@aotter/mantle 0.1.5-alpha.1 → 0.2.0-alpha.10

package/docs/handbook/start/project-and-cli.md

@@ -1,124 +1,71 @@
 ---
-description: Generate a full Mantle app or select smaller modules, then safely rerun the CLI as your manifests evolve.
+description: Generation targets, CLI options and ownership of native application files.
 ---
 # Project layout and CLI
 
-`mantle generate` can assemble a new application or compile manifests in an
-existing one. A new hosted app defaults to Spec, Runtime, API, MCP, Admin and
-an editable blank home. You can select a smaller set explicitly. It never
-invents a business Schema or publishes a deployment.
+| File | Owner |
+| --- | --- |
+| `manifests/*.yaml` | App: closed v2 declarations and SQL |
+| `src/worker.ts`, auth, handlers, frontend | App: routing, Caller verification and side effects |
+| `generated/` | Generator: TypeScript, native SQL and selected bindings |
+| `migrations/` | App's agent and native migration tool |
+| `wrangler.jsonc` | App configuration; generator maintains selected split-build keys |
+| `dist/` | Disposable bundle output (`dist/worker`, `dist/client`); do not commit |
 
-## Start a new app
+## Accept user-facing work
 
-Choose a host before running the command. The integrated hosts are `cf` and
-`chatgpt-sites`; `--features spec` works without a host. Install one exact
-published SDK version, then let the CLI declare its matching optional packages:
+Before reporting any user-facing deliverable as done, run the installed
+version's [independent acceptance
+flow](../guides/agent-workflow-acceptance.md) with a fresh agent on the surface
+its user uses. For MCP work, also run that guide's design audit before choosing
+tool names or writing manifests/handlers.
 
-```sh
-mkdir my-app && cd my-app
-npm init -y
-npm pkg set type=module
-MANTLE_VERSION=$(npm view @aotter/mantle@latest version)
-npm install --save-exact "@aotter/mantle@$MANTLE_VERSION"
-npx mantle generate --host cf
-npm install
-npx mantle generate
-npm run build
-```
-
-Confirm `MANTLE_VERSION` is a stable release, without a prerelease suffix.
-Use `--host chatgpt-sites` for a Site; [its guide](../chatgpt-sites/generated-app.md)
-continues with D1 migration, owner identity and local smoke. If you already
-use pnpm, keep that one package manager and run `pnpm install` /
-`pnpm exec mantle`. The first `generate` may exit asking you to install newly
-declared packages; the second completes generation. A README or lockfile from
-bootstrapping still counts as a new app. Once choices are saved, omit flags on
-rerun.
-
-For a smaller composition, list wanted modules positively:
+## Commands
 
 ```sh
-npx mantle generate --host cf --features spec,api
-npx mantle generate --features spec
+mantle help [topic]                  # these docs, one page at a time; start here
+mantle init [directory] [--dry-run]  # write the cloudflare-d1 app shell once; never overwrites
+mantle generate <target> <output-directory> <manifest>... [options]
+mantle bundle <entry> <outdir> [--assets <dir>]
 ```
 
-Dependencies are expanded in the saved selection: `api` includes Runtime and
-Spec; `admin` includes Runtime, API and MCP. Supported features are `spec`,
-`runtime`, `api`, `mcp`, `admin`, `web`. No host is needed for Spec-only. Use an
-explicit host in automation so a terminal prompt cannot stall. The selection
-lives in `mantle.config.json`; changing it later requires a deliberate migration,
-not an accidental CLI flag.
+`init` writes application code the app then owns. `generate` writes only generated output and Wrangler build keys,
+on every run; after writing, it follows the `--entry` file's imports and warns for each selected REST, MCP or Admin
+module the entry never imports.
 
-## Files and ownership
+| Target | Dialect | Handle |
+| --- | --- | --- |
+| `bun-sqlite` | sqlite | bun:sqlite Database |
+| `bun-postgres` | postgres | Bun.SQL |
+| `cloudflare-d1` | sqlite | D1 binding/session |
+| `cloudflare-postgres` | postgres | postgres.js, usually with Hyperdrive |
 
-| File | Owner | What happens on rerun |
-|---|---|---|
-| `manifests/*.yaml`, `src/handlers.ts`, `src/home.ts` | You | Preserved. Add domain behavior and edit the blank home here. |
-| `package.json`, `mantle.config.json`, `wrangler.jsonc` | Shared | Required versions and scripts are added; existing user values are preserved or conflicts reported. |
-| `.mantle/generated/*`, `src/storage-fingerprint.json` | CLI | Rebuilt from the saved selection and manifests. |
-| `drizzle/*.sql` on Sites | Review and apply | New migrations append; applied migrations are never rewritten. |
-| `public/_mantle/admin/*` | CLI | Prebuilt Admin assets copied from the selected exact package. |
-| `.openai/hosting.json` on Sites | Sites | Binding metadata is created locally; existing project metadata is preserved. |
+Other handles may adapt to the same [structural driver contracts](../guides/adapter-guide.md). Dialects are exactly postgres and sqlite in 0.2.0.
 
-A generated Worker imports the sealed `plan`, your handler map and the selected
-modules. Generated files carry a marker so the CLI can distinguish them from
-user-owned code. A rerun refuses to replace an unmarked file. Existing
-applications without a saved selection keep their direct-authoring compile
-behavior. For integration into an independently authored application, use the
-installed `docs/skills/integrate/SKILL.md` to choose an embedding, incremental
-replacement or rebuild strategy. Generation does not verify arbitrary host
-entry points or deployment wiring.
+| Option | Meaning |
+| --- | --- |
+| `--check` | Compare generated owned files and Wrangler build keys without writing; stale output exits nonzero. No database or credentials are needed. |
+| `--admin` | Emit native Admin bindings and `admin/*` modules; install the separate Admin package. |
+| `--auth <module>` | Read plain `authOptions(env)` (or an exported auth instance's options) and append selected Better Auth DDL. Repeat it once per Better Auth instance. Prefer plain options without initialization side effects. |
+| `--site <module>` | Read `siteDefaults`; emit site/media bindings and deployment SQL. |
+| `--wrangler <path>` | Existing JSONC/JSON/TOML config; default finds one or creates `wrangler.jsonc`. TOML receives manual-edit instructions. |
+| `--entry <path>` | Worker source entry; default `src/worker.ts`. |
+| `--outdir <path>` | Bundle output; default `dist`. The Worker goes to `<outdir>/worker`. Keep separate from source/generated files. |
+| `--assets <path>` | With `--admin`: the static assets directory `mantle bundle` builds Admin into (`<assets>/admin`); default `<outdir>/client`. Written to Wrangler's `assets.directory`, and to the build command when not the default. New assets blocks default to `ASSETS`, Worker-first routing and no HTML rewriting; existing blocks keep their binding/routing. |
 
-`generate` accepts `--manifests <dir>` (default `./manifests`), `--output <dir>`
-(default `.mantle/generated`), `--namespace <name>`, `--host cf|chatgpt-sites`,
-`--features <comma-list>` and `--check`. Check mode exits nonzero
-on drift and does not write. Sites also accepts `--review-unique-indexes` for
-an explicit, source-bound unique tuple migration and duplicate preflight;
-[review the D1 procedure](../chatgpt-sites/generated-app.md) before applying
-it. `mantle validate` checks grammar and linked
-capabilities; `--phase deploy` adds deployment checks. `mantle skills` projects
-the installed SDK's project skills into `.agents/skills/` and `.claude/skills/`;
-`mantle skills --check` detects drift. `mantle emit-openapi` describes HTTP
-Triggers and View REST routes; `mantle-harness indexes` and `http` inspect
-queries and running routes. [Command reference](../reference/surface.md).
+## Outputs
 
-## Verify the assembled app
-
-```sh
-npx mantle generate --check
-npx mantle skills
-npx mantle skills --check
-npm run typecheck
-npm run build
-npm run dev
-```
+`generated/.mantle-inputs.json` records the Mantle version, the target, and a hash of every input the run read (manifests and the
+`--auth` and `--site` modules). `mantle bundle`, which Wrangler runs for `wrangler dev` and every
+deploy, refuses to build when an input changed since, so stale generated code cannot run; regenerate and rebuild.
+Commit it with the other generated files.
+The bundle also prints notes, never errors, for SQL in the app's own code against Better Auth's tables (read users
+through `userOf(caller)` or `readIdentity(auth)` instead) and for Better Auth roles beyond `admin` and `user`.
 
-Run scripts that exist in the selected project; Spec-only has no server to
-start. Run `npx mantle validate` after adding the first Manifest: the validator
-reports `MANIFEST_ROOT_NOT_FOUND` on an intentionally empty app. A full
-Cloudflare app should serve the blank home and Admin assets.
-For local CF Admin, copy `.dev.vars.example` to `.dev.vars`, replace
-`ADMIN_EMAIL` with the intended owner's address and `BETTER_AUTH_SECRET` with
-a random 32-byte secret, and keep `PUBLIC_ORIGIN` equal to the loopback URL
-wrangler prints. Open `/admin/sign-in` with that email and read the OTP in
-wrangler logs. Check that `/_mantle/admin/assets/*` loads, an anonymous
-`/admin/api/site-settings` request is denied, and the signed-in owner can read
-it. Verify anonymous staff MCP access fails before claiming it works. A full
-Site must also apply its reviewed
-D1 migration before the Worker boots. The public MCP endpoint is discoverable
-without a staff session; the staff endpoint requires the host's verified
-identity and a Mantle role. See [MCP and agents](../concepts/mcp-and-agents.md).
+`generated.ts` exports typed queries and Store. Direct `views/<encoded-name>.ts` and `procedures/<encoded-name>.ts` entries export an operation and its types. Proved pageable Views also have `paged/views/*`; boundary checks live in `validation/*`. `admin-descriptors.ts`, `rest.ts` and `web.ts` are always emitted. Manifest exposure selects `mcp.ts`; `admin-bindings.ts`, `admin-client.ts` (browser-side types and hooks for `admin.tsx`) and `admin/*` require `--admin`. Auth and site are explicit options.
 
-For an already installed app, confirm `node_modules/@aotter/mantle/package.json`
-and the lockfile agree. Use that package's CLI and `docs/` tree; the latest
-GitHub handbook may describe a newer release. Keep all selected
-`@aotter/mantle*` packages on one exact version. The prior direct-authoring
-contract remains valid for older installed SDKs; upgrade deliberately using
-[release notes](../releases/index.md).
+Apply `schema.sql` only to an empty database. Later changes require [explicit migrations](../concepts/runtime-and-adapters.md#schema-installation-and-migrations); generation and runtime do not inspect the database. Ref declarations print the `Handlers` keys to implement.
 
-## Source
+Never edit generated output by hand. Merge manifests/options, regenerate with the same command, then review TypeScript and SQL diffs. Use that exact command with `--check` in CI. Unmarked app files are preserved. Imported option modules must be pure; generation does not make their side effects safe.
 
-- [Generate CLI](../../../packages/mantle/src/cli/generate.ts)
-- [Project selection and package pins](../../../packages/mantle/src/cli/generate-project.ts)
-- [Cloudflare assembly](../../../packages/mantle/src/cli/generate-cloudflare.ts)
-- [ChatGPT Sites assembly](../../../packages/mantle/src/cli/generate-sites.ts)
+On Workers, generation configures `mantle bundle` as Wrangler's build command. It emits minified split ESM into `<outdir>/worker` with a startup guard for eager Better Auth imports and for Admin's browser code (`@aotter/mantle-admin/app` and `/hooks`, which `generated/admin-client.ts` imports; they belong to `admin.tsx`). When the Worker imports `@aotter/mantle-admin/server`, it also builds Admin with Vite into `<assets>/admin` (`--assets`, default `<outdir>/client`), from `admin.tsx` beside the Worker entry or Admin's built-in entry; `src/admin.ts` is not an entry. The assets directory must not overlap the Worker directory, and neither the outdir nor the assets directory may be the working directory or contain the Worker entry. The built-in entry is not rebuilt while the installed `@aotter/mantle-admin` keeps its path and version and its direct dependencies and its `react`/`react-dom` peers keep theirs; an `admin.tsx` entry builds every time. The build needs no install scripts (`npm ci --ignore-scripts` works). A `package-lock.json` made on one OS can lack the native build binaries (rolldown, `@tailwindcss/oxide`, lightningcss) that npm installs per platform from `optionalDependencies`, so a lockfile made on macOS can fail the build on a Linux host; create the lockfile on the build platform or use pnpm. `wrangler dev` and `wrangler deploy` run that build command, so they need `node_modules`. The built output (`<outdir>/worker`, `<assets>`) never reads it, so a pipeline that deletes `node_modules` must run `wrangler deploy` first. On Bun, the app owns `Bun.serve`, its Database/SQL pool and scheduler; Bun runs the server as TypeScript, so for a `bun-*` target recorded in `.mantle-inputs.json`, `mantle bundle src/server.ts dist` skips the Worker bundle and builds only Admin, into `dist/client/admin` (read with `bunAdminAssets("dist/client/admin")`, adapted for `adminShell` as in service composition). See [service composition](../cloudflare/service-entry.md).

package/docs/handbook/start/quickstart-worker.md

@@ -1,203 +1,68 @@
 ---
-description: "Author a minimal Cloudflare Worker from scratch: one Schema, one public View, generate, validate, run locally and probe it with curl."
+description: Generate a small native D1 service and mount an application-owned Worker.
 ---
-# Quickstart: a minimal Worker
+# Quickstart: a service on Workers
 
-This page reproduces the API-only Worker reference as a direct-authoring
-walkthrough: View REST without Admin, Auth or a visitor frontend. For a new
-project, `mantle generate --host cf --features spec,api` assembles that smaller
-composition. Omit `--features` to include Admin, MCP and a blank home. The
-[local Admin tutorial](./quickstart-admin.md) covers an authored Worker entry.
-Pin every selected `@aotter/mantle*` package to one exact version; see
-[Versions](../reference/surface.md#versions).
+Create an application outside the SDK checkout. Install an exact released `@aotter/mantle` version, TypeScript, Wrangler and Cloudflare Worker types; `node_modules/@aotter/mantle/docs/examples/app-shell/package.json` lists the versions this release is tested with. Read that installed version's handbook; this page describes the native 0.2.0 contract.
 
-## Prerequisites
-
-- Node.js 22 or newer.
-- pnpm 9 or newer. The reference is tested with pnpm; see the npm note at the end of this page.
-- `wrangler` is installed as a project devDependency below. No Cloudflare account, D1 database or secret is needed for the local loop.
-
-## 1. `package.json`
-
-Step 5 adds the two Mantle packages at one exact version. For a prerelease
-evaluation, select its exact version explicitly rather than mixing channels.
-The entries below are the peers and tools used by this direct-authored reference.
-
-```json
-{
-  "name": "mantle-minimal-consumer",
-  "private": true,
-  "type": "module",
-  "scripts": {
-    "generate": "mantle generate",
-    "validate": "mantle validate",
-    "typecheck": "tsc --noEmit",
-    "dev": "wrangler dev --local --ip 127.0.0.1 --port 8787",
-    "check": "mantle generate && mantle generate --check && mantle validate && mantle skills && mantle skills --check && tsc --noEmit"
-  },
-  "dependencies": {
-    "better-auth": "1.7.2",
-    "hono": "^4.13.3",
-    "zod": "^4.5.4",
-    "aws4fetch": "^1.0.20"
-  },
-  "devDependencies": {
-    "@cloudflare/workers-types": "^5.20260907.1",
-    "typescript": "^6.0.3",
-    "wrangler": "^4.125.0"
-  },
-  "packageManager": "pnpm@9.15.0"
-}
-```
-
-The reference's own `check` script ends with `&& node smoke.mjs`, a test that starts the Worker and asserts the three probes in step 6. This walkthrough runs those probes by hand instead.
-
-Add a `tsconfig.json` that includes the generated module:
-
-```json
-{
-  "compilerOptions": {
-    "target": "ES2022",
-    "module": "ESNext",
-    "moduleResolution": "bundler",
-    "strict": true,
-    "noEmit": true,
-    "skipLibCheck": true,
-    "types": ["@cloudflare/workers-types"]
-  },
-  "include": ["src/**/*.ts", ".mantle/generated/**/*.ts"]
-}
-```
-
-## 2. `manifests/site.yaml`
-
-One publishing Schema and one public View. `mantle generate` never invents a Schema; this notes model is example business data.
+Save `manifests/tickets.yaml`:
 
 ```yaml
-apiVersion: cms.mantle.aotter.net/v1
+apiVersion: cms.mantle.aotter.net/v2
 kind: Schema
-metadata:
-  name: notes
+metadata: { name: tickets }
 spec:
-  title: Notes
+  title: Tickets
+  lifecycle: operational
+  indexes: [[ticketState]]
   schema:
     type: object
-    required: [title]
+    additionalProperties: false
+    required: [subject, ticketState]
     properties:
-      title: { type: string }
-  lifecycle: publishing
+      subject: { type: string }
+      ticketState: { type: string, enum: [open, closed] }
 ---
-apiVersion: cms.mantle.aotter.net/v1
+apiVersion: cms.mantle.aotter.net/v2
 kind: View
-metadata:
-  name: published-notes
+metadata: { name: tickets-by-state }
 spec:
   surface: public
-  from: notes
-  cache: { sharedMaxAge: 3600 }
-  fields: [id, title]
-  filter:
-    eq: { field: status, value: published }
-  limit: 20
-```
-
-## 3. `src/index.ts`
-
-The conventional Worker entry hands the sealed plan to the Cloudflare adapter.
-
-```ts
-import { createMantleWorker } from "@aotter/mantle/cloudflare";
-import { plan } from "../.mantle/generated/mantle.js";
-
-export default createMantleWorker({ plan });
-```
-
-`createMantleWorker` owns the D1 and assets bindings, Auth, Admin, View REST, HTTP Triggers, OAuth, MCP and cache policy. Application handlers and extra routes go through its `extend` option; see [the conventional Worker](../cloudflare/conventional-worker.md).
-
-## 4. `wrangler.jsonc`
-
-```jsonc
-{
-  "$schema": "node_modules/wrangler/config-schema.json",
-  "name": "mantle-reference",
-  "main": "src/index.ts",
-  "compatibility_date": "2026-09-08",
-  "compatibility_flags": ["nodejs_compat", "global_fetch_strictly_public"],
-  "observability": { "enabled": true },
-  "vars": { "MANTLE_AUTH_MODE": "self-managed" },
-  "d1_databases": [
-    { "binding": "DB", "database_name": "mantle-reference-local" }
-  ]
-}
-```
-
-Both compatibility flags are required by the adapter. `MANTLE_AUTH_MODE` must be explicit; `self-managed` without GitHub credentials is a deliberate partial configuration for this local reference, so Auth-owned routes fail closed while public routes work. Local `wrangler dev` creates the D1 database on demand; configure a real `database_id` and the full auth matrix before any remote deploy ([Authentication](../cloudflare/authentication.md)).
-
-## 5. Install, generate, validate, run
-
-```sh
-# Resolve once; for a requested prerelease, set its exact version instead.
-MANTLE_VERSION=$(pnpm view @aotter/mantle@latest version)
-pnpm add --save-exact "@aotter/mantle@$MANTLE_VERSION" "@aotter/mantle-cloudflare@$MANTLE_VERSION"
-pnpm exec mantle generate
-pnpm exec mantle validate
-pnpm exec wrangler dev --local --ip 127.0.0.1 --port 8787
-```
-
-`mantle validate` prints `OK  no issues (root: manifests, phase: preview)`. Wrangler prints `Ready on http://127.0.0.1:8787`. Use that origin in the next step. The Admin OTP path uses the same pin; `PUBLIC_ORIGIN` must match wrangler's printed origin there.
-
-## 6. Probe the Worker
-
-```sh
-curl -s http://127.0.0.1:8787/api/views/published-notes
-```
-
-```json
-{ "ok": true, "data": { "rows": [], "page": 1, "show": 20, "hasMore": false } }
+  input:
+    type: object
+    additionalProperties: false
+    required: [ticketState]
+    properties:
+      ticketState: { type: string, enum: [open, closed] }
+  sql: |
+    SELECT id, subject, ticketState AS "ticketState" FROM tickets
+    WHERE ticketState = input.ticketState
+    ORDER BY id ASC
 ```
 
-The View is served with no data because the local D1 is fresh. `show` follows the View's `limit` when the request carries no `?show=`; `?page=` and `?show=` are the reserved pagination params ([Reads: Views, REST and MCP](../concepts/views.md)).
-
 ```sh
-curl -i http://127.0.0.1:8787/
+pnpm exec mantle generate cloudflare-d1 generated manifests/tickets.yaml
+pnpm exec mantle generate cloudflare-d1 generated manifests/tickets.yaml --check
 ```
 
-`GET /` returns `404`. No visitor frontend is installed or rendered; `mantle-web` is optional composition and never owns an implicit home route. Add your own routes or templates when the product needs them ([Public web, SEO and cache](../cloudflare/public-web.md)).
+Write `src/worker.ts`:
 
-```sh
-curl -i http://127.0.0.1:8787/mcp/staff
+```ts
+import { rest } from '../generated/rest.js';
+interface Env { DB: D1Database }
+const api = rest<Env>({
+  db: env => env.DB,
+  caller: () => ({ kind: 'anonymous' }),
+});
+export default {
+  async fetch(request: Request, env: Env): Promise<Response> {
+    return await api(request, env) ?? new Response('Not found', { status: 404 });
+  },
+};
 ```
 
-`GET /mcp/staff` returns `503` with the error code `setup_incomplete` until `MANTLE_AUTH_MODE` is backed by a complete configuration. This is the expected fail-closed state; a working public endpoint is not evidence of a working Admin or MCP login.
-
-## What `mantle generate` wrote
-
-- `.mantle/generated/mantle.ts` — one module with the sealed `plan`, generated types (`MantleHandlers<Env>`), `createMantle` and `bindMantle`. The Worker entry above imports only `plan`.
-- `public/_mantle/admin/` — the Admin SPA, synced only when `@aotter/mantle-admin-ui` is installed. This project did not install it, so nothing is written there and `/admin` has no assets.
-
-This walkthrough uses the existing direct-authored Worker entry; in that legacy
-compile mode, `generate` expects the supplied manifests and does not add a
-home route. New applications can instead use `mantle generate --host cf`
-with `--features spec,api` for a smaller assembled Worker. The CLI never
-invents a Schema. `mantle generate --check` reports stale output without
-writing. The reference keeps `.mantle/`, `.agents/` and `.claude/` out of git
-and regenerates them in `check`; see [Project layout and CLI](./project-and-cli.md).
-
-## Next steps
+Set the database binding `DB`, Worker name and compatibility date in `wrangler.jsonc`. Generation adds the split build configuration. Apply `generated/schema.sql` explicitly to an empty local database, for example `pnpm exec wrangler d1 execute <database> --local --file generated/schema.sql`. The first request creates nothing.
 
-- [Quickstart: local Admin](./quickstart-admin.md) — opt-in Dev UI: ASSETS, prebuilt Admin, email OTP.
-- [Project layout and the CLI loop](./project-and-cli.md) — the files you own, every CLI flag, the daily check loop.
-- [The four atoms](../concepts/four-atoms.md) — add a Procedure and a Trigger to accept writes.
-- [Authentication](../cloudflare/authentication.md) — complete Auth so Admin and `/mcp/staff` open.
-- [Public web, SEO and cache](../cloudflare/public-web.md) — give the service a rendered public surface.
+Typecheck, then run `pnpm exec wrangler dev --local`. Query `/api/views/tickets-by-state?ticketState=open`; the response is `{ rows, nextCursor? }`. The empty database returns no rows. Use Store or a declared Procedure for writes.
 
-## Source
-- [`docs/examples/host-minimal-worker/README.md`](../../../docs/examples/host-minimal-worker/README.md)
-- [`docs/examples/host-minimal-worker/package.json`](../../../docs/examples/host-minimal-worker/package.json)
-- [`docs/examples/host-minimal-worker/tsconfig.json`](../../../docs/examples/host-minimal-worker/tsconfig.json)
-- [`docs/examples/host-minimal-worker/manifests/site.yaml`](../../../docs/examples/host-minimal-worker/manifests/site.yaml)
-- [`docs/examples/host-minimal-worker/src/index.ts`](../../../docs/examples/host-minimal-worker/src/index.ts)
-- [`docs/examples/host-minimal-worker/wrangler.jsonc`](../../../docs/examples/host-minimal-worker/wrangler.jsonc)
-- [`docs/examples/host-minimal-worker/smoke.mjs`](../../../docs/examples/host-minimal-worker/smoke.mjs)
-- [`docs/direct-authoring.md`](../../../docs/direct-authoring.md)
-- [`packages/mantle-runtime/src/domain/service/Pagination.ts`](../../../packages/mantle-runtime/src/domain/service/Pagination.ts)
+Commit generated files and Wrangler edits; keep bundle `dist/` untracked. Follow [service composition](../cloudflare/service-entry.md) to add auth, Admin or MCP and [deploy and operate](../cloudflare/deploy-and-operate.md) before changing schema or deploying.