@mulmoclaude/core 0.7.1 → 0.8.0

package/dist/deriveAll-D3wFH4Tw.js.map

@@ -1 +1 @@
-{"version":3,"file":"deriveAll-D3wFH4Tw.js","names":[],"sources":["../src/collection/core/schema.ts","../src/collection/core/derivedFormula.ts","../src/collection/core/deriveAll.ts"],"sourcesContent":["// Schema-driven collection types. A \"collection\" is a skill (under\n// .claude/skills/<slug>/) that also ships a sibling `schema.json`.\n// The host's <CollectionView> reads the schema + records and renders\n// a table/form; Claude reads SKILL.md and CRUDs the records as JSON\n// files.\n//\n// Field types for v0 — keep this list narrow and grow it only when a\n// real collection needs the new type. v0 supports flat records only;\n// nested tables / cross-collection refs / derived fields / actions are\n// deferred to follow-ups (see plans/done/feat-skill-driven-apps.md and\n// plans/done/feat-skill-driven-apps-worklog.md — historical names predate\n// the rename).\n\n/** Minimal \"this collection is a feed\" descriptor carried on the schema.\n *  Deliberately narrow — the canonical collection contract stays\n *  independent of the host's feeds subsystem. The host's richer retrieval\n *  spec (`IngestSpec` in `server/workspace/feeds/ingestTypes.ts`)\n *  `extends CollectionIngest`, so feed code reads the extra fields by\n *  typing feed schemas with that subtype; collection rendering only needs\n *  these three + the presence check. */\nexport interface CollectionIngest {\n  kind: string;\n  schedule: string;\n  /** Optional time-of-day anchor for `schedule: \"daily\"` — the hour (0–23) to\n   *  refresh around (the host ticks hourly, so the run lands within that hour).\n   *  Ignored for non-daily schedules. Absent ⇒ elapsed-based daily (\"≥24 h since\n   *  the last run\"). NOTE: **UTC**, not local — compared via `getUTCHours()` for\n   *  an unambiguous, DST-free check (matching the rest of the scheduler), so\n   *  convert local times before writing (e.g. 07:00 JST → `atHour: 22`). */\n  atHour?: number;\n  /** Declarative retrievers (`rss`/`atom`/`http-json`) only — the host fetches\n   *  this URL on the schedule. Absent for `kind: \"agent\"`, where the agent owns\n   *  retrieval. */\n  url?: string;\n  /** `kind: \"agent\"` only: role id the scheduled hidden worker runs in. */\n  role?: string;\n  /** `kind: \"agent\"` only: skill-relative template path (under `templates/`)\n   *  whose prose tells the worker how to refresh the records. */\n  template?: string;\n}\n\n/** Declarative retriever kinds a Feed's `ingest.kind` may declare. The host's\n *  feeds engine dispatches on these; they live here (with the schema contract)\n *  so the schema validator can enforce them. The host re-exports these from\n *  `server/workspace/feeds/ingestTypes.ts`. */\nexport const INGEST_KINDS = [\"rss\", \"atom\", \"http-json\"] as const;\nexport type IngestKind = (typeof INGEST_KINDS)[number];\n\n/** The agent-performed ingest kind. Instead of a declarative fetch, the host\n *  dispatches a hidden background chat (origin `system`) in `ingest.role`,\n *  seeded with `ingest.template` + a summary of every record, on the\n *  `ingest.schedule` cadence; the worker edits records via the collections io\n *  layer. Kept separate from {@link INGEST_KINDS} (which the declarative\n *  retriever registry keys on) so the schema validator can model `ingest` as a\n *  discriminated union without the feeds engine gaining an \"agent\" retriever. */\nexport const AGENT_INGEST_KIND = \"agent\" as const;\nexport type AgentIngestKind = typeof AGENT_INGEST_KIND;\n\n/** Refresh cadences a Feed's `ingest.schedule` may declare. */\nexport const FEED_SCHEDULES = [\"hourly\", \"daily\", \"weekly\", \"on-demand\"] as const;\nexport type FeedSchedule = (typeof FEED_SCHEDULES)[number];\n\nexport type CollectionFieldType =\n  | \"string\"\n  | \"text\"\n  | \"email\"\n  | \"number\"\n  | \"date\"\n  | \"datetime\"\n  | \"boolean\"\n  | \"markdown\"\n  | \"ref\"\n  | \"money\"\n  | \"enum\"\n  | \"table\"\n  | \"derived\"\n  | \"embed\"\n  // Holds a workspace-relative image path (e.g. a `data/attachments/...`\n  // upload); rendered as an <img> in the detail view (not the list table —\n  // a per-row fetch is too expensive at scale). Stored and edited as a\n  // plain string.\n  | \"image\"\n  // Holds a workspace-relative file path as a plain string (e.g. an\n  // `artifacts/html/<name>.html` app). Rendered as a clickable link in\n  // both the list table and the detail view: HTML / SVG artifacts open\n  // their rendered form in a new tab; any other path opens in the File\n  // Explorer. Stored and edited as a plain string, like `image`.\n  | \"file\"\n  // A checkbox that is a pure PROJECTION of an `enum` field — it stores\n  // nothing of its own. Checked when the enum equals `onValue`; toggling\n  // writes `onValue` / `offValue` back to that enum field. Lets a \"done\"\n  // checkbox front a kanban `status` field with the enum as the single\n  // source of truth (no separate stored boolean to keep in sync).\n  | \"toggle\";\n\n// \"feed\" collections live in the non-skill `<workspace>/feeds/` registry\n// and carry an `ingest` block; they reuse the same storage + rendering\n// as skill-backed collections but are never loaded into the agent prompt.\nexport type CollectionSource = \"user\" | \"project\" | \"feed\";\n\n/** Recurrence unit for a `spawn.every` advance. */\nexport type CollectionRecurUnit = \"day\" | \"week\" | \"month\" | \"year\";\n\n/** How a `spawn` advances the source item's `triggerField` date to\n *  produce the successor's. All arithmetic is done on the civil\n *  (year, month, day) triple — never by adding milliseconds — so month\n *  lengths and leap years are handled correctly. */\nexport interface CollectionEvery {\n  unit: CollectionRecurUnit;\n  /** Number of `unit`s to advance (≥ 1). `interval: 3` + `unit: \"month\"`\n   *  = quarterly; `interval: 1` + `unit: \"year\"` = annual. */\n  interval: number;\n  /** Day-of-month anchor for `month`/`year` units. The CANONICAL day —\n   *  read from the rule, never re-derived from the prior concrete date,\n   *  so \"31st of every month\" yields 31 → 28/29 → 31 → 30 … with no\n   *  drift (it is clamped per-month at compute time, not stored\n   *  clamped). `\"last\"` always means the last day of the target month.\n   *  Omitted ⇒ preserve the source date's day (safe for days ≤ 28).\n   *  Ignored for `day`/`week` units. */\n  dayOfMonth?: number | \"last\";\n}\n\n/** Field-driven recurrence: the advance interval is selected PER RECORD by\n *  the value of an `enum` field (`fromField`), looked up in `map`. Lets one\n *  collection mix daily / weekly / monthly obligations in a single list — the\n *  host reads `record[fromField]`, finds the matching `CollectionEvery`, and\n *  advances by it. `fromField` must point at a top-level `enum` field whose\n *  `values` the `map` keys exactly cover (validated at discovery), and must\n *  itself be carried/`set` onto the successor so the chain keeps recurring. */\nexport interface CollectionEveryFieldDriven {\n  /** Top-level `enum` field whose value selects the interval. */\n  fromField: string;\n  /** Interval per enum value. Keys exactly cover `fromField`'s `values`;\n   *  each value is a literal {@link CollectionEvery}. */\n  map: Record<string, CollectionEvery>;\n}\n\n/** The `every` of a `spawn`: either a single literal interval applied to\n *  every record, or a per-record interval selected by an `enum` field. The\n *  literal arm is what `advanceTriggerDate` consumes — the field-driven arm\n *  is resolved down to one of its `map` values before the date math runs. */\nexport type CollectionSpawnEvery = CollectionEvery | CollectionEveryFieldDriven;\n\n/** Narrowing guard: true when `every` is the field-driven arm. */\nexport function isFieldDrivenEvery(every: CollectionSpawnEvery): every is CollectionEveryFieldDriven {\n  return \"fromField\" in every;\n}\n\n/** Host-driven recurrence: when a record satisfies `when`, the host\n *  creates the next record with a forward-advanced `triggerField` date.\n *  The successor's id and contents are a pure function of (source\n *  record, this rule); creation is create-if-absent, so the mechanism\n *  stays convergent — observing the predicate N times writes one\n *  successor. Requires the schema to declare `triggerField`. */\nexport interface CollectionSpawn {\n  /** Predicate that fires the spawn (a `CollectionWhen`). Defaults to\n   *  \"`completionField` value ∈ `completionDoneValues`\" (i.e. spawn the\n   *  next instance when this one is done). */\n  when?: CollectionWhen;\n  /** How to advance `triggerField` from the source to the successor —\n   *  either a single literal interval or a per-record, field-driven map. */\n  every: CollectionSpawnEvery;\n  /** Record fields copied verbatim onto the successor. Fields not listed\n   *  here, not in `set`, and not the trigger / primary keys start\n   *  blank. */\n  carry?: string[];\n  /** Fields forced to fixed values on the successor (typically resetting\n   *  the status field to its pending value). */\n  set?: Record<string, unknown>;\n}\n\n/** The kind of work an action kicks off. v1 ships only `\"chat\"` —\n *  start a new chat in a role with a templated seed prompt. The enum\n *  reserves room for a future `\"mutate\"` (status transitions) without\n *  another schema-shape change. */\nexport type CollectionActionKind = \"chat\";\n\n/** Optional visibility predicate: the target (an action button or a\n *  field) renders only when the open record's `field` (stringified) is\n *  one of `in`. Generic and domain-free — the host evaluates it against\n *  the record with no knowledge of what the field means. Absent ⇒\n *  always shown. */\nexport interface CollectionWhen {\n  /** Top-level record field key whose value gates visibility. */\n  field: string;\n  /** Allowed values; the target shows when `String(record[field])` is\n   *  one of these. Non-empty. */\n  in: string[];\n}\n\n/** @deprecated Name retained for back-compat; use {@link CollectionWhen}.\n *  Both actions and fields share the same predicate shape. */\nexport type CollectionActionWhen = CollectionWhen;\n\n/** What a custom view's capability token is allowed to do against the\n *  collection's data endpoint. `read` returns enriched records (getItems\n *  semantics); `write` validates-and-stores rows (putItems semantics).\n *  There is deliberately no `delete` — a view can never do more than the\n *  agent's own `manageCollection` tool. */\nexport type CollectionViewCapability = \"read\" | \"write\";\n\n/** A custom (LLM-authored) HTML view for a collection. The host renders\n *  `file` in a sandboxed iframe over the collection's records; the view\n *  reaches its data only through a slug- and capability-scoped token (see\n *  `server/api/auth/viewToken.ts`). Pure data — the host holds no\n *  view-specific code; meaning lives in the HTML file + this registration. */\nexport interface CollectionCustomView {\n  /** Stable id; the view-mode selector key (`custom:<id>`) and the\n   *  capability-token clamp key. Must be a valid slug. */\n  id: string;\n  /** Button label in the view-mode selector (author-authored, like field\n   *  labels — not run through i18n). */\n  label: string;\n  /** Optional Material-icon name for the selector button. */\n  icon?: string;\n  /** Skill-relative path to the HTML file under `views/` (e.g.\n   *  `views/year.html`). Path-safe, must end in `.html`. */\n  file: string;\n  /** Optional skill-relative path to a JSON translation dictionary co-located\n   *  with the view (e.g. `views/year.i18n.json`). Shape mirrors **vue-i18n\n   *  locale messages** so an author can lift their app's locale JSON\n   *  verbatim:\n   *\n   *  ```json\n   *  { \"en\": { \"next\": \"Next\", \"hello\": \"Hello, {name}\" },\n   *    \"ja\": { \"next\": \"次へ\", \"hello\": \"{name} さん、こんにちは\" } }\n   *  ```\n   *\n   *  The host picks the block matching the active app locale (fallback\n   *  `\"en\"`, else `{}`) and injects ONLY that flat string map into\n   *  `window.__MC_VIEW.dict`. The iframe-side helper\n   *  `__MC_VIEW.t(key, named?)` mirrors vue-i18n's `t('msg', { name: 'x' })`\n   *  signature — named-interpolation only (no pluralization / linked\n   *  messages in v1; shipping vue-i18n's full runtime into every sandboxed\n   *  iframe would dominate page weight). The view never sees other locales'\n   *  strings. Constrained to `views/*.i18n.json` so authors keep the\n   *  translation file next to the HTML it translates. Absent ⇒ host-side\n   *  no-op (an i18n-less view keeps working; `t(key)` echoes the key). */\n  i18n?: string;\n  /** What the view may do with the data endpoint. Defaults to `[\"read\"]`\n   *  (least privilege); declare `[\"read\",\"write\"]` only for views that\n   *  edit records. The mint endpoint clamps any requested caps to this. */\n  capabilities?: CollectionViewCapability[];\n  /** Where the view runs. Absent ⇒ `\"desktop\"` (this token/dataUrl contract).\n   *  `\"mobile\"` ⇒ a remote view for the phone client: served through the\n   *  command channel's `getRemoteView` over the postMessage contract\n   *  (`@mulmoclaude/core/remote-view` — no token, `connect-src 'none'`) and\n   *  previewed on desktop inside a phone-sized frame. */\n  target?: \"desktop\" | \"mobile\";\n  /** **Mobile-only** (ignored for desktop views, which use token-scoped\n   *  `capabilities`). The whitelist of field names a `target: \"mobile\"` view\n   *  may patch via `__MC_VIEW.updateItem(id, patch)`. Default-deny: absent or\n   *  empty ⇒ updates are refused host-side. Never include the primary key.\n   *  See plans/feat-remote-writable-view.md. */\n  editableFields?: string[];\n  /** **Mobile-only.** When `true`, a `target: \"mobile\"` view may remove a\n   *  record via `__MC_VIEW.deleteItem(id)`. Absent/`false` ⇒ deletes refused. */\n  allowDelete?: boolean;\n}\n\n/** A schema-declared, per-record action rendered as a button in the\n *  read-only detail view. Pure UI/behaviour directive — never stored,\n *  never validated against record data. All domain specifics (label,\n *  role, template) live here in the schema / skill folder, so the host\n *  stays generic. */\nexport interface CollectionAction {\n  /** Stable id (used in the dispatch route + testids). */\n  id: string;\n  /** Button text (English, like field labels). */\n  label: string;\n  /** Material-icon name shown on the button. */\n  icon?: string;\n  /** What the action does. v1: `\"chat\"`. */\n  kind: CollectionActionKind;\n  /** `kind: \"chat\"`: the role id the new chat runs in. */\n  role: string;\n  /** `kind: \"chat\"`: skill-relative path to the template file whose\n   *  text becomes the seed prompt body (e.g. `templates/invoice.md`). */\n  template: string;\n  /** Optional visibility predicate; the button renders only when the\n   *  open record matches (see CollectionWhen). Absent ⇒ always\n   *  shown. */\n  when?: CollectionWhen;\n}\n\nexport interface CollectionFieldSpec {\n  type: CollectionFieldType;\n  label: string;\n  /** True for the field whose value is the record's filename (no\n   *  separate auto-id). Exactly one field per schema may set this. */\n  primary?: boolean;\n  required?: boolean;\n  /** When `type === \"ref\"` or `type === \"embed\"`: the slug of the\n   *  target collection. For `ref` the record stores the target\n   *  item's primary-key slug and the host renders a clickable link\n   *  + dropdown picker. For `embed` the host pulls a *fixed* record\n   *  (see `id`) from the target and renders its fields read-only in\n   *  the detail view. Required for both; ignored on every other\n   *  type. */\n  to?: string;\n  /** When `type === \"embed\"`: the primary-key value of the fixed\n   *  record to pull from the `to` collection (e.g. `me` for the\n   *  singleton mc-profile). Nothing is stored on this record — the\n   *  embed is a display-only directive resolved at render time, so\n   *  it never appears in the list table or the edit form. Supply\n   *  either this (a fixed target, same for every record) or\n   *  `idField` (a per-record target) — exactly one. Ignored on every\n   *  other type. */\n  id?: string;\n  /** When `type === \"embed\"`: the name of a sibling top-level field\n   *  whose value names the target record's primary key — letting the\n   *  embed point at a *different* record per row (e.g. an invoice's\n   *  `issuerId` ref selects which `profile` to embed as the\n   *  bill-from block). The renderer reads `record[idField]` at render\n   *  time; an absent/empty value resolves to \"no record\" (the same\n   *  fail-soft as a missing fixed `id`). Mutually exclusive with `id`\n   *  — an embed must declare exactly one. Ignored on every other type. */\n  idField?: string;\n  /** When `type === \"money\"` (or `type === \"derived\"` with\n   *  `display: \"money\"`): a literal ISO 4217 currency code passed to\n   *  `Intl.NumberFormat` for display — fixed for every record. The\n   *  stored value is always a plain decimal number; currency is\n   *  presentation only. Mutually substitutable with `currencyField`:\n   *  a money field must declare at least one of the two. */\n  currency?: string;\n  /** When `type === \"money\"` (or `type === \"derived\"` with\n   *  `display: \"money\"`): the name of a sibling record field whose\n   *  value holds the ISO 4217 code, letting currency vary per record\n   *  (e.g. an invoice's `currency` enum). The renderer reads\n   *  `record[currencyField]` and falls back to the literal `currency`\n   *  (then \"USD\") when the field is absent or empty. Resolved against\n   *  the top-level record even for money sub-fields inside a table. */\n  currencyField?: string;\n  /** When `type === \"enum\"`: the closed set of allowed string\n   *  values. The form renders a `<select>` populated from this\n   *  list; storage is a plain string. Required when type is\n   *  `enum`; ignored on every other type. */\n  values?: readonly string[];\n  /** When `type === \"table\"`: the sub-schema for each row (a flat\n   *  record of non-table / non-derived field specs). Required when\n   *  type is `table`. v0 disallows nested tables and derived\n   *  columns to keep the editor + evaluator simple. */\n  of?: Record<string, CollectionFieldSpec>;\n  /** When `type === \"derived\"`: a tiny expression evaluated against\n   *  the record. Supports `+ - * /`, parens, identifier refs to\n   *  top-level fields, `sum(tableField[].col)`, and\n   *  `sum(tableField[].col * tableField[].col)`. See\n   *  `src/utils/collections/derivedFormula.ts`. Required when type\n   *  is `derived`. */\n  formula?: string;\n  /** When `type === \"derived\"`: an inner field type the computed\n   *  value should be rendered as (e.g. `\"money\"` so $1,234.56 is\n   *  formatted). Defaults to `\"number\"`. */\n  display?: CollectionFieldType;\n  /** Optional visibility predicate: this field renders only when the\n   *  record matches (e.g. hide a `rating` field until `visited` is\n   *  `true` via `{ field: \"visited\", in: [\"true\"] }`). Applies to the\n   *  list cell (blank when hidden), the edit form (hidden live as the\n   *  gating field changes), and the detail view. Purely presentational\n   *  — a hidden field's stored value is never cleared. `when.field`\n   *  must name another top-level field. Absent ⇒ always shown. Only\n   *  honoured on top-level fields, not inside a `table`'s `of`. */\n  when?: CollectionWhen;\n  /** When `type === \"toggle\"`: the name of the top-level `enum` field this\n   *  checkbox projects. The toggle stores nothing itself — it reads and\n   *  writes this field. Required when type is `toggle`; ignored otherwise.\n   *  Must name a real `enum` field. */\n  field?: string;\n  /** When `type === \"toggle\"`: the enum value that means \"checked\". The\n   *  box is checked when the projected `field` equals this; checking writes\n   *  it. Required when type is `toggle`; must be one of the enum's `values`. */\n  onValue?: string;\n  /** When `type === \"toggle\"`: the enum value written when the box is\n   *  unchecked. Required when type is `toggle`; must be one of the enum's\n   *  `values`. */\n  offValue?: string;\n}\n\nexport interface CollectionSchema {\n  /** Human-facing collection name (sidebar, header). */\n  title: string;\n  /** Material-icon name shown next to the title. */\n  icon: string;\n  /** Workspace-relative folder holding one-JSON-per-record. Validated\n   *  to live under the workspace root at load time. */\n  dataPath: string;\n  /** Field name whose value doubles as the record's filename. */\n  primaryKey: string;\n  /** When set, the collection is a singleton: at most one record,\n   *  whose primary key is fixed to this value (e.g. `me` for the\n   *  business profile). The host pre-fills + locks the create form's\n   *  primary key and hides Add once the record exists. */\n  singleton?: string;\n  /** Ordered map: insertion order = column order in the table view. */\n  fields: Record<string, CollectionFieldSpec>;\n  /** Optional per-record actions rendered as buttons in the detail\n   *  view (e.g. \"Generate PDF\"). Order = button order. */\n  actions?: CollectionAction[];\n  /** Optional collection-level actions rendered as buttons in the\n   *  collection header (e.g. \"Extend the course\"). Unlike `actions`,\n   *  these carry no record context: the seed prompt injects a compact\n   *  progress summary of every record instead. The `when` predicate is\n   *  not evaluated (there is no record to gate on). Order = button order. */\n  collectionActions?: CollectionAction[];\n  /** Name of the field whose value marks an item as \"done\". When set,\n   *  a notification fires on item create (unless the item is born done)\n   *  and clears when the field's value transitions into\n   *  `completionDoneValues`. Must name a real field in `fields`. */\n  completionField?: string;\n  /** The set of values for `completionField` that count as \"done\"\n   *  (e.g. `[\"Done\"]` for a todo status field, `[\"paid\"]` for an\n   *  invoice). Non-empty. Compared as strings. */\n  completionDoneValues?: readonly string[];\n  /** Name of the field whose value is shown as the human-readable\n   *  label in a completion notification's title (e.g. a `name` field,\n   *  so the bell reads `Contacts: Jane Doe` instead of the opaque\n   *  primaryKey). Must name a real field in `fields`. When unset — or\n   *  when the record's value for it is empty — the title falls back to\n   *  the record's primaryKey value. Display-only; never stored. */\n  displayField?: string;\n  /** Name of a `date` field that gates this item's completion\n   *  notification: the bell is suppressed until the clock reaches that\n   *  date (compared at day-granularity in the server's local timezone),\n   *  instead of firing on create. Requires `completionField` /\n   *  `completionDoneValues` (the bell still clears via the done value).\n   *  Must name a real `date` field. Absent ⇒ fire on create, as before. */\n  triggerField?: string;\n  /** Lead time in whole days: fire the bell this many days BEFORE\n   *  `triggerField` (so `10` shows the reminder 10 days early). The lead\n   *  is applied at fire time, not stored, so it composes with `spawn` —\n   *  every recurred cycle fires the same number of days before its own\n   *  trigger. Non-negative integer; requires `triggerField`. Default 0\n   *  (fire on the trigger date). */\n  triggerLeadDays?: number;\n  /** Host-driven recurrence. When set, requires `triggerField`. See\n   *  {@link CollectionSpawn}. */\n  spawn?: CollectionSpawn;\n  /** Name of a `date` field that anchors the optional calendar view: a\n   *  month grid where each record lands on the day cell matching this\n   *  field's value. When unset, the calendar toggle still appears if the\n   *  schema has any `date` field (the first one, in declaration order, is\n   *  used by default and is switchable in-view). Set this to pin a specific\n   *  anchor. Must name a real `date` field. */\n  calendarField?: string;\n  /** Name of a second `date` field marking the END of a multi-day span on\n   *  the calendar: the record renders from `calendarField` through this\n   *  date inclusive. Requires `calendarField`. Must name a real `date`\n   *  field. Absent ⇒ single-day placement. */\n  calendarEndField?: string;\n  /** Name of a string field holding a free-form time or time-range\n   *  (e.g. \"14:00-17:00\", \"17:00-\", \"16:30\") that places records on the\n   *  calendar's day (time-allocation) view. Consulted only when the calendar\n   *  date fields are date-only. Requires `calendarField`. */\n  calendarTimeField?: string;\n  /** Name of an `enum` field that groups records into columns on the\n   *  optional Kanban board: each record lands in the column matching its\n   *  value, with empty/unknown values collected in an \"Uncategorized\"\n   *  column. When unset, the Kanban toggle still appears if the schema has\n   *  any `enum` field (the first one, in declaration order, is used by\n   *  default and is switchable in-view). Set this to pin a specific group\n   *  field. Must name a real `enum` field. */\n  kanbanField?: string;\n  /** Optional custom (LLM-authored) HTML views, each rendered in a\n   *  sandboxed iframe over the records. Absent ⇒ only the built-in\n   *  field-derived views (table / calendar / kanban / dashboard). See\n   *  {@link CollectionCustomView}. */\n  views?: CollectionCustomView[];\n  /** Optional predicate that gates the completion bell: when set, the bell\n   *  fires only for records whose `String(record[notifyWhen.field])` is one\n   *  of `notifyWhen.in` (e.g. notify only `high`/`urgent` priority todos).\n   *  Reuses the `when` predicate shape. Requires `completionField` — it\n   *  narrows that bell rather than introducing a second one. The bell still\n   *  clears on done / delete / when the predicate stops matching. Absent ⇒\n   *  notify for every open record (the prior behaviour). `notifyWhen.field`\n   *  must name a real top-level field. */\n  notifyWhen?: CollectionWhen;\n  /** Optional scheduled-retrieval config. When present, the host refreshes\n   *  this collection on `ingest.schedule`. Two flavours: a declarative Feed\n   *  (`kind: rss/atom/http-json`) periodically fetches `ingest.url`, maps the\n   *  response into records, and upserts them by `primaryKey` — only feeds\n   *  discovered from the `<workspace>/feeds/` registry carry this. Or\n   *  `kind: \"agent\"`, valid on any (incl. skill-backed) collection: the host\n   *  dispatches a hidden background worker in `ingest.role` seeded with\n   *  `ingest.template`, and the worker edits the records itself. The host's\n   *  feeds subsystem narrows this to its richer `IngestSpec`. */\n  ingest?: CollectionIngest;\n}\n\nexport interface CollectionSummary {\n  slug: string;\n  title: string;\n  icon: string;\n  source: CollectionSource;\n}\n\nexport interface CollectionDetail extends CollectionSummary {\n  schema: CollectionSchema;\n}\n\nexport type CollectionItem = Record<string, unknown>;\n\n/** Resolve an `embed` field's target record id: the fixed `id`, or the value\n *  of the sibling `idField` on this record (empty string when neither applies\n *  — the caller renders that as \"no record\"). Pure + isomorphic so the server\n *  projection (`derive.ts`) and the client preview (`useCollectionRendering`)\n *  resolve embeds identically. */\nexport function embedTargetId(field: CollectionFieldSpec, record: CollectionItem | null): string {\n  if (field.id) return field.id;\n  if (field.idField && record) return String(record[field.idField] ?? \"\");\n  return \"\";\n}\n","// Tiny expression evaluator for the `derived` field type on\n// schema-driven collections (see plans/done/feat-mc-invoice.md).\n//\n// Grammar (recursive-descent, no precedence climbing — six\n// non-terminals total):\n//\n//   expr   := term (('+' | '-') term)*\n//   term   := factor (('*' | '/') factor)*\n//   factor := number | sumCall | refAccess | identifier | '(' expr ')'\n//   sumCall:= 'sum' '(' sumArg ')'\n//   sumArg := tableCol (('*' | '/') tableCol)*      // e.g. lineItems[].quantity * lineItems[].rate\n//   tableCol := identifier '[]' '.' identifier\n//   refAccess := identifier '.' identifier          // e.g. ticker.price — deref a ref field into its target record\n//\n// `identifier` accepts top-level field names (single segment).\n// Inside `sumArg`, identifiers are the `<table>[].col` form.\n// A two-segment `<field>.<col>` at factor level is a *ref deref*:\n// `<field>` must be a `ref`-typed field on this record (its stored\n// value is the target item's slug), and `<col>` is a numeric column\n// read from that target record. The caller resolves the target into\n// `ctx.refs` (it owns the schema + the loaded target collection);\n// the evaluator stays pure and never does I/O.\n//\n// What's deliberately NOT supported (and would parse-error rather\n// than silently misbehave):\n//   - String literals, boolean operators, comparisons, conditionals\n//   - Nested function calls beyond `sum(...)`\n//   - Anything in the record that isn't a number / table-of-objects\n//\n// All evaluation is pure — no eval(), no Function constructor.\n// Returns `null` on any failure (parse error, unbound identifier,\n// non-finite arithmetic). The caller renders `null` as em-dash in\n// the table cell + form display.\n\nexport interface FormulaContext {\n  /** The record being evaluated. For derived fields in the form,\n   *  this is the live draft (text + table both converted via the\n   *  same `draftToRecord` pipeline). For the main table cell,\n   *  this is the persisted item. */\n  record: Record<string, unknown>;\n  /** Resolved ref-target records for THIS row, keyed by the local\n   *  `ref` field name. The caller (which has the schema + the linked\n   *  collection's items loaded) maps each ref field's stored slug to\n   *  the full target record and passes it here, so a `<field>.<col>`\n   *  formula can read a numeric column off the referenced record\n   *  (e.g. `shares * ticker.price`). A missing key or `null` value\n   *  (unknown field / dangling slug) makes that deref evaluate to\n   *  NaN → the whole formula returns `null` → em-dash, consistent\n   *  with every other failure mode. Absent ⇒ no refs available. */\n  refs?: Record<string, Record<string, unknown> | null>;\n}\n\nexport function evaluateDerived(formula: string, ctx: FormulaContext): number | null {\n  let tokens: Token[];\n  try {\n    tokens = tokenize(formula);\n  } catch {\n    return null;\n  }\n  // eslint-disable-next-line @typescript-eslint/no-use-before-define -- Parser class is defined later in the file (grouped with its AST + evaluator); evaluateDerived runs after module init so the TDZ concern doesn't apply.\n  const parser = new Parser(tokens);\n  let ast: Node;\n  try {\n    ast = parser.parseExpr();\n    if (!parser.atEnd()) return null; // trailing junk\n  } catch {\n    return null;\n  }\n  const value = evaluate(ast, ctx);\n  return Number.isFinite(value) ? value : null;\n}\n\n// ─── Tokens ────────────────────────────────────────────────\n\ntype TokenKind = \"number\" | \"ident\" | \"(\" | \")\" | \"+\" | \"-\" | \"*\" | \"/\" | \"[]\" | \".\";\n\ninterface Token {\n  kind: TokenKind;\n  value?: string | number;\n}\n\nconst SINGLE_CHAR_PUNCT = new Set<TokenKind>([\"(\", \")\", \"+\", \"-\", \"*\", \"/\", \".\"]);\n\ninterface Cursor {\n  input: string;\n  index: number;\n}\n\nfunction consumeWhitespace(cur: Cursor): boolean {\n  const char = cur.input[cur.index];\n  if (char === \" \" || char === \"\\t\" || char === \"\\n\") {\n    cur.index++;\n    return true;\n  }\n  return false;\n}\n\nfunction consumeNumber(cur: Cursor): Token | null {\n  const char = cur.input[cur.index] ?? \"\";\n  const next = cur.input[cur.index + 1] ?? \"\";\n  if (!isDigit(char) && !(char === \".\" && isDigit(next))) return null;\n  let raw = \"\";\n  while (cur.index < cur.input.length) {\n    const here = cur.input[cur.index] ?? \"\";\n    if (!isDigit(here) && here !== \".\") break;\n    raw += here;\n    cur.index++;\n  }\n  const num = Number(raw);\n  if (!Number.isFinite(num)) throw new Error(\"bad number\");\n  return { kind: \"number\", value: num };\n}\n\nfunction consumeIdent(cur: Cursor): Token | null {\n  const char = cur.input[cur.index] ?? \"\";\n  if (!isIdentStart(char)) return null;\n  let raw = \"\";\n  while (cur.index < cur.input.length && isIdentChar(cur.input[cur.index] ?? \"\")) {\n    raw += cur.input[cur.index];\n    cur.index++;\n  }\n  return { kind: \"ident\", value: raw };\n}\n\nfunction consumePunct(cur: Cursor): Token | null {\n  const char = cur.input[cur.index] ?? \"\";\n  if (char === \"[\" && cur.input[cur.index + 1] === \"]\") {\n    cur.index += 2;\n    return { kind: \"[]\" };\n  }\n  if (SINGLE_CHAR_PUNCT.has(char as TokenKind)) {\n    cur.index++;\n    return { kind: char as TokenKind };\n  }\n  return null;\n}\n\nfunction tokenize(input: string): Token[] {\n  const tokens: Token[] = [];\n  const cur: Cursor = { input, index: 0 };\n  while (cur.index < input.length) {\n    if (consumeWhitespace(cur)) continue;\n    // Number FIRST so a leading-dot literal (`.25`) isn't split by\n    // the `.` punctuation branch.\n    const numTok = consumeNumber(cur);\n    if (numTok) {\n      tokens.push(numTok);\n      continue;\n    }\n    const punctTok = consumePunct(cur);\n    if (punctTok) {\n      tokens.push(punctTok);\n      continue;\n    }\n    const identTok = consumeIdent(cur);\n    if (identTok) {\n      tokens.push(identTok);\n      continue;\n    }\n    throw new Error(`unexpected char ${input[cur.index]}`);\n  }\n  return tokens;\n}\n\nfunction isDigit(char: string): boolean {\n  return char >= \"0\" && char <= \"9\";\n}\nfunction isIdentStart(char: string): boolean {\n  return (char >= \"a\" && char <= \"z\") || (char >= \"A\" && char <= \"Z\") || char === \"_\";\n}\nfunction isIdentChar(char: string): boolean {\n  return isIdentStart(char) || isDigit(char);\n}\n\n// ─── AST + Parser ───────────────────────────────────────────\n\ntype Node =\n  | { kind: \"num\"; value: number }\n  | { kind: \"ident\"; name: string }\n  | { kind: \"ref\"; field: string; col: string }\n  | { kind: \"binop\"; operator: \"+\" | \"-\" | \"*\" | \"/\"; left: Node; right: Node }\n  | { kind: \"sum\"; arg: SumArg };\n\ninterface SumArg {\n  // factors multiplied/divided together; each is a (tableName, colName) ref into a row.\n  factors: { table: string; col: string }[];\n  /** Operators between factors: length = factors.length - 1; each\n   *  is \"*\" or \"/\". For a single-factor sum (`sum(lineItems[].amount)`)\n   *  this is empty. */\n  operators: (\"*\" | \"/\")[];\n}\n\nclass Parser {\n  private cursor = 0;\n  constructor(private readonly tokens: Token[]) {}\n\n  atEnd(): boolean {\n    return this.cursor >= this.tokens.length;\n  }\n  private peek(): Token | undefined {\n    return this.tokens[this.cursor];\n  }\n  private consume(): Token {\n    const tok = this.tokens[this.cursor++];\n    if (!tok) throw new Error(\"unexpected end of input\");\n    return tok;\n  }\n  private expect(kind: TokenKind): Token {\n    const tok = this.consume();\n    if (tok.kind !== kind) throw new Error(`expected ${kind}, got ${tok.kind}`);\n    return tok;\n  }\n\n  parseExpr(): Node {\n    let left = this.parseTerm();\n    while (this.peek()?.kind === \"+\" || this.peek()?.kind === \"-\") {\n      const operator = this.consume().kind as \"+\" | \"-\";\n      const right = this.parseTerm();\n      left = { kind: \"binop\", operator, left, right };\n    }\n    return left;\n  }\n\n  private parseTerm(): Node {\n    let left = this.parseFactor();\n    while (this.peek()?.kind === \"*\" || this.peek()?.kind === \"/\") {\n      const operator = this.consume().kind as \"*\" | \"/\";\n      const right = this.parseFactor();\n      left = { kind: \"binop\", operator, left, right };\n    }\n    return left;\n  }\n\n  private parseFactor(): Node {\n    const tok = this.peek();\n    if (!tok) throw new Error(\"unexpected end in factor\");\n    if (tok.kind === \"number\") {\n      this.consume();\n      return { kind: \"num\", value: tok.value as number };\n    }\n    if (tok.kind === \"(\") {\n      this.consume();\n      const inner = this.parseExpr();\n      this.expect(\")\");\n      return inner;\n    }\n    if (tok.kind === \"ident\") {\n      const name = (tok.value as string) ?? \"\";\n      // sum(...) — only function call we support\n      if (name === \"sum\" && this.tokens[this.cursor + 1]?.kind === \"(\") {\n        this.consume(); // ident\n        this.expect(\"(\");\n        const arg = this.parseSumArg();\n        this.expect(\")\");\n        return { kind: \"sum\", arg };\n      }\n      this.consume(); // ident\n      // ref deref: `<field>.<col>` (e.g. ticker.price). The table-row\n      // form `<table>[].col` only appears inside sum(), so a `.`\n      // immediately after a top-level ident is unambiguously a ref\n      // dereference here.\n      if (this.peek()?.kind === \".\") {\n        this.consume(); // '.'\n        const col = this.expect(\"ident\");\n        return { kind: \"ref\", field: name, col: col.value as string };\n      }\n      return { kind: \"ident\", name };\n    }\n    throw new Error(`unexpected token ${tok.kind} in factor`);\n  }\n\n  private parseSumArg(): SumArg {\n    const factors: { table: string; col: string }[] = [];\n    const operators: (\"*\" | \"/\")[] = [];\n    factors.push(this.parseTableCol());\n    while (this.peek()?.kind === \"*\" || this.peek()?.kind === \"/\") {\n      const operator = this.consume().kind as \"*\" | \"/\";\n      operators.push(operator);\n      factors.push(this.parseTableCol());\n    }\n    return { factors, operators };\n  }\n\n  private parseTableCol(): { table: string; col: string } {\n    const tableTok = this.expect(\"ident\");\n    this.expect(\"[]\");\n    this.expect(\".\");\n    const colTok = this.expect(\"ident\");\n    return { table: tableTok.value as string, col: colTok.value as string };\n  }\n}\n\n// ─── Evaluator ──────────────────────────────────────────────\n\nfunction evaluate(node: Node, ctx: FormulaContext): number {\n  if (node.kind === \"num\") return node.value;\n  if (node.kind === \"ident\") {\n    const raw = ctx.record[node.name];\n    return toFiniteNumber(raw);\n  }\n  if (node.kind === \"ref\") {\n    // `<field>.<col>`: read `col` off the resolved target record the\n    // caller put in ctx.refs. Unknown field / dangling slug → null →\n    // NaN, so the whole formula fails soft to an em-dash.\n    const target = ctx.refs?.[node.field] ?? null;\n    if (!target) return Number.NaN;\n    return toFiniteNumber(target[node.col]);\n  }\n  if (node.kind === \"binop\") {\n    const left = evaluate(node.left, ctx);\n    const right = evaluate(node.right, ctx);\n    return applyBinop(node.operator, left, right);\n  }\n  if (node.kind === \"sum\") {\n    return evaluateSum(node.arg, ctx);\n  }\n  // Exhaustive — TS narrows above branches but throw keeps runtime honest.\n  throw new Error(`unknown node`);\n}\n\nfunction applyBinop(operator: \"+\" | \"-\" | \"*\" | \"/\", left: number, right: number): number {\n  if (!Number.isFinite(left) || !Number.isFinite(right)) return Number.NaN;\n  if (operator === \"+\") return left + right;\n  if (operator === \"-\") return left - right;\n  if (operator === \"*\") return left * right;\n  // operator === \"/\"\n  if (right === 0) return Number.NaN;\n  return left / right;\n}\n\nfunction evaluateSum(arg: SumArg, ctx: FormulaContext): number {\n  if (arg.factors.length === 0) return 0;\n  const tableName = arg.factors[0].table;\n  // All factors must reference the SAME table (you can't multiply\n  // a row from lineItems against a row from another table — the\n  // semantics would be ambiguous). Reject mismatch.\n  for (const factor of arg.factors) {\n    if (factor.table !== tableName) return Number.NaN;\n  }\n  const rows = ctx.record[tableName];\n  if (!Array.isArray(rows)) return 0;\n  let total = 0;\n  for (const row of rows) {\n    if (!row || typeof row !== \"object\") continue;\n    let product = toFiniteNumber((row as Record<string, unknown>)[arg.factors[0].col]);\n    if (!Number.isFinite(product)) return Number.NaN;\n    for (let i = 1; i < arg.factors.length; i++) {\n      const value = toFiniteNumber((row as Record<string, unknown>)[arg.factors[i].col]);\n      if (!Number.isFinite(value)) return Number.NaN;\n      product = applyBinop(arg.operators[i - 1], product, value);\n    }\n    total += product;\n  }\n  return total;\n}\n\nfunction toFiniteNumber(value: unknown): number {\n  if (typeof value === \"number\") return Number.isFinite(value) ? value : Number.NaN;\n  if (typeof value === \"string\" && value.length > 0) {\n    const num = Number(value);\n    return Number.isFinite(num) ? num : Number.NaN;\n  }\n  return Number.NaN;\n}\n","// The derived-field saturation loop for schema-driven collections,\n// extracted from `composables/collections/useCollectionRendering.ts` so\n// the server (manageCollection getItems enrichment) and the client\n// (table cells, form display) evaluate formulas through ONE\n// implementation — if the two ever diverged, the UI and the LLM would\n// disagree on a number. Pure module: no Vue, no I/O.\n//\n// Like `actionVisible.ts`, the input types are minimal structural\n// shapes so both the client `FieldSpec`/`CollectionSchema`\n// (src/components/collectionTypes.ts) and the server\n// `CollectionFieldSpec`/`CollectionSchema`\n// (server/workspace/collections/types.ts) satisfy them as-is.\n\nimport { evaluateDerived, type FormulaContext } from \"./derivedFormula\";\n\n/** Minimal field shape the derive loop needs — accepts both the client\n *  FieldSpec and the server CollectionFieldSpec. */\nexport interface DerivableFieldSpec {\n  type: string;\n  /** When type === \"ref\": slug of the target collection. */\n  to?: string;\n  /** When type === \"derived\": formula evaluated against the record. */\n  formula?: string;\n}\n\n/** Minimal schema shape: just the ordered field map. */\nexport interface DerivableSchema {\n  fields: Record<string, DerivableFieldSpec>;\n}\n\nexport type DerivableRecord = Record<string, unknown>;\n\n/** Per-target-collection cache of loaded referenced records:\n *  target collection slug → item slug → full record. Mirrors the\n *  client's `RefRecordCache` / the server's enrichment loader. */\nexport type DeriveRefRecords = Record<string, Record<string, DerivableRecord>>;\n\n/** Map each `ref` field's stored slug to its loaded target record (or\n *  null when dangling / not loaded), keyed by the LOCAL field name —\n *  the shape `evaluateDerived` reads for `<field>.<col>` derefs. */\nexport function resolveRowRefs(schema: DerivableSchema, record: DerivableRecord, refRecords: DeriveRefRecords): NonNullable<FormulaContext[\"refs\"]> {\n  const refs: NonNullable<FormulaContext[\"refs\"]> = {};\n  for (const [key, field] of Object.entries(schema.fields)) {\n    if (field.type !== \"ref\" || !field.to) continue;\n    const slug = record[key];\n    refs[key] = typeof slug === \"string\" ? (refRecords[field.to]?.[slug] ?? null) : null;\n  }\n  return refs;\n}\n\n/** Evaluate every `derived` field against `base`, saturating so a\n *  derived field can read another derived field computed in an earlier\n *  pass (`subtotal → tax → total` converges in ≤ field-count passes).\n *  Cycles can't loop forever — passes are bounded by the number of\n *  derived fields and the loop breaks as soon as a pass changes\n *  nothing. Failed formulas stay ABSENT (the UI renders them as\n *  em-dash). Returns a copy; `base` is never mutated.\n *\n *  Derived keys already present in `base` are stripped before\n *  evaluation: computed output is host-truth, never persisted-input\n *  fallback. A record JSON can carry a stale (or forged) derived value\n *  — raw Write/Edit, legacy data — and without the strip, a failing\n *  formula would silently surface that value as if the host computed\n *  it. */\nexport function deriveAll(schema: DerivableSchema, base: DerivableRecord, refRecords: DeriveRefRecords): DerivableRecord {\n  const derivedKeys = new Set(Object.keys(schema.fields).filter((key) => schema.fields[key]?.type === \"derived\"));\n  const enriched: DerivableRecord = Object.fromEntries(Object.entries(base).filter(([key]) => !derivedKeys.has(key)));\n  const refs = resolveRowRefs(schema, base, refRecords);\n  const maxPasses = Object.values(schema.fields).filter((field) => field.type === \"derived\").length;\n  for (let pass = 0; pass < maxPasses; pass++) {\n    let mutated = false;\n    for (const [key, field] of Object.entries(schema.fields)) {\n      if (field.type !== \"derived\" || !field.formula) continue;\n      const next = evaluateDerived(field.formula, { record: enriched, refs });\n      if (next !== null && enriched[key] !== next) {\n        enriched[key] = next;\n        mutated = true;\n      }\n    }\n    if (!mutated) break;\n  }\n  return enriched;\n}\n"],"mappings":";;;;;AA6CA,IAAa,eAAe;CAAC;CAAO;CAAQ;AAAW;;;;;;;;AAUvD,IAAa,oBAAoB;;AAIjC,IAAa,iBAAiB;CAAC;CAAU;CAAS;CAAU;AAAW;;AAqFvE,SAAgB,mBAAmB,OAAkE;CACnG,OAAO,eAAe;AACxB;;;;;;AAwWA,SAAgB,cAAc,OAA4B,QAAuC;CAC/F,IAAI,MAAM,IAAI,OAAO,MAAM;CAC3B,IAAI,MAAM,WAAW,QAAQ,OAAO,OAAO,OAAO,MAAM,YAAY,EAAE;CACtE,OAAO;AACT;;;AC1cA,SAAgB,gBAAgB,SAAiB,KAAoC;CACnF,IAAI;CACJ,IAAI;EACF,SAAS,SAAS,OAAO;CAC3B,QAAQ;EACN,OAAO;CACT;CAEA,MAAM,SAAS,IAAI,OAAO,MAAM;CAChC,IAAI;CACJ,IAAI;EACF,MAAM,OAAO,UAAU;EACvB,IAAI,CAAC,OAAO,MAAM,GAAG,OAAO;CAC9B,QAAQ;EACN,OAAO;CACT;CACA,MAAM,QAAQ,SAAS,KAAK,GAAG;CAC/B,OAAO,OAAO,SAAS,KAAK,IAAI,QAAQ;AAC1C;AAWA,IAAM,oCAAoB,IAAI,IAAe;CAAC;CAAK;CAAK;CAAK;CAAK;CAAK;CAAK;AAAG,CAAC;AAOhF,SAAS,kBAAkB,KAAsB;CAC/C,MAAM,OAAO,IAAI,MAAM,IAAI;CAC3B,IAAI,SAAS,OAAO,SAAS,OAAQ,SAAS,MAAM;EAClD,IAAI;EACJ,OAAO;CACT;CACA,OAAO;AACT;AAEA,SAAS,cAAc,KAA2B;CAChD,MAAM,OAAO,IAAI,MAAM,IAAI,UAAU;CACrC,MAAM,OAAO,IAAI,MAAM,IAAI,QAAQ,MAAM;CACzC,IAAI,CAAC,QAAQ,IAAI,KAAK,EAAE,SAAS,OAAO,QAAQ,IAAI,IAAI,OAAO;CAC/D,IAAI,MAAM;CACV,OAAO,IAAI,QAAQ,IAAI,MAAM,QAAQ;EACnC,MAAM,OAAO,IAAI,MAAM,IAAI,UAAU;EACrC,IAAI,CAAC,QAAQ,IAAI,KAAK,SAAS,KAAK;EACpC,OAAO;EACP,IAAI;CACN;CACA,MAAM,MAAM,OAAO,GAAG;CACtB,IAAI,CAAC,OAAO,SAAS,GAAG,GAAG,MAAM,IAAI,MAAM,YAAY;CACvD,OAAO;EAAE,MAAM;EAAU,OAAO;CAAI;AACtC;AAEA,SAAS,aAAa,KAA2B;CAE/C,IAAI,CAAC,aADQ,IAAI,MAAM,IAAI,UAAU,EACf,GAAG,OAAO;CAChC,IAAI,MAAM;CACV,OAAO,IAAI,QAAQ,IAAI,MAAM,UAAU,YAAY,IAAI,MAAM,IAAI,UAAU,EAAE,GAAG;EAC9E,OAAO,IAAI,MAAM,IAAI;EACrB,IAAI;CACN;CACA,OAAO;EAAE,MAAM;EAAS,OAAO;CAAI;AACrC;AAEA,SAAS,aAAa,KAA2B;CAC/C,MAAM,OAAO,IAAI,MAAM,IAAI,UAAU;CACrC,IAAI,SAAS,OAAO,IAAI,MAAM,IAAI,QAAQ,OAAO,KAAK;EACpD,IAAI,SAAS;EACb,OAAO,EAAE,MAAM,KAAK;CACtB;CACA,IAAI,kBAAkB,IAAI,IAAiB,GAAG;EAC5C,IAAI;EACJ,OAAO,EAAE,MAAM,KAAkB;CACnC;CACA,OAAO;AACT;AAEA,SAAS,SAAS,OAAwB;CACxC,MAAM,SAAkB,CAAC;CACzB,MAAM,MAAc;EAAE;EAAO,OAAO;CAAE;CACtC,OAAO,IAAI,QAAQ,MAAM,QAAQ;EAC/B,IAAI,kBAAkB,GAAG,GAAG;EAG5B,MAAM,SAAS,cAAc,GAAG;EAChC,IAAI,QAAQ;GACV,OAAO,KAAK,MAAM;GAClB;EACF;EACA,MAAM,WAAW,aAAa,GAAG;EACjC,IAAI,UAAU;GACZ,OAAO,KAAK,QAAQ;GACpB;EACF;EACA,MAAM,WAAW,aAAa,GAAG;EACjC,IAAI,UAAU;GACZ,OAAO,KAAK,QAAQ;GACpB;EACF;EACA,MAAM,IAAI,MAAM,mBAAmB,MAAM,IAAI,QAAQ;CACvD;CACA,OAAO;AACT;AAEA,SAAS,QAAQ,MAAuB;CACtC,OAAO,QAAQ,OAAO,QAAQ;AAChC;AACA,SAAS,aAAa,MAAuB;CAC3C,OAAQ,QAAQ,OAAO,QAAQ,OAAS,QAAQ,OAAO,QAAQ,OAAQ,SAAS;AAClF;AACA,SAAS,YAAY,MAAuB;CAC1C,OAAO,aAAa,IAAI,KAAK,QAAQ,IAAI;AAC3C;AAoBA,IAAM,SAAN,MAAa;CAEkB;CAD7B,SAAiB;CACjB,YAAY,QAAkC;EAAjB,KAAA,SAAA;CAAkB;CAE/C,QAAiB;EACf,OAAO,KAAK,UAAU,KAAK,OAAO;CACpC;CACA,OAAkC;EAChC,OAAO,KAAK,OAAO,KAAK;CAC1B;CACA,UAAyB;EACvB,MAAM,MAAM,KAAK,OAAO,KAAK;EAC7B,IAAI,CAAC,KAAK,MAAM,IAAI,MAAM,yBAAyB;EACnD,OAAO;CACT;CACA,OAAe,MAAwB;EACrC,MAAM,MAAM,KAAK,QAAQ;EACzB,IAAI,IAAI,SAAS,MAAM,MAAM,IAAI,MAAM,YAAY,KAAK,QAAQ,IAAI,MAAM;EAC1E,OAAO;CACT;CAEA,YAAkB;EAChB,IAAI,OAAO,KAAK,UAAU;EAC1B,OAAO,KAAK,KAAK,CAAC,EAAE,SAAS,OAAO,KAAK,KAAK,CAAC,EAAE,SAAS,KAAK;GAC7D,MAAM,WAAW,KAAK,QAAQ,CAAC,CAAC;GAChC,MAAM,QAAQ,KAAK,UAAU;GAC7B,OAAO;IAAE,MAAM;IAAS;IAAU;IAAM;GAAM;EAChD;EACA,OAAO;CACT;CAEA,YAA0B;EACxB,IAAI,OAAO,KAAK,YAAY;EAC5B,OAAO,KAAK,KAAK,CAAC,EAAE,SAAS,OAAO,KAAK,KAAK,CAAC,EAAE,SAAS,KAAK;GAC7D,MAAM,WAAW,KAAK,QAAQ,CAAC,CAAC;GAChC,MAAM,QAAQ,KAAK,YAAY;GAC/B,OAAO;IAAE,MAAM;IAAS;IAAU;IAAM;GAAM;EAChD;EACA,OAAO;CACT;CAEA,cAA4B;EAC1B,MAAM,MAAM,KAAK,KAAK;EACtB,IAAI,CAAC,KAAK,MAAM,IAAI,MAAM,0BAA0B;EACpD,IAAI,IAAI,SAAS,UAAU;GACzB,KAAK,QAAQ;GACb,OAAO;IAAE,MAAM;IAAO,OAAO,IAAI;GAAgB;EACnD;EACA,IAAI,IAAI,SAAS,KAAK;GACpB,KAAK,QAAQ;GACb,MAAM,QAAQ,KAAK,UAAU;GAC7B,KAAK,OAAO,GAAG;GACf,OAAO;EACT;EACA,IAAI,IAAI,SAAS,SAAS;GACxB,MAAM,OAAQ,IAAI,SAAoB;GAEtC,IAAI,SAAS,SAAS,KAAK,OAAO,KAAK,SAAS,EAAE,EAAE,SAAS,KAAK;IAChE,KAAK,QAAQ;IACb,KAAK,OAAO,GAAG;IACf,MAAM,MAAM,KAAK,YAAY;IAC7B,KAAK,OAAO,GAAG;IACf,OAAO;KAAE,MAAM;KAAO;IAAI;GAC5B;GACA,KAAK,QAAQ;GAKb,IAAI,KAAK,KAAK,CAAC,EAAE,SAAS,KAAK;IAC7B,KAAK,QAAQ;IAEb,OAAO;KAAE,MAAM;KAAO,OAAO;KAAM,KADvB,KAAK,OAAO,OACgB,CAAA,CAAI;IAAgB;GAC9D;GACA,OAAO;IAAE,MAAM;IAAS;GAAK;EAC/B;EACA,MAAM,IAAI,MAAM,oBAAoB,IAAI,KAAK,WAAW;CAC1D;CAEA,cAA8B;EAC5B,MAAM,UAA4C,CAAC;EACnD,MAAM,YAA2B,CAAC;EAClC,QAAQ,KAAK,KAAK,cAAc,CAAC;EACjC,OAAO,KAAK,KAAK,CAAC,EAAE,SAAS,OAAO,KAAK,KAAK,CAAC,EAAE,SAAS,KAAK;GAC7D,MAAM,WAAW,KAAK,QAAQ,CAAC,CAAC;GAChC,UAAU,KAAK,QAAQ;GACvB,QAAQ,KAAK,KAAK,cAAc,CAAC;EACnC;EACA,OAAO;GAAE;GAAS;EAAU;CAC9B;CAEA,gBAAwD;EACtD,MAAM,WAAW,KAAK,OAAO,OAAO;EACpC,KAAK,OAAO,IAAI;EAChB,KAAK,OAAO,GAAG;EACf,MAAM,SAAS,KAAK,OAAO,OAAO;EAClC,OAAO;GAAE,OAAO,SAAS;GAAiB,KAAK,OAAO;EAAgB;CACxE;AACF;AAIA,SAAS,SAAS,MAAY,KAA6B;CACzD,IAAI,KAAK,SAAS,OAAO,OAAO,KAAK;CACrC,IAAI,KAAK,SAAS,SAAS;EACzB,MAAM,MAAM,IAAI,OAAO,KAAK;EAC5B,OAAO,eAAe,GAAG;CAC3B;CACA,IAAI,KAAK,SAAS,OAAO;EAIvB,MAAM,SAAS,IAAI,OAAO,KAAK,UAAU;EACzC,IAAI,CAAC,QAAQ,OAAO;EACpB,OAAO,eAAe,OAAO,KAAK,IAAI;CACxC;CACA,IAAI,KAAK,SAAS,SAAS;EACzB,MAAM,OAAO,SAAS,KAAK,MAAM,GAAG;EACpC,MAAM,QAAQ,SAAS,KAAK,OAAO,GAAG;EACtC,OAAO,WAAW,KAAK,UAAU,MAAM,KAAK;CAC9C;CACA,IAAI,KAAK,SAAS,OAChB,OAAO,YAAY,KAAK,KAAK,GAAG;CAGlC,MAAM,IAAI,MAAM,cAAc;AAChC;AAEA,SAAS,WAAW,UAAiC,MAAc,OAAuB;CACxF,IAAI,CAAC,OAAO,SAAS,IAAI,KAAK,CAAC,OAAO,SAAS,KAAK,GAAG,OAAO;CAC9D,IAAI,aAAa,KAAK,OAAO,OAAO;CACpC,IAAI,aAAa,KAAK,OAAO,OAAO;CACpC,IAAI,aAAa,KAAK,OAAO,OAAO;CAEpC,IAAI,UAAU,GAAG,OAAO;CACxB,OAAO,OAAO;AAChB;AAEA,SAAS,YAAY,KAAa,KAA6B;CAC7D,IAAI,IAAI,QAAQ,WAAW,GAAG,OAAO;CACrC,MAAM,YAAY,IAAI,QAAQ,EAAE,CAAC;CAIjC,KAAK,MAAM,UAAU,IAAI,SACvB,IAAI,OAAO,UAAU,WAAW,OAAO;CAEzC,MAAM,OAAO,IAAI,OAAO;CACxB,IAAI,CAAC,MAAM,QAAQ,IAAI,GAAG,OAAO;CACjC,IAAI,QAAQ;CACZ,KAAK,MAAM,OAAO,MAAM;EACtB,IAAI,CAAC,OAAO,OAAO,QAAQ,UAAU;EACrC,IAAI,UAAU,eAAgB,IAAgC,IAAI,QAAQ,EAAE,CAAC,IAAI;EACjF,IAAI,CAAC,OAAO,SAAS,OAAO,GAAG,OAAO;EACtC,KAAK,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,QAAQ,KAAK;GAC3C,MAAM,QAAQ,eAAgB,IAAgC,IAAI,QAAQ,EAAE,CAAC,IAAI;GACjF,IAAI,CAAC,OAAO,SAAS,KAAK,GAAG,OAAO;GACpC,UAAU,WAAW,IAAI,UAAU,IAAI,IAAI,SAAS,KAAK;EAC3D;EACA,SAAS;CACX;CACA,OAAO;AACT;AAEA,SAAS,eAAe,OAAwB;CAC9C,IAAI,OAAO,UAAU,UAAU,OAAO,OAAO,SAAS,KAAK,IAAI,QAAQ;CACvE,IAAI,OAAO,UAAU,YAAY,MAAM,SAAS,GAAG;EACjD,MAAM,MAAM,OAAO,KAAK;EACxB,OAAO,OAAO,SAAS,GAAG,IAAI,MAAM;CACtC;CACA,OAAO;AACT;;;;;;ACnUA,SAAgB,eAAe,QAAyB,QAAyB,YAAmE;CAClJ,MAAM,OAA4C,CAAC;CACnD,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,MAAM,GAAG;EACxD,IAAI,MAAM,SAAS,SAAS,CAAC,MAAM,IAAI;EACvC,MAAM,OAAO,OAAO;EACpB,KAAK,OAAO,OAAO,SAAS,WAAY,WAAW,MAAM,GAAG,GAAG,SAAS,OAAQ;CAClF;CACA,OAAO;AACT;;;;;;;;;;;;;;;AAgBA,SAAgB,UAAU,QAAyB,MAAuB,YAA+C;CACvH,MAAM,cAAc,IAAI,IAAI,OAAO,KAAK,OAAO,MAAM,CAAC,CAAC,QAAQ,QAAQ,OAAO,OAAO,IAAI,EAAE,SAAS,SAAS,CAAC;CAC9G,MAAM,WAA4B,OAAO,YAAY,OAAO,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,YAAY,IAAI,GAAG,CAAC,CAAC;CAClH,MAAM,OAAO,eAAe,QAAQ,MAAM,UAAU;CACpD,MAAM,YAAY,OAAO,OAAO,OAAO,MAAM,CAAC,CAAC,QAAQ,UAAU,MAAM,SAAS,SAAS,CAAC,CAAC;CAC3F,KAAK,IAAI,OAAO,GAAG,OAAO,WAAW,QAAQ;EAC3C,IAAI,UAAU;EACd,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,MAAM,GAAG;GACxD,IAAI,MAAM,SAAS,aAAa,CAAC,MAAM,SAAS;GAChD,MAAM,OAAO,gBAAgB,MAAM,SAAS;IAAE,QAAQ;IAAU;GAAK,CAAC;GACtE,IAAI,SAAS,QAAQ,SAAS,SAAS,MAAM;IAC3C,SAAS,OAAO;IAChB,UAAU;GACZ;EACF;EACA,IAAI,CAAC,SAAS;CAChB;CACA,OAAO;AACT"}
+{"version":3,"file":"deriveAll-D3wFH4Tw.js","names":[],"sources":["../src/collection/core/schema.ts","../src/collection/core/derivedFormula.ts","../src/collection/core/deriveAll.ts"],"sourcesContent":["// Schema-driven collection types. A \"collection\" is a skill (under\n// .claude/skills/<slug>/) that also ships a sibling `schema.json`.\n// The host's <CollectionView> reads the schema + records and renders\n// a table/form; Claude reads SKILL.md and CRUDs the records as JSON\n// files.\n//\n// Field types for v0 — keep this list narrow and grow it only when a\n// real collection needs the new type. v0 supports flat records only;\n// nested tables / cross-collection refs / derived fields / actions are\n// deferred to follow-ups (see plans/done/feat-skill-driven-apps.md and\n// plans/done/feat-skill-driven-apps-worklog.md — historical names predate\n// the rename).\n\n/** Minimal \"this collection is a feed\" descriptor carried on the schema.\n *  Deliberately narrow — the canonical collection contract stays\n *  independent of the host's feeds subsystem. The host's richer retrieval\n *  spec (`IngestSpec` in `server/workspace/feeds/ingestTypes.ts`)\n *  `extends CollectionIngest`, so feed code reads the extra fields by\n *  typing feed schemas with that subtype; collection rendering only needs\n *  these three + the presence check. */\nexport interface CollectionIngest {\n  kind: string;\n  schedule: string;\n  /** Optional time-of-day anchor for `schedule: \"daily\"` — the hour (0–23) to\n   *  refresh around (the host ticks hourly, so the run lands within that hour).\n   *  Ignored for non-daily schedules. Absent ⇒ elapsed-based daily (\"≥24 h since\n   *  the last run\"). NOTE: **UTC**, not local — compared via `getUTCHours()` for\n   *  an unambiguous, DST-free check (matching the rest of the scheduler), so\n   *  convert local times before writing (e.g. 07:00 JST → `atHour: 22`). */\n  atHour?: number;\n  /** Declarative retrievers (`rss`/`atom`/`http-json`) only — the host fetches\n   *  this URL on the schedule. Absent for `kind: \"agent\"`, where the agent owns\n   *  retrieval. */\n  url?: string;\n  /** `kind: \"agent\"` only: role id the scheduled hidden worker runs in. */\n  role?: string;\n  /** `kind: \"agent\"` only: skill-relative template path (under `templates/`)\n   *  whose prose tells the worker how to refresh the records. */\n  template?: string;\n}\n\n/** Declarative retriever kinds a Feed's `ingest.kind` may declare. The host's\n *  feeds engine dispatches on these; they live here (with the schema contract)\n *  so the schema validator can enforce them. The host re-exports these from\n *  `server/workspace/feeds/ingestTypes.ts`. */\nexport const INGEST_KINDS = [\"rss\", \"atom\", \"http-json\"] as const;\nexport type IngestKind = (typeof INGEST_KINDS)[number];\n\n/** The agent-performed ingest kind. Instead of a declarative fetch, the host\n *  dispatches a hidden background chat (origin `system`) in `ingest.role`,\n *  seeded with `ingest.template` + a summary of every record, on the\n *  `ingest.schedule` cadence; the worker edits records via the collections io\n *  layer. Kept separate from {@link INGEST_KINDS} (which the declarative\n *  retriever registry keys on) so the schema validator can model `ingest` as a\n *  discriminated union without the feeds engine gaining an \"agent\" retriever. */\nexport const AGENT_INGEST_KIND = \"agent\" as const;\nexport type AgentIngestKind = typeof AGENT_INGEST_KIND;\n\n/** Refresh cadences a Feed's `ingest.schedule` may declare. */\nexport const FEED_SCHEDULES = [\"hourly\", \"daily\", \"weekly\", \"on-demand\"] as const;\nexport type FeedSchedule = (typeof FEED_SCHEDULES)[number];\n\nexport type CollectionFieldType =\n  | \"string\"\n  | \"text\"\n  | \"email\"\n  | \"number\"\n  | \"date\"\n  | \"datetime\"\n  | \"boolean\"\n  | \"markdown\"\n  | \"ref\"\n  | \"money\"\n  | \"enum\"\n  | \"table\"\n  | \"derived\"\n  | \"embed\"\n  // Holds a workspace-relative image path (e.g. a `data/attachments/...`\n  // upload); rendered as an <img> in the detail view (not the list table —\n  // a per-row fetch is too expensive at scale). Stored and edited as a\n  // plain string.\n  | \"image\"\n  // Holds a workspace-relative file path as a plain string (e.g. an\n  // `artifacts/html/<name>.html` app). Rendered as a clickable link in\n  // both the list table and the detail view: HTML / SVG artifacts open\n  // their rendered form in a new tab; any other path opens in the File\n  // Explorer. Stored and edited as a plain string, like `image`.\n  | \"file\"\n  // A checkbox that is a pure PROJECTION of an `enum` field — it stores\n  // nothing of its own. Checked when the enum equals `onValue`; toggling\n  // writes `onValue` / `offValue` back to that enum field. Lets a \"done\"\n  // checkbox front a kanban `status` field with the enum as the single\n  // source of truth (no separate stored boolean to keep in sync).\n  | \"toggle\";\n\n// \"feed\" collections live in the non-skill `<workspace>/feeds/` registry\n// and carry an `ingest` block; they reuse the same storage + rendering\n// as skill-backed collections but are never loaded into the agent prompt.\nexport type CollectionSource = \"user\" | \"project\" | \"feed\";\n\n/** Recurrence unit for a `spawn.every` advance. */\nexport type CollectionRecurUnit = \"day\" | \"week\" | \"month\" | \"year\";\n\n/** How a `spawn` advances the source item's `triggerField` date to\n *  produce the successor's. All arithmetic is done on the civil\n *  (year, month, day) triple — never by adding milliseconds — so month\n *  lengths and leap years are handled correctly. */\nexport interface CollectionEvery {\n  unit: CollectionRecurUnit;\n  /** Number of `unit`s to advance (≥ 1). `interval: 3` + `unit: \"month\"`\n   *  = quarterly; `interval: 1` + `unit: \"year\"` = annual. */\n  interval: number;\n  /** Day-of-month anchor for `month`/`year` units. The CANONICAL day —\n   *  read from the rule, never re-derived from the prior concrete date,\n   *  so \"31st of every month\" yields 31 → 28/29 → 31 → 30 … with no\n   *  drift (it is clamped per-month at compute time, not stored\n   *  clamped). `\"last\"` always means the last day of the target month.\n   *  Omitted ⇒ preserve the source date's day (safe for days ≤ 28).\n   *  Ignored for `day`/`week` units. */\n  dayOfMonth?: number | \"last\";\n}\n\n/** Field-driven recurrence: the advance interval is selected PER RECORD by\n *  the value of an `enum` field (`fromField`), looked up in `map`. Lets one\n *  collection mix daily / weekly / monthly obligations in a single list — the\n *  host reads `record[fromField]`, finds the matching `CollectionEvery`, and\n *  advances by it. `fromField` must point at a top-level `enum` field whose\n *  `values` the `map` keys exactly cover (validated at discovery), and must\n *  itself be carried/`set` onto the successor so the chain keeps recurring. */\nexport interface CollectionEveryFieldDriven {\n  /** Top-level `enum` field whose value selects the interval. */\n  fromField: string;\n  /** Interval per enum value. Keys exactly cover `fromField`'s `values`;\n   *  each value is a literal {@link CollectionEvery}. */\n  map: Record<string, CollectionEvery>;\n}\n\n/** The `every` of a `spawn`: either a single literal interval applied to\n *  every record, or a per-record interval selected by an `enum` field. The\n *  literal arm is what `advanceTriggerDate` consumes — the field-driven arm\n *  is resolved down to one of its `map` values before the date math runs. */\nexport type CollectionSpawnEvery = CollectionEvery | CollectionEveryFieldDriven;\n\n/** Narrowing guard: true when `every` is the field-driven arm. */\nexport function isFieldDrivenEvery(every: CollectionSpawnEvery): every is CollectionEveryFieldDriven {\n  return \"fromField\" in every;\n}\n\n/** Host-driven recurrence: when a record satisfies `when`, the host\n *  creates the next record with a forward-advanced `triggerField` date.\n *  The successor's id and contents are a pure function of (source\n *  record, this rule); creation is create-if-absent, so the mechanism\n *  stays convergent — observing the predicate N times writes one\n *  successor. Requires the schema to declare `triggerField`. */\nexport interface CollectionSpawn {\n  /** Predicate that fires the spawn (a `CollectionWhen`). Defaults to\n   *  \"`completionField` value ∈ `completionDoneValues`\" (i.e. spawn the\n   *  next instance when this one is done). */\n  when?: CollectionWhen;\n  /** How to advance `triggerField` from the source to the successor —\n   *  either a single literal interval or a per-record, field-driven map. */\n  every: CollectionSpawnEvery;\n  /** Record fields copied verbatim onto the successor. Fields not listed\n   *  here, not in `set`, and not the trigger / primary keys start\n   *  blank. */\n  carry?: string[];\n  /** Fields forced to fixed values on the successor (typically resetting\n   *  the status field to its pending value). */\n  set?: Record<string, unknown>;\n}\n\n/** The kind of work an action kicks off. v1 ships only `\"chat\"` —\n *  start a new chat in a role with a templated seed prompt. The enum\n *  reserves room for a future `\"mutate\"` (status transitions) without\n *  another schema-shape change. */\nexport type CollectionActionKind = \"chat\";\n\n/** Optional visibility predicate: the target (an action button or a\n *  field) renders only when the open record's `field` (stringified) is\n *  one of `in`. Generic and domain-free — the host evaluates it against\n *  the record with no knowledge of what the field means. Absent ⇒\n *  always shown. */\nexport interface CollectionWhen {\n  /** Top-level record field key whose value gates visibility. */\n  field: string;\n  /** Allowed values; the target shows when `String(record[field])` is\n   *  one of these. Non-empty. */\n  in: string[];\n}\n\n/** @deprecated Name retained for back-compat; use {@link CollectionWhen}.\n *  Both actions and fields share the same predicate shape. */\nexport type CollectionActionWhen = CollectionWhen;\n\n/** What a custom view's capability token is allowed to do against the\n *  collection's data endpoint. `read` returns enriched records (getItems\n *  semantics); `write` validates-and-stores rows (putItems semantics).\n *  There is deliberately no `delete` — a view can never do more than the\n *  agent's own `manageCollection` tool. */\nexport type CollectionViewCapability = \"read\" | \"write\";\n\n/** A custom (LLM-authored) HTML view for a collection. The host renders\n *  `file` in a sandboxed iframe over the collection's records; the view\n *  reaches its data only through a slug- and capability-scoped token (see\n *  `server/api/auth/viewToken.ts`). Pure data — the host holds no\n *  view-specific code; meaning lives in the HTML file + this registration. */\nexport interface CollectionCustomView {\n  /** Stable id; the view-mode selector key (`custom:<id>`) and the\n   *  capability-token clamp key. Must be a valid slug. */\n  id: string;\n  /** Button label in the view-mode selector (author-authored, like field\n   *  labels — not run through i18n). */\n  label: string;\n  /** Optional Material-icon name for the selector button. */\n  icon?: string;\n  /** Skill-relative path to the HTML file under `views/` (e.g.\n   *  `views/year.html`). Path-safe, must end in `.html`. */\n  file: string;\n  /** Optional skill-relative path to a JSON translation dictionary co-located\n   *  with the view (e.g. `views/year.i18n.json`). Shape mirrors **vue-i18n\n   *  locale messages** so an author can lift their app's locale JSON\n   *  verbatim:\n   *\n   *  ```json\n   *  { \"en\": { \"next\": \"Next\", \"hello\": \"Hello, {name}\" },\n   *    \"ja\": { \"next\": \"次へ\", \"hello\": \"{name} さん、こんにちは\" } }\n   *  ```\n   *\n   *  The host picks the block matching the active app locale (fallback\n   *  `\"en\"`, else `{}`) and injects ONLY that flat string map into\n   *  `window.__MC_VIEW.dict`. The iframe-side helper\n   *  `__MC_VIEW.t(key, named?)` mirrors vue-i18n's `t('msg', { name: 'x' })`\n   *  signature — named-interpolation only (no pluralization / linked\n   *  messages in v1; shipping vue-i18n's full runtime into every sandboxed\n   *  iframe would dominate page weight). The view never sees other locales'\n   *  strings. Constrained to `views/*.i18n.json` so authors keep the\n   *  translation file next to the HTML it translates. Absent ⇒ host-side\n   *  no-op (an i18n-less view keeps working; `t(key)` echoes the key). */\n  i18n?: string;\n  /** What the view may do with the data endpoint. Defaults to `[\"read\"]`\n   *  (least privilege); declare `[\"read\",\"write\"]` only for views that\n   *  edit records. The mint endpoint clamps any requested caps to this. */\n  capabilities?: CollectionViewCapability[];\n  /** Where the view runs. Absent ⇒ `\"desktop\"` (this token/dataUrl contract).\n   *  `\"mobile\"` ⇒ a remote view for the phone client: served through the\n   *  command channel's `getRemoteView` over the postMessage contract\n   *  (`@mulmoclaude/core/remote-view` — no token, `connect-src 'none'`) and\n   *  previewed on desktop inside a phone-sized frame. */\n  target?: \"desktop\" | \"mobile\";\n  /** **Mobile-only** (ignored for desktop views, which use token-scoped\n   *  `capabilities`). The whitelist of field names a `target: \"mobile\"` view\n   *  may patch via `__MC_VIEW.updateItem(id, patch)`. Default-deny: absent or\n   *  empty ⇒ updates are refused host-side. Never include the primary key.\n   *  See plans/feat-remote-writable-view.md. */\n  editableFields?: string[];\n  /** **Mobile-only.** When `true`, a `target: \"mobile\"` view may remove a\n   *  record via `__MC_VIEW.deleteItem(id)`. Absent/`false` ⇒ deletes refused. */\n  allowDelete?: boolean;\n  /** **Mobile-only.** `image`-type fields whose workspace path the host inlines\n   *  as a downscaled `data:` URL thumbnail in `getItems` pages, so they render\n   *  on the phone (which can't reach the host's localhost). Opt-in (absent ⇒\n   *  none); the host projects `fields` first and only inlines the declared\n   *  fields that survive, within a per-page byte budget. Ignored for desktop\n   *  views (they resolve via `/api/files/raw`). See plans/feat-remote-view-images.md. */\n  imageFields?: string[];\n  /** **Mobile-only.** Longest-edge (px) an inlined `imageFields` thumbnail is\n   *  downscaled to. Absent ⇒ 512, clamped to `[64, 1024]`. */\n  imageMaxEdge?: number;\n}\n\n/** A schema-declared, per-record action rendered as a button in the\n *  read-only detail view. Pure UI/behaviour directive — never stored,\n *  never validated against record data. All domain specifics (label,\n *  role, template) live here in the schema / skill folder, so the host\n *  stays generic. */\nexport interface CollectionAction {\n  /** Stable id (used in the dispatch route + testids). */\n  id: string;\n  /** Button text (English, like field labels). */\n  label: string;\n  /** Material-icon name shown on the button. */\n  icon?: string;\n  /** What the action does. v1: `\"chat\"`. */\n  kind: CollectionActionKind;\n  /** `kind: \"chat\"`: the role id the new chat runs in. */\n  role: string;\n  /** `kind: \"chat\"`: skill-relative path to the template file whose\n   *  text becomes the seed prompt body (e.g. `templates/invoice.md`). */\n  template: string;\n  /** Optional visibility predicate; the button renders only when the\n   *  open record matches (see CollectionWhen). Absent ⇒ always\n   *  shown. */\n  when?: CollectionWhen;\n}\n\nexport interface CollectionFieldSpec {\n  type: CollectionFieldType;\n  label: string;\n  /** True for the field whose value is the record's filename (no\n   *  separate auto-id). Exactly one field per schema may set this. */\n  primary?: boolean;\n  required?: boolean;\n  /** When `type === \"ref\"` or `type === \"embed\"`: the slug of the\n   *  target collection. For `ref` the record stores the target\n   *  item's primary-key slug and the host renders a clickable link\n   *  + dropdown picker. For `embed` the host pulls a *fixed* record\n   *  (see `id`) from the target and renders its fields read-only in\n   *  the detail view. Required for both; ignored on every other\n   *  type. */\n  to?: string;\n  /** When `type === \"embed\"`: the primary-key value of the fixed\n   *  record to pull from the `to` collection (e.g. `me` for the\n   *  singleton mc-profile). Nothing is stored on this record — the\n   *  embed is a display-only directive resolved at render time, so\n   *  it never appears in the list table or the edit form. Supply\n   *  either this (a fixed target, same for every record) or\n   *  `idField` (a per-record target) — exactly one. Ignored on every\n   *  other type. */\n  id?: string;\n  /** When `type === \"embed\"`: the name of a sibling top-level field\n   *  whose value names the target record's primary key — letting the\n   *  embed point at a *different* record per row (e.g. an invoice's\n   *  `issuerId` ref selects which `profile` to embed as the\n   *  bill-from block). The renderer reads `record[idField]` at render\n   *  time; an absent/empty value resolves to \"no record\" (the same\n   *  fail-soft as a missing fixed `id`). Mutually exclusive with `id`\n   *  — an embed must declare exactly one. Ignored on every other type. */\n  idField?: string;\n  /** When `type === \"money\"` (or `type === \"derived\"` with\n   *  `display: \"money\"`): a literal ISO 4217 currency code passed to\n   *  `Intl.NumberFormat` for display — fixed for every record. The\n   *  stored value is always a plain decimal number; currency is\n   *  presentation only. Mutually substitutable with `currencyField`:\n   *  a money field must declare at least one of the two. */\n  currency?: string;\n  /** When `type === \"money\"` (or `type === \"derived\"` with\n   *  `display: \"money\"`): the name of a sibling record field whose\n   *  value holds the ISO 4217 code, letting currency vary per record\n   *  (e.g. an invoice's `currency` enum). The renderer reads\n   *  `record[currencyField]` and falls back to the literal `currency`\n   *  (then \"USD\") when the field is absent or empty. Resolved against\n   *  the top-level record even for money sub-fields inside a table. */\n  currencyField?: string;\n  /** When `type === \"enum\"`: the closed set of allowed string\n   *  values. The form renders a `<select>` populated from this\n   *  list; storage is a plain string. Required when type is\n   *  `enum`; ignored on every other type. */\n  values?: readonly string[];\n  /** When `type === \"table\"`: the sub-schema for each row (a flat\n   *  record of non-table / non-derived field specs). Required when\n   *  type is `table`. v0 disallows nested tables and derived\n   *  columns to keep the editor + evaluator simple. */\n  of?: Record<string, CollectionFieldSpec>;\n  /** When `type === \"derived\"`: a tiny expression evaluated against\n   *  the record. Supports `+ - * /`, parens, identifier refs to\n   *  top-level fields, `sum(tableField[].col)`, and\n   *  `sum(tableField[].col * tableField[].col)`. See\n   *  `src/utils/collections/derivedFormula.ts`. Required when type\n   *  is `derived`. */\n  formula?: string;\n  /** When `type === \"derived\"`: an inner field type the computed\n   *  value should be rendered as (e.g. `\"money\"` so $1,234.56 is\n   *  formatted). Defaults to `\"number\"`. */\n  display?: CollectionFieldType;\n  /** Optional visibility predicate: this field renders only when the\n   *  record matches (e.g. hide a `rating` field until `visited` is\n   *  `true` via `{ field: \"visited\", in: [\"true\"] }`). Applies to the\n   *  list cell (blank when hidden), the edit form (hidden live as the\n   *  gating field changes), and the detail view. Purely presentational\n   *  — a hidden field's stored value is never cleared. `when.field`\n   *  must name another top-level field. Absent ⇒ always shown. Only\n   *  honoured on top-level fields, not inside a `table`'s `of`. */\n  when?: CollectionWhen;\n  /** When `type === \"toggle\"`: the name of the top-level `enum` field this\n   *  checkbox projects. The toggle stores nothing itself — it reads and\n   *  writes this field. Required when type is `toggle`; ignored otherwise.\n   *  Must name a real `enum` field. */\n  field?: string;\n  /** When `type === \"toggle\"`: the enum value that means \"checked\". The\n   *  box is checked when the projected `field` equals this; checking writes\n   *  it. Required when type is `toggle`; must be one of the enum's `values`. */\n  onValue?: string;\n  /** When `type === \"toggle\"`: the enum value written when the box is\n   *  unchecked. Required when type is `toggle`; must be one of the enum's\n   *  `values`. */\n  offValue?: string;\n}\n\nexport interface CollectionSchema {\n  /** Human-facing collection name (sidebar, header). */\n  title: string;\n  /** Material-icon name shown next to the title. */\n  icon: string;\n  /** Workspace-relative folder holding one-JSON-per-record. Validated\n   *  to live under the workspace root at load time. */\n  dataPath: string;\n  /** Field name whose value doubles as the record's filename. */\n  primaryKey: string;\n  /** When set, the collection is a singleton: at most one record,\n   *  whose primary key is fixed to this value (e.g. `me` for the\n   *  business profile). The host pre-fills + locks the create form's\n   *  primary key and hides Add once the record exists. */\n  singleton?: string;\n  /** Ordered map: insertion order = column order in the table view. */\n  fields: Record<string, CollectionFieldSpec>;\n  /** Optional per-record actions rendered as buttons in the detail\n   *  view (e.g. \"Generate PDF\"). Order = button order. */\n  actions?: CollectionAction[];\n  /** Optional collection-level actions rendered as buttons in the\n   *  collection header (e.g. \"Extend the course\"). Unlike `actions`,\n   *  these carry no record context: the seed prompt injects a compact\n   *  progress summary of every record instead. The `when` predicate is\n   *  not evaluated (there is no record to gate on). Order = button order. */\n  collectionActions?: CollectionAction[];\n  /** Name of the field whose value marks an item as \"done\". When set,\n   *  a notification fires on item create (unless the item is born done)\n   *  and clears when the field's value transitions into\n   *  `completionDoneValues`. Must name a real field in `fields`. */\n  completionField?: string;\n  /** The set of values for `completionField` that count as \"done\"\n   *  (e.g. `[\"Done\"]` for a todo status field, `[\"paid\"]` for an\n   *  invoice). Non-empty. Compared as strings. */\n  completionDoneValues?: readonly string[];\n  /** Name of the field whose value is shown as the human-readable\n   *  label in a completion notification's title (e.g. a `name` field,\n   *  so the bell reads `Contacts: Jane Doe` instead of the opaque\n   *  primaryKey). Must name a real field in `fields`. When unset — or\n   *  when the record's value for it is empty — the title falls back to\n   *  the record's primaryKey value. Display-only; never stored. */\n  displayField?: string;\n  /** Name of a `date` field that gates this item's completion\n   *  notification: the bell is suppressed until the clock reaches that\n   *  date (compared at day-granularity in the server's local timezone),\n   *  instead of firing on create. Requires `completionField` /\n   *  `completionDoneValues` (the bell still clears via the done value).\n   *  Must name a real `date` field. Absent ⇒ fire on create, as before. */\n  triggerField?: string;\n  /** Lead time in whole days: fire the bell this many days BEFORE\n   *  `triggerField` (so `10` shows the reminder 10 days early). The lead\n   *  is applied at fire time, not stored, so it composes with `spawn` —\n   *  every recurred cycle fires the same number of days before its own\n   *  trigger. Non-negative integer; requires `triggerField`. Default 0\n   *  (fire on the trigger date). */\n  triggerLeadDays?: number;\n  /** Host-driven recurrence. When set, requires `triggerField`. See\n   *  {@link CollectionSpawn}. */\n  spawn?: CollectionSpawn;\n  /** Name of a `date` field that anchors the optional calendar view: a\n   *  month grid where each record lands on the day cell matching this\n   *  field's value. When unset, the calendar toggle still appears if the\n   *  schema has any `date` field (the first one, in declaration order, is\n   *  used by default and is switchable in-view). Set this to pin a specific\n   *  anchor. Must name a real `date` field. */\n  calendarField?: string;\n  /** Name of a second `date` field marking the END of a multi-day span on\n   *  the calendar: the record renders from `calendarField` through this\n   *  date inclusive. Requires `calendarField`. Must name a real `date`\n   *  field. Absent ⇒ single-day placement. */\n  calendarEndField?: string;\n  /** Name of a string field holding a free-form time or time-range\n   *  (e.g. \"14:00-17:00\", \"17:00-\", \"16:30\") that places records on the\n   *  calendar's day (time-allocation) view. Consulted only when the calendar\n   *  date fields are date-only. Requires `calendarField`. */\n  calendarTimeField?: string;\n  /** Name of an `enum` field that groups records into columns on the\n   *  optional Kanban board: each record lands in the column matching its\n   *  value, with empty/unknown values collected in an \"Uncategorized\"\n   *  column. When unset, the Kanban toggle still appears if the schema has\n   *  any `enum` field (the first one, in declaration order, is used by\n   *  default and is switchable in-view). Set this to pin a specific group\n   *  field. Must name a real `enum` field. */\n  kanbanField?: string;\n  /** Optional custom (LLM-authored) HTML views, each rendered in a\n   *  sandboxed iframe over the records. Absent ⇒ only the built-in\n   *  field-derived views (table / calendar / kanban / dashboard). See\n   *  {@link CollectionCustomView}. */\n  views?: CollectionCustomView[];\n  /** Optional predicate that gates the completion bell: when set, the bell\n   *  fires only for records whose `String(record[notifyWhen.field])` is one\n   *  of `notifyWhen.in` (e.g. notify only `high`/`urgent` priority todos).\n   *  Reuses the `when` predicate shape. Requires `completionField` — it\n   *  narrows that bell rather than introducing a second one. The bell still\n   *  clears on done / delete / when the predicate stops matching. Absent ⇒\n   *  notify for every open record (the prior behaviour). `notifyWhen.field`\n   *  must name a real top-level field. */\n  notifyWhen?: CollectionWhen;\n  /** Optional scheduled-retrieval config. When present, the host refreshes\n   *  this collection on `ingest.schedule`. Two flavours: a declarative Feed\n   *  (`kind: rss/atom/http-json`) periodically fetches `ingest.url`, maps the\n   *  response into records, and upserts them by `primaryKey` — only feeds\n   *  discovered from the `<workspace>/feeds/` registry carry this. Or\n   *  `kind: \"agent\"`, valid on any (incl. skill-backed) collection: the host\n   *  dispatches a hidden background worker in `ingest.role` seeded with\n   *  `ingest.template`, and the worker edits the records itself. The host's\n   *  feeds subsystem narrows this to its richer `IngestSpec`. */\n  ingest?: CollectionIngest;\n}\n\nexport interface CollectionSummary {\n  slug: string;\n  title: string;\n  icon: string;\n  source: CollectionSource;\n}\n\nexport interface CollectionDetail extends CollectionSummary {\n  schema: CollectionSchema;\n}\n\nexport type CollectionItem = Record<string, unknown>;\n\n/** Resolve an `embed` field's target record id: the fixed `id`, or the value\n *  of the sibling `idField` on this record (empty string when neither applies\n *  — the caller renders that as \"no record\"). Pure + isomorphic so the server\n *  projection (`derive.ts`) and the client preview (`useCollectionRendering`)\n *  resolve embeds identically. */\nexport function embedTargetId(field: CollectionFieldSpec, record: CollectionItem | null): string {\n  if (field.id) return field.id;\n  if (field.idField && record) return String(record[field.idField] ?? \"\");\n  return \"\";\n}\n","// Tiny expression evaluator for the `derived` field type on\n// schema-driven collections (see plans/done/feat-mc-invoice.md).\n//\n// Grammar (recursive-descent, no precedence climbing — six\n// non-terminals total):\n//\n//   expr   := term (('+' | '-') term)*\n//   term   := factor (('*' | '/') factor)*\n//   factor := number | sumCall | refAccess | identifier | '(' expr ')'\n//   sumCall:= 'sum' '(' sumArg ')'\n//   sumArg := tableCol (('*' | '/') tableCol)*      // e.g. lineItems[].quantity * lineItems[].rate\n//   tableCol := identifier '[]' '.' identifier\n//   refAccess := identifier '.' identifier          // e.g. ticker.price — deref a ref field into its target record\n//\n// `identifier` accepts top-level field names (single segment).\n// Inside `sumArg`, identifiers are the `<table>[].col` form.\n// A two-segment `<field>.<col>` at factor level is a *ref deref*:\n// `<field>` must be a `ref`-typed field on this record (its stored\n// value is the target item's slug), and `<col>` is a numeric column\n// read from that target record. The caller resolves the target into\n// `ctx.refs` (it owns the schema + the loaded target collection);\n// the evaluator stays pure and never does I/O.\n//\n// What's deliberately NOT supported (and would parse-error rather\n// than silently misbehave):\n//   - String literals, boolean operators, comparisons, conditionals\n//   - Nested function calls beyond `sum(...)`\n//   - Anything in the record that isn't a number / table-of-objects\n//\n// All evaluation is pure — no eval(), no Function constructor.\n// Returns `null` on any failure (parse error, unbound identifier,\n// non-finite arithmetic). The caller renders `null` as em-dash in\n// the table cell + form display.\n\nexport interface FormulaContext {\n  /** The record being evaluated. For derived fields in the form,\n   *  this is the live draft (text + table both converted via the\n   *  same `draftToRecord` pipeline). For the main table cell,\n   *  this is the persisted item. */\n  record: Record<string, unknown>;\n  /** Resolved ref-target records for THIS row, keyed by the local\n   *  `ref` field name. The caller (which has the schema + the linked\n   *  collection's items loaded) maps each ref field's stored slug to\n   *  the full target record and passes it here, so a `<field>.<col>`\n   *  formula can read a numeric column off the referenced record\n   *  (e.g. `shares * ticker.price`). A missing key or `null` value\n   *  (unknown field / dangling slug) makes that deref evaluate to\n   *  NaN → the whole formula returns `null` → em-dash, consistent\n   *  with every other failure mode. Absent ⇒ no refs available. */\n  refs?: Record<string, Record<string, unknown> | null>;\n}\n\nexport function evaluateDerived(formula: string, ctx: FormulaContext): number | null {\n  let tokens: Token[];\n  try {\n    tokens = tokenize(formula);\n  } catch {\n    return null;\n  }\n  // eslint-disable-next-line @typescript-eslint/no-use-before-define -- Parser class is defined later in the file (grouped with its AST + evaluator); evaluateDerived runs after module init so the TDZ concern doesn't apply.\n  const parser = new Parser(tokens);\n  let ast: Node;\n  try {\n    ast = parser.parseExpr();\n    if (!parser.atEnd()) return null; // trailing junk\n  } catch {\n    return null;\n  }\n  const value = evaluate(ast, ctx);\n  return Number.isFinite(value) ? value : null;\n}\n\n// ─── Tokens ────────────────────────────────────────────────\n\ntype TokenKind = \"number\" | \"ident\" | \"(\" | \")\" | \"+\" | \"-\" | \"*\" | \"/\" | \"[]\" | \".\";\n\ninterface Token {\n  kind: TokenKind;\n  value?: string | number;\n}\n\nconst SINGLE_CHAR_PUNCT = new Set<TokenKind>([\"(\", \")\", \"+\", \"-\", \"*\", \"/\", \".\"]);\n\ninterface Cursor {\n  input: string;\n  index: number;\n}\n\nfunction consumeWhitespace(cur: Cursor): boolean {\n  const char = cur.input[cur.index];\n  if (char === \" \" || char === \"\\t\" || char === \"\\n\") {\n    cur.index++;\n    return true;\n  }\n  return false;\n}\n\nfunction consumeNumber(cur: Cursor): Token | null {\n  const char = cur.input[cur.index] ?? \"\";\n  const next = cur.input[cur.index + 1] ?? \"\";\n  if (!isDigit(char) && !(char === \".\" && isDigit(next))) return null;\n  let raw = \"\";\n  while (cur.index < cur.input.length) {\n    const here = cur.input[cur.index] ?? \"\";\n    if (!isDigit(here) && here !== \".\") break;\n    raw += here;\n    cur.index++;\n  }\n  const num = Number(raw);\n  if (!Number.isFinite(num)) throw new Error(\"bad number\");\n  return { kind: \"number\", value: num };\n}\n\nfunction consumeIdent(cur: Cursor): Token | null {\n  const char = cur.input[cur.index] ?? \"\";\n  if (!isIdentStart(char)) return null;\n  let raw = \"\";\n  while (cur.index < cur.input.length && isIdentChar(cur.input[cur.index] ?? \"\")) {\n    raw += cur.input[cur.index];\n    cur.index++;\n  }\n  return { kind: \"ident\", value: raw };\n}\n\nfunction consumePunct(cur: Cursor): Token | null {\n  const char = cur.input[cur.index] ?? \"\";\n  if (char === \"[\" && cur.input[cur.index + 1] === \"]\") {\n    cur.index += 2;\n    return { kind: \"[]\" };\n  }\n  if (SINGLE_CHAR_PUNCT.has(char as TokenKind)) {\n    cur.index++;\n    return { kind: char as TokenKind };\n  }\n  return null;\n}\n\nfunction tokenize(input: string): Token[] {\n  const tokens: Token[] = [];\n  const cur: Cursor = { input, index: 0 };\n  while (cur.index < input.length) {\n    if (consumeWhitespace(cur)) continue;\n    // Number FIRST so a leading-dot literal (`.25`) isn't split by\n    // the `.` punctuation branch.\n    const numTok = consumeNumber(cur);\n    if (numTok) {\n      tokens.push(numTok);\n      continue;\n    }\n    const punctTok = consumePunct(cur);\n    if (punctTok) {\n      tokens.push(punctTok);\n      continue;\n    }\n    const identTok = consumeIdent(cur);\n    if (identTok) {\n      tokens.push(identTok);\n      continue;\n    }\n    throw new Error(`unexpected char ${input[cur.index]}`);\n  }\n  return tokens;\n}\n\nfunction isDigit(char: string): boolean {\n  return char >= \"0\" && char <= \"9\";\n}\nfunction isIdentStart(char: string): boolean {\n  return (char >= \"a\" && char <= \"z\") || (char >= \"A\" && char <= \"Z\") || char === \"_\";\n}\nfunction isIdentChar(char: string): boolean {\n  return isIdentStart(char) || isDigit(char);\n}\n\n// ─── AST + Parser ───────────────────────────────────────────\n\ntype Node =\n  | { kind: \"num\"; value: number }\n  | { kind: \"ident\"; name: string }\n  | { kind: \"ref\"; field: string; col: string }\n  | { kind: \"binop\"; operator: \"+\" | \"-\" | \"*\" | \"/\"; left: Node; right: Node }\n  | { kind: \"sum\"; arg: SumArg };\n\ninterface SumArg {\n  // factors multiplied/divided together; each is a (tableName, colName) ref into a row.\n  factors: { table: string; col: string }[];\n  /** Operators between factors: length = factors.length - 1; each\n   *  is \"*\" or \"/\". For a single-factor sum (`sum(lineItems[].amount)`)\n   *  this is empty. */\n  operators: (\"*\" | \"/\")[];\n}\n\nclass Parser {\n  private cursor = 0;\n  constructor(private readonly tokens: Token[]) {}\n\n  atEnd(): boolean {\n    return this.cursor >= this.tokens.length;\n  }\n  private peek(): Token | undefined {\n    return this.tokens[this.cursor];\n  }\n  private consume(): Token {\n    const tok = this.tokens[this.cursor++];\n    if (!tok) throw new Error(\"unexpected end of input\");\n    return tok;\n  }\n  private expect(kind: TokenKind): Token {\n    const tok = this.consume();\n    if (tok.kind !== kind) throw new Error(`expected ${kind}, got ${tok.kind}`);\n    return tok;\n  }\n\n  parseExpr(): Node {\n    let left = this.parseTerm();\n    while (this.peek()?.kind === \"+\" || this.peek()?.kind === \"-\") {\n      const operator = this.consume().kind as \"+\" | \"-\";\n      const right = this.parseTerm();\n      left = { kind: \"binop\", operator, left, right };\n    }\n    return left;\n  }\n\n  private parseTerm(): Node {\n    let left = this.parseFactor();\n    while (this.peek()?.kind === \"*\" || this.peek()?.kind === \"/\") {\n      const operator = this.consume().kind as \"*\" | \"/\";\n      const right = this.parseFactor();\n      left = { kind: \"binop\", operator, left, right };\n    }\n    return left;\n  }\n\n  private parseFactor(): Node {\n    const tok = this.peek();\n    if (!tok) throw new Error(\"unexpected end in factor\");\n    if (tok.kind === \"number\") {\n      this.consume();\n      return { kind: \"num\", value: tok.value as number };\n    }\n    if (tok.kind === \"(\") {\n      this.consume();\n      const inner = this.parseExpr();\n      this.expect(\")\");\n      return inner;\n    }\n    if (tok.kind === \"ident\") {\n      const name = (tok.value as string) ?? \"\";\n      // sum(...) — only function call we support\n      if (name === \"sum\" && this.tokens[this.cursor + 1]?.kind === \"(\") {\n        this.consume(); // ident\n        this.expect(\"(\");\n        const arg = this.parseSumArg();\n        this.expect(\")\");\n        return { kind: \"sum\", arg };\n      }\n      this.consume(); // ident\n      // ref deref: `<field>.<col>` (e.g. ticker.price). The table-row\n      // form `<table>[].col` only appears inside sum(), so a `.`\n      // immediately after a top-level ident is unambiguously a ref\n      // dereference here.\n      if (this.peek()?.kind === \".\") {\n        this.consume(); // '.'\n        const col = this.expect(\"ident\");\n        return { kind: \"ref\", field: name, col: col.value as string };\n      }\n      return { kind: \"ident\", name };\n    }\n    throw new Error(`unexpected token ${tok.kind} in factor`);\n  }\n\n  private parseSumArg(): SumArg {\n    const factors: { table: string; col: string }[] = [];\n    const operators: (\"*\" | \"/\")[] = [];\n    factors.push(this.parseTableCol());\n    while (this.peek()?.kind === \"*\" || this.peek()?.kind === \"/\") {\n      const operator = this.consume().kind as \"*\" | \"/\";\n      operators.push(operator);\n      factors.push(this.parseTableCol());\n    }\n    return { factors, operators };\n  }\n\n  private parseTableCol(): { table: string; col: string } {\n    const tableTok = this.expect(\"ident\");\n    this.expect(\"[]\");\n    this.expect(\".\");\n    const colTok = this.expect(\"ident\");\n    return { table: tableTok.value as string, col: colTok.value as string };\n  }\n}\n\n// ─── Evaluator ──────────────────────────────────────────────\n\nfunction evaluate(node: Node, ctx: FormulaContext): number {\n  if (node.kind === \"num\") return node.value;\n  if (node.kind === \"ident\") {\n    const raw = ctx.record[node.name];\n    return toFiniteNumber(raw);\n  }\n  if (node.kind === \"ref\") {\n    // `<field>.<col>`: read `col` off the resolved target record the\n    // caller put in ctx.refs. Unknown field / dangling slug → null →\n    // NaN, so the whole formula fails soft to an em-dash.\n    const target = ctx.refs?.[node.field] ?? null;\n    if (!target) return Number.NaN;\n    return toFiniteNumber(target[node.col]);\n  }\n  if (node.kind === \"binop\") {\n    const left = evaluate(node.left, ctx);\n    const right = evaluate(node.right, ctx);\n    return applyBinop(node.operator, left, right);\n  }\n  if (node.kind === \"sum\") {\n    return evaluateSum(node.arg, ctx);\n  }\n  // Exhaustive — TS narrows above branches but throw keeps runtime honest.\n  throw new Error(`unknown node`);\n}\n\nfunction applyBinop(operator: \"+\" | \"-\" | \"*\" | \"/\", left: number, right: number): number {\n  if (!Number.isFinite(left) || !Number.isFinite(right)) return Number.NaN;\n  if (operator === \"+\") return left + right;\n  if (operator === \"-\") return left - right;\n  if (operator === \"*\") return left * right;\n  // operator === \"/\"\n  if (right === 0) return Number.NaN;\n  return left / right;\n}\n\nfunction evaluateSum(arg: SumArg, ctx: FormulaContext): number {\n  if (arg.factors.length === 0) return 0;\n  const tableName = arg.factors[0].table;\n  // All factors must reference the SAME table (you can't multiply\n  // a row from lineItems against a row from another table — the\n  // semantics would be ambiguous). Reject mismatch.\n  for (const factor of arg.factors) {\n    if (factor.table !== tableName) return Number.NaN;\n  }\n  const rows = ctx.record[tableName];\n  if (!Array.isArray(rows)) return 0;\n  let total = 0;\n  for (const row of rows) {\n    if (!row || typeof row !== \"object\") continue;\n    let product = toFiniteNumber((row as Record<string, unknown>)[arg.factors[0].col]);\n    if (!Number.isFinite(product)) return Number.NaN;\n    for (let i = 1; i < arg.factors.length; i++) {\n      const value = toFiniteNumber((row as Record<string, unknown>)[arg.factors[i].col]);\n      if (!Number.isFinite(value)) return Number.NaN;\n      product = applyBinop(arg.operators[i - 1], product, value);\n    }\n    total += product;\n  }\n  return total;\n}\n\nfunction toFiniteNumber(value: unknown): number {\n  if (typeof value === \"number\") return Number.isFinite(value) ? value : Number.NaN;\n  if (typeof value === \"string\" && value.length > 0) {\n    const num = Number(value);\n    return Number.isFinite(num) ? num : Number.NaN;\n  }\n  return Number.NaN;\n}\n","// The derived-field saturation loop for schema-driven collections,\n// extracted from `composables/collections/useCollectionRendering.ts` so\n// the server (manageCollection getItems enrichment) and the client\n// (table cells, form display) evaluate formulas through ONE\n// implementation — if the two ever diverged, the UI and the LLM would\n// disagree on a number. Pure module: no Vue, no I/O.\n//\n// Like `actionVisible.ts`, the input types are minimal structural\n// shapes so both the client `FieldSpec`/`CollectionSchema`\n// (src/components/collectionTypes.ts) and the server\n// `CollectionFieldSpec`/`CollectionSchema`\n// (server/workspace/collections/types.ts) satisfy them as-is.\n\nimport { evaluateDerived, type FormulaContext } from \"./derivedFormula\";\n\n/** Minimal field shape the derive loop needs — accepts both the client\n *  FieldSpec and the server CollectionFieldSpec. */\nexport interface DerivableFieldSpec {\n  type: string;\n  /** When type === \"ref\": slug of the target collection. */\n  to?: string;\n  /** When type === \"derived\": formula evaluated against the record. */\n  formula?: string;\n}\n\n/** Minimal schema shape: just the ordered field map. */\nexport interface DerivableSchema {\n  fields: Record<string, DerivableFieldSpec>;\n}\n\nexport type DerivableRecord = Record<string, unknown>;\n\n/** Per-target-collection cache of loaded referenced records:\n *  target collection slug → item slug → full record. Mirrors the\n *  client's `RefRecordCache` / the server's enrichment loader. */\nexport type DeriveRefRecords = Record<string, Record<string, DerivableRecord>>;\n\n/** Map each `ref` field's stored slug to its loaded target record (or\n *  null when dangling / not loaded), keyed by the LOCAL field name —\n *  the shape `evaluateDerived` reads for `<field>.<col>` derefs. */\nexport function resolveRowRefs(schema: DerivableSchema, record: DerivableRecord, refRecords: DeriveRefRecords): NonNullable<FormulaContext[\"refs\"]> {\n  const refs: NonNullable<FormulaContext[\"refs\"]> = {};\n  for (const [key, field] of Object.entries(schema.fields)) {\n    if (field.type !== \"ref\" || !field.to) continue;\n    const slug = record[key];\n    refs[key] = typeof slug === \"string\" ? (refRecords[field.to]?.[slug] ?? null) : null;\n  }\n  return refs;\n}\n\n/** Evaluate every `derived` field against `base`, saturating so a\n *  derived field can read another derived field computed in an earlier\n *  pass (`subtotal → tax → total` converges in ≤ field-count passes).\n *  Cycles can't loop forever — passes are bounded by the number of\n *  derived fields and the loop breaks as soon as a pass changes\n *  nothing. Failed formulas stay ABSENT (the UI renders them as\n *  em-dash). Returns a copy; `base` is never mutated.\n *\n *  Derived keys already present in `base` are stripped before\n *  evaluation: computed output is host-truth, never persisted-input\n *  fallback. A record JSON can carry a stale (or forged) derived value\n *  — raw Write/Edit, legacy data — and without the strip, a failing\n *  formula would silently surface that value as if the host computed\n *  it. */\nexport function deriveAll(schema: DerivableSchema, base: DerivableRecord, refRecords: DeriveRefRecords): DerivableRecord {\n  const derivedKeys = new Set(Object.keys(schema.fields).filter((key) => schema.fields[key]?.type === \"derived\"));\n  const enriched: DerivableRecord = Object.fromEntries(Object.entries(base).filter(([key]) => !derivedKeys.has(key)));\n  const refs = resolveRowRefs(schema, base, refRecords);\n  const maxPasses = Object.values(schema.fields).filter((field) => field.type === \"derived\").length;\n  for (let pass = 0; pass < maxPasses; pass++) {\n    let mutated = false;\n    for (const [key, field] of Object.entries(schema.fields)) {\n      if (field.type !== \"derived\" || !field.formula) continue;\n      const next = evaluateDerived(field.formula, { record: enriched, refs });\n      if (next !== null && enriched[key] !== next) {\n        enriched[key] = next;\n        mutated = true;\n      }\n    }\n    if (!mutated) break;\n  }\n  return enriched;\n}\n"],"mappings":";;;;;AA6CA,IAAa,eAAe;CAAC;CAAO;CAAQ;AAAW;;;;;;;;AAUvD,IAAa,oBAAoB;;AAIjC,IAAa,iBAAiB;CAAC;CAAU;CAAS;CAAU;AAAW;;AAqFvE,SAAgB,mBAAmB,OAAkE;CACnG,OAAO,eAAe;AACxB;;;;;;AAkXA,SAAgB,cAAc,OAA4B,QAAuC;CAC/F,IAAI,MAAM,IAAI,OAAO,MAAM;CAC3B,IAAI,MAAM,WAAW,QAAQ,OAAO,OAAO,OAAO,MAAM,YAAY,EAAE;CACtE,OAAO;AACT;;;ACpdA,SAAgB,gBAAgB,SAAiB,KAAoC;CACnF,IAAI;CACJ,IAAI;EACF,SAAS,SAAS,OAAO;CAC3B,QAAQ;EACN,OAAO;CACT;CAEA,MAAM,SAAS,IAAI,OAAO,MAAM;CAChC,IAAI;CACJ,IAAI;EACF,MAAM,OAAO,UAAU;EACvB,IAAI,CAAC,OAAO,MAAM,GAAG,OAAO;CAC9B,QAAQ;EACN,OAAO;CACT;CACA,MAAM,QAAQ,SAAS,KAAK,GAAG;CAC/B,OAAO,OAAO,SAAS,KAAK,IAAI,QAAQ;AAC1C;AAWA,IAAM,oCAAoB,IAAI,IAAe;CAAC;CAAK;CAAK;CAAK;CAAK;CAAK;CAAK;AAAG,CAAC;AAOhF,SAAS,kBAAkB,KAAsB;CAC/C,MAAM,OAAO,IAAI,MAAM,IAAI;CAC3B,IAAI,SAAS,OAAO,SAAS,OAAQ,SAAS,MAAM;EAClD,IAAI;EACJ,OAAO;CACT;CACA,OAAO;AACT;AAEA,SAAS,cAAc,KAA2B;CAChD,MAAM,OAAO,IAAI,MAAM,IAAI,UAAU;CACrC,MAAM,OAAO,IAAI,MAAM,IAAI,QAAQ,MAAM;CACzC,IAAI,CAAC,QAAQ,IAAI,KAAK,EAAE,SAAS,OAAO,QAAQ,IAAI,IAAI,OAAO;CAC/D,IAAI,MAAM;CACV,OAAO,IAAI,QAAQ,IAAI,MAAM,QAAQ;EACnC,MAAM,OAAO,IAAI,MAAM,IAAI,UAAU;EACrC,IAAI,CAAC,QAAQ,IAAI,KAAK,SAAS,KAAK;EACpC,OAAO;EACP,IAAI;CACN;CACA,MAAM,MAAM,OAAO,GAAG;CACtB,IAAI,CAAC,OAAO,SAAS,GAAG,GAAG,MAAM,IAAI,MAAM,YAAY;CACvD,OAAO;EAAE,MAAM;EAAU,OAAO;CAAI;AACtC;AAEA,SAAS,aAAa,KAA2B;CAE/C,IAAI,CAAC,aADQ,IAAI,MAAM,IAAI,UAAU,EACf,GAAG,OAAO;CAChC,IAAI,MAAM;CACV,OAAO,IAAI,QAAQ,IAAI,MAAM,UAAU,YAAY,IAAI,MAAM,IAAI,UAAU,EAAE,GAAG;EAC9E,OAAO,IAAI,MAAM,IAAI;EACrB,IAAI;CACN;CACA,OAAO;EAAE,MAAM;EAAS,OAAO;CAAI;AACrC;AAEA,SAAS,aAAa,KAA2B;CAC/C,MAAM,OAAO,IAAI,MAAM,IAAI,UAAU;CACrC,IAAI,SAAS,OAAO,IAAI,MAAM,IAAI,QAAQ,OAAO,KAAK;EACpD,IAAI,SAAS;EACb,OAAO,EAAE,MAAM,KAAK;CACtB;CACA,IAAI,kBAAkB,IAAI,IAAiB,GAAG;EAC5C,IAAI;EACJ,OAAO,EAAE,MAAM,KAAkB;CACnC;CACA,OAAO;AACT;AAEA,SAAS,SAAS,OAAwB;CACxC,MAAM,SAAkB,CAAC;CACzB,MAAM,MAAc;EAAE;EAAO,OAAO;CAAE;CACtC,OAAO,IAAI,QAAQ,MAAM,QAAQ;EAC/B,IAAI,kBAAkB,GAAG,GAAG;EAG5B,MAAM,SAAS,cAAc,GAAG;EAChC,IAAI,QAAQ;GACV,OAAO,KAAK,MAAM;GAClB;EACF;EACA,MAAM,WAAW,aAAa,GAAG;EACjC,IAAI,UAAU;GACZ,OAAO,KAAK,QAAQ;GACpB;EACF;EACA,MAAM,WAAW,aAAa,GAAG;EACjC,IAAI,UAAU;GACZ,OAAO,KAAK,QAAQ;GACpB;EACF;EACA,MAAM,IAAI,MAAM,mBAAmB,MAAM,IAAI,QAAQ;CACvD;CACA,OAAO;AACT;AAEA,SAAS,QAAQ,MAAuB;CACtC,OAAO,QAAQ,OAAO,QAAQ;AAChC;AACA,SAAS,aAAa,MAAuB;CAC3C,OAAQ,QAAQ,OAAO,QAAQ,OAAS,QAAQ,OAAO,QAAQ,OAAQ,SAAS;AAClF;AACA,SAAS,YAAY,MAAuB;CAC1C,OAAO,aAAa,IAAI,KAAK,QAAQ,IAAI;AAC3C;AAoBA,IAAM,SAAN,MAAa;CAEkB;CAD7B,SAAiB;CACjB,YAAY,QAAkC;EAAjB,KAAA,SAAA;CAAkB;CAE/C,QAAiB;EACf,OAAO,KAAK,UAAU,KAAK,OAAO;CACpC;CACA,OAAkC;EAChC,OAAO,KAAK,OAAO,KAAK;CAC1B;CACA,UAAyB;EACvB,MAAM,MAAM,KAAK,OAAO,KAAK;EAC7B,IAAI,CAAC,KAAK,MAAM,IAAI,MAAM,yBAAyB;EACnD,OAAO;CACT;CACA,OAAe,MAAwB;EACrC,MAAM,MAAM,KAAK,QAAQ;EACzB,IAAI,IAAI,SAAS,MAAM,MAAM,IAAI,MAAM,YAAY,KAAK,QAAQ,IAAI,MAAM;EAC1E,OAAO;CACT;CAEA,YAAkB;EAChB,IAAI,OAAO,KAAK,UAAU;EAC1B,OAAO,KAAK,KAAK,CAAC,EAAE,SAAS,OAAO,KAAK,KAAK,CAAC,EAAE,SAAS,KAAK;GAC7D,MAAM,WAAW,KAAK,QAAQ,CAAC,CAAC;GAChC,MAAM,QAAQ,KAAK,UAAU;GAC7B,OAAO;IAAE,MAAM;IAAS;IAAU;IAAM;GAAM;EAChD;EACA,OAAO;CACT;CAEA,YAA0B;EACxB,IAAI,OAAO,KAAK,YAAY;EAC5B,OAAO,KAAK,KAAK,CAAC,EAAE,SAAS,OAAO,KAAK,KAAK,CAAC,EAAE,SAAS,KAAK;GAC7D,MAAM,WAAW,KAAK,QAAQ,CAAC,CAAC;GAChC,MAAM,QAAQ,KAAK,YAAY;GAC/B,OAAO;IAAE,MAAM;IAAS;IAAU;IAAM;GAAM;EAChD;EACA,OAAO;CACT;CAEA,cAA4B;EAC1B,MAAM,MAAM,KAAK,KAAK;EACtB,IAAI,CAAC,KAAK,MAAM,IAAI,MAAM,0BAA0B;EACpD,IAAI,IAAI,SAAS,UAAU;GACzB,KAAK,QAAQ;GACb,OAAO;IAAE,MAAM;IAAO,OAAO,IAAI;GAAgB;EACnD;EACA,IAAI,IAAI,SAAS,KAAK;GACpB,KAAK,QAAQ;GACb,MAAM,QAAQ,KAAK,UAAU;GAC7B,KAAK,OAAO,GAAG;GACf,OAAO;EACT;EACA,IAAI,IAAI,SAAS,SAAS;GACxB,MAAM,OAAQ,IAAI,SAAoB;GAEtC,IAAI,SAAS,SAAS,KAAK,OAAO,KAAK,SAAS,EAAE,EAAE,SAAS,KAAK;IAChE,KAAK,QAAQ;IACb,KAAK,OAAO,GAAG;IACf,MAAM,MAAM,KAAK,YAAY;IAC7B,KAAK,OAAO,GAAG;IACf,OAAO;KAAE,MAAM;KAAO;IAAI;GAC5B;GACA,KAAK,QAAQ;GAKb,IAAI,KAAK,KAAK,CAAC,EAAE,SAAS,KAAK;IAC7B,KAAK,QAAQ;IAEb,OAAO;KAAE,MAAM;KAAO,OAAO;KAAM,KADvB,KAAK,OAAO,OACgB,CAAA,CAAI;IAAgB;GAC9D;GACA,OAAO;IAAE,MAAM;IAAS;GAAK;EAC/B;EACA,MAAM,IAAI,MAAM,oBAAoB,IAAI,KAAK,WAAW;CAC1D;CAEA,cAA8B;EAC5B,MAAM,UAA4C,CAAC;EACnD,MAAM,YAA2B,CAAC;EAClC,QAAQ,KAAK,KAAK,cAAc,CAAC;EACjC,OAAO,KAAK,KAAK,CAAC,EAAE,SAAS,OAAO,KAAK,KAAK,CAAC,EAAE,SAAS,KAAK;GAC7D,MAAM,WAAW,KAAK,QAAQ,CAAC,CAAC;GAChC,UAAU,KAAK,QAAQ;GACvB,QAAQ,KAAK,KAAK,cAAc,CAAC;EACnC;EACA,OAAO;GAAE;GAAS;EAAU;CAC9B;CAEA,gBAAwD;EACtD,MAAM,WAAW,KAAK,OAAO,OAAO;EACpC,KAAK,OAAO,IAAI;EAChB,KAAK,OAAO,GAAG;EACf,MAAM,SAAS,KAAK,OAAO,OAAO;EAClC,OAAO;GAAE,OAAO,SAAS;GAAiB,KAAK,OAAO;EAAgB;CACxE;AACF;AAIA,SAAS,SAAS,MAAY,KAA6B;CACzD,IAAI,KAAK,SAAS,OAAO,OAAO,KAAK;CACrC,IAAI,KAAK,SAAS,SAAS;EACzB,MAAM,MAAM,IAAI,OAAO,KAAK;EAC5B,OAAO,eAAe,GAAG;CAC3B;CACA,IAAI,KAAK,SAAS,OAAO;EAIvB,MAAM,SAAS,IAAI,OAAO,KAAK,UAAU;EACzC,IAAI,CAAC,QAAQ,OAAO;EACpB,OAAO,eAAe,OAAO,KAAK,IAAI;CACxC;CACA,IAAI,KAAK,SAAS,SAAS;EACzB,MAAM,OAAO,SAAS,KAAK,MAAM,GAAG;EACpC,MAAM,QAAQ,SAAS,KAAK,OAAO,GAAG;EACtC,OAAO,WAAW,KAAK,UAAU,MAAM,KAAK;CAC9C;CACA,IAAI,KAAK,SAAS,OAChB,OAAO,YAAY,KAAK,KAAK,GAAG;CAGlC,MAAM,IAAI,MAAM,cAAc;AAChC;AAEA,SAAS,WAAW,UAAiC,MAAc,OAAuB;CACxF,IAAI,CAAC,OAAO,SAAS,IAAI,KAAK,CAAC,OAAO,SAAS,KAAK,GAAG,OAAO;CAC9D,IAAI,aAAa,KAAK,OAAO,OAAO;CACpC,IAAI,aAAa,KAAK,OAAO,OAAO;CACpC,IAAI,aAAa,KAAK,OAAO,OAAO;CAEpC,IAAI,UAAU,GAAG,OAAO;CACxB,OAAO,OAAO;AAChB;AAEA,SAAS,YAAY,KAAa,KAA6B;CAC7D,IAAI,IAAI,QAAQ,WAAW,GAAG,OAAO;CACrC,MAAM,YAAY,IAAI,QAAQ,EAAE,CAAC;CAIjC,KAAK,MAAM,UAAU,IAAI,SACvB,IAAI,OAAO,UAAU,WAAW,OAAO;CAEzC,MAAM,OAAO,IAAI,OAAO;CACxB,IAAI,CAAC,MAAM,QAAQ,IAAI,GAAG,OAAO;CACjC,IAAI,QAAQ;CACZ,KAAK,MAAM,OAAO,MAAM;EACtB,IAAI,CAAC,OAAO,OAAO,QAAQ,UAAU;EACrC,IAAI,UAAU,eAAgB,IAAgC,IAAI,QAAQ,EAAE,CAAC,IAAI;EACjF,IAAI,CAAC,OAAO,SAAS,OAAO,GAAG,OAAO;EACtC,KAAK,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,QAAQ,KAAK;GAC3C,MAAM,QAAQ,eAAgB,IAAgC,IAAI,QAAQ,EAAE,CAAC,IAAI;GACjF,IAAI,CAAC,OAAO,SAAS,KAAK,GAAG,OAAO;GACpC,UAAU,WAAW,IAAI,UAAU,IAAI,IAAI,SAAS,KAAK;EAC3D;EACA,SAAS;CACX;CACA,OAAO;AACT;AAEA,SAAS,eAAe,OAAwB;CAC9C,IAAI,OAAO,UAAU,UAAU,OAAO,OAAO,SAAS,KAAK,IAAI,QAAQ;CACvE,IAAI,OAAO,UAAU,YAAY,MAAM,SAAS,GAAG;EACjD,MAAM,MAAM,OAAO,KAAK;EACxB,OAAO,OAAO,SAAS,GAAG,IAAI,MAAM;CACtC;CACA,OAAO;AACT;;;;;;ACnUA,SAAgB,eAAe,QAAyB,QAAyB,YAAmE;CAClJ,MAAM,OAA4C,CAAC;CACnD,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,MAAM,GAAG;EACxD,IAAI,MAAM,SAAS,SAAS,CAAC,MAAM,IAAI;EACvC,MAAM,OAAO,OAAO;EACpB,KAAK,OAAO,OAAO,SAAS,WAAY,WAAW,MAAM,GAAG,GAAG,SAAS,OAAQ;CAClF;CACA,OAAO;AACT;;;;;;;;;;;;;;;AAgBA,SAAgB,UAAU,QAAyB,MAAuB,YAA+C;CACvH,MAAM,cAAc,IAAI,IAAI,OAAO,KAAK,OAAO,MAAM,CAAC,CAAC,QAAQ,QAAQ,OAAO,OAAO,IAAI,EAAE,SAAS,SAAS,CAAC;CAC9G,MAAM,WAA4B,OAAO,YAAY,OAAO,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,YAAY,IAAI,GAAG,CAAC,CAAC;CAClH,MAAM,OAAO,eAAe,QAAQ,MAAM,UAAU;CACpD,MAAM,YAAY,OAAO,OAAO,OAAO,MAAM,CAAC,CAAC,QAAQ,UAAU,MAAM,SAAS,SAAS,CAAC,CAAC;CAC3F,KAAK,IAAI,OAAO,GAAG,OAAO,WAAW,QAAQ;EAC3C,IAAI,UAAU;EACd,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,MAAM,GAAG;GACxD,IAAI,MAAM,SAAS,aAAa,CAAC,MAAM,SAAS;GAChD,MAAM,OAAO,gBAAgB,MAAM,SAAS;IAAE,QAAQ;IAAU;GAAK,CAAC;GACtE,IAAI,SAAS,QAAQ,SAAS,SAAS,MAAM;IAC3C,SAAS,OAAO;IAChB,UAAU;GACZ;EACF;EACA,IAAI,CAAC,SAAS;CAChB;CACA,OAAO;AACT"}

package/dist/feeds/server/index.cjs

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_rolldown_runtime = require("../../rolldown-runtime-D6vf50IK.cjs");
 const require_deriveAll = require("../../deriveAll-Cb9rWjan.cjs");
-const require_server = require("../../server-DBi5HmrM.cjs");
+const require_server = require("../../server-U2d7Fb1h.cjs");
 const require_ingestTypes = require("../../ingestTypes-DhJ63Ogd.cjs");
 const require_feeds_paths = require("../paths.cjs");
 const require_notifier = require("../../notifier-bS8IEeLA.cjs");

package/dist/feeds/server/index.js

@@ -1,5 +1,5 @@
 import { a as FEED_SCHEDULES, o as INGEST_KINDS } from "../../deriveAll-D3wFH4Tw.js";
-import { A as promptPathsFor, D as deleteItem, E as buildCollectionActionSeedPrompt, G as safeSlugName, H as resolveDataDir, I as writeItem, P as readSkillTemplate, k as listItems, v as discoverCollections } from "../../server-DgAdWcCM.js";
+import { A as promptPathsFor, D as deleteItem, E as buildCollectionActionSeedPrompt, G as safeSlugName, H as resolveDataDir, I as writeItem, P as readSkillTemplate, k as listItems, v as discoverCollections } from "../../server-BDxrLT41.js";
 import { n as DEFAULT_FEED_MAX_ITEMS, r as isFeedSchedule, t as AGENT_INGEST_KIND } from "../../ingestTypes-BtMZogMX.js";
 import { FEEDS_DIR, feedDir, feedStatePath, feedsRoot, ingestStateDir, ingestStatePath } from "../paths.js";
 import { d as publish, n as clear } from "../../notifier-ChpY0XrY.js";

package/dist/remote-view/index.cjs

@@ -28,6 +28,15 @@ var MAX_PAGE_LIMIT = 200;
 /** Hard cap on the wrapped srcdoc: it travels to the phone INSIDE a Firestore
 *  command document (1 MiB total), so leave envelope headroom. */
 var REMOTE_VIEW_MAX_BYTES = 9e5;
+/** Hard cap on ONE `getItems` page (phase 5 — plans/feat-remote-view-images.md).
+*  Same 1 MiB command-document envelope as the srcdoc: when a view inlines image
+*  fields as `data:` URLs, the host stops inlining once the serialized page would
+*  exceed this, leaving the remaining image fields as their original path (which
+*  the view renders as a placeholder). Guards the doc-write from ever failing. */
+var REMOTE_VIEW_ITEMS_MAX_BYTES = 9e5;
+/** Default longest-edge (px) a remote view's inlined image thumbnail is
+*  downscaled to; a view may override via `imageMaxEdge`. */
+var DEFAULT_IMAGE_MAX_EDGE = 512;
 /** In-iframe `getItems` timeout — matches the remote client's `callHost`
 *  response timeout so the two layers give up together. */
 var GET_ITEMS_TIMEOUT_MS = 3e4;
@@ -51,6 +60,13 @@ var clampLimit = (value) => {
 	if (num === null || num <= 0) return 50;
 	return Math.min(num, 200);
 };
+/** Clamp an `imageMaxEdge` (arrives as untyped schema/JSON) to [64, 1024];
+*  default 512. Keeps a runaway edge from defeating the thumbnail's purpose. */
+var clampImageMaxEdge = (value) => {
+	const num = toInt(value);
+	if (num === null || num <= 0) return 512;
+	return Math.min(Math.max(num, 64), 1024);
+};
 /** Coerce a `fields` projection list from untyped message JSON. */
 var normalizeFields = (value) => {
 	if (!Array.isArray(value)) return void 0;
@@ -253,14 +269,17 @@ async function handleRemoteViewMessage(data, handlers, reply) {
 	return true;
 }
 //#endregion
+exports.DEFAULT_IMAGE_MAX_EDGE = DEFAULT_IMAGE_MAX_EDGE;
 exports.DEFAULT_PAGE_LIMIT = DEFAULT_PAGE_LIMIT;
 exports.MAX_PAGE_LIMIT = MAX_PAGE_LIMIT;
+exports.REMOTE_VIEW_ITEMS_MAX_BYTES = REMOTE_VIEW_ITEMS_MAX_BYTES;
 exports.REMOTE_VIEW_MAX_BYTES = REMOTE_VIEW_MAX_BYTES;
 exports.REMOTE_VIEW_MESSAGES = REMOTE_VIEW_MESSAGES;
 exports.REMOTE_VIEW_PROTOCOL = REMOTE_VIEW_PROTOCOL;
 exports.SANDBOXED_VIEW_CDN_ALLOWLIST = SANDBOXED_VIEW_CDN_ALLOWLIST;
 exports.buildRemoteViewCsp = buildRemoteViewCsp;
 exports.buildRemoteViewSrcdoc = buildRemoteViewSrcdoc;
+exports.clampImageMaxEdge = clampImageMaxEdge;
 exports.clampLimit = clampLimit;
 exports.clampOffset = clampOffset;
 exports.handleRemoteViewMessage = handleRemoteViewMessage;

package/dist/remote-view/index.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs","names":[],"sources":["../../src/remote-view/index.ts"],"sourcesContent":["// The remote custom-view contract (phase 3 — plans/feat-remote-custom-view.md).\n//\n// Browser-safe single source of truth shared by the host server (which wraps\n// the view HTML into a sandboxed srcdoc), the desktop phone-frame preview, and\n// the mulmoserver mobile client (post-publish). A remote view runs on a phone\n// that can reach the internet but NOT the host's localhost, so — unlike the\n// desktop custom view (token + fetch to the view-data route) — its records\n// arrive over an async postMessage bridge owned by the parent page, and its\n// CSP locks `connect-src` to 'none' entirely.\n\n/** Bump when the bootstrap/message contract changes shape; the bootstrap\n *  exposes it as `__MC_VIEW.protocol` so a parent can refuse a stale view.\n *  v2 (phase 4) adds the mutate pair below — a backward-compatible superset,\n *  so a v1 (read-only) parent still serves get-items/start-chat unchanged. */\nexport const REMOTE_VIEW_PROTOCOL = 2;\n\n/** postMessage types between the sandboxed view and its parent page.\n *  `startChat` reuses the desktop custom-view message type on purpose — the\n *  desktop parent already understands it. */\nexport const REMOTE_VIEW_MESSAGES = {\n  /** view → parent: request one page of records ({ requestId, offset, limit, fields }). */\n  getItems: \"mc-remote-get-items\",\n  /** parent → view: the reply ({ requestId, ok, page | error }). */\n  items: \"mc-remote-items\",\n  /** view → parent: mutate one record ({ requestId, op: \"update\"|\"delete\", id, patch? }). */\n  mutate: \"mc-remote-mutate\",\n  /** parent → view: the mutate reply ({ requestId, ok, result | error }). */\n  mutateResult: \"mc-remote-mutate-result\",\n  /** view → parent: open a new chat with a prefilled, NOT auto-sent draft. */\n  startChat: \"mc-start-chat\",\n} as const;\n\n/** Pagination defaults — mirrored by the phase-2 record handlers\n *  (`server/remoteHost/handlers/collectionPage.ts` imports these) so a view\n *  page can never outgrow what the command channel itself serves. */\nexport const DEFAULT_PAGE_LIMIT = 50;\nexport const MAX_PAGE_LIMIT = 200;\n\n/** Hard cap on the wrapped srcdoc: it travels to the phone INSIDE a Firestore\n *  command document (1 MiB total), so leave envelope headroom. */\nexport const REMOTE_VIEW_MAX_BYTES = 900_000;\n\n/** In-iframe `getItems` timeout — matches the remote client's `callHost`\n *  response timeout so the two layers give up together. */\nconst GET_ITEMS_TIMEOUT_MS = 30_000;\n\n// CDN allowlist for sandboxed LLM-authored HTML (script/style/font loads).\n// Shared with the desktop preview + custom-view CSPs\n// (src/utils/html/previewCsp.ts re-exports it as its default) so the two\n// policies can't drift. Keep the list audited — every entry is a potential\n// supply-chain surface; the hosts here are reputable infrastructure that does\n// not expose per-request logs to third parties.\nexport const SANDBOXED_VIEW_CDN_ALLOWLIST: readonly string[] = [\n  \"https://cdn.jsdelivr.net\",\n  \"https://unpkg.com\",\n  \"https://cdnjs.cloudflare.com\",\n  \"https://fonts.googleapis.com\",\n  \"https://fonts.gstatic.com\",\n  // Plotly's first-party CDN — the LLM defaults to it for Plotly charts.\n  \"https://cdn.plot.ly\",\n];\n\nconst toInt = (value: unknown): number | null => {\n  const num = typeof value === \"number\" ? value : typeof value === \"string\" ? Number(value) : NaN;\n  return Number.isFinite(num) ? Math.floor(num) : null;\n};\n\n/** Coerce a channel/postMessage offset (arrives as untyped JSON) to a non-negative int. */\nexport const clampOffset = (value: unknown): number => Math.max(0, toInt(value) ?? 0);\n\n/** Coerce a channel/postMessage limit to [1, MAX_PAGE_LIMIT] (default 50). */\nexport const clampLimit = (value: unknown): number => {\n  const num = toInt(value);\n  if (num === null || num <= 0) return DEFAULT_PAGE_LIMIT;\n  return Math.min(num, MAX_PAGE_LIMIT);\n};\n\n/** Coerce a `fields` projection list from untyped message JSON. */\nexport const normalizeFields = (value: unknown): string[] | undefined => {\n  if (!Array.isArray(value)) return undefined;\n  const cleaned = value\n    .filter((entry): entry is string => typeof entry === \"string\")\n    .map((entry) => entry.trim())\n    .filter((entry) => entry.length > 0);\n  return cleaned.length > 0 ? cleaned : undefined;\n};\n\nexport type RemoteViewItem = Record<string, unknown>;\n\n/** One page of records, the resolved value of the view's `getItems()`. Same\n *  shape as the phase-2 `getCollection` page so a parent can pass a channel\n *  page straight through. */\nexport interface RemoteViewPage {\n  items: RemoteViewItem[];\n  total: number;\n  offset: number;\n  limit: number;\n}\n\n/** A normalized (clamped, fields-cleaned) page request handed to a parent's\n *  `getPage` — `handleRemoteViewMessage` does the coercion so every parent\n *  answers identical values. */\nexport interface RemoteViewPageRequest {\n  offset: number;\n  limit: number;\n  fields?: string[];\n}\n\n/** Keep only `fields` (+ always the primary key) on each record. Parents apply\n *  this uniformly — the desktop preview via `pageFromItems`, the phone parent\n *  over the page it fetched through the channel — so a view sees the same\n *  projection everywhere. No-op without `fields`. */\nexport function projectItems(items: RemoteViewItem[], fields: string[] | undefined, primaryKey: string): RemoteViewItem[] {\n  if (!fields || fields.length === 0) return items;\n  const keep = new Set([primaryKey, ...fields]);\n  return items.map((item) => Object.fromEntries(Object.entries(item).filter(([key]) => keep.has(key))));\n}\n\n/** Answer a page request from an already-loaded record array (the desktop\n *  preview's data source): slice + project. Observable behavior matches the\n *  phone paging over the command channel. */\nexport function pageFromItems(items: RemoteViewItem[], request: RemoteViewPageRequest, primaryKey: string): RemoteViewPage {\n  const pageItems = items.slice(request.offset, request.offset + request.limit);\n  return { items: projectItems(pageItems, request.fields, primaryKey), total: items.length, offset: request.offset, limit: request.limit };\n}\n\n/**\n * CSP for a remote (mobile) custom view. Stricter than the desktop custom-view\n * policy: the view's data arrives over postMessage, so `connect-src` is\n * `'none'` — no fetch / XHR / WebSocket / sendBeacon to ANY origin, which\n * closes the bidirectional-exfiltration channel completely (there is no token\n * to steal either). Script/style/font keep the curated CDN allowlist (the\n * phone can reach the internet; only the host is unreachable), and\n * `img-src`/`media-src` allow any `https:` host so record image/media URLs\n * render — the same knowingly-accepted one-way GET-exfil tradeoff as the\n * desktop policy (see buildCustomViewCsp in src/utils/html/previewCsp.ts).\n */\nexport function buildRemoteViewCsp(cdns: readonly string[] = SANDBOXED_VIEW_CDN_ALLOWLIST): string {\n  const cdnList = cdns.join(\" \");\n  return [\n    \"default-src 'none'\",\n    `script-src 'unsafe-inline' ${cdnList}`,\n    `style-src 'unsafe-inline' ${cdnList}`,\n    `font-src ${cdnList}`,\n    `img-src ${cdnList} data: blob: https:`,\n    \"media-src https: data: blob:\",\n    \"connect-src 'none'\",\n  ].join(\"; \");\n}\n\n/** The in-iframe bootstrap installed before any of the view's own scripts.\n *  Owns the fiddly part of the contract — request/response correlation — so an\n *  LLM-authored view only ever awaits `__MC_VIEW.getItems(...)` /\n *  `.updateItem(...)` / `.deleteItem(...)`:\n *\n *  - `getItems({ offset, limit, fields })`: posts an `mc-remote-get-items`\n *    with a fresh `requestId`, resolves on the matching `mc-remote-items`\n *    reply (validated to come from `window.parent`), rejects on `ok: false`\n *    or after 30 s. targetOrigin `'*'` is safe: the request carries no secret\n *    and the parent is by construction the party supplying the data.\n *  - `updateItem(id, patch)` / `deleteItem(id)` (phase 4): post an\n *    `mc-remote-mutate` and resolve on the matching `mc-remote-mutate-result`,\n *    sharing the same `call()` correlation as `getItems`. Installed ONLY when\n *    the host set `writable` (the view declared `editableFields`/`allowDelete`);\n *    otherwise both reject `\"this view is read-only\"` so a mis-declared view\n *    fails loudly instead of silently no-op'ing. The HOST still re-derives and\n *    enforces the write policy — `writable` only gates the client surface.\n *  - `startChat(prompt, role)`: same message type + semantics as the desktop\n *    bridge — the parent opens a new chat with `prompt` prefilled as an\n *    editable draft, never auto-sent.\n *  - `t(key, named)`: the same vue-i18n-compatible dict helper as the desktop\n *    bootstrap (named interpolation only), over the host-picked `dict`.\n *\n *  Self-contained one-line string (no `<`, no `</script>`, `${}` only for the\n *  interpolated constants). */\nfunction remoteViewBootstrap(): string {\n  return `(function(){var v=window.__MC_VIEW,seq=0,pend={};window.addEventListener('message',function(e){if(e.source!==window.parent)return;var d=e.data;if(!d)return;if(d.type!=='${REMOTE_VIEW_MESSAGES.items}'&&d.type!=='${REMOTE_VIEW_MESSAGES.mutateResult}')return;var p=pend[d.requestId];if(!p)return;delete pend[d.requestId];clearTimeout(p.timer);if(d.ok)p.resolve(d.type==='${REMOTE_VIEW_MESSAGES.items}'?d.page:d.result);else p.reject(new Error(typeof d.error==='string'?d.error:'request failed'));});function call(type,payload){return new Promise(function(resolve,reject){var id='q'+(++seq);var timer=setTimeout(function(){delete pend[id];reject(new Error(type+' timed out'));},${GET_ITEMS_TIMEOUT_MS});pend[id]={resolve:resolve,reject:reject,timer:timer};var m={type:type,slug:v.slug,requestId:id};for(var k in payload){m[k]=payload[k];}window.parent.postMessage(m,'*');});}v.getItems=function(opts){opts=opts&&typeof opts==='object'?opts:{};return call('${REMOTE_VIEW_MESSAGES.getItems}',{offset:opts.offset,limit:opts.limit,fields:opts.fields});};if(v.writable){v.updateItem=function(id,patch){return call('${REMOTE_VIEW_MESSAGES.mutate}',{op:'update',id:String(id),patch:patch&&typeof patch==='object'?patch:{}});};v.deleteItem=function(id){return call('${REMOTE_VIEW_MESSAGES.mutate}',{op:'delete',id:String(id)});};}else{v.updateItem=v.deleteItem=function(){return Promise.reject(new Error('this view is read-only'));};}v.startChat=function(prompt,role){window.parent.postMessage({type:'${REMOTE_VIEW_MESSAGES.startChat}',slug:v.slug,prompt:String(prompt),role:typeof role==='string'?role:undefined},'*');};v.dict=v.dict||{};v.t=function(key,named){var s=v.dict[key];if(typeof s!=='string')return typeof key==='string'?key:String(key);if(!named||typeof named!=='object')return s;return s.replace(/\\\\{(\\\\w+)\\\\}/g,function(m,n){var x=named[n];return x==null?m:String(x);});};})();`;\n}\n\n/** What the host injects into `window.__MC_VIEW` — note what is ABSENT\n *  compared to the desktop boot: no token, no dataUrl, no origin. */\nexport interface RemoteViewBoot {\n  slug: string;\n  /** Locale the dict was picked for; empty string when no translations. */\n  locale?: string;\n  /** Host-picked, locale-filtered flat string map (same contract as the\n   *  desktop custom-view dict). */\n  dict?: Record<string, string>;\n  /** True when the view declared a mutable surface (`editableFields` and/or\n   *  `allowDelete`). Gates the client-side `updateItem`/`deleteItem` install\n   *  only — the host re-enforces the actual policy on every mutate. */\n  writable?: boolean;\n}\n\n/** Wrap a view's HTML into the sandboxed srcdoc: CSP meta + `__MC_VIEW` boot +\n *  bridge bootstrap injected at the start of `<head>` (before any view\n *  script). Runs HOST-side (`getRemoteView`) so the phone and the desktop\n *  preview receive the identical finished artifact. */\nexport function buildRemoteViewSrcdoc(html: string, boot: RemoteViewBoot): string {\n  const cspMeta = `<meta http-equiv=\"Content-Security-Policy\" content=\"${buildRemoteViewCsp()}\">`;\n  // `<`-escape the JSON so a hostile slug/dict string can't break out of the\n  // <script> element (same escape as the desktop srcdoc builder).\n  const json = JSON.stringify({\n    slug: boot.slug,\n    locale: boot.locale ?? \"\",\n    dict: boot.dict ?? {},\n    target: \"mobile\",\n    protocol: REMOTE_VIEW_PROTOCOL,\n    writable: boot.writable ?? false,\n  }).replace(/</g, \"\\\\u003c\");\n  const injection = `${cspMeta}<script>window.__MC_VIEW=${json};${remoteViewBootstrap()}</script>`;\n  if (/<head\\b[^>]*>/i.test(html)) {\n    return html.replace(/(<head\\b[^>]*>)/i, `$1${injection}`);\n  }\n  return `<!DOCTYPE html><html><head>${injection}</head><body>${html}</body></html>`;\n}\n\n/** A normalized mutate request handed to a parent's `onMutate`\n *  (`handleRemoteViewMessage` validates op/id/patch first). `update` carries a\n *  partial record; the HOST decides which keys are actually writable. */\nexport type RemoteViewMutateRequest = { op: \"update\"; id: string; patch: Record<string, unknown> } | { op: \"delete\"; id: string };\n\n/** The resolved value of a mutate: the merged record for an update, the removed\n *  id for a delete. Sent back to the view as the `mc-remote-mutate-result`\n *  `result`. */\nexport interface RemoteViewMutateResult {\n  item?: RemoteViewItem;\n  id?: string;\n}\n\n/** What a parent page provides to answer the sandboxed view. Deliberately\n *  minimal — exactly the phone runtime's capabilities, nothing more, so the\n *  desktop preview can never exceed what works on the phone. */\nexport interface RemoteViewBridgeHandlers {\n  slug: string;\n  /** Answer one normalized page request (already clamped + fields-cleaned). */\n  getPage: (request: RemoteViewPageRequest) => Promise<RemoteViewPage> | RemoteViewPage;\n  /** Apply one normalized mutate (update/delete). Omit on a read-only parent —\n   *  the handler then replies `ok: false, \"this view is read-only\"`. The parent\n   *  forwards to the host (which enforces the write policy authoritatively). */\n  onMutate?: (request: RemoteViewMutateRequest) => Promise<RemoteViewMutateResult> | RemoteViewMutateResult;\n  /** Relay a `startChat` draft; omit on a parent without a chat surface. */\n  onStartChat?: (prompt: string, role?: string) => void;\n}\n\n/** Coerce an untyped `mc-remote-mutate` payload to a normalized request, or\n *  null when it is malformed (unknown op, missing id, non-object update patch —\n *  the parent then replies with an `\"invalid mutate request\"` error). */\nexport function normalizeMutate(data: { op?: unknown; id?: unknown; patch?: unknown }): RemoteViewMutateRequest | null {\n  const itemId = typeof data.id === \"string\" ? data.id : typeof data.id === \"number\" && Number.isFinite(data.id) ? String(data.id) : \"\";\n  if (!itemId) return null;\n  if (data.op === \"delete\") return { op: \"delete\", id: itemId };\n  if (data.op === \"update\") {\n    if (typeof data.patch !== \"object\" || data.patch === null || Array.isArray(data.patch)) return null;\n    return { op: \"update\", id: itemId, patch: data.patch as Record<string, unknown> };\n  }\n  return null;\n}\n\nasync function answerGetItems(requestId: string, request: RemoteViewPageRequest, handlers: RemoteViewBridgeHandlers, reply: RemoteViewReply): Promise<void> {\n  try {\n    const page = await handlers.getPage(request);\n    reply({ type: REMOTE_VIEW_MESSAGES.items, requestId, ok: true, page });\n  } catch (err) {\n    reply({ type: REMOTE_VIEW_MESSAGES.items, requestId, ok: false, error: err instanceof Error ? err.message : String(err) });\n  }\n}\n\n/** Validate + dispatch a `mc-remote-mutate` payload, replying on every path\n *  (malformed request, read-only parent, handler success/throw). Split out of\n *  `handleRemoteViewMessage` so that function stays under the 20-line limit. */\nasync function answerMutate(\n  requestId: string,\n  msg: { op?: unknown; id?: unknown; patch?: unknown },\n  handlers: RemoteViewBridgeHandlers,\n  reply: RemoteViewReply,\n): Promise<void> {\n  const request = normalizeMutate(msg);\n  if (!request) {\n    reply({ type: REMOTE_VIEW_MESSAGES.mutateResult, requestId, ok: false, error: \"invalid mutate request\" });\n    return;\n  }\n  if (!handlers.onMutate) {\n    reply({ type: REMOTE_VIEW_MESSAGES.mutateResult, requestId, ok: false, error: \"this view is read-only\" });\n    return;\n  }\n  try {\n    const result = await handlers.onMutate(request);\n    reply({ type: REMOTE_VIEW_MESSAGES.mutateResult, requestId, ok: true, result });\n  } catch (err) {\n    reply({ type: REMOTE_VIEW_MESSAGES.mutateResult, requestId, ok: false, error: err instanceof Error ? err.message : String(err) });\n  }\n}\n\ntype RemoteViewReply = (message: Record<string, unknown>) => void;\n\n/**\n * Handle one message-event payload from a sandboxed remote view. DOM- and\n * framework-free: the caller owns the `message` listener (and MUST verify\n * `event.source === iframe.contentWindow` before calling), `reply` posts the\n * response back into the iframe (targetOrigin `\"*\"` — the sandboxed document's\n * origin is opaque, so nothing else can match). Returns true when the payload\n * was a remote-view request for this slug (callers ignore everything else).\n */\nexport async function handleRemoteViewMessage(data: unknown, handlers: RemoteViewBridgeHandlers, reply: RemoteViewReply): Promise<boolean> {\n  if (typeof data !== \"object\" || data === null) return false;\n  const msg = data as {\n    type?: unknown;\n    slug?: unknown;\n    requestId?: unknown;\n    offset?: unknown;\n    limit?: unknown;\n    fields?: unknown;\n    op?: unknown;\n    id?: unknown;\n    patch?: unknown;\n    prompt?: unknown;\n    role?: unknown;\n  };\n  if (msg.slug !== handlers.slug) return false;\n  if (msg.type === REMOTE_VIEW_MESSAGES.startChat) {\n    const prompt = typeof msg.prompt === \"string\" ? msg.prompt.trim() : \"\";\n    if (prompt) handlers.onStartChat?.(prompt, typeof msg.role === \"string\" ? msg.role : undefined);\n    return true;\n  }\n  if (msg.type === REMOTE_VIEW_MESSAGES.mutate && typeof msg.requestId === \"string\") {\n    await answerMutate(msg.requestId, msg, handlers, reply);\n    return true;\n  }\n  if (msg.type !== REMOTE_VIEW_MESSAGES.getItems || typeof msg.requestId !== \"string\") return false;\n  const request: RemoteViewPageRequest = { offset: clampOffset(msg.offset), limit: clampLimit(msg.limit), fields: normalizeFields(msg.fields) };\n  await answerGetItems(msg.requestId, request, handlers, reply);\n  return true;\n}\n"],"mappings":";;;;;;AAcA,IAAa,uBAAuB;;;;AAKpC,IAAa,uBAAuB;;CAElC,UAAU;;CAEV,OAAO;;CAEP,QAAQ;;CAER,cAAc;;CAEd,WAAW;AACb;;;;AAKA,IAAa,qBAAqB;AAClC,IAAa,iBAAiB;;;AAI9B,IAAa,wBAAwB;;;AAIrC,IAAM,uBAAuB;AAQ7B,IAAa,+BAAkD;CAC7D;CACA;CACA;CACA;CACA;CAEA;AACF;AAEA,IAAM,SAAS,UAAkC;CAC/C,MAAM,MAAM,OAAO,UAAU,WAAW,QAAQ,OAAO,UAAU,WAAW,OAAO,KAAK,IAAI;CAC5F,OAAO,OAAO,SAAS,GAAG,IAAI,KAAK,MAAM,GAAG,IAAI;AAClD;;AAGA,IAAa,eAAe,UAA2B,KAAK,IAAI,GAAG,MAAM,KAAK,KAAK,CAAC;;AAGpF,IAAa,cAAc,UAA2B;CACpD,MAAM,MAAM,MAAM,KAAK;CACvB,IAAI,QAAQ,QAAQ,OAAO,GAAG,OAAA;CAC9B,OAAO,KAAK,IAAI,KAAA,GAAmB;AACrC;;AAGA,IAAa,mBAAmB,UAAyC;CACvE,IAAI,CAAC,MAAM,QAAQ,KAAK,GAAG,OAAO,KAAA;CAClC,MAAM,UAAU,MACb,QAAQ,UAA2B,OAAO,UAAU,QAAQ,CAAC,CAC7D,KAAK,UAAU,MAAM,KAAK,CAAC,CAAC,CAC5B,QAAQ,UAAU,MAAM,SAAS,CAAC;CACrC,OAAO,QAAQ,SAAS,IAAI,UAAU,KAAA;AACxC;;;;;AA2BA,SAAgB,aAAa,OAAyB,QAA8B,YAAsC;CACxH,IAAI,CAAC,UAAU,OAAO,WAAW,GAAG,OAAO;CAC3C,MAAM,uBAAO,IAAI,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC;CAC5C,OAAO,MAAM,KAAK,SAAS,OAAO,YAAY,OAAO,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,SAAS,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC;AACtG;;;;AAKA,SAAgB,cAAc,OAAyB,SAAgC,YAAoC;CAEzH,OAAO;EAAE,OAAO,aADE,MAAM,MAAM,QAAQ,QAAQ,QAAQ,SAAS,QAAQ,KAC1C,GAAW,QAAQ,QAAQ,UAAU;EAAG,OAAO,MAAM;EAAQ,QAAQ,QAAQ;EAAQ,OAAO,QAAQ;CAAM;AACzI;;;;;;;;;;;;AAaA,SAAgB,mBAAmB,OAA0B,8BAAsC;CACjG,MAAM,UAAU,KAAK,KAAK,GAAG;CAC7B,OAAO;EACL;EACA,8BAA8B;EAC9B,6BAA6B;EAC7B,YAAY;EACZ,WAAW,QAAQ;EACnB;EACA;CACF,CAAC,CAAC,KAAK,IAAI;AACb;;;;;;;;;;;;;;;;;;;;;;;;;;AA2BA,SAAS,sBAA8B;CACrC,OAAO,4KAA4K,qBAAqB,MAAM,eAAe,qBAAqB,aAAa,2HAA2H,qBAAqB,MAAM,uRAAuR,qBAAqB,iQAAiQ,qBAAqB,SAAS,4HAA4H,qBAAqB,OAAO,wHAAwH,qBAAqB,OAAO,+MAA+M,qBAAqB,UAAU;AAC5/C;;;;;AAqBA,SAAgB,sBAAsB,MAAc,MAA8B;CAYhF,MAAM,YAAY,GAAG,uDAXkD,mBAAmB,EAAE,IAW/D,2BARhB,KAAK,UAAU;EAC1B,MAAM,KAAK;EACX,QAAQ,KAAK,UAAU;EACvB,MAAM,KAAK,QAAQ,CAAC;EACpB,QAAQ;EACR,UAAA;EACA,UAAU,KAAK,YAAY;CAC7B,CAAC,CAAC,CAAC,QAAQ,MAAM,SACuC,EAAK,GAAG,oBAAoB,EAAE;CACtF,IAAI,iBAAiB,KAAK,IAAI,GAC5B,OAAO,KAAK,QAAQ,oBAAoB,KAAK,WAAW;CAE1D,OAAO,8BAA8B,UAAU,eAAe,KAAK;AACrE;;;;AAiCA,SAAgB,gBAAgB,MAAuF;CACrH,MAAM,SAAS,OAAO,KAAK,OAAO,WAAW,KAAK,KAAK,OAAO,KAAK,OAAO,YAAY,OAAO,SAAS,KAAK,EAAE,IAAI,OAAO,KAAK,EAAE,IAAI;CACnI,IAAI,CAAC,QAAQ,OAAO;CACpB,IAAI,KAAK,OAAO,UAAU,OAAO;EAAE,IAAI;EAAU,IAAI;CAAO;CAC5D,IAAI,KAAK,OAAO,UAAU;EACxB,IAAI,OAAO,KAAK,UAAU,YAAY,KAAK,UAAU,QAAQ,MAAM,QAAQ,KAAK,KAAK,GAAG,OAAO;EAC/F,OAAO;GAAE,IAAI;GAAU,IAAI;GAAQ,OAAO,KAAK;EAAiC;CAClF;CACA,OAAO;AACT;AAEA,eAAe,eAAe,WAAmB,SAAgC,UAAoC,OAAuC;CAC1J,IAAI;EACF,MAAM,OAAO,MAAM,SAAS,QAAQ,OAAO;EAC3C,MAAM;GAAE,MAAM,qBAAqB;GAAO;GAAW,IAAI;GAAM;EAAK,CAAC;CACvE,SAAS,KAAK;EACZ,MAAM;GAAE,MAAM,qBAAqB;GAAO;GAAW,IAAI;GAAO,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;EAAE,CAAC;CAC3H;AACF;;;;AAKA,eAAe,aACb,WACA,KACA,UACA,OACe;CACf,MAAM,UAAU,gBAAgB,GAAG;CACnC,IAAI,CAAC,SAAS;EACZ,MAAM;GAAE,MAAM,qBAAqB;GAAc;GAAW,IAAI;GAAO,OAAO;EAAyB,CAAC;EACxG;CACF;CACA,IAAI,CAAC,SAAS,UAAU;EACtB,MAAM;GAAE,MAAM,qBAAqB;GAAc;GAAW,IAAI;GAAO,OAAO;EAAyB,CAAC;EACxG;CACF;CACA,IAAI;EACF,MAAM,SAAS,MAAM,SAAS,SAAS,OAAO;EAC9C,MAAM;GAAE,MAAM,qBAAqB;GAAc;GAAW,IAAI;GAAM;EAAO,CAAC;CAChF,SAAS,KAAK;EACZ,MAAM;GAAE,MAAM,qBAAqB;GAAc;GAAW,IAAI;GAAO,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;EAAE,CAAC;CAClI;AACF;;;;;;;;;AAYA,eAAsB,wBAAwB,MAAe,UAAoC,OAA0C;CACzI,IAAI,OAAO,SAAS,YAAY,SAAS,MAAM,OAAO;CACtD,MAAM,MAAM;CAaZ,IAAI,IAAI,SAAS,SAAS,MAAM,OAAO;CACvC,IAAI,IAAI,SAAS,qBAAqB,WAAW;EAC/C,MAAM,SAAS,OAAO,IAAI,WAAW,WAAW,IAAI,OAAO,KAAK,IAAI;EACpE,IAAI,QAAQ,SAAS,cAAc,QAAQ,OAAO,IAAI,SAAS,WAAW,IAAI,OAAO,KAAA,CAAS;EAC9F,OAAO;CACT;CACA,IAAI,IAAI,SAAS,qBAAqB,UAAU,OAAO,IAAI,cAAc,UAAU;EACjF,MAAM,aAAa,IAAI,WAAW,KAAK,UAAU,KAAK;EACtD,OAAO;CACT;CACA,IAAI,IAAI,SAAS,qBAAqB,YAAY,OAAO,IAAI,cAAc,UAAU,OAAO;CAC5F,MAAM,UAAiC;EAAE,QAAQ,YAAY,IAAI,MAAM;EAAG,OAAO,WAAW,IAAI,KAAK;EAAG,QAAQ,gBAAgB,IAAI,MAAM;CAAE;CAC5I,MAAM,eAAe,IAAI,WAAW,SAAS,UAAU,KAAK;CAC5D,OAAO;AACT"}
+{"version":3,"file":"index.cjs","names":[],"sources":["../../src/remote-view/index.ts"],"sourcesContent":["// The remote custom-view contract (phase 3 — plans/feat-remote-custom-view.md).\n//\n// Browser-safe single source of truth shared by the host server (which wraps\n// the view HTML into a sandboxed srcdoc), the desktop phone-frame preview, and\n// the mulmoserver mobile client (post-publish). A remote view runs on a phone\n// that can reach the internet but NOT the host's localhost, so — unlike the\n// desktop custom view (token + fetch to the view-data route) — its records\n// arrive over an async postMessage bridge owned by the parent page, and its\n// CSP locks `connect-src` to 'none' entirely.\n\n/** Bump when the bootstrap/message contract changes shape; the bootstrap\n *  exposes it as `__MC_VIEW.protocol` so a parent can refuse a stale view.\n *  v2 (phase 4) adds the mutate pair below — a backward-compatible superset,\n *  so a v1 (read-only) parent still serves get-items/start-chat unchanged. */\nexport const REMOTE_VIEW_PROTOCOL = 2;\n\n/** postMessage types between the sandboxed view and its parent page.\n *  `startChat` reuses the desktop custom-view message type on purpose — the\n *  desktop parent already understands it. */\nexport const REMOTE_VIEW_MESSAGES = {\n  /** view → parent: request one page of records ({ requestId, offset, limit, fields }). */\n  getItems: \"mc-remote-get-items\",\n  /** parent → view: the reply ({ requestId, ok, page | error }). */\n  items: \"mc-remote-items\",\n  /** view → parent: mutate one record ({ requestId, op: \"update\"|\"delete\", id, patch? }). */\n  mutate: \"mc-remote-mutate\",\n  /** parent → view: the mutate reply ({ requestId, ok, result | error }). */\n  mutateResult: \"mc-remote-mutate-result\",\n  /** view → parent: open a new chat with a prefilled, NOT auto-sent draft. */\n  startChat: \"mc-start-chat\",\n} as const;\n\n/** Pagination defaults — mirrored by the phase-2 record handlers\n *  (`server/remoteHost/handlers/collectionPage.ts` imports these) so a view\n *  page can never outgrow what the command channel itself serves. */\nexport const DEFAULT_PAGE_LIMIT = 50;\nexport const MAX_PAGE_LIMIT = 200;\n\n/** Hard cap on the wrapped srcdoc: it travels to the phone INSIDE a Firestore\n *  command document (1 MiB total), so leave envelope headroom. */\nexport const REMOTE_VIEW_MAX_BYTES = 900_000;\n\n/** Hard cap on ONE `getItems` page (phase 5 — plans/feat-remote-view-images.md).\n *  Same 1 MiB command-document envelope as the srcdoc: when a view inlines image\n *  fields as `data:` URLs, the host stops inlining once the serialized page would\n *  exceed this, leaving the remaining image fields as their original path (which\n *  the view renders as a placeholder). Guards the doc-write from ever failing. */\nexport const REMOTE_VIEW_ITEMS_MAX_BYTES = 900_000;\n\n/** Default longest-edge (px) a remote view's inlined image thumbnail is\n *  downscaled to; a view may override via `imageMaxEdge`. */\nexport const DEFAULT_IMAGE_MAX_EDGE = 512;\n\n/** In-iframe `getItems` timeout — matches the remote client's `callHost`\n *  response timeout so the two layers give up together. */\nconst GET_ITEMS_TIMEOUT_MS = 30_000;\n\n// CDN allowlist for sandboxed LLM-authored HTML (script/style/font loads).\n// Shared with the desktop preview + custom-view CSPs\n// (src/utils/html/previewCsp.ts re-exports it as its default) so the two\n// policies can't drift. Keep the list audited — every entry is a potential\n// supply-chain surface; the hosts here are reputable infrastructure that does\n// not expose per-request logs to third parties.\nexport const SANDBOXED_VIEW_CDN_ALLOWLIST: readonly string[] = [\n  \"https://cdn.jsdelivr.net\",\n  \"https://unpkg.com\",\n  \"https://cdnjs.cloudflare.com\",\n  \"https://fonts.googleapis.com\",\n  \"https://fonts.gstatic.com\",\n  // Plotly's first-party CDN — the LLM defaults to it for Plotly charts.\n  \"https://cdn.plot.ly\",\n];\n\nconst toInt = (value: unknown): number | null => {\n  const num = typeof value === \"number\" ? value : typeof value === \"string\" ? Number(value) : NaN;\n  return Number.isFinite(num) ? Math.floor(num) : null;\n};\n\n/** Coerce a channel/postMessage offset (arrives as untyped JSON) to a non-negative int. */\nexport const clampOffset = (value: unknown): number => Math.max(0, toInt(value) ?? 0);\n\n/** Coerce a channel/postMessage limit to [1, MAX_PAGE_LIMIT] (default 50). */\nexport const clampLimit = (value: unknown): number => {\n  const num = toInt(value);\n  if (num === null || num <= 0) return DEFAULT_PAGE_LIMIT;\n  return Math.min(num, MAX_PAGE_LIMIT);\n};\n\n/** Clamp an `imageMaxEdge` (arrives as untyped schema/JSON) to [64, 1024];\n *  default 512. Keeps a runaway edge from defeating the thumbnail's purpose. */\nexport const clampImageMaxEdge = (value: unknown): number => {\n  const num = toInt(value);\n  if (num === null || num <= 0) return DEFAULT_IMAGE_MAX_EDGE;\n  return Math.min(Math.max(num, 64), 1024);\n};\n\n/** Coerce a `fields` projection list from untyped message JSON. */\nexport const normalizeFields = (value: unknown): string[] | undefined => {\n  if (!Array.isArray(value)) return undefined;\n  const cleaned = value\n    .filter((entry): entry is string => typeof entry === \"string\")\n    .map((entry) => entry.trim())\n    .filter((entry) => entry.length > 0);\n  return cleaned.length > 0 ? cleaned : undefined;\n};\n\nexport type RemoteViewItem = Record<string, unknown>;\n\n/** One page of records, the resolved value of the view's `getItems()`. Same\n *  shape as the phase-2 `getCollection` page so a parent can pass a channel\n *  page straight through. */\nexport interface RemoteViewPage {\n  items: RemoteViewItem[];\n  total: number;\n  offset: number;\n  limit: number;\n}\n\n/** A normalized (clamped, fields-cleaned) page request handed to a parent's\n *  `getPage` — `handleRemoteViewMessage` does the coercion so every parent\n *  answers identical values. */\nexport interface RemoteViewPageRequest {\n  offset: number;\n  limit: number;\n  fields?: string[];\n}\n\n/** Keep only `fields` (+ always the primary key) on each record. Parents apply\n *  this uniformly — the desktop preview via `pageFromItems`, the phone parent\n *  over the page it fetched through the channel — so a view sees the same\n *  projection everywhere. No-op without `fields`. */\nexport function projectItems(items: RemoteViewItem[], fields: string[] | undefined, primaryKey: string): RemoteViewItem[] {\n  if (!fields || fields.length === 0) return items;\n  const keep = new Set([primaryKey, ...fields]);\n  return items.map((item) => Object.fromEntries(Object.entries(item).filter(([key]) => keep.has(key))));\n}\n\n/** Answer a page request from an already-loaded record array (the desktop\n *  preview's data source): slice + project. Observable behavior matches the\n *  phone paging over the command channel. */\nexport function pageFromItems(items: RemoteViewItem[], request: RemoteViewPageRequest, primaryKey: string): RemoteViewPage {\n  const pageItems = items.slice(request.offset, request.offset + request.limit);\n  return { items: projectItems(pageItems, request.fields, primaryKey), total: items.length, offset: request.offset, limit: request.limit };\n}\n\n/**\n * CSP for a remote (mobile) custom view. Stricter than the desktop custom-view\n * policy: the view's data arrives over postMessage, so `connect-src` is\n * `'none'` — no fetch / XHR / WebSocket / sendBeacon to ANY origin, which\n * closes the bidirectional-exfiltration channel completely (there is no token\n * to steal either). Script/style/font keep the curated CDN allowlist (the\n * phone can reach the internet; only the host is unreachable), and\n * `img-src`/`media-src` allow any `https:` host so record image/media URLs\n * render — the same knowingly-accepted one-way GET-exfil tradeoff as the\n * desktop policy (see buildCustomViewCsp in src/utils/html/previewCsp.ts).\n */\nexport function buildRemoteViewCsp(cdns: readonly string[] = SANDBOXED_VIEW_CDN_ALLOWLIST): string {\n  const cdnList = cdns.join(\" \");\n  return [\n    \"default-src 'none'\",\n    `script-src 'unsafe-inline' ${cdnList}`,\n    `style-src 'unsafe-inline' ${cdnList}`,\n    `font-src ${cdnList}`,\n    `img-src ${cdnList} data: blob: https:`,\n    \"media-src https: data: blob:\",\n    \"connect-src 'none'\",\n  ].join(\"; \");\n}\n\n/** The in-iframe bootstrap installed before any of the view's own scripts.\n *  Owns the fiddly part of the contract — request/response correlation — so an\n *  LLM-authored view only ever awaits `__MC_VIEW.getItems(...)` /\n *  `.updateItem(...)` / `.deleteItem(...)`:\n *\n *  - `getItems({ offset, limit, fields })`: posts an `mc-remote-get-items`\n *    with a fresh `requestId`, resolves on the matching `mc-remote-items`\n *    reply (validated to come from `window.parent`), rejects on `ok: false`\n *    or after 30 s. targetOrigin `'*'` is safe: the request carries no secret\n *    and the parent is by construction the party supplying the data.\n *  - `updateItem(id, patch)` / `deleteItem(id)` (phase 4): post an\n *    `mc-remote-mutate` and resolve on the matching `mc-remote-mutate-result`,\n *    sharing the same `call()` correlation as `getItems`. Installed ONLY when\n *    the host set `writable` (the view declared `editableFields`/`allowDelete`);\n *    otherwise both reject `\"this view is read-only\"` so a mis-declared view\n *    fails loudly instead of silently no-op'ing. The HOST still re-derives and\n *    enforces the write policy — `writable` only gates the client surface.\n *  - `startChat(prompt, role)`: same message type + semantics as the desktop\n *    bridge — the parent opens a new chat with `prompt` prefilled as an\n *    editable draft, never auto-sent.\n *  - `t(key, named)`: the same vue-i18n-compatible dict helper as the desktop\n *    bootstrap (named interpolation only), over the host-picked `dict`.\n *\n *  Self-contained one-line string (no `<`, no `</script>`, `${}` only for the\n *  interpolated constants). */\nfunction remoteViewBootstrap(): string {\n  return `(function(){var v=window.__MC_VIEW,seq=0,pend={};window.addEventListener('message',function(e){if(e.source!==window.parent)return;var d=e.data;if(!d)return;if(d.type!=='${REMOTE_VIEW_MESSAGES.items}'&&d.type!=='${REMOTE_VIEW_MESSAGES.mutateResult}')return;var p=pend[d.requestId];if(!p)return;delete pend[d.requestId];clearTimeout(p.timer);if(d.ok)p.resolve(d.type==='${REMOTE_VIEW_MESSAGES.items}'?d.page:d.result);else p.reject(new Error(typeof d.error==='string'?d.error:'request failed'));});function call(type,payload){return new Promise(function(resolve,reject){var id='q'+(++seq);var timer=setTimeout(function(){delete pend[id];reject(new Error(type+' timed out'));},${GET_ITEMS_TIMEOUT_MS});pend[id]={resolve:resolve,reject:reject,timer:timer};var m={type:type,slug:v.slug,requestId:id};for(var k in payload){m[k]=payload[k];}window.parent.postMessage(m,'*');});}v.getItems=function(opts){opts=opts&&typeof opts==='object'?opts:{};return call('${REMOTE_VIEW_MESSAGES.getItems}',{offset:opts.offset,limit:opts.limit,fields:opts.fields});};if(v.writable){v.updateItem=function(id,patch){return call('${REMOTE_VIEW_MESSAGES.mutate}',{op:'update',id:String(id),patch:patch&&typeof patch==='object'?patch:{}});};v.deleteItem=function(id){return call('${REMOTE_VIEW_MESSAGES.mutate}',{op:'delete',id:String(id)});};}else{v.updateItem=v.deleteItem=function(){return Promise.reject(new Error('this view is read-only'));};}v.startChat=function(prompt,role){window.parent.postMessage({type:'${REMOTE_VIEW_MESSAGES.startChat}',slug:v.slug,prompt:String(prompt),role:typeof role==='string'?role:undefined},'*');};v.dict=v.dict||{};v.t=function(key,named){var s=v.dict[key];if(typeof s!=='string')return typeof key==='string'?key:String(key);if(!named||typeof named!=='object')return s;return s.replace(/\\\\{(\\\\w+)\\\\}/g,function(m,n){var x=named[n];return x==null?m:String(x);});};})();`;\n}\n\n/** What the host injects into `window.__MC_VIEW` — note what is ABSENT\n *  compared to the desktop boot: no token, no dataUrl, no origin. */\nexport interface RemoteViewBoot {\n  slug: string;\n  /** Locale the dict was picked for; empty string when no translations. */\n  locale?: string;\n  /** Host-picked, locale-filtered flat string map (same contract as the\n   *  desktop custom-view dict). */\n  dict?: Record<string, string>;\n  /** True when the view declared a mutable surface (`editableFields` and/or\n   *  `allowDelete`). Gates the client-side `updateItem`/`deleteItem` install\n   *  only — the host re-enforces the actual policy on every mutate. */\n  writable?: boolean;\n}\n\n/** Wrap a view's HTML into the sandboxed srcdoc: CSP meta + `__MC_VIEW` boot +\n *  bridge bootstrap injected at the start of `<head>` (before any view\n *  script). Runs HOST-side (`getRemoteView`) so the phone and the desktop\n *  preview receive the identical finished artifact. */\nexport function buildRemoteViewSrcdoc(html: string, boot: RemoteViewBoot): string {\n  const cspMeta = `<meta http-equiv=\"Content-Security-Policy\" content=\"${buildRemoteViewCsp()}\">`;\n  // `<`-escape the JSON so a hostile slug/dict string can't break out of the\n  // <script> element (same escape as the desktop srcdoc builder).\n  const json = JSON.stringify({\n    slug: boot.slug,\n    locale: boot.locale ?? \"\",\n    dict: boot.dict ?? {},\n    target: \"mobile\",\n    protocol: REMOTE_VIEW_PROTOCOL,\n    writable: boot.writable ?? false,\n  }).replace(/</g, \"\\\\u003c\");\n  const injection = `${cspMeta}<script>window.__MC_VIEW=${json};${remoteViewBootstrap()}</script>`;\n  if (/<head\\b[^>]*>/i.test(html)) {\n    return html.replace(/(<head\\b[^>]*>)/i, `$1${injection}`);\n  }\n  return `<!DOCTYPE html><html><head>${injection}</head><body>${html}</body></html>`;\n}\n\n/** A normalized mutate request handed to a parent's `onMutate`\n *  (`handleRemoteViewMessage` validates op/id/patch first). `update` carries a\n *  partial record; the HOST decides which keys are actually writable. */\nexport type RemoteViewMutateRequest = { op: \"update\"; id: string; patch: Record<string, unknown> } | { op: \"delete\"; id: string };\n\n/** The resolved value of a mutate: the merged record for an update, the removed\n *  id for a delete. Sent back to the view as the `mc-remote-mutate-result`\n *  `result`. */\nexport interface RemoteViewMutateResult {\n  item?: RemoteViewItem;\n  id?: string;\n}\n\n/** What a parent page provides to answer the sandboxed view. Deliberately\n *  minimal — exactly the phone runtime's capabilities, nothing more, so the\n *  desktop preview can never exceed what works on the phone. */\nexport interface RemoteViewBridgeHandlers {\n  slug: string;\n  /** Answer one normalized page request (already clamped + fields-cleaned). */\n  getPage: (request: RemoteViewPageRequest) => Promise<RemoteViewPage> | RemoteViewPage;\n  /** Apply one normalized mutate (update/delete). Omit on a read-only parent —\n   *  the handler then replies `ok: false, \"this view is read-only\"`. The parent\n   *  forwards to the host (which enforces the write policy authoritatively). */\n  onMutate?: (request: RemoteViewMutateRequest) => Promise<RemoteViewMutateResult> | RemoteViewMutateResult;\n  /** Relay a `startChat` draft; omit on a parent without a chat surface. */\n  onStartChat?: (prompt: string, role?: string) => void;\n}\n\n/** Coerce an untyped `mc-remote-mutate` payload to a normalized request, or\n *  null when it is malformed (unknown op, missing id, non-object update patch —\n *  the parent then replies with an `\"invalid mutate request\"` error). */\nexport function normalizeMutate(data: { op?: unknown; id?: unknown; patch?: unknown }): RemoteViewMutateRequest | null {\n  const itemId = typeof data.id === \"string\" ? data.id : typeof data.id === \"number\" && Number.isFinite(data.id) ? String(data.id) : \"\";\n  if (!itemId) return null;\n  if (data.op === \"delete\") return { op: \"delete\", id: itemId };\n  if (data.op === \"update\") {\n    if (typeof data.patch !== \"object\" || data.patch === null || Array.isArray(data.patch)) return null;\n    return { op: \"update\", id: itemId, patch: data.patch as Record<string, unknown> };\n  }\n  return null;\n}\n\nasync function answerGetItems(requestId: string, request: RemoteViewPageRequest, handlers: RemoteViewBridgeHandlers, reply: RemoteViewReply): Promise<void> {\n  try {\n    const page = await handlers.getPage(request);\n    reply({ type: REMOTE_VIEW_MESSAGES.items, requestId, ok: true, page });\n  } catch (err) {\n    reply({ type: REMOTE_VIEW_MESSAGES.items, requestId, ok: false, error: err instanceof Error ? err.message : String(err) });\n  }\n}\n\n/** Validate + dispatch a `mc-remote-mutate` payload, replying on every path\n *  (malformed request, read-only parent, handler success/throw). Split out of\n *  `handleRemoteViewMessage` so that function stays under the 20-line limit. */\nasync function answerMutate(\n  requestId: string,\n  msg: { op?: unknown; id?: unknown; patch?: unknown },\n  handlers: RemoteViewBridgeHandlers,\n  reply: RemoteViewReply,\n): Promise<void> {\n  const request = normalizeMutate(msg);\n  if (!request) {\n    reply({ type: REMOTE_VIEW_MESSAGES.mutateResult, requestId, ok: false, error: \"invalid mutate request\" });\n    return;\n  }\n  if (!handlers.onMutate) {\n    reply({ type: REMOTE_VIEW_MESSAGES.mutateResult, requestId, ok: false, error: \"this view is read-only\" });\n    return;\n  }\n  try {\n    const result = await handlers.onMutate(request);\n    reply({ type: REMOTE_VIEW_MESSAGES.mutateResult, requestId, ok: true, result });\n  } catch (err) {\n    reply({ type: REMOTE_VIEW_MESSAGES.mutateResult, requestId, ok: false, error: err instanceof Error ? err.message : String(err) });\n  }\n}\n\ntype RemoteViewReply = (message: Record<string, unknown>) => void;\n\n/**\n * Handle one message-event payload from a sandboxed remote view. DOM- and\n * framework-free: the caller owns the `message` listener (and MUST verify\n * `event.source === iframe.contentWindow` before calling), `reply` posts the\n * response back into the iframe (targetOrigin `\"*\"` — the sandboxed document's\n * origin is opaque, so nothing else can match). Returns true when the payload\n * was a remote-view request for this slug (callers ignore everything else).\n */\nexport async function handleRemoteViewMessage(data: unknown, handlers: RemoteViewBridgeHandlers, reply: RemoteViewReply): Promise<boolean> {\n  if (typeof data !== \"object\" || data === null) return false;\n  const msg = data as {\n    type?: unknown;\n    slug?: unknown;\n    requestId?: unknown;\n    offset?: unknown;\n    limit?: unknown;\n    fields?: unknown;\n    op?: unknown;\n    id?: unknown;\n    patch?: unknown;\n    prompt?: unknown;\n    role?: unknown;\n  };\n  if (msg.slug !== handlers.slug) return false;\n  if (msg.type === REMOTE_VIEW_MESSAGES.startChat) {\n    const prompt = typeof msg.prompt === \"string\" ? msg.prompt.trim() : \"\";\n    if (prompt) handlers.onStartChat?.(prompt, typeof msg.role === \"string\" ? msg.role : undefined);\n    return true;\n  }\n  if (msg.type === REMOTE_VIEW_MESSAGES.mutate && typeof msg.requestId === \"string\") {\n    await answerMutate(msg.requestId, msg, handlers, reply);\n    return true;\n  }\n  if (msg.type !== REMOTE_VIEW_MESSAGES.getItems || typeof msg.requestId !== \"string\") return false;\n  const request: RemoteViewPageRequest = { offset: clampOffset(msg.offset), limit: clampLimit(msg.limit), fields: normalizeFields(msg.fields) };\n  await answerGetItems(msg.requestId, request, handlers, reply);\n  return true;\n}\n"],"mappings":";;;;;;AAcA,IAAa,uBAAuB;;;;AAKpC,IAAa,uBAAuB;;CAElC,UAAU;;CAEV,OAAO;;CAEP,QAAQ;;CAER,cAAc;;CAEd,WAAW;AACb;;;;AAKA,IAAa,qBAAqB;AAClC,IAAa,iBAAiB;;;AAI9B,IAAa,wBAAwB;;;;;;AAOrC,IAAa,8BAA8B;;;AAI3C,IAAa,yBAAyB;;;AAItC,IAAM,uBAAuB;AAQ7B,IAAa,+BAAkD;CAC7D;CACA;CACA;CACA;CACA;CAEA;AACF;AAEA,IAAM,SAAS,UAAkC;CAC/C,MAAM,MAAM,OAAO,UAAU,WAAW,QAAQ,OAAO,UAAU,WAAW,OAAO,KAAK,IAAI;CAC5F,OAAO,OAAO,SAAS,GAAG,IAAI,KAAK,MAAM,GAAG,IAAI;AAClD;;AAGA,IAAa,eAAe,UAA2B,KAAK,IAAI,GAAG,MAAM,KAAK,KAAK,CAAC;;AAGpF,IAAa,cAAc,UAA2B;CACpD,MAAM,MAAM,MAAM,KAAK;CACvB,IAAI,QAAQ,QAAQ,OAAO,GAAG,OAAA;CAC9B,OAAO,KAAK,IAAI,KAAA,GAAmB;AACrC;;;AAIA,IAAa,qBAAqB,UAA2B;CAC3D,MAAM,MAAM,MAAM,KAAK;CACvB,IAAI,QAAQ,QAAQ,OAAO,GAAG,OAAA;CAC9B,OAAO,KAAK,IAAI,KAAK,IAAI,KAAK,EAAE,GAAG,IAAI;AACzC;;AAGA,IAAa,mBAAmB,UAAyC;CACvE,IAAI,CAAC,MAAM,QAAQ,KAAK,GAAG,OAAO,KAAA;CAClC,MAAM,UAAU,MACb,QAAQ,UAA2B,OAAO,UAAU,QAAQ,CAAC,CAC7D,KAAK,UAAU,MAAM,KAAK,CAAC,CAAC,CAC5B,QAAQ,UAAU,MAAM,SAAS,CAAC;CACrC,OAAO,QAAQ,SAAS,IAAI,UAAU,KAAA;AACxC;;;;;AA2BA,SAAgB,aAAa,OAAyB,QAA8B,YAAsC;CACxH,IAAI,CAAC,UAAU,OAAO,WAAW,GAAG,OAAO;CAC3C,MAAM,uBAAO,IAAI,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC;CAC5C,OAAO,MAAM,KAAK,SAAS,OAAO,YAAY,OAAO,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,SAAS,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC;AACtG;;;;AAKA,SAAgB,cAAc,OAAyB,SAAgC,YAAoC;CAEzH,OAAO;EAAE,OAAO,aADE,MAAM,MAAM,QAAQ,QAAQ,QAAQ,SAAS,QAAQ,KAC1C,GAAW,QAAQ,QAAQ,UAAU;EAAG,OAAO,MAAM;EAAQ,QAAQ,QAAQ;EAAQ,OAAO,QAAQ;CAAM;AACzI;;;;;;;;;;;;AAaA,SAAgB,mBAAmB,OAA0B,8BAAsC;CACjG,MAAM,UAAU,KAAK,KAAK,GAAG;CAC7B,OAAO;EACL;EACA,8BAA8B;EAC9B,6BAA6B;EAC7B,YAAY;EACZ,WAAW,QAAQ;EACnB;EACA;CACF,CAAC,CAAC,KAAK,IAAI;AACb;;;;;;;;;;;;;;;;;;;;;;;;;;AA2BA,SAAS,sBAA8B;CACrC,OAAO,4KAA4K,qBAAqB,MAAM,eAAe,qBAAqB,aAAa,2HAA2H,qBAAqB,MAAM,uRAAuR,qBAAqB,iQAAiQ,qBAAqB,SAAS,4HAA4H,qBAAqB,OAAO,wHAAwH,qBAAqB,OAAO,+MAA+M,qBAAqB,UAAU;AAC5/C;;;;;AAqBA,SAAgB,sBAAsB,MAAc,MAA8B;CAYhF,MAAM,YAAY,GAAG,uDAXkD,mBAAmB,EAAE,IAW/D,2BARhB,KAAK,UAAU;EAC1B,MAAM,KAAK;EACX,QAAQ,KAAK,UAAU;EACvB,MAAM,KAAK,QAAQ,CAAC;EACpB,QAAQ;EACR,UAAA;EACA,UAAU,KAAK,YAAY;CAC7B,CAAC,CAAC,CAAC,QAAQ,MAAM,SACuC,EAAK,GAAG,oBAAoB,EAAE;CACtF,IAAI,iBAAiB,KAAK,IAAI,GAC5B,OAAO,KAAK,QAAQ,oBAAoB,KAAK,WAAW;CAE1D,OAAO,8BAA8B,UAAU,eAAe,KAAK;AACrE;;;;AAiCA,SAAgB,gBAAgB,MAAuF;CACrH,MAAM,SAAS,OAAO,KAAK,OAAO,WAAW,KAAK,KAAK,OAAO,KAAK,OAAO,YAAY,OAAO,SAAS,KAAK,EAAE,IAAI,OAAO,KAAK,EAAE,IAAI;CACnI,IAAI,CAAC,QAAQ,OAAO;CACpB,IAAI,KAAK,OAAO,UAAU,OAAO;EAAE,IAAI;EAAU,IAAI;CAAO;CAC5D,IAAI,KAAK,OAAO,UAAU;EACxB,IAAI,OAAO,KAAK,UAAU,YAAY,KAAK,UAAU,QAAQ,MAAM,QAAQ,KAAK,KAAK,GAAG,OAAO;EAC/F,OAAO;GAAE,IAAI;GAAU,IAAI;GAAQ,OAAO,KAAK;EAAiC;CAClF;CACA,OAAO;AACT;AAEA,eAAe,eAAe,WAAmB,SAAgC,UAAoC,OAAuC;CAC1J,IAAI;EACF,MAAM,OAAO,MAAM,SAAS,QAAQ,OAAO;EAC3C,MAAM;GAAE,MAAM,qBAAqB;GAAO;GAAW,IAAI;GAAM;EAAK,CAAC;CACvE,SAAS,KAAK;EACZ,MAAM;GAAE,MAAM,qBAAqB;GAAO;GAAW,IAAI;GAAO,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;EAAE,CAAC;CAC3H;AACF;;;;AAKA,eAAe,aACb,WACA,KACA,UACA,OACe;CACf,MAAM,UAAU,gBAAgB,GAAG;CACnC,IAAI,CAAC,SAAS;EACZ,MAAM;GAAE,MAAM,qBAAqB;GAAc;GAAW,IAAI;GAAO,OAAO;EAAyB,CAAC;EACxG;CACF;CACA,IAAI,CAAC,SAAS,UAAU;EACtB,MAAM;GAAE,MAAM,qBAAqB;GAAc;GAAW,IAAI;GAAO,OAAO;EAAyB,CAAC;EACxG;CACF;CACA,IAAI;EACF,MAAM,SAAS,MAAM,SAAS,SAAS,OAAO;EAC9C,MAAM;GAAE,MAAM,qBAAqB;GAAc;GAAW,IAAI;GAAM;EAAO,CAAC;CAChF,SAAS,KAAK;EACZ,MAAM;GAAE,MAAM,qBAAqB;GAAc;GAAW,IAAI;GAAO,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;EAAE,CAAC;CAClI;AACF;;;;;;;;;AAYA,eAAsB,wBAAwB,MAAe,UAAoC,OAA0C;CACzI,IAAI,OAAO,SAAS,YAAY,SAAS,MAAM,OAAO;CACtD,MAAM,MAAM;CAaZ,IAAI,IAAI,SAAS,SAAS,MAAM,OAAO;CACvC,IAAI,IAAI,SAAS,qBAAqB,WAAW;EAC/C,MAAM,SAAS,OAAO,IAAI,WAAW,WAAW,IAAI,OAAO,KAAK,IAAI;EACpE,IAAI,QAAQ,SAAS,cAAc,QAAQ,OAAO,IAAI,SAAS,WAAW,IAAI,OAAO,KAAA,CAAS;EAC9F,OAAO;CACT;CACA,IAAI,IAAI,SAAS,qBAAqB,UAAU,OAAO,IAAI,cAAc,UAAU;EACjF,MAAM,aAAa,IAAI,WAAW,KAAK,UAAU,KAAK;EACtD,OAAO;CACT;CACA,IAAI,IAAI,SAAS,qBAAqB,YAAY,OAAO,IAAI,cAAc,UAAU,OAAO;CAC5F,MAAM,UAAiC;EAAE,QAAQ,YAAY,IAAI,MAAM;EAAG,OAAO,WAAW,IAAI,KAAK;EAAG,QAAQ,gBAAgB,IAAI,MAAM;CAAE;CAC5I,MAAM,eAAe,IAAI,WAAW,SAAS,UAAU,KAAK;CAC5D,OAAO;AACT"}

package/dist/remote-view/index.d.ts

@@ -26,11 +26,23 @@ export declare const MAX_PAGE_LIMIT = 200;
 /** Hard cap on the wrapped srcdoc: it travels to the phone INSIDE a Firestore
  *  command document (1 MiB total), so leave envelope headroom. */
 export declare const REMOTE_VIEW_MAX_BYTES = 900000;
+/** Hard cap on ONE `getItems` page (phase 5 — plans/feat-remote-view-images.md).
+ *  Same 1 MiB command-document envelope as the srcdoc: when a view inlines image
+ *  fields as `data:` URLs, the host stops inlining once the serialized page would
+ *  exceed this, leaving the remaining image fields as their original path (which
+ *  the view renders as a placeholder). Guards the doc-write from ever failing. */
+export declare const REMOTE_VIEW_ITEMS_MAX_BYTES = 900000;
+/** Default longest-edge (px) a remote view's inlined image thumbnail is
+ *  downscaled to; a view may override via `imageMaxEdge`. */
+export declare const DEFAULT_IMAGE_MAX_EDGE = 512;
 export declare const SANDBOXED_VIEW_CDN_ALLOWLIST: readonly string[];
 /** Coerce a channel/postMessage offset (arrives as untyped JSON) to a non-negative int. */
 export declare const clampOffset: (value: unknown) => number;
 /** Coerce a channel/postMessage limit to [1, MAX_PAGE_LIMIT] (default 50). */
 export declare const clampLimit: (value: unknown) => number;
+/** Clamp an `imageMaxEdge` (arrives as untyped schema/JSON) to [64, 1024];
+ *  default 512. Keeps a runaway edge from defeating the thumbnail's purpose. */
+export declare const clampImageMaxEdge: (value: unknown) => number;
 /** Coerce a `fields` projection list from untyped message JSON. */
 export declare const normalizeFields: (value: unknown) => string[] | undefined;
 export type RemoteViewItem = Record<string, unknown>;

package/dist/remote-view/index.js

@@ -27,6 +27,15 @@ var MAX_PAGE_LIMIT = 200;
 /** Hard cap on the wrapped srcdoc: it travels to the phone INSIDE a Firestore
 *  command document (1 MiB total), so leave envelope headroom. */
 var REMOTE_VIEW_MAX_BYTES = 9e5;
+/** Hard cap on ONE `getItems` page (phase 5 — plans/feat-remote-view-images.md).
+*  Same 1 MiB command-document envelope as the srcdoc: when a view inlines image
+*  fields as `data:` URLs, the host stops inlining once the serialized page would
+*  exceed this, leaving the remaining image fields as their original path (which
+*  the view renders as a placeholder). Guards the doc-write from ever failing. */
+var REMOTE_VIEW_ITEMS_MAX_BYTES = 9e5;
+/** Default longest-edge (px) a remote view's inlined image thumbnail is
+*  downscaled to; a view may override via `imageMaxEdge`. */
+var DEFAULT_IMAGE_MAX_EDGE = 512;
 /** In-iframe `getItems` timeout — matches the remote client's `callHost`
 *  response timeout so the two layers give up together. */
 var GET_ITEMS_TIMEOUT_MS = 3e4;
@@ -50,6 +59,13 @@ var clampLimit = (value) => {
 	if (num === null || num <= 0) return 50;
 	return Math.min(num, 200);
 };
+/** Clamp an `imageMaxEdge` (arrives as untyped schema/JSON) to [64, 1024];
+*  default 512. Keeps a runaway edge from defeating the thumbnail's purpose. */
+var clampImageMaxEdge = (value) => {
+	const num = toInt(value);
+	if (num === null || num <= 0) return 512;
+	return Math.min(Math.max(num, 64), 1024);
+};
 /** Coerce a `fields` projection list from untyped message JSON. */
 var normalizeFields = (value) => {
 	if (!Array.isArray(value)) return void 0;
@@ -252,6 +268,6 @@ async function handleRemoteViewMessage(data, handlers, reply) {
 	return true;
 }
 //#endregion
-export { DEFAULT_PAGE_LIMIT, MAX_PAGE_LIMIT, REMOTE_VIEW_MAX_BYTES, REMOTE_VIEW_MESSAGES, REMOTE_VIEW_PROTOCOL, SANDBOXED_VIEW_CDN_ALLOWLIST, buildRemoteViewCsp, buildRemoteViewSrcdoc, clampLimit, clampOffset, handleRemoteViewMessage, normalizeFields, normalizeMutate, pageFromItems, projectItems };
+export { DEFAULT_IMAGE_MAX_EDGE, DEFAULT_PAGE_LIMIT, MAX_PAGE_LIMIT, REMOTE_VIEW_ITEMS_MAX_BYTES, REMOTE_VIEW_MAX_BYTES, REMOTE_VIEW_MESSAGES, REMOTE_VIEW_PROTOCOL, SANDBOXED_VIEW_CDN_ALLOWLIST, buildRemoteViewCsp, buildRemoteViewSrcdoc, clampImageMaxEdge, clampLimit, clampOffset, handleRemoteViewMessage, normalizeFields, normalizeMutate, pageFromItems, projectItems };
 
 //# sourceMappingURL=index.js.map