@mulmoclaude/core 0.25.0 → 0.26.0

package/dist/{server-DZH7OjOD.js → server-CNLZZONa.js}

@@ -1,525 +1,11 @@
-import { d as isReadOnlySchema, l as embedTargetId, o as COMPUTED_TYPES, u as isFieldDrivenEvery } from "./ids-D4e10971.js";
-import { D as rollupValue, E as projectBacklinkRow, O as actionVisible, S as itemIsDone, T as coerceNumeric, b as resolveIcon, d as parseIsoDateTime, g as deriveAll, t as defangForPrompt, u as parseIsoDate, w as backlinkRows, x as selectDynamicRecord, y as firstDateField } from "./promptSafety-Boz5qOs-.js";
-import { A as archiveDir, C as isContainedInRoot, D as resolveTemplatePath, E as resolveDataDir, F as log, N as getWorkspaceRoot, O as safeRecordId, P as isPresetSlug$1, R as skillsStagingDir, S as SCHEMA_FILE$1, _ as readItem, b as writeItem, f as isRegularFile, k as safeSlugName, n as discoverCollections, o as CollectionSchemaZ, p as listItems, r as loadCollection, s as resolveMutateSet, x as writeFileAtomic, y as resolveCreateItemId } from "./discovery-3K_Wtkvn.js";
+import { f as storageKindFor, l as embedTargetId, o as COMPUTED_TYPES, u as isFieldDrivenEvery } from "./ids-P2T89Gou.js";
+import { D as rollupValue, E as projectBacklinkRow, O as actionVisible, S as itemIsDone, T as coerceNumeric, b as resolveIcon, d as parseIsoDateTime, g as deriveAll, t as defangForPrompt, u as parseIsoDate, w as backlinkRows, x as selectDynamicRecord, y as firstDateField } from "./promptSafety-B5KPkaNY.js";
+import { $ as isPresetSlug$1, B as writeFileAtomic, C as compileJsonlQuery, G as resolveDataDir, H as isContainedInRoot, J as safeSlugName, K as resolveTemplatePath, Q as getWorkspaceRoot, R as resolveCreateItemId, V as SCHEMA_FILE$1, Y as archiveDir, b as normalizeCsvValue, d as checkpointSqliteDatabase, et as log, h as cacheDir, j as isRegularFile, l as readOnlyRefusal, n as discoverCollections, o as CollectionSchemaZ, r as loadCollection, rt as skillsStagingDir, s as resolveMutateSet, u as storeFor, w as CollectionQueryZ, x as queryCsv } from "./discovery-QUi_7aNG.js";
 import { dataSkillDir, mirrorSkillWrite } from "./skill-bridge/index.js";
 import path from "node:path";
-import { cp, lstat, mkdir, open, readFile, readdir, rename, rm, rmdir, stat, unlink, writeFile } from "node:fs/promises";
-import { createHash, randomBytes, randomUUID } from "node:crypto";
-import { tmpdir } from "node:os";
-import iconv from "iconv-lite";
+import { cp, lstat, mkdir, open, readFile, readdir, rm, rmdir, stat, unlink, writeFile } from "node:fs/promises";
+import { randomBytes, randomUUID } from "node:crypto";
 import { z } from "zod";
-//#region src/collection/core/queryZ.ts
-/** Result-column aliases double as SQL identifiers and JSON keys — keep
-*  them to a conservative identifier charset so neither side needs
-*  escaping gymnastics. */
-var SAFE_ALIAS_PATTERN = /^[A-Za-z_]\w{0,63}$/;
-/** Hard ceiling on returned rows; `limit` clamps below it. A group-by on
-*  a near-unique column would otherwise return one row per source row —
-*  the exact materialization the aggregate path exists to avoid. */
-var MAX_QUERY_ROWS = 1e4;
-/** Default row cap when the query declares no `limit`. */
-var DEFAULT_QUERY_ROWS = 1e3;
-/** One aggregate column: `count` (rows; `column` optional to count
-*  non-null cells) or `sum`/`avg`/`min`/`max` over a named CSV column. */
-var QueryAggregateZ = z.object({
-	op: z.enum([
-		"count",
-		"sum",
-		"avg",
-		"min",
-		"max"
-	]),
-	column: z.string().min(1).optional()
-}).refine((aggregate) => aggregate.op === "count" || aggregate.column !== void 0, {
-	message: "`column` is required for every aggregate op except `count`",
-	path: ["column"]
-});
-/** One filter condition. Same op vocabulary as the schema-level `where`
-*  (`core/where.ts`) so authors learn one set; values may be typed
-*  (number / boolean) since CSV columns are. `in` requires an array
-*  value, every other op a scalar. */
-var QueryWhereZ = z.object({
-	field: z.string().min(1),
-	op: z.enum([
-		"eq",
-		"ne",
-		"in",
-		"gt",
-		"gte",
-		"lt",
-		"lte",
-		"contains"
-	]),
-	value: z.union([
-		z.string(),
-		z.number(),
-		z.boolean(),
-		z.array(z.union([
-			z.string(),
-			z.number(),
-			z.boolean()
-		])).min(1).max(100)
-	])
-}).refine((cond) => cond.op === "in" === Array.isArray(cond.value), {
-	message: "`in` requires an array value (the allowed set); every other op requires a scalar value",
-	path: ["value"]
-});
-var QueryOrderZ = z.object({
-	/** A `groupBy` column or an aggregate alias — membership enforced by
-	*  the whole-query refine below. */
-	field: z.string().min(1),
-	dir: z.enum(["asc", "desc"]).optional()
-});
-/** The whole query. At least one of `groupBy` / `aggregates` must be
-*  present: bare `groupBy` is a DISTINCT listing, bare `aggregates` a
-*  whole-file scalar row, together a grouped aggregation. */
-var CollectionQueryZ = z.object({
-	groupBy: z.array(z.string().min(1)).max(8).refine((columns) => new Set(columns.map((column) => column.toLowerCase())).size === columns.length, { message: "`groupBy` columns must be unique (case-insensitively — SQL identifiers ignore case)" }).optional(),
-	aggregates: z.record(z.string().regex(SAFE_ALIAS_PATTERN, "aggregate aliases must be simple identifiers (letters/digits/underscore)"), QueryAggregateZ).optional(),
-	where: z.array(QueryWhereZ).max(16).optional(),
-	orderBy: z.array(QueryOrderZ).max(4).optional(),
-	limit: z.number().int().min(1).max(MAX_QUERY_ROWS).optional()
-}).refine((query) => (query.groupBy?.length ?? 0) > 0 || Object.keys(query.aggregates ?? {}).length > 0, {
-	message: "declare at least one of `groupBy` (columns to bucket by) or `aggregates` (values to compute)",
-	path: ["groupBy"]
-}).refine((query) => Object.keys(query.aggregates ?? {}).length <= 32, {
-	message: `\`aggregates\` supports at most 32 entries`,
-	path: ["aggregates"]
-}).refine((query) => {
-	const groupLower = new Set((query.groupBy ?? []).map((column) => column.toLowerCase()));
-	const seen = /* @__PURE__ */ new Set();
-	return Object.keys(query.aggregates ?? {}).every((alias) => {
-		const lower = alias.toLowerCase();
-		if (groupLower.has(lower) || seen.has(lower)) return false;
-		seen.add(lower);
-		return true;
-	});
-}, {
-	message: "aggregate aliases must be unique and must not collide with `groupBy` column names (case-insensitively — SQL identifiers ignore case)",
-	path: ["aggregates"]
-}).refine((query) => {
-	const sortable = /* @__PURE__ */ new Set([...query.groupBy ?? [], ...Object.keys(query.aggregates ?? {})]);
-	return (query.orderBy ?? []).every((order) => sortable.has(order.field));
-}, {
-	message: "every `orderBy.field` must be a `groupBy` column or an aggregate alias",
-	path: ["orderBy"]
-});
-//#endregion
-//#region src/collection/server/csvQuery.ts
-/** Double-quote a SQL identifier (CSV column name / result alias). */
-function quoteIdent(name) {
-	return `"${name.replaceAll("\"", "\"\"")}"`;
-}
-/** Single-quote a SQL string literal (a `types={...}` struct key). */
-function quoteLiteral(value) {
-	return `'${value.replaceAll("'", "''")}'`;
-}
-/** The `read_csv` argument list shared by every CSV query: the (prepared)
-*  path plus a `types` pin forcing the key column to VARCHAR — without it
-*  DuckDB's sniffer turns `001` into BIGINT 1, so leading zeros vanish
-*  and distinct keys collapse. */
-function readCsvArgs(primaryKey) {
-	return `?, types={${quoteLiteral(primaryKey)}: 'VARCHAR'}`;
-}
-/** One aggregate's SQL expression. `sum`/`avg` TRY_CAST to DOUBLE so a
-*  column the sniffer kept as VARCHAR (mixed values) aggregates over its
-*  numeric cells instead of erroring; non-numeric cells become NULL and
-*  are skipped — standard BI tolerance. `min`/`max` stay native (they are
-*  meaningful on strings and dates too). */
-function aggregateExpr(aggregate) {
-	const { op, column } = aggregate;
-	if (op === "count") return column === void 0 ? "count(*)" : `count(${quoteIdent(column)})`;
-	if (op === "sum" || op === "avg") return `${op}(TRY_CAST(${quoteIdent(column ?? "")} AS DOUBLE))`;
-	return `${op}(${quoteIdent(column ?? "")})`;
-}
-/** One where condition → SQL fragment + its bound parameters. String
-*  equality compares against `CAST(col AS VARCHAR)` so a sniffer-typed
-*  column still matches its textual value; numeric/boolean values compare
-*  natively (DuckDB coerces the column side). */
-function whereFragment(cond) {
-	const column = quoteIdent(cond.field);
-	const asText = `CAST(${column} AS VARCHAR)`;
-	if (cond.op === "in") {
-		const values = cond.value;
-		return {
-			sql: `${values.every((value) => typeof value === "string") ? asText : column} IN (${values.map(() => "?").join(", ")})`,
-			params: values
-		};
-	}
-	if (cond.op === "contains") return {
-		sql: `contains(${asText}, ?)`,
-		params: [String(cond.value)]
-	};
-	const operator = {
-		eq: "=",
-		ne: "<>",
-		gt: ">",
-		gte: ">=",
-		lt: "<",
-		lte: "<="
-	}[cond.op];
-	return {
-		sql: `${typeof cond.value === "string" && (cond.op === "eq" || cond.op === "ne") ? asText : column} ${operator} ?`,
-		params: [cond.value]
-	};
-}
-/** Compile a validated query against `fromSql` (a table-function call
-*  whose FIRST placeholder is the source path — the executor binds it).
-*  Returns the SQL and the where-value parameters that follow the path.
-*  Callers MUST have run `CollectionQueryZ` first; this function trusts
-*  the shape (aliases already charset-checked, orderBy membership already
-*  enforced). */
-function compileQuery(query, fromSql) {
-	const groupBy = query.groupBy ?? [];
-	const aggregates = Object.entries(query.aggregates ?? {});
-	const selectList = [...groupBy.map(quoteIdent), ...aggregates.map(([alias, aggregate]) => `${aggregateExpr(aggregate)} AS ${quoteIdent(alias)}`)];
-	const where = (query.where ?? []).map(whereFragment);
-	const clauses = [`SELECT ${selectList.join(", ")}`, `FROM ${fromSql}`];
-	if (where.length > 0) clauses.push(`WHERE ${where.map((fragment) => fragment.sql).join(" AND ")}`);
-	if (groupBy.length > 0) clauses.push(`GROUP BY ${groupBy.map(quoteIdent).join(", ")}`);
-	const orderBy = (query.orderBy ?? []).map((order) => quoteIdent(order.field) + (order.dir === "desc" ? " DESC" : " ASC"));
-	if (orderBy.length > 0) clauses.push(`ORDER BY ${orderBy.join(", ")}`);
-	clauses.push(`LIMIT ${query.limit ?? 1e3}`);
-	return {
-		sql: clauses.join(" "),
-		params: where.flatMap((fragment) => fragment.params)
-	};
-}
-/** Compile against a CSV file (the dataSource store's engine). */
-function compileCsvQuery(query, primaryKey) {
-	return compileQuery(query, `read_csv(${readCsvArgs(primaryKey)})`);
-}
-/** Compile against a JSONL file of ENRICHED records — the file-backed
-*  collections' engine (see `jsonlQuery.ts`). No VARCHAR key pin needed:
-*  enriched record ids are already strings. `sample_size=-1` makes the
-*  schema inference scan EVERY line — with the default sample, a sparse
-*  optional/derived field first appearing past the sample would not be
-*  inferred as a column and the query would binder-error on it (Codex P2
-*  on #2165). The full scan costs nothing extra here: aggregation reads
-*  the whole file anyway. */
-function compileJsonlQuery(query) {
-	return compileQuery(query, `read_json(?, format='newline_delimited', sample_size=-1)`);
-}
-//#endregion
-//#region src/collection/server/csvStore.ts
-/** `list()` row cap. Over-cap files are truncated with a warn — the v1
-*  contract is "browse + per-record views", not full-table analytics. */
-var MAX_CSV_ROWS = 5e3;
-/** Record ids minted from non-safe key values: `id0x` + utf-8 hex. Raw key
-*  values that themselves match this pattern are ALSO encoded, so the
-*  encoded namespace never collides with a raw value (injective mapping). */
-var ENCODED_ID_PATTERN = /^id0x([0-9a-f]+)$/;
-/** A CSV key value → the record id it's addressed by. Safe values pass
-*  through untouched; everything else (and anything shaped like an encoded
-*  id) becomes `id0x<hex>`. Pure + exported for unit tests. */
-function encodeCsvRecordId(rawKey) {
-	if (safeRecordId(rawKey) === rawKey && !ENCODED_ID_PATTERN.test(rawKey)) return rawKey;
-	return `id0x${Buffer.from(rawKey, "utf-8").toString("hex")}`;
-}
-/** A record id → the CSV key value to look up. Inverse of
-*  `encodeCsvRecordId` for encoded ids; anything else is already the raw
-*  value. Pure + exported for unit tests. */
-function decodeCsvRecordId(itemId) {
-	const match = ENCODED_ID_PATTERN.exec(itemId);
-	if (!match) return itemId;
-	return Buffer.from(match[1], "hex").toString("utf-8");
-}
-/** Normalize one DuckDB JS value into a JSON-safe record value: BigInt →
-*  number (string beyond the safe range), DATE/TIMESTAMP → ISO string
-*  (date-only when the clock is exactly UTC midnight, matching the `date`
-*  field contract), exotic DuckDB values → their string form. Pure +
-*  exported for unit tests. */
-function normalizeCsvValue(value) {
-	if (typeof value === "bigint") return value <= BigInt(Number.MAX_SAFE_INTEGER) && value >= BigInt(-Number.MAX_SAFE_INTEGER) ? Number(value) : value.toString();
-	if (value instanceof Date) {
-		const iso = value.toISOString();
-		return iso.endsWith("T00:00:00.000Z") ? iso.slice(0, 10) : iso;
-	}
-	if (value !== null && typeof value === "object") return String(value);
-	return value;
-}
-/** One raw DuckDB row → a CollectionItem, or null when the key cell is
-*  missing/empty (the row can't be addressed). The primaryKey field is
-*  OVERWRITTEN with the (possibly encoded) record id so `item[primaryKey]`
-*  and the record's address never drift — same invariant the file store's
-*  write path enforces. Pure + exported for unit tests. */
-function csvRowToItem(row, primaryKey) {
-	const normalized = Object.fromEntries(Object.entries(row).map(([key, value]) => [key, normalizeCsvValue(value)]));
-	const rawKey = normalized[primaryKey];
-	if (rawKey === null || rawKey === void 0 || String(rawKey) === "") return null;
-	return {
-		...normalized,
-		[primaryKey]: encodeCsvRecordId(String(rawKey))
-	};
-}
-/** Dedupe by record id, LAST row wins (matches `csvRead`'s last-match
-*  pick). Returns the surviving items in first-seen order. Pure +
-*  exported for unit tests. */
-function dedupeByRecordId(items, primaryKey) {
-	const byId = /* @__PURE__ */ new Map();
-	for (const item of items) byId.set(String(item[primaryKey]), item);
-	return {
-		items: [...byId.values()],
-		duplicates: items.length - byId.size
-	};
-}
-/** True when a thrown DuckDB error is the `types` pin naming a column the
-*  CSV doesn't have — the schema/file-mismatch case the caller downgrades
-*  to "empty collection + warn" instead of a 500. */
-function isMissingKeyColumnError(err) {
-	return String(err).includes("do not exist in the CSV");
-}
-/** Bytes sniffed for UTF-8 validity. The trailing 3 bytes of the sample
-*  are dropped so a multibyte char split at the boundary can't produce a
-*  false negative on a valid file. */
-var SNIFF_BYTES = 1024 * 1024;
-function isValidUtf8(buf) {
-	try {
-		new TextDecoder("utf-8", { fatal: true }).decode(buf);
-		return true;
-	} catch {
-		return false;
-	}
-}
-/** Detect the (best-effort) encoding of a non-UTF-8 buffer. BOMs decide
-*  UTF-16; otherwise cp932 (the Shift_JIS superset — Excel-exported
-*  Japanese CSVs are the primary non-UTF-8 case this feature serves). */
-function fallbackEncoding(buf) {
-	if (buf.length >= 2 && buf[0] === 255 && buf[1] === 254) return "utf-16le";
-	if (buf.length >= 2 && buf[0] === 254 && buf[1] === 255) return "utf-16be";
-	return "cp932";
-}
-function cacheDir() {
-	return path.join(tmpdir(), "mulmoclaude-csv-utf8");
-}
-/** Read only the first `bytes` of a file — the encoding sniff must not
-*  pull a multi-hundred-MB CSV into memory on the (common) UTF-8 path. */
-async function readHead(absPath, bytes) {
-	const handle = await open(absPath, "r");
-	try {
-		const { size } = await handle.stat();
-		const buf = Buffer.alloc(Math.min(bytes, size));
-		await handle.read(buf, 0, buf.length, 0);
-		return buf;
-	} finally {
-		await handle.close();
-	}
-}
-/** Decode the whole file into a UTF-8 cache copy and return its path.
-*  Cache key = (path, mtime, size), so a replaced CSV re-decodes and an
-*  unchanged one never does. */
-async function pathExists$1(target) {
-	try {
-		await stat(target);
-		return true;
-	} catch {
-		return false;
-	}
-}
-/** Best-effort removal of older decode-cache entries for the same source
-*  path — a frequently-replaced large CSV would otherwise accumulate one
-*  full copy per (mtime, size) forever. Runs AFTER the current copy is
-*  published; a concurrent reader holding an old fd is unaffected
-*  (unlink-while-open is safe on POSIX). */
-async function evictSupersededCache(key, keepBasename) {
-	try {
-		const entries = await readdir(cacheDir());
-		await Promise.all(entries.filter((name) => name.startsWith(`${key}-`) && name !== keepBasename).map((name) => unlink(path.join(cacheDir(), name)).catch(() => void 0)));
-	} catch {}
-}
-/** Decode the whole file into a UTF-8 cache copy and return its path.
-*  Cache key = (path, mtime, size), so a replaced CSV re-decodes and an
-*  unchanged one never does; superseded copies are evicted. The cache
-*  lives in the SHARED OS tmpdir, so the dir is 0700 and files 0600 —
-*  decoded rows must not be readable by other local users. */
-async function decodeToCache(absPath, info) {
-	const key = createHash("sha256").update(absPath).digest("hex").slice(0, 16);
-	const cached = path.join(cacheDir(), `${key}-${Math.trunc(info.mtimeMs)}-${info.size}.csv`);
-	if (!await pathExists$1(cached)) {
-		const whole = await readFile(absPath);
-		const encoding = fallbackEncoding(whole);
-		const text = iconv.decode(whole, encoding);
-		await mkdir(cacheDir(), {
-			recursive: true,
-			mode: 448
-		});
-		const tmp = `${cached}.${randomBytes(4).toString("hex")}.tmp`;
-		await writeFile(tmp, text, {
-			encoding: "utf-8",
-			mode: 384
-		});
-		await rename(tmp, cached);
-		log.info("collections", "decoded non-UTF-8 dataSource file to cache", {
-			path: absPath,
-			encoding
-		});
-		await evictSupersededCache(key, path.basename(cached));
-	}
-	return cached;
-}
-/** Re-validate the dataSource file at READ time, mirroring the JSON
-*  store's per-read defenses: realpath containment (a symlink swapped in
-*  after discovery must not walk out of the workspace) and an lstat
-*  regular-file check (a symlink leaf is refused outright, even one
-*  pointing inside the workspace — same rule as `isRegularFile` on
-*  record files). Returns the stat info, or null for "no readable file"
-*  (ENOENT / refused), which callers render as an empty collection. */
-async function safeCsvStat(absPath, workspaceRoot) {
-	if (!isContainedInRoot(absPath, workspaceRoot)) {
-		log.warn("collections", "dataSource read refused: path escapes workspace", { path: absPath });
-		return null;
-	}
-	let info;
-	try {
-		info = await lstat(absPath);
-	} catch (err) {
-		if (err.code === "ENOENT") return null;
-		throw err;
-	}
-	if (!info.isFile()) {
-		log.warn("collections", "dataSource read refused: not a regular file (symlink?)", { path: absPath });
-		return null;
-	}
-	return info;
-}
-/** Return a path DuckDB can read as UTF-8: the original file when it
-*  already is UTF-8 (the cheap, common case — only the head is sniffed),
-*  else a decoded cache copy (see `decodeToCache`). Returns null when
-*  there is no readable file (missing, symlink, or containment-refused —
-*  see `safeCsvStat`), which callers render as an empty collection. */
-async function ensureUtf8CsvPath(absPath, workspaceRoot) {
-	const info = await safeCsvStat(absPath, workspaceRoot);
-	if (info === null) return null;
-	const head = await readHead(absPath, SNIFF_BYTES);
-	const sample = head.length === SNIFF_BYTES ? head.subarray(0, SNIFF_BYTES - 3) : head;
-	if (!(head.length >= 2 && (head[0] === 255 && head[1] === 254 || head[0] === 254 && head[1] === 255)) && isValidUtf8(sample)) return absPath;
-	return decodeToCache(absPath, info);
-}
-var instancePromise = null;
-/** Lazily create one shared in-memory DuckDB instance. The dynamic import
-*  keeps the native module OUT of core's load path — a platform where the
-*  prebuilt binding is missing degrades to a per-query error on dataSource
-*  collections only, never a broken core. A failed init is retried on the
-*  next call (the promise is reset). */
-async function duckDbInstance() {
-	if (instancePromise === null) instancePromise = import("@duckdb/node-api").then((mod) => mod.DuckDBInstance.create(":memory:"));
-	try {
-		return await instancePromise;
-	} catch (err) {
-		instancePromise = null;
-		throw new Error(`DuckDB is unavailable on this host (@duckdb/node-api failed to load: ${String(err)}) — dataSource collections cannot be read`);
-	}
-}
-async function queryCsv(sql, params) {
-	const connection = await (await duckDbInstance()).connect();
-	try {
-		return (await connection.runAndReadAll(sql, params)).getRowObjectsJS();
-	} finally {
-		connection.disconnectSync();
-	}
-}
-/** Every row of the CSV as records — capped, deduped, id-encoded. The
-*  key column is pinned to VARCHAR (see `readCsvArgs`). `workspaceRoot`
-*  drives the per-read containment check; omitted, the configured host
-*  root is used. */
-async function csvList(absPath, primaryKey, workspaceRoot) {
-	const utf8Path = await ensureUtf8CsvPath(absPath, workspaceRoot ?? getWorkspaceRoot());
-	if (utf8Path === null) return [];
-	let rows;
-	try {
-		rows = await queryCsv(`SELECT * FROM read_csv(${readCsvArgs(primaryKey)}) LIMIT 5001`, [utf8Path]);
-	} catch (err) {
-		if (!isMissingKeyColumnError(err)) throw err;
-		log.warn("collections", "dataSource CSV has no primaryKey column — every row is skipped", {
-			path: absPath,
-			primaryKey
-		});
-		return [];
-	}
-	if (rows.length > 5e3) {
-		log.warn("collections", "dataSource CSV truncated to row cap", {
-			path: absPath,
-			cap: MAX_CSV_ROWS
-		});
-		rows.length = MAX_CSV_ROWS;
-	}
-	const items = rows.map((row) => csvRowToItem(row, primaryKey)).filter((item) => item !== null);
-	const skipped = rows.length - items.length;
-	if (skipped > 0) log.warn("collections", "dataSource CSV rows skipped (empty key cell)", {
-		path: absPath,
-		skipped
-	});
-	const deduped = dedupeByRecordId(items, primaryKey);
-	if (deduped.duplicates > 0) log.warn("collections", "dataSource CSV has duplicate key values (last row wins)", {
-		path: absPath,
-		duplicates: deduped.duplicates
-	});
-	return deduped.items;
-}
-/** The scan-order ordinal column the last-match read adds. Underscore
-*  prefix keeps it out of any plausible CSV header namespace; it is
-*  stripped from the returned record either way. */
-var ROW_ORDINAL = "__mc_row";
-/** One record by id. The comparison value rides as a prepared-statement
-*  parameter, and the LAST matching row is selected IN DuckDB (scan-order
-*  ordinal + LIMIT 1) — a CSV with thousands of duplicate keys must not
-*  materialize them all for one detail read. Consistent with csvList's
-*  last-wins dedupe. */
-async function csvRead(absPath, primaryKey, itemId, workspaceRoot) {
-	const utf8Path = await ensureUtf8CsvPath(absPath, workspaceRoot ?? getWorkspaceRoot());
-	if (utf8Path === null) return null;
-	const rawKey = decodeCsvRecordId(itemId);
-	const last = (await queryCsv(`SELECT * FROM (SELECT *, row_number() OVER () AS ${quoteIdent(ROW_ORDINAL)} FROM read_csv(${readCsvArgs(primaryKey)})) WHERE CAST(${quoteIdent(primaryKey)} AS VARCHAR) = ? ORDER BY ${quoteIdent(ROW_ORDINAL)} DESC LIMIT 1`, [utf8Path, rawKey])).at(0);
-	if (last === void 0) return null;
-	const { [ROW_ORDINAL]: __ordinal, ...record } = last;
-	return csvRowToItem(record, primaryKey);
-}
-/** Run a validated aggregation query (the structured DSL — see
-*  `core/queryZ.ts`) over the WHOLE file: no row cap on the scan (a
-*  capped aggregate would be a wrong number), only the result-row LIMIT
-*  the compiler emits. Values are normalized like list/read rows so a
-*  chart consumer gets plain JSON scalars. */
-async function csvRunQuery(absPath, primaryKey, query, workspaceRoot) {
-	const utf8Path = await ensureUtf8CsvPath(absPath, workspaceRoot ?? getWorkspaceRoot());
-	if (utf8Path === null) return [];
-	const { sql, params } = compileCsvQuery(query, primaryKey);
-	return (await queryCsv(sql, [utf8Path, ...params])).map((row) => Object.fromEntries(Object.entries(row).map(([key, value]) => [key, normalizeCsvValue(value)])));
-}
-//#endregion
-//#region src/collection/server/store.ts
-/** True when the collection accepts UI/tool writes. A `dataSource`
-*  collection is read-only: updates happen by editing/replacing the
-*  data file itself. Every write entry point checks this BEFORE calling
-*  `writeItem`/`deleteItem` — server-enforced, not just UI-hidden. */
-function collectionWritable(collection) {
-	return !isReadOnlySchema(collection.schema);
-}
-/** The one-line refusal write paths surface (HTTP 405 / MCP error text). */
-function readOnlyRefusal(slug) {
-	return `collection '${slug}' is read-only (backed by an external dataSource) — update the data file itself instead`;
-}
-/** Pick the store implementation for a discovered collection. A
-*  `dataSource` schema whose `dataSourceFile` failed to resolve yields a
-*  read-only EMPTY store rather than falling back to the (writable) file
-*  store — a half-loaded read-only collection must never become writable. */
-function storeFor(collection, opts = {}) {
-	if (isReadOnlySchema(collection.schema)) {
-		const file = collection.dataSourceFile;
-		const key = collection.schema.primaryKey;
-		return {
-			capabilities: { writable: false },
-			list: () => file === void 0 ? Promise.resolve([]) : csvList(file, key, opts.workspaceRoot),
-			read: (itemId) => file === void 0 ? Promise.resolve(null) : csvRead(file, key, itemId, opts.workspaceRoot),
-			query: (query) => file === void 0 ? Promise.resolve([]) : csvRunQuery(file, key, query, opts.workspaceRoot)
-		};
-	}
-	return {
-		capabilities: { writable: true },
-		list: () => listItems(collection.dataDir, opts),
-		read: (itemId) => readItem(collection.dataDir, itemId, opts)
-	};
-}
-//#endregion
 //#region src/collection/server/jsonlQuery.ts
 /** SQL semantics for an aggregate-only query over ZERO rows: one scalar
 *  row (`count` = 0, everything else NULL) — the same shape the CSV path
@@ -588,6 +74,132 @@ async function runQueryOverRows(rows, query) {
 	}
 }
 //#endregion
+//#region src/collection/server/derive.ts
+/** Slugs of every collection referenced by a `ref` field — top-level
+*  and one level into `table` sub-fields (nested tables are
+*  schema-rejected). Mirrors the client's `uniqueRefTargets`. */
+function uniqueRefTargets(schema) {
+	const targets = /* @__PURE__ */ new Set();
+	const walk = (fields) => {
+		for (const field of Object.values(fields)) {
+			if (field.type === "ref" && typeof field.to === "string" && field.to.length > 0) targets.add(field.to);
+			if (field.type === "table" && field.of) walk(field.of);
+		}
+	};
+	walk(schema.fields);
+	return [...targets];
+}
+/** Slugs of every collection referenced by an `embed` field (top-level
+*  only, like the client). */
+function uniqueEmbedTargets(schema) {
+	const targets = /* @__PURE__ */ new Set();
+	for (const field of Object.values(schema.fields)) if (field.type === "embed" && typeof field.to === "string" && field.to.length > 0) targets.add(field.to);
+	return [...targets];
+}
+/** Slugs of every SOURCE collection a `backlinks` or `rollup` field
+*  reverses over — loaded exactly like ref/embed targets (whole
+*  collection, once; the two field kinds share one load). */
+function uniqueBacklinkSources(schema) {
+	const sources = /* @__PURE__ */ new Set();
+	for (const field of Object.values(schema.fields)) if ((field.type === "backlinks" || field.type === "rollup") && field.from.length > 0) sources.add(field.from);
+	return [...sources];
+}
+async function loadTarget(slug, opts) {
+	const target = await loadCollection(slug, opts);
+	if (!target) return null;
+	const items = await storeFor(target, { workspaceRoot: opts.workspaceRoot }).list();
+	const byId = {};
+	for (const item of items) {
+		const itemId = item[target.schema.primaryKey];
+		if (typeof itemId === "string" && itemId.length > 0) byId[itemId] = deriveAll(target.schema, item, {});
+	}
+	return {
+		schema: target.schema,
+		byId
+	};
+}
+/** Load every ref/embed target and backlink source collection once.
+*  Unknown / unloadable targets are simply absent — downstream derefs
+*  resolve to null (em-dash) and backlinks to an empty row set, the
+*  same fail-soft the UI renders. */
+async function loadLinkedTargets(schema, opts) {
+	const slugs = [.../* @__PURE__ */ new Set([
+		...uniqueRefTargets(schema),
+		...uniqueEmbedTargets(schema),
+		...uniqueBacklinkSources(schema)
+	])];
+	const loaded = {};
+	for (const slug of slugs) {
+		const target = await loadTarget(slug, opts);
+		if (target) loaded[slug] = target;
+	}
+	return loaded;
+}
+function toRefRecords(linked) {
+	return Object.fromEntries(Object.entries(linked).map(([slug, target]) => [slug, target.byId]));
+}
+/** The matching source rows for one `backlinks` field, projected to the
+*  source primaryKey + `display` columns — so getItems on a
+*  heavily-referenced record stays a summary, not a dump of the source
+*  collection. Missing source ⇒ [] (fail-soft). The rows come from the
+*  DERIVED source records (`byId`), so `display`/`filter` on a derived
+*  source column (an invoice `total`) works. */
+function projectBacklinks(field, schema, enriched, linked) {
+	const source = linked[field.from];
+	if (!source) return [];
+	return backlinkRows(field, String(enriched[schema.primaryKey] ?? ""), Object.values(source.byId)).map((row) => projectBacklinkRow(row, field.display, source.schema.primaryKey));
+}
+/** Project the computed (never-stored) field kinds onto one derived
+*  record: `toggle` → boolean off its enum, `embed` → the target record
+*  (fixed `id` or per-record `idField`), or null when missing,
+*  `backlinks` → the matching source rows (see `projectBacklinks`). */
+function projectComputed(schema, enriched, linked) {
+	for (const [key, field] of Object.entries(schema.fields)) {
+		if (field.type === "toggle" && field.field) enriched[key] = String(enriched[field.field] ?? "") === field.onValue;
+		if (field.type === "embed" && field.to) {
+			const targetId = embedTargetId(field, enriched);
+			enriched[key] = targetId && linked[field.to]?.byId[targetId] || null;
+		}
+		if (field.type === "backlinks") enriched[key] = projectBacklinks(field, schema, enriched, linked);
+	}
+	return enriched;
+}
+/** Resolve every rollup field onto a COPY of the record, BEFORE the
+*  formula pass — a `derived` formula may reference rollup values as
+*  plain identifiers (`played = homePlayed + awayPlayed`). Same reverse
+*  machinery as backlinks, collapsed to a number: an unresolvable source
+*  is null (a formula reading it fails soft to em-dash); an empty match
+*  set is a real 0. Returns `record` unchanged when the schema declares
+*  no rollups. */
+function projectRollups(schema, record, linked) {
+	let out = record;
+	for (const [key, field] of Object.entries(schema.fields)) {
+		if (field.type !== "rollup") continue;
+		if (out === record) out = { ...record };
+		const source = linked[field.from];
+		const selfId = String(record[schema.primaryKey] ?? "");
+		out[key] = source ? rollupValue(field, selfId, Object.values(source.byId)) : null;
+	}
+	return out;
+}
+/** Enrich records with every host-computed field: derived formulas
+*  evaluated (cross-collection derefs included), toggles projected,
+*  embeds resolved. Loads each linked collection ONCE per call. Input
+*  records are not mutated. */
+async function enrichItems(collection, items, opts = {}) {
+	const { schema } = collection;
+	const linked = await loadLinkedTargets(schema, opts);
+	const refRecords = toRefRecords(linked);
+	return items.map((item) => projectComputed(schema, deriveAll(schema, projectRollups(schema, item, linked), refRecords), linked));
+}
+//#endregion
+//#region src/collection/server/queryRunner.ts
+async function runCollectionQuery(collection, query, opts = {}) {
+	const store = storeFor(collection, { workspaceRoot: opts.workspaceRoot });
+	if (store.query) return store.query(query);
+	return runQueryOverRows(await enrichItems(collection, await store.list(), opts), query);
+}
+//#endregion
 //#region src/collection/core/recordZ.ts
 /** The emptiness rule shared by `required` and the "only check present
 *  values" gate. NOT a truthiness check — `0` and `false` are filled. */
@@ -705,6 +317,7 @@ async function listRecordFilenames(dataDir, workspaceRoot) {
 }
 async function validateCollectionRecords(collection, opts = {}) {
 	if (collection.schema.dataSource !== void 0) return [];
+	if (collection.schema.storage !== void 0) return validateStoreRecords(collection, opts);
 	const workspaceRoot = opts.workspaceRoot ?? getWorkspaceRoot();
 	const entries = await listRecordFilenames(collection.dataDir, workspaceRoot);
 	const issues = [];
@@ -716,6 +329,34 @@ async function validateCollectionRecords(collection, opts = {}) {
 	}
 	return issues;
 }
+/** Store-backed twin of the file scan: list every record through the
+*  collection's store and lint it with the same "strict" report-only tier.
+*  A row the store can't even parse is invisible here (the store skips
+*  it), so the read/parse classifications of the file scan don't apply —
+*  schema violations are what this catches. `file` carries the record id
+*  (there is no per-record filename). */
+async function validateStoreRecords(collection, opts) {
+	let items;
+	try {
+		items = await storeFor(collection, { workspaceRoot: opts.workspaceRoot }).list();
+	} catch (err) {
+		return [{
+			file: "(store)",
+			problem: `records could not be read from the storage backend: ${err instanceof Error ? err.message : String(err)}`
+		}];
+	}
+	const issues = [];
+	for (const item of items) {
+		if (issues.length >= MAX_ISSUES) break;
+		const itemId = String(item[collection.schema.primaryKey] ?? "");
+		const problem = validateRecordObject(item, itemId, collection.schema, "strict");
+		if (problem) issues.push({
+			file: itemId,
+			problem
+		});
+	}
+	return issues;
+}
 async function readRecordText(fullPath, name) {
 	try {
 		if (!(await lstat(fullPath)).isFile()) return {
@@ -793,7 +434,13 @@ async function applyMutateAction(collection, action, itemId, params, opts = {})
 		status: "invalid-params",
 		problem: paramProblem
 	};
-	const existing = await readItem(collection.dataDir, itemId, opts);
+	const store = storeFor(collection, opts);
+	if (!store.write) return {
+		ok: false,
+		status: "write-refused",
+		problem: "write refused (read-only collection)"
+	};
+	const existing = await store.read(itemId);
 	if (!existing) return {
 		ok: false,
 		status: "not-found",
@@ -818,10 +465,7 @@ async function applyMutateAction(collection, action, itemId, params, opts = {})
 		status: "invalid-record",
 		problem: invalid
 	};
-	const result = await writeItem(collection.dataDir, itemId, merged, {
-		workspaceRoot: opts.workspaceRoot,
-		slug: collection.slug
-	});
+	const result = await store.write(itemId, merged);
 	if (result.kind !== "ok") return {
 		ok: false,
 		status: "write-refused",
@@ -879,14 +523,14 @@ async function countRecordFiles(dataDir, workspaceRoot) {
 	}
 }
 /** A collection's record count for the ontology. File-backed: the cheap
-*  readdir count. `dataSource`-backed: the row count via the CSV store
-*  (subject to its row cap) — the dataDir is a phantom there, so the
-*  readdir count would always misreport 0. Fail-soft to 0 like
-*  `countRecordFiles` (an unreadable file / missing DuckDB must not
+*  readdir count. Every other backend (`dataSource` CSV, `storage`
+*  sqlite): the store's page total — the dataDir is a phantom there, so
+*  the readdir count would always misreport 0. Fail-soft to 0 like
+*  `countRecordFiles` (an unreadable file / missing engine must not
 *  break the whole ontology). */
 async function countRecords(collection, workspaceRoot) {
-	if (!collectionWritable(collection)) try {
-		return (await storeFor(collection, { workspaceRoot }).list()).length;
+	if (storageKindFor(collection.schema) !== "file") try {
+		return (await storeFor(collection, { workspaceRoot }).page({ limit: 0 })).total;
 	} catch {
 		return 0;
 	}
@@ -913,125 +557,6 @@ async function buildWorkspaceOntology(opts = {}) {
 	return Promise.all(collections.map((collection) => toOntologyEntry(collection, workspaceRoot)));
 }
 //#endregion
-//#region src/collection/server/derive.ts
-/** Slugs of every collection referenced by a `ref` field — top-level
-*  and one level into `table` sub-fields (nested tables are
-*  schema-rejected). Mirrors the client's `uniqueRefTargets`. */
-function uniqueRefTargets(schema) {
-	const targets = /* @__PURE__ */ new Set();
-	const walk = (fields) => {
-		for (const field of Object.values(fields)) {
-			if (field.type === "ref" && typeof field.to === "string" && field.to.length > 0) targets.add(field.to);
-			if (field.type === "table" && field.of) walk(field.of);
-		}
-	};
-	walk(schema.fields);
-	return [...targets];
-}
-/** Slugs of every collection referenced by an `embed` field (top-level
-*  only, like the client). */
-function uniqueEmbedTargets(schema) {
-	const targets = /* @__PURE__ */ new Set();
-	for (const field of Object.values(schema.fields)) if (field.type === "embed" && typeof field.to === "string" && field.to.length > 0) targets.add(field.to);
-	return [...targets];
-}
-/** Slugs of every SOURCE collection a `backlinks` or `rollup` field
-*  reverses over — loaded exactly like ref/embed targets (whole
-*  collection, once; the two field kinds share one load). */
-function uniqueBacklinkSources(schema) {
-	const sources = /* @__PURE__ */ new Set();
-	for (const field of Object.values(schema.fields)) if ((field.type === "backlinks" || field.type === "rollup") && field.from.length > 0) sources.add(field.from);
-	return [...sources];
-}
-async function loadTarget(slug, opts) {
-	const target = await loadCollection(slug, opts);
-	if (!target) return null;
-	const items = await storeFor(target, { workspaceRoot: opts.workspaceRoot }).list();
-	const byId = {};
-	for (const item of items) {
-		const itemId = item[target.schema.primaryKey];
-		if (typeof itemId === "string" && itemId.length > 0) byId[itemId] = deriveAll(target.schema, item, {});
-	}
-	return {
-		schema: target.schema,
-		byId
-	};
-}
-/** Load every ref/embed target and backlink source collection once.
-*  Unknown / unloadable targets are simply absent — downstream derefs
-*  resolve to null (em-dash) and backlinks to an empty row set, the
-*  same fail-soft the UI renders. */
-async function loadLinkedTargets(schema, opts) {
-	const slugs = [.../* @__PURE__ */ new Set([
-		...uniqueRefTargets(schema),
-		...uniqueEmbedTargets(schema),
-		...uniqueBacklinkSources(schema)
-	])];
-	const loaded = {};
-	for (const slug of slugs) {
-		const target = await loadTarget(slug, opts);
-		if (target) loaded[slug] = target;
-	}
-	return loaded;
-}
-function toRefRecords(linked) {
-	return Object.fromEntries(Object.entries(linked).map(([slug, target]) => [slug, target.byId]));
-}
-/** The matching source rows for one `backlinks` field, projected to the
-*  source primaryKey + `display` columns — so getItems on a
-*  heavily-referenced record stays a summary, not a dump of the source
-*  collection. Missing source ⇒ [] (fail-soft). The rows come from the
-*  DERIVED source records (`byId`), so `display`/`filter` on a derived
-*  source column (an invoice `total`) works. */
-function projectBacklinks(field, schema, enriched, linked) {
-	const source = linked[field.from];
-	if (!source) return [];
-	return backlinkRows(field, String(enriched[schema.primaryKey] ?? ""), Object.values(source.byId)).map((row) => projectBacklinkRow(row, field.display, source.schema.primaryKey));
-}
-/** Project the computed (never-stored) field kinds onto one derived
-*  record: `toggle` → boolean off its enum, `embed` → the target record
-*  (fixed `id` or per-record `idField`), or null when missing,
-*  `backlinks` → the matching source rows (see `projectBacklinks`). */
-function projectComputed(schema, enriched, linked) {
-	for (const [key, field] of Object.entries(schema.fields)) {
-		if (field.type === "toggle" && field.field) enriched[key] = String(enriched[field.field] ?? "") === field.onValue;
-		if (field.type === "embed" && field.to) {
-			const targetId = embedTargetId(field, enriched);
-			enriched[key] = targetId && linked[field.to]?.byId[targetId] || null;
-		}
-		if (field.type === "backlinks") enriched[key] = projectBacklinks(field, schema, enriched, linked);
-	}
-	return enriched;
-}
-/** Resolve every rollup field onto a COPY of the record, BEFORE the
-*  formula pass — a `derived` formula may reference rollup values as
-*  plain identifiers (`played = homePlayed + awayPlayed`). Same reverse
-*  machinery as backlinks, collapsed to a number: an unresolvable source
-*  is null (a formula reading it fails soft to em-dash); an empty match
-*  set is a real 0. Returns `record` unchanged when the schema declares
-*  no rollups. */
-function projectRollups(schema, record, linked) {
-	let out = record;
-	for (const [key, field] of Object.entries(schema.fields)) {
-		if (field.type !== "rollup") continue;
-		if (out === record) out = { ...record };
-		const source = linked[field.from];
-		const selfId = String(record[schema.primaryKey] ?? "");
-		out[key] = source ? rollupValue(field, selfId, Object.values(source.byId)) : null;
-	}
-	return out;
-}
-/** Enrich records with every host-computed field: derived formulas
-*  evaluated (cross-collection derefs included), toggles projected,
-*  embeds resolved. Loads each linked collection ONCE per call. Input
-*  records are not mutated. */
-async function enrichItems(collection, items, opts = {}) {
-	const { schema } = collection;
-	const linked = await loadLinkedTargets(schema, opts);
-	const refRecords = toRefRecords(linked);
-	return items.map((item) => projectComputed(schema, deriveAll(schema, projectRollups(schema, item, linked), refRecords), linked));
-}
-//#endregion
 //#region src/collection/server/dynamicIcon.ts
 /** Index `items` by their `primaryKey` value — the `recordsById` map a
 *  `valueFrom` reference (e.g. `_config.defaultCity`) resolves against.
@@ -1252,7 +777,8 @@ function logSpawnSkip(slug, triggerField, every, sourceItem, sourceId) {
 *  predicate doesn't match, the trigger date is unparseable, or the
 *  successor already exists (create-if-absent). Never overwrites an
 *  existing successor — protects any edits the user made to it. */
-async function maybeSpawnSuccessor(slug, schema, dataDir, sourceItem, sourceId, ioOpts = {}) {
+async function maybeSpawnSuccessor(collection, sourceItem, sourceId, ioOpts = {}) {
+	const { slug, schema } = collection;
 	const { spawn } = schema;
 	if (!spawn || !schema.triggerField) return;
 	if (!matchesWhen(spawn.when, schema, sourceItem)) return;
@@ -1270,11 +796,15 @@ async function maybeSpawnSuccessor(slug, schema, dataDir, sourceItem, sourceId,
 		return;
 	}
 	try {
-		const result = await writeItem(dataDir, computed.id, computed.record, {
-			...ioOpts,
-			refuseOverwrite: true,
-			slug
-		});
+		const { write } = storeFor(collection, ioOpts);
+		if (!write) {
+			log.warn("collections", "spawn skipped: collection store is read-only", {
+				slug,
+				sourceId
+			});
+			return;
+		}
+		const result = await write(computed.id, computed.record, { refuseOverwrite: true });
 		if (result.kind === "ok") log.info("collections", "spawned successor", {
 			slug,
 			sourceId,
@@ -1332,7 +862,8 @@ function deleteTargets(collection, workspaceRoot) {
 	return [
 		stagingSkillDir(workspaceRoot, collection.slug),
 		collection.skillDir,
-		collection.dataDir
+		collection.dataDir,
+		...collection.storageFile !== void 0 ? [collection.storageFile] : []
 	];
 }
 /** The records directory the delete recursively archives + removes
@@ -1364,6 +895,11 @@ function isDataDirSafe(dataDir, slug, workspaceRoot) {
 *  `dataSource` collection has no record files to copy (its rows live in
 *  the external data file, which the delete never touches). */
 function restoreRecordsStep(schema) {
+	if (schema.storage !== void 0) return `2. Records: copy the archived database file
+   \`${path.basename(schema.storage.path)}\` (next to this document) back to
+   \`${schema.storage.path}\` (workspace-relative, \`cp\`). It holds every
+   record. If \`-wal\`/\`-journal\` sidecar files were archived alongside
+   it, copy them back too.`;
 	if (schema.dataPath === void 0) return `2. Records: nothing to copy. This is a \`dataSource\` collection —
    its records are the rows of \`${schema.dataSource?.path}\`, which the
    delete never touched.`;
@@ -1400,7 +936,7 @@ ${restoreRecordsStep(schema)}
 
 - slug: \`${slug}\`
 - title: ${schema.title}
-- dataPath: \`${schema.dataPath ?? `(dataSource) ${schema.dataSource?.path}`}\`
+- dataPath: \`${schema.dataPath ?? (schema.storage !== void 0 ? `(storage) ${schema.storage.path}` : `(dataSource) ${schema.dataSource?.path}`)}\`
 `;
 }
 /** Copy one skill copy + the records + RESTORE.md into `archiveDir`. */
@@ -1408,6 +944,18 @@ async function writeArchive(collection, archiveDir, workspaceRoot) {
 	const staging = stagingSkillDir(workspaceRoot, collection.slug);
 	await cp(await pathExists(staging) ? staging : collection.skillDir, path.join(archiveDir, "skill"), { recursive: true });
 	if (await pathExists(collection.dataDir)) await cp(collection.dataDir, path.join(archiveDir, "records"), { recursive: true });
+	if (collection.storageFile !== void 0 && await pathExists(collection.storageFile)) {
+		const checkpointed = await checkpointSqliteDatabase(collection.storageFile);
+		await cp(collection.storageFile, path.join(archiveDir, path.basename(collection.storageFile)));
+		if (!checkpointed) for (const suffix of [
+			"-wal",
+			"-journal",
+			"-shm"
+		]) {
+			const sidecar = `${collection.storageFile}${suffix}`;
+			if (await pathExists(sidecar)) await cp(sidecar, path.join(archiveDir, path.basename(sidecar)));
+		}
+	}
 	await writeFile(path.join(archiveDir, "RESTORE.md"), buildRestoreDoc(collection), "utf-8");
 }
 /** Remove all three locations. `rm -rf`-style (force) so a missing dir
@@ -1427,6 +975,12 @@ async function removeLocations(collection, workspaceRoot) {
 		force: true
 	});
 	await rmdir(path.dirname(collection.dataDir)).catch(() => void 0);
+	if (collection.storageFile !== void 0) {
+		await rm(collection.storageFile, { force: true });
+		await rm(`${collection.storageFile}-wal`, { force: true });
+		await rm(`${collection.storageFile}-journal`, { force: true });
+		await rm(`${collection.storageFile}-shm`, { force: true });
+	}
 }
 async function deleteCollection(collection, opts = {}) {
 	const { slug } = collection;
@@ -1685,13 +1239,13 @@ function computedKeyProblem(record, schema) {
 *  `toggle` value, and re-writing it would perpetuate a forged
 *  host-computed value. A merge heals the record instead.
 *
-*  readItem THROWS on a malformed stored file (only ENOENT is null) —
+*  the store read THROWS on a malformed stored file (only ENOENT is null) —
 *  downgraded to a per-row rejection here, like loadRequestedItems'
 *  `missing`, so one broken file can't abort the whole putItems batch. */
-async function mergeWithExisting(collection, record, itemId, deps) {
+async function mergeWithExisting(collection, store, record, itemId) {
 	let existing;
 	try {
-		existing = await readItem(collection.dataDir, itemId, { workspaceRoot: deps.workspaceRoot });
+		existing = await store.read(itemId);
 	} catch {
 		return `'${itemId}' has a malformed stored file — mode "merge" needs to read it; fix the file (Read → correct → Write) or replace it whole with "upsert"`;
 	}
@@ -1705,7 +1259,7 @@ async function mergeWithExisting(collection, record, itemId, deps) {
 		...record
 	};
 }
-async function putOneItem(collection, record, mode, deps) {
+async function putOneItem(collection, store, write, record, mode, deps) {
 	const { schema } = collection;
 	const itemId = resolveCreateItemId(schema, record);
 	const reject = (about, problem) => ({ rejected: {
@@ -1717,7 +1271,7 @@ async function putOneItem(collection, record, mode, deps) {
 	if (computed) return reject(itemId, computed);
 	let toWrite = record;
 	if (mode === "merge") {
-		const merged = await mergeWithExisting(collection, record, itemId, deps);
+		const merged = await mergeWithExisting(collection, store, record, itemId);
 		if (typeof merged === "string") return reject(itemId, merged);
 		toWrite = merged;
 	}
@@ -1725,11 +1279,7 @@ async function putOneItem(collection, record, mode, deps) {
 		const invalid = validateRecordObject(toWrite, itemId, schema);
 		if (invalid) return reject(itemId, invalid);
 	}
-	const result = await writeItem(collection.dataDir, itemId, toWrite, {
-		refuseOverwrite: mode === "create",
-		workspaceRoot: deps.workspaceRoot,
-		slug: collection.slug
-	});
+	const result = await write(itemId, toWrite, { refuseOverwrite: mode === "create" });
 	if (result.kind === "ok") return { written: result.itemId };
 	if (result.kind === "invalid-id") return reject(itemId, `'${itemId}' is not a valid record id (letters/digits at the ends; -, _, or . inside; no '..' or path characters)`);
 	if (result.kind === "conflict") return reject(itemId, `'${itemId}' already exists — mode "create" refuses overwrite; use "upsert" to update it`);
@@ -1737,25 +1287,14 @@ async function putOneItem(collection, record, mode, deps) {
 }
 /** Aggregation over a collection via the structured query DSL
 *  (`core/queryZ.ts`) — the paved road for counts / sums / group-bys
-*  that a row listing can't answer honestly. Two engines behind one
-*  shape: a dataSource collection queries its CSV natively through the
-*  store (`store.query`, uncapped whole-file scan); a file-backed
-*  collection aggregates its ENRICHED records (computed fields —
-*  `derived` / `rollup` / `toggle` — are real columns) through the same
-*  compiled SQL over a temp JSONL (`runQueryOverRows`). */
+*  that a row listing can't answer honestly. The engine choice (native
+*  store query vs enrich-then-JSONL fallback) lives in
+*  `runCollectionQuery`, shared with the desktop custom view's `/query`
+*  route so the two surfaces can never drift. */
 async function handleQueryItems(collection, queryArg, deps) {
 	const parsed = CollectionQueryZ.safeParse(queryArg);
 	if (!parsed.success) return `manageCollection: \`query\` rejected — fix and retry:\n${parsed.error.issues.slice(0, 20).map((issue) => `- ${issue.path.map(String).join(".") || "(root)"}: ${defangForPrompt(issue.message)}`).join("\n")}`;
-	const store = storeFor(collection, { workspaceRoot: deps.workspaceRoot });
-	if (store.query) {
-		const rows = await store.query(parsed.data);
-		return JSON.stringify({
-			collection: collection.slug,
-			count: rows.length,
-			rows
-		});
-	}
-	const rows = await runQueryOverRows(await enrichItems(collection, await store.list(), deps), parsed.data);
+	const rows = await runCollectionQuery(collection, parsed.data, { workspaceRoot: deps.workspaceRoot });
 	return JSON.stringify({
 		collection: collection.slug,
 		count: rows.length,
@@ -1763,11 +1302,13 @@ async function handleQueryItems(collection, queryArg, deps) {
 	});
 }
 async function handlePutItems(collection, args, deps) {
-	if (!collectionWritable(collection)) return `manageCollection: ${readOnlyRefusal(collection.slug)} (its records are the rows of '${collection.schema.dataSource?.path}'; edit that file to change the data).`;
+	const store = storeFor(collection, { workspaceRoot: deps.workspaceRoot });
+	const { write } = store;
+	if (!write) return `manageCollection: ${readOnlyRefusal(collection.slug)} (its records are the rows of '${collection.schema.dataSource?.path}'; edit that file to change the data).`;
 	const written = [];
 	const rejected = [];
 	for (const record of args.items) {
-		const outcome = await putOneItem(collection, record, args.mode, deps);
+		const outcome = await putOneItem(collection, store, write, record, args.mode, deps);
 		if (outcome.written) written.push(outcome.written);
 		if (outcome.rejected) rejected.push(outcome.rejected);
 	}
@@ -1777,6 +1318,44 @@ async function handlePutItems(collection, args, deps) {
 		rejected
 	});
 }
+/** Delete records by id, through the store — so it works on any writable
+*  backend, not just file records. Same read-only refusal as putItems (an
+*  absent `delete` IS the refusal), and the same per-id result shape so a
+*  partially-bad batch reports per id instead of failing whole. */
+async function handleDeleteItems(collection, ids, deps) {
+	const { delete: removeItem } = storeFor(collection, { workspaceRoot: deps.workspaceRoot });
+	if (!removeItem) return `manageCollection: ${readOnlyRefusal(collection.slug)} (its records are the rows of '${collection.schema.dataSource?.path}'; edit that file to change the data).`;
+	const deleted = [];
+	const rejected = [];
+	for (const itemId of ids) {
+		const outcome = await deleteOneItem(removeItem, itemId);
+		if (outcome.deleted) deleted.push(outcome.deleted);
+		if (outcome.rejected) rejected.push(outcome.rejected);
+	}
+	return JSON.stringify({
+		collection: collection.slug,
+		deleted,
+		rejected
+	});
+}
+/** A missing id is a rejection, not a silent success: deleting by a typo'd
+*  id would otherwise report "done" while the real record survives. */
+async function deleteOneItem(removeItem, itemId) {
+	const result = await removeItem(itemId);
+	if (result.kind === "ok") return { deleted: result.itemId };
+	const reject = (problem) => ({ rejected: {
+		id: defangForPrompt(itemId),
+		problem: defangForPrompt(problem)
+	} });
+	if (result.kind === "invalid-id") return reject(`'${itemId}' is not a valid record id (letters/digits at the ends; -, _, or . inside; no '..' or path characters)`);
+	if (result.kind === "not-found") return reject(`'${itemId}' not found — nothing was deleted; confirm the id with getItems`);
+	return reject("delete refused: the collection's data dir escapes the workspace");
+}
+function parseDeleteIds(args) {
+	const { ids } = args;
+	if (!(Array.isArray(ids) && ids.length > 0 && ids.every((entry) => typeof entry === "string" && entry.trim().length > 0))) return "manageCollection: `ids` is required for deleteItems — a non-empty array of record ids.";
+	return ids;
+}
 function parsePutItems(args, slug) {
 	const { items, mode } = args;
 	if (!(Array.isArray(items) && items.length > 0 && items.every((entry) => Boolean(entry) && typeof entry === "object" && !Array.isArray(entry)))) return "manageCollection: `items` is required for putItems — a non-empty array of record objects.";
@@ -1885,7 +1464,7 @@ async function handlePutSchema(slug, schemaArg, deps) {
 		written: true
 	});
 }
-var MANAGE_COLLECTION_PROMPT = "Use `manageCollection` instead of raw Read/Write/Edit when working with a collection's records OR its schema (raw file I/O stays available as the escape hatch). Before authoring or changing a collection's `schema.json`, call `schemaDocs` to load the field/DSL reference, then read with `getSchema` and write with `putSchema` — `putSchema` validates the whole schema before writing and returns actionable errors instead of silently failing discovery's validation. `getItems` is the only way to see computed values — `derived` fields (e.g. a portfolio's value), `toggle` projections, and `embed` records are host-computed and never present in the stored JSON files. On large collections pass `ids` and/or `fields` to keep the result small. For a question that spans collections (\"which clients have unpaid invoices?\"), start with `getOntology`: it lists every collection with its primaryKey, record count, and outbound `ref`/`embed` relations, so you know which collections to join before reading any records. `putItems` validates every row against the schema before writing (required fields, enum values, primaryKey = record id) and returns `{ written, rejected }`; fix each rejected row using its `problem` text and retry just those rows. Never include computed fields in a row you write. To update a few fields of an existing record, use `mode: \"merge\"` with a partial row ({ id, <changed fields> }) — the default upsert replaces the WHOLE record, so a partial upsert would silently erase every optional field it omits. Answer aggregation questions (counts, sums, averages, group-bys) with `queryItems` on ANY collection — on a dataSource (CSV) collection it scans the whole file (getItems is row-capped, so aggregates computed from its output can be silently wrong on large files); on a file-backed collection it aggregates the enriched records, so computed fields (derived/rollup/toggle) are queryable columns.";
+var MANAGE_COLLECTION_PROMPT = "Use `manageCollection` instead of raw Read/Write/Edit when working with a collection's records OR its schema (raw file I/O stays available as the escape hatch). Before authoring or changing a collection's `schema.json`, call `schemaDocs` to load the field/DSL reference, then read with `getSchema` and write with `putSchema` — `putSchema` validates the whole schema before writing and returns actionable errors instead of silently failing discovery's validation. `getItems` is the only way to see computed values — `derived` fields (e.g. a portfolio's value), `toggle` projections, and `embed` records are host-computed and never present in the stored JSON files. On large collections pass `ids` and/or `fields` to keep the result small. For a question that spans collections (\"which clients have unpaid invoices?\"), start with `getOntology`: it lists every collection with its primaryKey, record count, and outbound `ref`/`embed` relations, so you know which collections to join before reading any records. `putItems` validates every row against the schema before writing (required fields, enum values, primaryKey = record id) and returns `{ written, rejected }`; fix each rejected row using its `problem` text and retry just those rows. Never include computed fields in a row you write. To update a few fields of an existing record, use `mode: \"merge\"` with a partial row ({ id, <changed fields> }) — the default upsert replaces the WHOLE record, so a partial upsert would silently erase every optional field it omits. `deleteItems` removes records by id and returns `{ deleted, rejected }`; an id that doesn't exist comes back rejected rather than counted as deleted, so check `rejected` before reporting a deletion as done. Answer aggregation questions (counts, sums, averages, group-bys) with `queryItems` on ANY collection — on a dataSource (CSV) collection it scans the whole file (getItems is row-capped, so aggregates computed from its output can be silently wrong on large files); on a file-backed collection it aggregates the enriched records, so computed fields (derived/rollup/toggle) are queryable columns.";
 /** Validate getItems' optional `ids`/`fields` args, then delegate. */
 async function dispatchGetItems(collection, args, deps) {
 	const ids = optionalStringArray(args.ids, "ids");
@@ -1898,6 +1477,26 @@ async function dispatchGetItems(collection, args, deps) {
 		fields: fields.value
 	}, deps);
 }
+/** Actions that operate on a collection's RECORDS — i.e. the ones that
+*  need the collection loaded first. Schema/workspace actions don't. */
+var RECORD_ACTIONS = /* @__PURE__ */ new Set([
+	"getItems",
+	"putItems",
+	"deleteItems",
+	"queryItems"
+]);
+/** Record-action dispatch, split from `manageCollectionHandler` to keep
+*  both within the cognitive-complexity budget. */
+async function dispatchRecordAction(action, collection, args, deps) {
+	if (action === "getItems") return dispatchGetItems(collection, args, deps);
+	if (action === "queryItems") return handleQueryItems(collection, args.query, deps);
+	if (action === "deleteItems") {
+		const ids = parseDeleteIds(args);
+		return typeof ids === "string" ? ids : handleDeleteItems(collection, ids, deps);
+	}
+	const parsed = parsePutItems(args, collection.slug);
+	return typeof parsed === "string" ? parsed : handlePutItems(collection, parsed, deps);
+}
 async function manageCollectionHandler(deps, args) {
 	const action = typeof args.action === "string" ? args.action : "";
 	if (action === "schemaDocs") return handleSchemaDocs(deps);
@@ -1906,18 +1505,14 @@ async function manageCollectionHandler(deps, args) {
 	if (!slug) return "manageCollection: `slug` is required (the collection's slug).";
 	if (action === "getSchema") return handleGetSchema(slug, deps);
 	if (action === "putSchema") return handlePutSchema(slug, args.schema, deps);
-	if (action !== "getItems" && action !== "putItems" && action !== "queryItems") return "manageCollection: `action` must be \"getItems\", \"putItems\", \"queryItems\", \"getOntology\", \"schemaDocs\", \"getSchema\", or \"putSchema\".";
+	if (!RECORD_ACTIONS.has(action)) return "manageCollection: `action` must be \"getItems\", \"putItems\", \"deleteItems\", \"queryItems\", \"getOntology\", \"schemaDocs\", \"getSchema\", or \"putSchema\".";
 	const collection = await loadCollection(slug, deps);
 	if (!collection) return unknownCollection(slug);
-	if (action === "getItems") return dispatchGetItems(collection, args, deps);
-	if (action === "queryItems") return handleQueryItems(collection, args.query, deps);
-	const parsed = parsePutItems(args, slug);
-	if (typeof parsed === "string") return parsed;
-	return handlePutItems(collection, parsed, deps);
+	return dispatchRecordAction(action, collection, args, deps);
 }
 var MANAGE_COLLECTION_DEFINITION = {
 	name: "manageCollection",
-	description: "Read and write a schema-driven collection through the host — both its records and its structure. getItems returns records WITH computed values (derived formulas, toggles, embeds) the stored JSON files don't contain; putItems validates each row against the schema before writing. getOntology maps the whole workspace: every collection with its record count and outbound ref/embed relations — call it first for cross-collection questions. schemaDocs returns the collection-authoring reference; getSchema/putSchema read and validate-then-write the collection's schema.json. Prefer it over raw file I/O on collections.",
+	description: "Read and write a schema-driven collection through the host — both its records and its structure. getItems returns records WITH computed values (derived formulas, toggles, embeds) the stored JSON files don't contain; putItems validates each row against the schema before writing; deleteItems removes records by id. getOntology maps the whole workspace: every collection with its record count and outbound ref/embed relations — call it first for cross-collection questions. schemaDocs returns the collection-authoring reference; getSchema/putSchema read and validate-then-write the collection's schema.json. Prefer it over raw file I/O on collections.",
 	inputSchema: {
 		type: "object",
 		properties: {
@@ -1926,6 +1521,7 @@ var MANAGE_COLLECTION_DEFINITION = {
 				enum: [
 					"getItems",
 					"putItems",
+					"deleteItems",
 					"queryItems",
 					"getOntology",
 					"schemaDocs",
@@ -1941,7 +1537,7 @@ var MANAGE_COLLECTION_DEFINITION = {
 			ids: {
 				type: "array",
 				items: { type: "string" },
-				description: "getItems: only these record ids (primary-key values). Omit for all records."
+				description: "getItems: only these record ids (primary-key values); omit for all records. deleteItems: the record ids to delete — required, and never optional there."
 			},
 			fields: {
 				type: "array",
@@ -1983,6 +1579,6 @@ function makeManageCollectionTool(deps = {}) {
 	};
 }
 //#endregion
-export { readOnlyRefusal as A, CollectionQueryZ as B, firstMutateParamProblem as C, recordFieldProblem as D, compileRecordZ as E, dedupeByRecordId as F, MAX_QUERY_ROWS as H, encodeCsvRecordId as I, normalizeCsvValue as L, MAX_CSV_ROWS as M, csvRowToItem as N, runQueryOverRows as O, decodeCsvRecordId as P, compileCsvQuery as R, applyMutateAction as S, validateRecordObject as T, DEFAULT_QUERY_ROWS as V, errorMessage as _, deleteCollection as a, buildWorkspaceOntology as b, computeSuccessor as c, isTriggerDue as d, maybeSpawnSuccessor as f, ONE_SECOND_MS as g, successorId as h, deleteCustomView as i, storeFor as j, collectionWritable as k, daysInMonth as l, resolveEvery as m, MAX_UNSELECTIVE_ITEMS as n, deleteCollectionRefusalMessage as o, parseCivil as p, makeManageCollectionTool as r, advanceTriggerDate as s, MAX_SCHEMA_ISSUES as t, formatCivil as u, computeCollectionIcon as v, validateCollectionRecords as w, schemaRelations as x, enrichItems as y, compileJsonlQuery as z };
+export { validateCollectionRecords as C, runCollectionQuery as D, recordFieldProblem as E, enrichItems as O, firstMutateParamProblem as S, compileRecordZ as T, errorMessage as _, deleteCollection as a, schemaRelations as b, computeSuccessor as c, isTriggerDue as d, maybeSpawnSuccessor as f, ONE_SECOND_MS as g, successorId as h, deleteCustomView as i, runQueryOverRows as k, daysInMonth as l, resolveEvery as m, MAX_UNSELECTIVE_ITEMS as n, deleteCollectionRefusalMessage as o, parseCivil as p, makeManageCollectionTool as r, advanceTriggerDate as s, MAX_SCHEMA_ISSUES as t, formatCivil as u, computeCollectionIcon as v, validateRecordObject as w, applyMutateAction as x, buildWorkspaceOntology as y };
 
-//# sourceMappingURL=server-DZH7OjOD.js.map
+//# sourceMappingURL=server-CNLZZONa.js.map