@aotter/mantle 0.1.5-alpha.1 → 0.2.0-alpha.2

package/dist/cloudflare/index.d.ts

@@ -0,0 +1,21 @@
+/** `@aotter/mantle/cloudflare`: the D1 driver. Structural types, so this needs no `@cloudflare/workers-types`. */
+import type { DatabaseDriver } from "../core/driver.js";
+import type { SiteDefaults } from "../spec/domain/index.js";
+interface D1PreparedStatement {
+    bind(...values: unknown[]): D1PreparedStatement;
+}
+interface D1Database {
+    prepare(sql: string): D1PreparedStatement;
+    batch(statements: D1PreparedStatement[]): Promise<{
+        results?: Record<string, unknown>[];
+    }[]>;
+}
+export declare function d1Driver(db: D1Database): DatabaseDriver;
+/** D1 storage for `createMantle`: `storage: (env) => d1Storage(env.DB)`. */
+export declare const d1Storage: (db: D1Database, options?: {
+    timeZone?: string;
+    site?: SiteDefaults;
+}) => import("../core/service.js").MantleStorageAdapter;
+export { r2MediaStorage, type R2MediaStorageOptions } from "./r2Media.js";
+export { toCloudflareCron } from "../spec/domain/service/CloudflareCron.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/cloudflare/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cloudflare/index.ts"],"names":[],"mappings":"AAAA,kHAAkH;AAClH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAExD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAE5D,UAAU,mBAAmB;IAAG,IAAI,CAAC,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,mBAAmB,CAAA;CAAE;AACjF,UAAU,UAAU;IAClB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,mBAAmB,CAAC;IAC1C,KAAK,CAAC,UAAU,EAAE,mBAAmB,EAAE,GAAG,OAAO,CAAC;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAA;KAAE,EAAE,CAAC,CAAC;CAC9F;AAED,wBAAgB,QAAQ,CAAC,EAAE,EAAE,UAAU,GAAG,cAAc,CAOvD;AAED,4EAA4E;AAC5E,eAAO,MAAM,SAAS,GAAI,IAAI,UAAU,EAAE,UAAU;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,YAAY,CAAA;CAAE,sDAAkE,CAAC;AACjK,OAAO,EAAE,cAAc,EAAE,KAAK,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC"}

package/dist/cloudflare/index.js

@@ -0,0 +1,14 @@
+import { sqliteStorage } from "../d1/index.js";
+export function d1Driver(db) {
+    return {
+        async batch(statements) {
+            const out = await db.batch(statements.map((s) => db.prepare(s.sql).bind(...(s.binds ?? []))));
+            return out.map((r) => ({ rows: r.results ?? [] }));
+        },
+    };
+}
+/** D1 storage for `createMantle`: `storage: (env) => d1Storage(env.DB)`. */
+export const d1Storage = (db, options) => sqliteStorage(d1Driver(db), { ...options, maxBindings: 100 });
+export { r2MediaStorage } from "./r2Media.js";
+export { toCloudflareCron } from "../spec/domain/service/CloudflareCron.js";
+//# sourceMappingURL=index.js.map

package/dist/cloudflare/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cloudflare/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAS/C,MAAM,UAAU,QAAQ,CAAC,EAAc;IACrC,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,UAAU;YACpB,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9F,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;QACrD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,EAAc,EAAE,OAAoD,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,EAAE,GAAG,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;AACjK,OAAO,EAAE,cAAc,EAA8B,MAAM,cAAc,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC"}

package/dist/cloudflare/r2Media.d.ts

@@ -0,0 +1,43 @@
+import type { MediaStorage } from "../core/site.js";
+interface R2Head {
+    readonly size: number;
+    readonly httpMetadata?: {
+        contentType?: string;
+    };
+    readonly customMetadata?: Record<string, string>;
+}
+interface R2Bucket {
+    head(key: string): Promise<R2Head | null>;
+    get(key: string): Promise<(R2Head & {
+        readonly body: ReadableStream;
+    }) | null>;
+    put(key: string, body: ReadableStream, options: {
+        httpMetadata: {
+            contentType: string;
+        };
+        customMetadata: Record<string, string>;
+    }): Promise<unknown>;
+    delete(key: string): Promise<void>;
+}
+/** `aws4fetch`'s `AwsClient` has this shape. */
+interface S3Signer {
+    sign(url: string, init: {
+        method: "PUT";
+        aws: {
+            signQuery: true;
+            service: "s3";
+        };
+    }): Promise<{
+        url: string;
+    }>;
+}
+export interface R2MediaStorageOptions {
+    readonly bucket: R2Bucket;
+    readonly signer: S3Signer;
+    /** This bucket's S3 endpoint, e.g. `https://<bucket>.<account>.r2.cloudflarestorage.com`. */
+    readonly endpoint: string;
+    readonly publicBase: string;
+}
+export declare function r2MediaStorage({ bucket, signer, endpoint, publicBase }: R2MediaStorageOptions): MediaStorage;
+export {};
+//# sourceMappingURL=r2Media.d.ts.map

package/dist/cloudflare/r2Media.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"r2Media.d.ts","sourceRoot":"","sources":["../../src/cloudflare/r2Media.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,YAAY,EAAgB,MAAM,iBAAiB,CAAC;AAElE,UAAU,MAAM;IACd,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACjD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClD;AACD,UAAU,QAAQ;IAChB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC1C,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,MAAM,GAAG;QAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IAC/E,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE;QAAE,YAAY,EAAE;YAAE,WAAW,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACrJ,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpC;AACD,gDAAgD;AAChD,UAAU,QAAQ;IAChB,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE;QAAE,MAAM,EAAE,KAAK,CAAC;QAAC,GAAG,EAAE;YAAE,SAAS,EAAE,IAAI,CAAC;YAAC,OAAO,EAAE,IAAI,CAAA;SAAE,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC/G;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC1B,6FAA6F;IAC7F,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAOD,wBAAgB,cAAc,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,qBAAqB,GAAG,YAAY,CAoD5G"}

package/dist/cloudflare/r2Media.js

@@ -0,0 +1,69 @@
+/**
+ * `MediaStorage` on R2, public bucket only. The binding reads, copies and deletes objects; it cannot presign, so the PUT
+ * URLs are SigV4 query-signed by the host's S3 client (`new AwsClient({ accessKeyId, secretAccessKey, region: "auto", service: "s3" })` from `aws4fetch`).
+ * Reads bypass the Worker: `publicBase` is the bucket's custom domain or `pub-<hash>.r2.dev`.
+ *
+ * A presigned PUT binds neither the type nor the size, and it stays usable until it expires. So uploads land under `uploads/`,
+ * commit checks each object through the binding and copies it to its public key, which no upload URL names, and a rejected
+ * group is deleted by the use case (`deleteObject` on each upload key).
+ */
+import { DiagnosticError, makeDiagnostic } from "../spec/kernel/index.js";
+const EXT = { "image/png": "png", "image/jpeg": "jpg", "image/webp": "webp", "image/avif": "avif", "image/gif": "gif" };
+const UPLOADS = "uploads/";
+const fail = (code, message, value) => new DiagnosticError(makeDiagnostic({ code, phase: "runtime", severity: "error", path: "media/r2", message, ...(value === undefined ? {} : { value }) }));
+export function r2MediaStorage({ bucket, signer, endpoint, publicBase }) {
+    if (!publicBase)
+        throw fail("MEDIA_NOT_CONFIGURED", "R2 media storage needs publicBase, the bucket's public URL");
+    const base = publicBase.replace(/\/+$/, "");
+    const s3 = endpoint.replace(/\/+$/, "");
+    return {
+        async createUpload({ uploadGroupId, purpose, variants, now, expiresAt }) {
+            const ttl = Math.max(60, Math.floor((expiresAt - now) / 1000));
+            return {
+                capabilities: await Promise.all(variants.map(async (v) => {
+                    // server-made keys, one directory per asset so its variants list together
+                    const storageKey = `${UPLOADS}${purpose}/${uploadGroupId}/${v.role}.${EXT[v.mimeType] ?? "bin"}`;
+                    const target = new URL(`${s3}/${storageKey}`);
+                    target.searchParams.set("X-Amz-Expires", String(ttl));
+                    const { url } = await signer.sign(target.href, { method: "PUT", aws: { signQuery: true, service: "s3" } });
+                    return { mimeType: v.mimeType, role: v.role, method: "PUT", uploadUrl: url, storageKey, requiredHeaders: { "Content-Type": v.mimeType } };
+                })),
+            };
+        },
+        async commitUpload({ uploadGroupId, filename, variants, alt, caption, now }) {
+            // every variant is checked before any is published, so a rejected group publishes nothing
+            const heads = [];
+            for (const spec of variants) {
+                const o = await bucket.head(spec.storageKey);
+                if (!o)
+                    throw fail("MEDIA_OBJECT_NOT_FOUND", `variant ${spec.role} of '${uploadGroupId}' was not uploaded`, uploadGroupId);
+                const mime = o.httpMetadata?.contentType ?? "application/octet-stream";
+                if (mime !== spec.mimeType)
+                    throw fail("MEDIA_MIME_REJECTED", `the stored ${spec.role} is ${mime}, not ${spec.mimeType}`, mime);
+                if (o.size > spec.maxBytes)
+                    throw fail("MEDIA_VARIANT_SIZE_EXCEEDED", `the stored ${spec.role} is ${o.size} bytes, more than ${spec.maxBytes}`, o.size);
+                heads.push(o);
+            }
+            const out = [];
+            for (const [i, spec] of variants.entries()) {
+                const key = spec.storageKey.slice(UPLOADS.length);
+                const o = await bucket.get(spec.storageKey);
+                // an upload URL may PUT again between the check and the copy: the copy must be what was checked
+                if (!o || o.size !== heads[i].size || o.httpMetadata?.contentType !== spec.mimeType) {
+                    await o?.body.cancel().catch(() => undefined);
+                    await Promise.allSettled(out.map((v) => bucket.delete(v.storageKey)));
+                    throw fail("MEDIA_OBJECT_NOT_FOUND", `variant ${spec.role} of '${uploadGroupId}' changed during commit`, uploadGroupId);
+                }
+                await bucket.put(key, o.body, {
+                    httpMetadata: { contentType: spec.mimeType },
+                    customMetadata: { ...o.customMetadata, committedAt: String(now), role: spec.role, uploadGroupId, filename, ...(alt ? { alt } : {}), ...(caption ? { caption } : {}) },
+                });
+                await bucket.delete(spec.storageKey);
+                out.push({ mimeType: spec.mimeType, publicUrl: `${base}/${key}`, storageKey: key, byteSize: o.size, role: spec.role });
+            }
+            return { id: uploadGroupId, variants: out, createdAt: now, metadata: { filename }, ...(alt !== undefined ? { alt } : {}), ...(caption !== undefined ? { caption } : {}) };
+        },
+        deleteObject: ({ storageKey }) => bucket.delete(storageKey),
+    };
+}
+//# sourceMappingURL=r2Media.js.map

package/dist/cloudflare/r2Media.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"r2Media.js","sourceRoot":"","sources":["../../src/cloudflare/r2Media.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,eAAe,EAAE,cAAc,EAAuB,MAAM,yBAAyB,CAAC;AA2B/F,MAAM,GAAG,GAA2B,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;AAChJ,MAAM,OAAO,GAAG,UAAU,CAAC;AAC3B,MAAM,IAAI,GAAG,CAAC,IAAoB,EAAE,OAAe,EAAE,KAAe,EAAE,EAAE,CACtE,IAAI,eAAe,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AAE3J,MAAM,UAAU,cAAc,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAyB;IAC5F,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,CAAC,sBAAsB,EAAE,4DAA4D,CAAC,CAAC;IAClH,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5C,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxC,OAAO;QACL,KAAK,CAAC,YAAY,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE;YACrE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;YAC/D,OAAO;gBACL,YAAY,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;oBACvD,0EAA0E;oBAC1E,MAAM,UAAU,GAAG,GAAG,OAAO,GAAG,OAAO,IAAI,aAAa,IAAI,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC;oBACjG,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,IAAI,UAAU,EAAE,CAAC,CAAC;oBAC9C,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;oBACtD,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;oBAC3G,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,KAAc,EAAE,SAAS,EAAE,GAAG,EAAE,UAAU,EAAE,eAAe,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;gBACrJ,CAAC,CAAC,CAAC;aACJ,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE;YACzE,0FAA0F;YAC1F,MAAM,KAAK,GAAG,EAAE,CAAC;YACjB,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;gBAC5B,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAC7C,IAAI,CAAC,CAAC;oBAAE,MAAM,IAAI,CAAC,wBAAwB,EAAE,WAAW,IAAI,CAAC,IAAI,QAAQ,aAAa,oBAAoB,EAAE,aAAa,CAAC,CAAC;gBAC3H,MAAM,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,WAAW,IAAI,0BAA0B,CAAC;gBACvE,IAAI,IAAI,KAAK,IAAI,CAAC,QAAQ;oBAAE,MAAM,IAAI,CAAC,qBAAqB,EAAE,cAAc,IAAI,CAAC,IAAI,OAAO,IAAI,SAAS,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAC,CAAC;gBAChI,IAAI,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,QAAQ;oBAAE,MAAM,IAAI,CAAC,6BAA6B,EAAE,cAAc,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,qBAAqB,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;gBACxJ,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,CAAC;YACD,MAAM,GAAG,GAAmB,EAAE,CAAC;YAC/B,KAAK,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;gBAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBAClD,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAC5C,gGAAgG;gBAChG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,IAAI,CAAC,CAAC,YAAY,EAAE,WAAW,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACrF,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;oBAC9C,MAAM,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;oBACtE,MAAM,IAAI,CAAC,wBAAwB,EAAE,WAAW,IAAI,CAAC,IAAI,QAAQ,aAAa,yBAAyB,EAAE,aAAa,CAAC,CAAC;gBAC1H,CAAC;gBACD,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE;oBAC5B,YAAY,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,QAAQ,EAAE;oBAC5C,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC,cAAc,EAAE,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;iBACtK,CAAC,CAAC;gBACH,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBACrC,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YACzH,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC5K,CAAC;QAED,YAAY,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;KAC5D,CAAC;AACJ,CAAC"}

package/dist/core/caller.d.ts

@@ -0,0 +1,35 @@
+/** Caller identity (ADR-0032 decision 8). Mantle never owns the user or the auth; a resolver produces the Caller. */
+import type { StaffRole } from "../spec/domain/index.js";
+export type CredentialKind = "session" | "oauth" | "api-key" | "personal-token";
+export type Caller = {
+    readonly kind: "anonymous";
+} | {
+    readonly kind: "user";
+    /** Application subject key: opaque, stable, unique across issuers. Never an email. */
+    readonly subject: string;
+    /** Informational. */
+    readonly issuer?: string;
+    readonly role: StaffRole | null;
+    readonly scopes: readonly string[];
+    readonly credential: CredentialKind;
+    /** Opaque record id or token JTI, never the raw credential. */
+    readonly credentialId: string | null;
+    readonly clientId: string | null;
+} | {
+    readonly kind: "system";
+    readonly reason: string;
+};
+/**
+ * Resolves the Caller once per request, at the service's entry. `invalid` is answered 401 before any
+ * surface runs and is never anonymous; only "no credential presented" is.
+ */
+export type CallerResolver = (request: Request) => Promise<{
+    readonly caller: Caller;
+} | {
+    readonly invalid: true;
+    readonly challenge?: string; /** 403 for a valid token that lacks a scope (RFC 6750 insufficient_scope); 401 otherwise. */
+    readonly status?: 401 | 403;
+}>;
+/** Host code only; no wire produces one. Satisfies no `requires.auth` predicate, bypasses caller scope and nothing else. */
+export declare const systemCaller: (reason: string) => Caller;
+//# sourceMappingURL=caller.d.ts.map

package/dist/core/caller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"caller.d.ts","sourceRoot":"","sources":["../../src/core/caller.ts"],"names":[],"mappings":"AAAA,qHAAqH;AACrH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAEzD,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,GAAG,gBAAgB,CAAC;AAEhF,MAAM,MAAM,MAAM,GACd;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAC9B;IACE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sFAAsF;IACtF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,qBAAqB;IACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAC;IACpC,+DAA+D;IAC/D,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzD;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC,6FAA6F;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,GAAG,GAAG,GAAG,CAAA;CAAE,CAAC,CAAC;AAE7Q,4HAA4H;AAC5H,eAAO,MAAM,YAAY,GAAI,QAAQ,MAAM,KAAG,MAAsC,CAAC"}

package/dist/core/caller.js

@@ -0,0 +1,3 @@
+/** Host code only; no wire produces one. Satisfies no `requires.auth` predicate, bypasses caller scope and nothing else. */
+export const systemCaller = (reason) => ({ kind: "system", reason });
+//# sourceMappingURL=caller.js.map

package/dist/core/caller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"caller.js","sourceRoot":"","sources":["../../src/core/caller.ts"],"names":[],"mappings":"AA4BA,4HAA4H;AAC5H,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAc,EAAU,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC"}

package/dist/core/createMantle.d.ts

@@ -0,0 +1,22 @@
+import type { RuntimePlan } from "../spec/domain/index.js";
+import type { MantleService, MantleStorageAdapter } from "./service.js";
+interface WaitUntil {
+    waitUntil(promise: Promise<unknown>): void;
+}
+export interface MantleOptions<Env> {
+    /** The sealed plan the CLI compiled (`mantle generate` emits it beside `src/service.ts`). ADR-0032 decision 6 leaves it out of the signature. */
+    readonly plan: RuntimePlan;
+    readonly storage: (env: Env) => MantleStorageAdapter;
+    /** Set when the entry wires schedules; boot fails for an enabled schedule Trigger without it. */
+    readonly schedules?: boolean;
+    /** Refuses to boot when the plan is not the one Cloud compiled. */
+    readonly expectedFingerprint?: string;
+}
+export interface Mantle<Env> {
+    fetch(request: Request, env: Env, ctx?: WaitUntil): Promise<Response>;
+    invokeSchedule(cron: string, scheduledTime: number, env: Env, ctx?: WaitUntil): Promise<void>;
+    runDeferredHook(message: unknown, env: Env, ctx?: WaitUntil): Promise<void>;
+}
+export declare function createMantle<Env>(service: MantleService<Env>, options: MantleOptions<Env>): Mantle<Env>;
+export {};
+//# sourceMappingURL=createMantle.d.ts.map

package/dist/core/createMantle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"createMantle.d.ts","sourceRoot":"","sources":["../../src/core/createMantle.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAM3D,OAAO,KAAK,EAAiB,aAAa,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEvF,UAAU,SAAS;IACjB,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;CAC5C;AAED,MAAM,WAAW,aAAa,CAAC,GAAG;IAChC,iJAAiJ;IACjJ,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,oBAAoB,CAAC;IACrD,iGAAiG;IACjG,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,mEAAmE;IACnE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;CACvC;AAED,MAAM,WAAW,MAAM,CAAC,GAAG;IACzB,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACtE,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9F,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7E;AA6BD,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,aAAa,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAqEvG"}

package/dist/core/createMantle.js

@@ -0,0 +1,117 @@
+/**
+ * `createMantle`: the one host-neutral entry (ADR-0032 decision 6). It boots the runtime lazily from `storage(env)`,
+ * hands it to `service.fetch`, and turns a schedule or a deferred-hook message into an Invocation. The host's own entry
+ * is one to three generated lines; Core absorbs no platform event types.
+ */
+import { DiagnosticError, makeDiagnostic } from "../spec/kernel/index.js";
+import { STAFF_ROLES, LIFECYCLE_HOOKS } from "../spec/domain/index.js";
+import { systemCaller } from "./caller.js";
+import { MAX_INVOCATION_DEPTH } from "./invocation.js";
+import { createMantleRuntime } from "./runtime/createRuntime.js";
+import { bindStoreCause } from "./store/createStore.js";
+const bad = (message) => new DiagnosticError(makeDiagnostic({ code: "INPUT_VALIDATION_FAILED", phase: "runtime", severity: "error", path: "deferred-hook", message }));
+const record = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+/** Queue payloads are unknown, including their caller and parent chain. Validate before boot or dispatch. */
+function deferredInvocation(message) {
+    if (!record(message) || typeof message.procedure !== "string" || !record(message.caller))
+        throw bad("invalid deferred Invocation");
+    const c = message.caller;
+    if (c.kind !== "anonymous" && !(c.kind === "user" && typeof c.subject === "string" && c.subject.length > 0
+        && (c.role === null || STAFF_ROLES.includes(c.role))
+        && Array.isArray(c.scopes) && c.scopes.every((s) => typeof s === "string")
+        && ["session", "oauth", "api-key", "personal-token"].includes(c.credential)
+        && (c.credentialId === null || typeof c.credentialId === "string") && (c.clientId === null || typeof c.clientId === "string")))
+        throw bad("invalid deferred caller");
+    let cause = message.cause;
+    let depth = 0;
+    while (cause !== undefined) {
+        if (++depth > MAX_INVOCATION_DEPTH || !record(cause) || typeof cause.id !== "string")
+            throw bad("invalid deferred cause chain");
+        if (!["http", "mcp", "internal", "schedule", "lifecycle"].includes(cause.kind))
+            throw bad("invalid deferred cause kind");
+        if (cause.kind === "lifecycle" && (typeof cause.trigger !== "string" || typeof cause.schema !== "string"
+            || typeof cause.hook !== "string" || !LIFECYCLE_HOOKS.includes(cause.hook)
+            || !Array.isArray(cause.rows) || !cause.rows.length || !cause.rows.every(record)))
+            throw bad("invalid deferred lifecycle cause");
+        if (cause.kind === "schedule" && (typeof cause.trigger !== "string" || typeof cause.cron !== "string" || typeof cause.scheduledTime !== "number" || !Number.isFinite(cause.scheduledTime)))
+            throw bad("invalid deferred schedule cause");
+        cause = cause.parent;
+    }
+    if (!record(message.cause) || message.cause.kind !== "lifecycle" || !message.cause.hook.startsWith("after_"))
+        throw bad("a deferred hook message is the Invocation of an after hook");
+    return message;
+}
+export function createMantle(service, options) {
+    let booted;
+    const retainers = new WeakMap();
+    const runtimeFor = async (env, ctx) => {
+        booted ??= createMantleRuntime({
+            plan: options.plan, handlers: service.handlers, storage: options.storage(env), env, schedules: options.schedules,
+            expectedFingerprint: options.expectedFingerprint, waitUntil: (p, cause) => {
+                for (let depth = 0; cause && depth <= MAX_INVOCATION_DEPTH; cause = cause.parent, depth++) {
+                    const retain = retainers.get(cause);
+                    if (retain) {
+                        retain(p);
+                        return;
+                    }
+                }
+            },
+        }).catch((e) => { booted = undefined; throw e; }); // a failed boot is retried by the next request
+        const runtime = await booted;
+        const retain = ctx ? (p) => ctx.waitUntil(p) : () => undefined;
+        const hostCause = { kind: "internal", id: `host:${crypto.randomUUID()}` };
+        retainers.set(hostCause, retain);
+        return {
+            ...runtime,
+            invokeProcedure: (inv) => {
+                const cause = { ...inv.cause };
+                retainers.set(cause, retain);
+                return runtime.invokeProcedure({ ...inv, cause });
+            },
+            store: {
+                ...runtime.store,
+                ...bindStoreCause(runtime.store, hostCause),
+                as: (caller, cause = { kind: "internal", id: `store:${crypto.randomUUID()}` }) => {
+                    const boundCause = { ...cause };
+                    retainers.set(boundCause, retain);
+                    return runtime.store.as(caller, boundCause);
+                },
+            },
+        };
+    };
+    return {
+        async fetch(request, env, ctx) {
+            const runtime = await runtimeFor(env, ctx);
+            return service.fetch(request, env, { runtime, waitUntil: ctx ? (p) => ctx.waitUntil(p) : () => undefined });
+        },
+        async invokeSchedule(cron, scheduledTime, env, ctx) {
+            const runtime = await runtimeFor(env, ctx);
+            const errors = [];
+            for (const [trigger, t] of Object.entries(options.plan.triggers).sort(([a], [b]) => (a < b ? -1 : 1))) {
+                if (t.source.kind !== "schedule" || t.source.cron !== cron || t.source.enabled === false)
+                    continue;
+                try {
+                    // retries keep the same cause id, so a handler can deduplicate one delivery
+                    await runtime.invokeProcedure({ procedure: t.procedure, input: {}, caller: systemCaller("schedule"), cause: { kind: "schedule", id: `${trigger}:${scheduledTime}`, trigger, cron, scheduledTime } });
+                }
+                catch (e) {
+                    errors.push(e);
+                }
+            }
+            if (errors.length)
+                throw new AggregateError(errors, `${errors.length} scheduled Procedure(s) failed for '${cron}'`);
+        },
+        async runDeferredHook(message, env, ctx) {
+            const inv = deferredInvocation(message);
+            // the queue is Mantle's own channel, but the message is only ever honoured for what a Trigger of the plan would have run:
+            // that Trigger, its Procedure and its hook, and never as the system caller (no wire produces one)
+            if (inv.cause.kind !== "lifecycle")
+                throw bad("invalid deferred lifecycle cause");
+            const t = Object.hasOwn(options.plan.triggers, inv.cause.trigger) ? options.plan.triggers[inv.cause.trigger] : undefined;
+            if (inv.caller.kind === "system" || t?.source.kind !== "lifecycle" || t.procedure !== inv.procedure || t.source.schema !== inv.cause.schema || !t.source.on.includes(inv.cause.hook))
+                throw bad("the message does not match a lifecycle Trigger of the plan");
+            await (await runtimeFor(env, ctx)).invokeProcedure(inv);
+        },
+    };
+}
+//# sourceMappingURL=createMantle.js.map

package/dist/core/createMantle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createMantle.js","sourceRoot":"","sources":["../../src/core/createMantle.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAE1E,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,oBAAoB,EAAyC,MAAM,iBAAiB,CAAC;AAC9F,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAuBxD,MAAM,GAAG,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,IAAI,eAAe,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;AAC/K,MAAM,MAAM,GAAG,CAAC,CAAU,EAAgC,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAEtH,6GAA6G;AAC7G,SAAS,kBAAkB,CAAC,OAAgB;IAC1C,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,MAAM,GAAG,CAAC,6BAA6B,CAAC,CAAC;IACnI,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IACzB,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;WACrG,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAK,WAAkC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;WACzE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;WACvE,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAoB,CAAC;WAClF,CAAC,CAAC,CAAC,YAAY,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;QAAE,MAAM,GAAG,CAAC,yBAAyB,CAAC,CAAC;IACvK,IAAI,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC1B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,EAAE,KAAK,GAAG,oBAAoB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAC,8BAA8B,CAAC,CAAC;QAChI,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAc,CAAC;YAAE,MAAM,GAAG,CAAC,6BAA6B,CAAC,CAAC;QACnI,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;eACnG,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAE,eAAqC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;eAC9F,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAAE,MAAM,GAAG,CAAC,kCAAkC,CAAC,CAAC;QACnI,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;YAAE,MAAM,GAAG,CAAC,iCAAiC,CAAC,CAAC;QACzO,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC;IACvB,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW,IAAI,CAAE,OAAO,CAAC,KAAK,CAAC,IAAe,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,MAAM,GAAG,CAAC,4DAA4D,CAAC,CAAC;IAClM,OAAO,OAAgC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,YAAY,CAAM,OAA2B,EAAE,OAA2B;IACxF,IAAI,MAA0C,CAAC;IAC/C,MAAM,SAAS,GAAG,IAAI,OAAO,EAAkD,CAAC;IAEhF,MAAM,UAAU,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAe,EAA0B,EAAE;QAC7E,MAAM,KAAK,mBAAmB,CAAC;YAC7B,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAiB,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS;YACzH,mBAAmB,EAAE,OAAO,CAAC,mBAAmB,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE;gBACxE,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,KAAK,IAAI,oBAAoB,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;oBAC1F,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;oBACpC,IAAI,MAAM,EAAE,CAAC;wBAAC,MAAM,CAAC,CAAC,CAAC,CAAC;wBAAC,OAAO;oBAAC,CAAC;gBACpC,CAAC;YACH,CAAC;SACF,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,MAAM,GAAG,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,+CAA+C;QAClG,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC;QAC7B,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAmB,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;QACjF,MAAM,SAAS,GAAoB,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,MAAM,CAAC,UAAU,EAAE,EAAE,EAAE,CAAC;QAC3F,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACjC,OAAO;YACL,GAAG,OAAO;YACV,eAAe,EAAE,CAAC,GAAG,EAAE,EAAE;gBACvB,MAAM,KAAK,GAAG,EAAE,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC;gBAC/B,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;gBAC7B,OAAO,OAAO,CAAC,eAAe,CAAC,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;YACpD,CAAC;YACD,KAAK,EAAE;gBACL,GAAG,OAAO,CAAC,KAAK;gBAChB,GAAG,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC;gBAC3C,EAAE,EAAE,CAAC,MAAM,EAAE,KAAK,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,MAAM,CAAC,UAAU,EAAE,EAAE,EAAE,EAAE,EAAE;oBAC/E,MAAM,UAAU,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;oBAChC,SAAS,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;oBAClC,OAAO,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;gBAC9C,CAAC;aACF;SACF,CAAC;IACJ,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG;YAC3B,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC3C,OAAO,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QAC9G,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,GAAG;YAChD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC3C,MAAM,MAAM,GAAc,EAAE,CAAC;YAC7B,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtG,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,KAAK,KAAK;oBAAE,SAAS;gBACnG,IAAI,CAAC;oBACH,4EAA4E;oBAC5E,MAAM,OAAO,CAAC,eAAe,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,YAAY,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,OAAO,IAAI,aAAa,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;gBACvM,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACjB,CAAC;YACH,CAAC;YACD,IAAI,MAAM,CAAC,MAAM;gBAAE,MAAM,IAAI,cAAc,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,uCAAuC,IAAI,GAAG,CAAC,CAAC;QACtH,CAAC;QAED,KAAK,CAAC,eAAe,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG;YACrC,MAAM,GAAG,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;YACxC,0HAA0H;YAC1H,kGAAkG;YAClG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW;gBAAE,MAAM,GAAG,CAAC,kCAAkC,CAAC,CAAC;YAClF,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACzH,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,EAAE,MAAM,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,CAAC,SAAS,KAAK,GAAG,CAAC,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;gBAClL,MAAM,GAAG,CAAC,4DAA4D,CAAC,CAAC;YAC1E,MAAM,CAAC,MAAM,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,GAAiB,CAAC,CAAC;QACxE,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/core/dialect.d.ts

@@ -0,0 +1,41 @@
+/**
+ * The runtime side of a SQL dialect as Core uses it (ADR-0035 decisions 3 and 6). Core holds no engine code: the storage
+ * adapter hands Core its dialect, and Store checks, rewrites, binds and decodes through it. Internal until the compliance
+ * suite makes it a public interface (ADR-0035, How to apply 5); the D1 dialect is the one implementation.
+ */
+import type { SqlContext, SqlDiagnostic, SqlNode, SqlPlan, SqlSchemaDef } from "../spec/domain/index.js";
+import type { BindContext } from "./sql/compile.js";
+import type { DialectBind, PolicyLowering } from "./sql/policy.js";
+/** A Schema as storage and the policy rewriter read it from the plan. */
+export interface StorageSchema extends SqlSchemaDef {
+    /** Boolean expressions over the row's own columns (IR), enforced by the engine on every write. */
+    readonly checks?: readonly SqlNode[];
+    /** Fields `search` matches. */
+    readonly search?: readonly string[];
+    /** Unique constraints; on a scoped Schema the scope column is added. */
+    readonly unique?: readonly (readonly string[])[];
+    /** Ordered composite non-unique indexes. */
+    readonly indexes?: readonly (readonly string[])[];
+}
+/** The Store's wire values to and from what the engine stores (ADR-0034 decision 5). A value the type cannot hold throws `SqlRefusal`. */
+export interface StoreCodec {
+    encode(type: string, value: unknown): unknown;
+    decode(type: string, value: unknown): unknown;
+}
+/** An operator's own refusals of a program's IR, run after the dialect's at runtime (ADR-0037 decision 4). It can only narrow. */
+export type RestrictSql = (plan: SqlPlan, context: SqlContext) => readonly SqlDiagnostic[];
+/** The dialect with `restrict` run after its own check. */
+export declare function restricted(dialect: MantleDialect, restrict?: RestrictSql): MantleDialect;
+/** Core's policy rewriter adds visibility and ownership to every relation position; the dialect spells the rest (`lowering`). */
+export interface MantleDialect {
+    /** What a plan compiled for this dialect records (`RuntimePlan.dialect`); boot refuses any other. */
+    readonly name: string;
+    readonly version: string;
+    readonly codec: StoreCodec;
+    /** The dialect's refusals of a program's IR. Run on every program: the runtime never trusts an IR. */
+    check(plan: SqlPlan, context: SqlContext): readonly SqlDiagnostic[];
+    readonly lowering: PolicyLowering;
+    /** Resolves a bind the lowering added. */
+    bind(spec: DialectBind, context: BindContext): unknown;
+}
+//# sourceMappingURL=dialect.d.ts.map

package/dist/core/dialect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dialect.d.ts","sourceRoot":"","sources":["../../src/core/dialect.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACzG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEnE,yEAAyE;AACzE,MAAM,WAAW,aAAc,SAAQ,YAAY;IACjD,kGAAkG;IAClG,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IACrC,+BAA+B;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,wEAAwE;IACxE,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,CAAC;IACjD,4CAA4C;IAC5C,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,CAAC;CACnD;AAED,0IAA0I;AAC1I,MAAM,WAAW,UAAU;IACzB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC;IAC9C,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC;CAC/C;AAED,kIAAkI;AAClI,MAAM,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,KAAK,SAAS,aAAa,EAAE,CAAC;AAE3F,2DAA2D;AAC3D,wBAAgB,UAAU,CAAC,OAAO,EAAE,aAAa,EAAE,QAAQ,CAAC,EAAE,WAAW,GAAG,aAAa,CAGxF;AAED,iIAAiI;AACjI,MAAM,WAAW,aAAa;IAC5B,qGAAqG;IACrG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,sGAAsG;IACtG,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,GAAG,SAAS,aAAa,EAAE,CAAC;IACpE,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,0CAA0C;IAC1C,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC;CACxD"}

package/dist/core/dialect.js

@@ -0,0 +1,7 @@
+/** The dialect with `restrict` run after its own check. */
+export function restricted(dialect, restrict) {
+    if (!restrict)
+        return dialect;
+    return { ...dialect, check: (plan, context) => { const own = dialect.check(plan, context); return own.length ? own : restrict(plan, context); } };
+}
+//# sourceMappingURL=dialect.js.map

package/dist/core/dialect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dialect.js","sourceRoot":"","sources":["../../src/core/dialect.ts"],"names":[],"mappings":"AA8BA,2DAA2D;AAC3D,MAAM,UAAU,UAAU,CAAC,OAAsB,EAAE,QAAsB;IACvE,IAAI,CAAC,QAAQ;QAAE,OAAO,OAAO,CAAC;IAC9B,OAAO,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACpJ,CAAC"}

package/dist/core/driver.d.ts

@@ -0,0 +1,17 @@
+/** The SQLite-family port under SqliteStoreExecutor: D1, Bun and libSQL each wrap their native driver to this. */
+export interface SqlStatement {
+    readonly sql: string;
+    /** Bound in `?n` order. */
+    readonly binds?: readonly unknown[];
+}
+export interface SqlResult {
+    readonly rows: readonly Record<string, unknown>[];
+}
+export interface DatabaseDriver {
+    /**
+     * Every statement in order, all or nothing (a D1 `batch`). When one fails, rethrows the engine's error unchanged, with its
+     * code (`code` or `errcode`): the executor tells a refused statement from one that never reached the engine by it.
+     */
+    batch(statements: readonly SqlStatement[]): Promise<readonly SqlResult[]>;
+}
+//# sourceMappingURL=driver.d.ts.map

package/dist/core/driver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"driver.d.ts","sourceRoot":"","sources":["../../src/core/driver.ts"],"names":[],"mappings":"AAAA,kHAAkH;AAClH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,2BAA2B;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;CACnD;AAED,MAAM,WAAW,cAAc;IAC7B;;;OAGG;IACH,KAAK,CAAC,UAAU,EAAE,SAAS,YAAY,EAAE,GAAG,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAAC;CAC3E"}

package/dist/core/driver.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=driver.js.map

package/dist/core/driver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"driver.js","sourceRoot":"","sources":["../../src/core/driver.ts"],"names":[],"mappings":""}

package/dist/core/email.d.ts

@@ -0,0 +1,17 @@
+/** The transactional-email port (Better Auth email OTP and magic link, staff invitations). The sender decides how to branch on `locale`; `category` names the template lane. */
+export interface EmailSender {
+    send(args: EmailSendArgs): Promise<void>;
+}
+export interface EmailSendArgs {
+    readonly to: string;
+    readonly subject: string;
+    /** Plain-text body — always required so non-HTML clients work. */
+    readonly text: string;
+    /** Optional HTML body. */
+    readonly html?: string;
+    /** BCP 47 locale the recipient is expected to read. */
+    readonly locale: string;
+    /** Optional categorization for templating / deliverability segmentation. */
+    readonly category?: string;
+}
+//# sourceMappingURL=email.d.ts.map

package/dist/core/email.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email.d.ts","sourceRoot":"","sources":["../../src/core/email.ts"],"names":[],"mappings":"AAAA,gLAAgL;AAChL,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1C;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,0BAA0B;IAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,uDAAuD;IACvD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,4EAA4E;IAC5E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B"}

package/dist/core/email.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=email.js.map

package/dist/core/email.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"email.js","sourceRoot":"","sources":["../../src/core/email.ts"],"names":[],"mappings":""}

package/dist/core/index.d.ts

@@ -0,0 +1,16 @@
+export * from "./caller.js";
+export * from "./createMantle.js";
+export * from "./driver.js";
+export * from "./invocation.js";
+export * from "./runtime/createRuntime.js";
+export * from "./service.js";
+export * from "./withCaller.js";
+export * from "./site.js";
+export * from "./store.js";
+export * from "./email.js";
+export * from "./runtime/auth.js";
+export type { RestrictSql } from "./dialect.js";
+export * from "./runtime/verifyPlan.js";
+export { DiagnosticError, makeDiagnostic, runtimeDiagnostic, type Diagnostic, type DiagnosticCode } from "../spec/kernel/index.js";
+export { STAFF_ROLES, isStaffRole, type StaffRole } from "../spec/domain/index.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/core/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/core/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,mBAAmB,CAAC;AAClC,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,mBAAmB,CAAC;AAClC,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,cAAc,yBAAyB,CAAC;AAExC,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,iBAAiB,EAAE,KAAK,UAAU,EAAE,KAAK,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACnI,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,SAAS,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/core/index.js

@@ -0,0 +1,16 @@
+export * from "./caller.js";
+export * from "./createMantle.js";
+export * from "./driver.js";
+export * from "./invocation.js";
+export * from "./runtime/createRuntime.js";
+export * from "./service.js";
+export * from "./withCaller.js";
+export * from "./site.js";
+export * from "./store.js";
+export * from "./email.js";
+export * from "./runtime/auth.js";
+export * from "./runtime/verifyPlan.js";
+// what host and handler code throws and checks, from the root: the `/spec` barrel bundles the SQL parser into a Worker
+export { DiagnosticError, makeDiagnostic, runtimeDiagnostic } from "../spec/kernel/index.js";
+export { STAFF_ROLES, isStaffRole } from "../spec/domain/index.js";
+//# sourceMappingURL=index.js.map

package/dist/core/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/core/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,mBAAmB,CAAC;AAClC,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,mBAAmB,CAAC;AAElC,cAAc,yBAAyB,CAAC;AACxC,uHAAuH;AACvH,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,iBAAiB,EAAwC,MAAM,yBAAyB,CAAC;AACnI,OAAO,EAAE,WAAW,EAAE,WAAW,EAAkB,MAAM,yBAAyB,CAAC"}

package/dist/core/invocation.d.ts

@@ -0,0 +1,66 @@
+/** Invocation, the handler contract and the lifecycle port (ADR-0032 decisions 3 and 7, ADR-0034 decision 4). */
+import type { LifecycleHook } from "../spec/domain/index.js";
+import type { Caller } from "./caller.js";
+import type { CallerStore, StoreRow } from "./store.js";
+/** `ctx.cause.parent` chains through hooks and `ctx.invoke`; deeper than this fails `INVOCATION_DEPTH_EXCEEDED`. */
+export declare const MAX_INVOCATION_DEPTH = 8;
+/** Why a Procedure runs. `id` is stable across retries and deferred replays. */
+export type InvocationCause = {
+    readonly id: string;
+    readonly parent?: InvocationCause;
+} & ({
+    readonly kind: "http" | "mcp" | "internal";
+} | {
+    readonly kind: "schedule";
+    readonly trigger: string;
+    readonly cron: string;
+    readonly scheduledTime: number;
+} | {
+    readonly kind: "lifecycle";
+    readonly trigger: string;
+    readonly hook: LifecycleHook;
+    readonly schema: string;
+    /** After hooks: every row the statement wrote, whole and as Store's `select` returns it, whatever its own RETURNING. Before hooks: the one row, or for an insert the row about to be written. */
+    readonly rows: readonly [StoreRow, ...StoreRow[]];
+});
+/** The serializable part of a call. Every source produces one; only an Invocation crosses a wire. */
+export interface Invocation {
+    readonly procedure: string;
+    readonly input: unknown;
+    readonly caller: Caller;
+    readonly cause: InvocationCause;
+}
+/**
+ * Handed to every handler. In a guard or a before hook `store.write` and `invoke` fail (before hooks are
+ * read-only checks).
+ */
+export interface HandlerContext<Env = unknown> {
+    readonly caller: Caller;
+    readonly cause: InvocationCause;
+    readonly env: Env;
+    waitUntil(promise: Promise<unknown>): void;
+    readonly store: CallerStore;
+    /** The one Procedure-to-Procedure entry: keeps the caller, chains `cause.parent`, re-runs the target's auth and guard. */
+    invoke(procedure: string, input: unknown): Promise<unknown>;
+}
+/** `input` is validated against the Procedure's `input` schema before the call, the return against `output`. */
+export type HandlerFn<I = unknown, O = unknown, Env = unknown> = (input: I, ctx: HandlerContext<Env>) => O | Promise<O>;
+/** Codegen narrows this to exactly the plan's refs (`HANDLER_NOT_REGISTERED` / `HANDLER_NOT_DECLARED`). */
+export type MantleHandlers<Env = unknown> = Readonly<Record<string, HandlerFn<any, any, Env>>>;
+/** One hook call: one statement and one Trigger. */
+export interface LifecycleEvent {
+    readonly id: string;
+    readonly schema: string;
+    readonly hook: LifecycleHook;
+    readonly rows: readonly [StoreRow, ...StoreRow[]];
+    readonly caller: Caller;
+    readonly parent?: InvocationCause;
+}
+/** What Store calls; the Trigger layer implements it. Store never references Procedures. */
+export interface LifecycleDispatcher {
+    /** Runs before the batch applies, in op order. A throw rejects the mutation and applies nothing. */
+    before(events: readonly LifecycleEvent[]): Promise<void>;
+    /** Runs after a successful commit, best effort: a failure never changes the committed result. */
+    after(events: readonly LifecycleEvent[]): Promise<void>;
+}
+//# sourceMappingURL=invocation.d.ts.map