@mulmoclaude/core 0.18.1 → 0.19.0

package/dist/{server-Cd6HA_3-.cjs → server-Bh-DPK-H.cjs}

@@ -1,6 +1,7 @@
 const require_rolldown_runtime = require("./rolldown-runtime-D6vf50IK.cjs");
-const require_calendarGrid = require("./calendarGrid-CRaMAguM.cjs");
+const require_promptSafety = require("./promptSafety-DN5V__Ku.cjs");
 const require_collection_paths = require("./collection/paths.cjs");
+const require_skill_bridge_index = require("./skill-bridge/index.cjs");
 let node_path = require("node:path");
 node_path = require_rolldown_runtime.__toESM(node_path, 1);
 let node_fs = require("node:fs");
@@ -62,7 +63,7 @@ function collectionsRegistriesConfigPath() {
 	const host = requireHost();
 	return host.paths.collectionsRegistriesConfig(host.workspaceRoot);
 }
-function isPresetSlug(slug) {
+function isPresetSlug$1(slug) {
 	return requireHost().isPresetSlug(slug);
 }
 /** Logger proxy so engine modules can `import { log }` and use it exactly like
@@ -79,7 +80,7 @@ var log = {
 };
 //#endregion
 //#region src/collection/server/paths.ts
-var SCHEMA_FILE = "schema.json";
+var SCHEMA_FILE$1 = "schema.json";
 /** Sanitise a user-supplied slug into a safe directory-name leaf.
 *  Returns null for anything that fails the slug whitelist OR isn't a
 *  basename (i.e. survives `path.basename` round-trip unchanged).
@@ -87,7 +88,7 @@ var SCHEMA_FILE = "schema.json";
 *  `js/path-injection` sanitiser. */
 function safeSlugName(slug) {
 	if (typeof slug !== "string") return null;
-	if (!require_calendarGrid.SAFE_SLUG_PATTERN.test(slug)) return null;
+	if (!require_promptSafety.SAFE_SLUG_PATTERN.test(slug)) return null;
 	const basename = node_path.default.basename(slug);
 	if (basename !== slug) return null;
 	return basename;
@@ -99,7 +100,7 @@ function safeSlugName(slug) {
 *  `js/path-injection` sanitiser CodeQL recognises on `safeSlugName`. */
 function safeRecordId(recordId) {
 	if (typeof recordId !== "string") return null;
-	if (!require_calendarGrid.SAFE_RECORD_ID_PATTERN.test(recordId)) return null;
+	if (!require_promptSafety.SAFE_RECORD_ID_PATTERN.test(recordId)) return null;
 	if (recordId.includes("..")) return null;
 	const basename = node_path.default.basename(recordId);
 	if (basename !== recordId) return null;
@@ -658,10 +659,10 @@ function enforcedProblem(key, spec, value) {
 function strictTypeProblem(key, spec, value) {
 	switch (spec.type) {
 		case "number":
-		case "money": return Number.isFinite(require_calendarGrid.coerceNumeric(value)) ? null : `'${key}' = '${String(value)}' is not numeric (a '${spec.type}' field stores a plain number)`;
+		case "money": return Number.isFinite(require_promptSafety.coerceNumeric(value)) ? null : `'${key}' = '${String(value)}' is not numeric (a '${spec.type}' field stores a plain number)`;
 		case "boolean": return value === true || value === false ? null : `'${key}' = '${String(value)}' is not a boolean (store true or false, unquoted)`;
-		case "date": return require_calendarGrid.parseIsoDate(value) !== null ? null : `'${key}' = '${String(value)}' is not a real YYYY-MM-DD date`;
-		case "datetime": return require_calendarGrid.parseIsoDateTime(value) !== null ? null : `'${key}' = '${String(value)}' is not a YYYY-MM-DDTHH:MM datetime (seconds optional, no timezone suffix — the shape the calendar parses)`;
+		case "date": return require_promptSafety.parseIsoDate(value) !== null ? null : `'${key}' = '${String(value)}' is not a real YYYY-MM-DD date`;
+		case "datetime": return require_promptSafety.parseIsoDateTime(value) !== null ? null : `'${key}' = '${String(value)}' is not a YYYY-MM-DDTHH:MM datetime (seconds optional, no timezone suffix — the shape the calendar parses)`;
 		default: return null;
 	}
 }
@@ -706,7 +707,7 @@ var compiled = /* @__PURE__ */ new WeakMap();
 function compileRecordZ(schema, tier) {
 	const cached = compiled.get(schema)?.[tier];
 	if (cached) return cached;
-	const stored = Object.entries(schema.fields).filter(([, spec]) => !require_calendarGrid.COMPUTED_TYPES.has(spec.type));
+	const stored = Object.entries(schema.fields).filter(([, spec]) => !require_promptSafety.COMPUTED_TYPES.has(spec.type));
 	const validator = zod.z.looseObject({}).superRefine((record, ctx) => {
 		for (const [key, spec] of stored) {
 			const problem = recordFieldProblem(key, spec, record[key], tier);
@@ -872,14 +873,14 @@ async function applyMutateAction(collection, action, itemId, params, opts = {})
 		status: "not-found",
 		problem: `item '${itemId}' not found`
 	};
-	if (!require_calendarGrid.actionVisible(action, existing)) return {
+	if (!require_promptSafety.actionVisible(action, existing)) return {
 		ok: false,
 		status: "require-unmet",
 		problem: `action '${action.id}' is not available for item '${itemId}' in its current state`
 	};
 	const stored = Object.entries(existing).filter(([key]) => {
 		const spec = collection.schema.fields[key];
-		return !spec || !require_calendarGrid.COMPUTED_TYPES.has(spec.type);
+		return !spec || !require_promptSafety.COMPUTED_TYPES.has(spec.type);
 	});
 	const merged = {
 		...Object.fromEntries(stored),
@@ -972,7 +973,7 @@ var RefFieldZ = zod.z.object({
 	type: zod.z.literal("ref"),
 	...fieldBase,
 	to: zod.z.string().min(1)
-}).refine((spec) => require_calendarGrid.isSafeSlug(spec.to), slugMessage("to"));
+}).refine((spec) => require_promptSafety.isSafeSlug(spec.to), slugMessage("to"));
 /** A money amount. See `currencyKeys` for the currency-source contract. */
 var MoneyFieldZ = zod.z.object({
 	type: zod.z.literal("money"),
@@ -1007,7 +1008,7 @@ var SubRefFieldZ = zod.z.object({
 	type: zod.z.literal("ref"),
 	...subFieldBase,
 	to: zod.z.string().min(1)
-}).refine((spec) => require_calendarGrid.isSafeSlug(spec.to), slugMessage("to"));
+}).refine((spec) => require_promptSafety.isSafeSlug(spec.to), slugMessage("to"));
 var SubMoneyFieldZ = zod.z.object({
 	type: zod.z.literal("money"),
 	...subFieldBase,
@@ -1070,7 +1071,7 @@ var EmbedFieldZ = zod.z.object({
 	to: zod.z.string().min(1),
 	id: zod.z.string().trim().min(1).optional(),
 	idField: zod.z.string().trim().min(1).optional()
-}).refine((spec) => require_calendarGrid.isSafeSlug(spec.to) && spec.id !== void 0 !== (spec.idField !== void 0), {
+}).refine((spec) => require_promptSafety.isSafeSlug(spec.to) && spec.id !== void 0 !== (spec.idField !== void 0), {
 	message: "fields with type 'embed' must declare a `to` (valid collection slug) and exactly one of `id` (a fixed record's primary key) or `idField` (a sibling field naming the per-record target)",
 	path: ["id"]
 });
@@ -1091,7 +1092,7 @@ var BacklinksFieldZ = zod.z.object({
 	via: zod.z.string().trim().min(1),
 	display: zod.z.array(zod.z.string().trim().min(1)).min(1),
 	filter: WhenZ.optional()
-}).refine((spec) => require_calendarGrid.isSafeSlug(spec.from), slugMessage("from"));
+}).refine((spec) => require_promptSafety.isSafeSlug(spec.from), slugMessage("from"));
 /** A cross-collection AGGREGATE over a backlink relation (plan step ⑤ of
 *  plans/done/collection-ontology.md): a computed number — never stored — that
 *  sums a source column (or counts rows) over the records in `from` whose
@@ -1112,7 +1113,7 @@ var RollupFieldZ = zod.z.object({
 	op: zod.z.enum(["sum", "count"]),
 	column: zod.z.string().trim().min(1).optional(),
 	filter: WhenZ.optional()
-}).refine((spec) => require_calendarGrid.isSafeSlug(spec.from), slugMessage("from")).refine((spec) => spec.op === "sum" === (spec.column !== void 0), {
+}).refine((spec) => require_promptSafety.isSafeSlug(spec.from), slugMessage("from")).refine((spec) => spec.op === "sum" === (spec.column !== void 0), {
 	message: "a rollup's `column` names the source column to aggregate: required for op \"sum\", meaningless for op \"count\"",
 	path: ["column"]
 });
@@ -1261,9 +1262,9 @@ var SpawnZ = zod.z.object({
 *  array) only when the response body isn't itself the array; rss/atom yield
 *  items natively and ignore it — so no kind-specific requirement here. */
 var DeclarativeIngestZ = zod.z.object({
-	kind: zod.z.enum(require_calendarGrid.INGEST_KINDS),
+	kind: zod.z.enum(require_promptSafety.INGEST_KINDS),
 	url: zod.z.string().url(),
-	schedule: zod.z.enum(require_calendarGrid.FEED_SCHEDULES),
+	schedule: zod.z.enum(require_promptSafety.FEED_SCHEDULES),
 	atHour: zod.z.number().int().min(0).max(23).optional(),
 	itemsAt: zod.z.string().trim().min(1).optional(),
 	map: zod.z.record(zod.z.string().trim().min(1), zod.z.string().trim().min(1)),
@@ -1277,8 +1278,8 @@ var DeclarativeIngestZ = zod.z.object({
 *  validated the SAME way an action's template is (safe path under
 *  `templates/`), so the skill-bridge mirrors it identically. */
 var AgentIngestZ = zod.z.object({
-	kind: zod.z.literal(require_calendarGrid.AGENT_INGEST_KIND),
-	schedule: zod.z.enum(require_calendarGrid.FEED_SCHEDULES),
+	kind: zod.z.literal(require_promptSafety.AGENT_INGEST_KIND),
+	schedule: zod.z.enum(require_promptSafety.FEED_SCHEDULES),
 	atHour: zod.z.number().int().min(0).max(23).optional(),
 	role: zod.z.string().trim().min(1),
 	template: zod.z.string().trim().min(1).refine(require_collection_paths.isSafeActionTemplatePath, "must be a safe path under `templates/` (e.g. `templates/refresh.md`; no `..`, no leading `/`, no backslash)")
@@ -1424,7 +1425,7 @@ var CollectionSchemaZ = zod.z.object({
 	notifyWhen: WhenZ.optional(),
 	ingest: IngestZ.optional(),
 	dynamicIcon: DynamicIconSpecZ.optional()
-}).refine((schema) => schema.singleton === void 0 || require_calendarGrid.isSafeRecordId(schema.singleton), {
+}).refine((schema) => schema.singleton === void 0 || require_promptSafety.isSafeRecordId(schema.singleton), {
 	message: "schema `singleton` must be a valid item id (alphanumeric / hyphen / underscore / interior dot, no `..` or path separators)",
 	path: ["singleton"]
 }).refine((schema) => schema.actions === void 0 || new Set(schema.actions.map((action) => action.id)).size === schema.actions.length, {
@@ -1435,7 +1436,7 @@ var CollectionSchemaZ = zod.z.object({
 	path: ["collectionActions"]
 }).refine((schema) => (schema.actions ?? []).every((action) => action.kind !== "mutate" || Object.keys(action.set).every((key) => {
 	const target = schema.fields[key];
-	return target !== void 0 && !require_calendarGrid.COMPUTED_TYPES.has(target.type) && key !== schema.primaryKey;
+	return target !== void 0 && !require_promptSafety.COMPUTED_TYPES.has(target.type) && key !== schema.primaryKey;
 })), {
 	message: "a mutate action's `set` keys must name declared, non-computed fields (and never the primaryKey)",
 	path: ["actions"]
@@ -1530,7 +1531,7 @@ var CollectionSchemaZ = zod.z.object({
 }).refine((schema) => schema.notifyWhen === void 0 || schema.fields[schema.notifyWhen.field] !== void 0, {
 	message: "schema `notifyWhen.field` must name a top-level field declared in `fields`",
 	path: ["notifyWhen"]
-}).refine((schema) => schema.views === void 0 || schema.views.every((view) => require_calendarGrid.isSafeSlug(view.id)), {
+}).refine((schema) => schema.views === void 0 || schema.views.every((view) => require_promptSafety.isSafeSlug(view.id)), {
 	message: "every `views[].id` must be a valid slug (alphanumeric / hyphen / underscore, no path separators)",
 	path: ["views"]
 }).refine((schema) => schema.views === void 0 || new Set(schema.views.map((view) => view.id)).size === schema.views.length, {
@@ -1591,7 +1592,7 @@ function acceptParsedSchema(schema, opts) {
 async function loadOneCollection(skillsRoot, slug, source, workspaceRoot) {
 	const safeName = safeSlugName(slug);
 	if (safeName === null) return null;
-	const schemaPath = node_path.default.join(skillsRoot, safeName, SCHEMA_FILE);
+	const schemaPath = node_path.default.join(skillsRoot, safeName, SCHEMA_FILE$1);
 	let raw;
 	try {
 		if (!(await (0, node_fs_promises.stat)(schemaPath)).isFile()) return null;
@@ -1824,7 +1825,7 @@ async function loadTarget(slug, opts) {
 	const byId = {};
 	for (const item of items) {
 		const itemId = item[target.schema.primaryKey];
-		if (typeof itemId === "string" && itemId.length > 0) byId[itemId] = require_calendarGrid.deriveAll(target.schema, item, {});
+		if (typeof itemId === "string" && itemId.length > 0) byId[itemId] = require_promptSafety.deriveAll(target.schema, item, {});
 	}
 	return {
 		schema: target.schema,
@@ -1860,7 +1861,7 @@ function toRefRecords(linked) {
 function projectBacklinks(field, schema, enriched, linked) {
 	const source = linked[field.from];
 	if (!source) return [];
-	return require_calendarGrid.backlinkRows(field, String(enriched[schema.primaryKey] ?? ""), Object.values(source.byId)).map((row) => require_calendarGrid.projectBacklinkRow(row, field.display, source.schema.primaryKey));
+	return require_promptSafety.backlinkRows(field, String(enriched[schema.primaryKey] ?? ""), Object.values(source.byId)).map((row) => require_promptSafety.projectBacklinkRow(row, field.display, source.schema.primaryKey));
 }
 /** Project the computed (never-stored) field kinds onto one derived
 *  record: `toggle` → boolean off its enum, `embed` → the target record
@@ -1870,7 +1871,7 @@ function projectComputed(schema, enriched, linked) {
 	for (const [key, field] of Object.entries(schema.fields)) {
 		if (field.type === "toggle" && field.field) enriched[key] = String(enriched[field.field] ?? "") === field.onValue;
 		if (field.type === "embed" && field.to) {
-			const targetId = require_calendarGrid.embedTargetId(field, enriched);
+			const targetId = require_promptSafety.embedTargetId(field, enriched);
 			enriched[key] = targetId && linked[field.to]?.byId[targetId] || null;
 		}
 		if (field.type === "backlinks") enriched[key] = projectBacklinks(field, schema, enriched, linked);
@@ -1891,7 +1892,7 @@ function projectRollups(schema, record, linked) {
 		if (out === record) out = { ...record };
 		const source = linked[field.from];
 		const selfId = String(record[schema.primaryKey] ?? "");
-		out[key] = source ? require_calendarGrid.rollupValue(field, selfId, Object.values(source.byId)) : null;
+		out[key] = source ? require_promptSafety.rollupValue(field, selfId, Object.values(source.byId)) : null;
 	}
 	return out;
 }
@@ -1903,7 +1904,7 @@ async function enrichItems(collection, items, opts = {}) {
 	const { schema } = collection;
 	const linked = await loadLinkedTargets(schema, opts);
 	const refRecords = toRefRecords(linked);
-	return items.map((item) => projectComputed(schema, require_calendarGrid.deriveAll(schema, projectRollups(schema, item, linked), refRecords), linked));
+	return items.map((item) => projectComputed(schema, require_promptSafety.deriveAll(schema, projectRollups(schema, item, linked), refRecords), linked));
 }
 //#endregion
 //#region src/collection/server/dynamicIcon.ts
@@ -1939,9 +1940,9 @@ async function computeCollectionIcon(collection, opts = {}) {
 		const source = await loadCollection(spec.source.collection, opts);
 		if (!source) return spec.fallback ?? schema.icon;
 		const ordered = sortByPrimaryKey(await listItems(source.dataDir, { workspaceRoot: opts.workspaceRoot }), source.schema.primaryKey);
-		const orderBy = spec.source.orderBy ?? require_calendarGrid.firstDateField(source.schema);
+		const orderBy = spec.source.orderBy ?? require_promptSafety.firstDateField(source.schema);
 		const recordsById = buildRecordsById(ordered, source.schema.primaryKey);
-		return require_calendarGrid.resolveIcon(require_calendarGrid.selectDynamicRecord(ordered, spec.source, orderBy, recordsById), spec, schema.icon, recordsById);
+		return require_promptSafety.resolveIcon(require_promptSafety.selectDynamicRecord(ordered, spec.source, orderBy, recordsById), spec, schema.icon, recordsById);
 	} catch (err) {
 		log.warn("collections", "dynamic icon compute failed, falling back", {
 			slug: collection.slug,
@@ -2075,7 +2076,7 @@ function matchesWhen(when, schema, item) {
 *  Discovery rejects a map that doesn't cover the enum's values, so null
 *  here means a record that predates a map/enum edit. */
 function resolveEvery(every, sourceItem) {
-	if (!require_calendarGrid.isFieldDrivenEvery(every)) return every;
+	if (!require_promptSafety.isFieldDrivenEvery(every)) return every;
 	const raw = sourceItem[every.fromField];
 	if (raw === void 0 || raw === null || raw === "") return null;
 	return every.map[String(raw)] ?? null;
@@ -2115,7 +2116,7 @@ function logSpawnSkip(slug, triggerField, every, sourceItem, sourceId) {
 		});
 		return;
 	}
-	const fromField = require_calendarGrid.isFieldDrivenEvery(every) ? every.fromField : void 0;
+	const fromField = require_promptSafety.isFieldDrivenEvery(every) ? every.fromField : void 0;
 	log.warn("collections", "spawn skipped: no `every` mapping for frequency value", {
 		slug,
 		sourceId,
@@ -2302,7 +2303,7 @@ async function deleteCollection(collection, opts = {}) {
 		kind: "user-scope",
 		slug
 	};
-	if (isPresetSlug(slug)) return {
+	if (isPresetSlug$1(slug)) return {
 		kind: "preset",
 		slug
 	};
@@ -2368,9 +2369,9 @@ async function canonicalBase(collection, workspaceRoot, safeSlug) {
 *  project collection (no staging mirror) doesn't have an empty staging tree
 *  materialised by a side effect of the delete. */
 async function schemaWriteTargets(collection, workspaceRoot, safeSlug) {
-	const active = node_path.default.join(collection.skillDir, SCHEMA_FILE);
+	const active = node_path.default.join(collection.skillDir, SCHEMA_FILE$1);
 	if (collection.source !== "project") return [active];
-	const stagingSchema = node_path.default.join(skillsStagingDir(workspaceRoot), safeSlug, SCHEMA_FILE);
+	const stagingSchema = node_path.default.join(skillsStagingDir(workspaceRoot), safeSlug, SCHEMA_FILE$1);
 	const targets = [];
 	if (await fileExists(stagingSchema)) targets.push(stagingSchema);
 	targets.push(active);
@@ -2391,7 +2392,7 @@ async function unlinkIfPresent(target) {
 *  preserved verbatim. */
 async function removeViewFromSchemas(collection, viewId, workspaceRoot, safeSlug) {
 	const base = await canonicalBase(collection, workspaceRoot, safeSlug);
-	const canonical = node_path.default.join(base, SCHEMA_FILE);
+	const canonical = node_path.default.join(base, SCHEMA_FILE$1);
 	const parsed = JSON.parse(await (0, node_fs_promises.readFile)(canonical, "utf-8"));
 	if (Array.isArray(parsed.views)) parsed.views = parsed.views.filter((entry) => entry?.id !== viewId);
 	const serialized = `${JSON.stringify(parsed, null, 2)}\n`;
@@ -2402,7 +2403,7 @@ async function removeViewFromSchemas(collection, viewId, workspaceRoot, safeSlug
 *  refused (read-only / re-seeded on boot), consistent with `deleteCollection`. */
 async function deleteCustomView(collection, viewId, opts = {}) {
 	if (collection.source === "user") return { kind: "user-scope" };
-	if (isPresetSlug(collection.slug)) return { kind: "preset" };
+	if (isPresetSlug$1(collection.slug)) return { kind: "preset" };
 	const safeSlug = safeSlugName(collection.slug);
 	if (safeSlug === null) return {
 		kind: "unsafe-path",
@@ -2427,6 +2428,391 @@ async function deleteCustomView(collection, viewId, opts = {}) {
 		viewId
 	};
 }
+/** True for a launcher-managed preset slug (`mc-<something>`). The sync logic uses
+*  this to bound which active skills it may refresh/prune, so user-authored skills are
+*  never touched. */
+function isPresetSlug(slug) {
+	return slug.startsWith("mc-") && slug.length > 3;
+}
+//#endregion
+//#region src/collection/server/manageTool.ts
+/** Refuse an unselective getItems beyond this many records — a silent
+*  truncation would read as "covered everything", and an unbounded dump
+*  of a large collection is a token bomb. `ids` or `fields` lifts it. */
+var MAX_UNSELECTIVE_ITEMS = 200;
+/** schema.json basename under a skill dir (canonical staging + active mirror). */
+var SCHEMA_FILE = "schema.json";
+/** The collection-authoring reference, served by the `schemaDocs` action. */
+var SCHEMA_DOCS_FILE = "collection-skills.md";
+/** Cap the rejected-schema issue list so a deeply-broken schema can't flood the result. */
+var MAX_SCHEMA_ISSUES = 20;
+/** The workspace help-docs dir both hosts seed (`@mulmoclaude/core/workspace-setup`
+*  syncs the bundled assets here) — the user-editable copy schemaDocs prefers. */
+var HELPS_DIR = "config/helps";
+/** Resolve the workspace root the same way every collections call does:
+*  the injected override (tests) or the configured collection host. */
+function resolveBase(deps) {
+	return deps.workspaceRoot ?? getWorkspaceRoot();
+}
+/** Shared "unknown collection" message — its schema.json is missing or
+*  failed validation, so discovery skipped it. */
+function unknownCollection(slug) {
+	return `manageCollection: unknown collection '${require_promptSafety.defangForPrompt(slug)}' — its schema.json is missing or failed validation.`;
+}
+function optionalStringArray(value, name) {
+	if (value === void 0) return { ok: true };
+	if (!Array.isArray(value) || !value.every((entry) => typeof entry === "string" && entry.length > 0)) return {
+		ok: false,
+		error: `manageCollection: \`${name}\` must be an array of non-empty strings when present.`
+	};
+	return {
+		ok: true,
+		value
+	};
+}
+/** Project a record down to the requested fields. The primary key is
+*  always kept so every returned record stays addressable for a
+*  follow-up getItems/putItems. */
+function projectFields(record, fields, primaryKey) {
+	const keys = fields.includes(primaryKey) ? fields : [primaryKey, ...fields];
+	return Object.fromEntries(keys.filter((key) => key in record).map((key) => [key, record[key]]));
+}
+/** The validation warning appended to a getItems result when stored
+*  record files are malformed (they're silently skipped at read time,
+*  so without this they'd just look missing). Issue strings quote
+*  record-controlled text → defanged, mirroring the presentCollection
+*  dispatch. The record VALUES in `items` ride verbatim, like a raw
+*  file Read — only host-composed report strings are defanged. */
+async function recordIssuesWarning(collection, deps) {
+	if (deps.ablateValidation) return void 0;
+	const issues = await validateCollectionRecords(collection, { workspaceRoot: deps.workspaceRoot });
+	if (issues.length === 0) return void 0;
+	const lines = issues.map((issue) => `- ${require_promptSafety.defangForPrompt(issue.file)}: ${require_promptSafety.defangForPrompt(issue.problem)}`).join("\n");
+	return `${issues.length} record file(s) have data problems and are missing from this result. Fix each (Read → correct → Write):\n${lines}`;
+}
+async function loadRequestedItems(collection, ids, deps) {
+	if (!ids) return {
+		items: await listItems(collection.dataDir, { workspaceRoot: deps.workspaceRoot }),
+		missing: []
+	};
+	const items = [];
+	const missing = [];
+	for (const recordId of ids) {
+		const item = await readItem(collection.dataDir, recordId, { workspaceRoot: deps.workspaceRoot }).catch(() => null);
+		if (item) items.push(item);
+		else missing.push(recordId);
+	}
+	return {
+		items,
+		missing
+	};
+}
+async function handleGetItems(collection, args, deps) {
+	const { items, missing } = await loadRequestedItems(collection, args.ids, deps);
+	if (!args.ids && !args.fields && items.length > 200) return `manageCollection: refused — '${collection.slug}' has ${items.length} records, over the unselective limit of 200. Pass \`ids\` for specific records or \`fields\` to project only the columns you need.`;
+	const enriched = await enrichItems(collection, items, deps);
+	const projected = args.fields ? enriched.map((item) => projectFields(item, args.fields, collection.schema.primaryKey)) : enriched;
+	const warning = !args.ids || missing.length > 0 ? await recordIssuesWarning(collection, deps) : void 0;
+	return JSON.stringify({
+		collection: collection.slug,
+		count: projected.length,
+		items: projected,
+		...missing.length > 0 ? { missing: missing.map((recordId) => require_promptSafety.defangForPrompt(recordId)) } : {},
+		...warning ? { warning } : {}
+	});
+}
+/** Reject writes that set host-computed keys, with a pointer at the
+*  writable source of truth (the toggle's enum) where one exists. */
+function computedKeyProblem(record, schema) {
+	for (const key of Object.keys(record)) {
+		const spec = schema.fields[key];
+		if (!spec || !require_promptSafety.COMPUTED_TYPES.has(spec.type)) continue;
+		if (spec.type === "toggle" && spec.field) return `'${key}' is a toggle projection — write the enum field '${spec.field}' instead`;
+		return `'${key}' is ${{
+			derived: "derived",
+			embed: "an embed",
+			backlinks: "a backlinks view",
+			rollup: "a rollup"
+		}[spec.type] ?? "computed"} — computed by the host, remove it from the record`;
+	}
+	return null;
+}
+/** `mode: "merge"` resolves the row against the EXISTING record —
+*  a partial row updates just the fields it carries, instead of a
+*  whole-record upsert silently erasing the optional fields it omits
+*  (an upsert of `{id, status}` would pass validation yet drop
+*  `notes`/`lesson`/…). Merge is a partial UPDATE by definition, so a
+*  missing record is a reject, not an implicit create — a merged-over-
+*  nothing partial record is exactly the data shape this mode exists
+*  to prevent.
+*
+*  Computed keys found in the STORED record are stripped before the
+*  merge: the caller's own row was already computed-key-rejected, but a
+*  raw-written / legacy record can carry a stale `derived`/`embed`/
+*  `toggle` value, and re-writing it would perpetuate a forged
+*  host-computed value. A merge heals the record instead.
+*
+*  readItem THROWS on a malformed stored file (only ENOENT is null) —
+*  downgraded to a per-row rejection here, like loadRequestedItems'
+*  `missing`, so one broken file can't abort the whole putItems batch. */
+async function mergeWithExisting(collection, record, itemId, deps) {
+	let existing;
+	try {
+		existing = await readItem(collection.dataDir, itemId, { workspaceRoot: deps.workspaceRoot });
+	} catch {
+		return `'${itemId}' has a malformed stored file — mode "merge" needs to read it; fix the file (Read → correct → Write) or replace it whole with "upsert"`;
+	}
+	if (!existing) return `'${itemId}' not found — mode "merge" updates an existing record; use "upsert" or "create" to add it`;
+	const stored = Object.entries(existing).filter(([key]) => {
+		const spec = collection.schema.fields[key];
+		return !spec || !require_promptSafety.COMPUTED_TYPES.has(spec.type);
+	});
+	return {
+		...Object.fromEntries(stored),
+		...record
+	};
+}
+async function putOneItem(collection, record, mode, deps) {
+	const { schema } = collection;
+	const itemId = resolveCreateItemId(schema, record);
+	const reject = (about, problem) => ({ rejected: {
+		id: require_promptSafety.defangForPrompt(about),
+		problem: require_promptSafety.defangForPrompt(problem)
+	} });
+	if (itemId === null) return reject("(no id)", `record has no '${schema.primaryKey}' value — set it (it doubles as the filename)`);
+	const computed = computedKeyProblem(record, schema);
+	if (computed) return reject(itemId, computed);
+	let toWrite = record;
+	if (mode === "merge") {
+		const merged = await mergeWithExisting(collection, record, itemId, deps);
+		if (typeof merged === "string") return reject(itemId, merged);
+		toWrite = merged;
+	}
+	if (!deps.ablateValidation) {
+		const invalid = validateRecordObject(toWrite, itemId, schema);
+		if (invalid) return reject(itemId, invalid);
+	}
+	const result = await writeItem(collection.dataDir, itemId, toWrite, {
+		refuseOverwrite: mode === "create",
+		workspaceRoot: deps.workspaceRoot,
+		slug: collection.slug
+	});
+	if (result.kind === "ok") return { written: result.itemId };
+	if (result.kind === "invalid-id") return reject(itemId, `'${itemId}' is not a valid record id (letters/digits at the ends; -, _, or . inside; no '..' or path characters)`);
+	if (result.kind === "conflict") return reject(itemId, `'${itemId}' already exists — mode "create" refuses overwrite; use "upsert" to update it`);
+	return reject(itemId, "write refused: the collection's data dir escapes the workspace");
+}
+async function handlePutItems(collection, args, deps) {
+	const written = [];
+	const rejected = [];
+	for (const record of args.items) {
+		const outcome = await putOneItem(collection, record, args.mode, deps);
+		if (outcome.written) written.push(outcome.written);
+		if (outcome.rejected) rejected.push(outcome.rejected);
+	}
+	return JSON.stringify({
+		collection: collection.slug,
+		written,
+		rejected
+	});
+}
+function parsePutItems(args, slug) {
+	const { items, mode } = args;
+	if (!(Array.isArray(items) && items.length > 0 && items.every((entry) => Boolean(entry) && typeof entry === "object" && !Array.isArray(entry)))) return "manageCollection: `items` is required for putItems — a non-empty array of record objects.";
+	if (mode !== void 0 && mode !== "upsert" && mode !== "create" && mode !== "merge") return "manageCollection: `mode` must be \"upsert\" (default), \"create\", or \"merge\".";
+	return {
+		slug,
+		items,
+		mode: mode ?? "upsert"
+	};
+}
+/** The machine-readable workspace ontology: every collection with its
+*  identity, record count, and outbound `ref`/`embed` relations. Slugs
+*  are discovery-sanitized; titles/labels are workspace-authored schema
+*  text and ride verbatim — the same trust class as the record values
+*  getItems returns. */
+async function handleGetOntology(deps) {
+	const collections = await buildWorkspaceOntology(deps);
+	return JSON.stringify({
+		count: collections.length,
+		collections
+	});
+}
+/** Return the collection-authoring reference (`collection-skills.md`).
+*  Workspace copy first (reflects user edits), bundled asset as the
+*  always-present fallback. Both reads guarded; if neither resolves the
+*  agent still gets an actionable message instead of a thrown call. */
+async function handleSchemaDocs(deps) {
+	const candidates = [node_path.default.join(resolveBase(deps), HELPS_DIR, SCHEMA_DOCS_FILE), ...deps.bundledHelpsDir ? [node_path.default.join(deps.bundledHelpsDir(), SCHEMA_DOCS_FILE)] : []];
+	for (const candidate of candidates) try {
+		return await (0, node_fs_promises.readFile)(candidate, "utf-8");
+	} catch {}
+	return `manageCollection: could not read the collection-authoring reference (${SCHEMA_DOCS_FILE}).`;
+}
+/** Return the raw schema.json of an existing collection, for editing.
+*  Staging (the canonical writable copy) first, the active mirror as a
+*  fallback for user-scope skills that have no staging copy. Raw text —
+*  not the parsed schema — so the agent edits the true on-disk source. */
+async function handleGetSchema(slug, deps) {
+	const collection = await loadCollection(slug, deps);
+	if (!collection) return unknownCollection(slug);
+	const candidates = [node_path.default.join(require_skill_bridge_index.dataSkillDir(resolveBase(deps), collection.slug), SCHEMA_FILE), node_path.default.join(collection.skillDir, SCHEMA_FILE)];
+	for (const candidate of candidates) try {
+		return await (0, node_fs_promises.readFile)(candidate, "utf-8");
+	} catch {}
+	return `manageCollection: '${require_promptSafety.defangForPrompt(slug)}' has no readable ${SCHEMA_FILE}.`;
+}
+/** Refuse a schema edit the host can't honour: user-scope/feed collections
+*  are read-only, and presets (mc-*) re-seed on restart so an edit is lost. */
+function schemaEditRefusal(collection, slug) {
+	if (collection.source !== "project") return `manageCollection: '${require_promptSafety.defangForPrompt(slug)}' is ${collection.source}-scope and read-only here — only project collections (data/skills/) can be edited.`;
+	if (isPresetSlug(slug)) return `manageCollection: '${require_promptSafety.defangForPrompt(slug)}' is a preset (mc-*) and re-seeds on restart — copy it under a different slug to customise.`;
+	return null;
+}
+/** Turn a CollectionSchemaZ failure into a short, actionable list the
+*  agent can fix, pointing back at the field reference. */
+function formatSchemaIssues(issues) {
+	const shown = issues.slice(0, 20);
+	const lines = shown.map((issue) => `- ${issue.path.map(String).join(".") || "(root)"}: ${require_promptSafety.defangForPrompt(issue.message)}`).join("\n");
+	const omitted = issues.length - shown.length;
+	return `manageCollection: schema rejected — fix and retry (call schemaDocs for the field reference):\n${lines}${omitted > 0 ? `\n- …and ${omitted} more issue(s); fix these first and retry.` : ""}`;
+}
+/** Write the validated schema to the canonical staging copy, then mirror
+*  it into the active `.claude/skills/` tree discovery reads — an internal
+*  write doesn't fire the skill-bridge hook, so we mirror explicitly. */
+async function writeAndMirrorSchema(slug, schema, deps) {
+	const base = resolveBase(deps);
+	await writeFileAtomic(node_path.default.join(require_skill_bridge_index.dataSkillDir(base, slug), SCHEMA_FILE), `${JSON.stringify(schema, null, 2)}\n`);
+	require_skill_bridge_index.mirrorSkillWrite(base, {
+		slug,
+		relSegments: [SCHEMA_FILE]
+	});
+	try {
+		await deps.refreshAfterWrite?.();
+	} catch {}
+}
+/** The post-Zod acceptance gates discovery applies before a parsed schema
+*  becomes a live collection. Mirrors discovery's checks (`loadOneCollection`)
+*  so a write can't pass here yet be silently skipped on the next load.
+*  putSchema only runs for project-scope collections, so the feed-`ingest`
+*  gate doesn't apply. Returns a one-line reason, or null when the schema
+*  would be accepted. */
+function schemaDiscoveryGate(schema, base) {
+	const primaryField = schema.fields[schema.primaryKey];
+	if (!primaryField) return `primaryKey '${schema.primaryKey}' is not one of the declared fields`;
+	if (primaryField.primary !== true) return `the primaryKey field '${schema.primaryKey}' must be flagged \`primary: true\``;
+	if (resolveDataDir(schema.dataPath, base) === null) return `dataPath '${schema.dataPath}' escapes the workspace`;
+	return null;
+}
+/** Validate a schema against CollectionSchemaZ and, on success, persist it.
+*  Edit-only: a new collection is created by writing SKILL.md + schema.json
+*  under data/skills/<slug>/ (the normal create flow), not through here. */
+async function handlePutSchema(slug, schemaArg, deps) {
+	if (!schemaArg || typeof schemaArg !== "object" || Array.isArray(schemaArg)) return "manageCollection: `schema` is required for putSchema — the full collection schema object.";
+	const collection = await loadCollection(slug, deps);
+	if (!collection) return `manageCollection: unknown collection '${require_promptSafety.defangForPrompt(slug)}' — create it by writing SKILL.md + ${SCHEMA_FILE} under data/skills/${require_promptSafety.defangForPrompt(slug)}/, then edit it here.`;
+	const refusal = schemaEditRefusal(collection, slug);
+	if (refusal) return refusal;
+	const parsed = CollectionSchemaZ.safeParse(schemaArg);
+	if (!parsed.success) return formatSchemaIssues(parsed.error.issues);
+	const gate = schemaDiscoveryGate(parsed.data, resolveBase(deps));
+	if (gate) return `manageCollection: schema rejected — ${gate} (call schemaDocs for the field reference). It passes basic validation but discovery would skip it, hiding the collection.`;
+	await writeAndMirrorSchema(collection.slug, parsed.data, deps);
+	return JSON.stringify({
+		collection: collection.slug,
+		written: true
+	});
+}
+var MANAGE_COLLECTION_PROMPT = "Use `manageCollection` instead of raw Read/Write/Edit when working with a collection's records OR its schema (raw file I/O stays available as the escape hatch). Before authoring or changing a collection's `schema.json`, call `schemaDocs` to load the field/DSL reference, then read with `getSchema` and write with `putSchema` — `putSchema` validates the whole schema before writing and returns actionable errors instead of silently failing discovery's validation. `getItems` is the only way to see computed values — `derived` fields (e.g. a portfolio's value), `toggle` projections, and `embed` records are host-computed and never present in the stored JSON files. On large collections pass `ids` and/or `fields` to keep the result small. For a question that spans collections (\"which clients have unpaid invoices?\"), start with `getOntology`: it lists every collection with its primaryKey, record count, and outbound `ref`/`embed` relations, so you know which collections to join before reading any records. `putItems` validates every row against the schema before writing (required fields, enum values, primaryKey = record id) and returns `{ written, rejected }`; fix each rejected row using its `problem` text and retry just those rows. Never include computed fields in a row you write. To update a few fields of an existing record, use `mode: \"merge\"` with a partial row ({ id, <changed fields> }) — the default upsert replaces the WHOLE record, so a partial upsert would silently erase every optional field it omits.";
+/** Validate getItems' optional `ids`/`fields` args, then delegate. */
+async function dispatchGetItems(collection, args, deps) {
+	const ids = optionalStringArray(args.ids, "ids");
+	if (!ids.ok) return ids.error;
+	const fields = optionalStringArray(args.fields, "fields");
+	if (!fields.ok) return fields.error;
+	return handleGetItems(collection, {
+		slug: collection.slug,
+		ids: ids.value,
+		fields: fields.value
+	}, deps);
+}
+async function manageCollectionHandler(deps, args) {
+	const action = typeof args.action === "string" ? args.action : "";
+	if (action === "schemaDocs") return handleSchemaDocs(deps);
+	if (action === "getOntology") return handleGetOntology(deps);
+	const slug = typeof args.slug === "string" ? args.slug.trim() : "";
+	if (!slug) return "manageCollection: `slug` is required (the collection's slug).";
+	if (action === "getSchema") return handleGetSchema(slug, deps);
+	if (action === "putSchema") return handlePutSchema(slug, args.schema, deps);
+	if (action !== "getItems" && action !== "putItems") return "manageCollection: `action` must be \"getItems\", \"putItems\", \"getOntology\", \"schemaDocs\", \"getSchema\", or \"putSchema\".";
+	const collection = await loadCollection(slug, deps);
+	if (!collection) return unknownCollection(slug);
+	if (action === "getItems") return dispatchGetItems(collection, args, deps);
+	const parsed = parsePutItems(args, slug);
+	if (typeof parsed === "string") return parsed;
+	return handlePutItems(collection, parsed, deps);
+}
+function makeManageCollectionTool(deps = {}) {
+	return {
+		definition: {
+			name: "manageCollection",
+			description: "Read and write a schema-driven collection through the host — both its records and its structure. getItems returns records WITH computed values (derived formulas, toggles, embeds) the stored JSON files don't contain; putItems validates each row against the schema before writing. getOntology maps the whole workspace: every collection with its record count and outbound ref/embed relations — call it first for cross-collection questions. schemaDocs returns the collection-authoring reference; getSchema/putSchema read and validate-then-write the collection's schema.json. Prefer it over raw file I/O on collections.",
+			inputSchema: {
+				type: "object",
+				properties: {
+					action: {
+						type: "string",
+						enum: [
+							"getItems",
+							"putItems",
+							"getOntology",
+							"schemaDocs",
+							"getSchema",
+							"putSchema"
+						],
+						description: "What to do."
+					},
+					slug: {
+						type: "string",
+						description: "The collection's slug (its directory name, e.g. `stock-quotes`). Required for everything except schemaDocs and getOntology."
+					},
+					ids: {
+						type: "array",
+						items: { type: "string" },
+						description: "getItems: only these record ids (primary-key values). Omit for all records."
+					},
+					fields: {
+						type: "array",
+						items: { type: "string" },
+						description: "getItems: only these fields per record (the primary key is always included). Omit for all fields. Use on large collections."
+					},
+					items: {
+						type: "array",
+						items: { type: "object" },
+						description: "putItems: the record objects to store. Each must carry the schema's primaryKey value (it doubles as the filename)."
+					},
+					mode: {
+						type: "string",
+						enum: [
+							"upsert",
+							"create",
+							"merge"
+						],
+						description: "putItems: \"upsert\" (default) replaces existing records WHOLE; \"create\" rejects rows whose id already exists; \"merge\" updates only the fields a row carries, keeping the rest of the existing record (rejects unknown ids). Use \"merge\" when changing a few fields."
+					},
+					schema: {
+						type: "object",
+						description: "putSchema: the full collection schema object (same shape as schema.json — title, icon, dataPath, primaryKey, fields, …). Call getSchema first for the current one, and schemaDocs for the field DSL."
+					}
+				},
+				required: ["action"]
+			}
+		},
+		alwaysActive: true,
+		prompt: MANAGE_COLLECTION_PROMPT,
+		handler: (args) => manageCollectionHandler(deps, args)
+	};
+}
 //#endregion
 Object.defineProperty(exports, "CollectionSchemaZ", {
 	enumerable: true,
@@ -2434,6 +2820,18 @@ Object.defineProperty(exports, "CollectionSchemaZ", {
 		return CollectionSchemaZ;
 	}
 });
+Object.defineProperty(exports, "MAX_SCHEMA_ISSUES", {
+	enumerable: true,
+	get: function() {
+		return MAX_SCHEMA_ISSUES;
+	}
+});
+Object.defineProperty(exports, "MAX_UNSELECTIVE_ITEMS", {
+	enumerable: true,
+	get: function() {
+		return MAX_UNSELECTIVE_ITEMS;
+	}
+});
 Object.defineProperty(exports, "ONE_SECOND_MS", {
 	enumerable: true,
 	get: function() {
@@ -2443,7 +2841,7 @@ Object.defineProperty(exports, "ONE_SECOND_MS", {
 Object.defineProperty(exports, "SCHEMA_FILE", {
 	enumerable: true,
 	get: function() {
-		return SCHEMA_FILE;
+		return SCHEMA_FILE$1;
 	}
 });
 Object.defineProperty(exports, "acceptParsedSchema", {
@@ -2632,6 +3030,12 @@ Object.defineProperty(exports, "log", {
 		return log;
 	}
 });
+Object.defineProperty(exports, "makeManageCollectionTool", {
+	enumerable: true,
+	get: function() {
+		return makeManageCollectionTool;
+	}
+});
 Object.defineProperty(exports, "maybeSpawnSuccessor", {
 	enumerable: true,
 	get: function() {
@@ -2777,4 +3181,4 @@ Object.defineProperty(exports, "writeItem", {
 	}
 });
 
-//# sourceMappingURL=server-Cd6HA_3-.cjs.map
+//# sourceMappingURL=server-Bh-DPK-H.cjs.map