@mulmoclaude/core 0.13.1 → 0.15.0

package/dist/{server-DKXXFTbw.js → server-BNTR7ySK.js}

@@ -1,4 +1,4 @@
-import { a as resolveIcon, c as AGENT_INGEST_KIND, d as embedTargetId, f as isFieldDrivenEvery, i as firstDateField, l as FEED_SCHEDULES, o as selectDynamicRecord, t as deriveAll, u as INGEST_KINDS } from "./deriveAll-CMFXDQ_G.js";
+import { A as isSafeSlug, C as projectBacklinkRow, D as SAFE_RECORD_ID_PATTERN, F as embedTargetId, I as isFieldDrivenEvery, M as COMPUTED_TYPES, N as FEED_SCHEDULES, O as SAFE_SLUG_PATTERN, P as INGEST_KINDS, S as backlinkRows, b as selectDynamicRecord, h as deriveAll, j as AGENT_INGEST_KIND, k as isSafeRecordId, l as parseIsoDate, u as parseIsoDateTime, v as firstDateField, y as resolveIcon } from "./calendarGrid-CaR-q36Y.js";
 import { isSafeActionTemplatePath, isSafeCustomViewI18nPath, isSafeCustomViewPath } from "./collection/paths.js";
 import path from "node:path";
 import { promises, realpathSync } from "node:fs";
@@ -78,7 +78,6 @@ var log = {
 //#endregion
 //#region src/collection/server/paths.ts
 var SCHEMA_FILE = "schema.json";
-var SAFE_SLUG_PATTERN = /^[a-zA-Z0-9](?:[a-zA-Z0-9_-]*[a-zA-Z0-9])?$/;
 /** Sanitise a user-supplied slug into a safe directory-name leaf.
 *  Returns null for anything that fails the slug whitelist OR isn't a
 *  basename (i.e. survives `path.basename` round-trip unchanged).
@@ -91,7 +90,6 @@ function safeSlugName(slug) {
 	if (basename !== slug) return null;
 	return basename;
 }
-var SAFE_RECORD_ID_PATTERN = /^[a-zA-Z0-9](?:[a-zA-Z0-9_.-]*[a-zA-Z0-9])?$/;
 /** Sanitise a user-supplied record id into a safe filename stem. Like
 *  `safeSlugName` but tolerates interior dots (so natural keys work),
 *  while still rejecting any `..` substring, path separators, and
@@ -239,7 +237,9 @@ async function writeFileAtomic(filePath, content) {
 *  inside an otherwise-contained data dir — without this, a record
 *  file could symlink to /etc/passwd and the detail endpoint would
 *  happily serve it. Returns false on ENOENT and on any other lstat
-*  failure so the caller's "missing" branch covers those cases too. */
+*  failure so the caller's "missing" branch covers those cases too.
+*  Exported so `ontology.ts`'s record COUNT classifies entries with the
+*  SAME lstat logic — the two must agree on what a record file is. */
 async function isRegularFile(filePath) {
 	try {
 		return (await lstat(filePath)).isFile();
@@ -634,13 +634,112 @@ ${dataJson}
 ${templateText}`;
 }
 //#endregion
+//#region src/collection/core/recordZ.ts
+/** The emptiness rule shared by `required` and the "only check present
+*  values" gate. NOT a truthiness check — `0` and `false` are filled. */
+var isEmptyValue = (value) => value === void 0 || value === null || value === "";
+/** The historical write-gate checks, verbatim: required non-empty, enum
+*  membership (compared as strings, so a numeric `5` satisfies `"5"`). */
+function enforcedProblem(key, spec, value) {
+	const empty = isEmptyValue(value);
+	if (spec.required && empty) return `missing required field '${key}'`;
+	if (!empty && spec.type === "enum" && !spec.values.includes(String(value))) return `'${key}' = '${String(value)}' is not one of [${spec.values.join(", ")}]`;
+	return null;
+}
+/** Numeric coercion for the strict `number`/`money` check: a plain number,
+*  or a non-blank numeric string (renderers coerce those via `Number(...)`,
+*  so they display fine). Anything else — arrays (`[]` stringifies to `""`
+*  = 0, `[42]` to `"42"`), booleans, objects — is NaN and gets flagged. */
+function coerceNumeric(value) {
+	if (typeof value === "number") return value;
+	if (typeof value === "string" && value.trim() !== "") return Number(value);
+	return NaN;
+}
+/** Report-only per-type checks on a PRESENT value. Date / datetime reuse the
+*  calendar's STRICT civil parsers (`parseIsoDate` / `parseIsoDateTime`), so
+*  the lint flags exactly the values the calendar / trigger / spawn code
+*  would silently drop — impossible days like `2026-02-30`, and datetimes
+*  outside the canonical `YYYY-MM-DDTHH:MM[:SS]` shape (e.g. a `Z` suffix,
+*  which the day view can't place). `string`-backed types accept anything
+*  stringifiable; `ref` existence is out of scope. */
+function strictTypeProblem(key, spec, value) {
+	switch (spec.type) {
+		case "number":
+		case "money": return Number.isFinite(coerceNumeric(value)) ? null : `'${key}' = '${String(value)}' is not numeric (a '${spec.type}' field stores a plain number)`;
+		case "boolean": return value === true || value === false ? null : `'${key}' = '${String(value)}' is not a boolean (store true or false, unquoted)`;
+		case "date": return parseIsoDate(value) !== null ? null : `'${key}' = '${String(value)}' is not a real YYYY-MM-DD date`;
+		case "datetime": return parseIsoDateTime(value) !== null ? null : `'${key}' = '${String(value)}' is not a YYYY-MM-DDTHH:MM datetime (seconds optional, no timezone suffix — the shape the calendar parses)`;
+		default: return null;
+	}
+}
+/** Strict check for a PRESENT `table` value: an array of row objects, each
+*  row conforming to the sub-schema (required / enum / typed sub-values).
+*  First row problem wins, prefixed with the row number so the fix is
+*  locatable. */
+function strictTableProblem(key, spec, value) {
+	if (!Array.isArray(value)) return `'${key}' = '${String(value)}' is not an array of rows (a 'table' field stores an array of row objects)`;
+	for (let index = 0; index < value.length; index++) {
+		const row = value[index];
+		if (!row || typeof row !== "object" || Array.isArray(row)) return `'${key}' row ${index + 1} is not an object`;
+		for (const [subKey, subSpec] of Object.entries(spec.of)) {
+			const subValue = row[subKey];
+			const problem = enforcedProblem(subKey, subSpec, subValue) ?? (isEmptyValue(subValue) ? null : strictTypeProblem(subKey, subSpec, subValue));
+			if (problem) return `'${key}' row ${index + 1}: ${problem}`;
+		}
+	}
+	return null;
+}
+/** First problem for one field's stored value under `tier`, or null.
+*  Enforced checks always run (and their messages never vary by tier — the
+*  scan and the write gate must agree on them); strict adds the per-type
+*  layer on present values only. */
+function recordFieldProblem(key, spec, value, tier) {
+	const enforced = enforcedProblem(key, spec, value);
+	if (enforced || tier === "enforced") return enforced;
+	if (isEmptyValue(value)) return null;
+	if (spec.type === "table") return strictTableProblem(key, spec, value);
+	return strictTypeProblem(key, spec, value);
+}
+var compiled = /* @__PURE__ */ new WeakMap();
+/** Compile `schema.fields` into a zod validator for a stored record.
+*  Loose object: unknown keys are allowed and any declared key may be
+*  absent (records are user files, not parse-and-rewrite targets —
+*  callers validate, they never persist the parse output). The checks run
+*  as ONE object-level refine iterating fields in declaration order —
+*  per-key shape schemas can't express "key may be absent BUT its absence
+*  must still reach the required check", and the single loop keeps the
+*  first reported issue identical to the historical first-problem-wins
+*  contract. */
+function compileRecordZ(schema, tier) {
+	const cached = compiled.get(schema)?.[tier];
+	if (cached) return cached;
+	const stored = Object.entries(schema.fields).filter(([, spec]) => !COMPUTED_TYPES.has(spec.type));
+	const validator = z.looseObject({}).superRefine((record, ctx) => {
+		for (const [key, spec] of stored) {
+			const problem = recordFieldProblem(key, spec, record[key], tier);
+			if (problem) ctx.addIssue({
+				code: "custom",
+				message: problem,
+				path: [key]
+			});
+		}
+	});
+	const entry = compiled.get(schema) ?? {};
+	entry[tier] = validator;
+	compiled.set(schema, entry);
+	return validator;
+}
+/** First schema problem on an in-memory record under `tier`, or null. One
+*  issue per record keeps the report short and the fix obvious (the
+*  historical contract of `validateRecordObject`). */
+function firstRecordProblem(record, schema, tier) {
+	const result = compileRecordZ(schema, tier).safeParse(record);
+	if (result.success) return null;
+	return result.error.issues[0]?.message ?? "record failed schema validation";
+}
+//#endregion
 //#region src/collection/server/validate.ts
 var MAX_ISSUES = 25;
-var COMPUTED_TYPES = /* @__PURE__ */ new Set([
-	"derived",
-	"embed",
-	"toggle"
-]);
 /** Read every `<id>.json` under the collection's dataDir and report the
 *  ones that won't load or violate the schema. An empty list means every
 *  record is fine. */
@@ -703,72 +802,70 @@ async function inspectRecord(fullPath, name, schema) {
 		file: name,
 		problem: "not a JSON object — skipped, won't appear"
 	};
-	const problem = validateRecordObject(parsed, name.replace(/\.json$/, ""), schema);
+	const problem = validateRecordObject(parsed, name.replace(/\.json$/, ""), schema, "strict");
 	return problem ? {
 		file: name,
 		problem
 	} : null;
 }
 /** First schema problem on an in-memory record (primaryKey↔id mismatch,
-*  missing required, bad enum value), or null when it's fine. One issue
-*  per record keeps the report short and the fix obvious. Pure +
-*  exported so write paths (manageCollection putItems) can gate on the
-*  SAME rules the post-hoc file scan reports — `itemId` is the id the
-*  record is (or would be) stored under. */
-function validateRecordObject(record, itemId, schema) {
+*  then the compiled per-field checks — see `../core/recordZ` for the two
+*  tiers), or null when it's fine. One issue per record keeps the report
+*  short and the fix obvious. Pure + exported so write paths
+*  (manageCollection putItems) can gate on the SAME enforced rules the
+*  post-hoc file scan reports — `itemId` is the id the record is (or
+*  would be) stored under. The default `"enforced"` tier keeps every
+*  write gate on the historical three checks; only pass `"strict"` from
+*  report-only surfaces. */
+function validateRecordObject(record, itemId, schema, tier = "enforced") {
 	const idValue = record[schema.primaryKey];
 	if (typeof idValue !== "string" || idValue !== itemId) return `'${schema.primaryKey}' is '${String(idValue ?? "")}' but must equal the filename ('${itemId}'), or the record can't be opened`;
-	for (const [field, spec] of Object.entries(schema.fields)) {
-		if (COMPUTED_TYPES.has(spec.type)) continue;
-		const value = record[field];
-		const empty = value === void 0 || value === null || value === "";
-		if (spec.required && empty) return `missing required field '${field}'`;
-		if (!empty && spec.type === "enum" && spec.values && !spec.values.includes(String(value))) return `'${field}' = '${String(value)}' is not one of [${spec.values.join(", ")}]`;
-	}
-	return null;
+	return firstRecordProblem(record, schema, tier);
 }
 //#endregion
-//#region src/collection/server/discovery.ts
-var refRefine = (spec) => {
-	if (spec.type !== "ref") return true;
-	if (typeof spec.to !== "string") return false;
-	return safeSlugName(spec.to) !== null;
-};
-var refMessage = {
-	message: "fields with type 'ref' must declare a `to` that is a valid collection slug (alphanumeric / hyphen / underscore, no path separators)",
-	path: ["to"]
-};
-var isDateLike = (type) => type === "date" || type === "datetime";
-var isTimeStringField = (type) => type === "string" || type === "text";
-var embedRefine = (spec) => {
-	if (spec.type !== "embed") return true;
-	if (typeof spec.to !== "string" || safeSlugName(spec.to) === null) return false;
-	return (typeof spec.id === "string" && spec.id.trim().length > 0) !== (typeof spec.idField === "string" && spec.idField.trim().length > 0);
-};
-var embedMessage = {
-	message: "fields with type 'embed' must declare a `to` (valid collection slug) and exactly one of `id` (a fixed record's primary key) or `idField` (a sibling field naming the per-record target)",
-	path: ["id"]
-};
-var enumRefine = (spec) => spec.type !== "enum" || Array.isArray(spec.values) && spec.values.length > 0 && spec.values.every((value) => typeof value === "string" && value.length > 0);
-var enumMessage = {
-	message: "fields with type 'enum' must declare a non-empty `values` array of non-empty strings",
-	path: ["values"]
+//#region src/collection/core/schemaZ.ts
+/** Optional visibility predicate shared by actions and fields: the target
+*  shows only when the open record's `field` (stringified) is one of `in`.
+*  Domain-free — `field` is any non-empty key, `in` a non-empty array of
+*  non-empty values; the host never interprets the meaning.
+*
+*  `trim().min(1)` rather than bare `min(1)` so a whitespace-only string
+*  ("   ") fails validation — otherwise the cell formatter / dropdown would
+*  render visual blanks that look like missing data. Applied consistently to
+*  every "non-empty string" slot in this file (CodeRabbit PR #1497). */
+var WhenZ = z.object({
+	field: z.string().trim().min(1),
+	in: z.array(z.string().trim().min(1)).min(1)
+});
+var fieldBase = {
+	label: z.string().min(1),
+	primary: z.boolean().optional(),
+	required: z.boolean().optional(),
+	when: WhenZ.optional()
 };
-var currencyRefine = (spec) => {
-	if (!(spec.type === "money" || spec.type === "derived" && spec.display === "money")) return true;
-	const hasLiteral = typeof spec.currency === "string" && spec.currency.trim().length > 0;
-	const hasPointer = typeof spec.currencyField === "string" && spec.currencyField.trim().length > 0;
-	return hasLiteral || hasPointer;
+var currencyKeys = {
+	currency: z.string().trim().min(1).optional(),
+	currencyField: z.string().trim().min(1).optional()
 };
+var hasCurrencySource = (spec) => spec.currency !== void 0 || spec.currencyField !== void 0;
 var currencyMessage = {
 	message: "fields that render as money (type 'money', or 'derived' with display 'money') must declare either a literal `currency` (ISO 4217 code, e.g. 'USD', 'JPY') or a `currencyField` naming the record field that holds the code",
 	path: ["currency"]
 };
-var WhenSchema = z.object({
-	field: z.string().trim().min(1),
-	in: z.array(z.string().trim().min(1)).min(1)
+var slugMessage = (key) => ({
+	message: `\`${key}\` must be a valid collection slug (alphanumeric / hyphen / underscore, no path separators)`,
+	path: [key]
 });
-var SubFieldSpecSchema = z.object({
+/** The plain scalar field types. Stored and edited as primitive values; no
+*  variant-specific keys.
+*  - `image`: a workspace-relative image path (e.g. a `data/attachments/...`
+*    upload); rendered as an <img> in the detail view (not the list table —
+*    a per-row fetch is too expensive at scale). Stored as a plain string.
+*  - `file`: a workspace-relative file path as a plain string (e.g. an
+*    `artifacts/html/<name>.html` app). Rendered as a clickable link in both
+*    the list table and the detail view: HTML / SVG artifacts open their
+*    rendered form in a new tab; any other path opens in the File Explorer. */
+var ScalarFieldZ = z.object({
 	type: z.enum([
 		"string",
 		"text",
@@ -778,18 +875,39 @@ var SubFieldSpecSchema = z.object({
 		"datetime",
 		"boolean",
 		"markdown",
-		"ref",
-		"money",
-		"enum"
+		"image",
+		"file"
 	]),
+	...fieldBase
+});
+/** A link to another collection: the record stores the target item's
+*  primary-key slug and the host renders a clickable link + dropdown picker.
+*  `to` must be a real slug (not `../foo`, not `mc-clients/extra` — see
+*  Codex P2 on PR #1495); whether the target collection exists resolves
+*  fail-soft at render time, never here. */
+var RefFieldZ = z.object({
+	type: z.literal("ref"),
+	...fieldBase,
+	to: z.string().min(1)
+}).refine((spec) => isSafeSlug(spec.to), slugMessage("to"));
+/** A money amount. See `currencyKeys` for the currency-source contract. */
+var MoneyFieldZ = z.object({
+	type: z.literal("money"),
+	...fieldBase,
+	...currencyKeys
+}).refine(hasCurrencySource, currencyMessage);
+/** A closed set of allowed string values. The form renders a `<select>`
+*  populated from `values`; storage is a plain string. */
+var EnumFieldZ = z.object({
+	type: z.literal("enum"),
+	...fieldBase,
+	values: z.array(z.string().trim().min(1)).min(1)
+});
+var subFieldBase = {
 	label: z.string().min(1),
-	required: z.boolean().optional(),
-	to: z.string().min(1).optional(),
-	currency: z.string().trim().min(1).optional(),
-	currencyField: z.string().trim().min(1).optional(),
-	values: z.array(z.string().trim().min(1)).min(1).optional()
-}).refine(refRefine, refMessage).refine(enumRefine, enumMessage).refine(currencyRefine, currencyMessage);
-var FieldSpecSchema = z.object({
+	required: z.boolean().optional()
+};
+var SubScalarFieldZ = z.object({
 	type: z.enum([
 		"string",
 		"text",
@@ -798,62 +916,145 @@ var FieldSpecSchema = z.object({
 		"date",
 		"datetime",
 		"boolean",
-		"markdown",
-		"ref",
-		"money",
-		"enum",
-		"table",
-		"derived",
-		"embed",
-		"image",
-		"file",
-		"toggle"
+		"markdown"
 	]),
-	label: z.string().min(1),
-	primary: z.boolean().optional(),
-	required: z.boolean().optional(),
-	to: z.string().min(1).optional(),
-	id: z.string().trim().min(1).optional(),
-	idField: z.string().trim().min(1).optional(),
-	currency: z.string().trim().min(1).optional(),
-	currencyField: z.string().trim().min(1).optional(),
-	values: z.array(z.string().trim().min(1)).min(1).optional(),
-	field: z.string().trim().min(1).optional(),
-	onValue: z.string().trim().min(1).optional(),
-	offValue: z.string().trim().min(1).optional(),
-	of: z.record(z.string(), SubFieldSpecSchema).optional(),
-	formula: z.string().trim().min(1).optional(),
-	/** Inner type to render a derived value as (e.g. `"money"`).
-	*  Restricted to the non-composite display targets — derived
-	*  values are scalars, so rendering them via `table` or another
-	*  `derived` would be meaningless. */
+	...subFieldBase
+});
+var SubRefFieldZ = z.object({
+	type: z.literal("ref"),
+	...subFieldBase,
+	to: z.string().min(1)
+}).refine((spec) => isSafeSlug(spec.to), slugMessage("to"));
+var SubMoneyFieldZ = z.object({
+	type: z.literal("money"),
+	...subFieldBase,
+	...currencyKeys
+}).refine(hasCurrencySource, currencyMessage);
+var SubEnumFieldZ = z.object({
+	type: z.literal("enum"),
+	...subFieldBase,
+	values: z.array(z.string().trim().min(1)).min(1)
+});
+var SubFieldSpecZ = z.discriminatedUnion("type", [
+	SubScalarFieldZ,
+	SubRefFieldZ,
+	SubMoneyFieldZ,
+	SubEnumFieldZ
+]);
+/** A flat sub-table: each row is a record of `of`'s sub-schema (insertion
+*  order = column order). v0 disallows nested tables and derived columns to
+*  keep the editor + evaluator simple. */
+var TableFieldZ = z.object({
+	type: z.literal("table"),
+	...fieldBase,
+	of: z.record(z.string(), SubFieldSpecZ)
+}).refine((spec) => Object.keys(spec.of).length > 0, {
+	message: "fields with type 'table' must declare a non-empty `of` (sub-schema for each row)",
+	path: ["of"]
+});
+/** A computed scalar: `formula` is a tiny expression evaluated against the
+*  record — `+ - * /`, parens, identifier refs to top-level fields,
+*  `sum(tableField[].col)`, and `sum(tableField[].col * tableField[].col)`
+*  (see `./derivedFormula`). `display` picks the inner type the value renders
+*  as (default `"number"`) — restricted to the non-composite display targets,
+*  since a derived value is a scalar. Never stored; computed by `deriveAll`
+*  on both server and client. */
+var DerivedFieldZ = z.object({
+	type: z.literal("derived"),
+	...fieldBase,
+	formula: z.string().trim().min(1),
 	display: z.enum([
 		"string",
 		"number",
 		"money",
 		"date"
 	]).optional(),
-	when: WhenSchema.optional()
-}).refine(refRefine, refMessage).refine(enumRefine, enumMessage).refine(embedRefine, embedMessage).refine(currencyRefine, currencyMessage).refine((spec) => spec.type !== "table" || spec.of !== void 0 && Object.keys(spec.of).length > 0, {
-	message: "fields with type 'table' must declare a non-empty `of` (sub-schema for each row)",
-	path: ["of"]
-}).refine((spec) => spec.type !== "derived" || typeof spec.formula === "string" && spec.formula.length > 0, {
-	message: "fields with type 'derived' must declare a non-empty `formula` (see src/utils/collections/derivedFormula.ts)",
-	path: ["formula"]
-}).refine((spec) => spec.type !== "toggle" || typeof spec.field === "string" && spec.field.length > 0 && typeof spec.onValue === "string" && typeof spec.offValue === "string", {
-	message: "fields with type 'toggle' must declare `field` (the enum field to project), `onValue`, and `offValue`",
-	path: ["field"]
+	...currencyKeys
+}).refine((spec) => spec.display !== "money" || hasCurrencySource(spec), currencyMessage);
+/** Pulls a record from another collection into the read-only detail view.
+*  Display-only — nothing is stored on this record, so it never appears in
+*  the list table or the edit form. Must declare a valid `to` slug (same
+*  path-traversal guard as `ref`) AND exactly one of `id` (a fixed target
+*  record, e.g. `me` for the singleton profile — same for every record) or
+*  `idField` (a sibling top-level field naming the per-record target, e.g.
+*  an invoice's `issuerId` selecting which profile to embed as the bill-from
+*  block; an absent/empty value resolves fail-soft to "no record"). The
+*  `idField` target is validated to be a real `ref`/`string` field by a
+*  schema-level refine below. */
+var EmbedFieldZ = z.object({
+	type: z.literal("embed"),
+	...fieldBase,
+	to: z.string().min(1),
+	id: z.string().trim().min(1).optional(),
+	idField: z.string().trim().min(1).optional()
+}).refine((spec) => isSafeSlug(spec.to) && spec.id !== void 0 !== (spec.idField !== void 0), {
+	message: "fields with type 'embed' must declare a `to` (valid collection slug) and exactly one of `id` (a fixed record's primary key) or `idField` (a sibling field naming the per-record target)",
+	path: ["id"]
 });
-var ActionSpecSchema = z.object({
+/** Display-only REVERSE refs (plan step ② of plans/collection-ontology.md):
+*  a read-only sub-table of the records in collection `from` whose `via`
+*  ref field stores THIS record's primary key. Stores nothing (joins
+*  `COMPUTED_TYPES`); resolution is shared server/client via
+*  `core/backlinks.ts`. `display` names the `from` columns to show;
+*  `filter` (the standard `when` shape, matched against each SOURCE
+*  record) narrows the rows. Validation is shape-only, like `embed`:
+*  `from` must be a safe slug, but whether it exists — and whether `via` /
+*  `display` name real fields there — resolves fail-soft at render
+*  (empty sub-table). Do NOT add cross-schema existence checks here. */
+var BacklinksFieldZ = z.object({
+	type: z.literal("backlinks"),
+	...fieldBase,
+	from: z.string().min(1),
+	via: z.string().trim().min(1),
+	display: z.array(z.string().trim().min(1)).min(1),
+	filter: WhenZ.optional()
+}).refine((spec) => isSafeSlug(spec.from), slugMessage("from"));
+/** A checkbox that is a pure PROJECTION of an `enum` field — it stores
+*  nothing of its own. Checked when the enum named by `field` equals
+*  `onValue`; toggling writes `onValue` / `offValue` back to that enum
+*  field. Lets a "done" checkbox front a kanban `status` field with the enum
+*  as the single source of truth (no separate stored boolean to keep in
+*  sync). `field` / `onValue` / `offValue` are validated against the target
+*  enum's `values` by a schema-level refine below. */
+var ToggleFieldZ = z.object({
+	type: z.literal("toggle"),
+	...fieldBase,
+	field: z.string().trim().min(1),
+	onValue: z.string().trim().min(1),
+	offValue: z.string().trim().min(1)
+});
+var FieldSpecZ = z.discriminatedUnion("type", [
+	ScalarFieldZ,
+	RefFieldZ,
+	MoneyFieldZ,
+	EnumFieldZ,
+	TableFieldZ,
+	DerivedFieldZ,
+	EmbedFieldZ,
+	BacklinksFieldZ,
+	ToggleFieldZ
+]);
+/** A schema-declared record action, rendered as a button in the read-only
+*  detail view. Domain-free: the host validates the shape; the meaning
+*  (which role, which template) is data. v1 ships only `kind: "chat"` —
+*  start a new chat in `role` with a templated seed prompt; the enum
+*  reserves room for a future `"mutate"` (status transitions) without
+*  another schema-shape change. */
+var ActionSpecZ = z.object({
 	id: z.string().trim().min(1),
 	label: z.string().trim().min(1),
 	icon: z.string().trim().min(1).optional(),
 	kind: z.enum(["chat"]),
 	role: z.string().trim().min(1),
 	template: z.string().trim().min(1).refine(isSafeActionTemplatePath, "must be a safe path under `templates/` (e.g. `templates/invoice.md`; no `..`, no leading `/`, no backslash)"),
-	when: WhenSchema.optional()
+	when: WhenZ.optional()
 });
-var CustomViewSchema = z.object({
+/** A custom (LLM-authored) HTML view registration. Domain-free: the host
+*  validates the shape; the view's behaviour lives in the HTML file. `file`
+*  is constrained to `views/*.html` (path-safe) so the view-file reader can
+*  never reach the data folder or the schema/template files. `id` is
+*  validated to be a real slug + unique by schema-level refines below. */
+var CustomViewZ = z.object({
 	id: z.string().trim().min(1),
 	label: z.string().trim().min(1),
 	icon: z.string().trim().min(1).optional(),
@@ -866,7 +1067,14 @@ var CustomViewSchema = z.object({
 	imageFields: z.array(z.string().trim().min(1)).optional(),
 	imageMaxEdge: z.number().int().min(1).optional()
 });
-var EveryLiteralSchema = z.object({
+/** Recurrence advance for `spawn.every`. `interval` is a positive integer
+*  count of `unit`s (`interval: 3` + `unit: "month"` = quarterly);
+*  `dayOfMonth` (month/year only) is the CANONICAL day-of-month anchor
+*  (1-31, read from the rule and clamped per-month at compute time so "31st
+*  of every month" never drifts) or the `"last"` sentinel for end-of-month.
+*  `.strict()` so the union below cleanly rejects an object carrying BOTH
+*  `unit` and `fromField` (it fails this arm on the unknown `fromField`). */
+var EveryLiteralZ = z.object({
 	unit: z.enum([
 		"day",
 		"week",
@@ -876,17 +1084,114 @@ var EveryLiteralSchema = z.object({
 	interval: z.number().int().min(1),
 	dayOfMonth: z.union([z.number().int().min(1).max(31), z.literal("last")]).optional()
 }).strict();
-var EveryFieldDrivenSchema = z.object({
+/** Field-driven recurrence: pick the interval per-record by an `enum`
+*  field's value — one collection can mix daily / weekly / monthly
+*  obligations in a single list. `map` keys are validated to exactly cover
+*  that field's `values` by a `CollectionSchemaZ` refine (which can see the
+*  sibling `fields`); here each map value just has to be a well-formed
+*  literal `every`. `.strict()` mirrors the literal arm so a both-keys
+*  object fails this arm too. */
+var EveryFieldDrivenZ = z.object({
 	fromField: z.string().trim().min(1),
-	map: z.record(z.string(), EveryLiteralSchema)
+	map: z.record(z.string(), EveryLiteralZ)
 }).strict();
-var EverySchema = z.union([EveryLiteralSchema, EveryFieldDrivenSchema]);
-var SpawnSchema = z.object({
-	when: WhenSchema.optional(),
-	every: EverySchema,
+/** Either a single literal interval (applied to every record) or the
+*  field-driven map. Two `.strict()` arms mean "both keys" and "neither
+*  key" both fail validation, with no extra refine. */
+var EveryZ = z.union([EveryLiteralZ, EveryFieldDrivenZ]);
+/** Host-driven recurrence: when a record satisfies `when` (default:
+*  "`completionField` value ∈ `completionDoneValues`"), the host creates the
+*  next record with a forward-advanced `triggerField` date. `carry` copies
+*  record fields verbatim onto the successor; `set` forces fixed values
+*  (typically resetting the status field to its pending value). The
+*  successor's id and contents are a pure function of (source record, this
+*  rule); creation is create-if-absent, so the mechanism stays convergent. */
+var SpawnZ = z.object({
+	when: WhenZ.optional(),
+	every: EveryZ,
 	carry: z.array(z.string().trim().min(1)).optional(),
 	set: z.record(z.string(), z.unknown()).optional()
 });
+/** Declarative retrieval config for a Feed (a collection that refills itself
+*  from the internet). `http-json` needs `itemsAt` (a path to the items
+*  array) only when the response body isn't itself the array; rss/atom yield
+*  items natively and ignore it — so no kind-specific requirement here. */
+var DeclarativeIngestZ = z.object({
+	kind: z.enum(INGEST_KINDS),
+	url: z.string().url(),
+	schedule: z.enum(FEED_SCHEDULES),
+	atHour: z.number().int().min(0).max(23).optional(),
+	itemsAt: z.string().trim().min(1).optional(),
+	map: z.record(z.string().trim().min(1), z.string().trim().min(1)),
+	idFrom: z.string().trim().min(1).optional(),
+	maxItems: z.number().int().min(0).optional()
+});
+/** Agent-performed retrieval. Valid on any collection (the primary consumer
+*  is skill-backed collections — feeds keep their declarative kinds). No
+*  `url`/`map`: the worker owns retrieval and record shape, seeded by
+*  `template` + a summary of every record, run in `role`. `template` is
+*  validated the SAME way an action's template is (safe path under
+*  `templates/`), so the skill-bridge mirrors it identically. */
+var AgentIngestZ = z.object({
+	kind: z.literal(AGENT_INGEST_KIND),
+	schedule: z.enum(FEED_SCHEDULES),
+	atHour: z.number().int().min(0).max(23).optional(),
+	role: z.string().trim().min(1),
+	template: z.string().trim().min(1).refine(isSafeActionTemplatePath, "must be a safe path under `templates/` (e.g. `templates/refresh.md`; no `..`, no leading `/`, no backslash)")
+});
+/** `ingest` is a discriminated union on `kind`: the three declarative
+*  retrievers fetch-and-map; `agent` dispatches a hidden worker. Optional on
+*  every schema — skill-backed collections usually omit it; only feeds
+*  discovered from `<workspace>/feeds/` are REQUIRED to carry it (gated by
+*  `acceptParsedSchema`). */
+var IngestZ = z.discriminatedUnion("kind", [DeclarativeIngestZ, AgentIngestZ]);
+var ValueRefZ = z.object({
+	record: z.string().trim().min(1).optional(),
+	field: z.string().trim().min(1)
+});
+var WhereCondZ = z.object({
+	field: z.string().trim().min(1),
+	op: z.enum([
+		"eq",
+		"ne",
+		"in",
+		"gt",
+		"gte",
+		"lt",
+		"lte",
+		"contains"
+	]),
+	value: z.union([z.string(), z.array(z.string())]).optional(),
+	valueFrom: ValueRefZ.optional()
+}).refine((cond) => cond.value !== void 0 !== (cond.valueFrom !== void 0), {
+	message: "a where condition must declare exactly one of `value` (a literal) or `valueFrom` (a reference to another record's field), never both or neither",
+	path: ["value"]
+}).refine((cond) => cond.value === void 0 || cond.op === "in" === Array.isArray(cond.value), {
+	message: "`in` requires an array `value` (the allowed set); every other op requires a single string `value`",
+	path: ["value"]
+});
+var WhereZ = z.array(WhereCondZ);
+var DynamicIconSourceZ = z.object({
+	collection: z.string().trim().min(1),
+	from: z.enum([
+		"latest",
+		"first",
+		"when"
+	]).optional(),
+	orderBy: z.string().trim().min(1).optional(),
+	where: WhereZ.optional()
+});
+var DynamicIconRuleZ = z.object({
+	where: WhereZ,
+	icon: z.string().trim().min(1)
+});
+var DynamicIconSpecZ = z.object({
+	source: DynamicIconSourceZ,
+	rules: z.array(DynamicIconRuleZ),
+	fallback: z.string().trim().min(1).optional()
+});
+var isDateLike = (type) => type === "date" || type === "datetime";
+var isTimeStringField = (type) => type === "string" || type === "text";
 var CODE_FIELD_TYPES = /* @__PURE__ */ new Set([
 	"string",
 	"text",
@@ -924,7 +1229,7 @@ function spawnSuccessorStartsInert(schema) {
 }
 function fieldDrivenSpawnEvery(schema) {
 	const every = schema.spawn?.every;
-	if (!every || !isFieldDrivenEvery(every)) return null;
+	if (!every || !("fromField" in every)) return null;
 	return every;
 }
 function fieldDrivenFromFieldIsEnum(schema) {
@@ -952,93 +1257,30 @@ function fieldDrivenFromFieldCarried(schema) {
 	}
 	return (carry ?? []).includes(driven.fromField);
 }
-var DeclarativeIngestZ = z.object({
-	kind: z.enum(INGEST_KINDS),
-	url: z.string().url(),
-	schedule: z.enum(FEED_SCHEDULES),
-	atHour: z.number().int().min(0).max(23).optional(),
-	itemsAt: z.string().trim().min(1).optional(),
-	map: z.record(z.string().trim().min(1), z.string().trim().min(1)),
-	idFrom: z.string().trim().min(1).optional(),
-	maxItems: z.number().int().min(0).optional()
-});
-var AgentIngestZ = z.object({
-	kind: z.literal(AGENT_INGEST_KIND),
-	schedule: z.enum(FEED_SCHEDULES),
-	atHour: z.number().int().min(0).max(23).optional(),
-	role: z.string().trim().min(1),
-	template: z.string().trim().min(1).refine(isSafeActionTemplatePath, "must be a safe path under `templates/` (e.g. `templates/refresh.md`; no `..`, no leading `/`, no backslash)")
-});
-var IngestSchemaZ = z.discriminatedUnion("kind", [DeclarativeIngestZ, AgentIngestZ]);
-var ValueRefZ = z.object({
-	record: z.string().trim().min(1).optional(),
-	field: z.string().trim().min(1)
-});
-var WhereCondZ = z.object({
-	field: z.string().trim().min(1),
-	op: z.enum([
-		"eq",
-		"ne",
-		"in",
-		"gt",
-		"gte",
-		"lt",
-		"lte",
-		"contains"
-	]),
-	value: z.union([z.string(), z.array(z.string())]).optional(),
-	valueFrom: ValueRefZ.optional()
-}).refine((cond) => cond.value !== void 0 !== (cond.valueFrom !== void 0), {
-	message: "a where condition must declare exactly one of `value` (a literal) or `valueFrom` (a reference to another record's field), never both or neither",
-	path: ["value"]
-}).refine((cond) => cond.value === void 0 || cond.op === "in" === Array.isArray(cond.value), {
-	message: "`in` requires an array `value` (the allowed set); every other op requires a single string `value`",
-	path: ["value"]
-});
-var WhereZ = z.array(WhereCondZ);
-var DynamicIconSourceZ = z.object({
-	collection: z.string().trim().min(1),
-	from: z.enum([
-		"latest",
-		"first",
-		"when"
-	]).optional(),
-	orderBy: z.string().trim().min(1).optional(),
-	where: WhereZ.optional()
-});
-var DynamicIconRuleZ = z.object({
-	where: WhereZ,
-	icon: z.string().trim().min(1)
-});
-var DynamicIconSpecZ = z.object({
-	source: DynamicIconSourceZ,
-	rules: z.array(DynamicIconRuleZ),
-	fallback: z.string().trim().min(1).optional()
-});
 var CollectionSchemaZ = z.object({
 	title: z.string().min(1),
 	icon: z.string().min(1),
 	dataPath: z.string().min(1),
 	primaryKey: z.string().min(1),
 	singleton: z.string().trim().min(1).optional(),
-	fields: z.record(z.string(), FieldSpecSchema),
-	actions: z.array(ActionSpecSchema).optional(),
-	collectionActions: z.array(ActionSpecSchema).optional(),
+	fields: z.record(z.string(), FieldSpecZ),
+	actions: z.array(ActionSpecZ).optional(),
+	collectionActions: z.array(ActionSpecZ).optional(),
 	completionField: z.string().trim().min(1).optional(),
 	completionDoneValues: z.array(z.string().trim().min(1)).min(1).optional(),
 	displayField: z.string().trim().min(1).optional(),
 	triggerField: z.string().trim().min(1).optional(),
 	triggerLeadDays: z.number().int().min(0).optional(),
-	spawn: SpawnSchema.optional(),
+	spawn: SpawnZ.optional(),
 	calendarField: z.string().trim().min(1).optional(),
 	calendarEndField: z.string().trim().min(1).optional(),
 	calendarTimeField: z.string().trim().min(1).optional(),
 	kanbanField: z.string().trim().min(1).optional(),
-	views: z.array(CustomViewSchema).optional(),
-	notifyWhen: WhenSchema.optional(),
-	ingest: IngestSchemaZ.optional(),
+	views: z.array(CustomViewZ).optional(),
+	notifyWhen: WhenZ.optional(),
+	ingest: IngestZ.optional(),
 	dynamicIcon: DynamicIconSpecZ.optional()
-}).refine((schema) => schema.singleton === void 0 || safeRecordId(schema.singleton) !== null, {
+}).refine((schema) => schema.singleton === void 0 || isSafeRecordId(schema.singleton), {
 	message: "schema `singleton` must be a valid item id (alphanumeric / hyphen / underscore / interior dot, no `..` or path separators)",
 	path: ["singleton"]
 }).refine((schema) => schema.actions === void 0 || new Set(schema.actions.map((action) => action.id)).size === schema.actions.length, {
@@ -1129,13 +1371,15 @@ var CollectionSchemaZ = z.object({
 }).refine((schema) => schema.notifyWhen === void 0 || schema.fields[schema.notifyWhen.field] !== void 0, {
 	message: "schema `notifyWhen.field` must name a top-level field declared in `fields`",
 	path: ["notifyWhen"]
-}).refine((schema) => schema.views === void 0 || schema.views.every((view) => safeSlugName(view.id) !== null), {
+}).refine((schema) => schema.views === void 0 || schema.views.every((view) => isSafeSlug(view.id)), {
 	message: "every `views[].id` must be a valid slug (alphanumeric / hyphen / underscore, no path separators)",
 	path: ["views"]
 }).refine((schema) => schema.views === void 0 || new Set(schema.views.map((view) => view.id)).size === schema.views.length, {
 	message: "schema `views` must have unique `id`s",
 	path: ["views"]
 });
+//#endregion
+//#region src/collection/server/discovery.ts
 function applyFeedSchemaDefaults(parsed, slug) {
 	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return parsed;
 	const obj = parsed;
@@ -1318,6 +1562,72 @@ function toDetail(collection) {
 	};
 }
 //#endregion
+//#region src/collection/server/ontology.ts
+/** Extract the relations a schema declares, in field declaration order:
+*  top-level `ref` / `embed` / `backlinks` fields plus `ref` sub-fields
+*  inside `table` columns. Pure — exported so the phase-2 graph panel
+*  can reuse it on already-loaded schemas. */
+function schemaRelations(schema) {
+	const relations = [];
+	for (const [key, spec] of Object.entries(schema.fields)) {
+		if (spec.type === "ref" || spec.type === "embed") relations.push({
+			field: key,
+			kind: spec.type,
+			to: spec.to
+		});
+		if (spec.type === "backlinks") relations.push({
+			field: key,
+			kind: "backlinks",
+			to: spec.from
+		});
+		if (spec.type !== "table") continue;
+		for (const [subKey, subSpec] of Object.entries(spec.of)) if (subSpec.type === "ref") relations.push({
+			field: `${key}.${subKey}`,
+			kind: "ref",
+			to: subSpec.to
+		});
+	}
+	return relations;
+}
+/** Count the record files in a collection's data dir — the same
+*  `<id>.json` entries `listItems` considers, WITHOUT parsing them (the
+*  ontology is a summary; a malformed record is still a record). Each
+*  candidate is classified by the SHARED `isRegularFile` lstat helper —
+*  the exact file-disclosure defense `listItems` applies — so a
+*  symlinked record never counts and the count can't diverge from the
+*  readable set on any filesystem (Codex review on PR #2099, twice).
+*  Fail-soft: a missing dir or a dataDir escaping the workspace via
+*  symlink counts 0. */
+async function countRecordFiles(dataDir, workspaceRoot) {
+	if (!isContainedInRoot(dataDir, workspaceRoot)) return 0;
+	try {
+		const names = (await readdir(dataDir)).filter((name) => name.endsWith(".json") && !name.startsWith("."));
+		return (await Promise.all(names.map((name) => isRegularFile(path.join(dataDir, name))))).filter(Boolean).length;
+	} catch {
+		return 0;
+	}
+}
+async function toOntologyEntry(collection, workspaceRoot) {
+	const { schema } = collection;
+	return {
+		slug: collection.slug,
+		title: schema.title,
+		icon: schema.icon,
+		primaryKey: schema.primaryKey,
+		displayField: schema.displayField ?? schema.primaryKey,
+		recordCount: await countRecordFiles(collection.dataDir, workspaceRoot),
+		relations: schemaRelations(schema)
+	};
+}
+/** Build the workspace ontology: every discovered collection (slug-sorted,
+*  discovery's order), each with its outbound relations and a
+*  readdir-cheap record count — fine to call on demand. */
+async function buildWorkspaceOntology(opts = {}) {
+	const workspaceRoot = opts.workspaceRoot ?? getWorkspaceRoot();
+	const collections = await discoverCollections(opts);
+	return Promise.all(collections.map((collection) => toOntologyEntry(collection, workspaceRoot)));
+}
+//#endregion
 //#region src/collection/server/derive.ts
 /** Slugs of every collection referenced by a `ref` field — top-level
 *  and one level into `table` sub-fields (nested tables are
@@ -1340,6 +1650,13 @@ function uniqueEmbedTargets(schema) {
 	for (const field of Object.values(schema.fields)) if (field.type === "embed" && typeof field.to === "string" && field.to.length > 0) targets.add(field.to);
 	return [...targets];
 }
+/** Slugs of every SOURCE collection a `backlinks` field reverses over —
+*  loaded exactly like ref/embed targets (whole collection, once). */
+function uniqueBacklinkSources(schema) {
+	const sources = /* @__PURE__ */ new Set();
+	for (const field of Object.values(schema.fields)) if (field.type === "backlinks" && field.from.length > 0) sources.add(field.from);
+	return [...sources];
+}
 async function loadTarget(slug, opts) {
 	const target = await loadCollection(slug, opts);
 	if (!target) return null;
@@ -1354,11 +1671,16 @@ async function loadTarget(slug, opts) {
 		byId
 	};
 }
-/** Load every ref/embed target collection once. Unknown / unloadable
-*  targets are simply absent — downstream derefs resolve to null, the
-*  same fail-soft the UI renders as an em-dash. */
+/** Load every ref/embed target and backlink source collection once.
+*  Unknown / unloadable targets are simply absent — downstream derefs
+*  resolve to null (em-dash) and backlinks to an empty row set, the
+*  same fail-soft the UI renders. */
 async function loadLinkedTargets(schema, opts) {
-	const slugs = [.../* @__PURE__ */ new Set([...uniqueRefTargets(schema), ...uniqueEmbedTargets(schema)])];
+	const slugs = [.../* @__PURE__ */ new Set([
+		...uniqueRefTargets(schema),
+		...uniqueEmbedTargets(schema),
+		...uniqueBacklinkSources(schema)
+	])];
 	const loaded = {};
 	for (const slug of slugs) {
 		const target = await loadTarget(slug, opts);
@@ -1369,9 +1691,21 @@ async function loadLinkedTargets(schema, opts) {
 function toRefRecords(linked) {
 	return Object.fromEntries(Object.entries(linked).map(([slug, target]) => [slug, target.byId]));
 }
+/** The matching source rows for one `backlinks` field, projected to the
+*  source primaryKey + `display` columns — so getItems on a
+*  heavily-referenced record stays a summary, not a dump of the source
+*  collection. Missing source ⇒ [] (fail-soft). The rows come from the
+*  DERIVED source records (`byId`), so `display`/`filter` on a derived
+*  source column (an invoice `total`) works. */
+function projectBacklinks(field, schema, enriched, linked) {
+	const source = linked[field.from];
+	if (!source) return [];
+	return backlinkRows(field, String(enriched[schema.primaryKey] ?? ""), Object.values(source.byId)).map((row) => projectBacklinkRow(row, field.display, source.schema.primaryKey));
+}
 /** Project the computed (never-stored) field kinds onto one derived
 *  record: `toggle` → boolean off its enum, `embed` → the target record
-*  (fixed `id` or per-record `idField`), or null when missing. */
+*  (fixed `id` or per-record `idField`), or null when missing,
+*  `backlinks` → the matching source rows (see `projectBacklinks`). */
 function projectComputed(schema, enriched, linked) {
 	for (const [key, field] of Object.entries(schema.fields)) {
 		if (field.type === "toggle" && field.field) enriched[key] = String(enriched[field.field] ?? "") === field.onValue;
@@ -1379,6 +1713,7 @@ function projectComputed(schema, enriched, linked) {
 			const targetId = embedTargetId(field, enriched);
 			enriched[key] = targetId && linked[field.to]?.byId[targetId] || null;
 		}
+		if (field.type === "backlinks") enriched[key] = projectBacklinks(field, schema, enriched, linked);
 	}
 	return enriched;
 }
@@ -1915,6 +2250,6 @@ async function deleteCustomView(collection, viewId, opts = {}) {
 	};
 }
 //#endregion
-export { listItems as A, isContainedInRoot as B, COMPUTED_TYPES as C, buildCollectionActionSeedPrompt as D, buildActionSeedPrompt as E, readSkillTemplate as F, safeRecordId as G, itemFilePath as H, resolveCreateItemId as I, configureCollectionHost as J, safeSlugName as K, writeItem as L, readCustomViewHtml as M, readCustomViewI18n as N, deleteItem as O, readItem as P, setCollectionChangePublisher as Q, writeFileAtomic as R, toSummary as S, validateRecordObject as T, resolveDataDir as U, isContainedInWorkspace as V, resolveTemplatePath as W, log as X, getWorkspaceRoot as Y, publishCollectionChange as Z, CollectionSchemaZ as _, computeSuccessor as a, loadCollection as b, isTriggerDue as c, resolveEvery as d, successorId as f, enrichItems as g, computeCollectionIcon as h, advanceTriggerDate as i, promptPathsFor as j, generateItemId as k, maybeSpawnSuccessor as l, errorMessage as m, deleteCollection as n, daysInMonth as o, ONE_SECOND_MS as p, collectionsRegistriesConfigPath as q, deleteCollectionRefusalMessage as r, formatCivil as s, deleteCustomView as t, parseCivil as u, acceptParsedSchema as v, validateCollectionRecords as w, toDetail as x, discoverCollections as y, SCHEMA_FILE as z };
+export { getWorkspaceRoot as $, buildCollectionActionSeedPrompt as A, resolveCreateItemId as B, toSummary as C, compileRecordZ as D, validateRecordObject as E, promptPathsFor as F, isContainedInWorkspace as G, writeFileAtomic as H, readCustomViewHtml as I, resolveTemplatePath as J, itemFilePath as K, readCustomViewI18n as L, generateItemId as M, isRegularFile as N, recordFieldProblem as O, listItems as P, configureCollectionHost as Q, readItem as R, toDetail as S, validateCollectionRecords as T, SCHEMA_FILE as U, writeItem as V, isContainedInRoot as W, safeSlugName as X, safeRecordId as Y, collectionsRegistriesConfigPath as Z, buildWorkspaceOntology as _, computeSuccessor as a, discoverCollections as b, isTriggerDue as c, resolveEvery as d, log as et, successorId as f, enrichItems as g, computeCollectionIcon as h, advanceTriggerDate as i, deleteItem as j, buildActionSeedPrompt as k, maybeSpawnSuccessor as l, errorMessage as m, deleteCollection as n, setCollectionChangePublisher as nt, daysInMonth as o, ONE_SECOND_MS as p, resolveDataDir as q, deleteCollectionRefusalMessage as r, formatCivil as s, deleteCustomView as t, publishCollectionChange as tt, parseCivil as u, schemaRelations as v, CollectionSchemaZ as w, loadCollection as x, acceptParsedSchema as y, readSkillTemplate as z };
 
-//# sourceMappingURL=server-DKXXFTbw.js.map
+//# sourceMappingURL=server-BNTR7ySK.js.map