@mulmoclaude/core 3.12.0 → 3.13.0

package/dist/{server-DkT40KgR.js → server-DGjmK9vU.js}

@@ -4,6 +4,7 @@ import { n as toPosixRelPath } from "./relPath-DW8MC8VO.js";
 import { B as fieldText, I as embedTargetId, L as isFieldDrivenEvery, N as COMPUTED_TYPES, V as fieldTextOrNull, d as parseIsoDate, f as parseIsoDateTime, x as isValidCollectionName, z as storageKindFor } from "./itemId-DfTm08jm.js";
 import { C as actionVisible, _ as uniqueRefTargets, b as projectBacklinkRow, c as selectDynamicRecord, f as itemIsDone, g as uniqueEmbedTargets, h as uniqueBacklinkSources, i as ownProp, n as deriveAll, o as firstDateField, s as resolveIcon, t as defangForPrompt, v as backlinkRows, x as rollupValue, y as coerceNumeric } from "./promptSafety-CSdyp7RF.js";
 import { B as SCHEMA_FILE$1, C as CollectionQueryZ, I as parseAppManifest, J as isBackendUnavailable, K as safeSlugName, O as isRegularFile, S as compileJsonlQuery, U as resolveDataDir, V as isContainedInRoot, W as resolveTemplatePath, X as archiveDir, b as queryCsv, c as resolveMutateSet, d as storeFor, f as checkpointSqliteDatabase, ht as stagingSkillDir, i as resolvePrimaryField, it as isPresetSlug$1, j as resolveCreateItemId, m as cacheDir, n as discoverCollections, nt as getWorkspaceRoot, ot as log, r as loadCollection, s as CollectionSchemaZ, u as readOnlyRefusal, y as normalizeCsvValue } from "./discovery-B9zdNkgW.js";
+import { r as isSafeCustomViewPath } from "./templatePath-k_WNbL_Q.js";
 import { ingestStatePath } from "./feeds/paths.js";
 import { mirrorSkillWrite } from "./skill-bridge/index.js";
 import path from "node:path";
@@ -83,6 +84,14 @@ var CollectionConfigZ = z.object({
 	*  declaration with the role and no field is refused (`assigneeProblems`),
 	*  because that member would silently hold nothing. */
 	assigneeField: z.string().trim().min(1).optional(),
+	/** This collection is the public projection of `mirrorOf` — the other
+	*  half of `public.submit[...].mirror`, declared here because the rules
+	*  read it when the PROJECTION is written rather than when the record is.
+	*
+	*  What it buys: `state` may be written by anybody, and only to the value
+	*  the authority actually says, so a visitor who was refused a slot can
+	*  repair the stale row that offered it to them. */
+	mirrorOf: NameZ.optional(),
 	peerVisibility: z.enum(["public", "hidden"]).optional(),
 	revealGated: z.boolean().optional(),
 	gatedFrom: NameZ.optional(),
@@ -123,10 +132,38 @@ var WindowRefZ = z.object({
 	collection: NameZ,
 	field: z.string().trim().min(1)
 }).strict();
+/** The closing bound's per-record twin, and it ships WITH `fromField` rather
+*  than as a symmetric extra: a booking desk that opens per slot and never
+*  closes is not a booking desk. Same shape, opposite comparison — and
+*  EXCLUSIVE where `fromField` is inclusive, so one slot's closing instant and
+*  the next one's opening instant may be the same number. */
 var WindowZ = z.object({
 	from: z.iso.datetime().optional(),
 	until: z.iso.datetime().optional(),
-	fromField: WindowRefZ.optional()
+	fromField: WindowRefZ.optional(),
+	untilField: WindowRefZ.optional()
+}).strict();
+/** Which record a `field` document id must name, and what state it must be in.
+*
+*  `idFrom: "field"` alone only stops the same string being written twice —
+*  nothing stops a client bypassing the page and inventing a slot, so the
+*  rules check the referenced record themselves. `exists()` is a FLOOR: a
+*  cancelled slot and a slot nobody may book any more exist too, which is what
+*  `where` is for.
+*
+*  Always the object form, never a bare collection name. Two shapes for one
+*  key is the kind of thing a generator gets right once and wrong afterwards,
+*  and the rules read `s.idIn.collection` either way. */
+var IdInZ = z.object({
+	collection: NameZ,
+	where: z.object({
+		field: z.string().trim().min(1),
+		equals: z.union([
+			z.string(),
+			z.number(),
+			z.boolean()
+		])
+	}).strict().optional()
 }).strict();
 var ValidateZ = z.object({
 	required: z.array(z.string().trim().min(1)).optional(),
@@ -151,12 +188,31 @@ var SubmitZ = z.object({
 	emailField: z.string().trim().min(1).optional(),
 	createFields: z.array(z.string().trim().min(1)).min(1),
 	initialStatus: z.string().trim().min(1).optional(),
+	/** `field` is the mode that makes a CONTESTED resource exclusive: the
+	*  booking's document id IS the slot's id, so the second person to want
+	*  that slot is writing a document that already exists — an update, which
+	*  the public submission path never allows. Firestore decides that
+	*  atomically, so unlike a countable capacity (see `stampField`) this is
+	*  first-come ENFORCED rather than first-come read off a rank. */
 	idFrom: z.enum([
 		"auto",
 		"auth.uid",
-		"auth.uid+field"
+		"auth.uid+field",
+		"field"
 	]).optional(),
 	idField: z.string().trim().min(1).optional(),
+	/** Required by `idFrom: "field"` — see {@link IdInZ}. */
+	idIn: IdInZ.optional(),
+	/** The collection holding this record's PUBLIC PROJECTION, one row per
+	*  contested thing, sharing its document id.
+	*
+	*  A booking carries a name, an address and a phone number, and Firestore
+	*  rules cannot hide a field, so the public page must not read bookings at
+	*  all. It reads the projection instead, whose `state` is a copy of "does
+	*  a booking with this id exist" — and the rules accept the two writes
+	*  only as one batch, in both directions, so the copy cannot drift into
+	*  advertising a slot that is gone. */
+	mirror: NameZ.optional(),
 	validate: ValidateZ.optional(),
 	window: WindowZ.optional(),
 	/** A field the rules PIN to the server clock on create: the record must
@@ -188,6 +244,24 @@ var PublicZ = z.object({
 	*  well as its own declaration. */
 	enabled: z.boolean().optional(),
 	read: z.array(NameZ).optional(),
+	/** The page the public sees, instead of the generated form.
+	*
+	*  A form is enough to ANSWER something and not enough to CHOOSE from
+	*  what is available — a stylist-by-hour grid is not the far end of a
+	*  table. So the app may name one HTML file, which the host publishes to
+	*  `config/view` and the public page renders in a sandboxed iframe.
+	*
+	*  `submit` stays declared alongside: the view sends an INTENT, and the
+	*  page it is embedded in performs the write against these rules.
+	*
+	*  `collections` is declared rather than inferred from `read`. Inferring
+	*  it produces the worst failure this feature has — the view renders, the
+	*  data it wanted was never sent, and it draws an empty grid with no error
+	*  anywhere. */
+	view: z.object({
+		path: z.string().trim().min(1),
+		collections: z.array(NameZ).min(1)
+	}).strict().optional(),
 	submit: z.record(NameZ, SubmitZ).optional()
 }).strict();
 /** The URL name an app is handed out under: `https://<host>/{slug}`.
@@ -294,7 +368,8 @@ function windowMillis(window) {
 	if (Object.values(out).some((value) => !Number.isFinite(value))) throw new Error(`publish: window bound is not a parseable timestamp (${JSON.stringify(window)})`);
 	const projected = {
 		...out,
-		...window.fromField === void 0 ? {} : { fromField: window.fromField }
+		...window.fromField === void 0 ? {} : { fromField: window.fromField },
+		...window.untilField === void 0 ? {} : { untilField: window.untilField }
 	};
 	return Object.keys(projected).length > 0 ? projected : void 0;
 }
@@ -370,6 +445,7 @@ function projectApp(authored, schemas, stamp, existing) {
 		enabled: authored.public?.enabled === true,
 		read: authored.public?.read ?? [],
 		submit,
+		...authored.public?.view === void 0 ? {} : { view: { collections: authored.public.view.collections } },
 		publishedAt: stamp.publishedAt
 	};
 	if (authored.name !== void 0) config.name = authored.name;
@@ -667,7 +743,7 @@ function ruleReadFields(submit) {
 		field: submit.emailField,
 		why: `public.submit.<cid>.emailField — the rules compare it to the submitter's verified address`
 	});
-	if (submit.idFrom === "auth.uid+field" && submit.idField !== void 0) fields.push({
+	if ((submit.idFrom === "auth.uid+field" || submit.idFrom === "field") && submit.idField !== void 0) fields.push({
 		field: submit.idField,
 		why: `public.submit.<cid>.idField — the rules rebuild the document id from it`
 	});
@@ -690,10 +766,58 @@ function submitCoherenceProblems(app, cid, submit) {
 	const collection = app.collections?.[cid];
 	const problems = [...statusCoherenceProblems(cid, submit, collection), ...createFieldProblems(cid, submit)];
 	if (submit.idFrom === "auth.uid+field" && submit.idField === void 0) problems.push(`public.submit.${cid}.idFrom is "auth.uid+field" but no idField is declared: the rules rebuild the document id from that field and refuse every create.`);
+	problems.push(...fieldIdProblems(cid, submit));
 	if ((submit.selfUpdate !== void 0 || submit.selfTransitions !== void 0) && !collection?.statusField) problems.push(`public.submit.${cid}.selfUpdate / selfTransitions are declared per CURRENT STATUS, but collections.${cid} declares no statusField: the rules read the current status first and refuse every self-edit without it.`);
 	if (submit.audience === "participant" && Object.keys(app.members).length === 0) problems.push(`public.submit.${cid}.audience is "participant" but the roster is empty: the rules resolve the submitter's role from members, so every submission is refused.`);
 	return problems;
 }
+/** `idFrom: "field"` makes the document id a CLAIM ABOUT ANOTHER RECORD, and
+*  the claim is only worth what is checked.
+*
+*  `idIn` is required rather than optional, and that is the whole point of
+*  refusing here: without it the id is any string a stranger likes, so the app
+*  quietly accepts bookings for slots that do not exist. Nothing downstream
+*  ever notices — the booking is real, its slot is not — which is exactly the
+*  kind of hole a gate is for and a rule cannot state.
+*
+*  `idIn` without the mode is refused for the opposite reason: the rules read
+*  it only in that branch, so an author who wrote it believes a check is
+*  running that is not. */
+function fieldIdProblems(cid, submit) {
+	const problems = [];
+	if (submit.idFrom === "field") {
+		if (submit.idField === void 0) problems.push(`public.submit.${cid}.idFrom is "field" but no idField is declared: the rules take the document id from that field and refuse every create.`);
+		if (submit.idIn === void 0) problems.push(`public.submit.${cid}.idFrom is "field" but no idIn is declared: the document id is then any string a submitter chooses, so the app accepts records pointing at things that do not exist. Name the collection the id must be found in — and, when only some of those records may be claimed, the state they must be in: "idIn": { "collection": "slots", "where": { "field": "state", "equals": "open" } }.`);
+	} else if (submit.idIn !== void 0) {
+		const mode = submit.idFrom === void 0 ? "absent" : JSON.stringify(submit.idFrom);
+		problems.push(`public.submit.${cid}.idIn is declared but idFrom is ${mode}: the rules read idIn only for idFrom "field", so as written nothing checks the referenced record and the declaration promises a check it does not perform.`);
+	}
+	return problems;
+}
+/** Every `idIn` target, checked against the collections this repository has.
+*
+*  Separate from {@link fieldIdProblems} for the reason the file is split at
+*  all: that one reads the declaration alone, this one needs to know what
+*  exists. */
+function idTargetProblems(app, collections) {
+	const known = new Set(collections.map((collection) => collection.cid));
+	const names = known.size > 0 ? [...known].sort().join(", ") : "(none)";
+	return Object.entries(app.public?.submit ?? {}).flatMap(([cid, submit]) => idInTargetProblems(cid, submit, known, names));
+}
+/** Where a `field` id says its record must be found.
+*
+*  A typo passes every other check: the rules look the record up in a
+*  collection that does not exist, the lookup can never succeed, and every
+*  submission is refused with no explanation anywhere. A collection pointing
+*  at ITSELF is worse than a typo — on a create the document being written
+*  does not exist yet, so it is a declaration that can never accept anything. */
+function idInTargetProblems(cid, submit, known, names) {
+	const target = submit.idIn?.collection;
+	if (target === void 0) return [];
+	if (target === cid) return [`public.submit.${cid}.idIn.collection names '${cid}' itself: a create writes a document that does not exist yet, so the record can never be found and every submission is refused. Name the collection of the thing being claimed (the slots, the seats, the assets).`];
+	if (!known.has(target)) return [`public.submit.${cid}.idIn.collection names '${target}', which is not a shared collection in this repository. The rules look the record up there, so nothing can ever be submitted. Shared collections here: ${names}.`];
+	return [];
+}
 /** The staged reveal reads its flag off the PARENT record, so the path to that
 *  parent is not optional decoration — without it the gate never opens. */
 function gateCoherenceProblems(cid, collection) {
@@ -744,7 +868,10 @@ function publishProblems(app, collections, publisherEmail) {
 		...primaryKeyProblems(app, collections),
 		...assigneeProblems(app),
 		...stampProblems(app),
-		...windowRefProblems(app, collections)
+		...windowRefProblems(app, collections),
+		...idTargetProblems(app, collections),
+		...mirrorProblems(app, collections),
+		...publicViewProblems(app, collections)
 	];
 }
 /** A public submission must NOT be allowed to name its own primary key.
@@ -825,14 +952,74 @@ function stampProblems(app) {
 *  good. */
 function windowRefProblems(app, collections) {
 	const known = new Set(collections.map((collection) => collection.cid));
-	return Object.entries(app.public?.submit ?? {}).flatMap(([cid, submit]) => {
-		const ref = submit.window?.fromField;
-		if (ref === void 0) return [];
-		const problems = [];
-		if (!known.has(ref.collection)) problems.push(`public.submit.${cid}.window.fromField.collection names '${ref.collection}', which is not a shared collection in this repository. The rules read the opening time off a record there, so nothing can ever be submitted. Shared collections here: ${known.size > 0 ? [...known].sort().join(", ") : "(none)"}.`);
-		if (!submit.createFields.includes(ref.ref)) problems.push(`public.submit.${cid}.window.fromField.ref names '${ref.ref}', which is not in createFields. The rules take the target record's id from that field ON THE SUBMISSION — if the submitter never writes it, there is nothing to look up and every submission is refused.`);
-		return problems;
-	});
+	return Object.entries(app.public?.submit ?? {}).flatMap(([cid, submit]) => [...windowBoundProblems(cid, submit, known, "fromField", submit.window?.fromField, "opening"), ...windowBoundProblems(cid, submit, known, "untilField", submit.window?.untilField, "closing")]);
+}
+/** Both bounds, checked identically. `untilField` arrived with the booking
+*  desk and reads exactly like its twin, so a check that knew only about
+*  `fromField` would let the closing half through unchecked — and a closing
+*  bound that names nothing does not leave the door ajar, it refuses every
+*  submission with no explanation. */
+function windowBoundProblems(cid, submit, known, key, ref, which) {
+	if (ref === void 0) return [];
+	const problems = [];
+	if (!known.has(ref.collection)) problems.push(`public.submit.${cid}.window.${key}.collection names '${ref.collection}', which is not a shared collection in this repository. The rules read the ${which} time off a record there, so nothing can ever be submitted. Shared collections here: ${known.size > 0 ? [...known].sort().join(", ") : "(none)"}.`);
+	if (!submit.createFields.includes(ref.ref)) problems.push(`public.submit.${cid}.window.${key}.ref names '${ref.ref}', which is not in createFields. The rules take the target record's id from that field ON THE SUBMISSION — if the submitter never writes it, there is nothing to look up and every submission is refused.`);
+	return problems;
+}
+/** The two halves of a mirror, checked as the pair they only work as.
+*
+*  `mirror` on the submission and `mirrorOf` on the projection are separate
+*  keys in separate places, and each is inert without the other: a booking
+*  whose slot declares no `mirrorOf` can never be created (the rules demand a
+*  paired write that the projection's own rule will refuse), and a projection
+*  whose authority declares no `mirror` drifts unbounded because nothing makes
+*  the two move together. Both failures are silent, and one of them —
+*  advertising a slot somebody already holds — is the exact thing the mirror
+*  exists to prevent.
+*
+*  Also refuses a collection mirroring ITSELF, which reads as a typo and
+*  behaves as an unwritable collection: every create would have to prove its
+*  own document is simultaneously taken and open. */
+function mirrorProblems(app, collections) {
+	const known = new Set(collections.map((collection) => collection.cid));
+	const names = known.size > 0 ? [...known].sort().join(", ") : "(none)";
+	return [...Object.entries(app.public?.submit ?? {}).flatMap(([cid, submit]) => mirrorClaimProblems(app, cid, submit, known, names)), ...Object.entries(app.collections ?? {}).flatMap(([cid, collection]) => mirrorOfProblems(app, cid, collection, known, names))];
+}
+/** The submission side: `public.submit[cid].mirror`. */
+function mirrorClaimProblems(app, cid, submit, known, names) {
+	const { mirror } = submit;
+	if (mirror === void 0) return [];
+	if (mirror === cid) return [`public.submit.${cid}.mirror names its own collection: the projection is a SEPARATE record, and as written no create can satisfy the rules.`];
+	if (!known.has(mirror)) return [`public.submit.${cid}.mirror names '${mirror}', which is not a shared collection in this repository. The rules require the projection to move in the same write, so every submission is refused. Shared collections here: ${names}.`];
+	if (app.collections?.[mirror]?.mirrorOf !== cid) return [`public.submit.${cid}.mirror names '${mirror}', but collections.${mirror} does not declare mirrorOf: "${cid}". The two halves only work as a pair — the submission side demands the projection move with it, and the projection side is what allows that move — so as written every submission is refused.`];
+	return [];
+}
+/** The projection side: `collections[cid].mirrorOf`. */
+function mirrorOfProblems(app, cid, collection, known, names) {
+	const authority = collection.mirrorOf;
+	if (authority === void 0) return [];
+	if (!known.has(authority)) return [`collections.${cid}.mirrorOf names '${authority}', which is not a shared collection in this repository. Nothing can then be true of it, so the projection's state may never be written. Shared collections here: ${names}.`];
+	if (app.public?.submit?.[authority]?.mirror !== cid) return [`collections.${cid}.mirrorOf names '${authority}', but public.submit.${authority} does not declare mirror: "${cid}". Only the pair keeps the projection honest: without the other half a record can be created without moving this one, and the public page goes on offering something that is already taken.`];
+	return [];
+}
+/** What the public view is handed. Declared, never inferred — a view whose
+*  datasets were guessed from `public.read` renders perfectly and draws an
+*  empty grid, with nothing in the page, the rules or the log to say why. */
+function publicViewProblems(app, collections) {
+	const view = app.public?.view;
+	if (view === void 0) return [];
+	const known = new Set(collections.map((collection) => collection.cid));
+	const readable = new Set(app.public?.read ?? []);
+	const problems = [];
+	if (!isSafeCustomViewPath(view.path) || view.path.split("/").length !== 2) problems.push(`public.view.path is '${view.path}': a published view is exactly one HTML file directly inside the collection's own views/ directory (e.g. views/booking.html) — no sub-directories, and no segments that climb out of it. The host reads this as a file to publish, and what it publishes is world-readable.`);
+	for (const cid of view.collections) {
+		if (!known.has(cid)) {
+			problems.push(`public.view.collections names '${cid}', which is not a shared collection in this repository. Shared collections here: ${known.size > 0 ? [...known].sort().join(", ") : "(none)"}.`);
+			continue;
+		}
+		if (!readable.has(cid)) problems.push(`public.view.collections names '${cid}', which is not in public.read: the page reads these with the VISITOR's permissions, so the rules refuse the read and the view draws an empty page. Nothing errors — this is the failure that looks like a working view with no data.`);
+	}
+	return problems;
 }
 /** What publish will actually promote, checked as the PAIR it becomes.
 *
@@ -861,12 +1048,146 @@ function windowRefProblems(app, collections) {
 function promotedRoleProblems(app, staged) {
 	const promoted = stagedRuleConfig(staged).collections ?? {};
 	const stagedCids = new Set(staged.map((entry) => entry.cid));
+	return [
+		...promotedAssigneeProblems(app, promoted, stagedCids),
+		...promotedMirrorProblems(app, promoted, stagedCids),
+		...promotedRefFieldProblems(app, staged)
+	];
+}
+/** The FIELDS a rule reads off another record — `idIn.where.field` and the two
+*  window bounds — checked against the schema publish is about to promote.
+*
+*  These are checked here rather than in `publishProblems` because that gate
+*  is given a cid and a primary key per collection and nothing else, on
+*  purpose: it reads the DECLARATION. A field name can only be judged against
+*  a schema, and the schema that matters is the STAGED one — the version
+*  publish promotes — not whatever the working tree says now.
+*
+*  What a typo costs: `where: { field: "staet" }` publishes cleanly, the
+*  rules' comparison can never match, and every submission is denied with no
+*  message. The author's own app looks broken with nothing to read.
+*
+*  Only fields the schema DECLARES are accepted. A record may carry more than
+*  its schema does, but a shared collection's records are written through it,
+*  and "the field exists on some rows" is not something a gate can promise. */
+function promotedRefFieldProblems(app, staged) {
+	const schemaOf = new Map(staged.map((entry) => [entry.cid, entry.doc.publishedSchema]));
+	return Object.entries(app.public?.submit ?? {}).flatMap(([cid, submit]) => submitRefProblems(schemaOf, cid, submit));
+}
+function submitRefProblems(schemaOf, cid, submit) {
+	return [
+		...idInRefProblems(schemaOf, cid, submit),
+		...boundRefProblems(schemaOf, cid, "fromField", submit.window?.fromField),
+		...boundRefProblems(schemaOf, cid, "untilField", submit.window?.untilField)
+	];
+}
+function idInRefProblems(schemaOf, cid, submit) {
+	const where = submit.idIn?.where;
+	if (where === void 0) return [];
+	return [...refFieldProblem(schemaOf, cid, "idIn.where.field", submit.idIn?.collection, where.field), ...comparableProblem(schemaOf, cid, submit.idIn?.collection, where)];
+}
+function boundRefProblems(schemaOf, cid, key, ref) {
+	if (ref === void 0) return [];
+	return [...refFieldProblem(schemaOf, cid, `window.${key}.field`, ref.collection, ref.field), ...millisProblem(schemaOf, cid, `window.${key}.field`, ref)];
+}
+/** The field spec a reference points at, or undefined when there is nothing
+*  staged to judge it against (the host refuses that separately, naming every
+*  missing collection at once). */
+function referencedField(schemaOf, target, field) {
+	if (target === void 0 || field === void 0) return void 0;
+	return schemaOf.get(target)?.fields?.[field];
+}
+/** An enum's domain, or undefined for every other kind. Narrowed by the key
+*  rather than asserted: `fields` is a discriminated union and only some of
+*  its members carry `values`. */
+function enumValues(spec) {
+	return spec.type === "enum" ? spec.values : void 0;
+}
+function refFieldProblem(schemaOf, cid, key, target, field) {
+	if (target === void 0 || field === void 0) return [];
+	const schema = schemaOf.get(target);
+	if (schema === void 0 || referencedField(schemaOf, target, field) !== void 0) return [];
+	const known = Object.keys(schema.fields ?? {}).sort().join(", ");
+	return [`public.submit.${cid}.${key} names '${field}', which the STAGED schema of '${target}' — the one publish promotes — does not declare. The rules read that field off the record and compare it, so as written every submission is refused with nothing to explain it. Fields on '${target}': ${known.length > 0 ? known : "(none)"}.`];
+}
+/** A comparison the rules can never satisfy is as dead as a missing field, and
+*  looks even more correct on the page: an `enum` whose domain does not contain
+*  the value, or a boolean field compared with a string. */
+function comparableProblem(schemaOf, cid, target, where) {
+	const spec = referencedField(schemaOf, target, where.field);
+	if (spec === void 0) return [];
+	const said = JSON.stringify(where.equals);
+	const values = enumValues(spec);
+	if (values !== void 0) {
+		if (values.includes(String(where.equals))) return [];
+		return [`public.submit.${cid}.idIn.where.equals is ${said}, which is not one of the values '${where.field}' can hold on '${String(target)}' (${values.join(", ") || "(none)"}). The comparison can never be true, so every submission is refused.`];
+	}
+	const wanted = spec.type === "number" ? "number" : spec.type === "boolean" ? "boolean" : "string";
+	if (typeof where.equals === wanted) return [];
+	return [`public.submit.${cid}.idIn.where.equals is ${said}, and '${where.field}' on '${String(target)}' is a ${spec.type} field. The rules compare the stored value with this one and never coerce, so the comparison can never be true and every submission is refused.`];
+}
+/** A per-record window bound is EPOCH MILLIS, because the rules have no date
+*  arithmetic and do not coerce: they compare `request.time.toMillis()` with
+*  whatever is stored. A `datetime` field holds an ISO string, which is a type
+*  error that fails closed — the window never opens, and nothing says so. */
+function millisProblem(schemaOf, cid, key, ref) {
+	const spec = referencedField(schemaOf, ref?.collection, ref?.field);
+	if (spec === void 0 || spec.type === "number") return [];
+	return [`public.submit.${cid}.${key} names '${String(ref?.field)}' on '${String(ref?.collection)}', which is a ${spec.type} field. A per-record bound is EPOCH MILLIS: the rules compare it with request.time.toMillis() and never coerce, so anything else is a type error that refuses every submission — the window simply never opens. Store the instant as a number.`];
+}
+function promotedAssigneeProblems(app, promoted, stagedCids) {
 	return Object.entries(app.members).flatMap(([email, roles]) => Object.entries(roles).flatMap(([cid, role]) => {
 		if (role !== "assignee" || cid === "*" || !stagedCids.has(cid)) return [];
 		if (promoted[cid]?.assigneeField !== void 0) return [];
 		return [`members["${email}"] holds "assignee" on '${cid}', and the STAGED version of '${cid}' — the one publish promotes — carries no assigneeField, even if app.json declares one now. Publish writes the roster from app.json and the collection configuration from the deploy, so that member would land with nothing to be compared against: refused every write, while the app keeps working for everybody else. Run deploy again, so the version being published is the one the declaration describes.`];
 	}));
 }
+/** The mirror's other half, checked against what publish will actually
+*  promote — the same trap as the assignee's field, reached by the same route.
+*
+*  `mirror` is published from the MANIFEST (it lives in `public.submit`) while
+*  `mirrorOf` is promoted from what DEPLOY staged. Add both halves to
+*  `app.json` and publish without redeploying, and what lands is a submission
+*  demanding a paired projection write beside a projection whose rule config
+*  does not allow it: every booking is refused, and the declaration on disk
+*  looks perfectly sound.
+*
+*  Refused in the reverse direction too. Removing `mirrorOf` from a live app
+*  and publishing without a deploy leaves the projection accepting nothing —
+*  and removing it FROM the staged side while the submission still demands it
+*  is the drift this pair exists to prevent. */
+function promotedMirrorProblems(app, promoted, stagedCids) {
+	return [...addedMirrorProblems(app, promoted, stagedCids), ...strandedMirrorProblems(app, promoted)];
+}
+/** The manifest asks for a projection the promoted configuration will not
+*  allow: every submission denied, and nothing on the page to say why. */
+function addedMirrorProblems(app, promoted, stagedCids) {
+	return Object.entries(app.public?.submit ?? {}).flatMap(([cid, submit]) => {
+		const { mirror } = submit;
+		if (mirror === void 0 || !stagedCids.has(mirror)) return [];
+		if (promoted[mirror]?.mirrorOf === cid) return [];
+		return [`public.submit.${cid}.mirror names '${mirror}', and the STAGED version of '${mirror}' — the one publish promotes — does not declare mirrorOf: "${cid}", even if app.json declares it now. Publish writes the submission side from app.json and the collection side from the deploy, so what lands is a booking that must move its projection beside a projection that refuses to move: every submission is denied, with nothing on the page to say why. Run deploy again, so the version being published is the one the declaration describes.`];
+	});
+}
+/** The other direction, and the DANGEROUS one.
+*
+*  Take a live pair, delete BOTH halves from `app.json`, and publish without
+*  redeploying. The submission side comes from the manifest, so nothing
+*  requires the projection to move any more; the collection side comes from
+*  staging, which still says `mirrorOf`, so the projection stays writable.
+*  Bookings are then created while the public row goes on saying `open` — the
+*  precise failure the pair exists to prevent, arrived at by removing it.
+*
+*  Refused rather than tolerated because the app keeps WORKING: submissions
+*  succeed. Only the public page is wrong, and only to the people reading it. */
+function strandedMirrorProblems(app, promoted) {
+	return Object.entries(promoted).flatMap(([cid, config]) => {
+		const authority = config.mirrorOf;
+		if (authority === void 0) return [];
+		if (app.public?.submit?.[authority]?.mirror === cid) return [];
+		return [`the STAGED version of '${cid}' — the one publish promotes — declares mirrorOf: "${authority}", and app.json no longer declares public.submit.${authority}.mirror: "${cid}". What lands is a projection that is still writable beside submissions that no longer have to move it, so records can be created while '${cid}' goes on advertising them as available. Nothing fails: the app works and the public page lies. Run deploy again, so the version being published is the one the declaration describes.`];
+	});
+}
 //#endregion
 //#region src/collection/server/skillAssets.ts
 /** Read a collection's custom-view HTML, path-safely. `viewFile` is a
@@ -2939,4 +3260,4 @@ function makeManageCollectionTool(deps = {}) {
 //#endregion
 export { AuthoredAppZ as $, runQueryOverRows as A, APPS_COLLECTION as B, STORE_UNREADABLE as C, recordFieldProblem as D, compileRecordZ as E, readCustomViewI18n as F, appSlugDoc as G, PUBLIC_CONFIG_DOC as H, readSkillTemplate as I, projectDeploy as J, appStagingPath as K, bindsSubmitterIdentity as L, buildCollectionActionSeedPrompt as M, promptPathsFor as N, runCollectionQuery as O, readCustomViewHtml as P, APP_ROLES as Q, promotedRoleProblems as R, MAX_RECORD_ISSUES as S, validateRecordObject as T, appConfigPath as U, APP_SLUGS_COLLECTION as V, appSchemasPath as W, promoteSchema as X, projectPublish as Y, stagedRuleConfig as Z, computeCollectionIcon as _, deleteCollection as a, applyMutateAction as b, computeSuccessor as c, isTriggerDue as d, parseAuthoredApp as et, maybeSpawnSuccessor as f, ONE_SECOND_MS as g, successorId as h, deleteCustomView as i, buildActionSeedPrompt as j, enrichItems as k, daysInMonth as l, resolveEvery as m, MAX_UNSELECTIVE_ITEMS as n, deleteCollectionRefusalMessage as o, parseCivil as p, projectApp as q, makeManageCollectionTool as r, advanceTriggerDate as s, MAX_SCHEMA_ISSUES as t, formatCivil as u, buildWorkspaceOntology as v, validateCollectionRecords as w, firstMutateParamProblem as x, schemaRelations as y, publishProblems as z };
 
-//# sourceMappingURL=server-DkT40KgR.js.map
+//# sourceMappingURL=server-DGjmK9vU.js.map