@mulmoclaude/core 3.11.0 → 3.13.0

package/dist/{server-zcM1ViCE.js → server-DGjmK9vU.js}

@@ -4,6 +4,7 @@ import { n as toPosixRelPath } from "./relPath-DW8MC8VO.js";
 import { B as fieldText, I as embedTargetId, L as isFieldDrivenEvery, N as COMPUTED_TYPES, V as fieldTextOrNull, d as parseIsoDate, f as parseIsoDateTime, x as isValidCollectionName, z as storageKindFor } from "./itemId-DfTm08jm.js";
 import { C as actionVisible, _ as uniqueRefTargets, b as projectBacklinkRow, c as selectDynamicRecord, f as itemIsDone, g as uniqueEmbedTargets, h as uniqueBacklinkSources, i as ownProp, n as deriveAll, o as firstDateField, s as resolveIcon, t as defangForPrompt, v as backlinkRows, x as rollupValue, y as coerceNumeric } from "./promptSafety-CSdyp7RF.js";
 import { B as SCHEMA_FILE$1, C as CollectionQueryZ, I as parseAppManifest, J as isBackendUnavailable, K as safeSlugName, O as isRegularFile, S as compileJsonlQuery, U as resolveDataDir, V as isContainedInRoot, W as resolveTemplatePath, X as archiveDir, b as queryCsv, c as resolveMutateSet, d as storeFor, f as checkpointSqliteDatabase, ht as stagingSkillDir, i as resolvePrimaryField, it as isPresetSlug$1, j as resolveCreateItemId, m as cacheDir, n as discoverCollections, nt as getWorkspaceRoot, ot as log, r as loadCollection, s as CollectionSchemaZ, u as readOnlyRefusal, y as normalizeCsvValue } from "./discovery-B9zdNkgW.js";
+import { r as isSafeCustomViewPath } from "./templatePath-k_WNbL_Q.js";
 import { ingestStatePath } from "./feeds/paths.js";
 import { mirrorSkillWrite } from "./skill-bridge/index.js";
 import path from "node:path";
@@ -19,13 +20,30 @@ var NameZ = z.string().refine(isValidCollectionName, { message: "is not a valid
 *  the rules compare it to `request.auth.token.email` verbatim, so any
 *  narrowing here would refuse addresses Firebase itself accepts. */
 var EmailZ = z.string().trim().min(3).includes("@");
-/** The four roles the deployed rules understand. `participant` is the layer
-*  that is NAMED but reads only its own rows — see `readerOf` vs `listedIn`. */
+/** The roles the deployed rules understand.
+*
+*  Two of them are row-scoped, in opposite directions, and the pair is what
+*  the four-way split could not express:
+*
+*    `participant` — the layer that is NAMED but reads only its OWN rows (the
+*    rows it submitted). See `readerOf` vs `listedIn`.
+*
+*    `assignee` — reads EVERY row and writes only the rows ASSIGNED to it. The
+*    stylist who approves their own bookings and not a colleague's; the marker
+*    who grades their own students. Which rows are theirs is
+*    `collections[cid].assigneeField`, a field on the record holding the
+*    member's address. Reads are deliberately unscoped: a stylist needs the
+*    whole day's schedule, and scoping the read makes the app unusable.
+*
+*  The names are permanent. The deployed rules compare these strings directly
+*  and they are written into `app.json` files people commit, so a rename is a
+*  migration over published apps rather than an edit. */
 var APP_ROLES = [
 	"owner",
 	"editor",
 	"viewer",
-	"participant"
+	"participant",
+	"assignee"
 ];
 var RoleZ = z.enum(APP_ROLES);
 /** `{ email: { "*" | cid: role } }`. The `"*"` key is the app-wide role; a
@@ -51,6 +69,29 @@ var CollectionConfigZ = z.object({
 	transitions: z.record(z.string().trim().min(1), z.array(z.string().trim().min(1))).optional(),
 	immutable: z.boolean().optional(),
 	submitOnly: z.boolean().optional(),
+	/** The field naming the member a row belongs to, for the `assignee` role.
+	*
+	*  Holds an ADDRESS, because that is the only thing the rules can compare
+	*  a member against (`request.auth.token.email`). A `ref` to a staff
+	*  collection stores the target's primary-key slug, not an address, so it
+	*  cannot be this field — declare a plain field beside the ref and let the
+	*  ref stay the thing the UI renders. The alternative, having the rules
+	*  `get()` the staff record to read an address off it, costs a document
+	*  access on every write and puts a second document between an
+	*  authorization decision and its answer.
+	*
+	*  Only meaningful with a member holding `assignee` on this cid; a
+	*  declaration with the role and no field is refused (`assigneeProblems`),
+	*  because that member would silently hold nothing. */
+	assigneeField: z.string().trim().min(1).optional(),
+	/** This collection is the public projection of `mirrorOf` — the other
+	*  half of `public.submit[...].mirror`, declared here because the rules
+	*  read it when the PROJECTION is written rather than when the record is.
+	*
+	*  What it buys: `state` may be written by anybody, and only to the value
+	*  the authority actually says, so a visitor who was refused a slot can
+	*  repair the stale row that offered it to them. */
+	mirrorOf: NameZ.optional(),
 	peerVisibility: z.enum(["public", "hidden"]).optional(),
 	revealGated: z.boolean().optional(),
 	gatedFrom: NameZ.optional(),
@@ -69,9 +110,60 @@ var CollectionConfigZ = z.object({
 *  the rules do not coerce strings, so an ISO string reaching Firestore is a
 *  type error that fails CLOSED (`inWindow` refuses every submission and the
 *  author sees "nobody can submit", not an error). */
+/** A window bound that lives on ANOTHER record, read at write time.
+*
+*  `window.from` is one absolute instant for the whole collection, which is
+*  enough for a survey and useless for anything recurring: "each class opens
+*  three days before it starts, at 08:00" is a bound PER RECORD. So the bound
+*  is not computed in the rules — they have no usable date arithmetic and
+*  `request.time` is UTC, which is the wrong answer for "08:00" — it is
+*  computed by whoever schedules the class, stored on the class record as
+*  epoch millis, and merely COMPARED here.
+*
+*  `ref` is the field on the record being written that names the target
+*  (`classId`); `collection` is the cid the target lives in, fixed in the
+*  declaration so that a path is never built out of a value a submitter wrote;
+*  `field` is the epoch-millis field on the target.
+*
+*  Not spelled `in` — that is an operator in the rules language, and
+*  `w.fromField.in` does not parse there. */
+var WindowRefZ = z.object({
+	ref: z.string().trim().min(1),
+	collection: NameZ,
+	field: z.string().trim().min(1)
+}).strict();
+/** The closing bound's per-record twin, and it ships WITH `fromField` rather
+*  than as a symmetric extra: a booking desk that opens per slot and never
+*  closes is not a booking desk. Same shape, opposite comparison — and
+*  EXCLUSIVE where `fromField` is inclusive, so one slot's closing instant and
+*  the next one's opening instant may be the same number. */
 var WindowZ = z.object({
 	from: z.iso.datetime().optional(),
-	until: z.iso.datetime().optional()
+	until: z.iso.datetime().optional(),
+	fromField: WindowRefZ.optional(),
+	untilField: WindowRefZ.optional()
+}).strict();
+/** Which record a `field` document id must name, and what state it must be in.
+*
+*  `idFrom: "field"` alone only stops the same string being written twice —
+*  nothing stops a client bypassing the page and inventing a slot, so the
+*  rules check the referenced record themselves. `exists()` is a FLOOR: a
+*  cancelled slot and a slot nobody may book any more exist too, which is what
+*  `where` is for.
+*
+*  Always the object form, never a bare collection name. Two shapes for one
+*  key is the kind of thing a generator gets right once and wrong afterwards,
+*  and the rules read `s.idIn.collection` either way. */
+var IdInZ = z.object({
+	collection: NameZ,
+	where: z.object({
+		field: z.string().trim().min(1),
+		equals: z.union([
+			z.string(),
+			z.number(),
+			z.boolean()
+		])
+	}).strict().optional()
 }).strict();
 var ValidateZ = z.object({
 	required: z.array(z.string().trim().min(1)).optional(),
@@ -96,14 +188,46 @@ var SubmitZ = z.object({
 	emailField: z.string().trim().min(1).optional(),
 	createFields: z.array(z.string().trim().min(1)).min(1),
 	initialStatus: z.string().trim().min(1).optional(),
+	/** `field` is the mode that makes a CONTESTED resource exclusive: the
+	*  booking's document id IS the slot's id, so the second person to want
+	*  that slot is writing a document that already exists — an update, which
+	*  the public submission path never allows. Firestore decides that
+	*  atomically, so unlike a countable capacity (see `stampField`) this is
+	*  first-come ENFORCED rather than first-come read off a rank. */
 	idFrom: z.enum([
 		"auto",
 		"auth.uid",
-		"auth.uid+field"
+		"auth.uid+field",
+		"field"
 	]).optional(),
 	idField: z.string().trim().min(1).optional(),
+	/** Required by `idFrom: "field"` — see {@link IdInZ}. */
+	idIn: IdInZ.optional(),
+	/** The collection holding this record's PUBLIC PROJECTION, one row per
+	*  contested thing, sharing its document id.
+	*
+	*  A booking carries a name, an address and a phone number, and Firestore
+	*  rules cannot hide a field, so the public page must not read bookings at
+	*  all. It reads the projection instead, whose `state` is a copy of "does
+	*  a booking with this id exist" — and the rules accept the two writes
+	*  only as one batch, in both directions, so the copy cannot drift into
+	*  advertising a slot that is gone. */
+	mirror: NameZ.optional(),
 	validate: ValidateZ.optional(),
 	window: WindowZ.optional(),
+	/** A field the rules PIN to the server clock on create: the record must
+	*  carry `request.time` in it, and may never change it afterwards.
+	*
+	*  What it buys is an order nobody can jump. A first-come app takes its
+	*  capacity from rank rather than from a count — the rules cannot count
+	*  documents, so "the first 8" can only ever be a reading of the rows —
+	*  and a rank is only as honest as the timestamp it sorts by. `idFrom`
+	*  stops a person holding two places; nothing else stops them writing
+	*  yesterday's date into the field that decides who got there first.
+	*
+	*  Binds EVERY create, the writer branch included, so a staff-entered row
+	*  cannot be back-dated into the queue either. */
+	stampField: z.string().trim().min(1).optional(),
 	/** Per CURRENT STATUS, never a flat list: a flat list lets a customer move
 	*  an approved booking's `startAt` without anyone re-approving it. */
 	selfUpdate: z.record(z.string().trim().min(1), z.array(z.string().trim().min(1))).optional(),
@@ -120,6 +244,24 @@ var PublicZ = z.object({
 	*  well as its own declaration. */
 	enabled: z.boolean().optional(),
 	read: z.array(NameZ).optional(),
+	/** The page the public sees, instead of the generated form.
+	*
+	*  A form is enough to ANSWER something and not enough to CHOOSE from
+	*  what is available — a stylist-by-hour grid is not the far end of a
+	*  table. So the app may name one HTML file, which the host publishes to
+	*  `config/view` and the public page renders in a sandboxed iframe.
+	*
+	*  `submit` stays declared alongside: the view sends an INTENT, and the
+	*  page it is embedded in performs the write against these rules.
+	*
+	*  `collections` is declared rather than inferred from `read`. Inferring
+	*  it produces the worst failure this feature has — the view renders, the
+	*  data it wanted was never sent, and it draws an empty grid with no error
+	*  anywhere. */
+	view: z.object({
+		path: z.string().trim().min(1),
+		collections: z.array(NameZ).min(1)
+	}).strict().optional(),
 	submit: z.record(NameZ, SubmitZ).optional()
 }).strict();
 /** The URL name an app is handed out under: `https://<host>/{slug}`.
@@ -224,7 +366,12 @@ function windowMillis(window) {
 	if (window.from !== void 0) out.fromMs = Date.parse(window.from);
 	if (window.until !== void 0) out.untilMs = Date.parse(window.until);
 	if (Object.values(out).some((value) => !Number.isFinite(value))) throw new Error(`publish: window bound is not a parseable timestamp (${JSON.stringify(window)})`);
-	return Object.keys(out).length > 0 ? out : void 0;
+	const projected = {
+		...out,
+		...window.fromField === void 0 ? {} : { fromField: window.fromField },
+		...window.untilField === void 0 ? {} : { untilField: window.untilField }
+	};
+	return Object.keys(projected).length > 0 ? projected : void 0;
 }
 /** One `public.submit[cid]`, with its window lowered. Everything else passes
 *  through: the rules read these keys by the names the author wrote. */
@@ -298,6 +445,7 @@ function projectApp(authored, schemas, stamp, existing) {
 		enabled: authored.public?.enabled === true,
 		read: authored.public?.read ?? [],
 		submit,
+		...authored.public?.view === void 0 ? {} : { view: { collections: authored.public.view.collections } },
 		publishedAt: stamp.publishedAt
 	};
 	if (authored.name !== void 0) config.name = authored.name;
@@ -595,7 +743,7 @@ function ruleReadFields(submit) {
 		field: submit.emailField,
 		why: `public.submit.<cid>.emailField — the rules compare it to the submitter's verified address`
 	});
-	if (submit.idFrom === "auth.uid+field" && submit.idField !== void 0) fields.push({
+	if ((submit.idFrom === "auth.uid+field" || submit.idFrom === "field") && submit.idField !== void 0) fields.push({
 		field: submit.idField,
 		why: `public.submit.<cid>.idField — the rules rebuild the document id from it`
 	});
@@ -618,10 +766,58 @@ function submitCoherenceProblems(app, cid, submit) {
 	const collection = app.collections?.[cid];
 	const problems = [...statusCoherenceProblems(cid, submit, collection), ...createFieldProblems(cid, submit)];
 	if (submit.idFrom === "auth.uid+field" && submit.idField === void 0) problems.push(`public.submit.${cid}.idFrom is "auth.uid+field" but no idField is declared: the rules rebuild the document id from that field and refuse every create.`);
+	problems.push(...fieldIdProblems(cid, submit));
 	if ((submit.selfUpdate !== void 0 || submit.selfTransitions !== void 0) && !collection?.statusField) problems.push(`public.submit.${cid}.selfUpdate / selfTransitions are declared per CURRENT STATUS, but collections.${cid} declares no statusField: the rules read the current status first and refuse every self-edit without it.`);
 	if (submit.audience === "participant" && Object.keys(app.members).length === 0) problems.push(`public.submit.${cid}.audience is "participant" but the roster is empty: the rules resolve the submitter's role from members, so every submission is refused.`);
 	return problems;
 }
+/** `idFrom: "field"` makes the document id a CLAIM ABOUT ANOTHER RECORD, and
+*  the claim is only worth what is checked.
+*
+*  `idIn` is required rather than optional, and that is the whole point of
+*  refusing here: without it the id is any string a stranger likes, so the app
+*  quietly accepts bookings for slots that do not exist. Nothing downstream
+*  ever notices — the booking is real, its slot is not — which is exactly the
+*  kind of hole a gate is for and a rule cannot state.
+*
+*  `idIn` without the mode is refused for the opposite reason: the rules read
+*  it only in that branch, so an author who wrote it believes a check is
+*  running that is not. */
+function fieldIdProblems(cid, submit) {
+	const problems = [];
+	if (submit.idFrom === "field") {
+		if (submit.idField === void 0) problems.push(`public.submit.${cid}.idFrom is "field" but no idField is declared: the rules take the document id from that field and refuse every create.`);
+		if (submit.idIn === void 0) problems.push(`public.submit.${cid}.idFrom is "field" but no idIn is declared: the document id is then any string a submitter chooses, so the app accepts records pointing at things that do not exist. Name the collection the id must be found in — and, when only some of those records may be claimed, the state they must be in: "idIn": { "collection": "slots", "where": { "field": "state", "equals": "open" } }.`);
+	} else if (submit.idIn !== void 0) {
+		const mode = submit.idFrom === void 0 ? "absent" : JSON.stringify(submit.idFrom);
+		problems.push(`public.submit.${cid}.idIn is declared but idFrom is ${mode}: the rules read idIn only for idFrom "field", so as written nothing checks the referenced record and the declaration promises a check it does not perform.`);
+	}
+	return problems;
+}
+/** Every `idIn` target, checked against the collections this repository has.
+*
+*  Separate from {@link fieldIdProblems} for the reason the file is split at
+*  all: that one reads the declaration alone, this one needs to know what
+*  exists. */
+function idTargetProblems(app, collections) {
+	const known = new Set(collections.map((collection) => collection.cid));
+	const names = known.size > 0 ? [...known].sort().join(", ") : "(none)";
+	return Object.entries(app.public?.submit ?? {}).flatMap(([cid, submit]) => idInTargetProblems(cid, submit, known, names));
+}
+/** Where a `field` id says its record must be found.
+*
+*  A typo passes every other check: the rules look the record up in a
+*  collection that does not exist, the lookup can never succeed, and every
+*  submission is refused with no explanation anywhere. A collection pointing
+*  at ITSELF is worse than a typo — on a create the document being written
+*  does not exist yet, so it is a declaration that can never accept anything. */
+function idInTargetProblems(cid, submit, known, names) {
+	const target = submit.idIn?.collection;
+	if (target === void 0) return [];
+	if (target === cid) return [`public.submit.${cid}.idIn.collection names '${cid}' itself: a create writes a document that does not exist yet, so the record can never be found and every submission is refused. Name the collection of the thing being claimed (the slots, the seats, the assets).`];
+	if (!known.has(target)) return [`public.submit.${cid}.idIn.collection names '${target}', which is not a shared collection in this repository. The rules look the record up there, so nothing can ever be submitted. Shared collections here: ${names}.`];
+	return [];
+}
 /** The staged reveal reads its flag off the PARENT record, so the path to that
 *  parent is not optional decoration — without it the gate never opens. */
 function gateCoherenceProblems(cid, collection) {
@@ -651,7 +847,8 @@ function unknownCidProblems(app, collections) {
 		["collections", Object.keys(app.collections ?? {})],
 		["public.read", app.public?.read ?? []],
 		["public.submit", Object.keys(app.public?.submit ?? {})],
-		["participantRead", app.participantRead ?? []]
+		["participantRead", app.participantRead ?? []],
+		["members", [...new Set(Object.values(app.members).flatMap((roles) => Object.keys(roles)))].filter((key) => key !== "*")]
 	].flatMap(([where, cids]) => cids.filter((cid) => !known.has(cid)).map((cid) => `${where} names '${cid}', which is not a shared collection in this repository. Shared collections here: ${known.size > 0 ? [...known].sort().join(", ") : "(none - a schema needs storage.type \"firestore\")"}.`));
 }
 /** Everything publish refuses, as lines the author can act on.
@@ -668,7 +865,13 @@ function publishProblems(app, collections, publisherEmail) {
 		...mailProblems(app),
 		...submitShapeProblems(app),
 		...coherenceProblems(app),
-		...primaryKeyProblems(app, collections)
+		...primaryKeyProblems(app, collections),
+		...assigneeProblems(app),
+		...stampProblems(app),
+		...windowRefProblems(app, collections),
+		...idTargetProblems(app, collections),
+		...mirrorProblems(app, collections),
+		...publicViewProblems(app, collections)
 	];
 }
 /** A public submission must NOT be allowed to name its own primary key.
@@ -698,6 +901,293 @@ function primaryKeyProblems(app, collections) {
 		return [`public.submit.${cid}.createFields must NOT include "${primaryKey}", the schema's primaryKey: the rules can pin the document id but not the value of a field, so a submitter could write at their own id while claiming another record's. A shared record's identity is its document id — the store fills the field from it, and a submitted value is either the same thing or a lie that is thrown away.`];
 	});
 }
+/** `assignee` without the field that says which rows are theirs.
+*
+*  A FAIL-CLOSED trap of the worst kind, because it fails closed for one
+*  person and nobody else: the rules ask `collections[cid].assigneeField` for
+*  the field to compare, find nothing, and refuse every write that member
+*  makes. The app works for the owner who set it up, and the member it was set
+*  up for is told only "permission denied".
+*
+*  `'*': "assignee"` is refused outright rather than checked against every
+*  collection. The role means "the rows assigned to you", and what counts as
+*  assigned is per collection — an app-wide one would need the same field name
+*  to be right everywhere, and where it is missing it silently means "no
+*  access to this collection" rather than "no scoping here".
+*/
+function assigneeProblems(app) {
+	return Object.entries(app.members).flatMap(([email, roles]) => Object.entries(roles).flatMap(([cid, role]) => {
+		if (role !== "assignee") return [];
+		if (cid === "*") return [`members["${email}"] holds "assignee" under "*", and the role cannot be app-wide: which rows are yours is declared per collection (\`collections.<cid>.assigneeField\`). Name the collections instead — { "bookings": "assignee" }.`];
+		if (app.collections?.[cid]?.assigneeField !== void 0) return [];
+		return [`members["${email}"] holds "assignee" on '${cid}', but collections.${cid}.assigneeField does not say which field names the member a row belongs to. Add it (assigneeField: "<a field holding an address>"), or give a role that is not row-scoped. Without it the rules have nothing to compare and refuse every write that member makes, while the app keeps working for everybody else.`];
+	}));
+}
+/** A server-stamped field the submitter cannot write, or can rewrite later.
+*
+*  Both failures are silent in opposite directions. Left out of
+*  `createFields`, the rules refuse every submission (`hasOnly(createFields)`
+*  rejects the key the stamp check requires) — an app nobody can use. Left IN
+*  a `selfUpdate` list, the field the queue is ordered by becomes editable by
+*  the person standing in the queue. */
+function stampProblems(app) {
+	return Object.entries(app.public?.submit ?? {}).flatMap(([cid, submit]) => {
+		const stamp = submit.stampField;
+		if (stamp === void 0) return [];
+		const problems = [];
+		if (!submit.createFields.includes(stamp)) problems.push(`public.submit.${cid}.stampField names '${stamp}', which is not in createFields. The rules require the record to CARRY the server time in that field, and refuse any key outside createFields — so every submission is denied. Add it to createFields; the page fills it in, not the person.`);
+		for (const [status, fields] of Object.entries(submit.selfUpdate ?? {})) {
+			if (!fields.includes(stamp)) continue;
+			problems.push(`public.submit.${cid}.selfUpdate.${status} lets the submitter write '${stamp}', which is the field stampField pins to the server clock. Whatever that field orders — a first-come queue, an audit trail — could then be rewritten by the person it ranks. Remove it from selfUpdate.`);
+		}
+		return problems;
+	});
+}
+/** A per-record window bound pointing at a collection or a field the submitter
+*  never writes.
+*
+*  `fromField` makes the rules read another record, and every part of that
+*  read is fail-closed: an unknown collection, or a `ref` the submission does
+*  not carry, means the bound can never be satisfied and the form is shut for
+*  good. */
+function windowRefProblems(app, collections) {
+	const known = new Set(collections.map((collection) => collection.cid));
+	return Object.entries(app.public?.submit ?? {}).flatMap(([cid, submit]) => [...windowBoundProblems(cid, submit, known, "fromField", submit.window?.fromField, "opening"), ...windowBoundProblems(cid, submit, known, "untilField", submit.window?.untilField, "closing")]);
+}
+/** Both bounds, checked identically. `untilField` arrived with the booking
+*  desk and reads exactly like its twin, so a check that knew only about
+*  `fromField` would let the closing half through unchecked — and a closing
+*  bound that names nothing does not leave the door ajar, it refuses every
+*  submission with no explanation. */
+function windowBoundProblems(cid, submit, known, key, ref, which) {
+	if (ref === void 0) return [];
+	const problems = [];
+	if (!known.has(ref.collection)) problems.push(`public.submit.${cid}.window.${key}.collection names '${ref.collection}', which is not a shared collection in this repository. The rules read the ${which} time off a record there, so nothing can ever be submitted. Shared collections here: ${known.size > 0 ? [...known].sort().join(", ") : "(none)"}.`);
+	if (!submit.createFields.includes(ref.ref)) problems.push(`public.submit.${cid}.window.${key}.ref names '${ref.ref}', which is not in createFields. The rules take the target record's id from that field ON THE SUBMISSION — if the submitter never writes it, there is nothing to look up and every submission is refused.`);
+	return problems;
+}
+/** The two halves of a mirror, checked as the pair they only work as.
+*
+*  `mirror` on the submission and `mirrorOf` on the projection are separate
+*  keys in separate places, and each is inert without the other: a booking
+*  whose slot declares no `mirrorOf` can never be created (the rules demand a
+*  paired write that the projection's own rule will refuse), and a projection
+*  whose authority declares no `mirror` drifts unbounded because nothing makes
+*  the two move together. Both failures are silent, and one of them —
+*  advertising a slot somebody already holds — is the exact thing the mirror
+*  exists to prevent.
+*
+*  Also refuses a collection mirroring ITSELF, which reads as a typo and
+*  behaves as an unwritable collection: every create would have to prove its
+*  own document is simultaneously taken and open. */
+function mirrorProblems(app, collections) {
+	const known = new Set(collections.map((collection) => collection.cid));
+	const names = known.size > 0 ? [...known].sort().join(", ") : "(none)";
+	return [...Object.entries(app.public?.submit ?? {}).flatMap(([cid, submit]) => mirrorClaimProblems(app, cid, submit, known, names)), ...Object.entries(app.collections ?? {}).flatMap(([cid, collection]) => mirrorOfProblems(app, cid, collection, known, names))];
+}
+/** The submission side: `public.submit[cid].mirror`. */
+function mirrorClaimProblems(app, cid, submit, known, names) {
+	const { mirror } = submit;
+	if (mirror === void 0) return [];
+	if (mirror === cid) return [`public.submit.${cid}.mirror names its own collection: the projection is a SEPARATE record, and as written no create can satisfy the rules.`];
+	if (!known.has(mirror)) return [`public.submit.${cid}.mirror names '${mirror}', which is not a shared collection in this repository. The rules require the projection to move in the same write, so every submission is refused. Shared collections here: ${names}.`];
+	if (app.collections?.[mirror]?.mirrorOf !== cid) return [`public.submit.${cid}.mirror names '${mirror}', but collections.${mirror} does not declare mirrorOf: "${cid}". The two halves only work as a pair — the submission side demands the projection move with it, and the projection side is what allows that move — so as written every submission is refused.`];
+	return [];
+}
+/** The projection side: `collections[cid].mirrorOf`. */
+function mirrorOfProblems(app, cid, collection, known, names) {
+	const authority = collection.mirrorOf;
+	if (authority === void 0) return [];
+	if (!known.has(authority)) return [`collections.${cid}.mirrorOf names '${authority}', which is not a shared collection in this repository. Nothing can then be true of it, so the projection's state may never be written. Shared collections here: ${names}.`];
+	if (app.public?.submit?.[authority]?.mirror !== cid) return [`collections.${cid}.mirrorOf names '${authority}', but public.submit.${authority} does not declare mirror: "${cid}". Only the pair keeps the projection honest: without the other half a record can be created without moving this one, and the public page goes on offering something that is already taken.`];
+	return [];
+}
+/** What the public view is handed. Declared, never inferred — a view whose
+*  datasets were guessed from `public.read` renders perfectly and draws an
+*  empty grid, with nothing in the page, the rules or the log to say why. */
+function publicViewProblems(app, collections) {
+	const view = app.public?.view;
+	if (view === void 0) return [];
+	const known = new Set(collections.map((collection) => collection.cid));
+	const readable = new Set(app.public?.read ?? []);
+	const problems = [];
+	if (!isSafeCustomViewPath(view.path) || view.path.split("/").length !== 2) problems.push(`public.view.path is '${view.path}': a published view is exactly one HTML file directly inside the collection's own views/ directory (e.g. views/booking.html) — no sub-directories, and no segments that climb out of it. The host reads this as a file to publish, and what it publishes is world-readable.`);
+	for (const cid of view.collections) {
+		if (!known.has(cid)) {
+			problems.push(`public.view.collections names '${cid}', which is not a shared collection in this repository. Shared collections here: ${known.size > 0 ? [...known].sort().join(", ") : "(none)"}.`);
+			continue;
+		}
+		if (!readable.has(cid)) problems.push(`public.view.collections names '${cid}', which is not in public.read: the page reads these with the VISITOR's permissions, so the rules refuse the read and the view draws an empty page. Nothing errors — this is the failure that looks like a working view with no data.`);
+	}
+	return problems;
+}
+/** What publish will actually promote, checked as the PAIR it becomes.
+*
+*  `publishProblems` reads the manifest, where `members` and `collections` sit
+*  side by side and agree. Publish does not write that pair. It writes the
+*  roster from the manifest and the collection configuration from what DEPLOY
+*  staged, so the app that lands is one half of each — and no check has ever
+*  looked at that combination.
+*
+*  The sequence that gets through: deploy revision A with no `assigneeField`,
+*  add the field AND the member in revision B, publish without redeploying.
+*  Every manifest-level check passes on a declaration that is internally sound,
+*  while what lands is A's field-less configuration beside B's roster — an
+*  assignee with nothing to be compared against, refused every write, in an app
+*  that keeps working for everybody else. That is the precise trap
+*  `assigneeProblems` exists to prevent, reached by the one route it cannot
+*  see.
+*
+*  Separate from `publishProblems` because it needs what deploy staged, which
+*  is a Firestore read the host makes and this package does not. It is checked
+*  against `stagedRuleConfig` — the same function the projection uses — rather
+*  than against a re-derivation, so the value validated is the value written.
+*
+*  Only the staged half can be stale, so only that half is named and the fix is
+*  "deploy again" rather than "fix the declaration". */
+function promotedRoleProblems(app, staged) {
+	const promoted = stagedRuleConfig(staged).collections ?? {};
+	const stagedCids = new Set(staged.map((entry) => entry.cid));
+	return [
+		...promotedAssigneeProblems(app, promoted, stagedCids),
+		...promotedMirrorProblems(app, promoted, stagedCids),
+		...promotedRefFieldProblems(app, staged)
+	];
+}
+/** The FIELDS a rule reads off another record — `idIn.where.field` and the two
+*  window bounds — checked against the schema publish is about to promote.
+*
+*  These are checked here rather than in `publishProblems` because that gate
+*  is given a cid and a primary key per collection and nothing else, on
+*  purpose: it reads the DECLARATION. A field name can only be judged against
+*  a schema, and the schema that matters is the STAGED one — the version
+*  publish promotes — not whatever the working tree says now.
+*
+*  What a typo costs: `where: { field: "staet" }` publishes cleanly, the
+*  rules' comparison can never match, and every submission is denied with no
+*  message. The author's own app looks broken with nothing to read.
+*
+*  Only fields the schema DECLARES are accepted. A record may carry more than
+*  its schema does, but a shared collection's records are written through it,
+*  and "the field exists on some rows" is not something a gate can promise. */
+function promotedRefFieldProblems(app, staged) {
+	const schemaOf = new Map(staged.map((entry) => [entry.cid, entry.doc.publishedSchema]));
+	return Object.entries(app.public?.submit ?? {}).flatMap(([cid, submit]) => submitRefProblems(schemaOf, cid, submit));
+}
+function submitRefProblems(schemaOf, cid, submit) {
+	return [
+		...idInRefProblems(schemaOf, cid, submit),
+		...boundRefProblems(schemaOf, cid, "fromField", submit.window?.fromField),
+		...boundRefProblems(schemaOf, cid, "untilField", submit.window?.untilField)
+	];
+}
+function idInRefProblems(schemaOf, cid, submit) {
+	const where = submit.idIn?.where;
+	if (where === void 0) return [];
+	return [...refFieldProblem(schemaOf, cid, "idIn.where.field", submit.idIn?.collection, where.field), ...comparableProblem(schemaOf, cid, submit.idIn?.collection, where)];
+}
+function boundRefProblems(schemaOf, cid, key, ref) {
+	if (ref === void 0) return [];
+	return [...refFieldProblem(schemaOf, cid, `window.${key}.field`, ref.collection, ref.field), ...millisProblem(schemaOf, cid, `window.${key}.field`, ref)];
+}
+/** The field spec a reference points at, or undefined when there is nothing
+*  staged to judge it against (the host refuses that separately, naming every
+*  missing collection at once). */
+function referencedField(schemaOf, target, field) {
+	if (target === void 0 || field === void 0) return void 0;
+	return schemaOf.get(target)?.fields?.[field];
+}
+/** An enum's domain, or undefined for every other kind. Narrowed by the key
+*  rather than asserted: `fields` is a discriminated union and only some of
+*  its members carry `values`. */
+function enumValues(spec) {
+	return spec.type === "enum" ? spec.values : void 0;
+}
+function refFieldProblem(schemaOf, cid, key, target, field) {
+	if (target === void 0 || field === void 0) return [];
+	const schema = schemaOf.get(target);
+	if (schema === void 0 || referencedField(schemaOf, target, field) !== void 0) return [];
+	const known = Object.keys(schema.fields ?? {}).sort().join(", ");
+	return [`public.submit.${cid}.${key} names '${field}', which the STAGED schema of '${target}' — the one publish promotes — does not declare. The rules read that field off the record and compare it, so as written every submission is refused with nothing to explain it. Fields on '${target}': ${known.length > 0 ? known : "(none)"}.`];
+}
+/** A comparison the rules can never satisfy is as dead as a missing field, and
+*  looks even more correct on the page: an `enum` whose domain does not contain
+*  the value, or a boolean field compared with a string. */
+function comparableProblem(schemaOf, cid, target, where) {
+	const spec = referencedField(schemaOf, target, where.field);
+	if (spec === void 0) return [];
+	const said = JSON.stringify(where.equals);
+	const values = enumValues(spec);
+	if (values !== void 0) {
+		if (values.includes(String(where.equals))) return [];
+		return [`public.submit.${cid}.idIn.where.equals is ${said}, which is not one of the values '${where.field}' can hold on '${String(target)}' (${values.join(", ") || "(none)"}). The comparison can never be true, so every submission is refused.`];
+	}
+	const wanted = spec.type === "number" ? "number" : spec.type === "boolean" ? "boolean" : "string";
+	if (typeof where.equals === wanted) return [];
+	return [`public.submit.${cid}.idIn.where.equals is ${said}, and '${where.field}' on '${String(target)}' is a ${spec.type} field. The rules compare the stored value with this one and never coerce, so the comparison can never be true and every submission is refused.`];
+}
+/** A per-record window bound is EPOCH MILLIS, because the rules have no date
+*  arithmetic and do not coerce: they compare `request.time.toMillis()` with
+*  whatever is stored. A `datetime` field holds an ISO string, which is a type
+*  error that fails closed — the window never opens, and nothing says so. */
+function millisProblem(schemaOf, cid, key, ref) {
+	const spec = referencedField(schemaOf, ref?.collection, ref?.field);
+	if (spec === void 0 || spec.type === "number") return [];
+	return [`public.submit.${cid}.${key} names '${String(ref?.field)}' on '${String(ref?.collection)}', which is a ${spec.type} field. A per-record bound is EPOCH MILLIS: the rules compare it with request.time.toMillis() and never coerce, so anything else is a type error that refuses every submission — the window simply never opens. Store the instant as a number.`];
+}
+function promotedAssigneeProblems(app, promoted, stagedCids) {
+	return Object.entries(app.members).flatMap(([email, roles]) => Object.entries(roles).flatMap(([cid, role]) => {
+		if (role !== "assignee" || cid === "*" || !stagedCids.has(cid)) return [];
+		if (promoted[cid]?.assigneeField !== void 0) return [];
+		return [`members["${email}"] holds "assignee" on '${cid}', and the STAGED version of '${cid}' — the one publish promotes — carries no assigneeField, even if app.json declares one now. Publish writes the roster from app.json and the collection configuration from the deploy, so that member would land with nothing to be compared against: refused every write, while the app keeps working for everybody else. Run deploy again, so the version being published is the one the declaration describes.`];
+	}));
+}
+/** The mirror's other half, checked against what publish will actually
+*  promote — the same trap as the assignee's field, reached by the same route.
+*
+*  `mirror` is published from the MANIFEST (it lives in `public.submit`) while
+*  `mirrorOf` is promoted from what DEPLOY staged. Add both halves to
+*  `app.json` and publish without redeploying, and what lands is a submission
+*  demanding a paired projection write beside a projection whose rule config
+*  does not allow it: every booking is refused, and the declaration on disk
+*  looks perfectly sound.
+*
+*  Refused in the reverse direction too. Removing `mirrorOf` from a live app
+*  and publishing without a deploy leaves the projection accepting nothing —
+*  and removing it FROM the staged side while the submission still demands it
+*  is the drift this pair exists to prevent. */
+function promotedMirrorProblems(app, promoted, stagedCids) {
+	return [...addedMirrorProblems(app, promoted, stagedCids), ...strandedMirrorProblems(app, promoted)];
+}
+/** The manifest asks for a projection the promoted configuration will not
+*  allow: every submission denied, and nothing on the page to say why. */
+function addedMirrorProblems(app, promoted, stagedCids) {
+	return Object.entries(app.public?.submit ?? {}).flatMap(([cid, submit]) => {
+		const { mirror } = submit;
+		if (mirror === void 0 || !stagedCids.has(mirror)) return [];
+		if (promoted[mirror]?.mirrorOf === cid) return [];
+		return [`public.submit.${cid}.mirror names '${mirror}', and the STAGED version of '${mirror}' — the one publish promotes — does not declare mirrorOf: "${cid}", even if app.json declares it now. Publish writes the submission side from app.json and the collection side from the deploy, so what lands is a booking that must move its projection beside a projection that refuses to move: every submission is denied, with nothing on the page to say why. Run deploy again, so the version being published is the one the declaration describes.`];
+	});
+}
+/** The other direction, and the DANGEROUS one.
+*
+*  Take a live pair, delete BOTH halves from `app.json`, and publish without
+*  redeploying. The submission side comes from the manifest, so nothing
+*  requires the projection to move any more; the collection side comes from
+*  staging, which still says `mirrorOf`, so the projection stays writable.
+*  Bookings are then created while the public row goes on saying `open` — the
+*  precise failure the pair exists to prevent, arrived at by removing it.
+*
+*  Refused rather than tolerated because the app keeps WORKING: submissions
+*  succeed. Only the public page is wrong, and only to the people reading it. */
+function strandedMirrorProblems(app, promoted) {
+	return Object.entries(promoted).flatMap(([cid, config]) => {
+		const authority = config.mirrorOf;
+		if (authority === void 0) return [];
+		if (app.public?.submit?.[authority]?.mirror === cid) return [];
+		return [`the STAGED version of '${cid}' — the one publish promotes — declares mirrorOf: "${authority}", and app.json no longer declares public.submit.${authority}.mirror: "${cid}". What lands is a projection that is still writable beside submissions that no longer have to move it, so records can be created while '${cid}' goes on advertising them as available. Nothing fails: the app works and the public page lies. Run deploy again, so the version being published is the one the declaration describes.`];
+	});
+}
 //#endregion
 //#region src/collection/server/skillAssets.ts
 /** Read a collection's custom-view HTML, path-safely. `viewFile` is a
@@ -2768,6 +3258,6 @@ function makeManageCollectionTool(deps = {}) {
 	};
 }
 //#endregion
-export { parseAuthoredApp as $, runQueryOverRows as A, APP_SLUGS_COLLECTION as B, STORE_UNREADABLE as C, recordFieldProblem as D, compileRecordZ as E, readCustomViewI18n as F, appStagingPath as G, appConfigPath as H, readSkillTemplate as I, projectPublish as J, projectApp as K, bindsSubmitterIdentity as L, buildCollectionActionSeedPrompt as M, promptPathsFor as N, runCollectionQuery as O, readCustomViewHtml as P, AuthoredAppZ as Q, publishProblems as R, MAX_RECORD_ISSUES as S, validateRecordObject as T, appSchemasPath as U, PUBLIC_CONFIG_DOC as V, appSlugDoc as W, stagedRuleConfig as X, promoteSchema as Y, APP_ROLES as Z, computeCollectionIcon as _, deleteCollection as a, applyMutateAction as b, computeSuccessor as c, isTriggerDue as d, maybeSpawnSuccessor as f, ONE_SECOND_MS as g, successorId as h, deleteCustomView as i, buildActionSeedPrompt as j, enrichItems as k, daysInMonth as l, resolveEvery as m, MAX_UNSELECTIVE_ITEMS as n, deleteCollectionRefusalMessage as o, parseCivil as p, projectDeploy as q, makeManageCollectionTool as r, advanceTriggerDate as s, MAX_SCHEMA_ISSUES as t, formatCivil as u, buildWorkspaceOntology as v, validateCollectionRecords as w, firstMutateParamProblem as x, schemaRelations as y, APPS_COLLECTION as z };
+export { AuthoredAppZ as $, runQueryOverRows as A, APPS_COLLECTION as B, STORE_UNREADABLE as C, recordFieldProblem as D, compileRecordZ as E, readCustomViewI18n as F, appSlugDoc as G, PUBLIC_CONFIG_DOC as H, readSkillTemplate as I, projectDeploy as J, appStagingPath as K, bindsSubmitterIdentity as L, buildCollectionActionSeedPrompt as M, promptPathsFor as N, runCollectionQuery as O, readCustomViewHtml as P, APP_ROLES as Q, promotedRoleProblems as R, MAX_RECORD_ISSUES as S, validateRecordObject as T, appConfigPath as U, APP_SLUGS_COLLECTION as V, appSchemasPath as W, promoteSchema as X, projectPublish as Y, stagedRuleConfig as Z, computeCollectionIcon as _, deleteCollection as a, applyMutateAction as b, computeSuccessor as c, isTriggerDue as d, parseAuthoredApp as et, maybeSpawnSuccessor as f, ONE_SECOND_MS as g, successorId as h, deleteCustomView as i, buildActionSeedPrompt as j, enrichItems as k, daysInMonth as l, resolveEvery as m, MAX_UNSELECTIVE_ITEMS as n, deleteCollectionRefusalMessage as o, parseCivil as p, projectApp as q, makeManageCollectionTool as r, advanceTriggerDate as s, MAX_SCHEMA_ISSUES as t, formatCivil as u, buildWorkspaceOntology as v, validateCollectionRecords as w, firstMutateParamProblem as x, schemaRelations as y, publishProblems as z };
 
-//# sourceMappingURL=server-zcM1ViCE.js.map
+//# sourceMappingURL=server-DGjmK9vU.js.map