@mulmoclaude/core 3.6.0 → 3.7.0

package/dist/{server-9mFaGLdq.cjs → server-CWZyg8fn.cjs}

@@ -4,7 +4,7 @@ const require_root = require("./root-rPH6FGDT.cjs");
 const require_relPath = require("./relPath-CTAjGdCL.cjs");
 const require_calendarGrid = require("./calendarGrid-DGILaVxI.cjs");
 const require_promptSafety = require("./promptSafety-NNGViiCr.cjs");
-const require_discovery = require("./discovery-Cw5xWzZD.cjs");
+const require_store = require("./store-5_P_NsGa.cjs");
 const require_feeds_paths = require("./feeds/paths.cjs");
 const require_skill_bridge_index = require("./skill-bridge/index.cjs");
 let node_path = require("node:path");
@@ -12,6 +12,1045 @@ node_path = require_rolldown_runtime.__toESM(node_path, 1);
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 let zod = require("zod");
+let node_child_process = require("node:child_process");
+let node_util = require("node:util");
+//#region src/collection/server/publishManifest.ts
+/** A collection id / app id, held to the one name rule (`SAFE_SLUG_PATTERN`)
+*  that `sharedCollectionKey` applies. Stated once so a path built later
+*  cannot be a way around it. */
+var NameZ = zod.z.string().refine(require_calendarGrid.isValidCollectionName, { message: "is not a valid id (letters, digits, '-' and '_' only)" });
+/** An address on the roster. Not validated as an email beyond "has an @":
+*  the rules compare it to `request.auth.token.email` verbatim, so any
+*  narrowing here would refuse addresses Firebase itself accepts. */
+var EmailZ = zod.z.string().trim().min(3).includes("@");
+/** The four roles the deployed rules understand. `participant` is the layer
+*  that is NAMED but reads only its own rows — see `readerOf` vs `listedIn`. */
+var APP_ROLES = [
+	"owner",
+	"editor",
+	"viewer",
+	"participant"
+];
+var RoleZ = zod.z.enum(APP_ROLES);
+/** `{ email: { "*" | cid: role } }`. The `"*"` key is the app-wide role; a
+*  member may hold per-collection roles only (the stylist who is editor of
+*  bookings and viewer of everything else). */
+var MembersZ = zod.z.record(EmailZ, zod.z.record(zod.z.union([zod.z.literal("*"), NameZ]), RoleZ));
+/** The declarative mail queue, as the rules re-derive it: a transition of the
+*  status field, a recipient read off the RECORD, and a fixed template. */
+var MailZ = zod.z.object({
+	toField: zod.z.string().trim().min(1),
+	on: zod.z.record(zod.z.string().trim().min(1), zod.z.object({
+		from: zod.z.array(zod.z.string().trim().min(1)).min(1),
+		to: zod.z.string().trim().min(1)
+	}).strict()),
+	dataFields: zod.z.array(zod.z.string().trim().min(1)).optional()
+}).strict();
+/** What the rules read out of `collections[cid]`. NOT the schema — the schema
+*  is published beside it, untouched, for clients to render from. */
+var CollectionConfigZ = zod.z.object({
+	statusField: zod.z.string().trim().min(1).optional(),
+	/** `{ initial: [...], <status>: [<status>...] }`. Binds writers too, and
+	*  binds `create` — that is the point of publishing it. */
+	transitions: zod.z.record(zod.z.string().trim().min(1), zod.z.array(zod.z.string().trim().min(1))).optional(),
+	immutable: zod.z.boolean().optional(),
+	submitOnly: zod.z.boolean().optional(),
+	peerVisibility: zod.z.enum(["public", "hidden"]).optional(),
+	revealGated: zod.z.boolean().optional(),
+	gatedFrom: NameZ.optional(),
+	revealBy: zod.z.string().trim().min(1).optional(),
+	mail: MailZ.optional(),
+	/** Which fields an aggregate groups by. Declared here rather than in the
+	*  schema for the same reason as everything else in this file — the schema
+	*  has no `aggregate` key yet — and it is here at all because the
+	*  invariant that guards it ("every aggregation key is a CHECKED field")
+	*  is about `public.submit`, which is an app-level declaration. Published
+	*  as-is; the rules never read it. */
+	aggregate: zod.z.object({ by: zod.z.array(zod.z.string().trim().min(1)).min(1) }).strict().optional()
+}).strict();
+/** An authored submit window. ISO strings, because `app.json` is JSON and a
+*  Firestore `Timestamp` has no JSON form. Publish lowers it to epoch millis —
+*  the rules do not coerce strings, so an ISO string reaching Firestore is a
+*  type error that fails CLOSED (`inWindow` refuses every submission and the
+*  author sees "nobody can submit", not an error). */
+var WindowZ = zod.z.object({
+	from: zod.z.iso.datetime().optional(),
+	until: zod.z.iso.datetime().optional()
+}).strict();
+var ValidateZ = zod.z.object({
+	required: zod.z.array(zod.z.string().trim().min(1)).optional(),
+	/** Capped at two by the rules themselves: rules have no iteration, so
+	*  `keyFieldsOk` is unrolled. A third would be accepted here and silently
+	*  unchecked there. */
+	keyFields: zod.z.array(zod.z.object({
+		field: zod.z.string().trim().min(1),
+		values: zod.z.array(zod.z.union([
+			zod.z.string(),
+			zod.z.number(),
+			zod.z.boolean()
+		])).min(1)
+	}).strict()).optional()
+}).strict();
+var SubmitZ = zod.z.object({
+	auth: zod.z.enum([
+		"none",
+		"anonymous",
+		"verifiedEmail"
+	]),
+	emailField: zod.z.string().trim().min(1).optional(),
+	createFields: zod.z.array(zod.z.string().trim().min(1)).min(1),
+	initialStatus: zod.z.string().trim().min(1).optional(),
+	idFrom: zod.z.enum([
+		"auto",
+		"auth.uid",
+		"auth.uid+field"
+	]).optional(),
+	idField: zod.z.string().trim().min(1).optional(),
+	validate: ValidateZ.optional(),
+	window: WindowZ.optional(),
+	/** Per CURRENT STATUS, never a flat list: a flat list lets a customer move
+	*  an approved booking's `startAt` without anyone re-approving it. */
+	selfUpdate: zod.z.record(zod.z.string().trim().min(1), zod.z.array(zod.z.string().trim().min(1))).optional(),
+	selfTransitions: zod.z.record(zod.z.string().trim().min(1), zod.z.array(zod.z.string().trim().min(1))).optional(),
+	finalize: zod.z.boolean().optional(),
+	audience: zod.z.literal("participant").optional(),
+	gateOn: zod.z.object({
+		phase: zod.z.string().trim().min(1),
+		match: zod.z.string().trim().min(1)
+	}).strict().optional()
+}).strict();
+var PublicZ = zod.z.object({
+	/** The master switch. Anonymous submission (`auth: "none"`) needs it as
+	*  well as its own declaration. */
+	enabled: zod.z.boolean().optional(),
+	read: zod.z.array(NameZ).optional(),
+	submit: zod.z.record(NameZ, SubmitZ).optional()
+}).strict();
+/** The whole authored declaration.
+*
+*  `owner` is accepted but is NOT the published value — publish stamps the
+*  publisher's uid (or carries the existing one forward, which is what the
+*  rules require on update) and refuses a declaration that disagrees. It is
+*  accepted rather than banned because the sample app.json in the design note
+*  shows it, and a hard refusal on a key the samples contain would be a worse
+*  first experience than a message naming the mismatch. */
+var AuthoredAppZ = zod.z.object({
+	aid: NameZ,
+	name: zod.z.string().trim().min(1).optional(),
+	/** Per-worktree app id (design D6, implementation order 7). Accepted so a
+	*  repository already carrying it parses; nothing reads it yet. */
+	aidEnv: zod.z.string().trim().min(1).optional(),
+	owner: zod.z.string().trim().min(1).optional(),
+	members: MembersZ,
+	collections: zod.z.record(NameZ, CollectionConfigZ).optional(),
+	participantRead: zod.z.array(NameZ).optional(),
+	public: PublicZ.optional()
+}).strict();
+/** Parse the authored declaration out of `app.json`'s text.
+*
+*  Returns a LIST of problems rather than throwing, for the same reason
+*  `loadAppManifest` returns a failure: the caller is a gate whose entire job
+*  is to hand the author something to act on. Every problem is reported at
+*  once — publish is a manual step, and a parser that stops at the first key
+*  makes it N round trips. */
+function parseAuthoredApp(raw) {
+	const manifest = require_store.parseAppManifest(raw);
+	if (!manifest.ok) return {
+		ok: false,
+		problems: [manifest.kind === "missing" ? "app.json is missing" : manifest.detail]
+	};
+	const parsed = AuthoredAppZ.safeParse(JSON.parse(raw));
+	if (!parsed.success) return {
+		ok: false,
+		problems: authoredProblems(parsed.error)
+	};
+	return {
+		ok: true,
+		app: parsed.data
+	};
+}
+/** zod issues as one actionable line each: `public.submit.responses.auth: …`. */
+function authoredProblems(error) {
+	return error.issues.map((issue) => {
+		return `${issue.path.length > 0 ? issue.path.join(".") : "app.json"}: ${issue.message}`;
+	});
+}
+//#endregion
+//#region src/collection/server/publishProject.ts
+/** The document id under `apps/{aid}/config`. One document, named, rather than
+*  a spread of them: a second public document is a second thing to keep in
+*  step, and nothing yet needs one. */
+var PUBLIC_CONFIG_DOC = "public";
+/** Drop keys whose value is `undefined`. Firestore rejects an undefined field
+*  value outright, and `"k" in c` — which every optional key in the rules is
+*  read through — must mean "the author declared it". */
+function compact(entries) {
+	return Object.fromEntries(Object.entries(entries).filter(([, value]) => value !== void 0));
+}
+/** ISO → epoch millis, the one conversion the rules cannot do for themselves.
+*  The caller has already refused an unparseable string (the authored parser
+*  requires `z.iso.datetime()`), so a NaN here would be a programming error;
+*  it is still checked, because a NaN written to Firestore fails closed in the
+*  same silent way an ISO string does. */
+function windowMillis(window) {
+	if (!window) return void 0;
+	const out = {};
+	if (window.from !== void 0) out.fromMs = Date.parse(window.from);
+	if (window.until !== void 0) out.untilMs = Date.parse(window.until);
+	if (Object.values(out).some((value) => !Number.isFinite(value))) throw new Error(`publish: window bound is not a parseable timestamp (${JSON.stringify(window)})`);
+	return Object.keys(out).length > 0 ? out : void 0;
+}
+/** One `public.submit[cid]`, with its window lowered. Everything else passes
+*  through: the rules read these keys by the names the author wrote. */
+function projectSubmit(submit) {
+	const { window, ...rest } = submit;
+	return compact({
+		...rest,
+		window: windowMillis(window)
+	});
+}
+/** The roster's addresses as a set, in a stable order.
+*
+*  Sorted so two publishes of the same declaration produce the same document
+*  — idempotence is a property this step is tested for, and Firestore compares
+*  arrays by ORDER. `membersConsistent()` compares as sets and would accept
+*  any order; the test that would notice is the one asserting a second publish
+*  changes nothing but `publishedAt`. */
+function memberEmailsOf(members) {
+	return Object.keys(members).sort();
+}
+/** The previous document, kept for rollback, with its OWN `previousPublished`
+*  stripped.
+*
+*  One level, deliberately. Chaining would make every publish carry the entire
+*  history of the app inside a single document, which grows without bound and
+*  meets Firestore's 1 MiB document limit as a permission-shaped failure at
+*  some unpredictable publish. One level answers the question rollback
+*  actually asks — "put back what was there before I broke it" — and the
+*  further history is in git, which is where the declaration came from. */
+function previousOf(existing) {
+	if (!existing) return void 0;
+	const { previousPublished: __dropped, ...rest } = existing;
+	return rest;
+}
+/** Project the authored declaration into the documents publish writes.
+*
+*  `existing` is the app document as it is in Firestore right now, or null on
+*  a first publish. Two things need it, both required by the rules:
+*    - `owner` must be UNCHANGED on update. Re-stamping the publisher's uid
+*      would be refused for any app whose owner ever signed in as a different
+*      account, and would silently transfer ownership if it were not.
+*    - `previousPublished` is that document, so a rollback has something to
+*      put back.
+*
+*  Pure: no clock, no filesystem, no Firestore. Everything variable arrives as
+*  a parameter, which is what makes the conversion table testable as a table. */
+function projectApp(authored, schemas, stamp, existing) {
+	const owner = typeof existing?.owner === "string" ? existing.owner : stamp.uid;
+	const submit = Object.fromEntries(Object.entries(authored.public?.submit ?? {}).map(([cid, spec]) => [cid, projectSubmit(spec)]));
+	const publicBlock = authored.public ? compact({
+		enabled: authored.public.enabled,
+		read: authored.public.read,
+		submit: Object.keys(submit).length > 0 ? submit : void 0
+	}) : void 0;
+	const app = compact({
+		aid: authored.aid,
+		name: authored.name,
+		owner,
+		members: authored.members,
+		memberEmails: memberEmailsOf(authored.members),
+		collections: authored.collections,
+		participantRead: authored.participantRead,
+		public: publicBlock,
+		publishedAt: stamp.publishedAt,
+		publishedBy: stamp.email,
+		publishedCommit: stamp.commit,
+		previousPublished: previousOf(existing)
+	});
+	const config = {
+		enabled: authored.public?.enabled === true,
+		read: authored.public?.read ?? [],
+		submit,
+		publishedAt: stamp.publishedAt
+	};
+	if (authored.name !== void 0) config.name = authored.name;
+	return {
+		app,
+		schemas: schemas.map(({ cid, schema }) => ({
+			cid,
+			doc: schemaDoc(schema, stamp)
+		})),
+		config
+	};
+}
+/** One published schema document. Written key by key rather than through
+*  `compact`, so the declared type is the type — an optional commit is the
+*  only variable part. */
+function schemaDoc(schema, stamp) {
+	const doc = {
+		publishedSchema: schema,
+		publishedAt: stamp.publishedAt,
+		publishedBy: stamp.email
+	};
+	if (stamp.commit !== void 0) doc.publishedCommit = stamp.commit;
+	return doc;
+}
+/** The app documents' parent path — the `FirestoreDocs` seam takes a
+*  collection path plus a document id, and the app document's id is the aid. */
+var APPS_COLLECTION = "apps";
+/** The collection (schema) documents' parent path. */
+var appSchemasPath = (aid) => `apps/${aid}/collections`;
+/** The public-config documents' parent path. */
+var appConfigPath = (aid) => `apps/${aid}/config`;
+//#endregion
+//#region src/collection/server/publishChecks.ts
+/** Does this submit declaration bind a record to the submitter's identity?
+*
+*  The condition for requiring `submitOnly`, and deliberately NOT "declares an
+*  `audience`": `audience` appears only in the rules' public-create branch, so
+*  an owner or editor never meets it and can add records freely. `immutable`
+*  is the wrong condition too — a survey's responses are not immutable and
+*  can be padded exactly the same way.
+*
+*  What these four have in common is that each one makes the record MEAN "the
+*  person who submitted it said this": a per-uid id, a per-uid+field id, a
+*  row stamped with the submitter's verified address, or a submission
+*  restricted to a named participant. A record created through the writer
+*  branch carries the same shape and none of that meaning. */
+function bindsSubmitterIdentity(submit) {
+	return submit.idFrom === "auth.uid" || submit.idFrom === "auth.uid+field" || submit.emailField !== void 0 || submit.audience === "participant";
+}
+/** The fields a rule actually CHECKS the value of, for one collection.
+*
+*  `keyFields` pins a value against a declared set, `gateOn.match` pins it
+*  against the session's current question, and the status field is pinned by
+*  the transition machine. An aggregation grouped by anything else is grouped
+*  by a field any submitter may write anything into — so the published
+*  aggregate is whatever the noisiest respondent decided it should be. */
+function checkedFields(collection, submit) {
+	const fields = /* @__PURE__ */ new Set();
+	for (const keyField of submit?.validate?.keyFields ?? []) fields.add(keyField.field);
+	if (submit?.gateOn) fields.add(submit.gateOn.match);
+	if (collection?.statusField) fields.add(collection.statusField);
+	return fields;
+}
+/** INVARIANT 1 — a submission bound to its submitter needs `submitOnly`. */
+function submitOnlyProblems(app) {
+	const problems = [];
+	for (const [cid, submit] of Object.entries(app.public?.submit ?? {})) {
+		if (!bindsSubmitterIdentity(submit)) continue;
+		if (app.collections?.[cid]?.submitOnly === true) continue;
+		problems.push(`collections.${cid}.submitOnly must be true: public.submit.${cid} binds each record to its submitter (${identityBindings(submit).join(", ")}), so a record created any other way would carry that meaning without having earned it. Without submitOnly the rules let an owner or editor write rows directly into ${cid}.`);
+	}
+	return problems;
+}
+function identityBindings(submit) {
+	const bindings = [];
+	if (submit.idFrom === "auth.uid" || submit.idFrom === "auth.uid+field") bindings.push(`idFrom: "${submit.idFrom}"`);
+	if (submit.emailField !== void 0) bindings.push(`emailField: "${submit.emailField}"`);
+	if (submit.audience === "participant") bindings.push(`audience: "participant"`);
+	return bindings;
+}
+/** INVARIANT 2 — every aggregation key is a field some rule checks. */
+function aggregateProblems(app) {
+	const problems = [];
+	for (const [cid, collection] of Object.entries(app.collections ?? {})) {
+		const keys = collection.aggregate?.by;
+		if (!keys) continue;
+		const checked = checkedFields(collection, app.public?.submit?.[cid]);
+		const loose = keys.filter((field) => !checked.has(field));
+		const spelled = loose.map((field) => `'${field}'`).join(", ");
+		if (loose.length > 0) problems.push(`collections.${cid}.aggregate.by names ${spelled}, which no rule checks the value of. An aggregation key must appear in public.submit.${cid}.validate.keyFields, in gateOn.match, or be the statusField — otherwise a submitter chooses their own bucket and the published aggregate is not a count of anything.`);
+	}
+	return problems;
+}
+/** INVARIANT 3 — `auth: "verifiedEmail"` only.
+*
+*  A product decision, not a rules limitation: the rules keep all three stages
+*  and the emulator tests keep exercising them, because deleting a stage from
+*  the rules turns a change of mind into a cross-repo deploy. Publish is where
+*  the current decision is expressed, and it is one line to move. */
+function authProblems(app) {
+	return Object.entries(app.public?.submit ?? {}).filter(([, submit]) => submit.auth !== "verifiedEmail").map(([cid, submit]) => `public.submit.${cid}.auth is "${submit.auth}": only "verifiedEmail" may be published. The rules still implement "none" and "anonymous" — this is a product decision, and lifting it is a change here, not a rules deploy.`);
+}
+/** INVARIANT 5 — a mail transition's origins and destination must be disjoint.
+*
+*  Overlap means the same write can satisfy the same template twice over, and
+*  the deterministic mail id is the only other thing stopping a duplicate
+*  send. The rules also require the status to have CHANGED, so an overlapping
+*  declaration is not merely redundant: `from` containing `to` is a transition
+*  that can never fire, which is a mail nobody ever receives. */
+function mailProblems(app) {
+	return Object.entries(app.collections ?? {}).flatMap(([cid, collection]) => collectionMailProblems(cid, collection));
+}
+function collectionMailProblems(cid, collection) {
+	const { mail } = collection;
+	if (!mail) return [];
+	const problems = [];
+	if (!collection.statusField) problems.push(`collections.${cid}.mail needs collections.${cid}.statusField: the rules read the status before and after the write to decide the mail is warranted.`);
+	for (const [template, transition] of Object.entries(mail.on)) problems.push(...templateMailProblems(cid, collection, template, transition));
+	return problems;
+}
+function templateMailProblems(cid, collection, template, transition) {
+	const problems = [];
+	if (transition.from.includes(transition.to)) problems.push(`collections.${cid}.mail.on.${template} lists "${transition.to}" in both \`from\` and \`to\`. The rules require the status to CHANGE in the same write, so this template can never send.`);
+	const allowed = collection.transitions;
+	if (allowed) {
+		const unreachable = transition.from.filter((from) => !(allowed[from] ?? []).includes(transition.to));
+		const spelled = unreachable.map((from) => `'${from}' -> '${transition.to}'`).join(", ");
+		if (unreachable.length > 0) problems.push(`collections.${cid}.mail.on.${template} sends on ${spelled}, which collections.${cid}.transitions does not allow. The record write is refused first, so the mail never fires.`);
+	}
+	return problems;
+}
+/** INVARIANTS 6 and 7 — the window is a real interval, and `keyFields` fits
+*  the unrolled check in the rules. */
+function submitShapeProblems(app) {
+	return Object.entries(app.public?.submit ?? {}).flatMap(([cid, submit]) => [...windowProblems(cid, submit), ...keyFieldCountProblems(cid, submit)]);
+}
+function windowProblems(cid, submit) {
+	const { window } = submit;
+	if (window?.from === void 0 || window.until === void 0) return [];
+	if (Date.parse(window.until) > Date.parse(window.from)) return [];
+	return [`public.submit.${cid}.window closes at or before it opens (${window.from} -> ${window.until}): nothing could ever be submitted.`];
+}
+function keyFieldCountProblems(cid, submit) {
+	const keyFields = submit.validate?.keyFields ?? [];
+	if (keyFields.length <= 2) return [];
+	return [`public.submit.${cid}.validate.keyFields declares ${keyFields.length}; the rules check at most 2. Rules have no iteration, so the check is unrolled — a third would be published and never enforced.`];
+}
+/** The fail-closed traps: declarations the rules read together, where the
+*  missing half denies every write instead of loosening one. */
+function coherenceProblems(app) {
+	const fromSubmits = Object.entries(app.public?.submit ?? {}).flatMap(([cid, submit]) => submitCoherenceProblems(app, cid, submit));
+	const fromCollections = Object.entries(app.collections ?? {}).flatMap(([cid, collection]) => gateCoherenceProblems(cid, collection));
+	return [...fromSubmits, ...fromCollections];
+}
+/** `initialStatus` is read together with the collection's `statusField` and
+*  with `createFields`; miss either and every submission is refused. */
+function statusCoherenceProblems(cid, submit, collection) {
+	if (submit.initialStatus === void 0) return [];
+	if (!collection?.statusField) return [`public.submit.${cid}.initialStatus needs collections.${cid}.statusField: the rules look the status up by that name, and refuse every submission without it.`];
+	if (new Set(submit.createFields).has(collection.statusField)) return [];
+	return [`public.submit.${cid}.createFields must include "${collection.statusField}": a submission may carry ONLY the createFields, and the rules also require the status field to be present and equal to initialStatus. As written, every submission is refused.`];
+}
+/** Every field a RULE reads off a submitted record, other than the status
+*  field (which `statusCoherenceProblems` words for itself).
+*
+*  `emailField` and `idField` belong here for exactly the reason `required`
+*  and `keyFields` do, and forgetting them was the same oversight twice: the
+*  rules read `request.resource.data[s.emailField]` and rebuild the document
+*  id from `s.idField`, while `hasOnly(createFields)` decides what a
+*  submission may carry at all. A field in one list and not the other is a
+*  contradiction the submitter cannot resolve — including it is refused,
+*  omitting it fails the check. */
+function ruleReadFields(submit) {
+	const fields = [];
+	if (submit.emailField !== void 0) fields.push({
+		field: submit.emailField,
+		why: `public.submit.<cid>.emailField — the rules compare it to the submitter's verified address`
+	});
+	if (submit.idFrom === "auth.uid+field" && submit.idField !== void 0) fields.push({
+		field: submit.idField,
+		why: `public.submit.<cid>.idField — the rules rebuild the document id from it`
+	});
+	return fields;
+}
+/** A checked field a submission is not allowed to carry can never be
+*  satisfied: carrying it fails `hasOnly`, omitting it fails the check. */
+function createFieldProblems(cid, submit) {
+	const createFields = new Set(submit.createFields);
+	const ruleRead = ruleReadFields(submit).filter((entry) => !createFields.has(entry.field)).map((entry) => `public.submit.${cid}.createFields must include "${entry.field}" (${entry.why.replace("<cid>", cid)}): a submission may carry only the createFields, so as written every submission is refused whether or not it carries the field.`);
+	const required = (submit.validate?.required ?? []).filter((field) => !createFields.has(field)).map((field) => `public.submit.${cid}.validate.required names "${field}", which is not in createFields: a submission may carry only the createFields, so the requirement can never be met.`);
+	const keyFields = (submit.validate?.keyFields ?? []).filter((keyField) => !createFields.has(keyField.field)).map((keyField) => `public.submit.${cid}.validate.keyFields checks "${keyField.field}", which is not in createFields: a submission carrying it is refused, and one omitting it fails the check.`);
+	return [
+		...ruleRead,
+		...required,
+		...keyFields
+	];
+}
+function submitCoherenceProblems(app, cid, submit) {
+	const collection = app.collections?.[cid];
+	const problems = [...statusCoherenceProblems(cid, submit, collection), ...createFieldProblems(cid, submit)];
+	if (submit.idFrom === "auth.uid+field" && submit.idField === void 0) problems.push(`public.submit.${cid}.idFrom is "auth.uid+field" but no idField is declared: the rules rebuild the document id from that field and refuse every create.`);
+	if ((submit.selfUpdate !== void 0 || submit.selfTransitions !== void 0) && !collection?.statusField) problems.push(`public.submit.${cid}.selfUpdate / selfTransitions are declared per CURRENT STATUS, but collections.${cid} declares no statusField: the rules read the current status first and refuse every self-edit without it.`);
+	if (submit.audience === "participant" && Object.keys(app.members).length === 0) problems.push(`public.submit.${cid}.audience is "participant" but the roster is empty: the rules resolve the submitter's role from members, so every submission is refused.`);
+	return problems;
+}
+/** The staged reveal reads its flag off the PARENT record, so the path to that
+*  parent is not optional decoration — without it the gate never opens. */
+function gateCoherenceProblems(cid, collection) {
+	if (collection.revealGated !== true) return [];
+	if (collection.gatedFrom !== void 0 && collection.revealBy !== void 0) return [];
+	return [`collections.${cid}.revealGated needs both gatedFrom and revealBy: the flag is read off the PARENT record, and without the path the gate never opens.`];
+}
+/** The publisher must be able to write what they are about to write.
+*
+*  On a first publish the rules require the creator to name themselves owner,
+*  in the roster, under `'*'`. Getting this wrong produces a bare permission
+*  error from Firestore with nothing in it about rosters — worth one line
+*  here instead. */
+function publisherProblems(app, publisherEmail) {
+	if (app.members[publisherEmail]?.["*"] === "owner") return [];
+	return [`members must give you app-wide owner: add "${publisherEmail}": { "*": "owner" }. The rules require the publisher to hold that role (and to name themselves owner when the app is first created); otherwise the write is refused with no explanation.`];
+}
+/** Every cid the declaration mentions must be a collection that exists.
+*
+*  A typo'd cid is not an error anywhere else: the app document simply carries
+*  a configuration for a collection nobody publishes, and the collection the
+*  author meant is published with no configuration at all — i.e. with the
+*  status machine and the submit path silently absent. */
+function unknownCidProblems(app, collections) {
+	const known = new Set(collections.map((collection) => collection.cid));
+	return [
+		["collections", Object.keys(app.collections ?? {})],
+		["public.read", app.public?.read ?? []],
+		["public.submit", Object.keys(app.public?.submit ?? {})],
+		["participantRead", app.participantRead ?? []]
+	].flatMap(([where, cids]) => cids.filter((cid) => !known.has(cid)).map((cid) => `${where} names '${cid}', which is not a shared collection in this repository. Shared collections here: ${known.size > 0 ? [...known].sort().join(", ") : "(none - a schema needs storage.type \"firestore\")"}.`));
+}
+/** Everything publish refuses, as lines the author can act on.
+*
+*  All of them, every time. Publish is a manual step with a human waiting on
+*  it; stopping at the first problem turns one review into five. */
+function publishProblems(app, collections, publisherEmail) {
+	return [
+		...unknownCidProblems(app, collections),
+		...publisherProblems(app, publisherEmail),
+		...submitOnlyProblems(app),
+		...aggregateProblems(app),
+		...authProblems(app),
+		...mailProblems(app),
+		...submitShapeProblems(app),
+		...coherenceProblems(app),
+		...primaryKeyProblems(app, collections)
+	];
+}
+/** A public submission must be able to produce a record the HOST can read.
+*
+*  The rules and the engine disagree about what identifies a record, and the
+*  gap is invisible from either side alone. The rules bind the DOCUMENT ID
+*  (`idFrom`) and let a submission carry only `createFields`; the engine
+*  identifies a record by its schema's `primaryKey` FIELD, and the firestore
+*  store hands back the document's fields verbatim — `toItem` does not
+*  synthesize the key from the document id. So a submit path whose
+*  `createFields` omits the primary key writes rows that Firestore accepts and
+*  every reader rejects: `validateRecordObject` fails them, the collection
+*  renders empty-ish, and the next publish's own pre-check reports them as
+*  broken records the publisher never wrote.
+*
+*  Not checkable by the rules (they have never heard of a schema) and not
+*  catchable at write time (nothing is wrong with the write). Publish is the
+*  only place that holds both halves. */
+function primaryKeyProblems(app, collections) {
+	const primaryKeyOf = new Map(collections.map((collection) => [collection.cid, collection.primaryKey]));
+	return Object.entries(app.public?.submit ?? {}).flatMap(([cid, submit]) => {
+		const primaryKey = primaryKeyOf.get(cid);
+		if (primaryKey === void 0 || submit.createFields.includes(primaryKey)) return [];
+		return [`public.submit.${cid}.createFields must include "${primaryKey}", the schema's primaryKey: a submission may carry only the createFields, and a shared record is stored as exactly the fields it was written with — the document id is not copied into the record. Without it every submission is accepted by the rules and then rejected by every reader.`];
+	});
+}
+//#endregion
+//#region src/collection/core/recordZ.ts
+/** The emptiness rule shared by `required` and the "only check present
+*  values" gate. NOT a truthiness check — `0` and `false` are filled. */
+var isEmptyValue = (value) => value === void 0 || value === null || value === "";
+/** The historical write-gate checks, verbatim: required non-empty, enum
+*  membership (compared as strings, so a numeric `5` satisfies `"5"`). */
+function enforcedProblem(key, spec, value) {
+	const empty = isEmptyValue(value);
+	if (spec.required && empty) return `missing required field '${key}'`;
+	if (!empty && spec.type === "enum" && !spec.values.includes(String(value))) return `'${key}' = '${String(value)}' is not one of [${spec.values.join(", ")}]`;
+	return null;
+}
+/** Report-only per-type checks on a PRESENT value. Date / datetime reuse the
+*  calendar's STRICT civil parsers (`parseIsoDate` / `parseIsoDateTime`), so
+*  the lint flags exactly the values the calendar / trigger / spawn code
+*  would silently drop — impossible days like `2026-02-30`, and datetimes
+*  outside the canonical `YYYY-MM-DDTHH:MM[:SS]` shape (e.g. a `Z` suffix,
+*  which the day view can't place). `string`-backed types accept anything
+*  stringifiable; `ref` existence is out of scope. */
+function strictTypeProblem(key, spec, value) {
+	switch (spec.type) {
+		case "number":
+		case "money": return Number.isFinite(require_promptSafety.coerceNumeric(value)) ? null : `'${key}' = '${String(value)}' is not numeric (a '${spec.type}' field stores a plain number)`;
+		case "boolean": return value === true || value === false ? null : `'${key}' = '${String(value)}' is not a boolean (store true or false, unquoted)`;
+		case "date": return require_calendarGrid.parseIsoDate(value) !== null ? null : `'${key}' = '${String(value)}' is not a real YYYY-MM-DD date`;
+		case "datetime": return require_calendarGrid.parseIsoDateTime(value) !== null ? null : `'${key}' = '${String(value)}' is not a YYYY-MM-DDTHH:MM datetime (seconds optional, no timezone suffix — the shape the calendar parses)`;
+		default: return null;
+	}
+}
+/** Strict check for a PRESENT `table` value: an array of row objects, each
+*  row conforming to the sub-schema (required / enum / typed sub-values).
+*  First row problem wins, prefixed with the row number so the fix is
+*  locatable. */
+function strictTableProblem(key, spec, value) {
+	if (!Array.isArray(value)) return `'${key}' = '${String(value)}' is not an array of rows (a 'table' field stores an array of row objects)`;
+	for (let index = 0; index < value.length; index++) {
+		const row = value[index];
+		if (!require_dist.isRecord(row)) return `'${key}' row ${index + 1} is not an object`;
+		for (const [subKey, subSpec] of Object.entries(spec.of)) {
+			const subValue = row[subKey];
+			const problem = enforcedProblem(subKey, subSpec, subValue) ?? (isEmptyValue(subValue) ? null : strictTypeProblem(subKey, subSpec, subValue));
+			if (problem) return `'${key}' row ${index + 1}: ${problem}`;
+		}
+	}
+	return null;
+}
+/** First problem for one field's stored value under `tier`, or null.
+*  Enforced checks always run (and their messages never vary by tier — the
+*  scan and the write gate must agree on them); strict adds the per-type
+*  layer on present values only. */
+function recordFieldProblem(key, spec, value, tier) {
+	const enforced = enforcedProblem(key, spec, value);
+	if (enforced || tier === "enforced") return enforced;
+	if (isEmptyValue(value)) return null;
+	if (spec.type === "table") return strictTableProblem(key, spec, value);
+	return strictTypeProblem(key, spec, value);
+}
+var compiled = /* @__PURE__ */ new WeakMap();
+/** Compile `schema.fields` into a zod validator for a stored record.
+*  Loose object: unknown keys are allowed and any declared key may be
+*  absent (records are user files, not parse-and-rewrite targets —
+*  callers validate, they never persist the parse output). The checks run
+*  as ONE object-level refine iterating fields in declaration order —
+*  per-key shape schemas can't express "key may be absent BUT its absence
+*  must still reach the required check", and the single loop keeps the
+*  first reported issue identical to the historical first-problem-wins
+*  contract. */
+function compileRecordZ(schema, tier) {
+	const cached = compiled.get(schema)?.[tier];
+	if (cached) return cached;
+	const stored = Object.entries(schema.fields).filter(([, spec]) => !require_calendarGrid.COMPUTED_TYPES.has(spec.type));
+	const validator = zod.z.looseObject({}).superRefine((record, ctx) => {
+		for (const [key, spec] of stored) {
+			const problem = recordFieldProblem(key, spec, record[key], tier);
+			if (problem) ctx.addIssue({
+				code: "custom",
+				message: problem,
+				path: [key]
+			});
+		}
+	});
+	const entry = compiled.get(schema) ?? {};
+	entry[tier] = validator;
+	compiled.set(schema, entry);
+	return validator;
+}
+/** First schema problem on an in-memory record under `tier`, or null. One
+*  issue per record keeps the report short and the fix obvious (the
+*  historical contract of `validateRecordObject`). */
+function firstRecordProblem(record, schema, tier) {
+	const result = compileRecordZ(schema, tier).safeParse(record);
+	if (result.success) return null;
+	return result.error.issues[0]?.message ?? "record failed schema validation";
+}
+//#endregion
+//#region src/collection/server/validate.ts
+/** Don't flood the result; the first batch is enough to act on. Exported
+*  because a caller that REPORTS a count has to know the count is a floor —
+*  `publish` presents a full batch as "at least N" rather than as a total. */
+var MAX_RECORD_ISSUES = 25;
+/** The `file` of the pseudo-issue reported when the backend could not be read
+*  at all.
+*
+*  Exported because it is a DIFFERENT KIND of answer from "this record is
+*  invalid", and a caller that treats the two alike gets it wrong in the
+*  direction that matters: `publish` lets the user override invalid records,
+*  and overriding this one would mean publishing without ever having looked. */
+var STORE_UNREADABLE = "(store)";
+var MAX_ISSUES = 25;
+/** Read every `<id>.json` under the collection's dataDir and report the
+*  ones that won't load or violate the schema. An empty list means every
+*  record is fine. */
+/** List entries under the data dir, guarding realpath containment (against a
+*  symlinked dir swapped in after discovery, like `listItems`) and treating a
+*  missing dir as empty while surfacing real I/O faults. */
+async function listRecordFilenames(dataDir, workspaceRoot) {
+	if (!require_store.isContainedInRoot(dataDir, workspaceRoot)) {
+		require_store.log.warn("collections", "validate refused: dataDir escapes workspace via symlink", { dataDir });
+		return [];
+	}
+	try {
+		return await (0, node_fs_promises.readdir)(dataDir);
+	} catch (err) {
+		if (require_dist.isErrorWithCode(err) && err.code === "ENOENT") return [];
+		throw err;
+	}
+}
+async function validateCollectionRecords(collection, opts = {}) {
+	if (collection.schema.dataSource !== void 0) return [];
+	if (collection.schema.storage !== void 0) return validateStoreRecords(collection, opts);
+	const workspaceRoot = opts.workspaceRoot ?? require_store.getWorkspaceRoot();
+	const entries = await listRecordFilenames(collection.dataDir, workspaceRoot);
+	const issues = [];
+	for (const name of entries.sort()) {
+		if (!name.endsWith(".json") || name.startsWith(".")) continue;
+		if (issues.length >= MAX_ISSUES) break;
+		const issue = await inspectRecord(node_path.default.join(collection.dataDir, name), name, collection.schema);
+		if (issue) issues.push(issue);
+	}
+	return issues;
+}
+/** Store-backed twin of the file scan: list every record through the
+*  collection's store and lint it with the same "strict" report-only tier.
+*  A row the store can't even parse is invisible here (the store skips
+*  it), so the read/parse classifications of the file scan don't apply —
+*  schema violations are what this catches. `file` carries the record id
+*  (there is no per-record filename). */
+async function validateStoreRecords(collection, opts) {
+	let items;
+	try {
+		items = await require_store.storeFor(collection, { workspaceRoot: opts.workspaceRoot }).list();
+	} catch (err) {
+		return [{
+			file: STORE_UNREADABLE,
+			problem: `records could not be read from the storage backend: ${err instanceof Error ? err.message : String(err)}`
+		}];
+	}
+	const issues = [];
+	for (const item of items) {
+		if (issues.length >= MAX_ISSUES) break;
+		const itemId = require_calendarGrid.fieldText(item[collection.schema.primaryKey]);
+		const problem = validateRecordObject(item, itemId, collection.schema, "strict");
+		if (problem) issues.push({
+			file: itemId,
+			problem
+		});
+	}
+	return issues;
+}
+async function readRecordText(fullPath, name) {
+	try {
+		if (!(await (0, node_fs_promises.lstat)(fullPath)).isFile()) return {
+			file: name,
+			problem: "not a regular file (symlink?) — skipped, won't appear"
+		};
+		return { raw: await (0, node_fs_promises.readFile)(fullPath, "utf-8") };
+	} catch {
+		return {
+			file: name,
+			problem: "could not be read — skipped, won't appear"
+		};
+	}
+}
+/** Classify a single record file: unreadable / unparseable / non-object /
+*  schema violation, or null when it's fine. */
+async function inspectRecord(fullPath, name, schema) {
+	const read = await readRecordText(fullPath, name);
+	if ("problem" in read) return read;
+	let parsed;
+	try {
+		parsed = JSON.parse(read.raw);
+	} catch (err) {
+		return {
+			file: name,
+			problem: `invalid JSON (${err instanceof Error ? err.message : String(err)}) — SKIPPED, won't appear. Usual cause: an unescaped " inside a string value; use 「」/『』 or write \\" instead.`
+		};
+	}
+	if (!require_dist.isRecord(parsed)) return {
+		file: name,
+		problem: "not a JSON object — skipped, won't appear"
+	};
+	const problem = validateRecordObject(parsed, name.replace(/\.json$/, ""), schema, "strict");
+	return problem ? {
+		file: name,
+		problem
+	} : null;
+}
+/** What a non-string primary key actually is, for the error message. Names the
+*  shape rather than stringifying the value — "[object Object]" tells the reader
+*  nothing about what is wrong. */
+function describeIdType(value) {
+	if (value === null) return "null";
+	if (value === void 0) return "missing";
+	if (Array.isArray(value)) return "an array";
+	return `a ${typeof value}`;
+}
+/** First schema problem on an in-memory record (primaryKey↔id mismatch,
+*  then the compiled per-field checks — see `../core/recordZ` for the two
+*  tiers), or null when it's fine. One issue per record keeps the report
+*  short and the fix obvious. Pure + exported so write paths
+*  (manageCollection putItems) can gate on the SAME enforced rules the
+*  post-hoc file scan reports — `itemId` is the id the record is (or
+*  would be) stored under. The default `"enforced"` tier keeps every
+*  write gate on the historical three checks; only pass `"strict"` from
+*  report-only surfaces. */
+function validateRecordObject(record, itemId, schema, tier = "enforced") {
+	const idValue = record[schema.primaryKey];
+	if (typeof idValue !== "string") return `'${schema.primaryKey}' must be a string, but is ${describeIdType(idValue)} — must equal the filename ('${itemId}'), or the record can't be opened`;
+	if (idValue !== itemId) return `'${schema.primaryKey}' is '${idValue}' but must equal the filename ('${itemId}'), or the record can't be opened`;
+	return firstRecordProblem(record, schema, tier);
+}
+//#endregion
+//#region src/collection/server/publish.ts
+var execFileAsync = (0, node_util.promisify)(node_child_process.execFile);
+/** How many broken records to name before summarising. A publish that would
+*  break a thousand rows is answered by the count and a sample; dumping all of
+*  them buries the number, which is the part the decision turns on. */
+var MAX_LISTED_ISSUES = 10;
+/** `git rev-parse HEAD` plus a dirty check, or nothing.
+*
+*  A missing git, a repository with no commits and a non-repository are all
+*  the same answer here — no commit — because the stamp is attribution, not a
+*  requirement. What is NOT acceptable is a stamp that lies, which is why the
+*  dirty flag exists: publishing from a modified tree records a commit that
+*  does not describe what was published, and the flag is the only thing that
+*  would ever tell a reader so. */
+async function gitStamp(root) {
+	try {
+		const { stdout } = await execFileAsync("git", [
+			"-C",
+			root,
+			"rev-parse",
+			"HEAD"
+		]);
+		const commit = stdout.trim();
+		const { stdout: status } = await execFileAsync("git", [
+			"-C",
+			root,
+			"status",
+			"--porcelain"
+		]);
+		return {
+			commit: commit.length > 0 ? commit : void 0,
+			dirty: status.trim().length > 0
+		};
+	} catch {
+		return {};
+	}
+}
+/** The shared collections of THIS REPOSITORY, by cid.
+*
+*  `userSkillsDir: null` — not a test convenience, a boundary. Discovery
+*  resolves every schema it finds against the WORKSPACE root, user-scope
+*  included, so a globally installed skill under `~/.claude/skills` carrying
+*  `storage.type: "firestore"` picks up whichever repository's `aid` it
+*  happens to be discovered from. Left in, publish would write that schema
+*  into this app — and into every other app the same user publishes, since the
+*  skill is installed once per machine and the repositories are not.
+*
+*  An app is a REPOSITORY (design D1): its collections are the ones committed
+*  beside its `app.json`, which is what makes a clone resolve the same
+*  collections and an invitation a matter of authorization rather than
+*  discovery. A schema that is not in the repository has no claim on a cid
+*  there. And because a view is HTML, publishing one is not a tidiness
+*  question: it is the machine's own skills reaching every member's browser.
+*
+*  The consequence is deliberate: a cid named in `app.json` that exists only
+*  in user scope is now an unknown cid, and publish says so by name instead of
+*  quietly publishing a schema from outside the repository. */
+async function sharedCollections(opts, root) {
+	return (await require_store.discoverCollections({
+		...opts,
+		workspaceRoot: root,
+		userSkillsDir: null
+	})).filter((collection) => collection.appId !== void 0);
+}
+/** Existing records that would not satisfy the schema about to be published.
+*
+*  Read from FIRESTORE, not from disk: a shared collection's records live in
+*  the app, and the question this answers is "what does the live data look
+*  like under the new schema" — which is the migration question. Reported as
+*  a refusal the publisher can override, because a breaking change is
+*  sometimes exactly what is intended and the point is that it is a decision
+*  rather than a discovery. */
+async function recordProblems(collections, opts) {
+	const lines = [];
+	const unreadable = [];
+	let records = 0;
+	let cappedAnywhere = false;
+	for (const collection of collections) {
+		const issues = await validateCollectionRecords(collection, opts);
+		if (issues.length === 0) continue;
+		const unread = issues.filter((issue) => issue.file === STORE_UNREADABLE);
+		if (unread.length > 0) {
+			unreadable.push(`${collection.slug}: ${unread.map((issue) => issue.problem).join("; ")}`);
+			continue;
+		}
+		records += issues.length;
+		const capped = issues.length >= 25;
+		cappedAnywhere = cappedAnywhere || capped;
+		const count = capped ? `at least ${issues.length}` : String(issues.length);
+		const plural = issues.length === 1 ? "" : "s";
+		const note = capped ? " (the scan stops there)" : "";
+		lines.push(`${collection.slug}: ${count} existing record${plural} would not satisfy the schema about to be published${note}`);
+		for (const issue of issues.slice(0, MAX_LISTED_ISSUES)) lines.push(`  - ${issue.file}: ${issue.problem}`);
+		if (issues.length > MAX_LISTED_ISSUES) lines.push(`  - … and ${issues.length - MAX_LISTED_ISSUES} more`);
+	}
+	return {
+		lines,
+		records,
+		capped: cappedAnywhere,
+		unreadable
+	};
+}
+function schemasOf(collections) {
+	return collections.map((collection) => ({
+		cid: collection.slug,
+		schema: collection.schema
+	})).sort((left, right) => left.cid < right.cid ? -1 : left.cid > right.cid ? 1 : 0);
+}
+/** Read and parse `<root>/app.json`'s full declaration. */
+async function readAuthored(root) {
+	let raw;
+	try {
+		raw = await (0, node_fs_promises.readFile)(node_path.default.join(root, require_store.APP_MANIFEST_FILE), "utf-8");
+	} catch (err) {
+		return {
+			ok: false,
+			problems: [`cannot read ${node_path.default.join(root, require_store.APP_MANIFEST_FILE)}: ${String(err)}`]
+		};
+	}
+	return parseAuthoredApp(raw);
+}
+/** Everything wrong with the declaration itself, publisher included. */
+function declarationProblems(app, collections, handle) {
+	const problems = publishProblems(app, collections.map((collection) => ({
+		cid: collection.slug,
+		primaryKey: collection.schema.primaryKey
+	})), handle.email);
+	if (app.owner !== void 0 && app.owner !== handle.uid) problems.push(`app.json declares owner "${app.owner}", which is not your uid (${handle.uid}). \`owner\` is stamped by publish and carried forward unchanged afterwards — remove it from app.json rather than maintaining it by hand.`);
+	return problems;
+}
+/** Put the three kinds of document, in the order the rules require, and turn a
+*  rejected write into the result type instead of letting it escape.
+*
+*  Returns null when everything was written; a failure result otherwise.
+*
+*  A raw rejection here would reach the agent as a tool crash rather than the
+*  actionable text this tool promises. But "actionable" is a strong claim for
+*  a half-finished publish, so the message ENUMERATES what landed rather than
+*  summarising it: the order is app → every schema → config, and a summary
+*  written for one failure point is wrong at the others. Saying "the roster
+*  and configuration are live" after a SCHEMA write failed names a config
+*  document this publish never wrote — which still holds whatever the last
+*  publish left, and is exactly the state the caller is trying to repair. */
+async function writeDocuments(handle, aid, published) {
+	const steps = [
+		{
+			what: `the app document (apps/${aid})`,
+			run: () => handle.docs.set(APPS_COLLECTION, aid, published.app)
+		},
+		...published.schemas.map(({ cid, doc }) => ({
+			what: `the published schema for '${cid}'`,
+			run: () => handle.docs.set(appSchemasPath(aid), cid, doc)
+		})),
+		{
+			what: `the public config document (apps/${aid}/config/${PUBLIC_CONFIG_DOC})`,
+			run: () => handle.docs.set(appConfigPath(aid), PUBLIC_CONFIG_DOC, published.config)
+		}
+	];
+	const landed = [];
+	for (const [index, step] of steps.entries()) try {
+		await step.run();
+		landed.push(step.what);
+	} catch (err) {
+		const reason = err instanceof Error ? err.message : String(err);
+		return {
+			ok: false,
+			partial: index > 0,
+			problems: [`publish failed while writing ${step.what}: ${reason}`, ...partialState(landed, [step.what, ...steps.slice(index + 1).map((rest) => rest.what)])]
+		};
+	}
+	return null;
+}
+/** What is live and what is not, listed rather than summarised.
+*
+*  Two facts, and both matter for the repair: a document this publish wrote is
+*  live NOW, and a document it did not write still holds what the LAST publish
+*  left — which is not the same as being absent, and not the same as matching
+*  the declaration that was just half-applied. */
+function partialState(landed, notWritten) {
+	const repair = "Publishing again is the repair: the write is idempotent, and it re-does every step, including the ones that did land.";
+	if (landed.length === 0) return [`Nothing was written. ${repair}`];
+	return [
+		`Written by this publish, and live now: ${landed.join("; ")}.`,
+		`NOT written: ${notWritten.join("; ")} — ${notWritten.length === 1 ? "it still holds" : "they still hold"} whatever the previous publish left.`,
+		repair
+	];
+}
+/** Publish this repository's declaration to its app.
+*
+*  Everything variable is a parameter or comes from the host binding, so the
+*  whole path is exercisable against an in-memory `FirestoreDocs` with no
+*  network and no API key — which is the only way the conversion table gets
+*  tested as a table. */
+async function publishApp(opts = {}) {
+	const root = opts.workspaceRoot ?? require_store.getWorkspaceRoot();
+	const handle = require_store.firestoreHandle();
+	if (!handle) return {
+		ok: false,
+		partial: false,
+		problems: ["publish needs a signed-in Firestore session: connect remote-host first. Publishing writes the app's roster and configuration as the app's owner, which is an authenticated write."]
+	};
+	const authored = await readAuthored(root);
+	if (!authored.ok) return {
+		...authored,
+		partial: false
+	};
+	const collections = await sharedCollections(opts, root);
+	const problems = declarationProblems(authored.app, collections, handle);
+	if (problems.length > 0) return {
+		ok: false,
+		partial: false,
+		problems
+	};
+	const issues = await recordProblems(collections, {
+		...opts,
+		workspaceRoot: root
+	});
+	if (issues.unreadable.length > 0) return {
+		ok: false,
+		partial: false,
+		problems: [...issues.unreadable, "publish stopped: the live records could not be read, so nothing checked whether the schemas about to be published still fit them. This is not something `confirm` overrides — confirming means accepting a known breakage, and here there is no reading at all. Fix the access (or the connection) and publish again."]
+	};
+	if (issues.records > 0 && opts.confirm !== true) return {
+		ok: false,
+		partial: false,
+		problems: [...issues.lines, "publish stopped: these records are live and members are reading them. Migrate them first, or re-run with confirm to publish the schema anyway and repair the records afterwards."]
+	};
+	return writePublished(authored.app, collections, handle, opts, root, issues);
+}
+/** The write half: stamp, project, and put the documents in the order the
+*  rules require. Split from the gate above so neither half hides the other —
+*  everything up to here can refuse, and nothing from here on does. */
+async function writePublished(authored, collections, handle, opts, root, issues) {
+	const { aid } = authored;
+	let existing;
+	try {
+		existing = await handle.docs.get(APPS_COLLECTION, aid);
+	} catch (err) {
+		return {
+			ok: false,
+			partial: false,
+			problems: [`publish failed while reading the current app document (apps/${aid}): ${err instanceof Error ? err.message : String(err)}`, "Nothing was written. Publishing again is safe — this read only decides whether the app is created or updated."]
+		};
+	}
+	const stampSource = await (opts.resolveCommit ?? gitStamp)(root);
+	const stamp = {
+		uid: handle.uid,
+		email: handle.email,
+		publishedAt: (opts.now ?? Date.now)(),
+		commit: stampSource.commit
+	};
+	const existingApp = require_dist.isRecord(existing) ? existing : null;
+	const published = projectApp(authored, schemasOf(collections), stamp, existingApp);
+	if (stampSource.dirty === true) published.app.publishedDirty = true;
+	const written = await writeDocuments(handle, aid, published);
+	if (written !== null) return written;
+	return {
+		ok: true,
+		aid,
+		cids: published.schemas.map((entry) => entry.cid),
+		created: existingApp === null,
+		commit: stamp.commit,
+		dirty: stampSource.dirty === true,
+		recordIssues: issues.records,
+		recordIssuesCapped: issues.capped,
+		published
+	};
+}
+//#endregion
 //#region src/collection/server/skillAssets.ts
 /** Read a collection's custom-view HTML, path-safely. `viewFile` is a
 *  schema-validated `views/*.html` path, resolved with realpath containment.
@@ -36,13 +1075,13 @@ async function readCustomViewHtml(collection, viewFile, opts = {}) {
 *  `readCustomViewHtml`. Used by both `readCustomViewHtml` and
 *  `readCustomViewI18n` so the two stay in lockstep. */
 async function readSourceAwareFile(collection, relPath, opts) {
-	const safeSlug = require_discovery.safeSlugName(collection.slug);
+	const safeSlug = require_store.safeSlugName(collection.slug);
 	if (safeSlug === null) return null;
-	const workspaceRoot = opts.workspaceRoot ?? require_discovery.getWorkspaceRoot();
-	const staging = collection.source === "project" ? require_discovery.stagingSkillDir(workspaceRoot, safeSlug) : null;
+	const workspaceRoot = opts.workspaceRoot ?? require_store.getWorkspaceRoot();
+	const staging = collection.source === "project" ? require_store.stagingSkillDir(workspaceRoot, safeSlug) : null;
 	const bases = staging === null ? [collection.skillDir] : [staging, collection.skillDir];
 	for (const base of bases) {
-		const resolved = require_discovery.resolveTemplatePath(base, relPath);
+		const resolved = require_store.resolveTemplatePath(base, relPath);
 		if (resolved === null) continue;
 		try {
 			return await (0, node_fs_promises.readFile)(resolved, "utf-8");
@@ -100,9 +1139,9 @@ async function readCustomViewI18n(collection, i18nFile, locale, opts = {}) {
 *  the file contents, or null when the path escapes the skill dir, the
 *  resolved target isn't a regular file, or the read fails. */
 async function readSkillTemplate(skillDir, templateRelPath) {
-	const resolved = require_discovery.resolveTemplatePath(skillDir, templateRelPath);
+	const resolved = require_store.resolveTemplatePath(skillDir, templateRelPath);
 	if (resolved === null) return null;
-	if (!await require_discovery.isRegularFile(resolved)) return null;
+	if (!await require_store.isRegularFile(resolved)) return null;
 	try {
 		return await (0, node_fs_promises.readFile)(resolved, "utf-8");
 	} catch {
@@ -244,11 +1283,11 @@ function absentReferencedColumns(rows, query) {
 /** Run a validated query over enriched collection rows. */
 async function runQueryOverRows(rows, query) {
 	if (rows.length === 0) return emptyCollectionResult(query);
-	await (0, node_fs_promises.mkdir)(require_discovery.cacheDir(), {
+	await (0, node_fs_promises.mkdir)(require_store.cacheDir(), {
 		recursive: true,
 		mode: 448
 	});
-	const jsonlPath = node_path.default.join(require_discovery.cacheDir(), `q-${(0, node_crypto.randomBytes)(8).toString("hex")}.jsonl`);
+	const jsonlPath = node_path.default.join(require_store.cacheDir(), `q-${(0, node_crypto.randomBytes)(8).toString("hex")}.jsonl`);
 	try {
 		const nullPads = Object.fromEntries(absentReferencedColumns(rows, query).map((column) => [column, null]));
 		const handle = await (0, node_fs_promises.open)(jsonlPath, "wx", 384);
@@ -264,335 +1303,115 @@ async function runQueryOverRows(rows, query) {
 		} finally {
 			await handle.close();
 		}
-		const { sql, params } = require_discovery.compileJsonlQuery(query);
-		return (await require_discovery.queryCsv(sql, [jsonlPath, ...params])).map((row) => Object.fromEntries(Object.entries(row).map(([key, value]) => [key, require_discovery.normalizeCsvValue(value)])));
+		const { sql, params } = require_store.compileJsonlQuery(query);
+		return (await require_store.queryCsv(sql, [jsonlPath, ...params])).map((row) => Object.fromEntries(Object.entries(row).map(([key, value]) => [key, require_store.normalizeCsvValue(value)])));
 	} finally {
-		await (0, node_fs_promises.unlink)(jsonlPath).catch((err) => {
-			if (!require_dist.isErrorWithCode(err) || err.code !== "ENOENT") require_discovery.log.warn("collections", "temp JSONL cleanup failed", {
-				path: jsonlPath,
-				error: String(err)
-			});
-		});
-	}
-}
-//#endregion
-//#region src/collection/server/derive.ts
-async function loadTarget(slug, opts) {
-	const target = await require_discovery.loadCollection(slug, opts);
-	if (!target) return null;
-	const items = await require_discovery.storeFor(target, { workspaceRoot: opts.workspaceRoot }).list();
-	const byId = {};
-	for (const item of items) {
-		const itemId = item[target.schema.primaryKey];
-		if (typeof itemId === "string" && itemId.length > 0) byId[itemId] = require_promptSafety.deriveAll(target.schema, item, {});
-	}
-	return {
-		schema: target.schema,
-		byId
-	};
-}
-/** Load every ref/embed target and backlink source collection once.
-*  Unknown / unloadable targets are simply absent — downstream derefs
-*  resolve to null (em-dash) and backlinks to an empty row set, the
-*  same fail-soft the UI renders. */
-async function loadLinkedTargets(schema, opts) {
-	const slugs = [.../* @__PURE__ */ new Set([
-		...require_promptSafety.uniqueRefTargets(schema),
-		...require_promptSafety.uniqueEmbedTargets(schema),
-		...require_promptSafety.uniqueBacklinkSources(schema)
-	])];
-	const loaded = {};
-	for (const slug of slugs) {
-		const target = await loadTarget(slug, opts);
-		if (target) loaded[slug] = target;
-	}
-	return loaded;
-}
-function toRefRecords(linked) {
-	return Object.fromEntries(Object.entries(linked).map(([slug, target]) => [slug, target.byId]));
-}
-/** The matching source rows for one `backlinks` field, projected to the
-*  source primaryKey + `display` columns — so getItems on a
-*  heavily-referenced record stays a summary, not a dump of the source
-*  collection. Missing source ⇒ [] (fail-soft). The rows come from the
-*  DERIVED source records (`byId`), so `display`/`filter` on a derived
-*  source column (an invoice `total`) works. */
-function projectBacklinks(field, schema, enriched, linked) {
-	const source = linked[field.from];
-	if (!source) return [];
-	const selfId = require_calendarGrid.fieldText(enriched[schema.primaryKey]);
-	return require_promptSafety.backlinkRows(field, selfId, Object.values(source.byId)).map((row) => require_promptSafety.projectBacklinkRow(row, field.display, source.schema.primaryKey));
-}
-/** Project the computed (never-stored) field kinds onto one derived
-*  record: `toggle` → boolean off its enum, `embed` → the target record
-*  (fixed `id` or per-record `idField`), or null when missing,
-*  `backlinks` → the matching source rows (see `projectBacklinks`). */
-function projectComputed(schema, enriched, linked) {
-	for (const [key, field] of Object.entries(schema.fields)) {
-		if (field.type === "toggle" && field.field) enriched[key] = require_calendarGrid.fieldText(enriched[field.field]) === field.onValue;
-		if (field.type === "embed" && field.to) {
-			const targetId = require_calendarGrid.embedTargetId(field, enriched);
-			const target = require_promptSafety.ownProp(linked, field.to);
-			enriched[key] = targetId && target && require_promptSafety.ownProp(target.byId, targetId) || null;
-		}
-		if (field.type === "backlinks") enriched[key] = projectBacklinks(field, schema, enriched, linked);
-	}
-	return enriched;
-}
-/** Resolve every rollup field onto a COPY of the record, BEFORE the
-*  formula pass — a `derived` formula may reference rollup values as
-*  plain identifiers (`played = homePlayed + awayPlayed`). Same reverse
-*  machinery as backlinks, collapsed to a number: an unresolvable source
-*  is null (a formula reading it fails soft to em-dash); an empty match
-*  set is a real 0. Returns `record` unchanged when the schema declares
-*  no rollups. */
-function projectRollups(schema, record, linked) {
-	let out = record;
-	for (const [key, field] of Object.entries(schema.fields)) {
-		if (field.type !== "rollup") continue;
-		if (out === record) out = { ...record };
-		const source = linked[field.from];
-		const selfId = require_calendarGrid.fieldText(record[schema.primaryKey]);
-		out[key] = source ? require_promptSafety.rollupValue(field, selfId, Object.values(source.byId)) : null;
-	}
-	return out;
-}
-/** Enrich records with every host-computed field: derived formulas
-*  evaluated (cross-collection derefs included), toggles projected,
-*  embeds resolved. Loads each linked collection ONCE per call. Input
-*  records are not mutated. */
-async function enrichItems(collection, items, opts = {}) {
-	const { schema } = collection;
-	const linked = await loadLinkedTargets(schema, opts);
-	const refRecords = toRefRecords(linked);
-	return items.map((item) => projectComputed(schema, require_promptSafety.deriveAll(schema, projectRollups(schema, item, linked), refRecords), linked));
-}
-//#endregion
-//#region src/collection/server/queryRunner.ts
-async function runCollectionQuery(collection, query, opts = {}) {
-	const store = require_discovery.storeFor(collection, { workspaceRoot: opts.workspaceRoot });
-	if (store.query) return store.query(query);
-	return runQueryOverRows(await enrichItems(collection, await store.list(), opts), query);
-}
-//#endregion
-//#region src/collection/core/recordZ.ts
-/** The emptiness rule shared by `required` and the "only check present
-*  values" gate. NOT a truthiness check — `0` and `false` are filled. */
-var isEmptyValue = (value) => value === void 0 || value === null || value === "";
-/** The historical write-gate checks, verbatim: required non-empty, enum
-*  membership (compared as strings, so a numeric `5` satisfies `"5"`). */
-function enforcedProblem(key, spec, value) {
-	const empty = isEmptyValue(value);
-	if (spec.required && empty) return `missing required field '${key}'`;
-	if (!empty && spec.type === "enum" && !spec.values.includes(String(value))) return `'${key}' = '${String(value)}' is not one of [${spec.values.join(", ")}]`;
-	return null;
-}
-/** Report-only per-type checks on a PRESENT value. Date / datetime reuse the
-*  calendar's STRICT civil parsers (`parseIsoDate` / `parseIsoDateTime`), so
-*  the lint flags exactly the values the calendar / trigger / spawn code
-*  would silently drop — impossible days like `2026-02-30`, and datetimes
-*  outside the canonical `YYYY-MM-DDTHH:MM[:SS]` shape (e.g. a `Z` suffix,
-*  which the day view can't place). `string`-backed types accept anything
-*  stringifiable; `ref` existence is out of scope. */
-function strictTypeProblem(key, spec, value) {
-	switch (spec.type) {
-		case "number":
-		case "money": return Number.isFinite(require_promptSafety.coerceNumeric(value)) ? null : `'${key}' = '${String(value)}' is not numeric (a '${spec.type}' field stores a plain number)`;
-		case "boolean": return value === true || value === false ? null : `'${key}' = '${String(value)}' is not a boolean (store true or false, unquoted)`;
-		case "date": return require_calendarGrid.parseIsoDate(value) !== null ? null : `'${key}' = '${String(value)}' is not a real YYYY-MM-DD date`;
-		case "datetime": return require_calendarGrid.parseIsoDateTime(value) !== null ? null : `'${key}' = '${String(value)}' is not a YYYY-MM-DDTHH:MM datetime (seconds optional, no timezone suffix — the shape the calendar parses)`;
-		default: return null;
-	}
-}
-/** Strict check for a PRESENT `table` value: an array of row objects, each
-*  row conforming to the sub-schema (required / enum / typed sub-values).
-*  First row problem wins, prefixed with the row number so the fix is
-*  locatable. */
-function strictTableProblem(key, spec, value) {
-	if (!Array.isArray(value)) return `'${key}' = '${String(value)}' is not an array of rows (a 'table' field stores an array of row objects)`;
-	for (let index = 0; index < value.length; index++) {
-		const row = value[index];
-		if (!require_dist.isRecord(row)) return `'${key}' row ${index + 1} is not an object`;
-		for (const [subKey, subSpec] of Object.entries(spec.of)) {
-			const subValue = row[subKey];
-			const problem = enforcedProblem(subKey, subSpec, subValue) ?? (isEmptyValue(subValue) ? null : strictTypeProblem(subKey, subSpec, subValue));
-			if (problem) return `'${key}' row ${index + 1}: ${problem}`;
-		}
-	}
-	return null;
-}
-/** First problem for one field's stored value under `tier`, or null.
-*  Enforced checks always run (and their messages never vary by tier — the
-*  scan and the write gate must agree on them); strict adds the per-type
-*  layer on present values only. */
-function recordFieldProblem(key, spec, value, tier) {
-	const enforced = enforcedProblem(key, spec, value);
-	if (enforced || tier === "enforced") return enforced;
-	if (isEmptyValue(value)) return null;
-	if (spec.type === "table") return strictTableProblem(key, spec, value);
-	return strictTypeProblem(key, spec, value);
-}
-var compiled = /* @__PURE__ */ new WeakMap();
-/** Compile `schema.fields` into a zod validator for a stored record.
-*  Loose object: unknown keys are allowed and any declared key may be
-*  absent (records are user files, not parse-and-rewrite targets —
-*  callers validate, they never persist the parse output). The checks run
-*  as ONE object-level refine iterating fields in declaration order —
-*  per-key shape schemas can't express "key may be absent BUT its absence
-*  must still reach the required check", and the single loop keeps the
-*  first reported issue identical to the historical first-problem-wins
-*  contract. */
-function compileRecordZ(schema, tier) {
-	const cached = compiled.get(schema)?.[tier];
-	if (cached) return cached;
-	const stored = Object.entries(schema.fields).filter(([, spec]) => !require_calendarGrid.COMPUTED_TYPES.has(spec.type));
-	const validator = zod.z.looseObject({}).superRefine((record, ctx) => {
-		for (const [key, spec] of stored) {
-			const problem = recordFieldProblem(key, spec, record[key], tier);
-			if (problem) ctx.addIssue({
-				code: "custom",
-				message: problem,
-				path: [key]
-			});
-		}
-	});
-	const entry = compiled.get(schema) ?? {};
-	entry[tier] = validator;
-	compiled.set(schema, entry);
-	return validator;
-}
-/** First schema problem on an in-memory record under `tier`, or null. One
-*  issue per record keeps the report short and the fix obvious (the
-*  historical contract of `validateRecordObject`). */
-function firstRecordProblem(record, schema, tier) {
-	const result = compileRecordZ(schema, tier).safeParse(record);
-	if (result.success) return null;
-	return result.error.issues[0]?.message ?? "record failed schema validation";
+		await (0, node_fs_promises.unlink)(jsonlPath).catch((err) => {
+			if (!require_dist.isErrorWithCode(err) || err.code !== "ENOENT") require_store.log.warn("collections", "temp JSONL cleanup failed", {
+				path: jsonlPath,
+				error: String(err)
+			});
+		});
+	}
 }
 //#endregion
-//#region src/collection/server/validate.ts
-var MAX_ISSUES = 25;
-/** Read every `<id>.json` under the collection's dataDir and report the
-*  ones that won't load or violate the schema. An empty list means every
-*  record is fine. */
-/** List entries under the data dir, guarding realpath containment (against a
-*  symlinked dir swapped in after discovery, like `listItems`) and treating a
-*  missing dir as empty while surfacing real I/O faults. */
-async function listRecordFilenames(dataDir, workspaceRoot) {
-	if (!require_discovery.isContainedInRoot(dataDir, workspaceRoot)) {
-		require_discovery.log.warn("collections", "validate refused: dataDir escapes workspace via symlink", { dataDir });
-		return [];
-	}
-	try {
-		return await (0, node_fs_promises.readdir)(dataDir);
-	} catch (err) {
-		if (require_dist.isErrorWithCode(err) && err.code === "ENOENT") return [];
-		throw err;
+//#region src/collection/server/derive.ts
+async function loadTarget(slug, opts) {
+	const target = await require_store.loadCollection(slug, opts);
+	if (!target) return null;
+	const items = await require_store.storeFor(target, { workspaceRoot: opts.workspaceRoot }).list();
+	const byId = {};
+	for (const item of items) {
+		const itemId = item[target.schema.primaryKey];
+		if (typeof itemId === "string" && itemId.length > 0) byId[itemId] = require_promptSafety.deriveAll(target.schema, item, {});
 	}
+	return {
+		schema: target.schema,
+		byId
+	};
 }
-async function validateCollectionRecords(collection, opts = {}) {
-	if (collection.schema.dataSource !== void 0) return [];
-	if (collection.schema.storage !== void 0) return validateStoreRecords(collection, opts);
-	const workspaceRoot = opts.workspaceRoot ?? require_discovery.getWorkspaceRoot();
-	const entries = await listRecordFilenames(collection.dataDir, workspaceRoot);
-	const issues = [];
-	for (const name of entries.sort()) {
-		if (!name.endsWith(".json") || name.startsWith(".")) continue;
-		if (issues.length >= MAX_ISSUES) break;
-		const issue = await inspectRecord(node_path.default.join(collection.dataDir, name), name, collection.schema);
-		if (issue) issues.push(issue);
+/** Load every ref/embed target and backlink source collection once.
+*  Unknown / unloadable targets are simply absent — downstream derefs
+*  resolve to null (em-dash) and backlinks to an empty row set, the
+*  same fail-soft the UI renders. */
+async function loadLinkedTargets(schema, opts) {
+	const slugs = [.../* @__PURE__ */ new Set([
+		...require_promptSafety.uniqueRefTargets(schema),
+		...require_promptSafety.uniqueEmbedTargets(schema),
+		...require_promptSafety.uniqueBacklinkSources(schema)
+	])];
+	const loaded = {};
+	for (const slug of slugs) {
+		const target = await loadTarget(slug, opts);
+		if (target) loaded[slug] = target;
 	}
-	return issues;
+	return loaded;
 }
-/** Store-backed twin of the file scan: list every record through the
-*  collection's store and lint it with the same "strict" report-only tier.
-*  A row the store can't even parse is invisible here (the store skips
-*  it), so the read/parse classifications of the file scan don't apply —
-*  schema violations are what this catches. `file` carries the record id
-*  (there is no per-record filename). */
-async function validateStoreRecords(collection, opts) {
-	let items;
-	try {
-		items = await require_discovery.storeFor(collection, { workspaceRoot: opts.workspaceRoot }).list();
-	} catch (err) {
-		return [{
-			file: "(store)",
-			problem: `records could not be read from the storage backend: ${err instanceof Error ? err.message : String(err)}`
-		}];
-	}
-	const issues = [];
-	for (const item of items) {
-		if (issues.length >= MAX_ISSUES) break;
-		const itemId = require_calendarGrid.fieldText(item[collection.schema.primaryKey]);
-		const problem = validateRecordObject(item, itemId, collection.schema, "strict");
-		if (problem) issues.push({
-			file: itemId,
-			problem
-		});
-	}
-	return issues;
+function toRefRecords(linked) {
+	return Object.fromEntries(Object.entries(linked).map(([slug, target]) => [slug, target.byId]));
 }
-async function readRecordText(fullPath, name) {
-	try {
-		if (!(await (0, node_fs_promises.lstat)(fullPath)).isFile()) return {
-			file: name,
-			problem: "not a regular file (symlink?) — skipped, won't appear"
-		};
-		return { raw: await (0, node_fs_promises.readFile)(fullPath, "utf-8") };
-	} catch {
-		return {
-			file: name,
-			problem: "could not be read — skipped, won't appear"
-		};
+/** The matching source rows for one `backlinks` field, projected to the
+*  source primaryKey + `display` columns — so getItems on a
+*  heavily-referenced record stays a summary, not a dump of the source
+*  collection. Missing source ⇒ [] (fail-soft). The rows come from the
+*  DERIVED source records (`byId`), so `display`/`filter` on a derived
+*  source column (an invoice `total`) works. */
+function projectBacklinks(field, schema, enriched, linked) {
+	const source = linked[field.from];
+	if (!source) return [];
+	const selfId = require_calendarGrid.fieldText(enriched[schema.primaryKey]);
+	return require_promptSafety.backlinkRows(field, selfId, Object.values(source.byId)).map((row) => require_promptSafety.projectBacklinkRow(row, field.display, source.schema.primaryKey));
+}
+/** Project the computed (never-stored) field kinds onto one derived
+*  record: `toggle` → boolean off its enum, `embed` → the target record
+*  (fixed `id` or per-record `idField`), or null when missing,
+*  `backlinks` → the matching source rows (see `projectBacklinks`). */
+function projectComputed(schema, enriched, linked) {
+	for (const [key, field] of Object.entries(schema.fields)) {
+		if (field.type === "toggle" && field.field) enriched[key] = require_calendarGrid.fieldText(enriched[field.field]) === field.onValue;
+		if (field.type === "embed" && field.to) {
+			const targetId = require_calendarGrid.embedTargetId(field, enriched);
+			const target = require_promptSafety.ownProp(linked, field.to);
+			enriched[key] = targetId && target && require_promptSafety.ownProp(target.byId, targetId) || null;
+		}
+		if (field.type === "backlinks") enriched[key] = projectBacklinks(field, schema, enriched, linked);
 	}
+	return enriched;
 }
-/** Classify a single record file: unreadable / unparseable / non-object /
-*  schema violation, or null when it's fine. */
-async function inspectRecord(fullPath, name, schema) {
-	const read = await readRecordText(fullPath, name);
-	if ("problem" in read) return read;
-	let parsed;
-	try {
-		parsed = JSON.parse(read.raw);
-	} catch (err) {
-		return {
-			file: name,
-			problem: `invalid JSON (${err instanceof Error ? err.message : String(err)}) — SKIPPED, won't appear. Usual cause: an unescaped " inside a string value; use 「」/『』 or write \\" instead.`
-		};
+/** Resolve every rollup field onto a COPY of the record, BEFORE the
+*  formula pass — a `derived` formula may reference rollup values as
+*  plain identifiers (`played = homePlayed + awayPlayed`). Same reverse
+*  machinery as backlinks, collapsed to a number: an unresolvable source
+*  is null (a formula reading it fails soft to em-dash); an empty match
+*  set is a real 0. Returns `record` unchanged when the schema declares
+*  no rollups. */
+function projectRollups(schema, record, linked) {
+	let out = record;
+	for (const [key, field] of Object.entries(schema.fields)) {
+		if (field.type !== "rollup") continue;
+		if (out === record) out = { ...record };
+		const source = linked[field.from];
+		const selfId = require_calendarGrid.fieldText(record[schema.primaryKey]);
+		out[key] = source ? require_promptSafety.rollupValue(field, selfId, Object.values(source.byId)) : null;
 	}
-	if (!require_dist.isRecord(parsed)) return {
-		file: name,
-		problem: "not a JSON object — skipped, won't appear"
-	};
-	const problem = validateRecordObject(parsed, name.replace(/\.json$/, ""), schema, "strict");
-	return problem ? {
-		file: name,
-		problem
-	} : null;
+	return out;
 }
-/** What a non-string primary key actually is, for the error message. Names the
-*  shape rather than stringifying the value — "[object Object]" tells the reader
-*  nothing about what is wrong. */
-function describeIdType(value) {
-	if (value === null) return "null";
-	if (value === void 0) return "missing";
-	if (Array.isArray(value)) return "an array";
-	return `a ${typeof value}`;
+/** Enrich records with every host-computed field: derived formulas
+*  evaluated (cross-collection derefs included), toggles projected,
+*  embeds resolved. Loads each linked collection ONCE per call. Input
+*  records are not mutated. */
+async function enrichItems(collection, items, opts = {}) {
+	const { schema } = collection;
+	const linked = await loadLinkedTargets(schema, opts);
+	const refRecords = toRefRecords(linked);
+	return items.map((item) => projectComputed(schema, require_promptSafety.deriveAll(schema, projectRollups(schema, item, linked), refRecords), linked));
 }
-/** First schema problem on an in-memory record (primaryKey↔id mismatch,
-*  then the compiled per-field checks — see `../core/recordZ` for the two
-*  tiers), or null when it's fine. One issue per record keeps the report
-*  short and the fix obvious. Pure + exported so write paths
-*  (manageCollection putItems) can gate on the SAME enforced rules the
-*  post-hoc file scan reports — `itemId` is the id the record is (or
-*  would be) stored under. The default `"enforced"` tier keeps every
-*  write gate on the historical three checks; only pass `"strict"` from
-*  report-only surfaces. */
-function validateRecordObject(record, itemId, schema, tier = "enforced") {
-	const idValue = record[schema.primaryKey];
-	if (typeof idValue !== "string") return `'${schema.primaryKey}' must be a string, but is ${describeIdType(idValue)} — must equal the filename ('${itemId}'), or the record can't be opened`;
-	if (idValue !== itemId) return `'${schema.primaryKey}' is '${idValue}' but must equal the filename ('${itemId}'), or the record can't be opened`;
-	return firstRecordProblem(record, schema, tier);
+//#endregion
+//#region src/collection/server/queryRunner.ts
+async function runCollectionQuery(collection, query, opts = {}) {
+	const store = require_store.storeFor(collection, { workspaceRoot: opts.workspaceRoot });
+	if (store.query) return store.query(query);
+	return runQueryOverRows(await enrichItems(collection, await store.list(), opts), query);
 }
 //#endregion
 //#region src/collection/server/mutate.ts
@@ -619,7 +1438,7 @@ async function applyMutateAction(collection, action, itemId, params, opts = {})
 		status: "invalid-params",
 		problem: paramProblem
 	};
-	const store = require_discovery.storeFor(collection, opts);
+	const store = require_store.storeFor(collection, opts);
 	if (!store.write) return {
 		ok: false,
 		status: "write-refused",
@@ -642,7 +1461,7 @@ async function applyMutateAction(collection, action, itemId, params, opts = {})
 	});
 	const merged = {
 		...Object.fromEntries(stored),
-		...require_discovery.resolveMutateSet(action.set, params)
+		...require_store.resolveMutateSet(action.set, params)
 	};
 	const invalid = validateRecordObject(merged, itemId, collection.schema);
 	if (invalid) return {
@@ -700,10 +1519,10 @@ function schemaRelations(schema) {
 *  Fail-soft: a missing dir or a dataDir escaping the workspace via
 *  symlink counts 0. */
 async function countRecordFiles(dataDir, workspaceRoot) {
-	if (!require_discovery.isContainedInRoot(dataDir, workspaceRoot)) return 0;
+	if (!require_store.isContainedInRoot(dataDir, workspaceRoot)) return 0;
 	try {
 		const names = (await (0, node_fs_promises.readdir)(dataDir)).filter((name) => name.endsWith(".json") && !name.startsWith("."));
-		return (await Promise.all(names.map((name) => require_discovery.isRegularFile(node_path.default.join(dataDir, name))))).filter(Boolean).length;
+		return (await Promise.all(names.map((name) => require_store.isRegularFile(node_path.default.join(dataDir, name))))).filter(Boolean).length;
 	} catch {
 		return 0;
 	}
@@ -716,9 +1535,9 @@ async function countRecordFiles(dataDir, workspaceRoot) {
 *  break the whole ontology). */
 async function countRecords(collection, workspaceRoot) {
 	if (require_calendarGrid.storageKindFor(collection.schema) !== "file") try {
-		return (await require_discovery.storeFor(collection, { workspaceRoot }).page({ limit: 0 })).total;
+		return (await require_store.storeFor(collection, { workspaceRoot }).page({ limit: 0 })).total;
 	} catch (err) {
-		if (require_discovery.isBackendUnavailable(err)) return null;
+		if (require_store.isBackendUnavailable(err)) return null;
 		return 0;
 	}
 	return countRecordFiles(collection.dataDir, workspaceRoot);
@@ -739,8 +1558,8 @@ async function toOntologyEntry(collection, workspaceRoot) {
 *  discovery's order), each with its outbound relations and a
 *  readdir-cheap record count — fine to call on demand. */
 async function buildWorkspaceOntology(opts = {}) {
-	const workspaceRoot = opts.workspaceRoot ?? require_discovery.getWorkspaceRoot();
-	const collections = await require_discovery.discoverCollections(opts);
+	const workspaceRoot = opts.workspaceRoot ?? require_store.getWorkspaceRoot();
+	const collections = await require_store.discoverCollections(opts);
 	return Promise.all(collections.map((collection) => toOntologyEntry(collection, workspaceRoot)));
 }
 //#endregion
@@ -774,15 +1593,15 @@ async function computeCollectionIcon(collection, opts = {}) {
 	const spec = schema.dynamicIcon;
 	if (!spec) return schema.icon;
 	try {
-		const source = await require_discovery.loadCollection(spec.source.collection, opts);
+		const source = await require_store.loadCollection(spec.source.collection, opts);
 		if (!source) return spec.fallback ?? schema.icon;
-		const ordered = sortByPrimaryKey(await require_discovery.storeFor(source, { workspaceRoot: opts.workspaceRoot }).list(), source.schema.primaryKey);
+		const ordered = sortByPrimaryKey(await require_store.storeFor(source, { workspaceRoot: opts.workspaceRoot }).list(), source.schema.primaryKey);
 		const orderBy = spec.source.orderBy ?? require_promptSafety.firstDateField(source.schema);
 		const recordsById = buildRecordsById(ordered, source.schema.primaryKey);
 		const record = require_promptSafety.selectDynamicRecord(ordered, spec.source, orderBy, recordsById);
 		return require_promptSafety.resolveIcon(record, spec, schema.icon, recordsById);
 	} catch (err) {
-		require_discovery.log.warn("collections", "dynamic icon compute failed, falling back", {
+		require_store.log.warn("collections", "dynamic icon compute failed, falling back", {
 			slug: collection.slug,
 			source: spec.source.collection,
 			error: String(err)
@@ -944,7 +1763,7 @@ function computeSuccessor(schema, sourceItem, sourceId) {
 *  predates a map/enum edit — discovery rejects this statically otherwise). */
 function logSpawnSkip(slug, triggerField, every, sourceItem, sourceId) {
 	if (parseCivil(sourceItem[triggerField]) === null) {
-		require_discovery.log.warn("collections", "spawn skipped: source trigger date unparseable", {
+		require_store.log.warn("collections", "spawn skipped: source trigger date unparseable", {
 			slug,
 			sourceId,
 			triggerField
@@ -952,7 +1771,7 @@ function logSpawnSkip(slug, triggerField, every, sourceItem, sourceId) {
 		return;
 	}
 	const fromField = require_calendarGrid.isFieldDrivenEvery(every) ? every.fromField : void 0;
-	require_discovery.log.warn("collections", "spawn skipped: no `every` mapping for frequency value", {
+	require_store.log.warn("collections", "spawn skipped: no `every` mapping for frequency value", {
 		slug,
 		sourceId,
 		fromField,
@@ -975,7 +1794,7 @@ async function maybeSpawnSuccessor(collection, sourceItem, sourceId, ioOpts = {}
 		return;
 	}
 	if (matchesWhen(spawn.when, schema, computed.record)) {
-		require_discovery.log.warn("collections", "spawn skipped: successor would be born matching its own predicate (unbounded respawn)", {
+		require_store.log.warn("collections", "spawn skipped: successor would be born matching its own predicate (unbounded respawn)", {
 			slug,
 			sourceId,
 			successorId: computed.id
@@ -983,28 +1802,28 @@ async function maybeSpawnSuccessor(collection, sourceItem, sourceId, ioOpts = {}
 		return;
 	}
 	try {
-		const { write } = require_discovery.storeFor(collection, ioOpts);
+		const { write } = require_store.storeFor(collection, ioOpts);
 		if (!write) {
-			require_discovery.log.warn("collections", "spawn skipped: collection store is read-only", {
+			require_store.log.warn("collections", "spawn skipped: collection store is read-only", {
 				slug,
 				sourceId
 			});
 			return;
 		}
 		const result = await write(computed.id, computed.record, { refuseOverwrite: true });
-		if (result.kind === "ok") require_discovery.log.info("collections", "spawned successor", {
+		if (result.kind === "ok") require_store.log.info("collections", "spawned successor", {
 			slug,
 			sourceId,
 			successorId: computed.id
 		});
-		else if (result.kind !== "conflict") require_discovery.log.warn("collections", "spawn write failed", {
+		else if (result.kind !== "conflict") require_store.log.warn("collections", "spawn write failed", {
 			slug,
 			sourceId,
 			successorId: computed.id,
 			kind: result.kind
 		});
 	} catch (err) {
-		require_discovery.log.warn("collections", "spawn write threw", {
+		require_store.log.warn("collections", "spawn write threw", {
 			slug,
 			sourceId,
 			successorId: computed.id,
@@ -1043,7 +1862,7 @@ function todayStamp() {
 /** Every directory the delete will touch must resolve under the
 *  workspace root — guards against a symlinked ancestor escaping it. */
 function deleteTargets(collection, workspaceRoot) {
-	const staging = require_discovery.stagingSkillDir(workspaceRoot, collection.slug);
+	const staging = require_store.stagingSkillDir(workspaceRoot, collection.slug);
 	return [
 		...staging === null ? [] : [staging],
 		collection.skillDir,
@@ -1155,12 +1974,12 @@ function recordLocationLabel(schema) {
 }
 /** Copy one skill copy + the records + RESTORE.md into `archiveDir`. */
 async function writeArchive(collection, archiveDir, workspaceRoot) {
-	const staging = require_discovery.stagingSkillDir(workspaceRoot, collection.slug);
+	const staging = require_store.stagingSkillDir(workspaceRoot, collection.slug);
 	const skillSrc = staging !== null && await pathExists(staging) ? staging : collection.skillDir;
 	await (0, node_fs_promises.cp)(skillSrc, node_path.default.join(archiveDir, "skill"), { recursive: true });
 	if (await pathExists(collection.dataDir)) await (0, node_fs_promises.cp)(collection.dataDir, node_path.default.join(archiveDir, "records"), { recursive: true });
 	if (collection.storageFile !== void 0 && await pathExists(collection.storageFile)) {
-		const checkpointed = await require_discovery.checkpointSqliteDatabase(collection.storageFile);
+		const checkpointed = await require_store.checkpointSqliteDatabase(collection.storageFile);
 		await (0, node_fs_promises.cp)(collection.storageFile, node_path.default.join(archiveDir, node_path.default.basename(collection.storageFile)));
 		if (!checkpointed) for (const suffix of [
 			"-wal",
@@ -1177,7 +1996,7 @@ async function writeArchive(collection, archiveDir, workspaceRoot) {
 *  is a no-op; the now-empty data parent (`data/<slug>/` after its
 *  `items/` is gone) is swept too, but only when empty. */
 async function removeLocations(collection, workspaceRoot) {
-	const staging = require_discovery.stagingSkillDir(workspaceRoot, collection.slug);
+	const staging = require_store.stagingSkillDir(workspaceRoot, collection.slug);
 	if (staging !== null) await (0, node_fs_promises.rm)(staging, {
 		recursive: true,
 		force: true
@@ -1201,24 +2020,24 @@ async function removeLocations(collection, workspaceRoot) {
 }
 async function deleteCollection(collection, opts = {}) {
 	const { slug } = collection;
-	const workspaceRoot = opts.workspaceRoot ?? require_discovery.getWorkspaceRoot();
+	const workspaceRoot = opts.workspaceRoot ?? require_store.getWorkspaceRoot();
 	if (collection.source === "user") return {
 		kind: "user-scope",
 		slug
 	};
-	if (require_discovery.isPresetSlug(slug)) return {
+	if (require_store.isPresetSlug(slug)) return {
 		kind: "preset",
 		slug
 	};
 	if (collection.schema.storage?.type === "firestore") {
-		require_discovery.log.warn("collections", "deleteCollection refused: a shared collection's records can be neither archived nor removed here", { slug });
+		require_store.log.warn("collections", "deleteCollection refused: a shared collection's records can be neither archived nor removed here", { slug });
 		return {
 			kind: "unsupported-backend",
 			slug
 		};
 	}
 	if (!isDataDirSafe(collection.dataDir, slug, workspaceRoot)) {
-		require_discovery.log.warn("collections", "deleteCollection refused: dataDir is not under the per-collection root", {
+		require_store.log.warn("collections", "deleteCollection refused: dataDir is not under the per-collection root", {
 			slug,
 			dataDir: collection.dataDir
 		});
@@ -1227,19 +2046,19 @@ async function deleteCollection(collection, opts = {}) {
 			slug
 		};
 	}
-	if (deleteTargets(collection, workspaceRoot).some((target) => !require_discovery.isContainedInRoot(target, workspaceRoot))) {
-		require_discovery.log.warn("collections", "deleteCollection refused: a target escapes the workspace", { slug });
+	if (deleteTargets(collection, workspaceRoot).some((target) => !require_store.isContainedInRoot(target, workspaceRoot))) {
+		require_store.log.warn("collections", "deleteCollection refused: a target escapes the workspace", { slug });
 		return {
 			kind: "path-escape",
 			slug
 		};
 	}
-	const archiveRel = node_path.default.join(require_discovery.archiveDir(), `${opts.dateStamp ?? todayStamp()}-${(0, node_crypto.randomUUID)()}`);
+	const archiveRel = node_path.default.join(require_store.archiveDir(), `${opts.dateStamp ?? todayStamp()}-${(0, node_crypto.randomUUID)()}`);
 	const archiveDir$1 = node_path.default.join(workspaceRoot, archiveRel);
 	await (0, node_fs_promises.mkdir)(archiveDir$1, { recursive: true });
 	await writeArchive(collection, archiveDir$1, workspaceRoot);
 	await removeLocations(collection, workspaceRoot);
-	require_discovery.log.info("collections", "collection deleted + archived", {
+	require_store.log.info("collections", "collection deleted + archived", {
 		slug,
 		archive: archiveRel
 	});
@@ -1269,7 +2088,7 @@ async function fileExists(target) {
 *  deletes agree on both layouts. */
 async function canonicalBase(collection, workspaceRoot, safeSlug) {
 	if (collection.source !== "project") return collection.skillDir;
-	const staging = require_discovery.stagingSkillDir(workspaceRoot, safeSlug);
+	const staging = require_store.stagingSkillDir(workspaceRoot, safeSlug);
 	if (staging !== null && await fileExists(node_path.default.join(staging, "schema.json"))) return staging;
 	return collection.skillDir;
 }
@@ -1279,11 +2098,11 @@ async function canonicalBase(collection, workspaceRoot, safeSlug) {
 *  project collection (no staging mirror) doesn't have an empty staging tree
 *  materialised by a side effect of the delete. */
 async function schemaWriteTargets(collection, workspaceRoot, safeSlug) {
-	const active = node_path.default.join(collection.skillDir, require_discovery.SCHEMA_FILE);
+	const active = node_path.default.join(collection.skillDir, require_store.SCHEMA_FILE);
 	if (collection.source !== "project") return [active];
-	const staging = require_discovery.stagingSkillDir(workspaceRoot, safeSlug);
+	const staging = require_store.stagingSkillDir(workspaceRoot, safeSlug);
 	const targets = [];
-	if (staging !== null && await fileExists(node_path.default.join(staging, "schema.json"))) targets.push(node_path.default.join(staging, require_discovery.SCHEMA_FILE));
+	if (staging !== null && await fileExists(node_path.default.join(staging, "schema.json"))) targets.push(node_path.default.join(staging, require_store.SCHEMA_FILE));
 	targets.push(active);
 	return targets;
 }
@@ -1302,7 +2121,7 @@ async function unlinkIfPresent(target) {
 *  preserved verbatim. */
 async function removeViewFromSchemas(collection, viewId, workspaceRoot, safeSlug) {
 	const base = await canonicalBase(collection, workspaceRoot, safeSlug);
-	const canonical = node_path.default.join(base, require_discovery.SCHEMA_FILE);
+	const canonical = node_path.default.join(base, require_store.SCHEMA_FILE);
 	const parsed = JSON.parse(await (0, node_fs_promises.readFile)(canonical, "utf-8"));
 	const next = require_dist.isRecord(parsed) && require_dist.isUnknownArray(parsed.views) ? {
 		...parsed,
@@ -1316,8 +2135,8 @@ async function removeViewFromSchemas(collection, viewId, workspaceRoot, safeSlug
 *  refused (read-only / re-seeded on boot), consistent with `deleteCollection`. */
 async function deleteCustomView(collection, viewId, opts = {}) {
 	if (collection.source === "user") return { kind: "user-scope" };
-	if (require_discovery.isPresetSlug(collection.slug)) return { kind: "preset" };
-	const safeSlug = require_discovery.safeSlugName(collection.slug);
+	if (require_store.isPresetSlug(collection.slug)) return { kind: "preset" };
+	const safeSlug = require_store.safeSlugName(collection.slug);
 	if (safeSlug === null) return {
 		kind: "unsafe-path",
 		viewId
@@ -1328,8 +2147,8 @@ async function deleteCustomView(collection, viewId, opts = {}) {
 		kind: "not-found",
 		viewId
 	};
-	const workspaceRoot = opts.workspaceRoot ?? require_discovery.getWorkspaceRoot();
-	const htmlPath = require_discovery.resolveTemplatePath(await canonicalBase(collection, workspaceRoot, safeSlug), view.file);
+	const workspaceRoot = opts.workspaceRoot ?? require_store.getWorkspaceRoot();
+	const htmlPath = require_store.resolveTemplatePath(await canonicalBase(collection, workspaceRoot, safeSlug), view.file);
 	if (htmlPath === null) return {
 		kind: "unsafe-path",
 		viewId
@@ -1556,7 +2375,7 @@ var SCHEMA_DOCS_PROBE_SLUG = "_";
 /** Resolve the workspace root the same way every collections call does:
 *  the injected override (tests) or the configured collection host. */
 function resolveBase(deps) {
-	return deps.workspaceRoot ?? require_discovery.getWorkspaceRoot();
+	return deps.workspaceRoot ?? require_store.getWorkspaceRoot();
 }
 /** Where a collection skill is authored in THIS root, and therefore both which
 *  authoring guide `schemaDocs` serves and where `getSchema` / `putSchema`
@@ -1570,7 +2389,7 @@ function resolveBase(deps) {
 *  from there, so the tool would silently contradict its own documentation.
 *  Staged requires BOTH to agree; anything else is direct. */
 function authoringTarget(deps, slug) {
-	const stagingDir = deps.stagedSkillAuthoring === false ? null : require_discovery.stagingSkillDir(resolveBase(deps), slug);
+	const stagingDir = deps.stagedSkillAuthoring === false ? null : require_store.stagingSkillDir(resolveBase(deps), slug);
 	return {
 		variant: stagingDir === null ? "direct" : "staged",
 		stagingDir
@@ -1613,7 +2432,7 @@ async function recordIssuesWarning(collection, deps) {
 	return `${issues.length} record file(s) have data problems and are missing from this result. Fix each (Read → correct → Write):\n${lines}`;
 }
 async function loadRequestedItems(collection, ids, deps) {
-	const store = require_discovery.storeFor(collection, { workspaceRoot: deps.workspaceRoot });
+	const store = require_store.storeFor(collection, { workspaceRoot: deps.workspaceRoot });
 	if (!ids) return {
 		items: await store.list(),
 		missing: []
@@ -1622,7 +2441,7 @@ async function loadRequestedItems(collection, ids, deps) {
 	const missing = [];
 	for (const recordId of ids) {
 		const item = await store.read(recordId).catch((err) => {
-			if (require_discovery.isBackendUnavailable(err)) throw err;
+			if (require_store.isBackendUnavailable(err)) throw err;
 			return null;
 		});
 		if (item) items.push(item);
@@ -1687,7 +2506,7 @@ async function mergeWithExisting(collection, store, record, itemId) {
 	try {
 		existing = await store.read(itemId);
 	} catch (err) {
-		if (require_discovery.isBackendUnavailable(err)) throw err;
+		if (require_store.isBackendUnavailable(err)) throw err;
 		return `'${itemId}' has a malformed stored file — mode "merge" needs to read it; fix the file (Read → correct → Write) or replace it whole with "upsert"`;
 	}
 	if (!existing) return `'${itemId}' not found — mode "merge" updates an existing record; use "upsert" or "create" to add it`;
@@ -1702,7 +2521,7 @@ async function mergeWithExisting(collection, store, record, itemId) {
 }
 async function putOneItem(collection, store, write, record, mode, deps) {
 	const { schema } = collection;
-	const itemId = require_discovery.resolveCreateItemId(schema, record);
+	const itemId = require_store.resolveCreateItemId(schema, record);
 	const reject = (about, problem) => ({ rejected: {
 		id: require_promptSafety.defangForPrompt(about),
 		problem: require_promptSafety.defangForPrompt(problem)
@@ -1733,7 +2552,7 @@ async function putOneItem(collection, store, write, record, mode, deps) {
 *  `runCollectionQuery`, shared with the desktop custom view's `/query`
 *  route so the two surfaces can never drift. */
 async function handleQueryItems(collection, queryArg, deps) {
-	const parsed = require_discovery.CollectionQueryZ.safeParse(queryArg);
+	const parsed = require_store.CollectionQueryZ.safeParse(queryArg);
 	if (!parsed.success) return `manageCollection: \`query\` rejected — fix and retry:\n${parsed.error.issues.slice(0, 20).map((issue) => `- ${issue.path.map(String).join(".") || "(root)"}: ${require_promptSafety.defangForPrompt(issue.message)}`).join("\n")}`;
 	const rows = await runCollectionQuery(collection, parsed.data, { workspaceRoot: deps.workspaceRoot });
 	return JSON.stringify({
@@ -1743,9 +2562,9 @@ async function handleQueryItems(collection, queryArg, deps) {
 	});
 }
 async function handlePutItems(collection, args, deps) {
-	const store = require_discovery.storeFor(collection, { workspaceRoot: deps.workspaceRoot });
+	const store = require_store.storeFor(collection, { workspaceRoot: deps.workspaceRoot });
 	const { write } = store;
-	if (!write) return `manageCollection: ${require_discovery.readOnlyRefusal(collection.slug)} (its records are the rows of '${collection.schema.dataSource?.path}'; edit that file to change the data).`;
+	if (!write) return `manageCollection: ${require_store.readOnlyRefusal(collection.slug)} (its records are the rows of '${collection.schema.dataSource?.path}'; edit that file to change the data).`;
 	const written = [];
 	const rejected = [];
 	for (const record of args.items) {
@@ -1764,8 +2583,8 @@ async function handlePutItems(collection, args, deps) {
 *  absent `delete` IS the refusal), and the same per-id result shape so a
 *  partially-bad batch reports per id instead of failing whole. */
 async function handleDeleteItems(collection, ids, deps) {
-	const { delete: removeItem } = require_discovery.storeFor(collection, { workspaceRoot: deps.workspaceRoot });
-	if (!removeItem) return `manageCollection: ${require_discovery.readOnlyRefusal(collection.slug)} (its records are the rows of '${collection.schema.dataSource?.path}'; edit that file to change the data).`;
+	const { delete: removeItem } = require_store.storeFor(collection, { workspaceRoot: deps.workspaceRoot });
+	if (!removeItem) return `manageCollection: ${require_store.readOnlyRefusal(collection.slug)} (its records are the rows of '${collection.schema.dataSource?.path}'; edit that file to change the data).`;
 	const deleted = [];
 	const rejected = [];
 	for (const itemId of ids) {
@@ -1834,6 +2653,32 @@ async function handleGetOntology(deps) {
 		collections
 	});
 }
+/** Publish this repository's `app.json` + shared schemas to its Firestore app.
+*
+*  Named as a whole-app action because it IS one: publish takes the repository
+*  as its unit (one roster, one public config, every shared collection), so it
+*  carries no `slug` and refusing one is not a limitation to work around.
+*
+*  The reply is prose rather than a status code on purpose. This is the one
+*  operation in the collection surface that changes what every member sees the
+*  moment it lands, and the two things the caller has to relay — what will
+*  break, and that `confirm` is how it proceeds anyway — are sentences, not
+*  fields. */
+async function handlePublishApp(deps, confirm) {
+	const result = await publishApp({
+		...deps,
+		confirm
+	});
+	if (!result.ok) {
+		const bullets = result.problems.map((problem) => `- ${problem}`).join("\n");
+		return `${result.partial ? "publish FAILED PART-WAY — some documents are already live:" : "publish refused — nothing was written:"}\n${bullets}`;
+	}
+	const dirtyNote = result.dirty ? " (WORKING TREE DIRTY — the commit does not describe what was published)" : "";
+	const stamp = result.commit ? `commit ${result.commit.slice(0, 12)}${dirtyNote}` : "no commit (not a git repository, or no HEAD)";
+	const brokenCount = result.recordIssuesCapped ? `at least ${result.recordIssues}` : `${result.recordIssues}`;
+	const forced = result.recordIssues > 0 ? ` Published over ${brokenCount} record(s) that do not satisfy the new schema — repair them now; members are reading them.` : "";
+	return `${result.created ? "Created" : "Updated"} app '${result.aid}' and published ${result.cids.length} collection(s): ${result.cids.join(", ")}. Signed ${stamp}. The previous app document is kept in \`previousPublished\` for rollback.${forced}`;
+}
 /** Return the collection-authoring reference (`collection-skills.md`),
 *  rendered by `renderSchemaDocs` — the full doc overflows the agent's
 *  per-result limit, so the default reply is the core guide + a table of
@@ -1854,7 +2699,7 @@ async function handleSchemaDocs(deps, topic) {
 *  fallback for user-scope skills that have no staging copy. Raw text —
 *  not the parsed schema — so the agent edits the true on-disk source. */
 async function handleGetSchema(slug, deps) {
-	const collection = await require_discovery.loadCollection(slug, deps);
+	const collection = await require_store.loadCollection(slug, deps);
 	if (!collection) return unknownCollection(slug);
 	const { stagingDir } = authoringTarget(deps, collection.slug);
 	const candidates = [...stagingDir === null ? [] : [node_path.default.join(stagingDir, SCHEMA_FILE)], node_path.default.join(collection.skillDir, SCHEMA_FILE)];
@@ -1916,11 +2761,11 @@ async function writeAndMirrorSchema(slug, skillDir, schema, deps) {
 *  gate doesn't apply. Returns a one-line reason, or null when the schema
 *  would be accepted. */
 function schemaDiscoveryGate(schema, base) {
-	const primaryField = require_discovery.resolvePrimaryField(schema.fields, schema.primaryKey);
+	const primaryField = require_store.resolvePrimaryField(schema.fields, schema.primaryKey);
 	if (!primaryField) return `primaryKey '${schema.primaryKey}' is not one of the declared fields`;
 	if (primaryField.primary !== true) return `the primaryKey field '${schema.primaryKey}' must be flagged \`primary: true\``;
-	if (schema.dataPath !== void 0 && require_discovery.resolveDataDir(schema.dataPath, base) === null) return `dataPath '${schema.dataPath}' escapes the workspace`;
-	if (schema.dataSource !== void 0 && require_discovery.resolveDataDir(schema.dataSource.path, base) === null) return `dataSource.path '${schema.dataSource.path}' escapes the workspace`;
+	if (schema.dataPath !== void 0 && require_store.resolveDataDir(schema.dataPath, base) === null) return `dataPath '${schema.dataPath}' escapes the workspace`;
+	if (schema.dataSource !== void 0 && require_store.resolveDataDir(schema.dataSource.path, base) === null) return `dataSource.path '${schema.dataSource.path}' escapes the workspace`;
 	return null;
 }
 /** Validate a schema against CollectionSchemaZ and, on success, persist it.
@@ -1928,11 +2773,11 @@ function schemaDiscoveryGate(schema, base) {
 *  the root's authoring dir (the normal create flow), not through here. */
 async function handlePutSchema(slug, schemaArg, deps) {
 	if (!schemaArg || typeof schemaArg !== "object" || Array.isArray(schemaArg)) return "manageCollection: `schema` is required for putSchema — the full collection schema object.";
-	const collection = await require_discovery.loadCollection(slug, deps);
+	const collection = await require_store.loadCollection(slug, deps);
 	if (!collection) return `manageCollection: unknown collection '${require_promptSafety.defangForPrompt(slug)}' — create it by writing SKILL.md + ${SCHEMA_FILE} under ${authoringDirLabel(deps, require_promptSafety.defangForPrompt(slug))}, then edit it here.`;
 	const refusal = schemaEditRefusal(collection, slug, deps);
 	if (refusal) return refusal;
-	const parsed = require_discovery.CollectionSchemaZ.safeParse(schemaArg);
+	const parsed = require_store.CollectionSchemaZ.safeParse(schemaArg);
 	if (!parsed.success) return formatSchemaIssues(parsed.error.issues);
 	const gate = schemaDiscoveryGate(parsed.data, resolveBase(deps));
 	if (gate) return `manageCollection: schema rejected — ${gate} (call schemaDocs for the field reference). It passes basic validation but discovery would skip it, hiding the collection.`;
@@ -1942,7 +2787,7 @@ async function handlePutSchema(slug, schemaArg, deps) {
 		written: true
 	});
 }
-var MANAGE_COLLECTION_PROMPT = "Use `manageCollection` instead of raw Read/Write/Edit when working with a collection's records OR its schema (raw file I/O stays available as the escape hatch). Before authoring or changing a collection's `schema.json`, call `schemaDocs` to load the field/DSL reference — the default reply is the core authoring guide plus a table of contents; fetch advanced sections (actions, bells, calendar/kanban views, dataSource, storage) by passing their heading as `topic` rather than dumping `topic: \"all\"`. Then read with `getSchema` and write with `putSchema` — `putSchema` validates the whole schema before writing and returns actionable errors instead of silently failing discovery's validation. `getItems` is the only way to see computed values — `derived` fields (e.g. a portfolio's value), `toggle` projections, and `embed` records are host-computed and never present in the stored JSON files. On large collections pass `ids` and/or `fields` to keep the result small. For a question that spans collections (\"which clients have unpaid invoices?\"), start with `getOntology`: it lists every collection with its primaryKey, record count, and outbound `ref`/`embed` relations, so you know which collections to join before reading any records. `putItems` validates every row against the schema before writing (required fields, enum values, primaryKey = record id) and returns `{ written, rejected }`; fix each rejected row using its `problem` text and retry just those rows. Never include computed fields in a row you write. To update a few fields of an existing record, use `mode: \"merge\"` with a partial row ({ id, <changed fields> }) — the default upsert replaces the WHOLE record, so a partial upsert would silently erase every optional field it omits. `deleteItems` removes records by id and returns `{ deleted, rejected }`; an id that doesn't exist comes back rejected rather than counted as deleted, so check `rejected` before reporting a deletion as done. Answer aggregation questions (counts, sums, averages, group-bys) with `queryItems` on ANY collection — on a dataSource (CSV) collection it scans the whole file (getItems is row-capped, so aggregates computed from its output can be silently wrong on large files); on a file-backed collection it aggregates the enriched records, so computed fields (derived/rollup/toggle) are queryable columns.";
+var MANAGE_COLLECTION_PROMPT = "Use `manageCollection` instead of raw Read/Write/Edit when working with a collection's records OR its schema (raw file I/O stays available as the escape hatch). Before authoring or changing a collection's `schema.json`, call `schemaDocs` to load the field/DSL reference — the default reply is the core authoring guide plus a table of contents; fetch advanced sections (actions, bells, calendar/kanban views, dataSource, storage) by passing their heading as `topic` rather than dumping `topic: \"all\"`. Then read with `getSchema` and write with `putSchema` — `putSchema` validates the whole schema before writing and returns actionable errors instead of silently failing discovery's validation. `getItems` is the only way to see computed values — `derived` fields (e.g. a portfolio's value), `toggle` projections, and `embed` records are host-computed and never present in the stored JSON files. On large collections pass `ids` and/or `fields` to keep the result small. For a question that spans collections (\"which clients have unpaid invoices?\"), start with `getOntology`: it lists every collection with its primaryKey, record count, and outbound `ref`/`embed` relations, so you know which collections to join before reading any records. `putItems` validates every row against the schema before writing (required fields, enum values, primaryKey = record id) and returns `{ written, rejected }`; fix each rejected row using its `problem` text and retry just those rows. Never include computed fields in a row you write. To update a few fields of an existing record, use `mode: \"merge\"` with a partial row ({ id, <changed fields> }) — the default upsert replaces the WHOLE record, so a partial upsert would silently erase every optional field it omits. `deleteItems` removes records by id and returns `{ deleted, rejected }`; an id that doesn't exist comes back rejected rather than counted as deleted, so check `rejected` before reporting a deletion as done. `publishApp` publishes the whole repository — its `app.json` (member roster, public read/submit configuration) and every shared collection's schema — to the app's Firestore. It is the ONE operation here that changes what every member sees the moment it runs, and it cannot be undone by reverting a commit: publishing again is the only undo (the previous app document is kept as `previousPublished`). Call it when the user asks to publish, invite, or open an app; never as a follow-up to an edit the user did not ask you to ship. Its refusals are the product, not an obstacle — relay them verbatim, and do not work around one by rewriting `app.json` until the user has said what they actually want. If it reports live records the new schemas would break, show the user that list and ask before re-running with `confirm`. Answer aggregation questions (counts, sums, averages, group-bys) with `queryItems` on ANY collection — on a dataSource (CSV) collection it scans the whole file (getItems is row-capped, so aggregates computed from its output can be silently wrong on large files); on a file-backed collection it aggregates the enriched records, so computed fields (derived/rollup/toggle) are queryable columns.";
 /** Validate getItems' optional `ids`/`fields` args, then delegate. */
 async function dispatchGetItems(collection, args, deps) {
 	const ids = optionalStringArray(args.ids, "ids");
@@ -1979,7 +2824,7 @@ async function manageCollectionHandler(deps, args) {
 	try {
 		return await dispatchManageCollection(deps, args);
 	} catch (err) {
-		if (require_discovery.isBackendUnavailable(err)) return `manageCollection: ${err.message}`;
+		if (require_store.isBackendUnavailable(err)) return `manageCollection: ${err.message}`;
 		throw err;
 	}
 }
@@ -1987,18 +2832,19 @@ async function dispatchManageCollection(deps, args) {
 	const action = typeof args.action === "string" ? args.action : "";
 	if (action === "schemaDocs") return handleSchemaDocs(deps, typeof args.topic === "string" ? args.topic : void 0);
 	if (action === "getOntology") return handleGetOntology(deps);
+	if (action === "publishApp") return handlePublishApp(deps, args.confirm === true);
 	const slug = typeof args.slug === "string" ? args.slug.trim() : "";
 	if (!slug) return "manageCollection: `slug` is required (the collection's slug).";
 	if (action === "getSchema") return handleGetSchema(slug, deps);
 	if (action === "putSchema") return handlePutSchema(slug, args.schema, deps);
-	if (!RECORD_ACTIONS.has(action)) return "manageCollection: `action` must be \"getItems\", \"putItems\", \"deleteItems\", \"queryItems\", \"getOntology\", \"schemaDocs\", \"getSchema\", or \"putSchema\".";
-	const collection = await require_discovery.loadCollection(slug, deps);
+	if (!RECORD_ACTIONS.has(action)) return "manageCollection: `action` must be \"getItems\", \"putItems\", \"deleteItems\", \"queryItems\", \"getOntology\", \"schemaDocs\", \"getSchema\", \"putSchema\", or \"publishApp\".";
+	const collection = await require_store.loadCollection(slug, deps);
 	if (!collection) return unknownCollection(slug);
 	return dispatchRecordAction(action, collection, args, deps);
 }
 var MANAGE_COLLECTION_DEFINITION = {
 	name: "manageCollection",
-	description: "Read and write a schema-driven collection through the host — both its records and its structure. getItems returns records WITH computed values (derived formulas, toggles, embeds) the stored JSON files don't contain; putItems validates each row against the schema before writing; deleteItems removes records by id. getOntology maps the whole workspace: every collection with its record count and outbound ref/embed relations — call it first for cross-collection questions. schemaDocs returns the collection-authoring reference — the core guide plus a table of contents by default; pass `topic` for a specific section. getSchema/putSchema read and validate-then-write the collection's schema.json. Prefer it over raw file I/O on collections.",
+	description: "Read and write a schema-driven collection through the host — both its records and its structure. getItems returns records WITH computed values (derived formulas, toggles, embeds) the stored JSON files don't contain; putItems validates each row against the schema before writing; deleteItems removes records by id. getOntology maps the whole workspace: every collection with its record count and outbound ref/embed relations — call it first for cross-collection questions. schemaDocs returns the collection-authoring reference — the core guide plus a table of contents by default; pass `topic` for a specific section. getSchema/putSchema read and validate-then-write the collection's schema.json. publishApp publishes the repository's app.json + shared schemas to Firestore, where every member sees them immediately -- it refuses declarations that would be silently permissive or silently deny everyone, and refuses to publish over records the new schemas would break unless `confirm` is set. Prefer it over raw file I/O on collections.",
 	inputSchema: {
 		type: "object",
 		properties: {
@@ -2012,7 +2858,8 @@ var MANAGE_COLLECTION_DEFINITION = {
 					"getOntology",
 					"schemaDocs",
 					"getSchema",
-					"putSchema"
+					"putSchema",
+					"publishApp"
 				],
 				description: "What to do."
 			},
@@ -2048,6 +2895,10 @@ var MANAGE_COLLECTION_DEFINITION = {
 				type: "object",
 				description: "putSchema: the full collection schema object (same shape as schema.json — title, icon, dataPath, primaryKey, fields, …). Call getSchema first for the current one, and schemaDocs for the field DSL."
 			},
+			confirm: {
+				type: "boolean",
+				description: "publishApp: publish even though existing records fail the schemas being published. Omit it first — the refusal lists what would break, and that list is the thing to show the user before asking."
+			},
 			topic: {
 				type: "string",
 				description: "schemaDocs: fetch one section of the reference by heading (case-insensitive substring — e.g. \"field types\", \"kanban\", \"calendar\", \"dataSource\"). Omit for the core authoring guide plus a table of contents of every section; \"all\" returns the full document (large — it can exceed your tool-result limit)."
@@ -2069,6 +2920,30 @@ function makeManageCollectionTool(deps = {}) {
 	};
 }
 //#endregion
+Object.defineProperty(exports, "APPS_COLLECTION", {
+	enumerable: true,
+	get: function() {
+		return APPS_COLLECTION;
+	}
+});
+Object.defineProperty(exports, "APP_ROLES", {
+	enumerable: true,
+	get: function() {
+		return APP_ROLES;
+	}
+});
+Object.defineProperty(exports, "AuthoredAppZ", {
+	enumerable: true,
+	get: function() {
+		return AuthoredAppZ;
+	}
+});
+Object.defineProperty(exports, "MAX_RECORD_ISSUES", {
+	enumerable: true,
+	get: function() {
+		return MAX_RECORD_ISSUES;
+	}
+});
 Object.defineProperty(exports, "MAX_SCHEMA_ISSUES", {
 	enumerable: true,
 	get: function() {
@@ -2087,18 +2962,48 @@ Object.defineProperty(exports, "ONE_SECOND_MS", {
 		return ONE_SECOND_MS;
 	}
 });
+Object.defineProperty(exports, "PUBLIC_CONFIG_DOC", {
+	enumerable: true,
+	get: function() {
+		return PUBLIC_CONFIG_DOC;
+	}
+});
+Object.defineProperty(exports, "STORE_UNREADABLE", {
+	enumerable: true,
+	get: function() {
+		return STORE_UNREADABLE;
+	}
+});
 Object.defineProperty(exports, "advanceTriggerDate", {
 	enumerable: true,
 	get: function() {
 		return advanceTriggerDate;
 	}
 });
+Object.defineProperty(exports, "appConfigPath", {
+	enumerable: true,
+	get: function() {
+		return appConfigPath;
+	}
+});
+Object.defineProperty(exports, "appSchemasPath", {
+	enumerable: true,
+	get: function() {
+		return appSchemasPath;
+	}
+});
 Object.defineProperty(exports, "applyMutateAction", {
 	enumerable: true,
 	get: function() {
 		return applyMutateAction;
 	}
 });
+Object.defineProperty(exports, "bindsSubmitterIdentity", {
+	enumerable: true,
+	get: function() {
+		return bindsSubmitterIdentity;
+	}
+});
 Object.defineProperty(exports, "buildActionSeedPrompt", {
 	enumerable: true,
 	get: function() {
@@ -2195,18 +3100,42 @@ Object.defineProperty(exports, "maybeSpawnSuccessor", {
 		return maybeSpawnSuccessor;
 	}
 });
+Object.defineProperty(exports, "parseAuthoredApp", {
+	enumerable: true,
+	get: function() {
+		return parseAuthoredApp;
+	}
+});
 Object.defineProperty(exports, "parseCivil", {
 	enumerable: true,
 	get: function() {
 		return parseCivil;
 	}
 });
+Object.defineProperty(exports, "projectApp", {
+	enumerable: true,
+	get: function() {
+		return projectApp;
+	}
+});
 Object.defineProperty(exports, "promptPathsFor", {
 	enumerable: true,
 	get: function() {
 		return promptPathsFor;
 	}
 });
+Object.defineProperty(exports, "publishApp", {
+	enumerable: true,
+	get: function() {
+		return publishApp;
+	}
+});
+Object.defineProperty(exports, "publishProblems", {
+	enumerable: true,
+	get: function() {
+		return publishProblems;
+	}
+});
 Object.defineProperty(exports, "readCustomViewHtml", {
 	enumerable: true,
 	get: function() {
@@ -2274,4 +3203,4 @@ Object.defineProperty(exports, "validateRecordObject", {
 	}
 });
 
-//# sourceMappingURL=server-9mFaGLdq.cjs.map
+//# sourceMappingURL=server-CWZyg8fn.cjs.map