@mulmoclaude/core 3.5.0 → 3.7.0

package/dist/collection/server/firestoreStore.d.ts

@@ -0,0 +1,14 @@
+import { SharedCollectionKey } from '../core/collectionKey';
+import { LoadedCollection } from './discoveredCollection';
+import { IoOptions } from './io';
+import { CollectionStore } from './store';
+/** The records subcollection of one shared collection.
+ *
+ *  Takes a KEY, never loose strings, and the key is the only way to reach this
+ *  function. `sharedCollectionKey` is where the name rule lives (the charset a
+ *  Firestore document id, a pubsub channel segment and the completion-bell id
+ *  must all survive), so building a path cannot be a way around it. */
+export declare function sharedItemsPath(key: SharedCollectionKey): string;
+/** The store factory registered for `storage.type === "firestore"`.
+ *  Synchronous and connection-agnostic by contract — see the header. */
+export declare function firestoreStoreFor(collection: LoadedCollection, opts: IoOptions): CollectionStore;

package/dist/collection/server/host.d.ts

@@ -1,6 +1,7 @@
 import { canonicalRoot } from '../../files/root.js';
 import { CollectionKey } from '../core/collectionKey.js';
 import { StructuredLogger } from '../../host/hostSlot.js';
+import { FirestoreDocs } from './firestoreDocs';
 /** Public alias of the shared `StructuredLogger` — keeps the domain surface name-stable. */
 export type CollectionLogger = StructuredLogger;
 /** Re-exported so collection-engine callers (the watcher, the reconciler) keep
@@ -96,6 +97,42 @@ export interface CollectionHost {
     /** True for a preset-skill slug (host-owned naming convention). */
     isPresetSlug: (slug: string) => boolean;
 }
+/** The authenticated Firestore access a shared collection is served through.
+ *
+ *  It carries NO uid, and that is a decision rather than an omission. Nothing
+ *  about a shared collection is keyed by uid any more: the documents live at
+ *  `apps/{aid}/collections/{cid}/items`, and the deployed rules authorize on
+ *  `request.auth.token.email` against the app's member roster. A uid kept
+ *  "just for identity" would be a value nothing checks, sitting next to a path
+ *  it no longer determines — which is how a later reader ends up deriving a
+ *  path from it again.
+ *
+ *  `email` is what the rules actually evaluate, so it is what makes a refusal
+ *  explainable: `permission-denied` is the most common failure a shared
+ *  collection has and the least informative, and naming the principal turns it
+ *  into "signed in as a@b — this app's roster may not list you". A session with
+ *  no verified email is NOT a session here (the accessor answers null): public
+ *  anonymous submission is a visitor's path through the published web app, not
+ *  the host's.
+ *
+ *  `docs` is the narrow document interface rather than a raw `Firestore` so the
+ *  backend stays testable: core ships `createFirestoreDocs` over the real SDK
+ *  (`firestoreDocs.ts`) and tests inject an in-memory fake. */
+export interface FirestoreHandle {
+    docs: FirestoreDocs;
+    email: string;
+    /** The signed-in Firebase uid.
+     *
+     *  The EMAIL is the principal the roster is keyed by, and it is what every
+     *  record operation needs. The uid is needed by exactly one caller —
+     *  `publish` — because the app document's `owner` is a uid: the rules
+     *  require `owner == request.auth.uid` when the app is created and require
+     *  it unchanged afterwards. Required rather than optional so a host cannot
+     *  wire a session that can read and write records but silently cannot
+     *  create an app; the failure would surface as a permission denial with
+     *  nothing in it about identity. */
+    uid: string;
+}
 /** A collection's records changed on disk. Carries the `slug` so the host can
  *  publish on a per-collection channel; `ids` lists the affected record ids
  *  when known (a consumer may ignore them and refetch the whole collection),
@@ -173,6 +210,21 @@ export declare function setCollectionChangePublisher(publish: CollectionChangePu
  *  expected to be fire-and-forget (it wraps its own pubsub call in try/catch),
  *  so this stays a thin pass-through and never throws into the write. */
 export declare function publishCollectionChange(payload: CollectionChangePayload): void;
+/** Wire the accessor for the host's authenticated Firestore session.
+ *
+ *  Separate from `configureCollectionHost` for the same reason
+ *  `setCollectionChangePublisher` is: the host binding is set at the top of
+ *  server startup, but this session doesn't exist until the user connects
+ *  remote-host (and closes again on disconnect), so it cannot be part of a
+ *  one-shot binding. Optional — left unwired, only shared collections are
+ *  affected, and they report "not connected". Pass `null` to detach. */
+export declare function setFirestoreAccessor(accessor: (() => FirestoreHandle | null) | null): void;
+/** The host's live Firestore access, or null when there is no session (or the
+ *  host never wired one — every non-shared backend leaves it unset).
+ *  Callers MUST surface null as an actionable "connect remote-host first",
+ *  never as an empty result: silence would be indistinguishable from a
+ *  collection that genuinely has no records. */
+export declare function firestoreHandle(): FirestoreHandle | null;
 /** The configured workspace root. Throws if the host never configured one —
  *  and, under an explicit-root binding (`workspaceRoot: null`), throws rather
  *  than guessing, which is the whole point of that mode: on a multi-root host

package/dist/collection/server/index.cjs

@@ -1,95 +1,115 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_root = require("../../root-rPH6FGDT.cjs");
 const require_calendarGrid = require("../../calendarGrid-DGILaVxI.cjs");
-const require_discovery = require("../../discovery-Ck4AqikY.cjs");
+const require_store = require("../../store-5_P_NsGa.cjs");
+const require_server = require("../../server-CWZyg8fn.cjs");
 const require_templatePath = require("../../templatePath-27vUZowm.cjs");
-const require_server = require("../../server-5EMj3naj.cjs");
-exports.BackendUnavailableError = require_discovery.BackendUnavailableError;
-exports.COLLECTION_ROOT_REQUIRED = require_discovery.COLLECTION_ROOT_REQUIRED;
+exports.APPS_COLLECTION = require_server.APPS_COLLECTION;
+exports.APP_MANIFEST_FILE = require_store.APP_MANIFEST_FILE;
+exports.APP_ROLES = require_server.APP_ROLES;
+exports.AuthoredAppZ = require_server.AuthoredAppZ;
+exports.BackendUnavailableError = require_store.BackendUnavailableError;
+exports.COLLECTION_ROOT_REQUIRED = require_store.COLLECTION_ROOT_REQUIRED;
 exports.COMPUTED_TYPES = require_calendarGrid.COMPUTED_TYPES;
-exports.CollectionQueryZ = require_discovery.CollectionQueryZ;
-exports.CollectionSchemaZ = require_discovery.CollectionSchemaZ;
-exports.DEFAULT_QUERY_ROWS = require_discovery.DEFAULT_QUERY_ROWS;
-exports.MAX_CSV_ROWS = require_discovery.MAX_CSV_ROWS;
-exports.MAX_QUERY_ROWS = require_discovery.MAX_QUERY_ROWS;
+exports.CollectionQueryZ = require_store.CollectionQueryZ;
+exports.CollectionSchemaZ = require_store.CollectionSchemaZ;
+exports.DEFAULT_QUERY_ROWS = require_store.DEFAULT_QUERY_ROWS;
+exports.MAX_CSV_ROWS = require_store.MAX_CSV_ROWS;
+exports.MAX_QUERY_ROWS = require_store.MAX_QUERY_ROWS;
+exports.MAX_RECORD_ISSUES = require_server.MAX_RECORD_ISSUES;
 exports.MAX_SCHEMA_ISSUES = require_server.MAX_SCHEMA_ISSUES;
 exports.MAX_UNSELECTIVE_ITEMS = require_server.MAX_UNSELECTIVE_ITEMS;
-exports.SCHEMA_FILE = require_discovery.SCHEMA_FILE;
-exports.acceptParsedSchema = require_discovery.acceptParsedSchema;
+exports.PUBLIC_CONFIG_DOC = require_server.PUBLIC_CONFIG_DOC;
+exports.SCHEMA_FILE = require_store.SCHEMA_FILE;
+exports.STORE_UNREADABLE = require_server.STORE_UNREADABLE;
+exports.acceptParsedSchema = require_store.acceptParsedSchema;
 exports.advanceTriggerDate = require_server.advanceTriggerDate;
+exports.appConfigPath = require_server.appConfigPath;
+exports.appManifestReason = require_store.appManifestReason;
+exports.appSchemasPath = require_server.appSchemasPath;
 exports.applyMutateAction = require_server.applyMutateAction;
+exports.bindsSubmitterIdentity = require_server.bindsSubmitterIdentity;
 exports.buildActionSeedPrompt = require_server.buildActionSeedPrompt;
 exports.buildCollectionActionSeedPrompt = require_server.buildCollectionActionSeedPrompt;
 exports.buildWorkspaceOntology = require_server.buildWorkspaceOntology;
 exports.canonicalRoot = require_root.canonicalRoot;
-exports.collectionChangeKey = require_discovery.collectionChangeKey;
-exports.collectionChangePayload = require_discovery.collectionChangePayload;
-exports.collectionWritable = require_discovery.collectionWritable;
-exports.compileCsvQuery = require_discovery.compileCsvQuery;
-exports.compileJsonlQuery = require_discovery.compileJsonlQuery;
+exports.collectionChangeKey = require_store.collectionChangeKey;
+exports.collectionChangePayload = require_store.collectionChangePayload;
+exports.collectionWritable = require_store.collectionWritable;
+exports.compileCsvQuery = require_store.compileCsvQuery;
+exports.compileJsonlQuery = require_store.compileJsonlQuery;
 exports.compileRecordZ = require_server.compileRecordZ;
 exports.computeCollectionIcon = require_server.computeCollectionIcon;
 exports.computeSuccessor = require_server.computeSuccessor;
-exports.configureCollectionHost = require_discovery.configureCollectionHost;
-exports.csvRowToItem = require_discovery.csvRowToItem;
+exports.configureCollectionHost = require_store.configureCollectionHost;
+exports.csvRowToItem = require_store.csvRowToItem;
 exports.daysInMonth = require_server.daysInMonth;
-exports.decodeCsvRecordId = require_discovery.decodeCsvRecordId;
-exports.dedupeByRecordId = require_discovery.dedupeByRecordId;
+exports.decodeCsvRecordId = require_store.decodeCsvRecordId;
+exports.dedupeByRecordId = require_store.dedupeByRecordId;
 exports.deleteCollection = require_server.deleteCollection;
 exports.deleteCollectionRefusalMessage = require_server.deleteCollectionRefusalMessage;
 exports.deleteCustomView = require_server.deleteCustomView;
-exports.deleteItem = require_discovery.deleteItem;
-exports.discoverCollections = require_discovery.discoverCollections;
-exports.encodeCsvRecordId = require_discovery.encodeCsvRecordId;
+exports.deleteItem = require_store.deleteItem;
+exports.discoverCollections = require_store.discoverCollections;
+exports.encodeCsvRecordId = require_store.encodeCsvRecordId;
 exports.enrichItems = require_server.enrichItems;
+exports.firestoreHandle = require_store.firestoreHandle;
 exports.firstMutateParamProblem = require_server.firstMutateParamProblem;
 exports.formatCivil = require_server.formatCivil;
-exports.generateItemId = require_discovery.generateItemId;
-exports.getWorkspaceRoot = require_discovery.getWorkspaceRoot;
-exports.isBackendUnavailable = require_discovery.isBackendUnavailable;
-exports.isContainedInRoot = require_discovery.isContainedInRoot;
-exports.isRegularFile = require_discovery.isRegularFile;
+exports.generateItemId = require_store.generateItemId;
+exports.getWorkspaceRoot = require_store.getWorkspaceRoot;
+exports.isBackendUnavailable = require_store.isBackendUnavailable;
+exports.isContainedInRoot = require_store.isContainedInRoot;
+exports.isRegularFile = require_store.isRegularFile;
 exports.isSafeActionTemplatePath = require_templatePath.isSafeActionTemplatePath;
 exports.isSafeCustomViewI18nPath = require_templatePath.isSafeCustomViewI18nPath;
 exports.isSafeCustomViewPath = require_templatePath.isSafeCustomViewPath;
 exports.isSafeTemplatePath = require_templatePath.isSafeTemplatePath;
 exports.isTriggerDue = require_server.isTriggerDue;
-exports.itemFilePath = require_discovery.itemFilePath;
-exports.listItems = require_discovery.listItems;
-exports.loadCollection = require_discovery.loadCollection;
-exports.localCollectionKey = require_discovery.localCollectionKey;
-exports.log = require_discovery.log;
+exports.itemFilePath = require_store.itemFilePath;
+exports.listItems = require_store.listItems;
+exports.loadAppManifest = require_store.loadAppManifest;
+exports.loadCollection = require_store.loadCollection;
+exports.localCollectionKey = require_store.localCollectionKey;
+exports.log = require_store.log;
 exports.makeManageCollectionTool = require_server.makeManageCollectionTool;
 exports.maybeSpawnSuccessor = require_server.maybeSpawnSuccessor;
-exports.normalizeCsvValue = require_discovery.normalizeCsvValue;
-exports.pageFromFullRead = require_discovery.pageFromFullRead;
+exports.normalizeCsvValue = require_store.normalizeCsvValue;
+exports.pageFromFullRead = require_store.pageFromFullRead;
+exports.parseAppManifest = require_store.parseAppManifest;
+exports.parseAuthoredApp = require_server.parseAuthoredApp;
 exports.parseCivil = require_server.parseCivil;
-exports.peekWorkspaceRoot = require_discovery.peekWorkspaceRoot;
-exports.projectItemFields = require_discovery.projectItemFields;
+exports.peekWorkspaceRoot = require_store.peekWorkspaceRoot;
+exports.projectApp = require_server.projectApp;
+exports.projectItemFields = require_store.projectItemFields;
 exports.promptPathsFor = require_server.promptPathsFor;
-exports.publishCollectionChange = require_discovery.publishCollectionChange;
+exports.publishApp = require_server.publishApp;
+exports.publishCollectionChange = require_store.publishCollectionChange;
+exports.publishProblems = require_server.publishProblems;
 exports.readCustomViewHtml = require_server.readCustomViewHtml;
 exports.readCustomViewI18n = require_server.readCustomViewI18n;
-exports.readItem = require_discovery.readItem;
-exports.readOnlyRefusal = require_discovery.readOnlyRefusal;
+exports.readItem = require_store.readItem;
+exports.readOnlyRefusal = require_store.readOnlyRefusal;
 exports.readSkillTemplate = require_server.readSkillTemplate;
 exports.recordFieldProblem = require_server.recordFieldProblem;
-exports.resolveCreateItemId = require_discovery.resolveCreateItemId;
-exports.resolveDataDir = require_discovery.resolveDataDir;
+exports.resolveCreateItemId = require_store.resolveCreateItemId;
+exports.resolveDataDir = require_store.resolveDataDir;
 exports.resolveEvery = require_server.resolveEvery;
-exports.resolvePrimaryField = require_discovery.resolvePrimaryField;
-exports.resolveTemplatePath = require_discovery.resolveTemplatePath;
+exports.resolvePrimaryField = require_store.resolvePrimaryField;
+exports.resolveTemplatePath = require_store.resolveTemplatePath;
 exports.runCollectionQuery = require_server.runCollectionQuery;
 exports.runQueryOverRows = require_server.runQueryOverRows;
-exports.safeRecordId = require_discovery.safeRecordId;
-exports.safeSlugName = require_discovery.safeSlugName;
+exports.safeRecordId = require_store.safeRecordId;
+exports.safeSlugName = require_store.safeSlugName;
 exports.schemaRelations = require_server.schemaRelations;
-exports.setCollectionChangePublisher = require_discovery.setCollectionChangePublisher;
-exports.sharedCollectionChangePayload = require_discovery.sharedCollectionChangePayload;
-exports.storeFor = require_discovery.storeFor;
+exports.setCollectionChangePublisher = require_store.setCollectionChangePublisher;
+exports.setFirestoreAccessor = require_store.setFirestoreAccessor;
+exports.sharedCollectionChangePayload = require_store.sharedCollectionChangePayload;
+exports.sharedItemsPath = require_store.sharedItemsPath;
+exports.storeFor = require_store.storeFor;
 exports.successorId = require_server.successorId;
-exports.toDetail = require_discovery.toDetail;
-exports.toSummary = require_discovery.toSummary;
+exports.toDetail = require_store.toDetail;
+exports.toSummary = require_store.toSummary;
 exports.validateCollectionRecords = require_server.validateCollectionRecords;
 exports.validateRecordObject = require_server.validateRecordObject;
-exports.writeItem = require_discovery.writeItem;
+exports.writeItem = require_store.writeItem;

package/dist/collection/server/index.d.ts

@@ -1,4 +1,11 @@
-export { configureCollectionHost, canonicalRoot, getWorkspaceRoot, peekWorkspaceRoot, COLLECTION_ROOT_REQUIRED, log, setCollectionChangePublisher, publishCollectionChange, collectionChangePayload, sharedCollectionChangePayload, collectionChangeKey, localCollectionKey, type CollectionHost, type CollectionLogger, type CollectionChangePayload, type LocalCollectionChange, type SharedCollectionChange, } from './host';
+export { configureCollectionHost, canonicalRoot, getWorkspaceRoot, peekWorkspaceRoot, COLLECTION_ROOT_REQUIRED, log, setCollectionChangePublisher, publishCollectionChange, collectionChangePayload, sharedCollectionChangePayload, collectionChangeKey, localCollectionKey, type CollectionHost, type CollectionLogger, type CollectionChangePayload, firestoreHandle, setFirestoreAccessor, type FirestoreHandle, type LocalCollectionChange, type SharedCollectionChange, } from './host';
+export type { FirestoreDoc, FirestoreDocs } from './firestoreDocs';
+export { sharedItemsPath } from './firestoreStore';
+export { loadAppManifest, parseAppManifest, appManifestReason, APP_MANIFEST_FILE, type AppManifest, type AppManifestResult } from './appManifest';
+export { AuthoredAppZ, parseAuthoredApp, APP_ROLES, type AuthoredApp, type AuthoredCollectionConfig, type AuthoredMail, type AuthoredSubmit, } from './publishManifest';
+export { projectApp, APPS_COLLECTION, PUBLIC_CONFIG_DOC, appConfigPath, appSchemasPath, type PublishStamp, type PublishedApp, type PublishedConfigDoc, type PublishedSchemaDoc, } from './publishProject';
+export { publishProblems, bindsSubmitterIdentity, type PublishableCollection } from './publishChecks';
+export { publishApp, type PublishOptions, type PublishResult } from './publish';
 export type { LoadedCollection } from './discoveredCollection';
 export * from './paths';
 export * from './templatePath';

package/dist/collection/server/index.js

@@ -1,6 +1,6 @@
 import { t as canonicalRoot } from "../../root-BMroU_mB.js";
 import { j as COMPUTED_TYPES } from "../../calendarGrid-CQ8MVSRb.js";
-import { $ as log, A as deleteItem, B as resolveDataDir, C as compileCsvQuery, D as MAX_QUERY_ROWS, E as DEFAULT_QUERY_ROWS, F as resolveCreateItemId, H as safeRecordId, I as writeItem, K as collectionChangeKey, L as SCHEMA_FILE, M as isRegularFile, N as listItems, O as BackendUnavailableError, P as readItem, Q as localCollectionKey, R as isContainedInRoot, T as CollectionQueryZ, U as safeSlugName, V as resolveTemplatePath, W as COLLECTION_ROOT_REQUIRED, X as getWorkspaceRoot, Y as configureCollectionHost, _ as csvRowToItem, a as toDetail, b as encodeCsvRecordId, d as storeFor, et as peekWorkspaceRoot, h as MAX_CSV_ROWS, i as resolvePrimaryField, it as sharedCollectionChangePayload, j as generateItemId, k as isBackendUnavailable, l as collectionWritable, m as projectItemFields, n as discoverCollections, nt as publishCollectionChange, o as toSummary, p as pageFromFullRead, q as collectionChangePayload, r as loadCollection, rt as setCollectionChangePublisher, s as CollectionSchemaZ, t as acceptParsedSchema, u as readOnlyRefusal, v as decodeCsvRecordId, w as compileJsonlQuery, x as normalizeCsvValue, y as dedupeByRecordId, z as itemFilePath } from "../../discovery-DH9wweuj.js";
+import { A as toSummary, B as SCHEMA_FILE, C as resolveCreateItemId, D as loadCollection, E as discoverCollections, F as loadAppManifest, G as safeRecordId, H as itemFilePath, I as parseAppManifest, J as isBackendUnavailable, K as safeSlugName, L as sharedItemsPath, N as APP_MANIFEST_FILE, O as resolvePrimaryField, P as appManifestReason, Q as collectionChangePayload, R as pageFromFullRead, S as readItem, T as acceptParsedSchema, U as resolveDataDir, V as isContainedInRoot, W as resolveTemplatePath, Y as COLLECTION_ROOT_REQUIRED, Z as collectionChangeKey, _ as MAX_QUERY_ROWS, a as MAX_CSV_ROWS, at as log, b as isRegularFile, c as decodeCsvRecordId, ct as publishCollectionChange, d as normalizeCsvValue, dt as sharedCollectionChangePayload, et as configureCollectionHost, g as DEFAULT_QUERY_ROWS, h as CollectionQueryZ, it as localCollectionKey, j as CollectionSchemaZ, k as toDetail, l as dedupeByRecordId, lt as setCollectionChangePublisher, m as compileJsonlQuery, n as readOnlyRefusal, nt as getWorkspaceRoot, ot as peekWorkspaceRoot, p as compileCsvQuery, q as BackendUnavailableError, r as storeFor, s as csvRowToItem, t as collectionWritable, tt as firestoreHandle, u as encodeCsvRecordId, ut as setFirestoreAccessor, v as deleteItem, w as writeItem, x as listItems, y as generateItemId, z as projectItemFields } from "../../store-_61sO8K8.js";
+import { A as readSkillTemplate, B as APPS_COLLECTION, C as enrichItems, D as promptPathsFor, E as buildCollectionActionSeedPrompt, F as validateRecordObject, G as APP_ROLES, H as appConfigPath, I as compileRecordZ, K as AuthoredAppZ, L as recordFieldProblem, M as MAX_RECORD_ISSUES, N as STORE_UNREADABLE, O as readCustomViewHtml, P as validateCollectionRecords, R as bindsSubmitterIdentity, S as runCollectionQuery, T as buildActionSeedPrompt, U as appSchemasPath, V as PUBLIC_CONFIG_DOC, W as projectApp, _ as computeCollectionIcon, a as deleteCollection, b as applyMutateAction, c as computeSuccessor, d as isTriggerDue, f as maybeSpawnSuccessor, h as successorId, i as deleteCustomView, j as publishApp, k as readCustomViewI18n, l as daysInMonth, m as resolveEvery, n as MAX_UNSELECTIVE_ITEMS, o as deleteCollectionRefusalMessage, p as parseCivil, q as parseAuthoredApp, r as makeManageCollectionTool, s as advanceTriggerDate, t as MAX_SCHEMA_ISSUES, u as formatCivil, v as buildWorkspaceOntology, w as runQueryOverRows, x as firstMutateParamProblem, y as schemaRelations, z as publishProblems } from "../../server-B48Jyxcj.js";
 import { i as isSafeTemplatePath, n as isSafeCustomViewI18nPath, r as isSafeCustomViewPath, t as isSafeActionTemplatePath } from "../../templatePath-k_WNbL_Q.js";
-import { A as buildCollectionActionSeedPrompt, C as validateRecordObject, D as enrichItems, E as runCollectionQuery, M as readCustomViewHtml, N as readCustomViewI18n, O as runQueryOverRows, P as readSkillTemplate, S as validateCollectionRecords, T as recordFieldProblem, _ as computeCollectionIcon, a as deleteCollection, b as applyMutateAction, c as computeSuccessor, d as isTriggerDue, f as maybeSpawnSuccessor, h as successorId, i as deleteCustomView, j as promptPathsFor, k as buildActionSeedPrompt, l as daysInMonth, m as resolveEvery, n as MAX_UNSELECTIVE_ITEMS, o as deleteCollectionRefusalMessage, p as parseCivil, r as makeManageCollectionTool, s as advanceTriggerDate, t as MAX_SCHEMA_ISSUES, u as formatCivil, v as buildWorkspaceOntology, w as compileRecordZ, x as firstMutateParamProblem, y as schemaRelations } from "../../server-BiRLLMpW.js";
-export { BackendUnavailableError, COLLECTION_ROOT_REQUIRED, COMPUTED_TYPES, CollectionQueryZ, CollectionSchemaZ, DEFAULT_QUERY_ROWS, MAX_CSV_ROWS, MAX_QUERY_ROWS, MAX_SCHEMA_ISSUES, MAX_UNSELECTIVE_ITEMS, SCHEMA_FILE, acceptParsedSchema, advanceTriggerDate, applyMutateAction, buildActionSeedPrompt, buildCollectionActionSeedPrompt, buildWorkspaceOntology, canonicalRoot, collectionChangeKey, collectionChangePayload, collectionWritable, compileCsvQuery, compileJsonlQuery, compileRecordZ, computeCollectionIcon, computeSuccessor, configureCollectionHost, csvRowToItem, daysInMonth, decodeCsvRecordId, dedupeByRecordId, deleteCollection, deleteCollectionRefusalMessage, deleteCustomView, deleteItem, discoverCollections, encodeCsvRecordId, enrichItems, firstMutateParamProblem, formatCivil, generateItemId, getWorkspaceRoot, isBackendUnavailable, isContainedInRoot, isRegularFile, isSafeActionTemplatePath, isSafeCustomViewI18nPath, isSafeCustomViewPath, isSafeTemplatePath, isTriggerDue, itemFilePath, listItems, loadCollection, localCollectionKey, log, makeManageCollectionTool, maybeSpawnSuccessor, normalizeCsvValue, pageFromFullRead, parseCivil, peekWorkspaceRoot, projectItemFields, promptPathsFor, publishCollectionChange, readCustomViewHtml, readCustomViewI18n, readItem, readOnlyRefusal, readSkillTemplate, recordFieldProblem, resolveCreateItemId, resolveDataDir, resolveEvery, resolvePrimaryField, resolveTemplatePath, runCollectionQuery, runQueryOverRows, safeRecordId, safeSlugName, schemaRelations, setCollectionChangePublisher, sharedCollectionChangePayload, storeFor, successorId, toDetail, toSummary, validateCollectionRecords, validateRecordObject, writeItem };
+export { APPS_COLLECTION, APP_MANIFEST_FILE, APP_ROLES, AuthoredAppZ, BackendUnavailableError, COLLECTION_ROOT_REQUIRED, COMPUTED_TYPES, CollectionQueryZ, CollectionSchemaZ, DEFAULT_QUERY_ROWS, MAX_CSV_ROWS, MAX_QUERY_ROWS, MAX_RECORD_ISSUES, MAX_SCHEMA_ISSUES, MAX_UNSELECTIVE_ITEMS, PUBLIC_CONFIG_DOC, SCHEMA_FILE, STORE_UNREADABLE, acceptParsedSchema, advanceTriggerDate, appConfigPath, appManifestReason, appSchemasPath, applyMutateAction, bindsSubmitterIdentity, buildActionSeedPrompt, buildCollectionActionSeedPrompt, buildWorkspaceOntology, canonicalRoot, collectionChangeKey, collectionChangePayload, collectionWritable, compileCsvQuery, compileJsonlQuery, compileRecordZ, computeCollectionIcon, computeSuccessor, configureCollectionHost, csvRowToItem, daysInMonth, decodeCsvRecordId, dedupeByRecordId, deleteCollection, deleteCollectionRefusalMessage, deleteCustomView, deleteItem, discoverCollections, encodeCsvRecordId, enrichItems, firestoreHandle, firstMutateParamProblem, formatCivil, generateItemId, getWorkspaceRoot, isBackendUnavailable, isContainedInRoot, isRegularFile, isSafeActionTemplatePath, isSafeCustomViewI18nPath, isSafeCustomViewPath, isSafeTemplatePath, isTriggerDue, itemFilePath, listItems, loadAppManifest, loadCollection, localCollectionKey, log, makeManageCollectionTool, maybeSpawnSuccessor, normalizeCsvValue, pageFromFullRead, parseAppManifest, parseAuthoredApp, parseCivil, peekWorkspaceRoot, projectApp, projectItemFields, promptPathsFor, publishApp, publishCollectionChange, publishProblems, readCustomViewHtml, readCustomViewI18n, readItem, readOnlyRefusal, readSkillTemplate, recordFieldProblem, resolveCreateItemId, resolveDataDir, resolveEvery, resolvePrimaryField, resolveTemplatePath, runCollectionQuery, runQueryOverRows, safeRecordId, safeSlugName, schemaRelations, setCollectionChangePublisher, setFirestoreAccessor, sharedCollectionChangePayload, sharedItemsPath, storeFor, successorId, toDetail, toSummary, validateCollectionRecords, validateRecordObject, writeItem };

package/dist/collection/server/manageTool.d.ts

@@ -91,6 +91,10 @@ export declare function makeManageCollectionTool(deps?: ManageCollectionDeps): {
                     type: string;
                     description: string;
                 };
+                confirm: {
+                    type: string;
+                    description: string;
+                };
                 topic: {
                     type: string;
                     description: string;

package/dist/collection/server/publish.d.ts

@@ -0,0 +1,56 @@
+import { DiscoveryOptions } from './discovery';
+import { PublishedApp } from './publishProject';
+export interface PublishOptions extends DiscoveryOptions {
+    /** Proceed even though existing records fail the schemas about to be
+     *  published. Never a default: the pre-check is the migration gate, and a
+     *  gate that opens itself is a log line. */
+    confirm?: boolean | undefined;
+    /** Wall clock, injectable so a test can assert an exact document. */
+    now?: (() => number) | undefined;
+    /** Resolve the commit the declaration is being published from. Injectable
+     *  for the same reason, and because a repository without git is a normal
+     *  state rather than a failure. */
+    resolveCommit?: ((root: string) => Promise<{
+        commit?: string | undefined;
+        dirty?: boolean | undefined;
+    }>) | undefined;
+}
+export type PublishResult = {
+    ok: false;
+    problems: string[];
+    /** Did any document reach Firestore before this failed?
+     *
+     *  Almost every refusal happens before the first write, and saying so is
+     *  most of the value of refusing. But a write that fails part-way is a
+     *  DIFFERENT state — the roster and configuration are live while the
+     *  schemas are one publish behind — and it is the state a caller most
+     *  needs to hear about. Carried as a field rather than left for the
+     *  caller to infer from prose, because a caller that guesses will guess
+     *  "nothing was written": that is what every other failure means. */
+    partial: boolean;
+} | {
+    ok: true;
+    aid: string;
+    cids: string[];
+    created: boolean;
+    commit?: string | undefined;
+    dirty: boolean;
+    /** How many live records the pre-check found that the published schemas
+     *  reject — and whether that number is a FLOOR.
+     *
+     *  `validateCollectionRecords` stops at its own cap per collection, so a
+     *  full batch means "at least this many". The count and the cap travel
+     *  together because they are read together: a caller that reports the
+     *  number without the flag understates how much repair is owed, on the
+     *  one path (a confirmed publish) where the damage is already done. */
+    recordIssues: number;
+    recordIssuesCapped: boolean;
+    published: PublishedApp;
+};
+/** Publish this repository's declaration to its app.
+ *
+ *  Everything variable is a parameter or comes from the host binding, so the
+ *  whole path is exercisable against an in-memory `FirestoreDocs` with no
+ *  network and no API key — which is the only way the conversion table gets
+ *  tested as a table. */
+export declare function publishApp(opts?: PublishOptions): Promise<PublishResult>;

package/dist/collection/server/publishChecks.d.ts

@@ -0,0 +1,29 @@
+import { AuthoredApp, AuthoredSubmit } from './publishManifest';
+/** What publish knows about a shared collection in this repository, as far as
+ *  these checks are concerned: its cid and the schema key its records are
+ *  identified by. The whole schema is deliberately not threaded in — these
+ *  checks are about the DECLARATION, and the primary key is the one part of
+ *  the schema the declaration can contradict. */
+export interface PublishableCollection {
+    cid: string;
+    primaryKey: string;
+}
+/** Does this submit declaration bind a record to the submitter's identity?
+ *
+ *  The condition for requiring `submitOnly`, and deliberately NOT "declares an
+ *  `audience`": `audience` appears only in the rules' public-create branch, so
+ *  an owner or editor never meets it and can add records freely. `immutable`
+ *  is the wrong condition too — a survey's responses are not immutable and
+ *  can be padded exactly the same way.
+ *
+ *  What these four have in common is that each one makes the record MEAN "the
+ *  person who submitted it said this": a per-uid id, a per-uid+field id, a
+ *  row stamped with the submitter's verified address, or a submission
+ *  restricted to a named participant. A record created through the writer
+ *  branch carries the same shape and none of that meaning. */
+export declare function bindsSubmitterIdentity(submit: AuthoredSubmit): boolean;
+/** Everything publish refuses, as lines the author can act on.
+ *
+ *  All of them, every time. Publish is a manual step with a human waiting on
+ *  it; stopping at the first problem turns one review into five. */
+export declare function publishProblems(app: AuthoredApp, collections: readonly PublishableCollection[], publisherEmail: string): string[];

package/dist/collection/server/publishManifest.d.ts

@@ -0,0 +1,181 @@
+import { z } from 'zod';
+/** The four roles the deployed rules understand. `participant` is the layer
+ *  that is NAMED but reads only its own rows — see `readerOf` vs `listedIn`. */
+export declare const APP_ROLES: readonly ["owner", "editor", "viewer", "participant"];
+/** The declarative mail queue, as the rules re-derive it: a transition of the
+ *  status field, a recipient read off the RECORD, and a fixed template. */
+declare const MailZ: z.ZodObject<{
+    toField: z.ZodString;
+    on: z.ZodRecord<z.ZodString, z.ZodObject<{
+        from: z.ZodArray<z.ZodString>;
+        to: z.ZodString;
+    }, z.core.$strict>>;
+    dataFields: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strict>;
+/** What the rules read out of `collections[cid]`. NOT the schema — the schema
+ *  is published beside it, untouched, for clients to render from. */
+declare const CollectionConfigZ: z.ZodObject<{
+    statusField: z.ZodOptional<z.ZodString>;
+    transitions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>;
+    immutable: z.ZodOptional<z.ZodBoolean>;
+    submitOnly: z.ZodOptional<z.ZodBoolean>;
+    peerVisibility: z.ZodOptional<z.ZodEnum<{
+        public: "public";
+        hidden: "hidden";
+    }>>;
+    revealGated: z.ZodOptional<z.ZodBoolean>;
+    gatedFrom: z.ZodOptional<z.ZodString>;
+    revealBy: z.ZodOptional<z.ZodString>;
+    mail: z.ZodOptional<z.ZodObject<{
+        toField: z.ZodString;
+        on: z.ZodRecord<z.ZodString, z.ZodObject<{
+            from: z.ZodArray<z.ZodString>;
+            to: z.ZodString;
+        }, z.core.$strict>>;
+        dataFields: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>;
+    aggregate: z.ZodOptional<z.ZodObject<{
+        by: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+declare const SubmitZ: z.ZodObject<{
+    auth: z.ZodEnum<{
+        none: "none";
+        anonymous: "anonymous";
+        verifiedEmail: "verifiedEmail";
+    }>;
+    emailField: z.ZodOptional<z.ZodString>;
+    createFields: z.ZodArray<z.ZodString>;
+    initialStatus: z.ZodOptional<z.ZodString>;
+    idFrom: z.ZodOptional<z.ZodEnum<{
+        auto: "auto";
+        "auth.uid": "auth.uid";
+        "auth.uid+field": "auth.uid+field";
+    }>>;
+    idField: z.ZodOptional<z.ZodString>;
+    validate: z.ZodOptional<z.ZodObject<{
+        required: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        keyFields: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            field: z.ZodString;
+            values: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+        }, z.core.$strict>>>;
+    }, z.core.$strict>>;
+    window: z.ZodOptional<z.ZodObject<{
+        from: z.ZodOptional<z.ZodISODateTime>;
+        until: z.ZodOptional<z.ZodISODateTime>;
+    }, z.core.$strict>>;
+    selfUpdate: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>;
+    selfTransitions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>;
+    finalize: z.ZodOptional<z.ZodBoolean>;
+    audience: z.ZodOptional<z.ZodLiteral<"participant">>;
+    gateOn: z.ZodOptional<z.ZodObject<{
+        phase: z.ZodString;
+        match: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+/** The whole authored declaration.
+ *
+ *  `owner` is accepted but is NOT the published value — publish stamps the
+ *  publisher's uid (or carries the existing one forward, which is what the
+ *  rules require on update) and refuses a declaration that disagrees. It is
+ *  accepted rather than banned because the sample app.json in the design note
+ *  shows it, and a hard refusal on a key the samples contain would be a worse
+ *  first experience than a message naming the mismatch. */
+export declare const AuthoredAppZ: z.ZodObject<{
+    aid: z.ZodString;
+    name: z.ZodOptional<z.ZodString>;
+    aidEnv: z.ZodOptional<z.ZodString>;
+    owner: z.ZodOptional<z.ZodString>;
+    members: z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodUnion<readonly [z.ZodLiteral<"*">, z.ZodString]>, z.ZodEnum<{
+        owner: "owner";
+        editor: "editor";
+        viewer: "viewer";
+        participant: "participant";
+    }>>>;
+    collections: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        statusField: z.ZodOptional<z.ZodString>;
+        transitions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>;
+        immutable: z.ZodOptional<z.ZodBoolean>;
+        submitOnly: z.ZodOptional<z.ZodBoolean>;
+        peerVisibility: z.ZodOptional<z.ZodEnum<{
+            public: "public";
+            hidden: "hidden";
+        }>>;
+        revealGated: z.ZodOptional<z.ZodBoolean>;
+        gatedFrom: z.ZodOptional<z.ZodString>;
+        revealBy: z.ZodOptional<z.ZodString>;
+        mail: z.ZodOptional<z.ZodObject<{
+            toField: z.ZodString;
+            on: z.ZodRecord<z.ZodString, z.ZodObject<{
+                from: z.ZodArray<z.ZodString>;
+                to: z.ZodString;
+            }, z.core.$strict>>;
+            dataFields: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
+        aggregate: z.ZodOptional<z.ZodObject<{
+            by: z.ZodArray<z.ZodString>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>>;
+    participantRead: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    public: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodOptional<z.ZodBoolean>;
+        read: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        submit: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+            auth: z.ZodEnum<{
+                none: "none";
+                anonymous: "anonymous";
+                verifiedEmail: "verifiedEmail";
+            }>;
+            emailField: z.ZodOptional<z.ZodString>;
+            createFields: z.ZodArray<z.ZodString>;
+            initialStatus: z.ZodOptional<z.ZodString>;
+            idFrom: z.ZodOptional<z.ZodEnum<{
+                auto: "auto";
+                "auth.uid": "auth.uid";
+                "auth.uid+field": "auth.uid+field";
+            }>>;
+            idField: z.ZodOptional<z.ZodString>;
+            validate: z.ZodOptional<z.ZodObject<{
+                required: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                keyFields: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                    field: z.ZodString;
+                    values: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+                }, z.core.$strict>>>;
+            }, z.core.$strict>>;
+            window: z.ZodOptional<z.ZodObject<{
+                from: z.ZodOptional<z.ZodISODateTime>;
+                until: z.ZodOptional<z.ZodISODateTime>;
+            }, z.core.$strict>>;
+            selfUpdate: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>;
+            selfTransitions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>;
+            finalize: z.ZodOptional<z.ZodBoolean>;
+            audience: z.ZodOptional<z.ZodLiteral<"participant">>;
+            gateOn: z.ZodOptional<z.ZodObject<{
+                phase: z.ZodString;
+                match: z.ZodString;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type AuthoredApp = z.infer<typeof AuthoredAppZ>;
+export type AuthoredCollectionConfig = z.infer<typeof CollectionConfigZ>;
+export type AuthoredSubmit = z.infer<typeof SubmitZ>;
+export type AuthoredMail = z.infer<typeof MailZ>;
+export type AuthoredAppResult = {
+    ok: true;
+    app: AuthoredApp;
+} | {
+    ok: false;
+    problems: string[];
+};
+/** Parse the authored declaration out of `app.json`'s text.
+ *
+ *  Returns a LIST of problems rather than throwing, for the same reason
+ *  `loadAppManifest` returns a failure: the caller is a gate whose entire job
+ *  is to hand the author something to act on. Every problem is reported at
+ *  once — publish is a manual step, and a parser that stops at the first key
+ *  makes it N round trips. */
+export declare function parseAuthoredApp(raw: string): AuthoredAppResult;
+/** zod issues as one actionable line each: `public.submit.responses.auth: …`. */
+export declare function authoredProblems(error: z.ZodError): string[];
+export {};