@mulmoclaude/core 3.4.0 → 3.6.0

package/dist/collection/server/host.d.ts

@@ -1,5 +1,7 @@
 import { canonicalRoot } from '../../files/root.js';
+import { CollectionKey } from '../core/collectionKey.js';
 import { StructuredLogger } from '../../host/hostSlot.js';
+import { FirestoreDocs } from './firestoreDocs';
 /** Public alias of the shared `StructuredLogger` — keeps the domain surface name-stable. */
 export type CollectionLogger = StructuredLogger;
 /** Re-exported so collection-engine callers (the watcher, the reconciler) keep
@@ -12,6 +14,10 @@ export { canonicalRoot };
  *  watcher is already running — and a host catching both in one place should
  *  not have to match on message text to tell them apart. */
 export declare const COLLECTION_ROOT_REQUIRED = "COLLECTION_ROOT_REQUIRED";
+/** Build a local {@link CollectionKey}, canonicalising the root. The identity
+ *  type itself is isomorphic and cannot canonicalise (that needs `node:path`),
+ *  so this is the constructor server code should use. */
+export declare const localCollectionKey: (root: string, slug: string) => CollectionKey;
 /** INVARIANT — **a slug is unique within a root and nowhere else.**
  *
  *  A collection's identity is `(root, slug)`. Anything keyed by slug ALONE —
@@ -91,30 +97,91 @@ export interface CollectionHost {
     /** True for a preset-skill slug (host-owned naming convention). */
     isPresetSlug: (slug: string) => boolean;
 }
+/** The authenticated Firestore access a shared collection is served through.
+ *
+ *  It carries NO uid, and that is a decision rather than an omission. Nothing
+ *  about a shared collection is keyed by uid any more: the documents live at
+ *  `apps/{aid}/collections/{cid}/items`, and the deployed rules authorize on
+ *  `request.auth.token.email` against the app's member roster. A uid kept
+ *  "just for identity" would be a value nothing checks, sitting next to a path
+ *  it no longer determines — which is how a later reader ends up deriving a
+ *  path from it again.
+ *
+ *  `email` is what the rules actually evaluate, so it is what makes a refusal
+ *  explainable: `permission-denied` is the most common failure a shared
+ *  collection has and the least informative, and naming the principal turns it
+ *  into "signed in as a@b — this app's roster may not list you". A session with
+ *  no verified email is NOT a session here (the accessor answers null): public
+ *  anonymous submission is a visitor's path through the published web app, not
+ *  the host's.
+ *
+ *  `docs` is the narrow document interface rather than a raw `Firestore` so the
+ *  backend stays testable: core ships `createFirestoreDocs` over the real SDK
+ *  (`firestoreDocs.ts`) and tests inject an in-memory fake. */
+export interface FirestoreHandle {
+    docs: FirestoreDocs;
+    email: string;
+}
 /** A collection's records changed on disk. Carries the `slug` so the host can
  *  publish on a per-collection channel; `ids` lists the affected record ids
  *  when known (a consumer may ignore them and refetch the whole collection),
  *  and `op` is advisory. Deliberately carries NO record bodies — this is a
  *  "refetch" ping, not a data feed, so it stays cheap and leaks nothing when a
  *  host relays it into an opaque-origin custom-view iframe. */
-export interface CollectionChangePayload {
+/** Fields every change carries, whatever kind of collection it is about. */
+interface CollectionChangeBase {
+    /** The collection's NAME in its scope: the slug, or a shared collection's
+     *  `cid`. Never an identity on its own — see the two arms below. */
     slug: string;
+    ids?: string[];
+    op?: "upsert" | "delete";
+}
+/** A change to a collection in a directory. */
+export interface LocalCollectionChange extends CollectionChangeBase {
     /** Absolute workspace/project root the change happened under. Present only
-     *  when the engine call carried an explicit `workspaceRoot`; absent means
-     *  the host's configured root, so a single-workspace host never sets it.
+     *  when the engine call carried an explicit `workspaceRoot`; absent means the
+     *  host's configured root, so a single-workspace host never sets it.
      *  A multi-root host MUST key its live-update fan-out on `(root, slug)` —
-     *  two projects each owning a `tasks` collection would otherwise refresh
-     *  each other's open views. */
+     *  two projects each owning a `tasks` collection would otherwise refresh each
+     *  other's open views. */
     root?: string;
-    ids?: string[];
-    op?: "upsert" | "delete";
+    /** Never on a local change. The two arms are mutually exclusive at the TYPE
+     *  level, not by convention: a payload carrying both would be read as shared
+     *  by `collectionChangeKey`, which drops the root and fans the update out on
+     *  the wrong channel. */
+    aid?: never;
 }
+/** A change to a collection published to a shared app. */
+export interface SharedCollectionChange extends CollectionChangeBase {
+    /** The shared app (`apps/{aid}/collections/{cid}`). Required on this arm:
+     *  it is what makes the payload an identity. */
+    aid: string;
+    /** Never on a shared change — a shared collection has no root, because the
+     *  same collection is resolved from every clone of the repository. */
+    root?: never;
+}
+/** A collection's records changed. Carries the `slug` so the host can publish
+ *  on a per-collection channel; `ids` lists the affected record ids when known
+ *  (a consumer may ignore them and refetch the whole collection), and `op` is
+ *  advisory. Deliberately carries NO record bodies — this is a "refetch" ping,
+ *  not a data feed, so it stays cheap and leaks nothing when a host relays it
+ *  into an opaque-origin custom-view iframe.
+ *
+ *  Reading a payload is unchanged: `slug`, `root`, `ids` and `op` are all
+ *  reachable on the union. Use {@link collectionChangeKey} rather than deciding
+ *  what an absent field means by hand. */
+export type CollectionChangePayload = LocalCollectionChange | SharedCollectionChange;
 type CollectionChangePublisher = (payload: CollectionChangePayload) => void;
 /** Build a change payload, attaching `root` only when the engine call carried
  *  an explicit one. Centralised so every publish site states the root the same
  *  way, and so a single-workspace host's payload shape stays byte-identical to
  *  what it saw before multi-root support. */
-export declare function collectionChangePayload(base: Omit<CollectionChangePayload, "root">, root: string | undefined): CollectionChangePayload;
+export declare function collectionChangePayload(base: CollectionChangeBase, root: string | undefined): LocalCollectionChange;
+/** Build a change payload for a SHARED collection. `slug` carries the `cid`,
+ *  which is what it is called inside its app; `aid` is what makes it an
+ *  identity. Never stamps a `root` — a shared collection does not have one. */
+export declare function sharedCollectionChangePayload(base: CollectionChangeBase, aid: string): SharedCollectionChange;
+export declare function collectionChangeKey(payload: CollectionChangePayload, fallbackRoot: string): CollectionKey;
 /** Wire the engine to a host. Call once at server startup, before any
  *  collection storage operation. Re-binding to a *different* host throws —
  *  silently redirecting later filesystem operations to another workspace
@@ -132,6 +199,21 @@ export declare function setCollectionChangePublisher(publish: CollectionChangePu
  *  expected to be fire-and-forget (it wraps its own pubsub call in try/catch),
  *  so this stays a thin pass-through and never throws into the write. */
 export declare function publishCollectionChange(payload: CollectionChangePayload): void;
+/** Wire the accessor for the host's authenticated Firestore session.
+ *
+ *  Separate from `configureCollectionHost` for the same reason
+ *  `setCollectionChangePublisher` is: the host binding is set at the top of
+ *  server startup, but this session doesn't exist until the user connects
+ *  remote-host (and closes again on disconnect), so it cannot be part of a
+ *  one-shot binding. Optional — left unwired, only shared collections are
+ *  affected, and they report "not connected". Pass `null` to detach. */
+export declare function setFirestoreAccessor(accessor: (() => FirestoreHandle | null) | null): void;
+/** The host's live Firestore access, or null when there is no session (or the
+ *  host never wired one — every non-shared backend leaves it unset).
+ *  Callers MUST surface null as an actionable "connect remote-host first",
+ *  never as an empty result: silence would be indistinguishable from a
+ *  collection that genuinely has no records. */
+export declare function firestoreHandle(): FirestoreHandle | null;
 /** The configured workspace root. Throws if the host never configured one —
  *  and, under an explicit-root binding (`workspaceRoot: null`), throws rather
  *  than guessing, which is the whole point of that mode: on a multi-root host

package/dist/collection/server/index.cjs

@@ -1,9 +1,10 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_root = require("../../root-rPH6FGDT.cjs");
-const require_calendarGrid = require("../../calendarGrid-p8K-7cuB.cjs");
-const require_discovery = require("../../discovery-CrA_EqUJ.cjs");
+const require_calendarGrid = require("../../calendarGrid-DGILaVxI.cjs");
+const require_discovery = require("../../discovery-Cw5xWzZD.cjs");
 const require_templatePath = require("../../templatePath-27vUZowm.cjs");
-const require_server = require("../../server-CorfPQVQ.cjs");
+const require_server = require("../../server-9mFaGLdq.cjs");
+exports.APP_MANIFEST_FILE = require_discovery.APP_MANIFEST_FILE;
 exports.BackendUnavailableError = require_discovery.BackendUnavailableError;
 exports.COLLECTION_ROOT_REQUIRED = require_discovery.COLLECTION_ROOT_REQUIRED;
 exports.COMPUTED_TYPES = require_calendarGrid.COMPUTED_TYPES;
@@ -17,11 +18,13 @@ exports.MAX_UNSELECTIVE_ITEMS = require_server.MAX_UNSELECTIVE_ITEMS;
 exports.SCHEMA_FILE = require_discovery.SCHEMA_FILE;
 exports.acceptParsedSchema = require_discovery.acceptParsedSchema;
 exports.advanceTriggerDate = require_server.advanceTriggerDate;
+exports.appManifestReason = require_discovery.appManifestReason;
 exports.applyMutateAction = require_server.applyMutateAction;
 exports.buildActionSeedPrompt = require_server.buildActionSeedPrompt;
 exports.buildCollectionActionSeedPrompt = require_server.buildCollectionActionSeedPrompt;
 exports.buildWorkspaceOntology = require_server.buildWorkspaceOntology;
 exports.canonicalRoot = require_root.canonicalRoot;
+exports.collectionChangeKey = require_discovery.collectionChangeKey;
 exports.collectionChangePayload = require_discovery.collectionChangePayload;
 exports.collectionWritable = require_discovery.collectionWritable;
 exports.compileCsvQuery = require_discovery.compileCsvQuery;
@@ -41,6 +44,7 @@ exports.deleteItem = require_discovery.deleteItem;
 exports.discoverCollections = require_discovery.discoverCollections;
 exports.encodeCsvRecordId = require_discovery.encodeCsvRecordId;
 exports.enrichItems = require_server.enrichItems;
+exports.firestoreHandle = require_discovery.firestoreHandle;
 exports.firstMutateParamProblem = require_server.firstMutateParamProblem;
 exports.formatCivil = require_server.formatCivil;
 exports.generateItemId = require_discovery.generateItemId;
@@ -55,12 +59,15 @@ exports.isSafeTemplatePath = require_templatePath.isSafeTemplatePath;
 exports.isTriggerDue = require_server.isTriggerDue;
 exports.itemFilePath = require_discovery.itemFilePath;
 exports.listItems = require_discovery.listItems;
+exports.loadAppManifest = require_discovery.loadAppManifest;
 exports.loadCollection = require_discovery.loadCollection;
+exports.localCollectionKey = require_discovery.localCollectionKey;
 exports.log = require_discovery.log;
 exports.makeManageCollectionTool = require_server.makeManageCollectionTool;
 exports.maybeSpawnSuccessor = require_server.maybeSpawnSuccessor;
 exports.normalizeCsvValue = require_discovery.normalizeCsvValue;
 exports.pageFromFullRead = require_discovery.pageFromFullRead;
+exports.parseAppManifest = require_discovery.parseAppManifest;
 exports.parseCivil = require_server.parseCivil;
 exports.peekWorkspaceRoot = require_discovery.peekWorkspaceRoot;
 exports.projectItemFields = require_discovery.projectItemFields;
@@ -83,6 +90,9 @@ exports.safeRecordId = require_discovery.safeRecordId;
 exports.safeSlugName = require_discovery.safeSlugName;
 exports.schemaRelations = require_server.schemaRelations;
 exports.setCollectionChangePublisher = require_discovery.setCollectionChangePublisher;
+exports.setFirestoreAccessor = require_discovery.setFirestoreAccessor;
+exports.sharedCollectionChangePayload = require_discovery.sharedCollectionChangePayload;
+exports.sharedItemsPath = require_discovery.sharedItemsPath;
 exports.storeFor = require_discovery.storeFor;
 exports.successorId = require_server.successorId;
 exports.toDetail = require_discovery.toDetail;

package/dist/collection/server/index.d.ts

@@ -1,4 +1,7 @@
-export { configureCollectionHost, canonicalRoot, getWorkspaceRoot, peekWorkspaceRoot, COLLECTION_ROOT_REQUIRED, log, setCollectionChangePublisher, publishCollectionChange, collectionChangePayload, type CollectionHost, type CollectionLogger, type CollectionChangePayload, } from './host';
+export { configureCollectionHost, canonicalRoot, getWorkspaceRoot, peekWorkspaceRoot, COLLECTION_ROOT_REQUIRED, log, setCollectionChangePublisher, publishCollectionChange, collectionChangePayload, sharedCollectionChangePayload, collectionChangeKey, localCollectionKey, type CollectionHost, type CollectionLogger, type CollectionChangePayload, firestoreHandle, setFirestoreAccessor, type FirestoreHandle, type LocalCollectionChange, type SharedCollectionChange, } from './host';
+export type { FirestoreDoc, FirestoreDocs } from './firestoreDocs';
+export { sharedItemsPath } from './firestoreStore';
+export { loadAppManifest, parseAppManifest, appManifestReason, APP_MANIFEST_FILE, type AppManifest, type AppManifestResult } from './appManifest';
 export type { LoadedCollection } from './discoveredCollection';
 export * from './paths';
 export * from './templatePath';

package/dist/collection/server/index.js

@@ -1,6 +1,6 @@
 import { t as canonicalRoot } from "../../root-BMroU_mB.js";
-import { S as COMPUTED_TYPES } from "../../calendarGrid-Csy2rpjp.js";
-import { A as deleteItem, B as resolveDataDir, C as compileCsvQuery, D as MAX_QUERY_ROWS, E as DEFAULT_QUERY_ROWS, F as resolveCreateItemId, H as safeRecordId, I as writeItem, J as configureCollectionHost, K as collectionChangePayload, L as SCHEMA_FILE, M as isRegularFile, N as listItems, O as BackendUnavailableError, P as readItem, Q as peekWorkspaceRoot, R as isContainedInRoot, T as CollectionQueryZ, U as safeSlugName, V as resolveTemplatePath, W as COLLECTION_ROOT_REQUIRED, Y as getWorkspaceRoot, Z as log, _ as csvRowToItem, a as toDetail, b as encodeCsvRecordId, d as storeFor, et as publishCollectionChange, h as MAX_CSV_ROWS, i as resolvePrimaryField, j as generateItemId, k as isBackendUnavailable, l as collectionWritable, m as projectItemFields, n as discoverCollections, o as toSummary, p as pageFromFullRead, r as loadCollection, s as CollectionSchemaZ, t as acceptParsedSchema, tt as setCollectionChangePublisher, u as readOnlyRefusal, v as decodeCsvRecordId, w as compileJsonlQuery, x as normalizeCsvValue, y as dedupeByRecordId, z as itemFilePath } from "../../discovery-D7LCN8gJ.js";
+import { j as COMPUTED_TYPES } from "../../calendarGrid-CQ8MVSRb.js";
+import { A as readItem, B as SCHEMA_FILE, C as CollectionQueryZ, D as generateItemId, E as deleteItem, F as loadAppManifest, G as safeRecordId, H as itemFilePath, I as parseAppManifest, J as isBackendUnavailable, K as safeSlugName, L as sharedItemsPath, M as writeItem, N as APP_MANIFEST_FILE, O as isRegularFile, P as appManifestReason, Q as collectionChangePayload, R as pageFromFullRead, S as compileJsonlQuery, T as MAX_QUERY_ROWS, U as resolveDataDir, V as isContainedInRoot, W as resolveTemplatePath, Y as COLLECTION_ROOT_REQUIRED, Z as collectionChangeKey, _ as dedupeByRecordId, a as toDetail, at as log, ct as publishCollectionChange, d as storeFor, dt as sharedCollectionChangePayload, et as configureCollectionHost, g as decodeCsvRecordId, h as csvRowToItem, i as resolvePrimaryField, it as localCollectionKey, j as resolveCreateItemId, k as listItems, l as collectionWritable, lt as setCollectionChangePublisher, n as discoverCollections, nt as getWorkspaceRoot, o as toSummary, ot as peekWorkspaceRoot, p as MAX_CSV_ROWS, q as BackendUnavailableError, r as loadCollection, s as CollectionSchemaZ, t as acceptParsedSchema, tt as firestoreHandle, u as readOnlyRefusal, ut as setFirestoreAccessor, v as encodeCsvRecordId, w as DEFAULT_QUERY_ROWS, x as compileCsvQuery, y as normalizeCsvValue, z as projectItemFields } from "../../discovery-CdkaURVY.js";
 import { i as isSafeTemplatePath, n as isSafeCustomViewI18nPath, r as isSafeCustomViewPath, t as isSafeActionTemplatePath } from "../../templatePath-k_WNbL_Q.js";
-import { A as buildCollectionActionSeedPrompt, C as validateRecordObject, D as enrichItems, E as runCollectionQuery, M as readCustomViewHtml, N as readCustomViewI18n, O as runQueryOverRows, P as readSkillTemplate, S as validateCollectionRecords, T as recordFieldProblem, _ as computeCollectionIcon, a as deleteCollection, b as applyMutateAction, c as computeSuccessor, d as isTriggerDue, f as maybeSpawnSuccessor, h as successorId, i as deleteCustomView, j as promptPathsFor, k as buildActionSeedPrompt, l as daysInMonth, m as resolveEvery, n as MAX_UNSELECTIVE_ITEMS, o as deleteCollectionRefusalMessage, p as parseCivil, r as makeManageCollectionTool, s as advanceTriggerDate, t as MAX_SCHEMA_ISSUES, u as formatCivil, v as buildWorkspaceOntology, w as compileRecordZ, x as firstMutateParamProblem, y as schemaRelations } from "../../server-D6QY853r.js";
-export { BackendUnavailableError, COLLECTION_ROOT_REQUIRED, COMPUTED_TYPES, CollectionQueryZ, CollectionSchemaZ, DEFAULT_QUERY_ROWS, MAX_CSV_ROWS, MAX_QUERY_ROWS, MAX_SCHEMA_ISSUES, MAX_UNSELECTIVE_ITEMS, SCHEMA_FILE, acceptParsedSchema, advanceTriggerDate, applyMutateAction, buildActionSeedPrompt, buildCollectionActionSeedPrompt, buildWorkspaceOntology, canonicalRoot, collectionChangePayload, collectionWritable, compileCsvQuery, compileJsonlQuery, compileRecordZ, computeCollectionIcon, computeSuccessor, configureCollectionHost, csvRowToItem, daysInMonth, decodeCsvRecordId, dedupeByRecordId, deleteCollection, deleteCollectionRefusalMessage, deleteCustomView, deleteItem, discoverCollections, encodeCsvRecordId, enrichItems, firstMutateParamProblem, formatCivil, generateItemId, getWorkspaceRoot, isBackendUnavailable, isContainedInRoot, isRegularFile, isSafeActionTemplatePath, isSafeCustomViewI18nPath, isSafeCustomViewPath, isSafeTemplatePath, isTriggerDue, itemFilePath, listItems, loadCollection, log, makeManageCollectionTool, maybeSpawnSuccessor, normalizeCsvValue, pageFromFullRead, parseCivil, peekWorkspaceRoot, projectItemFields, promptPathsFor, publishCollectionChange, readCustomViewHtml, readCustomViewI18n, readItem, readOnlyRefusal, readSkillTemplate, recordFieldProblem, resolveCreateItemId, resolveDataDir, resolveEvery, resolvePrimaryField, resolveTemplatePath, runCollectionQuery, runQueryOverRows, safeRecordId, safeSlugName, schemaRelations, setCollectionChangePublisher, storeFor, successorId, toDetail, toSummary, validateCollectionRecords, validateRecordObject, writeItem };
+import { A as buildCollectionActionSeedPrompt, C as validateRecordObject, D as enrichItems, E as runCollectionQuery, M as readCustomViewHtml, N as readCustomViewI18n, O as runQueryOverRows, P as readSkillTemplate, S as validateCollectionRecords, T as recordFieldProblem, _ as computeCollectionIcon, a as deleteCollection, b as applyMutateAction, c as computeSuccessor, d as isTriggerDue, f as maybeSpawnSuccessor, h as successorId, i as deleteCustomView, j as promptPathsFor, k as buildActionSeedPrompt, l as daysInMonth, m as resolveEvery, n as MAX_UNSELECTIVE_ITEMS, o as deleteCollectionRefusalMessage, p as parseCivil, r as makeManageCollectionTool, s as advanceTriggerDate, t as MAX_SCHEMA_ISSUES, u as formatCivil, v as buildWorkspaceOntology, w as compileRecordZ, x as firstMutateParamProblem, y as schemaRelations } from "../../server-DdHaX_Uu.js";
+export { APP_MANIFEST_FILE, BackendUnavailableError, COLLECTION_ROOT_REQUIRED, COMPUTED_TYPES, CollectionQueryZ, CollectionSchemaZ, DEFAULT_QUERY_ROWS, MAX_CSV_ROWS, MAX_QUERY_ROWS, MAX_SCHEMA_ISSUES, MAX_UNSELECTIVE_ITEMS, SCHEMA_FILE, acceptParsedSchema, advanceTriggerDate, appManifestReason, applyMutateAction, buildActionSeedPrompt, buildCollectionActionSeedPrompt, buildWorkspaceOntology, canonicalRoot, collectionChangeKey, collectionChangePayload, collectionWritable, compileCsvQuery, compileJsonlQuery, compileRecordZ, computeCollectionIcon, computeSuccessor, configureCollectionHost, csvRowToItem, daysInMonth, decodeCsvRecordId, dedupeByRecordId, deleteCollection, deleteCollectionRefusalMessage, deleteCustomView, deleteItem, discoverCollections, encodeCsvRecordId, enrichItems, firestoreHandle, firstMutateParamProblem, formatCivil, generateItemId, getWorkspaceRoot, isBackendUnavailable, isContainedInRoot, isRegularFile, isSafeActionTemplatePath, isSafeCustomViewI18nPath, isSafeCustomViewPath, isSafeTemplatePath, isTriggerDue, itemFilePath, listItems, loadAppManifest, loadCollection, localCollectionKey, log, makeManageCollectionTool, maybeSpawnSuccessor, normalizeCsvValue, pageFromFullRead, parseAppManifest, parseCivil, peekWorkspaceRoot, projectItemFields, promptPathsFor, publishCollectionChange, readCustomViewHtml, readCustomViewI18n, readItem, readOnlyRefusal, readSkillTemplate, recordFieldProblem, resolveCreateItemId, resolveDataDir, resolveEvery, resolvePrimaryField, resolveTemplatePath, runCollectionQuery, runQueryOverRows, safeRecordId, safeSlugName, schemaRelations, setCollectionChangePublisher, setFirestoreAccessor, sharedCollectionChangePayload, sharedItemsPath, storeFor, successorId, toDetail, toSummary, validateCollectionRecords, validateRecordObject, writeItem };

package/dist/collection-watchers/index.cjs

@@ -1,10 +1,10 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_root = require("../root-rPH6FGDT.cjs");
-const require_calendarGrid = require("../calendarGrid-p8K-7cuB.cjs");
-const require_promptSafety = require("../promptSafety-CNEW3_qS.cjs");
+const require_calendarGrid = require("../calendarGrid-DGILaVxI.cjs");
+const require_promptSafety = require("../promptSafety-NNGViiCr.cjs");
 require("../collection/index.cjs");
-const require_discovery = require("../discovery-CrA_EqUJ.cjs");
-const require_server = require("../server-CorfPQVQ.cjs");
+const require_discovery = require("../discovery-Cw5xWzZD.cjs");
+const require_server = require("../server-9mFaGLdq.cjs");
 const require_notifier = require("../notifier-DZJj0sOh.cjs");
 let node_fs_promises = require("node:fs/promises");
 //#region src/collection-watchers/config.ts
@@ -55,6 +55,12 @@ var LEGACY_ID_PREFIX = "collection-completion:";
 *  so the split is unambiguous. */
 var ROOT_MARK = "@";
 var ROOT_SEP = "\0";
+/** Marks a key that belongs to a SHARED collection (`apps/{aid}/collections/
+*  {cid}`) rather than to a directory: `<prefix>#<aid>\0<cid>:<itemId>`. A
+*  shared collection has no root, and its `cid` may well be the slug some
+*  project already owns, so it needs a mark of its own — reusing the rootless
+*  form would make the two dedupe into one bell. */
+var SHARED_MARK = "#";
 /** Stable key encoding (root, slug, item), round-tripped through the entry's
 *  `pluginData` so we can find it later without a side state file. Slug +
 *  itemId are upstream-validated via `safeSlugName`, which forbids the
@@ -76,21 +82,31 @@ var ROOT_SEP = "\0";
 *  this id is written to disk: a caller reaching `reconcileItem` directly with
 *  `/proj/` where the watcher used `/proj` would otherwise publish a SECOND
 *  bell for the same record, and neither pass would ever clear the other's. */
-function completionLegacyId(slug, itemId, root) {
-	return `${LEGACY_ID_PREFIX}${root === void 0 ? "" : `${ROOT_MARK}${require_root.canonicalRoot(root)}${ROOT_SEP}`}${slug}:${itemId}`;
+/** Exported for the format pin in `test/collection-watchers/test_completionId.ts`.
+*  Deliberately NOT on the package barrel: the id is a disk format, not an API. */
+function completionLegacyId(slug, itemId, root, aid) {
+	if (root !== void 0 && aid !== void 0) throw new Error(`completionLegacyId: "${slug}" carries both a root (${root}) and an app (${aid})`);
+	if (!require_calendarGrid.isValidCollectionName(slug)) throw new Error(`completionLegacyId: collection name "${slug}" is not a valid collection name`);
+	if (aid !== void 0 && !require_calendarGrid.isValidCollectionName(aid)) throw new Error(`completionLegacyId: app id "${aid}" is not a valid collection name`);
+	return `${LEGACY_ID_PREFIX}${aid !== void 0 ? `${SHARED_MARK}${aid}${ROOT_SEP}` : root === void 0 ? "" : `${ROOT_MARK}${require_root.canonicalRoot(root)}${ROOT_SEP}`}${slug}:${itemId}`;
 }
 /** Decode a key back into its (root, slug, itemId), or null if the string
 *  didn't originate from this module. Accepts both the rooted and the
 *  original root-less form — see the compatibility rule above. Used by the
 *  sweep step. */
+/** @see completionLegacyId — exported for the same reason. */
 function parseCompletionLegacyId(legacyId) {
 	if (!legacyId.startsWith(LEGACY_ID_PREFIX)) return null;
 	let body = legacyId.slice(22);
 	let root;
-	if (body.startsWith(ROOT_MARK)) {
+	let aid;
+	if (body.startsWith(ROOT_MARK) || body.startsWith(SHARED_MARK)) {
+		const shared = body.startsWith(SHARED_MARK);
 		const sep = body.indexOf(ROOT_SEP);
 		if (sep < 0) return null;
-		root = body.slice(1, sep);
+		const scope = body.slice(1, sep);
+		if (shared) aid = scope;
+		else root = require_root.canonicalRoot(scope);
 		body = body.slice(sep + 1);
 	}
 	const colon = body.indexOf(":");
@@ -99,6 +115,10 @@ function parseCompletionLegacyId(legacyId) {
 		slug: body.slice(0, colon),
 		itemId: body.slice(colon + 1)
 	};
+	if (aid !== void 0) return {
+		aid,
+		...parsed
+	};
 	return root === void 0 ? parsed : {
 		root,
 		...parsed
@@ -113,16 +133,28 @@ function resolveDisplayLabel(schema, item, itemId) {
 	const label = require_calendarGrid.fieldText(item[displayField]).trim();
 	return label.length > 0 ? label : itemId;
 }
+/** The scope a collection's bells belong to.
+*
+*  A shared collection's `appId` wins over the call's `workspaceRoot`: the
+*  root is where this host happens to have the repository checked out, which
+*  is exactly the fact that must NOT reach the identity. A local collection is
+*  unchanged — its root is present only when the call carried an explicit one,
+*  so a single-workspace host's ids stay byte-identical to what it has already
+*  written to `active.json`. */
+function bellScopeOf(collection, ioOpts) {
+	return collection.appId === void 0 ? { root: ioOpts.workspaceRoot } : { aid: collection.appId };
+}
+var scopedLegacyId = (slug, itemId, scope) => completionLegacyId(slug, itemId, scope.root, scope.aid);
 /** Every active bell entry whose key matches this (slug, itemId).
 *  Returns multiple when defensive cleanup is needed. Scans `listAll()`
 *  — cheap because the active set is bounded. */
-async function findActiveEntries(slug, itemId, root) {
+async function findActiveEntries(slug, itemId, scope) {
 	const adapter = requireAdapter();
-	const legacyId = completionLegacyId(slug, itemId, root);
+	const legacyId = scopedLegacyId(slug, itemId, scope);
 	return (await require_notifier.listAll()).filter((entry) => adapter.readEntry(entry.pluginData)?.legacyId === legacyId);
 }
-async function findActiveEntryIds(slug, itemId, root) {
-	return (await findActiveEntries(slug, itemId, root)).map((entry) => entry.id);
+async function findActiveEntryIds(slug, itemId, scope) {
+	return (await findActiveEntries(slug, itemId, scope)).map((entry) => entry.id);
 }
 var ensureLocks = /* @__PURE__ */ new Map();
 /** Bell priority for a record: the FIRST flagged value in `notifyWhen.in`
@@ -135,8 +167,8 @@ function notifyPriorityForItem(schema, item) {
 	const value = item[spec.field] === void 0 || item[spec.field] === null ? "" : String(item[spec.field]);
 	return spec.in.indexOf(value) === 0 ? "high" : "normal";
 }
-async function ensureItemNotification(slug, schema, itemId, displayLabel, priority, root) {
-	const legacyId = completionLegacyId(slug, itemId, root);
+async function ensureItemNotification(slug, schema, itemId, displayLabel, priority, scope) {
+	const legacyId = scopedLegacyId(slug, itemId, scope);
 	while (true) {
 		const inflight = ensureLocks.get(legacyId);
 		if (!inflight) break;
@@ -149,7 +181,7 @@ async function ensureItemNotification(slug, schema, itemId, displayLabel, priori
 		legacyId,
 		displayLabel,
 		priority,
-		root
+		scope
 	}) };
 	ensureLocks.set(legacyId, lock);
 	try {
@@ -162,8 +194,9 @@ async function ensureItemNotification(slug, schema, itemId, displayLabel, priori
 *  place (preserving id / position / createdAt) so a record whose flagged
 *  value changed while it stayed pending re-colours the bell without a
 *  clear+republish flicker. No-op when the stored priority already matches. */
-async function reconcileEntrySeverity(slug, itemId, entries, priority, root) {
+async function reconcileEntrySeverity(slug, itemId, entries, priority, scope) {
 	const adapter = requireAdapter();
+	const { root } = scope;
 	for (const entry of entries) {
 		const parsed = adapter.readEntry(entry.pluginData);
 		if (!parsed || parsed.priority === priority) continue;
@@ -180,12 +213,13 @@ async function reconcileEntrySeverity(slug, itemId, entries, priority, root) {
 		});
 	}
 }
-async function doEnsureItemNotification({ slug, schema, itemId, legacyId, displayLabel, priority, root }) {
+async function doEnsureItemNotification({ slug, schema, itemId, legacyId, displayLabel, priority, scope }) {
 	const adapter = requireAdapter();
+	const { root } = scope;
 	try {
-		const existing = await findActiveEntries(slug, itemId, root);
+		const existing = await findActiveEntries(slug, itemId, scope);
 		if (existing.length > 0) {
-			await reconcileEntrySeverity(slug, itemId, existing, priority, root);
+			await reconcileEntrySeverity(slug, itemId, existing, priority, scope);
 			return;
 		}
 		const navigateTarget = adapter.buildNavigateTarget(slug, itemId, root);
@@ -215,9 +249,18 @@ async function doEnsureItemNotification({ slug, schema, itemId, legacyId, displa
 /** Idempotently clear EVERY bell entry that matches this (slug, itemId).
 *  Silent no-op when nothing matches. The "every" is defensive: if a
 *  duplicate ever slips through, this drains the lot. */
-async function clearItemNotification(slug, itemId, root) {
+async function clearItemNotification(slug, itemId, root, aid) {
+	await clearScoped(slug, itemId, {
+		root,
+		aid
+	});
+}
+/** The scoped form every internal caller uses. `clearItemNotification` keeps
+*  its positional `(slug, itemId, root?)` shape because it is public API
+*  (MulmoTerminal calls it); `aid` is additive. */
+async function clearScoped(slug, itemId, scope) {
 	try {
-		const ids = await findActiveEntryIds(slug, itemId, root);
+		const ids = await findActiveEntryIds(slug, itemId, scope);
 		for (const entryId of ids) await require_notifier.clear(entryId);
 	} catch (err) {
 		log().warn("notify clear failed", {
@@ -237,19 +280,19 @@ async function clearItemNotification(slug, itemId, root) {
 *  `{ workspaceRoot: <tmpdir> }` so the check accepts a fixture dataDir. */
 async function reconcileItem(collection, itemId, ioOpts = {}, now = evalNow()) {
 	const { slug, schema } = collection;
-	const root = ioOpts.workspaceRoot;
+	const scope = bellScopeOf(collection, ioOpts);
 	if (!schema.completionField) {
-		await clearItemNotification(slug, itemId, root);
+		await clearScoped(slug, itemId, scope);
 		return;
 	}
 	const item = await require_discovery.storeFor(collection, ioOpts).read(itemId);
 	if (item === null) {
-		await clearItemNotification(slug, itemId, root);
+		await clearScoped(slug, itemId, scope);
 		return;
 	}
 	await require_server.maybeSpawnSuccessor(collection, item, itemId, ioOpts);
 	if (require_promptSafety.itemIsDone(schema, item)) {
-		await clearItemNotification(slug, itemId, root);
+		await clearScoped(slug, itemId, scope);
 		return;
 	}
 	if (schema.triggerField) {
@@ -261,15 +304,15 @@ async function reconcileItem(collection, itemId, ioOpts = {}, now = evalNow()) {
 			triggerField: schema.triggerField
 		});
 		if (due !== true) {
-			await clearItemNotification(slug, itemId, root);
+			await clearScoped(slug, itemId, scope);
 			return;
 		}
 	}
 	if (!require_promptSafety.whenMatches(schema.notifyWhen, item)) {
-		await clearItemNotification(slug, itemId, root);
+		await clearScoped(slug, itemId, scope);
 		return;
 	}
-	await ensureItemNotification(slug, schema, itemId, resolveDisplayLabel(schema, item, itemId), notifyPriorityForItem(schema, item), root);
+	await ensureItemNotification(slug, schema, itemId, resolveDisplayLabel(schema, item, itemId), notifyPriorityForItem(schema, item), scope);
 }
 /** Boot-time reconcile: walk every record of the collection once (through
 *  its store) and reconcile it. Catches up changes that happened while the
@@ -314,9 +357,10 @@ async function reconcileAllItems(collection, ioOpts = {}, now = evalNow()) {
 *    on produces a root-less id, so skipping it would strand a bell no pass can
 *    ever clear, while the reconcile publishes a second rooted one beside it.
 *    Clearing converges — the record republishes rooted if still pending. */
-function sweepVerdict(entryRoot, ownRoot) {
-	if (entryRoot === ownRoot) return "mine";
-	if (entryRoot === void 0) return "drop-legacy";
+function sweepVerdict(entry, ownRoot) {
+	if (entry.aid !== void 0) return "shared";
+	if (entry.root === ownRoot) return "mine";
+	if (entry.root === void 0) return "drop-legacy";
 	return "skip";
 }
 /** Should this entry's bell be dropped? True when the collection is gone, no
@@ -324,12 +368,40 @@ function sweepVerdict(entryRoot, ownRoot) {
 *  `notifyWhen`. The reverse of the reconcile invariant, applied to an entry
 *  whose record the forward pass can never walk to (a delete leaves a bell that
 *  a walk over the SURVIVING records cannot clear). */
-async function isStaleEntry(slug, itemId, opts) {
+async function isStaleEntry(slug, itemId, opts, aid) {
 	const collection = await require_discovery.loadCollection(slug, opts);
+	if (aid !== void 0 && collection?.appId !== aid) return false;
 	if (!collection || !collection.schema.completionField) return true;
+	return recordNoLongerBells(collection, itemId, opts);
+}
+/** The record half of the staleness question: gone, done, or outside
+*  `notifyWhen`. Split out so the caller stays one decision — WHOSE entry this
+*  is — and this one stays the other. */
+async function recordNoLongerBells(collection, itemId, opts) {
 	const item = await require_discovery.storeFor(collection, opts).read(itemId);
 	return item === null || require_promptSafety.itemIsDone(collection.schema, item) || !require_promptSafety.whenMatches(collection.schema.notifyWhen, item);
 }
+/** One entry's fate: whose it is (`sweepVerdict`), then — when it is this
+*  sweep's to judge — whether its record still justifies the bell. Extracted so
+*  the loop above stays a walk and this stays the decision. */
+async function sweepOneEntry(entryId, parsed, ownRoot, opts) {
+	const verdict = sweepVerdict(parsed, ownRoot);
+	if (verdict === "skip") return;
+	if (verdict === "drop-legacy") {
+		await require_notifier.clear(entryId);
+		return;
+	}
+	const { slug, itemId } = parsed;
+	try {
+		if (await isStaleEntry(slug, itemId, opts, verdict === "shared" ? parsed.aid : void 0)) await require_notifier.clear(entryId);
+	} catch (err) {
+		log().warn("sweep entry failed", {
+			slug,
+			itemId,
+			error: errMsg(err)
+		});
+	}
+}
 async function sweepStaleActiveEntries(opts = {}) {
 	const adapter = requireAdapter();
 	let entries;
@@ -345,22 +417,7 @@ async function sweepStaleActiveEntries(opts = {}) {
 		if (!own) continue;
 		const parsed = parseCompletionLegacyId(own.legacyId);
 		if (!parsed) continue;
-		const verdict = sweepVerdict(parsed.root, ownRoot);
-		if (verdict === "skip") continue;
-		if (verdict === "drop-legacy") {
-			await require_notifier.clear(entry.id);
-			continue;
-		}
-		const { slug, itemId } = parsed;
-		try {
-			if (await isStaleEntry(slug, itemId, opts)) await require_notifier.clear(entry.id);
-		} catch (err) {
-			log().warn("sweep entry failed", {
-				slug,
-				itemId,
-				error: errMsg(err)
-			});
-		}
+		await sweepOneEntry(entry.id, parsed, ownRoot, opts);
 	}
 }
 /** Test-only: clear the per-key in-flight locks. */
@@ -570,9 +627,58 @@ async function _tickTimeTriggersForTesting(now, workspaceRoot) {
 async function tickTimeTriggers(gen, now = evalNow()) {
 	for (const entry of gen.watchers.values()) {
 		const { schema } = entry.collection;
+		if (cannotReportChanges(gen, entry.collection)) continue;
 		if (!schema.triggerField && !schema.spawn) continue;
 		await reconcileAllItems(entry.collection, gen.discoveryOpts, now);
 	}
+	await tickUnwatchedCollections(gen, now);
+}
+/** True when the collection's store implements no `watch` — nothing will ever
+*  tell this module its records moved, so the clock tick is its only change
+*  detection. A capability question, deliberately not a backend one: the day a
+*  shared collection's store grows an `onSnapshot` watch, it stops being
+*  special here with no edit to this file. */
+function cannotReportChanges(gen, collection) {
+	return require_discovery.storeFor(collection, gen.discoveryOpts).watch === void 0;
+}
+/** True when a schema declares behaviour that only a reconcile pass can
+*  produce: bells (`completionField`), date-triggered bells (`triggerField`),
+*  or recurrence successors (`spawn`). */
+function needsReconcilePass(schema) {
+	return Boolean(schema.completionField ?? schema.triggerField ?? schema.spawn);
+}
+/** One unwatched collection's reconcile pass. Extracted so the single-flight
+*  callback doesn't close over loop state.
+*
+*  `reconcileAllItems` already swallows a failing store read (it logs and
+*  returns), so a closed session or a denied rule surfaces there, not as a
+*  rejection here. This catch is only for the unexpected — it must not let one
+*  collection's fault abort the rest of the tick. */
+async function reconcileUnwatched(gen, collection, now) {
+	try {
+		await runSingleFlight(gen.collectionSlots, collection.slug, () => reconcileAllItems(collection, gen.discoveryOpts, now));
+	} catch (err) {
+		log().warn("unwatched collection reconcile failed", {
+			slug: collection.slug,
+			error: errMsg(err)
+		});
+	}
+}
+/** Stand in for the store-change path (2) on backends that don't have one.
+*
+*  Gated on `needsReconcilePass` so a collection declaring none of it costs
+*  nothing: unlike the local backends, every pass here is a network round trip.
+*
+*  A collection that DROPS OUT of eligibility (its `completionField` edited
+*  away, or the collection removed) is not this pass's problem — `syncWatchers`
+*  already sweeps on a changed schema and on a vanished slug, and the sweep is
+*  what clears bells the declaration no longer justifies. */
+async function tickUnwatchedCollections(gen, now) {
+	if (require_discovery.firestoreHandle() === null) return;
+	const pending = [...gen.watchers.values()].map((entry) => entry.collection).filter((collection) => cannotReportChanges(gen, collection) && needsReconcilePass(collection.schema));
+	if (pending.length === 0) return;
+	for (const collection of pending) await reconcileUnwatched(gen, collection, now);
+	await sweepStaleActiveEntries(gen.discoveryOpts);
 }
 /** Reconcile the watcher set against the currently-discovered
 *  collections. Adds watchers for new slugs (with a boot reconcile of
@@ -613,7 +719,13 @@ function stopVanishedWatchers(gen, liveSlugs) {
 *  modes. The mounted fs.watch is bound to the OLD location, so it must
 *  be remounted, not just re-reconciled. */
 function storagePathChanged(previous, next) {
-	return previous.dataSource?.path !== next.dataSource?.path || previous.dataPath !== next.dataPath || previous.storage?.path !== next.storage?.path;
+	return previous.dataSource?.path !== next.dataSource?.path || previous.dataPath !== next.dataPath || previous.storage?.type !== next.storage?.type || storageFilePath(previous.storage) !== storageFilePath(next.storage);
+}
+/** The on-disk path of a storage backend, or undefined when it has none (a
+*  shared collection keeps its records off this filesystem, so there is no
+*  mount to move — only a `type` change matters for it). */
+function storageFilePath(storage) {
+	return storage?.type === "sqlite" ? storage.path : void 0;
 }
 /** Re-reconcile already-watched collections whose schema changed since
 *  the last tick. New collections fall through to `startNewWatchers`. */