@mulmoclaude/core 3.5.0 → 3.7.0

package/dist/{server-BiRLLMpW.js → server-B48Jyxcj.js}

@@ -1,15 +1,1054 @@
 import { a as isErrorWithCode, c as isStringArray, l as isUnknownArray, s as isRecord, t as errorMessage } from "./dist-D8zokgGo.js";
 import { n as writeFileAtomic } from "./root-BMroU_mB.js";
 import { n as toPosixRelPath } from "./relPath-DW8MC8VO.js";
-import { F as isFieldDrivenEvery, L as storageKindFor, P as embedTargetId, R as fieldText, j as COMPUTED_TYPES, l as parseIsoDate, u as parseIsoDateTime, z as fieldTextOrNull } from "./calendarGrid-CQ8MVSRb.js";
+import { F as isFieldDrivenEvery, L as storageKindFor, P as embedTargetId, R as fieldText, j as COMPUTED_TYPES, l as parseIsoDate, u as parseIsoDateTime, y as isValidCollectionName, z as fieldTextOrNull } from "./calendarGrid-CQ8MVSRb.js";
 import { C as actionVisible, _ as uniqueRefTargets, b as projectBacklinkRow, c as selectDynamicRecord, f as itemIsDone, g as uniqueEmbedTargets, h as uniqueBacklinkSources, i as ownProp, n as deriveAll, o as firstDateField, s as resolveIcon, t as defangForPrompt, v as backlinkRows, x as rollupValue, y as coerceNumeric } from "./promptSafety-CpiME8pj.js";
-import { $ as log, B as resolveDataDir, F as resolveCreateItemId, G as archiveDir, L as SCHEMA_FILE$1, M as isRegularFile, R as isContainedInRoot, S as queryCsv, T as CollectionQueryZ, U as safeSlugName, V as resolveTemplatePath, X as getWorkspaceRoot, Z as isPresetSlug$1, c as resolveMutateSet, d as storeFor, f as checkpointSqliteDatabase, g as cacheDir, i as resolvePrimaryField, k as isBackendUnavailable, n as discoverCollections, ot as stagingSkillDir, r as loadCollection, s as CollectionSchemaZ, u as readOnlyRefusal, w as compileJsonlQuery, x as normalizeCsvValue } from "./discovery-DH9wweuj.js";
+import { B as SCHEMA_FILE$1, C as resolveCreateItemId, D as loadCollection, E as discoverCollections, I as parseAppManifest, J as isBackendUnavailable, K as safeSlugName, M as resolveMutateSet, N as APP_MANIFEST_FILE, O as resolvePrimaryField, U as resolveDataDir, V as isContainedInRoot, W as resolveTemplatePath, X as archiveDir, at as log, b as isRegularFile, d as normalizeCsvValue, f as queryCsv, h as CollectionQueryZ, i as checkpointSqliteDatabase, j as CollectionSchemaZ, m as compileJsonlQuery, n as readOnlyRefusal, nt as getWorkspaceRoot, o as cacheDir, pt as stagingSkillDir, r as storeFor, rt as isPresetSlug$1, tt as firestoreHandle } from "./store-_61sO8K8.js";
 import { ingestStatePath } from "./feeds/paths.js";
 import { mirrorSkillWrite } from "./skill-bridge/index.js";
 import path from "node:path";
 import { randomBytes, randomUUID } from "node:crypto";
 import { cp, lstat, mkdir, open, readFile, readdir, rm, rmdir, stat, unlink, writeFile } from "node:fs/promises";
 import { z } from "zod";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+//#region src/collection/server/publishManifest.ts
+/** A collection id / app id, held to the one name rule (`SAFE_SLUG_PATTERN`)
+*  that `sharedCollectionKey` applies. Stated once so a path built later
+*  cannot be a way around it. */
+var NameZ = z.string().refine(isValidCollectionName, { message: "is not a valid id (letters, digits, '-' and '_' only)" });
+/** An address on the roster. Not validated as an email beyond "has an @":
+*  the rules compare it to `request.auth.token.email` verbatim, so any
+*  narrowing here would refuse addresses Firebase itself accepts. */
+var EmailZ = z.string().trim().min(3).includes("@");
+/** The four roles the deployed rules understand. `participant` is the layer
+*  that is NAMED but reads only its own rows — see `readerOf` vs `listedIn`. */
+var APP_ROLES = [
+	"owner",
+	"editor",
+	"viewer",
+	"participant"
+];
+var RoleZ = z.enum(APP_ROLES);
+/** `{ email: { "*" | cid: role } }`. The `"*"` key is the app-wide role; a
+*  member may hold per-collection roles only (the stylist who is editor of
+*  bookings and viewer of everything else). */
+var MembersZ = z.record(EmailZ, z.record(z.union([z.literal("*"), NameZ]), RoleZ));
+/** The declarative mail queue, as the rules re-derive it: a transition of the
+*  status field, a recipient read off the RECORD, and a fixed template. */
+var MailZ = z.object({
+	toField: z.string().trim().min(1),
+	on: z.record(z.string().trim().min(1), z.object({
+		from: z.array(z.string().trim().min(1)).min(1),
+		to: z.string().trim().min(1)
+	}).strict()),
+	dataFields: z.array(z.string().trim().min(1)).optional()
+}).strict();
+/** What the rules read out of `collections[cid]`. NOT the schema — the schema
+*  is published beside it, untouched, for clients to render from. */
+var CollectionConfigZ = z.object({
+	statusField: z.string().trim().min(1).optional(),
+	/** `{ initial: [...], <status>: [<status>...] }`. Binds writers too, and
+	*  binds `create` — that is the point of publishing it. */
+	transitions: z.record(z.string().trim().min(1), z.array(z.string().trim().min(1))).optional(),
+	immutable: z.boolean().optional(),
+	submitOnly: z.boolean().optional(),
+	peerVisibility: z.enum(["public", "hidden"]).optional(),
+	revealGated: z.boolean().optional(),
+	gatedFrom: NameZ.optional(),
+	revealBy: z.string().trim().min(1).optional(),
+	mail: MailZ.optional(),
+	/** Which fields an aggregate groups by. Declared here rather than in the
+	*  schema for the same reason as everything else in this file — the schema
+	*  has no `aggregate` key yet — and it is here at all because the
+	*  invariant that guards it ("every aggregation key is a CHECKED field")
+	*  is about `public.submit`, which is an app-level declaration. Published
+	*  as-is; the rules never read it. */
+	aggregate: z.object({ by: z.array(z.string().trim().min(1)).min(1) }).strict().optional()
+}).strict();
+/** An authored submit window. ISO strings, because `app.json` is JSON and a
+*  Firestore `Timestamp` has no JSON form. Publish lowers it to epoch millis —
+*  the rules do not coerce strings, so an ISO string reaching Firestore is a
+*  type error that fails CLOSED (`inWindow` refuses every submission and the
+*  author sees "nobody can submit", not an error). */
+var WindowZ = z.object({
+	from: z.iso.datetime().optional(),
+	until: z.iso.datetime().optional()
+}).strict();
+var ValidateZ = z.object({
+	required: z.array(z.string().trim().min(1)).optional(),
+	/** Capped at two by the rules themselves: rules have no iteration, so
+	*  `keyFieldsOk` is unrolled. A third would be accepted here and silently
+	*  unchecked there. */
+	keyFields: z.array(z.object({
+		field: z.string().trim().min(1),
+		values: z.array(z.union([
+			z.string(),
+			z.number(),
+			z.boolean()
+		])).min(1)
+	}).strict()).optional()
+}).strict();
+var SubmitZ = z.object({
+	auth: z.enum([
+		"none",
+		"anonymous",
+		"verifiedEmail"
+	]),
+	emailField: z.string().trim().min(1).optional(),
+	createFields: z.array(z.string().trim().min(1)).min(1),
+	initialStatus: z.string().trim().min(1).optional(),
+	idFrom: z.enum([
+		"auto",
+		"auth.uid",
+		"auth.uid+field"
+	]).optional(),
+	idField: z.string().trim().min(1).optional(),
+	validate: ValidateZ.optional(),
+	window: WindowZ.optional(),
+	/** Per CURRENT STATUS, never a flat list: a flat list lets a customer move
+	*  an approved booking's `startAt` without anyone re-approving it. */
+	selfUpdate: z.record(z.string().trim().min(1), z.array(z.string().trim().min(1))).optional(),
+	selfTransitions: z.record(z.string().trim().min(1), z.array(z.string().trim().min(1))).optional(),
+	finalize: z.boolean().optional(),
+	audience: z.literal("participant").optional(),
+	gateOn: z.object({
+		phase: z.string().trim().min(1),
+		match: z.string().trim().min(1)
+	}).strict().optional()
+}).strict();
+var PublicZ = z.object({
+	/** The master switch. Anonymous submission (`auth: "none"`) needs it as
+	*  well as its own declaration. */
+	enabled: z.boolean().optional(),
+	read: z.array(NameZ).optional(),
+	submit: z.record(NameZ, SubmitZ).optional()
+}).strict();
+/** The whole authored declaration.
+*
+*  `owner` is accepted but is NOT the published value — publish stamps the
+*  publisher's uid (or carries the existing one forward, which is what the
+*  rules require on update) and refuses a declaration that disagrees. It is
+*  accepted rather than banned because the sample app.json in the design note
+*  shows it, and a hard refusal on a key the samples contain would be a worse
+*  first experience than a message naming the mismatch. */
+var AuthoredAppZ = z.object({
+	aid: NameZ,
+	name: z.string().trim().min(1).optional(),
+	/** Per-worktree app id (design D6, implementation order 7). Accepted so a
+	*  repository already carrying it parses; nothing reads it yet. */
+	aidEnv: z.string().trim().min(1).optional(),
+	owner: z.string().trim().min(1).optional(),
+	members: MembersZ,
+	collections: z.record(NameZ, CollectionConfigZ).optional(),
+	participantRead: z.array(NameZ).optional(),
+	public: PublicZ.optional()
+}).strict();
+/** Parse the authored declaration out of `app.json`'s text.
+*
+*  Returns a LIST of problems rather than throwing, for the same reason
+*  `loadAppManifest` returns a failure: the caller is a gate whose entire job
+*  is to hand the author something to act on. Every problem is reported at
+*  once — publish is a manual step, and a parser that stops at the first key
+*  makes it N round trips. */
+function parseAuthoredApp(raw) {
+	const manifest = parseAppManifest(raw);
+	if (!manifest.ok) return {
+		ok: false,
+		problems: [manifest.kind === "missing" ? "app.json is missing" : manifest.detail]
+	};
+	const parsed = AuthoredAppZ.safeParse(JSON.parse(raw));
+	if (!parsed.success) return {
+		ok: false,
+		problems: authoredProblems(parsed.error)
+	};
+	return {
+		ok: true,
+		app: parsed.data
+	};
+}
+/** zod issues as one actionable line each: `public.submit.responses.auth: …`. */
+function authoredProblems(error) {
+	return error.issues.map((issue) => {
+		return `${issue.path.length > 0 ? issue.path.join(".") : "app.json"}: ${issue.message}`;
+	});
+}
+//#endregion
+//#region src/collection/server/publishProject.ts
+/** The document id under `apps/{aid}/config`. One document, named, rather than
+*  a spread of them: a second public document is a second thing to keep in
+*  step, and nothing yet needs one. */
+var PUBLIC_CONFIG_DOC = "public";
+/** Drop keys whose value is `undefined`. Firestore rejects an undefined field
+*  value outright, and `"k" in c` — which every optional key in the rules is
+*  read through — must mean "the author declared it". */
+function compact(entries) {
+	return Object.fromEntries(Object.entries(entries).filter(([, value]) => value !== void 0));
+}
+/** ISO → epoch millis, the one conversion the rules cannot do for themselves.
+*  The caller has already refused an unparseable string (the authored parser
+*  requires `z.iso.datetime()`), so a NaN here would be a programming error;
+*  it is still checked, because a NaN written to Firestore fails closed in the
+*  same silent way an ISO string does. */
+function windowMillis(window) {
+	if (!window) return void 0;
+	const out = {};
+	if (window.from !== void 0) out.fromMs = Date.parse(window.from);
+	if (window.until !== void 0) out.untilMs = Date.parse(window.until);
+	if (Object.values(out).some((value) => !Number.isFinite(value))) throw new Error(`publish: window bound is not a parseable timestamp (${JSON.stringify(window)})`);
+	return Object.keys(out).length > 0 ? out : void 0;
+}
+/** One `public.submit[cid]`, with its window lowered. Everything else passes
+*  through: the rules read these keys by the names the author wrote. */
+function projectSubmit(submit) {
+	const { window, ...rest } = submit;
+	return compact({
+		...rest,
+		window: windowMillis(window)
+	});
+}
+/** The roster's addresses as a set, in a stable order.
+*
+*  Sorted so two publishes of the same declaration produce the same document
+*  — idempotence is a property this step is tested for, and Firestore compares
+*  arrays by ORDER. `membersConsistent()` compares as sets and would accept
+*  any order; the test that would notice is the one asserting a second publish
+*  changes nothing but `publishedAt`. */
+function memberEmailsOf(members) {
+	return Object.keys(members).sort();
+}
+/** The previous document, kept for rollback, with its OWN `previousPublished`
+*  stripped.
+*
+*  One level, deliberately. Chaining would make every publish carry the entire
+*  history of the app inside a single document, which grows without bound and
+*  meets Firestore's 1 MiB document limit as a permission-shaped failure at
+*  some unpredictable publish. One level answers the question rollback
+*  actually asks — "put back what was there before I broke it" — and the
+*  further history is in git, which is where the declaration came from. */
+function previousOf(existing) {
+	if (!existing) return void 0;
+	const { previousPublished: __dropped, ...rest } = existing;
+	return rest;
+}
+/** Project the authored declaration into the documents publish writes.
+*
+*  `existing` is the app document as it is in Firestore right now, or null on
+*  a first publish. Two things need it, both required by the rules:
+*    - `owner` must be UNCHANGED on update. Re-stamping the publisher's uid
+*      would be refused for any app whose owner ever signed in as a different
+*      account, and would silently transfer ownership if it were not.
+*    - `previousPublished` is that document, so a rollback has something to
+*      put back.
+*
+*  Pure: no clock, no filesystem, no Firestore. Everything variable arrives as
+*  a parameter, which is what makes the conversion table testable as a table. */
+function projectApp(authored, schemas, stamp, existing) {
+	const owner = typeof existing?.owner === "string" ? existing.owner : stamp.uid;
+	const submit = Object.fromEntries(Object.entries(authored.public?.submit ?? {}).map(([cid, spec]) => [cid, projectSubmit(spec)]));
+	const publicBlock = authored.public ? compact({
+		enabled: authored.public.enabled,
+		read: authored.public.read,
+		submit: Object.keys(submit).length > 0 ? submit : void 0
+	}) : void 0;
+	const app = compact({
+		aid: authored.aid,
+		name: authored.name,
+		owner,
+		members: authored.members,
+		memberEmails: memberEmailsOf(authored.members),
+		collections: authored.collections,
+		participantRead: authored.participantRead,
+		public: publicBlock,
+		publishedAt: stamp.publishedAt,
+		publishedBy: stamp.email,
+		publishedCommit: stamp.commit,
+		previousPublished: previousOf(existing)
+	});
+	const config = {
+		enabled: authored.public?.enabled === true,
+		read: authored.public?.read ?? [],
+		submit,
+		publishedAt: stamp.publishedAt
+	};
+	if (authored.name !== void 0) config.name = authored.name;
+	return {
+		app,
+		schemas: schemas.map(({ cid, schema }) => ({
+			cid,
+			doc: schemaDoc(schema, stamp)
+		})),
+		config
+	};
+}
+/** One published schema document. Written key by key rather than through
+*  `compact`, so the declared type is the type — an optional commit is the
+*  only variable part. */
+function schemaDoc(schema, stamp) {
+	const doc = {
+		publishedSchema: schema,
+		publishedAt: stamp.publishedAt,
+		publishedBy: stamp.email
+	};
+	if (stamp.commit !== void 0) doc.publishedCommit = stamp.commit;
+	return doc;
+}
+/** The app documents' parent path — the `FirestoreDocs` seam takes a
+*  collection path plus a document id, and the app document's id is the aid. */
+var APPS_COLLECTION = "apps";
+/** The collection (schema) documents' parent path. */
+var appSchemasPath = (aid) => `apps/${aid}/collections`;
+/** The public-config documents' parent path. */
+var appConfigPath = (aid) => `apps/${aid}/config`;
+//#endregion
+//#region src/collection/server/publishChecks.ts
+/** Does this submit declaration bind a record to the submitter's identity?
+*
+*  The condition for requiring `submitOnly`, and deliberately NOT "declares an
+*  `audience`": `audience` appears only in the rules' public-create branch, so
+*  an owner or editor never meets it and can add records freely. `immutable`
+*  is the wrong condition too — a survey's responses are not immutable and
+*  can be padded exactly the same way.
+*
+*  What these four have in common is that each one makes the record MEAN "the
+*  person who submitted it said this": a per-uid id, a per-uid+field id, a
+*  row stamped with the submitter's verified address, or a submission
+*  restricted to a named participant. A record created through the writer
+*  branch carries the same shape and none of that meaning. */
+function bindsSubmitterIdentity(submit) {
+	return submit.idFrom === "auth.uid" || submit.idFrom === "auth.uid+field" || submit.emailField !== void 0 || submit.audience === "participant";
+}
+/** The fields a rule actually CHECKS the value of, for one collection.
+*
+*  `keyFields` pins a value against a declared set, `gateOn.match` pins it
+*  against the session's current question, and the status field is pinned by
+*  the transition machine. An aggregation grouped by anything else is grouped
+*  by a field any submitter may write anything into — so the published
+*  aggregate is whatever the noisiest respondent decided it should be. */
+function checkedFields(collection, submit) {
+	const fields = /* @__PURE__ */ new Set();
+	for (const keyField of submit?.validate?.keyFields ?? []) fields.add(keyField.field);
+	if (submit?.gateOn) fields.add(submit.gateOn.match);
+	if (collection?.statusField) fields.add(collection.statusField);
+	return fields;
+}
+/** INVARIANT 1 — a submission bound to its submitter needs `submitOnly`. */
+function submitOnlyProblems(app) {
+	const problems = [];
+	for (const [cid, submit] of Object.entries(app.public?.submit ?? {})) {
+		if (!bindsSubmitterIdentity(submit)) continue;
+		if (app.collections?.[cid]?.submitOnly === true) continue;
+		problems.push(`collections.${cid}.submitOnly must be true: public.submit.${cid} binds each record to its submitter (${identityBindings(submit).join(", ")}), so a record created any other way would carry that meaning without having earned it. Without submitOnly the rules let an owner or editor write rows directly into ${cid}.`);
+	}
+	return problems;
+}
+function identityBindings(submit) {
+	const bindings = [];
+	if (submit.idFrom === "auth.uid" || submit.idFrom === "auth.uid+field") bindings.push(`idFrom: "${submit.idFrom}"`);
+	if (submit.emailField !== void 0) bindings.push(`emailField: "${submit.emailField}"`);
+	if (submit.audience === "participant") bindings.push(`audience: "participant"`);
+	return bindings;
+}
+/** INVARIANT 2 — every aggregation key is a field some rule checks. */
+function aggregateProblems(app) {
+	const problems = [];
+	for (const [cid, collection] of Object.entries(app.collections ?? {})) {
+		const keys = collection.aggregate?.by;
+		if (!keys) continue;
+		const checked = checkedFields(collection, app.public?.submit?.[cid]);
+		const loose = keys.filter((field) => !checked.has(field));
+		const spelled = loose.map((field) => `'${field}'`).join(", ");
+		if (loose.length > 0) problems.push(`collections.${cid}.aggregate.by names ${spelled}, which no rule checks the value of. An aggregation key must appear in public.submit.${cid}.validate.keyFields, in gateOn.match, or be the statusField — otherwise a submitter chooses their own bucket and the published aggregate is not a count of anything.`);
+	}
+	return problems;
+}
+/** INVARIANT 3 — `auth: "verifiedEmail"` only.
+*
+*  A product decision, not a rules limitation: the rules keep all three stages
+*  and the emulator tests keep exercising them, because deleting a stage from
+*  the rules turns a change of mind into a cross-repo deploy. Publish is where
+*  the current decision is expressed, and it is one line to move. */
+function authProblems(app) {
+	return Object.entries(app.public?.submit ?? {}).filter(([, submit]) => submit.auth !== "verifiedEmail").map(([cid, submit]) => `public.submit.${cid}.auth is "${submit.auth}": only "verifiedEmail" may be published. The rules still implement "none" and "anonymous" — this is a product decision, and lifting it is a change here, not a rules deploy.`);
+}
+/** INVARIANT 5 — a mail transition's origins and destination must be disjoint.
+*
+*  Overlap means the same write can satisfy the same template twice over, and
+*  the deterministic mail id is the only other thing stopping a duplicate
+*  send. The rules also require the status to have CHANGED, so an overlapping
+*  declaration is not merely redundant: `from` containing `to` is a transition
+*  that can never fire, which is a mail nobody ever receives. */
+function mailProblems(app) {
+	return Object.entries(app.collections ?? {}).flatMap(([cid, collection]) => collectionMailProblems(cid, collection));
+}
+function collectionMailProblems(cid, collection) {
+	const { mail } = collection;
+	if (!mail) return [];
+	const problems = [];
+	if (!collection.statusField) problems.push(`collections.${cid}.mail needs collections.${cid}.statusField: the rules read the status before and after the write to decide the mail is warranted.`);
+	for (const [template, transition] of Object.entries(mail.on)) problems.push(...templateMailProblems(cid, collection, template, transition));
+	return problems;
+}
+function templateMailProblems(cid, collection, template, transition) {
+	const problems = [];
+	if (transition.from.includes(transition.to)) problems.push(`collections.${cid}.mail.on.${template} lists "${transition.to}" in both \`from\` and \`to\`. The rules require the status to CHANGE in the same write, so this template can never send.`);
+	const allowed = collection.transitions;
+	if (allowed) {
+		const unreachable = transition.from.filter((from) => !(allowed[from] ?? []).includes(transition.to));
+		const spelled = unreachable.map((from) => `'${from}' -> '${transition.to}'`).join(", ");
+		if (unreachable.length > 0) problems.push(`collections.${cid}.mail.on.${template} sends on ${spelled}, which collections.${cid}.transitions does not allow. The record write is refused first, so the mail never fires.`);
+	}
+	return problems;
+}
+/** INVARIANTS 6 and 7 — the window is a real interval, and `keyFields` fits
+*  the unrolled check in the rules. */
+function submitShapeProblems(app) {
+	return Object.entries(app.public?.submit ?? {}).flatMap(([cid, submit]) => [...windowProblems(cid, submit), ...keyFieldCountProblems(cid, submit)]);
+}
+function windowProblems(cid, submit) {
+	const { window } = submit;
+	if (window?.from === void 0 || window.until === void 0) return [];
+	if (Date.parse(window.until) > Date.parse(window.from)) return [];
+	return [`public.submit.${cid}.window closes at or before it opens (${window.from} -> ${window.until}): nothing could ever be submitted.`];
+}
+function keyFieldCountProblems(cid, submit) {
+	const keyFields = submit.validate?.keyFields ?? [];
+	if (keyFields.length <= 2) return [];
+	return [`public.submit.${cid}.validate.keyFields declares ${keyFields.length}; the rules check at most 2. Rules have no iteration, so the check is unrolled — a third would be published and never enforced.`];
+}
+/** The fail-closed traps: declarations the rules read together, where the
+*  missing half denies every write instead of loosening one. */
+function coherenceProblems(app) {
+	const fromSubmits = Object.entries(app.public?.submit ?? {}).flatMap(([cid, submit]) => submitCoherenceProblems(app, cid, submit));
+	const fromCollections = Object.entries(app.collections ?? {}).flatMap(([cid, collection]) => gateCoherenceProblems(cid, collection));
+	return [...fromSubmits, ...fromCollections];
+}
+/** `initialStatus` is read together with the collection's `statusField` and
+*  with `createFields`; miss either and every submission is refused. */
+function statusCoherenceProblems(cid, submit, collection) {
+	if (submit.initialStatus === void 0) return [];
+	if (!collection?.statusField) return [`public.submit.${cid}.initialStatus needs collections.${cid}.statusField: the rules look the status up by that name, and refuse every submission without it.`];
+	if (new Set(submit.createFields).has(collection.statusField)) return [];
+	return [`public.submit.${cid}.createFields must include "${collection.statusField}": a submission may carry ONLY the createFields, and the rules also require the status field to be present and equal to initialStatus. As written, every submission is refused.`];
+}
+/** Every field a RULE reads off a submitted record, other than the status
+*  field (which `statusCoherenceProblems` words for itself).
+*
+*  `emailField` and `idField` belong here for exactly the reason `required`
+*  and `keyFields` do, and forgetting them was the same oversight twice: the
+*  rules read `request.resource.data[s.emailField]` and rebuild the document
+*  id from `s.idField`, while `hasOnly(createFields)` decides what a
+*  submission may carry at all. A field in one list and not the other is a
+*  contradiction the submitter cannot resolve — including it is refused,
+*  omitting it fails the check. */
+function ruleReadFields(submit) {
+	const fields = [];
+	if (submit.emailField !== void 0) fields.push({
+		field: submit.emailField,
+		why: `public.submit.<cid>.emailField — the rules compare it to the submitter's verified address`
+	});
+	if (submit.idFrom === "auth.uid+field" && submit.idField !== void 0) fields.push({
+		field: submit.idField,
+		why: `public.submit.<cid>.idField — the rules rebuild the document id from it`
+	});
+	return fields;
+}
+/** A checked field a submission is not allowed to carry can never be
+*  satisfied: carrying it fails `hasOnly`, omitting it fails the check. */
+function createFieldProblems(cid, submit) {
+	const createFields = new Set(submit.createFields);
+	const ruleRead = ruleReadFields(submit).filter((entry) => !createFields.has(entry.field)).map((entry) => `public.submit.${cid}.createFields must include "${entry.field}" (${entry.why.replace("<cid>", cid)}): a submission may carry only the createFields, so as written every submission is refused whether or not it carries the field.`);
+	const required = (submit.validate?.required ?? []).filter((field) => !createFields.has(field)).map((field) => `public.submit.${cid}.validate.required names "${field}", which is not in createFields: a submission may carry only the createFields, so the requirement can never be met.`);
+	const keyFields = (submit.validate?.keyFields ?? []).filter((keyField) => !createFields.has(keyField.field)).map((keyField) => `public.submit.${cid}.validate.keyFields checks "${keyField.field}", which is not in createFields: a submission carrying it is refused, and one omitting it fails the check.`);
+	return [
+		...ruleRead,
+		...required,
+		...keyFields
+	];
+}
+function submitCoherenceProblems(app, cid, submit) {
+	const collection = app.collections?.[cid];
+	const problems = [...statusCoherenceProblems(cid, submit, collection), ...createFieldProblems(cid, submit)];
+	if (submit.idFrom === "auth.uid+field" && submit.idField === void 0) problems.push(`public.submit.${cid}.idFrom is "auth.uid+field" but no idField is declared: the rules rebuild the document id from that field and refuse every create.`);
+	if ((submit.selfUpdate !== void 0 || submit.selfTransitions !== void 0) && !collection?.statusField) problems.push(`public.submit.${cid}.selfUpdate / selfTransitions are declared per CURRENT STATUS, but collections.${cid} declares no statusField: the rules read the current status first and refuse every self-edit without it.`);
+	if (submit.audience === "participant" && Object.keys(app.members).length === 0) problems.push(`public.submit.${cid}.audience is "participant" but the roster is empty: the rules resolve the submitter's role from members, so every submission is refused.`);
+	return problems;
+}
+/** The staged reveal reads its flag off the PARENT record, so the path to that
+*  parent is not optional decoration — without it the gate never opens. */
+function gateCoherenceProblems(cid, collection) {
+	if (collection.revealGated !== true) return [];
+	if (collection.gatedFrom !== void 0 && collection.revealBy !== void 0) return [];
+	return [`collections.${cid}.revealGated needs both gatedFrom and revealBy: the flag is read off the PARENT record, and without the path the gate never opens.`];
+}
+/** The publisher must be able to write what they are about to write.
+*
+*  On a first publish the rules require the creator to name themselves owner,
+*  in the roster, under `'*'`. Getting this wrong produces a bare permission
+*  error from Firestore with nothing in it about rosters — worth one line
+*  here instead. */
+function publisherProblems(app, publisherEmail) {
+	if (app.members[publisherEmail]?.["*"] === "owner") return [];
+	return [`members must give you app-wide owner: add "${publisherEmail}": { "*": "owner" }. The rules require the publisher to hold that role (and to name themselves owner when the app is first created); otherwise the write is refused with no explanation.`];
+}
+/** Every cid the declaration mentions must be a collection that exists.
+*
+*  A typo'd cid is not an error anywhere else: the app document simply carries
+*  a configuration for a collection nobody publishes, and the collection the
+*  author meant is published with no configuration at all — i.e. with the
+*  status machine and the submit path silently absent. */
+function unknownCidProblems(app, collections) {
+	const known = new Set(collections.map((collection) => collection.cid));
+	return [
+		["collections", Object.keys(app.collections ?? {})],
+		["public.read", app.public?.read ?? []],
+		["public.submit", Object.keys(app.public?.submit ?? {})],
+		["participantRead", app.participantRead ?? []]
+	].flatMap(([where, cids]) => cids.filter((cid) => !known.has(cid)).map((cid) => `${where} names '${cid}', which is not a shared collection in this repository. Shared collections here: ${known.size > 0 ? [...known].sort().join(", ") : "(none - a schema needs storage.type \"firestore\")"}.`));
+}
+/** Everything publish refuses, as lines the author can act on.
+*
+*  All of them, every time. Publish is a manual step with a human waiting on
+*  it; stopping at the first problem turns one review into five. */
+function publishProblems(app, collections, publisherEmail) {
+	return [
+		...unknownCidProblems(app, collections),
+		...publisherProblems(app, publisherEmail),
+		...submitOnlyProblems(app),
+		...aggregateProblems(app),
+		...authProblems(app),
+		...mailProblems(app),
+		...submitShapeProblems(app),
+		...coherenceProblems(app),
+		...primaryKeyProblems(app, collections)
+	];
+}
+/** A public submission must be able to produce a record the HOST can read.
+*
+*  The rules and the engine disagree about what identifies a record, and the
+*  gap is invisible from either side alone. The rules bind the DOCUMENT ID
+*  (`idFrom`) and let a submission carry only `createFields`; the engine
+*  identifies a record by its schema's `primaryKey` FIELD, and the firestore
+*  store hands back the document's fields verbatim — `toItem` does not
+*  synthesize the key from the document id. So a submit path whose
+*  `createFields` omits the primary key writes rows that Firestore accepts and
+*  every reader rejects: `validateRecordObject` fails them, the collection
+*  renders empty-ish, and the next publish's own pre-check reports them as
+*  broken records the publisher never wrote.
+*
+*  Not checkable by the rules (they have never heard of a schema) and not
+*  catchable at write time (nothing is wrong with the write). Publish is the
+*  only place that holds both halves. */
+function primaryKeyProblems(app, collections) {
+	const primaryKeyOf = new Map(collections.map((collection) => [collection.cid, collection.primaryKey]));
+	return Object.entries(app.public?.submit ?? {}).flatMap(([cid, submit]) => {
+		const primaryKey = primaryKeyOf.get(cid);
+		if (primaryKey === void 0 || submit.createFields.includes(primaryKey)) return [];
+		return [`public.submit.${cid}.createFields must include "${primaryKey}", the schema's primaryKey: a submission may carry only the createFields, and a shared record is stored as exactly the fields it was written with — the document id is not copied into the record. Without it every submission is accepted by the rules and then rejected by every reader.`];
+	});
+}
+//#endregion
+//#region src/collection/core/recordZ.ts
+/** The emptiness rule shared by `required` and the "only check present
+*  values" gate. NOT a truthiness check — `0` and `false` are filled. */
+var isEmptyValue = (value) => value === void 0 || value === null || value === "";
+/** The historical write-gate checks, verbatim: required non-empty, enum
+*  membership (compared as strings, so a numeric `5` satisfies `"5"`). */
+function enforcedProblem(key, spec, value) {
+	const empty = isEmptyValue(value);
+	if (spec.required && empty) return `missing required field '${key}'`;
+	if (!empty && spec.type === "enum" && !spec.values.includes(String(value))) return `'${key}' = '${String(value)}' is not one of [${spec.values.join(", ")}]`;
+	return null;
+}
+/** Report-only per-type checks on a PRESENT value. Date / datetime reuse the
+*  calendar's STRICT civil parsers (`parseIsoDate` / `parseIsoDateTime`), so
+*  the lint flags exactly the values the calendar / trigger / spawn code
+*  would silently drop — impossible days like `2026-02-30`, and datetimes
+*  outside the canonical `YYYY-MM-DDTHH:MM[:SS]` shape (e.g. a `Z` suffix,
+*  which the day view can't place). `string`-backed types accept anything
+*  stringifiable; `ref` existence is out of scope. */
+function strictTypeProblem(key, spec, value) {
+	switch (spec.type) {
+		case "number":
+		case "money": return Number.isFinite(coerceNumeric(value)) ? null : `'${key}' = '${String(value)}' is not numeric (a '${spec.type}' field stores a plain number)`;
+		case "boolean": return value === true || value === false ? null : `'${key}' = '${String(value)}' is not a boolean (store true or false, unquoted)`;
+		case "date": return parseIsoDate(value) !== null ? null : `'${key}' = '${String(value)}' is not a real YYYY-MM-DD date`;
+		case "datetime": return parseIsoDateTime(value) !== null ? null : `'${key}' = '${String(value)}' is not a YYYY-MM-DDTHH:MM datetime (seconds optional, no timezone suffix — the shape the calendar parses)`;
+		default: return null;
+	}
+}
+/** Strict check for a PRESENT `table` value: an array of row objects, each
+*  row conforming to the sub-schema (required / enum / typed sub-values).
+*  First row problem wins, prefixed with the row number so the fix is
+*  locatable. */
+function strictTableProblem(key, spec, value) {
+	if (!Array.isArray(value)) return `'${key}' = '${String(value)}' is not an array of rows (a 'table' field stores an array of row objects)`;
+	for (let index = 0; index < value.length; index++) {
+		const row = value[index];
+		if (!isRecord(row)) return `'${key}' row ${index + 1} is not an object`;
+		for (const [subKey, subSpec] of Object.entries(spec.of)) {
+			const subValue = row[subKey];
+			const problem = enforcedProblem(subKey, subSpec, subValue) ?? (isEmptyValue(subValue) ? null : strictTypeProblem(subKey, subSpec, subValue));
+			if (problem) return `'${key}' row ${index + 1}: ${problem}`;
+		}
+	}
+	return null;
+}
+/** First problem for one field's stored value under `tier`, or null.
+*  Enforced checks always run (and their messages never vary by tier — the
+*  scan and the write gate must agree on them); strict adds the per-type
+*  layer on present values only. */
+function recordFieldProblem(key, spec, value, tier) {
+	const enforced = enforcedProblem(key, spec, value);
+	if (enforced || tier === "enforced") return enforced;
+	if (isEmptyValue(value)) return null;
+	if (spec.type === "table") return strictTableProblem(key, spec, value);
+	return strictTypeProblem(key, spec, value);
+}
+var compiled = /* @__PURE__ */ new WeakMap();
+/** Compile `schema.fields` into a zod validator for a stored record.
+*  Loose object: unknown keys are allowed and any declared key may be
+*  absent (records are user files, not parse-and-rewrite targets —
+*  callers validate, they never persist the parse output). The checks run
+*  as ONE object-level refine iterating fields in declaration order —
+*  per-key shape schemas can't express "key may be absent BUT its absence
+*  must still reach the required check", and the single loop keeps the
+*  first reported issue identical to the historical first-problem-wins
+*  contract. */
+function compileRecordZ(schema, tier) {
+	const cached = compiled.get(schema)?.[tier];
+	if (cached) return cached;
+	const stored = Object.entries(schema.fields).filter(([, spec]) => !COMPUTED_TYPES.has(spec.type));
+	const validator = z.looseObject({}).superRefine((record, ctx) => {
+		for (const [key, spec] of stored) {
+			const problem = recordFieldProblem(key, spec, record[key], tier);
+			if (problem) ctx.addIssue({
+				code: "custom",
+				message: problem,
+				path: [key]
+			});
+		}
+	});
+	const entry = compiled.get(schema) ?? {};
+	entry[tier] = validator;
+	compiled.set(schema, entry);
+	return validator;
+}
+/** First schema problem on an in-memory record under `tier`, or null. One
+*  issue per record keeps the report short and the fix obvious (the
+*  historical contract of `validateRecordObject`). */
+function firstRecordProblem(record, schema, tier) {
+	const result = compileRecordZ(schema, tier).safeParse(record);
+	if (result.success) return null;
+	return result.error.issues[0]?.message ?? "record failed schema validation";
+}
+//#endregion
+//#region src/collection/server/validate.ts
+/** Don't flood the result; the first batch is enough to act on. Exported
+*  because a caller that REPORTS a count has to know the count is a floor —
+*  `publish` presents a full batch as "at least N" rather than as a total. */
+var MAX_RECORD_ISSUES = 25;
+/** The `file` of the pseudo-issue reported when the backend could not be read
+*  at all.
+*
+*  Exported because it is a DIFFERENT KIND of answer from "this record is
+*  invalid", and a caller that treats the two alike gets it wrong in the
+*  direction that matters: `publish` lets the user override invalid records,
+*  and overriding this one would mean publishing without ever having looked. */
+var STORE_UNREADABLE = "(store)";
+var MAX_ISSUES = 25;
+/** Read every `<id>.json` under the collection's dataDir and report the
+*  ones that won't load or violate the schema. An empty list means every
+*  record is fine. */
+/** List entries under the data dir, guarding realpath containment (against a
+*  symlinked dir swapped in after discovery, like `listItems`) and treating a
+*  missing dir as empty while surfacing real I/O faults. */
+async function listRecordFilenames(dataDir, workspaceRoot) {
+	if (!isContainedInRoot(dataDir, workspaceRoot)) {
+		log.warn("collections", "validate refused: dataDir escapes workspace via symlink", { dataDir });
+		return [];
+	}
+	try {
+		return await readdir(dataDir);
+	} catch (err) {
+		if (isErrorWithCode(err) && err.code === "ENOENT") return [];
+		throw err;
+	}
+}
+async function validateCollectionRecords(collection, opts = {}) {
+	if (collection.schema.dataSource !== void 0) return [];
+	if (collection.schema.storage !== void 0) return validateStoreRecords(collection, opts);
+	const workspaceRoot = opts.workspaceRoot ?? getWorkspaceRoot();
+	const entries = await listRecordFilenames(collection.dataDir, workspaceRoot);
+	const issues = [];
+	for (const name of entries.sort()) {
+		if (!name.endsWith(".json") || name.startsWith(".")) continue;
+		if (issues.length >= MAX_ISSUES) break;
+		const issue = await inspectRecord(path.join(collection.dataDir, name), name, collection.schema);
+		if (issue) issues.push(issue);
+	}
+	return issues;
+}
+/** Store-backed twin of the file scan: list every record through the
+*  collection's store and lint it with the same "strict" report-only tier.
+*  A row the store can't even parse is invisible here (the store skips
+*  it), so the read/parse classifications of the file scan don't apply —
+*  schema violations are what this catches. `file` carries the record id
+*  (there is no per-record filename). */
+async function validateStoreRecords(collection, opts) {
+	let items;
+	try {
+		items = await storeFor(collection, { workspaceRoot: opts.workspaceRoot }).list();
+	} catch (err) {
+		return [{
+			file: STORE_UNREADABLE,
+			problem: `records could not be read from the storage backend: ${err instanceof Error ? err.message : String(err)}`
+		}];
+	}
+	const issues = [];
+	for (const item of items) {
+		if (issues.length >= MAX_ISSUES) break;
+		const itemId = fieldText(item[collection.schema.primaryKey]);
+		const problem = validateRecordObject(item, itemId, collection.schema, "strict");
+		if (problem) issues.push({
+			file: itemId,
+			problem
+		});
+	}
+	return issues;
+}
+async function readRecordText(fullPath, name) {
+	try {
+		if (!(await lstat(fullPath)).isFile()) return {
+			file: name,
+			problem: "not a regular file (symlink?) — skipped, won't appear"
+		};
+		return { raw: await readFile(fullPath, "utf-8") };
+	} catch {
+		return {
+			file: name,
+			problem: "could not be read — skipped, won't appear"
+		};
+	}
+}
+/** Classify a single record file: unreadable / unparseable / non-object /
+*  schema violation, or null when it's fine. */
+async function inspectRecord(fullPath, name, schema) {
+	const read = await readRecordText(fullPath, name);
+	if ("problem" in read) return read;
+	let parsed;
+	try {
+		parsed = JSON.parse(read.raw);
+	} catch (err) {
+		return {
+			file: name,
+			problem: `invalid JSON (${err instanceof Error ? err.message : String(err)}) — SKIPPED, won't appear. Usual cause: an unescaped " inside a string value; use 「」/『』 or write \\" instead.`
+		};
+	}
+	if (!isRecord(parsed)) return {
+		file: name,
+		problem: "not a JSON object — skipped, won't appear"
+	};
+	const problem = validateRecordObject(parsed, name.replace(/\.json$/, ""), schema, "strict");
+	return problem ? {
+		file: name,
+		problem
+	} : null;
+}
+/** What a non-string primary key actually is, for the error message. Names the
+*  shape rather than stringifying the value — "[object Object]" tells the reader
+*  nothing about what is wrong. */
+function describeIdType(value) {
+	if (value === null) return "null";
+	if (value === void 0) return "missing";
+	if (Array.isArray(value)) return "an array";
+	return `a ${typeof value}`;
+}
+/** First schema problem on an in-memory record (primaryKey↔id mismatch,
+*  then the compiled per-field checks — see `../core/recordZ` for the two
+*  tiers), or null when it's fine. One issue per record keeps the report
+*  short and the fix obvious. Pure + exported so write paths
+*  (manageCollection putItems) can gate on the SAME enforced rules the
+*  post-hoc file scan reports — `itemId` is the id the record is (or
+*  would be) stored under. The default `"enforced"` tier keeps every
+*  write gate on the historical three checks; only pass `"strict"` from
+*  report-only surfaces. */
+function validateRecordObject(record, itemId, schema, tier = "enforced") {
+	const idValue = record[schema.primaryKey];
+	if (typeof idValue !== "string") return `'${schema.primaryKey}' must be a string, but is ${describeIdType(idValue)} — must equal the filename ('${itemId}'), or the record can't be opened`;
+	if (idValue !== itemId) return `'${schema.primaryKey}' is '${idValue}' but must equal the filename ('${itemId}'), or the record can't be opened`;
+	return firstRecordProblem(record, schema, tier);
+}
+//#endregion
+//#region src/collection/server/publish.ts
+var execFileAsync = promisify(execFile);
+/** How many broken records to name before summarising. A publish that would
+*  break a thousand rows is answered by the count and a sample; dumping all of
+*  them buries the number, which is the part the decision turns on. */
+var MAX_LISTED_ISSUES = 10;
+/** `git rev-parse HEAD` plus a dirty check, or nothing.
+*
+*  A missing git, a repository with no commits and a non-repository are all
+*  the same answer here — no commit — because the stamp is attribution, not a
+*  requirement. What is NOT acceptable is a stamp that lies, which is why the
+*  dirty flag exists: publishing from a modified tree records a commit that
+*  does not describe what was published, and the flag is the only thing that
+*  would ever tell a reader so. */
+async function gitStamp(root) {
+	try {
+		const { stdout } = await execFileAsync("git", [
+			"-C",
+			root,
+			"rev-parse",
+			"HEAD"
+		]);
+		const commit = stdout.trim();
+		const { stdout: status } = await execFileAsync("git", [
+			"-C",
+			root,
+			"status",
+			"--porcelain"
+		]);
+		return {
+			commit: commit.length > 0 ? commit : void 0,
+			dirty: status.trim().length > 0
+		};
+	} catch {
+		return {};
+	}
+}
+/** The shared collections of THIS REPOSITORY, by cid.
+*
+*  `userSkillsDir: null` — not a test convenience, a boundary. Discovery
+*  resolves every schema it finds against the WORKSPACE root, user-scope
+*  included, so a globally installed skill under `~/.claude/skills` carrying
+*  `storage.type: "firestore"` picks up whichever repository's `aid` it
+*  happens to be discovered from. Left in, publish would write that schema
+*  into this app — and into every other app the same user publishes, since the
+*  skill is installed once per machine and the repositories are not.
+*
+*  An app is a REPOSITORY (design D1): its collections are the ones committed
+*  beside its `app.json`, which is what makes a clone resolve the same
+*  collections and an invitation a matter of authorization rather than
+*  discovery. A schema that is not in the repository has no claim on a cid
+*  there. And because a view is HTML, publishing one is not a tidiness
+*  question: it is the machine's own skills reaching every member's browser.
+*
+*  The consequence is deliberate: a cid named in `app.json` that exists only
+*  in user scope is now an unknown cid, and publish says so by name instead of
+*  quietly publishing a schema from outside the repository. */
+async function sharedCollections(opts, root) {
+	return (await discoverCollections({
+		...opts,
+		workspaceRoot: root,
+		userSkillsDir: null
+	})).filter((collection) => collection.appId !== void 0);
+}
+/** Existing records that would not satisfy the schema about to be published.
+*
+*  Read from FIRESTORE, not from disk: a shared collection's records live in
+*  the app, and the question this answers is "what does the live data look
+*  like under the new schema" — which is the migration question. Reported as
+*  a refusal the publisher can override, because a breaking change is
+*  sometimes exactly what is intended and the point is that it is a decision
+*  rather than a discovery. */
+async function recordProblems(collections, opts) {
+	const lines = [];
+	const unreadable = [];
+	let records = 0;
+	let cappedAnywhere = false;
+	for (const collection of collections) {
+		const issues = await validateCollectionRecords(collection, opts);
+		if (issues.length === 0) continue;
+		const unread = issues.filter((issue) => issue.file === STORE_UNREADABLE);
+		if (unread.length > 0) {
+			unreadable.push(`${collection.slug}: ${unread.map((issue) => issue.problem).join("; ")}`);
+			continue;
+		}
+		records += issues.length;
+		const capped = issues.length >= 25;
+		cappedAnywhere = cappedAnywhere || capped;
+		const count = capped ? `at least ${issues.length}` : String(issues.length);
+		const plural = issues.length === 1 ? "" : "s";
+		const note = capped ? " (the scan stops there)" : "";
+		lines.push(`${collection.slug}: ${count} existing record${plural} would not satisfy the schema about to be published${note}`);
+		for (const issue of issues.slice(0, MAX_LISTED_ISSUES)) lines.push(`  - ${issue.file}: ${issue.problem}`);
+		if (issues.length > MAX_LISTED_ISSUES) lines.push(`  - … and ${issues.length - MAX_LISTED_ISSUES} more`);
+	}
+	return {
+		lines,
+		records,
+		capped: cappedAnywhere,
+		unreadable
+	};
+}
+function schemasOf(collections) {
+	return collections.map((collection) => ({
+		cid: collection.slug,
+		schema: collection.schema
+	})).sort((left, right) => left.cid < right.cid ? -1 : left.cid > right.cid ? 1 : 0);
+}
+/** Read and parse `<root>/app.json`'s full declaration. */
+async function readAuthored(root) {
+	let raw;
+	try {
+		raw = await readFile(path.join(root, APP_MANIFEST_FILE), "utf-8");
+	} catch (err) {
+		return {
+			ok: false,
+			problems: [`cannot read ${path.join(root, APP_MANIFEST_FILE)}: ${String(err)}`]
+		};
+	}
+	return parseAuthoredApp(raw);
+}
+/** Everything wrong with the declaration itself, publisher included. */
+function declarationProblems(app, collections, handle) {
+	const problems = publishProblems(app, collections.map((collection) => ({
+		cid: collection.slug,
+		primaryKey: collection.schema.primaryKey
+	})), handle.email);
+	if (app.owner !== void 0 && app.owner !== handle.uid) problems.push(`app.json declares owner "${app.owner}", which is not your uid (${handle.uid}). \`owner\` is stamped by publish and carried forward unchanged afterwards — remove it from app.json rather than maintaining it by hand.`);
+	return problems;
+}
+/** Put the three kinds of document, in the order the rules require, and turn a
+*  rejected write into the result type instead of letting it escape.
+*
+*  Returns null when everything was written; a failure result otherwise.
+*
+*  A raw rejection here would reach the agent as a tool crash rather than the
+*  actionable text this tool promises. But "actionable" is a strong claim for
+*  a half-finished publish, so the message ENUMERATES what landed rather than
+*  summarising it: the order is app → every schema → config, and a summary
+*  written for one failure point is wrong at the others. Saying "the roster
+*  and configuration are live" after a SCHEMA write failed names a config
+*  document this publish never wrote — which still holds whatever the last
+*  publish left, and is exactly the state the caller is trying to repair. */
+async function writeDocuments(handle, aid, published) {
+	const steps = [
+		{
+			what: `the app document (apps/${aid})`,
+			run: () => handle.docs.set(APPS_COLLECTION, aid, published.app)
+		},
+		...published.schemas.map(({ cid, doc }) => ({
+			what: `the published schema for '${cid}'`,
+			run: () => handle.docs.set(appSchemasPath(aid), cid, doc)
+		})),
+		{
+			what: `the public config document (apps/${aid}/config/${PUBLIC_CONFIG_DOC})`,
+			run: () => handle.docs.set(appConfigPath(aid), PUBLIC_CONFIG_DOC, published.config)
+		}
+	];
+	const landed = [];
+	for (const [index, step] of steps.entries()) try {
+		await step.run();
+		landed.push(step.what);
+	} catch (err) {
+		const reason = err instanceof Error ? err.message : String(err);
+		return {
+			ok: false,
+			partial: index > 0,
+			problems: [`publish failed while writing ${step.what}: ${reason}`, ...partialState(landed, [step.what, ...steps.slice(index + 1).map((rest) => rest.what)])]
+		};
+	}
+	return null;
+}
+/** What is live and what is not, listed rather than summarised.
+*
+*  Two facts, and both matter for the repair: a document this publish wrote is
+*  live NOW, and a document it did not write still holds what the LAST publish
+*  left — which is not the same as being absent, and not the same as matching
+*  the declaration that was just half-applied. */
+function partialState(landed, notWritten) {
+	const repair = "Publishing again is the repair: the write is idempotent, and it re-does every step, including the ones that did land.";
+	if (landed.length === 0) return [`Nothing was written. ${repair}`];
+	return [
+		`Written by this publish, and live now: ${landed.join("; ")}.`,
+		`NOT written: ${notWritten.join("; ")} — ${notWritten.length === 1 ? "it still holds" : "they still hold"} whatever the previous publish left.`,
+		repair
+	];
+}
+/** Publish this repository's declaration to its app.
+*
+*  Everything variable is a parameter or comes from the host binding, so the
+*  whole path is exercisable against an in-memory `FirestoreDocs` with no
+*  network and no API key — which is the only way the conversion table gets
+*  tested as a table. */
+async function publishApp(opts = {}) {
+	const root = opts.workspaceRoot ?? getWorkspaceRoot();
+	const handle = firestoreHandle();
+	if (!handle) return {
+		ok: false,
+		partial: false,
+		problems: ["publish needs a signed-in Firestore session: connect remote-host first. Publishing writes the app's roster and configuration as the app's owner, which is an authenticated write."]
+	};
+	const authored = await readAuthored(root);
+	if (!authored.ok) return {
+		...authored,
+		partial: false
+	};
+	const collections = await sharedCollections(opts, root);
+	const problems = declarationProblems(authored.app, collections, handle);
+	if (problems.length > 0) return {
+		ok: false,
+		partial: false,
+		problems
+	};
+	const issues = await recordProblems(collections, {
+		...opts,
+		workspaceRoot: root
+	});
+	if (issues.unreadable.length > 0) return {
+		ok: false,
+		partial: false,
+		problems: [...issues.unreadable, "publish stopped: the live records could not be read, so nothing checked whether the schemas about to be published still fit them. This is not something `confirm` overrides — confirming means accepting a known breakage, and here there is no reading at all. Fix the access (or the connection) and publish again."]
+	};
+	if (issues.records > 0 && opts.confirm !== true) return {
+		ok: false,
+		partial: false,
+		problems: [...issues.lines, "publish stopped: these records are live and members are reading them. Migrate them first, or re-run with confirm to publish the schema anyway and repair the records afterwards."]
+	};
+	return writePublished(authored.app, collections, handle, opts, root, issues);
+}
+/** The write half: stamp, project, and put the documents in the order the
+*  rules require. Split from the gate above so neither half hides the other —
+*  everything up to here can refuse, and nothing from here on does. */
+async function writePublished(authored, collections, handle, opts, root, issues) {
+	const { aid } = authored;
+	let existing;
+	try {
+		existing = await handle.docs.get(APPS_COLLECTION, aid);
+	} catch (err) {
+		return {
+			ok: false,
+			partial: false,
+			problems: [`publish failed while reading the current app document (apps/${aid}): ${err instanceof Error ? err.message : String(err)}`, "Nothing was written. Publishing again is safe — this read only decides whether the app is created or updated."]
+		};
+	}
+	const stampSource = await (opts.resolveCommit ?? gitStamp)(root);
+	const stamp = {
+		uid: handle.uid,
+		email: handle.email,
+		publishedAt: (opts.now ?? Date.now)(),
+		commit: stampSource.commit
+	};
+	const existingApp = isRecord(existing) ? existing : null;
+	const published = projectApp(authored, schemasOf(collections), stamp, existingApp);
+	if (stampSource.dirty === true) published.app.publishedDirty = true;
+	const written = await writeDocuments(handle, aid, published);
+	if (written !== null) return written;
+	return {
+		ok: true,
+		aid,
+		cids: published.schemas.map((entry) => entry.cid),
+		created: existingApp === null,
+		commit: stamp.commit,
+		dirty: stampSource.dirty === true,
+		recordIssues: issues.records,
+		recordIssuesCapped: issues.capped,
+		published
+	};
+}
+//#endregion
 //#region src/collection/server/skillAssets.ts
 /** Read a collection's custom-view HTML, path-safely. `viewFile` is a
 *  schema-validated `views/*.html` path, resolved with realpath containment.
@@ -373,226 +1412,6 @@ async function runCollectionQuery(collection, query, opts = {}) {
 	return runQueryOverRows(await enrichItems(collection, await store.list(), opts), query);
 }
 //#endregion
-//#region src/collection/core/recordZ.ts
-/** The emptiness rule shared by `required` and the "only check present
-*  values" gate. NOT a truthiness check — `0` and `false` are filled. */
-var isEmptyValue = (value) => value === void 0 || value === null || value === "";
-/** The historical write-gate checks, verbatim: required non-empty, enum
-*  membership (compared as strings, so a numeric `5` satisfies `"5"`). */
-function enforcedProblem(key, spec, value) {
-	const empty = isEmptyValue(value);
-	if (spec.required && empty) return `missing required field '${key}'`;
-	if (!empty && spec.type === "enum" && !spec.values.includes(String(value))) return `'${key}' = '${String(value)}' is not one of [${spec.values.join(", ")}]`;
-	return null;
-}
-/** Report-only per-type checks on a PRESENT value. Date / datetime reuse the
-*  calendar's STRICT civil parsers (`parseIsoDate` / `parseIsoDateTime`), so
-*  the lint flags exactly the values the calendar / trigger / spawn code
-*  would silently drop — impossible days like `2026-02-30`, and datetimes
-*  outside the canonical `YYYY-MM-DDTHH:MM[:SS]` shape (e.g. a `Z` suffix,
-*  which the day view can't place). `string`-backed types accept anything
-*  stringifiable; `ref` existence is out of scope. */
-function strictTypeProblem(key, spec, value) {
-	switch (spec.type) {
-		case "number":
-		case "money": return Number.isFinite(coerceNumeric(value)) ? null : `'${key}' = '${String(value)}' is not numeric (a '${spec.type}' field stores a plain number)`;
-		case "boolean": return value === true || value === false ? null : `'${key}' = '${String(value)}' is not a boolean (store true or false, unquoted)`;
-		case "date": return parseIsoDate(value) !== null ? null : `'${key}' = '${String(value)}' is not a real YYYY-MM-DD date`;
-		case "datetime": return parseIsoDateTime(value) !== null ? null : `'${key}' = '${String(value)}' is not a YYYY-MM-DDTHH:MM datetime (seconds optional, no timezone suffix — the shape the calendar parses)`;
-		default: return null;
-	}
-}
-/** Strict check for a PRESENT `table` value: an array of row objects, each
-*  row conforming to the sub-schema (required / enum / typed sub-values).
-*  First row problem wins, prefixed with the row number so the fix is
-*  locatable. */
-function strictTableProblem(key, spec, value) {
-	if (!Array.isArray(value)) return `'${key}' = '${String(value)}' is not an array of rows (a 'table' field stores an array of row objects)`;
-	for (let index = 0; index < value.length; index++) {
-		const row = value[index];
-		if (!isRecord(row)) return `'${key}' row ${index + 1} is not an object`;
-		for (const [subKey, subSpec] of Object.entries(spec.of)) {
-			const subValue = row[subKey];
-			const problem = enforcedProblem(subKey, subSpec, subValue) ?? (isEmptyValue(subValue) ? null : strictTypeProblem(subKey, subSpec, subValue));
-			if (problem) return `'${key}' row ${index + 1}: ${problem}`;
-		}
-	}
-	return null;
-}
-/** First problem for one field's stored value under `tier`, or null.
-*  Enforced checks always run (and their messages never vary by tier — the
-*  scan and the write gate must agree on them); strict adds the per-type
-*  layer on present values only. */
-function recordFieldProblem(key, spec, value, tier) {
-	const enforced = enforcedProblem(key, spec, value);
-	if (enforced || tier === "enforced") return enforced;
-	if (isEmptyValue(value)) return null;
-	if (spec.type === "table") return strictTableProblem(key, spec, value);
-	return strictTypeProblem(key, spec, value);
-}
-var compiled = /* @__PURE__ */ new WeakMap();
-/** Compile `schema.fields` into a zod validator for a stored record.
-*  Loose object: unknown keys are allowed and any declared key may be
-*  absent (records are user files, not parse-and-rewrite targets —
-*  callers validate, they never persist the parse output). The checks run
-*  as ONE object-level refine iterating fields in declaration order —
-*  per-key shape schemas can't express "key may be absent BUT its absence
-*  must still reach the required check", and the single loop keeps the
-*  first reported issue identical to the historical first-problem-wins
-*  contract. */
-function compileRecordZ(schema, tier) {
-	const cached = compiled.get(schema)?.[tier];
-	if (cached) return cached;
-	const stored = Object.entries(schema.fields).filter(([, spec]) => !COMPUTED_TYPES.has(spec.type));
-	const validator = z.looseObject({}).superRefine((record, ctx) => {
-		for (const [key, spec] of stored) {
-			const problem = recordFieldProblem(key, spec, record[key], tier);
-			if (problem) ctx.addIssue({
-				code: "custom",
-				message: problem,
-				path: [key]
-			});
-		}
-	});
-	const entry = compiled.get(schema) ?? {};
-	entry[tier] = validator;
-	compiled.set(schema, entry);
-	return validator;
-}
-/** First schema problem on an in-memory record under `tier`, or null. One
-*  issue per record keeps the report short and the fix obvious (the
-*  historical contract of `validateRecordObject`). */
-function firstRecordProblem(record, schema, tier) {
-	const result = compileRecordZ(schema, tier).safeParse(record);
-	if (result.success) return null;
-	return result.error.issues[0]?.message ?? "record failed schema validation";
-}
-//#endregion
-//#region src/collection/server/validate.ts
-var MAX_ISSUES = 25;
-/** Read every `<id>.json` under the collection's dataDir and report the
-*  ones that won't load or violate the schema. An empty list means every
-*  record is fine. */
-/** List entries under the data dir, guarding realpath containment (against a
-*  symlinked dir swapped in after discovery, like `listItems`) and treating a
-*  missing dir as empty while surfacing real I/O faults. */
-async function listRecordFilenames(dataDir, workspaceRoot) {
-	if (!isContainedInRoot(dataDir, workspaceRoot)) {
-		log.warn("collections", "validate refused: dataDir escapes workspace via symlink", { dataDir });
-		return [];
-	}
-	try {
-		return await readdir(dataDir);
-	} catch (err) {
-		if (isErrorWithCode(err) && err.code === "ENOENT") return [];
-		throw err;
-	}
-}
-async function validateCollectionRecords(collection, opts = {}) {
-	if (collection.schema.dataSource !== void 0) return [];
-	if (collection.schema.storage !== void 0) return validateStoreRecords(collection, opts);
-	const workspaceRoot = opts.workspaceRoot ?? getWorkspaceRoot();
-	const entries = await listRecordFilenames(collection.dataDir, workspaceRoot);
-	const issues = [];
-	for (const name of entries.sort()) {
-		if (!name.endsWith(".json") || name.startsWith(".")) continue;
-		if (issues.length >= MAX_ISSUES) break;
-		const issue = await inspectRecord(path.join(collection.dataDir, name), name, collection.schema);
-		if (issue) issues.push(issue);
-	}
-	return issues;
-}
-/** Store-backed twin of the file scan: list every record through the
-*  collection's store and lint it with the same "strict" report-only tier.
-*  A row the store can't even parse is invisible here (the store skips
-*  it), so the read/parse classifications of the file scan don't apply —
-*  schema violations are what this catches. `file` carries the record id
-*  (there is no per-record filename). */
-async function validateStoreRecords(collection, opts) {
-	let items;
-	try {
-		items = await storeFor(collection, { workspaceRoot: opts.workspaceRoot }).list();
-	} catch (err) {
-		return [{
-			file: "(store)",
-			problem: `records could not be read from the storage backend: ${err instanceof Error ? err.message : String(err)}`
-		}];
-	}
-	const issues = [];
-	for (const item of items) {
-		if (issues.length >= MAX_ISSUES) break;
-		const itemId = fieldText(item[collection.schema.primaryKey]);
-		const problem = validateRecordObject(item, itemId, collection.schema, "strict");
-		if (problem) issues.push({
-			file: itemId,
-			problem
-		});
-	}
-	return issues;
-}
-async function readRecordText(fullPath, name) {
-	try {
-		if (!(await lstat(fullPath)).isFile()) return {
-			file: name,
-			problem: "not a regular file (symlink?) — skipped, won't appear"
-		};
-		return { raw: await readFile(fullPath, "utf-8") };
-	} catch {
-		return {
-			file: name,
-			problem: "could not be read — skipped, won't appear"
-		};
-	}
-}
-/** Classify a single record file: unreadable / unparseable / non-object /
-*  schema violation, or null when it's fine. */
-async function inspectRecord(fullPath, name, schema) {
-	const read = await readRecordText(fullPath, name);
-	if ("problem" in read) return read;
-	let parsed;
-	try {
-		parsed = JSON.parse(read.raw);
-	} catch (err) {
-		return {
-			file: name,
-			problem: `invalid JSON (${err instanceof Error ? err.message : String(err)}) — SKIPPED, won't appear. Usual cause: an unescaped " inside a string value; use 「」/『』 or write \\" instead.`
-		};
-	}
-	if (!isRecord(parsed)) return {
-		file: name,
-		problem: "not a JSON object — skipped, won't appear"
-	};
-	const problem = validateRecordObject(parsed, name.replace(/\.json$/, ""), schema, "strict");
-	return problem ? {
-		file: name,
-		problem
-	} : null;
-}
-/** What a non-string primary key actually is, for the error message. Names the
-*  shape rather than stringifying the value — "[object Object]" tells the reader
-*  nothing about what is wrong. */
-function describeIdType(value) {
-	if (value === null) return "null";
-	if (value === void 0) return "missing";
-	if (Array.isArray(value)) return "an array";
-	return `a ${typeof value}`;
-}
-/** First schema problem on an in-memory record (primaryKey↔id mismatch,
-*  then the compiled per-field checks — see `../core/recordZ` for the two
-*  tiers), or null when it's fine. One issue per record keeps the report
-*  short and the fix obvious. Pure + exported so write paths
-*  (manageCollection putItems) can gate on the SAME enforced rules the
-*  post-hoc file scan reports — `itemId` is the id the record is (or
-*  would be) stored under. The default `"enforced"` tier keeps every
-*  write gate on the historical three checks; only pass `"strict"` from
-*  report-only surfaces. */
-function validateRecordObject(record, itemId, schema, tier = "enforced") {
-	const idValue = record[schema.primaryKey];
-	if (typeof idValue !== "string") return `'${schema.primaryKey}' must be a string, but is ${describeIdType(idValue)} — must equal the filename ('${itemId}'), or the record can't be opened`;
-	if (idValue !== itemId) return `'${schema.primaryKey}' is '${idValue}' but must equal the filename ('${itemId}'), or the record can't be opened`;
-	return firstRecordProblem(record, schema, tier);
-}
-//#endregion
 //#region src/collection/server/mutate.ts
 /** First problem with the submitted params, or null. Every declared param
 *  is checked by the shared record-field validator; keys the action never
@@ -1022,7 +1841,8 @@ function deleteCollectionRefusalMessage(result) {
 		"user-scope": `collection '${slug}' is user-scope (~/.claude/skills/) and is read-only from MulmoClaude`,
 		preset: `collection '${slug}' is a preset (mc-*) and re-seeds on restart; unstar it from the catalog instead`,
 		"unsafe-data-path": `collection '${slug}' declares a dataPath outside its own data/${slug}/ subtree; refusing to delete`,
-		"path-escape": `a directory for collection '${slug}' escapes the workspace`
+		"path-escape": `a directory for collection '${slug}' escapes the workspace`,
+		"unsupported-backend": `collection '${slug}' is a shared collection — its records are documents of its app, which this delete can neither archive nor remove, and other members read the same documents. Removing its records first does NOT unlock it. To retire the whole app, a Firestore project administrator deletes it recursively (\`firebase firestore:delete "apps/<aid>" --recursive\`, children first); the app owner's client credentials cannot do it.`
 	}[result.kind];
 }
 async function pathExists(target) {
@@ -1078,6 +1898,10 @@ function isDataDirSafe(dataDir, slug, workspaceRoot) {
 *  `dataSource` collection has no record files to copy (its rows live in
 *  the external data file, which the delete never touches). */
 function restoreRecordsStep(schema) {
+	if (schema.storage?.type === "firestore") return `2. Records: NOT archived. This is a shared collection: its records are
+   documents at \`apps/<aid>/collections/<cid>/items\`, which this delete did
+   not touch or export. They are still there, and other members still read
+   them.`;
 	if (schema.storage !== void 0) return `2. Records: copy the archived database file
    \`${path.basename(schema.storage.path)}\` (next to this document) back to
    \`${schema.storage.path}\` (workspace-relative, \`cp\`). It holds every
@@ -1136,9 +1960,16 @@ ${restoreRecordsStep(schema)}
 
 - slug: \`${slug}\`
 - title: ${schema.title}
-- dataPath: \`${schema.dataPath ?? (schema.storage !== void 0 ? `(storage) ${schema.storage.path}` : `(dataSource) ${schema.dataSource?.path}`)}\`
+- dataPath: \`${schema.dataPath ?? recordLocationLabel(schema)}\`
 `;
 }
+/** Where a non-`dataPath` collection's records live, for the restore doc's
+*  header line. */
+function recordLocationLabel(schema) {
+	if (schema.storage?.type === "firestore") return "(storage) shared app";
+	if (schema.storage !== void 0) return `(storage) ${schema.storage.path}`;
+	return `(dataSource) ${schema.dataSource?.path}`;
+}
 /** Copy one skill copy + the records + RESTORE.md into `archiveDir`. */
 async function writeArchive(collection, archiveDir, workspaceRoot) {
 	const staging = stagingSkillDir(workspaceRoot, collection.slug);
@@ -1196,6 +2027,13 @@ async function deleteCollection(collection, opts = {}) {
 		kind: "preset",
 		slug
 	};
+	if (collection.schema.storage?.type === "firestore") {
+		log.warn("collections", "deleteCollection refused: a shared collection's records can be neither archived nor removed here", { slug });
+		return {
+			kind: "unsupported-backend",
+			slug
+		};
+	}
 	if (!isDataDirSafe(collection.dataDir, slug, workspaceRoot)) {
 		log.warn("collections", "deleteCollection refused: dataDir is not under the per-collection root", {
 			slug,
@@ -1813,6 +2651,32 @@ async function handleGetOntology(deps) {
 		collections
 	});
 }
+/** Publish this repository's `app.json` + shared schemas to its Firestore app.
+*
+*  Named as a whole-app action because it IS one: publish takes the repository
+*  as its unit (one roster, one public config, every shared collection), so it
+*  carries no `slug` and refusing one is not a limitation to work around.
+*
+*  The reply is prose rather than a status code on purpose. This is the one
+*  operation in the collection surface that changes what every member sees the
+*  moment it lands, and the two things the caller has to relay — what will
+*  break, and that `confirm` is how it proceeds anyway — are sentences, not
+*  fields. */
+async function handlePublishApp(deps, confirm) {
+	const result = await publishApp({
+		...deps,
+		confirm
+	});
+	if (!result.ok) {
+		const bullets = result.problems.map((problem) => `- ${problem}`).join("\n");
+		return `${result.partial ? "publish FAILED PART-WAY — some documents are already live:" : "publish refused — nothing was written:"}\n${bullets}`;
+	}
+	const dirtyNote = result.dirty ? " (WORKING TREE DIRTY — the commit does not describe what was published)" : "";
+	const stamp = result.commit ? `commit ${result.commit.slice(0, 12)}${dirtyNote}` : "no commit (not a git repository, or no HEAD)";
+	const brokenCount = result.recordIssuesCapped ? `at least ${result.recordIssues}` : `${result.recordIssues}`;
+	const forced = result.recordIssues > 0 ? ` Published over ${brokenCount} record(s) that do not satisfy the new schema — repair them now; members are reading them.` : "";
+	return `${result.created ? "Created" : "Updated"} app '${result.aid}' and published ${result.cids.length} collection(s): ${result.cids.join(", ")}. Signed ${stamp}. The previous app document is kept in \`previousPublished\` for rollback.${forced}`;
+}
 /** Return the collection-authoring reference (`collection-skills.md`),
 *  rendered by `renderSchemaDocs` — the full doc overflows the agent's
 *  per-result limit, so the default reply is the core guide + a table of
@@ -1921,7 +2785,7 @@ async function handlePutSchema(slug, schemaArg, deps) {
 		written: true
 	});
 }
-var MANAGE_COLLECTION_PROMPT = "Use `manageCollection` instead of raw Read/Write/Edit when working with a collection's records OR its schema (raw file I/O stays available as the escape hatch). Before authoring or changing a collection's `schema.json`, call `schemaDocs` to load the field/DSL reference — the default reply is the core authoring guide plus a table of contents; fetch advanced sections (actions, bells, calendar/kanban views, dataSource, storage) by passing their heading as `topic` rather than dumping `topic: \"all\"`. Then read with `getSchema` and write with `putSchema` — `putSchema` validates the whole schema before writing and returns actionable errors instead of silently failing discovery's validation. `getItems` is the only way to see computed values — `derived` fields (e.g. a portfolio's value), `toggle` projections, and `embed` records are host-computed and never present in the stored JSON files. On large collections pass `ids` and/or `fields` to keep the result small. For a question that spans collections (\"which clients have unpaid invoices?\"), start with `getOntology`: it lists every collection with its primaryKey, record count, and outbound `ref`/`embed` relations, so you know which collections to join before reading any records. `putItems` validates every row against the schema before writing (required fields, enum values, primaryKey = record id) and returns `{ written, rejected }`; fix each rejected row using its `problem` text and retry just those rows. Never include computed fields in a row you write. To update a few fields of an existing record, use `mode: \"merge\"` with a partial row ({ id, <changed fields> }) — the default upsert replaces the WHOLE record, so a partial upsert would silently erase every optional field it omits. `deleteItems` removes records by id and returns `{ deleted, rejected }`; an id that doesn't exist comes back rejected rather than counted as deleted, so check `rejected` before reporting a deletion as done. Answer aggregation questions (counts, sums, averages, group-bys) with `queryItems` on ANY collection — on a dataSource (CSV) collection it scans the whole file (getItems is row-capped, so aggregates computed from its output can be silently wrong on large files); on a file-backed collection it aggregates the enriched records, so computed fields (derived/rollup/toggle) are queryable columns.";
+var MANAGE_COLLECTION_PROMPT = "Use `manageCollection` instead of raw Read/Write/Edit when working with a collection's records OR its schema (raw file I/O stays available as the escape hatch). Before authoring or changing a collection's `schema.json`, call `schemaDocs` to load the field/DSL reference — the default reply is the core authoring guide plus a table of contents; fetch advanced sections (actions, bells, calendar/kanban views, dataSource, storage) by passing their heading as `topic` rather than dumping `topic: \"all\"`. Then read with `getSchema` and write with `putSchema` — `putSchema` validates the whole schema before writing and returns actionable errors instead of silently failing discovery's validation. `getItems` is the only way to see computed values — `derived` fields (e.g. a portfolio's value), `toggle` projections, and `embed` records are host-computed and never present in the stored JSON files. On large collections pass `ids` and/or `fields` to keep the result small. For a question that spans collections (\"which clients have unpaid invoices?\"), start with `getOntology`: it lists every collection with its primaryKey, record count, and outbound `ref`/`embed` relations, so you know which collections to join before reading any records. `putItems` validates every row against the schema before writing (required fields, enum values, primaryKey = record id) and returns `{ written, rejected }`; fix each rejected row using its `problem` text and retry just those rows. Never include computed fields in a row you write. To update a few fields of an existing record, use `mode: \"merge\"` with a partial row ({ id, <changed fields> }) — the default upsert replaces the WHOLE record, so a partial upsert would silently erase every optional field it omits. `deleteItems` removes records by id and returns `{ deleted, rejected }`; an id that doesn't exist comes back rejected rather than counted as deleted, so check `rejected` before reporting a deletion as done. `publishApp` publishes the whole repository — its `app.json` (member roster, public read/submit configuration) and every shared collection's schema — to the app's Firestore. It is the ONE operation here that changes what every member sees the moment it runs, and it cannot be undone by reverting a commit: publishing again is the only undo (the previous app document is kept as `previousPublished`). Call it when the user asks to publish, invite, or open an app; never as a follow-up to an edit the user did not ask you to ship. Its refusals are the product, not an obstacle — relay them verbatim, and do not work around one by rewriting `app.json` until the user has said what they actually want. If it reports live records the new schemas would break, show the user that list and ask before re-running with `confirm`. Answer aggregation questions (counts, sums, averages, group-bys) with `queryItems` on ANY collection — on a dataSource (CSV) collection it scans the whole file (getItems is row-capped, so aggregates computed from its output can be silently wrong on large files); on a file-backed collection it aggregates the enriched records, so computed fields (derived/rollup/toggle) are queryable columns.";
 /** Validate getItems' optional `ids`/`fields` args, then delegate. */
 async function dispatchGetItems(collection, args, deps) {
 	const ids = optionalStringArray(args.ids, "ids");
@@ -1966,18 +2830,19 @@ async function dispatchManageCollection(deps, args) {
 	const action = typeof args.action === "string" ? args.action : "";
 	if (action === "schemaDocs") return handleSchemaDocs(deps, typeof args.topic === "string" ? args.topic : void 0);
 	if (action === "getOntology") return handleGetOntology(deps);
+	if (action === "publishApp") return handlePublishApp(deps, args.confirm === true);
 	const slug = typeof args.slug === "string" ? args.slug.trim() : "";
 	if (!slug) return "manageCollection: `slug` is required (the collection's slug).";
 	if (action === "getSchema") return handleGetSchema(slug, deps);
 	if (action === "putSchema") return handlePutSchema(slug, args.schema, deps);
-	if (!RECORD_ACTIONS.has(action)) return "manageCollection: `action` must be \"getItems\", \"putItems\", \"deleteItems\", \"queryItems\", \"getOntology\", \"schemaDocs\", \"getSchema\", or \"putSchema\".";
+	if (!RECORD_ACTIONS.has(action)) return "manageCollection: `action` must be \"getItems\", \"putItems\", \"deleteItems\", \"queryItems\", \"getOntology\", \"schemaDocs\", \"getSchema\", \"putSchema\", or \"publishApp\".";
 	const collection = await loadCollection(slug, deps);
 	if (!collection) return unknownCollection(slug);
 	return dispatchRecordAction(action, collection, args, deps);
 }
 var MANAGE_COLLECTION_DEFINITION = {
 	name: "manageCollection",
-	description: "Read and write a schema-driven collection through the host — both its records and its structure. getItems returns records WITH computed values (derived formulas, toggles, embeds) the stored JSON files don't contain; putItems validates each row against the schema before writing; deleteItems removes records by id. getOntology maps the whole workspace: every collection with its record count and outbound ref/embed relations — call it first for cross-collection questions. schemaDocs returns the collection-authoring reference — the core guide plus a table of contents by default; pass `topic` for a specific section. getSchema/putSchema read and validate-then-write the collection's schema.json. Prefer it over raw file I/O on collections.",
+	description: "Read and write a schema-driven collection through the host — both its records and its structure. getItems returns records WITH computed values (derived formulas, toggles, embeds) the stored JSON files don't contain; putItems validates each row against the schema before writing; deleteItems removes records by id. getOntology maps the whole workspace: every collection with its record count and outbound ref/embed relations — call it first for cross-collection questions. schemaDocs returns the collection-authoring reference — the core guide plus a table of contents by default; pass `topic` for a specific section. getSchema/putSchema read and validate-then-write the collection's schema.json. publishApp publishes the repository's app.json + shared schemas to Firestore, where every member sees them immediately -- it refuses declarations that would be silently permissive or silently deny everyone, and refuses to publish over records the new schemas would break unless `confirm` is set. Prefer it over raw file I/O on collections.",
 	inputSchema: {
 		type: "object",
 		properties: {
@@ -1991,7 +2856,8 @@ var MANAGE_COLLECTION_DEFINITION = {
 					"getOntology",
 					"schemaDocs",
 					"getSchema",
-					"putSchema"
+					"putSchema",
+					"publishApp"
 				],
 				description: "What to do."
 			},
@@ -2027,6 +2893,10 @@ var MANAGE_COLLECTION_DEFINITION = {
 				type: "object",
 				description: "putSchema: the full collection schema object (same shape as schema.json — title, icon, dataPath, primaryKey, fields, …). Call getSchema first for the current one, and schemaDocs for the field DSL."
 			},
+			confirm: {
+				type: "boolean",
+				description: "publishApp: publish even though existing records fail the schemas being published. Omit it first — the refusal lists what would break, and that list is the thing to show the user before asking."
+			},
 			topic: {
 				type: "string",
 				description: "schemaDocs: fetch one section of the reference by heading (case-insensitive substring — e.g. \"field types\", \"kanban\", \"calendar\", \"dataSource\"). Omit for the core authoring guide plus a table of contents of every section; \"all\" returns the full document (large — it can exceed your tool-result limit)."
@@ -2048,6 +2918,6 @@ function makeManageCollectionTool(deps = {}) {
 	};
 }
 //#endregion
-export { buildCollectionActionSeedPrompt as A, validateRecordObject as C, enrichItems as D, runCollectionQuery as E, readCustomViewHtml as M, readCustomViewI18n as N, runQueryOverRows as O, readSkillTemplate as P, validateCollectionRecords as S, recordFieldProblem as T, computeCollectionIcon as _, deleteCollection as a, applyMutateAction as b, computeSuccessor as c, isTriggerDue as d, maybeSpawnSuccessor as f, ONE_SECOND_MS as g, successorId as h, deleteCustomView as i, promptPathsFor as j, buildActionSeedPrompt as k, daysInMonth as l, resolveEvery as m, MAX_UNSELECTIVE_ITEMS as n, deleteCollectionRefusalMessage as o, parseCivil as p, makeManageCollectionTool as r, advanceTriggerDate as s, MAX_SCHEMA_ISSUES as t, formatCivil as u, buildWorkspaceOntology as v, compileRecordZ as w, firstMutateParamProblem as x, schemaRelations as y };
+export { readSkillTemplate as A, APPS_COLLECTION as B, enrichItems as C, promptPathsFor as D, buildCollectionActionSeedPrompt as E, validateRecordObject as F, APP_ROLES as G, appConfigPath as H, compileRecordZ as I, AuthoredAppZ as K, recordFieldProblem as L, MAX_RECORD_ISSUES as M, STORE_UNREADABLE as N, readCustomViewHtml as O, validateCollectionRecords as P, bindsSubmitterIdentity as R, runCollectionQuery as S, buildActionSeedPrompt as T, appSchemasPath as U, PUBLIC_CONFIG_DOC as V, projectApp as W, computeCollectionIcon as _, deleteCollection as a, applyMutateAction as b, computeSuccessor as c, isTriggerDue as d, maybeSpawnSuccessor as f, ONE_SECOND_MS as g, successorId as h, deleteCustomView as i, publishApp as j, readCustomViewI18n as k, daysInMonth as l, resolveEvery as m, MAX_UNSELECTIVE_ITEMS as n, deleteCollectionRefusalMessage as o, parseCivil as p, parseAuthoredApp as q, makeManageCollectionTool as r, advanceTriggerDate as s, MAX_SCHEMA_ISSUES as t, formatCivil as u, buildWorkspaceOntology as v, runQueryOverRows as w, firstMutateParamProblem as x, schemaRelations as y, publishProblems as z };
 
-//# sourceMappingURL=server-BiRLLMpW.js.map
+//# sourceMappingURL=server-B48Jyxcj.js.map