@mulmoclaude/core 3.15.0 → 4.0.0

package/dist/{server-jm7aGA3g.js → server-BIewQYpC.js}

@@ -1,1594 +1,15 @@
 import { a as isErrorWithCode, c as isStringArray, l as isUnknownArray, s as isRecord, t as errorMessage } from "./dist-D8zokgGo.js";
 import { n as writeFileAtomic } from "./root-BMroU_mB.js";
 import { n as toPosixRelPath } from "./relPath-DW8MC8VO.js";
-import { B as fieldText, I as embedTargetId, L as isFieldDrivenEvery, N as COMPUTED_TYPES, V as fieldTextOrNull, d as parseIsoDate, f as parseIsoDateTime, x as isValidCollectionName, z as storageKindFor } from "./itemId-DfTm08jm.js";
+import { B as fieldText, I as embedTargetId, L as isFieldDrivenEvery, N as COMPUTED_TYPES, V as fieldTextOrNull, d as parseIsoDate, f as parseIsoDateTime, z as storageKindFor } from "./itemId-DfTm08jm.js";
 import { C as actionVisible, _ as uniqueRefTargets, b as projectBacklinkRow, c as selectDynamicRecord, f as itemIsDone, g as uniqueEmbedTargets, h as uniqueBacklinkSources, i as ownProp, n as deriveAll, o as firstDateField, s as resolveIcon, t as defangForPrompt, v as backlinkRows, x as rollupValue, y as coerceNumeric } from "./promptSafety-CSdyp7RF.js";
-import { B as SCHEMA_FILE$1, C as CollectionQueryZ, I as parseAppManifest, J as isBackendUnavailable, K as safeSlugName, O as isRegularFile, S as compileJsonlQuery, U as resolveDataDir, V as isContainedInRoot, W as resolveTemplatePath, X as archiveDir, b as queryCsv, c as resolveMutateSet, d as storeFor, f as checkpointSqliteDatabase, ht as stagingSkillDir, i as resolvePrimaryField, it as isPresetSlug$1, j as resolveCreateItemId, m as cacheDir, n as discoverCollections, nt as getWorkspaceRoot, ot as log, r as loadCollection, s as CollectionSchemaZ, u as readOnlyRefusal, y as normalizeCsvValue } from "./discovery-B9zdNkgW.js";
-import { r as isSafeCustomViewPath } from "./templatePath-k_WNbL_Q.js";
+import { B as SCHEMA_FILE$1, C as CollectionQueryZ, J as isBackendUnavailable, K as safeSlugName, O as isRegularFile, S as compileJsonlQuery, U as resolveDataDir, V as isContainedInRoot, W as resolveTemplatePath, X as archiveDir, b as queryCsv, c as resolveMutateSet, d as storeFor, f as checkpointSqliteDatabase, ht as stagingSkillDir, i as resolvePrimaryField, it as isPresetSlug$1, j as resolveCreateItemId, m as cacheDir, n as discoverCollections, nt as getWorkspaceRoot, ot as log, r as loadCollection, s as CollectionSchemaZ, u as readOnlyRefusal, y as normalizeCsvValue } from "./discovery-CQp0wi-n.js";
 import { ingestStatePath } from "./feeds/paths.js";
 import { mirrorSkillWrite } from "./skill-bridge/index.js";
 import path from "node:path";
 import { randomBytes, randomUUID } from "node:crypto";
 import { cp, lstat, mkdir, open, readFile, readdir, rm, rmdir, stat, unlink, writeFile } from "node:fs/promises";
 import { z } from "zod";
-//#region src/collection/server/appViews.ts
-/** The audiences a view may be written for. A CLOSED set: each one names a
-*  tier with a rule behind it, so an unknown value has nowhere to be
-*  published to and is refused before it gets there. */
-var VIEW_AUDIENCES = [
-	"public",
-	"member",
-	"participant"
-];
-/** Where each audience's documents live under `apps/{aid}`. `public` is not
-*  here: it keeps `config/public` + `config/view`, which are already published
-*  and already read by a deployed runtime. */
-var VIEW_TIER = {
-	member: "member",
-	participant: "roster"
-};
-/** The id `public.view` normalizes to. Fixed rather than derived, so two
-*  implementations of the same normalization cannot pick different ones. */
-var PUBLIC_VIEW_ID = "public";
-/** `config` is the projection's own document in every tier (`live:config`),
-*  so a view may not be called that — the two would be the same document. */
-var RESERVED_VIEW_IDS = ["config"];
-/** What an id may be.
-*
-*  Narrow on purpose: this value is written by the author, and it becomes a
-*  Firestore document id under a `live:` / `staged:` prefix. Excluding `:`
-*  keeps the prefix and the id from running together; excluding `/`, `.` and
-*  `__…__` keeps it a legal document id that addresses the path it says. */
-var VIEW_ID_PATTERN = /^[a-z0-9][a-z0-9-]{0,63}$/;
-var VIEW_ID_SHAPE = "must be lowercase letters, digits and hyphens, start with a letter or digit, and be at most 64 characters (e.g. front-desk)";
-/** Both declarations of the same thing, in one file.
-*
-*  Refused rather than merged or preferred: whichever way it were resolved,
-*  the author would have written two answers and been shown neither. */
-var BOTH_FORMS = "app.json declares both `views` and `public.view`. These are the same thing — `public.view` is the older spelling — and publishing would have to choose one silently. Move the `public.view` entry into `views` as { id: \"public\", audience: \"public\", … } and delete it.";
-/** The two declarations, as one list, or the refusal that they are both there.
-*
-*  `public.view` becomes an entry under the reserved id, so everything
-*  downstream reads one shape and "which spelling was used" is decided once. */
-function declaredViews(app) {
-	const legacy = app.public?.view;
-	const authored = app.views;
-	if (legacy !== void 0 && authored !== void 0) return {
-		ok: false,
-		problems: [BOTH_FORMS]
-	};
-	const views = (authored ?? []).map((view, index) => ({
-		id: view.id,
-		audience: view.audience,
-		path: view.path,
-		collections: view.collections,
-		where: `views[${index}]`
-	}));
-	if (legacy === void 0) return {
-		ok: true,
-		views
-	};
-	if (views.some((view) => view.id === "public")) return {
-		ok: false,
-		problems: [`views declares id '${PUBLIC_VIEW_ID}', which is reserved for the older \`public.view\` spelling. ${BOTH_FORMS}`]
-	};
-	return {
-		ok: true,
-		views: [...views, {
-			id: PUBLIC_VIEW_ID,
-			audience: "public",
-			path: legacy.path,
-			collections: legacy.collections,
-			where: "public.view"
-		}]
-	};
-}
-/** Whether one id may be used, and what to say when it may not. */
-function viewIdProblems(view) {
-	if (RESERVED_VIEW_IDS.includes(view.id)) return [`${view.where}.id is '${view.id}', which is reserved: each audience's own declaration is published at that document id.`];
-	if (!VIEW_ID_PATTERN.test(view.id)) return [`${view.where}.id is '${view.id}': a view id ${VIEW_ID_SHAPE}. It becomes the document id this view is published at.`];
-	if (view.id === "public" && view.audience !== "public") return [`${view.where}.id is '${PUBLIC_VIEW_ID}' with audience '${view.audience}': that id belongs to the public page.`];
-	return [];
-}
-/** ONE public page per app, and the reason is the wire rather than taste.
-*
-*  The public runtime reads a single `config/view` document and a single
-*  `config/public.view` declaration beside it. A second `audience: "public"`
-*  entry would pass every other check and then be published nowhere — and
-*  which of the two became the live page would depend on declaration order,
-*  silently. The member tiers have no such limit: `id` is their address, and
-*  each one gets its own document.
-*
-*  The refusal is here rather than "one day we will support it" precisely
-*  because the failure is invisible: nothing errors, and the author sees a
-*  successful publish of a page nobody is served. */
-function singlePublicProblems(views) {
-	const [first, ...rest] = views.filter((view) => view.audience === "public");
-	if (first === void 0) return [];
-	return rest.map((view) => `${view.where} is a second audience "public" view, after ${first.where}. The public page is published at ONE document (config/view), so only one of them could ever be served — and which, would depend on the order they were written in. Give the others audience "member" or "participant", which are addressed by id and may have as many as the app needs.`);
-}
-/** The one shape everything downstream reads.
-*
-*  Every caller — the publish gate, the projection, the host that writes the
-*  documents — goes through this, so "which declaration was used" is decided
-*  exactly once. */
-function normalizeViews(app) {
-	const declared = declaredViews(app);
-	if (!declared.ok) return declared;
-	const problems = [...singlePublicProblems(declared.views)];
-	const seen = /* @__PURE__ */ new Map();
-	for (const view of declared.views) {
-		problems.push(...viewIdProblems(view));
-		const first = seen.get(view.id);
-		if (first === void 0) {
-			seen.set(view.id, view.where);
-			continue;
-		}
-		problems.push(`${view.where}.id is '${view.id}', which ${first} already uses. The id is the document a view is published at, so two of them are one page — whichever was written second would silently replace the first, in staging and again at publish.`);
-	}
-	return problems.length > 0 ? {
-		ok: false,
-		problems
-	} : {
-		ok: true,
-		views: declared.views
-	};
-}
-/** How a participant reaches `cid`, or null if they cannot.
-*
-*  Mirrors the rules' read branches for someone holding no role:
-*  `partRead` (the whole collection) and `ownRow` (their own record, found
-*  by the submit declaration's `emailField` or by a uid-derived id).
-*
-*  `participantRead` is a PARAMETER rather than read off the manifest, and
-*  that is the whole point of the signature. Publish does not promote the
-*  manifest's value: `projectPublish` overwrites `participantRead` with what
-*  the STAGED schemas carry, so a cid added since the last deploy is in the
-*  manifest and not in the rules. Deriving the scope from the manifest would
-*  publish `scope: "all"` for a collection the promoted rules then deny —
-*  and removing one gives the mirror-image false refusal. The caller passes
-*  the set that will actually be in force. */
-function participantScope(app, cid, participantRead) {
-	if (participantRead.includes(cid)) return {
-		cid,
-		scope: "all"
-	};
-	const submit = app.public?.submit?.[cid];
-	if (submit?.emailField !== void 0) return {
-		cid,
-		scope: "own",
-		emailField: submit.emailField
-	};
-	if (submit?.idFrom === "auth.uid") return {
-		cid,
-		scope: "own",
-		ownDocId: "auth.uid"
-	};
-	return null;
-}
-/** The document ids one tier uses. `live:` and `staged:` are the only two
-*  prefixes, so a single `match` covers the projection and every view. */
-var viewDocId = (stage, viewId) => `${stage}:${viewId}`;
-var VIEW_CONFIG_ID = "config";
-/** The role a member holds on one collection, by the rules' own resolution:
-*  the per-collection entry, else the `*` fallback, else none. */
-function roleOn(app, address, cid) {
-	const held = app.members[address];
-	if (held === void 0) return void 0;
-	return held[cid] ?? held["*"];
-}
-/** The addresses holding one of `roles` on `cid`.
-*
-*  Sorted, for the same reason `memberEmails` is: a second publish of an
-*  unchanged declaration must produce an unchanged document. */
-function holdersOf(app, cid, roles) {
-	return Object.keys(app.members).filter((address) => roles.includes(roleOn(app, address, cid) ?? "")).sort();
-}
-/** Who may write every row of `cid`, and who may write only their own.
-*
-*  WHY ADDRESSES ARE PUBLISHED AT ALL. One `member/config` document is read by
-*  everyone the tier admits, and the tier only establishes that somebody holds
-*  SOME role SOMEWHERE — so a `viewer`, or a stylist scoped to another
-*  collection, reads the same entry as the front desk. Without these lists the
-*  page would draw approve and reassign for all of them and the rules would
-*  refuse when pressed, which is the declaration/enforcement mismatch this
-*  whole mechanism exists to prevent.
-*
-*  It cannot be answered per principal instead: the document is written once
-*  at publish and read by many, and the reader cannot look their own role up —
-*  `apps/{aid}` is `readerOf(a, '*')`, and a stylist carrying only
-*  `{bookings: "editor"}` holds no `*` role. So the ROSTER'S ANSWER travels
-*  with the declaration and the page compares its own address to it.
-*
-*  The cost is that staff addresses are visible to staff. That is already true
-*  of the approval mail they send each other, and participants read the
-*  `roster` tier, which never carries these.
-*
-*  A SNAPSHOT, like everything else published: a member added since the last
-*  publish is absent until the next one. The rules are the authority either
-*  way — this only decides which buttons are drawn. */
-function writersOf(app, cid) {
-	return holdersOf(app, cid, ["owner", "editor"]);
-}
-/** The transition half: which table applies, and the field it moves.
-*
-*  Both halves or neither. A status field with no table would offer every
-*  value; a table with no field has nothing to write it to. */
-function transitionPart(app, audience, cid) {
-	const config = app.collections?.[cid];
-	const transitions = audience === "member" ? config?.transitions : app.public?.submit?.[cid]?.selfTransitions;
-	if (config?.statusField === void 0 || transitions === void 0) return {};
-	const part = {
-		statusField: config.statusField,
-		transitions
-	};
-	if (audience === "member" && config.mail !== void 0) part.mail = config.mail;
-	return part;
-}
-/** The assignment half. `member` only — see {@link writersOf}.
-*
-*  `rowWriters` rides here rather than beside `writers`, because the
-*  `assignee` role grants nothing at all without a field to compare against
-*  (`isAssigned` in the rules requires one, and publish refuses the pair). */
-function assignPart(app, audience, cid) {
-	const assigneeField = app.collections?.[cid]?.assigneeField;
-	if (audience !== "member" || assigneeField === void 0) return {};
-	return {
-		assigneeField,
-		rowWriters: holdersOf(app, cid, ["assignee"])
-	};
-}
-/** What `audience` may change about `cid`, or null when the answer is nothing.
-*
-*  The two audiences differ in WHICH transition table applies, in whether
-*  assignment exists at all, and in whether the roster's answer travels with
-*  it; they agree that the status field is the collection's, since the rules
-*  read one field either way. */
-function writeFor(app, audience, cid) {
-	const write = {
-		cid,
-		...transitionPart(app, audience, cid),
-		...assignPart(app, audience, cid)
-	};
-	if (Object.keys(write).length === 1) return null;
-	if (audience === "member") write.writers = writersOf(app, cid);
-	return write;
-}
-//#endregion
-//#region src/collection/server/publishManifest.ts
-/** A collection id / app id, held to the one name rule (`SAFE_SLUG_PATTERN`)
-*  that `sharedCollectionKey` applies. Stated once so a path built later
-*  cannot be a way around it. */
-var NameZ = z.string().refine(isValidCollectionName, { message: "is not a valid id (letters, digits, '-' and '_' only)" });
-/** An address on the roster. Not validated as an email beyond "has an @":
-*  the rules compare it to `request.auth.token.email` verbatim, so any
-*  narrowing here would refuse addresses Firebase itself accepts. */
-var EmailZ = z.string().trim().min(3).includes("@");
-/** The roles the deployed rules understand.
-*
-*  Two of them are row-scoped, in opposite directions, and the pair is what
-*  the four-way split could not express:
-*
-*    `participant` — the layer that is NAMED but reads only its OWN rows (the
-*    rows it submitted). See `readerOf` vs `listedIn`.
-*
-*    `assignee` — reads EVERY row and writes only the rows ASSIGNED to it. The
-*    stylist who approves their own bookings and not a colleague's; the marker
-*    who grades their own students. Which rows are theirs is
-*    `collections[cid].assigneeField`, a field on the record holding the
-*    member's address. Reads are deliberately unscoped: a stylist needs the
-*    whole day's schedule, and scoping the read makes the app unusable.
-*
-*  The names are permanent. The deployed rules compare these strings directly
-*  and they are written into `app.json` files people commit, so a rename is a
-*  migration over published apps rather than an edit. */
-var APP_ROLES = [
-	"owner",
-	"editor",
-	"viewer",
-	"participant",
-	"assignee"
-];
-var RoleZ = z.enum(APP_ROLES);
-/** `{ email: { "*" | cid: role } }`. The `"*"` key is the app-wide role; a
-*  member may hold per-collection roles only (the stylist who is editor of
-*  bookings and viewer of everything else). */
-var MembersZ = z.record(EmailZ, z.record(z.union([z.literal("*"), NameZ]), RoleZ));
-/** The declarative mail queue, as the rules re-derive it: a transition of the
-*  status field, a recipient read off the RECORD, and a fixed template. */
-var MailZ = z.object({
-	toField: z.string().trim().min(1),
-	on: z.record(z.string().trim().min(1), z.object({
-		from: z.array(z.string().trim().min(1)).min(1),
-		to: z.string().trim().min(1)
-	}).strict()),
-	dataFields: z.array(z.string().trim().min(1)).optional()
-}).strict();
-/** What the rules read out of `collections[cid]`. NOT the schema — the schema
-*  is published beside it, untouched, for clients to render from. */
-var CollectionConfigZ = z.object({
-	statusField: z.string().trim().min(1).optional(),
-	/** `{ initial: [...], <status>: [<status>...] }`. Binds writers too, and
-	*  binds `create` — that is the point of publishing it. */
-	transitions: z.record(z.string().trim().min(1), z.array(z.string().trim().min(1))).optional(),
-	immutable: z.boolean().optional(),
-	submitOnly: z.boolean().optional(),
-	/** The field naming the member a row belongs to, for the `assignee` role.
-	*
-	*  Holds an ADDRESS, because that is the only thing the rules can compare
-	*  a member against (`request.auth.token.email`). A `ref` to a staff
-	*  collection stores the target's primary-key slug, not an address, so it
-	*  cannot be this field — declare a plain field beside the ref and let the
-	*  ref stay the thing the UI renders. The alternative, having the rules
-	*  `get()` the staff record to read an address off it, costs a document
-	*  access on every write and puts a second document between an
-	*  authorization decision and its answer.
-	*
-	*  Only meaningful with a member holding `assignee` on this cid; a
-	*  declaration with the role and no field is refused (`assigneeProblems`),
-	*  because that member would silently hold nothing. */
-	assigneeField: z.string().trim().min(1).optional(),
-	/** This collection is the public projection of `mirrorOf` — the other
-	*  half of `public.submit[...].mirror`, declared here because the rules
-	*  read it when the PROJECTION is written rather than when the record is.
-	*
-	*  What it buys: `state` may be written by anybody, and only to the value
-	*  the authority actually says, so a visitor who was refused a slot can
-	*  repair the stale row that offered it to them. */
-	mirrorOf: NameZ.optional(),
-	peerVisibility: z.enum(["public", "hidden"]).optional(),
-	revealGated: z.boolean().optional(),
-	gatedFrom: NameZ.optional(),
-	revealBy: z.string().trim().min(1).optional(),
-	mail: MailZ.optional(),
-	/** Which fields an aggregate groups by. Declared here rather than in the
-	*  schema for the same reason as everything else in this file — the schema
-	*  has no `aggregate` key yet — and it is here at all because the
-	*  invariant that guards it ("every aggregation key is a CHECKED field")
-	*  is about `public.submit`, which is an app-level declaration. Published
-	*  as-is; the rules never read it. */
-	aggregate: z.object({ by: z.array(z.string().trim().min(1)).min(1) }).strict().optional()
-}).strict();
-/** An authored submit window. ISO strings, because `app.json` is JSON and a
-*  Firestore `Timestamp` has no JSON form. Publish lowers it to epoch millis —
-*  the rules do not coerce strings, so an ISO string reaching Firestore is a
-*  type error that fails CLOSED (`inWindow` refuses every submission and the
-*  author sees "nobody can submit", not an error). */
-/** A window bound that lives on ANOTHER record, read at write time.
-*
-*  `window.from` is one absolute instant for the whole collection, which is
-*  enough for a survey and useless for anything recurring: "each class opens
-*  three days before it starts, at 08:00" is a bound PER RECORD. So the bound
-*  is not computed in the rules — they have no usable date arithmetic and
-*  `request.time` is UTC, which is the wrong answer for "08:00" — it is
-*  computed by whoever schedules the class, stored on the class record as
-*  epoch millis, and merely COMPARED here.
-*
-*  `ref` is the field on the record being written that names the target
-*  (`classId`); `collection` is the cid the target lives in, fixed in the
-*  declaration so that a path is never built out of a value a submitter wrote;
-*  `field` is the epoch-millis field on the target.
-*
-*  Not spelled `in` — that is an operator in the rules language, and
-*  `w.fromField.in` does not parse there. */
-var WindowRefZ = z.object({
-	ref: z.string().trim().min(1),
-	collection: NameZ,
-	field: z.string().trim().min(1)
-}).strict();
-/** The closing bound's per-record twin, and it ships WITH `fromField` rather
-*  than as a symmetric extra: a booking desk that opens per slot and never
-*  closes is not a booking desk. Same shape, opposite comparison — and
-*  EXCLUSIVE where `fromField` is inclusive, so one slot's closing instant and
-*  the next one's opening instant may be the same number. */
-var WindowZ = z.object({
-	from: z.iso.datetime().optional(),
-	until: z.iso.datetime().optional(),
-	fromField: WindowRefZ.optional(),
-	untilField: WindowRefZ.optional()
-}).strict();
-/** Which record a `field` document id must name, and what state it must be in.
-*
-*  `idFrom: "field"` alone only stops the same string being written twice —
-*  nothing stops a client bypassing the page and inventing a slot, so the
-*  rules check the referenced record themselves. `exists()` is a FLOOR: a
-*  cancelled slot and a slot nobody may book any more exist too, which is what
-*  `where` is for.
-*
-*  Always the object form, never a bare collection name. Two shapes for one
-*  key is the kind of thing a generator gets right once and wrong afterwards,
-*  and the rules read `s.idIn.collection` either way. */
-var IdInZ = z.object({
-	collection: NameZ,
-	where: z.object({
-		field: z.string().trim().min(1),
-		equals: z.union([
-			z.string(),
-			z.number(),
-			z.boolean()
-		])
-	}).strict().optional()
-}).strict();
-var ValidateZ = z.object({
-	required: z.array(z.string().trim().min(1)).optional(),
-	/** Capped at two by the rules themselves: rules have no iteration, so
-	*  `keyFieldsOk` is unrolled. A third would be accepted here and silently
-	*  unchecked there. */
-	keyFields: z.array(z.object({
-		field: z.string().trim().min(1),
-		values: z.array(z.union([
-			z.string(),
-			z.number(),
-			z.boolean()
-		])).min(1)
-	}).strict()).optional()
-}).strict();
-var SubmitZ = z.object({
-	auth: z.enum([
-		"none",
-		"anonymous",
-		"verifiedEmail"
-	]),
-	emailField: z.string().trim().min(1).optional(),
-	createFields: z.array(z.string().trim().min(1)).min(1),
-	initialStatus: z.string().trim().min(1).optional(),
-	/** `field` is the mode that makes a CONTESTED resource exclusive: the
-	*  booking's document id IS the slot's id, so the second person to want
-	*  that slot is writing a document that already exists — an update, which
-	*  the public submission path never allows. Firestore decides that
-	*  atomically, so unlike a countable capacity (see `stampField`) this is
-	*  first-come ENFORCED rather than first-come read off a rank. */
-	idFrom: z.enum([
-		"auto",
-		"auth.uid",
-		"auth.uid+field",
-		"field"
-	]).optional(),
-	idField: z.string().trim().min(1).optional(),
-	/** Required by `idFrom: "field"` — see {@link IdInZ}. */
-	idIn: IdInZ.optional(),
-	/** The collection holding this record's PUBLIC PROJECTION, one row per
-	*  contested thing, sharing its document id.
-	*
-	*  A booking carries a name, an address and a phone number, and Firestore
-	*  rules cannot hide a field, so the public page must not read bookings at
-	*  all. It reads the projection instead, whose `state` is a copy of "does
-	*  a booking with this id exist" — and the rules accept the two writes
-	*  only as one batch, in both directions, so the copy cannot drift into
-	*  advertising a slot that is gone. */
-	mirror: NameZ.optional(),
-	validate: ValidateZ.optional(),
-	window: WindowZ.optional(),
-	/** A field the rules PIN to the server clock on create: the record must
-	*  carry `request.time` in it, and may never change it afterwards.
-	*
-	*  What it buys is an order nobody can jump. A first-come app takes its
-	*  capacity from rank rather than from a count — the rules cannot count
-	*  documents, so "the first 8" can only ever be a reading of the rows —
-	*  and a rank is only as honest as the timestamp it sorts by. `idFrom`
-	*  stops a person holding two places; nothing else stops them writing
-	*  yesterday's date into the field that decides who got there first.
-	*
-	*  Binds EVERY create, the writer branch included, so a staff-entered row
-	*  cannot be back-dated into the queue either. */
-	stampField: z.string().trim().min(1).optional(),
-	/** Per CURRENT STATUS, never a flat list: a flat list lets a customer move
-	*  an approved booking's `startAt` without anyone re-approving it. */
-	selfUpdate: z.record(z.string().trim().min(1), z.array(z.string().trim().min(1))).optional(),
-	selfTransitions: z.record(z.string().trim().min(1), z.array(z.string().trim().min(1))).optional(),
-	finalize: z.boolean().optional(),
-	audience: z.literal("participant").optional(),
-	gateOn: z.object({
-		phase: z.string().trim().min(1),
-		match: z.string().trim().min(1)
-	}).strict().optional()
-}).strict();
-var PublicZ = z.object({
-	/** The master switch. Anonymous submission (`auth: "none"`) needs it as
-	*  well as its own declaration. */
-	enabled: z.boolean().optional(),
-	read: z.array(NameZ).optional(),
-	/** The page the public sees, instead of the generated form.
-	*
-	*  A form is enough to ANSWER something and not enough to CHOOSE from
-	*  what is available — a stylist-by-hour grid is not the far end of a
-	*  table. So the app may name one HTML file, which the host publishes to
-	*  `config/view` and the public page renders in a sandboxed iframe.
-	*
-	*  `submit` stays declared alongside: the view sends an INTENT, and the
-	*  page it is embedded in performs the write against these rules.
-	*
-	*  `collections` is declared rather than inferred from `read`. Inferring
-	*  it produces the worst failure this feature has — the view renders, the
-	*  data it wanted was never sent, and it draws an empty grid with no error
-	*  anywhere. */
-	view: z.object({
-		path: z.string().trim().min(1),
-		collections: z.array(NameZ).min(1)
-	}).strict().optional(),
-	submit: z.record(NameZ, SubmitZ).optional()
-}).strict();
-/** One page the app shows, and who it is for.
-*
-*  Generalised from `public.view` (which is still accepted, and normalizes
-*  into this — see `appViews.ts`). The audience is what decides which document
-*  the HTML is published to, and therefore who may read it: a rule cannot hide
-*  a field, so "the front desk sees this" is a place, not a filter.
-*
-*  `id` is not decoration. It becomes the document id the page is published
-*  at, which is what lets one audience have more than one page — the front
-*  desk and the stock room — and what lets a withdrawn view be found and
-*  deleted. Its grammar is enforced at the gate, not here, so the refusal can
-*  say what the value is used for.
-*
-*  `collections` is declared rather than inferred, for the reason `public.view`
-*  gives: an inferred list renders a perfect page with no data in it, and
-*  nothing anywhere says why. */
-var ViewZ = z.object({
-	id: z.string().trim().min(1),
-	audience: z.enum(VIEW_AUDIENCES),
-	path: z.string().trim().min(1),
-	collections: z.array(NameZ).min(1)
-}).strict();
-/** The URL name an app is handed out under: `https://<host>/{slug}`.
-*
-*  A SEPARATE name from the `aid`, and that separation is the point (design
-*  D2b). `apps/{aid}` is a shelf every user of the deployment shares and the
-*  rules' `allow create` asks only that you name yourself owner — so a
-*  memorable aid is first-come-first-served, cannot be checked for
-*  availability, and frees up again when an app is deleted. The aid is
-*  therefore a UUID, and the thing people can fight over is moved to the name
-*  that costs nothing to change.
-*
-*  Declared here rather than kept beside `app.json` because a RESERVATION has
-*  to travel with the repository: `appSlugs/{slug}` is unreadable until the app
-*  is published (`allow read: if resource.data.published == true`), so nothing
-*  can recover which slug an app holds by asking Firestore. A second file to
-*  keep in step with the declaration is the alternative, and it is the kind of
-*  pair that goes out of step silently.
-*
-*  The shape is stricter than `NameZ` on purpose: it is BOTH a URL path
-*  segment people read aloud and a Firestore document id. Lowercase
-*  alphanumerics separated by single hyphens covers both without a case rule
-*  that would make two slugs collide in one place and not the other.
-*
-*  Which slug an app ended up with is the HOST's business — a wanted slug can
-*  be taken, and the host writes the one it reserved back here. Nothing in this
-*  package reads the key; it is declared so that writing it back does not make
-*  the file unparseable. */
-var SLUG_SHAPE = "must be lowercase letters, digits and single hyphens, and must not start or end with one (e.g. sakura-hair)";
-var SlugZ = z.string().trim().max(64).regex(/^[a-z0-9][a-z0-9-]*[a-z0-9]$|^[a-z0-9]$/, SLUG_SHAPE).refine((slug) => !slug.includes("--"), SLUG_SHAPE);
-/** The whole authored declaration.
-*
-*  `owner` is accepted but is NOT the published value — publish stamps the
-*  publisher's uid (or carries the existing one forward, which is what the
-*  rules require on update) and refuses a declaration that disagrees. It is
-*  accepted rather than banned because the sample app.json in the design note
-*  shows it, and a hard refusal on a key the samples contain would be a worse
-*  first experience than a message naming the mismatch. */
-var AuthoredAppZ = z.object({
-	aid: NameZ,
-	name: z.string().trim().min(1).optional(),
-	/** The wanted (or reserved) URL name — see {@link SlugZ}. */
-	slug: SlugZ.optional(),
-	/** Per-worktree app id (design D6, implementation order 7). Accepted so a
-	*  repository already carrying it parses; nothing reads it yet. */
-	aidEnv: z.string().trim().min(1).optional(),
-	owner: z.string().trim().min(1).optional(),
-	members: MembersZ,
-	collections: z.record(NameZ, CollectionConfigZ).optional(),
-	participantRead: z.array(NameZ).optional(),
-	public: PublicZ.optional(),
-	/** The app's pages, per audience. See {@link ViewZ}; `public.view` is the
-	*  older spelling of the `public` one and normalizes into this list. */
-	views: z.array(ViewZ).optional()
-}).strict();
-/** Parse the authored declaration out of `app.json`'s text.
-*
-*  Returns a LIST of problems rather than throwing, for the same reason
-*  `loadAppManifest` returns a failure: the caller is a gate whose entire job
-*  is to hand the author something to act on. Every problem is reported at
-*  once — publish is a manual step, and a parser that stops at the first key
-*  makes it N round trips. */
-function parseAuthoredApp(raw) {
-	const manifest = parseAppManifest(raw);
-	if (!manifest.ok) return {
-		ok: false,
-		problems: [manifest.kind === "missing" ? "app.json is missing" : manifest.detail]
-	};
-	const parsed = AuthoredAppZ.safeParse(JSON.parse(raw));
-	if (!parsed.success) return {
-		ok: false,
-		problems: authoredProblems(parsed.error)
-	};
-	return {
-		ok: true,
-		app: parsed.data
-	};
-}
-/** zod issues as one actionable line each: `public.submit.responses.auth: …`. */
-function authoredProblems(error) {
-	return error.issues.map((issue) => {
-		return `${issue.path.length > 0 ? issue.path.join(".") : "app.json"}: ${issue.message}`;
-	});
-}
-//#endregion
-//#region src/collection/server/publishProject.ts
-/** The document id under `apps/{aid}/config`. One document, named, rather than
-*  a spread of them: a second public document is a second thing to keep in
-*  step, and nothing yet needs one. */
-var PUBLIC_CONFIG_DOC = "public";
-/** Drop keys whose value is `undefined`. Firestore rejects an undefined field
-*  value outright, and `"k" in c` — which every optional key in the rules is
-*  read through — must mean "the author declared it". */
-function compact(entries) {
-	return Object.fromEntries(Object.entries(entries).filter(([, value]) => value !== void 0));
-}
-/** ISO → epoch millis, the one conversion the rules cannot do for themselves.
-*  The caller has already refused an unparseable string (the authored parser
-*  requires `z.iso.datetime()`), so a NaN here would be a programming error;
-*  it is still checked, because a NaN written to Firestore fails closed in the
-*  same silent way an ISO string does. */
-function windowMillis(window) {
-	if (!window) return void 0;
-	const out = {};
-	if (window.from !== void 0) out.fromMs = Date.parse(window.from);
-	if (window.until !== void 0) out.untilMs = Date.parse(window.until);
-	if (Object.values(out).some((value) => !Number.isFinite(value))) throw new Error(`publish: window bound is not a parseable timestamp (${JSON.stringify(window)})`);
-	const projected = {
-		...out,
-		...window.fromField === void 0 ? {} : { fromField: window.fromField },
-		...window.untilField === void 0 ? {} : { untilField: window.untilField }
-	};
-	return Object.keys(projected).length > 0 ? projected : void 0;
-}
-/** One `public.submit[cid]`, with its window lowered. Everything else passes
-*  through: the rules read these keys by the names the author wrote. */
-function projectSubmit(submit) {
-	const { window, ...rest } = submit;
-	return compact({
-		...rest,
-		window: windowMillis(window)
-	});
-}
-/** The roster's addresses as a set, in a stable order.
-*
-*  Sorted so two publishes of the same declaration produce the same document
-*  — idempotence is a property this step is tested for, and Firestore compares
-*  arrays by ORDER. `membersConsistent()` compares as sets and would accept
-*  any order; the test that would notice is the one asserting a second publish
-*  changes nothing but `publishedAt`. */
-function memberEmailsOf(members) {
-	return Object.keys(members).sort();
-}
-/** The previous document, kept for rollback, with its OWN `previousPublished`
-*  stripped.
-*
-*  One level, deliberately. Chaining would make every publish carry the entire
-*  history of the app inside a single document, which grows without bound and
-*  meets Firestore's 1 MiB document limit as a permission-shaped failure at
-*  some unpredictable publish. One level answers the question rollback
-*  actually asks — "put back what was there before I broke it" — and the
-*  further history is in git, which is where the declaration came from. */
-function previousOf(existing) {
-	if (!existing) return void 0;
-	const { previousPublished: __dropped, ...rest } = existing;
-	return rest;
-}
-/** Project the authored declaration into the documents publish writes.
-*
-*  `existing` is the app document as it is in Firestore right now, or null on
-*  a first publish. Two things need it, both required by the rules:
-*    - `owner` must be UNCHANGED on update. Re-stamping the publisher's uid
-*      would be refused for any app whose owner ever signed in as a different
-*      account, and would silently transfer ownership if it were not.
-*    - `previousPublished` is that document, so a rollback has something to
-*      put back.
-*
-*  Pure: no clock, no filesystem, no Firestore. Everything variable arrives as
-*  a parameter, which is what makes the conversion table testable as a table. */
-function projectApp(authored, schemas, stamp, existing) {
-	const owner = typeof existing?.owner === "string" ? existing.owner : stamp.uid;
-	const submit = Object.fromEntries(Object.entries(authored.public?.submit ?? {}).map(([cid, spec]) => [cid, projectSubmit(spec)]));
-	const publicBlock = authored.public ? compact({
-		enabled: authored.public.enabled,
-		read: authored.public.read,
-		submit: Object.keys(submit).length > 0 ? submit : void 0
-	}) : void 0;
-	const app = compact({
-		aid: authored.aid,
-		name: authored.name,
-		owner,
-		members: authored.members,
-		memberEmails: memberEmailsOf(authored.members),
-		collections: authored.collections,
-		participantRead: authored.participantRead,
-		public: publicBlock,
-		publishedAt: stamp.publishedAt,
-		publishedBy: stamp.email,
-		publishedCommit: stamp.commit,
-		publishedDirty: stamp.dirty === true ? true : void 0,
-		previousPublished: previousOf(existing)
-	});
-	const normalized = normalizeViews(authored);
-	if (!normalized.ok) throw new Error(`publish: views declaration is not publishable (${normalized.problems.join(" ")})`);
-	const publicView = normalized.views.find((view) => view.audience === "public");
-	const config = {
-		enabled: authored.public?.enabled === true,
-		read: authored.public?.read ?? [],
-		submit,
-		...publicView === void 0 ? {} : { view: { collections: publicView.collections } },
-		publishedAt: stamp.publishedAt
-	};
-	if (authored.name !== void 0) config.name = authored.name;
-	return {
-		app,
-		schemas: schemas.map(({ cid, schema }) => ({
-			cid,
-			doc: schemaDoc(schema, stamp)
-		})),
-		config
-	};
-}
-/** Keys on the app document that publish owns: what is PUBLIC right now, and
-*  the rule-facing configuration anonymous access is judged against. Deploy
-*  carries them through from the existing document and never authors them. */
-var PUBLISH_OWNED_KEYS = [
-	"public",
-	"collections",
-	"participantRead",
-	"publishedAt",
-	"publishedBy",
-	"publishedCommit",
-	"publishedDirty",
-	"previousPublished"
-];
-var isPublishOwned = (key) => PUBLISH_OWNED_KEYS.includes(key);
-function projectDeploy(authored, schemas, stamp, existing) {
-	const { app } = projectApp(authored, schemas, stamp, existing);
-	const deployed = Object.fromEntries(Object.entries(app).filter(([key]) => !isPublishOwned(key)));
-	for (const key of PUBLISH_OWNED_KEYS) {
-		const live = existing?.[key];
-		if (live !== void 0) deployed[key] = live;
-	}
-	deployed.deployedAt = stamp.publishedAt;
-	deployed.deployedBy = stamp.email;
-	if (stamp.commit !== void 0) deployed.deployedCommit = stamp.commit;
-	return {
-		app: deployed,
-		staging: schemas.map(({ cid, schema }) => ({
-			cid,
-			doc: stagedDoc(schema, stamp, authored, cid)
-		}))
-	};
-}
-/** One staged schema document, carrying this cid's rule-facing configuration
-*  alongside the schema so publish can promote them together. */
-function stagedDoc(schema, stamp, authored, cid) {
-	const doc = {
-		publishedSchema: schema,
-		deployedAt: stamp.publishedAt,
-		deployedBy: stamp.email
-	};
-	const config = authored.collections?.[cid];
-	if (config !== void 0) doc.config = config;
-	if (authored.participantRead?.includes(cid) === true) doc.participantRead = true;
-	if (stamp.commit !== void 0) doc.deployedCommit = stamp.commit;
-	return doc;
-}
-/** The rule-facing configuration to promote, read from the STAGED documents
-*  rather than from the manifest as it reads right now.
-*
-*  Otherwise: deploy revision A, edit `app.json` to revision B, publish — and
-*  the promoted schema is A's while the authorization behaviour is B's, a
-*  combination nobody exercised through `/staging/{aid}`.
-*
-*  (`public` is deliberately NOT part of this: it is not staged, because it is
-*  the decision being made AT publish rather than something under test.) */
-function stagedRuleConfig(staged) {
-	const entries = [];
-	const participantRead = [];
-	for (const entry of staged) {
-		const { config } = entry.doc;
-		if (config !== void 0) entries.push([entry.cid, config]);
-		if (entry.doc.participantRead === true) participantRead.push(entry.cid);
-	}
-	return {
-		collections: entries.length > 0 ? Object.fromEntries(entries) : void 0,
-		participantRead: participantRead.length > 0 ? participantRead : void 0
-	};
-}
-function projectPublish(authored, staged, stamp, existing) {
-	const { app, config } = projectApp(authored, [], stamp, existing);
-	const staging = stagedRuleConfig(staged);
-	app.collections = staging.collections;
-	app.participantRead = staging.participantRead;
-	const published = Object.fromEntries(Object.entries(existing ?? app).filter(([key]) => !isPublishOwned(key)));
-	for (const key of PUBLISH_OWNED_KEYS) if (key !== "public" && app[key] !== void 0) published[key] = app[key];
-	const publicBlock = app.public;
-	return {
-		app: published,
-		config,
-		public: isRecord(publicBlock) ? publicBlock : void 0
-	};
-}
-/** Re-stamp a staged schema document as it is promoted to `collections/{cid}`.
-*
-*  The stamp answers "which version is PUBLIC right now, and who made it so",
-*  so it is written by the operation that changes the answer — publish — not
-*  carried over from the deploy that staged it. */
-function promoteSchema(staged, stamp) {
-	const doc = {
-		publishedSchema: staged.publishedSchema,
-		publishedAt: stamp.publishedAt,
-		publishedBy: stamp.email
-	};
-	if (stamp.commit !== void 0) doc.publishedCommit = stamp.commit;
-	return doc;
-}
-/** One published schema document. Written key by key rather than through
-*  `compact`, so the declared type is the type — an optional commit is the
-*  only variable part. */
-function schemaDoc(schema, stamp) {
-	const doc = {
-		publishedSchema: schema,
-		publishedAt: stamp.publishedAt,
-		publishedBy: stamp.email
-	};
-	if (stamp.commit !== void 0) doc.publishedCommit = stamp.commit;
-	return doc;
-}
-/** The app documents' parent path — the `FirestoreDocs` seam takes a
-*  collection path plus a document id, and the app document's id is the aid. */
-var APPS_COLLECTION = "apps";
-/** The collection (schema) documents' parent path — what the PUBLIC page
-*  reads, written only by publish (promotion). */
-var appSchemasPath = (aid) => `apps/${aid}/collections`;
-/** The URL-slug reservations — `appSlugs/{slug}` → `{ aid, published }`.
-*
-*  A TOP-LEVEL collection, not a field on the app: the public page resolves a
-*  slug to an aid BEFORE it can read anything under `apps/{aid}`, and a slug
-*  has to be claimable atomically (create-if-absent) so two apps cannot hold
-*  the same URL.
-*
-*  `published` is what makes the reservation invisible until publish. The slug
-*  is human-readable, so a readable reservation would let anyone guess the URL
-*  and get the aid — and the aid is the `/staging/{aid}` entrance. The rule is
-*  `allow read: if resource.data.published == true`, which needs no `get()` and
-*  so costs nothing against the rules' expression budget. */
-var APP_SLUGS_COLLECTION = "appSlugs";
-var appSlugDoc = (aid, published) => ({
-	aid,
-	published
-});
-/** The staged schema documents' parent path — what `/staging/{aid}` reads,
-*  written by deploy. A separate DOCUMENT rather than a field beside
-*  `publishedSchema`, because the rules cannot hide a field: anything inside a
-*  document the public page may read is public. */
-var appStagingPath = (aid) => `apps/${aid}/staging`;
-/** The public-config documents' parent path. */
-var appConfigPath = (aid) => `apps/${aid}/config`;
-/** Where one audience's pages live. `member` is read by anyone holding a role;
-*  `roster` by anyone on the roster, participants included. */
-var appViewTierPath = (aid, tier) => `apps/${aid}/${tier}`;
-/** What one audience may see of one collection.
-*
-*  For `member` this is always the whole collection: every read branch a role
-*  opens (`readerOf`) is unscoped. Whether THIS member holds the role is not
-*  knowable here — one projection is read by every member of the tier — and is
-*  settled where it can be, by the entrance trying the read.
-*
-*  For `participant` it is the rules' own answer, which is why it can be null:
-*  a participant with neither `participantRead` nor an own-row submit path
-*  cannot read the collection at all, and a page handed it would fail rather
-*  than render less. */
-function scopeFor(authored, audience, cid, participantRead) {
-	return audience === "member" ? {
-		cid,
-		scope: "all"
-	} : participantScope(authored, cid, participantRead);
-}
-/** What this audience may CHANGE, per collection it draws.
-*
-*  The `collections` config is the PROMOTED one where there is one: at publish
-*  the rules run against what deploy staged, so projecting the manifest's
-*  would advertise transitions the live rules deny. */
-function tierWrites(authored, audience, cids, promoted) {
-	const effective = promoted.collections === void 0 ? authored : {
-		...authored,
-		collections: promoted.collections
-	};
-	return cids.map((cid) => writeFor(effective, audience, cid)).filter((entry) => entry !== null);
-}
-/** What this audience may READ, and how to query for it.
-*
-*  A collection with no scope is dropped rather than published as unreachable:
-*  the gate has already refused the declaration, so reaching here with one is
-*  a programming error, and a page that queries it is denied. */
-function tierViews(authored, audience, views, participantRead) {
-	return views.map((view) => ({
-		id: view.id,
-		collections: view.collections.map((cid) => scopeFor(authored, audience, cid, participantRead)).filter((scope) => scope !== null)
-	}));
-}
-/** One tier's projection: what this audience may read, and what it may change. */
-function tierConfig(authored, audience, views, stamp, promoted) {
-	const cids = [...new Set(views.flatMap((view) => view.collections))];
-	const config = {
-		write: tierWrites(authored, audience, cids, promoted),
-		views: tierViews(authored, audience, views, promoted.participantRead ?? authored.participantRead ?? []),
-		submit: tierSubmit(authored, cids),
-		publishedAt: stamp.publishedAt
-	};
-	if (authored.name !== void 0) config.name = authored.name;
-	return config;
-}
-/** The submit declarations for the collections these views draw, so a page can
-*  show what may be sent rather than discovering it from a denial. */
-function tierSubmit(authored, cids) {
-	const declared = authored.public?.submit ?? {};
-	return Object.fromEntries(cids.flatMap((cid) => {
-		const spec = declared[cid];
-		return spec === void 0 ? [] : [[cid, projectSubmit(spec)]];
-	}));
-}
-function projectAppViews(authored, stamp, promoted = {}) {
-	const normalized = normalizeViews(authored);
-	if (!normalized.ok) throw new Error(`publish: views declaration is not publishable (${normalized.problems.join(" ")})`);
-	return ["member", "participant"].map((audience) => {
-		const views = normalized.views.filter((view) => view.audience === audience);
-		return {
-			tier: VIEW_TIER[audience],
-			audience,
-			config: tierConfig(authored, audience, views, stamp, promoted),
-			views
-		};
-	});
-}
-/** The document a tier's projection is published at. Beside the views
-*  themselves, under one `match` — see `firestore.rules`. */
-var viewConfigDocId = (stage) => viewDocId(stage, VIEW_CONFIG_ID);
-//#endregion
-//#region src/collection/server/publishChecks.ts
-/** Does this submit declaration bind a record to the submitter's identity?
-*
-*  The condition for requiring `submitOnly`, and deliberately NOT "declares an
-*  `audience`": `audience` appears only in the rules' public-create branch, so
-*  an owner or editor never meets it and can add records freely. `immutable`
-*  is the wrong condition too — a survey's responses are not immutable and
-*  can be padded exactly the same way.
-*
-*  What these four have in common is that each one makes the record MEAN "the
-*  person who submitted it said this": a per-uid id, a per-uid+field id, a
-*  row stamped with the submitter's verified address, or a submission
-*  restricted to a named participant. A record created through the writer
-*  branch carries the same shape and none of that meaning. */
-function bindsSubmitterIdentity(submit) {
-	return submit.idFrom === "auth.uid" || submit.idFrom === "auth.uid+field" || submit.emailField !== void 0 || submit.audience === "participant";
-}
-/** The fields a rule actually CHECKS the value of, for one collection.
-*
-*  `keyFields` pins a value against a declared set, `gateOn.match` pins it
-*  against the session's current question, and the status field is pinned by
-*  the transition machine. An aggregation grouped by anything else is grouped
-*  by a field any submitter may write anything into — so the published
-*  aggregate is whatever the noisiest respondent decided it should be. */
-function checkedFields(collection, submit) {
-	const fields = /* @__PURE__ */ new Set();
-	for (const keyField of submit?.validate?.keyFields ?? []) fields.add(keyField.field);
-	if (submit?.gateOn) fields.add(submit.gateOn.match);
-	if (collection?.statusField) fields.add(collection.statusField);
-	return fields;
-}
-/** INVARIANT 1 — a submission bound to its submitter needs `submitOnly`. */
-function submitOnlyProblems(app) {
-	const problems = [];
-	for (const [cid, submit] of Object.entries(app.public?.submit ?? {})) {
-		if (!bindsSubmitterIdentity(submit)) continue;
-		if (app.collections?.[cid]?.submitOnly === true) continue;
-		problems.push(`collections.${cid}.submitOnly must be true: public.submit.${cid} binds each record to its submitter (${identityBindings(submit).join(", ")}), so a record created any other way would carry that meaning without having earned it. Without submitOnly the rules let an owner or editor write rows directly into ${cid}.`);
-	}
-	return problems;
-}
-function identityBindings(submit) {
-	const bindings = [];
-	if (submit.idFrom === "auth.uid" || submit.idFrom === "auth.uid+field") bindings.push(`idFrom: "${submit.idFrom}"`);
-	if (submit.emailField !== void 0) bindings.push(`emailField: "${submit.emailField}"`);
-	if (submit.audience === "participant") bindings.push(`audience: "participant"`);
-	return bindings;
-}
-/** INVARIANT 2 — every aggregation key is a field some rule checks. */
-function aggregateProblems(app) {
-	const problems = [];
-	for (const [cid, collection] of Object.entries(app.collections ?? {})) {
-		const keys = collection.aggregate?.by;
-		if (!keys) continue;
-		const checked = checkedFields(collection, app.public?.submit?.[cid]);
-		const loose = keys.filter((field) => !checked.has(field));
-		const spelled = loose.map((field) => `'${field}'`).join(", ");
-		if (loose.length > 0) problems.push(`collections.${cid}.aggregate.by names ${spelled}, which no rule checks the value of. An aggregation key must appear in public.submit.${cid}.validate.keyFields, in gateOn.match, or be the statusField — otherwise a submitter chooses their own bucket and the published aggregate is not a count of anything.`);
-	}
-	return problems;
-}
-/** INVARIANT 3 — `auth: "verifiedEmail"` only.
-*
-*  A product decision, not a rules limitation: the rules keep all three stages
-*  and the emulator tests keep exercising them, because deleting a stage from
-*  the rules turns a change of mind into a cross-repo deploy. Publish is where
-*  the current decision is expressed, and it is one line to move. */
-function authProblems(app) {
-	return Object.entries(app.public?.submit ?? {}).filter(([, submit]) => submit.auth !== "verifiedEmail").map(([cid, submit]) => `public.submit.${cid}.auth is "${submit.auth}": only "verifiedEmail" may be published. The rules still implement "none" and "anonymous" — this is a product decision, and lifting it is a change here, not a rules deploy.`);
-}
-/** INVARIANT 5 — a mail transition's origins and destination must be disjoint.
-*
-*  Overlap means the same write can satisfy the same template twice over, and
-*  the deterministic mail id is the only other thing stopping a duplicate
-*  send. The rules also require the status to have CHANGED, so an overlapping
-*  declaration is not merely redundant: `from` containing `to` is a transition
-*  that can never fire, which is a mail nobody ever receives. */
-function mailProblems(app) {
-	return Object.entries(app.collections ?? {}).flatMap(([cid, collection]) => collectionMailProblems(cid, collection));
-}
-function collectionMailProblems(cid, collection) {
-	const { mail } = collection;
-	if (!mail) return [];
-	const problems = [];
-	if (!collection.statusField) problems.push(`collections.${cid}.mail needs collections.${cid}.statusField: the rules read the status before and after the write to decide the mail is warranted.`);
-	for (const [template, transition] of Object.entries(mail.on)) problems.push(...templateMailProblems(cid, collection, template, transition));
-	return problems;
-}
-function templateMailProblems(cid, collection, template, transition) {
-	const problems = [];
-	if (transition.from.includes(transition.to)) problems.push(`collections.${cid}.mail.on.${template} lists "${transition.to}" in both \`from\` and \`to\`. The rules require the status to CHANGE in the same write, so this template can never send.`);
-	const allowed = collection.transitions;
-	if (allowed) {
-		const unreachable = transition.from.filter((from) => !(allowed[from] ?? []).includes(transition.to));
-		const spelled = unreachable.map((from) => `'${from}' -> '${transition.to}'`).join(", ");
-		if (unreachable.length > 0) problems.push(`collections.${cid}.mail.on.${template} sends on ${spelled}, which collections.${cid}.transitions does not allow. The record write is refused first, so the mail never fires.`);
-	}
-	return problems;
-}
-/** INVARIANTS 6 and 7 — the window is a real interval, and `keyFields` fits
-*  the unrolled check in the rules. */
-function submitShapeProblems(app) {
-	return Object.entries(app.public?.submit ?? {}).flatMap(([cid, submit]) => [...windowProblems(cid, submit), ...keyFieldCountProblems(cid, submit)]);
-}
-function windowProblems(cid, submit) {
-	const { window } = submit;
-	if (window?.from === void 0 || window.until === void 0) return [];
-	if (Date.parse(window.until) > Date.parse(window.from)) return [];
-	return [`public.submit.${cid}.window closes at or before it opens (${window.from} -> ${window.until}): nothing could ever be submitted.`];
-}
-function keyFieldCountProblems(cid, submit) {
-	const keyFields = submit.validate?.keyFields ?? [];
-	if (keyFields.length <= 2) return [];
-	return [`public.submit.${cid}.validate.keyFields declares ${keyFields.length}; the rules check at most 2. Rules have no iteration, so the check is unrolled — a third would be published and never enforced.`];
-}
-/** The fail-closed traps: declarations the rules read together, where the
-*  missing half denies every write instead of loosening one. */
-function coherenceProblems(app) {
-	const fromSubmits = Object.entries(app.public?.submit ?? {}).flatMap(([cid, submit]) => submitCoherenceProblems(app, cid, submit));
-	const fromCollections = Object.entries(app.collections ?? {}).flatMap(([cid, collection]) => gateCoherenceProblems(cid, collection));
-	return [...fromSubmits, ...fromCollections];
-}
-/** `initialStatus` is read together with the collection's `statusField` and
-*  with `createFields`; miss either and every submission is refused. */
-function statusCoherenceProblems(cid, submit, collection) {
-	if (submit.initialStatus === void 0) return [];
-	if (!collection?.statusField) return [`public.submit.${cid}.initialStatus needs collections.${cid}.statusField: the rules look the status up by that name, and refuse every submission without it.`];
-	if (new Set(submit.createFields).has(collection.statusField)) return [];
-	return [`public.submit.${cid}.createFields must include "${collection.statusField}": a submission may carry ONLY the createFields, and the rules also require the status field to be present and equal to initialStatus. As written, every submission is refused.`];
-}
-/** Every field a RULE reads off a submitted record, other than the status
-*  field (which `statusCoherenceProblems` words for itself).
-*
-*  `emailField` and `idField` belong here for exactly the reason `required`
-*  and `keyFields` do, and forgetting them was the same oversight twice: the
-*  rules read `request.resource.data[s.emailField]` and rebuild the document
-*  id from `s.idField`, while `hasOnly(createFields)` decides what a
-*  submission may carry at all. A field in one list and not the other is a
-*  contradiction the submitter cannot resolve — including it is refused,
-*  omitting it fails the check. */
-function ruleReadFields(submit) {
-	const fields = [];
-	if (submit.emailField !== void 0) fields.push({
-		field: submit.emailField,
-		why: `public.submit.<cid>.emailField — the rules compare it to the submitter's verified address`
-	});
-	if ((submit.idFrom === "auth.uid+field" || submit.idFrom === "field") && submit.idField !== void 0) fields.push({
-		field: submit.idField,
-		why: `public.submit.<cid>.idField — the rules rebuild the document id from it`
-	});
-	return fields;
-}
-/** A checked field a submission is not allowed to carry can never be
-*  satisfied: carrying it fails `hasOnly`, omitting it fails the check. */
-function createFieldProblems(cid, submit) {
-	const createFields = new Set(submit.createFields);
-	const ruleRead = ruleReadFields(submit).filter((entry) => !createFields.has(entry.field)).map((entry) => `public.submit.${cid}.createFields must include "${entry.field}" (${entry.why.replace("<cid>", cid)}): a submission may carry only the createFields, so as written every submission is refused whether or not it carries the field.`);
-	const required = (submit.validate?.required ?? []).filter((field) => !createFields.has(field)).map((field) => `public.submit.${cid}.validate.required names "${field}", which is not in createFields: a submission may carry only the createFields, so the requirement can never be met.`);
-	const keyFields = (submit.validate?.keyFields ?? []).filter((keyField) => !createFields.has(keyField.field)).map((keyField) => `public.submit.${cid}.validate.keyFields checks "${keyField.field}", which is not in createFields: a submission carrying it is refused, and one omitting it fails the check.`);
-	return [
-		...ruleRead,
-		...required,
-		...keyFields
-	];
-}
-function submitCoherenceProblems(app, cid, submit) {
-	const collection = app.collections?.[cid];
-	const problems = [...statusCoherenceProblems(cid, submit, collection), ...createFieldProblems(cid, submit)];
-	if (submit.idFrom === "auth.uid+field" && submit.idField === void 0) problems.push(`public.submit.${cid}.idFrom is "auth.uid+field" but no idField is declared: the rules rebuild the document id from that field and refuse every create.`);
-	problems.push(...fieldIdProblems(cid, submit));
-	if ((submit.selfUpdate !== void 0 || submit.selfTransitions !== void 0) && !collection?.statusField) problems.push(`public.submit.${cid}.selfUpdate / selfTransitions are declared per CURRENT STATUS, but collections.${cid} declares no statusField: the rules read the current status first and refuse every self-edit without it.`);
-	if (submit.audience === "participant" && Object.keys(app.members).length === 0) problems.push(`public.submit.${cid}.audience is "participant" but the roster is empty: the rules resolve the submitter's role from members, so every submission is refused.`);
-	return problems;
-}
-/** `idFrom: "field"` makes the document id a CLAIM ABOUT ANOTHER RECORD, and
-*  the claim is only worth what is checked.
-*
-*  `idIn` is required rather than optional, and that is the whole point of
-*  refusing here: without it the id is any string a stranger likes, so the app
-*  quietly accepts bookings for slots that do not exist. Nothing downstream
-*  ever notices — the booking is real, its slot is not — which is exactly the
-*  kind of hole a gate is for and a rule cannot state.
-*
-*  `idIn` without the mode is refused for the opposite reason: the rules read
-*  it only in that branch, so an author who wrote it believes a check is
-*  running that is not. */
-function fieldIdProblems(cid, submit) {
-	const problems = [];
-	if (submit.idFrom === "field") {
-		if (submit.idField === void 0) problems.push(`public.submit.${cid}.idFrom is "field" but no idField is declared: the rules take the document id from that field and refuse every create.`);
-		if (submit.idIn === void 0) problems.push(`public.submit.${cid}.idFrom is "field" but no idIn is declared: the document id is then any string a submitter chooses, so the app accepts records pointing at things that do not exist. Name the collection the id must be found in — and, when only some of those records may be claimed, the state they must be in: "idIn": { "collection": "slots", "where": { "field": "state", "equals": "open" } }.`);
-	} else if (submit.idIn !== void 0) {
-		const mode = submit.idFrom === void 0 ? "absent" : JSON.stringify(submit.idFrom);
-		problems.push(`public.submit.${cid}.idIn is declared but idFrom is ${mode}: the rules read idIn only for idFrom "field", so as written nothing checks the referenced record and the declaration promises a check it does not perform.`);
-	}
-	return problems;
-}
-/** Every `idIn` target, checked against the collections this repository has.
-*
-*  Separate from {@link fieldIdProblems} for the reason the file is split at
-*  all: that one reads the declaration alone, this one needs to know what
-*  exists. */
-function idTargetProblems(app, collections) {
-	const known = new Set(collections.map((collection) => collection.cid));
-	const names = known.size > 0 ? [...known].sort().join(", ") : "(none)";
-	return Object.entries(app.public?.submit ?? {}).flatMap(([cid, submit]) => idInTargetProblems(cid, submit, known, names));
-}
-/** Where a `field` id says its record must be found.
-*
-*  A typo passes every other check: the rules look the record up in a
-*  collection that does not exist, the lookup can never succeed, and every
-*  submission is refused with no explanation anywhere. A collection pointing
-*  at ITSELF is worse than a typo — on a create the document being written
-*  does not exist yet, so it is a declaration that can never accept anything. */
-function idInTargetProblems(cid, submit, known, names) {
-	const target = submit.idIn?.collection;
-	if (target === void 0) return [];
-	if (target === cid) return [`public.submit.${cid}.idIn.collection names '${cid}' itself: a create writes a document that does not exist yet, so the record can never be found and every submission is refused. Name the collection of the thing being claimed (the slots, the seats, the assets).`];
-	if (!known.has(target)) return [`public.submit.${cid}.idIn.collection names '${target}', which is not a shared collection in this repository. The rules look the record up there, so nothing can ever be submitted. Shared collections here: ${names}.`];
-	return [];
-}
-/** The staged reveal reads its flag off the PARENT record, so the path to that
-*  parent is not optional decoration — without it the gate never opens. */
-function gateCoherenceProblems(cid, collection) {
-	if (collection.revealGated !== true) return [];
-	if (collection.gatedFrom !== void 0 && collection.revealBy !== void 0) return [];
-	return [`collections.${cid}.revealGated needs both gatedFrom and revealBy: the flag is read off the PARENT record, and without the path the gate never opens.`];
-}
-/** The publisher must be able to write what they are about to write.
-*
-*  On a first publish the rules require the creator to name themselves owner,
-*  in the roster, under `'*'`. Getting this wrong produces a bare permission
-*  error from Firestore with nothing in it about rosters — worth one line
-*  here instead. */
-function publisherProblems(app, publisherEmail) {
-	if (app.members[publisherEmail]?.["*"] === "owner") return [];
-	return [`members must give you app-wide owner: add "${publisherEmail}": { "*": "owner" }. The rules require the publisher to hold that role (and to name themselves owner when the app is first created); otherwise the write is refused with no explanation.`];
-}
-/** Every cid the declaration mentions must be a collection that exists.
-*
-*  A typo'd cid is not an error anywhere else: the app document simply carries
-*  a configuration for a collection nobody publishes, and the collection the
-*  author meant is published with no configuration at all — i.e. with the
-*  status machine and the submit path silently absent. */
-function unknownCidProblems(app, collections) {
-	const known = new Set(collections.map((collection) => collection.cid));
-	return [
-		["collections", Object.keys(app.collections ?? {})],
-		["public.read", app.public?.read ?? []],
-		["public.submit", Object.keys(app.public?.submit ?? {})],
-		["participantRead", app.participantRead ?? []],
-		["members", [...new Set(Object.values(app.members).flatMap((roles) => Object.keys(roles)))].filter((key) => key !== "*")]
-	].flatMap(([where, cids]) => cids.filter((cid) => !known.has(cid)).map((cid) => `${where} names '${cid}', which is not a shared collection in this repository. Shared collections here: ${known.size > 0 ? [...known].sort().join(", ") : "(none - a schema needs storage.type \"firestore\")"}.`));
-}
-/** Everything publish refuses, as lines the author can act on.
-*
-*  All of them, every time. Publish is a manual step with a human waiting on
-*  it; stopping at the first problem turns one review into five. */
-function publishProblems(app, collections, publisherEmail) {
-	return [
-		...unknownCidProblems(app, collections),
-		...publisherProblems(app, publisherEmail),
-		...submitOnlyProblems(app),
-		...aggregateProblems(app),
-		...authProblems(app),
-		...mailProblems(app),
-		...submitShapeProblems(app),
-		...coherenceProblems(app),
-		...primaryKeyProblems(app, collections),
-		...assigneeProblems(app),
-		...stampProblems(app),
-		...windowRefProblems(app, collections),
-		...idTargetProblems(app, collections),
-		...mirrorProblems(app, collections),
-		...viewProblems(app, collections)
-	];
-}
-/** A public submission must NOT be allowed to name its own primary key.
-*
-*  The rules constrain the DOCUMENT ID (`idFrom`) and cannot constrain the
-*  value of a field — nothing compares `request.resource.data[primaryKey]`
-*  with the path being written. So a submit path that accepts the primary key
-*  as a `createField` lets a submitter write at their one permitted document
-*  id while CLAIMING another record's identity, or a duplicate.
-*
-*  It is refused rather than tolerated because there is nothing for the field
-*  to do: `firestoreStore` takes a shared record's identity from the document
-*  id and overwrites the field on read, so a submitted value is either equal
-*  to the id (noise) or a lie (silently discarded). Publishing a form field
-*  whose value is thrown away is worse than not having it — the author will
-*  believe submitters choose their ids.
-*
-*  This is the second answer to the same question. The first was the reverse —
-*  REQUIRE the key, because a record without one was rejected by every reader
-*  — and it was right about the symptom and wrong about the cure: the identity
-*  belongs to the id the rules can pin, not to a field they cannot. */
-function primaryKeyProblems(app, collections) {
-	const primaryKeyOf = new Map(collections.map((collection) => [collection.cid, collection.primaryKey]));
-	return Object.entries(app.public?.submit ?? {}).flatMap(([cid, submit]) => {
-		const primaryKey = primaryKeyOf.get(cid);
-		if (primaryKey === void 0 || !submit.createFields.includes(primaryKey)) return [];
-		return [`public.submit.${cid}.createFields must NOT include "${primaryKey}", the schema's primaryKey: the rules can pin the document id but not the value of a field, so a submitter could write at their own id while claiming another record's. A shared record's identity is its document id — the store fills the field from it, and a submitted value is either the same thing or a lie that is thrown away.`];
-	});
-}
-/** `assignee` without the field that says which rows are theirs.
-*
-*  A FAIL-CLOSED trap of the worst kind, because it fails closed for one
-*  person and nobody else: the rules ask `collections[cid].assigneeField` for
-*  the field to compare, find nothing, and refuse every write that member
-*  makes. The app works for the owner who set it up, and the member it was set
-*  up for is told only "permission denied".
-*
-*  `'*': "assignee"` is refused outright rather than checked against every
-*  collection. The role means "the rows assigned to you", and what counts as
-*  assigned is per collection — an app-wide one would need the same field name
-*  to be right everywhere, and where it is missing it silently means "no
-*  access to this collection" rather than "no scoping here".
-*/
-function assigneeProblems(app) {
-	return Object.entries(app.members).flatMap(([email, roles]) => Object.entries(roles).flatMap(([cid, role]) => {
-		if (role !== "assignee") return [];
-		if (cid === "*") return [`members["${email}"] holds "assignee" under "*", and the role cannot be app-wide: which rows are yours is declared per collection (\`collections.<cid>.assigneeField\`). Name the collections instead — { "bookings": "assignee" }.`];
-		if (app.collections?.[cid]?.assigneeField !== void 0) return [];
-		return [`members["${email}"] holds "assignee" on '${cid}', but collections.${cid}.assigneeField does not say which field names the member a row belongs to. Add it (assigneeField: "<a field holding an address>"), or give a role that is not row-scoped. Without it the rules have nothing to compare and refuse every write that member makes, while the app keeps working for everybody else.`];
-	}));
-}
-/** A server-stamped field the submitter cannot write, or can rewrite later.
-*
-*  Both failures are silent in opposite directions. Left out of
-*  `createFields`, the rules refuse every submission (`hasOnly(createFields)`
-*  rejects the key the stamp check requires) — an app nobody can use. Left IN
-*  a `selfUpdate` list, the field the queue is ordered by becomes editable by
-*  the person standing in the queue. */
-function stampProblems(app) {
-	return Object.entries(app.public?.submit ?? {}).flatMap(([cid, submit]) => {
-		const stamp = submit.stampField;
-		if (stamp === void 0) return [];
-		const problems = [];
-		if (!submit.createFields.includes(stamp)) problems.push(`public.submit.${cid}.stampField names '${stamp}', which is not in createFields. The rules require the record to CARRY the server time in that field, and refuse any key outside createFields — so every submission is denied. Add it to createFields; the page fills it in, not the person.`);
-		for (const [status, fields] of Object.entries(submit.selfUpdate ?? {})) {
-			if (!fields.includes(stamp)) continue;
-			problems.push(`public.submit.${cid}.selfUpdate.${status} lets the submitter write '${stamp}', which is the field stampField pins to the server clock. Whatever that field orders — a first-come queue, an audit trail — could then be rewritten by the person it ranks. Remove it from selfUpdate.`);
-		}
-		return problems;
-	});
-}
-/** A per-record window bound pointing at a collection or a field the submitter
-*  never writes.
-*
-*  `fromField` makes the rules read another record, and every part of that
-*  read is fail-closed: an unknown collection, or a `ref` the submission does
-*  not carry, means the bound can never be satisfied and the form is shut for
-*  good. */
-function windowRefProblems(app, collections) {
-	const known = new Set(collections.map((collection) => collection.cid));
-	return Object.entries(app.public?.submit ?? {}).flatMap(([cid, submit]) => [...windowBoundProblems(cid, submit, known, "fromField", submit.window?.fromField, "opening"), ...windowBoundProblems(cid, submit, known, "untilField", submit.window?.untilField, "closing")]);
-}
-/** Both bounds, checked identically. `untilField` arrived with the booking
-*  desk and reads exactly like its twin, so a check that knew only about
-*  `fromField` would let the closing half through unchecked — and a closing
-*  bound that names nothing does not leave the door ajar, it refuses every
-*  submission with no explanation. */
-function windowBoundProblems(cid, submit, known, key, ref, which) {
-	if (ref === void 0) return [];
-	const problems = [];
-	if (!known.has(ref.collection)) problems.push(`public.submit.${cid}.window.${key}.collection names '${ref.collection}', which is not a shared collection in this repository. The rules read the ${which} time off a record there, so nothing can ever be submitted. Shared collections here: ${known.size > 0 ? [...known].sort().join(", ") : "(none)"}.`);
-	if (!submit.createFields.includes(ref.ref)) problems.push(`public.submit.${cid}.window.${key}.ref names '${ref.ref}', which is not in createFields. The rules take the target record's id from that field ON THE SUBMISSION — if the submitter never writes it, there is nothing to look up and every submission is refused.`);
-	return problems;
-}
-/** The two halves of a mirror, checked as the pair they only work as.
-*
-*  `mirror` on the submission and `mirrorOf` on the projection are separate
-*  keys in separate places, and each is inert without the other: a booking
-*  whose slot declares no `mirrorOf` can never be created (the rules demand a
-*  paired write that the projection's own rule will refuse), and a projection
-*  whose authority declares no `mirror` drifts unbounded because nothing makes
-*  the two move together. Both failures are silent, and one of them —
-*  advertising a slot somebody already holds — is the exact thing the mirror
-*  exists to prevent.
-*
-*  Also refuses a collection mirroring ITSELF, which reads as a typo and
-*  behaves as an unwritable collection: every create would have to prove its
-*  own document is simultaneously taken and open. */
-function mirrorProblems(app, collections) {
-	const known = new Set(collections.map((collection) => collection.cid));
-	const names = known.size > 0 ? [...known].sort().join(", ") : "(none)";
-	return [...Object.entries(app.public?.submit ?? {}).flatMap(([cid, submit]) => mirrorClaimProblems(app, cid, submit, known, names)), ...Object.entries(app.collections ?? {}).flatMap(([cid, collection]) => mirrorOfProblems(app, cid, collection, known, names))];
-}
-/** The submission side: `public.submit[cid].mirror`. */
-function mirrorClaimProblems(app, cid, submit, known, names) {
-	const { mirror } = submit;
-	if (mirror === void 0) return [];
-	if (mirror === cid) return [`public.submit.${cid}.mirror names its own collection: the projection is a SEPARATE record, and as written no create can satisfy the rules.`];
-	if (!known.has(mirror)) return [`public.submit.${cid}.mirror names '${mirror}', which is not a shared collection in this repository. The rules require the projection to move in the same write, so every submission is refused. Shared collections here: ${names}.`];
-	if (app.collections?.[mirror]?.mirrorOf !== cid) return [`public.submit.${cid}.mirror names '${mirror}', but collections.${mirror} does not declare mirrorOf: "${cid}". The two halves only work as a pair — the submission side demands the projection move with it, and the projection side is what allows that move — so as written every submission is refused.`];
-	return [];
-}
-/** The projection side: `collections[cid].mirrorOf`. */
-function mirrorOfProblems(app, cid, collection, known, names) {
-	const authority = collection.mirrorOf;
-	if (authority === void 0) return [];
-	if (!known.has(authority)) return [`collections.${cid}.mirrorOf names '${authority}', which is not a shared collection in this repository. Nothing can then be true of it, so the projection's state may never be written. Shared collections here: ${names}.`];
-	if (app.public?.submit?.[authority]?.mirror !== cid) return [`collections.${cid}.mirrorOf names '${authority}', but public.submit.${authority} does not declare mirror: "${cid}". Only the pair keeps the projection honest: without the other half a record can be created without moving this one, and the public page goes on offering something that is already taken.`];
-	return [];
-}
-/** What each view is handed, and whether its audience can actually read it.
-*
-*  Declared, never inferred — a view whose datasets were guessed from
-*  `public.read` renders perfectly and draws an empty grid, with nothing in
-*  the page, the rules or the log to say why.
-*
-*  The reachability check below is that same failure, once per audience. A
-*  `public` view naming a collection outside `public.read` draws nothing; a
-*  `participant` view naming one the participant reaches by neither
-*  `participantRead` nor their own row is worse, because an unscoped list on
-*  an own-row collection is DENIED rather than narrowed — the page does not
-*  render less, it fails.
-*
-*  There is deliberately no such check for `member`. Every read a role opens
-*  is unscoped, and WHICH role a given member holds is not a property of the
-*  declaration: a stylist scoped to `bookings` and an owner read the same
-*  projection. That one is settled at the entrance, by trying the read. */
-/** The path, for one view. The SAME validator the host's own custom views use,
-*  rather than a second opinion about what a safe view path is.
-*
-*  Two ad-hoc attempts were wrong here in the same afternoon: a prefix-and-
-*  suffix test let `views/../../secrets.html` through, and `views/[^/]+\.html`
-*  still let `views/..\..\secrets.html` through, because a backslash is not a
-*  slash on this side of the check and IS a separator on Windows. This one
-*  rejects `..`, backslashes, leading slashes and anything outside
-*  `[A-Za-z0-9._-]` per segment.
-*
-*  It matters more here than for a host view: the host reads this path to
-*  decide which file to copy onto a document other people read — for a public
-*  view, a document whose rule is `allow read: if true`, so the blast radius of
-*  a bad path is the world rather than the author's own iframe. Nested paths
-*  ARE allowed by the shared validator; the extra `views/<one name>.html` shape
-*  is this publisher's own narrowing, kept because there is no reason for a
-*  published view to live in a subdirectory. */
-function viewPathProblems(view) {
-	if (isSafeCustomViewPath(view.path) && view.path.split("/").length === 2) return [];
-	return [`${view.where}.path is '${view.path}': a published view is exactly one HTML file directly inside the collection's own views/ directory (e.g. views/booking.html) — no sub-directories, and no segments that climb out of it. The host reads this as a file to publish.`];
-}
-/** One dataset, for one view: does it exist here, and can the audience it is
-*  handed to actually read it? */
-function viewCollectionProblems(app, view, cid, known) {
-	if (!known.has(cid)) return [`${view.where}.collections names '${cid}', which is not a shared collection in this repository. Shared collections here: ${known.size > 0 ? [...known].sort().join(", ") : "(none)"}.`];
-	if (view.audience === "public" && !(app.public?.read ?? []).includes(cid)) return [`${view.where}.collections names '${cid}', which is not in public.read: the page reads these with the VISITOR's permissions, so the rules refuse the read and the view draws an empty page. Nothing errors — this is the failure that looks like a working view with no data.`];
-	return [];
-}
-function viewProblems(app, collections) {
-	const normalized = normalizeViews(app);
-	if (!normalized.ok) return normalized.problems;
-	const known = new Set(collections.map((collection) => collection.cid));
-	return normalized.views.flatMap((view) => [...viewPathProblems(view), ...view.collections.flatMap((cid) => viewCollectionProblems(app, view, cid, known))]);
-}
-/** What publish will actually promote, checked as the PAIR it becomes.
-*
-*  `publishProblems` reads the manifest, where `members` and `collections` sit
-*  side by side and agree. Publish does not write that pair. It writes the
-*  roster from the manifest and the collection configuration from what DEPLOY
-*  staged, so the app that lands is one half of each — and no check has ever
-*  looked at that combination.
-*
-*  The sequence that gets through: deploy revision A with no `assigneeField`,
-*  add the field AND the member in revision B, publish without redeploying.
-*  Every manifest-level check passes on a declaration that is internally sound,
-*  while what lands is A's field-less configuration beside B's roster — an
-*  assignee with nothing to be compared against, refused every write, in an app
-*  that keeps working for everybody else. That is the precise trap
-*  `assigneeProblems` exists to prevent, reached by the one route it cannot
-*  see.
-*
-*  Separate from `publishProblems` because it needs what deploy staged, which
-*  is a Firestore read the host makes and this package does not. It is checked
-*  against `stagedRuleConfig` — the same function the projection uses — rather
-*  than against a re-derivation, so the value validated is the value written.
-*
-*  Only the staged half can be stale, so only that half is named and the fix is
-*  "deploy again" rather than "fix the declaration". */
-function promotedRoleProblems(app, staged) {
-	const promoted = stagedRuleConfig(staged).collections ?? {};
-	const stagedCids = new Set(staged.map((entry) => entry.cid));
-	return [
-		...promotedAssigneeProblems(app, promoted, stagedCids),
-		...promotedMirrorProblems(app, promoted, stagedCids),
-		...promotedRefFieldProblems(app, staged),
-		...promotedParticipantViewProblems(app, staged)
-	];
-}
-/** A participant's page, checked against the `participantRead` publish will
-*  actually PROMOTE.
-*
-*  Not against the manifest's. `projectPublish` overwrites `participantRead`
-*  with what the staged schemas carry, so a cid added to the manifest since the
-*  last deploy is not in the rules — and a page written for it would be
-*  published, offered, and then refused the read. The manifest half of this
-*  file cannot see that; the promoted half can, which is why the check lives
-*  here rather than beside the other view checks. */
-function promotedParticipantViewProblems(app, staged) {
-	const normalized = normalizeViews(app);
-	if (!normalized.ok) return [];
-	const participantRead = stagedRuleConfig(staged).participantRead ?? [];
-	return normalized.views.filter((view) => view.audience === "participant").flatMap((view) => view.collections.filter((cid) => participantScope(app, cid, participantRead) === null).map((cid) => `${view.where}.collections names '${cid}', which a participant cannot read once this publishes: it is not in the participantRead that DEPLOY staged, and public.submit.${cid} declares neither an emailField nor idFrom "auth.uid", so there is no row the rules would call theirs. The page would be refused the read, not handed fewer records. (Adding it to participantRead in app.json is not enough — deploy first.)`));
-}
-/** The FIELDS a rule reads off another record — `idIn.where.field` and the two
-*  window bounds — checked against the schema publish is about to promote.
-*
-*  These are checked here rather than in `publishProblems` because that gate
-*  is given a cid and a primary key per collection and nothing else, on
-*  purpose: it reads the DECLARATION. A field name can only be judged against
-*  a schema, and the schema that matters is the STAGED one — the version
-*  publish promotes — not whatever the working tree says now.
-*
-*  What a typo costs: `where: { field: "staet" }` publishes cleanly, the
-*  rules' comparison can never match, and every submission is denied with no
-*  message. The author's own app looks broken with nothing to read.
-*
-*  Only fields the schema DECLARES are accepted. A record may carry more than
-*  its schema does, but a shared collection's records are written through it,
-*  and "the field exists on some rows" is not something a gate can promise. */
-function promotedRefFieldProblems(app, staged) {
-	const schemaOf = new Map(staged.map((entry) => [entry.cid, entry.doc.publishedSchema]));
-	return Object.entries(app.public?.submit ?? {}).flatMap(([cid, submit]) => submitRefProblems(schemaOf, cid, submit));
-}
-function submitRefProblems(schemaOf, cid, submit) {
-	return [
-		...idInRefProblems(schemaOf, cid, submit),
-		...boundRefProblems(schemaOf, cid, "fromField", submit.window?.fromField),
-		...boundRefProblems(schemaOf, cid, "untilField", submit.window?.untilField)
-	];
-}
-function idInRefProblems(schemaOf, cid, submit) {
-	const where = submit.idIn?.where;
-	if (where === void 0) return [];
-	return [...refFieldProblem(schemaOf, cid, "idIn.where.field", submit.idIn?.collection, where.field), ...comparableProblem(schemaOf, cid, submit.idIn?.collection, where)];
-}
-function boundRefProblems(schemaOf, cid, key, ref) {
-	if (ref === void 0) return [];
-	return [...refFieldProblem(schemaOf, cid, `window.${key}.field`, ref.collection, ref.field), ...millisProblem(schemaOf, cid, `window.${key}.field`, ref)];
-}
-/** The field spec a reference points at, or undefined when there is nothing
-*  staged to judge it against (the host refuses that separately, naming every
-*  missing collection at once). */
-function referencedField(schemaOf, target, field) {
-	if (target === void 0 || field === void 0) return void 0;
-	return schemaOf.get(target)?.fields?.[field];
-}
-/** An enum's domain, or undefined for every other kind. Narrowed by the key
-*  rather than asserted: `fields` is a discriminated union and only some of
-*  its members carry `values`. */
-function enumValues(spec) {
-	return spec.type === "enum" ? spec.values : void 0;
-}
-function refFieldProblem(schemaOf, cid, key, target, field) {
-	if (target === void 0 || field === void 0) return [];
-	const schema = schemaOf.get(target);
-	if (schema === void 0 || referencedField(schemaOf, target, field) !== void 0) return [];
-	const known = Object.keys(schema.fields ?? {}).sort().join(", ");
-	return [`public.submit.${cid}.${key} names '${field}', which the STAGED schema of '${target}' — the one publish promotes — does not declare. The rules read that field off the record and compare it, so as written every submission is refused with nothing to explain it. Fields on '${target}': ${known.length > 0 ? known : "(none)"}.`];
-}
-/** A comparison the rules can never satisfy is as dead as a missing field, and
-*  looks even more correct on the page: an `enum` whose domain does not contain
-*  the value, or a boolean field compared with a string. */
-function comparableProblem(schemaOf, cid, target, where) {
-	const spec = referencedField(schemaOf, target, where.field);
-	if (spec === void 0) return [];
-	const said = JSON.stringify(where.equals);
-	const values = enumValues(spec);
-	if (values !== void 0) {
-		if (values.includes(String(where.equals))) return [];
-		return [`public.submit.${cid}.idIn.where.equals is ${said}, which is not one of the values '${where.field}' can hold on '${String(target)}' (${values.join(", ") || "(none)"}). The comparison can never be true, so every submission is refused.`];
-	}
-	const wanted = spec.type === "number" ? "number" : spec.type === "boolean" ? "boolean" : "string";
-	if (typeof where.equals === wanted) return [];
-	return [`public.submit.${cid}.idIn.where.equals is ${said}, and '${where.field}' on '${String(target)}' is a ${spec.type} field. The rules compare the stored value with this one and never coerce, so the comparison can never be true and every submission is refused.`];
-}
-/** A per-record window bound is EPOCH MILLIS, because the rules have no date
-*  arithmetic and do not coerce: they compare `request.time.toMillis()` with
-*  whatever is stored. A `datetime` field holds an ISO string, which is a type
-*  error that fails closed — the window never opens, and nothing says so. */
-function millisProblem(schemaOf, cid, key, ref) {
-	const spec = referencedField(schemaOf, ref?.collection, ref?.field);
-	if (spec === void 0 || spec.type === "number") return [];
-	return [`public.submit.${cid}.${key} names '${String(ref?.field)}' on '${String(ref?.collection)}', which is a ${spec.type} field. A per-record bound is EPOCH MILLIS: the rules compare it with request.time.toMillis() and never coerce, so anything else is a type error that refuses every submission — the window simply never opens. Store the instant as a number.`];
-}
-function promotedAssigneeProblems(app, promoted, stagedCids) {
-	return Object.entries(app.members).flatMap(([email, roles]) => Object.entries(roles).flatMap(([cid, role]) => {
-		if (role !== "assignee" || cid === "*" || !stagedCids.has(cid)) return [];
-		if (promoted[cid]?.assigneeField !== void 0) return [];
-		return [`members["${email}"] holds "assignee" on '${cid}', and the STAGED version of '${cid}' — the one publish promotes — carries no assigneeField, even if app.json declares one now. Publish writes the roster from app.json and the collection configuration from the deploy, so that member would land with nothing to be compared against: refused every write, while the app keeps working for everybody else. Run deploy again, so the version being published is the one the declaration describes.`];
-	}));
-}
-/** The mirror's other half, checked against what publish will actually
-*  promote — the same trap as the assignee's field, reached by the same route.
-*
-*  `mirror` is published from the MANIFEST (it lives in `public.submit`) while
-*  `mirrorOf` is promoted from what DEPLOY staged. Add both halves to
-*  `app.json` and publish without redeploying, and what lands is a submission
-*  demanding a paired projection write beside a projection whose rule config
-*  does not allow it: every booking is refused, and the declaration on disk
-*  looks perfectly sound.
-*
-*  Refused in the reverse direction too. Removing `mirrorOf` from a live app
-*  and publishing without a deploy leaves the projection accepting nothing —
-*  and removing it FROM the staged side while the submission still demands it
-*  is the drift this pair exists to prevent. */
-function promotedMirrorProblems(app, promoted, stagedCids) {
-	return [...addedMirrorProblems(app, promoted, stagedCids), ...strandedMirrorProblems(app, promoted)];
-}
-/** The manifest asks for a projection the promoted configuration will not
-*  allow: every submission denied, and nothing on the page to say why. */
-function addedMirrorProblems(app, promoted, stagedCids) {
-	return Object.entries(app.public?.submit ?? {}).flatMap(([cid, submit]) => {
-		const { mirror } = submit;
-		if (mirror === void 0 || !stagedCids.has(mirror)) return [];
-		if (promoted[mirror]?.mirrorOf === cid) return [];
-		return [`public.submit.${cid}.mirror names '${mirror}', and the STAGED version of '${mirror}' — the one publish promotes — does not declare mirrorOf: "${cid}", even if app.json declares it now. Publish writes the submission side from app.json and the collection side from the deploy, so what lands is a booking that must move its projection beside a projection that refuses to move: every submission is denied, with nothing on the page to say why. Run deploy again, so the version being published is the one the declaration describes.`];
-	});
-}
-/** The other direction, and the DANGEROUS one.
-*
-*  Take a live pair, delete BOTH halves from `app.json`, and publish without
-*  redeploying. The submission side comes from the manifest, so nothing
-*  requires the projection to move any more; the collection side comes from
-*  staging, which still says `mirrorOf`, so the projection stays writable.
-*  Bookings are then created while the public row goes on saying `open` — the
-*  precise failure the pair exists to prevent, arrived at by removing it.
-*
-*  Refused rather than tolerated because the app keeps WORKING: submissions
-*  succeed. Only the public page is wrong, and only to the people reading it. */
-function strandedMirrorProblems(app, promoted) {
-	return Object.entries(promoted).flatMap(([cid, config]) => {
-		const authority = config.mirrorOf;
-		if (authority === void 0) return [];
-		if (app.public?.submit?.[authority]?.mirror === cid) return [];
-		return [`the STAGED version of '${cid}' — the one publish promotes — declares mirrorOf: "${authority}", and app.json no longer declares public.submit.${authority}.mirror: "${cid}". What lands is a projection that is still writable beside submissions that no longer have to move it, so records can be created while '${cid}' goes on advertising them as available. Nothing fails: the app works and the public page lies. Run deploy again, so the version being published is the one the declaration describes.`];
-	});
-}
-//#endregion
 //#region src/collection/server/skillAssets.ts
 /** Read a collection's custom-view HTML, path-safely. `viewFile` is a
 *  schema-validated `views/*.html` path, resolved with realpath containment.
@@ -3658,6 +2079,6 @@ function makeManageCollectionTool(deps = {}) {
 	};
 }
 //#endregion
-export { stagedRuleConfig as $, runQueryOverRows as A, APPS_COLLECTION as B, STORE_UNREADABLE as C, recordFieldProblem as D, compileRecordZ as E, readCustomViewI18n as F, appSlugDoc as G, PUBLIC_CONFIG_DOC as H, readSkillTemplate as I, projectApp as J, appStagingPath as K, bindsSubmitterIdentity as L, buildCollectionActionSeedPrompt as M, promptPathsFor as N, runCollectionQuery as O, readCustomViewHtml as P, promoteSchema as Q, promotedRoleProblems as R, MAX_RECORD_ISSUES as S, validateRecordObject as T, appConfigPath as U, APP_SLUGS_COLLECTION as V, appSchemasPath as W, projectDeploy as X, projectAppViews as Y, projectPublish as Z, computeCollectionIcon as _, deleteCollection as a, RESERVED_VIEW_IDS as at, applyMutateAction as b, computeSuccessor as c, VIEW_ID_PATTERN as ct, isTriggerDue as d, participantScope as dt, viewConfigDocId as et, maybeSpawnSuccessor as f, viewDocId as ft, ONE_SECOND_MS as g, successorId as h, deleteCustomView as i, PUBLIC_VIEW_ID as it, buildActionSeedPrompt as j, enrichItems as k, daysInMonth as l, VIEW_TIER as lt, resolveEvery as m, MAX_UNSELECTIVE_ITEMS as n, AuthoredAppZ as nt, deleteCollectionRefusalMessage as o, VIEW_AUDIENCES as ot, parseCivil as p, writeFor as pt, appViewTierPath as q, makeManageCollectionTool as r, parseAuthoredApp as rt, advanceTriggerDate as s, VIEW_CONFIG_ID as st, MAX_SCHEMA_ISSUES as t, APP_ROLES as tt, formatCivil as u, normalizeViews as ut, buildWorkspaceOntology as v, validateCollectionRecords as w, firstMutateParamProblem as x, schemaRelations as y, publishProblems as z };
+export { runQueryOverRows as A, STORE_UNREADABLE as C, recordFieldProblem as D, compileRecordZ as E, readCustomViewI18n as F, readSkillTemplate as I, buildCollectionActionSeedPrompt as M, promptPathsFor as N, runCollectionQuery as O, readCustomViewHtml as P, MAX_RECORD_ISSUES as S, validateRecordObject as T, computeCollectionIcon as _, deleteCollection as a, applyMutateAction as b, computeSuccessor as c, isTriggerDue as d, maybeSpawnSuccessor as f, ONE_SECOND_MS as g, successorId as h, deleteCustomView as i, buildActionSeedPrompt as j, enrichItems as k, daysInMonth as l, resolveEvery as m, MAX_UNSELECTIVE_ITEMS as n, deleteCollectionRefusalMessage as o, parseCivil as p, makeManageCollectionTool as r, advanceTriggerDate as s, MAX_SCHEMA_ISSUES as t, formatCivil as u, buildWorkspaceOntology as v, validateCollectionRecords as w, firstMutateParamProblem as x, schemaRelations as y };
 
-//# sourceMappingURL=server-jm7aGA3g.js.map
+//# sourceMappingURL=server-BIewQYpC.js.map