@mulmoclaude/core 3.4.0 → 3.6.0

package/dist/{discovery-CrA_EqUJ.cjs → discovery-Cw5xWzZD.cjs}

@@ -1,7 +1,7 @@
 const require_rolldown_runtime = require("./rolldown-runtime-VH7oDXx4.cjs");
 const require_dist = require("./dist-CsgSfWwR.cjs");
 const require_root = require("./root-rPH6FGDT.cjs");
-const require_calendarGrid = require("./calendarGrid-p8K-7cuB.cjs");
+const require_calendarGrid = require("./calendarGrid-DGILaVxI.cjs");
 const require_project = require("./project-C1ep9pvo.cjs");
 const require_templatePath = require("./templatePath-27vUZowm.cjs");
 let node_fs = require("node:fs");
@@ -51,6 +51,10 @@ function createForwardingLogger(getLogger) {
 *  watcher is already running — and a host catching both in one place should
 *  not have to match on message text to tell them apart. */
 var COLLECTION_ROOT_REQUIRED = "COLLECTION_ROOT_REQUIRED";
+/** Build a local {@link CollectionKey}, canonicalising the root. The identity
+*  type itself is isomorphic and cannot canonicalise (that needs `node:path`),
+*  so this is the constructor server code should use. */
+var localCollectionKey = (root, slug) => require_calendarGrid.localCollectionKeyOf(require_root.canonicalRoot(root), slug);
 /** Build a change payload, attaching `root` only when the engine call carried
 *  an explicit one. Centralised so every publish site states the root the same
 *  way, and so a single-workspace host's payload shape stays byte-identical to
@@ -61,8 +65,48 @@ function collectionChangePayload(base, root) {
 		root: require_root.canonicalRoot(root)
 	};
 }
+/** Build a change payload for a SHARED collection. `slug` carries the `cid`,
+*  which is what it is called inside its app; `aid` is what makes it an
+*  identity. Never stamps a `root` — a shared collection does not have one. */
+function sharedCollectionChangePayload(base, aid) {
+	require_calendarGrid.sharedCollectionKey(aid, base.slug);
+	return {
+		...base,
+		aid
+	};
+}
+/** The identity a change is about, as a value — the thing to key a fan-out on.
+*
+*  This is the one place that decides what an absent field means, so no host
+*  has to: `aid` present is a shared collection, otherwise it is local, and a
+*  local payload with no `root` means the host's configured root (which is why
+*  a single-workspace host's payloads still say nothing about roots).
+*
+*  `fallbackRoot` is what a payload with no root resolves to. An explicit-root
+*  host has no such default and must not guess — pass the root the call was
+*  made for. */
+/** Refuse a payload that names both an app and a root.
+*
+*  The two arms are mutually exclusive in the TYPE, so this cannot come from
+*  the constructors -- it is corrupt input (a JS caller, a cast, something off
+*  a wire). Throwing rather than picking one: whichever way it were guessed,
+*  the update would be fanned out on a channel it does not belong to, and that
+*  is invisible where a throw is not.
+*
+*  Takes the WIDENED shape deliberately. Written inline, TypeScript narrows the
+*  union to `never` inside the branch and the fields cannot be read at all --
+*  which is the type-level guarantee doing its job, and exactly why the runtime
+*  check has to be stated somewhere it can still see them. */
+function requireOneScope(payload) {
+	if (payload.aid !== void 0 && payload.root !== void 0) throw new Error(`collectionChangeKey: payload for "${payload.slug}" carries both an app (${payload.aid}) and a root (${payload.root})`);
+}
+function collectionChangeKey(payload, fallbackRoot) {
+	requireOneScope(payload);
+	return payload.aid === void 0 ? localCollectionKey(payload.root ?? fallbackRoot, payload.slug) : require_calendarGrid.sharedCollectionKey(payload.aid, payload.slug);
+}
 var hostSlot = createHostSlot("@mulmoclaude/core/collection/server: configureCollectionHost()");
 var changePublisher = null;
+var firestoreAccessor = null;
 /** Wire the engine to a host. Call once at server startup, before any
 *  collection storage operation. Re-binding to a *different* host throws —
 *  silently redirecting later filesystem operations to another workspace
@@ -86,6 +130,25 @@ function setCollectionChangePublisher(publish) {
 function publishCollectionChange(payload) {
 	changePublisher?.(payload);
 }
+/** Wire the accessor for the host's authenticated Firestore session.
+*
+*  Separate from `configureCollectionHost` for the same reason
+*  `setCollectionChangePublisher` is: the host binding is set at the top of
+*  server startup, but this session doesn't exist until the user connects
+*  remote-host (and closes again on disconnect), so it cannot be part of a
+*  one-shot binding. Optional — left unwired, only shared collections are
+*  affected, and they report "not connected". Pass `null` to detach. */
+function setFirestoreAccessor(accessor) {
+	firestoreAccessor = accessor;
+}
+/** The host's live Firestore access, or null when there is no session (or the
+*  host never wired one — every non-shared backend leaves it unset).
+*  Callers MUST surface null as an actionable "connect remote-host first",
+*  never as an empty result: silence would be indistinguishable from a
+*  collection that genuinely has no records. */
+function firestoreHandle() {
+	return firestoreAccessor?.() ?? null;
+}
 function requireHost() {
 	return hostSlot.get();
 }
@@ -150,6 +213,18 @@ function isPresetSlug(slug) {
 *  without a workspace root. */
 var log = createForwardingLogger(() => hostSlot.peek()?.log ?? null);
 //#endregion
+//#region src/collection/server/backendAvailability.ts
+/** Thrown by a store when its engine or session cannot serve the request. */
+var BackendUnavailableError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "BackendUnavailableError";
+	}
+};
+function isBackendUnavailable(err) {
+	return err instanceof BackendUnavailableError;
+}
+//#endregion
 //#region src/collection/server/paths.ts
 var SCHEMA_FILE = "schema.json";
 /** Sanitise a user-supplied slug into a safe directory-name leaf.
@@ -261,6 +336,280 @@ function resolveTemplatePath(skillDir, templateRelPath) {
 	return resolved;
 }
 //#endregion
+//#region src/collection/server/storePage.ts
+/** Project `fields` (+ the primary key, always) out of each record. Thin
+*  server-typed alias over the shared isomorphic `projectRecordFields`
+*  (../core/project.ts) — kept as the store layer's exported name. */
+function projectItemFields(items, fields, primaryKey) {
+	return require_project.projectRecordFields(items, fields, primaryKey);
+}
+/** Slice + project an already-ordered full read into a `ListPage` — the
+*  shared emulation for stores without native paging. Pure, exported for
+*  tests. `limit: 0` is a valid "count only" page. */
+function pageFromFullRead(items, opts, primaryKey, truncated) {
+	const offset = Math.max(0, opts.offset ?? 0);
+	const end = opts.limit === void 0 ? items.length : offset + Math.max(0, opts.limit);
+	return {
+		items: projectItemFields(items.slice(offset, end), opts.fields, primaryKey),
+		total: items.length,
+		truncated
+	};
+}
+//#endregion
+//#region src/collection/server/firestoreStore.ts
+/** What every operation throws when there is no live session. Worded as an
+*  instruction because it surfaces straight to the user and the agent. */
+var NOT_CONNECTED = "shared collection unavailable: connect remote-host first — these records live in the app's Firestore, not in the workspace, so nothing can be read or written while the session is closed";
+/** What a schema declaring `storage.type: "firestore"` must have had resolved
+*  for it before it can be served. Its absence is a programming error here, not
+*  a user-facing state: discovery REFUSES such a schema when the repository
+*  declares no `aid`, so a collection that reached this store has one. */
+var NO_APP = "shared collection has no app id — discovery should have refused this schema; check that the repository's app.json declares an `aid`";
+/** The records subcollection of one shared collection.
+*
+*  Takes a KEY, never loose strings, and the key is the only way to reach this
+*  function. `sharedCollectionKey` is where the name rule lives (the charset a
+*  Firestore document id, a pubsub channel segment and the completion-bell id
+*  must all survive), so building a path cannot be a way around it. */
+function sharedItemsPath(key) {
+	return `apps/${key.aid}/collections/${key.cid}/items`;
+}
+/** The collection's identity, from what discovery resolved. Throws on a
+*  missing `appId` — see NO_APP. */
+function keyOf(collection) {
+	if (collection.appId === void 0) throw new Error(NO_APP);
+	return require_calendarGrid.sharedCollectionKey(collection.appId, collection.slug);
+}
+function requireHandle() {
+	const handle = firestoreHandle();
+	if (handle === null) throw new BackendUnavailableError(NOT_CONNECTED);
+	return handle;
+}
+/** Firestore's own refusal, named.
+*
+*  `permission-denied` is the failure a shared collection has most often and
+*  the one the SDK explains worst ("Missing or insufficient permissions") — it
+*  says nothing about WHO was refused, which is the only fact that leads to a
+*  fix. Authorization here is the app's member roster, keyed by email, so the
+*  signed-in address is what the app's owner needs in order to add it. This is
+*  the whole reason `FirestoreHandle` carries `email`.
+*
+*  Reported as a `BackendUnavailableError` deliberately, even though it is a
+*  refusal rather than an outage: the layers above catch broadly, and without a
+*  type to test, `store.read(...).catch(() => null)` reports "record missing"
+*  and an ontology count reports 0 — a denial would read as an empty
+*  collection, which is the exact confusion this backend refuses to create. */
+function isPermissionDenied(err) {
+	return require_dist.isRecord(err) && err.code === "permission-denied";
+}
+function deniedMessage(key, email) {
+	return `permission denied on shared collection '${key.cid}' of app '${key.aid}' — signed in as ${email}. A shared collection is authorized by the app's member roster (by email), so this address needs a role for '${key.cid}' (or '*'); only the app's owner can add it.`;
+}
+/** Run one SDK call, translating a roster denial. Every read and write goes
+*  through this — a denial reaching one path and not another would mean the
+*  message a user sees depends on which screen they were on. */
+async function guarded(key, email, run) {
+	try {
+		return await run();
+	} catch (err) {
+		if (!isPermissionDenied(err)) throw err;
+		throw new BackendUnavailableError(deniedMessage(key, email));
+	}
+}
+/** A stored document's fields → a record. A document written by hand (or by an
+*  older version) can hold anything, so a non-object is dropped rather than
+*  surfaced as a broken record — the same fail-soft the file store applies to
+*  an unparseable `.json`. */
+function toItem(data) {
+	return require_dist.isRecord(data) ? data : null;
+}
+/** Record ids are validated with the SAME helper every other backend uses.
+*  Firestore would accept ids the file store refuses, but a record should stay
+*  portable between backends — and an id that can't round-trip to a filename
+*  would break an export back to a file collection. */
+function withSafeId(itemId, onInvalid, run) {
+	const safeId = safeRecordId(itemId);
+	if (safeId === null) return onInvalid();
+	return run(safeId, requireHandle());
+}
+async function firestoreList(key) {
+	const { docs, email } = requireHandle();
+	return (await guarded(key, email, () => docs.list(sharedItemsPath(key)))).map((entry) => toItem(entry.data)).filter((item) => item !== null);
+}
+/** Paging is emulated over a full ordered read rather than pushed into
+*  Firestore: `offset` has no server-side form there (the cursor API needs the
+*  preceding document, which a stateless offset/limit call doesn't have), and
+*  `total` needs the full count anyway. Hence `nativePaging: false` — the
+*  capability is honest about the cost. */
+async function firestorePage(key, primaryKey, opts) {
+	const items = await firestoreList(key);
+	const offset = Math.max(0, opts.offset ?? 0);
+	return {
+		items: projectItemFields(opts.limit === void 0 ? items.slice(offset) : items.slice(offset, offset + Math.max(0, opts.limit)), opts.fields, primaryKey),
+		total: items.length,
+		truncated: false
+	};
+}
+async function firestoreRead(key, itemId) {
+	return withSafeId(itemId, () => Promise.resolve(null), async (safeId, { docs, email }) => toItem(await guarded(key, email, () => docs.get(sharedItemsPath(key), safeId))));
+}
+/** Publish the "records changed" ping for a shared collection.
+*
+*  `sharedCollectionChangePayload` NEVER stamps a root, and that matters beyond
+*  tidiness: this payload is relayed to the browser and on into an
+*  LLM-generated custom-view iframe, so a filesystem path on it would be a
+*  disclosure. The type makes it unreachable rather than trusting the caller. */
+function publishShared(key, ids, operation) {
+	publishCollectionChange(sharedCollectionChangePayload({
+		slug: key.cid,
+		ids,
+		op: operation
+	}, key.aid));
+}
+async function firestoreWrite(key, itemId, item, opts) {
+	return withSafeId(itemId, () => Promise.resolve({
+		kind: "invalid-id",
+		itemId
+	}), async (safeId, { docs, email }) => {
+		const collectionPath = sharedItemsPath(key);
+		if (opts.refuseOverwrite) {
+			if (!await guarded(key, email, () => docs.create(collectionPath, safeId, item))) return {
+				kind: "conflict",
+				itemId: safeId
+			};
+		} else await guarded(key, email, () => docs.set(collectionPath, safeId, item));
+		if (opts.slug) publishShared(key, [safeId], "upsert");
+		return {
+			kind: "ok",
+			itemId: safeId,
+			item
+		};
+	});
+}
+async function firestoreDelete(key, itemId, opts) {
+	return withSafeId(itemId, () => Promise.resolve({
+		kind: "invalid-id",
+		itemId
+	}), async (safeId, { docs, email }) => {
+		if (!await guarded(key, email, () => docs.delete(sharedItemsPath(key), safeId))) return {
+			kind: "not-found",
+			itemId: safeId
+		};
+		if (opts.slug) publishShared(key, [safeId], "delete");
+		return {
+			kind: "ok",
+			itemId: safeId
+		};
+	});
+}
+/** The store factory registered for `storage.type === "firestore"`.
+*  Synchronous and connection-agnostic by contract — see the header. */
+function firestoreStoreFor(collection, opts) {
+	const { primaryKey } = collection.schema;
+	const ioOpts = {
+		...opts,
+		slug: opts.slug ?? collection.slug
+	};
+	return {
+		capabilities: {
+			writable: true,
+			nativeQuery: false,
+			nativePaging: false
+		},
+		list: async () => firestoreList(keyOf(collection)),
+		page: async (pageOpts = {}) => firestorePage(keyOf(collection), primaryKey, pageOpts),
+		read: async (itemId) => firestoreRead(keyOf(collection), itemId),
+		write: async (itemId, item, writeOpts = {}) => firestoreWrite(keyOf(collection), itemId, item, {
+			...ioOpts,
+			refuseOverwrite: writeOpts.refuseOverwrite
+		}),
+		delete: async (itemId) => firestoreDelete(keyOf(collection), itemId, ioOpts)
+	};
+}
+//#endregion
+//#region src/collection/server/appManifest.ts
+/** The app declaration's filename, at the repository root. */
+var APP_MANIFEST_FILE = "app.json";
+/** Read `<root>/app.json` and return its `aid`.
+*
+*  SYNCHRONOUS on purpose. The caller is `acceptParsedSchema`, which is sync
+*  and is shared by discovery and `manageCollection`'s `putSchema` precisely so
+*  that a schema which would be skipped on the next discovery cannot be written
+*  as if it were fine. Making this async would split that gate in two, and the
+*  half that lost the check is the half the author sees. The file is a few
+*  hundred bytes and is read once per firestore collection per discovery pass.
+*
+*  Never cached. `app.json` is edited by hand and by the agent, and a cache
+*  here would mean the app a collection points at is whatever it was when the
+*  server started. */
+function loadAppManifest(root) {
+	let raw;
+	try {
+		raw = (0, node_fs.readFileSync)(node_path.default.join(root, APP_MANIFEST_FILE), "utf-8");
+	} catch (err) {
+		if (require_dist.isErrorWithCode(err) && err.code === "ENOENT") return {
+			ok: false,
+			kind: "missing"
+		};
+		return {
+			ok: false,
+			kind: "unreadable",
+			detail: String(err)
+		};
+	}
+	return parseAppManifest(raw);
+}
+/** The parse half, exported so it can be tested without a filesystem.
+*
+*  `aid` is validated with `isValidCollectionName` — the SAME predicate the
+*  `CollectionKey` constructors apply — rather than a rule of its own. An `aid`
+*  is re-encoded downstream as a Firestore document id, a pubsub channel
+*  segment and a cache key, each with a different character that would break
+*  it; one rule, stated once, is what keeps those layers from disagreeing.
+*  Rejecting here rather than at `sharedCollectionKey` only changes WHERE the
+*  author is told: a reason on the collection they wrote, instead of a throw
+*  from inside a store call. */
+function parseAppManifest(raw) {
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch (err) {
+		return {
+			ok: false,
+			kind: "malformed",
+			detail: `not valid JSON (${String(err)})`
+		};
+	}
+	if (!require_dist.isRecord(parsed)) return {
+		ok: false,
+		kind: "malformed",
+		detail: "is not a JSON object"
+	};
+	const { aid } = parsed;
+	if (typeof aid !== "string" || aid.length === 0) return {
+		ok: false,
+		kind: "malformed",
+		detail: "declares no `aid` string"
+	};
+	if (!require_calendarGrid.isValidCollectionName(aid)) return {
+		ok: false,
+		kind: "malformed",
+		detail: `\`aid\` '${aid}' is not a valid app id`
+	};
+	return {
+		ok: true,
+		manifest: { aid }
+	};
+}
+/** The failure as the one line an author can act on. Kept next to the failure
+*  type so a new variant cannot be added without wording it. */
+function appManifestReason(failure, root) {
+	const manifestPath = node_path.default.join(root, APP_MANIFEST_FILE);
+	if (failure.kind === "missing") return `a shared collection needs an app: create ${manifestPath} declaring an \`aid\``;
+	if (failure.kind === "unreadable") return `cannot read ${manifestPath}: ${failure.detail}`;
+	return `${manifestPath} ${failure.detail}`;
+}
+//#endregion
 //#region src/collection/server/io.ts
 /** True iff `filePath` exists and is a regular file (NOT a symlink).
 *  Defends `listItems` / `readItem` against `*.json` symlinks placed
@@ -483,18 +832,6 @@ function resolveCreateItemId(schema, record) {
 	return typeof primaryRaw === "string" && primaryRaw.length > 0 ? primaryRaw : null;
 }
 //#endregion
-//#region src/collection/server/backendAvailability.ts
-/** Thrown by a store when its engine or session cannot serve the request. */
-var BackendUnavailableError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "BackendUnavailableError";
-	}
-};
-function isBackendUnavailable(err) {
-	return err instanceof BackendUnavailableError;
-}
-//#endregion
 //#region src/collection/core/queryZ.ts
 /** Result-column aliases double as SQL identifiers and JSON keys — keep
 *  them to a conservative identifier charset so neither side needs
@@ -1088,26 +1425,6 @@ function closerFor(handle) {
 	return handle === null ? null : () => handle.close();
 }
 //#endregion
-//#region src/collection/server/storePage.ts
-/** Project `fields` (+ the primary key, always) out of each record. Thin
-*  server-typed alias over the shared isomorphic `projectRecordFields`
-*  (../core/project.ts) — kept as the store layer's exported name. */
-function projectItemFields(items, fields, primaryKey) {
-	return require_project.projectRecordFields(items, fields, primaryKey);
-}
-/** Slice + project an already-ordered full read into a `ListPage` — the
-*  shared emulation for stores without native paging. Pure, exported for
-*  tests. `limit: 0` is a valid "count only" page. */
-function pageFromFullRead(items, opts, primaryKey, truncated) {
-	const offset = Math.max(0, opts.offset ?? 0);
-	const end = opts.limit === void 0 ? items.length : offset + Math.max(0, opts.limit);
-	return {
-		items: projectItemFields(items.slice(offset, end), opts.fields, primaryKey),
-		total: items.length,
-		truncated
-	};
-}
-//#endregion
 //#region src/collection/server/sqliteStore.ts
 /** A constructor's parameter and return types are not observable at runtime,
 *  so the check stops at "DatabaseSync is constructible" — the only member of
@@ -1457,7 +1774,8 @@ function fileStoreFor(collection, opts) {
 var storeFactories = /* @__PURE__ */ new Map([
 	["file", fileStoreFor],
 	["csv", csvStoreFor],
-	["sqlite", sqliteStoreFor]
+	["sqlite", sqliteStoreFor],
+	["firestore", firestoreStoreFor]
 ]);
 /** Pick the store implementation for a discovered collection via the
 *  factory registry. An unknown kind cannot normally reach here (the
@@ -2313,15 +2631,19 @@ var DataSourceZ = zod.z.object({
 /** Alternative WRITABLE storage backend for a collection's records —
 *  unlike `dataSource` (external read-only file), a `storage` collection
 *  behaves like a normal writable collection; only where the rows live
-*  changes. v1: `sqlite` — records in a single SQLite database file
-*  (`node:sqlite`, one JSON record per row keyed by the primaryKey).
-*  `path` is workspace-relative and containment-checked exactly like
-*  `dataPath`. The store factory registry (`server/store.ts`) picks the
-*  implementation by `type` (plans/done/refactor-storage-virtualization.md). */
-var StorageZ = zod.z.object({
+*  changes. The store factory registry (`server/store.ts`) picks the
+*  implementation by `type` (plans/done/refactor-storage-virtualization.md).
+*
+*  A discriminated union rather than one shape with optional keys, because
+*  only the sqlite variant is a workspace FILE: its `path` is
+*  workspace-relative and containment-checked exactly like `dataPath`, while
+*  the firestore variant has no path to check — its records are not on this
+*  machine at all. Optional keys would let each arm accept the other's, and
+*  the compiler would stop being the thing that tells you which. */
+var StorageZ = zod.z.discriminatedUnion("type", [zod.z.object({
 	type: zod.z.literal("sqlite"),
 	path: zod.z.string().min(1)
-});
+}), zod.z.object({ type: zod.z.literal("firestore") }).strict()]);
 var BareCollectionSchemaZ = zod.z.object({
 	title: zod.z.string().min(1),
 	icon: zod.z.string().min(1),
@@ -2607,16 +2929,45 @@ function acceptParsedSchema(schema, opts) {
 			dataSourceFile
 		};
 	}
-	if (schema.storage !== void 0) {
-		const storageFile = resolveDataDir(schema.storage.path, opts.workspaceRoot);
+	if (schema.storage !== void 0) return acceptStorageSchema(schema.storage, opts);
+	const dataDir = resolveDataDir(schema.dataPath ?? "", opts.workspaceRoot);
+	if (dataDir === null) return {
+		ok: false,
+		reason: `dataPath '${schema.dataPath}' escapes the workspace`
+	};
+	return {
+		ok: true,
+		dataDir
+	};
+}
+/** The `storage` arm of the acceptance gate. Every storage backend gets the
+*  conventional phantom dataDir; what differs is what else has to resolve
+*  before the collection can exist at all.
+*
+*  A FILE-backed backend (sqlite) resolves and containment-checks a
+*  `storageFile`. A SHARED one (firestore) has no path on this machine — it
+*  resolves an IDENTITY instead: the `aid` from the repository's `app.json`,
+*  which together with the slug as `cid` names `apps/{aid}/collections/{cid}`.
+*
+*  Resolving it HERE, once, is the point. The store then receives a settled
+*  `(aid, cid)` and never reads `app.json` itself — otherwise the questions of
+*  caching, staleness and what to do when the file is missing would be decided
+*  inside a read path, where the only cheap answer is to return nothing, and
+*  "this collection is misconfigured" would reach the user as "this collection
+*  is empty". A missing or malformed `app.json` is a CONFIGURATION error, so it
+*  is reported the same way an escaping `storage.path` is: the schema is
+*  refused, with a reason naming the file to create. */
+function acceptStorageSchema(storage, opts) {
+	const dataDir = resolveDataDir(conventionalDataPath(opts.slug), opts.workspaceRoot);
+	if (dataDir === null) return {
+		ok: false,
+		reason: `slug '${opts.slug}' yields no workspace-contained data dir`
+	};
+	if (storage.type === "sqlite") {
+		const storageFile = resolveDataDir(storage.path, opts.workspaceRoot);
 		if (storageFile === null) return {
 			ok: false,
-			reason: `storage.path '${schema.storage.path}' escapes the workspace`
-		};
-		const dataDir = resolveDataDir(conventionalDataPath(opts.slug), opts.workspaceRoot);
-		if (dataDir === null) return {
-			ok: false,
-			reason: `slug '${opts.slug}' yields no workspace-contained data dir`
+			reason: `storage.path '${storage.path}' escapes the workspace`
 		};
 		return {
 			ok: true,
@@ -2624,14 +2975,15 @@ function acceptParsedSchema(schema, opts) {
 			storageFile
 		};
 	}
-	const dataDir = resolveDataDir(schema.dataPath ?? "", opts.workspaceRoot);
-	if (dataDir === null) return {
+	const manifest = loadAppManifest(opts.workspaceRoot);
+	if (!manifest.ok) return {
 		ok: false,
-		reason: `dataPath '${schema.dataPath}' escapes the workspace`
+		reason: appManifestReason(manifest, opts.workspaceRoot)
 	};
 	return {
 		ok: true,
-		dataDir
+		dataDir,
+		appId: manifest.manifest.aid
 	};
 }
 async function loadOneCollection(skillsRoot, slug, source, workspaceRoot) {
@@ -2689,6 +3041,7 @@ async function loadOneCollection(skillsRoot, slug, source, workspaceRoot) {
 		dataDir: acceptance.dataDir,
 		...acceptance.dataSourceFile !== void 0 ? { dataSourceFile: acceptance.dataSourceFile } : {},
 		...acceptance.storageFile !== void 0 ? { storageFile: acceptance.storageFile } : {},
+		...acceptance.appId !== void 0 ? { appId: acceptance.appId } : {},
 		skillDir: node_path.default.join(skillsRoot, safeName)
 	};
 }
@@ -2769,7 +3122,8 @@ function toSummary(collection) {
 		title: collection.schema.title,
 		icon: collection.schema.icon,
 		source: collection.source,
-		...collection.schema.dataSource !== void 0 ? { readonly: true } : {}
+		...collection.schema.dataSource !== void 0 ? { readonly: true } : {},
+		...collection.appId !== void 0 ? { appId: collection.appId } : {}
 	};
 }
 function toDetail(collection) {
@@ -2779,6 +3133,12 @@ function toDetail(collection) {
 	};
 }
 //#endregion
+Object.defineProperty(exports, "APP_MANIFEST_FILE", {
+	enumerable: true,
+	get: function() {
+		return APP_MANIFEST_FILE;
+	}
+});
 Object.defineProperty(exports, "BackendUnavailableError", {
 	enumerable: true,
 	get: function() {
@@ -2833,6 +3193,12 @@ Object.defineProperty(exports, "acceptParsedSchema", {
 		return acceptParsedSchema;
 	}
 });
+Object.defineProperty(exports, "appManifestReason", {
+	enumerable: true,
+	get: function() {
+		return appManifestReason;
+	}
+});
 Object.defineProperty(exports, "archiveDir", {
 	enumerable: true,
 	get: function() {
@@ -2851,6 +3217,12 @@ Object.defineProperty(exports, "checkpointSqliteDatabase", {
 		return checkpointSqliteDatabase;
 	}
 });
+Object.defineProperty(exports, "collectionChangeKey", {
+	enumerable: true,
+	get: function() {
+		return collectionChangeKey;
+	}
+});
 Object.defineProperty(exports, "collectionChangePayload", {
 	enumerable: true,
 	get: function() {
@@ -2935,6 +3307,12 @@ Object.defineProperty(exports, "encodeCsvRecordId", {
 		return encodeCsvRecordId;
 	}
 });
+Object.defineProperty(exports, "firestoreHandle", {
+	enumerable: true,
+	get: function() {
+		return firestoreHandle;
+	}
+});
 Object.defineProperty(exports, "generateItemId", {
 	enumerable: true,
 	get: function() {
@@ -2983,12 +3361,24 @@ Object.defineProperty(exports, "listItems", {
 		return listItems;
 	}
 });
+Object.defineProperty(exports, "loadAppManifest", {
+	enumerable: true,
+	get: function() {
+		return loadAppManifest;
+	}
+});
 Object.defineProperty(exports, "loadCollection", {
 	enumerable: true,
 	get: function() {
 		return loadCollection;
 	}
 });
+Object.defineProperty(exports, "localCollectionKey", {
+	enumerable: true,
+	get: function() {
+		return localCollectionKey;
+	}
+});
 Object.defineProperty(exports, "log", {
 	enumerable: true,
 	get: function() {
@@ -3007,6 +3397,12 @@ Object.defineProperty(exports, "pageFromFullRead", {
 		return pageFromFullRead;
 	}
 });
+Object.defineProperty(exports, "parseAppManifest", {
+	enumerable: true,
+	get: function() {
+		return parseAppManifest;
+	}
+});
 Object.defineProperty(exports, "peekWorkspaceRoot", {
 	enumerable: true,
 	get: function() {
@@ -3097,6 +3493,24 @@ Object.defineProperty(exports, "setCollectionChangePublisher", {
 		return setCollectionChangePublisher;
 	}
 });
+Object.defineProperty(exports, "setFirestoreAccessor", {
+	enumerable: true,
+	get: function() {
+		return setFirestoreAccessor;
+	}
+});
+Object.defineProperty(exports, "sharedCollectionChangePayload", {
+	enumerable: true,
+	get: function() {
+		return sharedCollectionChangePayload;
+	}
+});
+Object.defineProperty(exports, "sharedItemsPath", {
+	enumerable: true,
+	get: function() {
+		return sharedItemsPath;
+	}
+});
 Object.defineProperty(exports, "skillsStagingDir", {
 	enumerable: true,
 	get: function() {
@@ -3134,4 +3548,4 @@ Object.defineProperty(exports, "writeItem", {
 	}
 });
 
-//# sourceMappingURL=discovery-CrA_EqUJ.cjs.map
+//# sourceMappingURL=discovery-Cw5xWzZD.cjs.map