@aotter/mantle 0.2.0-alpha.1 → 0.2.0-alpha.11

package/dist/infrastructure/adminEntries.js

@@ -0,0 +1,156 @@
+import { enumOptions, protectedColumns } from "../build/compiler.js";
+import { parsePgSql } from "../build/compiler.js";
+import { compileProgram } from "../build/compiler.js";
+import { adminOrder } from "../domain/adminOrder.js";
+import { declaredType, serverOwned } from "../domain/columns.js";
+import { wireScalars, wireReturning } from "../domain/wireScalars.js";
+import { recipesOf } from "../domain/recipes.js";
+import { refChecks } from "../build/compiler.js";
+import { renderTerm } from "../kernel/store.js";
+const ref = (...names) => ({ ColumnRef: { fields: names.map(sval => ({ String: { sval } })) } });
+const op = (lexpr, rexpr) => ({ A_Expr: { kind: "AEXPR_OP", name: [{ String: { sval: "=" } }], lexpr, rexpr } });
+const and = (...args) => args.length === 1 ? args[0] : { BoolExpr: { boolop: "AND_EXPR", args } };
+const system = (s) => ["id", "version", "created_at", "updated_at", "author_id", ...(s.publishing ? ["status", "published_at"] : [])];
+const fields = (s) => Object.keys(s.fields).filter(f => f !== s.scope).flatMap(f => s.fields[f] === "geo" ? [f + "_lat", f + "_lng"] : [f]);
+export async function adminEntries(plan, dialect, wire, refusals) {
+    const result = Object.create(null), postgres = !!dialect.nativeOrder;
+    const tableNames = new Set(Object.keys(plan.schemas).map(name => name.toLowerCase()));
+    let rowsName = "_mantle_admin_rows";
+    while (tableNames.has(rowsName.toLowerCase()))
+        rowsName += "_";
+    const rowsAlias = { name: rowsName, sql: wire.ident(rowsName) };
+    const parse = async (sql) => { const { stmts } = await parsePgSql(sql); const visit = (n) => { if (n.RangeVar)
+        n.RangeVar.mantle = "table"; for (const value of Object.values(n))
+        if (value && typeof value === "object")
+            Array.isArray(value) ? value.forEach(visit) : visit(value); }; stmts.forEach(visit); return stmts; };
+    const print = (ast) => dialect.print(ast, plan.schemas);
+    const expr = (value) => print({ SelectStmt: { targetList: [{ ResTarget: { val: value } }], op: "SETOP_NONE", limitOption: "LIMIT_OPTION_DEFAULT" } }).replace(/^SELECT /, "");
+    for (const s of Object.values(plan.schemas))
+        try {
+            const columns = [...system(s), ...fields(s)], writable = Object.keys(s.fields).filter(f => f !== s.scope && s.fields[f] !== "geo");
+            const parent = s.translates && plan.schemas[s.translates.parent.toLowerCase()];
+            const types = columns.map(f => declaredType(s.fields, f) ?? (f === "version" ? "integer" : f.endsWith("_lat") || f.endsWith("_lng") ? "real" : "text"));
+            const schemas = Object.create(null);
+            let relation = s;
+            while (relation && !Object.hasOwn(schemas, relation.name)) {
+                schemas[relation.name] = relation;
+                relation = relation.translates ? plan.schemas[relation.translates.parent.toLowerCase()] : undefined;
+            }
+            const ctx = (kind, trusted, inputs) => ({ dialect, schemas, inputs, kind, mode: trusted ? "trusted" : "admin", uncheckedRefs: true });
+            const refs = (child) => Object.fromEntries(refChecks(s, plan.schemas).filter(r => writable.includes(r.column)).map(r => {
+                const holes = [], hole = (value) => { const token = wire.param(marker + 1 + holes.length); holes.push([token, value]); return token; };
+                const sql = `EXISTS (SELECT 1 FROM ${wire.ident(r.table)} _mantle_ref WHERE ${[`_mantle_ref.${wire.ident(r.field)} = ${hole(r.column)}`, ...r.same.map(([parent, column]) => `_mantle_ref.${wire.ident(parent)} = ${child(column, hole)}`), ...r.terms.map(t => renderTerm(wire, t, "_mantle_ref.", hole))].join(" AND ")})`;
+                return [r.column, { sql, holes }];
+            }));
+            const select = `SELECT ${columns.map(c => `${wire.ident(s.name)}.${wire.ident(c)}`).join(",")} FROM ${wire.ident(s.name)}`;
+            const base = await parse(select);
+            const project = (ast, names, keys) => {
+                const projected = wireScalars(ast, [...names, ...keys.map((_, i) => `_k${i}`)], [...names.map(n => types[columns.indexOf(n)] ?? (parent ? declaredType(parent.fields, n) : undefined)), ...keys], wire, true);
+                if (typeof projected === "string")
+                    throw Error(projected);
+                return projected;
+            };
+            let marker = 32767;
+            const authored = JSON.stringify([plan.schemas, s]);
+            while (authored.includes(String(marker)))
+                marker++;
+            const markerText = wire.param(marker);
+            const usedNames = new Set([...columns, ...(parent ? fields(parent) : [])].map(name => name.toLowerCase()));
+            const cursorAliases = [0, 1].map(i => { let name = "_mantle_admin_key" + i; while (usedNames.has(name.toLowerCase()))
+                name += "_"; usedNames.add(name.toLowerCase()); return { name, sql: wire.ident(name) }; });
+            const ordered = adminOrder(s), fieldFacts = Object.create(null);
+            for (const column of [...system(s), ...writable]) {
+                const type = declaredType(s.fields, column) ?? (column === "version" ? "integer" : "text");
+                if (!["text", "integer", "int4", "int8", "real", "float8", "bool", "date", "timestamptz"].includes(type))
+                    continue;
+                const expression = wire.ident(s.name) + "." + wire.ident(column), [kind, nullable] = (Object.hasOwn(ordered, column) ? ordered[column] : undefined) ?? [];
+                fieldFacts[column] = { expression, value: wire.cast(markerText, type), wire: kind && ["integer", "int8", "int4"].includes(type) ? `CAST(${expression} AS text)` : kind && type === "date" ? wire.wireDate(expression).join("") : kind && type === "timestamptz" ? wire.wireTimestamp(expression).join("") : expression, nullable: nullable ?? true, ...(kind ? { kind } : {}) };
+            }
+            const filter = s.uiSchema?.list?.filterField, enums = enumOptions(filter ? s.schema.properties?.[filter] : undefined)?.map(choice => choice.value);
+            const literal = (v) => "'" + v.replaceAll("'", "''") + "'";
+            let subtype = "NULL", option = 0;
+            if (filter && enums?.length) {
+                const type = s.fields[filter.toLowerCase()], temporal = type === "date" || type === "timestamptz";
+                try {
+                    subtype = "CASE " + enums.map((value, index) => {
+                        option = index;
+                        if (postgres && temporal && /^0000-/.test(value.trim()))
+                            throw Error("PostgreSQL requires a nonzero year.");
+                        const native = type === "date" ? wire.date(value) : type === "timestamptz" ? wire.timestamp(value) : value;
+                        return `WHEN ${wire.ident(s.name)}.${wire.ident(filter.toLowerCase())} = ${typeof native === "number" ? String(native) : wire.cast(literal(String(native)), type ?? "")} THEN ${literal(value)}`;
+                    }).join(" ") + " ELSE NULL END";
+                }
+                catch {
+                    throw Object.assign(Error(`Statistics filter option must be a valid ${type ?? "string"}${postgres && temporal ? " with a nonzero PostgreSQL year" : ""}.`), { path: `schemas/${s.name}/admin/statistics/${filter}/${option}` });
+                }
+            }
+            const modes = await Promise.all([false, true].map(async (trusted) => {
+                const [compiled] = compileProgram(base, ctx("view", trusted, {}));
+                if (!compiled)
+                    throw Error("Missing compiled collection View.");
+                const baseInner = compiled.ast.SelectStmt.fromClause[0].RangeSubselect.subquery.SelectStmt, policy = baseInner.whereClause;
+                compiled.ast.SelectStmt.fromClause = [baseInner.fromClause[0]];
+                if (parent) {
+                    const own = new Set(Object.keys(s.fields).flatMap(f => s.fields[f] === "geo" ? [f + "_lat", f + "_lng"] : [f]));
+                    const inherited = fields(parent).filter(f => !own.has(f)), on = s.translates.on.toLowerCase(), alias = "_mantle_merge";
+                    const [pc] = compileProgram(await parse(`SELECT id FROM ${wire.ident(parent.name)} ORDER BY created_at DESC,id DESC LIMIT 1`), ctx("view", trusted, {}));
+                    if (!pc)
+                        throw Error("Missing compiled parent View.");
+                    const renumber = (n) => { if (n.ParamRef)
+                        n.ParamRef.number += compiled.binds.length; for (const v of Object.values(n))
+                        if (v && typeof v === "object")
+                            Array.isArray(v) ? v.forEach(renumber) : renumber(v); };
+                    renumber(pc.ast);
+                    const inner = pc.ast.SelectStmt.fromClause[0].RangeSubselect.subquery.SelectStmt;
+                    pc.ast.SelectStmt.fromClause = inner.fromClause;
+                    pc.ast.SelectStmt.whereClause = and(...(inner.whereClause ? [inner.whereClause] : []), op(ref(parent.name, on), ref(s.name, on)), ...(parent.scope ? [op(ref(parent.name, parent.scope), ref(s.name, s.scope))] : []));
+                    compiled.binds.push(...pc.binds);
+                    const relation = { RangeVar: { relname: parent.name, alias: { aliasname: alias }, mantle: "system", inh: true, relpersistence: "p" } };
+                    compiled.ast.SelectStmt.fromClause = [{ JoinExpr: { jointype: "JOIN_LEFT", larg: compiled.ast.SelectStmt.fromClause[0], rarg: relation, quals: op(ref(alias, "id"), { SubLink: { subLinkType: "EXPR_SUBLINK", subselect: pc.ast } }) } }];
+                    compiled.ast.SelectStmt.targetList.push(...inherited.map(f => ({ ResTarget: { name: f, val: ref(alias, f) } })));
+                }
+                const names = compiled.ast.SelectStmt.targetList.map((t) => t.ResTarget.name ?? t.ResTarget.val.ColumnRef.fields.at(-1).String.sval);
+                const projection = print(project({ SelectStmt: { targetList: compiled.ast.SelectStmt.targetList, op: "SETOP_NONE", limitOption: "LIMIT_OPTION_DEFAULT" } }, names, [])).replace(/^SELECT /, "");
+                const from = print({ SelectStmt: { ...compiled.ast.SelectStmt, targetList: [{ ResTarget: { val: { A_Const: { ival: { ival: 1 } } } } }] } }).replace(/^SELECT 1/, "");
+                const inputs = { ...Object.fromEntries(writable.map(f => [f, s.fields[f]])), id: "text" };
+                const returning = columns.map(wire.ident).join(",");
+                const insertAst = writable.length ? (await parse(`INSERT INTO ${wire.ident(s.name)} (${writable.map(wire.ident).join(",")}) VALUES (${writable.map(f => `input.${wire.ident(f)}`).join(",")}) RETURNING ${returning}`))[0] : { InsertStmt: { relation: { RangeVar: { relname: s.name, mantle: "table", inh: true, relpersistence: "p" } }.RangeVar, cols: [], selectStmt: { SelectStmt: { valuesLists: [{ List: { items: [] } }] } }, returningClause: { exprs: columns.map(f => ({ ResTarget: { val: ref(f) } })) } } };
+                const updateFields = writable.filter(field => !protectedColumns(s).includes(field));
+                const updateAst = (await parse(`UPDATE ${wire.ident(s.name)} SET ${updateFields.length ? updateFields.map(f => `${wire.ident(f)}=input.${wire.ident(f)}`).join(",") : "id=input.id"} WHERE id=input.id RETURNING ${returning}`))[0];
+                if (!updateFields.length)
+                    updateAst.UpdateStmt.targetList = [];
+                const deleteAst = (await parse(`DELETE FROM ${wire.ident(s.name)} WHERE id=input.id RETURNING id`))[0];
+                const write = (ast) => {
+                    const [c] = compileProgram([ast], { ...ctx("procedure", trusted || !!(s.userScopes?.length && ast.InsertStmt), inputs), lockVersion: true });
+                    if (!c || c.kind !== "row")
+                        throw Error("Admin writes must affect exactly one row.");
+                    const fixed = c.binds.filter(b => !(b.k === "input" && writable.includes(String(b.name)))), rewritten = wireReturning(c.ast, plan.schemas, wire, true);
+                    const rewrite = (n) => { if (n.ParamRef) {
+                        const b = c.binds[n.ParamRef.number - 1];
+                        if (b.k === "input" && writable.includes(String(b.name))) {
+                            delete n.ParamRef;
+                            n.Raw = { parts: [wire.cast(markerText, String(b.type))] };
+                            return;
+                        }
+                        n.ParamRef.number = fixed.indexOf(b) + 1;
+                    } for (const v of Object.values(n))
+                        if (v && typeof v === "object")
+                            Array.isArray(v) ? v.forEach(rewrite) : rewrite(v); };
+                    rewrite(rewritten);
+                    return { ast: rewritten, binds: recipesOf({ binds: fixed }, ["id"], message => { throw Error(message); }) };
+                };
+                const create = write(insertAst), patch = write(updateAst), remove = write(deleteAst), entryFields = Object.create(null);
+                const insert = create.ast.InsertStmt, update = patch.ast.UpdateStmt;
+                for (const [i, field] of writable.entries())
+                    entryFields[field] = { column: wire.ident(field), insert: expr(insert.selectStmt.SelectStmt.fromClause[0].RangeSubselect.subquery.SelectStmt.valuesLists[0].List.items[i]), ...(!protectedColumns(s).includes(field) && !serverOwned(s.schema, field) ? { update: wire.ident(field) + " = " + expr(update.targetList[updateFields.indexOf(field)].ResTarget.val) } : {}) };
+                const returnSQL = (ast) => " RETURNING " + ast.returningClause.exprs.map((t) => expr(t.ResTarget.val) + (t.ResTarget.name ? " AS " + wire.ident(t.ResTarget.name) : "")).join(",");
+                const created = trusted ? {} : refs((column, hole) => hole(column)), patched = trusted ? {} : refs(column => wire.ident(s.name) + "." + wire.ident(column));
+                return { projection, from, policy: policy ? expr(policy) : "", binds: recipesOf(compiled, [], message => { throw Error(message); }), fields: entryFields, create: { ...(Object.keys(created).length ? { refs: created } : {}), prefix: print(create.ast).slice(0, print(create.ast).indexOf(" (")) + " (", between: ") VALUES (", suffix: ")", binds: create.binds, columns: insert.cols.slice(writable.length).map((t) => wire.ident(t.ResTarget.name)), values: insert.selectStmt.SelectStmt.targetList.slice(writable.length ? 1 : 0).map((t) => expr(t.ResTarget.val)), returning: returnSQL(insert) }, patch: { ...(Object.keys(patched).length ? { refs: patched } : {}), prefix: print(patch.ast).slice(0, print(patch.ast).indexOf(" SET ")) + " SET ", binds: patch.binds, sets: update.targetList.slice(updateFields.length).map((t) => wire.ident(t.ResTarget.name) + " = " + expr(t.ResTarget.val)), where: " WHERE " + expr(update.whereClause), returning: returnSQL(update) }, remove: { sql: print(remove.ast), binds: remove.binds, row: true } };
+            }));
+            result[s.name] = { ...(s.userScopes?.length ? { userScopes: s.userScopes } : {}), cursorAliases, scoped: !!s.scope, path: "schemas/" + s.name + "/admin", marker: markerText, id: wire.ident(s.name) + "." + wire.ident("id"), fields: fieldFacts, orderFields: Object.keys(ordered), search: `(${wire.ident(s.name)}.${wire.ident("id")} = ${markerText}${s.search?.length ? ` OR ${wire.search(s.name, s.search, wire.ident(s.name), markerText)}` : ""})`, statistics: { rowsAlias, column: wire.ident(s.name) + "." + wire.ident("created_at"), time: postgres ? `extract(epoch FROM ${wire.ident(s.name)}.${wire.ident("created_at")}) * 1000000` : wire.ident(s.name) + "." + wire.ident("created_at"), subtype }, caller: modes[0], trusted: modes[1] };
+        }
+        catch (error) {
+            refusals.push({ code: "GENERATE_UNSUPPORTED", path: error instanceof Error && "path" in error && typeof error.path === "string" ? error.path : "schemas/" + s.name + "/admin", message: error instanceof Error ? error.message : String(error) });
+        }
+    return result;
+}

package/dist/infrastructure/adminPaging.js

@@ -0,0 +1,70 @@
+import { adminEntries } from "./adminEntries.js";
+import { wireScalars } from "../domain/wireScalars.js";
+import { boundaryType } from "../domain/columns.js";
+import { viewOutputs, compileProgram } from "../build/compiler.js";
+import { pagedOf } from "../build/compiler.js";
+import { castCursor } from "../domain/paging.js";
+export function adminPaging(plan, dialect, proofs, project, refuse) {
+    const all = Object.create(null);
+    for (const [name, v] of Object.entries(plan.views).filter(([, v]) => v.surface !== "internal")) {
+        const proof = proofs[name];
+        if (!proof || !proof.types.length && !proof.single)
+            continue;
+        try {
+            const list = (v.uiSchema?.list ?? {});
+            const modes = v.surface === "public" ? ["public", "public"] : ["caller", "trusted"];
+            const pages = modes.map(mode => {
+                const [c] = compileProgram(v.stmts, { dialect, schemas: plan.schemas, inputs: v.inputs, kind: "view", mode, restrict: v.restrict });
+                if (!c)
+                    throw Error(`No compiled Admin View: ${name}`);
+                const keys = c.ast.SelectStmt.sortClause?.length ?? 0;
+                if (keys !== proof.types.length)
+                    throw Error(`Incomplete Admin cursor proof: ${name}`);
+                const first = pagedOf({ schemas: plan.schemas, dialect }, c, undefined, !keys && (list.filterFields?.length || list.searchFields?.length) ? { eq: [{ column: (list.filterFields ?? list.searchFields)[0], value: "" }] } : undefined), next = keys ? pagedOf({ schemas: plan.schemas, dialect }, c, Array(keys).fill(0), undefined) : undefined;
+                if (!keys && !first.flat)
+                    first.ast.SelectStmt.whereClause = undefined;
+                const reserved = JSON.stringify([c.ast, v.source, list, Object.values(plan.schemas).map(s => s.fields)]);
+                let marker = 32767;
+                while (reserved.includes(String(marker)))
+                    marker++;
+                const print = (ast) => dialect.print(ast, plan.schemas);
+                const read = (p) => { const typed = castCursor(p.ast, p.sources, proof.types, !!dialect.nativeOrder); return { prefix: print(project({ SelectStmt: { ...typed.SelectStmt, whereClause: undefined, sortClause: undefined, limitCount: undefined, limitOption: "LIMIT_OPTION_DEFAULT" } }, p.flat ? viewOutputs(v, plan.schemas).keys ?? [] : p.names, keys, name)) + (typed.SelectStmt.whereClause ? ` WHERE (${expression(typed.SelectStmt.whereClause)})` : ""), extra: p.sources.filter(x => "cursor" in x).map(x => x.cursor) }; };
+                const suffixAst = { SelectStmt: { targetList: [{ ResTarget: { val: { A_Const: { ival: { ival: 1 } } } } }], sortClause: keys ? first.ast.SelectStmt.sortClause : undefined, limitCount: { ParamRef: { number: marker } }, limitOption: "LIMIT_OPTION_COUNT", op: "SETOP_NONE" } };
+                const tail = print(suffixAst).replace(/^SELECT 1/, "");
+                const expression = (ast) => print({ SelectStmt: { targetList: [{ ResTarget: { val: ast } }], limitOption: "LIMIT_OPTION_DEFAULT", op: "SETOP_NONE" } }).replace(/^SELECT /, "");
+                const fragment = (match, type) => {
+                    const p = pagedOf({ schemas: plan.schemas, dialect }, c, undefined, match);
+                    const ast = structuredClone(p.ast.SelectStmt.whereClause);
+                    const renumber = (node) => { if (node.ParamRef) {
+                        node.ParamRef.number = marker;
+                        if (dialect.nativeOrder && (type === "date" || type === "timestamptz")) {
+                            delete node.ParamRef;
+                            node.Raw = { parts: ["CAST(CAST(", { ParamRef: { number: marker } }, ` AS text) AS ${type})`] };
+                            return;
+                        }
+                    } for (const child of Object.values(node))
+                        if (child && typeof child === "object")
+                            Array.isArray(child) ? child.forEach(renumber) : renumber(child); };
+                    renumber(ast);
+                    return expression(ast);
+                };
+                return { marker: dialect.nativeOrder ? `$${marker}` : `?${marker}`, binds: c.binds, keys, first: read(first), ...(next ? { next: read(next) } : {}), tail, eq: Object.fromEntries((list.filterFields ?? []).map(field => { const col = v.columns?.[field] ?? v.columns?.[field.toLowerCase()], type = col && plan.schemas[col.schema]?.fields[col.field]; return [field, fragment({ eq: [{ column: field, value: "" }] }, type)]; })), ...(list.searchFields?.length ? { search: fragment({ search: { columns: list.searchFields, text: "x" } }) } : {}) };
+            });
+            all[name] = { caller: pages[0], trusted: pages[1] };
+        }
+        catch (error) {
+            refuse(`views/${name}/admin`, error instanceof Error ? error.message : String(error));
+        }
+    }
+    return all;
+}
+export async function adminBindingsOf(plan, dialect, paging, wire, refusals) {
+    const adminPages = adminPaging(plan, dialect, paging, (ast, names, nkeys, name) => {
+        const keys = [...names, ...Array.from({ length: nkeys }, (_, i) => `_k${i}`)];
+        const projected = wireScalars(ast, keys, [...names.map(key => boundaryType(plan, name, key)), ...(paging[name]?.types ?? [])], wire, true);
+        if (typeof projected === "string")
+            throw Error(projected);
+        return projected;
+    }, (path, message) => refusals.push({ code: "GENERATE_UNSUPPORTED", path, message }));
+    return { ok: true, adminPages, adminEntries: await adminEntries(plan, dialect, wire, refusals) };
+}

package/dist/infrastructure/artifacts.js

@@ -0,0 +1,67 @@
+import { readFile, readdir, mkdir, rm, writeFile, lstat } from "node:fs/promises";
+import { dirname, join, resolve, relative, sep, isAbsolute } from "node:path";
+import { GENERATED } from "../domain/entry.js";
+async function ownedFiles(directory, prefix = "") {
+    const entries = await readdir(join(directory, prefix), { withFileTypes: true }).catch(error => {
+        if (error.code === "ENOENT")
+            return [];
+        throw error;
+    });
+    const files = [];
+    for (const entry of entries) {
+        const name = join(prefix, entry.name);
+        if (entry.isDirectory())
+            files.push(...await ownedFiles(directory, name));
+        else if (entry.isFile() && /\.(ts|sql)$/.test(name)) {
+            const source = await readFile(join(directory, name), "utf8");
+            if (source.startsWith(`// ${GENERATED}\n`) || source.startsWith(`-- ${GENERATED}\n`) ||
+                /^(?:views|procedures)[/\\]/.test(name) && /^import \{ (?:view|procedure)_[A-Za-z0-9$]+ as operation \} from "\.\.\/generated\.js";\nexport default operation;/.test(source))
+                files.push(name);
+        }
+    }
+    return files;
+}
+export async function writeArtifacts(directory, files, check = false) {
+    const root = resolve(directory);
+    const rootStat = await lstat(root).catch(error => { if (error.code === "ENOENT")
+        return undefined; throw error; });
+    if (rootStat?.isSymbolicLink())
+        throw new Error(`Generated output cannot follow an application-owned symlink: ${root}`);
+    for (const name of Object.keys(files)) {
+        const child = relative(root, resolve(root, name));
+        if (!child || isAbsolute(child) || child === ".." || child.startsWith(`..${sep}`))
+            throw new Error(`Generated path escapes output directory: ${name}`);
+        let path = root;
+        for (const part of child.split(sep)) {
+            path = join(path, part);
+            const stat = await lstat(path).catch(error => { if (error.code === "ENOENT")
+                return undefined; throw error; });
+            if (stat?.isSymbolicLink())
+                throw new Error(`Generated output cannot follow an application-owned symlink: ${path}`);
+        }
+    }
+    const changed = [];
+    for (const [name, source] of Object.entries(files)) {
+        const path = join(directory, name);
+        const previous = await readFile(path, "utf8").catch(error => {
+            if (error.code === "ENOENT")
+                return undefined;
+            throw error;
+        });
+        if (previous === source)
+            continue;
+        changed.push(path);
+        if (!check) {
+            await mkdir(dirname(path), { recursive: true });
+            await writeFile(path, source);
+        }
+    }
+    for (const name of await ownedFiles(directory)) {
+        if (Object.hasOwn(files, name.replaceAll("\\", "/")))
+            continue;
+        changed.push(join(directory, name));
+        if (!check)
+            await rm(join(directory, name));
+    }
+    return changed.sort();
+}

package/dist/infrastructure/authSchema.js

@@ -0,0 +1,74 @@
+import { getAuthTables } from "@better-auth/core/db";
+import { getSchema } from "better-auth/db";
+import { ident } from "../kernel/dialect/common.js";
+function columnType(field, dialect) {
+    const pg = dialect === "postgres";
+    switch (field.type) {
+        case "number": return field.bigint ? "bigint" : "integer";
+        case "boolean": return pg ? "boolean" : "integer";
+        case "date": return pg ? "timestamptz" : "text";
+        case "json": return pg ? "jsonb" : "text";
+        default: return "text";
+    }
+}
+export function fieldIndexName(table, column) {
+    const full = `${table}_${column}_idx`;
+    if (new TextEncoder().encode(full).length <= 63)
+        return full;
+    let hash = 2166136261;
+    for (let i = 0; i < full.length; i++)
+        hash = Math.imul(hash ^ full.charCodeAt(i), 16777619);
+    const suffix = `_${(hash >>> 0).toString(16).padStart(8, "0")}_idx`;
+    return full.slice(0, 63 - suffix.length) + suffix;
+}
+function orderedTables(options) {
+    const byOrder = Object.entries(getSchema(options)).filter(([, table]) => !table.disableMigrations).sort((a, b) => a[1].order - b[1].order);
+    const ordered = [];
+    const place = (entry, visiting) => {
+        if (ordered.includes(entry) || visiting.has(entry[0]))
+            return;
+        visiting.add(entry[0]);
+        for (const field of Object.values(entry[1].fields)) {
+            const target = byOrder.find(([name]) => name === field.references?.model);
+            if (target)
+                place(target, visiting);
+        }
+        ordered.push(entry);
+    };
+    for (const entry of byOrder)
+        place(entry, new Set());
+    return ordered;
+}
+export function authSchemaSql(options, dialect) {
+    const generateId = options.advanced?.database?.generateId;
+    const idType = generateId === "serial" ? "integer" : generateId === "uuid" && dialect === "postgres" ? "uuid" : "text";
+    const idColumn = generateId === "serial" ? (dialect === "postgres" ? "integer GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY" : "integer PRIMARY KEY") : `${idType} PRIMARY KEY NOT NULL${idType === "uuid" ? " DEFAULT gen_random_uuid()" : ""}`;
+    const tables = getAuthTables(options);
+    const logical = Object.values(tables);
+    const referenced = (ref) => logical.find(t => t.modelName === ref.model)?.fields[ref.field]?.fieldName ?? ref.field;
+    const statements = [];
+    const indexes = [];
+    for (const [name, table] of orderedTables(options)) {
+        const index = (unique, index, columns) => indexes.push(`CREATE ${unique ? "UNIQUE " : ""}INDEX IF NOT EXISTS ${ident(index)} ON ${ident(name)} (${columns.map(ident).join(", ")})`);
+        if (name === tables.user?.modelName)
+            index(false, fieldIndexName(`_mantle_auth_${name}`, "member_page"), [tables.user.fields.createdAt?.fieldName ?? "createdAt", "id"]);
+        const columns = [`${ident("id")} ${idColumn}`];
+        for (const [column, field] of Object.entries(table.fields)) {
+            if (column === "id")
+                continue;
+            const type = field.references?.field === "id" ? idType : columnType(field, dialect);
+            columns.push([
+                ident(column), type,
+                field.required !== false && "NOT NULL",
+                field.unique && "UNIQUE",
+                field.references && `REFERENCES ${ident(field.references.model)}(${ident(referenced(field.references))}) ON DELETE ${(field.references.onDelete ?? "cascade").toUpperCase()}`,
+            ].filter(Boolean).join(" "));
+            if (field.index && !field.unique)
+                index(false, fieldIndexName(name, column), [column]);
+        }
+        statements.push(`CREATE TABLE IF NOT EXISTS ${ident(name)} (${columns.join(", ")})`);
+        for (const declared of table.indexes ?? [])
+            index(declared.unique, declared.name, declared.columns);
+    }
+    return [...statements, ...indexes];
+}

package/dist/infrastructure/bundle.js

@@ -0,0 +1,159 @@
+import { existsSync, readFileSync, realpathSync, rmSync, writeFileSync } from "node:fs";
+import { createRequire } from "node:module";
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { pathToFileURL } from "node:url";
+import { build } from "esbuild";
+import { INPUTS_FILE, authTableSql, extraRoles, generatedTarget, staleInputs } from "./inputs.js";
+export function startupGraph(metafile, entry) {
+    const visited = new Set();
+    const visit = (name) => {
+        if (visited.has(name))
+            return;
+        visited.add(name);
+        const output = metafile.outputs[name];
+        for (const imported of output.imports) {
+            if (!imported.external && imported.kind !== "dynamic-import")
+                visit(imported.path);
+        }
+    };
+    for (const [name, output] of Object.entries(metafile.outputs))
+        if (output.entryPoint && resolve(output.entryPoint) === resolve(entry))
+            visit(name);
+    return [...visited];
+}
+const refused = [
+    [/(?:^|\/)node_modules\/(?:better-auth(?:\/|$)|@better-auth\/)/, "Load it through authLoader(() => import(...)) to keep Better Auth out of startup."],
+    [/(?:^|\/)node_modules\/@modelcontextprotocol\//, "Load MCP through a request-time import(...)."],
+    [/(?:^|\/)node_modules\/(?:@aotter\/mantle\/dist\/(?:build|infrastructure)\/|yaml\/|pgsql-deparser\/|libpg-query\/)|(?:^|\/)mantle\/(?:dist|src)\/(?:build|infrastructure)\//, "Generator code must not run in a Worker; import runtime entry points such as @aotter/mantle/rest."],
+    [/(?:^|\/)node_modules\/@aotter\/mantle-admin\/dist\/admin-app\/|(?:^|\/)mantle-admin\/(?:dist\/admin-app|admin\/src)\//, "Admin's UI (@aotter/mantle-admin/app, /hooks) runs in the browser: import it only from src/admin.tsx, which `mantle bundle` builds into the assets directory."],
+];
+export function guardStartup(metafile, entry) {
+    for (const name of startupGraph(metafile, entry)) {
+        const output = metafile.outputs[name];
+        for (const input of Object.keys(output.inputs)) {
+            const hit = refused.find(([pattern]) => pattern.test(input.replaceAll("\\", "/")));
+            if (hit)
+                throw new Error(`Startup module ${name} contains ${input}. ${hit[1]}`);
+        }
+    }
+}
+const physical = (input) => {
+    let found = resolve(input);
+    const tail = [];
+    while (!existsSync(found)) {
+        const parent = dirname(found);
+        if (parent === found)
+            return found;
+        tail.unshift(basename(found));
+        found = parent;
+    }
+    return resolve(realpathSync(found), ...tail);
+};
+const within = (outer, inner) => {
+    const path = relative(physical(outer), physical(inner));
+    return path === "" || (path !== ".." && !path.startsWith(`..${sep}`) && !isAbsolute(path));
+};
+function assertCleanable(label, dir, entry) {
+    if (physical(dir) === physical(process.cwd()))
+        throw new Error(`${label} must not be the working directory: it is cleaned before building.`);
+    if (within(dir, entry))
+        throw new Error(`${label} must not contain the source entry: it is cleaned before building.`);
+}
+export const ownModules = async (entry) => (await build({ entryPoints: [entry], bundle: true, write: false, metafile: true, packages: "external", format: "esm", platform: "neutral", logLevel: "silent", absWorkingDir: process.cwd() })).metafile;
+export async function bundleApp(entry, outdir, assets = join(outdir, "client")) {
+    const source = realpathSync(entry);
+    assertCleanable("Bundle outdir", outdir, source);
+    assertCleanable("The assets directory", assets, source);
+    const own = await ownModules(entry);
+    if (generatedDirs(own).some(dir => generatedTarget(join(dir, "generated.ts"))?.startsWith("bun-"))) {
+        if (Object.values(own.inputs).some(input => input.imports.some(imported => /^@aotter\/mantle-admin\/server(?:\/|$)/.test(imported.path))))
+            await bundleAdmin(source, outdir, join(assets, "admin"));
+        else
+            console.warn("note: no Admin built: the entry's own modules do not import @aotter/mantle-admin/server (an import through another package is not seen).");
+        return;
+    }
+    const worker = join(outdir, "worker");
+    if (within(worker, assets) || within(assets, worker))
+        throw new Error(`The assets directory ${assets} must not overlap the Worker directory ${worker}.`);
+    const metafile = await bundle(entry, worker);
+    if (Object.keys(metafile.inputs).some(input => /(?:^|\/)mantle-admin\/(?:dist|src)\/server\/index\.[jt]s$/.test(input.replaceAll("\\", "/")))) {
+        await bundleAdmin(source, outdir, join(assets, "admin"));
+    }
+}
+async function bundleAdmin(entry, outdir, out) {
+    const source = join(dirname(entry), "admin.tsx"), custom = existsSync(source);
+    const mcpSource = join(dirname(entry), "admin.mcp.tsx"), customMcp = existsSync(mcpSource);
+    assertCleanable("The Admin output directory", out, entry);
+    const require = createRequire(entry);
+    let builder;
+    try {
+        builder = require.resolve("@aotter/mantle-admin/build");
+    }
+    catch {
+        throw new Error(`The Worker serves Admin, but @aotter/mantle-admin/build does not resolve from ${relative(process.cwd(), entry)}. Install @aotter/mantle-admin at the version of @aotter/mantle-admin/server.`);
+    }
+    const stamp = join(outdir, ".admin-inputs");
+    const manifest = realpathSync(lookup(require, "@aotter/mantle-admin") ?? require.resolve("@aotter/mantle-admin/package.json"));
+    const key = custom || customMcp ? undefined : JSON.stringify({ out: resolve(out), path: dirname(manifest), packages: installed(manifest) });
+    if (key && existsSync(join(out, "index.html")) && existsSync(join(out, "mcp-app.html")) && existsSync(stamp) && readFileSync(stamp, "utf8") === key) {
+        console.log(`Admin inputs unchanged; kept ${relative(process.cwd(), out)}.`);
+        return;
+    }
+    rmSync(stamp, { force: true });
+    const { buildAdmin } = await import(pathToFileURL(builder).href);
+    await buildAdmin({ entry: custom ? source : undefined, ...(customMcp ? { mcpEntry: mcpSource } : {}), outDir: out });
+    if (key)
+        writeFileSync(stamp, key);
+}
+const lookup = (require, name) => require.resolve.paths(name)?.map(dir => join(dir, name, "package.json")).find(file => existsSync(file));
+function installed(manifest) {
+    const { name, version, dependencies = {}, peerDependencies = {} } = JSON.parse(readFileSync(manifest, "utf8"));
+    const require = createRequire(manifest);
+    const versions = { [name]: version };
+    for (const dependency of Object.keys({ ...peerDependencies, ...dependencies }).sort()) {
+        const found = lookup(require, dependency);
+        versions[dependency] = found ? JSON.parse(readFileSync(found, "utf8")).version : null;
+    }
+    return versions;
+}
+function generatedDirs(metafile) {
+    const dirs = [...new Set(Object.keys(metafile.inputs).map(input => resolve(input, "..")).filter(dir => existsSync(resolve(dir, INPUTS_FILE))))];
+    for (const dir of dirs) {
+        const input = resolve(dir, "generated.ts"), stale = staleInputs(input);
+        if (stale.length)
+            throw new Error(`Generated output in ${relative(process.cwd(), resolve(input, ".."))} is stale (${stale.join("; ")}). Run your generate script (mantle generate ...) and rebuild.`);
+    }
+    return dirs;
+}
+export async function bundle(entry, outdir) {
+    entry = realpathSync(entry);
+    assertCleanable("Bundle outdir", outdir, entry);
+    rmSync(outdir, { recursive: true, force: true });
+    const result = await build({
+        entryPoints: [entry], outdir, bundle: true, splitting: true, format: "esm", platform: "neutral",
+        conditions: ["workerd", "worker", "browser"], mainFields: ["module", "main"],
+        external: ["cloudflare:*", "node:*"], minify: true, metafile: true, chunkNames: "chunks/[name]-[hash]",
+        plugins: [{ name: "optional-peers", setup(builder) {
+                    builder.onResolve({ filter: /^(?:better-auth|@better-auth\/(?:core|oauth-provider)|@modelcontextprotocol\/server)(?:\/|$)/ }, async (args) => {
+                        if (args.pluginData?.optionalPeer)
+                            return;
+                        const resolved = await builder.resolve(args.path, { importer: args.importer, resolveDir: args.resolveDir, kind: args.kind, pluginData: { optionalPeer: true } });
+                        return resolved.errors.length ? { path: args.path, external: true } : resolved;
+                    });
+                } }],
+    });
+    if (Object.keys(result.metafile.inputs).some(input => /(?:^|\/)mantle\/(?:src|dist)\/testing\//.test(resolve(input).replaceAll("\\", "/"))))
+        throw new Error("@aotter/mantle/testing is only for tests and cannot be bundled for production.");
+    generatedDirs(result.metafile);
+    const appSources = Object.keys(result.metafile.inputs).filter(input => !/node_modules|(?:^|\/)generated\/|^\.\.\//.test(input) && /\.[cm]?[jt]s$/.test(input)).map(input => [input, readFileSync(input, "utf8")]);
+    for (const [input, source] of appSources) {
+        const tables = authTableSql(source);
+        if (tables.length)
+            console.warn(`note: ${input} queries Better Auth's ${tables.join(", ")} table with SQL. Read users through userOf(caller) or readIdentity(auth) (@aotter/mantle/auth, @aotter/mantle/auth/identity), which follow each instance's table mapping and ban state.`);
+    }
+    const roles = appSources.flatMap(([, source]) => extraRoles(source));
+    if (roles.length)
+        console.warn(`note: Better Auth roles beyond admin and user: ${[...new Set(roles)].join(", ")}. Mantle grants by the admin layer and app code; keep extra roles only if the app needs them.`);
+    guardStartup(result.metafile, entry);
+    return result.metafile;
+}