@aotter/mantle 0.1.5-alpha.1 → 0.2.0-alpha.1

package/dist/core/invocation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invocation.d.ts","sourceRoot":"","sources":["../../src/core/invocation.ts"],"names":[],"mappings":"AAAA,iHAAiH;AACjH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAExD,oHAAoH;AACpH,eAAO,MAAM,oBAAoB,IAAI,CAAC;AAEtC,gFAAgF;AAChF,MAAM,MAAM,eAAe,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAA;CAAE,GAAG,CACvF;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,GAAG,UAAU,CAAA;CAAE,GAC9C;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;CAAE,GAC9G;IACE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,iMAAiM;IACjM,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC;CACnD,CACJ,CAAC;AAEF,qGAAqG;AACrG,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;CACjC;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc,CAAC,GAAG,GAAG,OAAO;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;IAClB,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;IAC3C,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,0HAA0H;IAC1H,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC7D;AAED,gHAAgH;AAChH,MAAM,MAAM,SAAS,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,OAAO,EAAE,GAAG,GAAG,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;AAExH,2GAA2G;AAE3G,MAAM,MAAM,cAAc,CAAC,GAAG,GAAG,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;AAE/F,oDAAoD;AACpD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC;IAClD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC;CACnC;AAED,4FAA4F;AAC5F,MAAM,WAAW,mBAAmB;IAClC,oGAAoG;IACpG,MAAM,CAAC,MAAM,EAAE,SAAS,cAAc,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,iGAAiG;IACjG,KAAK,CAAC,MAAM,EAAE,SAAS,cAAc,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACzD"}

package/dist/core/invocation.js

@@ -0,0 +1,3 @@
+/** `ctx.cause.parent` chains through hooks and `ctx.invoke`; deeper than this fails `INVOCATION_DEPTH_EXCEEDED`. */
+export const MAX_INVOCATION_DEPTH = 8;
+//# sourceMappingURL=invocation.js.map

package/dist/core/invocation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invocation.js","sourceRoot":"","sources":["../../src/core/invocation.ts"],"names":[],"mappings":"AAKA,oHAAoH;AACpH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC"}

package/dist/core/runtime/auth.d.ts

@@ -0,0 +1,9 @@
+/** `requires.auth` evaluated against the Caller only (ADR-0032 decision 8); the grammar is unchanged. */
+import { type Diagnostic } from "../../spec/kernel/index.js";
+import type { AuthPredicate, AuthorizationRequirements } from "../../spec/domain/index.js";
+import type { Caller } from "../caller.js";
+export declare function evaluatePredicate(pred: AuthPredicate, caller: Caller): boolean;
+export declare function describePredicate(pred: AuthPredicate): string;
+/** `null` when every predicate holds (or none is declared), else a 401/403 Diagnostic naming the first that fails. */
+export declare function evaluateAuthAll(requires: AuthorizationRequirements | undefined, caller: Caller, path: string): Diagnostic | null;
+//# sourceMappingURL=auth.d.ts.map

package/dist/core/runtime/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/core/runtime/auth.ts"],"names":[],"mappings":"AAAA,yGAAyG;AACzG,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC7E,OAAO,KAAK,EAAE,aAAa,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAC3F,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE3C,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAM9E;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAK7D;AAED,sHAAsH;AACtH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,yBAAyB,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAchI"}

package/dist/core/runtime/auth.js

@@ -0,0 +1,39 @@
+/** `requires.auth` evaluated against the Caller only (ADR-0032 decision 8); the grammar is unchanged. */
+import { makeDiagnostic } from "../../spec/kernel/index.js";
+export function evaluatePredicate(pred, caller) {
+    // the system caller satisfies no predicate; an anonymous caller has no user, credential, role or scope
+    if (caller.kind !== "user")
+        return false;
+    if (pred === "ctx.user" || pred === "ctx.auth")
+        return true;
+    if ("ctx.auth.scope" in pred)
+        return caller.scopes.includes(pred["ctx.auth.scope"]);
+    return caller.role !== null && pred["ctx.staff"].includes(caller.role);
+}
+export function describePredicate(pred) {
+    if (pred === "ctx.user")
+        return "caller is signed in (ctx.user)";
+    if (pred === "ctx.auth")
+        return "caller presents a verified credential (ctx.auth)";
+    if ("ctx.auth.scope" in pred)
+        return `caller credential includes scope '${pred["ctx.auth.scope"]}'`;
+    return `caller is staff with role in [${pred["ctx.staff"].join(", ")}]`;
+}
+/** `null` when every predicate holds (or none is declared), else a 401/403 Diagnostic naming the first that fails. */
+export function evaluateAuthAll(requires, caller, path) {
+    const all = requires?.auth?.all ?? [];
+    for (const [i, pred] of all.entries()) {
+        if (evaluatePredicate(pred, caller))
+            continue;
+        return makeDiagnostic({
+            code: caller.kind === "user" ? "AUTH_DENIED" : "UNAUTHENTICATED",
+            phase: "runtime",
+            severity: "error",
+            path: `${path}#/requires/auth/all/${i}`,
+            expected: describePredicate(pred),
+            message: `Authorization predicate not satisfied: ${describePredicate(pred)}.`,
+        });
+    }
+    return null;
+}
+//# sourceMappingURL=auth.js.map

package/dist/core/runtime/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/core/runtime/auth.ts"],"names":[],"mappings":"AAAA,yGAAyG;AACzG,OAAO,EAAE,cAAc,EAAmB,MAAM,4BAA4B,CAAC;AAI7E,MAAM,UAAU,iBAAiB,CAAC,IAAmB,EAAE,MAAc;IACnE,uGAAuG;IACvG,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACzC,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IAC5D,IAAI,gBAAgB,IAAI,IAAI;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACpF,OAAO,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAmB;IACnD,IAAI,IAAI,KAAK,UAAU;QAAE,OAAO,gCAAgC,CAAC;IACjE,IAAI,IAAI,KAAK,UAAU;QAAE,OAAO,kDAAkD,CAAC;IACnF,IAAI,gBAAgB,IAAI,IAAI;QAAE,OAAO,qCAAqC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC;IACpG,OAAO,iCAAiC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AAC1E,CAAC;AAED,sHAAsH;AACtH,MAAM,UAAU,eAAe,CAAC,QAA+C,EAAE,MAAc,EAAE,IAAY;IAC3G,MAAM,GAAG,GAAG,QAAQ,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC;IACtC,KAAK,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;QACtC,IAAI,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC;YAAE,SAAS;QAC9C,OAAO,cAAc,CAAC;YACpB,IAAI,EAAE,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,iBAAiB;YAChE,KAAK,EAAE,SAAS;YAChB,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,GAAG,IAAI,uBAAuB,CAAC,EAAE;YACvC,QAAQ,EAAE,iBAAiB,CAAC,IAAI,CAAC;YACjC,OAAO,EAAE,0CAA0C,iBAAiB,CAAC,IAAI,CAAC,GAAG;SAC9E,CAAC,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/core/runtime/createRuntime.d.ts

@@ -0,0 +1,23 @@
+import { type RuntimePlan } from "../../spec/domain/index.js";
+import { systemCaller } from "../caller.js";
+import { type InvocationCause, type MantleHandlers } from "../invocation.js";
+import type { MantleRuntime, MantleStorageAdapter } from "../service.js";
+export declare const CORE_VERSION = "0.2.0";
+export interface MantleRuntimeArgs {
+    readonly plan: RuntimePlan;
+    readonly handlers: MantleHandlers<never>;
+    readonly storage: MantleStorageAdapter;
+    /** Refuses to boot on a mismatch (`PLAN_FINGERPRINT_MISMATCH`): what Cloud compiled is what runs. */
+    readonly expectedFingerprint?: string;
+    /** Boot fails for any enabled schedule unless the entry wires schedules. */
+    readonly schedules?: boolean;
+    /** Handed to handlers as `ctx.env`. */
+    readonly env?: unknown;
+    readonly waitUntil?: (promise: Promise<unknown>, cause?: InvocationCause) => void;
+    /** Microseconds since the epoch, and new entry ids. */
+    readonly now?: () => number;
+    readonly newId?: () => string;
+}
+export declare function createMantleRuntime(args: MantleRuntimeArgs): Promise<MantleRuntime>;
+export { systemCaller };
+//# sourceMappingURL=createRuntime.d.ts.map

package/dist/core/runtime/createRuntime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"createRuntime.d.ts","sourceRoot":"","sources":["../../../src/core/runtime/createRuntime.ts"],"names":[],"mappings":"AAKA,OAAO,EAAqI,KAAK,WAAW,EAA4C,MAAM,4BAA4B,CAAC;AAG3O,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAA8D,KAAK,eAAe,EAAiD,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAKxL,OAAO,KAAK,EAAoB,aAAa,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAG3F,eAAO,MAAM,YAAY,UAAU,CAAC;AAQpC,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC;IACzC,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;IACvC,qGAAqG;IACrG,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IACtC,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,uCAAuC;IACvC,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,EAAE,eAAe,KAAK,IAAI,CAAC;IAClF,uDAAuD;IACvD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;CAC/B;AAgBD,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,CAAC,CAqKzF;AAED,OAAO,EAAE,YAAY,EAAE,CAAC"}

package/dist/core/runtime/createRuntime.js

@@ -0,0 +1,214 @@
+/**
+ * `createMantleRuntime`: boots one sealed plan into a running runtime (ADR-0032 decisions 3, 7 and 10).
+ * Boot checks the plan, the handlers and the storage; `invokeProcedure` is the one path every source runs through.
+ */
+import { DiagnosticError, makeDiagnostic, readJsonPointer } from "../../spec/kernel/index.js";
+import { RUNTIME_PLAN_VERSION, SqlRefusal, firstZodIssueAsJsonPointer, jsonSchemaToZod, planFingerprint, safeParseJson, ManifestParseError } from "../../spec/domain/index.js";
+import { validateTriggerSpec } from "../../spec/domain/service/TriggerSpecChecks.js";
+import { systemCaller } from "../caller.js";
+import { MAX_INVOCATION_DEPTH } from "../invocation.js";
+import { sqlInput } from "../sql/compile.js";
+import { runProcedure } from "../sql/run.js";
+import { bindFor, createStore } from "../store/createStore.js";
+import { evaluateAuthAll } from "./auth.js";
+export const CORE_VERSION = "0.2.0";
+/** A staff View's `uiSchema.list.searchFields` and `filterFields`, which Store's `search` and `filters` match (ADR-0032 decision 5). */
+function listFields(uiSchema) {
+    const list = (uiSchema?.["list"] ?? {});
+    return { ...(list.searchFields?.length ? { searchFields: list.searchFields } : {}), ...(list.filterFields?.length ? { filterFields: list.filterFields } : {}) };
+}
+const fail = (code, path, message, phase = "boot", extra = {}) => new DiagnosticError(makeDiagnostic({ code, phase, severity: "error", path, message, ...extra }));
+const VERB = { create: "insert", update: "update", delete: "delete", publish: "publish" };
+const depthOf = (c) => {
+    let depth = 0;
+    for (; c && depth <= MAX_INVOCATION_DEPTH; c = c.parent)
+        depth++;
+    return depth;
+};
+const child = (parent, procedure) => ({ kind: "internal", id: `${parent.id}>${procedure}`, parent });
+/** The key of the Schema a lifecycle Trigger names, as the dispatcher keys its hooks: the name in lower case, an own key. */
+const lifecycleKey = (plan, schema) => (Object.hasOwn(plan.schemas, schema.toLowerCase()) ? schema.toLowerCase() : undefined);
+export async function createMantleRuntime(args) {
+    const { plan } = args;
+    const at = "plan";
+    // ---- boot: the plan is what was sealed, and what was expected ---------------------------------------------------------
+    if (plan.version !== RUNTIME_PLAN_VERSION)
+        throw fail("PLAN_FINGERPRINT_MISMATCH", at, `plan version ${plan.version} is not the version this Core runs (${RUNTIME_PLAN_VERSION})`);
+    const { fingerprint, ...body } = plan;
+    if ((await planFingerprint(body)) !== fingerprint)
+        throw fail("PLAN_FINGERPRINT_MISMATCH", at, "the plan does not match its fingerprint: it changed after it was sealed");
+    if (args.expectedFingerprint !== undefined && args.expectedFingerprint !== fingerprint)
+        throw fail("PLAN_FINGERPRINT_MISMATCH", at, `the plan's fingerprint is ${fingerprint}, expected ${args.expectedFingerprint}`);
+    // handlers and plan agree in both directions
+    const refs = new Set(Object.values(plan.procedures).flatMap((p) => ("ref" in p.handler ? [p.handler.ref] : [])));
+    for (const ref of refs)
+        if (!Object.hasOwn(args.handlers, ref))
+            throw fail("HANDLER_NOT_REGISTERED", `${at}#/handler/${ref}`, `the plan names handler '${ref}' and none is registered`, "boot", { candidates: Object.keys(args.handlers) });
+    for (const name of Object.keys(args.handlers))
+        if (!refs.has(name))
+            throw fail("HANDLER_NOT_DECLARED", `${at}#/handlers/${name}`, `handler '${name}' is registered and no Procedure of the plan declares it`);
+    const triggers = Object.entries(plan.triggers).sort(([a], [b]) => (a < b ? -1 : 1));
+    // a Trigger is checked as the CLI checks its manifest (a lifecycle hook that is not one would bind nothing), and it targets a
+    // Procedure and a Schema of this plan: a surface that cannot find one fails on every request instead
+    for (const [name, t] of triggers) {
+        const path = `${at}#/triggers/${name}`;
+        try {
+            validateTriggerSpec({ spec: { source: t.source, target: { procedure: t.procedure } } }, undefined); // no document index: the path names the Trigger
+        }
+        catch (e) {
+            if (e instanceof ManifestParseError)
+                throw fail(e.code, `${path}${e.pointer?.replace(/^\/spec/, "") ?? ""}`, e.message);
+            throw e;
+        }
+        if (!Object.hasOwn(plan.procedures, t.procedure))
+            throw fail("TRIGGER_TARGET_PROCEDURE_UNKNOWN", path, `Trigger '${name}' targets '${t.procedure}', which is not a Procedure of the plan`);
+        // the dispatcher keys hooks by the Schema's key (its name in lower case) and a deferred after hook is honoured only for the
+        // Schema's name as declared (`runDeferredHook`), so the Trigger names a Schema exactly as the CLI's linker requires
+        const key = t.source.kind === "lifecycle" ? lifecycleKey(plan, t.source.schema) : undefined;
+        if (t.source.kind === "lifecycle" && (key === undefined || plan.schemas[key].name !== t.source.schema))
+            throw fail("LIFECYCLE_SCHEMA_UNKNOWN", path, `lifecycle Trigger '${name}' watches '${t.source.schema}', which is not the name of a Schema of the plan`);
+    }
+    if (!args.schedules && triggers.some(([, t]) => t.source.kind === "schedule" && t.source.enabled !== false))
+        throw fail("SCHEDULE_NOT_WIRED", at, "the plan has an enabled schedule Trigger and this entry does not wire schedules (pass schedules: true)");
+    // hook targets and guards are consumer code: an inline program would write inside a before hook or a guard, which fails open
+    const inline = (name) => !("ref" in (plan.procedures[name]?.handler ?? { ref: "" }));
+    for (const [name, t] of triggers)
+        if (t.source.kind === "lifecycle" && inline(t.procedure))
+            throw fail("LIFECYCLE_TARGET_NOT_REF", `${at}#/triggers/${name}`, `lifecycle Trigger '${name}' targets '${t.procedure}', which is an inline program`);
+    for (const [name, p] of Object.entries(plan.procedures)) {
+        const g = p.requires?.guard?.procedure;
+        if (g && inline(g))
+            throw fail("GUARD_PROCEDURE_NOT_REF", `${at}#/procedures/${name}`, `'${name}' is guarded by '${g}', which is an inline program`);
+    }
+    for (const [name, v] of Object.entries(plan.views)) {
+        const g = v.requires?.guard?.procedure;
+        if (g && inline(g))
+            throw fail("GUARD_PROCEDURE_NOT_REF", `${at}#/views/${name}`, `View '${name}' is guarded by '${g}', which is an inline program`);
+    }
+    // a plan is dialect-specific: checked before storage converges to it
+    const { dialect } = args.storage;
+    if (plan.dialect?.name !== dialect.name || plan.dialect.version !== dialect.version)
+        throw fail("PLAN_FINGERPRINT_MISMATCH", at, `the plan was compiled for dialect ${plan.dialect?.name}@${plan.dialect?.version}; this storage runs ${dialect.name}@${dialect.version}`);
+    const { executor, site } = await args.storage.prepare(plan);
+    // ---- lifecycle: Store hands mutations to this dispatcher; Procedures are only reached through invokeProcedure ---------------
+    const byHook = new Map();
+    const before = new Set();
+    const after = new Set();
+    for (const [name, t] of triggers) {
+        if (t.source.kind !== "lifecycle")
+            continue;
+        for (const hook of t.source.on) {
+            const [stage, op] = hook.split("_");
+            // a statement names its table the way SQL folds it, so hooks are keyed by the lower-cased Schema name
+            const schema = lifecycleKey(plan, t.source.schema);
+            (stage === "before" ? before : after).add(`${schema}.${VERB[op]}`);
+            const key = `${schema}|${hook}`;
+            byHook.set(key, [...(byHook.get(key) ?? []), [name, t.procedure]]);
+        }
+    }
+    const fire = (e, [trigger, procedure]) => invoke({ procedure, input: {}, caller: e.caller, cause: { kind: "lifecycle", id: `${e.id}:${trigger}`, ...(e.parent ? { parent: e.parent } : {}), trigger, hook: e.hook, schema: plan.schemas[e.schema]?.name ?? e.schema, rows: e.rows } });
+    const dispatcher = {
+        // a before hook that throws rejects the mutation: it fails closed
+        async before(events) {
+            for (const e of events)
+                for (const t of byHook.get(`${e.schema}|${e.hook}`) ?? [])
+                    await fire(e, t);
+        },
+        // an after hook never changes a committed result; the cause id is stable so a handler can deduplicate a replay
+        async after(events) {
+            for (const e of events)
+                for (const t of byHook.get(`${e.schema}|${e.hook}`) ?? []) {
+                    try {
+                        await fire(e, t);
+                    }
+                    catch (error) {
+                        console.error("[mantle lifecycle] after hook failed", { trigger: t[0], hook: e.hook, schema: e.schema, error });
+                    }
+                }
+        },
+    };
+    const lifecycle = before.size || after.size ? { dispatcher, before, after } : undefined;
+    const now = args.now ?? (() => Date.now() * 1000);
+    const store = createStore({
+        executor, dialect, schemas: plan.schemas, lifecycle, now,
+        newId: args.newId ?? (() => crypto.randomUUID().replaceAll("-", "")),
+        views: Object.fromEntries(Object.entries(plan.views).map(([name, v]) => [name, { ir: v.stmts, inputs: v.inputs, ...(v.input ? { input: v.input } : {}), ...(v.columns ? { columns: v.columns } : {}), public: v.surface === "public", ...(v.requires ? { requires: v.requires } : {}), ...(v.requires?.guard ? { guard: v.requires.guard.procedure } : {}), ...listFields(v.uiSchema) }])),
+        guardView: async (procedure, caller, input, cause) => { await invoke({ procedure, input, caller, cause: child(cause, procedure) }, true); },
+    });
+    // ---- invocation ---------------------------------------------------------------------------------------------------------------
+    const zod = new Map();
+    const schemaOf = (key, schema) => zod.get(key) ?? (zod.set(key, jsonSchemaToZod(schema)), zod.get(key));
+    const check = (kind, name, path, value, schema) => {
+        const r = safeParseJson(schemaOf(`${name}#${kind}`, schema), value);
+        if (r.success)
+            return r.data;
+        const { instancePath, message } = firstZodIssueAsJsonPointer(r.error);
+        throw new DiagnosticError(makeDiagnostic({
+            code: kind === "input" ? "INPUT_VALIDATION_FAILED" : "OUTPUT_VALIDATION_FAILED", phase: "runtime", severity: "error", path: `${path}#/${kind}${instancePath}`,
+            // an output value is handler data the schema did not expect: it may hold what the schema meant to exclude, so it never reaches a wire
+            ...(kind === "input" ? { value: readJsonPointer(value, instancePath) } : {}), expected: message,
+            ...(kind === "output" ? { message: `Procedure '${name}' returned a value that does not match its declared output schema. This is a handler bug.` } : {}),
+        }));
+    };
+    const readOnly = (s) => ({
+        ...s, write: () => Promise.reject(fail("AUTH_DENIED", "store", "a guard or a before hook may not write", "runtime")),
+    });
+    async function invoke(inv, guard = false) {
+        if (depthOf(inv.cause) > MAX_INVOCATION_DEPTH)
+            throw fail("INVOCATION_DEPTH_EXCEEDED", `manifest:Procedure/${inv.procedure}`, `Procedures invoked more than ${MAX_INVOCATION_DEPTH} deep (hooks and ctx.invoke count)`, "runtime");
+        const proc = Object.hasOwn(plan.procedures, inv.procedure) ? plan.procedures[inv.procedure] : undefined;
+        const path = `manifest:Procedure/${inv.procedure}`;
+        if (!proc)
+            throw fail("PROCEDURE_NOT_FOUND", path, `unknown Procedure '${inv.procedure}'`, "runtime");
+        const denial = evaluateAuthAll(proc.requires, inv.caller, path);
+        if (denial)
+            throw new DiagnosticError(denial);
+        const input = check("input", inv.procedure, path, inv.input, proc.input);
+        // a dynamic guard sees the validated input and the same caller, reads only, and may not itself be guarded
+        const guardName = proc.requires?.guard?.procedure;
+        if (guardName && !guard)
+            await invoke({ procedure: guardName, input, caller: inv.caller, cause: child(inv.cause, guardName) }, true);
+        const isBefore = inv.cause.kind === "lifecycle" && inv.cause.hook.startsWith("before_");
+        const ro = guard || isBefore;
+        if (ro && "sql" in proc.handler)
+            throw fail("LIFECYCLE_TARGET_NOT_REF", path, "a guard or a before hook may not be an inline program", "runtime");
+        let result;
+        try {
+            if ("ref" in proc.handler) {
+                const bound = store.as(inv.caller, inv.cause); // writes chain to this invocation, so hooks they fire count toward the depth limit
+                // only the system caller reaches TTL maintenance: no request can produce one (ADR-0032 decision 8)
+                const scoped = inv.caller.kind === "system" && !ro ? { ...bound, sweepExpired: store.sweepExpired } : bound;
+                const ctx = {
+                    caller: inv.caller, cause: inv.cause, env: args.env, waitUntil: (promise) => args.waitUntil?.(promise, inv.cause),
+                    store: ro ? readOnly(scoped) : scoped,
+                    invoke: (procedure, i) => (ro ? Promise.reject(fail("AUTH_DENIED", path, "a guard or a before hook may not invoke a Procedure", "runtime")) : invoke({ procedure, input: i, caller: inv.caller, cause: child(inv.cause, procedure) })),
+                };
+                result = await args.handlers[proc.handler.ref](input, ctx);
+            }
+            else {
+                const { mode, bind } = bindFor(now(), inv.caller);
+                const env = { executor, dialect, schemas: plan.schemas, mode, lifecycle };
+                const ran = await runProcedure(env, { kind: "procedure", inputs: proc.inputs, ir: proc.handler.sql.stmts }, { caller: inv.caller, cause: inv.cause, bind: { ...bind, input: sqlInput(proc.input, input) } });
+                result = { results: ran.rows };
+            }
+        }
+        catch (e) {
+            if (e instanceof DiagnosticError)
+                throw e;
+            if (e instanceof SqlRefusal)
+                throw fail("INPUT_VALIDATION_FAILED", path, e.message, "runtime");
+            console.error(`[mantle procedure ${inv.procedure}] unhandled failure`, e);
+            throw fail("INTERNAL_ERROR", path, "An internal error occurred.", "runtime");
+        }
+        return check("output", inv.procedure, path, result, proc.output);
+    }
+    return {
+        plan,
+        store,
+        invokeProcedure: (invocation) => invoke(invocation),
+        bootReport: () => ({ fingerprint, coreVersion: CORE_VERSION }),
+        ...(site ? { site } : {}),
+    };
+}
+export { systemCaller };
+//# sourceMappingURL=createRuntime.js.map

package/dist/core/runtime/createRuntime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createRuntime.js","sourceRoot":"","sources":["../../../src/core/runtime/createRuntime.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,eAAe,EAAwC,MAAM,4BAA4B,CAAC;AACpI,OAAO,EAAE,oBAAoB,EAAE,UAAU,EAAE,0BAA0B,EAAE,eAAe,EAAE,eAAe,EAAE,aAAa,EAA8D,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAC3O,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAC;AAErF,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,oBAAoB,EAAkI,MAAM,kBAAkB,CAAC;AACxL,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAoC,MAAM,eAAe,CAAC;AAC/E,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAG/D,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAE5C,MAAM,CAAC,MAAM,YAAY,GAAG,OAAO,CAAC;AAEpC,wIAAwI;AACxI,SAAS,UAAU,CAAC,QAAuD;IACzE,MAAM,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAyD,CAAC;IAChG,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAClK,CAAC;AAkBD,MAAM,IAAI,GAAG,CAAC,IAAoB,EAAE,IAAY,EAAE,OAAe,EAAE,QAA6B,MAAM,EAAE,QAA6B,EAAE,EAAE,EAAE,CACzI,IAAI,eAAe,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC;AAEnG,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAW,CAAC;AACnG,MAAM,OAAO,GAAG,CAAC,CAA8B,EAAU,EAAE;IACzD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,CAAC,IAAI,KAAK,IAAI,oBAAoB,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM;QAAE,KAAK,EAAE,CAAC;IACjE,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AACF,MAAM,KAAK,GAAG,CAAC,MAAuB,EAAE,SAAiB,EAAmB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,MAAM,CAAC,EAAE,IAAI,SAAS,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;AAE/I,6HAA6H;AAC7H,MAAM,YAAY,GAAG,CAAC,IAAiB,EAAE,MAAc,EAAsB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAEvK,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAuB;IAC/D,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,GAAG,MAAM,CAAC;IAElB,0HAA0H;IAC1H,IAAI,IAAI,CAAC,OAAO,KAAK,oBAAoB;QAAE,MAAM,IAAI,CAAC,2BAA2B,EAAE,EAAE,EAAE,gBAAgB,IAAI,CAAC,OAAO,uCAAuC,oBAAoB,GAAG,CAAC,CAAC;IACnL,MAAM,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;IACtC,IAAI,CAAC,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,WAAW;QAAE,MAAM,IAAI,CAAC,2BAA2B,EAAE,EAAE,EAAE,yEAAyE,CAAC,CAAC;IAC1K,IAAI,IAAI,CAAC,mBAAmB,KAAK,SAAS,IAAI,IAAI,CAAC,mBAAmB,KAAK,WAAW;QACpF,MAAM,IAAI,CAAC,2BAA2B,EAAE,EAAE,EAAE,6BAA6B,WAAW,cAAc,IAAI,CAAC,mBAAmB,EAAE,CAAC,CAAC;IAEhI,6CAA6C;IAC7C,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACjH,KAAK,MAAM,GAAG,IAAI,IAAI;QAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC;YAAE,MAAM,IAAI,CAAC,wBAAwB,EAAE,GAAG,EAAE,aAAa,GAAG,EAAE,EAAE,2BAA2B,GAAG,0BAA0B,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC5O,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,CAAC,sBAAsB,EAAE,GAAG,EAAE,cAAc,IAAI,EAAE,EAAE,YAAY,IAAI,0DAA0D,CAAC,CAAC;IAE9M,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpF,8HAA8H;IAC9H,qGAAqG;IACrG,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,GAAG,EAAE,cAAc,IAAI,EAAE,CAAC;QACvC,IAAI,CAAC;YACH,mBAAmB,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,EAAE,EAAgC,EAAE,SAA8B,CAAC,CAAC,CAAC,gDAAgD;QACzM,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,kBAAkB;gBAAE,MAAM,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;YACxH,MAAM,CAAC,CAAC;QACV,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,CAAC,kCAAkC,EAAE,IAAI,EAAE,YAAY,IAAI,cAAc,CAAC,CAAC,SAAS,yCAAyC,CAAC,CAAC;QAC3L,4HAA4H;QAC5H,oHAAoH;QACpH,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5F,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAE,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;YACrG,MAAM,IAAI,CAAC,0BAA0B,EAAE,IAAI,EAAE,sBAAsB,IAAI,cAAc,CAAC,CAAC,MAAM,CAAC,MAAM,kDAAkD,CAAC,CAAC;IAC5J,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC;QACzG,MAAM,IAAI,CAAC,oBAAoB,EAAE,EAAE,EAAE,wGAAwG,CAAC,CAAC;IAEjJ,6HAA6H;IAC7H,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,OAAO,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAC7F,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,QAAQ;QAC9B,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,WAAW,IAAI,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,CAAC,0BAA0B,EAAE,GAAG,EAAE,cAAc,IAAI,EAAE,EAAE,sBAAsB,IAAI,cAAc,CAAC,CAAC,SAAS,+BAA+B,CAAC,CAAC;IAClN,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACxD,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAC;QACvC,IAAI,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,CAAC,yBAAyB,EAAE,GAAG,EAAE,gBAAgB,IAAI,EAAE,EAAE,IAAI,IAAI,oBAAoB,CAAC,+BAA+B,CAAC,CAAC;IACvJ,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACnD,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAC;QACvC,IAAI,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,CAAC,yBAAyB,EAAE,GAAG,EAAE,WAAW,IAAI,EAAE,EAAE,SAAS,IAAI,oBAAoB,CAAC,+BAA+B,CAAC,CAAC;IACvJ,CAAC;IAED,qEAAqE;IACrE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;IACjC,IAAI,IAAI,CAAC,OAAO,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO;QACjF,MAAM,IAAI,CAAC,2BAA2B,EAAE,EAAE,EAAE,qCAAqC,IAAI,CAAC,OAAO,EAAE,IAAI,IAAI,IAAI,CAAC,OAAO,EAAE,OAAO,uBAAuB,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACxL,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5D,gIAAgI;IAChI,MAAM,MAAM,GAAG,IAAI,GAAG,EAA8B,CAAC;IACrD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,QAAQ,EAAE,CAAC;QACjC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,WAAW;YAAE,SAAS;QAC5C,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YAC/B,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4C,CAAC;YAC/E,sGAAsG;YACtG,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAE,CAAC;YACpD,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACnE,MAAM,GAAG,GAAG,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC;YAChC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,CAAiB,EAAE,CAAC,OAAO,EAAE,SAAS,CAAmB,EAAE,EAAE,CACzE,MAAM,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,EAAE,IAAI,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAqB,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAChQ,MAAM,UAAU,GAAwB;QACtC,kEAAkE;QAClE,KAAK,CAAC,MAAM,CAAC,MAAM;YACjB,KAAK,MAAM,CAAC,IAAI,MAAM;gBAAE,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE;oBAAE,MAAM,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACtG,CAAC;QACD,+GAA+G;QAC/G,KAAK,CAAC,KAAK,CAAC,MAAM;YAChB,KAAK,MAAM,CAAC,IAAI,MAAM;gBACpB,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;oBAC1D,IAAI,CAAC;wBAAC,MAAM,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;oBAAC,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBAAC,OAAO,CAAC,KAAK,CAAC,sCAAsC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;oBAAC,CAAC;gBAC9J,CAAC;QACL,CAAC;KACF,CAAC;IACF,MAAM,SAAS,GAA+B,MAAM,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAEpH,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,WAAW,CAAC;QACxB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG;QACxD,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACpE,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,KAAK,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1X,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,MAAM,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;KAC5I,CAAC,CAAC;IAEH,kIAAkI;IAClI,MAAM,GAAG,GAAG,IAAI,GAAG,EAAmB,CAAC;IACvC,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAE,MAA6C,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC,CAAC;IACxJ,MAAM,KAAK,GAAG,CAAC,IAAwB,EAAE,IAAY,EAAE,IAAY,EAAE,KAAc,EAAE,MAA6C,EAAE,EAAE;QACpI,MAAM,CAAC,GAAG,aAAa,CAAC,QAAQ,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;QACpE,IAAI,CAAC,CAAC,OAAO;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC;QAC7B,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,GAAG,0BAA0B,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACtE,MAAM,IAAI,eAAe,CAAC,cAAc,CAAC;YACvC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,0BAA0B,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,KAAK,IAAI,GAAG,YAAY,EAAE;YAC7J,sIAAsI;YACtI,GAAG,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,eAAe,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO;YAC/F,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,IAAI,2FAA2F,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzJ,CAAC,CAAC,CAAC;IACN,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,CAAC,CAAc,EAAe,EAAE,CAAC,CAAC;QACjD,GAAG,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,EAAE,wCAAwC,EAAE,SAAS,CAAC,CAAC;KACrH,CAAC,CAAC;IAEH,KAAK,UAAU,MAAM,CAAC,GAAe,EAAE,KAAK,GAAG,KAAK;QAClD,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,oBAAoB;YAC3C,MAAM,IAAI,CAAC,2BAA2B,EAAE,sBAAsB,GAAG,CAAC,SAAS,EAAE,EAAE,gCAAgC,oBAAoB,oCAAoC,EAAE,SAAS,CAAC,CAAC;QACtL,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxG,MAAM,IAAI,GAAG,sBAAsB,GAAG,CAAC,SAAS,EAAE,CAAC;QACnD,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,CAAC,qBAAqB,EAAE,IAAI,EAAE,sBAAsB,GAAG,CAAC,SAAS,GAAG,EAAE,SAAS,CAAC,CAAC;QACtG,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAChE,IAAI,MAAM;YAAE,MAAM,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAEzE,0GAA0G;QAC1G,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAC;QAClD,IAAI,SAAS,IAAI,CAAC,KAAK;YAAE,MAAM,MAAM,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAErI,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACxF,MAAM,EAAE,GAAG,KAAK,IAAI,QAAQ,CAAC;QAC7B,IAAI,EAAE,IAAI,KAAK,IAAI,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,CAAC,0BAA0B,EAAE,IAAI,EAAE,uDAAuD,EAAE,SAAS,CAAC,CAAC;QAClJ,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,IAAI,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC1B,MAAM,KAAK,GAAG,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,mFAAmF;gBAClI,mGAAmG;gBACnG,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;gBAC5G,MAAM,GAAG,GAAmB;oBAC1B,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC;oBACjH,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM;oBACrC,MAAM,EAAE,CAAC,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,EAAE,qDAAqD,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;iBACvO,CAAC;gBACF,MAAM,GAAG,MAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAgD,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC7G,CAAC;iBAAM,CAAC;gBACN,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;gBAClD,MAAM,GAAG,GAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;gBAClF,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC7M,MAAM,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;YACjC,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,eAAe;gBAAE,MAAM,CAAC,CAAC;YAC1C,IAAI,CAAC,YAAY,UAAU;gBAAE,MAAM,IAAI,CAAC,yBAAyB,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YAC/F,OAAO,CAAC,KAAK,CAAC,qBAAqB,GAAG,CAAC,SAAS,qBAAqB,EAAE,CAAC,CAAC,CAAC;YAC1E,MAAM,IAAI,CAAC,gBAAgB,EAAE,IAAI,EAAE,6BAA6B,EAAE,SAAS,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACnE,CAAC;IAED,OAAO;QACL,IAAI;QACJ,KAAK;QACL,eAAe,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC;QACnD,UAAU,EAAE,GAAqB,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;QAChF,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1B,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,YAAY,EAAE,CAAC"}

package/dist/core/runtime/verifyPlan.d.ts

@@ -0,0 +1,34 @@
+/**
+ * `verifyPlan`: everything boot checks about an uploaded plan, plus every program through the storage's dialect, without a
+ * database or the handlers (ADR-0034 decision 7: Cloud validates the IR and never parses SQL). Worker-safe: no SQL parser.
+ */
+import { type Diagnostic } from "../../spec/kernel/index.js";
+import { type RuntimePlan } from "../../spec/domain/index.js";
+import type { MantleStorageAdapter } from "../service.js";
+/**
+ * The most a plan `verifyPlan` checks may hold, checked before anything else: every check below is linear in these. Each is many
+ * times what a real app declares (Mantle Cloud's Control plan: 8 Schemas of at most 8 fields, 10 Views, 59 Procedures, 79 Triggers).
+ */
+export declare const PLAN_LIMITS: {
+    readonly schemas: 256;
+    readonly fieldsPerSchema: 256;
+    readonly checksPerSchema: 32;
+    readonly views: 1024;
+    readonly procedures: 1024;
+    readonly triggers: 2048;
+    /** JSON objects and arrays in one program's IR (a check, a View, an inline Procedure): the allowlist walks at most `MAX_NODES` nodes, each a few of these */
+    readonly programIrValues: number;
+};
+/**
+ * The plan's diagnostics: a plan past `PLAN_LIMITS` (checked first, and alone), what boot refuses before storage (version,
+ * fingerprint, dialect, Triggers, guard and hook targets), what the CLI's own validators refuse of the manifests the plan stands
+ * for (`planShape`: its JSON Schemas, fields, TTL, graph checks), and every
+ * Schema check, View and inline Procedure through the storage's dialect (with its `restrict`) and the policy rewrite. Empty
+ * means every program reads and writes only through the policy rewrite, in the shapes the dialect allows. It does not type-check
+ * the SQL: a statement the database refuses (a function's argument count or type, an operand type) fails that call, or boot for
+ * a check, with the database's error, never past the policy. Only `storage.dialect` is read, so storage's own refusals (a
+ * reserved table name, a column type it cannot store) still surface where the plan first boots against its database.
+ * Handlers are not checked (the host binds them); enabled schedule Triggers are allowed (the host decides whether it wires them).
+ */
+export declare function verifyPlan(plan: RuntimePlan, storage: Pick<MantleStorageAdapter, "dialect">): Promise<readonly Diagnostic[]>;
+//# sourceMappingURL=verifyPlan.d.ts.map

package/dist/core/runtime/verifyPlan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifyPlan.d.ts","sourceRoot":"","sources":["../../../src/core/runtime/verifyPlan.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAmC,KAAK,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC9F,OAAO,EAA6P,KAAK,WAAW,EAA8E,MAAM,4BAA4B,CAAC;AAMrY,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAG1D;;;GAGG;AACH,eAAO,MAAM,WAAW;;;;;;;IAOtB,6JAA6J;;CAErJ,CAAC;AAMX;;;;;;;;;;GAUG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,oBAAoB,EAAE,SAAS,CAAC,GAAG,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC,CAQlI"}