fix(shard): enforce visibility on the REST reads that bypassed it

Protocol 3.0 Part A follow-up, found by the live five-rung smoke test.

Part A implemented the visibility framework correctly on the SSE path
and on /guilds + /governors, but the remaining public REST reads never
called into it. The result was that one event was projected live and
served verbatim from history:

  * GET /public/shard/feed returned the stored payload as-is, so
    actor.acct and actor.webId were readable ANONYMOUSLY for every
    logged kind - player.death, player.murdered, mob.killed,
    quest.complete, skill.gain, fame/karma.change, mob.login/logout,
    guild.join. Broader than the guild-leader leak Part A set out to
    close, since it covers every player rather than board holders.

  * GET /public/shard/idoc returned ownerAcct - the house owner's game
    account - to anonymous callers.

  * The `houses` field rules (owner/price -> staff) were dead config:
    neither getIdoc nor getHouses projected, so an admin could set them
    in the panel and nothing happened.

  * /feed filtered on PUBLIC_KINDS, a module-load constant derived from
    the compiled DEFAULTS, so live audience changes did not reach it.
    With `guilds` moved to staff, /guilds 403'd while /feed happily
    served guild.join to anonymous.

Four fixes, all at the root rather than per-route:

1. Rule 1 now matches a field's MEANING, not one spelling. The wire
   nests actors (leader.acct) but the read models flatten them
   (shapeHouse -> ownerAcct, shapeGuild -> leaderWebId), and an
   exact-key check missed every flattened one. isLockedField() locks a
   key that is or ends in acct/webId, case-insensitively, so it fails
   closed for shapes not yet written. The admin PUT rejects those
   spellings too - `ownerAcct` is no longer configurable.

2. visibleKinds(level, config) resolves readable kinds from the LIVE
   config; getFeed uses it and projects each row against its own kind's
   feature. Deliberately independent of the `stream` flag, which governs
   SSE fan-out only - so market history stays readable with its firehose
   off. This makes the set a superset of PUBLIC_KINDS by exactly the two
   vendor kinds.

3. getIdoc/getHouses/getChamps/getPresence project, so every shard
   surface honours the same config.

4. shardEvents.db.list treats an EMPTY kinds array as "serve nothing".
   It previously fell through to the unfiltered query, so a fully-gated
   config would have dumped the whole event log, staff audit included.

Also fixes a bug introduced while wiring this up: projectValue recursed
into any object, so a Date column came back as {}. It now walks arrays
and plain objects only. The unit tests used JSON fixtures and could not
have caught it - the live /idoc read did.

Verified live against MariaDB + a stub sidecar, all five rungs: 13
routes x 5 rungs, defaults reproducing pre-v3 access exactly, zero
acct/webId below admin on any read, unmapped kinds (staff.command,
cheat.detect, login.attempt) reaching only admin on SSE, and audience /
enabled / stream changes taking effect live on an already-open stream.

Tests: 487 server (+9). Swagger regenerated; route manifest unchanged.

Co-Authored-By: Claude <noreply@anthropic.com>

server/src/router/v1/public/shard.controller.js

@@ -39,21 +39,49 @@ async function getStatus(req, res) {
   }
 }
 
-// GET /public/shard/feed?kind=&limit= — recent notable events from the log,
-// restricted to the public-safe allowlist so staff audit / cheat / link events
-// (which are stored for the admin channel) can never leak to the public.
+// GET /public/shard/feed?kind=&limit= — recent notable events from the log.
+//
+// This is the stored-history twin of the SSE stream, and it must reach the same
+// verdict the stream does about the same event. Two things are therefore resolved
+// against the LIVE config rather than the compiled defaults:
+//
+//   • which kinds this viewer may read at all — `visibleKinds`, not the static
+//     PUBLIC_KINDS set (which is fixed at module load, so an admin moving
+//     `guilds` to `staff` would gate /guilds while /feed kept serving
+//     guild.join to anonymous callers), and
+//   • the payload itself, projected per event against ITS OWN kind's feature —
+//     the rows are a mix of features, and without this the stored frames were
+//     returned verbatim, `acct`/`webId` and all, on an anonymous endpoint.
 async function getFeed(req, res) {
   try {
+    const config = await visibility.getConfig()
+    const level = req.viewerLevel || (await visibility.viewerLevel(req))
+    const allowed = new Set(visibility.visibleKinds(level, config))
+
     const { kind, limit } = req.query
+    // No readable kinds ⇒ nothing to serve. Returning early also keeps us clear
+    // of `list({ kinds: [] })`, which means "no filter", not "match nothing".
+    if (allowed.size === 0) return res.json([])
+
     let events
     if (kind) {
-      // A specific kind is only served if it is itself public-safe.
-      if (!broadcast.PUBLIC_KINDS.has(kind)) return res.json([])
+      if (!allowed.has(kind)) return res.json([])
       events = await shardEvents.list({ kind, limit })
     } else {
-      events = await shardEvents.list({ kinds: [...broadcast.PUBLIC_KINDS], limit })
+      events = await shardEvents.list({ kinds: [...allowed], limit })
     }
-    return res.json(events)
+
+    return res.json(
+      events.map((ev) => ({
+        ...ev,
+        payload: visibility.projectFeature(
+          visibility.KIND_FEATURE.get(ev.kind),
+          ev.payload,
+          level,
+          config,
+        ),
+      })),
+    )
   } catch (err) {
     log.error('shard.getFeed', err)
     return res.status(500).json({ message: 'Internal Server Error' })
@@ -106,9 +134,14 @@ async function getOnline(req, res) {
 }
 
 // GET /public/shard/idoc — houses currently in danger (stage IDOC).
+//
+// Projected: shapeHouse flattens the owner actor into `ownerSerial`/`ownerAcct`/
+// `ownerName`, so this endpoint used to hand an anonymous caller the house
+// owner's GAME ACCOUNT NAME. The public IDOC board only ever needed name, region
+// and location — which is all that survives projection below `staff`.
 async function getIdoc(req, res) {
   try {
-    return res.json(await shardState.listIdoc())
+    return res.json(await visibility.project('houses', await shardState.listIdoc(), req))
   } catch (err) {
     log.error('shard.getIdoc', err)
     return res.status(500).json({ message: 'Internal Server Error' })
@@ -120,7 +153,7 @@ async function getIdoc(req, res) {
 // the public SSE stream so the page can update in place.
 async function getChamps(req, res) {
   try {
-    return res.json(await shardState.listChamps())
+    return res.json(await visibility.project('champs', await shardState.listChamps(), req))
   } catch (err) {
     log.error('shard.getChamps', err)
     return res.status(500).json({ message: 'Internal Server Error' })
@@ -170,7 +203,7 @@ async function getGovernorHistory(req, res) {
 // + per-region). Live via presence.online on the public SSE stream.
 async function getPresence(req, res) {
   try {
-    return res.json(await shardState.latestPresence())
+    return res.json(await visibility.project('presence', await shardState.latestPresence(), req))
   } catch (err) {
     log.error('shard.getPresence', err)
     return res.status(500).json({ message: 'Internal Server Error' })
@@ -194,7 +227,10 @@ async function getHouses(req, res) {
       z: h.z,
       isIdoc: true,
     }))
-    return res.json(publicHouses)
+    // Already a hand-picked safe subset; projected anyway so an admin who
+    // tightens a `houses` field rule sees it honoured on every houses surface
+    // rather than on some of them.
+    return res.json(await visibility.project('houses', publicHouses, req))
   } catch (err) {
     log.error('shard.getHouses', err)
     return res.status(500).json({ message: 'Internal Server Error' })

server/src/router/v1/public/shard.router.js

@@ -42,7 +42,8 @@ shardRouter.get(
   requireFeature('activity'),
   // #swagger.tags = ['Public · Shard']
   // #swagger.summary = 'Recent notable shard events (from the ingested log)'
-  // #swagger.parameters['kind'] = { in: 'query', required: false, schema: { type: 'string' }, description: 'Filter to a single event kind, e.g. vendor.sale.' }
+  // #swagger.description = 'The stored-history twin of /shard/stream, and it reaches the same verdict: which kinds are returned is resolved against the caller\'s audience rung under the live visibility config, and each event\'s payload is field-projected against its own kind\'s feature. Kinds the caller may not read are omitted (an explicit ?kind= for one of them returns []), and acct/webId never appear below admin.'
+  // #swagger.parameters['kind'] = { in: 'query', required: false, schema: { type: 'string' }, description: 'Filter to a single event kind, e.g. vendor.sale. Returns [] if the caller may not read that kind.' }
   // #swagger.parameters['limit'] = { in: 'query', required: false, schema: { type: 'integer' }, description: 'Max rows (default 100, max 1000).' }
   /* #swagger.responses[200] = { description: 'Events, newest first', content: { "application/json": { schema: { type: "array", items: { $ref: "#/components/schemas/ShardEvent" } } } } } */
   query('kind').optional({ values: 'falsy' }).isString().isLength({ max: 48 }),
@@ -74,6 +75,7 @@ shardRouter.get(
   requireFeature('houses'),
   // #swagger.tags = ['Public · Shard']
   // #swagger.summary = 'Houses currently in danger (IDOC)'
+  // #swagger.description = 'Location-level board of the houses about to collapse. Owner identity and price are gated by the `houses` feature\'s field rules (default `staff`), and the owner\'s game account is admin-only always — so an anonymous caller sees name, region and coordinates only.'
   /* #swagger.responses[200] = { description: 'IDOC houses', content: { "application/json": { schema: { type: "array", items: { $ref: "#/components/schemas/ShardHouse" } } } } } */
   shard.getIdoc,
 )