@mulmoclaude/core 3.6.0 → 3.10.0

package/dist/{server-9mFaGLdq.cjs → server-CgkkWWBd.cjs}

@@ -2,9 +2,9 @@ const require_rolldown_runtime = require("./rolldown-runtime-VH7oDXx4.cjs");
 const require_dist = require("./dist-CsgSfWwR.cjs");
 const require_root = require("./root-rPH6FGDT.cjs");
 const require_relPath = require("./relPath-CTAjGdCL.cjs");
-const require_calendarGrid = require("./calendarGrid-DGILaVxI.cjs");
-const require_promptSafety = require("./promptSafety-NNGViiCr.cjs");
-const require_discovery = require("./discovery-Cw5xWzZD.cjs");
+const require_itemId = require("./itemId-Dzrr3vs5.cjs");
+const require_promptSafety = require("./promptSafety-CWqYq-NS.cjs");
+const require_discovery = require("./discovery-BsXiDZBR.cjs");
 const require_feeds_paths = require("./feeds/paths.cjs");
 const require_skill_bridge_index = require("./skill-bridge/index.cjs");
 let node_path = require("node:path");
@@ -12,6 +12,665 @@ node_path = require_rolldown_runtime.__toESM(node_path, 1);
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 let zod = require("zod");
+//#region src/collection/server/publishManifest.ts
+/** A collection id / app id, held to the one name rule (`SAFE_SLUG_PATTERN`)
+*  that `sharedCollectionKey` applies. Stated once so a path built later
+*  cannot be a way around it. */
+var NameZ = zod.z.string().refine(require_itemId.isValidCollectionName, { message: "is not a valid id (letters, digits, '-' and '_' only)" });
+/** An address on the roster. Not validated as an email beyond "has an @":
+*  the rules compare it to `request.auth.token.email` verbatim, so any
+*  narrowing here would refuse addresses Firebase itself accepts. */
+var EmailZ = zod.z.string().trim().min(3).includes("@");
+/** The four roles the deployed rules understand. `participant` is the layer
+*  that is NAMED but reads only its own rows — see `readerOf` vs `listedIn`. */
+var APP_ROLES = [
+	"owner",
+	"editor",
+	"viewer",
+	"participant"
+];
+var RoleZ = zod.z.enum(APP_ROLES);
+/** `{ email: { "*" | cid: role } }`. The `"*"` key is the app-wide role; a
+*  member may hold per-collection roles only (the stylist who is editor of
+*  bookings and viewer of everything else). */
+var MembersZ = zod.z.record(EmailZ, zod.z.record(zod.z.union([zod.z.literal("*"), NameZ]), RoleZ));
+/** The declarative mail queue, as the rules re-derive it: a transition of the
+*  status field, a recipient read off the RECORD, and a fixed template. */
+var MailZ = zod.z.object({
+	toField: zod.z.string().trim().min(1),
+	on: zod.z.record(zod.z.string().trim().min(1), zod.z.object({
+		from: zod.z.array(zod.z.string().trim().min(1)).min(1),
+		to: zod.z.string().trim().min(1)
+	}).strict()),
+	dataFields: zod.z.array(zod.z.string().trim().min(1)).optional()
+}).strict();
+/** What the rules read out of `collections[cid]`. NOT the schema — the schema
+*  is published beside it, untouched, for clients to render from. */
+var CollectionConfigZ = zod.z.object({
+	statusField: zod.z.string().trim().min(1).optional(),
+	/** `{ initial: [...], <status>: [<status>...] }`. Binds writers too, and
+	*  binds `create` — that is the point of publishing it. */
+	transitions: zod.z.record(zod.z.string().trim().min(1), zod.z.array(zod.z.string().trim().min(1))).optional(),
+	immutable: zod.z.boolean().optional(),
+	submitOnly: zod.z.boolean().optional(),
+	peerVisibility: zod.z.enum(["public", "hidden"]).optional(),
+	revealGated: zod.z.boolean().optional(),
+	gatedFrom: NameZ.optional(),
+	revealBy: zod.z.string().trim().min(1).optional(),
+	mail: MailZ.optional(),
+	/** Which fields an aggregate groups by. Declared here rather than in the
+	*  schema for the same reason as everything else in this file — the schema
+	*  has no `aggregate` key yet — and it is here at all because the
+	*  invariant that guards it ("every aggregation key is a CHECKED field")
+	*  is about `public.submit`, which is an app-level declaration. Published
+	*  as-is; the rules never read it. */
+	aggregate: zod.z.object({ by: zod.z.array(zod.z.string().trim().min(1)).min(1) }).strict().optional()
+}).strict();
+/** An authored submit window. ISO strings, because `app.json` is JSON and a
+*  Firestore `Timestamp` has no JSON form. Publish lowers it to epoch millis —
+*  the rules do not coerce strings, so an ISO string reaching Firestore is a
+*  type error that fails CLOSED (`inWindow` refuses every submission and the
+*  author sees "nobody can submit", not an error). */
+var WindowZ = zod.z.object({
+	from: zod.z.iso.datetime().optional(),
+	until: zod.z.iso.datetime().optional()
+}).strict();
+var ValidateZ = zod.z.object({
+	required: zod.z.array(zod.z.string().trim().min(1)).optional(),
+	/** Capped at two by the rules themselves: rules have no iteration, so
+	*  `keyFieldsOk` is unrolled. A third would be accepted here and silently
+	*  unchecked there. */
+	keyFields: zod.z.array(zod.z.object({
+		field: zod.z.string().trim().min(1),
+		values: zod.z.array(zod.z.union([
+			zod.z.string(),
+			zod.z.number(),
+			zod.z.boolean()
+		])).min(1)
+	}).strict()).optional()
+}).strict();
+var SubmitZ = zod.z.object({
+	auth: zod.z.enum([
+		"none",
+		"anonymous",
+		"verifiedEmail"
+	]),
+	emailField: zod.z.string().trim().min(1).optional(),
+	createFields: zod.z.array(zod.z.string().trim().min(1)).min(1),
+	initialStatus: zod.z.string().trim().min(1).optional(),
+	idFrom: zod.z.enum([
+		"auto",
+		"auth.uid",
+		"auth.uid+field"
+	]).optional(),
+	idField: zod.z.string().trim().min(1).optional(),
+	validate: ValidateZ.optional(),
+	window: WindowZ.optional(),
+	/** Per CURRENT STATUS, never a flat list: a flat list lets a customer move
+	*  an approved booking's `startAt` without anyone re-approving it. */
+	selfUpdate: zod.z.record(zod.z.string().trim().min(1), zod.z.array(zod.z.string().trim().min(1))).optional(),
+	selfTransitions: zod.z.record(zod.z.string().trim().min(1), zod.z.array(zod.z.string().trim().min(1))).optional(),
+	finalize: zod.z.boolean().optional(),
+	audience: zod.z.literal("participant").optional(),
+	gateOn: zod.z.object({
+		phase: zod.z.string().trim().min(1),
+		match: zod.z.string().trim().min(1)
+	}).strict().optional()
+}).strict();
+var PublicZ = zod.z.object({
+	/** The master switch. Anonymous submission (`auth: "none"`) needs it as
+	*  well as its own declaration. */
+	enabled: zod.z.boolean().optional(),
+	read: zod.z.array(NameZ).optional(),
+	submit: zod.z.record(NameZ, SubmitZ).optional()
+}).strict();
+/** The whole authored declaration.
+*
+*  `owner` is accepted but is NOT the published value — publish stamps the
+*  publisher's uid (or carries the existing one forward, which is what the
+*  rules require on update) and refuses a declaration that disagrees. It is
+*  accepted rather than banned because the sample app.json in the design note
+*  shows it, and a hard refusal on a key the samples contain would be a worse
+*  first experience than a message naming the mismatch. */
+var AuthoredAppZ = zod.z.object({
+	aid: NameZ,
+	name: zod.z.string().trim().min(1).optional(),
+	/** Per-worktree app id (design D6, implementation order 7). Accepted so a
+	*  repository already carrying it parses; nothing reads it yet. */
+	aidEnv: zod.z.string().trim().min(1).optional(),
+	owner: zod.z.string().trim().min(1).optional(),
+	members: MembersZ,
+	collections: zod.z.record(NameZ, CollectionConfigZ).optional(),
+	participantRead: zod.z.array(NameZ).optional(),
+	public: PublicZ.optional()
+}).strict();
+/** Parse the authored declaration out of `app.json`'s text.
+*
+*  Returns a LIST of problems rather than throwing, for the same reason
+*  `loadAppManifest` returns a failure: the caller is a gate whose entire job
+*  is to hand the author something to act on. Every problem is reported at
+*  once — publish is a manual step, and a parser that stops at the first key
+*  makes it N round trips. */
+function parseAuthoredApp(raw) {
+	const manifest = require_discovery.parseAppManifest(raw);
+	if (!manifest.ok) return {
+		ok: false,
+		problems: [manifest.kind === "missing" ? "app.json is missing" : manifest.detail]
+	};
+	const parsed = AuthoredAppZ.safeParse(JSON.parse(raw));
+	if (!parsed.success) return {
+		ok: false,
+		problems: authoredProblems(parsed.error)
+	};
+	return {
+		ok: true,
+		app: parsed.data
+	};
+}
+/** zod issues as one actionable line each: `public.submit.responses.auth: …`. */
+function authoredProblems(error) {
+	return error.issues.map((issue) => {
+		return `${issue.path.length > 0 ? issue.path.join(".") : "app.json"}: ${issue.message}`;
+	});
+}
+//#endregion
+//#region src/collection/server/publishProject.ts
+/** The document id under `apps/{aid}/config`. One document, named, rather than
+*  a spread of them: a second public document is a second thing to keep in
+*  step, and nothing yet needs one. */
+var PUBLIC_CONFIG_DOC = "public";
+/** Drop keys whose value is `undefined`. Firestore rejects an undefined field
+*  value outright, and `"k" in c` — which every optional key in the rules is
+*  read through — must mean "the author declared it". */
+function compact(entries) {
+	return Object.fromEntries(Object.entries(entries).filter(([, value]) => value !== void 0));
+}
+/** ISO → epoch millis, the one conversion the rules cannot do for themselves.
+*  The caller has already refused an unparseable string (the authored parser
+*  requires `z.iso.datetime()`), so a NaN here would be a programming error;
+*  it is still checked, because a NaN written to Firestore fails closed in the
+*  same silent way an ISO string does. */
+function windowMillis(window) {
+	if (!window) return void 0;
+	const out = {};
+	if (window.from !== void 0) out.fromMs = Date.parse(window.from);
+	if (window.until !== void 0) out.untilMs = Date.parse(window.until);
+	if (Object.values(out).some((value) => !Number.isFinite(value))) throw new Error(`publish: window bound is not a parseable timestamp (${JSON.stringify(window)})`);
+	return Object.keys(out).length > 0 ? out : void 0;
+}
+/** One `public.submit[cid]`, with its window lowered. Everything else passes
+*  through: the rules read these keys by the names the author wrote. */
+function projectSubmit(submit) {
+	const { window, ...rest } = submit;
+	return compact({
+		...rest,
+		window: windowMillis(window)
+	});
+}
+/** The roster's addresses as a set, in a stable order.
+*
+*  Sorted so two publishes of the same declaration produce the same document
+*  — idempotence is a property this step is tested for, and Firestore compares
+*  arrays by ORDER. `membersConsistent()` compares as sets and would accept
+*  any order; the test that would notice is the one asserting a second publish
+*  changes nothing but `publishedAt`. */
+function memberEmailsOf(members) {
+	return Object.keys(members).sort();
+}
+/** The previous document, kept for rollback, with its OWN `previousPublished`
+*  stripped.
+*
+*  One level, deliberately. Chaining would make every publish carry the entire
+*  history of the app inside a single document, which grows without bound and
+*  meets Firestore's 1 MiB document limit as a permission-shaped failure at
+*  some unpredictable publish. One level answers the question rollback
+*  actually asks — "put back what was there before I broke it" — and the
+*  further history is in git, which is where the declaration came from. */
+function previousOf(existing) {
+	if (!existing) return void 0;
+	const { previousPublished: __dropped, ...rest } = existing;
+	return rest;
+}
+/** Project the authored declaration into the documents publish writes.
+*
+*  `existing` is the app document as it is in Firestore right now, or null on
+*  a first publish. Two things need it, both required by the rules:
+*    - `owner` must be UNCHANGED on update. Re-stamping the publisher's uid
+*      would be refused for any app whose owner ever signed in as a different
+*      account, and would silently transfer ownership if it were not.
+*    - `previousPublished` is that document, so a rollback has something to
+*      put back.
+*
+*  Pure: no clock, no filesystem, no Firestore. Everything variable arrives as
+*  a parameter, which is what makes the conversion table testable as a table. */
+function projectApp(authored, schemas, stamp, existing) {
+	const owner = typeof existing?.owner === "string" ? existing.owner : stamp.uid;
+	const submit = Object.fromEntries(Object.entries(authored.public?.submit ?? {}).map(([cid, spec]) => [cid, projectSubmit(spec)]));
+	const publicBlock = authored.public ? compact({
+		enabled: authored.public.enabled,
+		read: authored.public.read,
+		submit: Object.keys(submit).length > 0 ? submit : void 0
+	}) : void 0;
+	const app = compact({
+		aid: authored.aid,
+		name: authored.name,
+		owner,
+		members: authored.members,
+		memberEmails: memberEmailsOf(authored.members),
+		collections: authored.collections,
+		participantRead: authored.participantRead,
+		public: publicBlock,
+		publishedAt: stamp.publishedAt,
+		publishedBy: stamp.email,
+		publishedCommit: stamp.commit,
+		publishedDirty: stamp.dirty === true ? true : void 0,
+		previousPublished: previousOf(existing)
+	});
+	const config = {
+		enabled: authored.public?.enabled === true,
+		read: authored.public?.read ?? [],
+		submit,
+		publishedAt: stamp.publishedAt
+	};
+	if (authored.name !== void 0) config.name = authored.name;
+	return {
+		app,
+		schemas: schemas.map(({ cid, schema }) => ({
+			cid,
+			doc: schemaDoc(schema, stamp)
+		})),
+		config
+	};
+}
+/** Keys on the app document that publish owns: what is PUBLIC right now, and
+*  the rule-facing configuration anonymous access is judged against. Deploy
+*  carries them through from the existing document and never authors them. */
+var PUBLISH_OWNED_KEYS = [
+	"public",
+	"collections",
+	"participantRead",
+	"publishedAt",
+	"publishedBy",
+	"publishedCommit",
+	"publishedDirty",
+	"previousPublished"
+];
+var isPublishOwned = (key) => PUBLISH_OWNED_KEYS.includes(key);
+function projectDeploy(authored, schemas, stamp, existing) {
+	const { app } = projectApp(authored, schemas, stamp, existing);
+	const deployed = Object.fromEntries(Object.entries(app).filter(([key]) => !isPublishOwned(key)));
+	for (const key of PUBLISH_OWNED_KEYS) {
+		const live = existing?.[key];
+		if (live !== void 0) deployed[key] = live;
+	}
+	deployed.deployedAt = stamp.publishedAt;
+	deployed.deployedBy = stamp.email;
+	if (stamp.commit !== void 0) deployed.deployedCommit = stamp.commit;
+	return {
+		app: deployed,
+		staging: schemas.map(({ cid, schema }) => ({
+			cid,
+			doc: stagedDoc(schema, stamp, authored, cid)
+		}))
+	};
+}
+/** One staged schema document, carrying this cid's rule-facing configuration
+*  alongside the schema so publish can promote them together. */
+function stagedDoc(schema, stamp, authored, cid) {
+	const doc = {
+		publishedSchema: schema,
+		deployedAt: stamp.publishedAt,
+		deployedBy: stamp.email
+	};
+	const config = authored.collections?.[cid];
+	if (config !== void 0) doc.config = config;
+	if (authored.participantRead?.includes(cid) === true) doc.participantRead = true;
+	if (stamp.commit !== void 0) doc.deployedCommit = stamp.commit;
+	return doc;
+}
+/** The rule-facing configuration to promote, read from the STAGED documents
+*  rather than from the manifest as it reads right now.
+*
+*  Otherwise: deploy revision A, edit `app.json` to revision B, publish — and
+*  the promoted schema is A's while the authorization behaviour is B's, a
+*  combination nobody exercised through `/staging/{aid}`.
+*
+*  (`public` is deliberately NOT part of this: it is not staged, because it is
+*  the decision being made AT publish rather than something under test.) */
+function stagedRuleConfig(staged) {
+	const entries = [];
+	const participantRead = [];
+	for (const entry of staged) {
+		const { config } = entry.doc;
+		if (config !== void 0) entries.push([entry.cid, config]);
+		if (entry.doc.participantRead === true) participantRead.push(entry.cid);
+	}
+	return {
+		collections: entries.length > 0 ? Object.fromEntries(entries) : void 0,
+		participantRead: participantRead.length > 0 ? participantRead : void 0
+	};
+}
+function projectPublish(authored, staged, stamp, existing) {
+	const { app, config } = projectApp(authored, [], stamp, existing);
+	const staging = stagedRuleConfig(staged);
+	app.collections = staging.collections;
+	app.participantRead = staging.participantRead;
+	const published = Object.fromEntries(Object.entries(existing ?? app).filter(([key]) => !isPublishOwned(key)));
+	for (const key of PUBLISH_OWNED_KEYS) if (key !== "public" && app[key] !== void 0) published[key] = app[key];
+	const publicBlock = app.public;
+	return {
+		app: published,
+		config,
+		public: require_dist.isRecord(publicBlock) ? publicBlock : void 0
+	};
+}
+/** Re-stamp a staged schema document as it is promoted to `collections/{cid}`.
+*
+*  The stamp answers "which version is PUBLIC right now, and who made it so",
+*  so it is written by the operation that changes the answer — publish — not
+*  carried over from the deploy that staged it. */
+function promoteSchema(staged, stamp) {
+	const doc = {
+		publishedSchema: staged.publishedSchema,
+		publishedAt: stamp.publishedAt,
+		publishedBy: stamp.email
+	};
+	if (stamp.commit !== void 0) doc.publishedCommit = stamp.commit;
+	return doc;
+}
+/** One published schema document. Written key by key rather than through
+*  `compact`, so the declared type is the type — an optional commit is the
+*  only variable part. */
+function schemaDoc(schema, stamp) {
+	const doc = {
+		publishedSchema: schema,
+		publishedAt: stamp.publishedAt,
+		publishedBy: stamp.email
+	};
+	if (stamp.commit !== void 0) doc.publishedCommit = stamp.commit;
+	return doc;
+}
+/** The app documents' parent path — the `FirestoreDocs` seam takes a
+*  collection path plus a document id, and the app document's id is the aid. */
+var APPS_COLLECTION = "apps";
+/** The collection (schema) documents' parent path — what the PUBLIC page
+*  reads, written only by publish (promotion). */
+var appSchemasPath = (aid) => `apps/${aid}/collections`;
+/** The URL-slug reservations — `appSlugs/{slug}` → `{ aid, published }`.
+*
+*  A TOP-LEVEL collection, not a field on the app: the public page resolves a
+*  slug to an aid BEFORE it can read anything under `apps/{aid}`, and a slug
+*  has to be claimable atomically (create-if-absent) so two apps cannot hold
+*  the same URL.
+*
+*  `published` is what makes the reservation invisible until publish. The slug
+*  is human-readable, so a readable reservation would let anyone guess the URL
+*  and get the aid — and the aid is the `/staging/{aid}` entrance. The rule is
+*  `allow read: if resource.data.published == true`, which needs no `get()` and
+*  so costs nothing against the rules' expression budget. */
+var APP_SLUGS_COLLECTION = "appSlugs";
+var appSlugDoc = (aid, published) => ({
+	aid,
+	published
+});
+/** The staged schema documents' parent path — what `/staging/{aid}` reads,
+*  written by deploy. A separate DOCUMENT rather than a field beside
+*  `publishedSchema`, because the rules cannot hide a field: anything inside a
+*  document the public page may read is public. */
+var appStagingPath = (aid) => `apps/${aid}/staging`;
+/** The public-config documents' parent path. */
+var appConfigPath = (aid) => `apps/${aid}/config`;
+//#endregion
+//#region src/collection/server/publishChecks.ts
+/** Does this submit declaration bind a record to the submitter's identity?
+*
+*  The condition for requiring `submitOnly`, and deliberately NOT "declares an
+*  `audience`": `audience` appears only in the rules' public-create branch, so
+*  an owner or editor never meets it and can add records freely. `immutable`
+*  is the wrong condition too — a survey's responses are not immutable and
+*  can be padded exactly the same way.
+*
+*  What these four have in common is that each one makes the record MEAN "the
+*  person who submitted it said this": a per-uid id, a per-uid+field id, a
+*  row stamped with the submitter's verified address, or a submission
+*  restricted to a named participant. A record created through the writer
+*  branch carries the same shape and none of that meaning. */
+function bindsSubmitterIdentity(submit) {
+	return submit.idFrom === "auth.uid" || submit.idFrom === "auth.uid+field" || submit.emailField !== void 0 || submit.audience === "participant";
+}
+/** The fields a rule actually CHECKS the value of, for one collection.
+*
+*  `keyFields` pins a value against a declared set, `gateOn.match` pins it
+*  against the session's current question, and the status field is pinned by
+*  the transition machine. An aggregation grouped by anything else is grouped
+*  by a field any submitter may write anything into — so the published
+*  aggregate is whatever the noisiest respondent decided it should be. */
+function checkedFields(collection, submit) {
+	const fields = /* @__PURE__ */ new Set();
+	for (const keyField of submit?.validate?.keyFields ?? []) fields.add(keyField.field);
+	if (submit?.gateOn) fields.add(submit.gateOn.match);
+	if (collection?.statusField) fields.add(collection.statusField);
+	return fields;
+}
+/** INVARIANT 1 — a submission bound to its submitter needs `submitOnly`. */
+function submitOnlyProblems(app) {
+	const problems = [];
+	for (const [cid, submit] of Object.entries(app.public?.submit ?? {})) {
+		if (!bindsSubmitterIdentity(submit)) continue;
+		if (app.collections?.[cid]?.submitOnly === true) continue;
+		problems.push(`collections.${cid}.submitOnly must be true: public.submit.${cid} binds each record to its submitter (${identityBindings(submit).join(", ")}), so a record created any other way would carry that meaning without having earned it. Without submitOnly the rules let an owner or editor write rows directly into ${cid}.`);
+	}
+	return problems;
+}
+function identityBindings(submit) {
+	const bindings = [];
+	if (submit.idFrom === "auth.uid" || submit.idFrom === "auth.uid+field") bindings.push(`idFrom: "${submit.idFrom}"`);
+	if (submit.emailField !== void 0) bindings.push(`emailField: "${submit.emailField}"`);
+	if (submit.audience === "participant") bindings.push(`audience: "participant"`);
+	return bindings;
+}
+/** INVARIANT 2 — every aggregation key is a field some rule checks. */
+function aggregateProblems(app) {
+	const problems = [];
+	for (const [cid, collection] of Object.entries(app.collections ?? {})) {
+		const keys = collection.aggregate?.by;
+		if (!keys) continue;
+		const checked = checkedFields(collection, app.public?.submit?.[cid]);
+		const loose = keys.filter((field) => !checked.has(field));
+		const spelled = loose.map((field) => `'${field}'`).join(", ");
+		if (loose.length > 0) problems.push(`collections.${cid}.aggregate.by names ${spelled}, which no rule checks the value of. An aggregation key must appear in public.submit.${cid}.validate.keyFields, in gateOn.match, or be the statusField — otherwise a submitter chooses their own bucket and the published aggregate is not a count of anything.`);
+	}
+	return problems;
+}
+/** INVARIANT 3 — `auth: "verifiedEmail"` only.
+*
+*  A product decision, not a rules limitation: the rules keep all three stages
+*  and the emulator tests keep exercising them, because deleting a stage from
+*  the rules turns a change of mind into a cross-repo deploy. Publish is where
+*  the current decision is expressed, and it is one line to move. */
+function authProblems(app) {
+	return Object.entries(app.public?.submit ?? {}).filter(([, submit]) => submit.auth !== "verifiedEmail").map(([cid, submit]) => `public.submit.${cid}.auth is "${submit.auth}": only "verifiedEmail" may be published. The rules still implement "none" and "anonymous" — this is a product decision, and lifting it is a change here, not a rules deploy.`);
+}
+/** INVARIANT 5 — a mail transition's origins and destination must be disjoint.
+*
+*  Overlap means the same write can satisfy the same template twice over, and
+*  the deterministic mail id is the only other thing stopping a duplicate
+*  send. The rules also require the status to have CHANGED, so an overlapping
+*  declaration is not merely redundant: `from` containing `to` is a transition
+*  that can never fire, which is a mail nobody ever receives. */
+function mailProblems(app) {
+	return Object.entries(app.collections ?? {}).flatMap(([cid, collection]) => collectionMailProblems(cid, collection));
+}
+function collectionMailProblems(cid, collection) {
+	const { mail } = collection;
+	if (!mail) return [];
+	const problems = [];
+	if (!collection.statusField) problems.push(`collections.${cid}.mail needs collections.${cid}.statusField: the rules read the status before and after the write to decide the mail is warranted.`);
+	for (const [template, transition] of Object.entries(mail.on)) problems.push(...templateMailProblems(cid, collection, template, transition));
+	return problems;
+}
+function templateMailProblems(cid, collection, template, transition) {
+	const problems = [];
+	if (transition.from.includes(transition.to)) problems.push(`collections.${cid}.mail.on.${template} lists "${transition.to}" in both \`from\` and \`to\`. The rules require the status to CHANGE in the same write, so this template can never send.`);
+	const allowed = collection.transitions;
+	if (allowed) {
+		const unreachable = transition.from.filter((from) => !(allowed[from] ?? []).includes(transition.to));
+		const spelled = unreachable.map((from) => `'${from}' -> '${transition.to}'`).join(", ");
+		if (unreachable.length > 0) problems.push(`collections.${cid}.mail.on.${template} sends on ${spelled}, which collections.${cid}.transitions does not allow. The record write is refused first, so the mail never fires.`);
+	}
+	return problems;
+}
+/** INVARIANTS 6 and 7 — the window is a real interval, and `keyFields` fits
+*  the unrolled check in the rules. */
+function submitShapeProblems(app) {
+	return Object.entries(app.public?.submit ?? {}).flatMap(([cid, submit]) => [...windowProblems(cid, submit), ...keyFieldCountProblems(cid, submit)]);
+}
+function windowProblems(cid, submit) {
+	const { window } = submit;
+	if (window?.from === void 0 || window.until === void 0) return [];
+	if (Date.parse(window.until) > Date.parse(window.from)) return [];
+	return [`public.submit.${cid}.window closes at or before it opens (${window.from} -> ${window.until}): nothing could ever be submitted.`];
+}
+function keyFieldCountProblems(cid, submit) {
+	const keyFields = submit.validate?.keyFields ?? [];
+	if (keyFields.length <= 2) return [];
+	return [`public.submit.${cid}.validate.keyFields declares ${keyFields.length}; the rules check at most 2. Rules have no iteration, so the check is unrolled — a third would be published and never enforced.`];
+}
+/** The fail-closed traps: declarations the rules read together, where the
+*  missing half denies every write instead of loosening one. */
+function coherenceProblems(app) {
+	const fromSubmits = Object.entries(app.public?.submit ?? {}).flatMap(([cid, submit]) => submitCoherenceProblems(app, cid, submit));
+	const fromCollections = Object.entries(app.collections ?? {}).flatMap(([cid, collection]) => gateCoherenceProblems(cid, collection));
+	return [...fromSubmits, ...fromCollections];
+}
+/** `initialStatus` is read together with the collection's `statusField` and
+*  with `createFields`; miss either and every submission is refused. */
+function statusCoherenceProblems(cid, submit, collection) {
+	if (submit.initialStatus === void 0) return [];
+	if (!collection?.statusField) return [`public.submit.${cid}.initialStatus needs collections.${cid}.statusField: the rules look the status up by that name, and refuse every submission without it.`];
+	if (new Set(submit.createFields).has(collection.statusField)) return [];
+	return [`public.submit.${cid}.createFields must include "${collection.statusField}": a submission may carry ONLY the createFields, and the rules also require the status field to be present and equal to initialStatus. As written, every submission is refused.`];
+}
+/** Every field a RULE reads off a submitted record, other than the status
+*  field (which `statusCoherenceProblems` words for itself).
+*
+*  `emailField` and `idField` belong here for exactly the reason `required`
+*  and `keyFields` do, and forgetting them was the same oversight twice: the
+*  rules read `request.resource.data[s.emailField]` and rebuild the document
+*  id from `s.idField`, while `hasOnly(createFields)` decides what a
+*  submission may carry at all. A field in one list and not the other is a
+*  contradiction the submitter cannot resolve — including it is refused,
+*  omitting it fails the check. */
+function ruleReadFields(submit) {
+	const fields = [];
+	if (submit.emailField !== void 0) fields.push({
+		field: submit.emailField,
+		why: `public.submit.<cid>.emailField — the rules compare it to the submitter's verified address`
+	});
+	if (submit.idFrom === "auth.uid+field" && submit.idField !== void 0) fields.push({
+		field: submit.idField,
+		why: `public.submit.<cid>.idField — the rules rebuild the document id from it`
+	});
+	return fields;
+}
+/** A checked field a submission is not allowed to carry can never be
+*  satisfied: carrying it fails `hasOnly`, omitting it fails the check. */
+function createFieldProblems(cid, submit) {
+	const createFields = new Set(submit.createFields);
+	const ruleRead = ruleReadFields(submit).filter((entry) => !createFields.has(entry.field)).map((entry) => `public.submit.${cid}.createFields must include "${entry.field}" (${entry.why.replace("<cid>", cid)}): a submission may carry only the createFields, so as written every submission is refused whether or not it carries the field.`);
+	const required = (submit.validate?.required ?? []).filter((field) => !createFields.has(field)).map((field) => `public.submit.${cid}.validate.required names "${field}", which is not in createFields: a submission may carry only the createFields, so the requirement can never be met.`);
+	const keyFields = (submit.validate?.keyFields ?? []).filter((keyField) => !createFields.has(keyField.field)).map((keyField) => `public.submit.${cid}.validate.keyFields checks "${keyField.field}", which is not in createFields: a submission carrying it is refused, and one omitting it fails the check.`);
+	return [
+		...ruleRead,
+		...required,
+		...keyFields
+	];
+}
+function submitCoherenceProblems(app, cid, submit) {
+	const collection = app.collections?.[cid];
+	const problems = [...statusCoherenceProblems(cid, submit, collection), ...createFieldProblems(cid, submit)];
+	if (submit.idFrom === "auth.uid+field" && submit.idField === void 0) problems.push(`public.submit.${cid}.idFrom is "auth.uid+field" but no idField is declared: the rules rebuild the document id from that field and refuse every create.`);
+	if ((submit.selfUpdate !== void 0 || submit.selfTransitions !== void 0) && !collection?.statusField) problems.push(`public.submit.${cid}.selfUpdate / selfTransitions are declared per CURRENT STATUS, but collections.${cid} declares no statusField: the rules read the current status first and refuse every self-edit without it.`);
+	if (submit.audience === "participant" && Object.keys(app.members).length === 0) problems.push(`public.submit.${cid}.audience is "participant" but the roster is empty: the rules resolve the submitter's role from members, so every submission is refused.`);
+	return problems;
+}
+/** The staged reveal reads its flag off the PARENT record, so the path to that
+*  parent is not optional decoration — without it the gate never opens. */
+function gateCoherenceProblems(cid, collection) {
+	if (collection.revealGated !== true) return [];
+	if (collection.gatedFrom !== void 0 && collection.revealBy !== void 0) return [];
+	return [`collections.${cid}.revealGated needs both gatedFrom and revealBy: the flag is read off the PARENT record, and without the path the gate never opens.`];
+}
+/** The publisher must be able to write what they are about to write.
+*
+*  On a first publish the rules require the creator to name themselves owner,
+*  in the roster, under `'*'`. Getting this wrong produces a bare permission
+*  error from Firestore with nothing in it about rosters — worth one line
+*  here instead. */
+function publisherProblems(app, publisherEmail) {
+	if (app.members[publisherEmail]?.["*"] === "owner") return [];
+	return [`members must give you app-wide owner: add "${publisherEmail}": { "*": "owner" }. The rules require the publisher to hold that role (and to name themselves owner when the app is first created); otherwise the write is refused with no explanation.`];
+}
+/** Every cid the declaration mentions must be a collection that exists.
+*
+*  A typo'd cid is not an error anywhere else: the app document simply carries
+*  a configuration for a collection nobody publishes, and the collection the
+*  author meant is published with no configuration at all — i.e. with the
+*  status machine and the submit path silently absent. */
+function unknownCidProblems(app, collections) {
+	const known = new Set(collections.map((collection) => collection.cid));
+	return [
+		["collections", Object.keys(app.collections ?? {})],
+		["public.read", app.public?.read ?? []],
+		["public.submit", Object.keys(app.public?.submit ?? {})],
+		["participantRead", app.participantRead ?? []]
+	].flatMap(([where, cids]) => cids.filter((cid) => !known.has(cid)).map((cid) => `${where} names '${cid}', which is not a shared collection in this repository. Shared collections here: ${known.size > 0 ? [...known].sort().join(", ") : "(none - a schema needs storage.type \"firestore\")"}.`));
+}
+/** Everything publish refuses, as lines the author can act on.
+*
+*  All of them, every time. Publish is a manual step with a human waiting on
+*  it; stopping at the first problem turns one review into five. */
+function publishProblems(app, collections, publisherEmail) {
+	return [
+		...unknownCidProblems(app, collections),
+		...publisherProblems(app, publisherEmail),
+		...submitOnlyProblems(app),
+		...aggregateProblems(app),
+		...authProblems(app),
+		...mailProblems(app),
+		...submitShapeProblems(app),
+		...coherenceProblems(app),
+		...primaryKeyProblems(app, collections)
+	];
+}
+/** A public submission must NOT be allowed to name its own primary key.
+*
+*  The rules constrain the DOCUMENT ID (`idFrom`) and cannot constrain the
+*  value of a field — nothing compares `request.resource.data[primaryKey]`
+*  with the path being written. So a submit path that accepts the primary key
+*  as a `createField` lets a submitter write at their one permitted document
+*  id while CLAIMING another record's identity, or a duplicate.
+*
+*  It is refused rather than tolerated because there is nothing for the field
+*  to do: `firestoreStore` takes a shared record's identity from the document
+*  id and overwrites the field on read, so a submitted value is either equal
+*  to the id (noise) or a lie (silently discarded). Publishing a form field
+*  whose value is thrown away is worse than not having it — the author will
+*  believe submitters choose their ids.
+*
+*  This is the second answer to the same question. The first was the reverse —
+*  REQUIRE the key, because a record without one was rejected by every reader
+*  — and it was right about the symptom and wrong about the cure: the identity
+*  belongs to the id the rules can pin, not to a field they cannot. */
+function primaryKeyProblems(app, collections) {
+	const primaryKeyOf = new Map(collections.map((collection) => [collection.cid, collection.primaryKey]));
+	return Object.entries(app.public?.submit ?? {}).flatMap(([cid, submit]) => {
+		const primaryKey = primaryKeyOf.get(cid);
+		if (primaryKey === void 0 || !submit.createFields.includes(primaryKey)) return [];
+		return [`public.submit.${cid}.createFields must NOT include "${primaryKey}", the schema's primaryKey: the rules can pin the document id but not the value of a field, so a submitter could write at their own id while claiming another record's. A shared record's identity is its document id — the store fills the field from it, and a submitted value is either the same thing or a lie that is thrown away.`];
+	});
+}
+//#endregion
 //#region src/collection/server/skillAssets.ts
 /** Read a collection's custom-view HTML, path-safely. `viewFile` is a
 *  schema-validated `views/*.html` path, resolved with realpath containment.
@@ -320,7 +979,7 @@ function toRefRecords(linked) {
 function projectBacklinks(field, schema, enriched, linked) {
 	const source = linked[field.from];
 	if (!source) return [];
-	const selfId = require_calendarGrid.fieldText(enriched[schema.primaryKey]);
+	const selfId = require_itemId.fieldText(enriched[schema.primaryKey]);
 	return require_promptSafety.backlinkRows(field, selfId, Object.values(source.byId)).map((row) => require_promptSafety.projectBacklinkRow(row, field.display, source.schema.primaryKey));
 }
 /** Project the computed (never-stored) field kinds onto one derived
@@ -329,9 +988,9 @@ function projectBacklinks(field, schema, enriched, linked) {
 *  `backlinks` → the matching source rows (see `projectBacklinks`). */
 function projectComputed(schema, enriched, linked) {
 	for (const [key, field] of Object.entries(schema.fields)) {
-		if (field.type === "toggle" && field.field) enriched[key] = require_calendarGrid.fieldText(enriched[field.field]) === field.onValue;
+		if (field.type === "toggle" && field.field) enriched[key] = require_itemId.fieldText(enriched[field.field]) === field.onValue;
 		if (field.type === "embed" && field.to) {
-			const targetId = require_calendarGrid.embedTargetId(field, enriched);
+			const targetId = require_itemId.embedTargetId(field, enriched);
 			const target = require_promptSafety.ownProp(linked, field.to);
 			enriched[key] = targetId && target && require_promptSafety.ownProp(target.byId, targetId) || null;
 		}
@@ -352,7 +1011,7 @@ function projectRollups(schema, record, linked) {
 		if (field.type !== "rollup") continue;
 		if (out === record) out = { ...record };
 		const source = linked[field.from];
-		const selfId = require_calendarGrid.fieldText(record[schema.primaryKey]);
+		const selfId = require_itemId.fieldText(record[schema.primaryKey]);
 		out[key] = source ? require_promptSafety.rollupValue(field, selfId, Object.values(source.byId)) : null;
 	}
 	return out;
@@ -399,8 +1058,8 @@ function strictTypeProblem(key, spec, value) {
 		case "number":
 		case "money": return Number.isFinite(require_promptSafety.coerceNumeric(value)) ? null : `'${key}' = '${String(value)}' is not numeric (a '${spec.type}' field stores a plain number)`;
 		case "boolean": return value === true || value === false ? null : `'${key}' = '${String(value)}' is not a boolean (store true or false, unquoted)`;
-		case "date": return require_calendarGrid.parseIsoDate(value) !== null ? null : `'${key}' = '${String(value)}' is not a real YYYY-MM-DD date`;
-		case "datetime": return require_calendarGrid.parseIsoDateTime(value) !== null ? null : `'${key}' = '${String(value)}' is not a YYYY-MM-DDTHH:MM datetime (seconds optional, no timezone suffix — the shape the calendar parses)`;
+		case "date": return require_itemId.parseIsoDate(value) !== null ? null : `'${key}' = '${String(value)}' is not a real YYYY-MM-DD date`;
+		case "datetime": return require_itemId.parseIsoDateTime(value) !== null ? null : `'${key}' = '${String(value)}' is not a YYYY-MM-DDTHH:MM datetime (seconds optional, no timezone suffix — the shape the calendar parses)`;
 		default: return null;
 	}
 }
@@ -445,7 +1104,7 @@ var compiled = /* @__PURE__ */ new WeakMap();
 function compileRecordZ(schema, tier) {
 	const cached = compiled.get(schema)?.[tier];
 	if (cached) return cached;
-	const stored = Object.entries(schema.fields).filter(([, spec]) => !require_calendarGrid.COMPUTED_TYPES.has(spec.type));
+	const stored = Object.entries(schema.fields).filter(([, spec]) => !require_itemId.COMPUTED_TYPES.has(spec.type));
 	const validator = zod.z.looseObject({}).superRefine((record, ctx) => {
 		for (const [key, spec] of stored) {
 			const problem = recordFieldProblem(key, spec, record[key], tier);
@@ -471,6 +1130,18 @@ function firstRecordProblem(record, schema, tier) {
 }
 //#endregion
 //#region src/collection/server/validate.ts
+/** Don't flood the result; the first batch is enough to act on. Exported
+*  because a caller that REPORTS a count has to know the count is a floor —
+*  `publish` presents a full batch as "at least N" rather than as a total. */
+var MAX_RECORD_ISSUES = 25;
+/** The `file` of the pseudo-issue reported when the backend could not be read
+*  at all.
+*
+*  Exported because it is a DIFFERENT KIND of answer from "this record is
+*  invalid", and a caller that treats the two alike gets it wrong in the
+*  direction that matters: `publish` lets the user override invalid records,
+*  and overriding this one would mean publishing without ever having looked. */
+var STORE_UNREADABLE = "(store)";
 var MAX_ISSUES = 25;
 /** Read every `<id>.json` under the collection's dataDir and report the
 *  ones that won't load or violate the schema. An empty list means every
@@ -516,14 +1187,14 @@ async function validateStoreRecords(collection, opts) {
 		items = await require_discovery.storeFor(collection, { workspaceRoot: opts.workspaceRoot }).list();
 	} catch (err) {
 		return [{
-			file: "(store)",
+			file: STORE_UNREADABLE,
 			problem: `records could not be read from the storage backend: ${err instanceof Error ? err.message : String(err)}`
 		}];
 	}
 	const issues = [];
 	for (const item of items) {
 		if (issues.length >= MAX_ISSUES) break;
-		const itemId = require_calendarGrid.fieldText(item[collection.schema.primaryKey]);
+		const itemId = require_itemId.fieldText(item[collection.schema.primaryKey]);
 		const problem = validateRecordObject(item, itemId, collection.schema, "strict");
 		if (problem) issues.push({
 			file: itemId,
@@ -638,7 +1309,7 @@ async function applyMutateAction(collection, action, itemId, params, opts = {})
 	};
 	const stored = Object.entries(existing).filter(([key]) => {
 		const spec = collection.schema.fields[key];
-		return !spec || !require_calendarGrid.COMPUTED_TYPES.has(spec.type);
+		return !spec || !require_itemId.COMPUTED_TYPES.has(spec.type);
 	});
 	const merged = {
 		...Object.fromEntries(stored),
@@ -715,7 +1386,7 @@ async function countRecordFiles(dataDir, workspaceRoot) {
 *  `countRecordFiles` (an unreadable file / missing engine must not
 *  break the whole ontology). */
 async function countRecords(collection, workspaceRoot) {
-	if (require_calendarGrid.storageKindFor(collection.schema) !== "file") try {
+	if (require_itemId.storageKindFor(collection.schema) !== "file") try {
 		return (await require_discovery.storeFor(collection, { workspaceRoot }).page({ limit: 0 })).total;
 	} catch (err) {
 		if (require_discovery.isBackendUnavailable(err)) return null;
@@ -760,7 +1431,7 @@ function buildRecordsById(items, primaryKey) {
 *  ties pick a different record — and thus a different icon — between
 *  reconciles. A stable id sort pins one answer. */
 function sortByPrimaryKey(items, primaryKey) {
-	return [...items].sort((left, right) => require_calendarGrid.fieldText(left[primaryKey]).localeCompare(require_calendarGrid.fieldText(right[primaryKey])));
+	return [...items].sort((left, right) => require_itemId.fieldText(left[primaryKey]).localeCompare(require_itemId.fieldText(right[primaryKey])));
 }
 /** Compute the effective launcher icon for `collection`: its static
 *  `schema.icon` when it declares no `dynamicIcon`, else the icon
@@ -897,7 +1568,7 @@ function successorId(sourceId, next) {
 function matchesWhen(when, schema, item) {
 	if (when) {
 		const raw = item[when.field];
-		const text = require_calendarGrid.fieldTextOrNull(raw);
+		const text = require_itemId.fieldTextOrNull(raw);
 		return text !== null && when.in.includes(text);
 	}
 	return require_promptSafety.itemIsDone(schema, item);
@@ -909,10 +1580,10 @@ function matchesWhen(when, schema, item) {
 *  Discovery rejects a map that doesn't cover the enum's values, so null
 *  here means a record that predates a map/enum edit. */
 function resolveEvery(every, sourceItem) {
-	if (!require_calendarGrid.isFieldDrivenEvery(every)) return every;
+	if (!require_itemId.isFieldDrivenEvery(every)) return every;
 	const raw = sourceItem[every.fromField];
 	if (raw === void 0 || raw === null || raw === "") return null;
-	const key = require_calendarGrid.fieldTextOrNull(raw);
+	const key = require_itemId.fieldTextOrNull(raw);
 	if (key === null || !Object.hasOwn(every.map, key)) return null;
 	return every.map[key] ?? null;
 }
@@ -951,7 +1622,7 @@ function logSpawnSkip(slug, triggerField, every, sourceItem, sourceId) {
 		});
 		return;
 	}
-	const fromField = require_calendarGrid.isFieldDrivenEvery(every) ? every.fromField : void 0;
+	const fromField = require_itemId.isFieldDrivenEvery(every) ? every.fromField : void 0;
 	require_discovery.log.warn("collections", "spawn skipped: no `every` mapping for frequency value", {
 		slug,
 		sourceId,
@@ -1653,7 +2324,7 @@ async function handleGetItems(collection, args, deps) {
 function computedKeyProblem(record, schema) {
 	for (const key of Object.keys(record)) {
 		const spec = schema.fields[key];
-		if (!spec || !require_calendarGrid.COMPUTED_TYPES.has(spec.type)) continue;
+		if (!spec || !require_itemId.COMPUTED_TYPES.has(spec.type)) continue;
 		if (spec.type === "toggle" && spec.field) return `'${key}' is a toggle projection — write the enum field '${spec.field}' instead`;
 		return `'${key}' is ${{
 			derived: "derived",
@@ -1693,7 +2364,7 @@ async function mergeWithExisting(collection, store, record, itemId) {
 	if (!existing) return `'${itemId}' not found — mode "merge" updates an existing record; use "upsert" or "create" to add it`;
 	const stored = Object.entries(existing).filter(([key]) => {
 		const spec = collection.schema.fields[key];
-		return !spec || !require_calendarGrid.COMPUTED_TYPES.has(spec.type);
+		return !spec || !require_itemId.COMPUTED_TYPES.has(spec.type);
 	});
 	return {
 		...Object.fromEntries(stored),
@@ -2069,6 +2740,36 @@ function makeManageCollectionTool(deps = {}) {
 	};
 }
 //#endregion
+Object.defineProperty(exports, "APPS_COLLECTION", {
+	enumerable: true,
+	get: function() {
+		return APPS_COLLECTION;
+	}
+});
+Object.defineProperty(exports, "APP_ROLES", {
+	enumerable: true,
+	get: function() {
+		return APP_ROLES;
+	}
+});
+Object.defineProperty(exports, "APP_SLUGS_COLLECTION", {
+	enumerable: true,
+	get: function() {
+		return APP_SLUGS_COLLECTION;
+	}
+});
+Object.defineProperty(exports, "AuthoredAppZ", {
+	enumerable: true,
+	get: function() {
+		return AuthoredAppZ;
+	}
+});
+Object.defineProperty(exports, "MAX_RECORD_ISSUES", {
+	enumerable: true,
+	get: function() {
+		return MAX_RECORD_ISSUES;
+	}
+});
 Object.defineProperty(exports, "MAX_SCHEMA_ISSUES", {
 	enumerable: true,
 	get: function() {
@@ -2087,18 +2788,60 @@ Object.defineProperty(exports, "ONE_SECOND_MS", {
 		return ONE_SECOND_MS;
 	}
 });
+Object.defineProperty(exports, "PUBLIC_CONFIG_DOC", {
+	enumerable: true,
+	get: function() {
+		return PUBLIC_CONFIG_DOC;
+	}
+});
+Object.defineProperty(exports, "STORE_UNREADABLE", {
+	enumerable: true,
+	get: function() {
+		return STORE_UNREADABLE;
+	}
+});
 Object.defineProperty(exports, "advanceTriggerDate", {
 	enumerable: true,
 	get: function() {
 		return advanceTriggerDate;
 	}
 });
+Object.defineProperty(exports, "appConfigPath", {
+	enumerable: true,
+	get: function() {
+		return appConfigPath;
+	}
+});
+Object.defineProperty(exports, "appSchemasPath", {
+	enumerable: true,
+	get: function() {
+		return appSchemasPath;
+	}
+});
+Object.defineProperty(exports, "appSlugDoc", {
+	enumerable: true,
+	get: function() {
+		return appSlugDoc;
+	}
+});
+Object.defineProperty(exports, "appStagingPath", {
+	enumerable: true,
+	get: function() {
+		return appStagingPath;
+	}
+});
 Object.defineProperty(exports, "applyMutateAction", {
 	enumerable: true,
 	get: function() {
 		return applyMutateAction;
 	}
 });
+Object.defineProperty(exports, "bindsSubmitterIdentity", {
+	enumerable: true,
+	get: function() {
+		return bindsSubmitterIdentity;
+	}
+});
 Object.defineProperty(exports, "buildActionSeedPrompt", {
 	enumerable: true,
 	get: function() {
@@ -2195,18 +2938,54 @@ Object.defineProperty(exports, "maybeSpawnSuccessor", {
 		return maybeSpawnSuccessor;
 	}
 });
+Object.defineProperty(exports, "parseAuthoredApp", {
+	enumerable: true,
+	get: function() {
+		return parseAuthoredApp;
+	}
+});
 Object.defineProperty(exports, "parseCivil", {
 	enumerable: true,
 	get: function() {
 		return parseCivil;
 	}
 });
+Object.defineProperty(exports, "projectApp", {
+	enumerable: true,
+	get: function() {
+		return projectApp;
+	}
+});
+Object.defineProperty(exports, "projectDeploy", {
+	enumerable: true,
+	get: function() {
+		return projectDeploy;
+	}
+});
+Object.defineProperty(exports, "projectPublish", {
+	enumerable: true,
+	get: function() {
+		return projectPublish;
+	}
+});
+Object.defineProperty(exports, "promoteSchema", {
+	enumerable: true,
+	get: function() {
+		return promoteSchema;
+	}
+});
 Object.defineProperty(exports, "promptPathsFor", {
 	enumerable: true,
 	get: function() {
 		return promptPathsFor;
 	}
 });
+Object.defineProperty(exports, "publishProblems", {
+	enumerable: true,
+	get: function() {
+		return publishProblems;
+	}
+});
 Object.defineProperty(exports, "readCustomViewHtml", {
 	enumerable: true,
 	get: function() {
@@ -2255,6 +3034,12 @@ Object.defineProperty(exports, "schemaRelations", {
 		return schemaRelations;
 	}
 });
+Object.defineProperty(exports, "stagedRuleConfig", {
+	enumerable: true,
+	get: function() {
+		return stagedRuleConfig;
+	}
+});
 Object.defineProperty(exports, "successorId", {
 	enumerable: true,
 	get: function() {
@@ -2274,4 +3059,4 @@ Object.defineProperty(exports, "validateRecordObject", {
 	}
 });
 
-//# sourceMappingURL=server-9mFaGLdq.cjs.map
+//# sourceMappingURL=server-CgkkWWBd.cjs.map