, runtime?,
+ * input?, expect, code? }`. Any mistake refuses the whole file, naming the
+ * file, the case and the key, so nothing runs against half a file.
+ */
+export declare function parseAuthorizeCaseFile(text: string, path: string): {
+    ok: true;
+    cases: AuthorizeCase[];
+} | {
+    ok: false;
+    error: string;
+};
+/** The endpoint's body for one check; `runtime` only when one was named. */
+export declare function checkRequestBody(fields: {
+    user: string | null;
+    role: string | null;
+    trigger: CheckTrigger;
+    runtime: "request" | "task" | null;
+    input: unknown;
+}): Record<string, unknown>;
+/** The endpoint's answer, or why no request was made. */
+export type CheckOutcome = {
+    httpStatus: number;
+    body: any;
+} | {
+    error: string;
+};
+/** One case's row, for the table and `--json`. */
+export interface CaseRow {
+    functionKey: string;
+    name: string;
+    /** `allow` or `deny`; `-` on the row of a case file that could not be read. */
+    expect: string;
+    decision: string | null;
+    cause: string | null;
+    code: string | null;
+    reason: string | null;
+    ms: number | null;
+    reads: number | null;
+    pass: boolean;
+    error?: string;
+}
+/**
+ * A case's verdict. It passes when the decision is the one expected and,
+ * when the case names a code, the code is that code; an `authorize-error` is
+ * a deny with no code. A case that could not be decided — no request made, a
+ * refusal, a version with no `authorize` — fails, saying why.
+ */
+export declare function judgeCase(functionKey: string, testCase: {
+    name: string;
+    expect: string;
+    code: string | null;
+}, outcome: CheckOutcome): CaseRow;
+/** The single check's one line. */
+export declare function renderCheckLine(body: any): string;
+/** 0 allow, 1 deny (an `authorize-error` included), 2 when no check was made. */
+export declare function exitCodeForCheck(outcome: {
+    httpStatus: number;
+    body: any;
+}): 0 | 1 | 2;
+/** The case table: `CASE EXPECT GOT CODE MS READS RESULT`, FUNCTION first for `--all`. */
+export declare function renderCaseTable(rows: CaseRow[], options: {
+    withFunction: boolean;
+}): string;
+/** `N passed, M failed`. */
+export declare function caseSummary(rows: CaseRow[]): {
+    passed: number;
+    failed: number;
+    line: string;
+};
+/** The keys with a case file in a tree's `functions/` directory, sorted. */
+export declare function caseFilesInTree(functionsDir: string): string[];

package/dist/src/lib/function-authorize-check.js

@@ -0,0 +1,310 @@
+/**
+ * `primitive functions authorize` without the I/O — #4732, project
+ * `function-authorize` phase 3.
+ *
+ * The verb asks the admin endpoint `POST functions/{id}/authorize` to run a
+ * function's `authorize` alone, and reports what it decided: one check from
+ * flags, or every case in the function's case file. This module is the part
+ * a test can pin without a server: the `--trigger` and `--runtime` grammar,
+ * fixture aliases, the case file, the verdict on a case, and the rendering.
+ */
+import { existsSync, readdirSync } from "fs";
+import { AUTH_CASE_FILE_SUFFIX } from "./auth-fixtures.js";
+/** The door kinds `--trigger` names, as the server spells them. */
+export const TRIGGER_FLAG_KINDS = [
+    "http",
+    "webhook",
+    "cron",
+    "function",
+    "manual",
+    "tool",
+    "context",
+    "history",
+    "db3",
+];
+const TRIGGER_GRAMMAR = "http, webhook, cron, manual, context, history, db3, function:<key>, tool or tool:<name>";
+/**
+ * `--trigger` (and a case's `trigger`): a door kind, `function:<key>` for a
+ * nested start from the parent `<key>`, or `tool[:<name>]`. A bare `function`
+ * names no parent, so it is refused.
+ */
+export function parseTriggerFlag(text) {
+    const refuse = (why) => ({ ok: false, error: `trigger '${text}' ${why}; use ${TRIGGER_GRAMMAR}` });
+    const colon = text.indexOf(":");
+    const kind = colon === -1 ? text : text.slice(0, colon);
+    const param = colon === -1 ? null : text.slice(colon + 1);
+    if (!TRIGGER_FLAG_KINDS.includes(kind))
+        return refuse("is not a door");
+    if (kind === "function") {
+        if (!param)
+            return refuse("needs the parent function's key, function:<key>");
+        return { ok: true, trigger: { kind, functionKey: param } };
+    }
+    if (kind === "tool" && param !== null) {
+        if (!param)
+            return refuse("needs a tool name after the colon");
+        return { ok: true, trigger: { kind, toolName: param } };
+    }
+    if (param !== null)
+        return refuse("takes no parameter");
+    return { ok: true, trigger: { kind } };
+}
+/** `--runtime` (and a case's `runtime`): the isolate `authorize` loads in. */
+export function parseRuntimeFlag(text) {
+    if (text === "request" || text === "task")
+        return { ok: true, runtime: text };
+    return { ok: false, error: `runtime '${text}' must be request or task` };
+}
+/**
+ * Replace every string that is exactly `@<name>` with the fixture `<name>`,
+ * in objects and arrays at any depth. `@@…` is a literal `@…`; every other
+ * string, a lone `@` included, is kept as it is.
+ */
+export function resolveAliases(value, fixtures, fixturesPath, path = "$") {
+    if (typeof value === "string") {
+        if (value.startsWith("@@"))
+            return { ok: true, value: value.slice(1) };
+        if (value.startsWith("@") && value.length > 1) {
+            const alias = value.slice(1);
+            if (!Object.prototype.hasOwnProperty.call(fixtures, alias)) {
+                return {
+                    ok: false,
+                    alias,
+                    path,
+                    error: `unknown fixture alias @${alias} at ${path}: ${fixturesPath} has no "${alias}"`,
+                };
+            }
+            return { ok: true, value: fixtures[alias] };
+        }
+        return { ok: true, value };
+    }
+    if (Array.isArray(value)) {
+        const out = [];
+        for (let i = 0; i < value.length; i++) {
+            const item = resolveAliases(value[i], fixtures, fixturesPath, `${path}[${i}]`);
+            if (item.ok === false)
+                return item;
+            out.push(item.value);
+        }
+        return { ok: true, value: out };
+    }
+    if (value !== null && typeof value === "object") {
+        // Entries, not `out[key] =`: an own `__proto__` key JSON.parse made is
+        // data the author wrote, and an assignment would hit the prototype setter.
+        const entries = [];
+        for (const [key, child] of Object.entries(value)) {
+            const item = resolveAliases(child, fixtures, fixturesPath, `${path}.${key}`);
+            if (item.ok === false)
+                return item;
+            entries.push([key, item.value]);
+        }
+        return { ok: true, value: Object.fromEntries(entries) };
+    }
+    return { ok: true, value };
+}
+/** The codes a case may expect of a deny. */
+export const CASE_DENY_CODES = ["FORBIDDEN", "NOT_FOUND", "INVALID"];
+const CASE_KEYS = ["name", "user", "role", "trigger", "runtime", "input", "expect", "code"];
+/**
+ * A case file: a JSON array of `{ name, user?, role?, trigger?, runtime?,
+ * input?, expect, code? }`. Any mistake refuses the whole file, naming the
+ * file, the case and the key, so nothing runs against half a file.
+ */
+export function parseAuthorizeCaseFile(text, path) {
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch (err) {
+        return { ok: false, error: `${path} is not valid JSON: ${err?.message || String(err)}` };
+    }
+    if (!Array.isArray(parsed)) {
+        return { ok: false, error: `${path} must be a JSON array of cases` };
+    }
+    const cases = [];
+    const names = new Set();
+    for (let i = 0; i < parsed.length; i++) {
+        const raw = parsed[i];
+        const refuse = (label, why) => ({ ok: false, error: `${path}: ${label}: ${why}` });
+        if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+            return refuse(`case ${i + 1}`, "must be an object");
+        }
+        const entry = raw;
+        if (typeof entry.name !== "string" || !entry.name) {
+            return refuse(`case ${i + 1}`, `"name" is required and must be a non-empty string`);
+        }
+        const label = `case "${entry.name}"`;
+        if (names.has(entry.name))
+            return refuse(label, `duplicate name "${entry.name}"`);
+        names.add(entry.name);
+        const unknown = Object.keys(entry).find((key) => !CASE_KEYS.includes(key));
+        if (unknown)
+            return refuse(label, `unknown key "${unknown}"; a case takes ${CASE_KEYS.join(", ")}`);
+        const user = entry.user ?? null;
+        if (user !== null && typeof user !== "string")
+            return refuse(label, `"user" must be a user id, an @alias or null`);
+        const role = entry.role ?? null;
+        if (role !== null && (typeof role !== "string" || !role))
+            return refuse(label, `"role" must be a non-empty string`);
+        const trigger = entry.trigger ?? "http";
+        if (typeof trigger !== "string")
+            return refuse(label, `"trigger" must be a string`);
+        const parsedTrigger = parseTriggerFlag(trigger);
+        if (parsedTrigger.ok === false)
+            return refuse(label, `"trigger": ${parsedTrigger.error}`);
+        let runtime = null;
+        if (entry.runtime !== undefined && entry.runtime !== null) {
+            const parsedRuntime = parseRuntimeFlag(String(entry.runtime));
+            if (!parsedRuntime.ok || typeof entry.runtime !== "string") {
+                return refuse(label, `"runtime" must be "request" or "task"`);
+            }
+            runtime = parsedRuntime.runtime;
+        }
+        if (entry.expect !== "allow" && entry.expect !== "deny") {
+            return refuse(label, `"expect" is required and must be "allow" or "deny"`);
+        }
+        let code = null;
+        if (entry.code !== undefined && entry.code !== null) {
+            if (entry.expect !== "deny")
+                return refuse(label, `"code" applies only to "expect": "deny"`);
+            if (!CASE_DENY_CODES.includes(entry.code)) {
+                return refuse(label, `"code" must be one of ${CASE_DENY_CODES.join(", ")}`);
+            }
+            code = entry.code;
+        }
+        cases.push({
+            name: entry.name,
+            user: user,
+            role: role,
+            trigger,
+            runtime,
+            input: entry.input === undefined ? {} : entry.input,
+            expect: entry.expect,
+            code,
+        });
+    }
+    return { ok: true, cases };
+}
+/** The endpoint's body for one check; `runtime` only when one was named. */
+export function checkRequestBody(fields) {
+    return {
+        user: fields.user,
+        ...(fields.role ? { role: fields.role } : {}),
+        trigger: fields.trigger,
+        ...(fields.runtime ? { runtime: fields.runtime } : {}),
+        input: fields.input,
+    };
+}
+/** A refusal's one-line reason, from the admin API's envelope. */
+function refusalText(outcome) {
+    const body = outcome.body ?? {};
+    const code = body.code ?? body.errorCode;
+    const reason = body.reason ? ` (${body.reason})` : "";
+    return `${outcome.httpStatus}${code ? ` ${code}` : ""}: ${body.error ?? "request refused"}${reason}`;
+}
+/**
+ * A case's verdict. It passes when the decision is the one expected and,
+ * when the case names a code, the code is that code; an `authorize-error` is
+ * a deny with no code. A case that could not be decided — no request made, a
+ * refusal, a version with no `authorize` — fails, saying why.
+ */
+export function judgeCase(functionKey, testCase, outcome) {
+    const row = {
+        functionKey,
+        name: testCase.name,
+        expect: testCase.expect,
+        decision: null,
+        cause: null,
+        code: null,
+        reason: null,
+        ms: null,
+        reads: null,
+        pass: false,
+    };
+    if ("error" in outcome)
+        return { ...row, error: outcome.error };
+    if (outcome.httpStatus >= 400)
+        return { ...row, error: refusalText(outcome) };
+    const body = outcome.body ?? {};
+    if (body.decision === "legacy") {
+        return { ...row, decision: "legacy", error: "legacy (this version has no authorize)" };
+    }
+    const decided = {
+        ...row,
+        decision: typeof body.decision === "string" ? body.decision : null,
+        cause: body.cause ?? null,
+        code: body.code ?? null,
+        reason: body.reason ?? null,
+        ms: typeof body.ms === "number" ? body.ms : null,
+        reads: typeof body.reads === "number" ? body.reads : null,
+    };
+    decided.pass =
+        decided.decision === testCase.expect && (testCase.code === null || decided.code === testCase.code);
+    return decided;
+}
+/** The single check's one line. */
+export function renderCheckLine(body) {
+    if (body?.decision === "legacy")
+        return "legacy (this version has no authorize)";
+    const figures = `${body?.ms ?? "-"} ms  ${body?.reads ?? "-"} reads`;
+    if (body?.decision === "allow")
+        return `allow  ${figures}`;
+    if (body?.cause === "authorize-error")
+        return `deny  authorize-error ${body.reason}  ${figures}`;
+    const message = typeof body?.message === "string" ? `  ${JSON.stringify(body.message)}` : "";
+    return `deny  ${body?.code ?? "-"}${message}  ${figures}`;
+}
+/** 0 allow, 1 deny (an `authorize-error` included), 2 when no check was made. */
+export function exitCodeForCheck(outcome) {
+    if (outcome.httpStatus >= 400)
+        return 2;
+    if (outcome.body?.decision === "allow")
+        return 0;
+    if (outcome.body?.decision === "deny")
+        return 1;
+    return 2;
+}
+function resultCell(row) {
+    if (row.pass)
+        return "pass";
+    if (row.error)
+        return `fail: ${row.error}`;
+    if (row.cause === "authorize-error")
+        return `fail: authorize-error ${row.reason}`;
+    return "fail";
+}
+/** The case table: `CASE EXPECT GOT CODE MS READS RESULT`, FUNCTION first for `--all`. */
+export function renderCaseTable(rows, options) {
+    const header = [...(options.withFunction ? ["FUNCTION"] : []), "CASE", "EXPECT", "GOT", "CODE", "MS", "READS", "RESULT"];
+    const lines = rows.map((row) => [
+        ...(options.withFunction ? [row.functionKey] : []),
+        row.name,
+        row.expect,
+        row.decision ?? "-",
+        row.code ?? "-",
+        row.ms === null ? "-" : String(row.ms),
+        row.reads === null ? "-" : String(row.reads),
+        resultCell(row),
+    ]);
+    const widths = header.map((h, i) => Math.max(h.length, ...lines.map((cells) => cells[i].length)));
+    const render = (cells) => cells
+        .map((cell, i) => (i === cells.length - 1 ? cell : cell.padEnd(widths[i])))
+        .join("  ");
+    return [render(header), ...lines.map(render)].join("\n");
+}
+/** `N passed, M failed`. */
+export function caseSummary(rows) {
+    const passed = rows.filter((row) => row.pass).length;
+    const failed = rows.length - passed;
+    return { passed, failed, line: `${passed} passed, ${failed} failed` };
+}
+/** The keys with a case file in a tree's `functions/` directory, sorted. */
+export function caseFilesInTree(functionsDir) {
+    if (!existsSync(functionsDir))
+        return [];
+    return readdirSync(functionsDir)
+        .filter((file) => file.endsWith(AUTH_CASE_FILE_SUFFIX) && file.length > AUTH_CASE_FILE_SUFFIX.length)
+        .map((file) => file.slice(0, -AUTH_CASE_FILE_SUFFIX.length))
+        .sort();
+}
+//# sourceMappingURL=function-authorize-check.js.map

package/dist/src/lib/function-authorize-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"function-authorize-check.js","sourceRoot":"","sources":["../../../src/lib/function-authorize-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,IAAI,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,mEAAmE;AACnE,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,MAAM;IACN,SAAS;IACT,MAAM;IACN,UAAU;IACV,QAAQ;IACR,MAAM;IACN,SAAS;IACT,SAAS;IACT,KAAK;CACG,CAAC;AAEX,MAAM,eAAe,GACnB,yFAAyF,CAAC;AAK5F;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAY;IAEZ,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAc,EAAE,KAAK,EAAE,YAAY,IAAI,KAAK,GAAG,SAAS,eAAe,EAAE,EAAE,CAAC,CAAC;IACpH,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAE,kBAAwC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC,eAAe,CAAC,CAAC;IAC9F,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACxB,IAAI,CAAC,KAAK;YAAE,OAAO,MAAM,CAAC,iDAAiD,CAAC,CAAC;QAC7E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,CAAC;IAC7D,CAAC;IACD,IAAI,IAAI,KAAK,MAAM,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACtC,IAAI,CAAC,KAAK;YAAE,OAAO,MAAM,CAAC,mCAAmC,CAAC,CAAC;QAC/D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC;IAC1D,CAAC;IACD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC,oBAAoB,CAAC,CAAC;IACxD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC;AACzC,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,gBAAgB,CAC9B,IAAY;IAEZ,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC9E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,IAAI,2BAA2B,EAAE,CAAC;AAC3E,CAAC;AAOD;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,KAAc,EACd,QAAiC,EACjC,YAAoB,EACpB,IAAI,GAAG,GAAG;IAEV,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC7B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;gBAC3D,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,KAAK;oBACL,IAAI;oBACJ,KAAK,EAAE,0BAA0B,KAAK,OAAO,IAAI,KAAK,YAAY,YAAY,KAAK,GAAG;iBACvF,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9C,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,GAAG,GAAc,EAAE,CAAC;QAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;YAC/E,IAAI,IAAI,CAAC,EAAE,KAAK,KAAK;gBAAE,OAAO,IAAI,CAAC;YACnC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IAClC,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,uEAAuE;QACvE,2EAA2E;QAC3E,MAAM,OAAO,GAAwB,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC;YAC7E,IAAI,IAAI,CAAC,EAAE,KAAK,KAAK;gBAAE,OAAO,IAAI,CAAC;YACnC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1D,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC;AAED,6CAA6C;AAC7C,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,SAAS,CAAU,CAAC;AAiB9E,MAAM,SAAS,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;AAE5F;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,IAAY,EACZ,IAAY;IAEZ,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,IAAI,uBAAuB,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IAC3F,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,IAAI,gCAAgC,EAAE,CAAC;IACvE,CAAC;IACD,MAAM,KAAK,GAAoB,EAAE,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACtB,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,GAAW,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAc,EAAE,KAAK,EAAE,GAAG,IAAI,KAAK,KAAK,KAAK,GAAG,EAAE,EAAE,CAAC,CAAC;QAC5G,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAClE,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,mBAAmB,CAAC,CAAC;QACtD,CAAC;QACD,MAAM,KAAK,GAAG,GAA8B,CAAC;QAC7C,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAClD,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,mDAAmD,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,KAAK,GAAG,SAAS,KAAK,CAAC,IAAI,GAAG,CAAC;QACrC,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,OAAO,MAAM,CAAC,KAAK,EAAE,mBAAmB,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;QAClF,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtB,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3E,IAAI,OAAO;YAAE,OAAO,MAAM,CAAC,KAAK,EAAE,gBAAgB,OAAO,mBAAmB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpG,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC;QAChC,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC,KAAK,EAAE,6CAA6C,CAAC,CAAC;QACnH,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC;QAChC,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,MAAM,CAAC,KAAK,EAAE,mCAAmC,CAAC,CAAC;QACpH,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC;QACxC,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC,KAAK,EAAE,4BAA4B,CAAC,CAAC;QACpF,MAAM,aAAa,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,aAAa,CAAC,EAAE,KAAK,KAAK;YAAE,OAAO,MAAM,CAAC,KAAK,EAAE,cAAc,aAAa,CAAC,KAAK,EAAE,CAAC,CAAC;QAC1F,IAAI,OAAO,GAA8B,IAAI,CAAC;QAC9C,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAC1D,MAAM,aAAa,GAAG,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAC9D,IAAI,CAAC,aAAa,CAAC,EAAE,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAC3D,OAAO,MAAM,CAAC,KAAK,EAAE,uCAAuC,CAAC,CAAC;YAChE,CAAC;YACD,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC;QAClC,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACxD,OAAO,MAAM,CAAC,KAAK,EAAE,oDAAoD,CAAC,CAAC;QAC7E,CAAC;QACD,IAAI,IAAI,GAA0B,IAAI,CAAC;QACvC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACpD,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM;gBAAE,OAAO,MAAM,CAAC,KAAK,EAAE,yCAAyC,CAAC,CAAC;YAC7F,IAAI,CAAE,eAAsC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClE,OAAO,MAAM,CAAC,KAAK,EAAE,yBAAyB,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC9E,CAAC;YACD,IAAI,GAAG,KAAK,CAAC,IAA6B,CAAC;QAC7C,CAAC;QACD,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,IAAqB;YAC3B,IAAI,EAAE,IAAqB;YAC3B,OAAO;YACP,OAAO;YACP,KAAK,EAAE,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK;YACnD,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI;SACL,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,gBAAgB,CAAC,MAMhC;IACC,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC;AACJ,CAAC;AAKD,kEAAkE;AAClE,SAAS,WAAW,CAAC,OAA0C;IAC7D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC;IACzC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACtD,OAAO,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,KAAK,IAAI,iBAAiB,GAAG,MAAM,EAAE,CAAC;AACvG,CAAC;AAkBD;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CACvB,WAAmB,EACnB,QAA+D,EAC/D,OAAqB;IAErB,MAAM,GAAG,GAAY;QACnB,WAAW;QACX,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,QAAQ,EAAE,IAAI;QACd,KAAK,EAAE,IAAI;QACX,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,IAAI;QACZ,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,IAAI;QACX,IAAI,EAAE,KAAK;KACZ,CAAC;IACF,IAAI,OAAO,IAAI,OAAO;QAAE,OAAO,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;IAChE,IAAI,OAAO,CAAC,UAAU,IAAI,GAAG;QAAE,OAAO,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9E,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;IAChC,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC;IACzF,CAAC;IACD,MAAM,OAAO,GAAY;QACvB,GAAG,GAAG;QACN,QAAQ,EAAE,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI;QAClE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI;QACzB,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI;QACvB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;QAC3B,EAAE,EAAE,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;QAChD,KAAK,EAAE,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;KAC1D,CAAC;IACF,OAAO,CAAC,IAAI;QACV,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,CAAC,CAAC;IACrG,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,mCAAmC;AACnC,MAAM,UAAU,eAAe,CAAC,IAAS;IACvC,IAAI,IAAI,EAAE,QAAQ,KAAK,QAAQ;QAAE,OAAO,wCAAwC,CAAC;IACjF,MAAM,OAAO,GAAG,GAAG,IAAI,EAAE,EAAE,IAAI,GAAG,QAAQ,IAAI,EAAE,KAAK,IAAI,GAAG,QAAQ,CAAC;IACrE,IAAI,IAAI,EAAE,QAAQ,KAAK,OAAO;QAAE,OAAO,UAAU,OAAO,EAAE,CAAC;IAC3D,IAAI,IAAI,EAAE,KAAK,KAAK,iBAAiB;QAAE,OAAO,yBAAyB,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;IACjG,MAAM,OAAO,GAAG,OAAO,IAAI,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7F,OAAO,SAAS,IAAI,EAAE,IAAI,IAAI,GAAG,GAAG,OAAO,KAAK,OAAO,EAAE,CAAC;AAC5D,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,gBAAgB,CAAC,OAA0C;IACzE,IAAI,OAAO,CAAC,UAAU,IAAI,GAAG;QAAE,OAAO,CAAC,CAAC;IACxC,IAAI,OAAO,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO;QAAE,OAAO,CAAC,CAAC;IACjD,IAAI,OAAO,CAAC,IAAI,EAAE,QAAQ,KAAK,MAAM;QAAE,OAAO,CAAC,CAAC;IAChD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,UAAU,CAAC,GAAY;IAC9B,IAAI,GAAG,CAAC,IAAI;QAAE,OAAO,MAAM,CAAC;IAC5B,IAAI,GAAG,CAAC,KAAK;QAAE,OAAO,SAAS,GAAG,CAAC,KAAK,EAAE,CAAC;IAC3C,IAAI,GAAG,CAAC,KAAK,KAAK,iBAAiB;QAAE,OAAO,yBAAyB,GAAG,CAAC,MAAM,EAAE,CAAC;IAClF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,eAAe,CAAC,IAAe,EAAE,OAAkC;IACjF,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACzH,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC;QAC9B,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,IAAI;QACR,GAAG,CAAC,MAAM;QACV,GAAG,CAAC,QAAQ,IAAI,GAAG;QACnB,GAAG,CAAC,IAAI,IAAI,GAAG;QACf,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,GAAG,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;QAC5C,UAAU,CAAC,GAAG,CAAC;KAChB,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAClG,MAAM,MAAM,GAAG,CAAC,KAAe,EAAE,EAAE,CACjC,KAAK;SACF,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAC1E,IAAI,CAAC,IAAI,CAAC,CAAC;IAChB,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3D,CAAC;AAED,4BAA4B;AAC5B,MAAM,UAAU,WAAW,CAAC,IAAe;IACzC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;IACrD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACpC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,YAAY,MAAM,SAAS,EAAE,CAAC;AACxE,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,eAAe,CAAC,YAAoB;IAClD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,EAAE,CAAC;IACzC,OAAO,WAAW,CAAC,YAAY,CAAC;SAC7B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,qBAAqB,CAAC,MAAM,CAAC;SACpG,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;SAC3D,IAAI,EAAE,CAAC;AACZ,CAAC"}

package/dist/src/lib/function-authorize-view.d.ts

@@ -0,0 +1,15 @@
+/**
+ * The Authorize section `primitive functions get` prints (#4730, project
+ * `function-authorize` phase 3) — from the active version's manifest, which a
+ * flagged build pushes as version 3 with an `authorize` block.
+ *
+ * The block is what the push collected from the tree, so it documents what
+ * the author wrote; the version's `authorize` flag, printed above it, is the
+ * server's own answer.
+ */
+/**
+ * The section's label/value pairs: the block of a version-3 manifest, one
+ * `no detail recorded` line for a flagged version whose manifest carries none
+ * (pushed by an older CLI), and null for a legacy version.
+ */
+export declare function authorizeSection(manifest: any, flagged: boolean): Array<[string, string]> | null;

package/dist/src/lib/function-authorize-view.js

@@ -0,0 +1,50 @@
+/**
+ * The Authorize section `primitive functions get` prints (#4730, project
+ * `function-authorize` phase 3) — from the active version's manifest, which a
+ * flagged build pushes as version 3 with an `authorize` block.
+ *
+ * The block is what the push collected from the tree, so it documents what
+ * the author wrote; the version's `authorize` flag, printed above it, is the
+ * server's own answer.
+ */
+/** One `allowCallers` block's doors, in the order the helper takes them. */
+function doorsOf(callers) {
+    if (!callers || typeof callers !== "object")
+        return "-";
+    const doors = [];
+    for (const door of ["webhook", "cron", "manual", "db3"]) {
+        if (callers[door] === true)
+            doors.push(door);
+    }
+    const functions = Array.isArray(callers.functions) ? callers.functions : [];
+    if (functions.length > 0)
+        doors.push(`functions: ${functions.join(", ")}`);
+    if (callers.agents === true)
+        doors.push("agents");
+    else if (callers.agents === "rule")
+        doors.push("agents: rule");
+    if (callers.users === "rule")
+        doors.push("users: rule");
+    return doors.length > 0 ? doors.join(", ") : "none";
+}
+const listOf = (value) => Array.isArray(value) && value.length > 0 ? value.join(", ") : "none";
+/**
+ * The section's label/value pairs: the block of a version-3 manifest, one
+ * `no detail recorded` line for a flagged version whose manifest carries none
+ * (pushed by an older CLI), and null for a legacy version.
+ */
+export function authorizeSection(manifest, flagged) {
+    const block = manifest && typeof manifest === "object" ? manifest.authorize : null;
+    if (!block || typeof block !== "object") {
+        return flagged ? [["Authorize", "no detail recorded"]] : null;
+    }
+    return [
+        ["Present", block.present === true ? "yes" : "no"],
+        ["Public", block.public === true ? "yes" : "no"],
+        ["Helper", typeof block.helper === "string" ? block.helper : "none (hand-written)"],
+        ["Doors", doorsOf(block.callers)],
+        ["Auth families", listOf(block.families)],
+        ["Write families", listOf(manifest.writeFamilies)],
+    ];
+}
+//# sourceMappingURL=function-authorize-view.js.map

package/dist/src/lib/function-authorize-view.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"function-authorize-view.js","sourceRoot":"","sources":["../../../src/lib/function-authorize-view.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,4EAA4E;AAC5E,SAAS,OAAO,CAAC,OAAY;IAC3B,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;QACxD,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,SAAS,GAAa,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,cAAc,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3E,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;SAC7C,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC/D,IAAI,OAAO,CAAC,KAAK,KAAK,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACxD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AACtD,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,KAAc,EAAU,EAAE,CACxC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAEvE;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAAa,EACb,OAAgB;IAEhB,MAAM,KAAK,GAAG,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IACnF,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAChE,CAAC;IACD,OAAO;QACL,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QAClD,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QAChD,CAAC,QAAQ,EAAE,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,qBAAqB,CAAC;QACnF,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,eAAe,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACzC,CAAC,gBAAgB,EAAE,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;KACnD,CAAC;AACJ,CAAC"}

package/dist/src/lib/function-bundle.d.ts

@@ -8,27 +8,34 @@
  * in one envelope. The server verifies the hash and stores the object; it does
  * not compile anything.
  *
- * ── The two import rules ─────────────────────────────────────────────────
+ * ── Where an imported file may come from ───────────────────────────────
  *
- * They look contradictory and are not (F-005):
+ * Every file the build read is classified by its REAL path, never by how it
+ * was imported (F-005, widened by #4502):
  *
- *   - A **filesystem import** — relative or absolute — must stay inside the
- *     config tree. `entry`, every import it reaches, and every symlink they
- *     traverse are realpath-resolved and checked against the tree root, so a
- *     push can never read a file off a developer's disk that the tree does not
- *     contain.
- *   - A **bare package specifier** is exempt. It resolves through Node into an
- *     ancestor `node_modules`, which is outside every config tree by
- *     construction; esbuild inlines it into the bundle, and it is never
- *     captured as an authored source (so `config pull` never writes
- *     `node_modules` content back).
+ *   1. Inside the config tree → a **tree source**: captured as authored bytes
+ *      and stored with the version, so `config pull` hands it back. An
+ *      in-tree `node_modules` file still builds and is not captured.
+ *   2. Inside a directory the project declares in `functionSources` → a
+ *      **shared source**: bundled, typechecked, and never captured. The
+ *      repository is its source of truth, as it is for an npm package, so it is
+ *      listed in `projectSources` for the typechecker and nowhere else.
+ *   3. Under a `node_modules` directory AND reached by a bare specifier (or
+ *      from a file one reached) → a **dependency**: inlined, never captured.
+ *   4. Anything else → an **escape**, refused. A push can never read a file
+ *      off a developer's disk that neither the tree nor a declaration admits.
  *
- * The exemption follows the specifier, not the path a file happens to sit at.
- * A resolver plugin records the files a BARE specifier reached (and the files
- * those reach in turn), so `import "../../node_modules/private/index.js"` — a
- * relative filesystem import that merely lands in a `node_modules` directory —
- * is still an escape and still refused. Deciding by path would have let that
- * one specifier read any file on the disk and upload it.
+ * Rule 3 keeps two conditions on purpose. The provenance half: a resolver
+ * plugin records the files a BARE specifier reached, so `import
+ * "../../node_modules/private/index.js"` — a relative import that merely lands
+ * in a `node_modules` directory — is still an escape. Deciding by path alone
+ * would let that one specifier read any file on the disk and upload it. The
+ * path half: a bare specifier is not a free pass either. esbuild honours each
+ * file's nearest tsconfig `paths`, so a shared file's `@/util/h` resolves into
+ * the web app's own source, and a workspace package is a symlink to a
+ * directory the repository owns. Both are bare specifiers landing on ordinary
+ * files outside `node_modules`, so both are escapes unless their directory is
+ * declared — after which they are shared sources, bundled AND typechecked.
  *
  * `primitive-functions` is the one bare specifier left EXTERNAL: the loader
  * (#3180) supplies it at invoke time, so baking a copy into every bundle would
@@ -104,6 +111,13 @@ export interface BuiltFunctionBundle {
     contentHash: string;
     /** Every authored file the build read, sorted by path. */
     sources: FunctionSourceFile[];
+    /**
+     * The shared sources the bundle inlined from declared `functionSources`
+     * directories: POSIX paths relative to the real tree root
+     * (`../../web/src/engine/x.ts`), sorted. Never stored or sent — the push
+     * hands them to the typechecker.
+     */
+    projectSources: string[];
 }
 export interface EnvelopeShape {
     schemaVersion: number;
@@ -144,4 +158,10 @@ export declare function buildFunctionBundle(options: {
     entry: string;
     /** Only for the message; the key is not part of the build. */
     functionKey: string;
+    /**
+     * The declared `functionSources` directories, as absolute paths. Defaults
+     * to what the selected project config declares; the push loop resolves them
+     * once and passes them, so their warnings are printed once.
+     */
+    sourceRoots?: readonly string[];
 }): Promise<BuiltFunctionBundle>;