@brydio/manifest 0.1.0-alpha.5 → 0.1.0-alpha.50

package/src/schema.js

@@ -2,6 +2,10 @@ import { z } from 'zod';
 import { MANIFEST_LIMITS, SEMVER_FORMAT, baseManifestSchema as manifestSchema } from "./base.js";
 import { COLLECTION_NAME, FIELD_LIMITS, FIELD_NAME, FieldTypeInvalid, isSearchable, isSortable, isStructured, parseFieldType, RESERVED_FIELDS, } from "./field-types.js";
 import { migrationsSchema } from "./migrations.js";
+import { openSchemaProblems } from "./open-schema.js";
+import { confirmEmailProblems, confirmEmailSchema } from "./confirm-email.js";
+import { anonymousProblems, anonymousSchema, anonymousSpec } from "./anonymous.js";
+import { editorsProblems, editorsSchema, READERS_LIMIT, readersProblems, readersSchema } from "./readers.js";
 export { COLOUR_TOKENS, FIELD_LIMITS, parseFieldType, RESERVED_FIELDS, structuredFields, } from "./field-types.js";
 /**
  * What an app adds to `.brydio/app.json` to be more than a bundle of servers
@@ -24,12 +28,84 @@ const placementSettingSchema = z.object({
     required: z.boolean().optional(),
     placeholder: z.string().max(200).optional(),
 });
+/**
+ * How deep a folder's rows may nest, counting its own rows as the first
+ * level (ADR-A21): Issues → sprints → issues is two. Each level is listed
+ * only when a person opens its parent, so depth costs nothing while closed;
+ * the limit is for the sidebar's width and a person's patience.
+ */
+export const MAX_FOLDER_DEPTH = 4;
+/**
+ * "New sprint" on a folder's level (ADR-A21): one of the app's tools, run
+ * through the screen's door with the name the person typed in `titleField`
+ * and, below the first level, the row it is created under in `parentField`.
+ */
+const folderCreateSchema = z.object({
+    tool: z.string().min(1).max(64),
+    /** "sprint", in "New sprint". */
+    noun: z.string().min(1).max(40).optional(),
+    titleField: z.string().regex(FIELD_NAME, 'A field name is letters, digits and _, starting with a lower-case letter.').optional(),
+    parentField: z.string().regex(FIELD_NAME, 'A field name is letters, digits and _, starting with a lower-case letter.').optional(),
+});
+/** A level below a folder's own rows: what they are called, and how one is made. */
+const folderLevelSchema = z.object({
+    noun: z.string().min(1).max(60).optional(),
+    create: folderCreateSchema.optional(),
+});
+/** The sizes a Home card or a project widget can be drawn at (CC11-F10). */
+export const HOME_CARD_SIZES = ['small', 'medium', 'large'];
+/** The kinds drawn as a card, which say the sizes they draw well at. */
+export const SIZED_PLACEMENT_KINDS = ['home', 'project-widget'];
+/** A stable identity for one independently addable placement offering. */
+export const PLACEMENT_KEY = /^[a-z][a-z0-9-]{0,39}$/;
+export function effectivePlacementKey(one) {
+    return one.key ?? `${one.kind}:${one.screen}`;
+}
 const placementSchema = z.object({
-    kind: z.enum(['project-tab', 'project-sidebar', 'workspace-sidebar']),
+    key: z.string().regex(PLACEMENT_KEY).optional(),
+    /**
+     * `home`: a card on a person's Home, drawn by `screen` at one of `sizes`.
+     * `project-widget`: a card on a project's page, drawn at one of `sizes`.
+     * `project-tab` is retired (30 Sep 2026): still read from a published
+     * manifest, refused in a new one (`placement_tab_retired`).
+     * `public-page`: a screen people without a Brydio account open at the
+     * page's own address, once an admin turns it on (P3). It has no `sizes`,
+     * `children` or `settings` (`placement_public_shape`), and it reaches only
+     * collections marked `publicRead` or `publicSubmit` and tools marked
+     * `public`.
+     * `chat-card`: a screen drawn inside a chat message the app posted with
+     * a handler's `chat.post` (FO03). Nobody places it by hand, so it has no
+     * `sizes`, `children` or `settings` (`placement_chat_card_shape`); its
+     * screen sees `placement.kind === 'chat-card'` and the card's `route`.
+     */
+    kind: z.enum(['project-tab', 'project-widget', 'project-sidebar', 'workspace-sidebar', 'home', 'public-page', 'chat-card']),
     screen: z.string().min(1).max(FIELD_LIMITS.nameChars),
+    /** For `home` and `project-widget` only, and required there: the sizes the screen draws well at. */
+    sizes: z.array(z.enum(HOME_CARD_SIZES)).max(3).optional(),
     label: z.string().min(1).max(60).optional(),
     icon: z.string().max(60).optional(),
     settings: z.record(z.string().regex(FIELD_NAME), placementSettingSchema).optional(),
+    /**
+     * A folder (A2-F02-S02): a sidebar item whose rows one of the app's read
+     * tools lists live, only while it is open. It can nest, and offer "New …"
+     * at each level, when the app opts in (ADR-A21).
+     */
+    children: z
+        .object({
+        tool: z.string().min(1).max(64),
+        refreshSeconds: z.number().int().min(15).max(3600).optional(),
+        cap: z.number().int().min(1).max(50).optional(),
+        noun: z.string().min(1).max(60).optional(),
+        /** A "New …" row at the folder's first level (ADR-A21). */
+        create: folderCreateSchema.optional(),
+        /**
+         * The levels under the first, in order (ADR-A21). A row the tool marks
+         * `hasChildren` opens only when a level is declared for it; without
+         * `nested` the folder stays one flat list.
+         */
+        nested: z.array(folderLevelSchema).max(8).optional(),
+    })
+        .optional(),
 });
 const collectionSchema = z.object({
     /** Field name to type, in the manifest's spelling (`"member?"`, `["todo","done"]`). */
@@ -38,6 +114,49 @@ const collectionSchema = z.object({
     search: z.array(z.string()).optional(),
     /** The singular noun the tools are named with: `issue` gives `create_issue`. */
     label: z.string().optional(),
+    /**
+     * Fields defined at runtime as records of another collection (P5): `fields`
+     * names it, and `table`, when given, the `string` field on both naming
+     * which table a row or a definition belongs to.
+     */
+    openSchema: z
+        .object({
+        fields: z.string().min(1).max(FIELD_LIMITS.nameChars),
+        table: z.string().min(1).max(FIELD_LIMITS.nameChars).optional(),
+    })
+        .strict()
+        .optional(),
+    /**
+     * A visitor on one of the app's public pages may `get` and `list` every
+     * record of this collection in that instance (P3).
+     */
+    publicRead: z.boolean().optional(),
+    /**
+     * A visitor on one of the app's public pages may create records here, and
+     * nothing else: no update, remove or batch, and no get or list unless
+     * `publicRead` is set too (P3).
+     */
+    publicSubmit: z.boolean().optional(),
+    /**
+     * Brydio emails the visitor once after a public submission here (FO04):
+     * `field` names a `string` field holding their address; `subject` and
+     * `message` are short plain text; `link` adds a button back to the page.
+     * Needs `publicSubmit`. Brydio decides when, how often and from whom.
+     */
+    confirmEmail: confirmEmailSchema.optional(),
+    /**
+     * Answers nobody can tie to who gave them (P13): `group` names a
+     * structured field (a number, choice, date, boolean, token or project)
+     * the answers are read by, a whole group at a time and only once it holds
+     * `minimum` answers (at least 5, the default). Brydio keeps no writer,
+     * cuts times to the day, tells no live change, and refuses an update, a
+     * batch, a watch and a create naming its own writer.
+     */
+    anonymous: anonymousSchema.optional(),
+    /** One of its string[] fields: the user ids who alone may read a record, when it names any (P16). */
+    readers: readersSchema.optional(),
+    /** One of its string[] fields: the user ids who alone may change a record, when it names any (DW06). */
+    editors: editorsSchema.optional(),
 });
 const screenSchema = z.object({
     /**
@@ -74,23 +193,67 @@ const customToolSchema = z.object({
     write: z.boolean().optional(),
     /** The collection it works on, when it works on one: its grant then needs that collection too. */
     collection: z.string().optional(),
+    /**
+     * Callable from a public page (P3). Its handler then runs for a visitor,
+     * whose `data` is held to `publicRead` and `publicSubmit` and who can use
+     * nothing else of the workspace's.
+     */
+    public: z.boolean().optional(),
 });
 const toolsSchema = z.object({
     /** Off only when the app supplies every tool itself (A3-F08). */
-    generated: z.boolean().optional(),
+    /**
+     * Off only when the app supplies every tool itself. `"read"` keeps the
+     * generated reads (get, list, search) and leaves every write to the app's
+     * own tools, where its rules about who may change what live (DW06).
+     */
+    generated: z.union([z.boolean(), z.literal('read')]).optional(),
     custom: z.array(customToolSchema).max(MAX_CUSTOM_TOOLS).optional(),
 });
+/** Most secrets one app may declare (ADR-A24). */
+export const MAX_APP_SECRETS = 20;
+/** The longest value one secret may hold, in characters. */
+export const MAX_SECRET_CHARS = 8 * 1024;
+/** A secret's name, as a handler asks for it: `api_key`. */
+export const SECRET_NAME = /^[a-z][a-z0-9_]{0,59}$/;
+/**
+ * A secret the app needs (ADR-A24): named here, never valued here. The value
+ * is entered in the app's settings by an administrator, or stored by the
+ * app's own handler with `secrets.set`, and only that app's handlers can read
+ * it, with `secrets.get`. A screen never can.
+ *
+ * `install` (the default) is one value for the whole install; `instance` is
+ * one per instance.
+ */
+const secretSchema = z.object({
+    name: z.string().regex(SECRET_NAME, 'A secret name is lower case letters, digits and underscores, starting with a letter.'),
+    label: z.string().min(1).max(60),
+    description: z.string().max(300).optional(),
+    required: z.boolean().optional(),
+    scope: z.enum(['install', 'instance']).optional(),
+});
 const grantsSchema = z.object({
     tools: z.array(z.string().max(100)).max(200).optional(),
     collections: z.array(z.string().max(100)).max(FIELD_LIMITS.collections + 1).optional(),
     host: z.array(z.string().max(60)).max(20).optional(),
 });
+/** The `instances` rules an app may declare (CA10). */
+export const INSTANCE_RULES = ['one-per-workspace'];
 const extensionShape = {
     placements: z.array(placementSchema).max(20).optional(),
     data: z.record(z.string(), collectionSchema).optional(),
     tools: toolsSchema.optional(),
     screens: z.record(z.string(), screenSchema).optional(),
     grants: grantsSchema.optional(),
+    /** The secrets its handlers read (ADR-A24): names only, never values. */
+    secrets: z.array(secretSchema).max(MAX_APP_SECRETS).optional(),
+    /**
+     * How many instances a workspace may keep (CA10). `"one-per-workspace"`:
+     * a single workspace instance, shown in the sidebar and on any project as
+     * a view of that project's records; never a project's or a person's own.
+     * Left out, as many as people make.
+     */
+    instances: z.enum(INSTANCE_RULES).optional(),
     /**
      * How records move when the schema changes between versions (A3-F07).
      * Checked against the previous version when a version is published, and
@@ -104,13 +267,6 @@ const extensionShape = {
      */
     sdk: z.string().max(MANIFEST_LIMITS.versionChars).regex(SEMVER_FORMAT).optional(),
 };
-/**
- * Everything wrong with an app's additions that a type cannot say.
- *
- * Exported on its own so E5's validator can fold the codes into its import
- * report; the zod schemas below run it too, so a parse never accepts what
- * this refuses.
- */
 export function dataProblems(additions, options = {}) {
     const problems = [];
     const collections = Object.entries(additions.data ?? {});
@@ -225,6 +381,38 @@ export function dataProblems(additions, options = {}) {
             }
         }
     }
+    // Open-schema collections (P5): the companion is declared, shaped as the
+    // host reads it, and defines one collection's fields at most.
+    const companions = new Map();
+    for (const [collection, declared] of collections) {
+        if (!declared.openSchema)
+            continue;
+        for (const problem of openSchemaProblems(collection, declared.openSchema, additions.data ?? {})) {
+            problems.push({ ...problem, collection });
+        }
+        const other = companions.get(declared.openSchema.fields);
+        if (other) {
+            problems.push({
+                code: 'data_open_fields_unknown',
+                collection,
+                message: `${declared.openSchema.fields} already defines ${other}'s fields; give ${collection} its own.`,
+            });
+        }
+        companions.set(declared.openSchema.fields, collection);
+    }
+    // A confirmation email names a string field of a collection visitors submit to (FO04).
+    for (const [collection, declared] of collections) {
+        problems.push(...confirmEmailProblems(collection, declared));
+    }
+    // An anonymous collection groups its answers by one of its structured fields, names nobody (P13).
+    for (const [collection, declared] of collections) {
+        problems.push(...anonymousProblems(collection, declared));
+    }
+    // A collection whose records name their readers names a list of user ids to keep them in (P16).
+    for (const [collection, declared] of collections) {
+        problems.push(...readersProblems(collection, declared));
+        problems.push(...editorsProblems(collection, declared));
+    }
     // What the app keeps must be what it asks to keep (A3-F06-S01): a
     // collection the grants leave out would be data a workspace never agreed to
     // hold, found only when the first write is refused.
@@ -241,14 +429,134 @@ export function dataProblems(additions, options = {}) {
         }
     }
     problems.push(...customToolProblems(additions, options));
+    problems.push(...secretProblems(additions, options));
+    problems.push(...instanceRuleProblems(additions));
     const screens = new Set(Object.keys(additions.screens ?? {}));
+    const placementKeys = new Set();
     for (const placement of additions.placements ?? []) {
+        const key = effectivePlacementKey(placement);
+        if (placementKeys.has(key)) {
+            problems.push({
+                code: 'placement_key_taken',
+                message: `Two placements use the key "${key}"; each independently addable placement needs its own key.`,
+            });
+        }
+        else {
+            placementKeys.add(key);
+        }
         if (!screens.has(placement.screen)) {
             problems.push({
                 code: 'placement_screen_unknown',
                 message: `A ${placement.kind} placement opens "${placement.screen}", which is not one of the app's screens.`,
             });
         }
+        // A card must say how big it can be drawn (CC11-F10-S01).
+        if (placement.kind === 'home' && !placement.sizes?.length) {
+            problems.push({
+                code: 'placement_home_sizes',
+                message: `The Home card "${placement.screen}" must say which sizes it draws at: small, medium or large.`,
+            });
+        }
+        if (placement.kind === 'project-widget' && !placement.sizes?.length) {
+            problems.push({
+                code: 'placement_widget_sizes',
+                message: `The project widget "${placement.screen}" must say which sizes it draws at: small, medium or large.`,
+            });
+        }
+        if (!SIZED_PLACEMENT_KINDS.includes(placement.kind) && placement.sizes?.length) {
+            problems.push({
+                code: 'placement_sizes_not_home',
+                message: `Only a Home card or a project widget has sizes; the ${placement.kind} placement "${placement.screen}" cannot.`,
+            });
+        }
+        if (options.retired && placement.kind === 'project-tab') {
+            problems.push({
+                code: 'placement_tab_retired',
+                message: 'Project tabs are retired; declare a project-widget with sizes instead.',
+            });
+        }
+        // A public page is one screen at its own address: nothing to list in a
+        // sidebar, and nothing for an admin to fill in when it is placed.
+        if (placement.kind === 'public-page' && (placement.children || placement.settings)) {
+            problems.push({
+                code: 'placement_public_shape',
+                message: `The public page "${placement.screen}" can have no children or settings: it is one screen at its own address.`,
+            });
+        }
+        // A chat card is drawn at the message's own size, in a message nobody
+        // places by hand (FO03): nothing to size, configure or list.
+        if (placement.kind === 'chat-card' && (placement.sizes?.length || placement.children || placement.settings)) {
+            problems.push({
+                code: 'placement_chat_card_shape',
+                message: `The chat card "${placement.screen}" cannot have sizes, children or settings.`,
+            });
+        }
+    }
+    // A public page with nothing public could show a visitor nothing at all.
+    if ((additions.placements ?? []).some(placement => placement.kind === 'public-page')) {
+        const publicData = Object.values(additions.data ?? {}).some(declared => declared.publicRead || declared.publicSubmit);
+        const publicTool = (additions.tools?.custom ?? []).some(tool => tool.public);
+        if (!publicData && !publicTool) {
+            problems.push({
+                code: 'placement_public_nothing',
+                message: 'A public page needs something a visitor may use: mark a collection publicRead or publicSubmit, or a custom tool public.',
+            });
+        }
+    }
+    problems.push(...folderProblems(additions));
+    return problems;
+}
+/**
+ * A folder that nests or creates (ADR-A21) must stay within
+ * `MAX_FOLDER_DEPTH`, and each "New …" must name a tool the app has that
+ * changes records. Only the new keys are checked: a published manifest's
+ * existing folder still reads as it did.
+ */
+function folderProblems(additions) {
+    const problems = [];
+    const custom = new Map((additions.tools?.custom ?? []).map(tool => [tool.name, tool]));
+    const generatedWrites = additions.tools?.generated === false || additions.tools?.generated === 'read'
+        ? new Set()
+        : new Set(Object.entries(additions.data ?? {}).flatMap(([name, declared]) => {
+            const label = labelOf(name, declared.label);
+            return [`create_${label}`, `update_${label}`, `delete_${label}`, `batch_${label}s`];
+        }));
+    const generatedReads = additions.tools?.generated === false
+        ? new Set()
+        : new Set(Object.entries(additions.data ?? {}).flatMap(([name, declared]) => {
+            const label = labelOf(name, declared.label);
+            return [`get_${label}`, `list_${label}s`, `search_${label}s`];
+        }));
+    for (const placement of additions.placements ?? []) {
+        const children = placement.children;
+        if (!children)
+            continue;
+        const depth = 1 + (children.nested?.length ?? 0);
+        if (depth > MAX_FOLDER_DEPTH) {
+            problems.push({
+                code: 'placement_children_too_deep',
+                message: `The "${placement.screen}" folder nests ${depth} levels deep; a sidebar folder may nest at most ${MAX_FOLDER_DEPTH}.`,
+            });
+        }
+        const creates = [children.create, ...(children.nested ?? []).map(level => level.create)];
+        for (const create of creates) {
+            if (!create)
+                continue;
+            const own = custom.get(create.tool);
+            const reads = own ? own.write !== true : generatedReads.has(create.tool);
+            if (!own && !reads && !generatedWrites.has(create.tool)) {
+                problems.push({
+                    code: 'placement_create_tool_unknown',
+                    message: `The "${placement.screen}" folder creates with ${create.tool}, which is not one of the app's tools.`,
+                });
+            }
+            else if (reads) {
+                problems.push({
+                    code: 'placement_create_not_write',
+                    message: `The "${placement.screen}" folder creates with ${create.tool}, which only reads: name a tool that makes records, or mark a custom one write: true.`,
+                });
+            }
+        }
     }
     return problems;
 }
@@ -268,18 +576,28 @@ function customToolProblems(additions, options) {
         : new Set(Object.entries(additions.data ?? {}).flatMap(([name, declared]) => {
             const label = labelOf(name, declared.label);
             const plural = `${label}s`;
-            return [
-                `create_${label}`,
-                `update_${label}`,
-                `get_${label}`,
-                `delete_${label}`,
-                `list_${plural}`,
-                `search_${plural}`,
-                `batch_${plural}`,
-            ];
+            const reads = [`get_${label}`, `list_${plural}`, `search_${plural}`];
+            // With only reads generated, the write names are the app's to use.
+            return additions.tools?.generated === 'read'
+                ? reads
+                : [...reads, `create_${label}`, `update_${label}`, `delete_${label}`, `batch_${plural}`];
         }));
     const seen = new Set();
     const granted = additions.grants?.tools ?? [];
+    // Another app's tool, asked for by its assistant name `<slug>__<tool>`
+    // (FO07): never an unknown custom tool of this app, but naming the app
+    // itself would be a way round its own grants.
+    const name = additions.name;
+    const own = typeof name === 'string' ? appToolPrefix(name) : null;
+    for (const grant of granted) {
+        const qualified = crossAppTool(grant);
+        if (qualified && own !== null && qualified.app === own) {
+            problems.push({
+                code: 'grant_tool_cross_app_self',
+                message: `${grant} names this app's own tool: ask for ${qualified.tool} instead.`,
+            });
+        }
+    }
     for (const tool of custom) {
         if (generated.has(tool.name) || seen.has(tool.name)) {
             problems.push({
@@ -316,20 +634,86 @@ function customToolProblems(additions, options) {
     }
     return problems;
 }
+/**
+ * Another installed app's tool, as `grants.tools` names it (FO07): the name
+ * the assistant knows it by, `<slug>__<tool>`. Null for anything else.
+ * A handler calls it with `tools.call('<slug>__<tool>', input)`.
+ */
+export function crossAppTool(name) {
+    const at = name.indexOf('__');
+    if (at <= 0 || at + 2 >= name.length)
+        return null;
+    return { app: name.slice(0, at), tool: name.slice(at + 2) };
+}
+/** An app's name as the front of its tools' assistant names: `issue-tracker` → `issue_tracker`. */
+export const appToolPrefix = (name) => name
+    .replace(/[^A-Za-z0-9_]+/g, '_')
+    .replace(/_+/g, '_')
+    .replace(/^_+|_+$/g, '');
+/**
+ * Each secret declared once, and asked for (ADR-A24): an app that declares
+ * secrets without the `secrets` host grant could never read one.
+ */
+/**
+ * One instance per workspace is added once, from the workspace sidebar
+ * (CA10): an app that says so and offers no sidebar item could never be
+ * added at all.
+ */
+function instanceRuleProblems(additions) {
+    if (additions.instances !== 'one-per-workspace')
+        return [];
+    if ((additions.placements ?? []).some(one => one.kind === 'workspace-sidebar'))
+        return [];
+    return [
+        {
+            code: 'instances_needs_sidebar',
+            message: 'An app kept once per workspace is added from the workspace sidebar: add a "workspace-sidebar" placement.',
+        },
+    ];
+}
+function secretProblems(additions, options) {
+    const problems = [];
+    const secrets = additions.secrets ?? [];
+    const seen = new Set();
+    for (const secret of secrets) {
+        if (seen.has(secret.name)) {
+            problems.push({
+                code: 'secret_name_taken',
+                field: secret.name,
+                message: `The secret ${secret.name} is declared twice; keep one.`,
+            });
+        }
+        seen.add(secret.name);
+    }
+    const host = additions.grants?.host ?? [];
+    if (options.grants !== false && secrets.length && !host.includes('secrets') && !host.includes('*')) {
+        problems.push({
+            code: 'grant_secrets_missing',
+            message: 'The app declares secrets but does not ask to read them: add "secrets" to grants.host.',
+        });
+    }
+    return problems;
+}
 const refuse = (additions, ctx, options = {}) => {
     for (const problem of dataProblems(additions, options)) {
         ctx.addIssue({
             code: 'custom',
             message: problem.message,
-            path: problem.code === 'grant_tool_missing'
+            path: problem.code === 'grant_tool_missing' || problem.code === 'grant_tool_cross_app_self'
                 ? ['grants', 'tools']
-                : problem.code.startsWith('grant_')
-                    ? ['grants', 'collections']
-                    : problem.code.startsWith('custom_')
-                        ? ['tools', 'custom']
-                        : problem.collection
-                            ? ['data', problem.collection, ...(problem.field ? ['schema', problem.field] : [])]
-                            : [],
+                : problem.code === 'grant_secrets_missing'
+                    ? ['grants', 'host']
+                    : problem.code === 'secret_name_taken'
+                        ? ['secrets']
+                        : problem.code === 'instances_needs_sidebar'
+                            ? ['instances']
+                            : problem.code.startsWith('grant_')
+                                ? ['grants', 'collections']
+                                : problem.code.startsWith('custom_')
+                                    ? ['tools', 'custom']
+                                    : problem.collection
+                                        ? ['data', problem.collection, ...(problem.field ? ['schema', problem.field] : [])]
+                                        : [],
             params: { code: problem.code },
         });
     }
@@ -344,6 +728,14 @@ export const manifestExtensionsSchema = z.object(extensionShape).superRefine((ad
 export const storedExtensionsSchema = z.object(extensionShape).superRefine((additions, ctx) => refuse(additions, ctx, { grants: false }));
 /** E5's manifest with the additions: the whole `.brydio/app.json` of an app. */
 export const appManifestSchema = manifestSchema.extend(extensionShape).superRefine((additions, ctx) => refuse(additions, ctx));
+/**
+ * A manifest being written now, as `brydio validate`, `build` and `dev` read
+ * it: the same, and nothing retired (`placement_tab_retired`) — which a
+ * published version may still hold.
+ */
+export const newAppManifestSchema = manifestSchema
+    .extend(extensionShape)
+    .superRefine((additions, ctx) => refuse(additions, ctx, { retired: true }));
 /**
  * The singular a collection's tools are named with: the manifest's, else the
  * collection's name with a trailing "s" taken off (`issues` → `issue`).
@@ -360,8 +752,22 @@ export function labelOf(collection, label) {
  */
 export function collectionsOf(manifest) {
     const parsed = storedExtensionsSchema.parse({ data: manifest.data ?? {} });
+    const owners = new Map(Object.entries(parsed.data ?? {}).flatMap(([name, declared]) => declared.openSchema ? [[declared.openSchema.fields, { name, flag: declared.openSchema }]] : []));
     return Object.entries(parsed.data ?? {}).map(([name, declared]) => {
-        const fields = Object.fromEntries(Object.entries(declared.schema).map(([field, raw]) => [field, parseFieldType(raw)]));
+        const owner = owners.get(name);
+        // The field naming a row's table is kept in plain on both sides, so a
+        // table is filtered and counted without decrypting a row (P5).
+        const tableField = declared.openSchema?.table ?? owner?.flag.table;
+        const fields = Object.fromEntries(Object.entries(declared.schema).map(([field, raw]) => {
+            const type = parseFieldType(raw);
+            if (field === tableField)
+                return [field, { ...type, plain: true }];
+            // A record's readers or editors may name a whole team (P16, DW06).
+            return [
+                field,
+                (field === declared.readers || field === declared.editors) && type.kind === 'string[]' ? { ...type, maxEntries: READERS_LIMIT } : type,
+            ];
+        }));
         const label = labelOf(name, declared.label);
         const names = Object.keys(fields);
         return {
@@ -373,6 +779,13 @@ export function collectionsOf(manifest) {
             sortable: names.filter(field => isSortable(fields[field])),
             search: declared.search ?? [],
             projectField: names.find(field => fields[field].kind === 'project') ?? null,
+            ...(declared.openSchema
+                ? { openSchema: { fields: declared.openSchema.fields, table: declared.openSchema.table ?? null } }
+                : {}),
+            ...(owner ? { definesFieldsOf: owner.name } : {}),
+            ...(declared.anonymous ? { anonymous: anonymousSpec(declared.anonymous) } : {}),
+            ...(declared.readers ? { readers: declared.readers } : {}),
+            ...(declared.editors ? { editors: declared.editors } : {}),
         };
     });
 }

package/src/secrets.d.ts

@@ -30,3 +30,17 @@ export interface SecretFound {
 export declare function secretsInJson(document: unknown, at: string): SecretFound[];
 /** Every secret declared in a bundle's files, as the server finds them. */
 export declare function findSecrets(files: ReadonlyMap<string, Uint8Array>, root?: string): SecretFound[];
+/**
+ * The server's sentence for `developer_key_in_bundle` (ADR-A22), word for
+ * word: `DEVELOPER_KEY_IN_BUNDLE` in Brydio's `app-publish.service.ts`.
+ */
+export declare const DEVELOPER_KEY_MESSAGE = "That package contains a Brydio developer API key. A key belongs on your own server, never in an app: revoke it in Settings \u203A Developer, and call Brydio\u2019s model from a handler with the model grant instead.";
+/** Whether a text holds a Brydio developer API key. */
+export declare const holdsDeveloperKey: (text: string) => boolean;
+/**
+ * The first file holding a developer API key, by path, as Brydio's publish
+ * route finds it (`developerKeyIn`). Unlike the declaration scan, every file
+ * is read, scripts included: the key's shape is exact enough that a match is
+ * a key, not a guess, and no part of an app may hold one (ADR-A24).
+ */
+export declare function developerKeyIn(files: ReadonlyMap<string, Uint8Array>): string | null;