@aotter/mantle 0.2.0-alpha.1 → 0.2.0-alpha.11

package/dist/domain/describe/chunk-SGMRVDGE.js

@@ -0,0 +1 @@
+function resolveLocalizedText(value,preferred,canonical2){if(value==null)return null;if(typeof value=="string")return value;if(Object.prototype.hasOwnProperty.call(value,preferred))return value[preferred];if(canonical2&&Object.prototype.hasOwnProperty.call(value,canonical2))return value[canonical2];let firstKey=Object.keys(value)[0];return firstKey!==void 0?value[firstKey]:null}var INPUT_RULE_KEYWORDS=["dependentRequired","anyOf","if","then","else"];function lookupLocalRef(root,ref){if(typeof ref!="string"||!ref.startsWith("#/"))return;let value=root;try{for(let key of decodeURIComponent(ref.slice(2)).split("/").map(key2=>key2.replace(/~1/g,"/").replace(/~0/g,"~")))value=value&&typeof value=="object"&&Object.hasOwn(value,key)?value[key]:void 0}catch{return}return value&&typeof value=="object"?value:void 0}function rootRefChain(input){let chain=[];for(let schema=input;schema!==void 0;schema=lookupLocalRef(input,schema.$ref)){if(chain.includes(schema))return;if(chain.push(schema),schema.$ref===void 0)return chain}}function mcpToolNameSegment(name){return name.toLowerCase().replace(/-/g,"_")}function toolTitle(name){let words=name.replace(/([a-z0-9])([A-Z])/g,"$1 $2").replace(/[-_.\s]+/g," ").trim().toLowerCase();return words.charAt(0).toUpperCase()+words.slice(1)}var viewAnnotations={readOnlyHint:!0,destructiveHint:!1};function procedureAnnotations(p){let readOnlyHint=p.mcp?.readOnlyHint??!1;return{readOnlyHint,destructiveHint:!readOnlyHint&&("ref"in p.handler||overwrites(p.handler.sql.stmts)),...p.mcp}}var overwrites=node=>!!node&&typeof node=="object"&&("DeleteStmt"in node||"UpdateStmt"in node||node.onConflictClause?.action==="ONCONFLICT_UPDATE"||Object.values(node).some(overwrites));function mcpTools(plan,surface,locale="en"){let text=t=>resolveLocalizedText(t,locale,"en")??void 0,tools=new Map,add=tool=>{let prior=tools.get(tool.name);if(prior&&(prior.kind!==tool.kind||prior.source!==tool.source))throw new TypeError(`MCP tool '${tool.name}' comes from both '${prior.source}' and '${tool.source}'.`);tools.set(tool.name,tool)};for(let t of Object.values(plan.triggers)){if(t.source.kind!=="mcp"||t.source.surface!==surface)continue;let p=plan.procedures[t.procedure],title=text(p.title);add({name:mcpToolNameSegment(t.procedure),kind:"procedure",source:t.procedure,title:title??toolTitle(t.procedure),description:text(p.description)??title??t.procedure,inputSchema:p.input,...p.output.type==="object"?{outputSchema:p.output}:{},annotations:procedureAnnotations(p),requires:p.requires})}for(let[name,v]of Object.entries(plan.views)){if(v.surface!==surface)continue;let chain=(v.input?rootRefChain(v.input)??[v.input]:[]).reverse(),props=Object.assign({},...chain.map(s=>s.properties??{})),required=[...new Set(chain.flatMap(s=>s.required??[]))];if("limit"in props||"cursor"in props)throw new TypeError(`View '${name}' declares an input named limit or cursor; the MCP tool reserves both for paging.`);let rules=chain.map(s=>Object.fromEntries(INPUT_RULE_KEYWORDS.flatMap(k=>s[k]===void 0?[]:[[k,s[k]]]))).filter(r=>Object.keys(r).length),defs=v.input?referencedDefs(v.input,props):{},title=text(v.title);add({name:mcpToolNameSegment(name),kind:"view",source:name,title:title??toolTitle(name),description:text(v.description)??title??name,inputSchema:{type:"object",properties:{...props,limit:{type:"integer",minimum:1,maximum:500},cursor:{type:"string"}},...required.length?{required}:{},...rules.length>1?{allOf:rules}:rules[0],...Object.keys(defs).length?{$defs:defs}:{}},annotations:viewAnnotations,requires:v.requires})}return[...tools.values()]}function referencedDefs(root,node,found={}){if(!node||typeof node!="object")return found;let ref=node.$ref,[head,segment]=typeof ref=="string"&&ref.startsWith("#/")?decoded(ref.slice(2)).split("/"):[],key=head==="$defs"?segment?.replace(/~1/g,"/").replace(/~0/g,"~"):void 0;key!==void 0&&!Object.hasOwn(found,key)&&root.$defs&&Object.hasOwn(root.$defs,key)&&(found[key]=root.$defs[key],referencedDefs(root,found[key],found));for(let child of Object.values(node))referencedDefs(root,child,found);return found}var decoded=pointer=>{try{return decodeURIComponent(pointer)}catch{return""}};function canonical(v){return Array.isArray(v)?`[${v.map(canonical).join(",")}]`:v&&typeof v=="object"?`{${Object.keys(v).sort().filter(k=>v[k]!==void 0).map(k=>`${JSON.stringify(k)}:${canonical(v[k])}`).join(",")}}`:JSON.stringify(v)??"null"}var publishingTransitions=[["publish",["draft"],"published"],["unpublish",["published","archived"],"draft"],["archive",["draft","published"],"archived"]];var publishingInput={type:"object",properties:{id:{type:"string",minLength:1},expectedVersion:{type:"integer",minimum:1}},required:["id","expectedVersion"],additionalProperties:!1};function mediaDefinitions(){let define=(name,description,inputSchema,action,readOnlyHint=!1)=>({name,description,inputSchema,action,annotations:{readOnlyHint,destructiveHint:action==="delete",openWorldHint:!0}}),string={type:"string"},texts={alt:{type:"string",maxLength:1e3},caption:{type:"string",maxLength:1e3}},input=(properties,required=[])=>({type:"object",properties,required,additionalProperties:!1});return[define("get_media_upload_policy","Read declared image purpose MIME slots and byte caps before preparing variants or requesting an upload. Optimization runs locally, never in the host.",input({}),"policy",!0),define("create_media_upload","Create short-lived PUT capabilities for image variants. Read site media purpose policy first; optimize images locally. Obtain attachment bytes yourself, then PUT each variant with its requiredHeaders and call commit_media_upload. Never store upload URLs as published images or ask the user to run terminal commands.",input({filename:{type:"string",maxLength:255},purpose:string,variants:{type:"array",minItems:1,items:input({mimeType:string,byteSize:{type:"integer",minimum:1},role:{type:"string",enum:["primary","alternate","fallback"]}},["mimeType","byteSize","role"])},...texts},["filename","purpose","variants"]),"create"),define("commit_media_upload","Verify all uploaded variants and commit one permanent media asset. Store the returned asset id in fields referencing media_assets.id, never a temporary upload URL. Unknown or expired upload groups require a new create_media_upload.",input({uploadGroupId:string,...texts},["uploadGroupId"]),"commit"),define("list_media_assets","List committed image assets, newest first, with their permanent variants and alt/caption. Search matches id, alt or caption; reuse only a returned cursor.",input({limit:{type:"integer",minimum:1,maximum:500},cursor:string,search:string}),"list",!0),define("get_media_asset","Read one committed media asset and its permanent variant URLs.",input({id:string},["id"]),"get",!0),define("update_media_asset","Update committed asset alt or caption; omitted fields remain unchanged and empty strings clear text.",input({id:string,...texts},["id"]),"update"),define("delete_media_asset","Delete an asset's objects and library record. Check application references first. A partial failure can be retried using the same id.",input({id:string},["id"]),"delete")]}function inspectSql(value){let schemas=new Set,readSchemas=new Set,writes=[],readOnly=!0,walk=v=>{if(!v||typeof v!="object")return;let n=v;n.RangeVar?.mantle==="table"&&(schemas.add(n.RangeVar.relname.toLowerCase()),readSchemas.add(n.RangeVar.relname.toLowerCase()));for(let kind of["InsertStmt","UpdateStmt","DeleteStmt"])n[kind]&&(readOnly=!1,n[kind].relation?.relname&&writes.push({schema:n[kind].relation.relname.toLowerCase(),operation:kind==="InsertStmt"?"create":kind==="UpdateStmt"?"update":"delete"}),n[kind].relation?.relname&&(schemas.add(n[kind].relation.relname.toLowerCase()),kind!=="InsertStmt"&&readSchemas.add(n[kind].relation.relname.toLowerCase())));Object.values(n).forEach(walk)};return walk(value),{schemas:[...schemas].sort(),readSchemas:[...readSchemas].sort(),readOnly,writes}}function mergeRestrict(policies,conjunctive){return Object.fromEntries([...new Set(policies.flatMap(p=>Object.keys(p)))].sort().map(schema=>{let rows=policies.map(p=>p[schema]??{terms:[]}),terms=[...new Map(rows.flatMap(p=>p.terms).map(t=>[canonical(t),t])).values()].filter(t=>conjunctive||rows.every(p=>p.terms.some(v=>canonical(v)===canonical(t)))),owner=rows.find(p=>p.owner)?.owner;return[schema,{...owner&&(conjunctive||rows.every(p=>p.owner===owner))?{owner}:{},terms}]}))}function inspectBehavior(plan,ir,opaque,requires,restrict,writes){let inspected=inspectSql(ir);writes&&(inspected.writes=[...writes],inspected.schemas.push(...writes.map(w=>w.schema)),inspected.readSchemas.push(...writes.filter(w=>w.operation!=="create").map(w=>w.schema)));let dependencies=[],policies=[restrict??{}],procedures=new Set,hooks=new Set,visit=name=>{if(procedures.has(name))return;procedures.add(name);let p=plan.procedures[name];if(!p)throw new TypeError(`Unknown dependency '${name}'.`);dependencies.push({procedure:name,declaration:p}),policies.push(p.restrict??{}),opaque||="ref"in p.handler;let g=inspectSql("sql"in p.handler?p.handler.sql.stmts:void 0);inspected.schemas.push(...g.schemas),inspected.readSchemas.push(...g.readSchemas),inspected.writes.push(...g.writes),inspected.readOnly&&=g.readOnly,p.requires?.guard&&visit(p.requires.guard.procedure)};for(requires?.guard&&visit(requires.guard.procedure);;){let before=hooks.size;for(let[id,t]of Object.entries(plan.triggers).sort(([a],[b])=>a<b?-1:a>b?1:0)){if(t.source.kind!=="lifecycle"||hooks.has(id))continue;let source=t.source;!opaque&&!inspected.writes.some(w=>w.schema===source.schema.toLowerCase()&&source.on.some(on=>on.endsWith(`_${w.operation}`)))||(hooks.add(id),dependencies.push({trigger:id,source}),visit(t.procedure))}if(hooks.size===before)break}let related=names=>{let all=new Set(opaque?Object.keys(plan.schemas):names);for(let name of all){let parent=plan.schemas[name]?.translates?.parent.toLowerCase();parent&&all.add(parent)}return[...all].sort()};return{...inspected,schemas:related(inspected.schemas),readSchemas:related(inspected.readSchemas),opaque,restrict:mergeRestrict(policies,!0),dependencies}}var objectInput={type:"object",properties:{}},pathTemplate=path=>path.replace(/\{([^}]+)\}/g,":$1"),adminRoutes=["GET /me","GET /site","GET /collections","GET /views-manifest","GET /operations","GET /webmcp","POST /webmcp/:tool","GET /bootstrap","GET /views/:name/export","GET /views/:name","GET /view-batch","GET /developer/views/:name","POST /operations/:name","GET /developer-console","GET /collections/:name/statistics","GET /entries","GET /entries/export","GET /entries/:id","POST /entries","PATCH /entries/:id","POST /entries/:id/publish","POST /entries/:id/unpublish","POST /entries/:id/archive","DELETE /entries/:id","GET /site-settings","PATCH /site-settings","POST /media/uploads","POST /media/uploads/:groupId/commit","GET /media","GET /media/:id","PATCH /media/:id","DELETE /media/:id","GET /admin","GET /members","PATCH /admin/:id/role","POST /admin/invitations","DELETE /admin/invitations/:id"];function targetDefinitions(plan){let out=[],tools=[...mcpTools(plan,"public"),...mcpTools(plan,"admin")];for(let[kind,entries]of[["view",plan.views],["procedure",plan.procedures]])for(let[name,p]of Object.entries(entries).sort(([a],[b])=>a<b?-1:a>b?1:0)){let view=kind==="view"?plan.views[name]:void 0,proc=kind==="procedure"?plan.procedures[name]:void 0,ir=view?.stmts??(proc&&"sql"in proc.handler?proc.handler.sql.stmts:void 0),inspected=inspectBehavior(plan,ir,!!proc&&"ref"in proc.handler,p.requires,p.restrict),tool=tools.find(t=>t.kind===kind&&t.source===name),title=resolveLocalizedText(p.title,"en","en")??name,triggers=Object.entries(plan.triggers).filter(([,t])=>kind==="procedure"&&t.procedure===name).sort(([a],[b])=>a<b?-1:a>b?1:0).map(([id,t])=>({id,source:t.source})),surfaces=[...new Set([...view?[view.surface,"admin",...view.surface==="public"?["rest"]:[]]:[],...triggers.map(t=>t.source.kind==="mcp"?t.source.surface:t.source.kind==="http"?"rest":t.source.kind)])].sort();surfaces.length||surfaces.push("internal"),out.push({id:`${kind}:${name}`,name:tool?.name??mcpToolNameSegment(name),kind,surface:view?.surface??(surfaces.includes("public")||surfaces.includes("rest")?"public":surfaces.includes("admin")?"admin":"internal"),surfaces,triggers,title,description:resolveLocalizedText(p.description,"en","en")??title,inputSchema:tool?.inputSchema??view?.input??proc?.input??objectInput,annotations:tool?.annotations??{},requires:p.requires,restrict:inspected.restrict,schemas:inspected.schemas,readSchemas:inspected.readSchemas,readOnly:!inspected.opaque&&inspected.readOnly,opaque:inspected.opaque,trustedOnly:!!proc?.trustedOnly,variants:[],behavior:{declaration:p,dependencies:inspected.dependencies}})}let addRoute=(id,dependencies,inputSchema=objectInput)=>{let admin=id.startsWith("admin:");out.push({id,name:id.replace(/[^a-zA-Z0-9_-]/g,"_"),title:id,description:id,kind:admin?"admin":"rest",surface:admin?"admin":"public",surfaces:[admin?"admin":"rest"],triggers:dependencies.flatMap(d=>d.triggers),inputSchema,annotations:{},requires:admin?{auth:{all:["ctx.admin"]}}:dependencies[0]?.requires,restrict:mergeRestrict(dependencies.map(d=>d.restrict),!1),schemas:[...new Set(dependencies.flatMap(d=>d.schemas))].sort(),readSchemas:[...new Set(dependencies.flatMap(d=>d.readSchemas))].sort(),readOnly:dependencies.length>0&&dependencies.every(d=>d.readOnly)&&(!admin||id.startsWith("admin:GET ")||id==="admin:POST /operations/:name"||id==="admin:POST /webmcp/:tool"),opaque:dependencies.some(d=>d.opaque),trustedOnly:dependencies.some(d=>d.trustedOnly),variants:dependencies,behavior:dependencies.map(d=>({id:d.id,behavior:d.behavior,surfaces:d.surfaces,triggers:d.triggers,input:d.inputSchema,requires:d.requires,restrict:d.restrict,trustedOnly:d.trustedOnly}))})},declarations=[...out],adminOperations=new Set(mcpTools(plan,"admin").filter(t=>t.kind==="procedure").map(t=>`procedure:${t.source}`));for(let d of declarations)d.kind==="view"&&d.surfaces.includes("public")&&addRoute(`rest:GET /api/views/${d.id.slice(5)}`,[d],d.inputSchema);for(let[,t]of Object.entries(plan.triggers).sort(([a],[b])=>a<b?-1:a>b?1:0))if(t.source.kind==="http"){let d=declarations.find(d2=>d2.id===`procedure:${t.procedure}`);addRoute(`rest:${t.source.method} ${pathTemplate(t.source.path)}`,[d],d.inputSchema)}let generated=[];for(let[schema,s]of Object.entries(plan.schemas).sort(([a],[b])=>a<b?-1:a>b?1:0))if(s.publishing)for(let[verb,from,to]of publishingTransitions){addRoute(`procedure:${s.name}.${verb}`,[],publishingInput);let d=out.at(-1),inspected=inspectBehavior(plan,void 0,!1,void 0,void 0,[{schema,operation:verb==="publish"?"publish":"update"}]);Object.assign(d,{kind:"procedure",name:mcpToolNameSegment(`${verb}_${s.name}`),surface:"admin",surfaces:["admin"],requires:{auth:{all:["ctx.admin"]}},schemas:[...new Set([schema,...inspected.schemas])].sort(),readSchemas:[...new Set([schema,...inspected.readSchemas])].sort(),opaque:inspected.opaque,behavior:{schema,verb,from,to,dependencies:inspected.dependencies}}),generated.push(d)}for(let tool of mediaDefinitions()){addRoute(`admin:tool:${tool.name}`,[],tool.inputSchema);let d=out.at(-1);Object.assign(d,{name:tool.name,readOnly:tool.annotations.readOnlyHint,opaque:!tool.annotations.readOnlyHint,annotations:tool.annotations,behavior:{tool,schemas:plan.schemas}}),generated.push(d)}for(let route of adminRoutes){let deps=route.includes("/views/:")||route==="GET /view-batch"?declarations.filter(d2=>d2.kind==="view"&&(route.includes("/developer/")||plan.views[d2.id.slice(5)]?.surface==="admin")):route.includes("/operations/:")?declarations.filter(d2=>adminOperations.has(d2.id)):route==="POST /webmcp/:tool"?declarations.filter(d2=>mcpTools(plan,"admin").some(t=>`${t.kind}:${t.source}`===d2.id)).concat(generated):[],generic=route.includes("/entries")||route.includes("/statistics")||route==="GET /bootstrap";addRoute(`admin:${route}`,deps,deps.length&&route!=="GET /view-batch"?{...objectInput,anyOf:deps.map(d2=>({type:"object",properties:{[route.includes("/webmcp/")?"tool":"name"]:{type:"string",const:route.includes("/webmcp/")?d2.name:d2.id.slice(d2.kind==="view"?5:10)}}}))}:objectInput);let d=out.at(-1);if(generic){let operation=route==="POST /entries"?"create":route==="DELETE /entries/:id"?"delete":route.startsWith("GET ")?void 0:route.endsWith("/publish")?"publish":"update",inspected=inspectBehavior(plan,void 0,!1,void 0,void 0,operation?Object.keys(plan.schemas).map(schema=>({schema,operation})):[]);d.schemas=Object.keys(plan.schemas).sort(),d.readSchemas=d.schemas,d.opaque=inspected.opaque,d.behavior={schemas:plan.schemas,dependencies:inspected.dependencies}}}return[...new Map(out.map(d=>[d.id,d])).values()].sort((a,b)=>a.id<b.id?-1:a.id>b.id?1:0)}async function hash(value){let digest=await crypto.subtle.digest("SHA-256",new TextEncoder().encode(canonical(value)));return[...new Uint8Array(digest)].map(b=>b.toString(16).padStart(2,"0")).join("")}function hashDefinition(plan,d){return hash({id:d.id,surfaces:d.surfaces,triggers:d.triggers,behavior:d.behavior,input:d.inputSchema,requires:d.requires,restrict:d.restrict,dialect:plan.dialect,schemas:Object.fromEntries(d.schemas.map(name=>[name,plan.schemas[name]])),userFields:plan.access?.userFields,readOnly:d.readOnly,opaque:d.opaque,trustedOnly:d.trustedOnly})}async function targetHash(plan,targetId){let target=targetDefinitions(plan).find(d=>d.id===targetId);if(!target)throw new TypeError(`Unknown target '${targetId}'.`);return hashDefinition(plan,target)}export{canonical,targetDefinitions,hash,hashDefinition,targetHash};

package/dist/domain/describe/index.d.ts

@@ -0,0 +1,58 @@
+import type { RuntimePlan } from "../../build/compiler.js";
+import type { PlanRestrict } from "../../build/spec/domain/model/RuntimePlan.js";
+import type { UserFieldSpec } from "../../build/spec/domain/model/UserFields.js";
+import { type TargetDefinition } from "./targets.js";
+export { targetHash } from "./target-hash.js";
+export interface DescribeTarget {
+    name: string;
+    title: string;
+    description: string;
+    inputSchema: import("../../build/compiler.js").JsonSchema;
+    annotations: import("../../build/spec/domain/model/ManifestGrammar.js").ProcedureMcpAnnotations;
+    _meta: {
+        surfaces: string[];
+        triggers: TargetDefinition["triggers"];
+        id: string;
+        targetHash: string;
+        readOnly: boolean;
+        scope: PlanRestrict;
+        restrict: PlanRestrict;
+        opaque: boolean;
+        unscopedReads: boolean;
+        trustedOnly: boolean;
+        variants: {
+            id: string;
+            scope: PlanRestrict;
+            restrict: PlanRestrict;
+            requires: Requirements;
+            inputSchema: DescribeTarget["inputSchema"];
+            readOnly: boolean;
+            trustedOnly: boolean;
+            opaque: boolean;
+            unscopedReads: boolean;
+        }[];
+        requires: Requirements;
+    };
+}
+interface Requirements {
+    all: readonly (string | {
+        readonly "ctx.auth.scope": string;
+    })[];
+    guard?: string;
+}
+export interface AppDescription {
+    schemaVersion: 1;
+    access: Readonly<Record<string, UserFieldSpec>>;
+    targets: DescribeTarget[];
+}
+/** A report of sealed declarations; no SQL or row values leave this function. */
+export declare function describeApp(plan: RuntimePlan): Promise<AppDescription>;
+export interface AppChange {
+    id: string;
+    field: string;
+    direction: "widened" | "narrowed" | "changed";
+    before?: unknown;
+    after?: unknown;
+}
+/** Report widening on any reachable surface or dispatcher variant. */
+export declare function diffApp(a: AppDescription, b: AppDescription): AppChange[];

package/dist/domain/describe/index.js

@@ -0,0 +1 @@
+import{canonical,hashDefinition,targetDefinitions,targetHash}from"./chunk-SGMRVDGE.js";function requirements(d,surface){let all=d.requires?.auth?.all??[];return{all:surface==="admin"&&!all.includes("ctx.admin")?["ctx.admin",...all]:all,...d.requires?.guard?{guard:d.requires.guard.procedure}:{}}}async function describeApp(plan){let targets=await Promise.all(targetDefinitions(plan).map(async d=>{let scope=Object.fromEntries(d.schemas.map(name=>{let s=plan.schemas[name];return[name,{...s.scope?{owner:s.scope}:{},terms:s.userScopes??[]}]}));return{name:d.name,title:d.title,description:d.description,inputSchema:d.inputSchema,annotations:{...d.annotations,readOnlyHint:d.readOnly},_meta:{surfaces:d.surfaces,triggers:d.triggers,id:d.id,targetHash:await hashDefinition(plan,d),readOnly:d.readOnly,scope,restrict:d.restrict,opaque:d.opaque,unscopedReads:d.readSchemas.some(name=>!plan.schemas[name]?.scope&&!plan.schemas[name]?.userScopes?.length),trustedOnly:d.trustedOnly,variants:d.variants.map(v=>({id:v.id,restrict:v.restrict,requires:requirements(v,d.surface),inputSchema:v.inputSchema,readOnly:v.readOnly,trustedOnly:v.trustedOnly,opaque:v.opaque,unscopedReads:v.readSchemas.some(name=>!plan.schemas[name]?.scope&&!plan.schemas[name]?.userScopes?.length),scope:Object.fromEntries(v.schemas.map(name=>{let s=plan.schemas[name];return[name,{...s.scope?{owner:s.scope}:{},terms:s.userScopes??[]}]}))})),requires:requirements(d,d.surface)}}}));return JSON.parse(canonical({schemaVersion:1,access:plan.access?.userFields??{},targets}))}var securityFlags=["readOnly","trustedOnly","opaque","unscopedReads"],flagDirection=(field,value)=>(field==="readOnly"||field==="trustedOnly"?!value:value)?"widened":"narrowed",inclusion=(before,after)=>before.some(t=>!after.includes(t))?"widened":after.some(t=>!before.includes(t))?"narrowed":"changed",exposureDirection=(before,after)=>after.some(t=>!before.includes(t)&&t!==canonical("internal"))?"widened":before.some(t=>!after.includes(t)&&t!==canonical("internal"))?"narrowed":"changed",combine=directions=>directions.includes("widened")?"widened":directions.length&&directions.every(d=>d==="narrowed")?"narrowed":"changed",terms=p=>[...p.owner?[canonical({owner:p.owner})]:[],...p.terms.map(canonical)];function policyDirection(before,after,scope){let directions=[];for(let schema of new Set([...Object.keys(before),...Object.keys(after)])){let x=before[schema],y=after[schema];canonical(x)!==canonical(y)&&directions.push(scope&&(!x||!y)?x?"narrowed":"widened":inclusion(x?terms(x):[],y?terms(y):[]))}return combine(directions)}function requiresDirection(x,y){let directions=[];return canonical(x.all)!==canonical(y.all)&&directions.push(inclusion(x.all.map(canonical),y.all.map(canonical))),x.guard!==y.guard&&directions.push(y.guard?x.guard?"changed":"narrowed":"widened"),combine(directions)}function diffApp(a,b){if(a.schemaVersion!==1||b.schemaVersion!==1)throw new TypeError("Unsupported describe schemaVersion.");let changes=[],old=new Map(a.targets.map(t=>[t._meta.id,t])),next=new Map(b.targets.map(t=>[t._meta.id,t]));for(let id of[...new Set([...old.keys(),...next.keys()])].sort()){let before=old.get(id),after=next.get(id);if(!before||!after){changes.push({id,field:"target",direction:before?"narrowed":"widened"});continue}let x=before._meta,y=after._meta,start=changes.length,record=(field,left,right,direction)=>{canonical(left)!==canonical(right)&&changes.push({id,field,direction,before:left,after:right})};record("scope",x.scope,y.scope,policyDirection(x.scope,y.scope,!0)),record("restrict",x.restrict,y.restrict,policyDirection(x.restrict,y.restrict,!1)),record("requires",x.requires,y.requires,requiresDirection(x.requires,y.requires));for(let field of["surfaces","triggers"])record(field,x[field],y[field],exposureDirection(x[field].map(canonical),y[field].map(canonical)));for(let field of securityFlags)record(field,x[field],y[field],flagDirection(field,y[field]));record("inputSchema",before.inputSchema,after.inputSchema,"changed");let directions=[],variants=new Map(x.variants.map(v=>[v.id,v])),added=new Map(y.variants.map(v=>[v.id,v]));for(let name of new Set([...variants.keys(),...added.keys()])){let left=variants.get(name),right=added.get(name);if(canonical(left)!==canonical(right))if(!left||!right)directions.push(left?"narrowed":"widened");else{canonical(left.scope)!==canonical(right.scope)&&directions.push(policyDirection(left.scope,right.scope,!0)),canonical(left.restrict)!==canonical(right.restrict)&&directions.push(policyDirection(left.restrict,right.restrict,!1)),canonical(left.requires)!==canonical(right.requires)&&directions.push(requiresDirection(left.requires,right.requires)),canonical(left.inputSchema)!==canonical(right.inputSchema)&&directions.push("changed");for(let field of securityFlags)left[field]!==right[field]&&directions.push(flagDirection(field,right[field]))}}record("variants",x.variants,y.variants,combine(directions)),changes.length===start&&x.targetHash!==y.targetHash&&changes.push({id,field:"behavior",direction:"changed"})}return changes}export{describeApp,diffApp,targetHash};

package/dist/domain/describe/target-hash.d.ts

@@ -0,0 +1,8 @@
+import type { RuntimePlan } from "../../build/compiler.js";
+import { type TargetDefinition } from "./targets.js";
+import { canonical } from "../../build/spec/domain/service/PlanFingerprint.js";
+export { canonical };
+export declare function hash(value: unknown): Promise<string>;
+export declare function hashDefinition(plan: RuntimePlan, d: TargetDefinition): Promise<string>;
+/** Opt-in runtime export. No compiler, parser, database or Node API is loaded. */
+export declare function targetHash(plan: RuntimePlan, targetId: string): Promise<string>;

package/dist/domain/describe/target-hash.js

@@ -0,0 +1 @@
+import{canonical,hash,hashDefinition,targetHash}from"./chunk-SGMRVDGE.js";export{canonical,hash,hashDefinition,targetHash};

package/dist/domain/describe/targets.d.ts

@@ -0,0 +1,40 @@
+import type { RuntimePlan } from "../../build/compiler.js";
+import type { PlanRestrict } from "../../build/spec/domain/model/RuntimePlan.js";
+import { type JsonSchema, type AuthorizationRequirements, type ProcedureMcpAnnotations } from "../../build/spec/domain/model/ManifestGrammar.js";
+export interface TargetDefinition {
+    id: string;
+    name: string;
+    surface: string;
+    surfaces: string[];
+    triggers: {
+        id: string;
+        source: RuntimePlan["triggers"][string]["source"];
+    }[];
+    kind: "view" | "procedure" | "rest" | "admin";
+    title: string;
+    description: string;
+    inputSchema: JsonSchema;
+    annotations: ProcedureMcpAnnotations;
+    requires?: AuthorizationRequirements;
+    restrict: PlanRestrict;
+    schemas: string[];
+    readSchemas: string[];
+    readOnly: boolean;
+    opaque: boolean;
+    trustedOnly: boolean;
+    behavior: unknown;
+    variants: TargetDefinition[];
+}
+/** Walk sealed IR, including nested statements and expanded View dependencies. */
+export declare function inspectSql(value: unknown): {
+    schemas: string[];
+    readSchemas: string[];
+    readOnly: boolean;
+    writes: {
+        schema: string;
+        operation: string;
+    }[];
+};
+/** Built-in Admin API templates, relative to the configured Admin API base. */
+export declare const adminRoutes: readonly ["GET /me", "GET /site", "GET /collections", "GET /views-manifest", "GET /operations", "GET /webmcp", "POST /webmcp/:tool", "GET /bootstrap", "GET /views/:name/export", "GET /views/:name", "GET /view-batch", "GET /developer/views/:name", "POST /operations/:name", "GET /developer-console", "GET /collections/:name/statistics", "GET /entries", "GET /entries/export", "GET /entries/:id", "POST /entries", "PATCH /entries/:id", "POST /entries/:id/publish", "POST /entries/:id/unpublish", "POST /entries/:id/archive", "DELETE /entries/:id", "GET /site-settings", "PATCH /site-settings", "POST /media/uploads", "POST /media/uploads/:groupId/commit", "GET /media", "GET /media/:id", "PATCH /media/:id", "DELETE /media/:id", "GET /admin", "GET /members", "PATCH /admin/:id/role", "POST /admin/invitations", "DELETE /admin/invitations/:id"];
+export declare function targetDefinitions(plan: RuntimePlan): TargetDefinition[];

package/dist/domain/entry.js

@@ -0,0 +1,19 @@
+export const exportName = (kind, name) => kind + "_" + name.replace(/[^A-Za-z0-9]+/g, run => Array.from(new TextEncoder().encode(run), b => "$" + b.toString(16).padStart(2, "0")).join(""));
+export const entry = (kind, name, types, extra = "") => `import { ${exportName(kind, name)} as operation } from "../generated.js";\nexport default operation;\nexport type { ${types} } from "../generated.js";\n${extra}`;
+export const q = JSON.stringify;
+export const isSqlite = (target) => target === "bun-sqlite" || target === "cloudflare-d1";
+export const viewImports = (name, index, query = "query") => [`const page${index}: typeof import("./paged/views/${encodeURIComponent(name)}.js").default = async (...args) => (await import("./paged/views/${encodeURIComponent(name)}.js")).default(...args);`, `import { query as ${query}${index} } from "./validation/views/${encodeURIComponent(name)}.js";`];
+export const driverFor = (target) => target === "bun-sqlite" ? "bun-sqlite" : target === "cloudflare-d1" ? "d1" : "postgres";
+export const databaseImport = (target) => driverFor(target) === "postgres" ? 'import type { Postgres as Database } from "@aotter/mantle/contracts";' : `import type { Handle as Database } from "@aotter/mantle/driver/${driverFor(target)}";`;
+export const GENERATED = "Generated by mantle generate — do not edit.";
+export function generatedFiles(files) {
+    return Object.fromEntries(Object.entries(files).map(([name, source]) => [name,
+        `${name.endsWith(".sql") ? "--" : "//"} ${GENERATED}\n${source}`]));
+}
+export function literal(value) {
+    if (Array.isArray(value))
+        return `[${value.map(literal).join(",")}]`;
+    if (value && typeof value === "object")
+        return `{${Object.entries(value).map(([key, child]) => `${key === "__proto__" ? `[${q(key)}]` : q(key)}:${literal(child)}`).join(",")}}`;
+    return q(value);
+}

package/dist/domain/generated-tools.js

@@ -0,0 +1,18 @@
+export const publishingTransitions = [["publish", ["draft"], "published"], ["unpublish", ["published", "archived"], "draft"], ["archive", ["draft", "published"], "archived"]];
+export const publishingAnnotations = (verb) => ({ readOnlyHint: false, destructiveHint: verb === "archive" });
+export const publishingInput = { type: "object", properties: { id: { type: "string", minLength: 1 }, expectedVersion: { type: "integer", minimum: 1 } }, required: ["id", "expectedVersion"], additionalProperties: false };
+export function mediaDefinitions() {
+    const define = (name, description, inputSchema, action, readOnlyHint = false) => ({ name, description, inputSchema, action, annotations: { readOnlyHint, destructiveHint: action === "delete", openWorldHint: true } });
+    const string = { type: "string" };
+    const texts = { alt: { type: "string", maxLength: 1000 }, caption: { type: "string", maxLength: 1000 } };
+    const input = (properties, required = []) => ({ type: "object", properties, required, additionalProperties: false });
+    return [
+        define("get_media_upload_policy", "Read declared image purpose MIME slots and byte caps before preparing variants or requesting an upload. Optimization runs locally, never in the host.", input({}), "policy", true),
+        define("create_media_upload", "Create short-lived PUT capabilities for image variants. Read site media purpose policy first; optimize images locally. Obtain attachment bytes yourself, then PUT each variant with its requiredHeaders and call commit_media_upload. Never store upload URLs as published images or ask the user to run terminal commands.", input({ filename: { type: "string", maxLength: 255 }, purpose: string, variants: { type: "array", minItems: 1, items: input({ mimeType: string, byteSize: { type: "integer", minimum: 1 }, role: { type: "string", enum: ["primary", "alternate", "fallback"] } }, ["mimeType", "byteSize", "role"]) }, ...texts }, ["filename", "purpose", "variants"]), "create"),
+        define("commit_media_upload", "Verify all uploaded variants and commit one permanent media asset. Store the returned asset id in fields referencing media_assets.id, never a temporary upload URL. Unknown or expired upload groups require a new create_media_upload.", input({ uploadGroupId: string, ...texts }, ["uploadGroupId"]), "commit"),
+        define("list_media_assets", "List committed image assets, newest first, with their permanent variants and alt/caption. Search matches id, alt or caption; reuse only a returned cursor.", input({ limit: { type: "integer", minimum: 1, maximum: 500 }, cursor: string, search: string }), "list", true),
+        define("get_media_asset", "Read one committed media asset and its permanent variant URLs.", input({ id: string }, ["id"]), "get", true),
+        define("update_media_asset", "Update committed asset alt or caption; omitted fields remain unchanged and empty strings clear text.", input({ id: string, ...texts }, ["id"]), "update"),
+        define("delete_media_asset", "Delete an asset's objects and library record. Check application references first. A partial failure can be retried using the same id.", input({ id: string }, ["id"]), "delete"),
+    ];
+}

package/dist/domain/generation.d.ts

@@ -0,0 +1,16 @@
+/** Public generation targets and result envelope. */
+export type Target = "bun-sqlite" | "bun-postgres" | "cloudflare-d1" | "cloudflare-postgres";
+export interface GenerateDiagnostic {
+    readonly code: string;
+    readonly path: string;
+    readonly message: string;
+}
+export type GenerateResult = {
+    readonly ok: true;
+    readonly files: Readonly<Record<string, string>>;
+    readonly refProcedures: readonly string[];
+    readonly warnings?: readonly string[];
+} | {
+    readonly ok: false;
+    readonly diagnostics: readonly GenerateDiagnostic[];
+};

package/dist/domain/generation.js

@@ -0,0 +1 @@
+export {};

package/dist/domain/input.js

@@ -0,0 +1,15 @@
+import { q } from "./entry.js";
+export function conversions(properties, binds, target) {
+    const fields = Object.keys(properties ?? {}).flatMap(field => {
+        const bind = binds.find(b => b.k === "input" && String(b.name).toLowerCase() === field.toLowerCase());
+        if (!bind || bind.k !== "input")
+            return [];
+        const type = String(bind.type);
+        return [[field, type === "json" ? "json" : type === "bool" && !target.endsWith("postgres") ? "bool" : ""]];
+    });
+    return fields.length ? q(fields) : "";
+}
+export const authLines = (requires, path, binds = [], sqlite = true, trustedOnly = false) => [...(trustedOnly ? [`  deny(caller, caller.kind === "system", ${q(path)});`] : []), ...(requires?.auth?.all ?? []).map((p, index) => {
+        const allowed = typeof p === "string" ? p === "ctx.admin" ? 'isAdmin(caller)' : 'isUser(caller)' : `caller.kind === "user" && caller.scopes.includes(${q(p["ctx.auth.scope"])})`;
+        return `  deny(caller, ${allowed}, ${q(`${path}/requires/auth/all/${index}`)});`;
+    }), ...binds.filter(b => b.k === "user").map(b => `  userBinds(${sqlite})(${q(b)}, caller);`)];

package/dist/domain/model.js

@@ -0,0 +1 @@
+export {};

package/dist/domain/paging.js

@@ -0,0 +1,213 @@
+import { NATIVE_COLUMNS, NATIVE_NOT_NULL, notNullColumns } from "../build/compiler.js";
+import { declaredType } from "./columns.js";
+const NATIVE_FIELDS = new Map(Object.entries(NATIVE_COLUMNS).map(([field, column]) => [column, field]));
+const fieldName = (n) => n.ColumnRef?.fields?.at(-1)?.String?.sval;
+const scalar = (n) => !!(n.ParamRef || n.A_Const || n.TypeCast && scalar(n.TypeCast.arg));
+const anyOf = (raw) => raw?.length === 8 && raw[1]?.ColumnRef && raw[5]?.ParamRef && /^ (IN \(SELECT value FROM json_each\(|= ANY\()/.test(raw[3]);
+const scopeTerm = (raw) => typeof raw?.[0] === "string" && raw[0].startsWith("/*s:");
+const restricts = (n) => !!n && typeof n === "object" && (anyOf(n.Raw?.parts) || !scopeTerm(n.Raw?.parts) && Object.values(n).some(restricts));
+const aggregate = (n) => !!n && !n.SubLink && !n.SelectStmt && (n.FuncCall && !n.FuncCall.over && ["count", "sum", "min", "max", "avg"].includes(n.FuncCall.funcname?.at(-1)?.String?.sval) || Object.values(n).some(v => v && typeof v === "object" && (Array.isArray(v) ? v.some(aggregate) : aggregate(v))));
+export function provePaging(plan, ast) {
+    let reason;
+    const fail = (message) => { reason = message; return undefined; };
+    const select = (s, inherited = new Map()) => {
+        if (!s || s.distinctClause || s.op && s.op !== "SETOP_NONE")
+            return;
+        const ctes = new Map(inherited);
+        for (const c of s.withClause?.ctes ?? []) {
+            const n = c.CommonTableExpr;
+            ctes.set(n.ctename, undefined);
+            ctes.set(n.ctename, n.aliascolnames?.length ? undefined : select(n.ctequery.SelectStmt, ctes)?.relation);
+        }
+        reason = undefined;
+        const aliases = new Map();
+        const reduced = !!s.groupClause?.length || (s.targetList ?? []).some((t) => aggregate(t.ResTarget.val));
+        const relation = (n) => {
+            if (n.JoinExpr) {
+                const left = relation(n.JoinExpr.larg), before = new Set(aliases.keys()), right = relation(n.JoinExpr.rarg);
+                if (!left || !right)
+                    return;
+                const column = (v) => v?.ColumnRef?.fields?.length === 2 ? aliases.get(v.ColumnRef.fields[0].String?.sval)?.fields.get(fieldName(v)) : undefined;
+                const lookup = (side, other, term) => {
+                    if (term?.BoolExpr?.boolop === "AND_EXPR")
+                        return term.BoolExpr.args.some((x) => lookup(side, other, x));
+                    const e = term?.A_Expr, id = side.fields.get("id"), otherId = other.fields.get("id");
+                    if (!side.unique || !id || !otherId || e?.kind !== "AEXPR_OP" || e.name?.[0]?.String?.sval !== "=")
+                        return false;
+                    const a = column(e.lexpr), b = column(e.rexpr);
+                    const unique = (f, value) => f && value && f.source === id.source && value.source === otherId.source &&
+                        (f.name === id.name || (!f.schema.userScopes?.length && !f.schema.scope && f.schema.unique?.some(index => index.length === 1 && index[0] === f.name)));
+                    return !!(unique(a, b) || unique(b, a));
+                };
+                const rightSingle = right.single || lookup(right, left, n.JoinExpr.quals);
+                const leftSingle = left.single || lookup(left, right, n.JoinExpr.quals);
+                if (!rightSingle && (!leftSingle || n.JoinExpr.jointype === "JOIN_LEFT") && !reduced)
+                    return fail(`Fanning join '${[...aliases.keys()].filter(alias => !before.has(alias)).join(", ")}': join on the joined Schema's id or a single-field unique key, or reduce it to one row.`);
+                if (n.JoinExpr.jointype === "JOIN_FULL" || n.JoinExpr.jointype === "JOIN_RIGHT")
+                    return;
+                if (n.JoinExpr.jointype === "JOIN_LEFT")
+                    for (const [alias, r] of aliases)
+                        if (!before.has(alias))
+                            r.fields = new Map([...r.fields].map(([k, f]) => [k, { ...f, notNull: false }]));
+                return rightSingle ? left : leftSingle ? right : { ...left, unique: false };
+            }
+            const r = n.RangeVar, sub = n.RangeSubselect;
+            let fact;
+            if (r && r.mantle !== "cte" && plan.schemas[r.relname]) {
+                const schema = plan.schemas[r.relname], notNull = notNullColumns(schema), source = {};
+                const fields = new Map();
+                for (const name of [...Object.keys(schema.fields), "id", "version", "created_at", "updated_at", "author_id", "status"]) {
+                    const type = declaredType(schema.fields, name) ?? (name === "version" ? "integer" : "text");
+                    fields.set(name, { schema, name, type, notNull: NATIVE_NOT_NULL.has(name) || notNull.has(name), source });
+                }
+                fact = { fields, names: new Set(fields.keys()), single: false, unique: true, fixed: new Set(), sets: new Set() };
+            }
+            else if (r?.mantle === "cte")
+                fact = ctes.get(r.relname);
+            else if (sub)
+                fact = select(sub.subquery.SelectStmt, ctes)?.relation;
+            if (fact) {
+                const sources = new Map();
+                fact = { ...fact, fields: new Map([...fact.fields].map(([name, f]) => {
+                        if (!sources.has(f.source))
+                            sources.set(f.source, {});
+                        return [name, { ...f, source: sources.get(f.source) }];
+                    })), fixed: new Set(fact.fixed), sets: new Set(fact.sets) };
+                aliases.set(r?.alias?.aliasname ?? r?.relname ?? sub.alias.aliasname, fact);
+            }
+            return fact;
+        };
+        const from = s.fromClause ?? [];
+        let base;
+        for (const n of from) {
+            const r = relation(n);
+            if (!r || base && !base.single && !r.single)
+                return;
+            if (!base || !r.single)
+                base = r;
+        }
+        base ??= { fields: new Map(), names: new Set(), single: true, unique: false, fixed: new Set(), sets: new Set() };
+        const targets = new Map((s.targetList ?? []).map((t) => [t.ResTarget.name ?? fieldName(t.ResTarget.val), t.ResTarget.val]));
+        const resolve = (n, output = true) => {
+            const fields = n?.ColumnRef?.fields;
+            if (fields?.every((f) => f.String) && fields.length <= 2) {
+                const name = fieldName(n);
+                if (fields.length === 2)
+                    return aliases.get(fields[0].String.sval)?.fields.get(name);
+                if (output && targets.has(name))
+                    return resolve(targets.get(name), false);
+                const matches = [...aliases.values()].filter(r => r.names.has(name));
+                return matches.length === 1 ? matches[0].fields.get(name) : undefined;
+            }
+            const f = n?.FuncCall;
+            if (f && !f.over && !f.agg_filter && ["min", "max"].includes(f.funcname?.at(-1)?.String?.sval) && f.args?.length === 1 && s.groupClause?.length)
+                return resolve(f.args[0], false);
+            const pos = n?.A_Const?.ival?.ival;
+            if (output && pos > 0)
+                return resolve(s.targetList[pos - 1]?.ResTarget.val, false);
+            return;
+        };
+        const fixed = (n) => {
+            if (n?.BoolExpr?.boolop === "AND_EXPR")
+                n.BoolExpr.args.forEach(fixed);
+            const raw = n?.Raw?.parts;
+            if (scopeTerm(raw))
+                return fixed(raw[1]);
+            if (anyOf(raw)) {
+                const col = resolve(raw[1], false);
+                if (col && col.source === base.fields.get("id")?.source)
+                    base.sets.add(col.name);
+                return;
+            }
+            const e = n?.A_Expr;
+            if (e?.kind !== "AEXPR_OP" || e.name?.[0]?.String?.sval !== "=")
+                return;
+            const col = scalar(e.rexpr) ? resolve(e.lexpr, false) : scalar(e.lexpr) ? resolve(e.rexpr, false) : undefined;
+            if (col && col.source === base.fields.get("id")?.source)
+                base.fixed.add(col.name);
+        };
+        fixed(s.whereClause);
+        const fields = new Map();
+        for (const [name, expr] of targets) {
+            const field = resolve(expr, false);
+            if (field && name)
+                fields.set(name, field);
+        }
+        const group = s.groupClause ?? [], sorts = s.sortClause ?? [];
+        const keys = sorts.map(k => resolve(k.SortBy.node));
+        if (keys.some(k => k && !k.notNull))
+            return fail(`Nullable ORDER BY key '${keys.find(k => k && !k.notNull).name}': make the operational Schema field required and non-null, and order by the preserved side of a LEFT JOIN.`);
+        if (keys.some(k => !k?.notNull || !["text", "bool", "integer", "int4", "int8", "real", "float8", "date", "timestamptz"].includes(k.type) && !/^numeric\(/.test(k.type)))
+            return;
+        const same = (a, b) => a && b && a.name === b.name && a.source === b.source;
+        if (sorts.length) {
+            if (group.length) {
+                if (!group.every(g => {
+                    const source = g.ColumnRef?.fields?.length === 1 ? [...aliases.values()].filter(r => r.names.has(fieldName(g))) : [];
+                    const f = source.length ? source.length === 1 ? source[0].fields.get(fieldName(g)) : undefined : resolve(g);
+                    return f?.notNull && keys.some(k => same(k, f));
+                }))
+                    return;
+            }
+            else {
+                if (!base.unique || !keys.some(k => same(k, base.fields.get("id"))))
+                    return fail("Incomplete ORDER BY key tuple: include the base Schema's id as a tiebreak and preserve its row identity.");
+                const order = keys.filter(k => k.name !== "id");
+                if (order.length) {
+                    const schema = order[0].schema;
+                    if (order.some(f => f.source !== base.fields.get("id")?.source))
+                        return;
+                    const serving = (prefix) => [...(schema.indexes ?? []), ...(schema.unique ?? [])].find(index => {
+                        let i = 0;
+                        while (i < index.length && prefix.has(index[i]) && index[i] !== order[0].name)
+                            i++;
+                        return order.every((f, n) => index[i + n] === f.name);
+                    });
+                    if (!serving(base.fixed)) {
+                        const index = serving(new Set([...base.fixed, ...base.sets])), named = (c) => schema.names?.[c] ?? c, field = (c) => schema.names?.[c] ?? NATIVE_FIELDS.get(c) ?? c;
+                        const columns = order.map(f => named(f.name)).join(", "), fields = order.map(f => field(f.name)).join(", ");
+                        if (!index)
+                            return fail(`Missing index for ORDER BY (${columns}): declare a Schema index with [${fields}] in this order after any fixed equality prefix.`);
+                        const prefix = index.slice(0, index.indexOf(order[0].name)), set = prefix.filter(c => !base.fixed.has(c));
+                        const lead = prefix.slice(prefix.indexOf(set[0])), quoted = (cs) => cs.map(c => `'${field(c)}'`).join(", ");
+                        const notNull = notNullColumns(schema), owner = lead.filter(c => c === schema.scope), nullable = lead.filter(c => !NATIVE_NOT_NULL.has(c) && !notNull.has(c) && c !== schema.scope);
+                        const dir = (f) => sorts[keys.indexOf(f)].SortBy.sortby_dir === "SORTBY_DESC" ? " DESC" : "";
+                        const sorted = [...lead.map(c => named(c) + dir(order[0])), ...order.map(f => named(f.name) + dir(f))].join(", ");
+                        const desc = order.some(f => dir(f)) ? ", read backwards; on PostgreSQL confirm with EXPLAIN that no Sort remains" : "";
+                        const eq = [...base.fixed].filter(c => c !== "id" && !order.some(f => f.name === c));
+                        const ways = [...nullable.length || owner.length ? [] : [`ORDER BY ${sorted} (same index${desc})`], ...restricts(ast) ? [] : [`for { all: true } callers only, index [${[...eq.map(field), fields].join(", ")}, id]`]];
+                        const why = [...owner.length ? [`${quoted(owner)} is the owner column, which SQL cannot name`] : [], ...nullable.length ? [`${quoted(nullable)} can be null`] : []];
+                        const unavailable = why.length ? ` Scope-first ORDER BY unavailable: ${why.join("; ")}${ways.length ? "." : ""}` : "";
+                        return fail(`ORDER BY (${columns}) needs index [${index.map(field).join(", ")}] past ${quoted(set)}, which a user-field scope or restrict binds to a set of values: every page would sort all of the caller's rows.${unavailable}${ways.length ? ` Bounded: ${ways.join("; ")}` : ""} (handbook: reference/schema.md#index-prefixes-for-paged-views).`);
+                    }
+                }
+            }
+        }
+        const single = base.single || !group.length && (s.targetList ?? []).some((t) => aggregate(t.ResTarget.val)) || s.limitCount?.A_Const?.ival?.ival === 1 || base.unique && base.fixed.has("id");
+        return { relation: { fields, names: new Set(targets.keys()), single, unique: !group.length && base.unique && !!same(fields.get("id"), base.fields.get("id")), fixed: base.fixed, sets: base.sets }, keys: keys };
+    };
+    const result = select(ast.SelectStmt);
+    return result ? { types: result.keys.map(f => f.type), single: result.relation.single } : reason ? { types: [], single: false, reason } : undefined;
+}
+export function castCursor(ast, sources, types, postgres) {
+    const typeOf = (source) => source && "cursor" in source ? types[source.cursor] : undefined;
+    const typed = (type) => type && (postgres ? ["timestamptz", "date"] : ["integer", "int4", "int8"]).includes(type);
+    if (!sources.some(source => typed(typeOf(source))))
+        return ast;
+    const where = structuredClone(ast.SelectStmt.whereClause), base = ast.SelectStmt.limitCount.ParamRef.number - sources.length, pending = [where];
+    while (pending.length) {
+        const node = pending.pop();
+        if (!node || typeof node !== "object")
+            continue;
+        if (node.ParamRef) {
+            const number = node.ParamRef.number, type = typeOf(sources[number - base - 1]);
+            if (typed(type)) {
+                delete node.ParamRef;
+                node.Raw = { parts: postgres ? ["CAST(CAST(", { ParamRef: { number } }, ` AS text) AS ${type})`] : ["CAST(", { ParamRef: { number } }, " AS INTEGER)"] };
+            }
+        }
+        else
+            pending.push(...Object.values(node));
+    }
+    return { ...ast, SelectStmt: { ...ast.SelectStmt, whereClause: where } };
+}

package/dist/domain/recipes.js

@@ -0,0 +1,22 @@
+const KINDS = new Set(["uid", "admin", "user", "now", "cutoff", "const", "input", "version", "scoped"]);
+export function recipesOf(statement, fields, refuse, values) {
+    const field = (bound) => {
+        const name = fields.find(field => field.toLowerCase() === String(bound).toLowerCase());
+        if (name === undefined)
+            refuse(`Input bind '${bound}' has no declared field.`);
+        return name ?? String(bound);
+    };
+    return statement.binds.map(b => {
+        if (!KINDS.has(b.k))
+            refuse(`Bind recipe '${b.k}' needs an explicit native implementation.`);
+        if (b.k === "now" || b.k === "cutoff")
+            values?.add(b.k);
+        if (b.k === "scoped" && b.name !== undefined)
+            return { ...b, name: field(b.name) };
+        if (b.k !== "input")
+            return b;
+        if (b.type === "date" || b.type === "timestamptz")
+            values?.add(b.type === "date" ? "date" : "timestamp");
+        return { k: "input", name: field(b.name), ...(b.type === "timestamptz" || b.type === "date" || b.type === "json" ? { type: b.type } : {}) };
+    });
+}

package/dist/domain/userReferences.js

@@ -0,0 +1,4 @@
+export function userReferences(plan, sqlite) {
+    const used = !!plan.access;
+    return { used, code: used ? `import * as USER from "@aotter/mantle/user-fields";\nconst USER_VALUES = { scopeInsert: USER.scopeInsert, scopedAll: USER.scopedAll, userRefs: USER.userRefs(${sqlite}, 1) };` : '', values: used ? '...USER_VALUES' : '' };
+}

package/dist/domain/wireScalars.js

@@ -0,0 +1,41 @@
+import { declaredType } from "./columns.js";
+const raw = (...parts) => ({ Raw: { parts } });
+const wire = (type, d, v, boundary = false) => type === "timestamptz" ? raw(...d.wireTimestamp(v)) : type === "date" ? raw(...d.wireDate(v)) : boundary && type && ["integer", "int8", "int4"].includes(type) ? raw("CAST(", v, " AS text)") : undefined;
+export function wireScalars(ast, keys, types, d, boundary = false) {
+    if (!types.some(type => type === "timestamptz" || type === "date" || boundary && type && ["integer", "int8", "int4"].includes(type)) || !ast.SelectStmt)
+        return ast;
+    const select = (s) => {
+        if (s.op && s.op !== "SETOP_NONE") {
+            const larg = select(s.larg), rarg = select(s.rarg);
+            return typeof larg === "string" ? larg : typeof rarg === "string" ? rarg : { ...s, larg, rarg };
+        }
+        if (s.targetList?.length !== keys.length || s.targetList.some((t) => !t.ResTarget || t.ResTarget.val?.ColumnRef?.fields?.at(-1)?.A_Star))
+            return "Declared timestamp and date outputs need one SELECT item per output. Expand the SELECT list explicitly.";
+        return { ...s, targetList: s.targetList.map((t, i) => {
+                const val = wire(types[i], d, t.ResTarget.val, boundary);
+                return val ? { ResTarget: { ...t.ResTarget, name: keys[i], val } } : t;
+            }) };
+    };
+    const out = select(ast.SelectStmt);
+    return typeof out === "string" ? out : { ...ast, SelectStmt: out };
+}
+export function wireReturning(ast, schemas, d, boundary = false) {
+    const [kind, stmt] = Object.entries(ast)[0] ?? [];
+    const list = stmt?.returningClause?.exprs;
+    if (!list?.length || !["InsertStmt", "UpdateStmt", "DeleteStmt"].includes(kind))
+        return ast;
+    const schema = schemas[stmt.relation?.relname];
+    if (!schema)
+        return ast;
+    let changed = false;
+    const exprs = [];
+    for (const t of list) {
+        const fields = t.ResTarget?.val?.ColumnRef?.fields;
+        const col = fields?.at(-1)?.String?.sval;
+        const val = col === undefined ? undefined : wire(declaredType(schema.fields, col), d, t.ResTarget.val, boundary);
+        if (val)
+            changed = true;
+        exprs.push(val ? { ResTarget: { ...t.ResTarget, name: t.ResTarget.name ?? col, val } } : t);
+    }
+    return changed ? { [kind]: { ...stmt, returningClause: { ...stmt.returningClause, exprs } } } : ast;
+}