@mulmoclaude/core 3.13.0 → 3.15.0

package/dist/{server-DGjmK9vU.js → server-jm7aGA3g.js}

@@ -11,6 +11,250 @@ import path from "node:path";
 import { randomBytes, randomUUID } from "node:crypto";
 import { cp, lstat, mkdir, open, readFile, readdir, rm, rmdir, stat, unlink, writeFile } from "node:fs/promises";
 import { z } from "zod";
+//#region src/collection/server/appViews.ts
+/** The audiences a view may be written for. A CLOSED set: each one names a
+*  tier with a rule behind it, so an unknown value has nowhere to be
+*  published to and is refused before it gets there. */
+var VIEW_AUDIENCES = [
+	"public",
+	"member",
+	"participant"
+];
+/** Where each audience's documents live under `apps/{aid}`. `public` is not
+*  here: it keeps `config/public` + `config/view`, which are already published
+*  and already read by a deployed runtime. */
+var VIEW_TIER = {
+	member: "member",
+	participant: "roster"
+};
+/** The id `public.view` normalizes to. Fixed rather than derived, so two
+*  implementations of the same normalization cannot pick different ones. */
+var PUBLIC_VIEW_ID = "public";
+/** `config` is the projection's own document in every tier (`live:config`),
+*  so a view may not be called that — the two would be the same document. */
+var RESERVED_VIEW_IDS = ["config"];
+/** What an id may be.
+*
+*  Narrow on purpose: this value is written by the author, and it becomes a
+*  Firestore document id under a `live:` / `staged:` prefix. Excluding `:`
+*  keeps the prefix and the id from running together; excluding `/`, `.` and
+*  `__…__` keeps it a legal document id that addresses the path it says. */
+var VIEW_ID_PATTERN = /^[a-z0-9][a-z0-9-]{0,63}$/;
+var VIEW_ID_SHAPE = "must be lowercase letters, digits and hyphens, start with a letter or digit, and be at most 64 characters (e.g. front-desk)";
+/** Both declarations of the same thing, in one file.
+*
+*  Refused rather than merged or preferred: whichever way it were resolved,
+*  the author would have written two answers and been shown neither. */
+var BOTH_FORMS = "app.json declares both `views` and `public.view`. These are the same thing — `public.view` is the older spelling — and publishing would have to choose one silently. Move the `public.view` entry into `views` as { id: \"public\", audience: \"public\", … } and delete it.";
+/** The two declarations, as one list, or the refusal that they are both there.
+*
+*  `public.view` becomes an entry under the reserved id, so everything
+*  downstream reads one shape and "which spelling was used" is decided once. */
+function declaredViews(app) {
+	const legacy = app.public?.view;
+	const authored = app.views;
+	if (legacy !== void 0 && authored !== void 0) return {
+		ok: false,
+		problems: [BOTH_FORMS]
+	};
+	const views = (authored ?? []).map((view, index) => ({
+		id: view.id,
+		audience: view.audience,
+		path: view.path,
+		collections: view.collections,
+		where: `views[${index}]`
+	}));
+	if (legacy === void 0) return {
+		ok: true,
+		views
+	};
+	if (views.some((view) => view.id === "public")) return {
+		ok: false,
+		problems: [`views declares id '${PUBLIC_VIEW_ID}', which is reserved for the older \`public.view\` spelling. ${BOTH_FORMS}`]
+	};
+	return {
+		ok: true,
+		views: [...views, {
+			id: PUBLIC_VIEW_ID,
+			audience: "public",
+			path: legacy.path,
+			collections: legacy.collections,
+			where: "public.view"
+		}]
+	};
+}
+/** Whether one id may be used, and what to say when it may not. */
+function viewIdProblems(view) {
+	if (RESERVED_VIEW_IDS.includes(view.id)) return [`${view.where}.id is '${view.id}', which is reserved: each audience's own declaration is published at that document id.`];
+	if (!VIEW_ID_PATTERN.test(view.id)) return [`${view.where}.id is '${view.id}': a view id ${VIEW_ID_SHAPE}. It becomes the document id this view is published at.`];
+	if (view.id === "public" && view.audience !== "public") return [`${view.where}.id is '${PUBLIC_VIEW_ID}' with audience '${view.audience}': that id belongs to the public page.`];
+	return [];
+}
+/** ONE public page per app, and the reason is the wire rather than taste.
+*
+*  The public runtime reads a single `config/view` document and a single
+*  `config/public.view` declaration beside it. A second `audience: "public"`
+*  entry would pass every other check and then be published nowhere — and
+*  which of the two became the live page would depend on declaration order,
+*  silently. The member tiers have no such limit: `id` is their address, and
+*  each one gets its own document.
+*
+*  The refusal is here rather than "one day we will support it" precisely
+*  because the failure is invisible: nothing errors, and the author sees a
+*  successful publish of a page nobody is served. */
+function singlePublicProblems(views) {
+	const [first, ...rest] = views.filter((view) => view.audience === "public");
+	if (first === void 0) return [];
+	return rest.map((view) => `${view.where} is a second audience "public" view, after ${first.where}. The public page is published at ONE document (config/view), so only one of them could ever be served — and which, would depend on the order they were written in. Give the others audience "member" or "participant", which are addressed by id and may have as many as the app needs.`);
+}
+/** The one shape everything downstream reads.
+*
+*  Every caller — the publish gate, the projection, the host that writes the
+*  documents — goes through this, so "which declaration was used" is decided
+*  exactly once. */
+function normalizeViews(app) {
+	const declared = declaredViews(app);
+	if (!declared.ok) return declared;
+	const problems = [...singlePublicProblems(declared.views)];
+	const seen = /* @__PURE__ */ new Map();
+	for (const view of declared.views) {
+		problems.push(...viewIdProblems(view));
+		const first = seen.get(view.id);
+		if (first === void 0) {
+			seen.set(view.id, view.where);
+			continue;
+		}
+		problems.push(`${view.where}.id is '${view.id}', which ${first} already uses. The id is the document a view is published at, so two of them are one page — whichever was written second would silently replace the first, in staging and again at publish.`);
+	}
+	return problems.length > 0 ? {
+		ok: false,
+		problems
+	} : {
+		ok: true,
+		views: declared.views
+	};
+}
+/** How a participant reaches `cid`, or null if they cannot.
+*
+*  Mirrors the rules' read branches for someone holding no role:
+*  `partRead` (the whole collection) and `ownRow` (their own record, found
+*  by the submit declaration's `emailField` or by a uid-derived id).
+*
+*  `participantRead` is a PARAMETER rather than read off the manifest, and
+*  that is the whole point of the signature. Publish does not promote the
+*  manifest's value: `projectPublish` overwrites `participantRead` with what
+*  the STAGED schemas carry, so a cid added since the last deploy is in the
+*  manifest and not in the rules. Deriving the scope from the manifest would
+*  publish `scope: "all"` for a collection the promoted rules then deny —
+*  and removing one gives the mirror-image false refusal. The caller passes
+*  the set that will actually be in force. */
+function participantScope(app, cid, participantRead) {
+	if (participantRead.includes(cid)) return {
+		cid,
+		scope: "all"
+	};
+	const submit = app.public?.submit?.[cid];
+	if (submit?.emailField !== void 0) return {
+		cid,
+		scope: "own",
+		emailField: submit.emailField
+	};
+	if (submit?.idFrom === "auth.uid") return {
+		cid,
+		scope: "own",
+		ownDocId: "auth.uid"
+	};
+	return null;
+}
+/** The document ids one tier uses. `live:` and `staged:` are the only two
+*  prefixes, so a single `match` covers the projection and every view. */
+var viewDocId = (stage, viewId) => `${stage}:${viewId}`;
+var VIEW_CONFIG_ID = "config";
+/** The role a member holds on one collection, by the rules' own resolution:
+*  the per-collection entry, else the `*` fallback, else none. */
+function roleOn(app, address, cid) {
+	const held = app.members[address];
+	if (held === void 0) return void 0;
+	return held[cid] ?? held["*"];
+}
+/** The addresses holding one of `roles` on `cid`.
+*
+*  Sorted, for the same reason `memberEmails` is: a second publish of an
+*  unchanged declaration must produce an unchanged document. */
+function holdersOf(app, cid, roles) {
+	return Object.keys(app.members).filter((address) => roles.includes(roleOn(app, address, cid) ?? "")).sort();
+}
+/** Who may write every row of `cid`, and who may write only their own.
+*
+*  WHY ADDRESSES ARE PUBLISHED AT ALL. One `member/config` document is read by
+*  everyone the tier admits, and the tier only establishes that somebody holds
+*  SOME role SOMEWHERE — so a `viewer`, or a stylist scoped to another
+*  collection, reads the same entry as the front desk. Without these lists the
+*  page would draw approve and reassign for all of them and the rules would
+*  refuse when pressed, which is the declaration/enforcement mismatch this
+*  whole mechanism exists to prevent.
+*
+*  It cannot be answered per principal instead: the document is written once
+*  at publish and read by many, and the reader cannot look their own role up —
+*  `apps/{aid}` is `readerOf(a, '*')`, and a stylist carrying only
+*  `{bookings: "editor"}` holds no `*` role. So the ROSTER'S ANSWER travels
+*  with the declaration and the page compares its own address to it.
+*
+*  The cost is that staff addresses are visible to staff. That is already true
+*  of the approval mail they send each other, and participants read the
+*  `roster` tier, which never carries these.
+*
+*  A SNAPSHOT, like everything else published: a member added since the last
+*  publish is absent until the next one. The rules are the authority either
+*  way — this only decides which buttons are drawn. */
+function writersOf(app, cid) {
+	return holdersOf(app, cid, ["owner", "editor"]);
+}
+/** The transition half: which table applies, and the field it moves.
+*
+*  Both halves or neither. A status field with no table would offer every
+*  value; a table with no field has nothing to write it to. */
+function transitionPart(app, audience, cid) {
+	const config = app.collections?.[cid];
+	const transitions = audience === "member" ? config?.transitions : app.public?.submit?.[cid]?.selfTransitions;
+	if (config?.statusField === void 0 || transitions === void 0) return {};
+	const part = {
+		statusField: config.statusField,
+		transitions
+	};
+	if (audience === "member" && config.mail !== void 0) part.mail = config.mail;
+	return part;
+}
+/** The assignment half. `member` only — see {@link writersOf}.
+*
+*  `rowWriters` rides here rather than beside `writers`, because the
+*  `assignee` role grants nothing at all without a field to compare against
+*  (`isAssigned` in the rules requires one, and publish refuses the pair). */
+function assignPart(app, audience, cid) {
+	const assigneeField = app.collections?.[cid]?.assigneeField;
+	if (audience !== "member" || assigneeField === void 0) return {};
+	return {
+		assigneeField,
+		rowWriters: holdersOf(app, cid, ["assignee"])
+	};
+}
+/** What `audience` may change about `cid`, or null when the answer is nothing.
+*
+*  The two audiences differ in WHICH transition table applies, in whether
+*  assignment exists at all, and in whether the roster's answer travels with
+*  it; they agree that the status field is the collection's, since the rules
+*  read one field either way. */
+function writeFor(app, audience, cid) {
+	const write = {
+		cid,
+		...transitionPart(app, audience, cid),
+		...assignPart(app, audience, cid)
+	};
+	if (Object.keys(write).length === 1) return null;
+	if (audience === "member") write.writers = writersOf(app, cid);
+	return write;
+}
+//#endregion
 //#region src/collection/server/publishManifest.ts
 /** A collection id / app id, held to the one name rule (`SAFE_SLUG_PATTERN`)
 *  that `sharedCollectionKey` applies. Stated once so a path built later
@@ -264,6 +508,28 @@ var PublicZ = z.object({
 	}).strict().optional(),
 	submit: z.record(NameZ, SubmitZ).optional()
 }).strict();
+/** One page the app shows, and who it is for.
+*
+*  Generalised from `public.view` (which is still accepted, and normalizes
+*  into this — see `appViews.ts`). The audience is what decides which document
+*  the HTML is published to, and therefore who may read it: a rule cannot hide
+*  a field, so "the front desk sees this" is a place, not a filter.
+*
+*  `id` is not decoration. It becomes the document id the page is published
+*  at, which is what lets one audience have more than one page — the front
+*  desk and the stock room — and what lets a withdrawn view be found and
+*  deleted. Its grammar is enforced at the gate, not here, so the refusal can
+*  say what the value is used for.
+*
+*  `collections` is declared rather than inferred, for the reason `public.view`
+*  gives: an inferred list renders a perfect page with no data in it, and
+*  nothing anywhere says why. */
+var ViewZ = z.object({
+	id: z.string().trim().min(1),
+	audience: z.enum(VIEW_AUDIENCES),
+	path: z.string().trim().min(1),
+	collections: z.array(NameZ).min(1)
+}).strict();
 /** The URL name an app is handed out under: `https://<host>/{slug}`.
 *
 *  A SEPARATE name from the `aid`, and that separation is the point (design
@@ -312,7 +578,10 @@ var AuthoredAppZ = z.object({
 	members: MembersZ,
 	collections: z.record(NameZ, CollectionConfigZ).optional(),
 	participantRead: z.array(NameZ).optional(),
-	public: PublicZ.optional()
+	public: PublicZ.optional(),
+	/** The app's pages, per audience. See {@link ViewZ}; `public.view` is the
+	*  older spelling of the `public` one and normalizes into this list. */
+	views: z.array(ViewZ).optional()
 }).strict();
 /** Parse the authored declaration out of `app.json`'s text.
 *
@@ -441,11 +710,14 @@ function projectApp(authored, schemas, stamp, existing) {
 		publishedDirty: stamp.dirty === true ? true : void 0,
 		previousPublished: previousOf(existing)
 	});
+	const normalized = normalizeViews(authored);
+	if (!normalized.ok) throw new Error(`publish: views declaration is not publishable (${normalized.problems.join(" ")})`);
+	const publicView = normalized.views.find((view) => view.audience === "public");
 	const config = {
 		enabled: authored.public?.enabled === true,
 		read: authored.public?.read ?? [],
 		submit,
-		...authored.public?.view === void 0 ? {} : { view: { collections: authored.public.view.collections } },
+		...publicView === void 0 ? {} : { view: { collections: publicView.collections } },
 		publishedAt: stamp.publishedAt
 	};
 	if (authored.name !== void 0) config.name = authored.name;
@@ -596,6 +868,86 @@ var appSlugDoc = (aid, published) => ({
 var appStagingPath = (aid) => `apps/${aid}/staging`;
 /** The public-config documents' parent path. */
 var appConfigPath = (aid) => `apps/${aid}/config`;
+/** Where one audience's pages live. `member` is read by anyone holding a role;
+*  `roster` by anyone on the roster, participants included. */
+var appViewTierPath = (aid, tier) => `apps/${aid}/${tier}`;
+/** What one audience may see of one collection.
+*
+*  For `member` this is always the whole collection: every read branch a role
+*  opens (`readerOf`) is unscoped. Whether THIS member holds the role is not
+*  knowable here — one projection is read by every member of the tier — and is
+*  settled where it can be, by the entrance trying the read.
+*
+*  For `participant` it is the rules' own answer, which is why it can be null:
+*  a participant with neither `participantRead` nor an own-row submit path
+*  cannot read the collection at all, and a page handed it would fail rather
+*  than render less. */
+function scopeFor(authored, audience, cid, participantRead) {
+	return audience === "member" ? {
+		cid,
+		scope: "all"
+	} : participantScope(authored, cid, participantRead);
+}
+/** What this audience may CHANGE, per collection it draws.
+*
+*  The `collections` config is the PROMOTED one where there is one: at publish
+*  the rules run against what deploy staged, so projecting the manifest's
+*  would advertise transitions the live rules deny. */
+function tierWrites(authored, audience, cids, promoted) {
+	const effective = promoted.collections === void 0 ? authored : {
+		...authored,
+		collections: promoted.collections
+	};
+	return cids.map((cid) => writeFor(effective, audience, cid)).filter((entry) => entry !== null);
+}
+/** What this audience may READ, and how to query for it.
+*
+*  A collection with no scope is dropped rather than published as unreachable:
+*  the gate has already refused the declaration, so reaching here with one is
+*  a programming error, and a page that queries it is denied. */
+function tierViews(authored, audience, views, participantRead) {
+	return views.map((view) => ({
+		id: view.id,
+		collections: view.collections.map((cid) => scopeFor(authored, audience, cid, participantRead)).filter((scope) => scope !== null)
+	}));
+}
+/** One tier's projection: what this audience may read, and what it may change. */
+function tierConfig(authored, audience, views, stamp, promoted) {
+	const cids = [...new Set(views.flatMap((view) => view.collections))];
+	const config = {
+		write: tierWrites(authored, audience, cids, promoted),
+		views: tierViews(authored, audience, views, promoted.participantRead ?? authored.participantRead ?? []),
+		submit: tierSubmit(authored, cids),
+		publishedAt: stamp.publishedAt
+	};
+	if (authored.name !== void 0) config.name = authored.name;
+	return config;
+}
+/** The submit declarations for the collections these views draw, so a page can
+*  show what may be sent rather than discovering it from a denial. */
+function tierSubmit(authored, cids) {
+	const declared = authored.public?.submit ?? {};
+	return Object.fromEntries(cids.flatMap((cid) => {
+		const spec = declared[cid];
+		return spec === void 0 ? [] : [[cid, projectSubmit(spec)]];
+	}));
+}
+function projectAppViews(authored, stamp, promoted = {}) {
+	const normalized = normalizeViews(authored);
+	if (!normalized.ok) throw new Error(`publish: views declaration is not publishable (${normalized.problems.join(" ")})`);
+	return ["member", "participant"].map((audience) => {
+		const views = normalized.views.filter((view) => view.audience === audience);
+		return {
+			tier: VIEW_TIER[audience],
+			audience,
+			config: tierConfig(authored, audience, views, stamp, promoted),
+			views
+		};
+	});
+}
+/** The document a tier's projection is published at. Beside the views
+*  themselves, under one `match` — see `firestore.rules`. */
+var viewConfigDocId = (stage) => viewDocId(stage, VIEW_CONFIG_ID);
 //#endregion
 //#region src/collection/server/publishChecks.ts
 /** Does this submit declaration bind a record to the submitter's identity?
@@ -871,7 +1223,7 @@ function publishProblems(app, collections, publisherEmail) {
 		...windowRefProblems(app, collections),
 		...idTargetProblems(app, collections),
 		...mirrorProblems(app, collections),
-		...publicViewProblems(app, collections)
+		...viewProblems(app, collections)
 	];
 }
 /** A public submission must NOT be allowed to name its own primary key.
@@ -1002,24 +1354,56 @@ function mirrorOfProblems(app, cid, collection, known, names) {
 	if (app.public?.submit?.[authority]?.mirror !== cid) return [`collections.${cid}.mirrorOf names '${authority}', but public.submit.${authority} does not declare mirror: "${cid}". Only the pair keeps the projection honest: without the other half a record can be created without moving this one, and the public page goes on offering something that is already taken.`];
 	return [];
 }
-/** What the public view is handed. Declared, never inferred — a view whose
-*  datasets were guessed from `public.read` renders perfectly and draws an
-*  empty grid, with nothing in the page, the rules or the log to say why. */
-function publicViewProblems(app, collections) {
-	const view = app.public?.view;
-	if (view === void 0) return [];
+/** What each view is handed, and whether its audience can actually read it.
+*
+*  Declared, never inferred — a view whose datasets were guessed from
+*  `public.read` renders perfectly and draws an empty grid, with nothing in
+*  the page, the rules or the log to say why.
+*
+*  The reachability check below is that same failure, once per audience. A
+*  `public` view naming a collection outside `public.read` draws nothing; a
+*  `participant` view naming one the participant reaches by neither
+*  `participantRead` nor their own row is worse, because an unscoped list on
+*  an own-row collection is DENIED rather than narrowed — the page does not
+*  render less, it fails.
+*
+*  There is deliberately no such check for `member`. Every read a role opens
+*  is unscoped, and WHICH role a given member holds is not a property of the
+*  declaration: a stylist scoped to `bookings` and an owner read the same
+*  projection. That one is settled at the entrance, by trying the read. */
+/** The path, for one view. The SAME validator the host's own custom views use,
+*  rather than a second opinion about what a safe view path is.
+*
+*  Two ad-hoc attempts were wrong here in the same afternoon: a prefix-and-
+*  suffix test let `views/../../secrets.html` through, and `views/[^/]+\.html`
+*  still let `views/..\..\secrets.html` through, because a backslash is not a
+*  slash on this side of the check and IS a separator on Windows. This one
+*  rejects `..`, backslashes, leading slashes and anything outside
+*  `[A-Za-z0-9._-]` per segment.
+*
+*  It matters more here than for a host view: the host reads this path to
+*  decide which file to copy onto a document other people read — for a public
+*  view, a document whose rule is `allow read: if true`, so the blast radius of
+*  a bad path is the world rather than the author's own iframe. Nested paths
+*  ARE allowed by the shared validator; the extra `views/<one name>.html` shape
+*  is this publisher's own narrowing, kept because there is no reason for a
+*  published view to live in a subdirectory. */
+function viewPathProblems(view) {
+	if (isSafeCustomViewPath(view.path) && view.path.split("/").length === 2) return [];
+	return [`${view.where}.path is '${view.path}': a published view is exactly one HTML file directly inside the collection's own views/ directory (e.g. views/booking.html) — no sub-directories, and no segments that climb out of it. The host reads this as a file to publish.`];
+}
+/** One dataset, for one view: does it exist here, and can the audience it is
+*  handed to actually read it? */
+function viewCollectionProblems(app, view, cid, known) {
+	if (!known.has(cid)) return [`${view.where}.collections names '${cid}', which is not a shared collection in this repository. Shared collections here: ${known.size > 0 ? [...known].sort().join(", ") : "(none)"}.`];
+	if (view.audience === "public" && !(app.public?.read ?? []).includes(cid)) return [`${view.where}.collections names '${cid}', which is not in public.read: the page reads these with the VISITOR's permissions, so the rules refuse the read and the view draws an empty page. Nothing errors — this is the failure that looks like a working view with no data.`];
+	return [];
+}
+function viewProblems(app, collections) {
+	const normalized = normalizeViews(app);
+	if (!normalized.ok) return normalized.problems;
 	const known = new Set(collections.map((collection) => collection.cid));
-	const readable = new Set(app.public?.read ?? []);
-	const problems = [];
-	if (!isSafeCustomViewPath(view.path) || view.path.split("/").length !== 2) problems.push(`public.view.path is '${view.path}': a published view is exactly one HTML file directly inside the collection's own views/ directory (e.g. views/booking.html) — no sub-directories, and no segments that climb out of it. The host reads this as a file to publish, and what it publishes is world-readable.`);
-	for (const cid of view.collections) {
-		if (!known.has(cid)) {
-			problems.push(`public.view.collections names '${cid}', which is not a shared collection in this repository. Shared collections here: ${known.size > 0 ? [...known].sort().join(", ") : "(none)"}.`);
-			continue;
-		}
-		if (!readable.has(cid)) problems.push(`public.view.collections names '${cid}', which is not in public.read: the page reads these with the VISITOR's permissions, so the rules refuse the read and the view draws an empty page. Nothing errors — this is the failure that looks like a working view with no data.`);
-	}
-	return problems;
+	return normalized.views.flatMap((view) => [...viewPathProblems(view), ...view.collections.flatMap((cid) => viewCollectionProblems(app, view, cid, known))]);
 }
 /** What publish will actually promote, checked as the PAIR it becomes.
 *
@@ -1051,9 +1435,25 @@ function promotedRoleProblems(app, staged) {
 	return [
 		...promotedAssigneeProblems(app, promoted, stagedCids),
 		...promotedMirrorProblems(app, promoted, stagedCids),
-		...promotedRefFieldProblems(app, staged)
+		...promotedRefFieldProblems(app, staged),
+		...promotedParticipantViewProblems(app, staged)
 	];
 }
+/** A participant's page, checked against the `participantRead` publish will
+*  actually PROMOTE.
+*
+*  Not against the manifest's. `projectPublish` overwrites `participantRead`
+*  with what the staged schemas carry, so a cid added to the manifest since the
+*  last deploy is not in the rules — and a page written for it would be
+*  published, offered, and then refused the read. The manifest half of this
+*  file cannot see that; the promoted half can, which is why the check lives
+*  here rather than beside the other view checks. */
+function promotedParticipantViewProblems(app, staged) {
+	const normalized = normalizeViews(app);
+	if (!normalized.ok) return [];
+	const participantRead = stagedRuleConfig(staged).participantRead ?? [];
+	return normalized.views.filter((view) => view.audience === "participant").flatMap((view) => view.collections.filter((cid) => participantScope(app, cid, participantRead) === null).map((cid) => `${view.where}.collections names '${cid}', which a participant cannot read once this publishes: it is not in the participantRead that DEPLOY staged, and public.submit.${cid} declares neither an emailField nor idFrom "auth.uid", so there is no row the rules would call theirs. The page would be refused the read, not handed fewer records. (Adding it to participantRead in app.json is not enough — deploy first.)`));
+}
 /** The FIELDS a rule reads off another record — `idIn.where.field` and the two
 *  window bounds — checked against the schema publish is about to promote.
 *
@@ -3258,6 +3658,6 @@ function makeManageCollectionTool(deps = {}) {
 	};
 }
 //#endregion
-export { AuthoredAppZ as $, runQueryOverRows as A, APPS_COLLECTION as B, STORE_UNREADABLE as C, recordFieldProblem as D, compileRecordZ as E, readCustomViewI18n as F, appSlugDoc as G, PUBLIC_CONFIG_DOC as H, readSkillTemplate as I, projectDeploy as J, appStagingPath as K, bindsSubmitterIdentity as L, buildCollectionActionSeedPrompt as M, promptPathsFor as N, runCollectionQuery as O, readCustomViewHtml as P, APP_ROLES as Q, promotedRoleProblems as R, MAX_RECORD_ISSUES as S, validateRecordObject as T, appConfigPath as U, APP_SLUGS_COLLECTION as V, appSchemasPath as W, promoteSchema as X, projectPublish as Y, stagedRuleConfig as Z, computeCollectionIcon as _, deleteCollection as a, applyMutateAction as b, computeSuccessor as c, isTriggerDue as d, parseAuthoredApp as et, maybeSpawnSuccessor as f, ONE_SECOND_MS as g, successorId as h, deleteCustomView as i, buildActionSeedPrompt as j, enrichItems as k, daysInMonth as l, resolveEvery as m, MAX_UNSELECTIVE_ITEMS as n, deleteCollectionRefusalMessage as o, parseCivil as p, projectApp as q, makeManageCollectionTool as r, advanceTriggerDate as s, MAX_SCHEMA_ISSUES as t, formatCivil as u, buildWorkspaceOntology as v, validateCollectionRecords as w, firstMutateParamProblem as x, schemaRelations as y, publishProblems as z };
+export { stagedRuleConfig as $, runQueryOverRows as A, APPS_COLLECTION as B, STORE_UNREADABLE as C, recordFieldProblem as D, compileRecordZ as E, readCustomViewI18n as F, appSlugDoc as G, PUBLIC_CONFIG_DOC as H, readSkillTemplate as I, projectApp as J, appStagingPath as K, bindsSubmitterIdentity as L, buildCollectionActionSeedPrompt as M, promptPathsFor as N, runCollectionQuery as O, readCustomViewHtml as P, promoteSchema as Q, promotedRoleProblems as R, MAX_RECORD_ISSUES as S, validateRecordObject as T, appConfigPath as U, APP_SLUGS_COLLECTION as V, appSchemasPath as W, projectDeploy as X, projectAppViews as Y, projectPublish as Z, computeCollectionIcon as _, deleteCollection as a, RESERVED_VIEW_IDS as at, applyMutateAction as b, computeSuccessor as c, VIEW_ID_PATTERN as ct, isTriggerDue as d, participantScope as dt, viewConfigDocId as et, maybeSpawnSuccessor as f, viewDocId as ft, ONE_SECOND_MS as g, successorId as h, deleteCustomView as i, PUBLIC_VIEW_ID as it, buildActionSeedPrompt as j, enrichItems as k, daysInMonth as l, VIEW_TIER as lt, resolveEvery as m, MAX_UNSELECTIVE_ITEMS as n, AuthoredAppZ as nt, deleteCollectionRefusalMessage as o, VIEW_AUDIENCES as ot, parseCivil as p, writeFor as pt, appViewTierPath as q, makeManageCollectionTool as r, parseAuthoredApp as rt, advanceTriggerDate as s, VIEW_CONFIG_ID as st, MAX_SCHEMA_ISSUES as t, APP_ROLES as tt, formatCivil as u, normalizeViews as ut, buildWorkspaceOntology as v, validateCollectionRecords as w, firstMutateParamProblem as x, schemaRelations as y, publishProblems as z };
 
-//# sourceMappingURL=server-DGjmK9vU.js.map
+//# sourceMappingURL=server-jm7aGA3g.js.map