@aotter/mantle 0.2.0-alpha.5 → 0.2.0-alpha.7

package/dist/usecase/adminDescriptors.js

@@ -0,0 +1,153 @@
+/** Build-time projections only; generated exports are static, independently tree-shakable data. */
+import { DiagnosticError, BUILT_IN_NAV_GROUPS, navGroupProblems, formSchemaProblem, mcpTools, mcpToolNameSegment, collectionOf, developerConsole, rowPreconditions, checkPlanUiExtensions, planUiExtensionRefs, appCatalog, entrySchema } from "../build/compiler.js";
+import { q } from "../domain/entry.js";
+import { emitValidation } from "./validation.js";
+import { publishingInput, publishingTransitions } from "./publishing.js";
+const adminEnum = (p) => { if (!p.oneOf)
+    return p; const { oneOf, ...rest } = p; return { ...rest, enum: oneOf.map(c => c.const) }; };
+export function emitAdminDescriptors({ plan, adminExtensions = [], navGroups = [], admin = false }, diagnostics) {
+    // Sidebar placement: every nav.group names a built-in group or a declared navGroups id (presentation only).
+    for (const [path, message] of navGroupProblems(navGroups))
+        diagnostics.push({ code: "SCHEMA_UI_INVALID", path, message });
+    const groupIds = new Set([...Object.keys(BUILT_IN_NAV_GROUPS), ...(Array.isArray(navGroups) ? navGroups.map(g => g.id) : [])]);
+    const placed = [...Object.values(plan.schemas).map(s => ["schemas/" + s.name, s.uiSchema]), ...Object.entries(plan.views).map(([name, v]) => ["views/" + name, v.uiSchema])];
+    for (const [path, ui] of placed) {
+        const group = ui?.["nav"]?.group;
+        if (typeof group === "string" && !groupIds.has(group))
+            diagnostics.push({ code: "SCHEMA_UI_INVALID", path: path + "/uiSchema/nav/group", message: `Unknown nav group '${group}': use content, operations, reports or more, or declare it in navGroups of the --admin-extensions module.` });
+    }
+    for (const e of adminExtensions)
+        for (const p of e.contributes.pages ?? []) {
+            const group = p.nav?.group;
+            if (group !== undefined && group !== "settings" && !groupIds.has(group))
+                diagnostics.push({ code: "UI_EXTENSION_INVALID", path: `admin/extensions/${e.id}/pages/${p.id}/nav/group`, message: `Unknown nav group '${group}'.` });
+        }
+    try {
+        checkPlanUiExtensions(plan, adminExtensions);
+    }
+    catch (error) {
+        if (!(error instanceof DiagnosticError))
+            throw error;
+        const { code, path, message } = error.diagnostic;
+        diagnostics.push({ code, path, message });
+        return {};
+    }
+    if (diagnostics.length)
+        return {};
+    const schemas = Object.values(plan.schemas);
+    const allCollections = Object.fromEntries(schemas.map(s => [s.name, { ...collectionOf(s, schemas), ...(admin ? { scopeField: s.scope ? s.names[s.scope] ?? s.scope : null, exportFields: Object.keys(s.fields).filter(f => f !== s.scope && s.fields[f] !== "geo").map(f => s.names[f] ?? f) } : {}) }]));
+    const viewNames = Object.create(null);
+    const views = Object.entries(plan.views).filter(([, v]) => v.surface === "admin").map(([name, v]) => {
+        const columns = Object.fromEntries(Object.entries(v.columns ?? {}).map(([key, column]) => {
+            const schema = plan.schemas[column.schema], field = schema.names[column.field] ?? column.field;
+            const output = key === column.field ? field : key;
+            (viewNames[name] ??= Object.create(null))[key] = output;
+            return [output, { schema: schema.name, field }];
+        }));
+        const list = (v.uiSchema?.list ?? {});
+        return { name, title: v.title ?? null, description: v.description ?? null, input: v.input ?? null, list: { columns: list.columns ?? [], searchFields: list.searchFields ?? [], filterFields: list.filterFields ?? [], cells: list.cells ?? {} }, columns, ...(v.uiSchema?.nav ? { nav: v.uiSchema.nav } : {}) };
+    });
+    const adminTools = mcpTools(plan, "admin"), toolNames = new Set(adminTools.map(t => t.name));
+    const operations = adminTools.filter(t => t.kind === "procedure").map(t => {
+        const p = plan.procedures[t.source];
+        const preconditions = p.target && "sql" in p.handler ? rowPreconditions(p.handler.sql.stmts, p.target.schema, p.target.id, plan.schemas[p.target.schema.toLowerCase()]?.schema ?? {}) : [];
+        return { ...(preconditions.length ? { preconditions } : {}), name: t.source, title: p.title ?? null, description: p.description ?? null, input: p.input, uiSchema: p.uiSchema ?? null, interactions: p.target ? [{ collection: p.target.schema, bind: [{ input: p.target.id, field: "id" }], ...(p.target.version ? { version: p.target.version } : {}), mutates: true }] : [] };
+    });
+    const authorizations = { views: Object.fromEntries(views.map(v => [v.name, plan.views[v.name].requires ?? null])), procedures: Object.fromEntries(Object.entries(plan.procedures).map(([name, p]) => [name, p.requires ?? null])) };
+    const adminCatalogue = appCatalog(plan, "admin");
+    const catalogues = { public: appCatalog(plan, "public"), admin: { views: Object.fromEntries(Object.entries(adminCatalogue.views).map(([name, v]) => [name, { ...v, actions: [...v.actions] }])), actions: { ...adminCatalogue.actions } } };
+    const snapshot = developerConsole(plan);
+    const webmcp = { tools: adminTools.map(({ name, source, kind, title, description, inputSchema, outputSchema, annotations }) => ({ name, target: { kind, name: source }, ...(title ? { title: (kind === "view" ? plan.views[source] : plan.procedures[source]).title ?? title } : {}), description: (kind === "view" ? plan.views[source] : plan.procedures[source]).description ?? description, inputSchema, ...(outputSchema ? { outputSchema } : {}), ...(annotations ? { annotations } : {}) })), routes: Object.fromEntries(adminTools.flatMap(t => {
+            if (t.kind === "view")
+                return [[t.name, { path: "/admin/views/" + encodeURIComponent(t.source) }]];
+            const target = plan.procedures[t.source].target;
+            return target ? [[t.name, { path: "/admin/c/" + encodeURIComponent(plan.schemas[target.schema.toLowerCase()]?.name ?? target.schema), entry: true }]] : [];
+        })) };
+    // These are the actual generated transitions, not authored ref handlers or SQL IR.
+    for (const schema of schemas.filter(s => s.publishing))
+        for (const [verb] of publishingTransitions) {
+            const name = schema.name + "." + verb, tool = mcpToolNameSegment(verb + "_" + schema.name);
+            if (toolNames.has(tool)) {
+                diagnostics.push({ code: "GENERATE_UNSUPPORTED", path: "schemas/" + schema.name, message: "Generated publishing tool '" + tool + "' conflicts with an admin tool." });
+                continue;
+            }
+            toolNames.add(tool);
+            const action = { capability: tool, inputSchema: publishingInput, bind: [{ input: "id", field: "id" }], version: "expectedVersion", mutates: true };
+            catalogues.admin.actions[tool] = action;
+            for (const t of adminTools.filter(t => t.kind === "view"))
+                if (entrySchema(plan, plan.views[t.source]) === schema.name.toLowerCase())
+                    catalogues.admin.views[t.name].actions.push(tool);
+            authorizations.procedures[name] = { auth: { all: ["ctx.admin"] } };
+            const description = verb + " an entry in " + schema.name + ".";
+            webmcp.tools.push({ name: tool, target: { kind: "procedure", name }, description, inputSchema: publishingInput, annotations: { readOnlyHint: false, destructiveHint: verb === "archive" } });
+            webmcp.routes[tool] = { path: "/admin/c/" + encodeURIComponent(schema.name), entry: true };
+            snapshot.interfaces.callable.push({ kind: "procedure", name: tool, target: name, surface: "admin", audience: "admin", title: null, description, input: publishingInput, output: null, trigger: null });
+        }
+    const extensionIds = new Set();
+    const extensionMetadata = adminExtensions.map(extension => {
+        if (!/^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/.test(extension.id) || extensionIds.has(extension.id) || extension.apiVersion !== undefined && extension.apiVersion !== 1)
+            diagnostics.push({ code: "UI_EXTENSION_INVALID", path: "admin/extensions/" + extension.id, message: "Extensions need unique kebab-case ids and apiVersion 1." });
+        extensionIds.add(extension.id);
+        const { source, handlers: _handlers, bodyLimit: _bodyLimit, ...declaration } = extension;
+        if (source !== undefined)
+            diagnostics.push({ code: "GENERATE_UNSUPPORTED", path: "admin/extensions/" + extension.id, message: "Native Admin uses host-served module paths; source modules are not served. Set module and install its integrity in the host shell import map." });
+        if (extension.module && (!extension.module.startsWith("/") || extension.module.startsWith("//") || /[\\?#]/.test(extension.module)))
+            diagnostics.push({ code: "UI_EXTENSION_INVALID", path: "admin/extensions/" + extension.id, message: "module must be a same-origin absolute path." });
+        return { id: extension.id, declaration: JSON.stringify(declaration), public: declaration, ...(extension.module ? { module: extension.module } : {}), ...(extension.integrity ? { integrity: extension.integrity } : {}), source: false, settings: (extension.contributes.settings ?? []).map(s => s.id), actions: (extension.contributes.actions ?? []).map(a => ({ id: a.id, target: a.target, ...(a.when?.schema ? { schema: a.when.schema } : {}) })) };
+    });
+    const checks = [], validationFiles = {};
+    for (const extension of adminExtensions)
+        for (const settings of extension.contributes.settings ?? []) {
+            const key = extension.id + "/" + settings.id, problem = formSchemaProblem(settings.schema);
+            if (problem) {
+                diagnostics.push({ code: "UI_EXTENSION_INVALID", path: "admin/extensions/" + key, message: problem });
+                continue;
+            }
+            const input = { ...settings.schema, additionalProperties: false, properties: Object.fromEntries(Object.entries(settings.schema.properties ?? {}).map(([name, p]) => [name, adminEnum(p)])) };
+            const file = extension.id + "__" + settings.id; // ponytail: no "/" so Node ESM can import the emitted module
+            const generated = emitValidation({ views: {}, procedures: { [file]: { input } } }, (path, message) => diagnostics.push({ code: "GENERATE_UNSUPPORTED", path, message }));
+            Object.assign(validationFiles, generated);
+            const alias = "check" + checks.length;
+            checks.push(`import {validate as ${alias}} from "./validation/procedures/${encodeURIComponent(file)}.js";`);
+        }
+    const settingsKeys = adminExtensions.flatMap(e => (e.contributes.settings ?? []).map(s => e.id + "/" + s.id));
+    const bindings = "import {extensionOptions} from '@aotter/mantle-admin/server/extensions';\nimport type {AdminExtension} from '@aotter/mantle-admin/server/extensions';\nimport {extensionMetadata} from './admin-descriptors.js';\nimport {ContractError} from '@aotter/mantle/contracts';\n" + checks.join("\n") + "\nconst checks={" + settingsKeys.map((key, n) => `${q(key)}:(value:unknown)=>{try{check${n}(value);return {};}catch(error){if(!(error instanceof ContractError))throw error;return {[(error.path.split('/input/')[1]??'').replace(/~1/g,'/').replace(/~0/g,'~')]:error.message};}}`).join(",") + "};\nexport const extensionBindings=<Env,DB>(definitions:readonly AdminExtension<Env,DB>[])=>extensionOptions<Env,DB>(extensionMetadata,checks,definitions);\n";
+    const data = { allCollections, views, operations, navGroups, fieldNames: Object.fromEntries(schemas.map(s => [s.name, s.names])), viewNames, authorizations, developerConsole: snapshot, mcpAppCatalogues: catalogues, webmcp, extensionBindings: planUiExtensionRefs(plan), extensionMetadata };
+    return { ...validationFiles, ...(adminExtensions.length && admin ? { "admin-extensions.ts": bindings } : {}), "admin-descriptors.ts": "// Generated static Admin metadata. Import only the exports the application uses.\n" + literals(data) + "\nexport const collections = [" + schemas.filter(s => !s.translates).map(s => "allCollections[" + q(s.name) + "]").join(",") + "] as const;\nexport const bootstrap = {collections, allCollections, operations, views, navGroups, webmcp, developerConsole} as const;\n" };
+}
+/**
+ * Each export as a JSON literal; a subtree of 40 or more bytes that would be printed more than once is printed once, as a
+ * module-private constant the exports reference (a bundler keeps only those an imported export reaches).
+ */
+function literals(exports) {
+    const data = JSON.parse(q(exports)), count = new Map(), hoisted = new Map(), constants = [];
+    const each = (value, visit) => { if (value && typeof value === "object")
+        for (const child of Object.values(value))
+            if (child && typeof child === "object")
+                visit(q(child), child); };
+    const tally = (json, value, by = 1) => { if (json.length >= 40)
+        count.set(json, (count.get(json) ?? 0) + by); each(value, (json, child) => tally(json, child, by)); };
+    for (const value of Object.values(data))
+        each(value, tally);
+    // Longest first: once a subtree is printed once, what it contains occurs (copies - 1) times fewer per occurrence in it.
+    for (const json of [...count.keys()].sort((a, b) => b.length - a.length)) {
+        const copies = count.get(json);
+        if (copies > 1) {
+            hoisted.set(json, "");
+            each(JSON.parse(json), (inner, child) => tally(inner, child, 1 - copies));
+        }
+    }
+    let named = 0;
+    const print = (value) => !value || typeof value !== "object" ? q(value) : Array.isArray(value) ? "[" + value.map(reference).join(",") + "]" : "{" + Object.entries(value).map(([key, child]) => (key === "__proto__" ? "[" + q(key) + "]" : q(key)) + ":" + reference(child)).join(",") + "}";
+    const reference = (value) => {
+        const json = q(value);
+        if (hoisted.get(json) === "") {
+            const name = "$" + named++;
+            hoisted.set(json, name);
+            constants.push("const " + name + " = " + print(value) + " as const;");
+        }
+        return hoisted.get(json) ?? print(value);
+    };
+    const lines = Object.entries(data).map(([name, value]) => "export const " + name + " = " + print(value) + " as const;");
+    return [...constants, ...lines].join("\n");
+}

package/dist/usecase/generate.js

@@ -0,0 +1,164 @@
+import { userReferences } from "../domain/userReferences.js";
+/** Canonical lowered programs become ordinary target-specific TypeScript, never a runtime plan. */
+import { parseNumeric } from "../build/compiler.js";
+import { boundaryType, nativeType, outputType, wireType } from "../domain/columns.js";
+import { databaseImport, driverFor, entry, exportName, generatedFiles, isSqlite as sqlite, q } from "../domain/entry.js";
+import { authLines as auth } from "../domain/input.js";
+import { recipesOf } from "../domain/recipes.js";
+import { emitTtl } from "./ttl.js";
+import { emitPublishing } from "./publishing.js";
+import { emitStores } from "./stores.js";
+import { emitPaging } from "./paging.js";
+import { emitWeb } from "./web.js";
+import { emitMcp } from "./mcp.js";
+import { emitValidation } from "./validation.js";
+import { refuseDeclarations } from "./refusals.js";
+import { emitHandlers } from "./handlers.js";
+import { emitAdminDescriptors } from "./adminDescriptors.js";
+import { emitSite } from "./site.js";
+import { emitTranslations } from "./translations.js";
+import { emitAdminBindings } from "./adminBindings.js";
+import { emitRest } from "./rest.js";
+const typeOf = (s) => {
+    if (!s)
+        return "unknown";
+    if (s.nullable === true)
+        return `${typeOf({ ...s, nullable: false })} | null`;
+    if (s.enum)
+        return s.enum.map(v => q(v)).join(" | ") || "never";
+    if (s.const !== undefined)
+        return q(s.const);
+    if (Array.isArray(s.type))
+        return s.type.map(type => typeOf({ ...s, type })).join(" | ") || "never";
+    switch (s.type) {
+        case "string": return "string";
+        case "integer":
+        case "number": return "number";
+        case "boolean": return "boolean";
+        case "null": return "null";
+        case "array": return `ReadonlyArray<${Array.isArray(s.items) ? "unknown" : typeOf(s.items)}>`;
+        case "object": return `{ ${Object.entries(s.properties ?? {}).map(([key, child]) => `readonly ${q(key)}${s.required?.includes(key) ? "" : "?"}: ${typeOf(child)};`).join(" ")} ${s.additionalProperties !== false ? "readonly [key: string]: unknown;" : ""} }`;
+        default: return "unknown";
+    }
+};
+export function generate(input) {
+    const { target, plan, lowered, viewKeys, newId, adminExtensions, site, admin, paging } = input;
+    const diagnostics = [];
+    refuseDeclarations({ plan }, diagnostics);
+    const refuse = (path, message) => { diagnostics.push({ code: "GENERATE_UNSUPPORTED", path, message }); };
+    const isSqlite = sqlite(target);
+    const user = userReferences(plan, isSqlite);
+    const expected = isSqlite ? "@aotter/mantle/d1" : "@aotter/mantle/postgres";
+    if (lowered.dialect.name !== expected || plan.dialect.name !== expected)
+        refuse("target", `Target '${target}' needs canonical '${expected}' compilation and lowering.`);
+    const driver = driverFor(target);
+    const queryInputType = (schema, statements) => {
+        if (!schema?.properties)
+            return typeOf(schema);
+        const binds = statements.flatMap(s => s.binds).filter(b => b.k === "input");
+        const properties = Object.entries(schema.properties).map(([name, field]) => {
+            const bind = binds.find(b => b.k === "input" && name.toLowerCase() === String(b.name).toLowerCase());
+            if (!bind || bind.k !== "input")
+                return `readonly ${q(name)}${schema.required?.includes(name) ? "" : "?"}: ${typeOf(field)};`;
+            const type = String(bind.type);
+            const driverType = type === "json" || type === "date" ? "string" : type === "timestamptz" ? "string | Date" : isSqlite
+                ? type === "bool" || parseNumeric(type) ? "number" : typeOf(field)
+                : parseNumeric(type) ? "number | string" : typeOf(field);
+            const nullable = field.nullable === true || Array.isArray(field.type) && field.type.includes("null") || !schema.required?.includes(name);
+            // D1 cannot bind undefined. Bound fields are explicit, null represents absence.
+            return `readonly ${q(name)}: ${driverType}${nullable ? " | null" : ""};`;
+        });
+        return `{ ${properties.join(" ")} ${schema.additionalProperties !== false ? "readonly [key:string]: unknown;" : ""} }`;
+    };
+    const inputFields = (schema, path) => {
+        const fields = Object.keys(schema?.properties ?? {});
+        if (new Set(fields.map(field => field.toLowerCase())).size !== fields.length)
+            refuse(path, "Input properties must have unique case-insensitive names. Rename input properties to be unique without regard to case.");
+        return fields;
+    };
+    // The dialect functions the bind recipes call, so a bundle carries only those (`binds` takes this object).
+    const values = new Set();
+    /** A statement as a constant: its text and how to bind it. */
+    const step = (s, path, fields, row = false) => {
+        const recipes = recipesOf(s, fields, message => refuse(path, message));
+        for (const r of recipes) {
+            if (r.k === "now" || r.k === "cutoff")
+                values.add(r.k);
+            else if (r.k === "input" && r.type)
+                values.add(r.type === "date" ? "date" : "timestamp");
+        }
+        return `{ sql: ${q(s.sql)}, binds: ${q(recipes)}${row ? ", row: true" : ""} }`;
+    };
+    const declarations = [], views = [], procedures = [], refProcedures = [];
+    const entries = {};
+    const base = "@aotter/mantle/";
+    const refNames = emitHandlers(plan, target !== "cloudflare-d1", typeOf, declarations, refProcedures);
+    const hasHandlers = refNames.length > 0;
+    for (const [index, [name, view]] of Object.entries(plan.views).sort().entries()) {
+        const path = `views/${name}`, fn = `view${index}`;
+        const modes = lowered.views[name];
+        const mode = view.surface === "public" ? "public" : "caller";
+        const c = modes?.[mode], trusted = modes?.trusted;
+        if (!c || (mode === "caller" && !trusted)) {
+            refuse(path, "Every reachable visibility mode must have canonical lowered SQL.");
+            continue;
+        }
+        const keys = Object.hasOwn(viewKeys, name) ? viewKeys[name] : undefined;
+        if (!keys || new Set(keys).size !== keys.length) {
+            refuse(path, "Dynamic or repeated View outputs need an explicit generated row contract. Give each SELECT output a unique explicit alias.");
+            continue;
+        }
+        const output = [];
+        for (const key of keys) {
+            const type = outputType(plan, name, key);
+            // Declared timestamps and dates arrive formatted by the SQL itself (domain/wireScalars).
+            output.push(`readonly ${q(key)}: ${nativeType(type, isSqlite)};`);
+        }
+        const fieldNames = inputFields(view.input, path + "/input");
+        const callerStep = step(c, path, fieldNames), trustedStep = mode === "caller" ? step(trusted, path, fieldNames) : callerStep;
+        declarations.push(`export type View${index}Input = ${queryInputType(view.input ?? { type: "object", additionalProperties: false }, [c, ...(trusted ? [trusted] : [])])};`, `export type View${index}Row = { ${output.join(" ")} };`, `export type View${index}WireRow = { ${keys.map(key => `readonly ${q(key)}: ${boundaryType(plan, name, key) ? wireType(boundaryType(plan, name, key)) : `View${index}Row[${q(key)}]`};`).join(" ")} };`, `const ${fn}Caller = ${callerStep} as const;`, ...(trustedStep !== callerStep ? [`const ${fn}Trusted = ${trustedStep} as const;`] : []), `async function ${fn}(db: Database, caller: Caller, raw: View${index}Input): Promise<View${index}Row[]> {`, ...auth(view.requires, path), ...(user.used ? ['  USER.modeOf(caller);'] : []), `  const m = ${trustedStep !== callerStep ? `${user.used ? 'USER.modeOf(caller) === "trusted"' : 'caller.kind === "system"'} ? ${fn}Trusted : ` : ""}${fn}Caller;`, `  return DRIVER.read(db, ${user.used ? "USER.scoped(m.sql, caller)" : "m.sql"}, binds(D, m.binds, caller, raw));`, "}");
+        views.push(`[${q(name)}]: ${fn}`);
+        declarations.push(`export { ${fn} as ${exportName("view", name)} };`);
+        entries[`views/${encodeURIComponent(name)}.ts`] = entry("view", name, `View${index}Input as Input, View${index}Row as Row, View${index}WireRow as WireRow`);
+    }
+    for (const [index, [name, procedure]] of Object.entries(plan.procedures).sort().entries()) {
+        const path = `procedures/${name}`, fn = `procedure${index}`;
+        if (!("sql" in procedure.handler))
+            continue;
+        const modes = lowered.procedures[name];
+        if (!modes?.caller || !modes.trusted) {
+            refuse(path, "Both caller and trusted SQL must be lowered.");
+            continue;
+        }
+        if ([...modes.caller, ...modes.trusted].some(s => s.publish || s.schema && plan.schemas[s.schema]?.publishing))
+            refuse(path, "Publishing writes are generated: use the Store and the `<schema>.publish` / `.unpublish` / `.archive` transitions.");
+        const fieldNames = inputFields(procedure.input, path + "/input");
+        const steps = (statements) => `[${statements.map(s => step(s, path, fieldNames, s.kind === "row")).join(", ")}] as const`;
+        const same = steps(modes.caller) === steps(modes.trusted);
+        declarations.push(`export type Procedure${index}Input = ${queryInputType(procedure.input, [...modes.caller, ...modes.trusted])};`, `const ${fn}Caller = ${steps(modes.caller)};`, ...(same ? [] : [`const ${fn}Trusted = ${steps(modes.trusted)};`]), `async function ${fn}(db: Database, caller: Caller, raw: Procedure${index}Input): Promise<Output> {`, ...(modes.caller.some(s => s.kind !== "read") ? [`  if ("authenticatedAs" in caller && caller.authenticatedAs === "snapshot") (await import("@aotter/mantle/host-caller")).checkFresh(caller, false, ${q(path)});`] : []), ...auth(procedure.requires, path), ...(user.used ? ['  USER.modeOf(caller);'] : []), ...(procedure.trustedOnly ? [`  deny(caller, USER.modeOf(caller) === "trusted", ${q(path)});`] : []), `  return { results: await DRIVER.procedure(db, bound(D, ${user.used ? "USER.scopedAll(" : ""}${same ? "" : `${user.used ? 'USER.modeOf(caller) === "trusted"' : 'caller.kind === "system"'} ? ${fn}Trusted : `}${fn}Caller${user.used ? ", caller)" : ""}, caller, raw), ${q(path)}) };`, "}");
+        procedures.push(`[${q(name)}]: ${fn}`);
+        declarations.push(`export { ${fn} as ${exportName("procedure", name)} };`);
+        entries[`procedures/${encodeURIComponent(name)}.ts`] = entry("procedure", name, `Procedure${index}Input as Input`, `export type { Output } from "${base}contracts";\n`);
+    }
+    emitTtl(plan, isSqlite, declarations, procedures, entries, refuse);
+    emitPublishing(plan, isSqlite, declarations, procedures, entries, values, refuse);
+    const stores = emitStores(plan.schemas, isSqlite, newId, refuse, hasHandlers);
+    const surfaces = { ...emitPaging(plan, lowered, target, refuse, paging), ...emitPaging(plan, input.wireLowered ?? lowered, target, refuse, paging, true), ...emitValidation(plan, refuse), ...emitRest(plan, lowered, target, input.description), ...emitWeb(plan, lowered, target), ...emitMcp(plan, lowered, target, input.description, refuse, !!site), ...emitAdminDescriptors({ plan, adminExtensions, navGroups: input.navGroups, admin }, diagnostics), ...emitAdminBindings(input, refuse), ...emitSite(target, site, refuse, Object.keys(plan.schemas)), ...emitTranslations(plan, target) };
+    if (diagnostics.length)
+        return { ok: false, diagnostics };
+    const storeProcedures = hasHandlers ? "storeProcedures" : "procedures";
+    const code = [...(Object.keys(plan.access?.userFields ?? {}).length ? [`export const userFields = ${q(plan.access.userFields)} as const;`] : []), ...declarations, `export const views = { ${views.join(", ")} };`, `export const procedures = { ${procedures.join(", ")} };`, ...(stores ? [
+            `export type Tables = ${stores.tables};`, `const RULES = ${stores.rules} as const;`,
+            ...(hasHandlers ? [`const storeProcedures = { ${[...procedures, ...refProcedures].join(", ")} };`] : []),
+            `const initStore = () => createStore<Database, Tables, typeof DRIVER, { views: typeof views; procedures: typeof ${storeProcedures} }${hasHandlers ? ", { handlers: Handlers }" : ""}>(${user.used ? "{...DIALECT.dialect, ...USER_VALUES}" : "DIALECT.dialect"}, DRIVER, RULES, ${stores.facts}, { views, procedures: ${storeProcedures} });`,
+            `let makeStore: ReturnType<typeof initStore>;`,
+            `export function store${hasHandlers ? "<const H extends Handlers>" : ""}(db: Database, caller: Caller${hasHandlers ? ", options: { handlers: H & Record<Exclude<keyof H, keyof Handlers>, never> }" : ", _options?: { handlers?: Handlers }"}): ReturnType<typeof makeStore> { return (makeStore ??= initStore())(db, caller${hasHandlers ? ", options" : ""}); }`,
+        ] : [])].join("\n");
+    const dialect = `${base}dialect/${isSqlite ? "sqlite" : "postgres"}`;
+    const contracts = [...(target.endsWith("postgres") ? ["type Postgres as Database"] : []), "type Caller", ...(hasHandlers ? ["ContractError"] : []), ...(/^  deny\(/m.test(code) ? ["deny", ...(/\bisAdmin\(/.test(code) ? ["isAdmin"] : []), ...(/\bisUser\(/.test(code) ? ["isUser"] : [])] : []), ...(procedures.length ? ["type Output"] : [])];
+    const dbType = isSqlite ? databaseImport(target) : "";
+    return { ok: true, refProcedures: refNames, files: generatedFiles({ ...surfaces, ...entries, "generated.ts": ["// Generated native application SQL. No runtime plan or interpreter.", user.code, dbType, `import { ${contracts.join(", ")} } from "${base}contracts";`,
+                ...(values.size || stores ? [`import * as DIALECT from "${dialect}";`] : []), `import * as DRIVER from "${base}driver/${driver}";`, ...((names => names.length ? [`import { ${names.join(", ")} } from "${base}store";`] : [])([...(stores ? ["createStore"] : []), ...(hasHandlers && target !== "cloudflare-d1" ? ["handlerTransaction"] : [])])),
+                `import { ${procedures.length ? "binds, bound" : "binds"} } from "${base}binds";`,
+                `const D = { ${[...values].sort().map(v => `${v}: DIALECT.${v}`).concat(user.values ? [user.values] : []).join(", ")} };`, code].filter(Boolean).join("\n") + "\n" }) };
+}

package/dist/usecase/handlers.js

@@ -0,0 +1,21 @@
+import { authLines as auth } from "../domain/input.js";
+import { q } from "../domain/entry.js";
+export function emitHandlers(plan, interactive, typeOf, declarations, procedures) {
+    const refs = Object.entries(plan.procedures).sort().map(([name, procedure], index) => ({ name, procedure, index })).filter(({ procedure }) => "ref" in procedure.handler);
+    // An empty contract keeps app wiring (`handlers: Handlers = {}`) identical whether or not any ref Procedure exists.
+    if (!refs.length) {
+        declarations.push("export interface Handlers {}");
+        return [];
+    }
+    declarations.push('export type HandlerStore = Pick<ReturnType<typeof makeStore>, "collection" | "views" | "procedures">;', 
+    // D1 has no interactive transactions, so its handlers get no `transaction`: using one there fails typecheck.
+    `export interface HandlerContext { readonly caller: Caller; readonly db: Database; readonly store: HandlerStore;${interactive ? " readonly transaction: <R>(fn: (ctx: { readonly store: HandlerStore; readonly db: Database }) => Promise<R>) => Promise<R>;" : ""} }`, "export interface Handlers {", ...refs.map(({ name, index }) => `  readonly [${q(name)}]: (ctx: HandlerContext, input: Procedure${index}Input) => Promise<Procedure${index}Output>;`), "}");
+    for (const { name, procedure, index } of refs) {
+        const path = `procedures/${name}`, fn = `procedure${index}`;
+        declarations.push(`export type Procedure${index}Input = ${typeOf(procedure.input ?? { type: "object", additionalProperties: false })};`, `export type Procedure${index}Output = ${typeOf(procedure.output)};`, `async function ${fn}(db: Database, caller: Caller, raw: Procedure${index}Input, context: { handlers: Handlers; store: HandlerContext["store"] }): Promise<Procedure${index}Output> {`, `  if ("authenticatedAs" in caller && caller.authenticatedAs === "snapshot") (await import("@aotter/mantle/host-caller")).checkFresh(caller, false, ${q(path)});`, ...auth(procedure.requires, path), "  const handlers = context?.handlers;", `  const handler = handlers && Object.hasOwn(handlers, ${q(name)}) ? handlers[${q(name)}] : undefined;`, `  if (!handler) throw new ContractError("HANDLER_NOT_REGISTERED", "Procedure handler is not registered.", ${q(path)});`, 
+        // TODO #1470: REST/MCP use shared generated validators at the boundary; bare calls stay typed.
+        `  return handler({ caller, db, store: context.store${interactive ? ", transaction: handlerTransaction(context.store, db)" : ""} }, raw);`, "}");
+        procedures.push(`[${q(name)}]: ${fn}`);
+    }
+    return refs.map(({ name }) => name);
+}

package/dist/usecase/mcp-media.js

@@ -0,0 +1,17 @@
+import { emitValidation } from "./validation.js";
+import { mediaDefinitions } from "../domain/generated-tools.js";
+export { mediaDefinitions };
+export function emitMcpMedia(refuse) {
+    const definitions = mediaDefinitions();
+    const inputs = Object.fromEntries(definitions.map(tool => [tool.name, { input: tool.inputSchema }]));
+    const checks = Object.fromEntries(Object.entries(emitValidation({ views: {}, procedures: inputs }, refuse)).map(([path, code]) => [path.replace("validation/procedures/", "validation/media/"), code]));
+    const invoke = { policy: 'async (db,caller) => ({purposes:(await site(db,caller).read()).media.purposes})', create: '(db,caller,input:Record<string,unknown>) => site(db,caller).media(storage()).createUpload(input)', commit: '(db,caller,input:Record<string,unknown>) => site(db,caller).media(storage()).commitUpload(input.uploadGroupId as string,input)', list: '(db,caller,input:Record<string,unknown>) => site(db,caller).media(storage()).list(input)', get: '(db,caller,input:Record<string,unknown>) => site(db,caller).media(storage()).get(input.id as string)', update: '(db,caller,input:Record<string,unknown>) => site(db,caller).media(storage()).update(input.id as string,input)', delete: '(db,caller,input:Record<string,unknown>) => site(db,caller).media(storage()).delete(input.id as string)' };
+    return { ...checks, "mcp-media.ts": `import { site } from "./site.js";
+import type { MediaStorage } from "@aotter/mantle/site";
+import type { Tool } from "@aotter/mantle/mcp";
+${definitions.map((tool, i) => `import { validate as v${i} } from "./validation/media/${tool.name}.js";`).join("\n")}
+export function mediaTools<Handlers = never>(storage: () => MediaStorage): Tool<Parameters<typeof site>[0], Handlers>[] { return [
+${definitions.map(({ action, ...tool }, i) => `{...${JSON.stringify({ ...tool, ...(tool.annotations.readOnlyHint ? { readOnly: true } : {}) })},surface:"admin",closed:true,validate:v${i},run:${invoke[action]}}`).join(",\n")}
+]; }
+` };
+}

package/dist/usecase/mcp.js

@@ -0,0 +1,96 @@
+/** Emit the selected MCP boundary; the official transport loads on its first request. */
+import { mcpToolNameSegment } from "../build/compiler.js";
+import { emitMcpMedia, mediaDefinitions } from "./mcp-media.js";
+import { emitValidation } from "./validation.js";
+import { databaseImport, q } from "../domain/entry.js";
+import { authLines, conversions } from "../domain/input.js";
+import { publishingInput } from "./publishing.js";
+import { boundaryPage, outputConversions } from "../domain/columns.js";
+export function emitMcp(plan, lowered, target, description, refuse, media = false) {
+    if (!Object.values(plan.views).some(view => view.surface !== "internal") && !Object.values(plan.triggers).some(trigger => trigger.source.kind === "mcp"))
+        return {};
+    const reads = [];
+    const imports = plan.access ? ['import { userBinds } from "@aotter/mantle/user-fields";'] : [], tools = [];
+    const files = media ? emitMcpMedia(refuse) : {};
+    let hasRef = false, hasWire = false;
+    const names = new Set(media ? mediaDefinitions().map(tool => "admin:" + tool.name) : []);
+    const guard = (requires, path, binds = [], trustedOnly = false) => {
+        const lines = authLines(requires, path, binds, !target.endsWith("postgres"), trustedOnly);
+        return lines.length ? `, check: (caller) => {${lines.join("")}}` : "";
+    };
+    const refs = Object.values(plan.procedures).some(p => "ref" in p.handler);
+    if (Object.values(plan.procedures).some(p => p.trustedOnly) || [...Object.values(plan.views), ...Object.values(plan.procedures)].some(p => p.requires?.auth?.all.length) || Object.values(plan.schemas).some(s => s.publishing))
+        imports.push('import { deny, isAdmin, isUser } from "@aotter/mantle/contracts";');
+    const add = (name, kind, surface, operation = kind === "views" ? plan.views[name] : plan.procedures[name], tool = mcpToolNameSegment(name)) => {
+        if (kind === "views")
+            reads.push({ name: tool, surface });
+        const ref = kind === "procedures" && !!plan.procedures[name] && "ref" in plan.procedures[name].handler;
+        hasRef ||= ref;
+        const statements = kind === "views" ? [lowered.views[name]?.public ?? lowered.views[name]?.caller] : lowered.procedures[name]?.caller ?? [];
+        const binds = statements.flatMap(statement => statement?.binds ?? []);
+        const index = tools.length, file = encodeURIComponent(name);
+        if (kind === "views")
+            imports.push(`import { validate as validate${index} } from "./validation/${kind}/${file}.js";`);
+        if (kind === "views") {
+            const module = `./${outputConversions(plan, name, target).some(([, type]) => type === "int") ? "paged/wire/views" : "paged/views"}/${file}.js`;
+            imports.push(`const run${index}: typeof import(${q(module)}).default = async (...args) => (await import(${q(module)})).default(...args);`);
+        }
+        // The kernel adds a View tool's `limit` and `cursor` paging properties.
+        const schema = q(kind === "views" ? operation.input ?? { type: "object", additionalProperties: false } : operation.input);
+        if (kind === "views" && ("limit" in (operation.input?.properties ?? {}) || "cursor" in (operation.input?.properties ?? {})))
+            refuse(`views/${name}`, "MCP View input reserves limit and cursor for paging.");
+        if (names.has(surface + ":" + tool))
+            refuse(`${kind}/${name}`, `MCP tool name ${tool} collides on ${surface}.`);
+        names.add(surface + ":" + tool);
+        const convert = conversions(operation.input?.properties, binds, target), scopes = (operation.requires?.auth?.all ?? []).flatMap(p => typeof p === "object" && "ctx.auth.scope" in p ? [p["ctx.auth.scope"]] : []);
+        const procedure = kind === "procedures" ? plan.procedures[name] : undefined;
+        const output = kind === "procedures" ? ref ? (procedure?.output.type === "object" ? procedure.output : undefined) : { type: "object", properties: { results: { type: "array", items: { type: "array", items: { type: "object" } } } }, required: ["results"] } : undefined;
+        const annotations = kind === "views" ? { readOnlyHint: true } : procedure?.mcp;
+        const wire = kind === "views" ? outputConversions(plan, name, target) : [];
+        hasWire ||= wire.length > 0;
+        const fields = [...(description.targets.find(t => t._meta.id === `${kind === "views" ? "view" : "procedure"}:${name}`)?._meta.readOnly ? ["readOnly: true"] : []), `target: ${q({ kind: kind === "views" ? "view" : "procedure", name })}${guard(operation.requires, `${kind}/${name}`, binds, procedure?.trustedOnly)}`, `name: ${q(tool)}`, `surface: ${q(surface)}`, ...(operation.title ? [`title: ${q(operation.title)}`] : []), `description: ${q(operation.description ?? operation.title ?? name)}`, "inputSchema", ...(output ? [`outputSchema: ${q(output)}`] : []), ...(annotations ? [`annotations: ${q(annotations)}`] : []), ...((operation.requires?.auth?.all.length ?? 0) > 0 ? ["closed: true"] : []), ...(scopes.length ? [`scopes: ${q(scopes)}`] : []), `validate: ${kind === "views" ? `validate${index}` : `async (raw) => (await import("./validation/procedures/${file}.js")).validate(raw)`}`, ...(convert ? [`convert: ${convert}`] : []),
+            ...(kind === "views" ? [`path: ${q(`views/${name}`)}`, `page: ${boundaryPage(`run${index}`, wire)}`] : [`run: ${ref ? `(db, caller, input, handlers) => store(db, caller, { handlers }).procedures[${q(name)}](input)` : `async (db, caller, input) => (await import("./procedures/${file}.js")).default(db, caller, input)`}`])];
+        tools.push({ fields, schema });
+    };
+    for (const [name, view] of Object.entries(plan.views))
+        if (view.surface !== "internal")
+            add(name, "views", view.surface);
+    const exposed = new Set();
+    for (const trigger of Object.values(plan.triggers))
+        if (trigger.source.kind === "mcp") {
+            const key = trigger.source.surface + ":" + trigger.procedure;
+            if (!exposed.has(key)) {
+                exposed.add(key);
+                add(trigger.procedure, "procedures", trigger.source.surface);
+            }
+        }
+    for (const schema of Object.values(plan.schemas))
+        if (schema.publishing)
+            for (const verb of ["publish", "unpublish", "archive"]) {
+                const name = `${schema.name}.${verb}`, input = publishingInput;
+                Object.assign(files, emitValidation({ views: {}, procedures: { [name]: { input } } }, refuse));
+                add(name, "procedures", "admin", { input, requires: { auth: { all: ["ctx.admin"] } } }, mcpToolNameSegment(`${verb}_${schema.name}`));
+            }
+    if (hasWire)
+        imports.push('import { wireRows } from "@aotter/mantle/contracts";');
+    // An input schema several tools share is one constant.
+    const uses = new Map(), shared = new Map();
+    for (const { schema } of tools)
+        uses.set(schema, (uses.get(schema) ?? 0) + 1);
+    for (const [schema, count] of uses)
+        if (count > 1 && schema)
+            shared.set(schema, `schema${shared.size}`);
+    return { ...files, "mcp.ts": `${[`import { mcp as serve, type Options as McpOptions, type Tool } from "@aotter/mantle/mcp";`, databaseImport(target),
+            ...(media ? ['import type { MediaStorage } from "@aotter/mantle/site";'] : []),
+            'import type { Handlers } from "./generated.js";', ...(hasRef ? ['import { store } from "./generated.js";'] : []), ...imports,
+            ...[...shared].map(([schema, name]) => `const ${name} = ${schema};`)].join("\n")}
+export type Options<Env = unknown> = McpOptions<Env, Database> & { handlers${refs ? "" : "?"}: Handlers }${media ? " & { media?: (env: Env) => MediaStorage }" : ""};
+/** The generated tools, exported so an app can compose them with its own tools and MCP Apps. */
+export const tools: readonly Tool<Database, Handlers>[] = [
+${tools.map(({ fields, schema }) => `  { ${fields.map(field => field === "inputSchema" ? `inputSchema: ${shared.get(schema) ?? schema}` : field).join(", ")} },`).join("\n")}
+];
+export function mcp<Env = unknown>(options: Options<Env>): (request: Request, env: Env, ctx?: import("@aotter/mantle/contracts").RequestContext) => Promise<Response | undefined> {
+  return serve<Env, Database, Handlers>(${media ? `async (request, env) => [...tools, ...(options.media && new URL(request.url).pathname.replace(/\\/+$/, "") === "/mcp/admin" ? (await import("./mcp-media.js")).mediaTools<Handlers>(() => options.media!(env)) : [])]` : "tools"}, ${plan.access ? `{...options, fields: ${q(plan.access.userFields)}, accessTargets: () => import("./access-targets.js").then(m => m.targets)}` : '{...options, accessTargets: () => import("./access-targets.js").then(m => m.targets)}'}, ${media ? `[...${q(reads)}, ...(options.media ? ${q(mediaDefinitions().filter(tool => tool.annotations.readOnlyHint).map(tool => ({ name: tool.name, surface: "admin" })))} : [])]` : q(reads)});
+}
+` };
+}

package/dist/usecase/paging.js

@@ -0,0 +1,72 @@
+import { userReferences } from "../domain/userReferences.js";
+/** Selected View boundary: Core prints keyset SQL once; bare operations retain native rows. */
+import { parseNumeric } from "../build/compiler.js";
+import { outputConversions } from "../domain/columns.js";
+import { authLines } from "../domain/input.js";
+import { driverFor, databaseImport, isSqlite, q } from "../domain/entry.js";
+import { recipesOf } from "../domain/recipes.js";
+export function emitPaging(plan, lowered, target, refuse, proofs, boundary = false) {
+    const files = {}, base = "@aotter/mantle/";
+    const sqlite = isSqlite(target);
+    const user = userReferences(plan, sqlite);
+    const driver = driverFor(target);
+    for (const [name, view] of Object.entries(plan.views)) {
+        if (boundary && (view.surface === "internal" || !outputConversions(plan, name, target).some(([, type]) => type === "int")))
+            continue;
+        const path = `views/${name}`, sel = view.stmts[0]?.SelectStmt;
+        const proof = proofs?.[name];
+        if (boundary && (!proof || !proof.types.length && !proof.single))
+            continue;
+        // Internal bare queries remain available even when they cannot be safely paged.
+        if (!proof || !proof.types.length && !proof.single) {
+            if (view.surface !== "internal")
+                refuse(path, proof?.reason ?? "Paged Views need a complete typed NOT NULL key tuple, indexed Schema order and a non-fanning relation, or a proved singleton.");
+            continue;
+        }
+        const mode = view.surface === "public" ? "public" : "caller";
+        const c = lowered.views[name]?.[mode], trusted = mode === "caller" ? lowered.views[name]?.trusted : undefined;
+        if (!c)
+            continue;
+        const hidden = new Set(Array.from({ length: c.nkeys }, (_, i) => `_k${i}`));
+        if (Object.values(c.paged).some(p => p.names.some(name => hidden.has(sqlite ? name.toLowerCase() : name)))) {
+            if (view.surface !== "internal")
+                refuse(path, "Paged output names must not collide with the compiler's hidden cursor keys.");
+            continue;
+        }
+        const cap = sel.limitCount?.A_Const?.ival?.ival ?? 500;
+        if (sel.limitCount && (!sel.limitCount.A_Const?.ival || !Number.isInteger(cap) || cap < 1)) {
+            refuse(path, "A paged View LIMIT must be a positive integer literal.");
+            continue;
+        }
+        const values = new Set();
+        const kinds = proof.types.map(type => {
+            if (type === "date" || type === "timestamptz")
+                values.add(type === "date" ? "date" : "timestamp");
+            return type === "bool" ? "bool" : type === "int4" ? "int4" : ["integer", "int8"].includes(type) ? "int" : parseNumeric(type) ? "numeric" : ["real", "float8"].includes(type) ? "float" : type === "date" ? "date" : type === "timestamptz" ? "timestamp" : "text";
+        });
+        const variants = [c, ...(trusted ? [trusted] : [])].map(v => {
+            const pages = Object.values(v.paged);
+            const first = pages.find(p => !p.sources.some(s => "cursor" in s)), next = pages.find(p => p.sources.some(s => "cursor" in s));
+            if (!first || v.nkeys !== proof.types.length || v.nkeys > 0 && !next) {
+                refuse(path, "Core could not lower this View's keyset pages.");
+                return "";
+            }
+            const recipes = recipesOf(v, Object.keys(view.input?.properties ?? {}), message => refuse(path, message), values);
+            const page = (p) => `{ sql: ${q(p.sql)}, extra: ${q(p.sources.map(s => "cursor" in s ? s.cursor : -1))} }`;
+            return `{ binds: ${q(recipes)}, first: ${page(first)}, next: ${page(next ?? first)} }`;
+        });
+        const auth = authLines(view.requires, path);
+        const spec = [`path: ${q(path)}`, `cap: ${cap}`, `sqlite: ${sqlite}`, `cursor: ${q(kinds)}`, `keys: ${c.nkeys}`, `values: {${user.used ? [...values].sort().concat(user.values).join(", ") : values.size ? ` ${[...values].sort().join(", ")} ` : ""}}`, "read", `caller: ${variants[0]}`, ...(trusted ? [`trusted: ${variants[1]}`] : []), ...(auth.length ? [`auth: (caller: Caller) => {\n${auth.join("\n")}\n  }`] : [])];
+        files[`paged/${boundary ? "wire/" : ""}views/${encodeURIComponent(name)}.ts`] = `${user.code ? user.code + "\n" : ""}import { page, type Paged } from "${base}paging";
+import { ${auth.length ? "deny, isAdmin, isUser, " : ""}type Caller } from "${base}contracts";
+${databaseImport(target)}
+import { read } from "${base}driver/${driver}";
+${values.size ? `import { ${[...values].sort().join(", ")} } from "${base}dialect/${sqlite ? "sqlite" : "postgres"}";\n` : ""}import type { Input, Row } from "${boundary ? "../../../" : "../../"}views/${encodeURIComponent(name)}.js";
+const spec: Paged<Database> = {
+  ${spec.join(",\n  ")},
+};
+export default (db: Database, caller: Caller, input: Input, options?: { limit?: number; cursor?: string }) => page<Database, Row>(${user.used ? "{ ...spec, caller: USER.scopedAll(spec.caller, caller) }" : "spec"}, db, caller, input, options);
+`;
+    }
+    return files;
+}

package/dist/usecase/publishing.js

@@ -0,0 +1,63 @@
+/** Opt-in lifecycle: one atomic, version-guarded statement per transition, with Core's row rules. */
+import { rowPolicy } from "../build/compiler.js";
+import { dialect as sqlite } from "../kernel/dialect/sqlite.js";
+import { dialect as postgres } from "../kernel/dialect/postgres.js";
+import { renderTerm } from "../kernel/store.js";
+import { publishedParent } from "./translations.js";
+import { entry, exportName, q } from "../domain/entry.js";
+import { publishingInput, publishingTransitions } from "../domain/generated-tools.js";
+export { publishingInput, publishingTransitions };
+export function emitPublishing(plan, isSqlite, declarations, procedures, entries, values, refuse) {
+    const d = isSqlite ? sqlite : postgres;
+    const translations = Object.values(plan.schemas).some(s => s.translates);
+    if (translations)
+        declarations.push('import {translationWrite} from "@aotter/mantle/driver/transaction-context";');
+    if (Object.values(plan.schemas).some(s => s.publishing))
+        declarations.push('import { transition } from "@aotter/mantle/publishing";');
+    for (const s of Object.values(plan.schemas).filter(s => s.publishing).sort((a, b) => a.name.localeCompare(b.name))) {
+        if (Object.hasOwn(s.fields, "published_at")) {
+            refuse(`schemas/${s.name}`, "published_at is a publishing system column; remove the declared field.");
+            continue;
+        }
+        if (s.ttl)
+            values.add("cutoff");
+        for (const [verb, from, to] of publishingTransitions) {
+            const name = `${s.name}.${verb}`, fn = exportName("procedure", name), path = `procedures/${name}`;
+            const failure = `${verb}: row is missing or excluded, expectedVersion differs, status is not ${from.join(" or ")}${verb === "publish" ? `, or required data is missing${s.translates ? ", or no visible published parent shares the join key" : ""}` : ""}.`;
+            if (plan.procedures[name]) {
+                refuse(path, "This name is reserved for the generated publishing transition.");
+                continue;
+            }
+            const statement = (trusted) => {
+                const schema = plan.schemas[s.name];
+                const recipes = [{ k: "now" }, { k: "input", name: "id" }, { k: "input", name: "expectedVersion" }];
+                const conditions = [`id = ${d.param(2)}`, `version = ${d.param(3)}`, `status IN (${from.map(v => `'${v}'`).join(", ")})`];
+                // Same visibility as Store and Admin writes, translation parent included (a child under an out-of-set parent is missing);
+                // the status term is replaced by the transition's own `status IN (...)`.
+                for (const term of rowPolicy(schema, trusted ? "trusted" : "caller", plan.schemas))
+                    if (term[1] !== "admin")
+                        conditions.push(renderTerm(d, term, "", recipe => (recipes.push(recipe), d.param(recipes.length))));
+                if (verb === "publish")
+                    for (const field of s.schema.required ?? []) {
+                        const column = Object.keys(s.fields).find(c => (s.names?.[c] ?? c) === field);
+                        if (column)
+                            conditions.push(`${d.ident(column)} IS NOT NULL`);
+                    }
+                if (verb === "publish" && s.translates)
+                    conditions.push(publishedParent(plan, schema, d, recipes, trusted));
+                const clock = d.param(1);
+                return { sql: `UPDATE ${d.ident(s.name)} SET status = '${to}', published_at = ${verb === "publish" ? clock : "NULL"}, version = version + 1, updated_at = ${clock} WHERE ${conditions.join(" AND ")} RETURNING id, version, status, ${d.wireTimestamp(d.ident("published_at")).join("")} AS published_at`, binds: recipes, row: true };
+            };
+            values.add("now");
+            const caller = q([statement(false)]), trusted = q([statement(true)]);
+            declarations.push(`export type ${fn}Input = { readonly id: string; readonly expectedVersion: number };`, `const ${fn}Caller = ${caller} as const;`, ...(trusted === caller ? [] : [`const ${fn}Trusted = ${trusted} as const;`]), `async function ${fn}(db: Database, caller: Caller, raw: ${fn}Input): Promise<Output> { ${plan.access ? 'USER.modeOf(caller); ' : ''}return transition(db, caller, raw, ${q(path)}, ${plan.access ? "USER.scopedAll(" : ""}${trusted === caller ? "" : `${plan.access ? 'USER.modeOf(caller) === "trusted"' : 'caller.kind === "system"'} ? ${fn}Trusted : `}${fn}Caller${plan.access ? ", caller)" : ""}, ${q(failure)}, D, DRIVER.procedure${translations ? `, () => translationWrite(db, ${q(s.name)}, ${verb === "publish" && s.translates ? q(s.translates.parent) : "undefined"})` : ""}); }`, `export { ${fn} };`);
+            procedures.push(`[${q(name)}]: ${fn}`);
+            entries[`procedures/${encodeURIComponent(name)}.ts`] = entry("procedure", name, `${fn}Input as Input`, 'export type { Output } from "@aotter/mantle/contracts";\n');
+        }
+    }
+}
+/** Publishing lists get one index, prefixed by scope when present. */
+export function publishingSql(schemas, isSqlite) {
+    const d = isSqlite ? sqlite : postgres;
+    return Object.values(schemas).filter(s => s.publishing).map(s => `CREATE INDEX ${d.ident(`_mantle_ix_${s.name}_published`)} ON ${d.ident(s.name)} (${[...(s.scope ? [s.scope] : []), ...(s.userScopes ?? []).map(u => u.column), "published_at", "id"].map(d.ident).join(", ")})`);
+}