@mulmoclaude/core 3.6.0 → 3.7.0

package/dist/collection/server/host.d.ts

@@ -121,6 +121,17 @@ export interface CollectionHost {
 export interface FirestoreHandle {
     docs: FirestoreDocs;
     email: string;
+    /** The signed-in Firebase uid.
+     *
+     *  The EMAIL is the principal the roster is keyed by, and it is what every
+     *  record operation needs. The uid is needed by exactly one caller —
+     *  `publish` — because the app document's `owner` is a uid: the rules
+     *  require `owner == request.auth.uid` when the app is created and require
+     *  it unchanged afterwards. Required rather than optional so a host cannot
+     *  wire a session that can read and write records but silently cannot
+     *  create an app; the failure would surface as a permission denial with
+     *  nothing in it about identity. */
+    uid: string;
 }
 /** A collection's records changed on disk. Carries the `slug` so the host can
  *  publish on a per-collection channel; `ids` lists the affected record ids

package/dist/collection/server/index.cjs

@@ -1,102 +1,115 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_root = require("../../root-rPH6FGDT.cjs");
 const require_calendarGrid = require("../../calendarGrid-DGILaVxI.cjs");
-const require_discovery = require("../../discovery-Cw5xWzZD.cjs");
+const require_store = require("../../store-5_P_NsGa.cjs");
+const require_server = require("../../server-CWZyg8fn.cjs");
 const require_templatePath = require("../../templatePath-27vUZowm.cjs");
-const require_server = require("../../server-9mFaGLdq.cjs");
-exports.APP_MANIFEST_FILE = require_discovery.APP_MANIFEST_FILE;
-exports.BackendUnavailableError = require_discovery.BackendUnavailableError;
-exports.COLLECTION_ROOT_REQUIRED = require_discovery.COLLECTION_ROOT_REQUIRED;
+exports.APPS_COLLECTION = require_server.APPS_COLLECTION;
+exports.APP_MANIFEST_FILE = require_store.APP_MANIFEST_FILE;
+exports.APP_ROLES = require_server.APP_ROLES;
+exports.AuthoredAppZ = require_server.AuthoredAppZ;
+exports.BackendUnavailableError = require_store.BackendUnavailableError;
+exports.COLLECTION_ROOT_REQUIRED = require_store.COLLECTION_ROOT_REQUIRED;
 exports.COMPUTED_TYPES = require_calendarGrid.COMPUTED_TYPES;
-exports.CollectionQueryZ = require_discovery.CollectionQueryZ;
-exports.CollectionSchemaZ = require_discovery.CollectionSchemaZ;
-exports.DEFAULT_QUERY_ROWS = require_discovery.DEFAULT_QUERY_ROWS;
-exports.MAX_CSV_ROWS = require_discovery.MAX_CSV_ROWS;
-exports.MAX_QUERY_ROWS = require_discovery.MAX_QUERY_ROWS;
+exports.CollectionQueryZ = require_store.CollectionQueryZ;
+exports.CollectionSchemaZ = require_store.CollectionSchemaZ;
+exports.DEFAULT_QUERY_ROWS = require_store.DEFAULT_QUERY_ROWS;
+exports.MAX_CSV_ROWS = require_store.MAX_CSV_ROWS;
+exports.MAX_QUERY_ROWS = require_store.MAX_QUERY_ROWS;
+exports.MAX_RECORD_ISSUES = require_server.MAX_RECORD_ISSUES;
 exports.MAX_SCHEMA_ISSUES = require_server.MAX_SCHEMA_ISSUES;
 exports.MAX_UNSELECTIVE_ITEMS = require_server.MAX_UNSELECTIVE_ITEMS;
-exports.SCHEMA_FILE = require_discovery.SCHEMA_FILE;
-exports.acceptParsedSchema = require_discovery.acceptParsedSchema;
+exports.PUBLIC_CONFIG_DOC = require_server.PUBLIC_CONFIG_DOC;
+exports.SCHEMA_FILE = require_store.SCHEMA_FILE;
+exports.STORE_UNREADABLE = require_server.STORE_UNREADABLE;
+exports.acceptParsedSchema = require_store.acceptParsedSchema;
 exports.advanceTriggerDate = require_server.advanceTriggerDate;
-exports.appManifestReason = require_discovery.appManifestReason;
+exports.appConfigPath = require_server.appConfigPath;
+exports.appManifestReason = require_store.appManifestReason;
+exports.appSchemasPath = require_server.appSchemasPath;
 exports.applyMutateAction = require_server.applyMutateAction;
+exports.bindsSubmitterIdentity = require_server.bindsSubmitterIdentity;
 exports.buildActionSeedPrompt = require_server.buildActionSeedPrompt;
 exports.buildCollectionActionSeedPrompt = require_server.buildCollectionActionSeedPrompt;
 exports.buildWorkspaceOntology = require_server.buildWorkspaceOntology;
 exports.canonicalRoot = require_root.canonicalRoot;
-exports.collectionChangeKey = require_discovery.collectionChangeKey;
-exports.collectionChangePayload = require_discovery.collectionChangePayload;
-exports.collectionWritable = require_discovery.collectionWritable;
-exports.compileCsvQuery = require_discovery.compileCsvQuery;
-exports.compileJsonlQuery = require_discovery.compileJsonlQuery;
+exports.collectionChangeKey = require_store.collectionChangeKey;
+exports.collectionChangePayload = require_store.collectionChangePayload;
+exports.collectionWritable = require_store.collectionWritable;
+exports.compileCsvQuery = require_store.compileCsvQuery;
+exports.compileJsonlQuery = require_store.compileJsonlQuery;
 exports.compileRecordZ = require_server.compileRecordZ;
 exports.computeCollectionIcon = require_server.computeCollectionIcon;
 exports.computeSuccessor = require_server.computeSuccessor;
-exports.configureCollectionHost = require_discovery.configureCollectionHost;
-exports.csvRowToItem = require_discovery.csvRowToItem;
+exports.configureCollectionHost = require_store.configureCollectionHost;
+exports.csvRowToItem = require_store.csvRowToItem;
 exports.daysInMonth = require_server.daysInMonth;
-exports.decodeCsvRecordId = require_discovery.decodeCsvRecordId;
-exports.dedupeByRecordId = require_discovery.dedupeByRecordId;
+exports.decodeCsvRecordId = require_store.decodeCsvRecordId;
+exports.dedupeByRecordId = require_store.dedupeByRecordId;
 exports.deleteCollection = require_server.deleteCollection;
 exports.deleteCollectionRefusalMessage = require_server.deleteCollectionRefusalMessage;
 exports.deleteCustomView = require_server.deleteCustomView;
-exports.deleteItem = require_discovery.deleteItem;
-exports.discoverCollections = require_discovery.discoverCollections;
-exports.encodeCsvRecordId = require_discovery.encodeCsvRecordId;
+exports.deleteItem = require_store.deleteItem;
+exports.discoverCollections = require_store.discoverCollections;
+exports.encodeCsvRecordId = require_store.encodeCsvRecordId;
 exports.enrichItems = require_server.enrichItems;
-exports.firestoreHandle = require_discovery.firestoreHandle;
+exports.firestoreHandle = require_store.firestoreHandle;
 exports.firstMutateParamProblem = require_server.firstMutateParamProblem;
 exports.formatCivil = require_server.formatCivil;
-exports.generateItemId = require_discovery.generateItemId;
-exports.getWorkspaceRoot = require_discovery.getWorkspaceRoot;
-exports.isBackendUnavailable = require_discovery.isBackendUnavailable;
-exports.isContainedInRoot = require_discovery.isContainedInRoot;
-exports.isRegularFile = require_discovery.isRegularFile;
+exports.generateItemId = require_store.generateItemId;
+exports.getWorkspaceRoot = require_store.getWorkspaceRoot;
+exports.isBackendUnavailable = require_store.isBackendUnavailable;
+exports.isContainedInRoot = require_store.isContainedInRoot;
+exports.isRegularFile = require_store.isRegularFile;
 exports.isSafeActionTemplatePath = require_templatePath.isSafeActionTemplatePath;
 exports.isSafeCustomViewI18nPath = require_templatePath.isSafeCustomViewI18nPath;
 exports.isSafeCustomViewPath = require_templatePath.isSafeCustomViewPath;
 exports.isSafeTemplatePath = require_templatePath.isSafeTemplatePath;
 exports.isTriggerDue = require_server.isTriggerDue;
-exports.itemFilePath = require_discovery.itemFilePath;
-exports.listItems = require_discovery.listItems;
-exports.loadAppManifest = require_discovery.loadAppManifest;
-exports.loadCollection = require_discovery.loadCollection;
-exports.localCollectionKey = require_discovery.localCollectionKey;
-exports.log = require_discovery.log;
+exports.itemFilePath = require_store.itemFilePath;
+exports.listItems = require_store.listItems;
+exports.loadAppManifest = require_store.loadAppManifest;
+exports.loadCollection = require_store.loadCollection;
+exports.localCollectionKey = require_store.localCollectionKey;
+exports.log = require_store.log;
 exports.makeManageCollectionTool = require_server.makeManageCollectionTool;
 exports.maybeSpawnSuccessor = require_server.maybeSpawnSuccessor;
-exports.normalizeCsvValue = require_discovery.normalizeCsvValue;
-exports.pageFromFullRead = require_discovery.pageFromFullRead;
-exports.parseAppManifest = require_discovery.parseAppManifest;
+exports.normalizeCsvValue = require_store.normalizeCsvValue;
+exports.pageFromFullRead = require_store.pageFromFullRead;
+exports.parseAppManifest = require_store.parseAppManifest;
+exports.parseAuthoredApp = require_server.parseAuthoredApp;
 exports.parseCivil = require_server.parseCivil;
-exports.peekWorkspaceRoot = require_discovery.peekWorkspaceRoot;
-exports.projectItemFields = require_discovery.projectItemFields;
+exports.peekWorkspaceRoot = require_store.peekWorkspaceRoot;
+exports.projectApp = require_server.projectApp;
+exports.projectItemFields = require_store.projectItemFields;
 exports.promptPathsFor = require_server.promptPathsFor;
-exports.publishCollectionChange = require_discovery.publishCollectionChange;
+exports.publishApp = require_server.publishApp;
+exports.publishCollectionChange = require_store.publishCollectionChange;
+exports.publishProblems = require_server.publishProblems;
 exports.readCustomViewHtml = require_server.readCustomViewHtml;
 exports.readCustomViewI18n = require_server.readCustomViewI18n;
-exports.readItem = require_discovery.readItem;
-exports.readOnlyRefusal = require_discovery.readOnlyRefusal;
+exports.readItem = require_store.readItem;
+exports.readOnlyRefusal = require_store.readOnlyRefusal;
 exports.readSkillTemplate = require_server.readSkillTemplate;
 exports.recordFieldProblem = require_server.recordFieldProblem;
-exports.resolveCreateItemId = require_discovery.resolveCreateItemId;
-exports.resolveDataDir = require_discovery.resolveDataDir;
+exports.resolveCreateItemId = require_store.resolveCreateItemId;
+exports.resolveDataDir = require_store.resolveDataDir;
 exports.resolveEvery = require_server.resolveEvery;
-exports.resolvePrimaryField = require_discovery.resolvePrimaryField;
-exports.resolveTemplatePath = require_discovery.resolveTemplatePath;
+exports.resolvePrimaryField = require_store.resolvePrimaryField;
+exports.resolveTemplatePath = require_store.resolveTemplatePath;
 exports.runCollectionQuery = require_server.runCollectionQuery;
 exports.runQueryOverRows = require_server.runQueryOverRows;
-exports.safeRecordId = require_discovery.safeRecordId;
-exports.safeSlugName = require_discovery.safeSlugName;
+exports.safeRecordId = require_store.safeRecordId;
+exports.safeSlugName = require_store.safeSlugName;
 exports.schemaRelations = require_server.schemaRelations;
-exports.setCollectionChangePublisher = require_discovery.setCollectionChangePublisher;
-exports.setFirestoreAccessor = require_discovery.setFirestoreAccessor;
-exports.sharedCollectionChangePayload = require_discovery.sharedCollectionChangePayload;
-exports.sharedItemsPath = require_discovery.sharedItemsPath;
-exports.storeFor = require_discovery.storeFor;
+exports.setCollectionChangePublisher = require_store.setCollectionChangePublisher;
+exports.setFirestoreAccessor = require_store.setFirestoreAccessor;
+exports.sharedCollectionChangePayload = require_store.sharedCollectionChangePayload;
+exports.sharedItemsPath = require_store.sharedItemsPath;
+exports.storeFor = require_store.storeFor;
 exports.successorId = require_server.successorId;
-exports.toDetail = require_discovery.toDetail;
-exports.toSummary = require_discovery.toSummary;
+exports.toDetail = require_store.toDetail;
+exports.toSummary = require_store.toSummary;
 exports.validateCollectionRecords = require_server.validateCollectionRecords;
 exports.validateRecordObject = require_server.validateRecordObject;
-exports.writeItem = require_discovery.writeItem;
+exports.writeItem = require_store.writeItem;

package/dist/collection/server/index.d.ts

@@ -2,6 +2,10 @@ export { configureCollectionHost, canonicalRoot, getWorkspaceRoot, peekWorkspace
 export type { FirestoreDoc, FirestoreDocs } from './firestoreDocs';
 export { sharedItemsPath } from './firestoreStore';
 export { loadAppManifest, parseAppManifest, appManifestReason, APP_MANIFEST_FILE, type AppManifest, type AppManifestResult } from './appManifest';
+export { AuthoredAppZ, parseAuthoredApp, APP_ROLES, type AuthoredApp, type AuthoredCollectionConfig, type AuthoredMail, type AuthoredSubmit, } from './publishManifest';
+export { projectApp, APPS_COLLECTION, PUBLIC_CONFIG_DOC, appConfigPath, appSchemasPath, type PublishStamp, type PublishedApp, type PublishedConfigDoc, type PublishedSchemaDoc, } from './publishProject';
+export { publishProblems, bindsSubmitterIdentity, type PublishableCollection } from './publishChecks';
+export { publishApp, type PublishOptions, type PublishResult } from './publish';
 export type { LoadedCollection } from './discoveredCollection';
 export * from './paths';
 export * from './templatePath';

package/dist/collection/server/index.js

@@ -1,6 +1,6 @@
 import { t as canonicalRoot } from "../../root-BMroU_mB.js";
 import { j as COMPUTED_TYPES } from "../../calendarGrid-CQ8MVSRb.js";
-import { A as readItem, B as SCHEMA_FILE, C as CollectionQueryZ, D as generateItemId, E as deleteItem, F as loadAppManifest, G as safeRecordId, H as itemFilePath, I as parseAppManifest, J as isBackendUnavailable, K as safeSlugName, L as sharedItemsPath, M as writeItem, N as APP_MANIFEST_FILE, O as isRegularFile, P as appManifestReason, Q as collectionChangePayload, R as pageFromFullRead, S as compileJsonlQuery, T as MAX_QUERY_ROWS, U as resolveDataDir, V as isContainedInRoot, W as resolveTemplatePath, Y as COLLECTION_ROOT_REQUIRED, Z as collectionChangeKey, _ as dedupeByRecordId, a as toDetail, at as log, ct as publishCollectionChange, d as storeFor, dt as sharedCollectionChangePayload, et as configureCollectionHost, g as decodeCsvRecordId, h as csvRowToItem, i as resolvePrimaryField, it as localCollectionKey, j as resolveCreateItemId, k as listItems, l as collectionWritable, lt as setCollectionChangePublisher, n as discoverCollections, nt as getWorkspaceRoot, o as toSummary, ot as peekWorkspaceRoot, p as MAX_CSV_ROWS, q as BackendUnavailableError, r as loadCollection, s as CollectionSchemaZ, t as acceptParsedSchema, tt as firestoreHandle, u as readOnlyRefusal, ut as setFirestoreAccessor, v as encodeCsvRecordId, w as DEFAULT_QUERY_ROWS, x as compileCsvQuery, y as normalizeCsvValue, z as projectItemFields } from "../../discovery-CdkaURVY.js";
+import { A as toSummary, B as SCHEMA_FILE, C as resolveCreateItemId, D as loadCollection, E as discoverCollections, F as loadAppManifest, G as safeRecordId, H as itemFilePath, I as parseAppManifest, J as isBackendUnavailable, K as safeSlugName, L as sharedItemsPath, N as APP_MANIFEST_FILE, O as resolvePrimaryField, P as appManifestReason, Q as collectionChangePayload, R as pageFromFullRead, S as readItem, T as acceptParsedSchema, U as resolveDataDir, V as isContainedInRoot, W as resolveTemplatePath, Y as COLLECTION_ROOT_REQUIRED, Z as collectionChangeKey, _ as MAX_QUERY_ROWS, a as MAX_CSV_ROWS, at as log, b as isRegularFile, c as decodeCsvRecordId, ct as publishCollectionChange, d as normalizeCsvValue, dt as sharedCollectionChangePayload, et as configureCollectionHost, g as DEFAULT_QUERY_ROWS, h as CollectionQueryZ, it as localCollectionKey, j as CollectionSchemaZ, k as toDetail, l as dedupeByRecordId, lt as setCollectionChangePublisher, m as compileJsonlQuery, n as readOnlyRefusal, nt as getWorkspaceRoot, ot as peekWorkspaceRoot, p as compileCsvQuery, q as BackendUnavailableError, r as storeFor, s as csvRowToItem, t as collectionWritable, tt as firestoreHandle, u as encodeCsvRecordId, ut as setFirestoreAccessor, v as deleteItem, w as writeItem, x as listItems, y as generateItemId, z as projectItemFields } from "../../store-_61sO8K8.js";
+import { A as readSkillTemplate, B as APPS_COLLECTION, C as enrichItems, D as promptPathsFor, E as buildCollectionActionSeedPrompt, F as validateRecordObject, G as APP_ROLES, H as appConfigPath, I as compileRecordZ, K as AuthoredAppZ, L as recordFieldProblem, M as MAX_RECORD_ISSUES, N as STORE_UNREADABLE, O as readCustomViewHtml, P as validateCollectionRecords, R as bindsSubmitterIdentity, S as runCollectionQuery, T as buildActionSeedPrompt, U as appSchemasPath, V as PUBLIC_CONFIG_DOC, W as projectApp, _ as computeCollectionIcon, a as deleteCollection, b as applyMutateAction, c as computeSuccessor, d as isTriggerDue, f as maybeSpawnSuccessor, h as successorId, i as deleteCustomView, j as publishApp, k as readCustomViewI18n, l as daysInMonth, m as resolveEvery, n as MAX_UNSELECTIVE_ITEMS, o as deleteCollectionRefusalMessage, p as parseCivil, q as parseAuthoredApp, r as makeManageCollectionTool, s as advanceTriggerDate, t as MAX_SCHEMA_ISSUES, u as formatCivil, v as buildWorkspaceOntology, w as runQueryOverRows, x as firstMutateParamProblem, y as schemaRelations, z as publishProblems } from "../../server-B48Jyxcj.js";
 import { i as isSafeTemplatePath, n as isSafeCustomViewI18nPath, r as isSafeCustomViewPath, t as isSafeActionTemplatePath } from "../../templatePath-k_WNbL_Q.js";
-import { A as buildCollectionActionSeedPrompt, C as validateRecordObject, D as enrichItems, E as runCollectionQuery, M as readCustomViewHtml, N as readCustomViewI18n, O as runQueryOverRows, P as readSkillTemplate, S as validateCollectionRecords, T as recordFieldProblem, _ as computeCollectionIcon, a as deleteCollection, b as applyMutateAction, c as computeSuccessor, d as isTriggerDue, f as maybeSpawnSuccessor, h as successorId, i as deleteCustomView, j as promptPathsFor, k as buildActionSeedPrompt, l as daysInMonth, m as resolveEvery, n as MAX_UNSELECTIVE_ITEMS, o as deleteCollectionRefusalMessage, p as parseCivil, r as makeManageCollectionTool, s as advanceTriggerDate, t as MAX_SCHEMA_ISSUES, u as formatCivil, v as buildWorkspaceOntology, w as compileRecordZ, x as firstMutateParamProblem, y as schemaRelations } from "../../server-DdHaX_Uu.js";
-export { APP_MANIFEST_FILE, BackendUnavailableError, COLLECTION_ROOT_REQUIRED, COMPUTED_TYPES, CollectionQueryZ, CollectionSchemaZ, DEFAULT_QUERY_ROWS, MAX_CSV_ROWS, MAX_QUERY_ROWS, MAX_SCHEMA_ISSUES, MAX_UNSELECTIVE_ITEMS, SCHEMA_FILE, acceptParsedSchema, advanceTriggerDate, appManifestReason, applyMutateAction, buildActionSeedPrompt, buildCollectionActionSeedPrompt, buildWorkspaceOntology, canonicalRoot, collectionChangeKey, collectionChangePayload, collectionWritable, compileCsvQuery, compileJsonlQuery, compileRecordZ, computeCollectionIcon, computeSuccessor, configureCollectionHost, csvRowToItem, daysInMonth, decodeCsvRecordId, dedupeByRecordId, deleteCollection, deleteCollectionRefusalMessage, deleteCustomView, deleteItem, discoverCollections, encodeCsvRecordId, enrichItems, firestoreHandle, firstMutateParamProblem, formatCivil, generateItemId, getWorkspaceRoot, isBackendUnavailable, isContainedInRoot, isRegularFile, isSafeActionTemplatePath, isSafeCustomViewI18nPath, isSafeCustomViewPath, isSafeTemplatePath, isTriggerDue, itemFilePath, listItems, loadAppManifest, loadCollection, localCollectionKey, log, makeManageCollectionTool, maybeSpawnSuccessor, normalizeCsvValue, pageFromFullRead, parseAppManifest, parseCivil, peekWorkspaceRoot, projectItemFields, promptPathsFor, publishCollectionChange, readCustomViewHtml, readCustomViewI18n, readItem, readOnlyRefusal, readSkillTemplate, recordFieldProblem, resolveCreateItemId, resolveDataDir, resolveEvery, resolvePrimaryField, resolveTemplatePath, runCollectionQuery, runQueryOverRows, safeRecordId, safeSlugName, schemaRelations, setCollectionChangePublisher, setFirestoreAccessor, sharedCollectionChangePayload, sharedItemsPath, storeFor, successorId, toDetail, toSummary, validateCollectionRecords, validateRecordObject, writeItem };
+export { APPS_COLLECTION, APP_MANIFEST_FILE, APP_ROLES, AuthoredAppZ, BackendUnavailableError, COLLECTION_ROOT_REQUIRED, COMPUTED_TYPES, CollectionQueryZ, CollectionSchemaZ, DEFAULT_QUERY_ROWS, MAX_CSV_ROWS, MAX_QUERY_ROWS, MAX_RECORD_ISSUES, MAX_SCHEMA_ISSUES, MAX_UNSELECTIVE_ITEMS, PUBLIC_CONFIG_DOC, SCHEMA_FILE, STORE_UNREADABLE, acceptParsedSchema, advanceTriggerDate, appConfigPath, appManifestReason, appSchemasPath, applyMutateAction, bindsSubmitterIdentity, buildActionSeedPrompt, buildCollectionActionSeedPrompt, buildWorkspaceOntology, canonicalRoot, collectionChangeKey, collectionChangePayload, collectionWritable, compileCsvQuery, compileJsonlQuery, compileRecordZ, computeCollectionIcon, computeSuccessor, configureCollectionHost, csvRowToItem, daysInMonth, decodeCsvRecordId, dedupeByRecordId, deleteCollection, deleteCollectionRefusalMessage, deleteCustomView, deleteItem, discoverCollections, encodeCsvRecordId, enrichItems, firestoreHandle, firstMutateParamProblem, formatCivil, generateItemId, getWorkspaceRoot, isBackendUnavailable, isContainedInRoot, isRegularFile, isSafeActionTemplatePath, isSafeCustomViewI18nPath, isSafeCustomViewPath, isSafeTemplatePath, isTriggerDue, itemFilePath, listItems, loadAppManifest, loadCollection, localCollectionKey, log, makeManageCollectionTool, maybeSpawnSuccessor, normalizeCsvValue, pageFromFullRead, parseAppManifest, parseAuthoredApp, parseCivil, peekWorkspaceRoot, projectApp, projectItemFields, promptPathsFor, publishApp, publishCollectionChange, publishProblems, readCustomViewHtml, readCustomViewI18n, readItem, readOnlyRefusal, readSkillTemplate, recordFieldProblem, resolveCreateItemId, resolveDataDir, resolveEvery, resolvePrimaryField, resolveTemplatePath, runCollectionQuery, runQueryOverRows, safeRecordId, safeSlugName, schemaRelations, setCollectionChangePublisher, setFirestoreAccessor, sharedCollectionChangePayload, sharedItemsPath, storeFor, successorId, toDetail, toSummary, validateCollectionRecords, validateRecordObject, writeItem };

package/dist/collection/server/manageTool.d.ts

@@ -91,6 +91,10 @@ export declare function makeManageCollectionTool(deps?: ManageCollectionDeps): {
                     type: string;
                     description: string;
                 };
+                confirm: {
+                    type: string;
+                    description: string;
+                };
                 topic: {
                     type: string;
                     description: string;

package/dist/collection/server/publish.d.ts

@@ -0,0 +1,56 @@
+import { DiscoveryOptions } from './discovery';
+import { PublishedApp } from './publishProject';
+export interface PublishOptions extends DiscoveryOptions {
+    /** Proceed even though existing records fail the schemas about to be
+     *  published. Never a default: the pre-check is the migration gate, and a
+     *  gate that opens itself is a log line. */
+    confirm?: boolean | undefined;
+    /** Wall clock, injectable so a test can assert an exact document. */
+    now?: (() => number) | undefined;
+    /** Resolve the commit the declaration is being published from. Injectable
+     *  for the same reason, and because a repository without git is a normal
+     *  state rather than a failure. */
+    resolveCommit?: ((root: string) => Promise<{
+        commit?: string | undefined;
+        dirty?: boolean | undefined;
+    }>) | undefined;
+}
+export type PublishResult = {
+    ok: false;
+    problems: string[];
+    /** Did any document reach Firestore before this failed?
+     *
+     *  Almost every refusal happens before the first write, and saying so is
+     *  most of the value of refusing. But a write that fails part-way is a
+     *  DIFFERENT state — the roster and configuration are live while the
+     *  schemas are one publish behind — and it is the state a caller most
+     *  needs to hear about. Carried as a field rather than left for the
+     *  caller to infer from prose, because a caller that guesses will guess
+     *  "nothing was written": that is what every other failure means. */
+    partial: boolean;
+} | {
+    ok: true;
+    aid: string;
+    cids: string[];
+    created: boolean;
+    commit?: string | undefined;
+    dirty: boolean;
+    /** How many live records the pre-check found that the published schemas
+     *  reject — and whether that number is a FLOOR.
+     *
+     *  `validateCollectionRecords` stops at its own cap per collection, so a
+     *  full batch means "at least this many". The count and the cap travel
+     *  together because they are read together: a caller that reports the
+     *  number without the flag understates how much repair is owed, on the
+     *  one path (a confirmed publish) where the damage is already done. */
+    recordIssues: number;
+    recordIssuesCapped: boolean;
+    published: PublishedApp;
+};
+/** Publish this repository's declaration to its app.
+ *
+ *  Everything variable is a parameter or comes from the host binding, so the
+ *  whole path is exercisable against an in-memory `FirestoreDocs` with no
+ *  network and no API key — which is the only way the conversion table gets
+ *  tested as a table. */
+export declare function publishApp(opts?: PublishOptions): Promise<PublishResult>;

package/dist/collection/server/publishChecks.d.ts

@@ -0,0 +1,29 @@
+import { AuthoredApp, AuthoredSubmit } from './publishManifest';
+/** What publish knows about a shared collection in this repository, as far as
+ *  these checks are concerned: its cid and the schema key its records are
+ *  identified by. The whole schema is deliberately not threaded in — these
+ *  checks are about the DECLARATION, and the primary key is the one part of
+ *  the schema the declaration can contradict. */
+export interface PublishableCollection {
+    cid: string;
+    primaryKey: string;
+}
+/** Does this submit declaration bind a record to the submitter's identity?
+ *
+ *  The condition for requiring `submitOnly`, and deliberately NOT "declares an
+ *  `audience`": `audience` appears only in the rules' public-create branch, so
+ *  an owner or editor never meets it and can add records freely. `immutable`
+ *  is the wrong condition too — a survey's responses are not immutable and
+ *  can be padded exactly the same way.
+ *
+ *  What these four have in common is that each one makes the record MEAN "the
+ *  person who submitted it said this": a per-uid id, a per-uid+field id, a
+ *  row stamped with the submitter's verified address, or a submission
+ *  restricted to a named participant. A record created through the writer
+ *  branch carries the same shape and none of that meaning. */
+export declare function bindsSubmitterIdentity(submit: AuthoredSubmit): boolean;
+/** Everything publish refuses, as lines the author can act on.
+ *
+ *  All of them, every time. Publish is a manual step with a human waiting on
+ *  it; stopping at the first problem turns one review into five. */
+export declare function publishProblems(app: AuthoredApp, collections: readonly PublishableCollection[], publisherEmail: string): string[];

package/dist/collection/server/publishManifest.d.ts

@@ -0,0 +1,181 @@
+import { z } from 'zod';
+/** The four roles the deployed rules understand. `participant` is the layer
+ *  that is NAMED but reads only its own rows — see `readerOf` vs `listedIn`. */
+export declare const APP_ROLES: readonly ["owner", "editor", "viewer", "participant"];
+/** The declarative mail queue, as the rules re-derive it: a transition of the
+ *  status field, a recipient read off the RECORD, and a fixed template. */
+declare const MailZ: z.ZodObject<{
+    toField: z.ZodString;
+    on: z.ZodRecord<z.ZodString, z.ZodObject<{
+        from: z.ZodArray<z.ZodString>;
+        to: z.ZodString;
+    }, z.core.$strict>>;
+    dataFields: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strict>;
+/** What the rules read out of `collections[cid]`. NOT the schema — the schema
+ *  is published beside it, untouched, for clients to render from. */
+declare const CollectionConfigZ: z.ZodObject<{
+    statusField: z.ZodOptional<z.ZodString>;
+    transitions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>;
+    immutable: z.ZodOptional<z.ZodBoolean>;
+    submitOnly: z.ZodOptional<z.ZodBoolean>;
+    peerVisibility: z.ZodOptional<z.ZodEnum<{
+        public: "public";
+        hidden: "hidden";
+    }>>;
+    revealGated: z.ZodOptional<z.ZodBoolean>;
+    gatedFrom: z.ZodOptional<z.ZodString>;
+    revealBy: z.ZodOptional<z.ZodString>;
+    mail: z.ZodOptional<z.ZodObject<{
+        toField: z.ZodString;
+        on: z.ZodRecord<z.ZodString, z.ZodObject<{
+            from: z.ZodArray<z.ZodString>;
+            to: z.ZodString;
+        }, z.core.$strict>>;
+        dataFields: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>;
+    aggregate: z.ZodOptional<z.ZodObject<{
+        by: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+declare const SubmitZ: z.ZodObject<{
+    auth: z.ZodEnum<{
+        none: "none";
+        anonymous: "anonymous";
+        verifiedEmail: "verifiedEmail";
+    }>;
+    emailField: z.ZodOptional<z.ZodString>;
+    createFields: z.ZodArray<z.ZodString>;
+    initialStatus: z.ZodOptional<z.ZodString>;
+    idFrom: z.ZodOptional<z.ZodEnum<{
+        auto: "auto";
+        "auth.uid": "auth.uid";
+        "auth.uid+field": "auth.uid+field";
+    }>>;
+    idField: z.ZodOptional<z.ZodString>;
+    validate: z.ZodOptional<z.ZodObject<{
+        required: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        keyFields: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            field: z.ZodString;
+            values: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+        }, z.core.$strict>>>;
+    }, z.core.$strict>>;
+    window: z.ZodOptional<z.ZodObject<{
+        from: z.ZodOptional<z.ZodISODateTime>;
+        until: z.ZodOptional<z.ZodISODateTime>;
+    }, z.core.$strict>>;
+    selfUpdate: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>;
+    selfTransitions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>;
+    finalize: z.ZodOptional<z.ZodBoolean>;
+    audience: z.ZodOptional<z.ZodLiteral<"participant">>;
+    gateOn: z.ZodOptional<z.ZodObject<{
+        phase: z.ZodString;
+        match: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+/** The whole authored declaration.
+ *
+ *  `owner` is accepted but is NOT the published value — publish stamps the
+ *  publisher's uid (or carries the existing one forward, which is what the
+ *  rules require on update) and refuses a declaration that disagrees. It is
+ *  accepted rather than banned because the sample app.json in the design note
+ *  shows it, and a hard refusal on a key the samples contain would be a worse
+ *  first experience than a message naming the mismatch. */
+export declare const AuthoredAppZ: z.ZodObject<{
+    aid: z.ZodString;
+    name: z.ZodOptional<z.ZodString>;
+    aidEnv: z.ZodOptional<z.ZodString>;
+    owner: z.ZodOptional<z.ZodString>;
+    members: z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodUnion<readonly [z.ZodLiteral<"*">, z.ZodString]>, z.ZodEnum<{
+        owner: "owner";
+        editor: "editor";
+        viewer: "viewer";
+        participant: "participant";
+    }>>>;
+    collections: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        statusField: z.ZodOptional<z.ZodString>;
+        transitions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>;
+        immutable: z.ZodOptional<z.ZodBoolean>;
+        submitOnly: z.ZodOptional<z.ZodBoolean>;
+        peerVisibility: z.ZodOptional<z.ZodEnum<{
+            public: "public";
+            hidden: "hidden";
+        }>>;
+        revealGated: z.ZodOptional<z.ZodBoolean>;
+        gatedFrom: z.ZodOptional<z.ZodString>;
+        revealBy: z.ZodOptional<z.ZodString>;
+        mail: z.ZodOptional<z.ZodObject<{
+            toField: z.ZodString;
+            on: z.ZodRecord<z.ZodString, z.ZodObject<{
+                from: z.ZodArray<z.ZodString>;
+                to: z.ZodString;
+            }, z.core.$strict>>;
+            dataFields: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
+        aggregate: z.ZodOptional<z.ZodObject<{
+            by: z.ZodArray<z.ZodString>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>>;
+    participantRead: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    public: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodOptional<z.ZodBoolean>;
+        read: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        submit: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+            auth: z.ZodEnum<{
+                none: "none";
+                anonymous: "anonymous";
+                verifiedEmail: "verifiedEmail";
+            }>;
+            emailField: z.ZodOptional<z.ZodString>;
+            createFields: z.ZodArray<z.ZodString>;
+            initialStatus: z.ZodOptional<z.ZodString>;
+            idFrom: z.ZodOptional<z.ZodEnum<{
+                auto: "auto";
+                "auth.uid": "auth.uid";
+                "auth.uid+field": "auth.uid+field";
+            }>>;
+            idField: z.ZodOptional<z.ZodString>;
+            validate: z.ZodOptional<z.ZodObject<{
+                required: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                keyFields: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                    field: z.ZodString;
+                    values: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+                }, z.core.$strict>>>;
+            }, z.core.$strict>>;
+            window: z.ZodOptional<z.ZodObject<{
+                from: z.ZodOptional<z.ZodISODateTime>;
+                until: z.ZodOptional<z.ZodISODateTime>;
+            }, z.core.$strict>>;
+            selfUpdate: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>;
+            selfTransitions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>;
+            finalize: z.ZodOptional<z.ZodBoolean>;
+            audience: z.ZodOptional<z.ZodLiteral<"participant">>;
+            gateOn: z.ZodOptional<z.ZodObject<{
+                phase: z.ZodString;
+                match: z.ZodString;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type AuthoredApp = z.infer<typeof AuthoredAppZ>;
+export type AuthoredCollectionConfig = z.infer<typeof CollectionConfigZ>;
+export type AuthoredSubmit = z.infer<typeof SubmitZ>;
+export type AuthoredMail = z.infer<typeof MailZ>;
+export type AuthoredAppResult = {
+    ok: true;
+    app: AuthoredApp;
+} | {
+    ok: false;
+    problems: string[];
+};
+/** Parse the authored declaration out of `app.json`'s text.
+ *
+ *  Returns a LIST of problems rather than throwing, for the same reason
+ *  `loadAppManifest` returns a failure: the caller is a gate whose entire job
+ *  is to hand the author something to act on. Every problem is reported at
+ *  once — publish is a manual step, and a parser that stops at the first key
+ *  makes it N round trips. */
+export declare function parseAuthoredApp(raw: string): AuthoredAppResult;
+/** zod issues as one actionable line each: `public.submit.responses.auth: …`. */
+export declare function authoredProblems(error: z.ZodError): string[];
+export {};

package/dist/collection/server/publishProject.d.ts

@@ -0,0 +1,86 @@
+import { CollectionSchema } from '../core/schema';
+import { AuthoredApp } from './publishManifest';
+/** Who and when. Threaded in rather than read from a clock inside the
+ *  projection so the projection stays pure and the tests can assert on an
+ *  exact document. */
+export interface PublishStamp {
+    /** The publisher's Firebase uid. The rules require `owner ==
+     *  request.auth.uid` on CREATE and `owner` unchanged on UPDATE, so this is
+     *  used only when the app document does not exist yet. */
+    uid: string;
+    /** The publisher's verified email — the principal the roster is keyed by. */
+    email: string;
+    /** Wall-clock millis of this publish. */
+    publishedAt: number;
+    /** The git commit the declaration was read from, when the host could
+     *  resolve one. Absent is a normal state (a dirty tree, a repository
+     *  without git), and absent is more honest than a fabricated value. */
+    commit?: string | undefined;
+}
+/** One collection's published schema document (`apps/{aid}/collections/{cid}`).
+ *
+ *  The rules never read `publishedSchema` — `schemaRead` gates the whole
+ *  document and stops there. It is here for the CLIENTS: a member's host
+ *  renders from it, and a public webview has no other way to know the fields.
+ *  The whole schema is published rather than a projection of it, because
+ *  every attempt to guess "the part a view needs" is a guess about a view
+ *  that has not been written yet. */
+export interface PublishedSchemaDoc extends Record<string, unknown> {
+    publishedSchema: CollectionSchema;
+    publishedAt: number;
+    publishedBy: string;
+    publishedCommit?: string;
+}
+/** The public settings document (`apps/{aid}/config/public`).
+ *
+ *  `allow read: if true` — this is the one document an anonymous visitor can
+ *  read, and it is the reason `apps/{aid}` itself is reader-only: a
+ *  participant reading the app document would see their classmates'
+ *  addresses. So the roster is NOT here, and neither is `owner`. What is here
+ *  is what a public form needs in order to render itself and to tell a visitor
+ *  "this closed yesterday" instead of failing a write with no explanation. */
+export interface PublishedConfigDoc extends Record<string, unknown> {
+    name?: string;
+    enabled: boolean;
+    read: string[];
+    submit: Record<string, Record<string, unknown>>;
+    publishedAt: number;
+}
+/** Everything one publish writes. Separate documents because they live at
+ *  separate paths with separate rules — and in the order given: the app
+ *  document authorizes the other two, so it goes first. */
+export interface PublishedApp {
+    app: Record<string, unknown>;
+    schemas: {
+        cid: string;
+        doc: PublishedSchemaDoc;
+    }[];
+    config: PublishedConfigDoc;
+}
+/** The document id under `apps/{aid}/config`. One document, named, rather than
+ *  a spread of them: a second public document is a second thing to keep in
+ *  step, and nothing yet needs one. */
+export declare const PUBLIC_CONFIG_DOC = "public";
+/** Project the authored declaration into the documents publish writes.
+ *
+ *  `existing` is the app document as it is in Firestore right now, or null on
+ *  a first publish. Two things need it, both required by the rules:
+ *    - `owner` must be UNCHANGED on update. Re-stamping the publisher's uid
+ *      would be refused for any app whose owner ever signed in as a different
+ *      account, and would silently transfer ownership if it were not.
+ *    - `previousPublished` is that document, so a rollback has something to
+ *      put back.
+ *
+ *  Pure: no clock, no filesystem, no Firestore. Everything variable arrives as
+ *  a parameter, which is what makes the conversion table testable as a table. */
+export declare function projectApp(authored: AuthoredApp, schemas: {
+    cid: string;
+    schema: CollectionSchema;
+}[], stamp: PublishStamp, existing: Record<string, unknown> | null): PublishedApp;
+/** The app documents' parent path — the `FirestoreDocs` seam takes a
+ *  collection path plus a document id, and the app document's id is the aid. */
+export declare const APPS_COLLECTION = "apps";
+/** The collection (schema) documents' parent path. */
+export declare const appSchemasPath: (aid: string) => string;
+/** The public-config documents' parent path. */
+export declare const appConfigPath: (aid: string) => string;

package/dist/collection/server/validate.d.ts

@@ -8,6 +8,18 @@ export interface RecordIssue {
     /** Human-readable problem, written to be actionable by the LLM. */
     problem: string;
 }
+/** Don't flood the result; the first batch is enough to act on. Exported
+ *  because a caller that REPORTS a count has to know the count is a floor —
+ *  `publish` presents a full batch as "at least N" rather than as a total. */
+export declare const MAX_RECORD_ISSUES = 25;
+/** The `file` of the pseudo-issue reported when the backend could not be read
+ *  at all.
+ *
+ *  Exported because it is a DIFFERENT KIND of answer from "this record is
+ *  invalid", and a caller that treats the two alike gets it wrong in the
+ *  direction that matters: `publish` lets the user override invalid records,
+ *  and overriding this one would mean publishing without ever having looked. */
+export declare const STORE_UNREADABLE = "(store)";
 export declare function validateCollectionRecords(collection: LoadedCollection, opts?: {
     workspaceRoot?: string | undefined;
 }): Promise<RecordIssue[]>;