@aotter/mantle-admin 0.1.0-alpha.8 → 0.1.2-alpha.1

package/dist/mountMantleAdmin.js

@@ -1,5 +1,8 @@
-import { DiagnosticError, HTTP_STATUS_BY_CODE, MANTLE_REF_KEYWORD, MCP_HINT_KEYWORD, VIEW_PARAMS_RESERVED, isMediaMcpHint, httpStatusFor, meetsRole, redactForWire, runtimeDiagnostic, checkSchemaAdminUi, checkViewAdminUi, schemaSortableFields, STAFF_ROLES, } from "@aotter/mantle-spec";
-import { ViewParamCoercionError, coerceViewParams, evaluateAuthAll, } from "@aotter/mantle-runtime";
+import { bodyLimit } from "hono/body-limit";
+import { staffMcp } from "./staffMcp.js";
+import { rejectCrossOriginMutation } from "./rejectCrossOriginMutation.js";
+import { DiagnosticError, HTTP_STATUS_BY_CODE, MANTLE_REF_KEYWORD, MCP_HINT_KEYWORD, VIEW_PARAMS_RESERVED, isMediaMcpHint, httpStatusFor, meetsRole, redactForWire, resolveLocalizedText, resolveLifecycle, runtimeDiagnostic, checkSchemaAdminUi, checkViewAdminUi, schemaSortableFields, STAFF_ROLES, } from "@aotter/mantle-spec";
+import { ViewParamCoercionError, MAX_JSON_BODY_BYTES, coerceViewParams, evaluateAuthAll, projectCallableCapabilities, } from "@aotter/mantle-runtime";
 const STAFF_ROLE_SET = new Set(STAFF_ROLES);
 const [PAGE_PARAM, SHOW_PARAM] = VIEW_PARAMS_RESERVED;
 const MEMBER_CURSOR_PREFIX = "m:";
@@ -27,8 +30,19 @@ export function mountMantleAdmin(app, ref) {
     const authBasePath = auth.basePath;
     const spa = async (c) => {
         const asset = await ref.assets.fetch(new Request(new URL("/_mantle/admin/index.html", c.req.url)));
-        return asset ?? new Response("Mantle Admin assets are missing; run `mantle generate` and configure the ASSETS binding.", { status: 503, headers: { "cache-control": "private, no-store" } });
+        if (asset) {
+            const headers = new Headers(asset.headers);
+            // Append a separate policy so an asset's existing CSP remains effective.
+            headers.append("content-security-policy", "frame-ancestors 'none'");
+            headers.set("x-frame-options", "DENY");
+            headers.set("cache-control", "private, no-store");
+            return new Response(asset.body, { status: asset.status, headers });
+        }
+        return new Response("Mantle Admin assets are missing; run `mantle generate` and configure the ASSETS binding.", { status: 503, headers: { "cache-control": "private, no-store" } });
     };
+    const limitBody = bodyLimit({ maxSize: MAX_JSON_BODY_BYTES });
+    app.use("/admin/api/*", limitBody);
+    app.use(`${authBasePath}/*`, limitBody);
     // Public read-only manifest of registered sign-in methods. The admin
     // SPA hits this on sign-in-page mount so it can render per-method
     // sections without baking the method list into its build. No secrets
@@ -64,10 +78,13 @@ export function mountMantleAdmin(app, ref) {
         "/admin/c/:collection/:id",
         "/admin/media",
         "/admin/preferences",
+        "/admin/connected-apps",
         "/admin/settings",
         "/admin/staff",
         "/admin/members",
         "/admin/ops",
+        "/admin/dev",
+        "/admin/dev/*",
         "/admin/views/:name",
     ]) {
         app.get(path, spa);
@@ -114,29 +131,53 @@ export function mountMantleAdmin(app, ref) {
     // `/admin/api/collections` precedent exactly (same shape of
     // "precompute at mount from ref.plan, list on GET") and needs
     // no changes to the `SiteInfo` type or its query key.
-    // Report-sidebar source (#433): ONLY `surface: staff` Views. Public
-    // storefront Views explicitly marked public auto-mount on the public REST
-    // path and must not appear in the admin report sidebar — listing
-    // them was noise + broke on param-driven storefront Views (see #433).
-    const staffViews = Object.values(ref.plan.views)
-        .map(({ manifest }) => manifest)
-        .filter((view) => view.spec.surface === "staff");
-    const viewsManifest = staffViews.map((v) => ({
+    const views = Object.values(ref.plan.views).map(({ manifest }) => manifest);
+    const viewsManifest = views.map((v) => ({
         name: v.metadata.name,
         title: v.spec.title ?? null,
+        surface: v.spec.surface,
         from: v.spec.from ?? null,
         params: v.spec.params ?? null,
         fields: v.spec.fields ?? null,
         list: checkViewAdminUi(v).list,
     }));
+    const developerConsole = projectDeveloperConsole(ref.plan);
     const guarded = (method, path, body) => {
         app.on(method.toUpperCase(), path, async (c) => {
-            const gate = await readStaffGate(c, auth);
-            if (gate.kind === "unauth")
-                return adminUnauthenticated(c, path);
-            if (gate.kind === "forbidden")
-                return adminNotStaff(c, path, gate.login);
-            return body(c, gate);
+            const trace = path === "/admin/api/bootstrap" || path === "/admin/api/entries"
+                ? {
+                    kind: path === "/admin/api/bootstrap" ? "mantle-admin-bootstrap-v1" : "mantle-admin-entries-v1",
+                    requestId: crypto.randomUUID(), ray: c.req.header("cf-ray") ?? null, startedAt: performance.now(),
+                }
+                : undefined;
+            let status = null;
+            try {
+                const rejected = rejectCrossOriginMutation(c.req.raw);
+                if (rejected)
+                    return rejected;
+                const sessionStartedAt = performance.now();
+                const gate = await readStaffGate(c, auth);
+                if (trace)
+                    trace.sessionMs = elapsed(sessionStartedAt);
+                if (gate.kind === "unauth")
+                    return adminUnauthenticated(c, path);
+                if (gate.kind === "forbidden")
+                    return adminNotStaff(c, path, gate.login);
+                const response = await body(c, gate, trace);
+                status = response.status;
+                return response;
+            }
+            finally {
+                if (trace)
+                    console.info(JSON.stringify({
+                        kind: trace.kind, requestId: trace.requestId, ray: trace.ray, status,
+                        totalMs: elapsed(trace.startedAt), sessionMs: trace.sessionMs ?? null,
+                        runtimeMs: trace.runtimeMs ?? null, siteMs: trace.siteMs ?? null,
+                        catalogMs: trace.catalogMs ?? null, entriesMs: trace.entriesMs ?? null,
+                        listMs: trace.listMs ?? null, translationsMs: trace.translationsMs ?? null,
+                        serializeMs: trace.serializeMs ?? null, rows: trace.rows ?? null,
+                    }));
+            }
         });
     };
     const roleGuarded = (method, path, minimumRole, body) => {
@@ -147,6 +188,14 @@ export function mountMantleAdmin(app, ref) {
             return body(c, gate);
         });
     };
+    guarded("get", "/admin/api/webmcp", async () => {
+        const { tools, routes } = await staffMcp(await ref.get(), ref.plan);
+        return Response.json({ tools, routes }, { headers: { "cache-control": "private, no-store" } });
+    });
+    guarded("post", "/admin/api/mcp", async (c, gate) => {
+        const { dispatcher } = await staffMcp(await ref.get(), ref.plan);
+        return dispatcher.dispatch(c.req.raw, adminHandlerContext(c, gate, ref));
+    });
     guarded("get", "/admin/api/me", (_c, gate) => Response.json({ login: gate.login, role: gate.role, userId: gate.userId, image: gate.image }));
     roleGuarded("get", "/admin/api/staff", "owner", async () => Response.json({ users: await auth.listUsers() }));
     roleGuarded("get", "/admin/api/members", "editor", async (c) => {
@@ -257,7 +306,8 @@ export function mountMantleAdmin(app, ref) {
             }
             await auth.setUserRole(result.id, role);
         }
-        return Response.json({ ok: true, userId: result.id });
+        await auth.sendStaffInvitation?.(email, role);
+        return Response.json({ ok: true, userId: result.id, emailSent: Boolean(auth.sendStaffInvitation) });
     });
     roleGuarded("delete", "/admin/api/staff/invitations/:id", "owner", async (c) => {
         const revoked = await auth.revokeInvite(c.req.param("id") ?? "");
@@ -276,13 +326,33 @@ export function mountMantleAdmin(app, ref) {
         return Response.json({ ok: true });
     });
     guarded("get", "/admin/api/collections", () => Response.json({ collections }));
+    guarded("get", "/admin/api/collections/:name/statistics", async (c) => {
+        const collection = collections.find((item) => item.name === c.req.param("name") &&
+            (!item.parent || item.nav?.standalone === true));
+        if (!collection)
+            return Response.json({ error: "Collection not found" }, { status: 404 });
+        const ranges = {
+            "1h": [3_600_000, 300_000], "24h": [86_400_000, 3_600_000],
+            "7d": [7 * 86_400_000, 6 * 3_600_000], "20d": [20 * 86_400_000, 86_400_000],
+        };
+        const range = c.req.query("range") ?? "7d";
+        if (!Object.hasOwn(ranges, range))
+            return Response.json({ error: "Invalid statistics range" }, { status: 400 });
+        const [duration, bucketMs] = ranges[range];
+        const runtime = await ref.get();
+        if (!runtime.entries.readCreationStatistics) {
+            return Response.json({ error: "Statistics unavailable for this storage adapter" }, { status: 501 });
+        }
+        const to = Date.now();
+        const from = to - duration;
+        const statistics = await runtime.entries.readCreationStatistics({ collection: collection.name, from, to, bucketMs });
+        return Response.json({ ...statistics, from, to, bucketMs }, { headers: { "cache-control": "private, no-store" } });
+    });
+    roleGuarded("get", "/admin/api/developer-console", "owner", () => Response.json(developerConsole));
     guarded("get", "/admin/api/views-manifest", () => Response.json({ views: viewsManifest }));
-    // Staff Views (#433): mounted behind the staff gate at
-    // `/admin/api/views/<name>` — NOT on the public `/api/views/<name>`
-    // path (the public mount loop skips `surface: staff`). Reuses the
-    // exact same `handleViewRequest` logic and response shape as the
-    // public surface; only the gate + path differ.
-    for (const v of staffViews) {
+    // Admin inspection is staff-gated for both surfaces. Public Views keep
+    // their separate public `/api/views/<name>` contract.
+    for (const v of views) {
         const viewName = v.metadata.name;
         guarded("get", `/admin/api/views/${viewName}`, async (c, gate) => {
             const runtime = await ref.get();
@@ -293,7 +363,7 @@ export function mountMantleAdmin(app, ref) {
             return handleViewRequest(c.req.raw, runtime, v, adminHandlerContext(c, gate, ref), true);
         });
     }
-    guarded("get", "/admin/api/operations", (c, gate) => Response.json({
+    const operationsPayload = (c, gate) => ({
         operations: operations.filter((op) => evaluateAuthAll(op.procedure.spec.requires, adminHandlerContext(c, gate, ref), `GET /admin/api/operations/${op.name}`, "runtime") === null).map((op) => ({
             name: op.name,
             title: op.title,
@@ -302,8 +372,12 @@ export function mountMantleAdmin(app, ref) {
             uiSchema: op.uiSchema,
             triggers: op.triggers,
             rowBindings: op.rowBindings,
+            targetCollection: op.procedure.spec.handler.kind === "builtin"
+                ? op.procedure.spec.handler.schema
+                : null,
         })),
-    }));
+    });
+    guarded("get", "/admin/api/operations", (c, gate) => Response.json(operationsPayload(c, gate)));
     guarded("post", "/admin/api/operations/:name", async (c, gate) => {
         const name = c.req.param("name") ?? "";
         const op = operationsByName.get(name);
@@ -340,16 +414,17 @@ export function mountMantleAdmin(app, ref) {
             return { ok: true, output: result.data };
         });
     });
-    guarded("get", "/admin/api/site", async (c) => {
-        const runtime = await ref.get();
-        const { origin, ...site } = await runtime.siteConfig.load();
+    const sitePayload = async (c, runtime) => {
+        const resolvedRuntime = runtime ?? await ref.get();
+        const { origin, ...site } = await resolvedRuntime.siteConfig.load();
         const publicUrl = origin || new URL(c.req.url).origin;
-        return Response.json({
+        return {
             ...site,
             publicUrl,
             mcpUrl: `${publicUrl}/mcp/staff`,
-        });
-    });
+        };
+    };
+    guarded("get", "/admin/api/site", async (c) => Response.json(await sitePayload(c)));
     roleGuarded("get", "/admin/api/site-settings", "owner", async () => runMantleUseCase("GET /admin/api/site-settings", async () => {
         const runtime = await ref.get();
         return adminSiteSettings(await runtime.siteConfig.load());
@@ -366,7 +441,7 @@ export function mountMantleAdmin(app, ref) {
         });
         return adminSiteSettings(site);
     }));
-    guarded("get", "/admin/api/entries", async (c) => {
+    const entriesPayload = async (c, runtime, trace) => {
         const collection = c.req.query("collection");
         if (!collection) {
             return Response.json({
@@ -380,7 +455,10 @@ export function mountMantleAdmin(app, ref) {
                 }),
             }, { status: 400 });
         }
-        const runtime = await ref.get();
+        const runtimeStartedAt = performance.now();
+        const resolvedRuntime = runtime ?? await ref.get();
+        if (trace)
+            trace.runtimeMs = elapsed(runtimeStartedAt);
         const rawLimit = c.req.query("limit");
         const parsedLimit = rawLimit ? Number.parseInt(rawLimit, 10) : NaN;
         const statusQuery = c.req.query("status");
@@ -399,10 +477,25 @@ export function mountMantleAdmin(app, ref) {
                 }),
             }, { status: 400 });
         }
+        const scopeField = c.req.query("scope_field");
+        const scopeValue = c.req.query("scope_value");
+        if (Boolean(scopeField) !== Boolean(scopeValue)) {
+            return Response.json({
+                ok: false,
+                diagnostic: runtimeDiagnostic({
+                    code: "INPUT_VALIDATION_FAILED",
+                    severity: "error",
+                    path: "GET /admin/api/entries",
+                    expected: "scope_field and scope_value together",
+                    message: "List parent scope requires both `scope_field` and `scope_value`.",
+                }),
+            }, { status: 400 });
+        }
         // Admin pagination needs the cursored shape — `executePage` returns
         // `{ rows, nextCursor? }`. `execute()` is the flat-array variant
         // for app code.
-        const result = await runtime.listEntries.executePage({
+        const listStartedAt = performance.now();
+        const result = await resolvedRuntime.listEntries.executePage({
             collection,
             status: statusQuery && statusQuery !== "all" ? statusQuery : undefined,
             limit: Number.isFinite(parsedLimit) ? parsedLimit : 99,
@@ -412,11 +505,19 @@ export function mountMantleAdmin(app, ref) {
             filter: filterField && filterValue
                 ? { field: filterField, value: filterValue }
                 : undefined,
+            scope: scopeField && scopeValue
+                ? { field: scopeField, value: scopeValue }
+                : undefined,
             sort: {
                 field: c.req.query("sort") || "updatedAt",
                 direction: sortDirection,
             },
         });
+        if (trace) {
+            trace.listMs = elapsed(listStartedAt);
+            trace.rows = result.rows.length;
+        }
+        const translationsStartedAt = performance.now();
         const translationLocales = new Map();
         const translationSchemas = schemas.filter((schema) => schema.spec.translates?.parent === collection);
         for (const schema of translationSchemas) {
@@ -427,7 +528,7 @@ export function mountMantleAdmin(app, ref) {
                 if (value !== null)
                     parentValues.set(joinValueKey(value), value);
             }
-            const translations = await runtime.entries.readByDataFieldIn({
+            const translations = await resolvedRuntime.entries.readByDataFieldIn({
                 collection: schema.metadata.name,
                 field,
                 values: [...parentValues.values()],
@@ -452,12 +553,61 @@ export function mountMantleAdmin(app, ref) {
                 translationLocales.set(row.id, locales);
             }
         }
+        if (trace)
+            trace.translationsMs = elapsed(translationsStartedAt);
         const items = result.rows.map((row) => adminListItem(row, schemasByName, [...(translationLocales.get(row.id) ?? [])]));
-        return Response.json({
+        return {
             items,
             previous_cursor: result.previousCursor ?? null,
             next_cursor: result.nextCursor ?? null,
-        });
+        };
+    };
+    guarded("get", "/admin/api/entries", async (c, _gate, trace) => {
+        const payload = await entriesPayload(c, undefined, trace);
+        if (payload instanceof Response)
+            return payload;
+        const serializeStartedAt = performance.now();
+        const response = Response.json(payload);
+        if (trace)
+            trace.serializeMs = elapsed(serializeStartedAt);
+        return response;
+    });
+    guarded("get", "/admin/api/bootstrap", async (c, gate, trace) => {
+        const runtimeStartedAt = performance.now();
+        const runtime = await ref.get();
+        if (trace)
+            trace.runtimeMs = elapsed(runtimeStartedAt);
+        const siteStartedAt = performance.now();
+        const catalogStartedAt = performance.now();
+        const entriesStartedAt = performance.now();
+        const [site, catalog, entries] = await Promise.all([
+            sitePayload(c, runtime).finally(() => { if (trace)
+                trace.siteMs = elapsed(siteStartedAt); }),
+            staffMcp(runtime, ref.plan).finally(() => { if (trace)
+                trace.catalogMs = elapsed(catalogStartedAt); }),
+            entriesPayload(c, runtime, trace).finally(() => { if (trace)
+                trace.entriesMs = elapsed(entriesStartedAt); }),
+        ]);
+        if (entries instanceof Response)
+            return entries;
+        const serializeStartedAt = performance.now();
+        const response = Response.json({
+            me: {
+                login: gate.login,
+                role: gate.role,
+                userId: gate.userId,
+                image: gate.image,
+            },
+            collections,
+            site,
+            operations: operationsPayload(c, gate).operations,
+            views: viewsManifest,
+            webmcp: { tools: catalog.tools, routes: catalog.routes },
+            entries,
+        }, { headers: { "cache-control": "private, no-store" } });
+        if (trace)
+            trace.serializeMs = elapsed(serializeStartedAt);
+        return response;
     });
     guarded("get", "/admin/api/entries/export", async (c) => {
         const collection = c.req.query("collection");
@@ -492,11 +642,26 @@ export function mountMantleAdmin(app, ref) {
                 }),
             }, { status: 400 });
         }
+        const scopeField = c.req.query("scope_field");
+        const scopeValue = c.req.query("scope_value");
+        if (Boolean(scopeField) !== Boolean(scopeValue)) {
+            return Response.json({
+                ok: false,
+                diagnostic: runtimeDiagnostic({
+                    code: "INPUT_VALIDATION_FAILED",
+                    severity: "error",
+                    path: "GET /admin/api/entries/export",
+                    expected: "scope_field and scope_value together",
+                    message: "List parent scope requires both `scope_field` and `scope_value`.",
+                }),
+            }, { status: 400 });
+        }
         const listOptions = {
             collection,
             status: statusQuery && statusQuery !== "all" ? statusQuery : undefined,
             search: c.req.query("search") || undefined,
             filter: filterField && filterValue ? { field: filterField, value: filterValue } : undefined,
+            scope: scopeField && scopeValue ? { field: scopeField, value: scopeValue } : undefined,
             sort: {
                 field: c.req.query("sort") || "updatedAt",
                 direction: c.req.query("direction") === "asc" ? "asc" : "desc",
@@ -912,7 +1077,14 @@ function hasCtxStaffPredicate(procedure) {
     const predicates = procedure.spec.requires?.auth?.all ?? [];
     return predicates.some((pred) => typeof pred === "object" && pred !== null && "ctx.staff" in pred);
 }
-function adminEntryTitle(data, schema) {
+function adminEntryTitle(data, schema, primaryField) {
+    if (primaryField) {
+        const value = data[primaryField];
+        if (typeof value === "string" && value.trim())
+            return value;
+        if (typeof value === "number" || typeof value === "boolean")
+            return value;
+    }
     const key = titleFieldKey(data, schema);
     return key ? data[key] : null;
 }
@@ -1057,10 +1229,12 @@ async function entryEditorPayload(runtime, row, schemas) {
         }));
     }
     const related = await relatedEntrySections(runtime, schema, row, schemas);
+    const parent = await parentEntry(runtime, schema, row, schemas);
     return {
         collection: adminEditorCollection(schema, schemas),
         entry: adminEditorEntry(row),
-        parentEntryId: await parentEntryId(runtime, schema, row, schemas),
+        parentEntryId: parent?.id ?? null,
+        parentEntryTitle: parent ? parentEntryTitle(parent, schemas) : null,
         related,
     };
 }
@@ -1081,6 +1255,7 @@ function adminEditorCollection(schema, schemas) {
         sortableFields: schemaSortableFields(schema),
         filter: adminUi.filter,
         list: adminUi.list,
+        nav: adminUi.nav,
     };
 }
 function adminEditorEntry(row) {
@@ -1184,16 +1359,26 @@ function collectionParentFor(childSchema, schemas) {
     }
     return null;
 }
-async function parentEntryId(runtime, childSchema, childRow, schemas) {
+async function parentEntry(runtime, childSchema, childRow, schemas) {
     const parent = collectionParentFor(childSchema, schemas);
     if (!parent)
         return null;
     const value = primitiveJoinValue(childRow.data[parent.childField]);
     if (value === null)
         return null;
-    if (parent.parentField === "id" && typeof value === "string")
-        return value;
-    return (await entriesByDataValue(runtime, parent.collection, parent.parentField, value))[0]?.id ?? null;
+    if (parent.parentField === "id" && typeof value === "string") {
+        const entry = await runtime.getEntry.execute({ id: value });
+        return entry.collection === parent.collection ? entry : null;
+    }
+    return (await entriesByDataValue(runtime, parent.collection, parent.parentField, value))[0] ?? null;
+}
+function parentEntryTitle(entry, schemas) {
+    const schema = schemas.find((candidate) => candidate.metadata.name === entry.collection);
+    const primaryField = schema ? checkSchemaAdminUi(schema).list.primaryField : null;
+    const value = adminEntryTitle(entry.data, schema?.spec.schema, primaryField);
+    return typeof value === "string" || typeof value === "number" || typeof value === "boolean"
+        ? String(value)
+        : entry.id;
 }
 function primitiveJoinValue(value) {
     if (typeof value === "string" && value !== "")
@@ -1243,6 +1428,9 @@ function objectField(value) {
         ? value
         : {};
 }
+function elapsed(startedAt) {
+    return Math.round((performance.now() - startedAt) * 100) / 100;
+}
 function adminHandlerContext(c, gate, ref) {
     const request = ref.requestContext?.(c);
     return {
@@ -1262,8 +1450,11 @@ async function readStaffGate(c, auth) {
     const session = await auth.getSession(c.req.raw);
     if (!session)
         return { kind: "unauth" };
-    const role = await auth.getUserRole(session.user.id);
-    const login = session.user.githubLogin ?? null;
+    const role = session.user.roleCurrent
+        ? session.user.role ?? null
+        : await auth.getUserRole(session.user.id);
+    const login = [session.user.githubLogin, session.user.name, session.user.email]
+        .find((value) => value?.trim()) ?? null;
     if (!role || !STAFF_ROLE_SET.has(role)) {
         return { kind: "forbidden", login };
     }
@@ -1417,6 +1608,178 @@ function mediaFieldsForSchema(schema) {
     }
     return out;
 }
+function developerRelation(id, kind, sourceId, targetId, pointer, value) {
+    return { id, kind, sourceId, targetId, pointer, value };
+}
+function jsonPointerSegment(value) {
+    return value.replace(/~/g, "~0").replace(/\//g, "~1");
+}
+function developerAudience(predicates) {
+    if (predicates.some((predicate) => typeof predicate === "object" && "ctx.staff" in predicate))
+        return "staff";
+    if (predicates.includes("ctx.user"))
+        return "members";
+    if (predicates.some((predicate) => predicate === "ctx.auth" || (typeof predicate === "object" && "ctx.auth.scope" in predicate)))
+        return "api-clients";
+    return null;
+}
+function projectDeveloperConsole(plan) {
+    const schemasByName = new Map(Object.values(plan.schemas).map(({ name, manifest }) => [name, manifest]));
+    const procedures = Object.values(plan.procedures).map(({ name, manifest, authorization, guard }) => ({
+        name,
+        title: manifest.spec.title ?? null,
+        description: manifest.spec.description ?? null,
+        audience: developerAudience(authorization?.all ?? []) ?? "public",
+        input: manifest.spec.input,
+        output: manifest.spec.output,
+        authorization: authorization?.all ?? [],
+        guard: guard ?? null,
+        handler: manifest.spec.handler,
+        manifest,
+    })).sort((a, b) => a.name.localeCompare(b.name));
+    const triggers = Object.values(plan.triggers).map(({ name, manifest, target }) => {
+        const source = manifest.spec.source;
+        const targetAudience = developerAudience(plan.procedures[target]?.authorization?.all ?? []);
+        return {
+            name,
+            target,
+            audience: source.kind === "lifecycle" ? "system" : source.kind === "mcp" && source.surface === "staff" ? "staff" : targetAudience ?? "public",
+            source,
+            manifest,
+        };
+    }).sort((a, b) => a.name.localeCompare(b.name));
+    const graph = {
+        atoms: [
+            ...Object.values(plan.schemas).map(({ name, manifest }) => ({ id: `Schema:${name}`, kind: "Schema", name, title: manifest.spec.title })),
+            ...Object.values(plan.views).map(({ name, manifest, authorization }) => ({
+                id: `View:${name}`,
+                kind: "View",
+                name,
+                title: manifest.spec.title ?? null,
+                audience: manifest.spec.surface === "staff" ? "staff" : developerAudience(authorization?.all ?? []) ?? "public",
+            })),
+            ...procedures.map(({ name, title, description, audience, handler }) => ({
+                id: `Procedure:${name}`,
+                kind: "Procedure",
+                name,
+                title,
+                description,
+                audience,
+                handler,
+            })),
+            ...triggers.map(({ name, source, audience }) => ({
+                id: `Trigger:${name}`,
+                kind: "Trigger",
+                name,
+                title: null,
+                audience,
+                transport: source.kind,
+            })),
+        ].sort((a, b) => a.id.localeCompare(b.id)),
+        relations: [
+            ...Object.values(plan.schemas).flatMap(({ name, manifest, translationParent }) => [
+                ...(translationParent ? [developerRelation(`Schema:${name}:translates:${translationParent}`, "translation-parent", `Schema:${name}`, `Schema:${translationParent}`, "/spec/translates/parent", translationParent)] : []),
+                ...Object.entries(manifest.spec.schema.properties ?? {}).flatMap(([field, property]) => {
+                    const target = property[MANTLE_REF_KEYWORD];
+                    if (typeof target !== "string" || !schemasByName.has(target))
+                        return [];
+                    return [developerRelation(`Schema:${name}:field:${field}:${target}`, "schema-reference", `Schema:${name}`, `Schema:${target}`, `/spec/schema/properties/${jsonPointerSegment(field)}/x-mantle-ref`, target)];
+                }),
+            ]),
+            ...Object.values(plan.views).flatMap(({ name, query, guard }) => [
+                ...(query.kind === "declarative" ? [developerRelation(`View:${name}:from:${query.from}`, "view-source", `View:${name}`, `Schema:${query.from}`, "/spec/from", query.from)] : []),
+                ...(guard ? [developerRelation(`View:${name}:guard:${guard}`, "authorization-guard", `View:${name}`, `Procedure:${guard}`, "/spec/requires/guard/procedure", guard)] : []),
+            ]),
+            ...Object.values(plan.procedures).flatMap(({ name, manifest, builtinSchema, collectionActionSchema, guard }) => [
+                ...(builtinSchema ? [developerRelation(`Procedure:${name}:builtin:${builtinSchema}`, "procedure-schema", `Procedure:${name}`, `Schema:${builtinSchema}`, "/spec/handler/schema", builtinSchema)] : []),
+                ...(collectionActionSchema ? [developerRelation(`Procedure:${name}:collectionAction:${collectionActionSchema}`, "collection-action", `Procedure:${name}`, `Schema:${collectionActionSchema}`, "/spec/uiSchema/collectionAction", collectionActionSchema)] : []),
+                ...discoverRowBindings(manifest, schemasByName).map(({ collection, inputField }) => developerRelation(`Procedure:${name}:input:${inputField}:${collection}`, "input-reference", `Procedure:${name}`, `Schema:${collection}`, `/spec/input/properties/${jsonPointerSegment(inputField)}/x-mantle-ref`, collection)),
+                ...(guard ? [developerRelation(`Procedure:${name}:guard:${guard}`, "authorization-guard", `Procedure:${name}`, `Procedure:${guard}`, "/spec/requires/guard/procedure", guard)] : []),
+            ]),
+            ...Object.values(plan.triggers).flatMap(({ name, target, lifecycleSchema }) => [
+                developerRelation(`Trigger:${name}:target:${target}`, "trigger-target", `Trigger:${name}`, `Procedure:${target}`, "/spec/target/procedure", target),
+                ...(lifecycleSchema ? [developerRelation(`Trigger:${name}:source:${lifecycleSchema}`, "lifecycle-source", `Trigger:${name}`, `Schema:${lifecycleSchema}`, "/spec/source/schema", lifecycleSchema)] : []),
+            ]),
+        ].sort((a, b) => a.id.localeCompare(b.id)),
+    };
+    return {
+        dataModel: {
+            schemas: Object.values(plan.schemas).map(({ name, manifest }) => ({
+                name,
+                title: manifest.spec.title,
+                lifecycle: resolveLifecycle(manifest),
+                localized: manifest.spec.localized ?? false,
+                translates: manifest.spec.translates ?? null,
+                schema: manifest.spec.schema,
+                uniqueIndexes: manifest.spec.uniqueIndexes ?? [],
+                indexes: manifest.spec.indexes ?? [],
+                searchableFields: manifest.spec.searchableFields ?? [],
+                manifest,
+            })).sort((a, b) => a.name.localeCompare(b.name)),
+            views: Object.values(plan.views).map(({ name, manifest, query, authorization, guard }) => ({
+                name,
+                title: manifest.spec.title ?? null,
+                surface: manifest.spec.surface,
+                query,
+                authorization: authorization?.all ?? [],
+                guard: guard ?? null,
+                manifest,
+            })).sort((a, b) => a.name.localeCompare(b.name)),
+        },
+        logic: { triggers, procedures },
+        interfaces: projectDeveloperInterfaces(plan),
+        graph,
+    };
+}
+function projectDeveloperInterfaces(plan) {
+    const callable = projectCallableCapabilities(plan).map((capability) => ({
+        kind: capability.kind,
+        name: capability.name,
+        target: capability.ownerName,
+        surface: capability.surface,
+        audience: developerAudience((capability.kind === "view"
+            ? plan.views[capability.ownerName]?.authorization?.all
+            : plan.procedures[capability.ownerName]?.authorization?.all) ?? []) ?? "public",
+        title: capability.title ?? null,
+        description: capability.description,
+        input: capability.inputSchema,
+        output: capability.kind === "procedure" ? capability.outputSchema : null,
+        trigger: capability.kind === "procedure" ? capability.trigger : null,
+    }));
+    const http = [
+        ...plan.httpRoutes.map((route) => {
+            const procedure = plan.procedures[route.procedure];
+            return {
+                kind: "procedure",
+                name: route.trigger,
+                target: route.procedure,
+                method: route.method,
+                path: route.path,
+                audience: developerAudience(procedure.authorization?.all ?? []) ?? "public",
+                title: resolveLocalizedText(procedure.manifest.spec.title, "en") ?? null,
+                description: resolveLocalizedText(procedure.manifest.spec.description, "en") ?? `Invoke Procedure '${route.procedure}'.`,
+                input: procedure.manifest.spec.input,
+                output: procedure.manifest.spec.output,
+            };
+        }),
+        ...callable.filter((capability) => capability.kind === "view" && capability.surface === "public").map((capability) => {
+            const view = plan.views[capability.target];
+            return {
+                kind: "view",
+                name: capability.name,
+                target: capability.target,
+                method: "GET",
+                path: `/api/views/${capability.target}`,
+                audience: developerAudience(view.authorization?.all ?? []) ?? "public",
+                title: capability.title,
+                description: capability.description,
+                input: capability.input,
+                output: null,
+            };
+        }),
+    ].sort((a, b) => `${a.path}\0${a.method}`.localeCompare(`${b.path}\0${b.method}`));
+    return { http, callable };
+}
 export async function runMantleUseCase(operation, execute) {
     try {
         const result = await execute();