@aotter/mantle 0.1.5-alpha.1 → 0.2.0-alpha.10

package/dist/usecase/adminClient.js

@@ -0,0 +1,87 @@
+/** `admin-client.ts`: the types Admin's data hooks bind to, for the application's browser-side `admin.tsx`. */
+import { BUILT_IN_NAV_GROUPS, mcpTools } from "../build/compiler.js";
+import { q } from "../domain/entry.js";
+/**
+ * The compatibility test of the application's Admin MCP App (`node --test generated/admin-mcp-app.check.mjs`): it loads the App
+ * `mantle bundle` built in the official MCP Apps host and fails on a network request, a console error or an exception. It needs
+ * `playwright-core` (a devDependency) and Chrome: `npx playwright-core install chromium`, or `MANTLE_TEST_CHROMIUM=<executable>`.
+ * Node strips the types of `admin-descriptors.ts` (Node 22.18 or newer).
+ */
+const MCP_APP_TEST = `import { existsSync } from "node:fs";
+import { test } from "node:test";
+import { checkMcpApp } from "@aotter/mantle-admin/testing";
+import { mcpAppCatalogues } from "./admin-descriptors.ts";
+
+// \`mantle bundle <entry> dist\` writes the App here; MANTLE_MCP_APP_HTML names another file
+const html = process.env.MANTLE_MCP_APP_HTML ?? "dist/client/admin/mcp-app.html";
+
+test("the Admin MCP App works in an MCP host", { timeout: 300_000 }, async () => {
+  if (!existsSync(html)) throw new Error(\`\${html} is missing: run \\\`npm run build\\\` first.\`);
+  await checkMcpApp({ catalogue: mcpAppCatalogues.admin, html });
+});
+`;
+/** A Schema, View input or Procedure input as a closed object type; one that is only a `$ref` stays open. */
+const closed = (typeOf, schema) => !schema ? "{}" : schema.properties || schema.type === "object" && !schema["$ref"] ? typeOf({ ...schema, additionalProperties: false }) : "{ readonly [key: string]: unknown }";
+/**
+ * Types are what the routes take and return, not the Store's rows: an entry's `data` keeps declared field names, an input is
+ * what the route validates, a View row is its wire row under the names the browser route gives its columns (an MCP App's
+ * `tools/call` returns the SQL names; the hooks rename them with `rowNames`), with `true` when it is an admin MCP tool, else null, which
+ * types `pages[].mcp.renders` (types only; nothing ships). The file imports `generated/*` as types only, so nothing of the
+ * Worker enters the browser bundle, and it is refused in the Worker's startup graph (`mantle bundle`).
+ */
+export function emitAdminClient(plan, typeOf) {
+    const tools = mcpTools(plan, "admin"), hasTool = (kind, source) => tools.some(t => t.kind === kind && t.source === source);
+    const views = Object.entries(plan.views).filter(([, v]) => v.surface === "admin").sort(([a], [b]) => a < b ? -1 : 1);
+    const operations = Object.entries(plan.procedures).filter(([name]) => hasTool("procedure", name)).sort(([a], [b]) => a < b ? -1 : 1);
+    const schemas = Object.values(plan.schemas).sort((a, b) => a.name < b.name ? -1 : 1);
+    // the scope column belongs to the caller, so an entry's data has no such field
+    const dataOf = (s) => {
+        const scope = s.scope ? s.names[s.scope] ?? s.scope : undefined, { [scope ?? ""]: _scope, ...properties } = s.schema.properties ?? {};
+        // a draft of a publishing collection is only partly validated, so none of its fields is certain to be there
+        const required = s.publishing ? [] : s.schema.required?.filter(f => f !== scope);
+        const schema = { ...s.schema, properties, ...(required ? { required } : {}) };
+        return s.translates ? typeOf(schema) : closed(typeOf, schema);
+    };
+    // the names the browser route gives a View's columns where they differ from the SQL output names, as it applies them
+    const renames = views.map(([, v]) => Object.fromEntries(Object.entries(v.columns ?? {}).flatMap(([key, c]) => {
+        const named = key === c.field ? plan.schemas[c.schema].names[c.field] ?? key : key;
+        return named !== key ? [[key, named]] : [];
+    })));
+    // every sidebar group an admin Schema or View places an item in; `defineAdmin` must declare the ones Admin does not have
+    // (the generate-time check of `uiSchema.nav.group` is this type)
+    const placed = (ui) => { const group = ui?.["nav"]?.group; return typeof group === "string" ? [group] : []; };
+    const used = [...new Set([...schemas.flatMap(s => placed(s.uiSchema)), ...views.flatMap(([, v]) => placed(v.uiSchema))])].sort();
+    const custom = used.filter(group => !BUILT_IN_NAV_GROUPS.has(group));
+    const union = (names) => names.length ? names.map(name => q(name)).join(" | ") : "never";
+    // whether an admin View is an MCP tool, which a page declared for an MCP App (`pages[].mcp.renders`) must have
+    const toolOf = (name) => hasTool("view", name) || null;
+    const rows = views.map(([name], n) => `import type { WireRow as View${n}Wire } from "./views/${encodeURIComponent(name)}.js";`);
+    const sql = operations.some(([, p]) => "sql" in p.handler);
+    return { "admin-mcp-app.check.mjs": MCP_APP_TEST, "admin-client.ts": [
+            "// Browser only: import this from src/admin.tsx, never from the Worker (`mantle bundle` refuses it there).",
+            'import type { AdminMeta } from "@aotter/mantle-admin/app";',
+            'import { createAdminHooks } from "@aotter/mantle-admin/hooks";',
+            ...(sql ? ['import type { Output } from "@aotter/mantle/contracts";'] : []),
+            ...rows,
+            "",
+            "type Renamed<Row, Names extends { readonly [from: string]: string }> = { [K in keyof Row as K extends keyof Names ? Names[K] : K]: Row[K] };",
+            ...views.map((_, n) => `type View${n}Row = Renamed<View${n}Wire, ${q(renames[n])}>;`),
+            "",
+            "/** Every sidebar group the manifest places an item in. */",
+            `export type ManifestNavGroup = ${union(used)};`,
+            "",
+            "/** The input and row of each admin View, the `data` of each collection's entries, and the input and output of each admin operation. */",
+            "export interface AppAdminTypes {",
+            `  readonly views: { ${views.map(([name, v], n) => `readonly ${q(name)}: { readonly input: ${closed(typeOf, v.input)}; readonly row: View${n}Row; readonly mcp: ${q(toolOf(name))} }`).join("; ")} };`,
+            `  readonly collections: { ${schemas.map(s => `readonly ${q(s.name)}: { readonly data: ${dataOf(s)} }`).join("; ")} };`,
+            `  readonly operations: { ${operations.map(([name, p]) => `readonly ${q(name)}: { readonly input: ${closed(typeOf, p.input)}; readonly output: ${"sql" in p.handler ? "Output" : "unknown"} }`).join("; ")} };`,
+            `  readonly navGroups: ${union(custom)};`,
+            "}",
+            "",
+            "/** Pass to `defineAdmin(admin)`: the column names a View's rows carry in the browser, for an MCP App to match. */",
+            `export const admin: AdminMeta<AppAdminTypes> = { rowNames: ${q(Object.fromEntries(views.flatMap(([name], n) => Object.keys(renames[n]).length ? [[name, renames[n]]] : [])))} };`,
+            "",
+            "export const { useView, useEntries, useEntry, useOperation, useCollectionTotal, useMe, useBadges } = createAdminHooks<AppAdminTypes>();",
+            "",
+        ].join("\n") };
+}

package/dist/usecase/adminDescriptors.js

@@ -0,0 +1,107 @@
+/** Build-time projections only; generated exports are static, independently tree-shakable data. */
+import { isPrimaryCollection, mcpTools, mcpToolNameSegment, toolTitle, collectionOf, developerConsole, rowPreconditions, appCatalog, entrySchema } from "../build/compiler.js";
+import { q } from "../domain/entry.js";
+import { advertised } from "./validation.js";
+import { publishingAnnotations, publishingInput, publishingTransitions } from "./publishing.js";
+import { versioned } from "./tool-version.js";
+export function emitAdminDescriptors({ plan, admin = false }, diagnostics) {
+    const schemaList = Object.values(plan.schemas);
+    const placed = [...schemaList.map(s => ["schemas/" + s.name, s.uiSchema, s]), ...Object.entries(plan.views).map(([name, v]) => ["views/" + name, v.uiSchema, null])];
+    for (const [path, ui, s] of placed) {
+        const nav = (ui?.["nav"] ?? {}), group = nav["group"];
+        // a child folded under its parent, or a translation on its parent's language tabs, has no sidebar entry to place
+        if (s && !isPrimaryCollection(s, schemaList))
+            for (const key of ["group", "order", "hidden"])
+                if (nav[key] !== undefined)
+                    diagnostics.push({ code: "SCHEMA_UI_INVALID", path: `${path}/uiSchema/nav/${key}`, message: s.translates ? `Schema '${s.name}' has no sidebar entry to place: it is a translation, shown on its parent's language tabs.` : `Schema '${s.name}' has no sidebar entry to place: it is folded under its parent${collectionOf(s, schemaList).parent?.parentField === "id" ? "; nav.standalone: true lists it in the sidebar." : " and opens from its parent's workbench (standalone needs a required id reference)."}` });
+    }
+    if (diagnostics.length)
+        return {};
+    const schemas = Object.values(plan.schemas);
+    const allCollections = Object.fromEntries(schemas.map(s => [s.name, { ...collectionOf(s, schemas), ...(admin ? { scopeField: s.scope ? s.names[s.scope] ?? s.scope : null, exportFields: Object.keys(s.fields).filter(f => f !== s.scope && s.fields[f] !== "geo").map(f => s.names[f] ?? f) } : {}) }]));
+    const viewNames = Object.create(null);
+    const views = Object.entries(plan.views).filter(([, v]) => v.surface === "admin").map(([name, v]) => {
+        const columns = Object.fromEntries(Object.entries(v.columns ?? {}).map(([key, column]) => {
+            const schema = plan.schemas[column.schema], field = schema.names[column.field] ?? column.field;
+            const output = key === column.field ? field : key;
+            (viewNames[name] ??= Object.create(null))[key] = output;
+            return [output, { schema: schema.name, field }];
+        }));
+        const list = (v.uiSchema?.list ?? {});
+        return { name, title: v.title ?? null, description: v.description ?? null, input: v.input ?? null, list: { columns: list.columns ?? [], searchFields: list.searchFields ?? [], filterFields: list.filterFields ?? [] }, columns, ...(v.uiSchema?.nav ? { nav: v.uiSchema.nav } : {}) };
+    });
+    const adminTools = mcpTools(plan, "admin"), toolNames = new Set(adminTools.map(t => t.name));
+    const operations = adminTools.filter(t => t.kind === "procedure").map(t => {
+        const p = plan.procedures[t.source];
+        const preconditions = p.target && "sql" in p.handler ? rowPreconditions(p.handler.sql.stmts, p.target.schema, p.target.id, plan.schemas[p.target.schema.toLowerCase()]?.schema ?? {}) : [];
+        return { ...(preconditions.length ? { preconditions } : {}), name: t.source, title: p.title ?? null, description: p.description ?? null, input: p.input, uiSchema: p.uiSchema ?? null, interactions: p.target ? [{ collection: p.target.schema, bind: [{ input: p.target.id, field: "id" }], ...(p.target.version ? { version: p.target.version } : {}), mutates: true }] : [] };
+    });
+    const authorizations = { views: Object.fromEntries(views.map(v => [v.name, plan.views[v.name].requires ?? null])), procedures: Object.fromEntries(Object.entries(plan.procedures).map(([name, p]) => [name, p.requires ?? null])) };
+    const adminCatalogue = appCatalog(plan, "admin");
+    const catalogues = { public: appCatalog(plan, "public"), admin: { views: Object.fromEntries(Object.entries(adminCatalogue.views).map(([name, v]) => [name, { ...v, actions: [...v.actions] }])), actions: { ...adminCatalogue.actions } } };
+    const snapshot = developerConsole(plan);
+    const webmcp = { tools: adminTools.map(({ name, source, kind, title, description, inputSchema, outputSchema, annotations }) => ({ target: { kind, name: source }, ...versioned({ name, ...(title ? { title: (kind === "view" ? plan.views[source] : plan.procedures[source]).title ?? title } : {}), ...advertised(inputSchema, (kind === "view" ? plan.views[source] : plan.procedures[source]).description ?? description), ...(outputSchema ? { outputSchema } : {}), ...(annotations ? { annotations } : {}) }) })), routes: Object.fromEntries(adminTools.flatMap(t => {
+            if (t.kind === "view")
+                return [[t.name, { path: "/admin/views/" + encodeURIComponent(t.source) }]];
+            const target = plan.procedures[t.source].target;
+            return target ? [[t.name, { path: "/admin/c/" + encodeURIComponent(plan.schemas[target.schema.toLowerCase()]?.name ?? target.schema), entry: true }]] : [];
+        })) };
+    // These are the actual generated transitions, not authored ref handlers or SQL IR.
+    for (const schema of schemas.filter(s => s.publishing))
+        for (const [verb] of publishingTransitions) {
+            const name = schema.name + "." + verb, tool = mcpToolNameSegment(verb + "_" + schema.name);
+            if (toolNames.has(tool)) {
+                diagnostics.push({ code: "GENERATE_UNSUPPORTED", path: "schemas/" + schema.name, message: "Generated publishing tool '" + tool + "' conflicts with an admin tool." });
+                continue;
+            }
+            toolNames.add(tool);
+            const action = { capability: tool, inputSchema: publishingInput, bind: [{ input: "id", field: "id" }], version: "expectedVersion", mutates: true };
+            catalogues.admin.actions[tool] = action;
+            for (const t of adminTools.filter(t => t.kind === "view"))
+                if (entrySchema(plan, plan.views[t.source]) === schema.name.toLowerCase())
+                    catalogues.admin.views[t.name].actions.push(tool);
+            authorizations.procedures[name] = { auth: { all: ["ctx.admin"] } };
+            const description = verb + " an entry in " + schema.name + ".";
+            webmcp.tools.push({ target: { kind: "procedure", name }, ...versioned({ name: tool, title: toolTitle(verb + "_" + schema.name), description, inputSchema: publishingInput, annotations: publishingAnnotations(verb) }) });
+            webmcp.routes[tool] = { path: "/admin/c/" + encodeURIComponent(schema.name), entry: true };
+            snapshot.interfaces.callable.push({ kind: "procedure", name: tool, target: name, surface: "admin", audience: "admin", title: null, description, input: publishingInput, output: null, trigger: null });
+        }
+    const data = { allCollections, views, operations, fieldNames: Object.fromEntries(schemas.map(s => [s.name, s.names])), viewNames, authorizations, developerConsole: snapshot, mcpAppCatalogues: catalogues, webmcp };
+    return { "admin-descriptors.ts": "// Generated static Admin metadata. Import only the exports the application uses.\n" + literals(data) + "\nexport const collections = [" + schemas.filter(s => !s.translates).map(s => "allCollections[" + q(s.name) + "]").join(",") + "] as const;\nexport const bootstrap = {collections, allCollections, operations, views, webmcp, developerConsole} as const;\n" };
+}
+/**
+ * Each export as a JSON literal; a subtree of 40 or more bytes that would be printed more than once is printed once, as a
+ * module-private constant the exports reference (a bundler keeps only those an imported export reaches).
+ */
+function literals(exports) {
+    const data = JSON.parse(q(exports)), count = new Map(), hoisted = new Map(), constants = [];
+    const each = (value, visit) => { if (value && typeof value === "object")
+        for (const child of Object.values(value))
+            if (child && typeof child === "object")
+                visit(q(child), child); };
+    const tally = (json, value, by = 1) => { if (json.length >= 40)
+        count.set(json, (count.get(json) ?? 0) + by); each(value, (json, child) => tally(json, child, by)); };
+    for (const value of Object.values(data))
+        each(value, tally);
+    // Longest first: once a subtree is printed once, what it contains occurs (copies - 1) times fewer per occurrence in it.
+    for (const json of [...count.keys()].sort((a, b) => b.length - a.length)) {
+        const copies = count.get(json);
+        if (copies > 1) {
+            hoisted.set(json, "");
+            each(JSON.parse(json), (inner, child) => tally(inner, child, 1 - copies));
+        }
+    }
+    let named = 0;
+    const print = (value) => !value || typeof value !== "object" ? q(value) : Array.isArray(value) ? "[" + value.map(reference).join(",") + "]" : "{" + Object.entries(value).map(([key, child]) => (key === "__proto__" ? "[" + q(key) + "]" : q(key)) + ":" + reference(child)).join(",") + "}";
+    const reference = (value) => {
+        const json = q(value);
+        if (hoisted.get(json) === "") {
+            const name = "$" + named++;
+            hoisted.set(json, name);
+            constants.push("const " + name + " = " + print(value) + " as const;");
+        }
+        return hoisted.get(json) ?? print(value);
+    };
+    const lines = Object.entries(data).map(([name, value]) => "export const " + name + " = " + print(value) + " as const;");
+    return [...constants, ...lines].join("\n");
+}

package/dist/usecase/generate.js

@@ -0,0 +1,166 @@
+import { userReferences } from "../domain/userReferences.js";
+/** Canonical lowered programs become ordinary target-specific TypeScript, never a runtime plan. */
+import { parseNumeric, tableOutputs } from "../build/compiler.js";
+import { boundaryType, nativeType, outputType, wireType } from "../domain/columns.js";
+import { databaseImport, driverFor, entry, exportName, generatedFiles, isSqlite as sqlite, q } from "../domain/entry.js";
+import { authLines as auth } from "../domain/input.js";
+import { recipesOf } from "../domain/recipes.js";
+import { emitTtl } from "./ttl.js";
+import { emitPublishing } from "./publishing.js";
+import { emitStores } from "./stores.js";
+import { emitPaging } from "./paging.js";
+import { emitWeb } from "./web.js";
+import { emitMcp } from "./mcp.js";
+import { emitValidation } from "./validation.js";
+import { refuseDeclarations } from "./refusals.js";
+import { emitHandlers } from "./handlers.js";
+import { emitAdminDescriptors } from "./adminDescriptors.js";
+import { emitAdminClient } from "./adminClient.js";
+import { emitSite } from "./site.js";
+import { emitTranslations } from "./translations.js";
+import { emitAdminBindings } from "./adminBindings.js";
+import { emitRest } from "./rest.js";
+const typeOf = (s) => {
+    if (!s)
+        return "unknown";
+    if (s.nullable === true)
+        return `${typeOf({ ...s, nullable: false })} | null`;
+    if (s.enum)
+        return s.enum.map(v => q(v)).join(" | ") || "never";
+    if (s.const !== undefined)
+        return q(s.const);
+    if (Array.isArray(s.type))
+        return s.type.map(type => typeOf({ ...s, type })).join(" | ") || "never";
+    switch (s.type) {
+        case "string": return "string";
+        case "integer":
+        case "number": return "number";
+        case "boolean": return "boolean";
+        case "null": return "null";
+        case "array": return `ReadonlyArray<${Array.isArray(s.items) ? "unknown" : typeOf(s.items)}>`;
+        case "object": return `{ ${Object.entries(s.properties ?? {}).map(([key, child]) => `readonly ${q(key)}${s.required?.includes(key) ? "" : "?"}: ${typeOf(child)};`).join(" ")} ${s.additionalProperties !== false ? "readonly [key: string]: unknown;" : ""} }`;
+        default: return "unknown";
+    }
+};
+export function generate(input) {
+    const { target, plan, lowered, viewKeys, newId, site, admin, paging } = input;
+    const diagnostics = [];
+    refuseDeclarations({ plan }, diagnostics);
+    const refuse = (path, message) => { diagnostics.push({ code: "GENERATE_UNSUPPORTED", path, message }); };
+    const isSqlite = sqlite(target);
+    const user = userReferences(plan, isSqlite);
+    const expected = isSqlite ? "@aotter/mantle/d1" : "@aotter/mantle/postgres";
+    if (lowered.dialect.name !== expected || plan.dialect.name !== expected)
+        refuse("target", `Target '${target}' needs canonical '${expected}' compilation and lowering.`);
+    const driver = driverFor(target);
+    const queryInputType = (schema, statements) => {
+        if (!schema?.properties)
+            return typeOf(schema);
+        const binds = statements.flatMap(s => s.binds).filter(b => b.k === "input");
+        const properties = Object.entries(schema.properties).map(([name, field]) => {
+            const bind = binds.find(b => b.k === "input" && name.toLowerCase() === String(b.name).toLowerCase());
+            if (!bind || bind.k !== "input")
+                return `readonly ${q(name)}${schema.required?.includes(name) ? "" : "?"}: ${typeOf(field)};`;
+            const type = String(bind.type);
+            const driverType = type === "json" ? typeOf(field) : type === "date" ? "string" : type === "timestamptz" ? "string | Date" : isSqlite
+                ? type === "bool" || parseNumeric(type) ? "number" : typeOf(field)
+                : parseNumeric(type) ? "number | string" : typeOf(field);
+            const nullable = field.nullable === true || Array.isArray(field.type) && field.type.includes("null") || !schema.required?.includes(name);
+            // D1 cannot bind undefined. Bound fields are explicit, null represents absence.
+            return `readonly ${q(name)}: ${driverType}${nullable ? " | null" : ""};`;
+        });
+        return `{ ${properties.join(" ")} ${schema.additionalProperties !== false ? "readonly [key:string]: unknown;" : ""} }`;
+    };
+    const inputFields = (schema, path) => {
+        const fields = Object.keys(schema?.properties ?? {});
+        if (new Set(fields.map(field => field.toLowerCase())).size !== fields.length)
+            refuse(path, "Input properties must have unique case-insensitive names. Rename input properties to be unique without regard to case.");
+        return fields;
+    };
+    // The dialect functions the bind recipes call, so a bundle carries only those (`binds` takes this object).
+    const values = new Set();
+    /** A statement as a constant: its text and how to bind it. */
+    const step = (s, path, fields, row = false) => {
+        const recipes = recipesOf(s, fields, message => refuse(path, message));
+        for (const r of recipes) {
+            if (r.k === "now" || r.k === "cutoff")
+                values.add(r.k);
+            else if (r.k === "input" && r.type)
+                values.add(r.type === "date" ? "date" : "timestamp");
+        }
+        return `{ sql: ${q(s.sql)}, binds: ${q(recipes)}${row ? ", row: true" : ""} }`;
+    };
+    const declarations = [], views = [], procedures = [], refProcedures = [];
+    const entries = {};
+    const base = "@aotter/mantle/";
+    const refNames = emitHandlers(plan, target !== "cloudflare-d1", typeOf, declarations, refProcedures);
+    const hasHandlers = refNames.length > 0;
+    for (const [index, [name, view]] of Object.entries(plan.views).sort().entries()) {
+        const path = `views/${name}`, fn = `view${index}`;
+        const modes = lowered.views[name];
+        const mode = view.surface === "public" ? "public" : "caller";
+        const c = modes?.[mode], trusted = modes?.trusted;
+        if (!c || (mode === "caller" && !trusted)) {
+            refuse(path, "Every reachable visibility mode must have canonical lowered SQL.");
+            continue;
+        }
+        const keys = Object.hasOwn(viewKeys, name) ? viewKeys[name] : undefined;
+        if (!keys || new Set(keys).size !== keys.length) {
+            refuse(path, "Dynamic or repeated View outputs need an explicit generated row contract. Give each SELECT output a unique explicit alias.");
+            continue;
+        }
+        const output = [], direct = tableOutputs(view, plan.schemas);
+        for (const key of keys) {
+            // A table column read unchanged keeps its NOT NULL (and gives a native column such as `id` its type); anything else may be NULL.
+            const type = outputType(plan, name, key) ?? direct[key]?.type;
+            // Declared timestamps and dates arrive formatted by the SQL itself (domain/wireScalars).
+            output.push(`readonly ${q(key)}: ${nativeType(type, isSqlite, direct[key]?.notNull)};`);
+        }
+        const fieldNames = inputFields(view.input, path + "/input");
+        const callerStep = step(c, path, fieldNames), trustedStep = mode === "caller" ? step(trusted, path, fieldNames) : callerStep;
+        declarations.push(`export type View${index}Input = ${queryInputType(view.input ?? { type: "object", additionalProperties: false }, [c, ...(trusted ? [trusted] : [])])};`, `export type View${index}Row = { ${output.join(" ")} };`, `export type View${index}WireRow = { ${keys.map(key => `readonly ${q(key)}: ${boundaryType(plan, name, key) ? wireType(boundaryType(plan, name, key), direct[key]?.notNull) : `View${index}Row[${q(key)}]`};`).join(" ")} };`, `const ${fn}Caller = ${callerStep} as const;`, ...(trustedStep !== callerStep ? [`const ${fn}Trusted = ${trustedStep} as const;`] : []), `async function ${fn}(db: ${isSqlite ? "Database" : "Unsafe"}, caller: Caller, raw: View${index}Input): Promise<View${index}Row[]> {`, ...auth(view.requires, path), ...(user.used ? ['  USER.modeOf(caller);'] : []), `  const m = ${trustedStep !== callerStep ? `${user.used ? 'USER.modeOf(caller) === "trusted"' : 'caller.kind === "system"'} ? ${fn}Trusted : ` : ""}${fn}Caller;`, `  return DRIVER.read(db, ${user.used ? "USER.scoped(m.sql, caller)" : "m.sql"}, binds(D, m.binds, caller, raw));`, "}");
+        views.push(`[${q(name)}]: ${fn}`);
+        declarations.push(`export { ${fn} as ${exportName("view", name)} };`);
+        entries[`views/${encodeURIComponent(name)}.ts`] = entry("view", name, `View${index}Input as Input, View${index}Row as Row, View${index}WireRow as WireRow`);
+    }
+    for (const [index, [name, procedure]] of Object.entries(plan.procedures).sort().entries()) {
+        const path = `procedures/${name}`, fn = `procedure${index}`;
+        if (!("sql" in procedure.handler))
+            continue;
+        const modes = lowered.procedures[name];
+        if (!modes?.caller || !modes.trusted) {
+            refuse(path, "Both caller and trusted SQL must be lowered.");
+            continue;
+        }
+        if ([...modes.caller, ...modes.trusted].some(s => s.publish || s.schema && plan.schemas[s.schema]?.publishing))
+            refuse(path, "A SQL Procedure cannot write a publishing Schema: create and edit its rows from a ref handler through the Store (`ctx.store.collection(...)`), and change status with the generated `<schema>.publish` / `.unpublish` / `.archive` transitions.");
+        const fieldNames = inputFields(procedure.input, path + "/input");
+        const steps = (statements) => `[${statements.map(s => step(s, path, fieldNames, s.kind === "row")).join(", ")}] as const`;
+        const same = steps(modes.caller) === steps(modes.trusted);
+        declarations.push(`export type Procedure${index}Input = ${queryInputType(procedure.input, [...modes.caller, ...modes.trusted])};`, `const ${fn}Caller = ${steps(modes.caller)};`, ...(same ? [] : [`const ${fn}Trusted = ${steps(modes.trusted)};`]), `async function ${fn}(db: Database, caller: Caller, raw: Procedure${index}Input): Promise<Output> {`, ...(modes.caller.some(s => s.kind !== "read") ? [`  if ("authenticatedAs" in caller && caller.authenticatedAs === "snapshot") (await import("@aotter/mantle/host-caller")).checkFresh(caller, false, ${q(path)});`] : []), ...auth(procedure.requires, path), ...(user.used ? ['  USER.modeOf(caller);'] : []), ...(procedure.trustedOnly ? [`  deny(caller, USER.modeOf(caller) === "trusted", ${q(path)});`] : []), `  return { results: await DRIVER.procedure(db, bound(D, ${user.used ? "USER.scopedAll(" : ""}${same ? "" : `${user.used ? 'USER.modeOf(caller) === "trusted"' : 'caller.kind === "system"'} ? ${fn}Trusted : `}${fn}Caller${user.used ? ", caller)" : ""}, caller, raw), ${q(path)}) };`, "}");
+        procedures.push(`[${q(name)}]: ${fn}`);
+        declarations.push(`export { ${fn} as ${exportName("procedure", name)} };`);
+        entries[`procedures/${encodeURIComponent(name)}.ts`] = entry("procedure", name, `Procedure${index}Input as Input`, `export type { Output } from "${base}contracts";\n`);
+    }
+    emitTtl(plan, isSqlite, declarations, procedures, entries, refuse);
+    emitPublishing(plan, isSqlite, declarations, procedures, entries, values, refuse);
+    const stores = emitStores(plan.schemas, isSqlite, newId, refuse, hasHandlers);
+    const surfaces = { ...emitPaging(plan, lowered, target, refuse, paging), ...emitPaging(plan, input.wireLowered ?? lowered, target, refuse, paging, true), ...emitValidation(plan, refuse), ...emitRest(plan, lowered, target, input.description), ...emitWeb(plan, lowered, target), ...emitMcp(plan, lowered, target, input.description, refuse, !!site), ...emitAdminDescriptors({ plan, admin }, diagnostics), ...emitAdminBindings(input, refuse), ...(admin ? emitAdminClient(plan, typeOf) : {}), ...emitSite(target, site, refuse, Object.keys(plan.schemas)), ...emitTranslations(plan, target) };
+    if (diagnostics.length)
+        return { ok: false, diagnostics };
+    const storeProcedures = hasHandlers ? "storeProcedures" : "procedures";
+    const code = [...(Object.keys(plan.access?.userFields ?? {}).length ? [`export const userFields = ${q(plan.access.userFields)} as const;`] : []), ...declarations, `export const views = { ${views.join(", ")} };`, `export const procedures = { ${procedures.join(", ")} };`, ...(stores ? [
+            `export type Tables = ${stores.tables};`, `const RULES = ${stores.rules} as const;`,
+            ...(hasHandlers ? [`const storeProcedures = { ${[...procedures, ...refProcedures].join(", ")} };`] : []),
+            `const initStore = () => createStore<Database, Tables, typeof DRIVER, { views: typeof views; procedures: typeof ${storeProcedures} }${hasHandlers ? ", { handlers: Handlers }" : ""}>(${user.used ? "{...DIALECT.dialect, ...USER_VALUES}" : "DIALECT.dialect"}, DRIVER, RULES, ${stores.facts}, { views, procedures: ${storeProcedures} });`,
+            `let makeStore: ReturnType<typeof initStore>;`,
+            `export function store${hasHandlers ? "<const H extends Handlers>" : ""}(db: Database, caller: Caller${hasHandlers ? ", options: { handlers: H & Record<Exclude<keyof H, keyof Handlers>, never> }" : ", _options?: { handlers?: Handlers }"}): ReturnType<typeof makeStore> { return (makeStore ??= initStore())(db, caller${hasHandlers ? ", options" : ""}); }`,
+        ] : [])].join("\n");
+    const dialect = `${base}dialect/${isSqlite ? "sqlite" : "postgres"}`;
+    const contracts = [...(target.endsWith("postgres") ? ["type Postgres as Database", ...(views.length ? ["type Unsafe"] : [])] : []), "type Caller", ...(hasHandlers ? ["ContractError"] : []), ...(/^  deny\(/m.test(code) ? ["deny", ...(/\bisAdmin\(/.test(code) ? ["isAdmin"] : []), ...(/\bisUser\(/.test(code) ? ["isUser"] : [])] : []), ...(procedures.length ? ["type Output"] : [])];
+    const dbType = isSqlite ? databaseImport(target) : "";
+    return { ok: true, refProcedures: refNames, files: generatedFiles({ ...surfaces, ...entries, "generated.ts": ["// Generated native application SQL. No runtime plan or interpreter.", user.code, dbType, `import { ${contracts.join(", ")} } from "${base}contracts";`,
+                ...(values.size || stores ? [`import * as DIALECT from "${dialect}";`] : []), `import * as DRIVER from "${base}driver/${driver}";`, ...((names => names.length ? [`import { ${names.join(", ")} } from "${base}store";`] : [])([...(stores ? ["createStore"] : []), ...(hasHandlers && target !== "cloudflare-d1" ? ["handlerTransaction"] : [])])),
+                `import { ${procedures.length ? "binds, bound" : "binds"} } from "${base}binds";`,
+                `const D = { ${[...values].sort().map(v => `${v}: DIALECT.${v}`).concat(user.values ? [user.values] : []).join(", ")} };`, code].filter(Boolean).join("\n") + "\n" }) };
+}

package/dist/usecase/handlers.js

@@ -0,0 +1,21 @@
+import { authLines as auth } from "../domain/input.js";
+import { q } from "../domain/entry.js";
+export function emitHandlers(plan, interactive, typeOf, declarations, procedures) {
+    const refs = Object.entries(plan.procedures).sort().map(([name, procedure], index) => ({ name, procedure, index })).filter(({ procedure }) => "ref" in procedure.handler);
+    // An empty contract keeps app wiring (`handlers: Handlers = {}`) identical whether or not any ref Procedure exists.
+    if (!refs.length) {
+        declarations.push("export interface Handlers {}");
+        return [];
+    }
+    declarations.push('export type HandlerStore = Pick<ReturnType<typeof makeStore>, "collection" | "views" | "procedures">;', 
+    // D1 has no interactive transactions, so its handlers get no `transaction`: using one there fails typecheck.
+    `export interface HandlerContext { readonly caller: Caller; readonly db: Database; readonly store: HandlerStore;${interactive ? " readonly transaction: <R>(fn: (ctx: { readonly store: HandlerStore; readonly db: Database }) => Promise<R>) => Promise<R>;" : ""} }`, "export interface Handlers {", ...refs.map(({ name, index }) => `  readonly [${q(name)}]: (ctx: HandlerContext, input: Procedure${index}Input) => Promise<Procedure${index}Output>;`), "}");
+    for (const { name, procedure, index } of refs) {
+        const path = `procedures/${name}`, fn = `procedure${index}`;
+        declarations.push(`export type Procedure${index}Input = ${typeOf(procedure.input ?? { type: "object", additionalProperties: false })};`, `export type Procedure${index}Output = ${typeOf(procedure.output)};`, `async function ${fn}(db: Database, caller: Caller, raw: Procedure${index}Input, context: { handlers: Handlers; store: HandlerContext["store"] }): Promise<Procedure${index}Output> {`, `  if ("authenticatedAs" in caller && caller.authenticatedAs === "snapshot") (await import("@aotter/mantle/host-caller")).checkFresh(caller, false, ${q(path)});`, ...auth(procedure.requires, path), "  const handlers = context?.handlers;", `  const handler = handlers && Object.hasOwn(handlers, ${q(name)}) ? handlers[${q(name)}] : undefined;`, `  if (!handler) throw new ContractError("HANDLER_NOT_REGISTERED", "Procedure handler is not registered.", ${q(path)});`, 
+        // TODO #1470: REST/MCP use shared generated validators at the boundary; bare calls stay typed.
+        `  return handler({ caller, db, store: context.store${interactive ? ", transaction: handlerTransaction(context.store, db)" : ""} }, raw);`, "}");
+        procedures.push(`[${q(name)}]: ${fn}`);
+    }
+    return refs.map(({ name }) => name);
+}

package/dist/usecase/mcp-media.js

@@ -0,0 +1,17 @@
+import { emitValidation } from "./validation.js";
+import { mediaDefinitions } from "../domain/generated-tools.js";
+export { mediaDefinitions };
+/** `definitions` are the versioned media tools, computed once by the MCP emitter. */
+export function emitMcpMedia(definitions, refuse) {
+    const inputs = Object.fromEntries(definitions.map(tool => [tool.name, { input: tool.inputSchema }]));
+    const checks = Object.fromEntries(Object.entries(emitValidation({ views: {}, procedures: inputs }, refuse)).map(([path, code]) => [path.replace("validation/procedures/", "validation/media/"), code]));
+    const invoke = { policy: 'async (db,caller) => ({purposes:(await site(db,caller).read()).media.purposes})', create: '(db,caller,input:Record<string,unknown>) => site(db,caller).media(storage()).createUpload(input)', commit: '(db,caller,input:Record<string,unknown>) => site(db,caller).media(storage()).commitUpload(input.uploadGroupId as string,input)', list: '(db,caller,input:Record<string,unknown>) => site(db,caller).media(storage()).list(input)', get: '(db,caller,input:Record<string,unknown>) => site(db,caller).media(storage()).get(input.id as string)', update: '(db,caller,input:Record<string,unknown>) => site(db,caller).media(storage()).update(input.id as string,input)', delete: '(db,caller,input:Record<string,unknown>) => site(db,caller).media(storage()).delete(input.id as string)' };
+    return { ...checks, "mcp-media.ts": `import { site } from "./site.js";
+import type { MediaStorage } from "@aotter/mantle/site";
+import type { Tool } from "@aotter/mantle/mcp";
+${definitions.map((tool, i) => `import { validate as v${i} } from "./validation/media/${tool.name}.js";`).join("\n")}
+export function mediaTools<Handlers = never>(storage: () => MediaStorage): Tool<Parameters<typeof site>[0], Handlers>[] { return [
+${definitions.map(({ action, ...tool }, i) => `{...${JSON.stringify({ ...tool, ...(tool.annotations.readOnlyHint ? { readOnly: true } : {}) })},surface:"admin",closed:true,validate:v${i},run:${invoke[action]}}`).join(",\n")}
+]; }
+` };
+}

package/dist/usecase/mcp.js

@@ -0,0 +1,100 @@
+/** Emit the selected MCP boundary; the official transport loads on its first request. */
+import { mcpToolNameSegment, procedureAnnotations, toolTitle, viewAnnotations } from "../build/compiler.js";
+import { emitMcpMedia, mediaDefinitions } from "./mcp-media.js";
+import { advertised, emitValidation } from "./validation.js";
+import { databaseImport, literal, q } from "../domain/entry.js";
+import { authLines, conversions } from "../domain/input.js";
+import { publishingAnnotations, publishingInput } from "./publishing.js";
+import { versioned } from "./tool-version.js";
+import { boundaryPage, outputConversions } from "../domain/columns.js";
+export function emitMcp(plan, lowered, target, description, refuse, media = false) {
+    if (!Object.values(plan.views).some(view => view.surface !== "internal") && !Object.values(plan.triggers).some(trigger => trigger.source.kind === "mcp"))
+        return {};
+    const reads = [];
+    const imports = plan.access ? ['import { userBinds } from "@aotter/mantle/user-fields";'] : [], tools = [];
+    const mediaTools = media ? mediaDefinitions().map(({ action, ...tool }) => ({ action, ...versioned({ ...tool, title: toolTitle(tool.name) }) })) : [];
+    const files = media ? emitMcpMedia(mediaTools, refuse) : {};
+    let hasRef = false, hasWire = false;
+    const names = new Set(mediaTools.map(tool => "admin:" + tool.name));
+    const guard = (requires, path, binds = [], trustedOnly = false) => {
+        const lines = authLines(requires, path, binds, !target.endsWith("postgres"), trustedOnly);
+        return lines.length ? `, check: (caller) => {${lines.join("")}}` : "";
+    };
+    const refs = Object.values(plan.procedures).some(p => "ref" in p.handler);
+    if (Object.values(plan.procedures).some(p => p.trustedOnly) || [...Object.values(plan.views), ...Object.values(plan.procedures)].some(p => p.requires?.auth?.all.length) || Object.values(plan.schemas).some(s => s.publishing))
+        imports.push('import { deny, isAdmin, isUser } from "@aotter/mantle/contracts";');
+    const add = (name, kind, surface, operation = kind === "views" ? plan.views[name] : plan.procedures[name], tool = mcpToolNameSegment(name)) => {
+        if (kind === "views")
+            reads.push({ name: tool, surface });
+        const ref = kind === "procedures" && !!plan.procedures[name] && "ref" in plan.procedures[name].handler;
+        hasRef ||= ref;
+        const statements = kind === "views" ? [lowered.views[name]?.public ?? lowered.views[name]?.caller] : lowered.procedures[name]?.caller ?? [];
+        const binds = statements.flatMap(statement => statement?.binds ?? []);
+        const index = tools.length, file = encodeURIComponent(name);
+        if (kind === "views")
+            imports.push(`import { validate as validate${index} } from "./validation/${kind}/${file}.js";`);
+        if (kind === "views") {
+            const module = `./${outputConversions(plan, name, target).some(([, type]) => type === "int") ? "paged/wire/views" : "paged/views"}/${file}.js`;
+            imports.push(`const run${index}: typeof import(${q(module)}).default = async (...args) => (await import(${q(module)})).default(...args);`);
+        }
+        // The kernel adds a View tool's `limit` and `cursor` paging properties.
+        const { inputSchema, description: about } = advertised(kind === "views" ? operation.input ?? { type: "object", additionalProperties: false } : operation.input, operation.description ?? operation.title ?? name), schema = literal(inputSchema);
+        if (kind === "views" && ("limit" in (operation.input?.properties ?? {}) || "cursor" in (operation.input?.properties ?? {})))
+            refuse(`views/${name}`, "MCP View input reserves limit and cursor for paging.");
+        if (names.has(surface + ":" + tool))
+            refuse(`${kind}/${name}`, `MCP tool name ${tool} collides on ${surface}.`);
+        names.add(surface + ":" + tool);
+        const convert = conversions(operation.input?.properties, binds, target), scopes = (operation.requires?.auth?.all ?? []).flatMap(p => typeof p === "object" && "ctx.auth.scope" in p ? [p["ctx.auth.scope"]] : []);
+        const procedure = kind === "procedures" ? plan.procedures[name] : undefined;
+        const output = kind === "procedures" ? ref ? (procedure?.output.type === "object" ? procedure.output : undefined) : { type: "object", properties: { results: { type: "array", items: { type: "array", items: { type: "object" } } } }, required: ["results"] } : undefined;
+        const annotations = kind === "views" ? viewAnnotations : procedure ? procedureAnnotations(procedure) : operation.mcp;
+        const wire = kind === "views" ? outputConversions(plan, name, target) : [];
+        // Hashed as listed: the kernel adds a View tool's paging properties exactly so.
+        const listed = versioned({ name: tool, title: operation.title ?? toolTitle(name), description: about, inputSchema: kind === "views" ? { ...inputSchema, properties: { ...inputSchema?.properties, limit: { type: "integer", minimum: 1, maximum: 500 }, cursor: { type: "string" } } } : inputSchema, outputSchema: output, annotations });
+        hasWire ||= wire.length > 0;
+        const fields = [...(description.targets.find(t => t._meta.id === `${kind === "views" ? "view" : "procedure"}:${name}`)?._meta.readOnly ? ["readOnly: true"] : []), `target: ${q({ kind: kind === "views" ? "view" : "procedure", name })}${guard(operation.requires, `${kind}/${name}`, binds, procedure?.trustedOnly)}`, `name: ${q(tool)}`, `surface: ${q(surface)}`, `title: ${q(listed.title)}`, `description: ${q(listed.description)}`, "inputSchema", ...(output ? [`outputSchema: ${literal(output)}`] : []), ...(annotations ? [`annotations: ${q(annotations)}`] : []), ...((operation.requires?.auth?.all.length ?? 0) > 0 ? ["closed: true"] : []), ...(scopes.length ? [`scopes: ${q(scopes)}`] : []), `validate: ${kind === "views" ? `validate${index}` : `async (raw) => (await import("./validation/procedures/${file}.js")).validate(raw)`}`, ...(convert ? [`convert: ${convert}`] : []),
+            ...(kind === "views" ? [`path: ${q(`views/${name}`)}`, `page: ${boundaryPage(`run${index}`, wire)}`] : [`run: ${ref ? `(db, caller, input, handlers) => store(db, caller, { handlers }).procedures[${q(name)}](input)` : `async (db, caller, input) => (await import("./procedures/${file}.js")).default(db, caller, input)`}`])];
+        tools.push({ fields: [...fields, `version: ${q(listed.version)}`], schema });
+    };
+    for (const [name, view] of Object.entries(plan.views))
+        if (view.surface !== "internal")
+            add(name, "views", view.surface);
+    const exposed = new Set();
+    for (const trigger of Object.values(plan.triggers))
+        if (trigger.source.kind === "mcp") {
+            const key = trigger.source.surface + ":" + trigger.procedure;
+            if (!exposed.has(key)) {
+                exposed.add(key);
+                add(trigger.procedure, "procedures", trigger.source.surface);
+            }
+        }
+    for (const schema of Object.values(plan.schemas))
+        if (schema.publishing)
+            for (const verb of ["publish", "unpublish", "archive"]) {
+                const name = `${schema.name}.${verb}`, input = publishingInput;
+                Object.assign(files, emitValidation({ views: {}, procedures: { [name]: { input } } }, refuse));
+                add(name, "procedures", "admin", { input, title: toolTitle(`${verb}_${schema.name}`), requires: { auth: { all: ["ctx.admin"] } }, mcp: publishingAnnotations(verb) }, mcpToolNameSegment(`${verb}_${schema.name}`));
+            }
+    if (hasWire)
+        imports.push('import { wireRows } from "@aotter/mantle/contracts";');
+    // An input schema several tools share is one constant.
+    const uses = new Map(), shared = new Map();
+    for (const { schema } of tools)
+        uses.set(schema, (uses.get(schema) ?? 0) + 1);
+    for (const [schema, count] of uses)
+        if (count > 1 && schema)
+            shared.set(schema, `schema${shared.size}`);
+    return { ...files, "mcp.ts": `${[`import { mcp as serve, type Options as McpOptions, type Tool } from "@aotter/mantle/mcp";`, databaseImport(target),
+            ...(media ? ['import type { MediaStorage } from "@aotter/mantle/site";'] : []),
+            'import type { Handlers } from "./generated.js";', ...(hasRef ? ['import { store } from "./generated.js";'] : []), ...imports,
+            ...[...shared].map(([schema, name]) => `const ${name} = ${schema};`)].join("\n")}
+export type Options<Env = unknown> = McpOptions<Env, Database> & { handlers${refs ? "" : "?"}: Handlers }${media ? " & { media?: (env: Env) => MediaStorage }" : ""};
+/** The generated tools, exported so an app can compose them with its own tools and MCP Apps. */
+export const tools: readonly Tool<Database, Handlers>[] = [
+${tools.map(({ fields, schema }) => `  { ${fields.map(field => field === "inputSchema" ? `inputSchema: ${shared.get(schema) ?? schema}` : field).join(", ")} },`).join("\n")}
+];
+export function mcp<Env = unknown>(options: Options<Env>): (request: Request, env: Env, ctx?: import("@aotter/mantle/contracts").RequestContext) => Promise<Response | undefined> {
+  return serve<Env, Database, Handlers>(${media ? `async (request, env) => [...tools, ...(options.media && new URL(request.url).pathname.replace(/\\/+$/, "") === "/mcp/admin" ? (await import("./mcp-media.js")).mediaTools<Handlers>(() => options.media!(env)) : [])]` : "tools"}, ${plan.access ? `{...options, fields: ${q(plan.access.userFields)}, accessTargets: () => import("./access-targets.js").then(m => m.targets)}` : '{...options, accessTargets: () => import("./access-targets.js").then(m => m.targets)}'}, ${media ? `[...${q(reads)}, ...(options.media ? ${q(mediaTools.filter(tool => tool.annotations.readOnlyHint).map(tool => ({ name: tool.name, surface: "admin" })))} : [])]` : q(reads)});
+}
+` };
+}

package/dist/usecase/paging.js

@@ -0,0 +1,71 @@
+import { userReferences } from "../domain/userReferences.js";
+/** Selected View boundary: Core prints keyset SQL once; bare operations retain native rows. */
+import { parseNumeric } from "../build/compiler.js";
+import { outputConversions } from "../domain/columns.js";
+import { authLines } from "../domain/input.js";
+import { driverFor, databaseImport, isSqlite, q } from "../domain/entry.js";
+import { recipesOf } from "../domain/recipes.js";
+export function emitPaging(plan, lowered, target, refuse, proofs, boundary = false) {
+    const files = {}, base = "@aotter/mantle/";
+    const sqlite = isSqlite(target);
+    const user = userReferences(plan, sqlite);
+    const driver = driverFor(target);
+    for (const [name, view] of Object.entries(plan.views)) {
+        if (boundary && (view.surface === "internal" || !outputConversions(plan, name, target).some(([, type]) => type === "int")))
+            continue;
+        const path = `views/${name}`, sel = view.stmts[0]?.SelectStmt;
+        const proof = proofs?.[name];
+        if (boundary && (!proof || !proof.types.length && !proof.single))
+            continue;
+        // Internal bare queries remain available even when they cannot be safely paged.
+        if (!proof || !proof.types.length && !proof.single) {
+            if (view.surface !== "internal")
+                refuse(path, proof?.reason ?? "Paged Views need a complete typed NOT NULL key tuple, indexed Schema order and a non-fanning relation, or a proved singleton. For a lookup by a unique field, end ORDER BY with the Schema's id (`ORDER BY t.id`).");
+            continue;
+        }
+        const mode = view.surface === "public" ? "public" : "caller";
+        const c = lowered.views[name]?.[mode], trusted = mode === "caller" ? lowered.views[name]?.trusted : undefined;
+        if (!c)
+            continue;
+        const hidden = new Set(Array.from({ length: c.nkeys }, (_, i) => `_k${i}`));
+        if (Object.values(c.paged).some(p => p.names.some(name => hidden.has(sqlite ? name.toLowerCase() : name)))) {
+            if (view.surface !== "internal")
+                refuse(path, "Paged output names must not collide with the compiler's hidden cursor keys.");
+            continue;
+        }
+        const cap = sel.limitCount?.A_Const?.ival?.ival ?? 500;
+        if (sel.limitCount && (!sel.limitCount.A_Const?.ival || !Number.isInteger(cap) || cap < 1)) {
+            refuse(path, "A paged View LIMIT must be a positive integer literal.");
+            continue;
+        }
+        const values = new Set();
+        const kinds = proof.types.map(type => {
+            if (type === "date" || type === "timestamptz")
+                values.add(type === "date" ? "date" : "timestamp");
+            return type === "bool" ? "bool" : type === "int4" ? "int4" : ["integer", "int8"].includes(type) ? "int" : parseNumeric(type) ? "numeric" : ["real", "float8"].includes(type) ? "float" : type === "date" ? "date" : type === "timestamptz" ? "timestamp" : "text";
+        });
+        const variants = [c, ...(trusted ? [trusted] : [])].map(v => {
+            const pages = Object.values(v.paged);
+            const first = pages.find(p => !p.sources.some(s => "cursor" in s)), next = pages.find(p => p.sources.some(s => "cursor" in s));
+            if (!first || v.nkeys !== proof.types.length || v.nkeys > 0 && !next) {
+                refuse(path, "Core could not lower this View's keyset pages.");
+                return "";
+            }
+            const recipes = recipesOf(v, Object.keys(view.input?.properties ?? {}), message => refuse(path, message), values);
+            const page = (p) => `{ sql: ${q(p.sql)}, extra: ${q(p.sources.map(s => "cursor" in s ? s.cursor : -1))} }`;
+            return `{ binds: ${q(recipes)}, first: ${page(first)}, next: ${page(next ?? first)} }`;
+        });
+        const auth = authLines(view.requires, path);
+        const spec = [`path: ${q(path)}`, `cap: ${cap}`, `sqlite: ${sqlite}`, `cursor: ${q(kinds)}`, `keys: ${c.nkeys}`, `values: {${user.used ? [...values].sort().concat(user.values).join(", ") : values.size ? ` ${[...values].sort().join(", ")} ` : ""}}`, "read", `caller: ${variants[0]}`, ...(trusted ? [`trusted: ${variants[1]}`] : []), ...(auth.length ? [`auth: (caller: Caller) => {\n${auth.join("\n")}\n  }`] : [])];
+        files[`paged/${boundary ? "wire/" : ""}views/${encodeURIComponent(name)}.ts`] = `${user.code ? user.code + "\n" : ""}import { page, type Paged } from "${base}paging";
+import { ${auth.length ? "deny, isAdmin, isUser, " : ""}type Caller${sqlite ? "" : ", type Unsafe as Database"} } from "${base}contracts";
+${sqlite ? databaseImport(target) + "\n" : ""}import { read } from "${base}driver/${driver}";
+${values.size ? `import { ${[...values].sort().join(", ")} } from "${base}dialect/${sqlite ? "sqlite" : "postgres"}";\n` : ""}import type { Input, Row } from "${boundary ? "../../../" : "../../"}views/${encodeURIComponent(name)}.js";
+const spec: Paged<Database> = {
+  ${spec.join(",\n  ")},
+};
+export default (db: Database, caller: Caller, input: Input, options?: { limit?: number; cursor?: string }) => page<Database, Row>(${user.used ? "{ ...spec, caller: USER.scopedAll(spec.caller, caller) }" : "spec"}, db, caller, input, options);
+`;
+    }
+    return files;
+}