@mulmoclaude/core 3.6.0 → 3.10.0

package/dist/collection/server/publishManifest.d.ts

@@ -0,0 +1,181 @@
+import { z } from 'zod';
+/** The four roles the deployed rules understand. `participant` is the layer
+ *  that is NAMED but reads only its own rows — see `readerOf` vs `listedIn`. */
+export declare const APP_ROLES: readonly ["owner", "editor", "viewer", "participant"];
+/** The declarative mail queue, as the rules re-derive it: a transition of the
+ *  status field, a recipient read off the RECORD, and a fixed template. */
+declare const MailZ: z.ZodObject<{
+    toField: z.ZodString;
+    on: z.ZodRecord<z.ZodString, z.ZodObject<{
+        from: z.ZodArray<z.ZodString>;
+        to: z.ZodString;
+    }, z.core.$strict>>;
+    dataFields: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strict>;
+/** What the rules read out of `collections[cid]`. NOT the schema — the schema
+ *  is published beside it, untouched, for clients to render from. */
+declare const CollectionConfigZ: z.ZodObject<{
+    statusField: z.ZodOptional<z.ZodString>;
+    transitions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>;
+    immutable: z.ZodOptional<z.ZodBoolean>;
+    submitOnly: z.ZodOptional<z.ZodBoolean>;
+    peerVisibility: z.ZodOptional<z.ZodEnum<{
+        public: "public";
+        hidden: "hidden";
+    }>>;
+    revealGated: z.ZodOptional<z.ZodBoolean>;
+    gatedFrom: z.ZodOptional<z.ZodString>;
+    revealBy: z.ZodOptional<z.ZodString>;
+    mail: z.ZodOptional<z.ZodObject<{
+        toField: z.ZodString;
+        on: z.ZodRecord<z.ZodString, z.ZodObject<{
+            from: z.ZodArray<z.ZodString>;
+            to: z.ZodString;
+        }, z.core.$strict>>;
+        dataFields: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>;
+    aggregate: z.ZodOptional<z.ZodObject<{
+        by: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+declare const SubmitZ: z.ZodObject<{
+    auth: z.ZodEnum<{
+        none: "none";
+        anonymous: "anonymous";
+        verifiedEmail: "verifiedEmail";
+    }>;
+    emailField: z.ZodOptional<z.ZodString>;
+    createFields: z.ZodArray<z.ZodString>;
+    initialStatus: z.ZodOptional<z.ZodString>;
+    idFrom: z.ZodOptional<z.ZodEnum<{
+        auto: "auto";
+        "auth.uid": "auth.uid";
+        "auth.uid+field": "auth.uid+field";
+    }>>;
+    idField: z.ZodOptional<z.ZodString>;
+    validate: z.ZodOptional<z.ZodObject<{
+        required: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        keyFields: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            field: z.ZodString;
+            values: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+        }, z.core.$strict>>>;
+    }, z.core.$strict>>;
+    window: z.ZodOptional<z.ZodObject<{
+        from: z.ZodOptional<z.ZodISODateTime>;
+        until: z.ZodOptional<z.ZodISODateTime>;
+    }, z.core.$strict>>;
+    selfUpdate: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>;
+    selfTransitions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>;
+    finalize: z.ZodOptional<z.ZodBoolean>;
+    audience: z.ZodOptional<z.ZodLiteral<"participant">>;
+    gateOn: z.ZodOptional<z.ZodObject<{
+        phase: z.ZodString;
+        match: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+/** The whole authored declaration.
+ *
+ *  `owner` is accepted but is NOT the published value — publish stamps the
+ *  publisher's uid (or carries the existing one forward, which is what the
+ *  rules require on update) and refuses a declaration that disagrees. It is
+ *  accepted rather than banned because the sample app.json in the design note
+ *  shows it, and a hard refusal on a key the samples contain would be a worse
+ *  first experience than a message naming the mismatch. */
+export declare const AuthoredAppZ: z.ZodObject<{
+    aid: z.ZodString;
+    name: z.ZodOptional<z.ZodString>;
+    aidEnv: z.ZodOptional<z.ZodString>;
+    owner: z.ZodOptional<z.ZodString>;
+    members: z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodUnion<readonly [z.ZodLiteral<"*">, z.ZodString]>, z.ZodEnum<{
+        owner: "owner";
+        editor: "editor";
+        viewer: "viewer";
+        participant: "participant";
+    }>>>;
+    collections: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        statusField: z.ZodOptional<z.ZodString>;
+        transitions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>;
+        immutable: z.ZodOptional<z.ZodBoolean>;
+        submitOnly: z.ZodOptional<z.ZodBoolean>;
+        peerVisibility: z.ZodOptional<z.ZodEnum<{
+            public: "public";
+            hidden: "hidden";
+        }>>;
+        revealGated: z.ZodOptional<z.ZodBoolean>;
+        gatedFrom: z.ZodOptional<z.ZodString>;
+        revealBy: z.ZodOptional<z.ZodString>;
+        mail: z.ZodOptional<z.ZodObject<{
+            toField: z.ZodString;
+            on: z.ZodRecord<z.ZodString, z.ZodObject<{
+                from: z.ZodArray<z.ZodString>;
+                to: z.ZodString;
+            }, z.core.$strict>>;
+            dataFields: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
+        aggregate: z.ZodOptional<z.ZodObject<{
+            by: z.ZodArray<z.ZodString>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>>;
+    participantRead: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    public: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodOptional<z.ZodBoolean>;
+        read: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        submit: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+            auth: z.ZodEnum<{
+                none: "none";
+                anonymous: "anonymous";
+                verifiedEmail: "verifiedEmail";
+            }>;
+            emailField: z.ZodOptional<z.ZodString>;
+            createFields: z.ZodArray<z.ZodString>;
+            initialStatus: z.ZodOptional<z.ZodString>;
+            idFrom: z.ZodOptional<z.ZodEnum<{
+                auto: "auto";
+                "auth.uid": "auth.uid";
+                "auth.uid+field": "auth.uid+field";
+            }>>;
+            idField: z.ZodOptional<z.ZodString>;
+            validate: z.ZodOptional<z.ZodObject<{
+                required: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                keyFields: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                    field: z.ZodString;
+                    values: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+                }, z.core.$strict>>>;
+            }, z.core.$strict>>;
+            window: z.ZodOptional<z.ZodObject<{
+                from: z.ZodOptional<z.ZodISODateTime>;
+                until: z.ZodOptional<z.ZodISODateTime>;
+            }, z.core.$strict>>;
+            selfUpdate: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>;
+            selfTransitions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>;
+            finalize: z.ZodOptional<z.ZodBoolean>;
+            audience: z.ZodOptional<z.ZodLiteral<"participant">>;
+            gateOn: z.ZodOptional<z.ZodObject<{
+                phase: z.ZodString;
+                match: z.ZodString;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type AuthoredApp = z.infer<typeof AuthoredAppZ>;
+export type AuthoredCollectionConfig = z.infer<typeof CollectionConfigZ>;
+export type AuthoredSubmit = z.infer<typeof SubmitZ>;
+export type AuthoredMail = z.infer<typeof MailZ>;
+export type AuthoredAppResult = {
+    ok: true;
+    app: AuthoredApp;
+} | {
+    ok: false;
+    problems: string[];
+};
+/** Parse the authored declaration out of `app.json`'s text.
+ *
+ *  Returns a LIST of problems rather than throwing, for the same reason
+ *  `loadAppManifest` returns a failure: the caller is a gate whose entire job
+ *  is to hand the author something to act on. Every problem is reported at
+ *  once — publish is a manual step, and a parser that stops at the first key
+ *  makes it N round trips. */
+export declare function parseAuthoredApp(raw: string): AuthoredAppResult;
+/** zod issues as one actionable line each: `public.submit.responses.auth: …`. */
+export declare function authoredProblems(error: z.ZodError): string[];
+export {};

package/dist/collection/server/publishProject.d.ts

@@ -0,0 +1,255 @@
+import { CollectionSchema } from '../core/schema';
+import { AuthoredApp, AuthoredCollectionConfig } from './publishManifest';
+/** Who and when. Threaded in rather than read from a clock inside the
+ *  projection so the projection stays pure and the tests can assert on an
+ *  exact document. */
+export interface PublishStamp {
+    /** The publisher's Firebase uid. The rules require `owner ==
+     *  request.auth.uid` on CREATE and `owner` unchanged on UPDATE, so this is
+     *  used only when the app document does not exist yet. */
+    uid: string;
+    /** The publisher's verified email — the principal the roster is keyed by. */
+    email: string;
+    /** Wall-clock millis of this publish. */
+    publishedAt: number;
+    /** The git commit the declaration was read from, when the host could
+     *  resolve one. Absent is a normal state (a dirty tree, a repository
+     *  without git), and absent is more honest than a fabricated value. */
+    commit?: string | undefined;
+    /** Was the working tree modified when the commit was read?
+     *
+     *  Recorded as `publishedDirty` on the app document, because a commit that
+     *  does not describe what was published is worse than no commit: it looks
+     *  auditable. Publish-owned like the rest of the `published*` family — a
+     *  deploy must not drop the marker, and a later CLEAN publish must clear it
+     *  rather than inherit it forever. */
+    dirty?: boolean | undefined;
+}
+/** One collection's published schema document (`apps/{aid}/collections/{cid}`).
+ *
+ *  The rules never read `publishedSchema` — `schemaRead` gates the whole
+ *  document and stops there. It is here for the CLIENTS: a member's host
+ *  renders from it, and a public webview has no other way to know the fields.
+ *  The whole schema is published rather than a projection of it, because
+ *  every attempt to guess "the part a view needs" is a guess about a view
+ *  that has not been written yet. */
+export interface PublishedSchemaDoc extends Record<string, unknown> {
+    publishedSchema: CollectionSchema;
+    publishedAt: number;
+    publishedBy: string;
+    publishedCommit?: string;
+}
+/** A STAGED schema document (`apps/{aid}/staging/{cid}`) — what deploy writes
+ *  and what `/staging/{aid}` renders from.
+ *
+ *  Its provenance keys are `deployed*`, not `published*`. The two are different
+ *  questions with different answers at almost every moment: `published*` says
+ *  which revision the PUBLIC is looking at, and a deploy must not move it —
+ *  otherwise staging a draft rewrites the recorded public revision (and, with
+ *  `previousPublished`, the thing a rollback would restore) before anyone has
+ *  published anything. */
+export interface StagedSchemaDoc extends Record<string, unknown> {
+    publishedSchema: CollectionSchema;
+    /** This collection's RULE-FACING configuration (`transitions`, `immutable`,
+     *  `submitOnly`, `peerVisibility`, …) — staged with the schema, not written
+     *  straight onto the app document.
+     *
+     *  It has to be staged for the same reason the `public` block is: the rules
+     *  read `apps/{aid}.collections[cid]` when they authorize a PUBLIC write, so
+     *  a deploy that landed it would change what anonymous visitors may do
+     *  before anyone published. The cost is that `/staging/{aid}` exercises the
+     *  new schema against the CURRENTLY PUBLISHED rule configuration; that is
+     *  the safe direction to be wrong in. */
+    config?: AuthoredCollectionConfig;
+    /** Whether this cid is in `participantRead` — same reason, same treatment. */
+    participantRead?: boolean;
+    deployedAt: number;
+    deployedBy: string;
+    deployedCommit?: string;
+}
+/** The public settings document (`apps/{aid}/config/public`).
+ *
+ *  `allow read: if true` — this is the one document an anonymous visitor can
+ *  read, and it is the reason `apps/{aid}` itself is reader-only: a
+ *  participant reading the app document would see their classmates'
+ *  addresses. So the roster is NOT here, and neither is `owner`. What is here
+ *  is what a public form needs in order to render itself and to tell a visitor
+ *  "this closed yesterday" instead of failing a write with no explanation. */
+export interface PublishedConfigDoc extends Record<string, unknown> {
+    name?: string;
+    enabled: boolean;
+    read: string[];
+    submit: Record<string, Record<string, unknown>>;
+    publishedAt: number;
+}
+/** Everything one publish writes. Separate documents because they live at
+ *  separate paths with separate rules — and in the order given: the app
+ *  document authorizes the other two, so it goes first. */
+export interface PublishedApp {
+    app: Record<string, unknown>;
+    schemas: {
+        cid: string;
+        doc: PublishedSchemaDoc;
+    }[];
+    config: PublishedConfigDoc;
+}
+/** The document id under `apps/{aid}/config`. One document, named, rather than
+ *  a spread of them: a second public document is a second thing to keep in
+ *  step, and nothing yet needs one. */
+export declare const PUBLIC_CONFIG_DOC = "public";
+/** Project the authored declaration into the documents publish writes.
+ *
+ *  `existing` is the app document as it is in Firestore right now, or null on
+ *  a first publish. Two things need it, both required by the rules:
+ *    - `owner` must be UNCHANGED on update. Re-stamping the publisher's uid
+ *      would be refused for any app whose owner ever signed in as a different
+ *      account, and would silently transfer ownership if it were not.
+ *    - `previousPublished` is that document, so a rollback has something to
+ *      put back.
+ *
+ *  Pure: no clock, no filesystem, no Firestore. Everything variable arrives as
+ *  a parameter, which is what makes the conversion table testable as a table. */
+export declare function projectApp(authored: AuthoredApp, schemas: {
+    cid: string;
+    schema: CollectionSchema;
+}[], stamp: PublishStamp, existing: Record<string, unknown> | null): PublishedApp;
+/** Everything `deploy` writes — the host's staging half of the split (the
+ *  design's D10).
+ *
+ *  Two things are deliberately ABSENT from the app document here:
+ *
+ *  - **`public`**. That block is what the rules read to authorize anonymous
+ *    access (`publicOn` / `subOpen` read `apps/{aid}.public`, never the
+ *    world-readable `config/public`), so writing it on deploy would open the
+ *    app the moment someone deployed to test. It belongs to `publish`.
+ *  - **the published schemas**. They go to `staging/{cid}`, which only the
+ *    roster can read, so a deploy against a LIVE app does not swap the view
+ *    its visitors are looking at.
+ *
+ *  A host writing this must MERGE the app document rather than replace it:
+ *  a replace would drop a `public` block a previous publish put there and
+ *  silently unpublish the app. */
+export interface DeployedApp {
+    /** The COMPLETE app document. **Write it with `set`, replacing — never with
+     *  `{ merge: true }`.**
+     *
+     *  A merge cannot DELETE, and every deletion here is a permission change:
+     *  removing `members.<email>` revokes access, and a merge would leave the
+     *  entry live. Worse, the rules require `memberEmails` to equal the keys of
+     *  `members` (`membersConsistent()`), so a merged member-removal is rejected
+     *  outright — a deploy that silently does nothing would be the good case.
+     *
+     *  Everything publish owns is carried through from `existing` verbatim, so
+     *  replacing does not unpublish a live app. */
+    app: Record<string, unknown>;
+    /** The staged schema documents, for `apps/{aid}/staging/{cid}`. */
+    staging: {
+        cid: string;
+        doc: StagedSchemaDoc;
+    }[];
+}
+export declare function projectDeploy(authored: AuthoredApp, schemas: {
+    cid: string;
+    schema: CollectionSchema;
+}[], stamp: PublishStamp, existing: Record<string, unknown> | null): DeployedApp;
+/** Everything `publish` writes that is NOT a promotion — the public face.
+ *
+ *  The schemas are absent on purpose: publish PROMOTES the documents deploy
+ *  staged (copy `staging/{cid}` → `collections/{cid}`, re-stamped with
+ *  {@link promoteSchema}) rather than re-projecting them from git. What the
+ *  roster tested is then exactly what ships; re-projecting would publish
+ *  whatever the working tree says at publish time, which nobody has looked at
+ *  through `/staging/{aid}`.
+ *
+ *  WRITE `public` LAST. It is the only one of the three that grants anything,
+ *  so a partial failure with it last leaves the app private (fail closed).
+ *  See the design note's publish ordering. */
+export interface PublishedFace {
+    /** The COMPLETE app document **without `public`** — write it with `set`,
+     *  replacing.
+     *
+     *  Replacing (not merging) is what lets a key DISAPPEAR: withdrawing a
+     *  collection's rule configuration, or taking `public` out of `app.json`,
+     *  has to actually remove the field. Everything deploy owns is carried
+     *  through from `existing`, so publishing does not revert an invitation.
+     *
+     *  `public` is absent HERE on purpose — see {@link PublishedFace.public}. */
+    app: Record<string, unknown>;
+    /** `apps/{aid}/config/public` — the world-readable projection. */
+    config: PublishedConfigDoc;
+    /** The `public` block, to be written **LAST, as its own update** — or, when
+     *  `undefined`, DELETED from the app document (that is how an app becomes
+     *  private again).
+     *
+     *  Separate from {@link PublishedFace.app} because it is the only one of
+     *  publish's writes that GRANTS anything: the rules authorize anonymous
+     *  reads and submissions from `apps/{aid}.public`. Writing it inside the
+     *  replacement document would open the app before the promoted schemas and
+     *  the world-readable config exist, so a failure part-way would leave
+     *  anonymous access live against a half-published surface. Written last, the
+     *  same failure leaves the app private — which is the direction to fail in.
+     *
+     *  A re-publish therefore passes through a moment with no `public` block.
+     *  That is a brief denial for visitors, not a brief exposure. */
+    public: Record<string, unknown> | undefined;
+}
+/** The rule-facing configuration to promote, read from the STAGED documents
+ *  rather than from the manifest as it reads right now.
+ *
+ *  Otherwise: deploy revision A, edit `app.json` to revision B, publish — and
+ *  the promoted schema is A's while the authorization behaviour is B's, a
+ *  combination nobody exercised through `/staging/{aid}`.
+ *
+ *  (`public` is deliberately NOT part of this: it is not staged, because it is
+ *  the decision being made AT publish rather than something under test.) */
+export declare function stagedRuleConfig(staged: {
+    cid: string;
+    doc: StagedSchemaDoc;
+}[]): {
+    collections: Record<string, AuthoredCollectionConfig> | undefined;
+    participantRead: string[] | undefined;
+};
+export declare function projectPublish(authored: AuthoredApp, staged: {
+    cid: string;
+    doc: StagedSchemaDoc;
+}[], stamp: PublishStamp, existing: Record<string, unknown> | null): PublishedFace;
+/** Re-stamp a staged schema document as it is promoted to `collections/{cid}`.
+ *
+ *  The stamp answers "which version is PUBLIC right now, and who made it so",
+ *  so it is written by the operation that changes the answer — publish — not
+ *  carried over from the deploy that staged it. */
+export declare function promoteSchema(staged: StagedSchemaDoc, stamp: PublishStamp): PublishedSchemaDoc;
+/** The app documents' parent path — the `FirestoreDocs` seam takes a
+ *  collection path plus a document id, and the app document's id is the aid. */
+export declare const APPS_COLLECTION = "apps";
+/** The collection (schema) documents' parent path — what the PUBLIC page
+ *  reads, written only by publish (promotion). */
+export declare const appSchemasPath: (aid: string) => string;
+/** The URL-slug reservations — `appSlugs/{slug}` → `{ aid, published }`.
+ *
+ *  A TOP-LEVEL collection, not a field on the app: the public page resolves a
+ *  slug to an aid BEFORE it can read anything under `apps/{aid}`, and a slug
+ *  has to be claimable atomically (create-if-absent) so two apps cannot hold
+ *  the same URL.
+ *
+ *  `published` is what makes the reservation invisible until publish. The slug
+ *  is human-readable, so a readable reservation would let anyone guess the URL
+ *  and get the aid — and the aid is the `/staging/{aid}` entrance. The rule is
+ *  `allow read: if resource.data.published == true`, which needs no `get()` and
+ *  so costs nothing against the rules' expression budget. */
+export declare const APP_SLUGS_COLLECTION = "appSlugs";
+/** The reservation document. Written by deploy as `{ aid, published: false }`
+ *  and flipped by publish — never re-pointed at another aid, which the rules
+ *  enforce on update. */
+export interface AppSlugDoc extends Record<string, unknown> {
+    aid: string;
+    published: boolean;
+}
+export declare const appSlugDoc: (aid: string, published: boolean) => AppSlugDoc;
+/** The staged schema documents' parent path — what `/staging/{aid}` reads,
+ *  written by deploy. A separate DOCUMENT rather than a field beside
+ *  `publishedSchema`, because the rules cannot hide a field: anything inside a
+ *  document the public page may read is public. */
+export declare const appStagingPath: (aid: string) => string;
+/** The public-config documents' parent path. */
+export declare const appConfigPath: (aid: string) => string;

package/dist/collection/server/validate.d.ts

@@ -8,6 +8,18 @@ export interface RecordIssue {
     /** Human-readable problem, written to be actionable by the LLM. */
     problem: string;
 }
+/** Don't flood the result; the first batch is enough to act on. Exported
+ *  because a caller that REPORTS a count has to know the count is a floor —
+ *  `publish` presents a full batch as "at least N" rather than as a total. */
+export declare const MAX_RECORD_ISSUES = 25;
+/** The `file` of the pseudo-issue reported when the backend could not be read
+ *  at all.
+ *
+ *  Exported because it is a DIFFERENT KIND of answer from "this record is
+ *  invalid", and a caller that treats the two alike gets it wrong in the
+ *  direction that matters: `publish` lets the user override invalid records,
+ *  and overriding this one would mean publishing without ever having looked. */
+export declare const STORE_UNREADABLE = "(store)";
 export declare function validateCollectionRecords(collection: LoadedCollection, opts?: {
     workspaceRoot?: string | undefined;
 }): Promise<RecordIssue[]>;

package/dist/collection-watchers/index.cjs

@@ -1,10 +1,10 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_root = require("../root-rPH6FGDT.cjs");
-const require_calendarGrid = require("../calendarGrid-DGILaVxI.cjs");
-const require_promptSafety = require("../promptSafety-NNGViiCr.cjs");
+const require_itemId = require("../itemId-Dzrr3vs5.cjs");
+const require_promptSafety = require("../promptSafety-CWqYq-NS.cjs");
 require("../collection/index.cjs");
-const require_discovery = require("../discovery-Cw5xWzZD.cjs");
-const require_server = require("../server-9mFaGLdq.cjs");
+const require_discovery = require("../discovery-BsXiDZBR.cjs");
+const require_server = require("../server-CgkkWWBd.cjs");
 const require_notifier = require("../notifier-DZJj0sOh.cjs");
 let node_fs_promises = require("node:fs/promises");
 //#region src/collection-watchers/config.ts
@@ -86,8 +86,8 @@ var SHARED_MARK = "#";
 *  Deliberately NOT on the package barrel: the id is a disk format, not an API. */
 function completionLegacyId(slug, itemId, root, aid) {
 	if (root !== void 0 && aid !== void 0) throw new Error(`completionLegacyId: "${slug}" carries both a root (${root}) and an app (${aid})`);
-	if (!require_calendarGrid.isValidCollectionName(slug)) throw new Error(`completionLegacyId: collection name "${slug}" is not a valid collection name`);
-	if (aid !== void 0 && !require_calendarGrid.isValidCollectionName(aid)) throw new Error(`completionLegacyId: app id "${aid}" is not a valid collection name`);
+	if (!require_itemId.isValidCollectionName(slug)) throw new Error(`completionLegacyId: collection name "${slug}" is not a valid collection name`);
+	if (aid !== void 0 && !require_itemId.isValidCollectionName(aid)) throw new Error(`completionLegacyId: app id "${aid}" is not a valid collection name`);
 	return `${LEGACY_ID_PREFIX}${aid !== void 0 ? `${SHARED_MARK}${aid}${ROOT_SEP}` : root === void 0 ? "" : `${ROOT_MARK}${require_root.canonicalRoot(root)}${ROOT_SEP}`}${slug}:${itemId}`;
 }
 /** Decode a key back into its (root, slug, itemId), or null if the string
@@ -130,7 +130,7 @@ function parseCompletionLegacyId(legacyId) {
 function resolveDisplayLabel(schema, item, itemId) {
 	const { displayField } = schema;
 	if (!displayField) return itemId;
-	const label = require_calendarGrid.fieldText(item[displayField]).trim();
+	const label = require_itemId.fieldText(item[displayField]).trim();
 	return label.length > 0 ? label : itemId;
 }
 /** The scope a collection's bells belong to.
@@ -714,10 +714,22 @@ function stopVanishedWatchers(gen, liveSlugs) {
 	}
 	return mutated;
 }
+/** True when the collection's records moved — a different `dataSource.path`, a
+*  different `dataPath`, a flip between the two modes, or a different APP. The
+*  mount (an fs.watch, or a Firestore listener) is bound to the OLD location,
+*  so it must be remounted, not just re-reconciled.
+*
+*  `appId` belongs here even though it is not in the schema: it is resolved
+*  separately, from the repository's `app.json`. Point that file at another app
+*  and every read and write follows immediately, while a listener armed on the
+*  old one keeps running — so the collection would serve the NEW app's records
+*  and be woken by the OLD app's changes, forever. */
+function backendMoved(previous, next) {
+	return previous.appId !== next.appId || storagePathChanged(previous.schema, next.schema);
+}
 /** True when a schema edit moved the collection's storage — a different
 *  `dataSource.path`, a different `dataPath`, or a flip between the two
-*  modes. The mounted fs.watch is bound to the OLD location, so it must
-*  be remounted, not just re-reconciled. */
+*  modes. */
 function storagePathChanged(previous, next) {
 	return previous.dataSource?.path !== next.dataSource?.path || previous.dataPath !== next.dataPath || previous.storage?.type !== next.storage?.type || storageFilePath(previous.storage) !== storageFilePath(next.storage);
 }
@@ -729,23 +741,30 @@ function storageFilePath(storage) {
 }
 /** Re-reconcile already-watched collections whose schema changed since
 *  the last tick. New collections fall through to `startNewWatchers`. */
+/** Unmount a collection whose records moved. `startNewWatchers` (right after
+*  this pass in syncWatchers) remounts it on the new location. A dataSource
+*  collection also gets a change ping so open views refetch immediately. */
+function dropStaleMount(gen, existing, collection) {
+	log().info("watcher backend moved, remounting", { slug: collection.slug });
+	try {
+		existing.unsubscribe();
+	} catch {}
+	gen.watchers.delete(collection.slug);
+	if (collection.schema.dataSource !== void 0) safePublish(gen, collection, {
+		slug: collection.slug,
+		op: "upsert"
+	});
+}
 async function reconcileChangedSchemas(gen, collections) {
 	let mutated = false;
 	for (const collection of collections) {
 		const existing = gen.watchers.get(collection.slug);
 		if (!existing) continue;
 		const nextJson = JSON.stringify(collection.schema);
-		if (existing.schemaJson === nextJson) continue;
-		if (storagePathChanged(existing.collection.schema, collection.schema)) {
-			log().info("watcher storage path changed, remounting", { slug: collection.slug });
-			try {
-				existing.unsubscribe();
-			} catch {}
-			gen.watchers.delete(collection.slug);
-			if (collection.schema.dataSource !== void 0) safePublish(gen, {
-				slug: collection.slug,
-				op: "upsert"
-			});
+		const moved = backendMoved(existing.collection, collection);
+		if (existing.schemaJson === nextJson && !moved) continue;
+		if (moved) {
+			dropStaleMount(gen, existing, collection);
 			mutated = true;
 			continue;
 		}
@@ -753,7 +772,7 @@ async function reconcileChangedSchemas(gen, collections) {
 		existing.collection = collection;
 		log().info("watcher schema changed, re-reconciling", { slug: collection.slug });
 		await reconcileAllItems(collection, gen.discoveryOpts);
-		if (collection.schema.dataSource !== void 0) safePublish(gen, {
+		if (collection.schema.dataSource !== void 0) safePublish(gen, collection, {
 			slug: collection.slug,
 			op: "upsert"
 		});
@@ -841,13 +860,15 @@ async function handleStoreChange(gen, slug, change) {
 *  per slug so a burst of writes collapses into one pass plus one trailing
 *  re-run. */
 function scheduleCollectionReconcile(gen, slug) {
+	let target = gen.watchers.get(slug)?.collection ?? { appId: void 0 };
 	return runSingleFlight(gen.collectionSlots, slug, async () => {
 		const collection = await require_discovery.loadCollection(slug, gen.discoveryOpts);
 		if (!collection) return;
+		target = collection;
 		await reconcileAllItems(collection, gen.discoveryOpts);
 		await sweepStaleActiveEntries(gen.discoveryOpts);
 	}, () => {
-		safePublish(gen, {
+		safePublish(gen, target, {
 			slug,
 			op: "upsert"
 		});
@@ -911,13 +932,29 @@ function runSingleFlight(slots, key, pass, onSettled) {
 *  file-backed collections reach here; a `storage` (db) collection has no
 *  per-record file and publishes wholesale in `scheduleStorageReconcile`. */
 async function publishItemChange(gen, collection, itemId) {
-	const changeOp = await itemFileExists(collection.dataDir, itemId) ? "upsert" : "delete";
-	safePublish(gen, {
+	const changeOp = await recordStillExists(gen, collection, itemId) ? "upsert" : "delete";
+	safePublish(gen, collection, {
 		slug: collection.slug,
 		ids: [itemId],
 		op: changeOp
 	});
 }
+/** Upsert or delete? Answered by whatever actually holds the record.
+*
+*  A shared collection's records are Firestore documents — there is no item
+*  file, so the file check answers "gone" for every one of them and each live
+*  change would be published as a DELETE. Asking the store is the question the
+*  file check was standing in for; the file path keeps it because it is
+*  cheaper and its semantics (an unreadable dir, an id that is not a safe
+*  filename) are already settled there. */
+async function recordStillExists(gen, collection, itemId) {
+	if (collection.appId === void 0) return itemFileExists(collection.dataDir, itemId);
+	try {
+		return await require_discovery.storeFor(collection, gen.discoveryOpts).read(itemId) !== null;
+	} catch {
+		return true;
+	}
+}
 async function itemFileExists(dataDir, itemId) {
 	try {
 		await (0, node_fs_promises.access)(require_discovery.itemFilePath(dataDir, itemId));
@@ -934,8 +971,15 @@ async function itemFileExists(dataDir, itemId) {
 *  carries only absolute paths, and a root reconstructed by string surgery
 *  would be a guess. Undefined in a single-workspace host, which is exactly
 *  what the payload contract means by "the host's configured root". */
-function safePublish(gen, payload) {
-	const enriched = require_discovery.collectionChangePayload(payload, gen.discoveryOpts.workspaceRoot);
+/** Publish a change on the channel the collection actually lives on.
+*
+*  A SHARED collection is not keyed by this checkout: its identity is
+*  `(aid, cid)`, and the same collection is open in every clone. Publishing it
+*  as `(root, slug)` sends the refresh to a channel no shared subscriber is
+*  listening on — the live update simply never arrives, and nothing errors.
+*  That is why this takes the collection rather than a bare slug. */
+function safePublish(gen, collection, base) {
+	const enriched = collection.appId === void 0 ? require_discovery.collectionChangePayload(base, gen.discoveryOpts.workspaceRoot) : require_discovery.sharedCollectionChangePayload(base, collection.appId);
 	try {
 		require_discovery.publishCollectionChange(enriched);
 	} catch (err) {