@aotter/mantle 0.1.5-alpha.1 → 0.2.0-alpha.2

package/dist/spec/domain/service/SiteDefaultsValidator.d.ts

@@ -0,0 +1,39 @@
+import { type SiteIcon, type SiteDefaults } from "../model/SiteConfig.js";
+import { parseMimeAccept } from "../model/MediaMimeAccept.js";
+/**
+ * Synchronous fail-fast for `siteDefaults`. Throws
+ * `InvalidSiteDefaultsError` when any declared locale fails BCP 47
+ * canonicalization. Throws `InvalidMediaPurposesError` when any
+ * declared `media.purposes` entry's `name` fails the slug pattern,
+ * its `required` mime list is empty, or its `maxBytes` map is
+ * missing entries for any required mime. Throws `InvalidSiteIconsError`
+ * when a declared site icon cannot be served safely, and an `Error` when
+ * `origin` is not an absolute http(s) origin. Brand / title / description
+ * are not validated — only the fields whose values carry semantics the
+ * runtime depends on.
+ *
+ * Lives in spec (not runtime) because it's pure validation against
+ * the `SiteConfig` contract — no env, no DB. Runtime calls this during
+ * storage preparation so a typo in `siteDefaults` rejects deployment
+ * before the runtime accepts traffic.
+ */
+export declare class InvalidSiteDefaultsError extends Error {
+    readonly invalidLocales: ReadonlyArray<string>;
+    constructor(invalidLocales: ReadonlyArray<string>);
+}
+export interface MediaPurposeIssue {
+    readonly name: string;
+    readonly reason: "invalid-slug" | "empty-required" | "empty-required-slot" | "overlapping-slot-mimes" | "maxBytes-missing-mime" | "maxBytes-non-positive";
+    readonly detail?: string;
+}
+export declare class InvalidMediaPurposesError extends Error {
+    readonly issues: ReadonlyArray<MediaPurposeIssue>;
+    constructor(issues: ReadonlyArray<MediaPurposeIssue>);
+}
+export declare class InvalidSiteIconsError extends Error {
+    readonly invalidIcons: ReadonlyArray<SiteIcon>;
+    constructor(invalidIcons: ReadonlyArray<SiteIcon>);
+}
+export declare function assertSiteDefaultsCanonical(defaults: SiteDefaults | undefined): void;
+export { parseMimeAccept };
+//# sourceMappingURL=SiteDefaultsValidator.d.ts.map

package/dist/spec/domain/service/SiteDefaultsValidator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SiteDefaultsValidator.d.ts","sourceRoot":"","sources":["../../../../src/spec/domain/service/SiteDefaultsValidator.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,QAAQ,EACb,KAAK,YAAY,EAClB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAEL,eAAe,EAChB,MAAM,6BAA6B,CAAC;AAMrC;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;aACrB,cAAc,EAAE,aAAa,CAAC,MAAM,CAAC;gBAArC,cAAc,EAAE,aAAa,CAAC,MAAM,CAAC;CAelE;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EACX,cAAc,GACd,gBAAgB,GAChB,qBAAqB,GACrB,wBAAwB,GACxB,uBAAuB,GACvB,uBAAuB,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,qBAAa,yBAA0B,SAAQ,KAAK;aACtB,MAAM,EAAE,aAAa,CAAC,iBAAiB,CAAC;gBAAxC,MAAM,EAAE,aAAa,CAAC,iBAAiB,CAAC;CA+BrE;AAED,qBAAa,qBAAsB,SAAQ,KAAK;aAClB,YAAY,EAAE,aAAa,CAAC,QAAQ,CAAC;gBAArC,YAAY,EAAE,aAAa,CAAC,QAAQ,CAAC;CAOlE;AAED,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,YAAY,GAAG,SAAS,GACjC,IAAI,CAoBN;AAoGD,OAAO,EAAE,eAAe,EAAE,CAAC"}

package/dist/spec/domain/service/SiteDefaultsValidator.js

@@ -0,0 +1,194 @@
+import { MEDIA_PURPOSE_SLUG_PATTERN, } from "../model/SiteConfig.js";
+import { expandPolicyRequired, parseMimeAccept, } from "../model/MediaMimeAccept.js";
+import { canonicalizeLocaleList, containsScriptSubtagLocale, } from "./LocaleCanonicalizer.js";
+/**
+ * Synchronous fail-fast for `siteDefaults`. Throws
+ * `InvalidSiteDefaultsError` when any declared locale fails BCP 47
+ * canonicalization. Throws `InvalidMediaPurposesError` when any
+ * declared `media.purposes` entry's `name` fails the slug pattern,
+ * its `required` mime list is empty, or its `maxBytes` map is
+ * missing entries for any required mime. Throws `InvalidSiteIconsError`
+ * when a declared site icon cannot be served safely, and an `Error` when
+ * `origin` is not an absolute http(s) origin. Brand / title / description
+ * are not validated — only the fields whose values carry semantics the
+ * runtime depends on.
+ *
+ * Lives in spec (not runtime) because it's pure validation against
+ * the `SiteConfig` contract — no env, no DB. Runtime calls this during
+ * storage preparation so a typo in `siteDefaults` rejects deployment
+ * before the runtime accepts traffic.
+ */
+export class InvalidSiteDefaultsError extends Error {
+    invalidLocales;
+    constructor(invalidLocales) {
+        const hasScriptSubtag = containsScriptSubtagLocale(invalidLocales);
+        super(`Invalid Mantle locale tag(s) in adapter siteDefaults.locales: ` +
+            invalidLocales.map((s) => `'${s}'`).join(", ") +
+            `. Use Mantle v0.1 locale form like 'en' or 'zh-TW' — the canonicalizer ` +
+            `accepts mixed case ('zh-tw' / 'ZH_TW'), but the structure must ` +
+            `be a 2/3-letter language plus optional 2-letter region. ` +
+            (hasScriptSubtag
+                ? `Script subtags such as 'zh-Hant', 'zh-Hans', 'sr-Latn', or 'sr-Cyrl' are valid BCP 47 but intentionally unsupported in Mantle v0.1; use region tags such as 'zh-TW' for Traditional Chinese or 'zh-CN' for Simplified Chinese. `
+                : "") +
+            `See ADR-0010 / cms-spec's canonicalizeLocaleList.`);
+        this.invalidLocales = invalidLocales;
+        this.name = "InvalidSiteDefaultsError";
+    }
+}
+export class InvalidMediaPurposesError extends Error {
+    issues;
+    constructor(issues) {
+        super(`Invalid media purpose declaration(s) in adapter siteDefaults.media.purposes: ` +
+            issues
+                .map((i) => {
+                const tag = `'${i.name || "(unnamed)"}'`;
+                switch (i.reason) {
+                    case "invalid-slug":
+                        return `${tag} fails slug pattern ${MEDIA_PURPOSE_SLUG_PATTERN.source}`;
+                    case "empty-required":
+                        return `${tag} declares no required slots (need at least one)`;
+                    case "empty-required-slot":
+                        return `${tag} has a required slot that parses to zero mimes: ${i.detail}`;
+                    case "overlapping-slot-mimes":
+                        return `${tag} has slots with overlapping mime sets (variant→slot mapping is ambiguous): ${i.detail}`;
+                    case "maxBytes-missing-mime":
+                        return `${tag} maxBytes is missing entries: ${i.detail}`;
+                    case "maxBytes-non-positive":
+                        return `${tag} maxBytes has non-positive entries: ${i.detail}`;
+                }
+            })
+                .join("; ") +
+            `. Each purpose's name must match ` +
+            `${MEDIA_PURPOSE_SLUG_PATTERN.source} (lowercase alphanumerics, ` +
+            `dash-separated, no leading/trailing or repeated dashes); ` +
+            `required mimes are the closed set the variants manifest must ` +
+            `cover; maxBytes caps each variant's declared byteSize and MUST ` +
+            `name every mime in required. See aotter/mantle#272.`);
+        this.issues = issues;
+        this.name = "InvalidMediaPurposesError";
+    }
+}
+export class InvalidSiteIconsError extends Error {
+    invalidIcons;
+    constructor(invalidIcons) {
+        super("Invalid adapter siteDefaults.icons: each icon needs a root-relative or absolute HTTPS src, " +
+            "an optional supported image mimeType, and sizes such as '64x64' or 'any'.");
+        this.invalidIcons = invalidIcons;
+        this.name = "InvalidSiteIconsError";
+    }
+}
+export function assertSiteDefaultsCanonical(defaults) {
+    if (defaults?.locales && defaults.locales.length > 0) {
+        const { invalid } = canonicalizeLocaleList(defaults.locales);
+        if (invalid.length > 0)
+            throw new InvalidSiteDefaultsError(invalid);
+    }
+    if (defaults?.icons) {
+        const invalid = defaults.icons.filter((icon) => !validSiteIcon(icon));
+        if (defaults.icons.length === 0 || invalid.length > 0) {
+            throw new InvalidSiteIconsError(invalid.length > 0 ? invalid : defaults.icons);
+        }
+    }
+    // canonical and public URLs are built on it: an absolute http(s) origin, no path and no trailing slash
+    const origin = defaults?.origin;
+    if (origin && !(URL.canParse(origin) && /^https?:$/.test(new URL(origin).protocol) && new URL(origin).origin === origin))
+        throw new Error(`siteDefaults.origin '${origin}' must be an absolute http(s) origin such as 'https://example.com', with no path or trailing slash.`);
+    const purposes = defaults?.media?.purposes;
+    if (purposes && purposes.length > 0) {
+        const issues = collectMediaPurposeIssues(purposes);
+        if (issues.length > 0)
+            throw new InvalidMediaPurposesError(issues);
+    }
+}
+function validSiteIcon(icon) {
+    if (!icon || typeof icon !== "object" || typeof icon.src !== "string")
+        return false;
+    const validSrc = (/^\/(?!\/)[^\s\\]*$/.test(icon.src))
+        || (URL.canParse(icon.src) && new URL(icon.src).protocol === "https:");
+    return Boolean(validSrc
+        && (!icon.mimeType || ["image/png", "image/jpeg", "image/svg+xml", "image/webp"].includes(icon.mimeType))
+        && (!icon.theme || icon.theme === "light" || icon.theme === "dark")
+        && (!icon.sizes || (Array.isArray(icon.sizes) && icon.sizes.length > 0))
+        && (icon.sizes?.every((size) => typeof size === "string" && (size === "any" || /^[1-9]\d*x[1-9]\d*$/.test(size))) ?? true));
+}
+function collectMediaPurposeIssues(purposes) {
+    const out = [];
+    for (const p of purposes) {
+        if (!MEDIA_PURPOSE_SLUG_PATTERN.test(p.name)) {
+            out.push({ name: p.name, reason: "invalid-slug" });
+            continue;
+        }
+        if (p.required.length === 0) {
+            out.push({ name: p.name, reason: "empty-required" });
+            continue;
+        }
+        // Parse every slot under the `<input accept>` grammar (see
+        // MediaMimeAccept). Each slot must yield ≥1 mime; otherwise
+        // the agent has no acceptable mime to ship for that slot.
+        const slots = expandPolicyRequired(p.required);
+        const emptySlots = slots
+            .map((mimes, i) => ({ mimes, raw: p.required[i] }))
+            .filter((s) => s.mimes.length === 0);
+        if (emptySlots.length > 0) {
+            out.push({
+                name: p.name,
+                reason: "empty-required-slot",
+                detail: emptySlots.map((s) => `'${s.raw}'`).join(", "),
+            });
+            continue;
+        }
+        // Variant → slot mapping is by mime: each supplied mime must
+        // appear in exactly one slot, so the mime alone determines which
+        // slot a variant fills. (Variant role — primary / alternate — is
+        // declared independently by the agent and is NOT bound to slot
+        // position; see MediaMimeAccept.ts file header.) Overlapping mime
+        // sets break the by-mime mapping — reject at policy time rather
+        // than fail per-upload.
+        const seen = new Map();
+        const overlaps = [];
+        slots.forEach((mimes, slotIdx) => {
+            for (const mime of mimes) {
+                if (seen.has(mime)) {
+                    overlaps.push(`'${mime}' in slots [${seen.get(mime)}, ${slotIdx}]`);
+                }
+                else {
+                    seen.set(mime, slotIdx);
+                }
+            }
+        });
+        if (overlaps.length > 0) {
+            out.push({
+                name: p.name,
+                reason: "overlapping-slot-mimes",
+                detail: overlaps.join(", "),
+            });
+            continue;
+        }
+        // maxBytes must cover every mime that COULD be shipped — the
+        // expanded set, not the literal `required[i]` strings.
+        const expandedMimes = Array.from(seen.keys());
+        const missing = expandedMimes.filter((mime) => !(mime in p.maxBytes));
+        if (missing.length > 0) {
+            out.push({
+                name: p.name,
+                reason: "maxBytes-missing-mime",
+                detail: missing.join(", "),
+            });
+            continue;
+        }
+        const nonPositive = expandedMimes.filter((mime) => !(typeof p.maxBytes[mime] === "number" && p.maxBytes[mime] > 0));
+        if (nonPositive.length > 0) {
+            out.push({
+                name: p.name,
+                reason: "maxBytes-non-positive",
+                detail: nonPositive.map((m) => `${m}=${p.maxBytes[m]}`).join(", "),
+            });
+        }
+    }
+    return out;
+}
+// Re-export the accept-grammar parser at the validator level so
+// runtime consumers (CreateMediaUploadUseCase, MCP tool catalog)
+// can pull both validator + parser from one barrel.
+export { parseMimeAccept };
+//# sourceMappingURL=SiteDefaultsValidator.js.map

package/dist/spec/domain/service/SiteDefaultsValidator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SiteDefaultsValidator.js","sourceRoot":"","sources":["../../../../src/spec/domain/service/SiteDefaultsValidator.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,GAI3B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,oBAAoB,EACpB,eAAe,GAChB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,0BAA0B,CAAC;AAElC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACrB;IAA5B,YAA4B,cAAqC;QAC/D,MAAM,eAAe,GAAG,0BAA0B,CAAC,cAAc,CAAC,CAAC;QACnE,KAAK,CACH,gEAAgE;YAC9D,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAC9C,yEAAyE;YACzE,iEAAiE;YACjE,0DAA0D;YAC1D,CAAC,eAAe;gBACd,CAAC,CAAC,iOAAiO;gBACnO,CAAC,CAAC,EAAE,CAAC;YACP,mDAAmD,CACtD,CAAC;QAZwB,mBAAc,GAAd,cAAc,CAAuB;QAa/D,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAcD,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IACtB;IAA5B,YAA4B,MAAwC;QAClE,KAAK,CACH,+EAA+E;YAC7E,MAAM;iBACH,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;gBACT,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,IAAI,IAAI,WAAW,GAAG,CAAC;gBACzC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC;oBACjB,KAAK,cAAc;wBACjB,OAAO,GAAG,GAAG,uBAAuB,0BAA0B,CAAC,MAAM,EAAE,CAAC;oBAC1E,KAAK,gBAAgB;wBACnB,OAAO,GAAG,GAAG,iDAAiD,CAAC;oBACjE,KAAK,qBAAqB;wBACxB,OAAO,GAAG,GAAG,mDAAmD,CAAC,CAAC,MAAM,EAAE,CAAC;oBAC7E,KAAK,wBAAwB;wBAC3B,OAAO,GAAG,GAAG,8EAA8E,CAAC,CAAC,MAAM,EAAE,CAAC;oBACxG,KAAK,uBAAuB;wBAC1B,OAAO,GAAG,GAAG,iCAAiC,CAAC,CAAC,MAAM,EAAE,CAAC;oBAC3D,KAAK,uBAAuB;wBAC1B,OAAO,GAAG,GAAG,uCAAuC,CAAC,CAAC,MAAM,EAAE,CAAC;gBACnE,CAAC;YACH,CAAC,CAAC;iBACD,IAAI,CAAC,IAAI,CAAC;YACb,mCAAmC;YACnC,GAAG,0BAA0B,CAAC,MAAM,6BAA6B;YACjE,2DAA2D;YAC3D,+DAA+D;YAC/D,iEAAiE;YACjE,qDAAqD,CACxD,CAAC;QA5BwB,WAAM,GAAN,MAAM,CAAkC;QA6BlE,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAED,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAClB;IAA5B,YAA4B,YAAqC;QAC/D,KAAK,CACH,6FAA6F;YAC3F,2EAA2E,CAC9E,CAAC;QAJwB,iBAAY,GAAZ,YAAY,CAAyB;QAK/D,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED,MAAM,UAAU,2BAA2B,CACzC,QAAkC;IAElC,IAAI,QAAQ,EAAE,OAAO,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrD,MAAM,EAAE,OAAO,EAAE,GAAG,sBAAsB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC7D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,IAAI,wBAAwB,CAAC,OAAO,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,QAAQ,EAAE,KAAK,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;QACtE,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,qBAAqB,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IACD,uGAAuG;IACvG,MAAM,MAAM,GAAG,QAAQ,EAAE,MAAM,CAAC;IAChC,IAAI,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC;QACtH,MAAM,IAAI,KAAK,CAAC,wBAAwB,MAAM,qGAAqG,CAAC,CAAC;IACvJ,MAAM,QAAQ,GAAG,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC;IAC3C,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,IAAI,yBAAyB,CAAC,MAAM,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,IAAc;IACnC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACpF,MAAM,QAAQ,GAAG,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;WACjD,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;IACzE,OAAO,OAAO,CACZ,QAAQ;WACH,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,WAAW,EAAE,YAAY,EAAE,eAAe,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;WACtG,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK,OAAO,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC;WAChE,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;WACrE,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,KAAK,KAAK,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAC7H,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAChC,QAA2C;IAE3C,MAAM,GAAG,GAAwB,EAAE,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7C,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;YACnD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;YACrD,SAAS;QACX,CAAC;QACD,2DAA2D;QAC3D,4DAA4D;QAC5D,0DAA0D;QAC1D,MAAM,KAAK,GAAG,oBAAoB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,UAAU,GAAG,KAAK;aACrB,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;aAClD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;QACvC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,GAAG,CAAC,IAAI,CAAC;gBACP,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,MAAM,EAAE,qBAAqB;gBAC7B,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;aACvD,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,6DAA6D;QAC7D,iEAAiE;QACjE,iEAAiE;QACjE,+DAA+D;QAC/D,kEAAkE;QAClE,gEAAgE;QAChE,wBAAwB;QACxB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;QACvC,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACnB,QAAQ,CAAC,IAAI,CACX,IAAI,IAAI,eAAe,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,OAAO,GAAG,CACrD,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBAC1B,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,GAAG,CAAC,IAAI,CAAC;gBACP,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,MAAM,EAAE,wBAAwB;gBAChC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;aAC5B,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,6DAA6D;QAC7D,uDAAuD;QACvD,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QACtE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,GAAG,CAAC,IAAI,CAAC;gBACP,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,MAAM,EAAE,uBAAuB;gBAC/B,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;aAC3B,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,MAAM,WAAW,GAAG,aAAa,CAAC,MAAM,CACtC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAE,GAAG,CAAC,CAAC,CAC3E,CAAC;QACF,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,GAAG,CAAC,IAAI,CAAC;gBACP,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,MAAM,EAAE,uBAAuB;gBAC/B,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;aACnE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gEAAgE;AAChE,iEAAiE;AACjE,oDAAoD;AACpD,OAAO,EAAE,eAAe,EAAE,CAAC"}

package/dist/spec/domain/service/SqlClassify.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Row op or set op, on the compiled statement (ADR-0034 decision 4). Pure over IR, so the CLI infers a Procedure's `target` with
+ * the very rule the runtime uses to decide how a write is checked.
+ */
+import type { SqlNode as N } from "../model/SqlIr.js";
+/** The entry's own `id` column (`id` or `alias.id`), never `input.id`: an input that happens to be named id is a value, not the target. */
+export declare const isIdCol: (n: N) => boolean;
+/** `WHERE ... id = <scalar>` or a one-row INSERT is a row op; every other write is a set op. */
+export declare function classify(stmt: N): "read" | "row" | "set";
+/**
+ * What an update or delete pins: the Schema, the input that carries the id, and the input that carries the version when the
+ * statement is locked (`version = input.x`, ADR-0022). Undefined when the id is pinned to a literal or not at all.
+ */
+export declare function pinnedTarget(stmt: N): {
+    schema: string;
+    id: string;
+    version?: string;
+} | undefined;
+//# sourceMappingURL=SqlClassify.d.ts.map

package/dist/spec/domain/service/SqlClassify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SqlClassify.d.ts","sourceRoot":"","sources":["../../../../src/spec/domain/service/SqlClassify.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,OAAO,IAAI,CAAC,EAAE,MAAM,mBAAmB,CAAC;AAMtD,2IAA2I;AAC3I,eAAO,MAAM,OAAO,GAAI,GAAG,CAAC,KAAG,OAG9B,CAAC;AAEF,gGAAgG;AAChG,wBAAgB,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,GAAG,KAAK,GAAG,KAAK,CAMxD;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,CAAC,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAgBlG"}

package/dist/spec/domain/service/SqlClassify.js

@@ -0,0 +1,42 @@
+const conjuncts = (w) => (w?.BoolExpr?.boolop === "AND_EXPR" ? w.BoolExpr.args.flatMap(conjuncts) : w ? [w] : []);
+const isInput = (n) => n.ColumnRef?.fields?.length === 2 && n.ColumnRef.fields[0].String?.sval === "input";
+const isScalar = (n) => !!n.A_Const || isInput(n);
+/** The entry's own `id` column (`id` or `alias.id`), never `input.id`: an input that happens to be named id is a value, not the target. */
+export const isIdCol = (n) => {
+    const f = n.ColumnRef?.fields;
+    return !!f && f.at(-1)?.String?.sval === "id" && (f.length === 1 || (f.length === 2 && f[0].String?.sval !== "input"));
+};
+/** `WHERE ... id = <scalar>` or a one-row INSERT is a row op; every other write is a set op. */
+export function classify(stmt) {
+    if (stmt.SelectStmt)
+        return "read";
+    // ON CONFLICT is a set op: a DO NOTHING that hits the conflict must not fail with CONFLICT
+    if (stmt.InsertStmt)
+        return stmt.InsertStmt.selectStmt?.SelectStmt?.valuesLists?.length === 1 && !stmt.InsertStmt.onConflictClause ? "row" : "set";
+    const eqs = conjuncts((stmt.UpdateStmt ?? stmt.DeleteStmt).whereClause).filter((x) => x.A_Expr?.kind === "AEXPR_OP" && x.A_Expr.name[0].String.sval === "=");
+    return eqs.some((x) => (isIdCol(x.A_Expr.lexpr) && isScalar(x.A_Expr.rexpr)) || (isIdCol(x.A_Expr.rexpr) && isScalar(x.A_Expr.lexpr))) ? "row" : "set";
+}
+/**
+ * What an update or delete pins: the Schema, the input that carries the id, and the input that carries the version when the
+ * statement is locked (`version = input.x`, ADR-0022). Undefined when the id is pinned to a literal or not at all.
+ */
+export function pinnedTarget(stmt) {
+    const body = stmt.UpdateStmt ?? stmt.DeleteStmt;
+    if (!body || classify(stmt) !== "row")
+        return undefined;
+    const eqs = conjuncts(body.whereClause).filter((x) => x.A_Expr?.kind === "AEXPR_OP" && x.A_Expr.name[0].String.sval === "=");
+    const name = (n) => n.ColumnRef.fields[1].String.sval;
+    const idEq = eqs.find((x) => (isIdCol(x.A_Expr.lexpr) && isInput(x.A_Expr.rexpr)) || (isIdCol(x.A_Expr.rexpr) && isInput(x.A_Expr.lexpr)));
+    if (!idEq)
+        return undefined;
+    const verEq = eqs.find((x) => {
+        const col = (n) => n.ColumnRef?.fields?.at(-1)?.String?.sval === "version" && !isInput(n);
+        return (col(x.A_Expr.lexpr) && isInput(x.A_Expr.rexpr)) || (col(x.A_Expr.rexpr) && isInput(x.A_Expr.lexpr));
+    });
+    return {
+        schema: body.relation.relname,
+        id: name(isInput(idEq.A_Expr.rexpr) ? idEq.A_Expr.rexpr : idEq.A_Expr.lexpr),
+        ...(verEq ? { version: name(isInput(verEq.A_Expr.rexpr) ? verEq.A_Expr.rexpr : verEq.A_Expr.lexpr) } : {}),
+    };
+}
+//# sourceMappingURL=SqlClassify.js.map

package/dist/spec/domain/service/SqlClassify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SqlClassify.js","sourceRoot":"","sources":["../../../../src/spec/domain/service/SqlClassify.ts"],"names":[],"mappings":"AAMA,MAAM,SAAS,GAAG,CAAC,CAAgB,EAAO,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACtI,MAAM,OAAO,GAAG,CAAC,CAAI,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,KAAK,OAAO,CAAC;AAC9G,MAAM,QAAQ,GAAG,CAAC,CAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC;AAErD,2IAA2I;AAC3I,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAI,EAAW,EAAE;IACvC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC;IAC9B,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC;AACzH,CAAC,CAAC;AAEF,gGAAgG;AAChG,MAAM,UAAU,QAAQ,CAAC,IAAO;IAC9B,IAAI,IAAI,CAAC,UAAU;QAAE,OAAO,MAAM,CAAC;IACnC,2FAA2F;IAC3F,IAAI,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IACnJ,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;IAC7J,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;AACzJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,IAAO;IAClC,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC;IAChD,IAAI,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC;IACxD,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;IAC7H,MAAM,IAAI,GAAG,CAAC,CAAI,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAc,CAAC;IACnE,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3I,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QAC3B,MAAM,GAAG,GAAG,CAAC,CAAI,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC7F,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9G,CAAC,CAAC,CAAC;IACH,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO;QAC7B,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;QAC5E,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3G,CAAC;AACJ,CAAC"}

package/dist/spec/domain/service/SqlRefusal.d.ts

@@ -0,0 +1,16 @@
+import type { SqlDiagnosticCode } from "../model/SqlIr.js";
+/**
+ * Thrown inside the SQL allowlist and converted to a `SqlDiagnostic` at the
+ * boundary (`validateIr`, `compileSql`); it never escapes the spec module.
+ */
+export declare class SqlRefusal extends Error {
+    code: SqlDiagnosticCode;
+    offset?: number;
+    /**
+     * The keyword the refusal is about. The parser gives no position for a
+     * clause key, so the CLI finds this in the source.
+     */
+    keyword?: RegExp;
+    constructor(code: SqlDiagnosticCode, message: string, offset?: number, keyword?: RegExp);
+}
+//# sourceMappingURL=SqlRefusal.d.ts.map

package/dist/spec/domain/service/SqlRefusal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SqlRefusal.d.ts","sourceRoot":"","sources":["../../../../src/spec/domain/service/SqlRefusal.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D;;;GAGG;AACH,qBAAa,UAAW,SAAQ,KAAK;IACnC,IAAI,EAAE,iBAAiB,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;gBACL,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM;CAMxF"}

package/dist/spec/domain/service/SqlRefusal.js

@@ -0,0 +1,20 @@
+/**
+ * Thrown inside the SQL allowlist and converted to a `SqlDiagnostic` at the
+ * boundary (`validateIr`, `compileSql`); it never escapes the spec module.
+ */
+export class SqlRefusal extends Error {
+    code;
+    offset;
+    /**
+     * The keyword the refusal is about. The parser gives no position for a
+     * clause key, so the CLI finds this in the source.
+     */
+    keyword;
+    constructor(code, message, offset, keyword) {
+        super(message);
+        this.code = code;
+        this.offset = offset;
+        this.keyword = keyword;
+    }
+}
+//# sourceMappingURL=SqlRefusal.js.map

package/dist/spec/domain/service/SqlRefusal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SqlRefusal.js","sourceRoot":"","sources":["../../../../src/spec/domain/service/SqlRefusal.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,OAAO,UAAW,SAAQ,KAAK;IACnC,IAAI,CAAoB;IACxB,MAAM,CAAU;IAChB;;;OAGG;IACH,OAAO,CAAU;IACjB,YAAY,IAAuB,EAAE,OAAe,EAAE,MAAe,EAAE,OAAgB;QACrF,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF"}

package/dist/spec/domain/service/SqlTypes.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Type rules the SQL allowlist needs (ADR-0034 decisions 2 and 5): `numeric(p, s)`
+ * bounds and `interval` literals. Pure; a refusal is a `SqlRefusal`.
+ */
+import { type JsonSchema } from "../model/ManifestGrammar.js";
+export declare const MAX_NUMERIC_P = 15;
+export declare function parseNumeric(type: string): {
+    p: number;
+    s: number;
+} | undefined;
+/** The Mantle field types storage maps (`numeric(p, s)` aside): the one list a plan's `fields` are checked against. */
+export declare const MANTLE_FIELD_TYPES: ReadonlySet<string>;
+/** A field type storage can create: one of `MANTLE_FIELD_TYPES`, or a `numeric(p, s)` that `parseNumeric` accepts. */
+export declare function isFieldType(type: unknown): boolean;
+/**
+ * A TTL's `expireAfterSeconds` that reads can use: a whole number of seconds, 0 or more, whose cutoff (now less the TTL, in
+ * microseconds) stays a safe integer, which is how an instant is bound.
+ */
+export declare const MAX_TTL_SECONDS: number;
+export declare const isTtlSeconds: (x: unknown) => x is number;
+export declare function intervalMicros(text: string, typmod?: number): number;
+/** D1's search table of a Schema (FTS5) and R*Tree of each geo field: the names `near()` and `search` read. */
+export declare const ftsTableName: (schema: string) => string;
+export declare const geoTreeName: (schema: string, field: string) => string;
+/**
+ * Declarations whose search or geo tables would name one object: `a` field `b_c` and `a_b` field `c` share a tree, and a tree
+ * may be named as another's shadow table (`_node`, `_parent`, `_rowid`; FTS5's `_data` and the rest). Names fold, as SQLite's do.
+ */
+export declare function sideTableClashes(schemas: Readonly<Record<string, {
+    readonly search?: readonly string[];
+    readonly fields?: Readonly<Record<string, string>>;
+}>>): {
+    schema: string;
+    message: string;
+}[];
+/** JSON Schema property to Mantle type, as the CLI types a column or an input. `numeric(p,s)` has no manifest spelling yet. */
+export declare function fieldType(p: JsonSchema): string;
+/** A JSON Schema's top-level properties as columns or inputs: SQL folds unquoted identifiers, so keys are lower case. */
+export declare function fieldTypes(schema: JsonSchema | undefined): Record<string, string>;
+//# sourceMappingURL=SqlTypes.d.ts.map

package/dist/spec/domain/service/SqlTypes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SqlTypes.d.ts","sourceRoot":"","sources":["../../../../src/spec/domain/service/SqlTypes.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAe,KAAK,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAG3E,eAAO,MAAM,aAAa,KAAK,CAAC;AAEhC,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,CAAC,EAAE,MAAM,CAAC;IAAC,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAM/E;AAED,uHAAuH;AACvH,eAAO,MAAM,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAAsF,CAAC;AAE1I,sHAAsH;AACtH,wBAAgB,WAAW,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAIlD;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,QAAkD,CAAC;AAC/E,eAAO,MAAM,YAAY,GAAI,GAAG,OAAO,KAAG,CAAC,IAAI,MAA2F,CAAC;AAO3I,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAepE;AAED,+GAA+G;AAC/G,eAAO,MAAM,YAAY,GAAI,QAAQ,MAAM,WAA4B,CAAC;AACxE,eAAO,MAAM,WAAW,GAAI,QAAQ,MAAM,EAAE,OAAO,MAAM,WAAqC,CAAC;AAI/F;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CAAE,CAAC,CAAC,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EAAE,CAgBtM;AAED,+HAA+H;AAC/H,wBAAgB,SAAS,CAAC,CAAC,EAAE,UAAU,GAAG,MAAM,CAS/C;AAED,yHAAyH;AACzH,wBAAgB,UAAU,CAAC,MAAM,EAAE,UAAU,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAEjF"}

package/dist/spec/domain/service/SqlTypes.js

@@ -0,0 +1,110 @@
+/**
+ * Type rules the SQL allowlist needs (ADR-0034 decisions 2 and 5): `numeric(p, s)`
+ * bounds and `interval` literals. Pure; a refusal is a `SqlRefusal`.
+ */
+import { enumOptions } from "../model/ManifestGrammar.js";
+import { SqlRefusal } from "./SqlRefusal.js";
+export const MAX_NUMERIC_P = 15;
+export function parseNumeric(type) {
+    const m = /^numeric\((\d+),\s*(\d+)\)$/.exec(type);
+    if (!m)
+        return undefined;
+    const p = +m[1], s = +m[2];
+    if (p < 1 || p > MAX_NUMERIC_P || s > p)
+        throw new SqlRefusal('SQL_TYPE', `numeric(${p}, ${s}) is refused: precision is 1 to ${MAX_NUMERIC_P}, scale at most precision`);
+    return { p, s };
+}
+/** The Mantle field types storage maps (`numeric(p, s)` aside): the one list a plan's `fields` are checked against. */
+export const MANTLE_FIELD_TYPES = new Set(['text', 'integer', 'real', 'bool', 'json', 'timestamptz', 'date', 'geo']);
+/** A field type storage can create: one of `MANTLE_FIELD_TYPES`, or a `numeric(p, s)` that `parseNumeric` accepts. */
+export function isFieldType(type) {
+    if (typeof type !== 'string')
+        return false;
+    if (MANTLE_FIELD_TYPES.has(type))
+        return true;
+    try {
+        return parseNumeric(type) !== undefined;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * A TTL's `expireAfterSeconds` that reads can use: a whole number of seconds, 0 or more, whose cutoff (now less the TTL, in
+ * microseconds) stays a safe integer, which is how an instant is bound.
+ */
+export const MAX_TTL_SECONDS = Math.floor(Number.MAX_SAFE_INTEGER / 2_000_000);
+export const isTtlSeconds = (x) => Number.isSafeInteger(x) && x >= 0 && x <= MAX_TTL_SECONDS;
+/** PostgreSQL `interval` literal -> microseconds. Only second, minute and hour: day and longer are calendar units. */
+const UNIT_US = Object.fromEntries(['second seconds sec secs s', 'minute minutes min mins m', 'hour hours hr hrs h'].flatMap((names, i) => names.split(' ').map((u) => [u, [1e6, 6e7, 3.6e9][i]])));
+const TYPMOD_UNIT = { 1024: 'hour', 2048: 'minute', 4096: 'second' };
+export function intervalMicros(text, typmod) {
+    let m = /^\s*(-?\d+(?:\.\d+)?)\s*([a-z]+)\s*$/i.exec(text);
+    if (!m && typmod !== undefined && TYPMOD_UNIT[typmod] && /^\s*-?\d+(\.\d+)?\s*$/.test(text))
+        m = [text, text.trim(), TYPMOD_UNIT[typmod]];
+    if (!m)
+        throw new SqlRefusal('SQL_TYPE', `interval '${text}' is not supported: write a number and second, minute or hour`);
+    const unit = UNIT_US[m[2].toLowerCase()];
+    if (!unit && /^(days?|weeks?|months?|mons?|years?|y)$/i.test(m[2]))
+        throw new SqlRefusal('SQL_TYPE', `interval unit '${m[2]}' is a calendar unit (a day is 23 or 25 hours across daylight saving): bind the boundary as an input instead`);
+    if (!unit)
+        throw new SqlRefusal('SQL_TYPE', `interval '${text}' is not supported: write a number and second, minute or hour`);
+    // exact, in integers: a value finer than a microsecond is refused (each engine would round it its own way)
+    const [, sign, whole, frac = ''] = /^(-?)(\d+)(?:\.(\d+))?$/.exec(m[1]);
+    const scale = 10n ** BigInt(frac.length), fraction = BigInt(frac || '0') * BigInt(unit);
+    if (fraction % scale !== 0n)
+        throw new SqlRefusal('SQL_TYPE', `interval '${text}' is finer than a microsecond`);
+    const micros = (sign ? -1 : 1) * Number(BigInt(whole) * BigInt(unit) + fraction / scale);
+    // D1 stores microseconds as a double: past 2^53 two different intervals would compare equal
+    if (!Number.isSafeInteger(micros))
+        throw new SqlRefusal('SQL_TYPE', `interval '${text}' is longer than ${Number.MAX_SAFE_INTEGER} microseconds`);
+    return micros;
+}
+/** D1's search table of a Schema (FTS5) and R*Tree of each geo field: the names `near()` and `search` read. */
+export const ftsTableName = (schema) => `_mantle_fts_${schema}`;
+export const geoTreeName = (schema, field) => `_mantle_geo_${schema}_${field}`;
+const FTS5_SHADOWS = ['_data', '_idx', '_content', '_docsize', '_config'];
+const RTREE_SHADOWS = ['_node', '_parent', '_rowid'];
+/**
+ * Declarations whose search or geo tables would name one object: `a` field `b_c` and `a_b` field `c` share a tree, and a tree
+ * may be named as another's shadow table (`_node`, `_parent`, `_rowid`; FTS5's `_data` and the rest). Names fold, as SQLite's do.
+ */
+export function sideTableClashes(schemas) {
+    const named = new Map(); // folded table name -> the declaration that names it
+    const out = [];
+    for (const [schema, s] of Object.entries(schemas)) {
+        const tables = [
+            ...(s.search?.length ? [{ owner: `${schema} search`, name: ftsTableName(schema), shadows: FTS5_SHADOWS }] : []),
+            ...Object.entries(s.fields ?? {}).filter(([, t]) => t === 'geo').map(([f]) => ({ owner: `${schema}.${f}`, name: geoTreeName(schema, f), shadows: RTREE_SHADOWS })),
+        ];
+        for (const t of tables)
+            for (const n of [t.name, ...t.shadows.map((x) => t.name + x)]) {
+                const prior = named.get(n.toLowerCase());
+                if (prior !== undefined && prior !== t.owner)
+                    out.push({ schema, message: `${t.owner} and ${prior} would both name the table ${n}: rename a Schema or a field` });
+                else
+                    named.set(n.toLowerCase(), t.owner);
+            }
+    }
+    return out;
+}
+/** JSON Schema property to Mantle type, as the CLI types a column or an input. `numeric(p,s)` has no manifest spelling yet. */
+export function fieldType(p) {
+    const types = [...new Set([p.type].flat().filter((x) => x !== "null"))];
+    // integer or number is one number; any other union keeps each value's own JSON type
+    if (types.length > 1)
+        return types.every((x) => x === "integer" || x === "number") ? "real" : "json";
+    const t = types[0];
+    if (p.format === "geo")
+        return "geo";
+    if (!t && enumOptions(p))
+        return "text"; // a string enum or a oneOf of string consts
+    if (t === "string")
+        return p.format === "date-time" ? "timestamptz" : p.format === "date" ? "date" : "text";
+    return { integer: "integer", number: "real", boolean: "bool" }[String(t)] ?? "json";
+}
+/** A JSON Schema's top-level properties as columns or inputs: SQL folds unquoted identifiers, so keys are lower case. */
+export function fieldTypes(schema) {
+    return Object.fromEntries(Object.entries(schema?.properties ?? {}).map(([name, p]) => [name.toLowerCase(), fieldType(p)]));
+}
+//# sourceMappingURL=SqlTypes.js.map

package/dist/spec/domain/service/SqlTypes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SqlTypes.js","sourceRoot":"","sources":["../../../../src/spec/domain/service/SqlTypes.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,WAAW,EAAmB,MAAM,6BAA6B,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE7C,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC;AAEhC,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,CAAC,GAAG,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC;IAC7B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,aAAa,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,UAAU,EAAE,WAAW,CAAC,KAAK,CAAC,mCAAmC,aAAa,2BAA2B,CAAC,CAAC;IACzK,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;AAClB,CAAC;AAED,uHAAuH;AACvH,MAAM,CAAC,MAAM,kBAAkB,GAAwB,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AAE1I,sHAAsH;AACtH,MAAM,UAAU,WAAW,CAAC,IAAa;IACvC,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,CAAC;QAAC,OAAO,YAAY,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AAC1E,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAAC;AAC/E,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAU,EAAe,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAK,CAAY,IAAI,CAAC,IAAK,CAAY,IAAI,eAAe,CAAC;AAE3I,sHAAsH;AACtH,MAAM,OAAO,GAA2B,MAAM,CAAC,WAAW,CACvD,CAAC,2BAA2B,EAAE,2BAA2B,EAAE,qBAAqB,CAAW,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAC5K,CAAC;AACF,MAAM,WAAW,GAA2B,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC7F,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,MAAe;IAC1D,IAAI,CAAC,GAAG,uCAAuC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3D,IAAI,CAAC,CAAC,IAAI,MAAM,KAAK,SAAS,IAAI,WAAW,CAAC,MAAM,CAAC,IAAI,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,WAAW,CAAC,MAAM,CAAC,CAAQ,CAAC;IACjJ,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,UAAU,EAAE,aAAa,IAAI,+DAA+D,CAAC,CAAC;IAC3H,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI,IAAI,0CAA0C,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,8GAA8G,CAAC,CAAC;IAC5O,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,UAAU,CAAC,UAAU,EAAE,aAAa,IAAI,+DAA+D,CAAC,CAAC;IAC9H,2GAA2G;IAC3G,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,CAAC,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,CAAE,CAAC;IAC1E,MAAM,KAAK,GAAG,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC,IAAI,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACxF,IAAI,QAAQ,GAAG,KAAK,KAAK,EAAE;QAAE,MAAM,IAAI,UAAU,CAAC,UAAU,EAAE,aAAa,IAAI,+BAA+B,CAAC,CAAC;IAChH,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,KAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,GAAG,KAAK,CAAC,CAAC;IAC1F,4FAA4F;IAC5F,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,UAAU,EAAE,aAAa,IAAI,oBAAoB,MAAM,CAAC,gBAAgB,eAAe,CAAC,CAAC;IACjJ,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,+GAA+G;AAC/G,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,eAAe,MAAM,EAAE,CAAC;AACxE,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,MAAc,EAAE,KAAa,EAAE,EAAE,CAAC,eAAe,MAAM,IAAI,KAAK,EAAE,CAAC;AAC/F,MAAM,YAAY,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;AAC1E,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;AAErD;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAA8H;IAC7J,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,qDAAqD;IAC9F,MAAM,GAAG,GAA0C,EAAE,CAAC;IACtD,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAClD,MAAM,MAAM,GAAG;YACb,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,MAAM,SAAS,EAAE,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/G,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC;SACnK,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,MAAM;YACpB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9D,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;gBACzC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,CAAC,CAAC,KAAK;oBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,KAAK,QAAQ,KAAK,8BAA8B,CAAC,8BAA8B,EAAE,CAAC,CAAC;;oBAC7J,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YAC3C,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,+HAA+H;AAC/H,MAAM,UAAU,SAAS,CAAC,CAAa;IACrC,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC;IACxE,oFAAoF;IACpF,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;IACrG,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACnB,IAAI,CAAC,CAAC,MAAM,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IACrC,IAAI,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC,CAAC,4CAA4C;IACrF,IAAI,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5G,OAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAA6B,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;AAClH,CAAC;AAED,yHAAyH;AACzH,MAAM,UAAU,UAAU,CAAC,MAA8B;IACvD,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7H,CAAC"}

package/dist/spec/domain/service/StaffRoleHierarchy.d.ts

@@ -0,0 +1,3 @@
+import type { StaffRole } from "../model/ManifestGrammar.js";
+export declare function meetsRole(actual: StaffRole, min: StaffRole): boolean;
+//# sourceMappingURL=StaffRoleHierarchy.d.ts.map

package/dist/spec/domain/service/StaffRoleHierarchy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"StaffRoleHierarchy.d.ts","sourceRoot":"","sources":["../../../../src/spec/domain/service/StaffRoleHierarchy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAkB7D,wBAAgB,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,GAAG,OAAO,CAEpE"}

package/dist/spec/domain/service/StaffRoleHierarchy.js

@@ -0,0 +1,19 @@
+/**
+ * Staff-role ordering: `owner > editor > contributor`. Used by
+ * permission checks that want "role-or-above" semantics (e.g. "this
+ * action needs at least editor").
+ *
+ * Lives in `domain/service/` because role-rank comparison is
+ * behavior, not pure-type grammar — the `STAFF_ROLES` enum + the
+ * `StaffRole` type stay in `domain/model/ManifestGrammar.ts` (those
+ * are referenced by the parser).
+ */
+const ROLE_RANK = {
+    owner: 3,
+    editor: 2,
+    contributor: 1,
+};
+export function meetsRole(actual, min) {
+    return ROLE_RANK[actual] >= ROLE_RANK[min];
+}
+//# sourceMappingURL=StaffRoleHierarchy.js.map

package/dist/spec/domain/service/StaffRoleHierarchy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"StaffRoleHierarchy.js","sourceRoot":"","sources":["../../../../src/spec/domain/service/StaffRoleHierarchy.ts"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AACH,MAAM,SAAS,GAA8B;IAC3C,KAAK,EAAE,CAAC;IACR,MAAM,EAAE,CAAC;IACT,WAAW,EAAE,CAAC;CACf,CAAC;AAEF,MAAM,UAAU,SAAS,CAAC,MAAiB,EAAE,GAAc;IACzD,OAAO,SAAS,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC;AAC7C,CAAC"}

package/dist/spec/domain/service/TriggerGraphChecks.d.ts

@@ -0,0 +1,16 @@
+/** Graph checks across Triggers, Procedures and Views: targets, guards, sql handlers, and MCP tool names. */
+import { type Diagnostic } from "../../kernel/diagnostic.js";
+import { type ProcedureManifest, type SchemaManifest, type TriggerManifest, type ViewManifest } from "../model/ManifestGrammar.js";
+import { type ManifestFilePaths } from "./ManifestPathDiagnoser.js";
+/** `Procedure.spec.target` names what the handler mutates and locks. */
+export declare function checkProcedureTarget(procedure: ProcedureManifest, schemasByName: ReadonlyMap<string, SchemaManifest>, filePaths?: ManifestFilePaths): Diagnostic[];
+export declare function checkViewRefs(v: ViewManifest, schemasByName: ReadonlyMap<string, SchemaManifest>, filePaths?: ManifestFilePaths): Diagnostic[];
+export declare function checkSqlHandler(p: ProcedureManifest, filePaths?: ManifestFilePaths): Diagnostic[];
+export declare function checkGuards(targets: ReadonlyArray<ProcedureManifest | ViewManifest>, proceduresByName: ReadonlyMap<string, ProcedureManifest>, filePaths?: ManifestFilePaths): Diagnostic[];
+export declare function checkTriggerRefs(triggers: ReadonlyArray<TriggerManifest>, proceduresByName: ReadonlyMap<string, ProcedureManifest>, filePaths?: ManifestFilePaths, schemasByName?: ReadonlyMap<string, SchemaManifest>): Diagnostic[];
+/**
+ * MCP tools come only from Views and Procedures (ADR-0032): a View's tool and a Procedure's tool share one namespace, named by the
+ * manifest name with kebab folded to snake. Internal Views are never tools.
+ */
+export declare function checkMcpToolNameCollisions(views: readonly ViewManifest[], procedures: readonly ProcedureManifest[], triggers: readonly TriggerManifest[], filePaths?: ManifestFilePaths): Diagnostic[];
+//# sourceMappingURL=TriggerGraphChecks.d.ts.map

package/dist/spec/domain/service/TriggerGraphChecks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TriggerGraphChecks.d.ts","sourceRoot":"","sources":["../../../../src/spec/domain/service/TriggerGraphChecks.ts"],"names":[],"mappings":"AAAA,6GAA6G;AAC7G,OAAO,EAAsB,KAAK,UAAU,EAAE,MAAM,4BAA4B,CAAC;AACjF,OAAO,EAAwB,KAAK,iBAAiB,EAAE,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,KAAK,YAAY,EAAmB,MAAM,6BAA6B,CAAC;AAE1K,OAAO,EAA2B,KAAK,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAG7F,wEAAwE;AACxE,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,iBAAiB,EAC5B,aAAa,EAAE,WAAW,CAAC,MAAM,EAAE,cAAc,CAAC,EAClD,SAAS,CAAC,EAAE,iBAAiB,GAC5B,UAAU,EAAE,CA2Bd;AAaD,wBAAgB,aAAa,CAC3B,CAAC,EAAE,YAAY,EACf,aAAa,EAAE,WAAW,CAAC,MAAM,EAAE,cAAc,CAAC,EAClD,SAAS,CAAC,EAAE,iBAAiB,GAC5B,UAAU,EAAE,CAiBd;AAED,wBAAgB,eAAe,CAC7B,CAAC,EAAE,iBAAiB,EACpB,SAAS,CAAC,EAAE,iBAAiB,GAC5B,UAAU,EAAE,CAsBd;AAED,wBAAgB,WAAW,CACzB,OAAO,EAAE,aAAa,CAAC,iBAAiB,GAAG,YAAY,CAAC,EACxD,gBAAgB,EAAE,WAAW,CAAC,MAAM,EAAE,iBAAiB,CAAC,EACxD,SAAS,CAAC,EAAE,iBAAiB,GAC5B,UAAU,EAAE,CAkEd;AAED,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,aAAa,CAAC,eAAe,CAAC,EACxC,gBAAgB,EAAE,WAAW,CAAC,MAAM,EAAE,iBAAiB,CAAC,EACxD,SAAS,CAAC,EAAE,iBAAiB,EAC7B,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,cAAc,CAAC,GAClD,UAAU,EAAE,CAgJd;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,SAAS,YAAY,EAAE,EAC9B,UAAU,EAAE,SAAS,iBAAiB,EAAE,EACxC,QAAQ,EAAE,SAAS,eAAe,EAAE,EACpC,SAAS,CAAC,EAAE,iBAAiB,GAC5B,UAAU,EAAE,CAoDd"}