@aotter/mantle 0.2.0-alpha.10 → 0.2.0-alpha.11

package/dist/usecase/rest.js

@@ -14,7 +14,6 @@ export function emitRest(plan, lowered, target, description) {
     const views = [], procedures = [];
     let hasWire = false;
     const convert = (code) => code ? `, convert: ${code}` : "";
-    // Each segment matches in its encoded form; `{name}` segments capture.
     const route = (method, path) => {
         const keys = [];
         const source = path.split("/").map(segment => segment.startsWith("{") && segment.endsWith("}") ? (keys.push(segment.slice(1, -1)), "([^/]+)") : encodeURIComponent(segment).replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("/");

package/dist/usecase/site.js

@@ -1,4 +1,3 @@
-/** Generate the optional site/media module and deployment DDL, never runtime preparation. */
 import { assertSiteDefaultsCanonical, canonicalizeLocaleList, expandPolicyRequired } from "../build/compiler.js";
 import { driverFor, isSqlite, q } from "../domain/entry.js";
 export function emitSite(target, defaults, refuse, schemaNames) {

package/dist/usecase/stores.js

@@ -1,24 +1,14 @@
-/**
- * One typed collection per Schema, over the generic `createStore`. Core's row rules (`rowPolicy`, `writePolicy`) are evaluated
- * here, at build time, ONCE for a placeholder scope and TTL into the shared `Rules`; a Schema adds only a `Fact` (scope, TTL,
- * publishing, its date-time and date columns). Generation is refused if a Schema's expanded rules differ from Core's own for it
- * (caller and trusted rows, insert fills, update sets and lock, delete lock).
- * Column names, value types, writable columns and `orderBy` are TypeScript types only: nothing at runtime knows them.
- */
 import { NATIVE_NOT_NULL, notNullColumns, rowPolicy, writePolicy } from "../build/compiler.js";
 import { declaredType, inputType, nativeType } from "../domain/columns.js";
 import { q } from "../domain/entry.js";
 import { expand, SCOPE, TTL } from "../kernel/store.js";
 import { refChecks, userScopeTerm } from '../build/compiler.js';
-// Types the typed Store compares and writes as plain bind values. Fixed numerics are scaled integers on SQLite; geo is two columns.
 const SCALAR = new Set(["text", "real", "float8", "integer", "int4", "int8", "bool", "timestamptz", "date"]);
-/** Core's own rules for a Schema, in the shape of `Rules` without the id expression (a delete's lock is compared separately). */
 const core = (s, schemas) => {
     const update = writePolicy(s, "update", { lock: true });
     return { caller: rowPolicy(s, "caller", schemas), trusted: rowPolicy(s, "trusted", schemas), fills: writePolicy(s, "insert").fills, sets: update.sets, lock: update.lock };
 };
 const probe = { scope: SCOPE, ttl: TTL, ttlSeconds: 0, publishing: true };
-/** @internal */
 export function emitStores(schemas, isSqlite, newId, refuse, required = false) {
     const all = Object.values(schemas).sort((a, b) => a.name < b.name ? -1 : 1);
     if (!all.length && !required)
@@ -28,7 +18,7 @@ export function emitStores(schemas, isSqlite, newId, refuse, required = false) {
     for (const s of all) {
         const type = (column) => declaredType(s.fields, column) ?? (column === "version" ? "integer" : column === "published_at" ? "timestamptz" : "text");
         const declared = Object.keys(s.fields).filter(f => f !== s.scope && s.fields[f] !== "geo");
-        const geo = Object.keys(s.fields).filter(f => s.fields[f] === "geo").flatMap(f => [`${f}_lat`, `${f}_lng`]); // `*` returns a geo field's two columns
+        const geo = Object.keys(s.fields).filter(f => s.fields[f] === "geo").flatMap(f => [`${f}_lat`, `${f}_lng`]);
         const names = [...["id", "version", "created_at", "updated_at", "author_id", ...(s.publishing ? ["status", "published_at"] : [])], ...declared];
         const required = new Set(s.schema.required ?? []), notNull = notNullColumns(s);
         const nonNull = (column) => NATIVE_NOT_NULL.has(column) || notNull.has(column);
@@ -45,11 +35,9 @@ export function emitStores(schemas, isSqlite, newId, refuse, required = false) {
             ...(ref.length ? { ref } : {}),
             ...(parent ? { parent: { on: s.translates.on.toLowerCase(), ...(parent.scope ? { scope: [parent.scope, s.scope] } : {}), table: s.translates.parent.toLowerCase(), visible: rowPolicy(s, "caller", schemas).find(t => t[1] === "parent"), caller: rowPolicy(parent, "caller", schemas), trusted: rowPolicy(parent, "trusted", schemas), fields: inherited, ts: inherited.filter(c => parent.fields[c] === "timestamptz"), d: inherited.filter(c => parent.fields[c] === "date") } } : {}),
         };
-        // the shared rules, with this Schema's scope and TTL put in, are Core's rules for it: or the runtime would enforce something else
         const expected = q([core(s, schemas), writePolicy(s, "delete", { lock: true }).lock]), got = q([expand(rules, fact), rules.lock]);
         if (expected !== got)
             refuse(`schemas/${s.name}`, `Core's row rules for this Schema differ from the shared rules (${expected} vs ${got}); the generic Store cannot serve it.`);
-        // ORDER BY is allowed where the caller's scoped read can walk an index (its first column, or the one after the scope column) and the column is NOT NULL.
         const indexed = new Set([...(s.publishing ? [[...(s.scope ? [s.scope] : []), "published_at", "id"]] : []), ...(s.indexes ?? []), ...(s.unique ?? [])].map(i => i[0] === s.scope ? i[1] : i[0]).filter((c) => !!c));
         const key = (c) => /^[A-Za-z_]\w*$/.test(c) ? c : q(c);
         const of = (columns, value) => `{ ${columns.map(c => `${key(c)}: ${value(c)};`).join(" ")} }`;

package/dist/usecase/tool-version.js

@@ -1,8 +1,5 @@
-/** Generate-time tool versions: a stale host copy shows the model an older version than results carry. */
 import { canonical, fnv } from "../build/compiler.js";
-/** A hash of what a catalogue lists, so an unchanged definition keeps its version across deploys. */
 export const versionOf = (value) => fnv(canonical(value));
-/** A listed tool: its version, and its description (each locale's) ending with that version. */
 export function versioned(tool) {
     const v = versionOf(tool), mark = (text) => `${text} (tool version ${v})`;
     return { ...tool, description: typeof tool.description === "string" ? mark(tool.description) : Object.fromEntries(Object.entries(tool.description).map(([locale, text]) => [locale, mark(text)])), version: v };

package/dist/usecase/translations.js

@@ -1,12 +1,10 @@
 import { userReferences } from "../domain/userReferences.js";
-/** Translation helpers use generated SQL policy, never a request-time manifest. */
 import { rowPolicy } from "../build/compiler.js";
 import { renderTerm } from "../kernel/store.js";
 import { dialect as SQLITE } from "../kernel/dialect/sqlite.js";
 import { dialect as POSTGRES } from "../kernel/dialect/postgres.js";
 import { declaredType } from "../domain/columns.js";
 import { driverFor, isSqlite, q } from "../domain/entry.js";
-/** The parent is checked by the same atomic UPDATE that publishes the child. */
 export function publishedParent(plan, child, d, recipes, trusted) {
     const tr = child.translates, parent = plan.schemas[tr.parent.toLowerCase()], on = tr.on.toLowerCase();
     const conditions = [`p.${d.ident(on)} = ${d.ident(child.name)}.${d.ident(on)}`];

package/dist/usecase/validation.js

@@ -1,4 +1,3 @@
-/** Compile boundary checks into each operation; no schema enters the request bundle. */
 import { INPUT_RULE_KEYWORDS, lookupLocalRef as lookup, rootRefChain } from "../build/compiler.js";
 import { literal, q } from "../domain/entry.js";
 import { publishingInput } from "./publishing.js";
@@ -6,14 +5,9 @@ import { equal } from "../kernel/validation.js";
 const pointer = (key) => key.replace(/~/g, "~0").replace(/\//g, "~1");
 const supported = new Set([..."$defs $ref $schema $id type nullable properties required additionalProperties items enum const format pattern minLength maxLength minimum maximum exclusiveMinimum exclusiveMaximum multipleOf minItems maxItems title description default readOnly writeOnly examples deprecated x-mantle-ref x-mcp-hint".split(" "), ...INPUT_RULE_KEYWORDS]);
 const shapes = "see docs/handbook/reference/surface.md";
-// YAML .inf and .nan parse to numbers that JSON writes as null.
 const finite = (value) => typeof value === "number" ? Number.isFinite(value) : !!value && typeof value === "object" ? Object.values(value).every(finite) : true;
 const has = (key) => `Object.hasOwn(object,${q(key)})`;
 const exactly = (value, keys) => !!value && typeof value === "object" && !Array.isArray(value) && Object.keys(value).sort().join(" ") === keys;
-/**
- * An object schema's rules, each failing `when` (JavaScript on `object`) with its sentence at the missing field `key`, or the
- * reason a rule has an unsupported shape.
- */
 function rules(schema) {
     const declared = (names) => Array.isArray(names) && names.length > 0 && names.every(name => typeof name === "string" && Object.hasOwn(schema.properties ?? {}, name));
     const list = (names) => names.map(name => `'${name}'`).join(" and ");
@@ -34,7 +28,6 @@ function rules(schema) {
     if (condition !== undefined || then !== undefined || otherwise !== undefined) {
         const [key] = exactly(condition, "properties required") ? Object.keys(condition.properties) : [];
         const value = key === undefined ? undefined : condition.properties[key];
-        // Without required: [key], an absent key satisfies `if`.
         if (key === undefined || !exactly(condition.properties, key) || !exactly(value, "const") || !(["string", "boolean"].includes(typeof value.const) || Number.isFinite(value.const) || value.const === null) || q(condition.required) !== q([key]) || !declared([key]))
             return `if is supported only as exactly { properties: { <field>: { const: <string, finite number, boolean or null> } }, required: [<field>] }, so an absent field does not satisfy it; ${shapes}.`;
         if (then === undefined && otherwise === undefined || [then, otherwise].some(branch => branch !== undefined && !(exactly(branch, "required") && declared(branch.required))))
@@ -47,19 +40,12 @@ function rules(schema) {
     }
     return found;
 }
-/** Whether an input schema accepts `{}`: a list View is read with no input, so web indexes need this. */
 export function acceptsEmpty(input) {
     if (input === undefined)
         return true;
-    // Validation applies a root `$ref`'s target too, so each schema along the chain must accept `{}`; an unresolved or cyclic chain does not.
-    // dependentRequired needs a present key; an if needs its field, so `{}` meets only an else. An enum or const must admit `{}`.
     return rootRefChain(input)?.every(schema => !schema.required?.length && schema.anyOf === undefined && !schema.else?.required?.length
         && (schema.enum === undefined || schema.enum.some(option => equal({}, option))) && (schema.const === undefined || equal({}, schema.const)) && (schema.type === undefined || [schema.type].flat().includes("object"))) ?? false;
 }
-/**
- * An input schema as an AI tool catalogue advertises it: some model APIs refuse rules (a root `anyOf`, `if`), so each rule leaves
- * the schema and becomes a sentence of the description.
- */
 export function advertised(input, description) {
     if (!input)
         return { inputSchema: input, description };
@@ -68,7 +54,6 @@ export function advertised(input, description) {
         if (!node || typeof node !== "object")
             return;
         const schema = node;
-        // An MCP View tool keeps each rule set of its root `$ref` chain as an `allOf` branch over the merged properties.
         const branches = Array.isArray(schema.allOf) ? schema.allOf : [];
         for (const branch of [schema, ...branches.map(branch => ({ ...branch, properties: schema.properties }))]) {
             const found = rules(branch);
@@ -111,9 +96,7 @@ export function emitValidation(plan, refuse = (path, message) => { throw Error(`
                 files[file] = `import { transition } from "@aotter/mantle/validation";\nexport const validate = (raw: unknown) => transition(${q(base)}, raw);\n`;
                 continue;
             }
-            // Only a local `$ref`, or more than 100 nested objects and arrays, can reach the nesting limit: only then is `depth` passed.
             const recursive = json.includes('"$ref"') || json.split(/[[{]/).length > 101, depth = recursive ? ",depth+1" : "";
-            // Identical bodies share one function.
             const nodes = new Map(), bodies = new Map(), functions = [], formats = new Set(), patterns = new Map();
             let equality = false;
             const resolve = (ref) => {
@@ -142,7 +125,6 @@ export function emitValidation(plan, refuse = (path, message) => { throw Error(`
                         refuse(base, `Unsupported input type '${type}'.`);
                 if (types.length)
                     lines.push(typeCheck(types));
-                // After a single type check `fail` (never) has narrowed `value`: that type's guard is implied.
                 const only = types.length === 1 ? types[0] : undefined;
                 const guard = (type, test = `(${condition(type)})`) => only === type || type === "number" && only === "integer" ? "" : test + " && ";
                 if (schema.enum) {
@@ -197,7 +179,6 @@ export function emitValidation(plan, refuse = (path, message) => { throw Error(`
                 }
                 if (schema.items)
                     lines.push(`${only === "array" ? "" : "if (Array.isArray(value)) "}for (let i=0;i<value.length;i++) ${emit(schema.items)}(value[i],path+"/"+i${depth});`);
-                // Several keys that need no JSON-pointer escaping are checked by one loop, in the same order.
                 const required = schema.required ?? [], checks = Object.entries(schema.properties ?? {}).map(([key, child]) => [key, emit(child)]);
                 const loop = (keys) => keys.length > 1 && keys.every(key => pointer(key) === key);
                 const object = loop(required) ? [`for (const key of ${q(required)}) if (!Object.hasOwn(object,key)) fail(path+"/"+key,"Required field is missing.");`] : required.map(key => `if (!Object.hasOwn(object,${q(key)})) fail(path+${q("/" + pointer(key))},"Required field is missing.");`);
@@ -217,7 +198,6 @@ export function emitValidation(plan, refuse = (path, message) => { throw Error(`
                 if (object.length)
                     lines.push(`${only === "object" ? "" : `if (${condition("object")}) `}{ const object = value as Record<string,unknown>;\n${object.join("\n")}\n}`);
                 const body = lines.join("\n");
-                // Without recursion nothing calls a check before its body is complete, so an identical body's function serves it.
                 const fn = recursive ? named : bodies.get(body) ?? named;
                 if (fn === named) {
                     bodies.set(body, fn);

package/docs/examples/README.md

@@ -39,5 +39,5 @@ shell's allow-all `src/signup.ts`, unless sign-up should be invite-only. Purchas
 
 Every example uses two roles: `admin` (the admin layer) and `user`.
 
-[Reference service](https://github.com/aotter/mantle/tree/v0.2.0-alpha.10/docs/examples/reference-service) is the release smoke test for packed packages, not a starting point. Its source lives in the tagged repository; it is not included in the npm docs.
+[Reference service](https://github.com/aotter/mantle/tree/v0.2.0-alpha.11/docs/examples/reference-service) is the release smoke test for packed packages, not a starting point. Its source lives in the tagged repository; it is not included in the npm docs.
 Projects on 0.1.x move with [the upgrade guide](../upgrade-0.1-to-0.2.md).

package/docs/examples/app-shell/package.json

@@ -15,8 +15,8 @@
     "accept": "node accept.mjs"
   },
   "dependencies": {
-    "@aotter/mantle": "0.2.0-alpha.10",
-    "@aotter/mantle-ui": "0.2.0-alpha.10",
+    "@aotter/mantle": "0.2.0-alpha.11",
+    "@aotter/mantle-ui": "0.2.0-alpha.11",
     "@better-auth/cimd": "1.7.7",
     "@better-auth/core": "1.7.7",
     "@better-auth/mcp": "1.7.7",
@@ -25,7 +25,7 @@
     "@modelcontextprotocol/ext-apps": "2.0.0",
     "@modelcontextprotocol/server": "2.2.0",
     "better-auth": "1.7.7",
-    "@aotter/mantle-admin": "0.2.0-alpha.10",
+    "@aotter/mantle-admin": "0.2.0-alpha.11",
     "react": "19.3.0",
     "react-dom": "19.3.0"
   },

package/docs/examples/app-shell/src/routes.ts

@@ -2,7 +2,9 @@ import type { Caller } from "@aotter/mantle/contracts";
 import { signInPage } from "./sign-in.js";
 
 /**
- * App-owned routes, tried before Admin, MCP and REST. Return undefined to fall through.
+ * App-owned routes, tried before REST. Return undefined to fall through. Paths under /admin and /mcp never reach here, and
+ * neither do Better Auth's (/api/auth/*, /oauth/consent*, /.well-known/oauth-*). A root catch-all page (/:slug) must
+ * still return undefined for the paths of the app's own HTTP Triggers (REST), or it shadows them.
  * GET /sign-in: member sign-in (src/sign-in.ts); a member page sends anonymous visitors there with signInRedirect.
  * AGENT: add visitor pages and callbacks/webhooks here. Visitor pages carry everything in `mantle help public-pages`
  * (canonical, Open Graph, JSON-LD, answer block, .md alternates, sitemap.xml, robots.txt, llms.txt; recipes example).

package/docs/examples/app-shell/src/service.ts

@@ -43,7 +43,8 @@ export async function fetchService(request: Request, env: Env, context: Executio
     const ownAuth = await withAuthTasks(context.waitUntil.bind(context), () => authRoutes(auth!, { methods: [{ kind: "email-otp" }], resolver: caller })(request));
     if (ownAuth) return respond(ownAuth);
     const url = new URL(request.url);
-    const own = await appRoutes(request, env, { caller, waitUntil: context.waitUntil.bind(context) });
+    // /admin and /mcp belong to Admin and MCP: a root catch-all page in src/routes.ts (/:slug) never shadows them.
+    const own = /^\/(?:admin|mcp)(?:\/|$)/.test(url.pathname) ? undefined : await appRoutes(request, env, { caller, waitUntil: context.waitUntil.bind(context) });
     if (own) return respond(own);
     let response: Response | undefined;
     if (url.pathname === "/admin/api" || url.pathname.startsWith("/admin/api/")) {

package/docs/handbook/cloudflare/service-entry.md

@@ -81,6 +81,9 @@ export default {
         if (shell) return shell;
         // Your public frontend/web.ts routes can use an anonymous Caller without
         // loading auth; their generated SQL still controls publication visibility.
+        // Mounted here, after every Mantle surface, a root catch-all page (/:slug)
+        // cannot shadow /admin, /mcp or REST. Mount them earlier only behind a
+        // guard that skips those paths, as the app shell does.
         return new Response('Not found', { status: 404, headers: { 'cache-control': 'no-store' } });
       } catch (error) { return surfaceFailure(error); }
     });

package/docs/handbook/examples/hub.md

@@ -2,4 +2,4 @@
 
 Use the [Worker quickstart](../start/quickstart-worker.md) for a complete native manifest and entry, [typed queries](../guides/typed-queries.md) for embedding, and [service composition](../cloudflare/service-entry.md) for optional surfaces.
 
-The runnable [reference service](https://github.com/aotter/mantle/tree/v0.2.0-alpha.10/docs/examples/reference-service) exercises the native package integration. See the [generated public website](../../examples/generated-web/README.md) for a native Worker example.
+The runnable [reference service](https://github.com/aotter/mantle/tree/v0.2.0-alpha.11/docs/examples/reference-service) exercises the native package integration. See the [generated public website](../../examples/generated-web/README.md) for a native Worker example.

package/docs/handbook/guides/agent-setup.md

@@ -13,21 +13,21 @@ carries.
 The Mantle plugin carries one OSS authoring skill, `mantle`, and local
 acceptance references. It does not configure a hosted-service connection.
 Install from the Git tag matching the exact SDK version you selected (currently
-`v0.2.0-alpha.10`). Alpha releases integrate on `develop`; an unqualified
+`v0.2.0-alpha.11`). Alpha releases integrate on `develop`; an unqualified
 `aotter/mantle` source follows `main` and can install older, incompatible
 instructions. A skill install does not upgrade the application's SDK.
 
 For Codex, pin the marketplace checkout:
 
 ```sh
-codex plugin marketplace add aotter/mantle --ref v0.2.0-alpha.10
+codex plugin marketplace add aotter/mantle --ref v0.2.0-alpha.11
 codex plugin add mantle@mantle
 ```
 
 For Claude Code, first clone the release into a directory you will keep:
 
 ```sh
-git clone --depth 1 --branch v0.2.0-alpha.10 https://github.com/aotter/mantle.git mantle-plugin
+git clone --depth 1 --branch v0.2.0-alpha.11 https://github.com/aotter/mantle.git mantle-plugin
 ```
 
 Then, in Claude Code, use that checkout's absolute path:
@@ -41,7 +41,7 @@ Cursor and GitHub Copilot use their plugin manifests from the same tagged
 checkout. Without a plugin host, install only the consumer skill by name:
 
 ```sh
-npx skills add https://github.com/aotter/mantle/tree/v0.2.0-alpha.10 --skill mantle
+npx skills add https://github.com/aotter/mantle/tree/v0.2.0-alpha.11 --skill mantle
 ```
 
 When upgrading the SDK, update the marketplace ref or local tagged checkout and

package/docs/handbook/guides/public-pages.md

@@ -11,6 +11,12 @@ here instead of repeating it.
 - **App-owned pages** in `src/routes.ts`, when the page needs its own layout, JSON-LD or languages. The reference
   implementation is `node_modules/@aotter/mantle/docs/examples/recipes` (`src/pages.ts`, `src/routes.ts`; `smoke.mjs` checks every item below).
 
+## URLs
+
+Mantle owns `/admin`, `/mcp`, `/api/auth/`, `/oauth/consent` and `/.well-known/oauth-*`, and the app's HTTP Triggers own
+their declared paths. Give visitor pages their own prefix (`/{locale}/…`, `/teas/{slug}`), or make a root page (`/{slug}`)
+return nothing for those paths; the app shell already keeps `/admin` and `/mcp` away from `src/routes.ts`.
+
 ## Every public page
 
 - Server-rendered HTML per URL with the content in the body. A client-only SPA shell or metadata set by script is not

package/docs/handbook/reference/admin-descriptors.md

@@ -37,7 +37,10 @@ execution plan or SQL AST, storage access or execution observer is included.
   admin tool names. A conflicting declared admin tool is refused.
 - `webmcp` carries static tool declarations and Admin page routes. `bootstrap`
   combines `collections`, `operations`, `views` and `webmcp`; the handler adds
-  request-owned `me`, `site` and any selected entries page.
+  request-owned `me`, `site` and any selected entries page. Its
+  `developerConsole` is a loader for the same snapshot, generated again in
+  `admin-developer-console.ts`, so Admin imports it on a developer-console
+  request instead of at Worker startup.
 
 Generation reuses the 0.2 projection and SQL-logic helpers. View columns come
 from the compiled plan (Core's `viewOutputs` provenance, including aliases,

package/docs/handbook/reference/schema.md

@@ -94,7 +94,7 @@ For inserts, one allowed partition autofills a missing value; multiple values re
 
 #### References to a scoped Schema
 
-A non-null `x-mantle-ref` value that points to a scoped Schema (field or owner scope) must name a row of that Schema the caller can read, matched on `id` or on the object form's `field`, and that row must have the same value as the child for every scope field the two share (`ADR-0034`: a reference between scoped Schemas stays inside one owner or partition). A Store insert or update, and a Procedure `INSERT … VALUES`, `UPDATE … SET` or `DO UPDATE SET`, check it in the same statement; a missing, unreadable or other-partition parent behaves like a missing row: a single-row statement returns HTTP 409 (`CONFLICT`), and an `ON CONFLICT` insert or a set update writes nothing for that row. A caller holding several values or `{ all: true }` can still not point a child in one partition at a parent in another. `INSERT … SELECT` that writes such a reference runs only for system callers. A caller's `UPDATE … SET` or `DO UPDATE SET` of such a reference takes no subquery, which could read the parent's columns as its own. Trusted writes (system callers, `runtime.store`) are not checked, like the other row rules, and native Admin's generic create and patch do not check references yet. NULL is always allowed; deleting a parent does not touch its children.
+A non-null `x-mantle-ref` value that points to a scoped Schema (field or owner scope) must name a row of that Schema the caller can read, matched on `id` or on the object form's `field`, and that row must have the same value as the child for every scope field the two share (`ADR-0034`: a reference between scoped Schemas stays inside one owner or partition). A Store insert or update, a Procedure `INSERT … VALUES`, `UPDATE … SET` or `DO UPDATE SET`, and native Admin's generic create and patch check it in the same statement; a missing, unreadable or other-partition parent behaves like a missing row: a single-row statement returns HTTP 409 (`CONFLICT`), and an `ON CONFLICT` insert or a set update writes nothing for that row. A caller holding several values or `{ all: true }` can still not point a child in one partition at a parent in another. `INSERT … SELECT` that writes such a reference runs only for system callers. A caller's `UPDATE … SET` or `DO UPDATE SET` of such a reference takes no subquery, which could read the parent's columns as its own. Trusted writes (system callers, `runtime.store`) are not checked, like the other row rules. NULL is always allowed; deleting a parent does not touch its children.
 
 ## Reserved entry columns
 

package/docs/handbook/releases/index.md

@@ -17,10 +17,10 @@ Pin every package you use to the same exact version and upgrade them together.
 
 ## 0.2.0 — in preparation
 
-### Upgrading to 0.2.0-alpha.10
+### Upgrading to 0.2.0-alpha.11
 
 Pin every selected `@aotter/mantle`, `@aotter/mantle-ui` and
-`@aotter/mantle-admin` dependency to `0.2.0-alpha.10`, refresh the lockfile,
+`@aotter/mantle-admin` dependency to `0.2.0-alpha.11`, refresh the lockfile,
 then regenerate and check the application's owned artifacts. Keep existing
 production migrations application-owned; generated initial DDL is for an empty
 database. This alpha includes breaking Admin authoring and paging changes.
@@ -112,7 +112,7 @@ Existing alpha.6 applications require a source migration:
   application code. Review [authorization and Caller wiring](../concepts/runtime-and-adapters.md)
   and regenerate all owned artifacts before running `generate --check`.
 
-The [reference Worker](https://github.com/aotter/mantle/tree/v0.2.0-alpha.10/docs/examples/reference-service) and
+The [reference Worker](https://github.com/aotter/mantle/tree/v0.2.0-alpha.11/docs/examples/reference-service) and
 [app shell](../../examples/app-shell/) demonstrate the current composition.
 The following earlier-alpha notes are historical; the current handbook and
 the native migration above supersede their runtime and CLI instructions.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aotter/mantle",
-  "version": "0.2.0-alpha.10",
+  "version": "0.2.0-alpha.11",
   "type": "module",
   "sideEffects": false,
   "engines": {
@@ -140,7 +140,7 @@
     "registry": "https://registry.npmjs.org"
   },
   "scripts": {
-    "build": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\" && tsc -p tsconfig.lib.json && node scripts/bundle-compiler.mjs && node scripts/prune-declarations.mjs",
+    "build": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\" && tsc -p tsconfig.lib.json && node ../../scripts/strip-comments.mjs tsconfig.lib.json && node scripts/bundle-compiler.mjs && node scripts/prune-declarations.mjs",
     "typecheck": "tsc --noEmit -p tsconfig.json",
     "test": "bun test tests/*.test.ts && bun run test:compiler",
     "generate": "bun src/infrastructure/cli.ts",

package/skills/README.md

@@ -27,7 +27,7 @@ release tag as the application's SDK; alpha releases on `develop` can be newer
 than the default `main` branch. For a skill-only installation:
 
 ```sh
-npx skills add https://github.com/aotter/mantle/tree/v0.2.0-alpha.10 --skill mantle
+npx skills add https://github.com/aotter/mantle/tree/v0.2.0-alpha.11 --skill mantle
 ```
 
 The explicit skill name excludes repository maintainer skills. The manifests