@aotter/mantle 0.1.5-alpha.1 → 0.2.0-alpha.10

package/dist/build/spec/domain/model/SqlIr.d.ts

@@ -0,0 +1,129 @@
+/**
+ * Store SQL and its IR (ADR-0034). The IR is libpg-query's parse tree for the
+ * supported subset, with source locations stripped and every relation tagged
+ * `table` or `cte`. Mantle designs no node types, so nodes are typed loosely on
+ * purpose: the dialect's allowlist (`src/core/sql/allowlist.ts`), not a TypeScript type, constrains
+ * them.
+ *
+ * Pure types and constants only. Nothing here imports the parser.
+ */
+import type { DiagnosticCode } from "../../kernel/diagnostic.js";
+import type { UserScope } from "./UserFields.js";
+export type SqlNode = Record<string, any>;
+/** The PostgreSQL grammar version a plan records (libpg-query 18: PG 18.0.4). */
+export declare const PG_GRAMMAR = 180004;
+/** The `SQL_*` codes of the diagnostic kernel; each is described in docs/handbook/reference/diagnostics.md. */
+export type SqlDiagnosticCode = Extract<DiagnosticCode, `SQL_${string}` | `USER_FIELD_${string}` | "USER_REF_SCOPE_ONLY" | "AUTH_ROLE_REMOVED">;
+export interface SqlSchemaDef {
+    /** Translation reads share their parent's current visibility on this field. */
+    readonly translates?: {
+        readonly parent: string;
+        readonly on: string;
+    };
+    /** column that holds the owner; every read and write is filtered on it */
+    readonly scope?: string;
+    /** AND-joined value terms of the row template, beside the owner column `scope`. */
+    readonly userScopes?: readonly UserScope[];
+    /** a declared timestamptz field the author writes; a row is invisible once it is `ttlSeconds` old (a NULL never expires) */
+    readonly ttl?: string;
+    readonly ttlSeconds?: number;
+    /** lifecycle `publishing`: a public caller sees only published rows */
+    readonly publishing?: boolean;
+    /** declared fields and their Mantle types: text integer real bool json timestamptz date numeric(p,s) geo */
+    readonly fields: Readonly<Record<string, string>>;
+    /** lower-cased column -> the name the JSON Schema declares (the plan has it; `notNullColumns` reads it with `schema`) */
+    readonly names?: Readonly<Record<string, string>>;
+    /** the Schema's JSON Schema, of which storage reads only what is required and nullable */
+    readonly schema?: {
+        readonly required?: readonly string[];
+        readonly properties?: Readonly<Record<string, {
+            readonly type?: unknown;
+            readonly nullable?: boolean;
+            readonly enum?: readonly unknown[];
+            readonly oneOf?: readonly {
+                readonly const?: unknown;
+            }[];
+        }>>;
+    };
+}
+/**
+ * What the allowlist reads off every Schema of a context: computed from `schemas` (`schemaColumns`), once per plan by a caller that
+ * checks many programs against one plan, or per program when absent.
+ */
+export interface SchemaColumns {
+    /** every declared column name (a geo field also as its `_lat` and `_lng` columns) */
+    readonly known: ReadonlySet<string>;
+    /** the scope columns, folded */
+    readonly scopes: ReadonlySet<string>;
+    /** column name -> its type, when every Schema that declares it agrees */
+    readonly types: ReadonlyMap<string, string>;
+}
+export interface SqlContext {
+    readonly schemas: Readonly<Record<string, SqlSchemaDef>>;
+    /** `schemaColumns(schemas)`, precomputed; must be of these `schemas` */
+    readonly columns?: SchemaColumns;
+    /** declared input properties and their Mantle types */
+    readonly inputs: Readonly<Record<string, string>>;
+    readonly kind: "view" | "procedure";
+    /** a public View: a caller sees published rows only, even across a join */
+    readonly public?: boolean;
+    /**
+     * The Views a FROM may name (ADR-0037 decision 3), by name with `-` as `_`: an internal View's validated tagged SELECT, which the
+     * compiler expands as D1 CTE dependencies or native FROM subqueries, or why that View cannot be read. Compile side only.
+     */
+    readonly views?: Readonly<Record<string, {
+        readonly select?: SqlNode;
+        readonly refusal?: string;
+    }>>;
+}
+/** A refusal of Store SQL. `line` and `column` are 1-based; `token` is the source text there. */
+export interface SqlDiagnostic {
+    readonly code: SqlDiagnosticCode;
+    readonly message: string;
+    readonly offset?: number;
+    readonly line?: number;
+    readonly column?: number;
+    readonly token?: string;
+}
+/** What the plan carries for one SQL source: the grammar it was parsed by, and the IR statements. */
+export interface SqlPlan {
+    readonly grammar: number;
+    readonly stmts: readonly SqlNode[];
+}
+/** Shared-cache eligibility of validated, expanded View IR; source text is display metadata, not execution. */
+export declare function viewCacheProblem(stmts: readonly SqlNode[], schemas: Readonly<Record<string, SqlSchemaDef>>): string | undefined;
+/**
+ * The columns storage creates for a Schema, each with its type: the native ones, the scope field, `status` on a publishing Schema,
+ * and each field (a geo field as its `_lat` and `_lng` columns). `created_at`/`updated_at` are typed per dialect, so `native`.
+ */
+export declare function storageColumns(s: {
+    readonly fields?: Readonly<Record<string, string>>;
+    readonly scope?: string;
+    readonly publishing?: boolean;
+}): Map<string, string>;
+/** The aggregate functions either dialect's SQL may call: outside a window and without GROUP BY, one makes a select return one row even over none. */
+export declare const AGGREGATES: ReadonlySet<string>;
+/** The native columns storage declares NOT NULL (`status` only on a publishing Schema, the only one that has it); `author_id` is nullable. */
+export declare const NATIVE_NOT_NULL: ReadonlySet<string>;
+/** Each native field a manifest names (in an index, say) -> its storage column, which SQL names. */
+export declare const NATIVE_COLUMNS: Readonly<Record<string, string>>;
+/**
+ * The columns an `operational` Schema's database refuses NULL in beyond the native ones: each field its JSON Schema requires and
+ * does not allow null (a geo field as its two columns). A `publishing` Schema has none: its drafts may be incomplete. This is the one
+ * rule; the initial storage SQL of both dialects and the generated Store's `orderBy` type read it.
+ */
+export declare function notNullColumns(s: SqlSchemaDef): Set<string>;
+/** A field whose name is a column storage creates for something else (`_rid`, or another geo field's `_lat`/`_lng`), or undefined. */
+export declare function storageColumnClash(fields: Readonly<Record<string, string>>): string | undefined;
+/** The functions a Schema check may call, by their bare name: each takes one argument of a type SQLite and PostgreSQL both accept. */
+export declare const CHECK_FUNCTIONS: ReadonlyMap<string, {
+    readonly takes: readonly string[];
+    readonly returns: "text" | "integer" | "argument";
+}>;
+/**
+ * Why a Schema check cannot run in the table's DDL as written, or undefined. Storage prints a check unlowered into a trigger or
+ * CHECK constraint, so it names only `columns` (`storageColumns` of its own Schema, unqualified) through operators and
+ * `CHECK_FUNCTIONS`: no subquery, no cast, and nothing the runtime binds per request (`auth.uid()`, `now()`) or a dialect spells
+ * its own way. Operand types beyond the functions' arguments are the database's to check at boot.
+ */
+export declare function checkShapeProblem(v: unknown, columns: ReadonlyMap<string, string>): string | undefined;

package/dist/build/spec/domain/model/UserFields.d.ts

@@ -0,0 +1,21 @@
+export interface UserFieldSpec {
+    readonly type: "string" | "number";
+    readonly integer?: true;
+    readonly multiple: boolean;
+    readonly enum?: readonly (string | number)[];
+}
+/** One value term of a row template: `column IN auth.user('field')`. */
+export interface UserScope {
+    readonly column: string;
+    readonly field: string;
+    readonly type: "string" | "number";
+}
+export interface RowTemplate {
+    readonly owner?: string;
+    readonly terms: readonly {
+        readonly column: string;
+        readonly field: string;
+    }[];
+}
+/** AND-joined `column = auth.uid()` or `column IN auth.user('field')` terms only. */
+export declare function parseRowTemplate(text: unknown): RowTemplate | string;

package/dist/build/spec/domain/service/PlanFingerprint.d.ts

@@ -0,0 +1,7 @@
+import type { RuntimePlan } from "../model/RuntimePlan.js";
+/** JSON with sorted keys, so equal plans serialize to equal text whatever built them. */
+export declare function canonical(v: unknown): string;
+/** 32-bit FNV-1a (hex): a short deterministic name, not a security boundary. */
+export declare const fnv: (s: string) => string;
+/** SHA-256 (hex) of the plan without its own fingerprint: it crosses a trust boundary, so it is cryptographic (ADR-0032 decision 10). */
+export declare function planFingerprint(plan: Omit<RuntimePlan, "fingerprint">): Promise<string>;

package/dist/build/spec/kernel/diagnostic.d.ts

@@ -0,0 +1,108 @@
+/**
+ * Structured diagnostic shape — see ADR-0008. Used uniformly across
+ * static validation, boot-time, and runtime feedback. The public `test`
+ * phase remains reserved for consumer-authored test diagnostics; Core's
+ * shipped performance harnesses emit purpose-shaped reports instead.
+ *
+ * Codes are unprefixed UPPER_SNAKE strings; the `phase` field
+ * disambiguates which loop emitted each diagnostic. The same `code`
+ * may appear in multiple phases when it names the same root cause —
+ * AI consumers can group by code OR filter by phase.
+ *
+ * `candidates` is security-sensitive at runtime; `redactForWire`
+ * strips it before HTTP egress.
+ */
+export type Phase = "validate" | "test" | "boot" | "runtime";
+/**
+ * Closed catalog of diagnostic codes the SDK emits across all phases.
+ * Per ADR-0008, spec **defines** the catalog; runtime / cli / adapters
+ * **emit** them. Codes in the cross-phase and runtime-only sections
+ * below are not raised by spec source — they live here because the
+ * catalog is the public contract, not the union of what spec happens
+ * to throw today. Adding a new code is a grammar-revise event
+ * (ADR-0001).
+ *
+ * Single source of truth: the const array drives `DiagnosticCode`
+ * (type), so adding a code is one edit.
+ */
+export declare const DIAGNOSTIC_CODES: readonly ["AUTH_ROLE_REMOVED", "USER_FIELD_VALUES_UNENUMERATED", "USER_FIELD_INVALID", "USER_FIELD_CONFLICT", "USER_FIELD_POSITION", "USER_REF_SCOPE_ONLY", "USER_SCOPE_PUBLIC_ANON_EMPTY", "RESOURCE_EXHAUSTED", "RESOURCE_UNAVAILABLE", "RATE_LIMITED", "OUTCOME_UNKNOWN", "PARTIAL_FAILURE", "PRECONDITION_FAILED", "INVALID_MANIFEST_ENVELOPE", "DUPLICATE_NAME", "VIEW_INPUT_INVALID_SHAPE", "VIEW_INPUT_RESERVED_NAME", "VIEW_CACHE_INVALID", "VIEW_UI_INVALID", "REQUIRED_FIELD_UNKNOWN", "INVALID_PATTERN", "JSON_SCHEMA_UNSUPPORTED", "JSON_SCHEMA_REF_INVALID", "JSON_SCHEMA_LIMIT_EXCEEDED", "AUTH_PREDICATE_NOT_IN_ENUM", "GUARD_PROCEDURE_UNKNOWN", "GUARD_SELF_REFERENCE", "GUARD_PROCEDURE_NOT_REF", "GUARD_CHAIN_NOT_ALLOWED", "SCHEMA_INDEX_INVALID", "SCHEMA_INDEX_FIELD_UNKNOWN", "UNIQUE_INDEX_FIELD_UNKNOWN", "SCHEMA_SEARCH_INVALID", "SCHEMA_SEARCH_FIELD_UNKNOWN", "SCHEMA_TTL_INVALID", "SCHEMA_UI_INVALID", "SCHEMA_NAME_CASE_COLLISION", "SCHEMA_READER_NAME_COLLISION", "FIELD_NAME_CASE_COLLISION", "MANIFEST_ROOT_NOT_FOUND", "MANIFEST_READ_FAILED", "GENERATE_FEATURE_DEPENDENCY_MISSING", "SQL_SYNTAX", "SQL_UNSUPPORTED", "SQL_FUNCTION", "SQL_RELATION", "SQL_COLUMN", "SQL_WRITE", "SQL_SHAPE", "SQL_TYPE", "FIXTURE_SCHEMA_VIOLATION", "HANDLER_NOT_REGISTERED", "HANDLER_NOT_DECLARED", "PLAN_FINGERPRINT_MISMATCH", "SCHEDULE_NOT_WIRED", "STORAGE_CHANGE_BLOCKED", "STORAGE_TABLE_NOT_OWNED", "INVOCATION_DEPTH_EXCEEDED", "TRIGGER_TARGET_PROCEDURE_UNKNOWN", "SCHEDULE_INPUT_INVALID", "SCHEDULE_AUTH_INVALID", "TRIGGER_PATH_COLLISION", "TRIGGER_PATH_INVALID", "MCP_TOOL_NAME_COLLISION", "MCP_TOOL_DESCRIPTION_MISSING", "MCP_TOOL_INPUT_UNION_AMBIGUOUS", "MCP_TOOL_INPUT_UNBOUNDED", "MANTLE_REF_INVALID", "PROCEDURE_TARGET_INVALID", "PROCEDURE_NOT_FOUND", "NOT_FOUND", "METHOD_NOT_ALLOWED", "LIFECYCLE_SCHEMA_UNKNOWN", "LIFECYCLE_HOOK_REJECTED", "LIFECYCLE_TARGET_NOT_REF", "SCHEMA_LOCALIZED_REQUIRES_SITE_LOCALES", "TRANSLATES_PARENT_UNKNOWN", "TRANSLATES_REQUIRES_LOCALIZED", "TRANSLATES_REQUIRES_CONTENT_FIELD", "TRANSLATES_FIELD_NOT_IN_PARENT", "TRANSLATES_FIELD_NOT_IN_CHILD", "TRANSLATES_PARENT_IS_LOCALIZED", "SCHEMA_TTL_TRANSLATION_UNSUPPORTED", "INPUT_VALIDATION_FAILED", "UNAUTHENTICATED", "AUTH_DENIED", "ENTITLEMENT_REQUIRED", "CONFLICT", "DISPATCHER_NOT_BUILT", "INTERNAL_ERROR", "OUTPUT_VALIDATION_FAILED", "INVALID_LOCALE", "MEDIA_NOT_CONFIGURED", "SITE_NOT_CONFIGURED", "MEDIA_UPLOAD_EXPIRED", "MEDIA_OBJECT_NOT_FOUND", "MEDIA_MIME_REJECTED", "MEDIA_SIZE_EXCEEDED", "MEDIA_SVG_REJECTED", "MEDIA_CHECKSUM_MISMATCH", "MEDIA_PURPOSE_REJECTED", "MEDIA_VARIANTS_INCOMPLETE", "MEDIA_VARIANT_SIZE_EXCEEDED", "MEDIA_VARIANTS_SUSPICIOUS_SIZE", "MEDIA_ASSET_NOT_FOUND"];
+export type DiagnosticCode = (typeof DIAGNOSTIC_CODES)[number];
+export interface SourcePosition {
+    readonly line: number;
+    readonly column: number;
+    readonly offset: number;
+}
+export interface SourceSpan {
+    readonly start: SourcePosition;
+    readonly end: SourcePosition;
+}
+/** Authored location retained independently from a rendered diagnostic path. */
+export interface SourceLocation {
+    readonly sourceId: string;
+    readonly documentIndex: number;
+    /** JSON Pointer inside the YAML document. */
+    readonly path: string;
+    readonly span?: SourceSpan;
+}
+export interface Diagnostic {
+    readonly code: DiagnosticCode;
+    readonly phase: Phase;
+    readonly severity: "error" | "warning";
+    readonly path: string;
+    readonly source?: SourceLocation;
+    readonly value?: unknown;
+    readonly expected?: string;
+    readonly candidates?: readonly string[];
+    readonly suggestion?: string;
+    readonly message: string;
+    /** Safe effect/retry facts supplied by a port; never provider payloads. */
+    readonly failure?: {
+        readonly outcome: "not-applied" | "partial" | "unknown";
+        readonly retry: "never" | "after-change" | "safe" | "reconcile";
+        readonly resource?: string;
+    };
+    /** Why a `CONFLICT` write failed (ADR-0032 decision 1); `opIndex` names the statement in the batch (ADR-0034). */
+    readonly conflict?: {
+        readonly opIndex?: number;
+        readonly reason: "lock" | "expect" | "unique";
+    };
+}
+/**
+ * Build a Diagnostic with a derived default `message`. Call sites may supply
+ * contextual prose, but the structured fields remain authoritative.
+ */
+export declare function makeDiagnostic(input: Omit<Diagnostic, "message"> & {
+    message?: string;
+}): Diagnostic;
+/** Phase-stamping helpers — equivalent to `makeDiagnostic({...input, phase})`
+ *  but read cleaner at call sites. `phase: "test"` has no Core helper because
+ *  the shipped performance harnesses emit purpose-shaped reports; the phase
+ *  remains part of the public Diagnostic contract for consumer tests. */
+export declare const validateDiagnostic: (input: PhaselessInput) => Diagnostic;
+export declare const bootDiagnostic: (input: PhaselessInput) => Diagnostic;
+export declare const runtimeDiagnostic: (input: PhaselessInput) => Diagnostic;
+type PhaselessInput = Omit<Diagnostic, "phase" | "message"> & {
+    message?: string;
+};
+declare const BRAND: unique symbol;
+/**
+ * Throwable carrier for one or more Diagnostics. Layers that surface
+ * an error across a transport boundary (HTTP handler, MCP tool call,
+ * render pipeline) throw this so the boundary catch can detect a
+ * structured payload and emit it on the wire instead of falling back
+ * to the INTERNAL_ERROR envelope reserved for genuinely unexpected
+ * throws.
+ */
+export declare class DiagnosticError extends Error {
+    /**
+     * A handler bundled with its own copy of this class (a closed-module artifact) still throws a DiagnosticError: `instanceof`
+     * matches the brand, not the class identity, so the runtime keeps its code instead of reporting INTERNAL_ERROR.
+     */
+    static [Symbol.hasInstance](value: unknown): boolean;
+    readonly [BRAND] = true;
+    readonly diagnostics: readonly Diagnostic[];
+    constructor(diagnostic: Diagnostic | readonly Diagnostic[], options?: ErrorOptions);
+    /** First diagnostic — convenience for single-diagnostic call sites. */
+    get diagnostic(): Diagnostic;
+}
+export {};

package/dist/bun/assets.d.ts

@@ -0,0 +1,2 @@
+/** Native file response, or null for missing or invalid paths. */
+export declare function bunAdminAssets(root: string): (path: string) => Promise<Response | null>;

package/dist/bun/assets.js

@@ -0,0 +1,24 @@
+/** Bun owns files; no SQLite, runtime or compiler import enters this optional host reader. */
+import { realpath, stat } from "node:fs/promises";
+import { resolve, sep } from "node:path";
+/** Native file response, or null for missing or invalid paths. */
+export function bunAdminAssets(root) {
+    const base = resolve(root);
+    return async (path) => {
+        try {
+            path = decodeURIComponent(path);
+        }
+        catch {
+            return null;
+        }
+        if (/[\u0000-\u001f\\]/.test(path))
+            return null;
+        const target = resolve(base, `.${path}`);
+        if (!target.startsWith(`${base}${sep}`))
+            return null;
+        const physical = await realpath(target).catch(() => "");
+        if (!physical || !physical.startsWith(`${await realpath(base)}${sep}`) || !(await stat(physical)).isFile())
+            return null;
+        return new Response(Bun.file(physical));
+    };
+}

package/dist/domain/adminOrder.js

@@ -0,0 +1,24 @@
+/** Selected Admin orders mirror the existing UI's indexed, required fields and native controls. */
+import { adminIndexColumns, NATIVE_NOT_NULL, notNullColumns } from "../build/compiler.js";
+import { dialect as sqlite } from "../kernel/dialect/sqlite.js";
+import { dialect as postgres } from "../kernel/dialect/postgres.js";
+import { declaredType } from "./columns.js";
+export function adminOrder(schema) {
+    const notNull = notNullColumns(schema);
+    const fields = adminIndexColumns(schema);
+    return Object.fromEntries(["id", "updated_at", ...(schema.publishing ? ["status"] : []), ...fields].flatMap(f => {
+        const type = declaredType(schema.fields, f) ?? "text";
+        const kind = type === "text" ? "text" : type === "bool" ? "bool" : type === "int4" ? "int4" : ["integer", "int8"].includes(type) ? "int" : ["real", "float8"].includes(type) ? "float" : type === "date" ? "date" : type === "timestamptz" ? "timestamp" : undefined;
+        return kind ? [[f, [kind, !NATIVE_NOT_NULL.has(f) && !notNull.has(f)]]] : [];
+    }));
+}
+/** Deployment-only indexes; no request attempts to converge storage. */
+export function adminIndexes(schemas, isSqlite) {
+    const d = isSqlite ? sqlite : postgres;
+    return Object.values(schemas).flatMap(s => ["created_at", "updated_at", ...(s.publishing ? ["status"] : [])].flatMap(field => [[], ...(s.scope ? [[s.scope]] : [])].flatMap(prefix => {
+        const columns = [...prefix, field, "id"];
+        if ([...(s.indexes ?? []), ...(s.unique ?? [])].some(i => columns.every((c, n) => i[n] === c)))
+            return [];
+        return [`CREATE INDEX ${d.ident(`_mantle_admin_${s.name}_${prefix.length ? "scoped_" : ""}${field}`)} ON ${d.ident(s.name)} (${columns.map(d.ident).join(", ")})`];
+    })));
+}

package/dist/domain/columns.js

@@ -0,0 +1,57 @@
+/** What a column's Mantle type means to generated code, in one place: Views, Stores and wire forms all read it here. */
+import { jsonOutputs, viewOutputs } from "../build/compiler.js";
+/** A column's declared type, including the system version and timestamps. @internal */
+/** A JSON Schema `readOnly` property is server-maintained (counters, totals): Admin's generic writes never set it. */
+export const serverOwned = (schema, column) => Object.entries(schema.properties ?? {}).some(([name, property]) => name.toLowerCase() === column && property?.readOnly === true);
+export const declaredType = (fields, column) => fields[column] ?? (column === "version" ? "integer" : column === "created_at" || column === "updated_at" || column === "published_at" ? "timestamptz" : undefined);
+/** A computed output that is a JSON document by construction (json_group_array, json_set, jsonb_agg, …) is typed `json`. */
+const computedJson = (plan, view, key) => jsonOutputs(plan.views[view]).has(key);
+/** Compiler-owned schema type metadata, including aggregates that inherit a field's presentation type and computed JSON documents. @internal */
+export function outputType(plan, view, key) {
+    const columns = plan.views[view]?.columns;
+    const field = columns && Object.hasOwn(columns, key) ? columns[key] : undefined;
+    const schema = field && plan.schemas[field.schema];
+    return schema ? declaredType(schema.fields, field.field) : computedJson(plan, view, key) ? "json" : undefined;
+}
+/** Transport lineage excludes other expressions/aggregates; existing temporal SQL formatting is retained. */
+export function boundaryType(plan, view, key) {
+    const field = viewOutputs(plan.views[view], plan.schemas, new Map(), false, false).columns[key];
+    const type = outputType(plan, view, key);
+    return field || type === "date" || type === "timestamptz" || computedJson(plan, view, key) ? type : undefined;
+}
+/** Declared output lineage and computed JSON documents; other computed columns retain their native values. */
+export function outputConversions(plan, view, target) {
+    const postgres = target.endsWith("postgres");
+    const columns = viewOutputs(plan.views[view], plan.schemas, new Map(), false, false).columns;
+    return [...Object.keys(columns), ...jsonOutputs(plan.views[view])].flatMap(key => {
+        const type = outputType(plan, view, key);
+        return conversion(key, type, !postgres);
+    });
+}
+/** Shared static conversion recipe for Views and Admin collections. */
+export function conversion(key, type, sqlite) {
+    return type && ["integer", "int8", "int4"].includes(type) ? [[key, "int"]]
+        : sqlite && (type === "json" || type === "bool") ? [[key, type]] : [];
+}
+/** Client-visible declared output type, identical on every target. */
+export function wireType(type, notNull = false) {
+    const value = !type ? "unknown" : ["integer", "int8", "int4"].includes(type) ? "number | string"
+        : scalarType(type);
+    return value === "unknown" || notNull ? value : `${value} | null`;
+}
+const scalarType = (type) => type === "bool" ? "boolean" : ["integer", "int4", "int8", "real", "float8"].includes(type) ? "number" : type === "json" ? "unknown" : type === "geo" ? "{lat:number;lng:number}" : "string";
+/**
+ * The driver-native value a column of this type comes back as, `| null` unless `notNull`; declared timestamps and dates arrive as the
+ * SQL's wire-form text. A column with no declared type (a computed output) is `unknown`, which already includes null. @internal
+ */
+export function nativeType(type, sqlite, notNull = false) {
+    const native = !type ? "unknown" : ["date", "timestamptz"].includes(type) ? "string" : sqlite
+        ? type === "bool" ? "number" : type === "json" ? "string" : scalarType(type)
+        : ["integer", "int8"].includes(type) ? "number | string | bigint" : scalarType(type);
+    return notNull || native === "unknown" ? native : `${native} | null`;
+}
+/** The value a caller of the typed Store passes for a column of this type. JSON is an object or array (the Store tells it by its JS type, so a bare string would be bound as text). @internal */
+export const inputType = (type) => type === "timestamptz" ? "string | Date" : type === "json" ? "object" : scalarType(type);
+/** Wrap only a selected transport page. */
+export const boundaryPage = (page, fields) => fields.length
+    ? `(db, caller, input, paging) => ${page}(db, caller, input, paging).then(page => ({ ...page, rows: wireRows(page.rows, ${JSON.stringify(fields)}) }))` : page;