@mulmoclaude/core 3.7.0 → 3.11.0

package/dist/{server-CWZyg8fn.cjs → server-X_magqUa.cjs}

@@ -2,9 +2,9 @@ const require_rolldown_runtime = require("./rolldown-runtime-VH7oDXx4.cjs");
 const require_dist = require("./dist-CsgSfWwR.cjs");
 const require_root = require("./root-rPH6FGDT.cjs");
 const require_relPath = require("./relPath-CTAjGdCL.cjs");
-const require_calendarGrid = require("./calendarGrid-DGILaVxI.cjs");
-const require_promptSafety = require("./promptSafety-NNGViiCr.cjs");
-const require_store = require("./store-5_P_NsGa.cjs");
+const require_itemId = require("./itemId-Dzrr3vs5.cjs");
+const require_promptSafety = require("./promptSafety-CWqYq-NS.cjs");
+const require_discovery = require("./discovery-BsXiDZBR.cjs");
 const require_feeds_paths = require("./feeds/paths.cjs");
 const require_skill_bridge_index = require("./skill-bridge/index.cjs");
 let node_path = require("node:path");
@@ -12,13 +12,11 @@ node_path = require_rolldown_runtime.__toESM(node_path, 1);
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 let zod = require("zod");
-let node_child_process = require("node:child_process");
-let node_util = require("node:util");
 //#region src/collection/server/publishManifest.ts
 /** A collection id / app id, held to the one name rule (`SAFE_SLUG_PATTERN`)
 *  that `sharedCollectionKey` applies. Stated once so a path built later
 *  cannot be a way around it. */
-var NameZ = zod.z.string().refine(require_calendarGrid.isValidCollectionName, { message: "is not a valid id (letters, digits, '-' and '_' only)" });
+var NameZ = zod.z.string().refine(require_itemId.isValidCollectionName, { message: "is not a valid id (letters, digits, '-' and '_' only)" });
 /** An address on the roster. Not validated as an email beyond "has an @":
 *  the rules compare it to `request.auth.token.email` verbatim, so any
 *  narrowing here would refuse addresses Firebase itself accepts. */
@@ -126,6 +124,34 @@ var PublicZ = zod.z.object({
 	read: zod.z.array(NameZ).optional(),
 	submit: zod.z.record(NameZ, SubmitZ).optional()
 }).strict();
+/** The URL name an app is handed out under: `https://<host>/{slug}`.
+*
+*  A SEPARATE name from the `aid`, and that separation is the point (design
+*  D2b). `apps/{aid}` is a shelf every user of the deployment shares and the
+*  rules' `allow create` asks only that you name yourself owner — so a
+*  memorable aid is first-come-first-served, cannot be checked for
+*  availability, and frees up again when an app is deleted. The aid is
+*  therefore a UUID, and the thing people can fight over is moved to the name
+*  that costs nothing to change.
+*
+*  Declared here rather than kept beside `app.json` because a RESERVATION has
+*  to travel with the repository: `appSlugs/{slug}` is unreadable until the app
+*  is published (`allow read: if resource.data.published == true`), so nothing
+*  can recover which slug an app holds by asking Firestore. A second file to
+*  keep in step with the declaration is the alternative, and it is the kind of
+*  pair that goes out of step silently.
+*
+*  The shape is stricter than `NameZ` on purpose: it is BOTH a URL path
+*  segment people read aloud and a Firestore document id. Lowercase
+*  alphanumerics separated by single hyphens covers both without a case rule
+*  that would make two slugs collide in one place and not the other.
+*
+*  Which slug an app ended up with is the HOST's business — a wanted slug can
+*  be taken, and the host writes the one it reserved back here. Nothing in this
+*  package reads the key; it is declared so that writing it back does not make
+*  the file unparseable. */
+var SLUG_SHAPE = "must be lowercase letters, digits and single hyphens, and must not start or end with one (e.g. sakura-hair)";
+var SlugZ = zod.z.string().trim().max(64).regex(/^[a-z0-9][a-z0-9-]*[a-z0-9]$|^[a-z0-9]$/, SLUG_SHAPE).refine((slug) => !slug.includes("--"), SLUG_SHAPE);
 /** The whole authored declaration.
 *
 *  `owner` is accepted but is NOT the published value — publish stamps the
@@ -137,6 +163,8 @@ var PublicZ = zod.z.object({
 var AuthoredAppZ = zod.z.object({
 	aid: NameZ,
 	name: zod.z.string().trim().min(1).optional(),
+	/** The wanted (or reserved) URL name — see {@link SlugZ}. */
+	slug: SlugZ.optional(),
 	/** Per-worktree app id (design D6, implementation order 7). Accepted so a
 	*  repository already carrying it parses; nothing reads it yet. */
 	aidEnv: zod.z.string().trim().min(1).optional(),
@@ -154,7 +182,7 @@ var AuthoredAppZ = zod.z.object({
 *  once — publish is a manual step, and a parser that stops at the first key
 *  makes it N round trips. */
 function parseAuthoredApp(raw) {
-	const manifest = require_store.parseAppManifest(raw);
+	const manifest = require_discovery.parseAppManifest(raw);
 	if (!manifest.ok) return {
 		ok: false,
 		problems: [manifest.kind === "missing" ? "app.json is missing" : manifest.detail]
@@ -265,6 +293,7 @@ function projectApp(authored, schemas, stamp, existing) {
 		publishedAt: stamp.publishedAt,
 		publishedBy: stamp.email,
 		publishedCommit: stamp.commit,
+		publishedDirty: stamp.dirty === true ? true : void 0,
 		previousPublished: previousOf(existing)
 	});
 	const config = {
@@ -283,6 +312,102 @@ function projectApp(authored, schemas, stamp, existing) {
 		config
 	};
 }
+/** Keys on the app document that publish owns: what is PUBLIC right now, and
+*  the rule-facing configuration anonymous access is judged against. Deploy
+*  carries them through from the existing document and never authors them. */
+var PUBLISH_OWNED_KEYS = [
+	"public",
+	"collections",
+	"participantRead",
+	"publishedAt",
+	"publishedBy",
+	"publishedCommit",
+	"publishedDirty",
+	"previousPublished"
+];
+var isPublishOwned = (key) => PUBLISH_OWNED_KEYS.includes(key);
+function projectDeploy(authored, schemas, stamp, existing) {
+	const { app } = projectApp(authored, schemas, stamp, existing);
+	const deployed = Object.fromEntries(Object.entries(app).filter(([key]) => !isPublishOwned(key)));
+	for (const key of PUBLISH_OWNED_KEYS) {
+		const live = existing?.[key];
+		if (live !== void 0) deployed[key] = live;
+	}
+	deployed.deployedAt = stamp.publishedAt;
+	deployed.deployedBy = stamp.email;
+	if (stamp.commit !== void 0) deployed.deployedCommit = stamp.commit;
+	return {
+		app: deployed,
+		staging: schemas.map(({ cid, schema }) => ({
+			cid,
+			doc: stagedDoc(schema, stamp, authored, cid)
+		}))
+	};
+}
+/** One staged schema document, carrying this cid's rule-facing configuration
+*  alongside the schema so publish can promote them together. */
+function stagedDoc(schema, stamp, authored, cid) {
+	const doc = {
+		publishedSchema: schema,
+		deployedAt: stamp.publishedAt,
+		deployedBy: stamp.email
+	};
+	const config = authored.collections?.[cid];
+	if (config !== void 0) doc.config = config;
+	if (authored.participantRead?.includes(cid) === true) doc.participantRead = true;
+	if (stamp.commit !== void 0) doc.deployedCommit = stamp.commit;
+	return doc;
+}
+/** The rule-facing configuration to promote, read from the STAGED documents
+*  rather than from the manifest as it reads right now.
+*
+*  Otherwise: deploy revision A, edit `app.json` to revision B, publish — and
+*  the promoted schema is A's while the authorization behaviour is B's, a
+*  combination nobody exercised through `/staging/{aid}`.
+*
+*  (`public` is deliberately NOT part of this: it is not staged, because it is
+*  the decision being made AT publish rather than something under test.) */
+function stagedRuleConfig(staged) {
+	const entries = [];
+	const participantRead = [];
+	for (const entry of staged) {
+		const { config } = entry.doc;
+		if (config !== void 0) entries.push([entry.cid, config]);
+		if (entry.doc.participantRead === true) participantRead.push(entry.cid);
+	}
+	return {
+		collections: entries.length > 0 ? Object.fromEntries(entries) : void 0,
+		participantRead: participantRead.length > 0 ? participantRead : void 0
+	};
+}
+function projectPublish(authored, staged, stamp, existing) {
+	const { app, config } = projectApp(authored, [], stamp, existing);
+	const staging = stagedRuleConfig(staged);
+	app.collections = staging.collections;
+	app.participantRead = staging.participantRead;
+	const published = Object.fromEntries(Object.entries(existing ?? app).filter(([key]) => !isPublishOwned(key)));
+	for (const key of PUBLISH_OWNED_KEYS) if (key !== "public" && app[key] !== void 0) published[key] = app[key];
+	const publicBlock = app.public;
+	return {
+		app: published,
+		config,
+		public: require_dist.isRecord(publicBlock) ? publicBlock : void 0
+	};
+}
+/** Re-stamp a staged schema document as it is promoted to `collections/{cid}`.
+*
+*  The stamp answers "which version is PUBLIC right now, and who made it so",
+*  so it is written by the operation that changes the answer — publish — not
+*  carried over from the deploy that staged it. */
+function promoteSchema(staged, stamp) {
+	const doc = {
+		publishedSchema: staged.publishedSchema,
+		publishedAt: stamp.publishedAt,
+		publishedBy: stamp.email
+	};
+	if (stamp.commit !== void 0) doc.publishedCommit = stamp.commit;
+	return doc;
+}
 /** One published schema document. Written key by key rather than through
 *  `compact`, so the declared type is the type — an optional commit is the
 *  only variable part. */
@@ -298,8 +423,31 @@ function schemaDoc(schema, stamp) {
 /** The app documents' parent path — the `FirestoreDocs` seam takes a
 *  collection path plus a document id, and the app document's id is the aid. */
 var APPS_COLLECTION = "apps";
-/** The collection (schema) documents' parent path. */
+/** The collection (schema) documents' parent path — what the PUBLIC page
+*  reads, written only by publish (promotion). */
 var appSchemasPath = (aid) => `apps/${aid}/collections`;
+/** The URL-slug reservations — `appSlugs/{slug}` → `{ aid, published }`.
+*
+*  A TOP-LEVEL collection, not a field on the app: the public page resolves a
+*  slug to an aid BEFORE it can read anything under `apps/{aid}`, and a slug
+*  has to be claimable atomically (create-if-absent) so two apps cannot hold
+*  the same URL.
+*
+*  `published` is what makes the reservation invisible until publish. The slug
+*  is human-readable, so a readable reservation would let anyone guess the URL
+*  and get the aid — and the aid is the `/staging/{aid}` entrance. The rule is
+*  `allow read: if resource.data.published == true`, which needs no `get()` and
+*  so costs nothing against the rules' expression budget. */
+var APP_SLUGS_COLLECTION = "appSlugs";
+var appSlugDoc = (aid, published) => ({
+	aid,
+	published
+});
+/** The staged schema documents' parent path — what `/staging/{aid}` reads,
+*  written by deploy. A separate DOCUMENT rather than a field beside
+*  `publishedSchema`, because the rules cannot hide a field: anything inside a
+*  document the public page may read is public. */
+var appStagingPath = (aid) => `apps/${aid}/staging`;
 /** The public-config documents' parent path. */
 var appConfigPath = (aid) => `apps/${aid}/config`;
 //#endregion
@@ -525,532 +673,34 @@ function publishProblems(app, collections, publisherEmail) {
 		...primaryKeyProblems(app, collections)
 	];
 }
-/** A public submission must be able to produce a record the HOST can read.
+/** A public submission must NOT be allowed to name its own primary key.
+*
+*  The rules constrain the DOCUMENT ID (`idFrom`) and cannot constrain the
+*  value of a field — nothing compares `request.resource.data[primaryKey]`
+*  with the path being written. So a submit path that accepts the primary key
+*  as a `createField` lets a submitter write at their one permitted document
+*  id while CLAIMING another record's identity, or a duplicate.
 *
-*  The rules and the engine disagree about what identifies a record, and the
-*  gap is invisible from either side alone. The rules bind the DOCUMENT ID
-*  (`idFrom`) and let a submission carry only `createFields`; the engine
-*  identifies a record by its schema's `primaryKey` FIELD, and the firestore
-*  store hands back the document's fields verbatim — `toItem` does not
-*  synthesize the key from the document id. So a submit path whose
-*  `createFields` omits the primary key writes rows that Firestore accepts and
-*  every reader rejects: `validateRecordObject` fails them, the collection
-*  renders empty-ish, and the next publish's own pre-check reports them as
-*  broken records the publisher never wrote.
+*  It is refused rather than tolerated because there is nothing for the field
+*  to do: `firestoreStore` takes a shared record's identity from the document
+*  id and overwrites the field on read, so a submitted value is either equal
+*  to the id (noise) or a lie (silently discarded). Publishing a form field
+*  whose value is thrown away is worse than not having it — the author will
+*  believe submitters choose their ids.
 *
-*  Not checkable by the rules (they have never heard of a schema) and not
-*  catchable at write time (nothing is wrong with the write). Publish is the
-*  only place that holds both halves. */
+*  This is the second answer to the same question. The first was the reverse —
+*  REQUIRE the key, because a record without one was rejected by every reader
+*  — and it was right about the symptom and wrong about the cure: the identity
+*  belongs to the id the rules can pin, not to a field they cannot. */
 function primaryKeyProblems(app, collections) {
 	const primaryKeyOf = new Map(collections.map((collection) => [collection.cid, collection.primaryKey]));
 	return Object.entries(app.public?.submit ?? {}).flatMap(([cid, submit]) => {
 		const primaryKey = primaryKeyOf.get(cid);
-		if (primaryKey === void 0 || submit.createFields.includes(primaryKey)) return [];
-		return [`public.submit.${cid}.createFields must include "${primaryKey}", the schema's primaryKey: a submission may carry only the createFields, and a shared record is stored as exactly the fields it was written with — the document id is not copied into the record. Without it every submission is accepted by the rules and then rejected by every reader.`];
+		if (primaryKey === void 0 || !submit.createFields.includes(primaryKey)) return [];
+		return [`public.submit.${cid}.createFields must NOT include "${primaryKey}", the schema's primaryKey: the rules can pin the document id but not the value of a field, so a submitter could write at their own id while claiming another record's. A shared record's identity is its document id — the store fills the field from it, and a submitted value is either the same thing or a lie that is thrown away.`];
 	});
 }
 //#endregion
-//#region src/collection/core/recordZ.ts
-/** The emptiness rule shared by `required` and the "only check present
-*  values" gate. NOT a truthiness check — `0` and `false` are filled. */
-var isEmptyValue = (value) => value === void 0 || value === null || value === "";
-/** The historical write-gate checks, verbatim: required non-empty, enum
-*  membership (compared as strings, so a numeric `5` satisfies `"5"`). */
-function enforcedProblem(key, spec, value) {
-	const empty = isEmptyValue(value);
-	if (spec.required && empty) return `missing required field '${key}'`;
-	if (!empty && spec.type === "enum" && !spec.values.includes(String(value))) return `'${key}' = '${String(value)}' is not one of [${spec.values.join(", ")}]`;
-	return null;
-}
-/** Report-only per-type checks on a PRESENT value. Date / datetime reuse the
-*  calendar's STRICT civil parsers (`parseIsoDate` / `parseIsoDateTime`), so
-*  the lint flags exactly the values the calendar / trigger / spawn code
-*  would silently drop — impossible days like `2026-02-30`, and datetimes
-*  outside the canonical `YYYY-MM-DDTHH:MM[:SS]` shape (e.g. a `Z` suffix,
-*  which the day view can't place). `string`-backed types accept anything
-*  stringifiable; `ref` existence is out of scope. */
-function strictTypeProblem(key, spec, value) {
-	switch (spec.type) {
-		case "number":
-		case "money": return Number.isFinite(require_promptSafety.coerceNumeric(value)) ? null : `'${key}' = '${String(value)}' is not numeric (a '${spec.type}' field stores a plain number)`;
-		case "boolean": return value === true || value === false ? null : `'${key}' = '${String(value)}' is not a boolean (store true or false, unquoted)`;
-		case "date": return require_calendarGrid.parseIsoDate(value) !== null ? null : `'${key}' = '${String(value)}' is not a real YYYY-MM-DD date`;
-		case "datetime": return require_calendarGrid.parseIsoDateTime(value) !== null ? null : `'${key}' = '${String(value)}' is not a YYYY-MM-DDTHH:MM datetime (seconds optional, no timezone suffix — the shape the calendar parses)`;
-		default: return null;
-	}
-}
-/** Strict check for a PRESENT `table` value: an array of row objects, each
-*  row conforming to the sub-schema (required / enum / typed sub-values).
-*  First row problem wins, prefixed with the row number so the fix is
-*  locatable. */
-function strictTableProblem(key, spec, value) {
-	if (!Array.isArray(value)) return `'${key}' = '${String(value)}' is not an array of rows (a 'table' field stores an array of row objects)`;
-	for (let index = 0; index < value.length; index++) {
-		const row = value[index];
-		if (!require_dist.isRecord(row)) return `'${key}' row ${index + 1} is not an object`;
-		for (const [subKey, subSpec] of Object.entries(spec.of)) {
-			const subValue = row[subKey];
-			const problem = enforcedProblem(subKey, subSpec, subValue) ?? (isEmptyValue(subValue) ? null : strictTypeProblem(subKey, subSpec, subValue));
-			if (problem) return `'${key}' row ${index + 1}: ${problem}`;
-		}
-	}
-	return null;
-}
-/** First problem for one field's stored value under `tier`, or null.
-*  Enforced checks always run (and their messages never vary by tier — the
-*  scan and the write gate must agree on them); strict adds the per-type
-*  layer on present values only. */
-function recordFieldProblem(key, spec, value, tier) {
-	const enforced = enforcedProblem(key, spec, value);
-	if (enforced || tier === "enforced") return enforced;
-	if (isEmptyValue(value)) return null;
-	if (spec.type === "table") return strictTableProblem(key, spec, value);
-	return strictTypeProblem(key, spec, value);
-}
-var compiled = /* @__PURE__ */ new WeakMap();
-/** Compile `schema.fields` into a zod validator for a stored record.
-*  Loose object: unknown keys are allowed and any declared key may be
-*  absent (records are user files, not parse-and-rewrite targets —
-*  callers validate, they never persist the parse output). The checks run
-*  as ONE object-level refine iterating fields in declaration order —
-*  per-key shape schemas can't express "key may be absent BUT its absence
-*  must still reach the required check", and the single loop keeps the
-*  first reported issue identical to the historical first-problem-wins
-*  contract. */
-function compileRecordZ(schema, tier) {
-	const cached = compiled.get(schema)?.[tier];
-	if (cached) return cached;
-	const stored = Object.entries(schema.fields).filter(([, spec]) => !require_calendarGrid.COMPUTED_TYPES.has(spec.type));
-	const validator = zod.z.looseObject({}).superRefine((record, ctx) => {
-		for (const [key, spec] of stored) {
-			const problem = recordFieldProblem(key, spec, record[key], tier);
-			if (problem) ctx.addIssue({
-				code: "custom",
-				message: problem,
-				path: [key]
-			});
-		}
-	});
-	const entry = compiled.get(schema) ?? {};
-	entry[tier] = validator;
-	compiled.set(schema, entry);
-	return validator;
-}
-/** First schema problem on an in-memory record under `tier`, or null. One
-*  issue per record keeps the report short and the fix obvious (the
-*  historical contract of `validateRecordObject`). */
-function firstRecordProblem(record, schema, tier) {
-	const result = compileRecordZ(schema, tier).safeParse(record);
-	if (result.success) return null;
-	return result.error.issues[0]?.message ?? "record failed schema validation";
-}
-//#endregion
-//#region src/collection/server/validate.ts
-/** Don't flood the result; the first batch is enough to act on. Exported
-*  because a caller that REPORTS a count has to know the count is a floor —
-*  `publish` presents a full batch as "at least N" rather than as a total. */
-var MAX_RECORD_ISSUES = 25;
-/** The `file` of the pseudo-issue reported when the backend could not be read
-*  at all.
-*
-*  Exported because it is a DIFFERENT KIND of answer from "this record is
-*  invalid", and a caller that treats the two alike gets it wrong in the
-*  direction that matters: `publish` lets the user override invalid records,
-*  and overriding this one would mean publishing without ever having looked. */
-var STORE_UNREADABLE = "(store)";
-var MAX_ISSUES = 25;
-/** Read every `<id>.json` under the collection's dataDir and report the
-*  ones that won't load or violate the schema. An empty list means every
-*  record is fine. */
-/** List entries under the data dir, guarding realpath containment (against a
-*  symlinked dir swapped in after discovery, like `listItems`) and treating a
-*  missing dir as empty while surfacing real I/O faults. */
-async function listRecordFilenames(dataDir, workspaceRoot) {
-	if (!require_store.isContainedInRoot(dataDir, workspaceRoot)) {
-		require_store.log.warn("collections", "validate refused: dataDir escapes workspace via symlink", { dataDir });
-		return [];
-	}
-	try {
-		return await (0, node_fs_promises.readdir)(dataDir);
-	} catch (err) {
-		if (require_dist.isErrorWithCode(err) && err.code === "ENOENT") return [];
-		throw err;
-	}
-}
-async function validateCollectionRecords(collection, opts = {}) {
-	if (collection.schema.dataSource !== void 0) return [];
-	if (collection.schema.storage !== void 0) return validateStoreRecords(collection, opts);
-	const workspaceRoot = opts.workspaceRoot ?? require_store.getWorkspaceRoot();
-	const entries = await listRecordFilenames(collection.dataDir, workspaceRoot);
-	const issues = [];
-	for (const name of entries.sort()) {
-		if (!name.endsWith(".json") || name.startsWith(".")) continue;
-		if (issues.length >= MAX_ISSUES) break;
-		const issue = await inspectRecord(node_path.default.join(collection.dataDir, name), name, collection.schema);
-		if (issue) issues.push(issue);
-	}
-	return issues;
-}
-/** Store-backed twin of the file scan: list every record through the
-*  collection's store and lint it with the same "strict" report-only tier.
-*  A row the store can't even parse is invisible here (the store skips
-*  it), so the read/parse classifications of the file scan don't apply —
-*  schema violations are what this catches. `file` carries the record id
-*  (there is no per-record filename). */
-async function validateStoreRecords(collection, opts) {
-	let items;
-	try {
-		items = await require_store.storeFor(collection, { workspaceRoot: opts.workspaceRoot }).list();
-	} catch (err) {
-		return [{
-			file: STORE_UNREADABLE,
-			problem: `records could not be read from the storage backend: ${err instanceof Error ? err.message : String(err)}`
-		}];
-	}
-	const issues = [];
-	for (const item of items) {
-		if (issues.length >= MAX_ISSUES) break;
-		const itemId = require_calendarGrid.fieldText(item[collection.schema.primaryKey]);
-		const problem = validateRecordObject(item, itemId, collection.schema, "strict");
-		if (problem) issues.push({
-			file: itemId,
-			problem
-		});
-	}
-	return issues;
-}
-async function readRecordText(fullPath, name) {
-	try {
-		if (!(await (0, node_fs_promises.lstat)(fullPath)).isFile()) return {
-			file: name,
-			problem: "not a regular file (symlink?) — skipped, won't appear"
-		};
-		return { raw: await (0, node_fs_promises.readFile)(fullPath, "utf-8") };
-	} catch {
-		return {
-			file: name,
-			problem: "could not be read — skipped, won't appear"
-		};
-	}
-}
-/** Classify a single record file: unreadable / unparseable / non-object /
-*  schema violation, or null when it's fine. */
-async function inspectRecord(fullPath, name, schema) {
-	const read = await readRecordText(fullPath, name);
-	if ("problem" in read) return read;
-	let parsed;
-	try {
-		parsed = JSON.parse(read.raw);
-	} catch (err) {
-		return {
-			file: name,
-			problem: `invalid JSON (${err instanceof Error ? err.message : String(err)}) — SKIPPED, won't appear. Usual cause: an unescaped " inside a string value; use 「」/『』 or write \\" instead.`
-		};
-	}
-	if (!require_dist.isRecord(parsed)) return {
-		file: name,
-		problem: "not a JSON object — skipped, won't appear"
-	};
-	const problem = validateRecordObject(parsed, name.replace(/\.json$/, ""), schema, "strict");
-	return problem ? {
-		file: name,
-		problem
-	} : null;
-}
-/** What a non-string primary key actually is, for the error message. Names the
-*  shape rather than stringifying the value — "[object Object]" tells the reader
-*  nothing about what is wrong. */
-function describeIdType(value) {
-	if (value === null) return "null";
-	if (value === void 0) return "missing";
-	if (Array.isArray(value)) return "an array";
-	return `a ${typeof value}`;
-}
-/** First schema problem on an in-memory record (primaryKey↔id mismatch,
-*  then the compiled per-field checks — see `../core/recordZ` for the two
-*  tiers), or null when it's fine. One issue per record keeps the report
-*  short and the fix obvious. Pure + exported so write paths
-*  (manageCollection putItems) can gate on the SAME enforced rules the
-*  post-hoc file scan reports — `itemId` is the id the record is (or
-*  would be) stored under. The default `"enforced"` tier keeps every
-*  write gate on the historical three checks; only pass `"strict"` from
-*  report-only surfaces. */
-function validateRecordObject(record, itemId, schema, tier = "enforced") {
-	const idValue = record[schema.primaryKey];
-	if (typeof idValue !== "string") return `'${schema.primaryKey}' must be a string, but is ${describeIdType(idValue)} — must equal the filename ('${itemId}'), or the record can't be opened`;
-	if (idValue !== itemId) return `'${schema.primaryKey}' is '${idValue}' but must equal the filename ('${itemId}'), or the record can't be opened`;
-	return firstRecordProblem(record, schema, tier);
-}
-//#endregion
-//#region src/collection/server/publish.ts
-var execFileAsync = (0, node_util.promisify)(node_child_process.execFile);
-/** How many broken records to name before summarising. A publish that would
-*  break a thousand rows is answered by the count and a sample; dumping all of
-*  them buries the number, which is the part the decision turns on. */
-var MAX_LISTED_ISSUES = 10;
-/** `git rev-parse HEAD` plus a dirty check, or nothing.
-*
-*  A missing git, a repository with no commits and a non-repository are all
-*  the same answer here — no commit — because the stamp is attribution, not a
-*  requirement. What is NOT acceptable is a stamp that lies, which is why the
-*  dirty flag exists: publishing from a modified tree records a commit that
-*  does not describe what was published, and the flag is the only thing that
-*  would ever tell a reader so. */
-async function gitStamp(root) {
-	try {
-		const { stdout } = await execFileAsync("git", [
-			"-C",
-			root,
-			"rev-parse",
-			"HEAD"
-		]);
-		const commit = stdout.trim();
-		const { stdout: status } = await execFileAsync("git", [
-			"-C",
-			root,
-			"status",
-			"--porcelain"
-		]);
-		return {
-			commit: commit.length > 0 ? commit : void 0,
-			dirty: status.trim().length > 0
-		};
-	} catch {
-		return {};
-	}
-}
-/** The shared collections of THIS REPOSITORY, by cid.
-*
-*  `userSkillsDir: null` — not a test convenience, a boundary. Discovery
-*  resolves every schema it finds against the WORKSPACE root, user-scope
-*  included, so a globally installed skill under `~/.claude/skills` carrying
-*  `storage.type: "firestore"` picks up whichever repository's `aid` it
-*  happens to be discovered from. Left in, publish would write that schema
-*  into this app — and into every other app the same user publishes, since the
-*  skill is installed once per machine and the repositories are not.
-*
-*  An app is a REPOSITORY (design D1): its collections are the ones committed
-*  beside its `app.json`, which is what makes a clone resolve the same
-*  collections and an invitation a matter of authorization rather than
-*  discovery. A schema that is not in the repository has no claim on a cid
-*  there. And because a view is HTML, publishing one is not a tidiness
-*  question: it is the machine's own skills reaching every member's browser.
-*
-*  The consequence is deliberate: a cid named in `app.json` that exists only
-*  in user scope is now an unknown cid, and publish says so by name instead of
-*  quietly publishing a schema from outside the repository. */
-async function sharedCollections(opts, root) {
-	return (await require_store.discoverCollections({
-		...opts,
-		workspaceRoot: root,
-		userSkillsDir: null
-	})).filter((collection) => collection.appId !== void 0);
-}
-/** Existing records that would not satisfy the schema about to be published.
-*
-*  Read from FIRESTORE, not from disk: a shared collection's records live in
-*  the app, and the question this answers is "what does the live data look
-*  like under the new schema" — which is the migration question. Reported as
-*  a refusal the publisher can override, because a breaking change is
-*  sometimes exactly what is intended and the point is that it is a decision
-*  rather than a discovery. */
-async function recordProblems(collections, opts) {
-	const lines = [];
-	const unreadable = [];
-	let records = 0;
-	let cappedAnywhere = false;
-	for (const collection of collections) {
-		const issues = await validateCollectionRecords(collection, opts);
-		if (issues.length === 0) continue;
-		const unread = issues.filter((issue) => issue.file === STORE_UNREADABLE);
-		if (unread.length > 0) {
-			unreadable.push(`${collection.slug}: ${unread.map((issue) => issue.problem).join("; ")}`);
-			continue;
-		}
-		records += issues.length;
-		const capped = issues.length >= 25;
-		cappedAnywhere = cappedAnywhere || capped;
-		const count = capped ? `at least ${issues.length}` : String(issues.length);
-		const plural = issues.length === 1 ? "" : "s";
-		const note = capped ? " (the scan stops there)" : "";
-		lines.push(`${collection.slug}: ${count} existing record${plural} would not satisfy the schema about to be published${note}`);
-		for (const issue of issues.slice(0, MAX_LISTED_ISSUES)) lines.push(`  - ${issue.file}: ${issue.problem}`);
-		if (issues.length > MAX_LISTED_ISSUES) lines.push(`  - … and ${issues.length - MAX_LISTED_ISSUES} more`);
-	}
-	return {
-		lines,
-		records,
-		capped: cappedAnywhere,
-		unreadable
-	};
-}
-function schemasOf(collections) {
-	return collections.map((collection) => ({
-		cid: collection.slug,
-		schema: collection.schema
-	})).sort((left, right) => left.cid < right.cid ? -1 : left.cid > right.cid ? 1 : 0);
-}
-/** Read and parse `<root>/app.json`'s full declaration. */
-async function readAuthored(root) {
-	let raw;
-	try {
-		raw = await (0, node_fs_promises.readFile)(node_path.default.join(root, require_store.APP_MANIFEST_FILE), "utf-8");
-	} catch (err) {
-		return {
-			ok: false,
-			problems: [`cannot read ${node_path.default.join(root, require_store.APP_MANIFEST_FILE)}: ${String(err)}`]
-		};
-	}
-	return parseAuthoredApp(raw);
-}
-/** Everything wrong with the declaration itself, publisher included. */
-function declarationProblems(app, collections, handle) {
-	const problems = publishProblems(app, collections.map((collection) => ({
-		cid: collection.slug,
-		primaryKey: collection.schema.primaryKey
-	})), handle.email);
-	if (app.owner !== void 0 && app.owner !== handle.uid) problems.push(`app.json declares owner "${app.owner}", which is not your uid (${handle.uid}). \`owner\` is stamped by publish and carried forward unchanged afterwards — remove it from app.json rather than maintaining it by hand.`);
-	return problems;
-}
-/** Put the three kinds of document, in the order the rules require, and turn a
-*  rejected write into the result type instead of letting it escape.
-*
-*  Returns null when everything was written; a failure result otherwise.
-*
-*  A raw rejection here would reach the agent as a tool crash rather than the
-*  actionable text this tool promises. But "actionable" is a strong claim for
-*  a half-finished publish, so the message ENUMERATES what landed rather than
-*  summarising it: the order is app → every schema → config, and a summary
-*  written for one failure point is wrong at the others. Saying "the roster
-*  and configuration are live" after a SCHEMA write failed names a config
-*  document this publish never wrote — which still holds whatever the last
-*  publish left, and is exactly the state the caller is trying to repair. */
-async function writeDocuments(handle, aid, published) {
-	const steps = [
-		{
-			what: `the app document (apps/${aid})`,
-			run: () => handle.docs.set(APPS_COLLECTION, aid, published.app)
-		},
-		...published.schemas.map(({ cid, doc }) => ({
-			what: `the published schema for '${cid}'`,
-			run: () => handle.docs.set(appSchemasPath(aid), cid, doc)
-		})),
-		{
-			what: `the public config document (apps/${aid}/config/${PUBLIC_CONFIG_DOC})`,
-			run: () => handle.docs.set(appConfigPath(aid), PUBLIC_CONFIG_DOC, published.config)
-		}
-	];
-	const landed = [];
-	for (const [index, step] of steps.entries()) try {
-		await step.run();
-		landed.push(step.what);
-	} catch (err) {
-		const reason = err instanceof Error ? err.message : String(err);
-		return {
-			ok: false,
-			partial: index > 0,
-			problems: [`publish failed while writing ${step.what}: ${reason}`, ...partialState(landed, [step.what, ...steps.slice(index + 1).map((rest) => rest.what)])]
-		};
-	}
-	return null;
-}
-/** What is live and what is not, listed rather than summarised.
-*
-*  Two facts, and both matter for the repair: a document this publish wrote is
-*  live NOW, and a document it did not write still holds what the LAST publish
-*  left — which is not the same as being absent, and not the same as matching
-*  the declaration that was just half-applied. */
-function partialState(landed, notWritten) {
-	const repair = "Publishing again is the repair: the write is idempotent, and it re-does every step, including the ones that did land.";
-	if (landed.length === 0) return [`Nothing was written. ${repair}`];
-	return [
-		`Written by this publish, and live now: ${landed.join("; ")}.`,
-		`NOT written: ${notWritten.join("; ")} — ${notWritten.length === 1 ? "it still holds" : "they still hold"} whatever the previous publish left.`,
-		repair
-	];
-}
-/** Publish this repository's declaration to its app.
-*
-*  Everything variable is a parameter or comes from the host binding, so the
-*  whole path is exercisable against an in-memory `FirestoreDocs` with no
-*  network and no API key — which is the only way the conversion table gets
-*  tested as a table. */
-async function publishApp(opts = {}) {
-	const root = opts.workspaceRoot ?? require_store.getWorkspaceRoot();
-	const handle = require_store.firestoreHandle();
-	if (!handle) return {
-		ok: false,
-		partial: false,
-		problems: ["publish needs a signed-in Firestore session: connect remote-host first. Publishing writes the app's roster and configuration as the app's owner, which is an authenticated write."]
-	};
-	const authored = await readAuthored(root);
-	if (!authored.ok) return {
-		...authored,
-		partial: false
-	};
-	const collections = await sharedCollections(opts, root);
-	const problems = declarationProblems(authored.app, collections, handle);
-	if (problems.length > 0) return {
-		ok: false,
-		partial: false,
-		problems
-	};
-	const issues = await recordProblems(collections, {
-		...opts,
-		workspaceRoot: root
-	});
-	if (issues.unreadable.length > 0) return {
-		ok: false,
-		partial: false,
-		problems: [...issues.unreadable, "publish stopped: the live records could not be read, so nothing checked whether the schemas about to be published still fit them. This is not something `confirm` overrides — confirming means accepting a known breakage, and here there is no reading at all. Fix the access (or the connection) and publish again."]
-	};
-	if (issues.records > 0 && opts.confirm !== true) return {
-		ok: false,
-		partial: false,
-		problems: [...issues.lines, "publish stopped: these records are live and members are reading them. Migrate them first, or re-run with confirm to publish the schema anyway and repair the records afterwards."]
-	};
-	return writePublished(authored.app, collections, handle, opts, root, issues);
-}
-/** The write half: stamp, project, and put the documents in the order the
-*  rules require. Split from the gate above so neither half hides the other —
-*  everything up to here can refuse, and nothing from here on does. */
-async function writePublished(authored, collections, handle, opts, root, issues) {
-	const { aid } = authored;
-	let existing;
-	try {
-		existing = await handle.docs.get(APPS_COLLECTION, aid);
-	} catch (err) {
-		return {
-			ok: false,
-			partial: false,
-			problems: [`publish failed while reading the current app document (apps/${aid}): ${err instanceof Error ? err.message : String(err)}`, "Nothing was written. Publishing again is safe — this read only decides whether the app is created or updated."]
-		};
-	}
-	const stampSource = await (opts.resolveCommit ?? gitStamp)(root);
-	const stamp = {
-		uid: handle.uid,
-		email: handle.email,
-		publishedAt: (opts.now ?? Date.now)(),
-		commit: stampSource.commit
-	};
-	const existingApp = require_dist.isRecord(existing) ? existing : null;
-	const published = projectApp(authored, schemasOf(collections), stamp, existingApp);
-	if (stampSource.dirty === true) published.app.publishedDirty = true;
-	const written = await writeDocuments(handle, aid, published);
-	if (written !== null) return written;
-	return {
-		ok: true,
-		aid,
-		cids: published.schemas.map((entry) => entry.cid),
-		created: existingApp === null,
-		commit: stamp.commit,
-		dirty: stampSource.dirty === true,
-		recordIssues: issues.records,
-		recordIssuesCapped: issues.capped,
-		published
-	};
-}
-//#endregion
 //#region src/collection/server/skillAssets.ts
 /** Read a collection's custom-view HTML, path-safely. `viewFile` is a
 *  schema-validated `views/*.html` path, resolved with realpath containment.
@@ -1075,13 +725,13 @@ async function readCustomViewHtml(collection, viewFile, opts = {}) {
 *  `readCustomViewHtml`. Used by both `readCustomViewHtml` and
 *  `readCustomViewI18n` so the two stay in lockstep. */
 async function readSourceAwareFile(collection, relPath, opts) {
-	const safeSlug = require_store.safeSlugName(collection.slug);
+	const safeSlug = require_discovery.safeSlugName(collection.slug);
 	if (safeSlug === null) return null;
-	const workspaceRoot = opts.workspaceRoot ?? require_store.getWorkspaceRoot();
-	const staging = collection.source === "project" ? require_store.stagingSkillDir(workspaceRoot, safeSlug) : null;
+	const workspaceRoot = opts.workspaceRoot ?? require_discovery.getWorkspaceRoot();
+	const staging = collection.source === "project" ? require_discovery.stagingSkillDir(workspaceRoot, safeSlug) : null;
 	const bases = staging === null ? [collection.skillDir] : [staging, collection.skillDir];
 	for (const base of bases) {
-		const resolved = require_store.resolveTemplatePath(base, relPath);
+		const resolved = require_discovery.resolveTemplatePath(base, relPath);
 		if (resolved === null) continue;
 		try {
 			return await (0, node_fs_promises.readFile)(resolved, "utf-8");
@@ -1139,9 +789,9 @@ async function readCustomViewI18n(collection, i18nFile, locale, opts = {}) {
 *  the file contents, or null when the path escapes the skill dir, the
 *  resolved target isn't a regular file, or the read fails. */
 async function readSkillTemplate(skillDir, templateRelPath) {
-	const resolved = require_store.resolveTemplatePath(skillDir, templateRelPath);
+	const resolved = require_discovery.resolveTemplatePath(skillDir, templateRelPath);
 	if (resolved === null) return null;
-	if (!await require_store.isRegularFile(resolved)) return null;
+	if (!await require_discovery.isRegularFile(resolved)) return null;
 	try {
 		return await (0, node_fs_promises.readFile)(resolved, "utf-8");
 	} catch {
@@ -1283,11 +933,11 @@ function absentReferencedColumns(rows, query) {
 /** Run a validated query over enriched collection rows. */
 async function runQueryOverRows(rows, query) {
 	if (rows.length === 0) return emptyCollectionResult(query);
-	await (0, node_fs_promises.mkdir)(require_store.cacheDir(), {
+	await (0, node_fs_promises.mkdir)(require_discovery.cacheDir(), {
 		recursive: true,
 		mode: 448
 	});
-	const jsonlPath = node_path.default.join(require_store.cacheDir(), `q-${(0, node_crypto.randomBytes)(8).toString("hex")}.jsonl`);
+	const jsonlPath = node_path.default.join(require_discovery.cacheDir(), `q-${(0, node_crypto.randomBytes)(8).toString("hex")}.jsonl`);
 	try {
 		const nullPads = Object.fromEntries(absentReferencedColumns(rows, query).map((column) => [column, null]));
 		const handle = await (0, node_fs_promises.open)(jsonlPath, "wx", 384);
@@ -1303,115 +953,347 @@ async function runQueryOverRows(rows, query) {
 		} finally {
 			await handle.close();
 		}
-		const { sql, params } = require_store.compileJsonlQuery(query);
-		return (await require_store.queryCsv(sql, [jsonlPath, ...params])).map((row) => Object.fromEntries(Object.entries(row).map(([key, value]) => [key, require_store.normalizeCsvValue(value)])));
+		const { sql, params } = require_discovery.compileJsonlQuery(query);
+		return (await require_discovery.queryCsv(sql, [jsonlPath, ...params])).map((row) => Object.fromEntries(Object.entries(row).map(([key, value]) => [key, require_discovery.normalizeCsvValue(value)])));
 	} finally {
 		await (0, node_fs_promises.unlink)(jsonlPath).catch((err) => {
-			if (!require_dist.isErrorWithCode(err) || err.code !== "ENOENT") require_store.log.warn("collections", "temp JSONL cleanup failed", {
+			if (!require_dist.isErrorWithCode(err) || err.code !== "ENOENT") require_discovery.log.warn("collections", "temp JSONL cleanup failed", {
 				path: jsonlPath,
 				error: String(err)
 			});
-		});
-	}
+		});
+	}
+}
+//#endregion
+//#region src/collection/server/derive.ts
+async function loadTarget(slug, opts) {
+	const target = await require_discovery.loadCollection(slug, opts);
+	if (!target) return null;
+	const items = await require_discovery.storeFor(target, { workspaceRoot: opts.workspaceRoot }).list();
+	const byId = {};
+	for (const item of items) {
+		const itemId = item[target.schema.primaryKey];
+		if (typeof itemId === "string" && itemId.length > 0) byId[itemId] = require_promptSafety.deriveAll(target.schema, item, {});
+	}
+	return {
+		schema: target.schema,
+		byId
+	};
+}
+/** Load every ref/embed target and backlink source collection once.
+*  Unknown / unloadable targets are simply absent — downstream derefs
+*  resolve to null (em-dash) and backlinks to an empty row set, the
+*  same fail-soft the UI renders. */
+async function loadLinkedTargets(schema, opts) {
+	const slugs = [.../* @__PURE__ */ new Set([
+		...require_promptSafety.uniqueRefTargets(schema),
+		...require_promptSafety.uniqueEmbedTargets(schema),
+		...require_promptSafety.uniqueBacklinkSources(schema)
+	])];
+	const loaded = {};
+	for (const slug of slugs) {
+		const target = await loadTarget(slug, opts);
+		if (target) loaded[slug] = target;
+	}
+	return loaded;
+}
+function toRefRecords(linked) {
+	return Object.fromEntries(Object.entries(linked).map(([slug, target]) => [slug, target.byId]));
+}
+/** The matching source rows for one `backlinks` field, projected to the
+*  source primaryKey + `display` columns — so getItems on a
+*  heavily-referenced record stays a summary, not a dump of the source
+*  collection. Missing source ⇒ [] (fail-soft). The rows come from the
+*  DERIVED source records (`byId`), so `display`/`filter` on a derived
+*  source column (an invoice `total`) works. */
+function projectBacklinks(field, schema, enriched, linked) {
+	const source = linked[field.from];
+	if (!source) return [];
+	const selfId = require_itemId.fieldText(enriched[schema.primaryKey]);
+	return require_promptSafety.backlinkRows(field, selfId, Object.values(source.byId)).map((row) => require_promptSafety.projectBacklinkRow(row, field.display, source.schema.primaryKey));
+}
+/** Project the computed (never-stored) field kinds onto one derived
+*  record: `toggle` → boolean off its enum, `embed` → the target record
+*  (fixed `id` or per-record `idField`), or null when missing,
+*  `backlinks` → the matching source rows (see `projectBacklinks`). */
+function projectComputed(schema, enriched, linked) {
+	for (const [key, field] of Object.entries(schema.fields)) {
+		if (field.type === "toggle" && field.field) enriched[key] = require_itemId.fieldText(enriched[field.field]) === field.onValue;
+		if (field.type === "embed" && field.to) {
+			const targetId = require_itemId.embedTargetId(field, enriched);
+			const target = require_promptSafety.ownProp(linked, field.to);
+			enriched[key] = targetId && target && require_promptSafety.ownProp(target.byId, targetId) || null;
+		}
+		if (field.type === "backlinks") enriched[key] = projectBacklinks(field, schema, enriched, linked);
+	}
+	return enriched;
+}
+/** Resolve every rollup field onto a COPY of the record, BEFORE the
+*  formula pass — a `derived` formula may reference rollup values as
+*  plain identifiers (`played = homePlayed + awayPlayed`). Same reverse
+*  machinery as backlinks, collapsed to a number: an unresolvable source
+*  is null (a formula reading it fails soft to em-dash); an empty match
+*  set is a real 0. Returns `record` unchanged when the schema declares
+*  no rollups. */
+function projectRollups(schema, record, linked) {
+	let out = record;
+	for (const [key, field] of Object.entries(schema.fields)) {
+		if (field.type !== "rollup") continue;
+		if (out === record) out = { ...record };
+		const source = linked[field.from];
+		const selfId = require_itemId.fieldText(record[schema.primaryKey]);
+		out[key] = source ? require_promptSafety.rollupValue(field, selfId, Object.values(source.byId)) : null;
+	}
+	return out;
+}
+/** Enrich records with every host-computed field: derived formulas
+*  evaluated (cross-collection derefs included), toggles projected,
+*  embeds resolved. Loads each linked collection ONCE per call. Input
+*  records are not mutated. */
+async function enrichItems(collection, items, opts = {}) {
+	const { schema } = collection;
+	const linked = await loadLinkedTargets(schema, opts);
+	const refRecords = toRefRecords(linked);
+	return items.map((item) => projectComputed(schema, require_promptSafety.deriveAll(schema, projectRollups(schema, item, linked), refRecords), linked));
+}
+//#endregion
+//#region src/collection/server/queryRunner.ts
+async function runCollectionQuery(collection, query, opts = {}) {
+	const store = require_discovery.storeFor(collection, { workspaceRoot: opts.workspaceRoot });
+	if (store.query) return store.query(query);
+	return runQueryOverRows(await enrichItems(collection, await store.list(), opts), query);
+}
+//#endregion
+//#region src/collection/core/recordZ.ts
+/** The emptiness rule shared by `required` and the "only check present
+*  values" gate. NOT a truthiness check — `0` and `false` are filled. */
+var isEmptyValue = (value) => value === void 0 || value === null || value === "";
+/** The historical write-gate checks, verbatim: required non-empty, enum
+*  membership (compared as strings, so a numeric `5` satisfies `"5"`). */
+function enforcedProblem(key, spec, value) {
+	const empty = isEmptyValue(value);
+	if (spec.required && empty) return `missing required field '${key}'`;
+	if (!empty && spec.type === "enum" && !spec.values.includes(String(value))) return `'${key}' = '${String(value)}' is not one of [${spec.values.join(", ")}]`;
+	return null;
+}
+/** Report-only per-type checks on a PRESENT value. Date / datetime reuse the
+*  calendar's STRICT civil parsers (`parseIsoDate` / `parseIsoDateTime`), so
+*  the lint flags exactly the values the calendar / trigger / spawn code
+*  would silently drop — impossible days like `2026-02-30`, and datetimes
+*  outside the canonical `YYYY-MM-DDTHH:MM[:SS]` shape (e.g. a `Z` suffix,
+*  which the day view can't place). `string`-backed types accept anything
+*  stringifiable; `ref` existence is out of scope. */
+function strictTypeProblem(key, spec, value) {
+	switch (spec.type) {
+		case "number":
+		case "money": return Number.isFinite(require_promptSafety.coerceNumeric(value)) ? null : `'${key}' = '${String(value)}' is not numeric (a '${spec.type}' field stores a plain number)`;
+		case "boolean": return value === true || value === false ? null : `'${key}' = '${String(value)}' is not a boolean (store true or false, unquoted)`;
+		case "date": return require_itemId.parseIsoDate(value) !== null ? null : `'${key}' = '${String(value)}' is not a real YYYY-MM-DD date`;
+		case "datetime": return require_itemId.parseIsoDateTime(value) !== null ? null : `'${key}' = '${String(value)}' is not a YYYY-MM-DDTHH:MM datetime (seconds optional, no timezone suffix — the shape the calendar parses)`;
+		default: return null;
+	}
+}
+/** Strict check for a PRESENT `table` value: an array of row objects, each
+*  row conforming to the sub-schema (required / enum / typed sub-values).
+*  First row problem wins, prefixed with the row number so the fix is
+*  locatable. */
+function strictTableProblem(key, spec, value) {
+	if (!Array.isArray(value)) return `'${key}' = '${String(value)}' is not an array of rows (a 'table' field stores an array of row objects)`;
+	for (let index = 0; index < value.length; index++) {
+		const row = value[index];
+		if (!require_dist.isRecord(row)) return `'${key}' row ${index + 1} is not an object`;
+		for (const [subKey, subSpec] of Object.entries(spec.of)) {
+			const subValue = row[subKey];
+			const problem = enforcedProblem(subKey, subSpec, subValue) ?? (isEmptyValue(subValue) ? null : strictTypeProblem(subKey, subSpec, subValue));
+			if (problem) return `'${key}' row ${index + 1}: ${problem}`;
+		}
+	}
+	return null;
+}
+/** First problem for one field's stored value under `tier`, or null.
+*  Enforced checks always run (and their messages never vary by tier — the
+*  scan and the write gate must agree on them); strict adds the per-type
+*  layer on present values only. */
+function recordFieldProblem(key, spec, value, tier) {
+	const enforced = enforcedProblem(key, spec, value);
+	if (enforced || tier === "enforced") return enforced;
+	if (isEmptyValue(value)) return null;
+	if (spec.type === "table") return strictTableProblem(key, spec, value);
+	return strictTypeProblem(key, spec, value);
+}
+var compiled = /* @__PURE__ */ new WeakMap();
+/** Compile `schema.fields` into a zod validator for a stored record.
+*  Loose object: unknown keys are allowed and any declared key may be
+*  absent (records are user files, not parse-and-rewrite targets —
+*  callers validate, they never persist the parse output). The checks run
+*  as ONE object-level refine iterating fields in declaration order —
+*  per-key shape schemas can't express "key may be absent BUT its absence
+*  must still reach the required check", and the single loop keeps the
+*  first reported issue identical to the historical first-problem-wins
+*  contract. */
+function compileRecordZ(schema, tier) {
+	const cached = compiled.get(schema)?.[tier];
+	if (cached) return cached;
+	const stored = Object.entries(schema.fields).filter(([, spec]) => !require_itemId.COMPUTED_TYPES.has(spec.type));
+	const validator = zod.z.looseObject({}).superRefine((record, ctx) => {
+		for (const [key, spec] of stored) {
+			const problem = recordFieldProblem(key, spec, record[key], tier);
+			if (problem) ctx.addIssue({
+				code: "custom",
+				message: problem,
+				path: [key]
+			});
+		}
+	});
+	const entry = compiled.get(schema) ?? {};
+	entry[tier] = validator;
+	compiled.set(schema, entry);
+	return validator;
+}
+/** First schema problem on an in-memory record under `tier`, or null. One
+*  issue per record keeps the report short and the fix obvious (the
+*  historical contract of `validateRecordObject`). */
+function firstRecordProblem(record, schema, tier) {
+	const result = compileRecordZ(schema, tier).safeParse(record);
+	if (result.success) return null;
+	return result.error.issues[0]?.message ?? "record failed schema validation";
 }
 //#endregion
-//#region src/collection/server/derive.ts
-async function loadTarget(slug, opts) {
-	const target = await require_store.loadCollection(slug, opts);
-	if (!target) return null;
-	const items = await require_store.storeFor(target, { workspaceRoot: opts.workspaceRoot }).list();
-	const byId = {};
-	for (const item of items) {
-		const itemId = item[target.schema.primaryKey];
-		if (typeof itemId === "string" && itemId.length > 0) byId[itemId] = require_promptSafety.deriveAll(target.schema, item, {});
+//#region src/collection/server/validate.ts
+/** Don't flood the result; the first batch is enough to act on. Exported
+*  because a caller that REPORTS a count has to know the count is a floor —
+*  `publish` presents a full batch as "at least N" rather than as a total. */
+var MAX_RECORD_ISSUES = 25;
+/** The `file` of the pseudo-issue reported when the backend could not be read
+*  at all.
+*
+*  Exported because it is a DIFFERENT KIND of answer from "this record is
+*  invalid", and a caller that treats the two alike gets it wrong in the
+*  direction that matters: `publish` lets the user override invalid records,
+*  and overriding this one would mean publishing without ever having looked. */
+var STORE_UNREADABLE = "(store)";
+var MAX_ISSUES = 25;
+/** Read every `<id>.json` under the collection's dataDir and report the
+*  ones that won't load or violate the schema. An empty list means every
+*  record is fine. */
+/** List entries under the data dir, guarding realpath containment (against a
+*  symlinked dir swapped in after discovery, like `listItems`) and treating a
+*  missing dir as empty while surfacing real I/O faults. */
+async function listRecordFilenames(dataDir, workspaceRoot) {
+	if (!require_discovery.isContainedInRoot(dataDir, workspaceRoot)) {
+		require_discovery.log.warn("collections", "validate refused: dataDir escapes workspace via symlink", { dataDir });
+		return [];
 	}
-	return {
-		schema: target.schema,
-		byId
-	};
-}
-/** Load every ref/embed target and backlink source collection once.
-*  Unknown / unloadable targets are simply absent — downstream derefs
-*  resolve to null (em-dash) and backlinks to an empty row set, the
-*  same fail-soft the UI renders. */
-async function loadLinkedTargets(schema, opts) {
-	const slugs = [.../* @__PURE__ */ new Set([
-		...require_promptSafety.uniqueRefTargets(schema),
-		...require_promptSafety.uniqueEmbedTargets(schema),
-		...require_promptSafety.uniqueBacklinkSources(schema)
-	])];
-	const loaded = {};
-	for (const slug of slugs) {
-		const target = await loadTarget(slug, opts);
-		if (target) loaded[slug] = target;
+	try {
+		return await (0, node_fs_promises.readdir)(dataDir);
+	} catch (err) {
+		if (require_dist.isErrorWithCode(err) && err.code === "ENOENT") return [];
+		throw err;
 	}
-	return loaded;
 }
-function toRefRecords(linked) {
-	return Object.fromEntries(Object.entries(linked).map(([slug, target]) => [slug, target.byId]));
+async function validateCollectionRecords(collection, opts = {}) {
+	if (collection.schema.dataSource !== void 0) return [];
+	if (collection.schema.storage !== void 0) return validateStoreRecords(collection, opts);
+	const workspaceRoot = opts.workspaceRoot ?? require_discovery.getWorkspaceRoot();
+	const entries = await listRecordFilenames(collection.dataDir, workspaceRoot);
+	const issues = [];
+	for (const name of entries.sort()) {
+		if (!name.endsWith(".json") || name.startsWith(".")) continue;
+		if (issues.length >= MAX_ISSUES) break;
+		const issue = await inspectRecord(node_path.default.join(collection.dataDir, name), name, collection.schema);
+		if (issue) issues.push(issue);
+	}
+	return issues;
 }
-/** The matching source rows for one `backlinks` field, projected to the
-*  source primaryKey + `display` columns — so getItems on a
-*  heavily-referenced record stays a summary, not a dump of the source
-*  collection. Missing source ⇒ [] (fail-soft). The rows come from the
-*  DERIVED source records (`byId`), so `display`/`filter` on a derived
-*  source column (an invoice `total`) works. */
-function projectBacklinks(field, schema, enriched, linked) {
-	const source = linked[field.from];
-	if (!source) return [];
-	const selfId = require_calendarGrid.fieldText(enriched[schema.primaryKey]);
-	return require_promptSafety.backlinkRows(field, selfId, Object.values(source.byId)).map((row) => require_promptSafety.projectBacklinkRow(row, field.display, source.schema.primaryKey));
+/** Store-backed twin of the file scan: list every record through the
+*  collection's store and lint it with the same "strict" report-only tier.
+*  A row the store can't even parse is invisible here (the store skips
+*  it), so the read/parse classifications of the file scan don't apply —
+*  schema violations are what this catches. `file` carries the record id
+*  (there is no per-record filename). */
+async function validateStoreRecords(collection, opts) {
+	let items;
+	try {
+		items = await require_discovery.storeFor(collection, { workspaceRoot: opts.workspaceRoot }).list();
+	} catch (err) {
+		return [{
+			file: STORE_UNREADABLE,
+			problem: `records could not be read from the storage backend: ${err instanceof Error ? err.message : String(err)}`
+		}];
+	}
+	const issues = [];
+	for (const item of items) {
+		if (issues.length >= MAX_ISSUES) break;
+		const itemId = require_itemId.fieldText(item[collection.schema.primaryKey]);
+		const problem = validateRecordObject(item, itemId, collection.schema, "strict");
+		if (problem) issues.push({
+			file: itemId,
+			problem
+		});
+	}
+	return issues;
 }
-/** Project the computed (never-stored) field kinds onto one derived
-*  record: `toggle` → boolean off its enum, `embed` → the target record
-*  (fixed `id` or per-record `idField`), or null when missing,
-*  `backlinks` → the matching source rows (see `projectBacklinks`). */
-function projectComputed(schema, enriched, linked) {
-	for (const [key, field] of Object.entries(schema.fields)) {
-		if (field.type === "toggle" && field.field) enriched[key] = require_calendarGrid.fieldText(enriched[field.field]) === field.onValue;
-		if (field.type === "embed" && field.to) {
-			const targetId = require_calendarGrid.embedTargetId(field, enriched);
-			const target = require_promptSafety.ownProp(linked, field.to);
-			enriched[key] = targetId && target && require_promptSafety.ownProp(target.byId, targetId) || null;
-		}
-		if (field.type === "backlinks") enriched[key] = projectBacklinks(field, schema, enriched, linked);
+async function readRecordText(fullPath, name) {
+	try {
+		if (!(await (0, node_fs_promises.lstat)(fullPath)).isFile()) return {
+			file: name,
+			problem: "not a regular file (symlink?) — skipped, won't appear"
+		};
+		return { raw: await (0, node_fs_promises.readFile)(fullPath, "utf-8") };
+	} catch {
+		return {
+			file: name,
+			problem: "could not be read — skipped, won't appear"
+		};
 	}
-	return enriched;
 }
-/** Resolve every rollup field onto a COPY of the record, BEFORE the
-*  formula pass — a `derived` formula may reference rollup values as
-*  plain identifiers (`played = homePlayed + awayPlayed`). Same reverse
-*  machinery as backlinks, collapsed to a number: an unresolvable source
-*  is null (a formula reading it fails soft to em-dash); an empty match
-*  set is a real 0. Returns `record` unchanged when the schema declares
-*  no rollups. */
-function projectRollups(schema, record, linked) {
-	let out = record;
-	for (const [key, field] of Object.entries(schema.fields)) {
-		if (field.type !== "rollup") continue;
-		if (out === record) out = { ...record };
-		const source = linked[field.from];
-		const selfId = require_calendarGrid.fieldText(record[schema.primaryKey]);
-		out[key] = source ? require_promptSafety.rollupValue(field, selfId, Object.values(source.byId)) : null;
+/** Classify a single record file: unreadable / unparseable / non-object /
+*  schema violation, or null when it's fine. */
+async function inspectRecord(fullPath, name, schema) {
+	const read = await readRecordText(fullPath, name);
+	if ("problem" in read) return read;
+	let parsed;
+	try {
+		parsed = JSON.parse(read.raw);
+	} catch (err) {
+		return {
+			file: name,
+			problem: `invalid JSON (${err instanceof Error ? err.message : String(err)}) — SKIPPED, won't appear. Usual cause: an unescaped " inside a string value; use 「」/『』 or write \\" instead.`
+		};
 	}
-	return out;
+	if (!require_dist.isRecord(parsed)) return {
+		file: name,
+		problem: "not a JSON object — skipped, won't appear"
+	};
+	const problem = validateRecordObject(parsed, name.replace(/\.json$/, ""), schema, "strict");
+	return problem ? {
+		file: name,
+		problem
+	} : null;
 }
-/** Enrich records with every host-computed field: derived formulas
-*  evaluated (cross-collection derefs included), toggles projected,
-*  embeds resolved. Loads each linked collection ONCE per call. Input
-*  records are not mutated. */
-async function enrichItems(collection, items, opts = {}) {
-	const { schema } = collection;
-	const linked = await loadLinkedTargets(schema, opts);
-	const refRecords = toRefRecords(linked);
-	return items.map((item) => projectComputed(schema, require_promptSafety.deriveAll(schema, projectRollups(schema, item, linked), refRecords), linked));
+/** What a non-string primary key actually is, for the error message. Names the
+*  shape rather than stringifying the value — "[object Object]" tells the reader
+*  nothing about what is wrong. */
+function describeIdType(value) {
+	if (value === null) return "null";
+	if (value === void 0) return "missing";
+	if (Array.isArray(value)) return "an array";
+	return `a ${typeof value}`;
 }
-//#endregion
-//#region src/collection/server/queryRunner.ts
-async function runCollectionQuery(collection, query, opts = {}) {
-	const store = require_store.storeFor(collection, { workspaceRoot: opts.workspaceRoot });
-	if (store.query) return store.query(query);
-	return runQueryOverRows(await enrichItems(collection, await store.list(), opts), query);
+/** First schema problem on an in-memory record (primaryKey↔id mismatch,
+*  then the compiled per-field checks — see `../core/recordZ` for the two
+*  tiers), or null when it's fine. One issue per record keeps the report
+*  short and the fix obvious. Pure + exported so write paths
+*  (manageCollection putItems) can gate on the SAME enforced rules the
+*  post-hoc file scan reports — `itemId` is the id the record is (or
+*  would be) stored under. The default `"enforced"` tier keeps every
+*  write gate on the historical three checks; only pass `"strict"` from
+*  report-only surfaces. */
+function validateRecordObject(record, itemId, schema, tier = "enforced") {
+	const idValue = record[schema.primaryKey];
+	if (typeof idValue !== "string") return `'${schema.primaryKey}' must be a string, but is ${describeIdType(idValue)} — must equal the filename ('${itemId}'), or the record can't be opened`;
+	if (idValue !== itemId) return `'${schema.primaryKey}' is '${idValue}' but must equal the filename ('${itemId}'), or the record can't be opened`;
+	return firstRecordProblem(record, schema, tier);
 }
 //#endregion
 //#region src/collection/server/mutate.ts
@@ -1438,7 +1320,7 @@ async function applyMutateAction(collection, action, itemId, params, opts = {})
 		status: "invalid-params",
 		problem: paramProblem
 	};
-	const store = require_store.storeFor(collection, opts);
+	const store = require_discovery.storeFor(collection, opts);
 	if (!store.write) return {
 		ok: false,
 		status: "write-refused",
@@ -1457,11 +1339,11 @@ async function applyMutateAction(collection, action, itemId, params, opts = {})
 	};
 	const stored = Object.entries(existing).filter(([key]) => {
 		const spec = collection.schema.fields[key];
-		return !spec || !require_calendarGrid.COMPUTED_TYPES.has(spec.type);
+		return !spec || !require_itemId.COMPUTED_TYPES.has(spec.type);
 	});
 	const merged = {
 		...Object.fromEntries(stored),
-		...require_store.resolveMutateSet(action.set, params)
+		...require_discovery.resolveMutateSet(action.set, params)
 	};
 	const invalid = validateRecordObject(merged, itemId, collection.schema);
 	if (invalid) return {
@@ -1519,10 +1401,10 @@ function schemaRelations(schema) {
 *  Fail-soft: a missing dir or a dataDir escaping the workspace via
 *  symlink counts 0. */
 async function countRecordFiles(dataDir, workspaceRoot) {
-	if (!require_store.isContainedInRoot(dataDir, workspaceRoot)) return 0;
+	if (!require_discovery.isContainedInRoot(dataDir, workspaceRoot)) return 0;
 	try {
 		const names = (await (0, node_fs_promises.readdir)(dataDir)).filter((name) => name.endsWith(".json") && !name.startsWith("."));
-		return (await Promise.all(names.map((name) => require_store.isRegularFile(node_path.default.join(dataDir, name))))).filter(Boolean).length;
+		return (await Promise.all(names.map((name) => require_discovery.isRegularFile(node_path.default.join(dataDir, name))))).filter(Boolean).length;
 	} catch {
 		return 0;
 	}
@@ -1534,10 +1416,10 @@ async function countRecordFiles(dataDir, workspaceRoot) {
 *  `countRecordFiles` (an unreadable file / missing engine must not
 *  break the whole ontology). */
 async function countRecords(collection, workspaceRoot) {
-	if (require_calendarGrid.storageKindFor(collection.schema) !== "file") try {
-		return (await require_store.storeFor(collection, { workspaceRoot }).page({ limit: 0 })).total;
+	if (require_itemId.storageKindFor(collection.schema) !== "file") try {
+		return (await require_discovery.storeFor(collection, { workspaceRoot }).page({ limit: 0 })).total;
 	} catch (err) {
-		if (require_store.isBackendUnavailable(err)) return null;
+		if (require_discovery.isBackendUnavailable(err)) return null;
 		return 0;
 	}
 	return countRecordFiles(collection.dataDir, workspaceRoot);
@@ -1558,8 +1440,8 @@ async function toOntologyEntry(collection, workspaceRoot) {
 *  discovery's order), each with its outbound relations and a
 *  readdir-cheap record count — fine to call on demand. */
 async function buildWorkspaceOntology(opts = {}) {
-	const workspaceRoot = opts.workspaceRoot ?? require_store.getWorkspaceRoot();
-	const collections = await require_store.discoverCollections(opts);
+	const workspaceRoot = opts.workspaceRoot ?? require_discovery.getWorkspaceRoot();
+	const collections = await require_discovery.discoverCollections(opts);
 	return Promise.all(collections.map((collection) => toOntologyEntry(collection, workspaceRoot)));
 }
 //#endregion
@@ -1579,7 +1461,7 @@ function buildRecordsById(items, primaryKey) {
 *  ties pick a different record — and thus a different icon — between
 *  reconciles. A stable id sort pins one answer. */
 function sortByPrimaryKey(items, primaryKey) {
-	return [...items].sort((left, right) => require_calendarGrid.fieldText(left[primaryKey]).localeCompare(require_calendarGrid.fieldText(right[primaryKey])));
+	return [...items].sort((left, right) => require_itemId.fieldText(left[primaryKey]).localeCompare(require_itemId.fieldText(right[primaryKey])));
 }
 /** Compute the effective launcher icon for `collection`: its static
 *  `schema.icon` when it declares no `dynamicIcon`, else the icon
@@ -1593,15 +1475,15 @@ async function computeCollectionIcon(collection, opts = {}) {
 	const spec = schema.dynamicIcon;
 	if (!spec) return schema.icon;
 	try {
-		const source = await require_store.loadCollection(spec.source.collection, opts);
+		const source = await require_discovery.loadCollection(spec.source.collection, opts);
 		if (!source) return spec.fallback ?? schema.icon;
-		const ordered = sortByPrimaryKey(await require_store.storeFor(source, { workspaceRoot: opts.workspaceRoot }).list(), source.schema.primaryKey);
+		const ordered = sortByPrimaryKey(await require_discovery.storeFor(source, { workspaceRoot: opts.workspaceRoot }).list(), source.schema.primaryKey);
 		const orderBy = spec.source.orderBy ?? require_promptSafety.firstDateField(source.schema);
 		const recordsById = buildRecordsById(ordered, source.schema.primaryKey);
 		const record = require_promptSafety.selectDynamicRecord(ordered, spec.source, orderBy, recordsById);
 		return require_promptSafety.resolveIcon(record, spec, schema.icon, recordsById);
 	} catch (err) {
-		require_store.log.warn("collections", "dynamic icon compute failed, falling back", {
+		require_discovery.log.warn("collections", "dynamic icon compute failed, falling back", {
 			slug: collection.slug,
 			source: spec.source.collection,
 			error: String(err)
@@ -1716,7 +1598,7 @@ function successorId(sourceId, next) {
 function matchesWhen(when, schema, item) {
 	if (when) {
 		const raw = item[when.field];
-		const text = require_calendarGrid.fieldTextOrNull(raw);
+		const text = require_itemId.fieldTextOrNull(raw);
 		return text !== null && when.in.includes(text);
 	}
 	return require_promptSafety.itemIsDone(schema, item);
@@ -1728,10 +1610,10 @@ function matchesWhen(when, schema, item) {
 *  Discovery rejects a map that doesn't cover the enum's values, so null
 *  here means a record that predates a map/enum edit. */
 function resolveEvery(every, sourceItem) {
-	if (!require_calendarGrid.isFieldDrivenEvery(every)) return every;
+	if (!require_itemId.isFieldDrivenEvery(every)) return every;
 	const raw = sourceItem[every.fromField];
 	if (raw === void 0 || raw === null || raw === "") return null;
-	const key = require_calendarGrid.fieldTextOrNull(raw);
+	const key = require_itemId.fieldTextOrNull(raw);
 	if (key === null || !Object.hasOwn(every.map, key)) return null;
 	return every.map[key] ?? null;
 }
@@ -1763,15 +1645,15 @@ function computeSuccessor(schema, sourceItem, sourceId) {
 *  predates a map/enum edit — discovery rejects this statically otherwise). */
 function logSpawnSkip(slug, triggerField, every, sourceItem, sourceId) {
 	if (parseCivil(sourceItem[triggerField]) === null) {
-		require_store.log.warn("collections", "spawn skipped: source trigger date unparseable", {
+		require_discovery.log.warn("collections", "spawn skipped: source trigger date unparseable", {
 			slug,
 			sourceId,
 			triggerField
 		});
 		return;
 	}
-	const fromField = require_calendarGrid.isFieldDrivenEvery(every) ? every.fromField : void 0;
-	require_store.log.warn("collections", "spawn skipped: no `every` mapping for frequency value", {
+	const fromField = require_itemId.isFieldDrivenEvery(every) ? every.fromField : void 0;
+	require_discovery.log.warn("collections", "spawn skipped: no `every` mapping for frequency value", {
 		slug,
 		sourceId,
 		fromField,
@@ -1794,7 +1676,7 @@ async function maybeSpawnSuccessor(collection, sourceItem, sourceId, ioOpts = {}
 		return;
 	}
 	if (matchesWhen(spawn.when, schema, computed.record)) {
-		require_store.log.warn("collections", "spawn skipped: successor would be born matching its own predicate (unbounded respawn)", {
+		require_discovery.log.warn("collections", "spawn skipped: successor would be born matching its own predicate (unbounded respawn)", {
 			slug,
 			sourceId,
 			successorId: computed.id
@@ -1802,28 +1684,28 @@ async function maybeSpawnSuccessor(collection, sourceItem, sourceId, ioOpts = {}
 		return;
 	}
 	try {
-		const { write } = require_store.storeFor(collection, ioOpts);
+		const { write } = require_discovery.storeFor(collection, ioOpts);
 		if (!write) {
-			require_store.log.warn("collections", "spawn skipped: collection store is read-only", {
+			require_discovery.log.warn("collections", "spawn skipped: collection store is read-only", {
 				slug,
 				sourceId
 			});
 			return;
 		}
 		const result = await write(computed.id, computed.record, { refuseOverwrite: true });
-		if (result.kind === "ok") require_store.log.info("collections", "spawned successor", {
+		if (result.kind === "ok") require_discovery.log.info("collections", "spawned successor", {
 			slug,
 			sourceId,
 			successorId: computed.id
 		});
-		else if (result.kind !== "conflict") require_store.log.warn("collections", "spawn write failed", {
+		else if (result.kind !== "conflict") require_discovery.log.warn("collections", "spawn write failed", {
 			slug,
 			sourceId,
 			successorId: computed.id,
 			kind: result.kind
 		});
 	} catch (err) {
-		require_store.log.warn("collections", "spawn write threw", {
+		require_discovery.log.warn("collections", "spawn write threw", {
 			slug,
 			sourceId,
 			successorId: computed.id,
@@ -1862,7 +1744,7 @@ function todayStamp() {
 /** Every directory the delete will touch must resolve under the
 *  workspace root — guards against a symlinked ancestor escaping it. */
 function deleteTargets(collection, workspaceRoot) {
-	const staging = require_store.stagingSkillDir(workspaceRoot, collection.slug);
+	const staging = require_discovery.stagingSkillDir(workspaceRoot, collection.slug);
 	return [
 		...staging === null ? [] : [staging],
 		collection.skillDir,
@@ -1974,12 +1856,12 @@ function recordLocationLabel(schema) {
 }
 /** Copy one skill copy + the records + RESTORE.md into `archiveDir`. */
 async function writeArchive(collection, archiveDir, workspaceRoot) {
-	const staging = require_store.stagingSkillDir(workspaceRoot, collection.slug);
+	const staging = require_discovery.stagingSkillDir(workspaceRoot, collection.slug);
 	const skillSrc = staging !== null && await pathExists(staging) ? staging : collection.skillDir;
 	await (0, node_fs_promises.cp)(skillSrc, node_path.default.join(archiveDir, "skill"), { recursive: true });
 	if (await pathExists(collection.dataDir)) await (0, node_fs_promises.cp)(collection.dataDir, node_path.default.join(archiveDir, "records"), { recursive: true });
 	if (collection.storageFile !== void 0 && await pathExists(collection.storageFile)) {
-		const checkpointed = await require_store.checkpointSqliteDatabase(collection.storageFile);
+		const checkpointed = await require_discovery.checkpointSqliteDatabase(collection.storageFile);
 		await (0, node_fs_promises.cp)(collection.storageFile, node_path.default.join(archiveDir, node_path.default.basename(collection.storageFile)));
 		if (!checkpointed) for (const suffix of [
 			"-wal",
@@ -1996,7 +1878,7 @@ async function writeArchive(collection, archiveDir, workspaceRoot) {
 *  is a no-op; the now-empty data parent (`data/<slug>/` after its
 *  `items/` is gone) is swept too, but only when empty. */
 async function removeLocations(collection, workspaceRoot) {
-	const staging = require_store.stagingSkillDir(workspaceRoot, collection.slug);
+	const staging = require_discovery.stagingSkillDir(workspaceRoot, collection.slug);
 	if (staging !== null) await (0, node_fs_promises.rm)(staging, {
 		recursive: true,
 		force: true
@@ -2020,24 +1902,24 @@ async function removeLocations(collection, workspaceRoot) {
 }
 async function deleteCollection(collection, opts = {}) {
 	const { slug } = collection;
-	const workspaceRoot = opts.workspaceRoot ?? require_store.getWorkspaceRoot();
+	const workspaceRoot = opts.workspaceRoot ?? require_discovery.getWorkspaceRoot();
 	if (collection.source === "user") return {
 		kind: "user-scope",
 		slug
 	};
-	if (require_store.isPresetSlug(slug)) return {
+	if (require_discovery.isPresetSlug(slug)) return {
 		kind: "preset",
 		slug
 	};
 	if (collection.schema.storage?.type === "firestore") {
-		require_store.log.warn("collections", "deleteCollection refused: a shared collection's records can be neither archived nor removed here", { slug });
+		require_discovery.log.warn("collections", "deleteCollection refused: a shared collection's records can be neither archived nor removed here", { slug });
 		return {
 			kind: "unsupported-backend",
 			slug
 		};
 	}
 	if (!isDataDirSafe(collection.dataDir, slug, workspaceRoot)) {
-		require_store.log.warn("collections", "deleteCollection refused: dataDir is not under the per-collection root", {
+		require_discovery.log.warn("collections", "deleteCollection refused: dataDir is not under the per-collection root", {
 			slug,
 			dataDir: collection.dataDir
 		});
@@ -2046,19 +1928,19 @@ async function deleteCollection(collection, opts = {}) {
 			slug
 		};
 	}
-	if (deleteTargets(collection, workspaceRoot).some((target) => !require_store.isContainedInRoot(target, workspaceRoot))) {
-		require_store.log.warn("collections", "deleteCollection refused: a target escapes the workspace", { slug });
+	if (deleteTargets(collection, workspaceRoot).some((target) => !require_discovery.isContainedInRoot(target, workspaceRoot))) {
+		require_discovery.log.warn("collections", "deleteCollection refused: a target escapes the workspace", { slug });
 		return {
 			kind: "path-escape",
 			slug
 		};
 	}
-	const archiveRel = node_path.default.join(require_store.archiveDir(), `${opts.dateStamp ?? todayStamp()}-${(0, node_crypto.randomUUID)()}`);
+	const archiveRel = node_path.default.join(require_discovery.archiveDir(), `${opts.dateStamp ?? todayStamp()}-${(0, node_crypto.randomUUID)()}`);
 	const archiveDir$1 = node_path.default.join(workspaceRoot, archiveRel);
 	await (0, node_fs_promises.mkdir)(archiveDir$1, { recursive: true });
 	await writeArchive(collection, archiveDir$1, workspaceRoot);
 	await removeLocations(collection, workspaceRoot);
-	require_store.log.info("collections", "collection deleted + archived", {
+	require_discovery.log.info("collections", "collection deleted + archived", {
 		slug,
 		archive: archiveRel
 	});
@@ -2088,7 +1970,7 @@ async function fileExists(target) {
 *  deletes agree on both layouts. */
 async function canonicalBase(collection, workspaceRoot, safeSlug) {
 	if (collection.source !== "project") return collection.skillDir;
-	const staging = require_store.stagingSkillDir(workspaceRoot, safeSlug);
+	const staging = require_discovery.stagingSkillDir(workspaceRoot, safeSlug);
 	if (staging !== null && await fileExists(node_path.default.join(staging, "schema.json"))) return staging;
 	return collection.skillDir;
 }
@@ -2098,11 +1980,11 @@ async function canonicalBase(collection, workspaceRoot, safeSlug) {
 *  project collection (no staging mirror) doesn't have an empty staging tree
 *  materialised by a side effect of the delete. */
 async function schemaWriteTargets(collection, workspaceRoot, safeSlug) {
-	const active = node_path.default.join(collection.skillDir, require_store.SCHEMA_FILE);
+	const active = node_path.default.join(collection.skillDir, require_discovery.SCHEMA_FILE);
 	if (collection.source !== "project") return [active];
-	const staging = require_store.stagingSkillDir(workspaceRoot, safeSlug);
+	const staging = require_discovery.stagingSkillDir(workspaceRoot, safeSlug);
 	const targets = [];
-	if (staging !== null && await fileExists(node_path.default.join(staging, "schema.json"))) targets.push(node_path.default.join(staging, require_store.SCHEMA_FILE));
+	if (staging !== null && await fileExists(node_path.default.join(staging, "schema.json"))) targets.push(node_path.default.join(staging, require_discovery.SCHEMA_FILE));
 	targets.push(active);
 	return targets;
 }
@@ -2121,7 +2003,7 @@ async function unlinkIfPresent(target) {
 *  preserved verbatim. */
 async function removeViewFromSchemas(collection, viewId, workspaceRoot, safeSlug) {
 	const base = await canonicalBase(collection, workspaceRoot, safeSlug);
-	const canonical = node_path.default.join(base, require_store.SCHEMA_FILE);
+	const canonical = node_path.default.join(base, require_discovery.SCHEMA_FILE);
 	const parsed = JSON.parse(await (0, node_fs_promises.readFile)(canonical, "utf-8"));
 	const next = require_dist.isRecord(parsed) && require_dist.isUnknownArray(parsed.views) ? {
 		...parsed,
@@ -2135,8 +2017,8 @@ async function removeViewFromSchemas(collection, viewId, workspaceRoot, safeSlug
 *  refused (read-only / re-seeded on boot), consistent with `deleteCollection`. */
 async function deleteCustomView(collection, viewId, opts = {}) {
 	if (collection.source === "user") return { kind: "user-scope" };
-	if (require_store.isPresetSlug(collection.slug)) return { kind: "preset" };
-	const safeSlug = require_store.safeSlugName(collection.slug);
+	if (require_discovery.isPresetSlug(collection.slug)) return { kind: "preset" };
+	const safeSlug = require_discovery.safeSlugName(collection.slug);
 	if (safeSlug === null) return {
 		kind: "unsafe-path",
 		viewId
@@ -2147,8 +2029,8 @@ async function deleteCustomView(collection, viewId, opts = {}) {
 		kind: "not-found",
 		viewId
 	};
-	const workspaceRoot = opts.workspaceRoot ?? require_store.getWorkspaceRoot();
-	const htmlPath = require_store.resolveTemplatePath(await canonicalBase(collection, workspaceRoot, safeSlug), view.file);
+	const workspaceRoot = opts.workspaceRoot ?? require_discovery.getWorkspaceRoot();
+	const htmlPath = require_discovery.resolveTemplatePath(await canonicalBase(collection, workspaceRoot, safeSlug), view.file);
 	if (htmlPath === null) return {
 		kind: "unsafe-path",
 		viewId
@@ -2375,7 +2257,7 @@ var SCHEMA_DOCS_PROBE_SLUG = "_";
 /** Resolve the workspace root the same way every collections call does:
 *  the injected override (tests) or the configured collection host. */
 function resolveBase(deps) {
-	return deps.workspaceRoot ?? require_store.getWorkspaceRoot();
+	return deps.workspaceRoot ?? require_discovery.getWorkspaceRoot();
 }
 /** Where a collection skill is authored in THIS root, and therefore both which
 *  authoring guide `schemaDocs` serves and where `getSchema` / `putSchema`
@@ -2389,7 +2271,7 @@ function resolveBase(deps) {
 *  from there, so the tool would silently contradict its own documentation.
 *  Staged requires BOTH to agree; anything else is direct. */
 function authoringTarget(deps, slug) {
-	const stagingDir = deps.stagedSkillAuthoring === false ? null : require_store.stagingSkillDir(resolveBase(deps), slug);
+	const stagingDir = deps.stagedSkillAuthoring === false ? null : require_discovery.stagingSkillDir(resolveBase(deps), slug);
 	return {
 		variant: stagingDir === null ? "direct" : "staged",
 		stagingDir
@@ -2432,7 +2314,7 @@ async function recordIssuesWarning(collection, deps) {
 	return `${issues.length} record file(s) have data problems and are missing from this result. Fix each (Read → correct → Write):\n${lines}`;
 }
 async function loadRequestedItems(collection, ids, deps) {
-	const store = require_store.storeFor(collection, { workspaceRoot: deps.workspaceRoot });
+	const store = require_discovery.storeFor(collection, { workspaceRoot: deps.workspaceRoot });
 	if (!ids) return {
 		items: await store.list(),
 		missing: []
@@ -2441,7 +2323,7 @@ async function loadRequestedItems(collection, ids, deps) {
 	const missing = [];
 	for (const recordId of ids) {
 		const item = await store.read(recordId).catch((err) => {
-			if (require_store.isBackendUnavailable(err)) throw err;
+			if (require_discovery.isBackendUnavailable(err)) throw err;
 			return null;
 		});
 		if (item) items.push(item);
@@ -2472,7 +2354,7 @@ async function handleGetItems(collection, args, deps) {
 function computedKeyProblem(record, schema) {
 	for (const key of Object.keys(record)) {
 		const spec = schema.fields[key];
-		if (!spec || !require_calendarGrid.COMPUTED_TYPES.has(spec.type)) continue;
+		if (!spec || !require_itemId.COMPUTED_TYPES.has(spec.type)) continue;
 		if (spec.type === "toggle" && spec.field) return `'${key}' is a toggle projection — write the enum field '${spec.field}' instead`;
 		return `'${key}' is ${{
 			derived: "derived",
@@ -2506,13 +2388,13 @@ async function mergeWithExisting(collection, store, record, itemId) {
 	try {
 		existing = await store.read(itemId);
 	} catch (err) {
-		if (require_store.isBackendUnavailable(err)) throw err;
+		if (require_discovery.isBackendUnavailable(err)) throw err;
 		return `'${itemId}' has a malformed stored file — mode "merge" needs to read it; fix the file (Read → correct → Write) or replace it whole with "upsert"`;
 	}
 	if (!existing) return `'${itemId}' not found — mode "merge" updates an existing record; use "upsert" or "create" to add it`;
 	const stored = Object.entries(existing).filter(([key]) => {
 		const spec = collection.schema.fields[key];
-		return !spec || !require_calendarGrid.COMPUTED_TYPES.has(spec.type);
+		return !spec || !require_itemId.COMPUTED_TYPES.has(spec.type);
 	});
 	return {
 		...Object.fromEntries(stored),
@@ -2521,7 +2403,7 @@ async function mergeWithExisting(collection, store, record, itemId) {
 }
 async function putOneItem(collection, store, write, record, mode, deps) {
 	const { schema } = collection;
-	const itemId = require_store.resolveCreateItemId(schema, record);
+	const itemId = require_discovery.resolveCreateItemId(schema, record);
 	const reject = (about, problem) => ({ rejected: {
 		id: require_promptSafety.defangForPrompt(about),
 		problem: require_promptSafety.defangForPrompt(problem)
@@ -2552,7 +2434,7 @@ async function putOneItem(collection, store, write, record, mode, deps) {
 *  `runCollectionQuery`, shared with the desktop custom view's `/query`
 *  route so the two surfaces can never drift. */
 async function handleQueryItems(collection, queryArg, deps) {
-	const parsed = require_store.CollectionQueryZ.safeParse(queryArg);
+	const parsed = require_discovery.CollectionQueryZ.safeParse(queryArg);
 	if (!parsed.success) return `manageCollection: \`query\` rejected — fix and retry:\n${parsed.error.issues.slice(0, 20).map((issue) => `- ${issue.path.map(String).join(".") || "(root)"}: ${require_promptSafety.defangForPrompt(issue.message)}`).join("\n")}`;
 	const rows = await runCollectionQuery(collection, parsed.data, { workspaceRoot: deps.workspaceRoot });
 	return JSON.stringify({
@@ -2562,9 +2444,9 @@ async function handleQueryItems(collection, queryArg, deps) {
 	});
 }
 async function handlePutItems(collection, args, deps) {
-	const store = require_store.storeFor(collection, { workspaceRoot: deps.workspaceRoot });
+	const store = require_discovery.storeFor(collection, { workspaceRoot: deps.workspaceRoot });
 	const { write } = store;
-	if (!write) return `manageCollection: ${require_store.readOnlyRefusal(collection.slug)} (its records are the rows of '${collection.schema.dataSource?.path}'; edit that file to change the data).`;
+	if (!write) return `manageCollection: ${require_discovery.readOnlyRefusal(collection.slug)} (its records are the rows of '${collection.schema.dataSource?.path}'; edit that file to change the data).`;
 	const written = [];
 	const rejected = [];
 	for (const record of args.items) {
@@ -2583,8 +2465,8 @@ async function handlePutItems(collection, args, deps) {
 *  absent `delete` IS the refusal), and the same per-id result shape so a
 *  partially-bad batch reports per id instead of failing whole. */
 async function handleDeleteItems(collection, ids, deps) {
-	const { delete: removeItem } = require_store.storeFor(collection, { workspaceRoot: deps.workspaceRoot });
-	if (!removeItem) return `manageCollection: ${require_store.readOnlyRefusal(collection.slug)} (its records are the rows of '${collection.schema.dataSource?.path}'; edit that file to change the data).`;
+	const { delete: removeItem } = require_discovery.storeFor(collection, { workspaceRoot: deps.workspaceRoot });
+	if (!removeItem) return `manageCollection: ${require_discovery.readOnlyRefusal(collection.slug)} (its records are the rows of '${collection.schema.dataSource?.path}'; edit that file to change the data).`;
 	const deleted = [];
 	const rejected = [];
 	for (const itemId of ids) {
@@ -2653,32 +2535,6 @@ async function handleGetOntology(deps) {
 		collections
 	});
 }
-/** Publish this repository's `app.json` + shared schemas to its Firestore app.
-*
-*  Named as a whole-app action because it IS one: publish takes the repository
-*  as its unit (one roster, one public config, every shared collection), so it
-*  carries no `slug` and refusing one is not a limitation to work around.
-*
-*  The reply is prose rather than a status code on purpose. This is the one
-*  operation in the collection surface that changes what every member sees the
-*  moment it lands, and the two things the caller has to relay — what will
-*  break, and that `confirm` is how it proceeds anyway — are sentences, not
-*  fields. */
-async function handlePublishApp(deps, confirm) {
-	const result = await publishApp({
-		...deps,
-		confirm
-	});
-	if (!result.ok) {
-		const bullets = result.problems.map((problem) => `- ${problem}`).join("\n");
-		return `${result.partial ? "publish FAILED PART-WAY — some documents are already live:" : "publish refused — nothing was written:"}\n${bullets}`;
-	}
-	const dirtyNote = result.dirty ? " (WORKING TREE DIRTY — the commit does not describe what was published)" : "";
-	const stamp = result.commit ? `commit ${result.commit.slice(0, 12)}${dirtyNote}` : "no commit (not a git repository, or no HEAD)";
-	const brokenCount = result.recordIssuesCapped ? `at least ${result.recordIssues}` : `${result.recordIssues}`;
-	const forced = result.recordIssues > 0 ? ` Published over ${brokenCount} record(s) that do not satisfy the new schema — repair them now; members are reading them.` : "";
-	return `${result.created ? "Created" : "Updated"} app '${result.aid}' and published ${result.cids.length} collection(s): ${result.cids.join(", ")}. Signed ${stamp}. The previous app document is kept in \`previousPublished\` for rollback.${forced}`;
-}
 /** Return the collection-authoring reference (`collection-skills.md`),
 *  rendered by `renderSchemaDocs` — the full doc overflows the agent's
 *  per-result limit, so the default reply is the core guide + a table of
@@ -2699,7 +2555,7 @@ async function handleSchemaDocs(deps, topic) {
 *  fallback for user-scope skills that have no staging copy. Raw text —
 *  not the parsed schema — so the agent edits the true on-disk source. */
 async function handleGetSchema(slug, deps) {
-	const collection = await require_store.loadCollection(slug, deps);
+	const collection = await require_discovery.loadCollection(slug, deps);
 	if (!collection) return unknownCollection(slug);
 	const { stagingDir } = authoringTarget(deps, collection.slug);
 	const candidates = [...stagingDir === null ? [] : [node_path.default.join(stagingDir, SCHEMA_FILE)], node_path.default.join(collection.skillDir, SCHEMA_FILE)];
@@ -2761,11 +2617,11 @@ async function writeAndMirrorSchema(slug, skillDir, schema, deps) {
 *  gate doesn't apply. Returns a one-line reason, or null when the schema
 *  would be accepted. */
 function schemaDiscoveryGate(schema, base) {
-	const primaryField = require_store.resolvePrimaryField(schema.fields, schema.primaryKey);
+	const primaryField = require_discovery.resolvePrimaryField(schema.fields, schema.primaryKey);
 	if (!primaryField) return `primaryKey '${schema.primaryKey}' is not one of the declared fields`;
 	if (primaryField.primary !== true) return `the primaryKey field '${schema.primaryKey}' must be flagged \`primary: true\``;
-	if (schema.dataPath !== void 0 && require_store.resolveDataDir(schema.dataPath, base) === null) return `dataPath '${schema.dataPath}' escapes the workspace`;
-	if (schema.dataSource !== void 0 && require_store.resolveDataDir(schema.dataSource.path, base) === null) return `dataSource.path '${schema.dataSource.path}' escapes the workspace`;
+	if (schema.dataPath !== void 0 && require_discovery.resolveDataDir(schema.dataPath, base) === null) return `dataPath '${schema.dataPath}' escapes the workspace`;
+	if (schema.dataSource !== void 0 && require_discovery.resolveDataDir(schema.dataSource.path, base) === null) return `dataSource.path '${schema.dataSource.path}' escapes the workspace`;
 	return null;
 }
 /** Validate a schema against CollectionSchemaZ and, on success, persist it.
@@ -2773,11 +2629,11 @@ function schemaDiscoveryGate(schema, base) {
 *  the root's authoring dir (the normal create flow), not through here. */
 async function handlePutSchema(slug, schemaArg, deps) {
 	if (!schemaArg || typeof schemaArg !== "object" || Array.isArray(schemaArg)) return "manageCollection: `schema` is required for putSchema — the full collection schema object.";
-	const collection = await require_store.loadCollection(slug, deps);
+	const collection = await require_discovery.loadCollection(slug, deps);
 	if (!collection) return `manageCollection: unknown collection '${require_promptSafety.defangForPrompt(slug)}' — create it by writing SKILL.md + ${SCHEMA_FILE} under ${authoringDirLabel(deps, require_promptSafety.defangForPrompt(slug))}, then edit it here.`;
 	const refusal = schemaEditRefusal(collection, slug, deps);
 	if (refusal) return refusal;
-	const parsed = require_store.CollectionSchemaZ.safeParse(schemaArg);
+	const parsed = require_discovery.CollectionSchemaZ.safeParse(schemaArg);
 	if (!parsed.success) return formatSchemaIssues(parsed.error.issues);
 	const gate = schemaDiscoveryGate(parsed.data, resolveBase(deps));
 	if (gate) return `manageCollection: schema rejected — ${gate} (call schemaDocs for the field reference). It passes basic validation but discovery would skip it, hiding the collection.`;
@@ -2787,7 +2643,7 @@ async function handlePutSchema(slug, schemaArg, deps) {
 		written: true
 	});
 }
-var MANAGE_COLLECTION_PROMPT = "Use `manageCollection` instead of raw Read/Write/Edit when working with a collection's records OR its schema (raw file I/O stays available as the escape hatch). Before authoring or changing a collection's `schema.json`, call `schemaDocs` to load the field/DSL reference — the default reply is the core authoring guide plus a table of contents; fetch advanced sections (actions, bells, calendar/kanban views, dataSource, storage) by passing their heading as `topic` rather than dumping `topic: \"all\"`. Then read with `getSchema` and write with `putSchema` — `putSchema` validates the whole schema before writing and returns actionable errors instead of silently failing discovery's validation. `getItems` is the only way to see computed values — `derived` fields (e.g. a portfolio's value), `toggle` projections, and `embed` records are host-computed and never present in the stored JSON files. On large collections pass `ids` and/or `fields` to keep the result small. For a question that spans collections (\"which clients have unpaid invoices?\"), start with `getOntology`: it lists every collection with its primaryKey, record count, and outbound `ref`/`embed` relations, so you know which collections to join before reading any records. `putItems` validates every row against the schema before writing (required fields, enum values, primaryKey = record id) and returns `{ written, rejected }`; fix each rejected row using its `problem` text and retry just those rows. Never include computed fields in a row you write. To update a few fields of an existing record, use `mode: \"merge\"` with a partial row ({ id, <changed fields> }) — the default upsert replaces the WHOLE record, so a partial upsert would silently erase every optional field it omits. `deleteItems` removes records by id and returns `{ deleted, rejected }`; an id that doesn't exist comes back rejected rather than counted as deleted, so check `rejected` before reporting a deletion as done. `publishApp` publishes the whole repository — its `app.json` (member roster, public read/submit configuration) and every shared collection's schema — to the app's Firestore. It is the ONE operation here that changes what every member sees the moment it runs, and it cannot be undone by reverting a commit: publishing again is the only undo (the previous app document is kept as `previousPublished`). Call it when the user asks to publish, invite, or open an app; never as a follow-up to an edit the user did not ask you to ship. Its refusals are the product, not an obstacle — relay them verbatim, and do not work around one by rewriting `app.json` until the user has said what they actually want. If it reports live records the new schemas would break, show the user that list and ask before re-running with `confirm`. Answer aggregation questions (counts, sums, averages, group-bys) with `queryItems` on ANY collection — on a dataSource (CSV) collection it scans the whole file (getItems is row-capped, so aggregates computed from its output can be silently wrong on large files); on a file-backed collection it aggregates the enriched records, so computed fields (derived/rollup/toggle) are queryable columns.";
+var MANAGE_COLLECTION_PROMPT = "Use `manageCollection` instead of raw Read/Write/Edit when working with a collection's records OR its schema (raw file I/O stays available as the escape hatch). Before authoring or changing a collection's `schema.json`, call `schemaDocs` to load the field/DSL reference — the default reply is the core authoring guide plus a table of contents; fetch advanced sections (actions, bells, calendar/kanban views, dataSource, storage) by passing their heading as `topic` rather than dumping `topic: \"all\"`. Then read with `getSchema` and write with `putSchema` — `putSchema` validates the whole schema before writing and returns actionable errors instead of silently failing discovery's validation. `getItems` is the only way to see computed values — `derived` fields (e.g. a portfolio's value), `toggle` projections, and `embed` records are host-computed and never present in the stored JSON files. On large collections pass `ids` and/or `fields` to keep the result small. For a question that spans collections (\"which clients have unpaid invoices?\"), start with `getOntology`: it lists every collection with its primaryKey, record count, and outbound `ref`/`embed` relations, so you know which collections to join before reading any records. `putItems` validates every row against the schema before writing (required fields, enum values, primaryKey = record id) and returns `{ written, rejected }`; fix each rejected row using its `problem` text and retry just those rows. Never include computed fields in a row you write. To update a few fields of an existing record, use `mode: \"merge\"` with a partial row ({ id, <changed fields> }) — the default upsert replaces the WHOLE record, so a partial upsert would silently erase every optional field it omits. `deleteItems` removes records by id and returns `{ deleted, rejected }`; an id that doesn't exist comes back rejected rather than counted as deleted, so check `rejected` before reporting a deletion as done. Answer aggregation questions (counts, sums, averages, group-bys) with `queryItems` on ANY collection — on a dataSource (CSV) collection it scans the whole file (getItems is row-capped, so aggregates computed from its output can be silently wrong on large files); on a file-backed collection it aggregates the enriched records, so computed fields (derived/rollup/toggle) are queryable columns.";
 /** Validate getItems' optional `ids`/`fields` args, then delegate. */
 async function dispatchGetItems(collection, args, deps) {
 	const ids = optionalStringArray(args.ids, "ids");
@@ -2824,7 +2680,7 @@ async function manageCollectionHandler(deps, args) {
 	try {
 		return await dispatchManageCollection(deps, args);
 	} catch (err) {
-		if (require_store.isBackendUnavailable(err)) return `manageCollection: ${err.message}`;
+		if (require_discovery.isBackendUnavailable(err)) return `manageCollection: ${err.message}`;
 		throw err;
 	}
 }
@@ -2832,19 +2688,18 @@ async function dispatchManageCollection(deps, args) {
 	const action = typeof args.action === "string" ? args.action : "";
 	if (action === "schemaDocs") return handleSchemaDocs(deps, typeof args.topic === "string" ? args.topic : void 0);
 	if (action === "getOntology") return handleGetOntology(deps);
-	if (action === "publishApp") return handlePublishApp(deps, args.confirm === true);
 	const slug = typeof args.slug === "string" ? args.slug.trim() : "";
 	if (!slug) return "manageCollection: `slug` is required (the collection's slug).";
 	if (action === "getSchema") return handleGetSchema(slug, deps);
 	if (action === "putSchema") return handlePutSchema(slug, args.schema, deps);
-	if (!RECORD_ACTIONS.has(action)) return "manageCollection: `action` must be \"getItems\", \"putItems\", \"deleteItems\", \"queryItems\", \"getOntology\", \"schemaDocs\", \"getSchema\", \"putSchema\", or \"publishApp\".";
-	const collection = await require_store.loadCollection(slug, deps);
+	if (!RECORD_ACTIONS.has(action)) return "manageCollection: `action` must be \"getItems\", \"putItems\", \"deleteItems\", \"queryItems\", \"getOntology\", \"schemaDocs\", \"getSchema\", or \"putSchema\".";
+	const collection = await require_discovery.loadCollection(slug, deps);
 	if (!collection) return unknownCollection(slug);
 	return dispatchRecordAction(action, collection, args, deps);
 }
 var MANAGE_COLLECTION_DEFINITION = {
 	name: "manageCollection",
-	description: "Read and write a schema-driven collection through the host — both its records and its structure. getItems returns records WITH computed values (derived formulas, toggles, embeds) the stored JSON files don't contain; putItems validates each row against the schema before writing; deleteItems removes records by id. getOntology maps the whole workspace: every collection with its record count and outbound ref/embed relations — call it first for cross-collection questions. schemaDocs returns the collection-authoring reference — the core guide plus a table of contents by default; pass `topic` for a specific section. getSchema/putSchema read and validate-then-write the collection's schema.json. publishApp publishes the repository's app.json + shared schemas to Firestore, where every member sees them immediately -- it refuses declarations that would be silently permissive or silently deny everyone, and refuses to publish over records the new schemas would break unless `confirm` is set. Prefer it over raw file I/O on collections.",
+	description: "Read and write a schema-driven collection through the host — both its records and its structure. getItems returns records WITH computed values (derived formulas, toggles, embeds) the stored JSON files don't contain; putItems validates each row against the schema before writing; deleteItems removes records by id. getOntology maps the whole workspace: every collection with its record count and outbound ref/embed relations — call it first for cross-collection questions. schemaDocs returns the collection-authoring reference — the core guide plus a table of contents by default; pass `topic` for a specific section. getSchema/putSchema read and validate-then-write the collection's schema.json. Prefer it over raw file I/O on collections.",
 	inputSchema: {
 		type: "object",
 		properties: {
@@ -2858,8 +2713,7 @@ var MANAGE_COLLECTION_DEFINITION = {
 					"getOntology",
 					"schemaDocs",
 					"getSchema",
-					"putSchema",
-					"publishApp"
+					"putSchema"
 				],
 				description: "What to do."
 			},
@@ -2895,10 +2749,6 @@ var MANAGE_COLLECTION_DEFINITION = {
 				type: "object",
 				description: "putSchema: the full collection schema object (same shape as schema.json — title, icon, dataPath, primaryKey, fields, …). Call getSchema first for the current one, and schemaDocs for the field DSL."
 			},
-			confirm: {
-				type: "boolean",
-				description: "publishApp: publish even though existing records fail the schemas being published. Omit it first — the refusal lists what would break, and that list is the thing to show the user before asking."
-			},
 			topic: {
 				type: "string",
 				description: "schemaDocs: fetch one section of the reference by heading (case-insensitive substring — e.g. \"field types\", \"kanban\", \"calendar\", \"dataSource\"). Omit for the core authoring guide plus a table of contents of every section; \"all\" returns the full document (large — it can exceed your tool-result limit)."
@@ -2932,6 +2782,12 @@ Object.defineProperty(exports, "APP_ROLES", {
 		return APP_ROLES;
 	}
 });
+Object.defineProperty(exports, "APP_SLUGS_COLLECTION", {
+	enumerable: true,
+	get: function() {
+		return APP_SLUGS_COLLECTION;
+	}
+});
 Object.defineProperty(exports, "AuthoredAppZ", {
 	enumerable: true,
 	get: function() {
@@ -2992,6 +2848,18 @@ Object.defineProperty(exports, "appSchemasPath", {
 		return appSchemasPath;
 	}
 });
+Object.defineProperty(exports, "appSlugDoc", {
+	enumerable: true,
+	get: function() {
+		return appSlugDoc;
+	}
+});
+Object.defineProperty(exports, "appStagingPath", {
+	enumerable: true,
+	get: function() {
+		return appStagingPath;
+	}
+});
 Object.defineProperty(exports, "applyMutateAction", {
 	enumerable: true,
 	get: function() {
@@ -3118,16 +2986,28 @@ Object.defineProperty(exports, "projectApp", {
 		return projectApp;
 	}
 });
-Object.defineProperty(exports, "promptPathsFor", {
+Object.defineProperty(exports, "projectDeploy", {
 	enumerable: true,
 	get: function() {
-		return promptPathsFor;
+		return projectDeploy;
+	}
+});
+Object.defineProperty(exports, "projectPublish", {
+	enumerable: true,
+	get: function() {
+		return projectPublish;
+	}
+});
+Object.defineProperty(exports, "promoteSchema", {
+	enumerable: true,
+	get: function() {
+		return promoteSchema;
 	}
 });
-Object.defineProperty(exports, "publishApp", {
+Object.defineProperty(exports, "promptPathsFor", {
 	enumerable: true,
 	get: function() {
-		return publishApp;
+		return promptPathsFor;
 	}
 });
 Object.defineProperty(exports, "publishProblems", {
@@ -3184,6 +3064,12 @@ Object.defineProperty(exports, "schemaRelations", {
 		return schemaRelations;
 	}
 });
+Object.defineProperty(exports, "stagedRuleConfig", {
+	enumerable: true,
+	get: function() {
+		return stagedRuleConfig;
+	}
+});
 Object.defineProperty(exports, "successorId", {
 	enumerable: true,
 	get: function() {
@@ -3203,4 +3089,4 @@ Object.defineProperty(exports, "validateRecordObject", {
 	}
 });
 
-//# sourceMappingURL=server-CWZyg8fn.cjs.map
+//# sourceMappingURL=server-X_magqUa.cjs.map