@aotter/mantle 0.1.4 → 0.2.0-alpha.1

package/dist/core/runtime/createRuntime.d.ts

@@ -0,0 +1,23 @@
+import { type RuntimePlan } from "../../spec/domain/index.js";
+import { systemCaller } from "../caller.js";
+import { type InvocationCause, type MantleHandlers } from "../invocation.js";
+import type { MantleRuntime, MantleStorageAdapter } from "../service.js";
+export declare const CORE_VERSION = "0.2.0";
+export interface MantleRuntimeArgs {
+    readonly plan: RuntimePlan;
+    readonly handlers: MantleHandlers<never>;
+    readonly storage: MantleStorageAdapter;
+    /** Refuses to boot on a mismatch (`PLAN_FINGERPRINT_MISMATCH`): what Cloud compiled is what runs. */
+    readonly expectedFingerprint?: string;
+    /** Boot fails for any enabled schedule unless the entry wires schedules. */
+    readonly schedules?: boolean;
+    /** Handed to handlers as `ctx.env`. */
+    readonly env?: unknown;
+    readonly waitUntil?: (promise: Promise<unknown>, cause?: InvocationCause) => void;
+    /** Microseconds since the epoch, and new entry ids. */
+    readonly now?: () => number;
+    readonly newId?: () => string;
+}
+export declare function createMantleRuntime(args: MantleRuntimeArgs): Promise<MantleRuntime>;
+export { systemCaller };
+//# sourceMappingURL=createRuntime.d.ts.map

package/dist/core/runtime/createRuntime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"createRuntime.d.ts","sourceRoot":"","sources":["../../../src/core/runtime/createRuntime.ts"],"names":[],"mappings":"AAKA,OAAO,EAAqI,KAAK,WAAW,EAA4C,MAAM,4BAA4B,CAAC;AAG3O,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAA8D,KAAK,eAAe,EAAiD,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAKxL,OAAO,KAAK,EAAoB,aAAa,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAG3F,eAAO,MAAM,YAAY,UAAU,CAAC;AAQpC,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC;IACzC,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;IACvC,qGAAqG;IACrG,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IACtC,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,uCAAuC;IACvC,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,EAAE,eAAe,KAAK,IAAI,CAAC;IAClF,uDAAuD;IACvD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;CAC/B;AAgBD,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,CAAC,CAqKzF;AAED,OAAO,EAAE,YAAY,EAAE,CAAC"}

package/dist/core/runtime/createRuntime.js

@@ -0,0 +1,214 @@
+/**
+ * `createMantleRuntime`: boots one sealed plan into a running runtime (ADR-0032 decisions 3, 7 and 10).
+ * Boot checks the plan, the handlers and the storage; `invokeProcedure` is the one path every source runs through.
+ */
+import { DiagnosticError, makeDiagnostic, readJsonPointer } from "../../spec/kernel/index.js";
+import { RUNTIME_PLAN_VERSION, SqlRefusal, firstZodIssueAsJsonPointer, jsonSchemaToZod, planFingerprint, safeParseJson, ManifestParseError } from "../../spec/domain/index.js";
+import { validateTriggerSpec } from "../../spec/domain/service/TriggerSpecChecks.js";
+import { systemCaller } from "../caller.js";
+import { MAX_INVOCATION_DEPTH } from "../invocation.js";
+import { sqlInput } from "../sql/compile.js";
+import { runProcedure } from "../sql/run.js";
+import { bindFor, createStore } from "../store/createStore.js";
+import { evaluateAuthAll } from "./auth.js";
+export const CORE_VERSION = "0.2.0";
+/** A staff View's `uiSchema.list.searchFields` and `filterFields`, which Store's `search` and `filters` match (ADR-0032 decision 5). */
+function listFields(uiSchema) {
+    const list = (uiSchema?.["list"] ?? {});
+    return { ...(list.searchFields?.length ? { searchFields: list.searchFields } : {}), ...(list.filterFields?.length ? { filterFields: list.filterFields } : {}) };
+}
+const fail = (code, path, message, phase = "boot", extra = {}) => new DiagnosticError(makeDiagnostic({ code, phase, severity: "error", path, message, ...extra }));
+const VERB = { create: "insert", update: "update", delete: "delete", publish: "publish" };
+const depthOf = (c) => {
+    let depth = 0;
+    for (; c && depth <= MAX_INVOCATION_DEPTH; c = c.parent)
+        depth++;
+    return depth;
+};
+const child = (parent, procedure) => ({ kind: "internal", id: `${parent.id}>${procedure}`, parent });
+/** The key of the Schema a lifecycle Trigger names, as the dispatcher keys its hooks: the name in lower case, an own key. */
+const lifecycleKey = (plan, schema) => (Object.hasOwn(plan.schemas, schema.toLowerCase()) ? schema.toLowerCase() : undefined);
+export async function createMantleRuntime(args) {
+    const { plan } = args;
+    const at = "plan";
+    // ---- boot: the plan is what was sealed, and what was expected ---------------------------------------------------------
+    if (plan.version !== RUNTIME_PLAN_VERSION)
+        throw fail("PLAN_FINGERPRINT_MISMATCH", at, `plan version ${plan.version} is not the version this Core runs (${RUNTIME_PLAN_VERSION})`);
+    const { fingerprint, ...body } = plan;
+    if ((await planFingerprint(body)) !== fingerprint)
+        throw fail("PLAN_FINGERPRINT_MISMATCH", at, "the plan does not match its fingerprint: it changed after it was sealed");
+    if (args.expectedFingerprint !== undefined && args.expectedFingerprint !== fingerprint)
+        throw fail("PLAN_FINGERPRINT_MISMATCH", at, `the plan's fingerprint is ${fingerprint}, expected ${args.expectedFingerprint}`);
+    // handlers and plan agree in both directions
+    const refs = new Set(Object.values(plan.procedures).flatMap((p) => ("ref" in p.handler ? [p.handler.ref] : [])));
+    for (const ref of refs)
+        if (!Object.hasOwn(args.handlers, ref))
+            throw fail("HANDLER_NOT_REGISTERED", `${at}#/handler/${ref}`, `the plan names handler '${ref}' and none is registered`, "boot", { candidates: Object.keys(args.handlers) });
+    for (const name of Object.keys(args.handlers))
+        if (!refs.has(name))
+            throw fail("HANDLER_NOT_DECLARED", `${at}#/handlers/${name}`, `handler '${name}' is registered and no Procedure of the plan declares it`);
+    const triggers = Object.entries(plan.triggers).sort(([a], [b]) => (a < b ? -1 : 1));
+    // a Trigger is checked as the CLI checks its manifest (a lifecycle hook that is not one would bind nothing), and it targets a
+    // Procedure and a Schema of this plan: a surface that cannot find one fails on every request instead
+    for (const [name, t] of triggers) {
+        const path = `${at}#/triggers/${name}`;
+        try {
+            validateTriggerSpec({ spec: { source: t.source, target: { procedure: t.procedure } } }, undefined); // no document index: the path names the Trigger
+        }
+        catch (e) {
+            if (e instanceof ManifestParseError)
+                throw fail(e.code, `${path}${e.pointer?.replace(/^\/spec/, "") ?? ""}`, e.message);
+            throw e;
+        }
+        if (!Object.hasOwn(plan.procedures, t.procedure))
+            throw fail("TRIGGER_TARGET_PROCEDURE_UNKNOWN", path, `Trigger '${name}' targets '${t.procedure}', which is not a Procedure of the plan`);
+        // the dispatcher keys hooks by the Schema's key (its name in lower case) and a deferred after hook is honoured only for the
+        // Schema's name as declared (`runDeferredHook`), so the Trigger names a Schema exactly as the CLI's linker requires
+        const key = t.source.kind === "lifecycle" ? lifecycleKey(plan, t.source.schema) : undefined;
+        if (t.source.kind === "lifecycle" && (key === undefined || plan.schemas[key].name !== t.source.schema))
+            throw fail("LIFECYCLE_SCHEMA_UNKNOWN", path, `lifecycle Trigger '${name}' watches '${t.source.schema}', which is not the name of a Schema of the plan`);
+    }
+    if (!args.schedules && triggers.some(([, t]) => t.source.kind === "schedule" && t.source.enabled !== false))
+        throw fail("SCHEDULE_NOT_WIRED", at, "the plan has an enabled schedule Trigger and this entry does not wire schedules (pass schedules: true)");
+    // hook targets and guards are consumer code: an inline program would write inside a before hook or a guard, which fails open
+    const inline = (name) => !("ref" in (plan.procedures[name]?.handler ?? { ref: "" }));
+    for (const [name, t] of triggers)
+        if (t.source.kind === "lifecycle" && inline(t.procedure))
+            throw fail("LIFECYCLE_TARGET_NOT_REF", `${at}#/triggers/${name}`, `lifecycle Trigger '${name}' targets '${t.procedure}', which is an inline program`);
+    for (const [name, p] of Object.entries(plan.procedures)) {
+        const g = p.requires?.guard?.procedure;
+        if (g && inline(g))
+            throw fail("GUARD_PROCEDURE_NOT_REF", `${at}#/procedures/${name}`, `'${name}' is guarded by '${g}', which is an inline program`);
+    }
+    for (const [name, v] of Object.entries(plan.views)) {
+        const g = v.requires?.guard?.procedure;
+        if (g && inline(g))
+            throw fail("GUARD_PROCEDURE_NOT_REF", `${at}#/views/${name}`, `View '${name}' is guarded by '${g}', which is an inline program`);
+    }
+    // a plan is dialect-specific: checked before storage converges to it
+    const { dialect } = args.storage;
+    if (plan.dialect?.name !== dialect.name || plan.dialect.version !== dialect.version)
+        throw fail("PLAN_FINGERPRINT_MISMATCH", at, `the plan was compiled for dialect ${plan.dialect?.name}@${plan.dialect?.version}; this storage runs ${dialect.name}@${dialect.version}`);
+    const { executor, site } = await args.storage.prepare(plan);
+    // ---- lifecycle: Store hands mutations to this dispatcher; Procedures are only reached through invokeProcedure ---------------
+    const byHook = new Map();
+    const before = new Set();
+    const after = new Set();
+    for (const [name, t] of triggers) {
+        if (t.source.kind !== "lifecycle")
+            continue;
+        for (const hook of t.source.on) {
+            const [stage, op] = hook.split("_");
+            // a statement names its table the way SQL folds it, so hooks are keyed by the lower-cased Schema name
+            const schema = lifecycleKey(plan, t.source.schema);
+            (stage === "before" ? before : after).add(`${schema}.${VERB[op]}`);
+            const key = `${schema}|${hook}`;
+            byHook.set(key, [...(byHook.get(key) ?? []), [name, t.procedure]]);
+        }
+    }
+    const fire = (e, [trigger, procedure]) => invoke({ procedure, input: {}, caller: e.caller, cause: { kind: "lifecycle", id: `${e.id}:${trigger}`, ...(e.parent ? { parent: e.parent } : {}), trigger, hook: e.hook, schema: plan.schemas[e.schema]?.name ?? e.schema, rows: e.rows } });
+    const dispatcher = {
+        // a before hook that throws rejects the mutation: it fails closed
+        async before(events) {
+            for (const e of events)
+                for (const t of byHook.get(`${e.schema}|${e.hook}`) ?? [])
+                    await fire(e, t);
+        },
+        // an after hook never changes a committed result; the cause id is stable so a handler can deduplicate a replay
+        async after(events) {
+            for (const e of events)
+                for (const t of byHook.get(`${e.schema}|${e.hook}`) ?? []) {
+                    try {
+                        await fire(e, t);
+                    }
+                    catch (error) {
+                        console.error("[mantle lifecycle] after hook failed", { trigger: t[0], hook: e.hook, schema: e.schema, error });
+                    }
+                }
+        },
+    };
+    const lifecycle = before.size || after.size ? { dispatcher, before, after } : undefined;
+    const now = args.now ?? (() => Date.now() * 1000);
+    const store = createStore({
+        executor, dialect, schemas: plan.schemas, lifecycle, now,
+        newId: args.newId ?? (() => crypto.randomUUID().replaceAll("-", "")),
+        views: Object.fromEntries(Object.entries(plan.views).map(([name, v]) => [name, { ir: v.stmts, inputs: v.inputs, ...(v.input ? { input: v.input } : {}), ...(v.columns ? { columns: v.columns } : {}), public: v.surface === "public", ...(v.requires ? { requires: v.requires } : {}), ...(v.requires?.guard ? { guard: v.requires.guard.procedure } : {}), ...listFields(v.uiSchema) }])),
+        guardView: async (procedure, caller, input, cause) => { await invoke({ procedure, input, caller, cause: child(cause, procedure) }, true); },
+    });
+    // ---- invocation ---------------------------------------------------------------------------------------------------------------
+    const zod = new Map();
+    const schemaOf = (key, schema) => zod.get(key) ?? (zod.set(key, jsonSchemaToZod(schema)), zod.get(key));
+    const check = (kind, name, path, value, schema) => {
+        const r = safeParseJson(schemaOf(`${name}#${kind}`, schema), value);
+        if (r.success)
+            return r.data;
+        const { instancePath, message } = firstZodIssueAsJsonPointer(r.error);
+        throw new DiagnosticError(makeDiagnostic({
+            code: kind === "input" ? "INPUT_VALIDATION_FAILED" : "OUTPUT_VALIDATION_FAILED", phase: "runtime", severity: "error", path: `${path}#/${kind}${instancePath}`,
+            // an output value is handler data the schema did not expect: it may hold what the schema meant to exclude, so it never reaches a wire
+            ...(kind === "input" ? { value: readJsonPointer(value, instancePath) } : {}), expected: message,
+            ...(kind === "output" ? { message: `Procedure '${name}' returned a value that does not match its declared output schema. This is a handler bug.` } : {}),
+        }));
+    };
+    const readOnly = (s) => ({
+        ...s, write: () => Promise.reject(fail("AUTH_DENIED", "store", "a guard or a before hook may not write", "runtime")),
+    });
+    async function invoke(inv, guard = false) {
+        if (depthOf(inv.cause) > MAX_INVOCATION_DEPTH)
+            throw fail("INVOCATION_DEPTH_EXCEEDED", `manifest:Procedure/${inv.procedure}`, `Procedures invoked more than ${MAX_INVOCATION_DEPTH} deep (hooks and ctx.invoke count)`, "runtime");
+        const proc = Object.hasOwn(plan.procedures, inv.procedure) ? plan.procedures[inv.procedure] : undefined;
+        const path = `manifest:Procedure/${inv.procedure}`;
+        if (!proc)
+            throw fail("PROCEDURE_NOT_FOUND", path, `unknown Procedure '${inv.procedure}'`, "runtime");
+        const denial = evaluateAuthAll(proc.requires, inv.caller, path);
+        if (denial)
+            throw new DiagnosticError(denial);
+        const input = check("input", inv.procedure, path, inv.input, proc.input);
+        // a dynamic guard sees the validated input and the same caller, reads only, and may not itself be guarded
+        const guardName = proc.requires?.guard?.procedure;
+        if (guardName && !guard)
+            await invoke({ procedure: guardName, input, caller: inv.caller, cause: child(inv.cause, guardName) }, true);
+        const isBefore = inv.cause.kind === "lifecycle" && inv.cause.hook.startsWith("before_");
+        const ro = guard || isBefore;
+        if (ro && "sql" in proc.handler)
+            throw fail("LIFECYCLE_TARGET_NOT_REF", path, "a guard or a before hook may not be an inline program", "runtime");
+        let result;
+        try {
+            if ("ref" in proc.handler) {
+                const bound = store.as(inv.caller, inv.cause); // writes chain to this invocation, so hooks they fire count toward the depth limit
+                // only the system caller reaches TTL maintenance: no request can produce one (ADR-0032 decision 8)
+                const scoped = inv.caller.kind === "system" && !ro ? { ...bound, sweepExpired: store.sweepExpired } : bound;
+                const ctx = {
+                    caller: inv.caller, cause: inv.cause, env: args.env, waitUntil: (promise) => args.waitUntil?.(promise, inv.cause),
+                    store: ro ? readOnly(scoped) : scoped,
+                    invoke: (procedure, i) => (ro ? Promise.reject(fail("AUTH_DENIED", path, "a guard or a before hook may not invoke a Procedure", "runtime")) : invoke({ procedure, input: i, caller: inv.caller, cause: child(inv.cause, procedure) })),
+                };
+                result = await args.handlers[proc.handler.ref](input, ctx);
+            }
+            else {
+                const { mode, bind } = bindFor(now(), inv.caller);
+                const env = { executor, dialect, schemas: plan.schemas, mode, lifecycle };
+                const ran = await runProcedure(env, { kind: "procedure", inputs: proc.inputs, ir: proc.handler.sql.stmts }, { caller: inv.caller, cause: inv.cause, bind: { ...bind, input: sqlInput(proc.input, input) } });
+                result = { results: ran.rows };
+            }
+        }
+        catch (e) {
+            if (e instanceof DiagnosticError)
+                throw e;
+            if (e instanceof SqlRefusal)
+                throw fail("INPUT_VALIDATION_FAILED", path, e.message, "runtime");
+            console.error(`[mantle procedure ${inv.procedure}] unhandled failure`, e);
+            throw fail("INTERNAL_ERROR", path, "An internal error occurred.", "runtime");
+        }
+        return check("output", inv.procedure, path, result, proc.output);
+    }
+    return {
+        plan,
+        store,
+        invokeProcedure: (invocation) => invoke(invocation),
+        bootReport: () => ({ fingerprint, coreVersion: CORE_VERSION }),
+        ...(site ? { site } : {}),
+    };
+}
+export { systemCaller };
+//# sourceMappingURL=createRuntime.js.map

package/dist/core/runtime/createRuntime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createRuntime.js","sourceRoot":"","sources":["../../../src/core/runtime/createRuntime.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,eAAe,EAAwC,MAAM,4BAA4B,CAAC;AACpI,OAAO,EAAE,oBAAoB,EAAE,UAAU,EAAE,0BAA0B,EAAE,eAAe,EAAE,eAAe,EAAE,aAAa,EAA8D,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAC3O,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAC;AAErF,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,oBAAoB,EAAkI,MAAM,kBAAkB,CAAC;AACxL,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAoC,MAAM,eAAe,CAAC;AAC/E,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAG/D,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAE5C,MAAM,CAAC,MAAM,YAAY,GAAG,OAAO,CAAC;AAEpC,wIAAwI;AACxI,SAAS,UAAU,CAAC,QAAuD;IACzE,MAAM,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAyD,CAAC;IAChG,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAClK,CAAC;AAkBD,MAAM,IAAI,GAAG,CAAC,IAAoB,EAAE,IAAY,EAAE,OAAe,EAAE,QAA6B,MAAM,EAAE,QAA6B,EAAE,EAAE,EAAE,CACzI,IAAI,eAAe,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC;AAEnG,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAW,CAAC;AACnG,MAAM,OAAO,GAAG,CAAC,CAA8B,EAAU,EAAE;IACzD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,CAAC,IAAI,KAAK,IAAI,oBAAoB,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM;QAAE,KAAK,EAAE,CAAC;IACjE,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AACF,MAAM,KAAK,GAAG,CAAC,MAAuB,EAAE,SAAiB,EAAmB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,MAAM,CAAC,EAAE,IAAI,SAAS,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;AAE/I,6HAA6H;AAC7H,MAAM,YAAY,GAAG,CAAC,IAAiB,EAAE,MAAc,EAAsB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAEvK,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAuB;IAC/D,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,GAAG,MAAM,CAAC;IAElB,0HAA0H;IAC1H,IAAI,IAAI,CAAC,OAAO,KAAK,oBAAoB;QAAE,MAAM,IAAI,CAAC,2BAA2B,EAAE,EAAE,EAAE,gBAAgB,IAAI,CAAC,OAAO,uCAAuC,oBAAoB,GAAG,CAAC,CAAC;IACnL,MAAM,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;IACtC,IAAI,CAAC,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,WAAW;QAAE,MAAM,IAAI,CAAC,2BAA2B,EAAE,EAAE,EAAE,yEAAyE,CAAC,CAAC;IAC1K,IAAI,IAAI,CAAC,mBAAmB,KAAK,SAAS,IAAI,IAAI,CAAC,mBAAmB,KAAK,WAAW;QACpF,MAAM,IAAI,CAAC,2BAA2B,EAAE,EAAE,EAAE,6BAA6B,WAAW,cAAc,IAAI,CAAC,mBAAmB,EAAE,CAAC,CAAC;IAEhI,6CAA6C;IAC7C,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACjH,KAAK,MAAM,GAAG,IAAI,IAAI;QAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC;YAAE,MAAM,IAAI,CAAC,wBAAwB,EAAE,GAAG,EAAE,aAAa,GAAG,EAAE,EAAE,2BAA2B,GAAG,0BAA0B,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC5O,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,CAAC,sBAAsB,EAAE,GAAG,EAAE,cAAc,IAAI,EAAE,EAAE,YAAY,IAAI,0DAA0D,CAAC,CAAC;IAE9M,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpF,8HAA8H;IAC9H,qGAAqG;IACrG,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,GAAG,EAAE,cAAc,IAAI,EAAE,CAAC;QACvC,IAAI,CAAC;YACH,mBAAmB,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,EAAE,EAAgC,EAAE,SAA8B,CAAC,CAAC,CAAC,gDAAgD;QACzM,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,kBAAkB;gBAAE,MAAM,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;YACxH,MAAM,CAAC,CAAC;QACV,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,CAAC,kCAAkC,EAAE,IAAI,EAAE,YAAY,IAAI,cAAc,CAAC,CAAC,SAAS,yCAAyC,CAAC,CAAC;QAC3L,4HAA4H;QAC5H,oHAAoH;QACpH,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5F,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAE,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;YACrG,MAAM,IAAI,CAAC,0BAA0B,EAAE,IAAI,EAAE,sBAAsB,IAAI,cAAc,CAAC,CAAC,MAAM,CAAC,MAAM,kDAAkD,CAAC,CAAC;IAC5J,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC;QACzG,MAAM,IAAI,CAAC,oBAAoB,EAAE,EAAE,EAAE,wGAAwG,CAAC,CAAC;IAEjJ,6HAA6H;IAC7H,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,OAAO,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAC7F,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,QAAQ;QAC9B,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,WAAW,IAAI,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,CAAC,0BAA0B,EAAE,GAAG,EAAE,cAAc,IAAI,EAAE,EAAE,sBAAsB,IAAI,cAAc,CAAC,CAAC,SAAS,+BAA+B,CAAC,CAAC;IAClN,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACxD,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAC;QACvC,IAAI,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,CAAC,yBAAyB,EAAE,GAAG,EAAE,gBAAgB,IAAI,EAAE,EAAE,IAAI,IAAI,oBAAoB,CAAC,+BAA+B,CAAC,CAAC;IACvJ,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACnD,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAC;QACvC,IAAI,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,CAAC,yBAAyB,EAAE,GAAG,EAAE,WAAW,IAAI,EAAE,EAAE,SAAS,IAAI,oBAAoB,CAAC,+BAA+B,CAAC,CAAC;IACvJ,CAAC;IAED,qEAAqE;IACrE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;IACjC,IAAI,IAAI,CAAC,OAAO,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO;QACjF,MAAM,IAAI,CAAC,2BAA2B,EAAE,EAAE,EAAE,qCAAqC,IAAI,CAAC,OAAO,EAAE,IAAI,IAAI,IAAI,CAAC,OAAO,EAAE,OAAO,uBAAuB,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACxL,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5D,gIAAgI;IAChI,MAAM,MAAM,GAAG,IAAI,GAAG,EAA8B,CAAC;IACrD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,QAAQ,EAAE,CAAC;QACjC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,WAAW;YAAE,SAAS;QAC5C,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YAC/B,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4C,CAAC;YAC/E,sGAAsG;YACtG,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAE,CAAC;YACpD,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACnE,MAAM,GAAG,GAAG,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC;YAChC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,CAAiB,EAAE,CAAC,OAAO,EAAE,SAAS,CAAmB,EAAE,EAAE,CACzE,MAAM,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,EAAE,IAAI,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAqB,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAChQ,MAAM,UAAU,GAAwB;QACtC,kEAAkE;QAClE,KAAK,CAAC,MAAM,CAAC,MAAM;YACjB,KAAK,MAAM,CAAC,IAAI,MAAM;gBAAE,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE;oBAAE,MAAM,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACtG,CAAC;QACD,+GAA+G;QAC/G,KAAK,CAAC,KAAK,CAAC,MAAM;YAChB,KAAK,MAAM,CAAC,IAAI,MAAM;gBACpB,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;oBAC1D,IAAI,CAAC;wBAAC,MAAM,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;oBAAC,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBAAC,OAAO,CAAC,KAAK,CAAC,sCAAsC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;oBAAC,CAAC;gBAC9J,CAAC;QACL,CAAC;KACF,CAAC;IACF,MAAM,SAAS,GAA+B,MAAM,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAEpH,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,WAAW,CAAC;QACxB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG;QACxD,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACpE,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,KAAK,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1X,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,MAAM,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;KAC5I,CAAC,CAAC;IAEH,kIAAkI;IAClI,MAAM,GAAG,GAAG,IAAI,GAAG,EAAmB,CAAC;IACvC,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAE,MAA6C,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC,CAAC;IACxJ,MAAM,KAAK,GAAG,CAAC,IAAwB,EAAE,IAAY,EAAE,IAAY,EAAE,KAAc,EAAE,MAA6C,EAAE,EAAE;QACpI,MAAM,CAAC,GAAG,aAAa,CAAC,QAAQ,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;QACpE,IAAI,CAAC,CAAC,OAAO;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC;QAC7B,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,GAAG,0BAA0B,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACtE,MAAM,IAAI,eAAe,CAAC,cAAc,CAAC;YACvC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,0BAA0B,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,KAAK,IAAI,GAAG,YAAY,EAAE;YAC7J,sIAAsI;YACtI,GAAG,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,eAAe,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO;YAC/F,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,IAAI,2FAA2F,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzJ,CAAC,CAAC,CAAC;IACN,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,CAAC,CAAc,EAAe,EAAE,CAAC,CAAC;QACjD,GAAG,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,EAAE,wCAAwC,EAAE,SAAS,CAAC,CAAC;KACrH,CAAC,CAAC;IAEH,KAAK,UAAU,MAAM,CAAC,GAAe,EAAE,KAAK,GAAG,KAAK;QAClD,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,oBAAoB;YAC3C,MAAM,IAAI,CAAC,2BAA2B,EAAE,sBAAsB,GAAG,CAAC,SAAS,EAAE,EAAE,gCAAgC,oBAAoB,oCAAoC,EAAE,SAAS,CAAC,CAAC;QACtL,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxG,MAAM,IAAI,GAAG,sBAAsB,GAAG,CAAC,SAAS,EAAE,CAAC;QACnD,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,CAAC,qBAAqB,EAAE,IAAI,EAAE,sBAAsB,GAAG,CAAC,SAAS,GAAG,EAAE,SAAS,CAAC,CAAC;QACtG,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAChE,IAAI,MAAM;YAAE,MAAM,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAEzE,0GAA0G;QAC1G,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAC;QAClD,IAAI,SAAS,IAAI,CAAC,KAAK;YAAE,MAAM,MAAM,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAErI,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACxF,MAAM,EAAE,GAAG,KAAK,IAAI,QAAQ,CAAC;QAC7B,IAAI,EAAE,IAAI,KAAK,IAAI,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,CAAC,0BAA0B,EAAE,IAAI,EAAE,uDAAuD,EAAE,SAAS,CAAC,CAAC;QAClJ,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,IAAI,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC1B,MAAM,KAAK,GAAG,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,mFAAmF;gBAClI,mGAAmG;gBACnG,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;gBAC5G,MAAM,GAAG,GAAmB;oBAC1B,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC;oBACjH,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM;oBACrC,MAAM,EAAE,CAAC,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,EAAE,qDAAqD,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;iBACvO,CAAC;gBACF,MAAM,GAAG,MAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAgD,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC7G,CAAC;iBAAM,CAAC;gBACN,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;gBAClD,MAAM,GAAG,GAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;gBAClF,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC7M,MAAM,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;YACjC,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,eAAe;gBAAE,MAAM,CAAC,CAAC;YAC1C,IAAI,CAAC,YAAY,UAAU;gBAAE,MAAM,IAAI,CAAC,yBAAyB,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YAC/F,OAAO,CAAC,KAAK,CAAC,qBAAqB,GAAG,CAAC,SAAS,qBAAqB,EAAE,CAAC,CAAC,CAAC;YAC1E,MAAM,IAAI,CAAC,gBAAgB,EAAE,IAAI,EAAE,6BAA6B,EAAE,SAAS,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACnE,CAAC;IAED,OAAO;QACL,IAAI;QACJ,KAAK;QACL,eAAe,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC;QACnD,UAAU,EAAE,GAAqB,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;QAChF,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1B,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,YAAY,EAAE,CAAC"}

package/dist/core/runtime/verifyPlan.d.ts

@@ -0,0 +1,34 @@
+/**
+ * `verifyPlan`: everything boot checks about an uploaded plan, plus every program through the storage's dialect, without a
+ * database or the handlers (ADR-0034 decision 7: Cloud validates the IR and never parses SQL). Worker-safe: no SQL parser.
+ */
+import { type Diagnostic } from "../../spec/kernel/index.js";
+import { type RuntimePlan } from "../../spec/domain/index.js";
+import type { MantleStorageAdapter } from "../service.js";
+/**
+ * The most a plan `verifyPlan` checks may hold, checked before anything else: every check below is linear in these. Each is many
+ * times what a real app declares (Mantle Cloud's Control plan: 8 Schemas of at most 8 fields, 10 Views, 59 Procedures, 79 Triggers).
+ */
+export declare const PLAN_LIMITS: {
+    readonly schemas: 256;
+    readonly fieldsPerSchema: 256;
+    readonly checksPerSchema: 32;
+    readonly views: 1024;
+    readonly procedures: 1024;
+    readonly triggers: 2048;
+    /** JSON objects and arrays in one program's IR (a check, a View, an inline Procedure): the allowlist walks at most `MAX_NODES` nodes, each a few of these */
+    readonly programIrValues: number;
+};
+/**
+ * The plan's diagnostics: a plan past `PLAN_LIMITS` (checked first, and alone), what boot refuses before storage (version,
+ * fingerprint, dialect, Triggers, guard and hook targets), what the CLI's own validators refuse of the manifests the plan stands
+ * for (`planShape`: its JSON Schemas, fields, TTL, graph checks), and every
+ * Schema check, View and inline Procedure through the storage's dialect (with its `restrict`) and the policy rewrite. Empty
+ * means every program reads and writes only through the policy rewrite, in the shapes the dialect allows. It does not type-check
+ * the SQL: a statement the database refuses (a function's argument count or type, an operand type) fails that call, or boot for
+ * a check, with the database's error, never past the policy. Only `storage.dialect` is read, so storage's own refusals (a
+ * reserved table name, a column type it cannot store) still surface where the plan first boots against its database.
+ * Handlers are not checked (the host binds them); enabled schedule Triggers are allowed (the host decides whether it wires them).
+ */
+export declare function verifyPlan(plan: RuntimePlan, storage: Pick<MantleStorageAdapter, "dialect">): Promise<readonly Diagnostic[]>;
+//# sourceMappingURL=verifyPlan.d.ts.map

package/dist/core/runtime/verifyPlan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifyPlan.d.ts","sourceRoot":"","sources":["../../../src/core/runtime/verifyPlan.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAmC,KAAK,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC9F,OAAO,EAA6P,KAAK,WAAW,EAA8E,MAAM,4BAA4B,CAAC;AAMrY,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAG1D;;;GAGG;AACH,eAAO,MAAM,WAAW;;;;;;;IAOtB,6JAA6J;;CAErJ,CAAC;AAMX;;;;;;;;;;GAUG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,oBAAoB,EAAE,SAAS,CAAC,GAAG,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC,CAQlI"}

package/dist/core/runtime/verifyPlan.js

@@ -0,0 +1,301 @@
+/**
+ * `verifyPlan`: everything boot checks about an uploaded plan, plus every program through the storage's dialect, without a
+ * database or the handlers (ADR-0034 decision 7: Cloud validates the IR and never parses SQL). Worker-safe: no SQL parser.
+ */
+import { DiagnosticError, makeDiagnostic } from "../../spec/kernel/index.js";
+import { MAX_TTL_SECONDS, ManifestParseError, NATIVE_OUTPUT_TYPES, SqlRefusal, checkViewAdminUi, checkShapeProblem, fieldTypes, storageColumnClash, storageColumns, isFieldType, isTtlSeconds, mcpTools, sideTableClashes } from "../../spec/domain/index.js";
+import { validateJsonSchema } from "../../spec/domain/service/SchemaSpecChecks.js";
+import { checkGuards, checkProcedureTarget, checkTriggerRefs } from "../../spec/domain/service/TriggerGraphChecks.js";
+import { MAX_NODES, schemaColumns } from "../sql/allowlist.js";
+import { compileProgram } from "../sql/compile.js";
+import { outName } from "../sql/run.js";
+import { createMantleRuntime } from "./createRuntime.js";
+/**
+ * The most a plan `verifyPlan` checks may hold, checked before anything else: every check below is linear in these. Each is many
+ * times what a real app declares (Mantle Cloud's Control plan: 8 Schemas of at most 8 fields, 10 Views, 59 Procedures, 79 Triggers).
+ */
+export const PLAN_LIMITS = {
+    schemas: 256,
+    fieldsPerSchema: 256,
+    checksPerSchema: 32,
+    views: 1024,
+    procedures: 1024,
+    triggers: 2048,
+    /** JSON objects and arrays in one program's IR (a check, a View, an inline Procedure): the allowlist walks at most `MAX_NODES` nodes, each a few of these */
+    programIrValues: 8 * MAX_NODES,
+};
+const BOOTED = Symbol("booted");
+const refused = (path, message) => makeDiagnostic({ code: "INPUT_VALIDATION_FAILED", phase: "boot", severity: "error", path, message });
+/**
+ * The plan's diagnostics: a plan past `PLAN_LIMITS` (checked first, and alone), what boot refuses before storage (version,
+ * fingerprint, dialect, Triggers, guard and hook targets), what the CLI's own validators refuse of the manifests the plan stands
+ * for (`planShape`: its JSON Schemas, fields, TTL, graph checks), and every
+ * Schema check, View and inline Procedure through the storage's dialect (with its `restrict`) and the policy rewrite. Empty
+ * means every program reads and writes only through the policy rewrite, in the shapes the dialect allows. It does not type-check
+ * the SQL: a statement the database refuses (a function's argument count or type, an operand type) fails that call, or boot for
+ * a check, with the database's error, never past the policy. Only `storage.dialect` is read, so storage's own refusals (a
+ * reserved table name, a column type it cannot store) still surface where the plan first boots against its database.
+ * Handlers are not checked (the host binds them); enabled schedule Triggers are allowed (the host decides whether it wires them).
+ */
+export async function verifyPlan(plan, storage) {
+    // the plan is untrusted input: a shape Core does not expect is a refusal, never an exception
+    try {
+        return await verify(plan, storage);
+    }
+    catch (e) {
+        if (e instanceof DiagnosticError)
+            return e.diagnostics;
+        return [makeDiagnostic({ code: "INVALID_MANIFEST_ENVELOPE", phase: "boot", severity: "error", path: "plan", message: `the plan is malformed: ${e instanceof Error ? e.message : String(e)}` })];
+    }
+}
+async function verify(plan, storage) {
+    const tooLarge = bounds(plan);
+    if (tooLarge.length)
+        return tooLarge;
+    const refs = Object.values(plan.procedures).flatMap((p) => ("ref" in p.handler ? [p.handler.ref] : []));
+    try {
+        // boot's own checks, stopped where storage would be prepared
+        await createMantleRuntime({ plan, handlers: Object.fromEntries(refs.map((r) => [r, () => undefined])), schedules: true, storage: { dialect: storage.dialect, prepare: () => Promise.reject(BOOTED) } });
+    }
+    catch (e) {
+        if (e !== BOOTED)
+            throw e;
+    }
+    const out = [...planShape(plan)];
+    // what the allowlist reads off every Schema, once for the plan rather than once per program
+    const columns = schemaColumns(plan.schemas);
+    const check = (path, stmts, inputs, kind, mode) => {
+        try {
+            return compileProgram(stmts, { dialect: storage.dialect, schemas: plan.schemas, columns, inputs, kind, mode });
+        }
+        catch (e) {
+            // the dialect's refusals arrive as a DiagnosticError, the policy rewrite's as a SqlRefusal; the runtime refuses both
+            if (e instanceof DiagnosticError)
+                out.push(...e.diagnostics.map((d) => ({ ...d, path })));
+            else if (e instanceof SqlRefusal)
+                out.push(refused(path, `${e.code}: ${e.message}`));
+            else
+                throw e;
+            return undefined;
+        }
+    };
+    // a check is printed into the table's DDL and runs on every write: checked as the CLI compiles it, the WHERE of a read of its own Schema
+    for (const [name, schema] of Object.entries(plan.schemas))
+        for (const [i, where] of (schema.checks ?? []).entries()) {
+            const path = `plan#/schemas/${name}/checks/${i}`;
+            const problem = checkShapeProblem(where, storageColumns(schema));
+            if (problem)
+                out.push(refused(path, `SQL_SHAPE: ${problem}`));
+            else
+                check(path, [{ SelectStmt: { targetList: [{ ResTarget: { val: { A_Const: { ival: { ival: 1 } } } } }], fromClause: [{ RangeVar: { relname: name.toLowerCase(), inh: true, relpersistence: "p", mantle: "table" } }], whereClause: where, limitOption: "LIMIT_OPTION_DEFAULT", op: "SETOP_NONE" } }], {}, "view", "caller");
+        }
+    for (const [name, v] of Object.entries(plan.views)) {
+        const compiled = check(`plan#/views/${name}`, v.stmts, v.inputs, "view", v.surface === "public" ? "public" : "caller");
+        // searchFields and filterFields are matched against the outputs of the statement the policy wrote, by runView's rule
+        const outputs = (compiled?.[0]?.ast.SelectStmt?.targetList ?? []).map(outName);
+        const list = listOf(v.uiSchema);
+        if (compiled)
+            for (const key of ["searchFields", "filterFields"])
+                for (const f of Array.isArray(list?.[key]) ? list[key] : [])
+                    if (typeof f === "string" && !outputs.includes(f) && !outputs.includes(f.toLowerCase()))
+                        out.push(refused(`plan#/views/${name}/uiSchema/list/${key}`, `VIEW_UI_INVALID: ${JSON.stringify(f)} is not an output of the View`));
+    }
+    for (const [name, p] of Object.entries(plan.procedures))
+        if ("sql" in p.handler)
+            check(`plan#/procedures/${name}`, p.handler.sql.stmts, p.inputs, "procedure", "caller");
+    return out;
+}
+/** JSON objects and arrays in `value`, counted up to `cap` (past it the count stops): iterative, so any depth is safe. */
+function jsonValues(value, cap) {
+    let n = 0;
+    const stack = [value];
+    while (stack.length && n <= cap) {
+        const v = stack.pop();
+        if (v === null || typeof v !== "object")
+            continue;
+        n++;
+        for (const c of Array.isArray(v) ? v : Object.values(v))
+            if (c !== null && typeof c === "object")
+                stack.push(c);
+    }
+    return n;
+}
+/** The plan within `PLAN_LIMITS`: one diagnostic per limit passed, before any check reads more of the plan. */
+function bounds(plan) {
+    const out = [];
+    const over = (path, what, limit) => out.push(makeDiagnostic({ code: "RESOURCE_EXHAUSTED", phase: "boot", severity: "error", path, message: `the plan has more than ${limit} ${what}` }));
+    const count = (x) => (x && typeof x === "object" ? Object.keys(x).length : 0);
+    const L = PLAN_LIMITS;
+    if (count(plan.schemas) > L.schemas)
+        over("plan#/schemas", "Schemas", L.schemas);
+    if (count(plan.views) > L.views)
+        over("plan#/views", "Views", L.views);
+    if (count(plan.procedures) > L.procedures)
+        over("plan#/procedures", "Procedures", L.procedures);
+    if (count(plan.triggers) > L.triggers)
+        over("plan#/triggers", "Triggers", L.triggers);
+    if (out.length)
+        return out;
+    const program = (path, ir) => { if (jsonValues(ir, L.programIrValues) > L.programIrValues)
+        over(path, "IR values in one program", L.programIrValues); };
+    for (const [name, s] of Object.entries(plan.schemas)) {
+        if (count(s?.fields) > L.fieldsPerSchema)
+            over(`plan#/schemas/${name}/fields`, "fields in one Schema", L.fieldsPerSchema);
+        const checks = Array.isArray(s?.checks) ? s.checks : [];
+        if (checks.length > L.checksPerSchema)
+            over(`plan#/schemas/${name}/checks`, "checks in one Schema", L.checksPerSchema);
+        else
+            checks.forEach((c, i) => program(`plan#/schemas/${name}/checks/${i}`, c));
+    }
+    for (const [name, v] of Object.entries(plan.views))
+        program(`plan#/views/${name}`, v?.stmts);
+    for (const [name, p] of Object.entries(plan.procedures))
+        if (p?.handler && "sql" in p.handler)
+            program(`plan#/procedures/${name}`, p.handler.sql?.stmts);
+    return out;
+}
+/** The CLI's own JSON Schema check (depth, size, `$ref`, `pattern`, `enum`) on one of the plan's: its refusal, or undefined. */
+function jsonSchemaProblem(schema, path, kind, name) {
+    try {
+        validateJsonSchema(schema, undefined, kind, name, ""); // no document index: the path names the schema
+        return undefined;
+    }
+    catch (e) {
+        if (!(e instanceof ManifestParseError))
+            throw e;
+        return refused(`${path}${e.pointer ?? ""}`, `${e.code}: ${e.message}`);
+    }
+}
+/** Whether two string maps hold the same entries. */
+const sameMap = (a, b) => !!a && typeof a === "object" && Object.keys(a).length === Object.keys(b).length && Object.entries(b).every(([k, v]) => Object.hasOwn(a, k) && a[k] === v);
+/**
+ * The CLI's graph checks (the linker's), run on the plan's equivalents of the manifests they read: http Trigger paths under
+ * `/api/` and unique per method, lifecycle Triggers that name a Schema as declared, schedule targets a system caller can call,
+ * guards, and Procedure targets. Only errors: a warning is the author's to see.
+ */
+function graphChecks(plan) {
+    const procedures = new Map(Object.entries(plan.procedures).map(([name, p]) => [name, { kind: "Procedure", metadata: { name }, spec: { ...p, handler: "ref" in p.handler ? { ref: p.handler.ref } : { sql: p.handler.source } } }]));
+    const views = Object.entries(plan.views).map(([name, v]) => ({ kind: "View", metadata: { name }, spec: v }));
+    const triggers = Object.entries(plan.triggers).map(([name, t]) => ({ kind: "Trigger", metadata: { name }, spec: { source: t.source, target: { procedure: t.procedure } } }));
+    const schemas = new Map(Object.values(plan.schemas).map((s) => [s.name, { kind: "Schema", metadata: { name: s.name }, spec: { schema: s.schema } }]));
+    const PLURAL = { Trigger: "triggers", Procedure: "procedures", View: "views", Schema: "schemas" };
+    return [
+        ...[...procedures.values()].flatMap((p) => checkProcedureTarget(p, schemas)),
+        ...checkGuards([...procedures.values(), ...views], procedures),
+        ...checkTriggerRefs(triggers, procedures, undefined, schemas),
+    ].filter((d) => d.severity === "error").map((d) => {
+        // `manifest:Kind/name#/spec/...` names the plan's entry
+        const m = /^manifest:(\w+)\/(.*)#(?:\/spec)?(.*)$/s.exec(d.path);
+        return m && PLURAL[m[1]] ? { ...d, path: `plan#/${PLURAL[m[1]]}/${m[2]}${m[3]}` } : d;
+    });
+}
+const NATIVE = new Set(["id", "version", "status", "author_id", "created_at", "updated_at"]);
+const listOf = (uiSchema) => uiSchema?.list;
+/**
+ * What the CLI guarantees about the plan's other fields, checked in one pass: a Schema's names as the CLI writes them (its key,
+ * fields, scope, ttl, search, unique and index columns lower case, each a declared field or a native column; SQL folds names, the
+ * checks compare folded names and storage quotes them, so a plan whose `Items` and `items`, or scope `Owner` and field `owner`, are
+ * two things to one layer and one to another is refused), its field types and TTL as storage takes them, search and geo tables that
+ * name one object each; a View's `columns` and Admin list as Store and Admin read them; and MCP tools that do not collide.
+ */
+function planShape(plan) {
+    const out = [];
+    const isName = (x) => typeof x === "string" && x.length > 0 && x === x.toLowerCase();
+    // every JSON Schema as the CLI checks a manifest's: Store and invocation validate values against them, and a `$ref` cycle or an
+    // exponential `pattern` there would throw or stall on every call
+    let schemasOk = true;
+    const jsonSchema = (schema, path, kind, name) => {
+        const problem = jsonSchemaProblem(schema, path, kind, name);
+        if (problem)
+            (out.push(problem), (schemasOk = false));
+        return !problem;
+    };
+    // a program's `inputs` are its input's properties typed as the CLI types them: the allowlist and binds read one, Store the other
+    const inputs = (path, input, declared) => {
+        if (!sameMap(declared, fieldTypes(input)))
+            out.push(refused(`${path}/inputs`, "SQL_SHAPE: inputs are the input's properties, typed as the CLI types them"));
+    };
+    for (const [name, v] of Object.entries(plan.views)) {
+        const path = `plan#/views/${name}`;
+        if (v.input === undefined || jsonSchema(v.input, `${path}/input`, "View", name))
+            inputs(path, v.input, v.inputs);
+    }
+    for (const [name, p] of Object.entries(plan.procedures)) {
+        const path = `plan#/procedures/${name}`;
+        if (jsonSchema(p.input, `${path}/input`, "Procedure", name))
+            inputs(path, p.input, p.inputs);
+        jsonSchema(p.output, `${path}/output`, "Procedure", name);
+    }
+    for (const [key, s] of Object.entries(plan.schemas)) {
+        const bad = (what) => out.push(refused(`plan#/schemas/${key}`, `SQL_SHAPE: ${what}`));
+        const fields = s.fields ?? {};
+        // the columns are the JSON Schema's properties, typed and named as the CLI writes them (no two that fold to one name)
+        if (jsonSchema(s.schema, `plan#/schemas/${key}/schema`, "Schema", typeof s.name === "string" ? s.name : key)) {
+            const props = Object.keys(s.schema.properties ?? {});
+            if (!sameMap(fields, fieldTypes(s.schema)) || Object.keys(fields).length !== props.length)
+                bad("fields are the JSON Schema's properties, typed as the CLI types them");
+            if (!sameMap(s.names, Object.fromEntries(props.map((n) => [n.toLowerCase(), n]))))
+                bad("names map each field to its property's name");
+        }
+        // a column storage creates: a declared field that is one column (a geo field is two), or a native one (`status` only when publishing)
+        const column = (x) => isName(x) && (Object.hasOwn(fields, x) ? fields[x] !== "geo" : NATIVE.has(x) && (x !== "status" || !!s.publishing));
+        if (!isName(key) || typeof s.name !== "string" || s.name.toLowerCase() !== key)
+            bad("a Schema's key is its name in lower case");
+        for (const [f, t] of Object.entries(fields))
+            if (!isName(f) || NATIVE.has(f) || !isFieldType(t))
+                bad(`field ${JSON.stringify(f)} is a lower-case name with a Mantle type`);
+        const clash = storageColumnClash(fields);
+        if (clash)
+            bad(`field ${JSON.stringify(clash)} is a column storage creates for another purpose`);
+        for (const [f, n] of Object.entries(s.names ?? {}))
+            if (!Object.hasOwn(fields, f) || typeof n !== "string" || n.toLowerCase() !== f)
+                bad(`names[${JSON.stringify(f)}] names a field`);
+        if (s.scope !== undefined && !(isName(s.scope) && Object.hasOwn(fields, s.scope)))
+            bad("scope is a declared field");
+        if ((s.ttl === undefined) !== (s.ttlSeconds === undefined))
+            bad("ttl and ttlSeconds go together");
+        // as the CLI requires: a declared date-time field. A native column (`version`, `created_at`) would expire every row at once
+        if (s.ttl !== undefined && !(isName(s.ttl) && Object.hasOwn(fields, s.ttl) && fields[s.ttl] === "timestamptz"))
+            bad("ttl is a declared date-time (timestamptz) field");
+        if (s.ttlSeconds !== undefined && !isTtlSeconds(s.ttlSeconds))
+            bad(`ttlSeconds is a whole number of seconds from 0 to ${MAX_TTL_SECONDS}`);
+        // as the CLI requires: search columns are declared text fields, unique and index columns scalar columns storage creates
+        if (s.search !== undefined && !(Array.isArray(s.search) && s.search.length && s.search.every((x) => isName(x) && fields[x] === "text")))
+            bad("search columns are declared text fields");
+        for (const cols of [...(s.unique ?? []), ...(s.indexes ?? [])])
+            if (!Array.isArray(cols) || !cols.length || !cols.every((x) => column(x) && fields[x] !== "json"))
+                bad("unique and index columns are scalar columns storage creates (no geo or json field, status only when publishing)");
+    }
+    for (const c of sideTableClashes(plan.schemas))
+        out.push(refused(`plan#/schemas/${c.schema}`, `SQL_SHAPE: ${c.message}`));
+    for (const [name, v] of Object.entries(plan.views)) {
+        const path = `plan#/views/${name}`;
+        // an output Store decodes and Admin labels as a Schema field: the Schema and the field (or a native timestamp) exist
+        for (const [k, c] of Object.entries(v.columns ?? {})) {
+            const s = c && typeof c.schema === "string" && Object.hasOwn(plan.schemas, c.schema) ? plan.schemas[c.schema] : undefined;
+            if (!s || typeof c.field !== "string" || !(Object.hasOwn(s.fields ?? {}, c.field) || Object.hasOwn(NATIVE_OUTPUT_TYPES, c.field)))
+                out.push(refused(`${path}/columns`, `SQL_SHAPE: columns[${JSON.stringify(k)}] names a Schema and one of its fields`));
+        }
+        // Admin's list, as the CLI checks it: an object of name lists, on a staff View
+        if (v.uiSchema !== undefined) {
+            const problem = checkViewAdminUi({ spec: { surface: v.surface, uiSchema: v.uiSchema } }).problems[0];
+            if (problem)
+                out.push(refused(`${path}${problem.pointer.replace(/^\/spec/, "")}`, `VIEW_UI_INVALID: ${problem.message}`));
+        }
+    }
+    if (schemasOk)
+        out.push(...graphChecks(plan));
+    // the tools an MCP surface registers: a name two of them fold to, or a View input the tool reserves, fails the surface's build
+    for (const surface of ["public", "staff"]) {
+        try {
+            mcpTools(plan, surface);
+        }
+        catch (e) {
+            if (!(e instanceof TypeError))
+                throw e;
+            out.push(refused(`plan#/mcp/${surface}`, `MCP_TOOL_INVALID: ${e.message}`));
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=verifyPlan.js.map