@mulmoclaude/core 3.6.0 → 3.10.0

package/dist/{server-DdHaX_Uu.js → server-BNe8XMtu.js}

@@ -1,15 +1,674 @@
 import { a as isErrorWithCode, c as isStringArray, l as isUnknownArray, s as isRecord, t as errorMessage } from "./dist-D8zokgGo.js";
 import { n as writeFileAtomic } from "./root-BMroU_mB.js";
 import { n as toPosixRelPath } from "./relPath-DW8MC8VO.js";
-import { F as isFieldDrivenEvery, L as storageKindFor, P as embedTargetId, R as fieldText, j as COMPUTED_TYPES, l as parseIsoDate, u as parseIsoDateTime, z as fieldTextOrNull } from "./calendarGrid-CQ8MVSRb.js";
-import { C as actionVisible, _ as uniqueRefTargets, b as projectBacklinkRow, c as selectDynamicRecord, f as itemIsDone, g as uniqueEmbedTargets, h as uniqueBacklinkSources, i as ownProp, n as deriveAll, o as firstDateField, s as resolveIcon, t as defangForPrompt, v as backlinkRows, x as rollupValue, y as coerceNumeric } from "./promptSafety-CpiME8pj.js";
-import { B as SCHEMA_FILE$1, C as CollectionQueryZ, J as isBackendUnavailable, K as safeSlugName, O as isRegularFile, S as compileJsonlQuery, U as resolveDataDir, V as isContainedInRoot, W as resolveTemplatePath, X as archiveDir, at as log, b as queryCsv, c as resolveMutateSet, d as storeFor, f as checkpointSqliteDatabase, i as resolvePrimaryField, j as resolveCreateItemId, m as cacheDir, n as discoverCollections, nt as getWorkspaceRoot, pt as stagingSkillDir, r as loadCollection, rt as isPresetSlug$1, s as CollectionSchemaZ, u as readOnlyRefusal, y as normalizeCsvValue } from "./discovery-CdkaURVY.js";
+import { B as fieldText, I as embedTargetId, L as isFieldDrivenEvery, N as COMPUTED_TYPES, V as fieldTextOrNull, d as parseIsoDate, f as parseIsoDateTime, x as isValidCollectionName, z as storageKindFor } from "./itemId-DfTm08jm.js";
+import { C as actionVisible, _ as uniqueRefTargets, b as projectBacklinkRow, c as selectDynamicRecord, f as itemIsDone, g as uniqueEmbedTargets, h as uniqueBacklinkSources, i as ownProp, n as deriveAll, o as firstDateField, s as resolveIcon, t as defangForPrompt, v as backlinkRows, x as rollupValue, y as coerceNumeric } from "./promptSafety-CSdyp7RF.js";
+import { B as SCHEMA_FILE$1, C as CollectionQueryZ, I as parseAppManifest, J as isBackendUnavailable, K as safeSlugName, O as isRegularFile, S as compileJsonlQuery, U as resolveDataDir, V as isContainedInRoot, W as resolveTemplatePath, X as archiveDir, b as queryCsv, c as resolveMutateSet, d as storeFor, f as checkpointSqliteDatabase, ht as stagingSkillDir, i as resolvePrimaryField, it as isPresetSlug$1, j as resolveCreateItemId, m as cacheDir, n as discoverCollections, nt as getWorkspaceRoot, ot as log, r as loadCollection, s as CollectionSchemaZ, u as readOnlyRefusal, y as normalizeCsvValue } from "./discovery-B9zdNkgW.js";
 import { ingestStatePath } from "./feeds/paths.js";
 import { mirrorSkillWrite } from "./skill-bridge/index.js";
 import path from "node:path";
 import { randomBytes, randomUUID } from "node:crypto";
 import { cp, lstat, mkdir, open, readFile, readdir, rm, rmdir, stat, unlink, writeFile } from "node:fs/promises";
 import { z } from "zod";
+//#region src/collection/server/publishManifest.ts
+/** A collection id / app id, held to the one name rule (`SAFE_SLUG_PATTERN`)
+*  that `sharedCollectionKey` applies. Stated once so a path built later
+*  cannot be a way around it. */
+var NameZ = z.string().refine(isValidCollectionName, { message: "is not a valid id (letters, digits, '-' and '_' only)" });
+/** An address on the roster. Not validated as an email beyond "has an @":
+*  the rules compare it to `request.auth.token.email` verbatim, so any
+*  narrowing here would refuse addresses Firebase itself accepts. */
+var EmailZ = z.string().trim().min(3).includes("@");
+/** The four roles the deployed rules understand. `participant` is the layer
+*  that is NAMED but reads only its own rows — see `readerOf` vs `listedIn`. */
+var APP_ROLES = [
+	"owner",
+	"editor",
+	"viewer",
+	"participant"
+];
+var RoleZ = z.enum(APP_ROLES);
+/** `{ email: { "*" | cid: role } }`. The `"*"` key is the app-wide role; a
+*  member may hold per-collection roles only (the stylist who is editor of
+*  bookings and viewer of everything else). */
+var MembersZ = z.record(EmailZ, z.record(z.union([z.literal("*"), NameZ]), RoleZ));
+/** The declarative mail queue, as the rules re-derive it: a transition of the
+*  status field, a recipient read off the RECORD, and a fixed template. */
+var MailZ = z.object({
+	toField: z.string().trim().min(1),
+	on: z.record(z.string().trim().min(1), z.object({
+		from: z.array(z.string().trim().min(1)).min(1),
+		to: z.string().trim().min(1)
+	}).strict()),
+	dataFields: z.array(z.string().trim().min(1)).optional()
+}).strict();
+/** What the rules read out of `collections[cid]`. NOT the schema — the schema
+*  is published beside it, untouched, for clients to render from. */
+var CollectionConfigZ = z.object({
+	statusField: z.string().trim().min(1).optional(),
+	/** `{ initial: [...], <status>: [<status>...] }`. Binds writers too, and
+	*  binds `create` — that is the point of publishing it. */
+	transitions: z.record(z.string().trim().min(1), z.array(z.string().trim().min(1))).optional(),
+	immutable: z.boolean().optional(),
+	submitOnly: z.boolean().optional(),
+	peerVisibility: z.enum(["public", "hidden"]).optional(),
+	revealGated: z.boolean().optional(),
+	gatedFrom: NameZ.optional(),
+	revealBy: z.string().trim().min(1).optional(),
+	mail: MailZ.optional(),
+	/** Which fields an aggregate groups by. Declared here rather than in the
+	*  schema for the same reason as everything else in this file — the schema
+	*  has no `aggregate` key yet — and it is here at all because the
+	*  invariant that guards it ("every aggregation key is a CHECKED field")
+	*  is about `public.submit`, which is an app-level declaration. Published
+	*  as-is; the rules never read it. */
+	aggregate: z.object({ by: z.array(z.string().trim().min(1)).min(1) }).strict().optional()
+}).strict();
+/** An authored submit window. ISO strings, because `app.json` is JSON and a
+*  Firestore `Timestamp` has no JSON form. Publish lowers it to epoch millis —
+*  the rules do not coerce strings, so an ISO string reaching Firestore is a
+*  type error that fails CLOSED (`inWindow` refuses every submission and the
+*  author sees "nobody can submit", not an error). */
+var WindowZ = z.object({
+	from: z.iso.datetime().optional(),
+	until: z.iso.datetime().optional()
+}).strict();
+var ValidateZ = z.object({
+	required: z.array(z.string().trim().min(1)).optional(),
+	/** Capped at two by the rules themselves: rules have no iteration, so
+	*  `keyFieldsOk` is unrolled. A third would be accepted here and silently
+	*  unchecked there. */
+	keyFields: z.array(z.object({
+		field: z.string().trim().min(1),
+		values: z.array(z.union([
+			z.string(),
+			z.number(),
+			z.boolean()
+		])).min(1)
+	}).strict()).optional()
+}).strict();
+var SubmitZ = z.object({
+	auth: z.enum([
+		"none",
+		"anonymous",
+		"verifiedEmail"
+	]),
+	emailField: z.string().trim().min(1).optional(),
+	createFields: z.array(z.string().trim().min(1)).min(1),
+	initialStatus: z.string().trim().min(1).optional(),
+	idFrom: z.enum([
+		"auto",
+		"auth.uid",
+		"auth.uid+field"
+	]).optional(),
+	idField: z.string().trim().min(1).optional(),
+	validate: ValidateZ.optional(),
+	window: WindowZ.optional(),
+	/** Per CURRENT STATUS, never a flat list: a flat list lets a customer move
+	*  an approved booking's `startAt` without anyone re-approving it. */
+	selfUpdate: z.record(z.string().trim().min(1), z.array(z.string().trim().min(1))).optional(),
+	selfTransitions: z.record(z.string().trim().min(1), z.array(z.string().trim().min(1))).optional(),
+	finalize: z.boolean().optional(),
+	audience: z.literal("participant").optional(),
+	gateOn: z.object({
+		phase: z.string().trim().min(1),
+		match: z.string().trim().min(1)
+	}).strict().optional()
+}).strict();
+var PublicZ = z.object({
+	/** The master switch. Anonymous submission (`auth: "none"`) needs it as
+	*  well as its own declaration. */
+	enabled: z.boolean().optional(),
+	read: z.array(NameZ).optional(),
+	submit: z.record(NameZ, SubmitZ).optional()
+}).strict();
+/** The whole authored declaration.
+*
+*  `owner` is accepted but is NOT the published value — publish stamps the
+*  publisher's uid (or carries the existing one forward, which is what the
+*  rules require on update) and refuses a declaration that disagrees. It is
+*  accepted rather than banned because the sample app.json in the design note
+*  shows it, and a hard refusal on a key the samples contain would be a worse
+*  first experience than a message naming the mismatch. */
+var AuthoredAppZ = z.object({
+	aid: NameZ,
+	name: z.string().trim().min(1).optional(),
+	/** Per-worktree app id (design D6, implementation order 7). Accepted so a
+	*  repository already carrying it parses; nothing reads it yet. */
+	aidEnv: z.string().trim().min(1).optional(),
+	owner: z.string().trim().min(1).optional(),
+	members: MembersZ,
+	collections: z.record(NameZ, CollectionConfigZ).optional(),
+	participantRead: z.array(NameZ).optional(),
+	public: PublicZ.optional()
+}).strict();
+/** Parse the authored declaration out of `app.json`'s text.
+*
+*  Returns a LIST of problems rather than throwing, for the same reason
+*  `loadAppManifest` returns a failure: the caller is a gate whose entire job
+*  is to hand the author something to act on. Every problem is reported at
+*  once — publish is a manual step, and a parser that stops at the first key
+*  makes it N round trips. */
+function parseAuthoredApp(raw) {
+	const manifest = parseAppManifest(raw);
+	if (!manifest.ok) return {
+		ok: false,
+		problems: [manifest.kind === "missing" ? "app.json is missing" : manifest.detail]
+	};
+	const parsed = AuthoredAppZ.safeParse(JSON.parse(raw));
+	if (!parsed.success) return {
+		ok: false,
+		problems: authoredProblems(parsed.error)
+	};
+	return {
+		ok: true,
+		app: parsed.data
+	};
+}
+/** zod issues as one actionable line each: `public.submit.responses.auth: …`. */
+function authoredProblems(error) {
+	return error.issues.map((issue) => {
+		return `${issue.path.length > 0 ? issue.path.join(".") : "app.json"}: ${issue.message}`;
+	});
+}
+//#endregion
+//#region src/collection/server/publishProject.ts
+/** The document id under `apps/{aid}/config`. One document, named, rather than
+*  a spread of them: a second public document is a second thing to keep in
+*  step, and nothing yet needs one. */
+var PUBLIC_CONFIG_DOC = "public";
+/** Drop keys whose value is `undefined`. Firestore rejects an undefined field
+*  value outright, and `"k" in c` — which every optional key in the rules is
+*  read through — must mean "the author declared it". */
+function compact(entries) {
+	return Object.fromEntries(Object.entries(entries).filter(([, value]) => value !== void 0));
+}
+/** ISO → epoch millis, the one conversion the rules cannot do for themselves.
+*  The caller has already refused an unparseable string (the authored parser
+*  requires `z.iso.datetime()`), so a NaN here would be a programming error;
+*  it is still checked, because a NaN written to Firestore fails closed in the
+*  same silent way an ISO string does. */
+function windowMillis(window) {
+	if (!window) return void 0;
+	const out = {};
+	if (window.from !== void 0) out.fromMs = Date.parse(window.from);
+	if (window.until !== void 0) out.untilMs = Date.parse(window.until);
+	if (Object.values(out).some((value) => !Number.isFinite(value))) throw new Error(`publish: window bound is not a parseable timestamp (${JSON.stringify(window)})`);
+	return Object.keys(out).length > 0 ? out : void 0;
+}
+/** One `public.submit[cid]`, with its window lowered. Everything else passes
+*  through: the rules read these keys by the names the author wrote. */
+function projectSubmit(submit) {
+	const { window, ...rest } = submit;
+	return compact({
+		...rest,
+		window: windowMillis(window)
+	});
+}
+/** The roster's addresses as a set, in a stable order.
+*
+*  Sorted so two publishes of the same declaration produce the same document
+*  — idempotence is a property this step is tested for, and Firestore compares
+*  arrays by ORDER. `membersConsistent()` compares as sets and would accept
+*  any order; the test that would notice is the one asserting a second publish
+*  changes nothing but `publishedAt`. */
+function memberEmailsOf(members) {
+	return Object.keys(members).sort();
+}
+/** The previous document, kept for rollback, with its OWN `previousPublished`
+*  stripped.
+*
+*  One level, deliberately. Chaining would make every publish carry the entire
+*  history of the app inside a single document, which grows without bound and
+*  meets Firestore's 1 MiB document limit as a permission-shaped failure at
+*  some unpredictable publish. One level answers the question rollback
+*  actually asks — "put back what was there before I broke it" — and the
+*  further history is in git, which is where the declaration came from. */
+function previousOf(existing) {
+	if (!existing) return void 0;
+	const { previousPublished: __dropped, ...rest } = existing;
+	return rest;
+}
+/** Project the authored declaration into the documents publish writes.
+*
+*  `existing` is the app document as it is in Firestore right now, or null on
+*  a first publish. Two things need it, both required by the rules:
+*    - `owner` must be UNCHANGED on update. Re-stamping the publisher's uid
+*      would be refused for any app whose owner ever signed in as a different
+*      account, and would silently transfer ownership if it were not.
+*    - `previousPublished` is that document, so a rollback has something to
+*      put back.
+*
+*  Pure: no clock, no filesystem, no Firestore. Everything variable arrives as
+*  a parameter, which is what makes the conversion table testable as a table. */
+function projectApp(authored, schemas, stamp, existing) {
+	const owner = typeof existing?.owner === "string" ? existing.owner : stamp.uid;
+	const submit = Object.fromEntries(Object.entries(authored.public?.submit ?? {}).map(([cid, spec]) => [cid, projectSubmit(spec)]));
+	const publicBlock = authored.public ? compact({
+		enabled: authored.public.enabled,
+		read: authored.public.read,
+		submit: Object.keys(submit).length > 0 ? submit : void 0
+	}) : void 0;
+	const app = compact({
+		aid: authored.aid,
+		name: authored.name,
+		owner,
+		members: authored.members,
+		memberEmails: memberEmailsOf(authored.members),
+		collections: authored.collections,
+		participantRead: authored.participantRead,
+		public: publicBlock,
+		publishedAt: stamp.publishedAt,
+		publishedBy: stamp.email,
+		publishedCommit: stamp.commit,
+		publishedDirty: stamp.dirty === true ? true : void 0,
+		previousPublished: previousOf(existing)
+	});
+	const config = {
+		enabled: authored.public?.enabled === true,
+		read: authored.public?.read ?? [],
+		submit,
+		publishedAt: stamp.publishedAt
+	};
+	if (authored.name !== void 0) config.name = authored.name;
+	return {
+		app,
+		schemas: schemas.map(({ cid, schema }) => ({
+			cid,
+			doc: schemaDoc(schema, stamp)
+		})),
+		config
+	};
+}
+/** Keys on the app document that publish owns: what is PUBLIC right now, and
+*  the rule-facing configuration anonymous access is judged against. Deploy
+*  carries them through from the existing document and never authors them. */
+var PUBLISH_OWNED_KEYS = [
+	"public",
+	"collections",
+	"participantRead",
+	"publishedAt",
+	"publishedBy",
+	"publishedCommit",
+	"publishedDirty",
+	"previousPublished"
+];
+var isPublishOwned = (key) => PUBLISH_OWNED_KEYS.includes(key);
+function projectDeploy(authored, schemas, stamp, existing) {
+	const { app } = projectApp(authored, schemas, stamp, existing);
+	const deployed = Object.fromEntries(Object.entries(app).filter(([key]) => !isPublishOwned(key)));
+	for (const key of PUBLISH_OWNED_KEYS) {
+		const live = existing?.[key];
+		if (live !== void 0) deployed[key] = live;
+	}
+	deployed.deployedAt = stamp.publishedAt;
+	deployed.deployedBy = stamp.email;
+	if (stamp.commit !== void 0) deployed.deployedCommit = stamp.commit;
+	return {
+		app: deployed,
+		staging: schemas.map(({ cid, schema }) => ({
+			cid,
+			doc: stagedDoc(schema, stamp, authored, cid)
+		}))
+	};
+}
+/** One staged schema document, carrying this cid's rule-facing configuration
+*  alongside the schema so publish can promote them together. */
+function stagedDoc(schema, stamp, authored, cid) {
+	const doc = {
+		publishedSchema: schema,
+		deployedAt: stamp.publishedAt,
+		deployedBy: stamp.email
+	};
+	const config = authored.collections?.[cid];
+	if (config !== void 0) doc.config = config;
+	if (authored.participantRead?.includes(cid) === true) doc.participantRead = true;
+	if (stamp.commit !== void 0) doc.deployedCommit = stamp.commit;
+	return doc;
+}
+/** The rule-facing configuration to promote, read from the STAGED documents
+*  rather than from the manifest as it reads right now.
+*
+*  Otherwise: deploy revision A, edit `app.json` to revision B, publish — and
+*  the promoted schema is A's while the authorization behaviour is B's, a
+*  combination nobody exercised through `/staging/{aid}`.
+*
+*  (`public` is deliberately NOT part of this: it is not staged, because it is
+*  the decision being made AT publish rather than something under test.) */
+function stagedRuleConfig(staged) {
+	const entries = [];
+	const participantRead = [];
+	for (const entry of staged) {
+		const { config } = entry.doc;
+		if (config !== void 0) entries.push([entry.cid, config]);
+		if (entry.doc.participantRead === true) participantRead.push(entry.cid);
+	}
+	return {
+		collections: entries.length > 0 ? Object.fromEntries(entries) : void 0,
+		participantRead: participantRead.length > 0 ? participantRead : void 0
+	};
+}
+function projectPublish(authored, staged, stamp, existing) {
+	const { app, config } = projectApp(authored, [], stamp, existing);
+	const staging = stagedRuleConfig(staged);
+	app.collections = staging.collections;
+	app.participantRead = staging.participantRead;
+	const published = Object.fromEntries(Object.entries(existing ?? app).filter(([key]) => !isPublishOwned(key)));
+	for (const key of PUBLISH_OWNED_KEYS) if (key !== "public" && app[key] !== void 0) published[key] = app[key];
+	const publicBlock = app.public;
+	return {
+		app: published,
+		config,
+		public: isRecord(publicBlock) ? publicBlock : void 0
+	};
+}
+/** Re-stamp a staged schema document as it is promoted to `collections/{cid}`.
+*
+*  The stamp answers "which version is PUBLIC right now, and who made it so",
+*  so it is written by the operation that changes the answer — publish — not
+*  carried over from the deploy that staged it. */
+function promoteSchema(staged, stamp) {
+	const doc = {
+		publishedSchema: staged.publishedSchema,
+		publishedAt: stamp.publishedAt,
+		publishedBy: stamp.email
+	};
+	if (stamp.commit !== void 0) doc.publishedCommit = stamp.commit;
+	return doc;
+}
+/** One published schema document. Written key by key rather than through
+*  `compact`, so the declared type is the type — an optional commit is the
+*  only variable part. */
+function schemaDoc(schema, stamp) {
+	const doc = {
+		publishedSchema: schema,
+		publishedAt: stamp.publishedAt,
+		publishedBy: stamp.email
+	};
+	if (stamp.commit !== void 0) doc.publishedCommit = stamp.commit;
+	return doc;
+}
+/** The app documents' parent path — the `FirestoreDocs` seam takes a
+*  collection path plus a document id, and the app document's id is the aid. */
+var APPS_COLLECTION = "apps";
+/** The collection (schema) documents' parent path — what the PUBLIC page
+*  reads, written only by publish (promotion). */
+var appSchemasPath = (aid) => `apps/${aid}/collections`;
+/** The URL-slug reservations — `appSlugs/{slug}` → `{ aid, published }`.
+*
+*  A TOP-LEVEL collection, not a field on the app: the public page resolves a
+*  slug to an aid BEFORE it can read anything under `apps/{aid}`, and a slug
+*  has to be claimable atomically (create-if-absent) so two apps cannot hold
+*  the same URL.
+*
+*  `published` is what makes the reservation invisible until publish. The slug
+*  is human-readable, so a readable reservation would let anyone guess the URL
+*  and get the aid — and the aid is the `/staging/{aid}` entrance. The rule is
+*  `allow read: if resource.data.published == true`, which needs no `get()` and
+*  so costs nothing against the rules' expression budget. */
+var APP_SLUGS_COLLECTION = "appSlugs";
+var appSlugDoc = (aid, published) => ({
+	aid,
+	published
+});
+/** The staged schema documents' parent path — what `/staging/{aid}` reads,
+*  written by deploy. A separate DOCUMENT rather than a field beside
+*  `publishedSchema`, because the rules cannot hide a field: anything inside a
+*  document the public page may read is public. */
+var appStagingPath = (aid) => `apps/${aid}/staging`;
+/** The public-config documents' parent path. */
+var appConfigPath = (aid) => `apps/${aid}/config`;
+//#endregion
+//#region src/collection/server/publishChecks.ts
+/** Does this submit declaration bind a record to the submitter's identity?
+*
+*  The condition for requiring `submitOnly`, and deliberately NOT "declares an
+*  `audience`": `audience` appears only in the rules' public-create branch, so
+*  an owner or editor never meets it and can add records freely. `immutable`
+*  is the wrong condition too — a survey's responses are not immutable and
+*  can be padded exactly the same way.
+*
+*  What these four have in common is that each one makes the record MEAN "the
+*  person who submitted it said this": a per-uid id, a per-uid+field id, a
+*  row stamped with the submitter's verified address, or a submission
+*  restricted to a named participant. A record created through the writer
+*  branch carries the same shape and none of that meaning. */
+function bindsSubmitterIdentity(submit) {
+	return submit.idFrom === "auth.uid" || submit.idFrom === "auth.uid+field" || submit.emailField !== void 0 || submit.audience === "participant";
+}
+/** The fields a rule actually CHECKS the value of, for one collection.
+*
+*  `keyFields` pins a value against a declared set, `gateOn.match` pins it
+*  against the session's current question, and the status field is pinned by
+*  the transition machine. An aggregation grouped by anything else is grouped
+*  by a field any submitter may write anything into — so the published
+*  aggregate is whatever the noisiest respondent decided it should be. */
+function checkedFields(collection, submit) {
+	const fields = /* @__PURE__ */ new Set();
+	for (const keyField of submit?.validate?.keyFields ?? []) fields.add(keyField.field);
+	if (submit?.gateOn) fields.add(submit.gateOn.match);
+	if (collection?.statusField) fields.add(collection.statusField);
+	return fields;
+}
+/** INVARIANT 1 — a submission bound to its submitter needs `submitOnly`. */
+function submitOnlyProblems(app) {
+	const problems = [];
+	for (const [cid, submit] of Object.entries(app.public?.submit ?? {})) {
+		if (!bindsSubmitterIdentity(submit)) continue;
+		if (app.collections?.[cid]?.submitOnly === true) continue;
+		problems.push(`collections.${cid}.submitOnly must be true: public.submit.${cid} binds each record to its submitter (${identityBindings(submit).join(", ")}), so a record created any other way would carry that meaning without having earned it. Without submitOnly the rules let an owner or editor write rows directly into ${cid}.`);
+	}
+	return problems;
+}
+function identityBindings(submit) {
+	const bindings = [];
+	if (submit.idFrom === "auth.uid" || submit.idFrom === "auth.uid+field") bindings.push(`idFrom: "${submit.idFrom}"`);
+	if (submit.emailField !== void 0) bindings.push(`emailField: "${submit.emailField}"`);
+	if (submit.audience === "participant") bindings.push(`audience: "participant"`);
+	return bindings;
+}
+/** INVARIANT 2 — every aggregation key is a field some rule checks. */
+function aggregateProblems(app) {
+	const problems = [];
+	for (const [cid, collection] of Object.entries(app.collections ?? {})) {
+		const keys = collection.aggregate?.by;
+		if (!keys) continue;
+		const checked = checkedFields(collection, app.public?.submit?.[cid]);
+		const loose = keys.filter((field) => !checked.has(field));
+		const spelled = loose.map((field) => `'${field}'`).join(", ");
+		if (loose.length > 0) problems.push(`collections.${cid}.aggregate.by names ${spelled}, which no rule checks the value of. An aggregation key must appear in public.submit.${cid}.validate.keyFields, in gateOn.match, or be the statusField — otherwise a submitter chooses their own bucket and the published aggregate is not a count of anything.`);
+	}
+	return problems;
+}
+/** INVARIANT 3 — `auth: "verifiedEmail"` only.
+*
+*  A product decision, not a rules limitation: the rules keep all three stages
+*  and the emulator tests keep exercising them, because deleting a stage from
+*  the rules turns a change of mind into a cross-repo deploy. Publish is where
+*  the current decision is expressed, and it is one line to move. */
+function authProblems(app) {
+	return Object.entries(app.public?.submit ?? {}).filter(([, submit]) => submit.auth !== "verifiedEmail").map(([cid, submit]) => `public.submit.${cid}.auth is "${submit.auth}": only "verifiedEmail" may be published. The rules still implement "none" and "anonymous" — this is a product decision, and lifting it is a change here, not a rules deploy.`);
+}
+/** INVARIANT 5 — a mail transition's origins and destination must be disjoint.
+*
+*  Overlap means the same write can satisfy the same template twice over, and
+*  the deterministic mail id is the only other thing stopping a duplicate
+*  send. The rules also require the status to have CHANGED, so an overlapping
+*  declaration is not merely redundant: `from` containing `to` is a transition
+*  that can never fire, which is a mail nobody ever receives. */
+function mailProblems(app) {
+	return Object.entries(app.collections ?? {}).flatMap(([cid, collection]) => collectionMailProblems(cid, collection));
+}
+function collectionMailProblems(cid, collection) {
+	const { mail } = collection;
+	if (!mail) return [];
+	const problems = [];
+	if (!collection.statusField) problems.push(`collections.${cid}.mail needs collections.${cid}.statusField: the rules read the status before and after the write to decide the mail is warranted.`);
+	for (const [template, transition] of Object.entries(mail.on)) problems.push(...templateMailProblems(cid, collection, template, transition));
+	return problems;
+}
+function templateMailProblems(cid, collection, template, transition) {
+	const problems = [];
+	if (transition.from.includes(transition.to)) problems.push(`collections.${cid}.mail.on.${template} lists "${transition.to}" in both \`from\` and \`to\`. The rules require the status to CHANGE in the same write, so this template can never send.`);
+	const allowed = collection.transitions;
+	if (allowed) {
+		const unreachable = transition.from.filter((from) => !(allowed[from] ?? []).includes(transition.to));
+		const spelled = unreachable.map((from) => `'${from}' -> '${transition.to}'`).join(", ");
+		if (unreachable.length > 0) problems.push(`collections.${cid}.mail.on.${template} sends on ${spelled}, which collections.${cid}.transitions does not allow. The record write is refused first, so the mail never fires.`);
+	}
+	return problems;
+}
+/** INVARIANTS 6 and 7 — the window is a real interval, and `keyFields` fits
+*  the unrolled check in the rules. */
+function submitShapeProblems(app) {
+	return Object.entries(app.public?.submit ?? {}).flatMap(([cid, submit]) => [...windowProblems(cid, submit), ...keyFieldCountProblems(cid, submit)]);
+}
+function windowProblems(cid, submit) {
+	const { window } = submit;
+	if (window?.from === void 0 || window.until === void 0) return [];
+	if (Date.parse(window.until) > Date.parse(window.from)) return [];
+	return [`public.submit.${cid}.window closes at or before it opens (${window.from} -> ${window.until}): nothing could ever be submitted.`];
+}
+function keyFieldCountProblems(cid, submit) {
+	const keyFields = submit.validate?.keyFields ?? [];
+	if (keyFields.length <= 2) return [];
+	return [`public.submit.${cid}.validate.keyFields declares ${keyFields.length}; the rules check at most 2. Rules have no iteration, so the check is unrolled — a third would be published and never enforced.`];
+}
+/** The fail-closed traps: declarations the rules read together, where the
+*  missing half denies every write instead of loosening one. */
+function coherenceProblems(app) {
+	const fromSubmits = Object.entries(app.public?.submit ?? {}).flatMap(([cid, submit]) => submitCoherenceProblems(app, cid, submit));
+	const fromCollections = Object.entries(app.collections ?? {}).flatMap(([cid, collection]) => gateCoherenceProblems(cid, collection));
+	return [...fromSubmits, ...fromCollections];
+}
+/** `initialStatus` is read together with the collection's `statusField` and
+*  with `createFields`; miss either and every submission is refused. */
+function statusCoherenceProblems(cid, submit, collection) {
+	if (submit.initialStatus === void 0) return [];
+	if (!collection?.statusField) return [`public.submit.${cid}.initialStatus needs collections.${cid}.statusField: the rules look the status up by that name, and refuse every submission without it.`];
+	if (new Set(submit.createFields).has(collection.statusField)) return [];
+	return [`public.submit.${cid}.createFields must include "${collection.statusField}": a submission may carry ONLY the createFields, and the rules also require the status field to be present and equal to initialStatus. As written, every submission is refused.`];
+}
+/** Every field a RULE reads off a submitted record, other than the status
+*  field (which `statusCoherenceProblems` words for itself).
+*
+*  `emailField` and `idField` belong here for exactly the reason `required`
+*  and `keyFields` do, and forgetting them was the same oversight twice: the
+*  rules read `request.resource.data[s.emailField]` and rebuild the document
+*  id from `s.idField`, while `hasOnly(createFields)` decides what a
+*  submission may carry at all. A field in one list and not the other is a
+*  contradiction the submitter cannot resolve — including it is refused,
+*  omitting it fails the check. */
+function ruleReadFields(submit) {
+	const fields = [];
+	if (submit.emailField !== void 0) fields.push({
+		field: submit.emailField,
+		why: `public.submit.<cid>.emailField — the rules compare it to the submitter's verified address`
+	});
+	if (submit.idFrom === "auth.uid+field" && submit.idField !== void 0) fields.push({
+		field: submit.idField,
+		why: `public.submit.<cid>.idField — the rules rebuild the document id from it`
+	});
+	return fields;
+}
+/** A checked field a submission is not allowed to carry can never be
+*  satisfied: carrying it fails `hasOnly`, omitting it fails the check. */
+function createFieldProblems(cid, submit) {
+	const createFields = new Set(submit.createFields);
+	const ruleRead = ruleReadFields(submit).filter((entry) => !createFields.has(entry.field)).map((entry) => `public.submit.${cid}.createFields must include "${entry.field}" (${entry.why.replace("<cid>", cid)}): a submission may carry only the createFields, so as written every submission is refused whether or not it carries the field.`);
+	const required = (submit.validate?.required ?? []).filter((field) => !createFields.has(field)).map((field) => `public.submit.${cid}.validate.required names "${field}", which is not in createFields: a submission may carry only the createFields, so the requirement can never be met.`);
+	const keyFields = (submit.validate?.keyFields ?? []).filter((keyField) => !createFields.has(keyField.field)).map((keyField) => `public.submit.${cid}.validate.keyFields checks "${keyField.field}", which is not in createFields: a submission carrying it is refused, and one omitting it fails the check.`);
+	return [
+		...ruleRead,
+		...required,
+		...keyFields
+	];
+}
+function submitCoherenceProblems(app, cid, submit) {
+	const collection = app.collections?.[cid];
+	const problems = [...statusCoherenceProblems(cid, submit, collection), ...createFieldProblems(cid, submit)];
+	if (submit.idFrom === "auth.uid+field" && submit.idField === void 0) problems.push(`public.submit.${cid}.idFrom is "auth.uid+field" but no idField is declared: the rules rebuild the document id from that field and refuse every create.`);
+	if ((submit.selfUpdate !== void 0 || submit.selfTransitions !== void 0) && !collection?.statusField) problems.push(`public.submit.${cid}.selfUpdate / selfTransitions are declared per CURRENT STATUS, but collections.${cid} declares no statusField: the rules read the current status first and refuse every self-edit without it.`);
+	if (submit.audience === "participant" && Object.keys(app.members).length === 0) problems.push(`public.submit.${cid}.audience is "participant" but the roster is empty: the rules resolve the submitter's role from members, so every submission is refused.`);
+	return problems;
+}
+/** The staged reveal reads its flag off the PARENT record, so the path to that
+*  parent is not optional decoration — without it the gate never opens. */
+function gateCoherenceProblems(cid, collection) {
+	if (collection.revealGated !== true) return [];
+	if (collection.gatedFrom !== void 0 && collection.revealBy !== void 0) return [];
+	return [`collections.${cid}.revealGated needs both gatedFrom and revealBy: the flag is read off the PARENT record, and without the path the gate never opens.`];
+}
+/** The publisher must be able to write what they are about to write.
+*
+*  On a first publish the rules require the creator to name themselves owner,
+*  in the roster, under `'*'`. Getting this wrong produces a bare permission
+*  error from Firestore with nothing in it about rosters — worth one line
+*  here instead. */
+function publisherProblems(app, publisherEmail) {
+	if (app.members[publisherEmail]?.["*"] === "owner") return [];
+	return [`members must give you app-wide owner: add "${publisherEmail}": { "*": "owner" }. The rules require the publisher to hold that role (and to name themselves owner when the app is first created); otherwise the write is refused with no explanation.`];
+}
+/** Every cid the declaration mentions must be a collection that exists.
+*
+*  A typo'd cid is not an error anywhere else: the app document simply carries
+*  a configuration for a collection nobody publishes, and the collection the
+*  author meant is published with no configuration at all — i.e. with the
+*  status machine and the submit path silently absent. */
+function unknownCidProblems(app, collections) {
+	const known = new Set(collections.map((collection) => collection.cid));
+	return [
+		["collections", Object.keys(app.collections ?? {})],
+		["public.read", app.public?.read ?? []],
+		["public.submit", Object.keys(app.public?.submit ?? {})],
+		["participantRead", app.participantRead ?? []]
+	].flatMap(([where, cids]) => cids.filter((cid) => !known.has(cid)).map((cid) => `${where} names '${cid}', which is not a shared collection in this repository. Shared collections here: ${known.size > 0 ? [...known].sort().join(", ") : "(none - a schema needs storage.type \"firestore\")"}.`));
+}
+/** Everything publish refuses, as lines the author can act on.
+*
+*  All of them, every time. Publish is a manual step with a human waiting on
+*  it; stopping at the first problem turns one review into five. */
+function publishProblems(app, collections, publisherEmail) {
+	return [
+		...unknownCidProblems(app, collections),
+		...publisherProblems(app, publisherEmail),
+		...submitOnlyProblems(app),
+		...aggregateProblems(app),
+		...authProblems(app),
+		...mailProblems(app),
+		...submitShapeProblems(app),
+		...coherenceProblems(app),
+		...primaryKeyProblems(app, collections)
+	];
+}
+/** A public submission must NOT be allowed to name its own primary key.
+*
+*  The rules constrain the DOCUMENT ID (`idFrom`) and cannot constrain the
+*  value of a field — nothing compares `request.resource.data[primaryKey]`
+*  with the path being written. So a submit path that accepts the primary key
+*  as a `createField` lets a submitter write at their one permitted document
+*  id while CLAIMING another record's identity, or a duplicate.
+*
+*  It is refused rather than tolerated because there is nothing for the field
+*  to do: `firestoreStore` takes a shared record's identity from the document
+*  id and overwrites the field on read, so a submitted value is either equal
+*  to the id (noise) or a lie (silently discarded). Publishing a form field
+*  whose value is thrown away is worse than not having it — the author will
+*  believe submitters choose their ids.
+*
+*  This is the second answer to the same question. The first was the reverse —
+*  REQUIRE the key, because a record without one was rejected by every reader
+*  — and it was right about the symptom and wrong about the cure: the identity
+*  belongs to the id the rules can pin, not to a field they cannot. */
+function primaryKeyProblems(app, collections) {
+	const primaryKeyOf = new Map(collections.map((collection) => [collection.cid, collection.primaryKey]));
+	return Object.entries(app.public?.submit ?? {}).flatMap(([cid, submit]) => {
+		const primaryKey = primaryKeyOf.get(cid);
+		if (primaryKey === void 0 || !submit.createFields.includes(primaryKey)) return [];
+		return [`public.submit.${cid}.createFields must NOT include "${primaryKey}", the schema's primaryKey: the rules can pin the document id but not the value of a field, so a submitter could write at their own id while claiming another record's. A shared record's identity is its document id — the store fills the field from it, and a submitted value is either the same thing or a lie that is thrown away.`];
+	});
+}
+//#endregion
 //#region src/collection/server/skillAssets.ts
 /** Read a collection's custom-view HTML, path-safely. `viewFile` is a
 *  schema-validated `views/*.html` path, resolved with realpath containment.
@@ -469,6 +1128,18 @@ function firstRecordProblem(record, schema, tier) {
 }
 //#endregion
 //#region src/collection/server/validate.ts
+/** Don't flood the result; the first batch is enough to act on. Exported
+*  because a caller that REPORTS a count has to know the count is a floor —
+*  `publish` presents a full batch as "at least N" rather than as a total. */
+var MAX_RECORD_ISSUES = 25;
+/** The `file` of the pseudo-issue reported when the backend could not be read
+*  at all.
+*
+*  Exported because it is a DIFFERENT KIND of answer from "this record is
+*  invalid", and a caller that treats the two alike gets it wrong in the
+*  direction that matters: `publish` lets the user override invalid records,
+*  and overriding this one would mean publishing without ever having looked. */
+var STORE_UNREADABLE = "(store)";
 var MAX_ISSUES = 25;
 /** Read every `<id>.json` under the collection's dataDir and report the
 *  ones that won't load or violate the schema. An empty list means every
@@ -514,7 +1185,7 @@ async function validateStoreRecords(collection, opts) {
 		items = await storeFor(collection, { workspaceRoot: opts.workspaceRoot }).list();
 	} catch (err) {
 		return [{
-			file: "(store)",
+			file: STORE_UNREADABLE,
 			problem: `records could not be read from the storage backend: ${err instanceof Error ? err.message : String(err)}`
 		}];
 	}
@@ -2067,6 +2738,6 @@ function makeManageCollectionTool(deps = {}) {
 	};
 }
 //#endregion
-export { buildCollectionActionSeedPrompt as A, validateRecordObject as C, enrichItems as D, runCollectionQuery as E, readCustomViewHtml as M, readCustomViewI18n as N, runQueryOverRows as O, readSkillTemplate as P, validateCollectionRecords as S, recordFieldProblem as T, computeCollectionIcon as _, deleteCollection as a, applyMutateAction as b, computeSuccessor as c, isTriggerDue as d, maybeSpawnSuccessor as f, ONE_SECOND_MS as g, successorId as h, deleteCustomView as i, promptPathsFor as j, buildActionSeedPrompt as k, daysInMonth as l, resolveEvery as m, MAX_UNSELECTIVE_ITEMS as n, deleteCollectionRefusalMessage as o, parseCivil as p, makeManageCollectionTool as r, advanceTriggerDate as s, MAX_SCHEMA_ISSUES as t, formatCivil as u, buildWorkspaceOntology as v, compileRecordZ as w, firstMutateParamProblem as x, schemaRelations as y };
+export { parseAuthoredApp as $, runQueryOverRows as A, APP_SLUGS_COLLECTION as B, STORE_UNREADABLE as C, recordFieldProblem as D, compileRecordZ as E, readCustomViewI18n as F, appStagingPath as G, appConfigPath as H, readSkillTemplate as I, projectPublish as J, projectApp as K, bindsSubmitterIdentity as L, buildCollectionActionSeedPrompt as M, promptPathsFor as N, runCollectionQuery as O, readCustomViewHtml as P, AuthoredAppZ as Q, publishProblems as R, MAX_RECORD_ISSUES as S, validateRecordObject as T, appSchemasPath as U, PUBLIC_CONFIG_DOC as V, appSlugDoc as W, stagedRuleConfig as X, promoteSchema as Y, APP_ROLES as Z, computeCollectionIcon as _, deleteCollection as a, applyMutateAction as b, computeSuccessor as c, isTriggerDue as d, maybeSpawnSuccessor as f, ONE_SECOND_MS as g, successorId as h, deleteCustomView as i, buildActionSeedPrompt as j, enrichItems as k, daysInMonth as l, resolveEvery as m, MAX_UNSELECTIVE_ITEMS as n, deleteCollectionRefusalMessage as o, parseCivil as p, projectDeploy as q, makeManageCollectionTool as r, advanceTriggerDate as s, MAX_SCHEMA_ISSUES as t, formatCivil as u, buildWorkspaceOntology as v, validateCollectionRecords as w, firstMutateParamProblem as x, schemaRelations as y, APPS_COLLECTION as z };
 
-//# sourceMappingURL=server-DdHaX_Uu.js.map
+//# sourceMappingURL=server-BNe8XMtu.js.map