@mulmoclaude/core 0.24.0 → 0.25.1

package/dist/server-BI3wnTwl.js

@@ -0,0 +1,1529 @@
+import { f as storageKindFor, l as embedTargetId, o as COMPUTED_TYPES, u as isFieldDrivenEvery } from "./ids-P2T89Gou.js";
+import { D as rollupValue, E as projectBacklinkRow, O as actionVisible, S as itemIsDone, T as coerceNumeric, b as resolveIcon, d as parseIsoDateTime, g as deriveAll, t as defangForPrompt, u as parseIsoDate, w as backlinkRows, x as selectDynamicRecord, y as firstDateField } from "./promptSafety-Boz5qOs-.js";
+import { $ as isPresetSlug$1, B as writeFileAtomic, C as compileJsonlQuery, G as resolveDataDir, H as isContainedInRoot, J as safeSlugName, K as resolveTemplatePath, Q as getWorkspaceRoot, R as resolveCreateItemId, V as SCHEMA_FILE$1, Y as archiveDir, b as normalizeCsvValue, d as checkpointSqliteDatabase, et as log, h as cacheDir, j as isRegularFile, l as readOnlyRefusal, n as discoverCollections, o as CollectionSchemaZ, r as loadCollection, rt as skillsStagingDir, s as resolveMutateSet, u as storeFor, w as CollectionQueryZ, x as queryCsv } from "./discovery-QUi_7aNG.js";
+import { dataSkillDir, mirrorSkillWrite } from "./skill-bridge/index.js";
+import path from "node:path";
+import { cp, lstat, mkdir, open, readFile, readdir, rm, rmdir, stat, unlink, writeFile } from "node:fs/promises";
+import { randomBytes, randomUUID } from "node:crypto";
+import { z } from "zod";
+//#region src/collection/server/jsonlQuery.ts
+/** SQL semantics for an aggregate-only query over ZERO rows: one scalar
+*  row (`count` = 0, everything else NULL) — the same shape the CSV path
+*  produces for a header-only file, so callers reading `rows[0]` never
+*  break on storage kind or emptiness. A grouped query over zero rows is
+*  zero groups (`[]`), also matching SQL. Synthesized here because DuckDB
+*  has no empty file to infer a schema from. */
+function emptyCollectionResult(query) {
+	if ((query.groupBy?.length ?? 0) > 0) return [];
+	const aggregates = Object.entries(query.aggregates ?? {});
+	return [Object.fromEntries(aggregates.map(([alias, aggregate]) => [alias, aggregate.op === "count" ? 0 : null]))];
+}
+/** The SOURCE columns a query reads: groupBy columns, aggregate input
+*  columns, and where fields. (orderBy resolves to groupBy columns or
+*  aggregate ALIASES — never to a new source column — so it adds none.) */
+function referencedSourceColumns(query) {
+	const columns = new Set(query.groupBy ?? []);
+	for (const aggregate of Object.values(query.aggregates ?? {})) if (aggregate.column !== void 0) columns.add(aggregate.column);
+	for (const cond of query.where ?? []) columns.add(cond.field);
+	return [...columns];
+}
+/** Referenced columns that appear in NO row — a freshly-added optional
+*  field, or a derived field whose inputs no record has yet. DuckDB only
+*  infers columns from keys that occur in the JSONL, so without help a
+*  valid query on such a field binder-errors here while the CSV path
+*  (whose header always declares the column) returns NULLs. Padding the
+*  FIRST line with `col: null` makes the column exist (full-scan
+*  inference unions keys across lines) with matching NULL semantics. */
+function absentReferencedColumns(rows, query) {
+	const present = /* @__PURE__ */ new Set();
+	for (const row of rows) for (const key of Object.keys(row)) present.add(key);
+	return referencedSourceColumns(query).filter((column) => !present.has(column));
+}
+/** Run a validated query over enriched collection rows. */
+async function runQueryOverRows(rows, query) {
+	if (rows.length === 0) return emptyCollectionResult(query);
+	await mkdir(cacheDir(), {
+		recursive: true,
+		mode: 448
+	});
+	const jsonlPath = path.join(cacheDir(), `q-${randomBytes(8).toString("hex")}.jsonl`);
+	try {
+		const nullPads = Object.fromEntries(absentReferencedColumns(rows, query).map((column) => [column, null]));
+		const handle = await open(jsonlPath, "wx", 384);
+		try {
+			let first = true;
+			for (const row of rows) {
+				await handle.write(`${JSON.stringify(first ? {
+					...nullPads,
+					...row
+				} : row)}\n`);
+				first = false;
+			}
+		} finally {
+			await handle.close();
+		}
+		const { sql, params } = compileJsonlQuery(query);
+		return (await queryCsv(sql, [jsonlPath, ...params])).map((row) => Object.fromEntries(Object.entries(row).map(([key, value]) => [key, normalizeCsvValue(value)])));
+	} finally {
+		await unlink(jsonlPath).catch((err) => {
+			if (err.code !== "ENOENT") log.warn("collections", "temp JSONL cleanup failed", {
+				path: jsonlPath,
+				error: String(err)
+			});
+		});
+	}
+}
+//#endregion
+//#region src/collection/server/derive.ts
+/** Slugs of every collection referenced by a `ref` field — top-level
+*  and one level into `table` sub-fields (nested tables are
+*  schema-rejected). Mirrors the client's `uniqueRefTargets`. */
+function uniqueRefTargets(schema) {
+	const targets = /* @__PURE__ */ new Set();
+	const walk = (fields) => {
+		for (const field of Object.values(fields)) {
+			if (field.type === "ref" && typeof field.to === "string" && field.to.length > 0) targets.add(field.to);
+			if (field.type === "table" && field.of) walk(field.of);
+		}
+	};
+	walk(schema.fields);
+	return [...targets];
+}
+/** Slugs of every collection referenced by an `embed` field (top-level
+*  only, like the client). */
+function uniqueEmbedTargets(schema) {
+	const targets = /* @__PURE__ */ new Set();
+	for (const field of Object.values(schema.fields)) if (field.type === "embed" && typeof field.to === "string" && field.to.length > 0) targets.add(field.to);
+	return [...targets];
+}
+/** Slugs of every SOURCE collection a `backlinks` or `rollup` field
+*  reverses over — loaded exactly like ref/embed targets (whole
+*  collection, once; the two field kinds share one load). */
+function uniqueBacklinkSources(schema) {
+	const sources = /* @__PURE__ */ new Set();
+	for (const field of Object.values(schema.fields)) if ((field.type === "backlinks" || field.type === "rollup") && field.from.length > 0) sources.add(field.from);
+	return [...sources];
+}
+async function loadTarget(slug, opts) {
+	const target = await loadCollection(slug, opts);
+	if (!target) return null;
+	const items = await storeFor(target, { workspaceRoot: opts.workspaceRoot }).list();
+	const byId = {};
+	for (const item of items) {
+		const itemId = item[target.schema.primaryKey];
+		if (typeof itemId === "string" && itemId.length > 0) byId[itemId] = deriveAll(target.schema, item, {});
+	}
+	return {
+		schema: target.schema,
+		byId
+	};
+}
+/** Load every ref/embed target and backlink source collection once.
+*  Unknown / unloadable targets are simply absent — downstream derefs
+*  resolve to null (em-dash) and backlinks to an empty row set, the
+*  same fail-soft the UI renders. */
+async function loadLinkedTargets(schema, opts) {
+	const slugs = [.../* @__PURE__ */ new Set([
+		...uniqueRefTargets(schema),
+		...uniqueEmbedTargets(schema),
+		...uniqueBacklinkSources(schema)
+	])];
+	const loaded = {};
+	for (const slug of slugs) {
+		const target = await loadTarget(slug, opts);
+		if (target) loaded[slug] = target;
+	}
+	return loaded;
+}
+function toRefRecords(linked) {
+	return Object.fromEntries(Object.entries(linked).map(([slug, target]) => [slug, target.byId]));
+}
+/** The matching source rows for one `backlinks` field, projected to the
+*  source primaryKey + `display` columns — so getItems on a
+*  heavily-referenced record stays a summary, not a dump of the source
+*  collection. Missing source ⇒ [] (fail-soft). The rows come from the
+*  DERIVED source records (`byId`), so `display`/`filter` on a derived
+*  source column (an invoice `total`) works. */
+function projectBacklinks(field, schema, enriched, linked) {
+	const source = linked[field.from];
+	if (!source) return [];
+	return backlinkRows(field, String(enriched[schema.primaryKey] ?? ""), Object.values(source.byId)).map((row) => projectBacklinkRow(row, field.display, source.schema.primaryKey));
+}
+/** Project the computed (never-stored) field kinds onto one derived
+*  record: `toggle` → boolean off its enum, `embed` → the target record
+*  (fixed `id` or per-record `idField`), or null when missing,
+*  `backlinks` → the matching source rows (see `projectBacklinks`). */
+function projectComputed(schema, enriched, linked) {
+	for (const [key, field] of Object.entries(schema.fields)) {
+		if (field.type === "toggle" && field.field) enriched[key] = String(enriched[field.field] ?? "") === field.onValue;
+		if (field.type === "embed" && field.to) {
+			const targetId = embedTargetId(field, enriched);
+			enriched[key] = targetId && linked[field.to]?.byId[targetId] || null;
+		}
+		if (field.type === "backlinks") enriched[key] = projectBacklinks(field, schema, enriched, linked);
+	}
+	return enriched;
+}
+/** Resolve every rollup field onto a COPY of the record, BEFORE the
+*  formula pass — a `derived` formula may reference rollup values as
+*  plain identifiers (`played = homePlayed + awayPlayed`). Same reverse
+*  machinery as backlinks, collapsed to a number: an unresolvable source
+*  is null (a formula reading it fails soft to em-dash); an empty match
+*  set is a real 0. Returns `record` unchanged when the schema declares
+*  no rollups. */
+function projectRollups(schema, record, linked) {
+	let out = record;
+	for (const [key, field] of Object.entries(schema.fields)) {
+		if (field.type !== "rollup") continue;
+		if (out === record) out = { ...record };
+		const source = linked[field.from];
+		const selfId = String(record[schema.primaryKey] ?? "");
+		out[key] = source ? rollupValue(field, selfId, Object.values(source.byId)) : null;
+	}
+	return out;
+}
+/** Enrich records with every host-computed field: derived formulas
+*  evaluated (cross-collection derefs included), toggles projected,
+*  embeds resolved. Loads each linked collection ONCE per call. Input
+*  records are not mutated. */
+async function enrichItems(collection, items, opts = {}) {
+	const { schema } = collection;
+	const linked = await loadLinkedTargets(schema, opts);
+	const refRecords = toRefRecords(linked);
+	return items.map((item) => projectComputed(schema, deriveAll(schema, projectRollups(schema, item, linked), refRecords), linked));
+}
+//#endregion
+//#region src/collection/server/queryRunner.ts
+async function runCollectionQuery(collection, query, opts = {}) {
+	const store = storeFor(collection, { workspaceRoot: opts.workspaceRoot });
+	if (store.query) return store.query(query);
+	return runQueryOverRows(await enrichItems(collection, await store.list(), opts), query);
+}
+//#endregion
+//#region src/collection/core/recordZ.ts
+/** The emptiness rule shared by `required` and the "only check present
+*  values" gate. NOT a truthiness check — `0` and `false` are filled. */
+var isEmptyValue = (value) => value === void 0 || value === null || value === "";
+/** The historical write-gate checks, verbatim: required non-empty, enum
+*  membership (compared as strings, so a numeric `5` satisfies `"5"`). */
+function enforcedProblem(key, spec, value) {
+	const empty = isEmptyValue(value);
+	if (spec.required && empty) return `missing required field '${key}'`;
+	if (!empty && spec.type === "enum" && !spec.values.includes(String(value))) return `'${key}' = '${String(value)}' is not one of [${spec.values.join(", ")}]`;
+	return null;
+}
+/** Report-only per-type checks on a PRESENT value. Date / datetime reuse the
+*  calendar's STRICT civil parsers (`parseIsoDate` / `parseIsoDateTime`), so
+*  the lint flags exactly the values the calendar / trigger / spawn code
+*  would silently drop — impossible days like `2026-02-30`, and datetimes
+*  outside the canonical `YYYY-MM-DDTHH:MM[:SS]` shape (e.g. a `Z` suffix,
+*  which the day view can't place). `string`-backed types accept anything
+*  stringifiable; `ref` existence is out of scope. */
+function strictTypeProblem(key, spec, value) {
+	switch (spec.type) {
+		case "number":
+		case "money": return Number.isFinite(coerceNumeric(value)) ? null : `'${key}' = '${String(value)}' is not numeric (a '${spec.type}' field stores a plain number)`;
+		case "boolean": return value === true || value === false ? null : `'${key}' = '${String(value)}' is not a boolean (store true or false, unquoted)`;
+		case "date": return parseIsoDate(value) !== null ? null : `'${key}' = '${String(value)}' is not a real YYYY-MM-DD date`;
+		case "datetime": return parseIsoDateTime(value) !== null ? null : `'${key}' = '${String(value)}' is not a YYYY-MM-DDTHH:MM datetime (seconds optional, no timezone suffix — the shape the calendar parses)`;
+		default: return null;
+	}
+}
+/** Strict check for a PRESENT `table` value: an array of row objects, each
+*  row conforming to the sub-schema (required / enum / typed sub-values).
+*  First row problem wins, prefixed with the row number so the fix is
+*  locatable. */
+function strictTableProblem(key, spec, value) {
+	if (!Array.isArray(value)) return `'${key}' = '${String(value)}' is not an array of rows (a 'table' field stores an array of row objects)`;
+	for (let index = 0; index < value.length; index++) {
+		const row = value[index];
+		if (!row || typeof row !== "object" || Array.isArray(row)) return `'${key}' row ${index + 1} is not an object`;
+		for (const [subKey, subSpec] of Object.entries(spec.of)) {
+			const subValue = row[subKey];
+			const problem = enforcedProblem(subKey, subSpec, subValue) ?? (isEmptyValue(subValue) ? null : strictTypeProblem(subKey, subSpec, subValue));
+			if (problem) return `'${key}' row ${index + 1}: ${problem}`;
+		}
+	}
+	return null;
+}
+/** First problem for one field's stored value under `tier`, or null.
+*  Enforced checks always run (and their messages never vary by tier — the
+*  scan and the write gate must agree on them); strict adds the per-type
+*  layer on present values only. */
+function recordFieldProblem(key, spec, value, tier) {
+	const enforced = enforcedProblem(key, spec, value);
+	if (enforced || tier === "enforced") return enforced;
+	if (isEmptyValue(value)) return null;
+	if (spec.type === "table") return strictTableProblem(key, spec, value);
+	return strictTypeProblem(key, spec, value);
+}
+var compiled = /* @__PURE__ */ new WeakMap();
+/** Compile `schema.fields` into a zod validator for a stored record.
+*  Loose object: unknown keys are allowed and any declared key may be
+*  absent (records are user files, not parse-and-rewrite targets —
+*  callers validate, they never persist the parse output). The checks run
+*  as ONE object-level refine iterating fields in declaration order —
+*  per-key shape schemas can't express "key may be absent BUT its absence
+*  must still reach the required check", and the single loop keeps the
+*  first reported issue identical to the historical first-problem-wins
+*  contract. */
+function compileRecordZ(schema, tier) {
+	const cached = compiled.get(schema)?.[tier];
+	if (cached) return cached;
+	const stored = Object.entries(schema.fields).filter(([, spec]) => !COMPUTED_TYPES.has(spec.type));
+	const validator = z.looseObject({}).superRefine((record, ctx) => {
+		for (const [key, spec] of stored) {
+			const problem = recordFieldProblem(key, spec, record[key], tier);
+			if (problem) ctx.addIssue({
+				code: "custom",
+				message: problem,
+				path: [key]
+			});
+		}
+	});
+	const entry = compiled.get(schema) ?? {};
+	entry[tier] = validator;
+	compiled.set(schema, entry);
+	return validator;
+}
+/** First schema problem on an in-memory record under `tier`, or null. One
+*  issue per record keeps the report short and the fix obvious (the
+*  historical contract of `validateRecordObject`). */
+function firstRecordProblem(record, schema, tier) {
+	const result = compileRecordZ(schema, tier).safeParse(record);
+	if (result.success) return null;
+	return result.error.issues[0]?.message ?? "record failed schema validation";
+}
+//#endregion
+//#region src/collection/server/validate.ts
+var MAX_ISSUES = 25;
+/** Read every `<id>.json` under the collection's dataDir and report the
+*  ones that won't load or violate the schema. An empty list means every
+*  record is fine. */
+/** List entries under the data dir, guarding realpath containment (against a
+*  symlinked dir swapped in after discovery, like `listItems`) and treating a
+*  missing dir as empty while surfacing real I/O faults. */
+async function listRecordFilenames(dataDir, workspaceRoot) {
+	if (!isContainedInRoot(dataDir, workspaceRoot)) {
+		log.warn("collections", "validate refused: dataDir escapes workspace via symlink", { dataDir });
+		return [];
+	}
+	try {
+		return await readdir(dataDir);
+	} catch (err) {
+		if (err.code === "ENOENT") return [];
+		throw err;
+	}
+}
+async function validateCollectionRecords(collection, opts = {}) {
+	if (collection.schema.dataSource !== void 0) return [];
+	if (collection.schema.storage !== void 0) return validateStoreRecords(collection, opts);
+	const workspaceRoot = opts.workspaceRoot ?? getWorkspaceRoot();
+	const entries = await listRecordFilenames(collection.dataDir, workspaceRoot);
+	const issues = [];
+	for (const name of entries.sort()) {
+		if (!name.endsWith(".json") || name.startsWith(".")) continue;
+		if (issues.length >= MAX_ISSUES) break;
+		const issue = await inspectRecord(path.join(collection.dataDir, name), name, collection.schema);
+		if (issue) issues.push(issue);
+	}
+	return issues;
+}
+/** Store-backed twin of the file scan: list every record through the
+*  collection's store and lint it with the same "strict" report-only tier.
+*  A row the store can't even parse is invisible here (the store skips
+*  it), so the read/parse classifications of the file scan don't apply —
+*  schema violations are what this catches. `file` carries the record id
+*  (there is no per-record filename). */
+async function validateStoreRecords(collection, opts) {
+	let items;
+	try {
+		items = await storeFor(collection, { workspaceRoot: opts.workspaceRoot }).list();
+	} catch (err) {
+		return [{
+			file: "(store)",
+			problem: `records could not be read from the storage backend: ${err instanceof Error ? err.message : String(err)}`
+		}];
+	}
+	const issues = [];
+	for (const item of items) {
+		if (issues.length >= MAX_ISSUES) break;
+		const itemId = String(item[collection.schema.primaryKey] ?? "");
+		const problem = validateRecordObject(item, itemId, collection.schema, "strict");
+		if (problem) issues.push({
+			file: itemId,
+			problem
+		});
+	}
+	return issues;
+}
+async function readRecordText(fullPath, name) {
+	try {
+		if (!(await lstat(fullPath)).isFile()) return {
+			file: name,
+			problem: "not a regular file (symlink?) — skipped, won't appear"
+		};
+		return { raw: await readFile(fullPath, "utf-8") };
+	} catch {
+		return {
+			file: name,
+			problem: "could not be read — skipped, won't appear"
+		};
+	}
+}
+/** Classify a single record file: unreadable / unparseable / non-object /
+*  schema violation, or null when it's fine. */
+async function inspectRecord(fullPath, name, schema) {
+	const read = await readRecordText(fullPath, name);
+	if ("problem" in read) return read;
+	let parsed;
+	try {
+		parsed = JSON.parse(read.raw);
+	} catch (err) {
+		return {
+			file: name,
+			problem: `invalid JSON (${err instanceof Error ? err.message : String(err)}) — SKIPPED, won't appear. Usual cause: an unescaped " inside a string value; use 「」/『』 or write \\" instead.`
+		};
+	}
+	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {
+		file: name,
+		problem: "not a JSON object — skipped, won't appear"
+	};
+	const problem = validateRecordObject(parsed, name.replace(/\.json$/, ""), schema, "strict");
+	return problem ? {
+		file: name,
+		problem
+	} : null;
+}
+/** First schema problem on an in-memory record (primaryKey↔id mismatch,
+*  then the compiled per-field checks — see `../core/recordZ` for the two
+*  tiers), or null when it's fine. One issue per record keeps the report
+*  short and the fix obvious. Pure + exported so write paths
+*  (manageCollection putItems) can gate on the SAME enforced rules the
+*  post-hoc file scan reports — `itemId` is the id the record is (or
+*  would be) stored under. The default `"enforced"` tier keeps every
+*  write gate on the historical three checks; only pass `"strict"` from
+*  report-only surfaces. */
+function validateRecordObject(record, itemId, schema, tier = "enforced") {
+	const idValue = record[schema.primaryKey];
+	if (typeof idValue !== "string" || idValue !== itemId) return `'${schema.primaryKey}' is '${String(idValue ?? "")}' but must equal the filename ('${itemId}'), or the record can't be opened`;
+	return firstRecordProblem(record, schema, tier);
+}
+//#endregion
+//#region src/collection/server/mutate.ts
+/** First problem with the submitted params, or null. Every declared param
+*  is checked by the shared record-field validator; keys the action never
+*  declared are rejected outright — a stray key would otherwise ride the
+*  resolved `set` semantics silently. */
+function firstMutateParamProblem(action, params) {
+	const declared = action.params ?? {};
+	for (const key of Object.keys(params)) if (declared[key] === void 0) return `unknown param '${key}' — not declared by action '${action.id}'`;
+	for (const [key, spec] of Object.entries(declared)) {
+		const problem = recordFieldProblem(key, spec, params[key], "strict");
+		if (problem) return problem;
+	}
+	return null;
+}
+/** Apply one mutate action to one record. Never throws for data-shaped
+*  failures — the outcome's `problem` doubles as agent feedback when an
+*  LLM (not the user) pressed the button. */
+async function applyMutateAction(collection, action, itemId, params, opts = {}) {
+	const paramProblem = firstMutateParamProblem(action, params);
+	if (paramProblem) return {
+		ok: false,
+		status: "invalid-params",
+		problem: paramProblem
+	};
+	const store = storeFor(collection, opts);
+	if (!store.write) return {
+		ok: false,
+		status: "write-refused",
+		problem: "write refused (read-only collection)"
+	};
+	const existing = await store.read(itemId);
+	if (!existing) return {
+		ok: false,
+		status: "not-found",
+		problem: `item '${itemId}' not found`
+	};
+	if (!actionVisible(action, existing)) return {
+		ok: false,
+		status: "require-unmet",
+		problem: `action '${action.id}' is not available for item '${itemId}' in its current state`
+	};
+	const stored = Object.entries(existing).filter(([key]) => {
+		const spec = collection.schema.fields[key];
+		return !spec || !COMPUTED_TYPES.has(spec.type);
+	});
+	const merged = {
+		...Object.fromEntries(stored),
+		...resolveMutateSet(action.set, params)
+	};
+	const invalid = validateRecordObject(merged, itemId, collection.schema);
+	if (invalid) return {
+		ok: false,
+		status: "invalid-record",
+		problem: invalid
+	};
+	const result = await store.write(itemId, merged);
+	if (result.kind !== "ok") return {
+		ok: false,
+		status: "write-refused",
+		problem: `write refused (${result.kind})`
+	};
+	return {
+		ok: true,
+		item: merged
+	};
+}
+//#endregion
+//#region src/collection/server/ontology.ts
+/** Extract the relations a schema declares, in field declaration order:
+*  top-level `ref` / `embed` / `backlinks` fields plus `ref` sub-fields
+*  inside `table` columns. Pure — exported so the phase-2 graph panel
+*  can reuse it on already-loaded schemas. */
+function schemaRelations(schema) {
+	const relations = [];
+	for (const [key, spec] of Object.entries(schema.fields)) {
+		if (spec.type === "ref" || spec.type === "embed") relations.push({
+			field: key,
+			kind: spec.type,
+			to: spec.to
+		});
+		if (spec.type === "backlinks" || spec.type === "rollup") relations.push({
+			field: key,
+			kind: spec.type,
+			to: spec.from
+		});
+		if (spec.type !== "table") continue;
+		for (const [subKey, subSpec] of Object.entries(spec.of)) if (subSpec.type === "ref") relations.push({
+			field: `${key}.${subKey}`,
+			kind: "ref",
+			to: subSpec.to
+		});
+	}
+	return relations;
+}
+/** Count the record files in a collection's data dir — the same
+*  `<id>.json` entries `listItems` considers, WITHOUT parsing them (the
+*  ontology is a summary; a malformed record is still a record). Each
+*  candidate is classified by the SHARED `isRegularFile` lstat helper —
+*  the exact file-disclosure defense `listItems` applies — so a
+*  symlinked record never counts and the count can't diverge from the
+*  readable set on any filesystem (Codex review on PR #2099, twice).
+*  Fail-soft: a missing dir or a dataDir escaping the workspace via
+*  symlink counts 0. */
+async function countRecordFiles(dataDir, workspaceRoot) {
+	if (!isContainedInRoot(dataDir, workspaceRoot)) return 0;
+	try {
+		const names = (await readdir(dataDir)).filter((name) => name.endsWith(".json") && !name.startsWith("."));
+		return (await Promise.all(names.map((name) => isRegularFile(path.join(dataDir, name))))).filter(Boolean).length;
+	} catch {
+		return 0;
+	}
+}
+/** A collection's record count for the ontology. File-backed: the cheap
+*  readdir count. Every other backend (`dataSource` CSV, `storage`
+*  sqlite): the store's page total — the dataDir is a phantom there, so
+*  the readdir count would always misreport 0. Fail-soft to 0 like
+*  `countRecordFiles` (an unreadable file / missing engine must not
+*  break the whole ontology). */
+async function countRecords(collection, workspaceRoot) {
+	if (storageKindFor(collection.schema) !== "file") try {
+		return (await storeFor(collection, { workspaceRoot }).page({ limit: 0 })).total;
+	} catch {
+		return 0;
+	}
+	return countRecordFiles(collection.dataDir, workspaceRoot);
+}
+async function toOntologyEntry(collection, workspaceRoot) {
+	const { schema } = collection;
+	return {
+		slug: collection.slug,
+		title: schema.title,
+		icon: schema.icon,
+		primaryKey: schema.primaryKey,
+		displayField: schema.displayField ?? schema.primaryKey,
+		recordCount: await countRecords(collection, workspaceRoot),
+		relations: schemaRelations(schema)
+	};
+}
+/** Build the workspace ontology: every discovered collection (slug-sorted,
+*  discovery's order), each with its outbound relations and a
+*  readdir-cheap record count — fine to call on demand. */
+async function buildWorkspaceOntology(opts = {}) {
+	const workspaceRoot = opts.workspaceRoot ?? getWorkspaceRoot();
+	const collections = await discoverCollections(opts);
+	return Promise.all(collections.map((collection) => toOntologyEntry(collection, workspaceRoot)));
+}
+//#endregion
+//#region src/collection/server/dynamicIcon.ts
+/** Index `items` by their `primaryKey` value — the `recordsById` map a
+*  `valueFrom` reference (e.g. `_config.defaultCity`) resolves against.
+*  Items whose primary key isn't a string (shouldn't happen for a valid
+*  schema, but records are untyped storage) are skipped rather than
+*  coerced, so a broken key never silently shadows a real one. */
+function buildRecordsById(items, primaryKey) {
+	const entries = items.filter((item) => typeof item[primaryKey] === "string").map((item) => [String(item[primaryKey]), item]);
+	return Object.fromEntries(entries);
+}
+/** Order records by their `primaryKey` so record selection is deterministic:
+*  `listItems` returns filesystem `readdir` order (arbitrary across machines),
+*  which would let `from: "first"`, the no-`orderBy` `latest`, and `orderBy`
+*  ties pick a different record — and thus a different icon — between
+*  reconciles. A stable id sort pins one answer. */
+function sortByPrimaryKey(items, primaryKey) {
+	return [...items].sort((left, right) => String(left[primaryKey] ?? "").localeCompare(String(right[primaryKey] ?? "")));
+}
+/** Compute the effective launcher icon for `collection`: its static
+*  `schema.icon` when it declares no `dynamicIcon`, else the icon
+*  resolved from `dynamicIcon.source`'s RAW stored records (no
+*  derive/enrich — the icon rules match against stored values) via the
+*  pure resolver. Fails soft on any read/discovery error (missing source
+*  collection, filesystem error): falls back to `dynamicIcon.fallback ??
+*  schema.icon` rather than surfacing to the collections list. */
+async function computeCollectionIcon(collection, opts = {}) {
+	const { schema } = collection;
+	const spec = schema.dynamicIcon;
+	if (!spec) return schema.icon;
+	try {
+		const source = await loadCollection(spec.source.collection, opts);
+		if (!source) return spec.fallback ?? schema.icon;
+		const ordered = sortByPrimaryKey(await storeFor(source, { workspaceRoot: opts.workspaceRoot }).list(), source.schema.primaryKey);
+		const orderBy = spec.source.orderBy ?? firstDateField(source.schema);
+		const recordsById = buildRecordsById(ordered, source.schema.primaryKey);
+		return resolveIcon(selectDynamicRecord(ordered, spec.source, orderBy, recordsById), spec, schema.icon, recordsById);
+	} catch (err) {
+		log.warn("collections", "dynamic icon compute failed, falling back", {
+			slug: collection.slug,
+			source: spec.source.collection,
+			error: String(err)
+		});
+		return spec.fallback ?? schema.icon;
+	}
+}
+//#endregion
+//#region src/collection/server/util.ts
+/** Human-readable message from an unknown thrown value. */
+function errorMessage(err) {
+	return err instanceof Error ? err.message : String(err);
+}
+var ONE_SECOND_MS = 1e3;
+var ONE_DAY_MS = 1440 * 60 * 1e3;
+//#endregion
+//#region src/collection/server/spawn.ts
+var YMD_PATTERN = /^(\d{4})-(\d{2})-(\d{2})$/;
+function pad2(value) {
+	return String(value).padStart(2, "0");
+}
+function pad4(value) {
+	return String(value).padStart(4, "0");
+}
+/** Days in `month` (1-12) of `year`, leap-year-aware. `new Date(y, m, 0)`
+*  is day 0 of the *next* month = the last day of `month`; `.getDate()`
+*  reads the civil day regardless of timezone. */
+function daysInMonth(year, month) {
+	return new Date(year, month, 0).getDate();
+}
+/** Parse a `YYYY-MM-DD` string into a CivilDate, or null when the value
+*  isn't a well-formed in-range calendar date. */
+function parseCivil(raw) {
+	if (typeof raw !== "string") return null;
+	const match = YMD_PATTERN.exec(raw.trim());
+	if (!match) return null;
+	const year = Number(match[1]);
+	const month = Number(match[2]);
+	const day = Number(match[3]);
+	if (month < 1 || month > 12) return null;
+	if (day < 1 || day > daysInMonth(year, month)) return null;
+	return {
+		y: year,
+		m: month,
+		d: day
+	};
+}
+/** `YYYY-MM-DD` for storage in a `date` field. */
+function formatCivil(date) {
+	return `${pad4(date.y)}-${pad2(date.m)}-${pad2(date.d)}`;
+}
+/** A monotonic integer key for a civil date (YYYYMMDD), for ordering /
+*  equality without timezone concerns. */
+function ordinal(date) {
+	return date.y * 1e4 + date.m * 100 + date.d;
+}
+/** Add `n` whole days to a civil date. Uses UTC epoch arithmetic so it
+*  is DST-immune (we only ever read back the civil Y/M/D). */
+function addDays(date, days) {
+	const shifted = new Date(Date.UTC(date.y, date.m - 1, date.d) + days * ONE_DAY_MS);
+	return {
+		y: shifted.getUTCFullYear(),
+		m: shifted.getUTCMonth() + 1,
+		d: shifted.getUTCDate()
+	};
+}
+/** Advance a civil date by one `every` step. Month/year units preserve
+*  the rule's day-of-month anchor, clamped to the target month's length
+*  (no drift); day/week units do civil day arithmetic. */
+function advanceTriggerDate(source, every) {
+	const { unit, interval } = every;
+	if (unit === "day") return addDays(source, interval);
+	if (unit === "week") return addDays(source, interval * 7);
+	const monthsToAdd = interval * (unit === "year" ? 12 : 1);
+	const total = source.y * 12 + (source.m - 1) + monthsToAdd;
+	const nextYear = Math.floor(total / 12);
+	const nextMonth = total % 12 + 1;
+	const dim = daysInMonth(nextYear, nextMonth);
+	const anchor = every.dayOfMonth === "last" ? dim : every.dayOfMonth ?? source.d;
+	return {
+		y: nextYear,
+		m: nextMonth,
+		d: Math.min(anchor, dim)
+	};
+}
+/** True iff `now`'s civil date (local timezone) has reached the fire date
+*  for `triggerRaw` — i.e. the trigger date minus `leadDays` (so a 10-day
+*  lead fires 10 days early). Returns null when `triggerRaw` isn't a
+*  parseable date — callers treat that as "don't fire" and warn. */
+function isTriggerDue(triggerRaw, now, leadDays = 0) {
+	const due = parseCivil(triggerRaw);
+	if (due === null) return null;
+	const fireDate = leadDays > 0 ? addDays(due, -leadDays) : due;
+	return ordinal({
+		y: now.getFullYear(),
+		m: now.getMonth() + 1,
+		d: now.getDate()
+	}) >= ordinal(fireDate);
+}
+var DATE_SUFFIX_PATTERN = /-\d{8}$/;
+/** Deterministic successor id: `<stem>-<YYYYMMDD>`, where `<stem>` is the
+*  source id with a trailing `-YYYYMMDD` stripped if present. So a chain
+*  shares one stem and each instance is dated:
+*    `rent`           → `rent-20260610`
+*    `rent-20260610`  → `rent-20260710`
+*  Slug-safe (alphanumeric + hyphen) and a pure function of the inputs,
+*  which is what makes create-if-absent idempotent. */
+function successorId(sourceId, next) {
+	return `${sourceId.replace(DATE_SUFFIX_PATTERN, "")}-${pad4(next.y)}${pad2(next.m)}${pad2(next.d)}`;
+}
+/** True iff `item` satisfies the spawn predicate. With an explicit
+*  `when`, matches `String(item[when.field]) ∈ when.in`. Without one,
+*  defaults to the completion-done condition — the shared, flag-aware
+*  `itemIsDone` (core/completion; downhill import, so the module graph
+*  stays acyclic). */
+function matchesWhen(when, schema, item) {
+	if (when) {
+		const raw = item[when.field];
+		return raw !== void 0 && raw !== null && when.in.includes(String(raw));
+	}
+	return itemIsDone(schema, item);
+}
+/** Resolve the literal `every` that applies to `sourceItem`. Literal-arm
+*  `spawn.every` passes through unchanged. Field-driven `spawn.every` reads
+*  `sourceItem[fromField]` and looks it up in `map`; an empty field or a
+*  value with no map entry yields null (caller skips + logs — see plan §5).
+*  Discovery rejects a map that doesn't cover the enum's values, so null
+*  here means a record that predates a map/enum edit. */
+function resolveEvery(every, sourceItem) {
+	if (!isFieldDrivenEvery(every)) return every;
+	const raw = sourceItem[every.fromField];
+	if (raw === void 0 || raw === null || raw === "") return null;
+	return every.map[String(raw)] ?? null;
+}
+/** Build the successor record purely from (schema, source record, source
+*  id). Returns null when the schema has no spawn/triggerField or the
+*  source's trigger date is unparseable. */
+function computeSuccessor(schema, sourceItem, sourceId) {
+	const { spawn, triggerField } = schema;
+	if (!spawn || !triggerField) return null;
+	const srcDate = parseCivil(sourceItem[triggerField]);
+	if (srcDate === null) return null;
+	const every = resolveEvery(spawn.every, sourceItem);
+	if (every === null) return null;
+	const next = advanceTriggerDate(srcDate, every);
+	const nextId = successorId(sourceId, next);
+	const record = {};
+	for (const field of spawn.carry ?? []) if (Object.prototype.hasOwnProperty.call(sourceItem, field)) record[field] = sourceItem[field];
+	Object.assign(record, spawn.set ?? {});
+	record[triggerField] = formatCivil(next);
+	record[schema.primaryKey] = nextId;
+	return {
+		id: nextId,
+		record
+	};
+}
+/** Warn precisely about which of `computeSuccessor`'s two null causes fired
+*  (plan §5): an unparseable source trigger date (the original cause), or a
+*  field-driven `every` whose record value has no `map` entry (a record that
+*  predates a map/enum edit — discovery rejects this statically otherwise). */
+function logSpawnSkip(slug, triggerField, every, sourceItem, sourceId) {
+	if (parseCivil(sourceItem[triggerField]) === null) {
+		log.warn("collections", "spawn skipped: source trigger date unparseable", {
+			slug,
+			sourceId,
+			triggerField
+		});
+		return;
+	}
+	const fromField = isFieldDrivenEvery(every) ? every.fromField : void 0;
+	log.warn("collections", "spawn skipped: no `every` mapping for frequency value", {
+		slug,
+		sourceId,
+		fromField,
+		value: fromField === void 0 ? void 0 : sourceItem[fromField]
+	});
+}
+/** Idempotently create the successor for `sourceItem` when it matches the
+*  spawn predicate. No-op when the schema declares no spawn, the
+*  predicate doesn't match, the trigger date is unparseable, or the
+*  successor already exists (create-if-absent). Never overwrites an
+*  existing successor — protects any edits the user made to it. */
+async function maybeSpawnSuccessor(collection, sourceItem, sourceId, ioOpts = {}) {
+	const { slug, schema } = collection;
+	const { spawn } = schema;
+	if (!spawn || !schema.triggerField) return;
+	if (!matchesWhen(spawn.when, schema, sourceItem)) return;
+	const computed = computeSuccessor(schema, sourceItem, sourceId);
+	if (computed === null) {
+		logSpawnSkip(slug, schema.triggerField, spawn.every, sourceItem, sourceId);
+		return;
+	}
+	if (matchesWhen(spawn.when, schema, computed.record)) {
+		log.warn("collections", "spawn skipped: successor would be born matching its own predicate (unbounded respawn)", {
+			slug,
+			sourceId,
+			successorId: computed.id
+		});
+		return;
+	}
+	try {
+		const { write } = storeFor(collection, ioOpts);
+		if (!write) {
+			log.warn("collections", "spawn skipped: collection store is read-only", {
+				slug,
+				sourceId
+			});
+			return;
+		}
+		const result = await write(computed.id, computed.record, { refuseOverwrite: true });
+		if (result.kind === "ok") log.info("collections", "spawned successor", {
+			slug,
+			sourceId,
+			successorId: computed.id
+		});
+		else if (result.kind !== "conflict") log.warn("collections", "spawn write failed", {
+			slug,
+			sourceId,
+			successorId: computed.id,
+			kind: result.kind
+		});
+	} catch (err) {
+		log.warn("collections", "spawn write threw", {
+			slug,
+			sourceId,
+			successorId: computed.id,
+			error: errorMessage(err)
+		});
+	}
+}
+//#endregion
+//#region src/collection/server/delete.ts
+/** Human-readable reason for a non-`ok` delete result. Exported so the
+*  route maps `kind` → message without inlining the switch (keeps the
+*  handler short and the mapping unit-testable). The `Record` is
+*  exhaustive — a new refusal kind won't compile until it's added. */
+function deleteCollectionRefusalMessage(result) {
+	const { slug } = result;
+	return {
+		"user-scope": `collection '${slug}' is user-scope (~/.claude/skills/) and is read-only from MulmoClaude`,
+		preset: `collection '${slug}' is a preset (mc-*) and re-seeds on restart; unstar it from the catalog instead`,
+		"unsafe-data-path": `collection '${slug}' declares a dataPath outside its own data/${slug}/ subtree; refusing to delete`,
+		"path-escape": `a directory for collection '${slug}' escapes the workspace`
+	}[result.kind];
+}
+/** The canonical staging dir for a slug: `data/skills/<slug>`. */
+function stagingSkillDir(workspaceRoot, slug) {
+	return path.join(skillsStagingDir(workspaceRoot), slug);
+}
+async function pathExists(target) {
+	try {
+		await stat(target);
+		return true;
+	} catch {
+		return false;
+	}
+}
+/** UTC `YYYY-MM-DD` — keeps the archive folder human-sortable. */
+function todayStamp() {
+	return (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+}
+/** Every directory the delete will touch must resolve under the
+*  workspace root — guards against a symlinked ancestor escaping it. */
+function deleteTargets(collection, workspaceRoot) {
+	return [
+		stagingSkillDir(workspaceRoot, collection.slug),
+		collection.skillDir,
+		collection.dataDir,
+		...collection.storageFile !== void 0 ? [collection.storageFile] : []
+	];
+}
+/** The records directory the delete recursively archives + removes
+*  (`collection.dataDir`) must live in this collection's OWN per-slug
+*  subtree. `dataDir` is normally derived from `schema.dataPath`, but
+*  `deleteCollection` accepts a `LoadedCollection` whose fields could be
+*  inconsistent — so we validate the RESOLVED target the destructive ops
+*  actually touch, not the schema string. A shared root like `data` or
+*  `data/skills` would otherwise turn the recursive removal into a
+*  workspace-wide wipe whose archive captures only this collection.
+*  `path.resolve` collapses any `..` before the prefix test (symlink
+*  escapes are caught separately by the realpath containment check in
+*  `deleteTargets`).
+*
+*  TWO acceptable per-slug subtrees:
+*    - `data/<slug>/...` — the convention authored collections default to.
+*    - `data/collections/<slug>/...` — what `normalizedDataPath` in the
+*      registry-import path stamps onto every imported schema (so imported
+*      collections never collide with `data/<slug>/`-shaped authored ones).
+*  Both are equally per-collection and equally safe; a delete that targets
+*  anything else (e.g. raw `data/`, `data/wiki/`, a sibling slug) is
+*  refused. */
+function isDataDirSafe(dataDir, slug, workspaceRoot) {
+	const acceptableRoots = [path.resolve(workspaceRoot, "data", slug), path.resolve(workspaceRoot, "data", "collections", slug)];
+	const resolved = path.resolve(dataDir);
+	return acceptableRoots.some((root) => resolved === root || resolved.startsWith(root + path.sep));
+}
+/** Step 2 of the restore doc — how to bring the records back. A
+*  `dataSource` collection has no record files to copy (its rows live in
+*  the external data file, which the delete never touches). */
+function restoreRecordsStep(schema) {
+	if (schema.storage !== void 0) return `2. Records: copy the archived database file
+   \`${path.basename(schema.storage.path)}\` (next to this document) back to
+   \`${schema.storage.path}\` (workspace-relative, \`cp\`). It holds every
+   record. If \`-wal\`/\`-journal\` sidecar files were archived alongside
+   it, copy them back too.`;
+	if (schema.dataPath === void 0) return `2. Records: nothing to copy. This is a \`dataSource\` collection —
+   its records are the rows of \`${schema.dataSource?.path}\`, which the
+   delete never touched.`;
+	return `2. Copy the item data: \`cp\` every file under \`records/\` into
+   \`${schema.dataPath}/\`. The records are part of the collection and
+   must be restored. They are plain data files (NOT bridged), so use
+   \`cp\` — the Write-tool rule in step 1 applies ONLY to the skill
+   files, not to these records (there may be many; copy them, do not
+   Write them one by one).`;
+}
+function buildRestoreDoc(collection) {
+	const { slug, schema } = collection;
+	return `# Restore "${schema.title}" (collection \`${slug}\`)
+
+This folder is an automatic backup made when the collection was deleted.
+Follow these steps to restore it.
+
+1. Recreate the skill files in \`data/skills/${slug}/\` using the **Write
+   tool**: read each file under \`skill/\` and Write it to the matching
+   path — \`SKILL.md\`, \`schema.json\`, and any \`templates/*\`.
+
+   IMPORTANT — use the Write tool, NOT \`cp\` / \`mv\` / a shell redirect.
+   The skill-bridge hook mirrors \`data/skills/${slug}/\` into
+   \`.claude/skills/${slug}/\`, and that mirror is what actually registers
+   the collection. The hook only fires on Write/Edit tool calls, so a
+   \`cp\` would leave the files in staging with no \`.claude/skills/\`
+   mirror — the collection would stay invisible. (Writing
+   \`.claude/skills/\` directly is not an option either: that path is
+   permission-gated.)
+
+${restoreRecordsStep(schema)}
+
+3. Confirm the collection reappears at \`/collections/${slug}\`.
+
+- slug: \`${slug}\`
+- title: ${schema.title}
+- dataPath: \`${schema.dataPath ?? (schema.storage !== void 0 ? `(storage) ${schema.storage.path}` : `(dataSource) ${schema.dataSource?.path}`)}\`
+`;
+}
+/** Copy one skill copy + the records + RESTORE.md into `archiveDir`. */
+async function writeArchive(collection, archiveDir, workspaceRoot) {
+	const staging = stagingSkillDir(workspaceRoot, collection.slug);
+	await cp(await pathExists(staging) ? staging : collection.skillDir, path.join(archiveDir, "skill"), { recursive: true });
+	if (await pathExists(collection.dataDir)) await cp(collection.dataDir, path.join(archiveDir, "records"), { recursive: true });
+	if (collection.storageFile !== void 0 && await pathExists(collection.storageFile)) {
+		const checkpointed = await checkpointSqliteDatabase(collection.storageFile);
+		await cp(collection.storageFile, path.join(archiveDir, path.basename(collection.storageFile)));
+		if (!checkpointed) for (const suffix of [
+			"-wal",
+			"-journal",
+			"-shm"
+		]) {
+			const sidecar = `${collection.storageFile}${suffix}`;
+			if (await pathExists(sidecar)) await cp(sidecar, path.join(archiveDir, path.basename(sidecar)));
+		}
+	}
+	await writeFile(path.join(archiveDir, "RESTORE.md"), buildRestoreDoc(collection), "utf-8");
+}
+/** Remove all three locations. `rm -rf`-style (force) so a missing dir
+*  is a no-op; the now-empty data parent (`data/<slug>/` after its
+*  `items/` is gone) is swept too, but only when empty. */
+async function removeLocations(collection, workspaceRoot) {
+	await rm(stagingSkillDir(workspaceRoot, collection.slug), {
+		recursive: true,
+		force: true
+	});
+	await rm(collection.skillDir, {
+		recursive: true,
+		force: true
+	});
+	await rm(collection.dataDir, {
+		recursive: true,
+		force: true
+	});
+	await rmdir(path.dirname(collection.dataDir)).catch(() => void 0);
+	if (collection.storageFile !== void 0) {
+		await rm(collection.storageFile, { force: true });
+		await rm(`${collection.storageFile}-wal`, { force: true });
+		await rm(`${collection.storageFile}-journal`, { force: true });
+		await rm(`${collection.storageFile}-shm`, { force: true });
+	}
+}
+async function deleteCollection(collection, opts = {}) {
+	const { slug } = collection;
+	const workspaceRoot = opts.workspaceRoot ?? getWorkspaceRoot();
+	if (collection.source === "user") return {
+		kind: "user-scope",
+		slug
+	};
+	if (isPresetSlug$1(slug)) return {
+		kind: "preset",
+		slug
+	};
+	if (!isDataDirSafe(collection.dataDir, slug, workspaceRoot)) {
+		log.warn("collections", "deleteCollection refused: dataDir is not under the per-collection root", {
+			slug,
+			dataDir: collection.dataDir
+		});
+		return {
+			kind: "unsafe-data-path",
+			slug
+		};
+	}
+	if (deleteTargets(collection, workspaceRoot).some((target) => !isContainedInRoot(target, workspaceRoot))) {
+		log.warn("collections", "deleteCollection refused: a target escapes the workspace", { slug });
+		return {
+			kind: "path-escape",
+			slug
+		};
+	}
+	const archiveRel = path.join(archiveDir(), `${opts.dateStamp ?? todayStamp()}-${randomUUID()}`);
+	const archiveDir$1 = path.join(workspaceRoot, archiveRel);
+	await mkdir(archiveDir$1, { recursive: true });
+	await writeArchive(collection, archiveDir$1, workspaceRoot);
+	await removeLocations(collection, workspaceRoot);
+	log.info("collections", "collection deleted + archived", {
+		slug,
+		archive: archiveRel
+	});
+	return {
+		kind: "ok",
+		slug,
+		archivePath: archiveRel
+	};
+}
+//#endregion
+//#region src/collection/server/views.ts
+async function fileExists(target) {
+	try {
+		await stat(target);
+		return true;
+	} catch (err) {
+		const { code } = err;
+		if (code === "ENOENT" || code === "ENOTDIR") return false;
+		throw err;
+	}
+}
+/** The authoritative base dir for a collection's schema.json + view HTML.
+*  For a project collection, prefer the staging tree when its schema.json is
+*  present (authoring layout); otherwise fall back to the active skill dir
+*  (imported layout — staging never materialised). For feed / user, it's
+*  always the discovered skillDir. Matches `readCustomViewHtml` so reads and
+*  deletes agree on both layouts. */
+async function canonicalBase(collection, workspaceRoot, safeSlug) {
+	if (collection.source !== "project") return collection.skillDir;
+	const staging = path.join(skillsStagingDir(workspaceRoot), safeSlug);
+	if (await fileExists(path.join(staging, "schema.json"))) return staging;
+	return collection.skillDir;
+}
+/** Every on-disk schema.json that must reflect the removal. The active
+*  `<skillDir>/schema.json` is the discovery anchor and is always present.
+*  The staging copy is included only when it actually exists, so an imported
+*  project collection (no staging mirror) doesn't have an empty staging tree
+*  materialised by a side effect of the delete. */
+async function schemaWriteTargets(collection, workspaceRoot, safeSlug) {
+	const active = path.join(collection.skillDir, SCHEMA_FILE$1);
+	if (collection.source !== "project") return [active];
+	const stagingSchema = path.join(skillsStagingDir(workspaceRoot), safeSlug, SCHEMA_FILE$1);
+	const targets = [];
+	if (await fileExists(stagingSchema)) targets.push(stagingSchema);
+	targets.push(active);
+	return targets;
+}
+/** Idempotent unlink — a missing file is fine (the schema entry still gets
+*  cleaned), but a real error (permissions, etc.) propagates. */
+async function unlinkIfPresent(target) {
+	try {
+		await unlink(target);
+	} catch (err) {
+		if (err.code !== "ENOENT") throw err;
+	}
+}
+/** Re-read the canonical schema.json, drop the `views[]` entry, and write the
+*  result back to every on-disk copy so staging + active stay identical. Reads
+*  raw (not `collection.schema`) so fields the typed schema doesn't model are
+*  preserved verbatim. */
+async function removeViewFromSchemas(collection, viewId, workspaceRoot, safeSlug) {
+	const base = await canonicalBase(collection, workspaceRoot, safeSlug);
+	const canonical = path.join(base, SCHEMA_FILE$1);
+	const parsed = JSON.parse(await readFile(canonical, "utf-8"));
+	if (Array.isArray(parsed.views)) parsed.views = parsed.views.filter((entry) => entry?.id !== viewId);
+	const serialized = `${JSON.stringify(parsed, null, 2)}\n`;
+	for (const target of await schemaWriteTargets(collection, workspaceRoot, safeSlug)) await writeFileAtomic(target, serialized);
+}
+/** Delete one custom view from `collection`: unlink its HTML file and drop it
+*  from every schema.json copy. User-scope and preset (mc-*) collections are
+*  refused (read-only / re-seeded on boot), consistent with `deleteCollection`. */
+async function deleteCustomView(collection, viewId, opts = {}) {
+	if (collection.source === "user") return { kind: "user-scope" };
+	if (isPresetSlug$1(collection.slug)) return { kind: "preset" };
+	const safeSlug = safeSlugName(collection.slug);
+	if (safeSlug === null) return {
+		kind: "unsafe-path",
+		viewId
+	};
+	const views = collection.schema.views ?? [];
+	const view = views.find((entry) => entry.id === viewId);
+	if (!view) return {
+		kind: "not-found",
+		viewId
+	};
+	const workspaceRoot = opts.workspaceRoot ?? getWorkspaceRoot();
+	const htmlPath = resolveTemplatePath(await canonicalBase(collection, workspaceRoot, safeSlug), view.file);
+	if (htmlPath === null) return {
+		kind: "unsafe-path",
+		viewId
+	};
+	await removeViewFromSchemas(collection, viewId, workspaceRoot, safeSlug);
+	if (!views.some((entry) => entry.id !== viewId && entry.file === view.file)) await unlinkIfPresent(htmlPath);
+	return {
+		kind: "ok",
+		viewId
+	};
+}
+/** True for a launcher-managed preset slug (`mc-<something>`). The sync logic uses
+*  this to bound which active skills it may refresh/prune, so user-authored skills are
+*  never touched. */
+function isPresetSlug(slug) {
+	return slug.startsWith("mc-") && slug.length > 3;
+}
+//#endregion
+//#region src/collection/server/manageTool.ts
+/** Refuse an unselective getItems beyond this many records — a silent
+*  truncation would read as "covered everything", and an unbounded dump
+*  of a large collection is a token bomb. `ids` or `fields` lifts it. */
+var MAX_UNSELECTIVE_ITEMS = 200;
+/** schema.json basename under a skill dir (canonical staging + active mirror). */
+var SCHEMA_FILE = "schema.json";
+/** The collection-authoring reference, served by the `schemaDocs` action. */
+var SCHEMA_DOCS_FILE = "collection-skills.md";
+/** Cap the rejected-schema issue list so a deeply-broken schema can't flood the result. */
+var MAX_SCHEMA_ISSUES = 20;
+/** The workspace help-docs dir both hosts seed (`@mulmoclaude/core/workspace-setup`
+*  syncs the bundled assets here) — the user-editable copy schemaDocs prefers. */
+var HELPS_DIR = "config/helps";
+/** Resolve the workspace root the same way every collections call does:
+*  the injected override (tests) or the configured collection host. */
+function resolveBase(deps) {
+	return deps.workspaceRoot ?? getWorkspaceRoot();
+}
+/** Shared "unknown collection" message — its schema.json is missing or
+*  failed validation, so discovery skipped it. */
+function unknownCollection(slug) {
+	return `manageCollection: unknown collection '${defangForPrompt(slug)}' — its schema.json is missing or failed validation.`;
+}
+function optionalStringArray(value, name) {
+	if (value === void 0) return { ok: true };
+	if (!Array.isArray(value) || !value.every((entry) => typeof entry === "string" && entry.length > 0)) return {
+		ok: false,
+		error: `manageCollection: \`${name}\` must be an array of non-empty strings when present.`
+	};
+	return {
+		ok: true,
+		value
+	};
+}
+/** Project a record down to the requested fields. The primary key is
+*  always kept so every returned record stays addressable for a
+*  follow-up getItems/putItems. */
+function projectFields(record, fields, primaryKey) {
+	const keys = fields.includes(primaryKey) ? fields : [primaryKey, ...fields];
+	return Object.fromEntries(keys.filter((key) => key in record).map((key) => [key, record[key]]));
+}
+/** The validation warning appended to a getItems result when stored
+*  record files are malformed (they're silently skipped at read time,
+*  so without this they'd just look missing). Issue strings quote
+*  record-controlled text → defanged, mirroring the presentCollection
+*  dispatch. The record VALUES in `items` ride verbatim, like a raw
+*  file Read — only host-composed report strings are defanged. */
+async function recordIssuesWarning(collection, deps) {
+	if (deps.ablateValidation) return void 0;
+	const issues = await validateCollectionRecords(collection, { workspaceRoot: deps.workspaceRoot });
+	if (issues.length === 0) return void 0;
+	const lines = issues.map((issue) => `- ${defangForPrompt(issue.file)}: ${defangForPrompt(issue.problem)}`).join("\n");
+	return `${issues.length} record file(s) have data problems and are missing from this result. Fix each (Read → correct → Write):\n${lines}`;
+}
+async function loadRequestedItems(collection, ids, deps) {
+	const store = storeFor(collection, { workspaceRoot: deps.workspaceRoot });
+	if (!ids) return {
+		items: await store.list(),
+		missing: []
+	};
+	const items = [];
+	const missing = [];
+	for (const recordId of ids) {
+		const item = await store.read(recordId).catch(() => null);
+		if (item) items.push(item);
+		else missing.push(recordId);
+	}
+	return {
+		items,
+		missing
+	};
+}
+async function handleGetItems(collection, args, deps) {
+	const { items, missing } = await loadRequestedItems(collection, args.ids, deps);
+	if (!args.ids && !args.fields && items.length > 200) return `manageCollection: refused — '${collection.slug}' has ${items.length} records, over the unselective limit of 200. Pass \`ids\` for specific records or \`fields\` to project only the columns you need.`;
+	const enriched = await enrichItems(collection, items, deps);
+	const projected = args.fields ? enriched.map((item) => projectFields(item, args.fields, collection.schema.primaryKey)) : enriched;
+	const warning = !args.ids || missing.length > 0 ? await recordIssuesWarning(collection, deps) : void 0;
+	return JSON.stringify({
+		collection: collection.slug,
+		count: projected.length,
+		items: projected,
+		...missing.length > 0 ? { missing: missing.map((recordId) => defangForPrompt(recordId)) } : {},
+		...warning ? { warning } : {}
+	});
+}
+/** Reject writes that set host-computed keys, with a pointer at the
+*  writable source of truth (the toggle's enum) where one exists. */
+function computedKeyProblem(record, schema) {
+	for (const key of Object.keys(record)) {
+		const spec = schema.fields[key];
+		if (!spec || !COMPUTED_TYPES.has(spec.type)) continue;
+		if (spec.type === "toggle" && spec.field) return `'${key}' is a toggle projection — write the enum field '${spec.field}' instead`;
+		return `'${key}' is ${{
+			derived: "derived",
+			embed: "an embed",
+			backlinks: "a backlinks view",
+			rollup: "a rollup"
+		}[spec.type] ?? "computed"} — computed by the host, remove it from the record`;
+	}
+	return null;
+}
+/** `mode: "merge"` resolves the row against the EXISTING record —
+*  a partial row updates just the fields it carries, instead of a
+*  whole-record upsert silently erasing the optional fields it omits
+*  (an upsert of `{id, status}` would pass validation yet drop
+*  `notes`/`lesson`/…). Merge is a partial UPDATE by definition, so a
+*  missing record is a reject, not an implicit create — a merged-over-
+*  nothing partial record is exactly the data shape this mode exists
+*  to prevent.
+*
+*  Computed keys found in the STORED record are stripped before the
+*  merge: the caller's own row was already computed-key-rejected, but a
+*  raw-written / legacy record can carry a stale `derived`/`embed`/
+*  `toggle` value, and re-writing it would perpetuate a forged
+*  host-computed value. A merge heals the record instead.
+*
+*  the store read THROWS on a malformed stored file (only ENOENT is null) —
+*  downgraded to a per-row rejection here, like loadRequestedItems'
+*  `missing`, so one broken file can't abort the whole putItems batch. */
+async function mergeWithExisting(collection, store, record, itemId) {
+	let existing;
+	try {
+		existing = await store.read(itemId);
+	} catch {
+		return `'${itemId}' has a malformed stored file — mode "merge" needs to read it; fix the file (Read → correct → Write) or replace it whole with "upsert"`;
+	}
+	if (!existing) return `'${itemId}' not found — mode "merge" updates an existing record; use "upsert" or "create" to add it`;
+	const stored = Object.entries(existing).filter(([key]) => {
+		const spec = collection.schema.fields[key];
+		return !spec || !COMPUTED_TYPES.has(spec.type);
+	});
+	return {
+		...Object.fromEntries(stored),
+		...record
+	};
+}
+async function putOneItem(collection, store, write, record, mode, deps) {
+	const { schema } = collection;
+	const itemId = resolveCreateItemId(schema, record);
+	const reject = (about, problem) => ({ rejected: {
+		id: defangForPrompt(about),
+		problem: defangForPrompt(problem)
+	} });
+	if (itemId === null) return reject("(no id)", `record has no '${schema.primaryKey}' value — set it (it doubles as the filename)`);
+	const computed = computedKeyProblem(record, schema);
+	if (computed) return reject(itemId, computed);
+	let toWrite = record;
+	if (mode === "merge") {
+		const merged = await mergeWithExisting(collection, store, record, itemId);
+		if (typeof merged === "string") return reject(itemId, merged);
+		toWrite = merged;
+	}
+	if (!deps.ablateValidation) {
+		const invalid = validateRecordObject(toWrite, itemId, schema);
+		if (invalid) return reject(itemId, invalid);
+	}
+	const result = await write(itemId, toWrite, { refuseOverwrite: mode === "create" });
+	if (result.kind === "ok") return { written: result.itemId };
+	if (result.kind === "invalid-id") return reject(itemId, `'${itemId}' is not a valid record id (letters/digits at the ends; -, _, or . inside; no '..' or path characters)`);
+	if (result.kind === "conflict") return reject(itemId, `'${itemId}' already exists — mode "create" refuses overwrite; use "upsert" to update it`);
+	return reject(itemId, "write refused: the collection's data dir escapes the workspace");
+}
+/** Aggregation over a collection via the structured query DSL
+*  (`core/queryZ.ts`) — the paved road for counts / sums / group-bys
+*  that a row listing can't answer honestly. The engine choice (native
+*  store query vs enrich-then-JSONL fallback) lives in
+*  `runCollectionQuery`, shared with the desktop custom view's `/query`
+*  route so the two surfaces can never drift. */
+async function handleQueryItems(collection, queryArg, deps) {
+	const parsed = CollectionQueryZ.safeParse(queryArg);
+	if (!parsed.success) return `manageCollection: \`query\` rejected — fix and retry:\n${parsed.error.issues.slice(0, 20).map((issue) => `- ${issue.path.map(String).join(".") || "(root)"}: ${defangForPrompt(issue.message)}`).join("\n")}`;
+	const rows = await runCollectionQuery(collection, parsed.data, { workspaceRoot: deps.workspaceRoot });
+	return JSON.stringify({
+		collection: collection.slug,
+		count: rows.length,
+		rows
+	});
+}
+async function handlePutItems(collection, args, deps) {
+	const store = storeFor(collection, { workspaceRoot: deps.workspaceRoot });
+	const { write } = store;
+	if (!write) return `manageCollection: ${readOnlyRefusal(collection.slug)} (its records are the rows of '${collection.schema.dataSource?.path}'; edit that file to change the data).`;
+	const written = [];
+	const rejected = [];
+	for (const record of args.items) {
+		const outcome = await putOneItem(collection, store, write, record, args.mode, deps);
+		if (outcome.written) written.push(outcome.written);
+		if (outcome.rejected) rejected.push(outcome.rejected);
+	}
+	return JSON.stringify({
+		collection: collection.slug,
+		written,
+		rejected
+	});
+}
+function parsePutItems(args, slug) {
+	const { items, mode } = args;
+	if (!(Array.isArray(items) && items.length > 0 && items.every((entry) => Boolean(entry) && typeof entry === "object" && !Array.isArray(entry)))) return "manageCollection: `items` is required for putItems — a non-empty array of record objects.";
+	if (mode !== void 0 && mode !== "upsert" && mode !== "create" && mode !== "merge") return "manageCollection: `mode` must be \"upsert\" (default), \"create\", or \"merge\".";
+	return {
+		slug,
+		items,
+		mode: mode ?? "upsert"
+	};
+}
+/** The machine-readable workspace ontology: every collection with its
+*  identity, record count, and outbound `ref`/`embed` relations. Slugs
+*  are discovery-sanitized; titles/labels are workspace-authored schema
+*  text and ride verbatim — the same trust class as the record values
+*  getItems returns. */
+async function handleGetOntology(deps) {
+	const collections = await buildWorkspaceOntology(deps);
+	return JSON.stringify({
+		count: collections.length,
+		collections
+	});
+}
+/** Return the collection-authoring reference (`collection-skills.md`).
+*  Workspace copy first (reflects user edits), bundled asset as the
+*  always-present fallback. Both reads guarded; if neither resolves the
+*  agent still gets an actionable message instead of a thrown call. */
+async function handleSchemaDocs(deps) {
+	const candidates = [path.join(resolveBase(deps), HELPS_DIR, SCHEMA_DOCS_FILE), ...deps.bundledHelpsDir ? [path.join(deps.bundledHelpsDir(), SCHEMA_DOCS_FILE)] : []];
+	for (const candidate of candidates) try {
+		return await readFile(candidate, "utf-8");
+	} catch {}
+	return `manageCollection: could not read the collection-authoring reference (${SCHEMA_DOCS_FILE}).`;
+}
+/** Return the raw schema.json of an existing collection, for editing.
+*  Staging (the canonical writable copy) first, the active mirror as a
+*  fallback for user-scope skills that have no staging copy. Raw text —
+*  not the parsed schema — so the agent edits the true on-disk source. */
+async function handleGetSchema(slug, deps) {
+	const collection = await loadCollection(slug, deps);
+	if (!collection) return unknownCollection(slug);
+	const candidates = [path.join(dataSkillDir(resolveBase(deps), collection.slug), SCHEMA_FILE), path.join(collection.skillDir, SCHEMA_FILE)];
+	for (const candidate of candidates) try {
+		return await readFile(candidate, "utf-8");
+	} catch {}
+	return `manageCollection: '${defangForPrompt(slug)}' has no readable ${SCHEMA_FILE}.`;
+}
+/** Refuse a schema edit the host can't honour: user-scope/feed collections
+*  are read-only, and presets (mc-*) re-seed on restart so an edit is lost. */
+function schemaEditRefusal(collection, slug) {
+	if (collection.source !== "project") return `manageCollection: '${defangForPrompt(slug)}' is ${collection.source}-scope and read-only here — only project collections (data/skills/) can be edited.`;
+	if (isPresetSlug(slug)) return `manageCollection: '${defangForPrompt(slug)}' is a preset (mc-*) and re-seeds on restart — copy it under a different slug to customise.`;
+	return null;
+}
+/** Turn a CollectionSchemaZ failure into a short, actionable list the
+*  agent can fix, pointing back at the field reference. */
+function formatSchemaIssues(issues) {
+	const shown = issues.slice(0, 20);
+	const lines = shown.map((issue) => `- ${issue.path.map(String).join(".") || "(root)"}: ${defangForPrompt(issue.message)}`).join("\n");
+	const omitted = issues.length - shown.length;
+	return `manageCollection: schema rejected — fix and retry (call schemaDocs for the field reference):\n${lines}${omitted > 0 ? `\n- …and ${omitted} more issue(s); fix these first and retry.` : ""}`;
+}
+/** Write the validated schema to the canonical staging copy, then mirror
+*  it into the active `.claude/skills/` tree discovery reads — an internal
+*  write doesn't fire the skill-bridge hook, so we mirror explicitly. */
+async function writeAndMirrorSchema(slug, schema, deps) {
+	const base = resolveBase(deps);
+	await writeFileAtomic(path.join(dataSkillDir(base, slug), SCHEMA_FILE), `${JSON.stringify(schema, null, 2)}\n`);
+	mirrorSkillWrite(base, {
+		slug,
+		relSegments: [SCHEMA_FILE]
+	});
+	try {
+		await deps.refreshAfterWrite?.();
+	} catch {}
+}
+/** The post-Zod acceptance gates discovery applies before a parsed schema
+*  becomes a live collection. Mirrors discovery's checks (`loadOneCollection`)
+*  so a write can't pass here yet be silently skipped on the next load.
+*  putSchema only runs for project-scope collections, so the feed-`ingest`
+*  gate doesn't apply. Returns a one-line reason, or null when the schema
+*  would be accepted. */
+function schemaDiscoveryGate(schema, base) {
+	const primaryField = schema.fields[schema.primaryKey];
+	if (!primaryField) return `primaryKey '${schema.primaryKey}' is not one of the declared fields`;
+	if (primaryField.primary !== true) return `the primaryKey field '${schema.primaryKey}' must be flagged \`primary: true\``;
+	if (schema.dataPath !== void 0 && resolveDataDir(schema.dataPath, base) === null) return `dataPath '${schema.dataPath}' escapes the workspace`;
+	if (schema.dataSource !== void 0 && resolveDataDir(schema.dataSource.path, base) === null) return `dataSource.path '${schema.dataSource.path}' escapes the workspace`;
+	return null;
+}
+/** Validate a schema against CollectionSchemaZ and, on success, persist it.
+*  Edit-only: a new collection is created by writing SKILL.md + schema.json
+*  under data/skills/<slug>/ (the normal create flow), not through here. */
+async function handlePutSchema(slug, schemaArg, deps) {
+	if (!schemaArg || typeof schemaArg !== "object" || Array.isArray(schemaArg)) return "manageCollection: `schema` is required for putSchema — the full collection schema object.";
+	const collection = await loadCollection(slug, deps);
+	if (!collection) return `manageCollection: unknown collection '${defangForPrompt(slug)}' — create it by writing SKILL.md + ${SCHEMA_FILE} under data/skills/${defangForPrompt(slug)}/, then edit it here.`;
+	const refusal = schemaEditRefusal(collection, slug);
+	if (refusal) return refusal;
+	const parsed = CollectionSchemaZ.safeParse(schemaArg);
+	if (!parsed.success) return formatSchemaIssues(parsed.error.issues);
+	const gate = schemaDiscoveryGate(parsed.data, resolveBase(deps));
+	if (gate) return `manageCollection: schema rejected — ${gate} (call schemaDocs for the field reference). It passes basic validation but discovery would skip it, hiding the collection.`;
+	await writeAndMirrorSchema(collection.slug, parsed.data, deps);
+	return JSON.stringify({
+		collection: collection.slug,
+		written: true
+	});
+}
+var MANAGE_COLLECTION_PROMPT = "Use `manageCollection` instead of raw Read/Write/Edit when working with a collection's records OR its schema (raw file I/O stays available as the escape hatch). Before authoring or changing a collection's `schema.json`, call `schemaDocs` to load the field/DSL reference, then read with `getSchema` and write with `putSchema` — `putSchema` validates the whole schema before writing and returns actionable errors instead of silently failing discovery's validation. `getItems` is the only way to see computed values — `derived` fields (e.g. a portfolio's value), `toggle` projections, and `embed` records are host-computed and never present in the stored JSON files. On large collections pass `ids` and/or `fields` to keep the result small. For a question that spans collections (\"which clients have unpaid invoices?\"), start with `getOntology`: it lists every collection with its primaryKey, record count, and outbound `ref`/`embed` relations, so you know which collections to join before reading any records. `putItems` validates every row against the schema before writing (required fields, enum values, primaryKey = record id) and returns `{ written, rejected }`; fix each rejected row using its `problem` text and retry just those rows. Never include computed fields in a row you write. To update a few fields of an existing record, use `mode: \"merge\"` with a partial row ({ id, <changed fields> }) — the default upsert replaces the WHOLE record, so a partial upsert would silently erase every optional field it omits. Answer aggregation questions (counts, sums, averages, group-bys) with `queryItems` on ANY collection — on a dataSource (CSV) collection it scans the whole file (getItems is row-capped, so aggregates computed from its output can be silently wrong on large files); on a file-backed collection it aggregates the enriched records, so computed fields (derived/rollup/toggle) are queryable columns.";
+/** Validate getItems' optional `ids`/`fields` args, then delegate. */
+async function dispatchGetItems(collection, args, deps) {
+	const ids = optionalStringArray(args.ids, "ids");
+	if (!ids.ok) return ids.error;
+	const fields = optionalStringArray(args.fields, "fields");
+	if (!fields.ok) return fields.error;
+	return handleGetItems(collection, {
+		slug: collection.slug,
+		ids: ids.value,
+		fields: fields.value
+	}, deps);
+}
+async function manageCollectionHandler(deps, args) {
+	const action = typeof args.action === "string" ? args.action : "";
+	if (action === "schemaDocs") return handleSchemaDocs(deps);
+	if (action === "getOntology") return handleGetOntology(deps);
+	const slug = typeof args.slug === "string" ? args.slug.trim() : "";
+	if (!slug) return "manageCollection: `slug` is required (the collection's slug).";
+	if (action === "getSchema") return handleGetSchema(slug, deps);
+	if (action === "putSchema") return handlePutSchema(slug, args.schema, deps);
+	if (action !== "getItems" && action !== "putItems" && action !== "queryItems") return "manageCollection: `action` must be \"getItems\", \"putItems\", \"queryItems\", \"getOntology\", \"schemaDocs\", \"getSchema\", or \"putSchema\".";
+	const collection = await loadCollection(slug, deps);
+	if (!collection) return unknownCollection(slug);
+	if (action === "getItems") return dispatchGetItems(collection, args, deps);
+	if (action === "queryItems") return handleQueryItems(collection, args.query, deps);
+	const parsed = parsePutItems(args, slug);
+	if (typeof parsed === "string") return parsed;
+	return handlePutItems(collection, parsed, deps);
+}
+var MANAGE_COLLECTION_DEFINITION = {
+	name: "manageCollection",
+	description: "Read and write a schema-driven collection through the host — both its records and its structure. getItems returns records WITH computed values (derived formulas, toggles, embeds) the stored JSON files don't contain; putItems validates each row against the schema before writing. getOntology maps the whole workspace: every collection with its record count and outbound ref/embed relations — call it first for cross-collection questions. schemaDocs returns the collection-authoring reference; getSchema/putSchema read and validate-then-write the collection's schema.json. Prefer it over raw file I/O on collections.",
+	inputSchema: {
+		type: "object",
+		properties: {
+			action: {
+				type: "string",
+				enum: [
+					"getItems",
+					"putItems",
+					"queryItems",
+					"getOntology",
+					"schemaDocs",
+					"getSchema",
+					"putSchema"
+				],
+				description: "What to do."
+			},
+			slug: {
+				type: "string",
+				description: "The collection's slug (its directory name, e.g. `stock-quotes`). Required for everything except schemaDocs and getOntology."
+			},
+			ids: {
+				type: "array",
+				items: { type: "string" },
+				description: "getItems: only these record ids (primary-key values). Omit for all records."
+			},
+			fields: {
+				type: "array",
+				items: { type: "string" },
+				description: "getItems: only these fields per record (the primary key is always included). Omit for all fields. Use on large collections."
+			},
+			items: {
+				type: "array",
+				items: { type: "object" },
+				description: "putItems: the record objects to store. Each must carry the schema's primaryKey value (it doubles as the filename)."
+			},
+			mode: {
+				type: "string",
+				enum: [
+					"upsert",
+					"create",
+					"merge"
+				],
+				description: "putItems: \"upsert\" (default) replaces existing records WHOLE; \"create\" rejects rows whose id already exists; \"merge\" updates only the fields a row carries, keeping the rest of the existing record (rejects unknown ids). Use \"merge\" when changing a few fields."
+			},
+			schema: {
+				type: "object",
+				description: "putSchema: the full collection schema object (same shape as schema.json — title, icon, dataPath, primaryKey, fields, …). Call getSchema first for the current one, and schemaDocs for the field DSL."
+			},
+			query: {
+				type: "object",
+				description: "queryItems: a structured aggregation query — `{ groupBy?: [\"col\"], aggregates?: { alias: { op: \"count\"|\"sum\"|\"avg\"|\"min\"|\"max\", column? } }, where?: [{ field, op, value }], orderBy?: [{ field, dir? }], limit? }`. At least one of groupBy/aggregates. On a dataSource (CSV) collection it scans the WHOLE file uncapped (unlike getItems); on a file-backed collection it aggregates the ENRICHED records, so computed fields (derived/rollup/toggle) are queryable columns. Use it for counts / sums / averages / group-bys instead of arithmetic over getItems output."
+			}
+		},
+		required: ["action"]
+	}
+};
+function makeManageCollectionTool(deps = {}) {
+	return {
+		definition: MANAGE_COLLECTION_DEFINITION,
+		alwaysActive: true,
+		prompt: MANAGE_COLLECTION_PROMPT,
+		handler: (args) => manageCollectionHandler(deps, args)
+	};
+}
+//#endregion
+export { validateCollectionRecords as C, runCollectionQuery as D, recordFieldProblem as E, enrichItems as O, firstMutateParamProblem as S, compileRecordZ as T, errorMessage as _, deleteCollection as a, schemaRelations as b, computeSuccessor as c, isTriggerDue as d, maybeSpawnSuccessor as f, ONE_SECOND_MS as g, successorId as h, deleteCustomView as i, runQueryOverRows as k, daysInMonth as l, resolveEvery as m, MAX_UNSELECTIVE_ITEMS as n, deleteCollectionRefusalMessage as o, parseCivil as p, makeManageCollectionTool as r, advanceTriggerDate as s, MAX_SCHEMA_ISSUES as t, formatCivil as u, computeCollectionIcon as v, validateRecordObject as w, applyMutateAction as x, buildWorkspaceOntology as y };
+
+//# sourceMappingURL=server-BI3wnTwl.js.map