@mulmoclaude/core 3.6.0 → 3.10.0

package/dist/{discovery-Cw5xWzZD.cjs → discovery-BsXiDZBR.cjs}

@@ -1,18 +1,19 @@
 const require_rolldown_runtime = require("./rolldown-runtime-VH7oDXx4.cjs");
 const require_dist = require("./dist-CsgSfWwR.cjs");
 const require_root = require("./root-rPH6FGDT.cjs");
-const require_calendarGrid = require("./calendarGrid-DGILaVxI.cjs");
+const require_itemId = require("./itemId-Dzrr3vs5.cjs");
 const require_project = require("./project-C1ep9pvo.cjs");
+const require_listen = require("./listen-UZA68Upt.cjs");
 const require_templatePath = require("./templatePath-27vUZowm.cjs");
 let node_fs = require("node:fs");
 let node_path = require("node:path");
 node_path = require_rolldown_runtime.__toESM(node_path, 1);
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
+let zod = require("zod");
 let node_os = require("node:os");
 let iconv_lite = require("iconv-lite");
 iconv_lite = require_rolldown_runtime.__toESM(iconv_lite, 1);
-let zod = require("zod");
 //#region src/host/hostSlot.ts
 function createHostSlot(name) {
 	let current = null;
@@ -54,7 +55,7 @@ var COLLECTION_ROOT_REQUIRED = "COLLECTION_ROOT_REQUIRED";
 /** Build a local {@link CollectionKey}, canonicalising the root. The identity
 *  type itself is isomorphic and cannot canonicalise (that needs `node:path`),
 *  so this is the constructor server code should use. */
-var localCollectionKey = (root, slug) => require_calendarGrid.localCollectionKeyOf(require_root.canonicalRoot(root), slug);
+var localCollectionKey = (root, slug) => require_itemId.localCollectionKeyOf(require_root.canonicalRoot(root), slug);
 /** Build a change payload, attaching `root` only when the engine call carried
 *  an explicit one. Centralised so every publish site states the root the same
 *  way, and so a single-workspace host's payload shape stays byte-identical to
@@ -69,7 +70,7 @@ function collectionChangePayload(base, root) {
 *  which is what it is called inside its app; `aid` is what makes it an
 *  identity. Never stamps a `root` — a shared collection does not have one. */
 function sharedCollectionChangePayload(base, aid) {
-	require_calendarGrid.sharedCollectionKey(aid, base.slug);
+	require_itemId.sharedCollectionKey(aid, base.slug);
 	return {
 		...base,
 		aid
@@ -102,11 +103,12 @@ function requireOneScope(payload) {
 }
 function collectionChangeKey(payload, fallbackRoot) {
 	requireOneScope(payload);
-	return payload.aid === void 0 ? localCollectionKey(payload.root ?? fallbackRoot, payload.slug) : require_calendarGrid.sharedCollectionKey(payload.aid, payload.slug);
+	return payload.aid === void 0 ? localCollectionKey(payload.root ?? fallbackRoot, payload.slug) : require_itemId.sharedCollectionKey(payload.aid, payload.slug);
 }
 var hostSlot = createHostSlot("@mulmoclaude/core/collection/server: configureCollectionHost()");
 var changePublisher = null;
 var firestoreAccessor = null;
+var sharedCollectionsSupported = false;
 /** Wire the engine to a host. Call once at server startup, before any
 *  collection storage operation. Re-binding to a *different* host throws —
 *  silently redirecting later filesystem operations to another workspace
@@ -130,6 +132,39 @@ function setCollectionChangePublisher(publish) {
 function publishCollectionChange(payload) {
 	changePublisher?.(payload);
 }
+/** Does this host serve SHARED (firestore-backed) collections at all?
+*
+*  Opt-in, and `false` until a host says otherwise, because the default has to
+*  be the safe one: a host that cannot reach Firestore must not accept a
+*  shared schema and then report the collection as empty.
+*
+*  WHY A CAPABILITY AND NOT A HOST CHECK. The engine must not know which host
+*  it is running in. The rule being expressed — shared collections live in a
+*  PROJECT REPOSITORY, not in a single managed workspace where one roster
+*  would govern every unrelated collection beside it — is a property the host
+*  knows about ITSELF. Asking the engine to test for a particular host's
+*  workspace would put a host's name in shared code and make every change to
+*  a one-host feature a change to this package.
+*
+*  WHY NOT A FIELD ON `CollectionHost`. Same reason the accessor below is not
+*  one: `configureCollectionHost` is a ONE-SHOT binding a host sets at startup
+*  and cannot re-bind, so a suite exercising this engine could not turn the
+*  capability on for itself without owning the whole host. This is the same
+*  concern as the accessor and belongs beside it.
+*
+*  NOT DERIVED FROM THE ACCESSOR. "Has a session right now" and "serves shared
+*  collections at all" are different questions: the accessor answers null
+*  between connections, and a collection must not stop being ACCEPTABLE
+*  because nobody is signed in — that would turn "connect first" into "this
+*  schema is invalid". */
+function setSharedCollectionsSupport(supported) {
+	sharedCollectionsSupported = supported;
+}
+/** Whether the host declared support. Consulted from the schema ACCEPTANCE
+*  gate, whose contract is to return a reason rather than raise. */
+function hostSupportsSharedCollections() {
+	return sharedCollectionsSupported;
+}
 /** Wire the accessor for the host's authenticated Firestore session.
 *
 *  Separate from `configureCollectionHost` for the same reason
@@ -234,7 +269,7 @@ var SCHEMA_FILE = "schema.json";
 *  `js/path-injection` sanitiser. */
 function safeSlugName(slug) {
 	if (typeof slug !== "string") return null;
-	if (!require_calendarGrid.SAFE_SLUG_PATTERN.test(slug)) return null;
+	if (!require_itemId.SAFE_SLUG_PATTERN.test(slug)) return null;
 	const basename = node_path.default.basename(slug);
 	if (basename !== slug) return null;
 	return basename;
@@ -246,7 +281,7 @@ function safeSlugName(slug) {
 *  `js/path-injection` sanitiser CodeQL recognises on `safeSlugName`. */
 function safeRecordId(recordId) {
 	if (typeof recordId !== "string") return null;
-	if (!require_calendarGrid.SAFE_RECORD_ID_PATTERN.test(recordId)) return null;
+	if (!require_itemId.SAFE_RECORD_ID_PATTERN.test(recordId)) return null;
 	if (recordId.includes("..")) return null;
 	const basename = node_path.default.basename(recordId);
 	if (basename !== recordId) return null;
@@ -378,7 +413,7 @@ function sharedItemsPath(key) {
 *  missing `appId` — see NO_APP. */
 function keyOf(collection) {
 	if (collection.appId === void 0) throw new Error(NO_APP);
-	return require_calendarGrid.sharedCollectionKey(collection.appId, collection.slug);
+	return require_itemId.sharedCollectionKey(collection.appId, collection.slug);
 }
 function requireHandle() {
 	const handle = firestoreHandle();
@@ -420,8 +455,32 @@ async function guarded(key, email, run) {
 *  older version) can hold anything, so a non-object is dropped rather than
 *  surfaced as a broken record — the same fail-soft the file store applies to
 *  an unparseable `.json`. */
-function toItem(data) {
-	return require_dist.isRecord(data) ? data : null;
+/** A stored document as a record — with its identity taken from the DOCUMENT
+*  ID, never from the document's own fields.
+*
+*  This is the one place a shared record's identity is decided, and it is
+*  decided against the field the writer supplied on purpose.
+*
+*  The rules can constrain the document id (`idFrom` pins it to the
+*  submitter's uid, or to uid+field) and they CANNOT constrain the value of a
+*  field: `validateOk` checks which keys are present, `keyFieldsOk` checks a
+*  declared enum, and nothing compares `request.resource.data[primaryKey]`
+*  with the path being written. So a public submitter writing at their one
+*  permitted document id could put ANY value in the primary-key field —
+*  another member's record id, or a duplicate — and every reader would take it
+*  as the record's identity. Overwriting it here makes that unreachable rather
+*  than merely discouraged, and it costs nothing: for a record written through
+*  this store the two already agree, because `firestoreWrite` writes at the id
+*  it was given.
+*
+*  It also removes the reason a submit path would have had to accept the
+*  primary key as a `createField` at all — a submission that cannot name its
+*  own id is exactly right when the id is the thing being assigned. */
+function toItem(data, docId, primaryKey) {
+	return require_dist.isRecord(data) ? {
+		...data,
+		[primaryKey]: docId
+	} : null;
 }
 /** Record ids are validated with the SAME helper every other backend uses.
 *  Firestore would accept ids the file store refuses, but a record should stay
@@ -432,9 +491,9 @@ function withSafeId(itemId, onInvalid, run) {
 	if (safeId === null) return onInvalid();
 	return run(safeId, requireHandle());
 }
-async function firestoreList(key) {
+async function firestoreList(key, primaryKey) {
 	const { docs, email } = requireHandle();
-	return (await guarded(key, email, () => docs.list(sharedItemsPath(key)))).map((entry) => toItem(entry.data)).filter((item) => item !== null);
+	return (await guarded(key, email, () => docs.list(sharedItemsPath(key)))).map((entry) => toItem(entry.data, entry.id, primaryKey)).filter((item) => item !== null);
 }
 /** Paging is emulated over a full ordered read rather than pushed into
 *  Firestore: `offset` has no server-side form there (the cursor API needs the
@@ -442,7 +501,7 @@ async function firestoreList(key) {
 *  `total` needs the full count anyway. Hence `nativePaging: false` — the
 *  capability is honest about the cost. */
 async function firestorePage(key, primaryKey, opts) {
-	const items = await firestoreList(key);
+	const items = await firestoreList(key, primaryKey);
 	const offset = Math.max(0, opts.offset ?? 0);
 	return {
 		items: projectItemFields(opts.limit === void 0 ? items.slice(offset) : items.slice(offset, offset + Math.max(0, opts.limit)), opts.fields, primaryKey),
@@ -450,8 +509,8 @@ async function firestorePage(key, primaryKey, opts) {
 		truncated: false
 	};
 }
-async function firestoreRead(key, itemId) {
-	return withSafeId(itemId, () => Promise.resolve(null), async (safeId, { docs, email }) => toItem(await guarded(key, email, () => docs.get(sharedItemsPath(key), safeId))));
+async function firestoreRead(key, itemId, primaryKey) {
+	return withSafeId(itemId, () => Promise.resolve(null), async (safeId, { docs, email }) => toItem(await guarded(key, email, () => docs.get(sharedItemsPath(key), safeId)), safeId, primaryKey));
 }
 /** Publish the "records changed" ping for a shared collection.
 *
@@ -502,6 +561,111 @@ async function firestoreDelete(key, itemId, opts) {
 		};
 	});
 }
+/** Deliver one snapshot's changes.
+*
+*  THE FIRST SNAPSHOT IS ONE COLLECTION-LEVEL REPORT, not N per-record ones.
+*  `onSnapshot` hands over the collection's current contents immediately, as a
+*  snapshot in which every existing document reads as `added`.
+*
+*  Dropping it is wrong. There is a GAP on either side of a subscription — the
+*  boot reconcile finishes before the listener arms, and a listener that died
+*  is re-armed after a backoff — and a record that moved inside one of those
+*  gaps appears only in that first snapshot. Since this backend now HAS a
+*  `watch`, the watcher's periodic re-derivation no longer covers it, so a
+*  dropped first snapshot means stale bells and stale views until that record
+*  happens to change again. That is exactly the failure this step was supposed
+*  to remove.
+*
+*  Announcing every record individually is also wrong: it is a refresh storm
+*  to every open view, on every mount and every reconnect. `{ kind: "collection" }`
+*  says the same thing in one event — the watcher answers it with a full
+*  re-derivation plus a sweep, which is precisely "work out what changed while
+*  I was not listening".
+*
+*  A change this process made itself also arrives here — the write path has
+*  already published for it, so the record is reconciled twice. Harmless
+*  (reconciling is idempotent) and left alone: suppressing it would mean
+*  tracking our own in-flight writes, and getting that wrong loses a real
+*  change rather than a duplicate one. */
+function deliverSnapshot(run, ids, initial) {
+	if (run.stopped) return;
+	if (initial) {
+		run.onChange({ kind: "collection" });
+		return;
+	}
+	for (const itemId of ids) run.onChange({
+		kind: "item",
+		itemId
+	});
+}
+/** A listener died. Firestore never revives one on its own, so the choice is
+*  re-subscribe or go dark.
+*
+*  NO OVERALL RETRY WINDOW, unlike `hostRunner`'s listener. There, giving up
+*  escalates to a lifecycle owner that can re-authenticate; here there is
+*  nobody above to escalate to — the watcher registers a mounted collection
+*  once and never re-arms it, so "give up" means this collection serves stale
+*  data until the server restarts. A capped 30s re-subscribe is cheap and
+*  makes recovery automatic when the session comes back.
+*
+*  A FATAL error still stops: `permission-denied` is what a revoked membership
+*  looks like, and re-listening cannot restore a grant. It is logged as such
+*  rather than retried in silence. */
+function handleWatchError(run, error) {
+	if (run.stopped) return;
+	if (require_listen.classifyListenerError(error) === "fatal") {
+		log.warn("collections", "shared collection listener stopped", {
+			aid: run.key.aid,
+			cid: run.key.cid,
+			error: require_dist.isRecord(error) && typeof error.message === "string" ? error.message : String(error),
+			detail: "live updates for this collection are off until the server re-syncs; a revoked membership looks exactly like this"
+		});
+		return;
+	}
+	run.retryTimer = setTimeout(() => subscribeShared(run), require_listen.backoffDelayMs(run.attempt));
+	run.attempt += 1;
+}
+/** (Re-)arm the listener. The handle is fetched HERE rather than captured: a
+*  retry may land after the session was replaced, and listening through a
+*  closed session's handle would fail forever. */
+function subscribeShared(run) {
+	run.retryTimer = null;
+	if (run.stopped) return;
+	const handle = firestoreHandle();
+	if (handle === null) {
+		run.retryTimer = setTimeout(() => subscribeShared(run), require_listen.backoffDelayMs(run.attempt));
+		run.attempt += 1;
+		return;
+	}
+	run.detach = handle.docs.watch(sharedItemsPath(run.key), (ids, meta) => {
+		run.attempt = 0;
+		deliverSnapshot(run, ids, meta.initial);
+	}, (error) => handleWatchError(run, error));
+}
+/** Subscribe to a shared collection's records.
+*
+*  Returns `null` when there is no session: the watcher reads that as "has a
+*  watch but could not arm it", leaves the collection unmounted and retries on
+*  the next sync tick — which is the right channel for a connection that has
+*  not happened yet. Arming a dead listener instead would mark the slug mounted
+*  forever. */
+function armSharedWatch(key, onChange) {
+	if (firestoreHandle() === null) return null;
+	const run = {
+		key,
+		onChange,
+		stopped: false,
+		detach: () => {},
+		retryTimer: null,
+		attempt: 0
+	};
+	subscribeShared(run);
+	return () => {
+		run.stopped = true;
+		if (run.retryTimer !== null) clearTimeout(run.retryTimer);
+		run.detach();
+	};
+}
 /** The store factory registered for `storage.type === "firestore"`.
 *  Synchronous and connection-agnostic by contract — see the header. */
 function firestoreStoreFor(collection, opts) {
@@ -516,14 +680,15 @@ function firestoreStoreFor(collection, opts) {
 			nativeQuery: false,
 			nativePaging: false
 		},
-		list: async () => firestoreList(keyOf(collection)),
+		list: async () => firestoreList(keyOf(collection), primaryKey),
 		page: async (pageOpts = {}) => firestorePage(keyOf(collection), primaryKey, pageOpts),
-		read: async (itemId) => firestoreRead(keyOf(collection), itemId),
+		read: async (itemId) => firestoreRead(keyOf(collection), itemId, primaryKey),
 		write: async (itemId, item, writeOpts = {}) => firestoreWrite(keyOf(collection), itemId, item, {
 			...ioOpts,
 			refuseOverwrite: writeOpts.refuseOverwrite
 		}),
-		delete: async (itemId) => firestoreDelete(keyOf(collection), itemId, ioOpts)
+		delete: async (itemId) => firestoreDelete(keyOf(collection), itemId, ioOpts),
+		watch: async (onChange) => armSharedWatch(keyOf(collection), onChange)
 	};
 }
 //#endregion
@@ -591,7 +756,7 @@ function parseAppManifest(raw) {
 		kind: "malformed",
 		detail: "declares no `aid` string"
 	};
-	if (!require_calendarGrid.isValidCollectionName(aid)) return {
+	if (!require_itemId.isValidCollectionName(aid)) return {
 		ok: false,
 		kind: "malformed",
 		detail: `\`aid\` '${aid}' is not a valid app id`
@@ -813,11 +978,13 @@ async function deleteItem(dataDir, itemId, opts = {}) {
 		throw err;
 	}
 }
-/** Generate a short random hex id. Used by POST when the form doesn't
-*  carry a primary-key value (UI shortcut — Claude normally derives a
-*  semantic id from the record's name). */
+/** Generate a record id. Used by POST when the form doesn't carry a
+*  primary-key value (UI shortcut — Claude normally derives a semantic
+*  id from the record's name). Delegates to the isomorphic generator, so
+*  the id the UI pre-fills and the id a blank-id POST mints stay the
+*  same thing rather than two implementations that have to agree. */
 function generateItemId() {
-	return (0, node_crypto.randomBytes)(4).toString("hex");
+	return require_itemId.newItemId();
 }
 /** The item id a CREATE should use for `schema`, or null when the
 *  caller should generate one. A singleton collection pins every
@@ -1095,7 +1262,7 @@ function normalizeCsvValue(value) {
 function csvRowToItem(row, primaryKey) {
 	const normalized = Object.fromEntries(Object.entries(row).map(([key, value]) => [key, normalizeCsvValue(value)]));
 	const rawKey = normalized[primaryKey];
-	const keyText = require_calendarGrid.fieldTextOrNull(rawKey);
+	const keyText = require_itemId.fieldTextOrNull(rawKey);
 	if (keyText === null || keyText === "") return null;
 	return {
 		...normalized,
@@ -1703,8 +1870,8 @@ function sqliteStoreFor(collection, opts) {
 *  is filesystem-dependent; paging needs determinism. */
 function sortByRecordId(items, primaryKey) {
 	return [...items].sort((left, right) => {
-		const leftId = require_calendarGrid.fieldText(left[primaryKey]);
-		const rightId = require_calendarGrid.fieldText(right[primaryKey]);
+		const leftId = require_itemId.fieldText(left[primaryKey]);
+		const rightId = require_itemId.fieldText(right[primaryKey]);
 		if (leftId < rightId) return -1;
 		return leftId > rightId ? 1 : 0;
 	});
@@ -1714,7 +1881,7 @@ function sortByRecordId(items, primaryKey) {
 *  data file itself. Every write entry point checks this BEFORE calling
 *  `writeItem`/`deleteItem` — server-enforced, not just UI-hidden. */
 function collectionWritable(collection) {
-	return !require_calendarGrid.isReadOnlySchema(collection.schema);
+	return !require_itemId.isReadOnlySchema(collection.schema);
 }
 /** The one-line refusal write paths surface (HTTP 405 / MCP error text). */
 function readOnlyRefusal(slug) {
@@ -1782,7 +1949,7 @@ var storeFactories = /* @__PURE__ */ new Map([
 *  schema's `StorageZ` union gates it), so the throw is a loud invariant
 *  breach, not a user-facing path. */
 function storeFor(collection, opts = {}) {
-	const kind = require_calendarGrid.storageKindFor(collection.schema);
+	const kind = require_itemId.storageKindFor(collection.schema);
 	const factory = storeFactories.get(kind);
 	if (!factory) throw new Error(`no store factory registered for storage kind '${kind}'`);
 	return factory(collection, opts);
@@ -1825,7 +1992,7 @@ var CODE_FIELD_TYPES = /* @__PURE__ */ new Set([
 ]);
 var namesStoredField = (fields, name, primaryKey) => {
 	const target = declaredField(fields, name);
-	return target !== void 0 && !require_calendarGrid.COMPUTED_TYPES.has(target.type) && name !== primaryKey;
+	return target !== void 0 && !require_itemId.COMPUTED_TYPES.has(target.type) && name !== primaryKey;
 };
 var hasUniqueIds = (entries) => entries === void 0 || new Set(entries.map((entry) => entry.id)).size === entries.length;
 /** Exactly one storage declaration: native records need `dataPath`, an external
@@ -1884,7 +2051,7 @@ function collectionActionsAreNotMutate(schema) {
 *  otherwise the create form would lock the primary key to a value the POST
 *  route then rejects, making the collection impossible to initialize. */
 function singletonIsAValidRecordId(schema) {
-	return schema.singleton === void 0 || require_calendarGrid.isSafeRecordId(schema.singleton);
+	return schema.singleton === void 0 || require_itemId.isSafeRecordId(schema.singleton);
 }
 function collectCurrencyFieldRefs(fields) {
 	const refs = [];
@@ -1929,7 +2096,7 @@ function completionFlagReadsOnlyStoredFields(schema) {
 	if (spec?.type !== "flag") return true;
 	return spec.where.every((cond) => [cond.field, ...cond.valueFrom ? [cond.valueFrom.field] : []].every((name) => {
 		const target = declaredField(schema.fields, name);
-		return target !== void 0 && !require_calendarGrid.COMPUTED_TYPES.has(target.type);
+		return target !== void 0 && !require_itemId.COMPUTED_TYPES.has(target.type);
 	}));
 }
 /** `displayField`, like `completionField`, must name a real top-level field —
@@ -2077,7 +2244,7 @@ function fieldDrivenFromFieldCarried(schema) {
 	if (set && Object.prototype.hasOwnProperty.call(set, driven.fromField)) {
 		const raw = set[driven.fromField];
 		if (raw === void 0 || raw === null || raw === "") return false;
-		const key = require_calendarGrid.fieldTextOrNull(raw);
+		const key = require_itemId.fieldTextOrNull(raw);
 		return key !== null && Object.prototype.hasOwnProperty.call(driven.map, key);
 	}
 	return (carry ?? []).includes(driven.fromField);
@@ -2131,7 +2298,7 @@ function notifyWhenFieldIsDeclared(schema) {
 *  selector key (`custom:<id>`) and the capability-token clamp key, both of
 *  which expect a path-safe token. */
 function viewIdsAreSlugs(schema) {
-	return schema.views === void 0 || schema.views.every((view) => require_calendarGrid.isSafeSlug(view.id));
+	return schema.views === void 0 || schema.views.every((view) => require_itemId.isSafeSlug(view.id));
 }
 /** Custom view ids must be unique so the selector + token clamp resolve
 *  unambiguously. */
@@ -2231,7 +2398,7 @@ var RefFieldZ = zod.z.object({
 	type: zod.z.literal("ref"),
 	...fieldBase,
 	to: zod.z.string().min(1)
-}).refine((spec) => require_calendarGrid.isSafeSlug(spec.to), slugMessage("to"));
+}).refine((spec) => require_itemId.isSafeSlug(spec.to), slugMessage("to"));
 /** A money amount. See `currencyKeys` for the currency-source contract. */
 var MoneyFieldZ = zod.z.object({
 	type: zod.z.literal("money"),
@@ -2266,7 +2433,7 @@ var SubRefFieldZ = zod.z.object({
 	type: zod.z.literal("ref"),
 	...subFieldBase,
 	to: zod.z.string().min(1)
-}).refine((spec) => require_calendarGrid.isSafeSlug(spec.to), slugMessage("to"));
+}).refine((spec) => require_itemId.isSafeSlug(spec.to), slugMessage("to"));
 var SubMoneyFieldZ = zod.z.object({
 	type: zod.z.literal("money"),
 	...subFieldBase,
@@ -2329,7 +2496,7 @@ var EmbedFieldZ = zod.z.object({
 	to: zod.z.string().min(1),
 	id: zod.z.string().trim().min(1).optional(),
 	idField: zod.z.string().trim().min(1).optional()
-}).refine((spec) => require_calendarGrid.isSafeSlug(spec.to) && spec.id !== void 0 !== (spec.idField !== void 0), {
+}).refine((spec) => require_itemId.isSafeSlug(spec.to) && spec.id !== void 0 !== (spec.idField !== void 0), {
 	message: "fields with type 'embed' must declare a `to` (valid collection slug) and exactly one of `id` (a fixed record's primary key) or `idField` (a sibling field naming the per-record target)",
 	path: ["id"]
 });
@@ -2350,7 +2517,7 @@ var BacklinksFieldZ = zod.z.object({
 	via: zod.z.string().trim().min(1),
 	display: zod.z.array(zod.z.string().trim().min(1)).min(1),
 	filter: WhenZ.optional()
-}).refine((spec) => require_calendarGrid.isSafeSlug(spec.from), slugMessage("from"));
+}).refine((spec) => require_itemId.isSafeSlug(spec.from), slugMessage("from"));
 /** A cross-collection AGGREGATE over a backlink relation (plan step ⑤ of
 *  plans/done/collection-ontology.md): a computed number — never stored — that
 *  sums a source column (or counts rows) over the records in `from` whose
@@ -2371,7 +2538,7 @@ var RollupFieldZ = zod.z.object({
 	op: zod.z.enum(["sum", "count"]),
 	column: zod.z.string().trim().min(1).optional(),
 	filter: WhenZ.optional()
-}).refine((spec) => require_calendarGrid.isSafeSlug(spec.from), slugMessage("from")).refine((spec) => spec.op === "sum" === (spec.column !== void 0), {
+}).refine((spec) => require_itemId.isSafeSlug(spec.from), slugMessage("from")).refine((spec) => spec.op === "sum" === (spec.column !== void 0), {
 	message: "a rollup's `column` names the source column to aggregate: required for op \"sum\", meaningless for op \"count\"",
 	path: ["column"]
 });
@@ -2545,9 +2712,9 @@ var SpawnZ = zod.z.object({
 *  array) only when the response body isn't itself the array; rss/atom yield
 *  items natively and ignore it — so no kind-specific requirement here. */
 var DeclarativeIngestZ = zod.z.object({
-	kind: zod.z.enum(require_calendarGrid.INGEST_KINDS),
+	kind: zod.z.enum(require_itemId.INGEST_KINDS),
 	url: zod.z.url(),
-	schedule: zod.z.enum(require_calendarGrid.FEED_SCHEDULES),
+	schedule: zod.z.enum(require_itemId.FEED_SCHEDULES),
 	atHour: zod.z.number().int().min(0).max(23).optional(),
 	itemsAt: zod.z.string().trim().min(1).optional(),
 	map: zod.z.record(zod.z.string().trim().min(1), zod.z.string().trim().min(1)),
@@ -2561,8 +2728,8 @@ var DeclarativeIngestZ = zod.z.object({
 *  validated the SAME way an action's template is (safe path under
 *  `templates/`), so the skill-bridge mirrors it identically. */
 var AgentIngestZ = zod.z.object({
-	kind: zod.z.literal(require_calendarGrid.AGENT_INGEST_KIND),
-	schedule: zod.z.enum(require_calendarGrid.FEED_SCHEDULES),
+	kind: zod.z.literal(require_itemId.AGENT_INGEST_KIND),
+	schedule: zod.z.enum(require_itemId.FEED_SCHEDULES),
 	atHour: zod.z.number().int().min(0).max(23).optional(),
 	role: zod.z.string().trim().min(1),
 	template: zod.z.string().trim().min(1).refine(require_templatePath.isSafeActionTemplatePath, "must be a safe path under `templates/` (e.g. `templates/refresh.md`; no `..`, no leading `/`, no backslash)")
@@ -2975,6 +3142,10 @@ function acceptStorageSchema(storage, opts) {
 			storageFile
 		};
 	}
+	if (!hostSupportsSharedCollections()) return {
+		ok: false,
+		reason: "this host does not support shared collections — they live in a project repository, not a managed workspace"
+	};
 	const manifest = loadAppManifest(opts.workspaceRoot);
 	if (!manifest.ok) return {
 		ok: false,
@@ -3325,6 +3496,12 @@ Object.defineProperty(exports, "getWorkspaceRoot", {
 		return getWorkspaceRoot;
 	}
 });
+Object.defineProperty(exports, "hostSupportsSharedCollections", {
+	enumerable: true,
+	get: function() {
+		return hostSupportsSharedCollections;
+	}
+});
 Object.defineProperty(exports, "isBackendUnavailable", {
 	enumerable: true,
 	get: function() {
@@ -3499,6 +3676,12 @@ Object.defineProperty(exports, "setFirestoreAccessor", {
 		return setFirestoreAccessor;
 	}
 });
+Object.defineProperty(exports, "setSharedCollectionsSupport", {
+	enumerable: true,
+	get: function() {
+		return setSharedCollectionsSupport;
+	}
+});
 Object.defineProperty(exports, "sharedCollectionChangePayload", {
 	enumerable: true,
 	get: function() {
@@ -3548,4 +3731,4 @@ Object.defineProperty(exports, "writeItem", {
 	}
 });
 
-//# sourceMappingURL=discovery-Cw5xWzZD.cjs.map
+//# sourceMappingURL=discovery-BsXiDZBR.cjs.map