@mulmoclaude/core 5.1.0 → 5.4.0

package/README.md

@@ -13,7 +13,7 @@ rather than imported, which is what lets the same code run under either.
 
 | Area | Entries |
 | --- | --- |
-| Collections | `./collection`, `./collection/server`, `./collection/paths`, `./collection/registry`, `./collection/registry/server`, `./collection-watchers` |
+| Collections | `./collection`, `./collection/server`, `./collection/paths`, `./collection/firestore`, `./collection/registry`, `./collection/registry/server`, `./collection-watchers` |
 | Knowledge | `./wiki`, `./wiki/server`, `./wiki/paths`, `./feeds`, `./feeds/server`, `./feeds/paths` |
 | Google | `./google` — OAuth (loopback + PKCE), token store, Calendar / Tasks / Drive REST |
 | Runtime | `./scheduler`, `./notifier`, `./skill-bridge`, `./file-change`, `./workspace-setup`, `./artifacts` |
@@ -26,6 +26,22 @@ rather than imported, which is what lets the same code run under either.
 `./whisper/client`, `./workspace-setup/slug`, `./translation/client`,
 `./remote-view`, `./remote-host` and `./plugin-vue`.
 
+`firebase` is an **optional** peer, and only the entries named for it need it:
+`./collection/firestore`, `./remote-host` and `./remote-host/server`. Every
+other entry must LOAD with the package absent — a host that uses no Firestore
+installs nothing — under `import` and `require` alike.
+`test/workspace/collections/test_optionalFirebasePeer.ts` in the MulmoClaude
+repository holds that line: it loads every entry in the exports map, under both
+conditions, with `firebase` made unresolvable. It is a sweep, not a static
+guarantee — an import added to a module an entry reaches is caught by running
+that test, not by the type checker.
+
+A host wires shared collections by handing `setFirestoreAccessor` a
+`FirestoreDocs`. Build it with `createFirestoreDocs` from
+`./collection/firestore` — that adapter tracks the interface. **Hand-writing an
+implementation means a new member is a compile break on upgrade** — which is
+what `timestamp` was for anyone who had one.
+
 The package also ships `assets/helps/*` — the help documents the agent reads at
 runtime — which is why a change there alone still warrants a release.
 

package/assets/helps/error-recovery.md

@@ -657,6 +657,84 @@ workspace is already on a real filesystem and a conflict still will not
 clear, that is a new bug — report it with the calendar id and the
 record.
 
+## Push skips a record: "the record id cannot be used as a Google event id"
+
+### Symptoms
+
+Push reports a record as skipped and names its id. It never reaches
+Google, however many times the user presses the button. Editing the
+record's other fields changes nothing.
+
+### Cause
+
+A push CREATES the Google event with the record's own primary-key value
+as the event id, so a record keeps its identity across the round trip.
+Google constrains an event id to **lower-case base32hex**: 5-1024
+characters from `0-9a-v` only. So no `w`, `x`, `y` or `z`, no upper
+case, no hyphen, no underscore, no dot.
+
+A semantic id anyone would reach for — `team-standup`, `Weekly_Sync`,
+`2026-07-17` — breaks the rule on the hyphen, the case or the letters.
+Records created through the collection UI get a generated id that
+satisfies it; only a primary key someone typed or imported can fail.
+
+### Fix
+
+Recreate the record without setting the primary field, and let the UI
+generate the id. If the id has to be meaningful, it can be — as long as
+every character is a digit or a letter `a` through `v` and there are at
+least five of them (`teamstandup` passes, `team-standup` does not).
+
+Renaming the primary key of an EXISTING record means deleting it and
+adding it again: the primary key is the record's identity, so nothing
+else reassigns it.
+
+## A record keeps showing as "edited" and the same push repeats forever
+
+### Symptoms
+
+The same record is pushed on every cycle with content that never
+changes, and the Google event's `updated` moves each time. No conflict
+is reported and no data is lost — the calendar just receives the same
+write over and over.
+
+### Cause
+
+The push compares the record against the BASELINE in
+`<workspace>/data/calendar/.push-state.json`, and the baseline advances
+only when a PULL reports the event as changed. If a write reaches Google
+but does NOT change the event's stored value — Google normalising the
+value it was sent, or a write of the value the event already held — then
+Google reports no change, the pull never sees the event, and the
+baseline stays behind. The next push sees the same difference again.
+
+This was checked on a live calendar and the Events API did **not**
+normalise `description` HTML (empty `<div>`, `style` attributes and all
+survived a round trip byte-for-byte), so it is not the common case. It
+is written down because the SYMPTOM is indistinguishable from a real
+repeated edit, and the two are told apart the same way.
+
+### Fix
+
+Look at the baseline, not at the record. Read the event's entry in
+`.push-state.json` and compare it with what `google` (`kind:
+"calendarListEvents"`) reports for that event id:
+
+- **Baseline matches Google, record differs** — an ordinary unpushed
+  edit. Nothing is wrong; the next push sends it.
+- **Baseline differs from Google** — the baseline is stale. `autoPush`
+  does NOT fix this one: it converges only when the push actually
+  changed the stored value, because only then does the pull carry the
+  event. Press Sync to force a pull; if the event is still not reported,
+  the value Google holds is already what the push keeps sending, and the
+  baseline has to be rebuilt.
+
+Rebuilding: delete the calendar's entry from `.push-state.json` (or the
+file, if it covers only that calendar) and press Sync. The next pull
+writes a fresh baseline from Google's current values. Tell the user
+first — until that pull lands, a genuine unpushed local edit would be
+indistinguishable from a mirrored one.
+
 ## A calendar collection only ever holds a handful of records
 
 ### Symptoms

package/assets/helps/google-calendar-collection.md

@@ -17,6 +17,7 @@ author the schema when the user asks for one.
 | Google → collection | the `googleCalendar` block | hourly, on creation, and on the **Sync** button |
 | collection → Google | the **Push to Google** button | whenever the user clicks it |
 | collection → Google | `"autoPush": true` in the block | hourly, immediately before each pull |
+| collection → Google, deletions | `"propagateDeletes": true` in the block | with every push. Off by default; see "Deleting" |
 
 When a user asks for "two-way sync", `autoPush` is the answer: set it and each
 scheduled run pushes local edits up and then pulls Google's changes down, as one
@@ -66,6 +67,9 @@ it isn't, sync silently does nothing until they link it in settings.
   would see rows with no content.
 - `autoPush` — push local edits on the sync schedule, just before each pull.
   Omit it (the default) and the push stays a button. See "Both directions".
+- `propagateDeletes` — delete the Google event when its record is deleted here.
+  Omit it (the default) and a local deletion is reported and nothing else. See
+  "Deleting".
 
 Mappable event fields, two-way first: `summary`, `start`, `end`, `description`,
 `location`, `colorId`.
@@ -78,15 +82,56 @@ time),
 `transparency` (`"transparent"` when the event does not consume the attendee's
 time; `""` means opaque), `eventType` (all six Google returns: `default` / `birthday` / `focusTime` /
 `fromGmail` / `outOfOffice` / `workingLocation`), `hangoutLink` (the Meet URL),
-`recurringEventId` and `originalStartTime`.
+`recurringEventId`, `originalStartTime`, `selfResponseStatus` and
+`conferenceVideoUri`.
 
-The last two are how a recurring series stays legible. The sync asks Google to
-expand recurrences, so a weekly meeting arrives as one event per occurrence;
-`recurringEventId` names the series each occurrence came from (`""` for a
-one-off), and `originalStartTime` is the slot the occurrence held before anyone
-dragged it — so a moved occurrence reads as a move rather than as a deletion
-plus a new event. Map them when the user asks why one calendar edit produced a
-large batch of record changes.
+`recurringEventId` and `originalStartTime` are how a recurring series stays
+legible. The sync asks Google to expand recurrences, so a weekly meeting arrives
+as one event per occurrence; `recurringEventId` names the series each occurrence
+came from (`""` for a one-off), and `originalStartTime` is the slot the
+occurrence held before anyone dragged it — so a moved occurrence reads as a move
+rather than as a deletion plus a new event. Map them when the user asks why one
+calendar edit produced a large batch of record changes.
+
+### `selfResponseStatus` and `conferenceVideoUri`
+
+These two are not Google field names. Google answers `attendees` as an ARRAY and
+`conferenceData` as an array inside an object, and a collection field holds one
+value — so each is folded down to the single scalar the collection asks it for.
+The rest of those structures is dropped; there is no way to map the attendee
+list itself.
+
+**`selfResponseStatus`** — the signed-in user's own `responseStatus`:
+`needsAction`, `declined`, `tentative` or `accepted`.
+
+`""` means Google reported none, and that is the COMMON case, not an edge one:
+an event with no attendees has no entry to mark as the user, which is most of a
+personal calendar. So it reads as "nothing said", never as "not going".
+
+Filter with **`!= "declined"`**, never with `== "accepted"` — the second hides
+every solo event too. A `flag` field is the usual way:
+
+```jsonc
+"fields": {
+  "rsvp":    { "type": "string", "label": "RSVP" },
+  "onMySchedule": {
+    "type": "flag",
+    "label": "Mine",
+    "where": [{ "field": "rsvp", "op": "ne", "value": "declined" }]
+  }
+},
+"googleCalendar": { "map": { "rsvp": "selfResponseStatus" } }
+```
+
+**`conferenceVideoUri`** — the URL that joins the meeting, taken from the
+`video` entry point. `""` when the event has no conference, and also when its
+only entry points are a phone number or a dial-in page: a column named for
+joining that sometimes held `tel:` would be worse than one the caller can see is
+empty.
+
+`hangoutLink` already carries this for Google Meet. `conferenceVideoUri` is what
+reaches a calendar whose meetings are Zoom or Teams. A Meet event fills both, so
+map whichever the user's calendar actually uses.
 
 `description` is the event body, and Google stores limited **HTML** in it. It is
 kept verbatim — mirroring it through a plain-text field and pushing it back would
@@ -190,10 +235,9 @@ What the button does and deliberately does not do:
 - **Creates** an event for a record that never came from a sync.
 - **Updates** only the fields the user actually changed, so attendees,
   reminders and recurrence rules stay untouched.
-- **Never deletes.** A record deleted locally leaves its Google event alone —
-  a Google delete removes the event for every attendee and cannot be undone.
-  The count is reported so the user knows it was skipped; deleting for real is
-  the `google` tool's `calendarDeleteEvent`, after confirming with them.
+- **Never deletes, unless the collection asked it to.** See "Deleting" below;
+  without `propagateDeletes` a record deleted locally leaves its Google event
+  alone and the count is reported so the user knows.
 - **Skips a record edited on both sides** and reports it, rather than picking a
   winner. The user resolves it by editing one side to match. Under `autoPush`
   the pull that follows leaves that record alone too, so the local edit is not
@@ -225,6 +269,42 @@ reach by id but has not added to their calendar list has no role to check, so
 the push goes ahead and reports Google's own refusal if the write turns out not
 to be allowed — being unlisted is not treated as being read-only.
 
+## Deleting
+
+By default, a record deleted in the collection leaves its Google event alone.
+The push reports the count and does nothing else, and the next sync brings the
+record back — which is correct for a calendar Google owns, and wrong for one
+where the collection is the primary copy.
+
+`"propagateDeletes": true` in the `googleCalendar` block makes the push delete
+those events too. **Ask the user before adding it**, the same as `autoPush` and
+for a stronger reason: `autoPush` changes WHEN a write happens, this makes a
+write irreversible.
+
+Even on, the push **refuses an event that carries attendees** and reports it
+instead. Deleting an invited event withdraws it from the guests' calendars,
+which is a different act from tidying your own. **Any** attendee entry refuses,
+including the one Google adds for the organiser — so an event only the user was
+ever on is refused too, deliberately: telling the two apart means deciding which
+entry is the user from a payload that may not say, and being wrong there
+withdraws a real invitation. Either way, an event the user actually wants gone
+is deleted with the `google` tool's `calendarDeleteEvent`, after confirming with
+them.
+
+The delete also carries the version the check was made against, so an attendee
+added while the push was running makes Google refuse it rather than letting a
+decision taken a moment earlier stand. That is reported like any other refusal;
+pressing Push again re-checks.
+
+There is no undo here and this app keeps no copy of what it deleted. Google
+Calendar's own Trash holds a deleted event for a while, and that is where a
+mistake is recovered from.
+
+A deletion that carried stops being reported, because its baseline entry goes
+with it. A deletion that was REFUSED keeps being reported on every push — the
+event is still standing in Google, and the report is the only thing that says
+so.
+
 ## Not for this
 
 A `dataSource` (CSV-backed) collection is read-only and cannot declare

package/dist/collection/core/schemaZ.d.ts

@@ -513,8 +513,12 @@ export declare const AgentIngestZ: z.ZodObject<{
  *  limitation: `transparency` is writable and `eventType` is writable at
  *  creation, yet neither is sent. That is also why
  *  widening this enum needs no `.push-state.json` migration: the push baseline
- *  (`ShadowEvent`) is keyed off the pushable list, not off this one. */
-export declare const GOOGLE_CALENDAR_SOURCE_FIELDS: readonly ["summary", "start", "end", "description", "location", "colorId", "htmlLink", "status", "recurringEventId", "originalStartTime", "updated", "transparency", "eventType", "hangoutLink"];
+ *  (`ShadowEvent`) is keyed off the pushable list, not off this one.
+ *
+ *  The last two are not Google field names but DERIVED scalars
+ *  (`google/eventDerived.ts`): the structures they come from are arrays, and a
+ *  collection field holds one value. */
+export declare const GOOGLE_CALENDAR_SOURCE_FIELDS: readonly ["summary", "start", "end", "description", "location", "colorId", "htmlLink", "status", "recurringEventId", "originalStartTime", "updated", "transparency", "eventType", "hangoutLink", "selfResponseStatus", "conferenceVideoUri"];
 /** Marks a collection as the destination of the LLM-free Google Calendar
  *  sync (#2095). `map` is collectionField → Google event field, so the user's
  *  collection keeps whatever field names it already uses. */
@@ -535,8 +539,11 @@ export declare const GoogleCalendarSyncZ: z.ZodObject<{
         transparency: "transparency";
         eventType: "eventType";
         hangoutLink: "hangoutLink";
+        selfResponseStatus: "selfResponseStatus";
+        conferenceVideoUri: "conferenceVideoUri";
     }>>;
     autoPush: z.ZodOptional<z.ZodBoolean>;
+    propagateDeletes: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>;
 /** `ingest` is a discriminated union on `kind`: the three declarative
  *  retrievers fetch-and-map; `agent` dispatches a hidden worker. Optional on
@@ -1148,8 +1155,11 @@ declare const CollectionObjectZ: z.ZodObject<{
             transparency: "transparency";
             eventType: "eventType";
             hangoutLink: "hangoutLink";
+            selfResponseStatus: "selfResponseStatus";
+            conferenceVideoUri: "conferenceVideoUri";
         }>>;
         autoPush: z.ZodOptional<z.ZodBoolean>;
+        propagateDeletes: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>>;
     dynamicIcon: z.ZodOptional<z.ZodObject<{
         source: z.ZodObject<{
@@ -1646,8 +1656,11 @@ export declare const CollectionSchemaZ: z.ZodPreprocess<z.ZodObject<{
             transparency: "transparency";
             eventType: "eventType";
             hangoutLink: "hangoutLink";
+            selfResponseStatus: "selfResponseStatus";
+            conferenceVideoUri: "conferenceVideoUri";
         }>>;
         autoPush: z.ZodOptional<z.ZodBoolean>;
+        propagateDeletes: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>>;
     dynamicIcon: z.ZodOptional<z.ZodObject<{
         source: z.ZodObject<{

package/dist/collection/core/viewChatPolicy.d.ts

@@ -7,7 +7,19 @@ import { CollectionCustomView } from './schema';
  *  code composes the prompt text; letting it also decide whether that text runs
  *  would put both halves of the decision inside the sandbox.
  *
- *  The phone runtime does not consult this: it always sends, because a phone has
- *  no Enter key for the user to press (receptron/mulmoterminal#1253). The flag
- *  governs the desktop custom view and the desktop phone-frame preview. */
+ *  EVERY surface honours this declaration, the phone included. The phone once
+ *  always sent, on the grounds that it has no Enter key to press — but that made
+ *  the same view behave differently depending on where it was opened, and it
+ *  silently overrode default-deny on a device the author never tested.
+ *
+ *  The phone does not call THIS function: it reads `allowSendChat` out of the
+ *  collection schema it already receives (`toDetail` sends the schema whole) and
+ *  applies the same `=== true` rule in its own copy. Two reasons for that copy
+ *  have been written down and both were wrong, so this states none — if you are
+ *  touching it, check whether the phone can import this subpath and delete the
+ *  copy if it can. Until then, keep the two in step.
+ *
+ *  It must also ask about the view whose document is RENDERED, not the selected
+ *  one — during a view switch those differ, and the selected view's flag would
+ *  decide for the previous view's still-running sandbox. */
 export declare function customViewSendsChat(view: Pick<CollectionCustomView, "allowSendChat">): boolean;

package/dist/collection/firestore.cjs

@@ -50,7 +50,8 @@ function createFirestoreDocs(database) {
 				seen = true;
 				onChanged(snapshot.docChanges().map((change) => change.doc.id), { initial });
 			}, onError);
-		}
+		},
+		timestamp: (seconds, nanoseconds) => new firebase_firestore.Timestamp(seconds, nanoseconds)
 	};
 }
 //#endregion

package/dist/collection/firestore.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"firestore.cjs","names":[],"sources":["../../src/collection/server/firestoreDocs.ts"],"sourcesContent":["// The seam between the firestore store and the Firestore SDK.\n//\n// The modular SDK is function-based (`getDocs(query(collection(db, …)))`), so a\n// store that imported those functions directly could not be tested without a\n// real backend — a fake `db` would still be handed to the real functions.\n// Narrowing to this interface makes the backend swappable: core ships\n// `createFirestoreDocs` over the real SDK, and the tests inject an in-memory\n// fake that satisfies the same shape. That is what lets this repository's tests\n// run with no API key and no network.\n//\n// Deliberately minimal and id-keyed: no query builder, no field ordering, no\n// cursors. Everything the store needs is \"the documents of one collection path,\n// ordered by document id\" — see the store header for why field ordering is\n// avoided entirely.\n//\n// The collection path is an ARGUMENT, not something this module composes. It\n// owns the SDK calls; `firestoreStore` owns where the documents live.\n\nimport {\n  collection as firestoreCollection,\n  doc,\n  getDoc,\n  getDocs,\n  orderBy,\n  query as firestoreQuery,\n  onSnapshot,\n  runTransaction,\n  setDoc,\n  type Firestore,\n} from \"firebase/firestore\";\n\n/** One stored record document. `data` is the document's own fields — the\n *  record itself, not a wrapper around it; see `set` below. The store\n *  validates its shape, because a document written by hand could be\n *  anything. */\nexport interface FirestoreDoc {\n  id: string;\n  data: unknown;\n}\n\nexport interface FirestoreDocs {\n  /** Every document under `collectionPath`, ordered by document id. */\n  list: (collectionPath: string) => Promise<FirestoreDoc[]>;\n  /** One document's fields, or null when it doesn't exist. */\n  get: (collectionPath: string, docId: string) => Promise<unknown | null>;\n  /** Create or replace. */\n  set: (collectionPath: string, docId: string, data: Record<string, unknown>) => Promise<void>;\n  /** Create only. Returns false when the id already exists — atomic, so two\n   *  concurrent creates can't both observe \"missing\". */\n  create: (collectionPath: string, docId: string, data: Record<string, unknown>) => Promise<boolean>;\n  /** Delete. Returns false when the id didn't exist, so a caller can tell a\n   *  real delete from a typo'd id. */\n  delete: (collectionPath: string, docId: string) => Promise<boolean>;\n  /** Listen to `collectionPath`. Every snapshot reports the ids that changed\n   *  in it, and whether it is the FIRST one.\n   *\n   *  `initial` is not a nicety. `onSnapshot` delivers the current contents\n   *  immediately, as one snapshot in which every existing document reads as\n   *  `added` — so a listener that treats snapshots uniformly announces the\n   *  whole collection as changed the moment it arms, on every mount. The flag\n   *  is passed up rather than swallowed here so the decision (and its test)\n   *  lives with the store's policy, next to the rest of it.\n   *\n   *  `onError` fires at most once per subscription: a Firestore listen error\n   *  TERMINATES the listener and never recovers on its own. Re-subscribing is\n   *  the caller's job (`firestore/listen.ts` holds the policy).\n   *\n   *  Returns the detach function synchronously — `onSnapshot` is not async. */\n  watch: (collectionPath: string, onChanged: (ids: string[], meta: { initial: boolean }) => void, onError: (error: unknown) => void) => () => void;\n}\n\n/** The real implementation over the modular SDK.\n *\n *  THE RECORD IS THE DOCUMENT. Its fields are written at the top level, not\n *  nested under a `data` key. This is not a matter of taste: the deployed\n *  security rules read `request.resource.data.<field>` and\n *  `resource.data[submit.emailField]` — a wrapper would put every field one\n *  level down, so the required-field checks, the status state machine and the\n *  \"your own row\" predicate would all read absent values and fail closed. A\n *  shared record's shape is part of the authorization contract.\n *\n *  `orderBy(\"__name__\")` orders by DOCUMENT ID. Ordering by a record field\n *  would silently EXCLUDE documents missing that field (the trap\n *  `remote-host/server/hostRunner.ts:158-169` documents), turning a read into a\n *  partial one; the document id is always present and gives the stable order\n *  the store contract requires. */\nexport function createFirestoreDocs(database: Firestore): FirestoreDocs {\n  return {\n    list: async (collectionPath) => {\n      const snapshot = await getDocs(firestoreQuery(firestoreCollection(database, collectionPath), orderBy(\"__name__\")));\n      return snapshot.docs.map((entry) => ({ id: entry.id, data: entry.data() }));\n    },\n    get: async (collectionPath, docId) => {\n      const snapshot = await getDoc(doc(database, collectionPath, docId));\n      return snapshot.exists() ? snapshot.data() : null;\n    },\n    set: async (collectionPath, docId, data) => {\n      await setDoc(doc(database, collectionPath, docId), data);\n    },\n    create: (collectionPath, docId, data) =>\n      runTransaction(database, async (transaction) => {\n        const ref = doc(database, collectionPath, docId);\n        const existing = await transaction.get(ref);\n        if (existing.exists()) return false;\n        transaction.set(ref, data);\n        return true;\n      }),\n    // Firestore's deleteDoc succeeds on a missing document, so an existence\n    // check is what makes \"deleted\" distinguishable from \"there was nothing\".\n    // It runs INSIDE the transaction (like `create`): a plain get-then-delete\n    // would report `true` for a document a concurrent client had already\n    // removed, i.e. claim a delete this call never performed.\n    delete: (collectionPath, docId) =>\n      runTransaction(database, async (transaction) => {\n        const ref = doc(database, collectionPath, docId);\n        const existing = await transaction.get(ref);\n        if (!existing.exists()) return false;\n        transaction.delete(ref);\n        return true;\n      }),\n    // `docChanges()` rather than the whole snapshot: it names the documents\n    // that moved, which is what lets the store report per-record changes\n    // instead of \"something in this collection changed\". Added, modified and\n    // removed are all reported the same way — the store's listener takes an\n    // id, and re-reads; what KIND of change it was is not something a\n    // reconcile pass needs to be told.\n    //\n    // `includeMetadataChanges` is deliberately left off: local writes and\n    // has-pending-writes flips would otherwise wake every listener for\n    // changes this process just made.\n    watch: (collectionPath, onChanged, onError) => {\n      let seen = false;\n      return onSnapshot(\n        firestoreCollection(database, collectionPath),\n        (snapshot) => {\n          const initial = !seen;\n          seen = true;\n          onChanged(\n            snapshot.docChanges().map((change) => change.doc.id),\n            { initial },\n          );\n        },\n        onError,\n      );\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAsFA,SAAgB,oBAAoB,UAAoC;CACtE,OAAO;EACL,MAAM,OAAO,mBAAmB;GAE9B,QAAO,OAAA,GADgB,mBAAA,QAAA,EAAA,GAAQ,mBAAA,MAAA,EAAA,GAAe,mBAAA,WAAA,CAAoB,UAAU,cAAc,IAAA,GAAG,mBAAA,QAAA,CAAQ,UAAU,CAAC,CAAC,EAAA,CACjG,KAAK,KAAK,WAAW;IAAE,IAAI,MAAM;IAAI,MAAM,MAAM,KAAK;GAAE,EAAE;EAC5E;EACA,KAAK,OAAO,gBAAgB,UAAU;GACpC,MAAM,WAAW,OAAA,GAAM,mBAAA,OAAA,EAAA,GAAO,mBAAA,IAAA,CAAI,UAAU,gBAAgB,KAAK,CAAC;GAClE,OAAO,SAAS,OAAO,IAAI,SAAS,KAAK,IAAI;EAC/C;EACA,KAAK,OAAO,gBAAgB,OAAO,SAAS;GAC1C,OAAA,GAAM,mBAAA,OAAA,EAAA,GAAO,mBAAA,IAAA,CAAI,UAAU,gBAAgB,KAAK,GAAG,IAAI;EACzD;EACA,SAAS,gBAAgB,OAAO,UAAA,GAC9B,mBAAA,eAAA,CAAe,UAAU,OAAO,gBAAgB;GAC9C,MAAM,OAAA,GAAM,mBAAA,IAAA,CAAI,UAAU,gBAAgB,KAAK;GAE/C,KAAI,MADmB,YAAY,IAAI,GAAG,EAAA,CAC7B,OAAO,GAAG,OAAO;GAC9B,YAAY,IAAI,KAAK,IAAI;GACzB,OAAO;EACT,CAAC;EAMH,SAAS,gBAAgB,WAAA,GACvB,mBAAA,eAAA,CAAe,UAAU,OAAO,gBAAgB;GAC9C,MAAM,OAAA,GAAM,mBAAA,IAAA,CAAI,UAAU,gBAAgB,KAAK;GAE/C,IAAI,EAAC,MADkB,YAAY,IAAI,GAAG,EAAA,CAC5B,OAAO,GAAG,OAAO;GAC/B,YAAY,OAAO,GAAG;GACtB,OAAO;EACT,CAAC;EAWH,QAAQ,gBAAgB,WAAW,YAAY;GAC7C,IAAI,OAAO;GACX,QAAA,GAAO,mBAAA,WAAA,EAAA,GACL,mBAAA,WAAA,CAAoB,UAAU,cAAc,IAC3C,aAAa;IACZ,MAAM,UAAU,CAAC;IACjB,OAAO;IACP,UACE,SAAS,WAAW,CAAC,CAAC,KAAK,WAAW,OAAO,IAAI,EAAE,GACnD,EAAE,QAAQ,CACZ;GACF,GACA,OACF;EACF;CACF;AACF"}
+{"version":3,"file":"firestore.cjs","names":[],"sources":["../../src/collection/server/firestoreDocs.ts"],"sourcesContent":["// The seam between the firestore store and the Firestore SDK.\n//\n// The modular SDK is function-based (`getDocs(query(collection(db, …)))`), so a\n// store that imported those functions directly could not be tested without a\n// real backend — a fake `db` would still be handed to the real functions.\n// Narrowing to this interface makes the backend swappable: core ships\n// `createFirestoreDocs` over the real SDK, and the tests inject an in-memory\n// fake that satisfies the same shape. That is what lets this repository's tests\n// run with no API key and no network.\n//\n// Deliberately minimal and id-keyed: no query builder, no field ordering, no\n// cursors. Everything the store needs is \"the documents of one collection path,\n// ordered by document id\" — see the store header for why field ordering is\n// avoided entirely.\n//\n// The collection path is an ARGUMENT, not something this module composes. It\n// owns the SDK calls; `firestoreStore` owns where the documents live.\n\nimport {\n  collection as firestoreCollection,\n  doc,\n  getDoc,\n  getDocs,\n  orderBy,\n  query as firestoreQuery,\n  onSnapshot,\n  runTransaction,\n  setDoc,\n  Timestamp,\n  type Firestore,\n} from \"firebase/firestore\";\n\n/** One stored record document. `data` is the document's own fields — the\n *  record itself, not a wrapper around it; see `set` below. The store\n *  validates its shape, because a document written by hand could be\n *  anything. */\nexport interface FirestoreDoc {\n  id: string;\n  data: unknown;\n}\n\nexport interface FirestoreDocs {\n  /** Every document under `collectionPath`, ordered by document id. */\n  list: (collectionPath: string) => Promise<FirestoreDoc[]>;\n  /** One document's fields, or null when it doesn't exist. */\n  get: (collectionPath: string, docId: string) => Promise<unknown | null>;\n  /** Create or replace. */\n  set: (collectionPath: string, docId: string, data: Record<string, unknown>) => Promise<void>;\n  /** Create only. Returns false when the id already exists — atomic, so two\n   *  concurrent creates can't both observe \"missing\". */\n  create: (collectionPath: string, docId: string, data: Record<string, unknown>) => Promise<boolean>;\n  /** Delete. Returns false when the id didn't exist, so a caller can tell a\n   *  real delete from a typo'd id. */\n  delete: (collectionPath: string, docId: string) => Promise<boolean>;\n  /** Listen to `collectionPath`. Every snapshot reports the ids that changed\n   *  in it, and whether it is the FIRST one.\n   *\n   *  `initial` is not a nicety. `onSnapshot` delivers the current contents\n   *  immediately, as one snapshot in which every existing document reads as\n   *  `added` — so a listener that treats snapshots uniformly announces the\n   *  whole collection as changed the moment it arms, on every mount. The flag\n   *  is passed up rather than swallowed here so the decision (and its test)\n   *  lives with the store's policy, next to the rest of it.\n   *\n   *  `onError` fires at most once per subscription: a Firestore listen error\n   *  TERMINATES the listener and never recovers on its own. Re-subscribing is\n   *  the caller's job (`firestore/listen.ts` holds the policy).\n   *\n   *  Returns the detach function synchronously — `onSnapshot` is not async. */\n  watch: (collectionPath: string, onChanged: (ids: string[], meta: { initial: boolean }) => void, onError: (error: unknown) => void) => () => void;\n  /** Firestore's own instant, for a field the store must hand back as the type\n   *  it was stored as.\n   *\n   *  Here rather than in the store because this is the seam that owns the SDK:\n   *  `firebase` is an OPTIONAL peer, and the store is reachable from\n   *  `collection/server` (the factory registry in `store.ts` names it), so a\n   *  top-level `import { Timestamp }` there makes the peer required for every\n   *  consumer of that entry — including hosts with no Firestore at all. Typed\n   *  `unknown` so no SDK type crosses back out. */\n  timestamp: (seconds: number, nanoseconds: number) => unknown;\n}\n\n/** The real implementation over the modular SDK.\n *\n *  THE RECORD IS THE DOCUMENT. Its fields are written at the top level, not\n *  nested under a `data` key. This is not a matter of taste: the deployed\n *  security rules read `request.resource.data.<field>` and\n *  `resource.data[submit.emailField]` — a wrapper would put every field one\n *  level down, so the required-field checks, the status state machine and the\n *  \"your own row\" predicate would all read absent values and fail closed. A\n *  shared record's shape is part of the authorization contract.\n *\n *  `orderBy(\"__name__\")` orders by DOCUMENT ID. Ordering by a record field\n *  would silently EXCLUDE documents missing that field (the trap\n *  `remote-host/server/hostRunner.ts:158-169` documents), turning a read into a\n *  partial one; the document id is always present and gives the stable order\n *  the store contract requires. */\nexport function createFirestoreDocs(database: Firestore): FirestoreDocs {\n  return {\n    list: async (collectionPath) => {\n      const snapshot = await getDocs(firestoreQuery(firestoreCollection(database, collectionPath), orderBy(\"__name__\")));\n      return snapshot.docs.map((entry) => ({ id: entry.id, data: entry.data() }));\n    },\n    get: async (collectionPath, docId) => {\n      const snapshot = await getDoc(doc(database, collectionPath, docId));\n      return snapshot.exists() ? snapshot.data() : null;\n    },\n    set: async (collectionPath, docId, data) => {\n      await setDoc(doc(database, collectionPath, docId), data);\n    },\n    create: (collectionPath, docId, data) =>\n      runTransaction(database, async (transaction) => {\n        const ref = doc(database, collectionPath, docId);\n        const existing = await transaction.get(ref);\n        if (existing.exists()) return false;\n        transaction.set(ref, data);\n        return true;\n      }),\n    // Firestore's deleteDoc succeeds on a missing document, so an existence\n    // check is what makes \"deleted\" distinguishable from \"there was nothing\".\n    // It runs INSIDE the transaction (like `create`): a plain get-then-delete\n    // would report `true` for a document a concurrent client had already\n    // removed, i.e. claim a delete this call never performed.\n    delete: (collectionPath, docId) =>\n      runTransaction(database, async (transaction) => {\n        const ref = doc(database, collectionPath, docId);\n        const existing = await transaction.get(ref);\n        if (!existing.exists()) return false;\n        transaction.delete(ref);\n        return true;\n      }),\n    // `docChanges()` rather than the whole snapshot: it names the documents\n    // that moved, which is what lets the store report per-record changes\n    // instead of \"something in this collection changed\". Added, modified and\n    // removed are all reported the same way — the store's listener takes an\n    // id, and re-reads; what KIND of change it was is not something a\n    // reconcile pass needs to be told.\n    //\n    // `includeMetadataChanges` is deliberately left off: local writes and\n    // has-pending-writes flips would otherwise wake every listener for\n    // changes this process just made.\n    watch: (collectionPath, onChanged, onError) => {\n      let seen = false;\n      return onSnapshot(\n        firestoreCollection(database, collectionPath),\n        (snapshot) => {\n          const initial = !seen;\n          seen = true;\n          onChanged(\n            snapshot.docChanges().map((change) => change.doc.id),\n            { initial },\n          );\n        },\n        onError,\n      );\n    },\n    timestamp: (seconds, nanoseconds) => new Timestamp(seconds, nanoseconds),\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAiGA,SAAgB,oBAAoB,UAAoC;CACtE,OAAO;EACL,MAAM,OAAO,mBAAmB;GAE9B,QAAO,OAAA,GADgB,mBAAA,QAAA,EAAA,GAAQ,mBAAA,MAAA,EAAA,GAAe,mBAAA,WAAA,CAAoB,UAAU,cAAc,IAAA,GAAG,mBAAA,QAAA,CAAQ,UAAU,CAAC,CAAC,EAAA,CACjG,KAAK,KAAK,WAAW;IAAE,IAAI,MAAM;IAAI,MAAM,MAAM,KAAK;GAAE,EAAE;EAC5E;EACA,KAAK,OAAO,gBAAgB,UAAU;GACpC,MAAM,WAAW,OAAA,GAAM,mBAAA,OAAA,EAAA,GAAO,mBAAA,IAAA,CAAI,UAAU,gBAAgB,KAAK,CAAC;GAClE,OAAO,SAAS,OAAO,IAAI,SAAS,KAAK,IAAI;EAC/C;EACA,KAAK,OAAO,gBAAgB,OAAO,SAAS;GAC1C,OAAA,GAAM,mBAAA,OAAA,EAAA,GAAO,mBAAA,IAAA,CAAI,UAAU,gBAAgB,KAAK,GAAG,IAAI;EACzD;EACA,SAAS,gBAAgB,OAAO,UAAA,GAC9B,mBAAA,eAAA,CAAe,UAAU,OAAO,gBAAgB;GAC9C,MAAM,OAAA,GAAM,mBAAA,IAAA,CAAI,UAAU,gBAAgB,KAAK;GAE/C,KAAI,MADmB,YAAY,IAAI,GAAG,EAAA,CAC7B,OAAO,GAAG,OAAO;GAC9B,YAAY,IAAI,KAAK,IAAI;GACzB,OAAO;EACT,CAAC;EAMH,SAAS,gBAAgB,WAAA,GACvB,mBAAA,eAAA,CAAe,UAAU,OAAO,gBAAgB;GAC9C,MAAM,OAAA,GAAM,mBAAA,IAAA,CAAI,UAAU,gBAAgB,KAAK;GAE/C,IAAI,EAAC,MADkB,YAAY,IAAI,GAAG,EAAA,CAC5B,OAAO,GAAG,OAAO;GAC/B,YAAY,OAAO,GAAG;GACtB,OAAO;EACT,CAAC;EAWH,QAAQ,gBAAgB,WAAW,YAAY;GAC7C,IAAI,OAAO;GACX,QAAA,GAAO,mBAAA,WAAA,EAAA,GACL,mBAAA,WAAA,CAAoB,UAAU,cAAc,IAC3C,aAAa;IACZ,MAAM,UAAU,CAAC;IACjB,OAAO;IACP,UACE,SAAS,WAAW,CAAC,CAAC,KAAK,WAAW,OAAO,IAAI,EAAE,GACnD,EAAE,QAAQ,CACZ;GACF,GACA,OACF;EACF;EACA,YAAY,SAAS,gBAAgB,IAAI,mBAAA,UAAU,SAAS,WAAW;CACzE;AACF"}

package/dist/collection/firestore.js

@@ -1,4 +1,4 @@
-import { collection, doc, getDoc, getDocs, onSnapshot, orderBy, query, runTransaction, setDoc } from "firebase/firestore";
+import { Timestamp, collection, doc, getDoc, getDocs, onSnapshot, orderBy, query, runTransaction, setDoc } from "firebase/firestore";
 //#region src/collection/server/firestoreDocs.ts
 /** The real implementation over the modular SDK.
 *
@@ -49,7 +49,8 @@ function createFirestoreDocs(database) {
 				seen = true;
 				onChanged(snapshot.docChanges().map((change) => change.doc.id), { initial });
 			}, onError);
-		}
+		},
+		timestamp: (seconds, nanoseconds) => new Timestamp(seconds, nanoseconds)
 	};
 }
 //#endregion

package/dist/collection/firestore.js.map

@@ -1 +1 @@
-{"version":3,"file":"firestore.js","names":[],"sources":["../../src/collection/server/firestoreDocs.ts"],"sourcesContent":["// The seam between the firestore store and the Firestore SDK.\n//\n// The modular SDK is function-based (`getDocs(query(collection(db, …)))`), so a\n// store that imported those functions directly could not be tested without a\n// real backend — a fake `db` would still be handed to the real functions.\n// Narrowing to this interface makes the backend swappable: core ships\n// `createFirestoreDocs` over the real SDK, and the tests inject an in-memory\n// fake that satisfies the same shape. That is what lets this repository's tests\n// run with no API key and no network.\n//\n// Deliberately minimal and id-keyed: no query builder, no field ordering, no\n// cursors. Everything the store needs is \"the documents of one collection path,\n// ordered by document id\" — see the store header for why field ordering is\n// avoided entirely.\n//\n// The collection path is an ARGUMENT, not something this module composes. It\n// owns the SDK calls; `firestoreStore` owns where the documents live.\n\nimport {\n  collection as firestoreCollection,\n  doc,\n  getDoc,\n  getDocs,\n  orderBy,\n  query as firestoreQuery,\n  onSnapshot,\n  runTransaction,\n  setDoc,\n  type Firestore,\n} from \"firebase/firestore\";\n\n/** One stored record document. `data` is the document's own fields — the\n *  record itself, not a wrapper around it; see `set` below. The store\n *  validates its shape, because a document written by hand could be\n *  anything. */\nexport interface FirestoreDoc {\n  id: string;\n  data: unknown;\n}\n\nexport interface FirestoreDocs {\n  /** Every document under `collectionPath`, ordered by document id. */\n  list: (collectionPath: string) => Promise<FirestoreDoc[]>;\n  /** One document's fields, or null when it doesn't exist. */\n  get: (collectionPath: string, docId: string) => Promise<unknown | null>;\n  /** Create or replace. */\n  set: (collectionPath: string, docId: string, data: Record<string, unknown>) => Promise<void>;\n  /** Create only. Returns false when the id already exists — atomic, so two\n   *  concurrent creates can't both observe \"missing\". */\n  create: (collectionPath: string, docId: string, data: Record<string, unknown>) => Promise<boolean>;\n  /** Delete. Returns false when the id didn't exist, so a caller can tell a\n   *  real delete from a typo'd id. */\n  delete: (collectionPath: string, docId: string) => Promise<boolean>;\n  /** Listen to `collectionPath`. Every snapshot reports the ids that changed\n   *  in it, and whether it is the FIRST one.\n   *\n   *  `initial` is not a nicety. `onSnapshot` delivers the current contents\n   *  immediately, as one snapshot in which every existing document reads as\n   *  `added` — so a listener that treats snapshots uniformly announces the\n   *  whole collection as changed the moment it arms, on every mount. The flag\n   *  is passed up rather than swallowed here so the decision (and its test)\n   *  lives with the store's policy, next to the rest of it.\n   *\n   *  `onError` fires at most once per subscription: a Firestore listen error\n   *  TERMINATES the listener and never recovers on its own. Re-subscribing is\n   *  the caller's job (`firestore/listen.ts` holds the policy).\n   *\n   *  Returns the detach function synchronously — `onSnapshot` is not async. */\n  watch: (collectionPath: string, onChanged: (ids: string[], meta: { initial: boolean }) => void, onError: (error: unknown) => void) => () => void;\n}\n\n/** The real implementation over the modular SDK.\n *\n *  THE RECORD IS THE DOCUMENT. Its fields are written at the top level, not\n *  nested under a `data` key. This is not a matter of taste: the deployed\n *  security rules read `request.resource.data.<field>` and\n *  `resource.data[submit.emailField]` — a wrapper would put every field one\n *  level down, so the required-field checks, the status state machine and the\n *  \"your own row\" predicate would all read absent values and fail closed. A\n *  shared record's shape is part of the authorization contract.\n *\n *  `orderBy(\"__name__\")` orders by DOCUMENT ID. Ordering by a record field\n *  would silently EXCLUDE documents missing that field (the trap\n *  `remote-host/server/hostRunner.ts:158-169` documents), turning a read into a\n *  partial one; the document id is always present and gives the stable order\n *  the store contract requires. */\nexport function createFirestoreDocs(database: Firestore): FirestoreDocs {\n  return {\n    list: async (collectionPath) => {\n      const snapshot = await getDocs(firestoreQuery(firestoreCollection(database, collectionPath), orderBy(\"__name__\")));\n      return snapshot.docs.map((entry) => ({ id: entry.id, data: entry.data() }));\n    },\n    get: async (collectionPath, docId) => {\n      const snapshot = await getDoc(doc(database, collectionPath, docId));\n      return snapshot.exists() ? snapshot.data() : null;\n    },\n    set: async (collectionPath, docId, data) => {\n      await setDoc(doc(database, collectionPath, docId), data);\n    },\n    create: (collectionPath, docId, data) =>\n      runTransaction(database, async (transaction) => {\n        const ref = doc(database, collectionPath, docId);\n        const existing = await transaction.get(ref);\n        if (existing.exists()) return false;\n        transaction.set(ref, data);\n        return true;\n      }),\n    // Firestore's deleteDoc succeeds on a missing document, so an existence\n    // check is what makes \"deleted\" distinguishable from \"there was nothing\".\n    // It runs INSIDE the transaction (like `create`): a plain get-then-delete\n    // would report `true` for a document a concurrent client had already\n    // removed, i.e. claim a delete this call never performed.\n    delete: (collectionPath, docId) =>\n      runTransaction(database, async (transaction) => {\n        const ref = doc(database, collectionPath, docId);\n        const existing = await transaction.get(ref);\n        if (!existing.exists()) return false;\n        transaction.delete(ref);\n        return true;\n      }),\n    // `docChanges()` rather than the whole snapshot: it names the documents\n    // that moved, which is what lets the store report per-record changes\n    // instead of \"something in this collection changed\". Added, modified and\n    // removed are all reported the same way — the store's listener takes an\n    // id, and re-reads; what KIND of change it was is not something a\n    // reconcile pass needs to be told.\n    //\n    // `includeMetadataChanges` is deliberately left off: local writes and\n    // has-pending-writes flips would otherwise wake every listener for\n    // changes this process just made.\n    watch: (collectionPath, onChanged, onError) => {\n      let seen = false;\n      return onSnapshot(\n        firestoreCollection(database, collectionPath),\n        (snapshot) => {\n          const initial = !seen;\n          seen = true;\n          onChanged(\n            snapshot.docChanges().map((change) => change.doc.id),\n            { initial },\n          );\n        },\n        onError,\n      );\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAsFA,SAAgB,oBAAoB,UAAoC;CACtE,OAAO;EACL,MAAM,OAAO,mBAAmB;GAE9B,QAAO,MADgB,QAAQ,MAAe,WAAoB,UAAU,cAAc,GAAG,QAAQ,UAAU,CAAC,CAAC,EAAA,CACjG,KAAK,KAAK,WAAW;IAAE,IAAI,MAAM;IAAI,MAAM,MAAM,KAAK;GAAE,EAAE;EAC5E;EACA,KAAK,OAAO,gBAAgB,UAAU;GACpC,MAAM,WAAW,MAAM,OAAO,IAAI,UAAU,gBAAgB,KAAK,CAAC;GAClE,OAAO,SAAS,OAAO,IAAI,SAAS,KAAK,IAAI;EAC/C;EACA,KAAK,OAAO,gBAAgB,OAAO,SAAS;GAC1C,MAAM,OAAO,IAAI,UAAU,gBAAgB,KAAK,GAAG,IAAI;EACzD;EACA,SAAS,gBAAgB,OAAO,SAC9B,eAAe,UAAU,OAAO,gBAAgB;GAC9C,MAAM,MAAM,IAAI,UAAU,gBAAgB,KAAK;GAE/C,KAAI,MADmB,YAAY,IAAI,GAAG,EAAA,CAC7B,OAAO,GAAG,OAAO;GAC9B,YAAY,IAAI,KAAK,IAAI;GACzB,OAAO;EACT,CAAC;EAMH,SAAS,gBAAgB,UACvB,eAAe,UAAU,OAAO,gBAAgB;GAC9C,MAAM,MAAM,IAAI,UAAU,gBAAgB,KAAK;GAE/C,IAAI,EAAC,MADkB,YAAY,IAAI,GAAG,EAAA,CAC5B,OAAO,GAAG,OAAO;GAC/B,YAAY,OAAO,GAAG;GACtB,OAAO;EACT,CAAC;EAWH,QAAQ,gBAAgB,WAAW,YAAY;GAC7C,IAAI,OAAO;GACX,OAAO,WACL,WAAoB,UAAU,cAAc,IAC3C,aAAa;IACZ,MAAM,UAAU,CAAC;IACjB,OAAO;IACP,UACE,SAAS,WAAW,CAAC,CAAC,KAAK,WAAW,OAAO,IAAI,EAAE,GACnD,EAAE,QAAQ,CACZ;GACF,GACA,OACF;EACF;CACF;AACF"}
+{"version":3,"file":"firestore.js","names":[],"sources":["../../src/collection/server/firestoreDocs.ts"],"sourcesContent":["// The seam between the firestore store and the Firestore SDK.\n//\n// The modular SDK is function-based (`getDocs(query(collection(db, …)))`), so a\n// store that imported those functions directly could not be tested without a\n// real backend — a fake `db` would still be handed to the real functions.\n// Narrowing to this interface makes the backend swappable: core ships\n// `createFirestoreDocs` over the real SDK, and the tests inject an in-memory\n// fake that satisfies the same shape. That is what lets this repository's tests\n// run with no API key and no network.\n//\n// Deliberately minimal and id-keyed: no query builder, no field ordering, no\n// cursors. Everything the store needs is \"the documents of one collection path,\n// ordered by document id\" — see the store header for why field ordering is\n// avoided entirely.\n//\n// The collection path is an ARGUMENT, not something this module composes. It\n// owns the SDK calls; `firestoreStore` owns where the documents live.\n\nimport {\n  collection as firestoreCollection,\n  doc,\n  getDoc,\n  getDocs,\n  orderBy,\n  query as firestoreQuery,\n  onSnapshot,\n  runTransaction,\n  setDoc,\n  Timestamp,\n  type Firestore,\n} from \"firebase/firestore\";\n\n/** One stored record document. `data` is the document's own fields — the\n *  record itself, not a wrapper around it; see `set` below. The store\n *  validates its shape, because a document written by hand could be\n *  anything. */\nexport interface FirestoreDoc {\n  id: string;\n  data: unknown;\n}\n\nexport interface FirestoreDocs {\n  /** Every document under `collectionPath`, ordered by document id. */\n  list: (collectionPath: string) => Promise<FirestoreDoc[]>;\n  /** One document's fields, or null when it doesn't exist. */\n  get: (collectionPath: string, docId: string) => Promise<unknown | null>;\n  /** Create or replace. */\n  set: (collectionPath: string, docId: string, data: Record<string, unknown>) => Promise<void>;\n  /** Create only. Returns false when the id already exists — atomic, so two\n   *  concurrent creates can't both observe \"missing\". */\n  create: (collectionPath: string, docId: string, data: Record<string, unknown>) => Promise<boolean>;\n  /** Delete. Returns false when the id didn't exist, so a caller can tell a\n   *  real delete from a typo'd id. */\n  delete: (collectionPath: string, docId: string) => Promise<boolean>;\n  /** Listen to `collectionPath`. Every snapshot reports the ids that changed\n   *  in it, and whether it is the FIRST one.\n   *\n   *  `initial` is not a nicety. `onSnapshot` delivers the current contents\n   *  immediately, as one snapshot in which every existing document reads as\n   *  `added` — so a listener that treats snapshots uniformly announces the\n   *  whole collection as changed the moment it arms, on every mount. The flag\n   *  is passed up rather than swallowed here so the decision (and its test)\n   *  lives with the store's policy, next to the rest of it.\n   *\n   *  `onError` fires at most once per subscription: a Firestore listen error\n   *  TERMINATES the listener and never recovers on its own. Re-subscribing is\n   *  the caller's job (`firestore/listen.ts` holds the policy).\n   *\n   *  Returns the detach function synchronously — `onSnapshot` is not async. */\n  watch: (collectionPath: string, onChanged: (ids: string[], meta: { initial: boolean }) => void, onError: (error: unknown) => void) => () => void;\n  /** Firestore's own instant, for a field the store must hand back as the type\n   *  it was stored as.\n   *\n   *  Here rather than in the store because this is the seam that owns the SDK:\n   *  `firebase` is an OPTIONAL peer, and the store is reachable from\n   *  `collection/server` (the factory registry in `store.ts` names it), so a\n   *  top-level `import { Timestamp }` there makes the peer required for every\n   *  consumer of that entry — including hosts with no Firestore at all. Typed\n   *  `unknown` so no SDK type crosses back out. */\n  timestamp: (seconds: number, nanoseconds: number) => unknown;\n}\n\n/** The real implementation over the modular SDK.\n *\n *  THE RECORD IS THE DOCUMENT. Its fields are written at the top level, not\n *  nested under a `data` key. This is not a matter of taste: the deployed\n *  security rules read `request.resource.data.<field>` and\n *  `resource.data[submit.emailField]` — a wrapper would put every field one\n *  level down, so the required-field checks, the status state machine and the\n *  \"your own row\" predicate would all read absent values and fail closed. A\n *  shared record's shape is part of the authorization contract.\n *\n *  `orderBy(\"__name__\")` orders by DOCUMENT ID. Ordering by a record field\n *  would silently EXCLUDE documents missing that field (the trap\n *  `remote-host/server/hostRunner.ts:158-169` documents), turning a read into a\n *  partial one; the document id is always present and gives the stable order\n *  the store contract requires. */\nexport function createFirestoreDocs(database: Firestore): FirestoreDocs {\n  return {\n    list: async (collectionPath) => {\n      const snapshot = await getDocs(firestoreQuery(firestoreCollection(database, collectionPath), orderBy(\"__name__\")));\n      return snapshot.docs.map((entry) => ({ id: entry.id, data: entry.data() }));\n    },\n    get: async (collectionPath, docId) => {\n      const snapshot = await getDoc(doc(database, collectionPath, docId));\n      return snapshot.exists() ? snapshot.data() : null;\n    },\n    set: async (collectionPath, docId, data) => {\n      await setDoc(doc(database, collectionPath, docId), data);\n    },\n    create: (collectionPath, docId, data) =>\n      runTransaction(database, async (transaction) => {\n        const ref = doc(database, collectionPath, docId);\n        const existing = await transaction.get(ref);\n        if (existing.exists()) return false;\n        transaction.set(ref, data);\n        return true;\n      }),\n    // Firestore's deleteDoc succeeds on a missing document, so an existence\n    // check is what makes \"deleted\" distinguishable from \"there was nothing\".\n    // It runs INSIDE the transaction (like `create`): a plain get-then-delete\n    // would report `true` for a document a concurrent client had already\n    // removed, i.e. claim a delete this call never performed.\n    delete: (collectionPath, docId) =>\n      runTransaction(database, async (transaction) => {\n        const ref = doc(database, collectionPath, docId);\n        const existing = await transaction.get(ref);\n        if (!existing.exists()) return false;\n        transaction.delete(ref);\n        return true;\n      }),\n    // `docChanges()` rather than the whole snapshot: it names the documents\n    // that moved, which is what lets the store report per-record changes\n    // instead of \"something in this collection changed\". Added, modified and\n    // removed are all reported the same way — the store's listener takes an\n    // id, and re-reads; what KIND of change it was is not something a\n    // reconcile pass needs to be told.\n    //\n    // `includeMetadataChanges` is deliberately left off: local writes and\n    // has-pending-writes flips would otherwise wake every listener for\n    // changes this process just made.\n    watch: (collectionPath, onChanged, onError) => {\n      let seen = false;\n      return onSnapshot(\n        firestoreCollection(database, collectionPath),\n        (snapshot) => {\n          const initial = !seen;\n          seen = true;\n          onChanged(\n            snapshot.docChanges().map((change) => change.doc.id),\n            { initial },\n          );\n        },\n        onError,\n      );\n    },\n    timestamp: (seconds, nanoseconds) => new Timestamp(seconds, nanoseconds),\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAiGA,SAAgB,oBAAoB,UAAoC;CACtE,OAAO;EACL,MAAM,OAAO,mBAAmB;GAE9B,QAAO,MADgB,QAAQ,MAAe,WAAoB,UAAU,cAAc,GAAG,QAAQ,UAAU,CAAC,CAAC,EAAA,CACjG,KAAK,KAAK,WAAW;IAAE,IAAI,MAAM;IAAI,MAAM,MAAM,KAAK;GAAE,EAAE;EAC5E;EACA,KAAK,OAAO,gBAAgB,UAAU;GACpC,MAAM,WAAW,MAAM,OAAO,IAAI,UAAU,gBAAgB,KAAK,CAAC;GAClE,OAAO,SAAS,OAAO,IAAI,SAAS,KAAK,IAAI;EAC/C;EACA,KAAK,OAAO,gBAAgB,OAAO,SAAS;GAC1C,MAAM,OAAO,IAAI,UAAU,gBAAgB,KAAK,GAAG,IAAI;EACzD;EACA,SAAS,gBAAgB,OAAO,SAC9B,eAAe,UAAU,OAAO,gBAAgB;GAC9C,MAAM,MAAM,IAAI,UAAU,gBAAgB,KAAK;GAE/C,KAAI,MADmB,YAAY,IAAI,GAAG,EAAA,CAC7B,OAAO,GAAG,OAAO;GAC9B,YAAY,IAAI,KAAK,IAAI;GACzB,OAAO;EACT,CAAC;EAMH,SAAS,gBAAgB,UACvB,eAAe,UAAU,OAAO,gBAAgB;GAC9C,MAAM,MAAM,IAAI,UAAU,gBAAgB,KAAK;GAE/C,IAAI,EAAC,MADkB,YAAY,IAAI,GAAG,EAAA,CAC5B,OAAO,GAAG,OAAO;GAC/B,YAAY,OAAO,GAAG;GACtB,OAAO;EACT,CAAC;EAWH,QAAQ,gBAAgB,WAAW,YAAY;GAC7C,IAAI,OAAO;GACX,OAAO,WACL,WAAoB,UAAU,cAAc,IAC3C,aAAa;IACZ,MAAM,UAAU,CAAC;IACjB,OAAO;IACP,UACE,SAAS,WAAW,CAAC,CAAC,KAAK,WAAW,OAAO,IAAI,EAAE,GACnD,EAAE,QAAQ,CACZ;GACF,GACA,OACF;EACF;EACA,YAAY,SAAS,gBAAgB,IAAI,UAAU,SAAS,WAAW;CACzE;AACF"}

package/dist/collection/index.cjs

@@ -368,9 +368,21 @@ function firstMissingRequiredField(draft, schema) {
 *  code composes the prompt text; letting it also decide whether that text runs
 *  would put both halves of the decision inside the sandbox.
 *
-*  The phone runtime does not consult this: it always sends, because a phone has
-*  no Enter key for the user to press (receptron/mulmoterminal#1253). The flag
-*  governs the desktop custom view and the desktop phone-frame preview. */
+*  EVERY surface honours this declaration, the phone included. The phone once
+*  always sent, on the grounds that it has no Enter key to press — but that made
+*  the same view behave differently depending on where it was opened, and it
+*  silently overrode default-deny on a device the author never tested.
+*
+*  The phone does not call THIS function: it reads `allowSendChat` out of the
+*  collection schema it already receives (`toDetail` sends the schema whole) and
+*  applies the same `=== true` rule in its own copy. Two reasons for that copy
+*  have been written down and both were wrong, so this states none — if you are
+*  touching it, check whether the phone can import this subpath and delete the
+*  copy if it can. Until then, keep the two in step.
+*
+*  It must also ask about the view whose document is RENDERED, not the selected
+*  one — during a view switch those differ, and the selected view's flag would
+*  decide for the previous view's still-running sandbox. */
 function customViewSendsChat(view) {
 	return view.allowSendChat === true;
 }