@mulmoclaude/core 3.12.0 → 3.14.0

package/dist/{server-BIKy55wo.cjs → server-DknYbXBo.cjs}

@@ -5,6 +5,7 @@ const require_relPath = require("./relPath-CTAjGdCL.cjs");
 const require_itemId = require("./itemId-Dzrr3vs5.cjs");
 const require_promptSafety = require("./promptSafety-CWqYq-NS.cjs");
 const require_discovery = require("./discovery-BsXiDZBR.cjs");
+const require_templatePath = require("./templatePath-27vUZowm.cjs");
 const require_feeds_paths = require("./feeds/paths.cjs");
 const require_skill_bridge_index = require("./skill-bridge/index.cjs");
 let node_path = require("node:path");
@@ -12,6 +13,166 @@ node_path = require_rolldown_runtime.__toESM(node_path, 1);
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 let zod = require("zod");
+//#region src/collection/server/appViews.ts
+/** The audiences a view may be written for. A CLOSED set: each one names a
+*  tier with a rule behind it, so an unknown value has nowhere to be
+*  published to and is refused before it gets there. */
+var VIEW_AUDIENCES = [
+	"public",
+	"member",
+	"participant"
+];
+/** Where each audience's documents live under `apps/{aid}`. `public` is not
+*  here: it keeps `config/public` + `config/view`, which are already published
+*  and already read by a deployed runtime. */
+var VIEW_TIER = {
+	member: "member",
+	participant: "roster"
+};
+/** The id `public.view` normalizes to. Fixed rather than derived, so two
+*  implementations of the same normalization cannot pick different ones. */
+var PUBLIC_VIEW_ID = "public";
+/** `config` is the projection's own document in every tier (`live:config`),
+*  so a view may not be called that — the two would be the same document. */
+var RESERVED_VIEW_IDS = ["config"];
+/** What an id may be.
+*
+*  Narrow on purpose: this value is written by the author, and it becomes a
+*  Firestore document id under a `live:` / `staged:` prefix. Excluding `:`
+*  keeps the prefix and the id from running together; excluding `/`, `.` and
+*  `__…__` keeps it a legal document id that addresses the path it says. */
+var VIEW_ID_PATTERN = /^[a-z0-9][a-z0-9-]{0,63}$/;
+var VIEW_ID_SHAPE = "must be lowercase letters, digits and hyphens, start with a letter or digit, and be at most 64 characters (e.g. front-desk)";
+/** Both declarations of the same thing, in one file.
+*
+*  Refused rather than merged or preferred: whichever way it were resolved,
+*  the author would have written two answers and been shown neither. */
+var BOTH_FORMS = "app.json declares both `views` and `public.view`. These are the same thing — `public.view` is the older spelling — and publishing would have to choose one silently. Move the `public.view` entry into `views` as { id: \"public\", audience: \"public\", … } and delete it.";
+/** The two declarations, as one list, or the refusal that they are both there.
+*
+*  `public.view` becomes an entry under the reserved id, so everything
+*  downstream reads one shape and "which spelling was used" is decided once. */
+function declaredViews(app) {
+	const legacy = app.public?.view;
+	const authored = app.views;
+	if (legacy !== void 0 && authored !== void 0) return {
+		ok: false,
+		problems: [BOTH_FORMS]
+	};
+	const views = (authored ?? []).map((view, index) => ({
+		id: view.id,
+		audience: view.audience,
+		path: view.path,
+		collections: view.collections,
+		where: `views[${index}]`
+	}));
+	if (legacy === void 0) return {
+		ok: true,
+		views
+	};
+	if (views.some((view) => view.id === "public")) return {
+		ok: false,
+		problems: [`views declares id '${PUBLIC_VIEW_ID}', which is reserved for the older \`public.view\` spelling. ${BOTH_FORMS}`]
+	};
+	return {
+		ok: true,
+		views: [...views, {
+			id: PUBLIC_VIEW_ID,
+			audience: "public",
+			path: legacy.path,
+			collections: legacy.collections,
+			where: "public.view"
+		}]
+	};
+}
+/** Whether one id may be used, and what to say when it may not. */
+function viewIdProblems(view) {
+	if (RESERVED_VIEW_IDS.includes(view.id)) return [`${view.where}.id is '${view.id}', which is reserved: each audience's own declaration is published at that document id.`];
+	if (!VIEW_ID_PATTERN.test(view.id)) return [`${view.where}.id is '${view.id}': a view id ${VIEW_ID_SHAPE}. It becomes the document id this view is published at.`];
+	if (view.id === "public" && view.audience !== "public") return [`${view.where}.id is '${PUBLIC_VIEW_ID}' with audience '${view.audience}': that id belongs to the public page.`];
+	return [];
+}
+/** ONE public page per app, and the reason is the wire rather than taste.
+*
+*  The public runtime reads a single `config/view` document and a single
+*  `config/public.view` declaration beside it. A second `audience: "public"`
+*  entry would pass every other check and then be published nowhere — and
+*  which of the two became the live page would depend on declaration order,
+*  silently. The member tiers have no such limit: `id` is their address, and
+*  each one gets its own document.
+*
+*  The refusal is here rather than "one day we will support it" precisely
+*  because the failure is invisible: nothing errors, and the author sees a
+*  successful publish of a page nobody is served. */
+function singlePublicProblems(views) {
+	const [first, ...rest] = views.filter((view) => view.audience === "public");
+	if (first === void 0) return [];
+	return rest.map((view) => `${view.where} is a second audience "public" view, after ${first.where}. The public page is published at ONE document (config/view), so only one of them could ever be served — and which, would depend on the order they were written in. Give the others audience "member" or "participant", which are addressed by id and may have as many as the app needs.`);
+}
+/** The one shape everything downstream reads.
+*
+*  Every caller — the publish gate, the projection, the host that writes the
+*  documents — goes through this, so "which declaration was used" is decided
+*  exactly once. */
+function normalizeViews(app) {
+	const declared = declaredViews(app);
+	if (!declared.ok) return declared;
+	const problems = [...singlePublicProblems(declared.views)];
+	const seen = /* @__PURE__ */ new Map();
+	for (const view of declared.views) {
+		problems.push(...viewIdProblems(view));
+		const first = seen.get(view.id);
+		if (first === void 0) {
+			seen.set(view.id, view.where);
+			continue;
+		}
+		problems.push(`${view.where}.id is '${view.id}', which ${first} already uses. The id is the document a view is published at, so two of them are one page — whichever was written second would silently replace the first, in staging and again at publish.`);
+	}
+	return problems.length > 0 ? {
+		ok: false,
+		problems
+	} : {
+		ok: true,
+		views: declared.views
+	};
+}
+/** How a participant reaches `cid`, or null if they cannot.
+*
+*  Mirrors the rules' read branches for someone holding no role:
+*  `partRead` (the whole collection) and `ownRow` (their own record, found
+*  by the submit declaration's `emailField` or by a uid-derived id).
+*
+*  `participantRead` is a PARAMETER rather than read off the manifest, and
+*  that is the whole point of the signature. Publish does not promote the
+*  manifest's value: `projectPublish` overwrites `participantRead` with what
+*  the STAGED schemas carry, so a cid added since the last deploy is in the
+*  manifest and not in the rules. Deriving the scope from the manifest would
+*  publish `scope: "all"` for a collection the promoted rules then deny —
+*  and removing one gives the mirror-image false refusal. The caller passes
+*  the set that will actually be in force. */
+function participantScope(app, cid, participantRead) {
+	if (participantRead.includes(cid)) return {
+		cid,
+		scope: "all"
+	};
+	const submit = app.public?.submit?.[cid];
+	if (submit?.emailField !== void 0) return {
+		cid,
+		scope: "own",
+		emailField: submit.emailField
+	};
+	if (submit?.idFrom === "auth.uid") return {
+		cid,
+		scope: "own",
+		ownDocId: "auth.uid"
+	};
+	return null;
+}
+/** The document ids one tier uses. `live:` and `staged:` are the only two
+*  prefixes, so a single `match` covers the projection and every view. */
+var viewDocId = (stage, viewId) => `${stage}:${viewId}`;
+var VIEW_CONFIG_ID = "config";
+//#endregion
 //#region src/collection/server/publishManifest.ts
 /** A collection id / app id, held to the one name rule (`SAFE_SLUG_PATTERN`)
 *  that `sharedCollectionKey` applies. Stated once so a path built later
@@ -85,6 +246,14 @@ var CollectionConfigZ = zod.z.object({
 	*  declaration with the role and no field is refused (`assigneeProblems`),
 	*  because that member would silently hold nothing. */
 	assigneeField: zod.z.string().trim().min(1).optional(),
+	/** This collection is the public projection of `mirrorOf` — the other
+	*  half of `public.submit[...].mirror`, declared here because the rules
+	*  read it when the PROJECTION is written rather than when the record is.
+	*
+	*  What it buys: `state` may be written by anybody, and only to the value
+	*  the authority actually says, so a visitor who was refused a slot can
+	*  repair the stale row that offered it to them. */
+	mirrorOf: NameZ.optional(),
 	peerVisibility: zod.z.enum(["public", "hidden"]).optional(),
 	revealGated: zod.z.boolean().optional(),
 	gatedFrom: NameZ.optional(),
@@ -125,10 +294,38 @@ var WindowRefZ = zod.z.object({
 	collection: NameZ,
 	field: zod.z.string().trim().min(1)
 }).strict();
+/** The closing bound's per-record twin, and it ships WITH `fromField` rather
+*  than as a symmetric extra: a booking desk that opens per slot and never
+*  closes is not a booking desk. Same shape, opposite comparison — and
+*  EXCLUSIVE where `fromField` is inclusive, so one slot's closing instant and
+*  the next one's opening instant may be the same number. */
 var WindowZ = zod.z.object({
 	from: zod.z.iso.datetime().optional(),
 	until: zod.z.iso.datetime().optional(),
-	fromField: WindowRefZ.optional()
+	fromField: WindowRefZ.optional(),
+	untilField: WindowRefZ.optional()
+}).strict();
+/** Which record a `field` document id must name, and what state it must be in.
+*
+*  `idFrom: "field"` alone only stops the same string being written twice —
+*  nothing stops a client bypassing the page and inventing a slot, so the
+*  rules check the referenced record themselves. `exists()` is a FLOOR: a
+*  cancelled slot and a slot nobody may book any more exist too, which is what
+*  `where` is for.
+*
+*  Always the object form, never a bare collection name. Two shapes for one
+*  key is the kind of thing a generator gets right once and wrong afterwards,
+*  and the rules read `s.idIn.collection` either way. */
+var IdInZ = zod.z.object({
+	collection: NameZ,
+	where: zod.z.object({
+		field: zod.z.string().trim().min(1),
+		equals: zod.z.union([
+			zod.z.string(),
+			zod.z.number(),
+			zod.z.boolean()
+		])
+	}).strict().optional()
 }).strict();
 var ValidateZ = zod.z.object({
 	required: zod.z.array(zod.z.string().trim().min(1)).optional(),
@@ -153,12 +350,31 @@ var SubmitZ = zod.z.object({
 	emailField: zod.z.string().trim().min(1).optional(),
 	createFields: zod.z.array(zod.z.string().trim().min(1)).min(1),
 	initialStatus: zod.z.string().trim().min(1).optional(),
+	/** `field` is the mode that makes a CONTESTED resource exclusive: the
+	*  booking's document id IS the slot's id, so the second person to want
+	*  that slot is writing a document that already exists — an update, which
+	*  the public submission path never allows. Firestore decides that
+	*  atomically, so unlike a countable capacity (see `stampField`) this is
+	*  first-come ENFORCED rather than first-come read off a rank. */
 	idFrom: zod.z.enum([
 		"auto",
 		"auth.uid",
-		"auth.uid+field"
+		"auth.uid+field",
+		"field"
 	]).optional(),
 	idField: zod.z.string().trim().min(1).optional(),
+	/** Required by `idFrom: "field"` — see {@link IdInZ}. */
+	idIn: IdInZ.optional(),
+	/** The collection holding this record's PUBLIC PROJECTION, one row per
+	*  contested thing, sharing its document id.
+	*
+	*  A booking carries a name, an address and a phone number, and Firestore
+	*  rules cannot hide a field, so the public page must not read bookings at
+	*  all. It reads the projection instead, whose `state` is a copy of "does
+	*  a booking with this id exist" — and the rules accept the two writes
+	*  only as one batch, in both directions, so the copy cannot drift into
+	*  advertising a slot that is gone. */
+	mirror: NameZ.optional(),
 	validate: ValidateZ.optional(),
 	window: WindowZ.optional(),
 	/** A field the rules PIN to the server clock on create: the record must
@@ -190,8 +406,48 @@ var PublicZ = zod.z.object({
 	*  well as its own declaration. */
 	enabled: zod.z.boolean().optional(),
 	read: zod.z.array(NameZ).optional(),
+	/** The page the public sees, instead of the generated form.
+	*
+	*  A form is enough to ANSWER something and not enough to CHOOSE from
+	*  what is available — a stylist-by-hour grid is not the far end of a
+	*  table. So the app may name one HTML file, which the host publishes to
+	*  `config/view` and the public page renders in a sandboxed iframe.
+	*
+	*  `submit` stays declared alongside: the view sends an INTENT, and the
+	*  page it is embedded in performs the write against these rules.
+	*
+	*  `collections` is declared rather than inferred from `read`. Inferring
+	*  it produces the worst failure this feature has — the view renders, the
+	*  data it wanted was never sent, and it draws an empty grid with no error
+	*  anywhere. */
+	view: zod.z.object({
+		path: zod.z.string().trim().min(1),
+		collections: zod.z.array(NameZ).min(1)
+	}).strict().optional(),
 	submit: zod.z.record(NameZ, SubmitZ).optional()
 }).strict();
+/** One page the app shows, and who it is for.
+*
+*  Generalised from `public.view` (which is still accepted, and normalizes
+*  into this — see `appViews.ts`). The audience is what decides which document
+*  the HTML is published to, and therefore who may read it: a rule cannot hide
+*  a field, so "the front desk sees this" is a place, not a filter.
+*
+*  `id` is not decoration. It becomes the document id the page is published
+*  at, which is what lets one audience have more than one page — the front
+*  desk and the stock room — and what lets a withdrawn view be found and
+*  deleted. Its grammar is enforced at the gate, not here, so the refusal can
+*  say what the value is used for.
+*
+*  `collections` is declared rather than inferred, for the reason `public.view`
+*  gives: an inferred list renders a perfect page with no data in it, and
+*  nothing anywhere says why. */
+var ViewZ = zod.z.object({
+	id: zod.z.string().trim().min(1),
+	audience: zod.z.enum(VIEW_AUDIENCES),
+	path: zod.z.string().trim().min(1),
+	collections: zod.z.array(NameZ).min(1)
+}).strict();
 /** The URL name an app is handed out under: `https://<host>/{slug}`.
 *
 *  A SEPARATE name from the `aid`, and that separation is the point (design
@@ -240,7 +496,10 @@ var AuthoredAppZ = zod.z.object({
 	members: MembersZ,
 	collections: zod.z.record(NameZ, CollectionConfigZ).optional(),
 	participantRead: zod.z.array(NameZ).optional(),
-	public: PublicZ.optional()
+	public: PublicZ.optional(),
+	/** The app's pages, per audience. See {@link ViewZ}; `public.view` is the
+	*  older spelling of the `public` one and normalizes into this list. */
+	views: zod.z.array(ViewZ).optional()
 }).strict();
 /** Parse the authored declaration out of `app.json`'s text.
 *
@@ -296,7 +555,8 @@ function windowMillis(window) {
 	if (Object.values(out).some((value) => !Number.isFinite(value))) throw new Error(`publish: window bound is not a parseable timestamp (${JSON.stringify(window)})`);
 	const projected = {
 		...out,
-		...window.fromField === void 0 ? {} : { fromField: window.fromField }
+		...window.fromField === void 0 ? {} : { fromField: window.fromField },
+		...window.untilField === void 0 ? {} : { untilField: window.untilField }
 	};
 	return Object.keys(projected).length > 0 ? projected : void 0;
 }
@@ -368,10 +628,14 @@ function projectApp(authored, schemas, stamp, existing) {
 		publishedDirty: stamp.dirty === true ? true : void 0,
 		previousPublished: previousOf(existing)
 	});
+	const normalized = normalizeViews(authored);
+	if (!normalized.ok) throw new Error(`publish: views declaration is not publishable (${normalized.problems.join(" ")})`);
+	const publicView = normalized.views.find((view) => view.audience === "public");
 	const config = {
 		enabled: authored.public?.enabled === true,
 		read: authored.public?.read ?? [],
 		submit,
+		...publicView === void 0 ? {} : { view: { collections: publicView.collections } },
 		publishedAt: stamp.publishedAt
 	};
 	if (authored.name !== void 0) config.name = authored.name;
@@ -522,6 +786,64 @@ var appSlugDoc = (aid, published) => ({
 var appStagingPath = (aid) => `apps/${aid}/staging`;
 /** The public-config documents' parent path. */
 var appConfigPath = (aid) => `apps/${aid}/config`;
+/** Where one audience's pages live. `member` is read by anyone holding a role;
+*  `roster` by anyone on the roster, participants included. */
+var appViewTierPath = (aid, tier) => `apps/${aid}/${tier}`;
+/** What one audience may see of one collection.
+*
+*  For `member` this is always the whole collection: every read branch a role
+*  opens (`readerOf`) is unscoped. Whether THIS member holds the role is not
+*  knowable here — one projection is read by every member of the tier — and is
+*  settled where it can be, by the entrance trying the read.
+*
+*  For `participant` it is the rules' own answer, which is why it can be null:
+*  a participant with neither `participantRead` nor an own-row submit path
+*  cannot read the collection at all, and a page handed it would fail rather
+*  than render less. */
+function scopeFor(authored, audience, cid, participantRead) {
+	return audience === "member" ? {
+		cid,
+		scope: "all"
+	} : participantScope(authored, cid, participantRead);
+}
+/** Project the declaration into the per-audience documents.
+*
+*  Pure, like `projectApp`: the HTML is not here (the host reads the files),
+*  and neither is the clock. What is here is the answer to "what may this
+*  audience read, and how" — computed once, so the page never has to guess and
+*  never has to discover it from a denial. */
+function projectAppViews(authored, stamp, promoted) {
+	const participantRead = promoted?.participantRead ?? authored.participantRead ?? [];
+	const normalized = normalizeViews(authored);
+	if (!normalized.ok) throw new Error(`publish: views declaration is not publishable (${normalized.problems.join(" ")})`);
+	return ["member", "participant"].map((audience) => {
+		const views = normalized.views.filter((view) => view.audience === audience);
+		const cids = [...new Set(views.flatMap((view) => view.collections))];
+		const declaredSubmit = authored.public?.submit ?? {};
+		const submit = Object.fromEntries(cids.flatMap((cid) => {
+			const spec = declaredSubmit[cid];
+			return spec === void 0 ? [] : [[cid, projectSubmit(spec)]];
+		}));
+		const config = {
+			views: views.map((view) => ({
+				id: view.id,
+				collections: view.collections.map((cid) => scopeFor(authored, audience, cid, participantRead)).filter((scope) => scope !== null)
+			})),
+			submit,
+			publishedAt: stamp.publishedAt
+		};
+		if (authored.name !== void 0) config.name = authored.name;
+		return {
+			tier: VIEW_TIER[audience],
+			audience,
+			config,
+			views
+		};
+	});
+}
+/** The document a tier's projection is published at. Beside the views
+*  themselves, under one `match` — see `firestore.rules`. */
+var viewConfigDocId = (stage) => viewDocId(stage, VIEW_CONFIG_ID);
 //#endregion
 //#region src/collection/server/publishChecks.ts
 /** Does this submit declaration bind a record to the submitter's identity?
@@ -669,7 +991,7 @@ function ruleReadFields(submit) {
 		field: submit.emailField,
 		why: `public.submit.<cid>.emailField — the rules compare it to the submitter's verified address`
 	});
-	if (submit.idFrom === "auth.uid+field" && submit.idField !== void 0) fields.push({
+	if ((submit.idFrom === "auth.uid+field" || submit.idFrom === "field") && submit.idField !== void 0) fields.push({
 		field: submit.idField,
 		why: `public.submit.<cid>.idField — the rules rebuild the document id from it`
 	});
@@ -692,10 +1014,58 @@ function submitCoherenceProblems(app, cid, submit) {
 	const collection = app.collections?.[cid];
 	const problems = [...statusCoherenceProblems(cid, submit, collection), ...createFieldProblems(cid, submit)];
 	if (submit.idFrom === "auth.uid+field" && submit.idField === void 0) problems.push(`public.submit.${cid}.idFrom is "auth.uid+field" but no idField is declared: the rules rebuild the document id from that field and refuse every create.`);
+	problems.push(...fieldIdProblems(cid, submit));
 	if ((submit.selfUpdate !== void 0 || submit.selfTransitions !== void 0) && !collection?.statusField) problems.push(`public.submit.${cid}.selfUpdate / selfTransitions are declared per CURRENT STATUS, but collections.${cid} declares no statusField: the rules read the current status first and refuse every self-edit without it.`);
 	if (submit.audience === "participant" && Object.keys(app.members).length === 0) problems.push(`public.submit.${cid}.audience is "participant" but the roster is empty: the rules resolve the submitter's role from members, so every submission is refused.`);
 	return problems;
 }
+/** `idFrom: "field"` makes the document id a CLAIM ABOUT ANOTHER RECORD, and
+*  the claim is only worth what is checked.
+*
+*  `idIn` is required rather than optional, and that is the whole point of
+*  refusing here: without it the id is any string a stranger likes, so the app
+*  quietly accepts bookings for slots that do not exist. Nothing downstream
+*  ever notices — the booking is real, its slot is not — which is exactly the
+*  kind of hole a gate is for and a rule cannot state.
+*
+*  `idIn` without the mode is refused for the opposite reason: the rules read
+*  it only in that branch, so an author who wrote it believes a check is
+*  running that is not. */
+function fieldIdProblems(cid, submit) {
+	const problems = [];
+	if (submit.idFrom === "field") {
+		if (submit.idField === void 0) problems.push(`public.submit.${cid}.idFrom is "field" but no idField is declared: the rules take the document id from that field and refuse every create.`);
+		if (submit.idIn === void 0) problems.push(`public.submit.${cid}.idFrom is "field" but no idIn is declared: the document id is then any string a submitter chooses, so the app accepts records pointing at things that do not exist. Name the collection the id must be found in — and, when only some of those records may be claimed, the state they must be in: "idIn": { "collection": "slots", "where": { "field": "state", "equals": "open" } }.`);
+	} else if (submit.idIn !== void 0) {
+		const mode = submit.idFrom === void 0 ? "absent" : JSON.stringify(submit.idFrom);
+		problems.push(`public.submit.${cid}.idIn is declared but idFrom is ${mode}: the rules read idIn only for idFrom "field", so as written nothing checks the referenced record and the declaration promises a check it does not perform.`);
+	}
+	return problems;
+}
+/** Every `idIn` target, checked against the collections this repository has.
+*
+*  Separate from {@link fieldIdProblems} for the reason the file is split at
+*  all: that one reads the declaration alone, this one needs to know what
+*  exists. */
+function idTargetProblems(app, collections) {
+	const known = new Set(collections.map((collection) => collection.cid));
+	const names = known.size > 0 ? [...known].sort().join(", ") : "(none)";
+	return Object.entries(app.public?.submit ?? {}).flatMap(([cid, submit]) => idInTargetProblems(cid, submit, known, names));
+}
+/** Where a `field` id says its record must be found.
+*
+*  A typo passes every other check: the rules look the record up in a
+*  collection that does not exist, the lookup can never succeed, and every
+*  submission is refused with no explanation anywhere. A collection pointing
+*  at ITSELF is worse than a typo — on a create the document being written
+*  does not exist yet, so it is a declaration that can never accept anything. */
+function idInTargetProblems(cid, submit, known, names) {
+	const target = submit.idIn?.collection;
+	if (target === void 0) return [];
+	if (target === cid) return [`public.submit.${cid}.idIn.collection names '${cid}' itself: a create writes a document that does not exist yet, so the record can never be found and every submission is refused. Name the collection of the thing being claimed (the slots, the seats, the assets).`];
+	if (!known.has(target)) return [`public.submit.${cid}.idIn.collection names '${target}', which is not a shared collection in this repository. The rules look the record up there, so nothing can ever be submitted. Shared collections here: ${names}.`];
+	return [];
+}
 /** The staged reveal reads its flag off the PARENT record, so the path to that
 *  parent is not optional decoration — without it the gate never opens. */
 function gateCoherenceProblems(cid, collection) {
@@ -746,7 +1116,10 @@ function publishProblems(app, collections, publisherEmail) {
 		...primaryKeyProblems(app, collections),
 		...assigneeProblems(app),
 		...stampProblems(app),
-		...windowRefProblems(app, collections)
+		...windowRefProblems(app, collections),
+		...idTargetProblems(app, collections),
+		...mirrorProblems(app, collections),
+		...viewProblems(app, collections)
 	];
 }
 /** A public submission must NOT be allowed to name its own primary key.
@@ -827,14 +1200,106 @@ function stampProblems(app) {
 *  good. */
 function windowRefProblems(app, collections) {
 	const known = new Set(collections.map((collection) => collection.cid));
-	return Object.entries(app.public?.submit ?? {}).flatMap(([cid, submit]) => {
-		const ref = submit.window?.fromField;
-		if (ref === void 0) return [];
-		const problems = [];
-		if (!known.has(ref.collection)) problems.push(`public.submit.${cid}.window.fromField.collection names '${ref.collection}', which is not a shared collection in this repository. The rules read the opening time off a record there, so nothing can ever be submitted. Shared collections here: ${known.size > 0 ? [...known].sort().join(", ") : "(none)"}.`);
-		if (!submit.createFields.includes(ref.ref)) problems.push(`public.submit.${cid}.window.fromField.ref names '${ref.ref}', which is not in createFields. The rules take the target record's id from that field ON THE SUBMISSION — if the submitter never writes it, there is nothing to look up and every submission is refused.`);
-		return problems;
-	});
+	return Object.entries(app.public?.submit ?? {}).flatMap(([cid, submit]) => [...windowBoundProblems(cid, submit, known, "fromField", submit.window?.fromField, "opening"), ...windowBoundProblems(cid, submit, known, "untilField", submit.window?.untilField, "closing")]);
+}
+/** Both bounds, checked identically. `untilField` arrived with the booking
+*  desk and reads exactly like its twin, so a check that knew only about
+*  `fromField` would let the closing half through unchecked — and a closing
+*  bound that names nothing does not leave the door ajar, it refuses every
+*  submission with no explanation. */
+function windowBoundProblems(cid, submit, known, key, ref, which) {
+	if (ref === void 0) return [];
+	const problems = [];
+	if (!known.has(ref.collection)) problems.push(`public.submit.${cid}.window.${key}.collection names '${ref.collection}', which is not a shared collection in this repository. The rules read the ${which} time off a record there, so nothing can ever be submitted. Shared collections here: ${known.size > 0 ? [...known].sort().join(", ") : "(none)"}.`);
+	if (!submit.createFields.includes(ref.ref)) problems.push(`public.submit.${cid}.window.${key}.ref names '${ref.ref}', which is not in createFields. The rules take the target record's id from that field ON THE SUBMISSION — if the submitter never writes it, there is nothing to look up and every submission is refused.`);
+	return problems;
+}
+/** The two halves of a mirror, checked as the pair they only work as.
+*
+*  `mirror` on the submission and `mirrorOf` on the projection are separate
+*  keys in separate places, and each is inert without the other: a booking
+*  whose slot declares no `mirrorOf` can never be created (the rules demand a
+*  paired write that the projection's own rule will refuse), and a projection
+*  whose authority declares no `mirror` drifts unbounded because nothing makes
+*  the two move together. Both failures are silent, and one of them —
+*  advertising a slot somebody already holds — is the exact thing the mirror
+*  exists to prevent.
+*
+*  Also refuses a collection mirroring ITSELF, which reads as a typo and
+*  behaves as an unwritable collection: every create would have to prove its
+*  own document is simultaneously taken and open. */
+function mirrorProblems(app, collections) {
+	const known = new Set(collections.map((collection) => collection.cid));
+	const names = known.size > 0 ? [...known].sort().join(", ") : "(none)";
+	return [...Object.entries(app.public?.submit ?? {}).flatMap(([cid, submit]) => mirrorClaimProblems(app, cid, submit, known, names)), ...Object.entries(app.collections ?? {}).flatMap(([cid, collection]) => mirrorOfProblems(app, cid, collection, known, names))];
+}
+/** The submission side: `public.submit[cid].mirror`. */
+function mirrorClaimProblems(app, cid, submit, known, names) {
+	const { mirror } = submit;
+	if (mirror === void 0) return [];
+	if (mirror === cid) return [`public.submit.${cid}.mirror names its own collection: the projection is a SEPARATE record, and as written no create can satisfy the rules.`];
+	if (!known.has(mirror)) return [`public.submit.${cid}.mirror names '${mirror}', which is not a shared collection in this repository. The rules require the projection to move in the same write, so every submission is refused. Shared collections here: ${names}.`];
+	if (app.collections?.[mirror]?.mirrorOf !== cid) return [`public.submit.${cid}.mirror names '${mirror}', but collections.${mirror} does not declare mirrorOf: "${cid}". The two halves only work as a pair — the submission side demands the projection move with it, and the projection side is what allows that move — so as written every submission is refused.`];
+	return [];
+}
+/** The projection side: `collections[cid].mirrorOf`. */
+function mirrorOfProblems(app, cid, collection, known, names) {
+	const authority = collection.mirrorOf;
+	if (authority === void 0) return [];
+	if (!known.has(authority)) return [`collections.${cid}.mirrorOf names '${authority}', which is not a shared collection in this repository. Nothing can then be true of it, so the projection's state may never be written. Shared collections here: ${names}.`];
+	if (app.public?.submit?.[authority]?.mirror !== cid) return [`collections.${cid}.mirrorOf names '${authority}', but public.submit.${authority} does not declare mirror: "${cid}". Only the pair keeps the projection honest: without the other half a record can be created without moving this one, and the public page goes on offering something that is already taken.`];
+	return [];
+}
+/** What each view is handed, and whether its audience can actually read it.
+*
+*  Declared, never inferred — a view whose datasets were guessed from
+*  `public.read` renders perfectly and draws an empty grid, with nothing in
+*  the page, the rules or the log to say why.
+*
+*  The reachability check below is that same failure, once per audience. A
+*  `public` view naming a collection outside `public.read` draws nothing; a
+*  `participant` view naming one the participant reaches by neither
+*  `participantRead` nor their own row is worse, because an unscoped list on
+*  an own-row collection is DENIED rather than narrowed — the page does not
+*  render less, it fails.
+*
+*  There is deliberately no such check for `member`. Every read a role opens
+*  is unscoped, and WHICH role a given member holds is not a property of the
+*  declaration: a stylist scoped to `bookings` and an owner read the same
+*  projection. That one is settled at the entrance, by trying the read. */
+/** The path, for one view. The SAME validator the host's own custom views use,
+*  rather than a second opinion about what a safe view path is.
+*
+*  Two ad-hoc attempts were wrong here in the same afternoon: a prefix-and-
+*  suffix test let `views/../../secrets.html` through, and `views/[^/]+\.html`
+*  still let `views/..\..\secrets.html` through, because a backslash is not a
+*  slash on this side of the check and IS a separator on Windows. This one
+*  rejects `..`, backslashes, leading slashes and anything outside
+*  `[A-Za-z0-9._-]` per segment.
+*
+*  It matters more here than for a host view: the host reads this path to
+*  decide which file to copy onto a document other people read — for a public
+*  view, a document whose rule is `allow read: if true`, so the blast radius of
+*  a bad path is the world rather than the author's own iframe. Nested paths
+*  ARE allowed by the shared validator; the extra `views/<one name>.html` shape
+*  is this publisher's own narrowing, kept because there is no reason for a
+*  published view to live in a subdirectory. */
+function viewPathProblems(view) {
+	if (require_templatePath.isSafeCustomViewPath(view.path) && view.path.split("/").length === 2) return [];
+	return [`${view.where}.path is '${view.path}': a published view is exactly one HTML file directly inside the collection's own views/ directory (e.g. views/booking.html) — no sub-directories, and no segments that climb out of it. The host reads this as a file to publish.`];
+}
+/** One dataset, for one view: does it exist here, and can the audience it is
+*  handed to actually read it? */
+function viewCollectionProblems(app, view, cid, known) {
+	if (!known.has(cid)) return [`${view.where}.collections names '${cid}', which is not a shared collection in this repository. Shared collections here: ${known.size > 0 ? [...known].sort().join(", ") : "(none)"}.`];
+	if (view.audience === "public" && !(app.public?.read ?? []).includes(cid)) return [`${view.where}.collections names '${cid}', which is not in public.read: the page reads these with the VISITOR's permissions, so the rules refuse the read and the view draws an empty page. Nothing errors — this is the failure that looks like a working view with no data.`];
+	return [];
+}
+function viewProblems(app, collections) {
+	const normalized = normalizeViews(app);
+	if (!normalized.ok) return normalized.problems;
+	const known = new Set(collections.map((collection) => collection.cid));
+	return normalized.views.flatMap((view) => [...viewPathProblems(view), ...view.collections.flatMap((cid) => viewCollectionProblems(app, view, cid, known))]);
 }
 /** What publish will actually promote, checked as the PAIR it becomes.
 *
@@ -863,12 +1328,162 @@ function windowRefProblems(app, collections) {
 function promotedRoleProblems(app, staged) {
 	const promoted = stagedRuleConfig(staged).collections ?? {};
 	const stagedCids = new Set(staged.map((entry) => entry.cid));
+	return [
+		...promotedAssigneeProblems(app, promoted, stagedCids),
+		...promotedMirrorProblems(app, promoted, stagedCids),
+		...promotedRefFieldProblems(app, staged),
+		...promotedParticipantViewProblems(app, staged)
+	];
+}
+/** A participant's page, checked against the `participantRead` publish will
+*  actually PROMOTE.
+*
+*  Not against the manifest's. `projectPublish` overwrites `participantRead`
+*  with what the staged schemas carry, so a cid added to the manifest since the
+*  last deploy is not in the rules — and a page written for it would be
+*  published, offered, and then refused the read. The manifest half of this
+*  file cannot see that; the promoted half can, which is why the check lives
+*  here rather than beside the other view checks. */
+function promotedParticipantViewProblems(app, staged) {
+	const normalized = normalizeViews(app);
+	if (!normalized.ok) return [];
+	const participantRead = stagedRuleConfig(staged).participantRead ?? [];
+	return normalized.views.filter((view) => view.audience === "participant").flatMap((view) => view.collections.filter((cid) => participantScope(app, cid, participantRead) === null).map((cid) => `${view.where}.collections names '${cid}', which a participant cannot read once this publishes: it is not in the participantRead that DEPLOY staged, and public.submit.${cid} declares neither an emailField nor idFrom "auth.uid", so there is no row the rules would call theirs. The page would be refused the read, not handed fewer records. (Adding it to participantRead in app.json is not enough — deploy first.)`));
+}
+/** The FIELDS a rule reads off another record — `idIn.where.field` and the two
+*  window bounds — checked against the schema publish is about to promote.
+*
+*  These are checked here rather than in `publishProblems` because that gate
+*  is given a cid and a primary key per collection and nothing else, on
+*  purpose: it reads the DECLARATION. A field name can only be judged against
+*  a schema, and the schema that matters is the STAGED one — the version
+*  publish promotes — not whatever the working tree says now.
+*
+*  What a typo costs: `where: { field: "staet" }` publishes cleanly, the
+*  rules' comparison can never match, and every submission is denied with no
+*  message. The author's own app looks broken with nothing to read.
+*
+*  Only fields the schema DECLARES are accepted. A record may carry more than
+*  its schema does, but a shared collection's records are written through it,
+*  and "the field exists on some rows" is not something a gate can promise. */
+function promotedRefFieldProblems(app, staged) {
+	const schemaOf = new Map(staged.map((entry) => [entry.cid, entry.doc.publishedSchema]));
+	return Object.entries(app.public?.submit ?? {}).flatMap(([cid, submit]) => submitRefProblems(schemaOf, cid, submit));
+}
+function submitRefProblems(schemaOf, cid, submit) {
+	return [
+		...idInRefProblems(schemaOf, cid, submit),
+		...boundRefProblems(schemaOf, cid, "fromField", submit.window?.fromField),
+		...boundRefProblems(schemaOf, cid, "untilField", submit.window?.untilField)
+	];
+}
+function idInRefProblems(schemaOf, cid, submit) {
+	const where = submit.idIn?.where;
+	if (where === void 0) return [];
+	return [...refFieldProblem(schemaOf, cid, "idIn.where.field", submit.idIn?.collection, where.field), ...comparableProblem(schemaOf, cid, submit.idIn?.collection, where)];
+}
+function boundRefProblems(schemaOf, cid, key, ref) {
+	if (ref === void 0) return [];
+	return [...refFieldProblem(schemaOf, cid, `window.${key}.field`, ref.collection, ref.field), ...millisProblem(schemaOf, cid, `window.${key}.field`, ref)];
+}
+/** The field spec a reference points at, or undefined when there is nothing
+*  staged to judge it against (the host refuses that separately, naming every
+*  missing collection at once). */
+function referencedField(schemaOf, target, field) {
+	if (target === void 0 || field === void 0) return void 0;
+	return schemaOf.get(target)?.fields?.[field];
+}
+/** An enum's domain, or undefined for every other kind. Narrowed by the key
+*  rather than asserted: `fields` is a discriminated union and only some of
+*  its members carry `values`. */
+function enumValues(spec) {
+	return spec.type === "enum" ? spec.values : void 0;
+}
+function refFieldProblem(schemaOf, cid, key, target, field) {
+	if (target === void 0 || field === void 0) return [];
+	const schema = schemaOf.get(target);
+	if (schema === void 0 || referencedField(schemaOf, target, field) !== void 0) return [];
+	const known = Object.keys(schema.fields ?? {}).sort().join(", ");
+	return [`public.submit.${cid}.${key} names '${field}', which the STAGED schema of '${target}' — the one publish promotes — does not declare. The rules read that field off the record and compare it, so as written every submission is refused with nothing to explain it. Fields on '${target}': ${known.length > 0 ? known : "(none)"}.`];
+}
+/** A comparison the rules can never satisfy is as dead as a missing field, and
+*  looks even more correct on the page: an `enum` whose domain does not contain
+*  the value, or a boolean field compared with a string. */
+function comparableProblem(schemaOf, cid, target, where) {
+	const spec = referencedField(schemaOf, target, where.field);
+	if (spec === void 0) return [];
+	const said = JSON.stringify(where.equals);
+	const values = enumValues(spec);
+	if (values !== void 0) {
+		if (values.includes(String(where.equals))) return [];
+		return [`public.submit.${cid}.idIn.where.equals is ${said}, which is not one of the values '${where.field}' can hold on '${String(target)}' (${values.join(", ") || "(none)"}). The comparison can never be true, so every submission is refused.`];
+	}
+	const wanted = spec.type === "number" ? "number" : spec.type === "boolean" ? "boolean" : "string";
+	if (typeof where.equals === wanted) return [];
+	return [`public.submit.${cid}.idIn.where.equals is ${said}, and '${where.field}' on '${String(target)}' is a ${spec.type} field. The rules compare the stored value with this one and never coerce, so the comparison can never be true and every submission is refused.`];
+}
+/** A per-record window bound is EPOCH MILLIS, because the rules have no date
+*  arithmetic and do not coerce: they compare `request.time.toMillis()` with
+*  whatever is stored. A `datetime` field holds an ISO string, which is a type
+*  error that fails closed — the window never opens, and nothing says so. */
+function millisProblem(schemaOf, cid, key, ref) {
+	const spec = referencedField(schemaOf, ref?.collection, ref?.field);
+	if (spec === void 0 || spec.type === "number") return [];
+	return [`public.submit.${cid}.${key} names '${String(ref?.field)}' on '${String(ref?.collection)}', which is a ${spec.type} field. A per-record bound is EPOCH MILLIS: the rules compare it with request.time.toMillis() and never coerce, so anything else is a type error that refuses every submission — the window simply never opens. Store the instant as a number.`];
+}
+function promotedAssigneeProblems(app, promoted, stagedCids) {
 	return Object.entries(app.members).flatMap(([email, roles]) => Object.entries(roles).flatMap(([cid, role]) => {
 		if (role !== "assignee" || cid === "*" || !stagedCids.has(cid)) return [];
 		if (promoted[cid]?.assigneeField !== void 0) return [];
 		return [`members["${email}"] holds "assignee" on '${cid}', and the STAGED version of '${cid}' — the one publish promotes — carries no assigneeField, even if app.json declares one now. Publish writes the roster from app.json and the collection configuration from the deploy, so that member would land with nothing to be compared against: refused every write, while the app keeps working for everybody else. Run deploy again, so the version being published is the one the declaration describes.`];
 	}));
 }
+/** The mirror's other half, checked against what publish will actually
+*  promote — the same trap as the assignee's field, reached by the same route.
+*
+*  `mirror` is published from the MANIFEST (it lives in `public.submit`) while
+*  `mirrorOf` is promoted from what DEPLOY staged. Add both halves to
+*  `app.json` and publish without redeploying, and what lands is a submission
+*  demanding a paired projection write beside a projection whose rule config
+*  does not allow it: every booking is refused, and the declaration on disk
+*  looks perfectly sound.
+*
+*  Refused in the reverse direction too. Removing `mirrorOf` from a live app
+*  and publishing without a deploy leaves the projection accepting nothing —
+*  and removing it FROM the staged side while the submission still demands it
+*  is the drift this pair exists to prevent. */
+function promotedMirrorProblems(app, promoted, stagedCids) {
+	return [...addedMirrorProblems(app, promoted, stagedCids), ...strandedMirrorProblems(app, promoted)];
+}
+/** The manifest asks for a projection the promoted configuration will not
+*  allow: every submission denied, and nothing on the page to say why. */
+function addedMirrorProblems(app, promoted, stagedCids) {
+	return Object.entries(app.public?.submit ?? {}).flatMap(([cid, submit]) => {
+		const { mirror } = submit;
+		if (mirror === void 0 || !stagedCids.has(mirror)) return [];
+		if (promoted[mirror]?.mirrorOf === cid) return [];
+		return [`public.submit.${cid}.mirror names '${mirror}', and the STAGED version of '${mirror}' — the one publish promotes — does not declare mirrorOf: "${cid}", even if app.json declares it now. Publish writes the submission side from app.json and the collection side from the deploy, so what lands is a booking that must move its projection beside a projection that refuses to move: every submission is denied, with nothing on the page to say why. Run deploy again, so the version being published is the one the declaration describes.`];
+	});
+}
+/** The other direction, and the DANGEROUS one.
+*
+*  Take a live pair, delete BOTH halves from `app.json`, and publish without
+*  redeploying. The submission side comes from the manifest, so nothing
+*  requires the projection to move any more; the collection side comes from
+*  staging, which still says `mirrorOf`, so the projection stays writable.
+*  Bookings are then created while the public row goes on saying `open` — the
+*  precise failure the pair exists to prevent, arrived at by removing it.
+*
+*  Refused rather than tolerated because the app keeps WORKING: submissions
+*  succeed. Only the public page is wrong, and only to the people reading it. */
+function strandedMirrorProblems(app, promoted) {
+	return Object.entries(promoted).flatMap(([cid, config]) => {
+		const authority = config.mirrorOf;
+		if (authority === void 0) return [];
+		if (app.public?.submit?.[authority]?.mirror === cid) return [];
+		return [`the STAGED version of '${cid}' — the one publish promotes — declares mirrorOf: "${authority}", and app.json no longer declares public.submit.${authority}.mirror: "${cid}". What lands is a projection that is still writable beside submissions that no longer have to move it, so records can be created while '${cid}' goes on advertising them as available. Nothing fails: the app works and the public page lies. Run deploy again, so the version being published is the one the declaration describes.`];
+	});
+}
 //#endregion
 //#region src/collection/server/skillAssets.ts
 /** Read a collection's custom-view HTML, path-safely. `viewFile` is a
@@ -2993,12 +3608,48 @@ Object.defineProperty(exports, "PUBLIC_CONFIG_DOC", {
 		return PUBLIC_CONFIG_DOC;
 	}
 });
+Object.defineProperty(exports, "PUBLIC_VIEW_ID", {
+	enumerable: true,
+	get: function() {
+		return PUBLIC_VIEW_ID;
+	}
+});
+Object.defineProperty(exports, "RESERVED_VIEW_IDS", {
+	enumerable: true,
+	get: function() {
+		return RESERVED_VIEW_IDS;
+	}
+});
 Object.defineProperty(exports, "STORE_UNREADABLE", {
 	enumerable: true,
 	get: function() {
 		return STORE_UNREADABLE;
 	}
 });
+Object.defineProperty(exports, "VIEW_AUDIENCES", {
+	enumerable: true,
+	get: function() {
+		return VIEW_AUDIENCES;
+	}
+});
+Object.defineProperty(exports, "VIEW_CONFIG_ID", {
+	enumerable: true,
+	get: function() {
+		return VIEW_CONFIG_ID;
+	}
+});
+Object.defineProperty(exports, "VIEW_ID_PATTERN", {
+	enumerable: true,
+	get: function() {
+		return VIEW_ID_PATTERN;
+	}
+});
+Object.defineProperty(exports, "VIEW_TIER", {
+	enumerable: true,
+	get: function() {
+		return VIEW_TIER;
+	}
+});
 Object.defineProperty(exports, "advanceTriggerDate", {
 	enumerable: true,
 	get: function() {
@@ -3029,6 +3680,12 @@ Object.defineProperty(exports, "appStagingPath", {
 		return appStagingPath;
 	}
 });
+Object.defineProperty(exports, "appViewTierPath", {
+	enumerable: true,
+	get: function() {
+		return appViewTierPath;
+	}
+});
 Object.defineProperty(exports, "applyMutateAction", {
 	enumerable: true,
 	get: function() {
@@ -3137,6 +3794,12 @@ Object.defineProperty(exports, "maybeSpawnSuccessor", {
 		return maybeSpawnSuccessor;
 	}
 });
+Object.defineProperty(exports, "normalizeViews", {
+	enumerable: true,
+	get: function() {
+		return normalizeViews;
+	}
+});
 Object.defineProperty(exports, "parseAuthoredApp", {
 	enumerable: true,
 	get: function() {
@@ -3149,12 +3812,24 @@ Object.defineProperty(exports, "parseCivil", {
 		return parseCivil;
 	}
 });
+Object.defineProperty(exports, "participantScope", {
+	enumerable: true,
+	get: function() {
+		return participantScope;
+	}
+});
 Object.defineProperty(exports, "projectApp", {
 	enumerable: true,
 	get: function() {
 		return projectApp;
 	}
 });
+Object.defineProperty(exports, "projectAppViews", {
+	enumerable: true,
+	get: function() {
+		return projectAppViews;
+	}
+});
 Object.defineProperty(exports, "projectDeploy", {
 	enumerable: true,
 	get: function() {
@@ -3263,5 +3938,17 @@ Object.defineProperty(exports, "validateRecordObject", {
 		return validateRecordObject;
 	}
 });
+Object.defineProperty(exports, "viewConfigDocId", {
+	enumerable: true,
+	get: function() {
+		return viewConfigDocId;
+	}
+});
+Object.defineProperty(exports, "viewDocId", {
+	enumerable: true,
+	get: function() {
+		return viewDocId;
+	}
+});
 
-//# sourceMappingURL=server-BIKy55wo.cjs.map
+//# sourceMappingURL=server-DknYbXBo.cjs.map