@aotter/mantle 0.2.0-alpha.6 → 0.2.0-alpha.7

package/dist/core/caller.d.ts

@@ -1,35 +0,0 @@
-/** Caller identity (ADR-0032 decision 8). Mantle never owns the user or the auth; a resolver produces the Caller. */
-import type { StaffRole } from "../spec/domain/index.js";
-export type CredentialKind = "session" | "oauth" | "api-key" | "personal-token";
-export type Caller = {
-    readonly kind: "anonymous";
-} | {
-    readonly kind: "user";
-    /** Application subject key: opaque, stable, unique across issuers. Never an email. */
-    readonly subject: string;
-    /** Informational. */
-    readonly issuer?: string;
-    readonly role: StaffRole | null;
-    readonly scopes: readonly string[];
-    readonly credential: CredentialKind;
-    /** Opaque record id or token JTI, never the raw credential. */
-    readonly credentialId: string | null;
-    readonly clientId: string | null;
-} | {
-    readonly kind: "system";
-    readonly reason: string;
-};
-/**
- * Resolves the Caller once per request, at the service's entry. `invalid` is answered 401 before any
- * surface runs and is never anonymous; only "no credential presented" is.
- */
-export type CallerResolver = (request: Request) => Promise<{
-    readonly caller: Caller;
-} | {
-    readonly invalid: true;
-    readonly challenge?: string; /** 403 for a valid token that lacks a scope (RFC 6750 insufficient_scope); 401 otherwise. */
-    readonly status?: 401 | 403;
-}>;
-/** Host code only; no wire produces one. Satisfies no `requires.auth` predicate, bypasses caller scope and nothing else. */
-export declare const systemCaller: (reason: string) => Caller;
-//# sourceMappingURL=caller.d.ts.map

package/dist/core/caller.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"caller.d.ts","sourceRoot":"","sources":["../../src/core/caller.ts"],"names":[],"mappings":"AAAA,qHAAqH;AACrH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAEzD,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,GAAG,gBAAgB,CAAC;AAEhF,MAAM,MAAM,MAAM,GACd;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAC9B;IACE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sFAAsF;IACtF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,qBAAqB;IACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAC;IACpC,+DAA+D;IAC/D,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzD;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC,6FAA6F;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,GAAG,GAAG,GAAG,CAAA;CAAE,CAAC,CAAC;AAE7Q,4HAA4H;AAC5H,eAAO,MAAM,YAAY,GAAI,QAAQ,MAAM,KAAG,MAAsC,CAAC"}

package/dist/core/caller.js

@@ -1,3 +0,0 @@
-/** Host code only; no wire produces one. Satisfies no `requires.auth` predicate, bypasses caller scope and nothing else. */
-export const systemCaller = (reason) => ({ kind: "system", reason });
-//# sourceMappingURL=caller.js.map

package/dist/core/caller.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"caller.js","sourceRoot":"","sources":["../../src/core/caller.ts"],"names":[],"mappings":"AA4BA,4HAA4H;AAC5H,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAc,EAAU,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC"}

package/dist/core/createMantle.d.ts

@@ -1,22 +0,0 @@
-import type { RuntimePlan } from "../spec/domain/index.js";
-import type { MantleService, MantleStorageAdapter } from "./service.js";
-interface WaitUntil {
-    waitUntil(promise: Promise<unknown>): void;
-}
-export interface MantleOptions<Env> {
-    /** The sealed plan the CLI compiled (`mantle generate` emits it beside `src/service.ts`). ADR-0032 decision 6 leaves it out of the signature. */
-    readonly plan: RuntimePlan;
-    readonly storage: (env: Env) => MantleStorageAdapter;
-    /** Set when the entry wires schedules; boot fails for an enabled schedule Trigger without it. */
-    readonly schedules?: boolean;
-    /** Refuses to boot when the plan is not the one Cloud compiled. */
-    readonly expectedFingerprint?: string;
-}
-export interface Mantle<Env> {
-    fetch(request: Request, env: Env, ctx?: WaitUntil): Promise<Response>;
-    invokeSchedule(cron: string, scheduledTime: number, env: Env, ctx?: WaitUntil): Promise<void>;
-    runDeferredHook(message: unknown, env: Env, ctx?: WaitUntil): Promise<void>;
-}
-export declare function createMantle<Env>(service: MantleService<Env>, options: MantleOptions<Env>): Mantle<Env>;
-export {};
-//# sourceMappingURL=createMantle.d.ts.map

package/dist/core/createMantle.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"createMantle.d.ts","sourceRoot":"","sources":["../../src/core/createMantle.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAM3D,OAAO,KAAK,EAAiB,aAAa,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEvF,UAAU,SAAS;IACjB,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;CAC5C;AAED,MAAM,WAAW,aAAa,CAAC,GAAG;IAChC,iJAAiJ;IACjJ,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,oBAAoB,CAAC;IACrD,iGAAiG;IACjG,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,mEAAmE;IACnE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;CACvC;AAED,MAAM,WAAW,MAAM,CAAC,GAAG;IACzB,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACtE,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9F,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7E;AA6BD,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,aAAa,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAqEvG"}

package/dist/core/createMantle.js

@@ -1,117 +0,0 @@
-/**
- * `createMantle`: the one host-neutral entry (ADR-0032 decision 6). It boots the runtime lazily from `storage(env)`,
- * hands it to `service.fetch`, and turns a schedule or a deferred-hook message into an Invocation. The host's own entry
- * is one to three generated lines; Core absorbs no platform event types.
- */
-import { DiagnosticError, makeDiagnostic } from "../spec/kernel/index.js";
-import { STAFF_ROLES, LIFECYCLE_HOOKS } from "../spec/domain/index.js";
-import { systemCaller } from "./caller.js";
-import { MAX_INVOCATION_DEPTH } from "./invocation.js";
-import { createMantleRuntime } from "./runtime/createRuntime.js";
-import { bindStoreCause } from "./store/createStore.js";
-const bad = (message) => new DiagnosticError(makeDiagnostic({ code: "INPUT_VALIDATION_FAILED", phase: "runtime", severity: "error", path: "deferred-hook", message }));
-const record = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
-/** Queue payloads are unknown, including their caller and parent chain. Validate before boot or dispatch. */
-function deferredInvocation(message) {
-    if (!record(message) || typeof message.procedure !== "string" || !record(message.caller))
-        throw bad("invalid deferred Invocation");
-    const c = message.caller;
-    if (c.kind !== "anonymous" && !(c.kind === "user" && typeof c.subject === "string" && c.subject.length > 0
-        && (c.role === null || STAFF_ROLES.includes(c.role))
-        && Array.isArray(c.scopes) && c.scopes.every((s) => typeof s === "string")
-        && ["session", "oauth", "api-key", "personal-token"].includes(c.credential)
-        && (c.credentialId === null || typeof c.credentialId === "string") && (c.clientId === null || typeof c.clientId === "string")))
-        throw bad("invalid deferred caller");
-    let cause = message.cause;
-    let depth = 0;
-    while (cause !== undefined) {
-        if (++depth > MAX_INVOCATION_DEPTH || !record(cause) || typeof cause.id !== "string")
-            throw bad("invalid deferred cause chain");
-        if (!["http", "mcp", "internal", "schedule", "lifecycle"].includes(cause.kind))
-            throw bad("invalid deferred cause kind");
-        if (cause.kind === "lifecycle" && (typeof cause.trigger !== "string" || typeof cause.schema !== "string"
-            || typeof cause.hook !== "string" || !LIFECYCLE_HOOKS.includes(cause.hook)
-            || !Array.isArray(cause.rows) || !cause.rows.length || !cause.rows.every(record)))
-            throw bad("invalid deferred lifecycle cause");
-        if (cause.kind === "schedule" && (typeof cause.trigger !== "string" || typeof cause.cron !== "string" || typeof cause.scheduledTime !== "number" || !Number.isFinite(cause.scheduledTime)))
-            throw bad("invalid deferred schedule cause");
-        cause = cause.parent;
-    }
-    if (!record(message.cause) || message.cause.kind !== "lifecycle" || !message.cause.hook.startsWith("after_"))
-        throw bad("a deferred hook message is the Invocation of an after hook");
-    return message;
-}
-export function createMantle(service, options) {
-    let booted;
-    const retainers = new WeakMap();
-    const runtimeFor = async (env, ctx) => {
-        booted ??= createMantleRuntime({
-            plan: options.plan, handlers: service.handlers, storage: options.storage(env), env, schedules: options.schedules,
-            expectedFingerprint: options.expectedFingerprint, waitUntil: (p, cause) => {
-                for (let depth = 0; cause && depth <= MAX_INVOCATION_DEPTH; cause = cause.parent, depth++) {
-                    const retain = retainers.get(cause);
-                    if (retain) {
-                        retain(p);
-                        return;
-                    }
-                }
-            },
-        }).catch((e) => { booted = undefined; throw e; }); // a failed boot is retried by the next request
-        const runtime = await booted;
-        const retain = ctx ? (p) => ctx.waitUntil(p) : () => undefined;
-        const hostCause = { kind: "internal", id: `host:${crypto.randomUUID()}` };
-        retainers.set(hostCause, retain);
-        return {
-            ...runtime,
-            invokeProcedure: (inv) => {
-                const cause = { ...inv.cause };
-                retainers.set(cause, retain);
-                return runtime.invokeProcedure({ ...inv, cause });
-            },
-            store: {
-                ...runtime.store,
-                ...bindStoreCause(runtime.store, hostCause),
-                as: (caller, cause = { kind: "internal", id: `store:${crypto.randomUUID()}` }) => {
-                    const boundCause = { ...cause };
-                    retainers.set(boundCause, retain);
-                    return runtime.store.as(caller, boundCause);
-                },
-            },
-        };
-    };
-    return {
-        async fetch(request, env, ctx) {
-            const runtime = await runtimeFor(env, ctx);
-            return service.fetch(request, env, { runtime, waitUntil: ctx ? (p) => ctx.waitUntil(p) : () => undefined });
-        },
-        async invokeSchedule(cron, scheduledTime, env, ctx) {
-            const runtime = await runtimeFor(env, ctx);
-            const errors = [];
-            for (const [trigger, t] of Object.entries(options.plan.triggers).sort(([a], [b]) => (a < b ? -1 : 1))) {
-                if (t.source.kind !== "schedule" || t.source.cron !== cron || t.source.enabled === false)
-                    continue;
-                try {
-                    // retries keep the same cause id, so a handler can deduplicate one delivery
-                    await runtime.invokeProcedure({ procedure: t.procedure, input: {}, caller: systemCaller("schedule"), cause: { kind: "schedule", id: `${trigger}:${scheduledTime}`, trigger, cron, scheduledTime } });
-                }
-                catch (e) {
-                    errors.push(e);
-                }
-            }
-            if (errors.length)
-                throw new AggregateError(errors, `${errors.length} scheduled Procedure(s) failed for '${cron}'`);
-        },
-        async runDeferredHook(message, env, ctx) {
-            const inv = deferredInvocation(message);
-            // the queue is Mantle's own channel, but the message is only ever honoured for what a Trigger of the plan would have run:
-            // that Trigger, its Procedure and its hook, and never as the system caller (no wire produces one)
-            if (inv.cause.kind !== "lifecycle")
-                throw bad("invalid deferred lifecycle cause");
-            const t = Object.hasOwn(options.plan.triggers, inv.cause.trigger) ? options.plan.triggers[inv.cause.trigger] : undefined;
-            if (inv.caller.kind === "system" || t?.source.kind !== "lifecycle" || t.procedure !== inv.procedure || t.source.schema !== inv.cause.schema || !t.source.on.includes(inv.cause.hook))
-                throw bad("the message does not match a lifecycle Trigger of the plan");
-            await (await runtimeFor(env, ctx)).invokeProcedure(inv);
-        },
-    };
-}
-//# sourceMappingURL=createMantle.js.map

package/dist/core/createMantle.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"createMantle.js","sourceRoot":"","sources":["../../src/core/createMantle.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAE1E,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,oBAAoB,EAAyC,MAAM,iBAAiB,CAAC;AAC9F,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAuBxD,MAAM,GAAG,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,IAAI,eAAe,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;AAC/K,MAAM,MAAM,GAAG,CAAC,CAAU,EAAgC,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAEtH,6GAA6G;AAC7G,SAAS,kBAAkB,CAAC,OAAgB;IAC1C,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,MAAM,GAAG,CAAC,6BAA6B,CAAC,CAAC;IACnI,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IACzB,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;WACrG,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAK,WAAkC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;WACzE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;WACvE,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAoB,CAAC;WAClF,CAAC,CAAC,CAAC,YAAY,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;QAAE,MAAM,GAAG,CAAC,yBAAyB,CAAC,CAAC;IACvK,IAAI,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC1B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,EAAE,KAAK,GAAG,oBAAoB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAC,8BAA8B,CAAC,CAAC;QAChI,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAc,CAAC;YAAE,MAAM,GAAG,CAAC,6BAA6B,CAAC,CAAC;QACnI,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;eACnG,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAE,eAAqC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;eAC9F,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAAE,MAAM,GAAG,CAAC,kCAAkC,CAAC,CAAC;QACnI,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;YAAE,MAAM,GAAG,CAAC,iCAAiC,CAAC,CAAC;QACzO,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC;IACvB,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW,IAAI,CAAE,OAAO,CAAC,KAAK,CAAC,IAAe,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,MAAM,GAAG,CAAC,4DAA4D,CAAC,CAAC;IAClM,OAAO,OAAgC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,YAAY,CAAM,OAA2B,EAAE,OAA2B;IACxF,IAAI,MAA0C,CAAC;IAC/C,MAAM,SAAS,GAAG,IAAI,OAAO,EAAkD,CAAC;IAEhF,MAAM,UAAU,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAe,EAA0B,EAAE;QAC7E,MAAM,KAAK,mBAAmB,CAAC;YAC7B,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAiB,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS;YACzH,mBAAmB,EAAE,OAAO,CAAC,mBAAmB,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE;gBACxE,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,KAAK,IAAI,oBAAoB,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;oBAC1F,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;oBACpC,IAAI,MAAM,EAAE,CAAC;wBAAC,MAAM,CAAC,CAAC,CAAC,CAAC;wBAAC,OAAO;oBAAC,CAAC;gBACpC,CAAC;YACH,CAAC;SACF,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,MAAM,GAAG,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,+CAA+C;QAClG,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC;QAC7B,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAmB,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;QACjF,MAAM,SAAS,GAAoB,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,MAAM,CAAC,UAAU,EAAE,EAAE,EAAE,CAAC;QAC3F,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACjC,OAAO;YACL,GAAG,OAAO;YACV,eAAe,EAAE,CAAC,GAAG,EAAE,EAAE;gBACvB,MAAM,KAAK,GAAG,EAAE,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC;gBAC/B,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;gBAC7B,OAAO,OAAO,CAAC,eAAe,CAAC,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;YACpD,CAAC;YACD,KAAK,EAAE;gBACL,GAAG,OAAO,CAAC,KAAK;gBAChB,GAAG,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC;gBAC3C,EAAE,EAAE,CAAC,MAAM,EAAE,KAAK,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,MAAM,CAAC,UAAU,EAAE,EAAE,EAAE,EAAE,EAAE;oBAC/E,MAAM,UAAU,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;oBAChC,SAAS,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;oBAClC,OAAO,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;gBAC9C,CAAC;aACF;SACF,CAAC;IACJ,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG;YAC3B,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC3C,OAAO,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QAC9G,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,GAAG;YAChD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC3C,MAAM,MAAM,GAAc,EAAE,CAAC;YAC7B,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtG,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,KAAK,KAAK;oBAAE,SAAS;gBACnG,IAAI,CAAC;oBACH,4EAA4E;oBAC5E,MAAM,OAAO,CAAC,eAAe,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,YAAY,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,OAAO,IAAI,aAAa,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;gBACvM,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACjB,CAAC;YACH,CAAC;YACD,IAAI,MAAM,CAAC,MAAM;gBAAE,MAAM,IAAI,cAAc,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,uCAAuC,IAAI,GAAG,CAAC,CAAC;QACtH,CAAC;QAED,KAAK,CAAC,eAAe,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG;YACrC,MAAM,GAAG,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;YACxC,0HAA0H;YAC1H,kGAAkG;YAClG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW;gBAAE,MAAM,GAAG,CAAC,kCAAkC,CAAC,CAAC;YAClF,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACzH,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,EAAE,MAAM,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,CAAC,SAAS,KAAK,GAAG,CAAC,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;gBAClL,MAAM,GAAG,CAAC,4DAA4D,CAAC,CAAC;YAC1E,MAAM,CAAC,MAAM,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,GAAiB,CAAC,CAAC;QACxE,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/core/dialect.d.ts

@@ -1,53 +0,0 @@
-/**
- * The runtime side of a SQL dialect as Core uses it (ADR-0035 decisions 3 and 6). Core holds no engine code: the storage
- * adapter hands Core its dialect, and Store checks, rewrites, binds and decodes through it. Internal until the compliance
- * suite makes it a public interface (ADR-0035, How to apply 5); the D1 dialect is the one implementation.
- */
-import type { SqlContext, SqlDiagnostic, SqlNode, SqlPlan, SqlSchemaDef } from "../spec/domain/index.js";
-import type { BindContext } from "./sql/compile.js";
-import type { DialectBind, PolicyLowering } from "./sql/policy.js";
-/** A Schema as storage and the policy rewriter read it from the plan. */
-export interface StorageSchema extends SqlSchemaDef {
-    /** Boolean expressions over the row's own columns (IR), enforced by the engine on every write. */
-    readonly checks?: readonly SqlNode[];
-    /** Fields `search` matches. */
-    readonly search?: readonly string[];
-    /** Unique constraints; on a scoped Schema the scope column is added. */
-    readonly unique?: readonly (readonly string[])[];
-    /** Ordered composite non-unique indexes. */
-    readonly indexes?: readonly (readonly string[])[];
-}
-/** The Store's wire values to and from what the engine stores (ADR-0034 decision 5). A value the type cannot hold throws `SqlRefusal`. */
-export interface StoreCodec {
-    encode(type: string, value: unknown): unknown;
-    decode(type: string, value: unknown): unknown;
-}
-/** An operator's own refusals of a program's IR, run after the dialect's at runtime (ADR-0037 decision 4). It can only narrow. An accepted program's verdict is cached per program (Core's compile cache), so `restrict` must be a pure function of (plan, context); refusals are not cached. */
-export type RestrictSql = (plan: SqlPlan, context: SqlContext) => readonly SqlDiagnostic[];
-/** The dialect with `restrict` run after its own check. */
-export declare function restricted(dialect: MantleDialect, restrict?: RestrictSql): MantleDialect;
-/** Core's policy rewriter adds visibility and ownership to every relation position; the dialect spells the rest (`lowering`). */
-export interface MantleDialect {
-    /** What a plan compiled for this dialect records (`RuntimePlan.dialect`); boot refuses any other. */
-    readonly name: string;
-    readonly version: string;
-    readonly codec: StoreCodec;
-    /** The dialect's refusals of a program's IR. Run on every program: the runtime never trusts an IR. */
-    check(plan: SqlPlan, context: SqlContext): readonly SqlDiagnostic[];
-    readonly lowering: PolicyLowering;
-    /**
-     * The engine orders as PostgreSQL does (ADR-0039): NULL sorts as the largest value, and the appended `id` tiebreak runs in the
-     * direction of the last sort key, so a btree index serves ORDER BY ... LIMIT. Absent, the SQLite rule applies: NULL first
-     * ascending, last descending, `id` ascending.
-     */
-    readonly nativeOrder?: boolean;
-    /**
-     * The engine's SQL is its own (ADR-0039), not SQLite's vocabulary lowered onto it: `json_each`, `->> '$.path'`, integer
-     * truthiness and `||` over non-text are refused or mean what the engine says. The compliance suite then runs the engine's
-     * spelling of those cases.
-     */
-    readonly nativeSql?: boolean;
-    /** Resolves a bind the lowering added. */
-    bind(spec: DialectBind, context: BindContext): unknown;
-}
-//# sourceMappingURL=dialect.d.ts.map

package/dist/core/dialect.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"dialect.d.ts","sourceRoot":"","sources":["../../src/core/dialect.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACzG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEnE,yEAAyE;AACzE,MAAM,WAAW,aAAc,SAAQ,YAAY;IACjD,kGAAkG;IAClG,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IACrC,+BAA+B;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,wEAAwE;IACxE,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,CAAC;IACjD,4CAA4C;IAC5C,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,CAAC;CACnD;AAED,0IAA0I;AAC1I,MAAM,WAAW,UAAU;IACzB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC;IAC9C,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC;CAC/C;AAED,iSAAiS;AACjS,MAAM,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,KAAK,SAAS,aAAa,EAAE,CAAC;AAE3F,2DAA2D;AAC3D,wBAAgB,UAAU,CAAC,OAAO,EAAE,aAAa,EAAE,QAAQ,CAAC,EAAE,WAAW,GAAG,aAAa,CAGxF;AAED,iIAAiI;AACjI,MAAM,WAAW,aAAa;IAC5B,qGAAqG;IACrG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,sGAAsG;IACtG,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,GAAG,SAAS,aAAa,EAAE,CAAC;IACpE,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,0CAA0C;IAC1C,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC;CACxD"}

package/dist/core/dialect.js

@@ -1,7 +0,0 @@
-/** The dialect with `restrict` run after its own check. */
-export function restricted(dialect, restrict) {
-    if (!restrict)
-        return dialect;
-    return { ...dialect, check: (plan, context) => { const own = dialect.check(plan, context); return own.length ? own : restrict(plan, context); } };
-}
-//# sourceMappingURL=dialect.js.map

package/dist/core/dialect.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"dialect.js","sourceRoot":"","sources":["../../src/core/dialect.ts"],"names":[],"mappings":"AA8BA,2DAA2D;AAC3D,MAAM,UAAU,UAAU,CAAC,OAAsB,EAAE,QAAsB;IACvE,IAAI,CAAC,QAAQ;QAAE,OAAO,OAAO,CAAC;IAC9B,OAAO,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACpJ,CAAC"}

package/dist/core/driver.d.ts

@@ -1,24 +0,0 @@
-/** The SQLite-family port under SqliteStoreExecutor: D1, Bun and libSQL each wrap their native driver to this. */
-export interface SqlStatement {
-    readonly sql: string;
-    /** Bound in `?n` order. */
-    readonly binds?: readonly unknown[];
-}
-export interface SqlResult {
-    readonly rows: readonly Record<string, unknown>[];
-}
-export interface DatabaseDriver {
-    /**
-     * Every statement in order, all or nothing (a D1 `batch`). When one fails, rethrows the engine's error unchanged, with its
-     * code (`code` or `errcode`): the executor tells a refused statement from one that never reached the engine by it.
-     */
-    batch(statements: readonly SqlStatement[]): Promise<readonly SqlResult[]>;
-    /**
-     * One read statement, outside any transaction: the engine's plain read path, one round trip. Optional: a driver without it
-     * has its reads go through `batch`. Only a single-statement SELECT may use it; a write or a read-modify-write goes through `batch`.
-     */
-    first?(statement: SqlStatement): Promise<Record<string, unknown> | null>;
-    /** `first` for every row. */
-    all?(statement: SqlStatement): Promise<readonly Record<string, unknown>[]>;
-}
-//# sourceMappingURL=driver.d.ts.map

package/dist/core/driver.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"driver.d.ts","sourceRoot":"","sources":["../../src/core/driver.ts"],"names":[],"mappings":"AAAA,kHAAkH;AAClH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,2BAA2B;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;CACnD;AAED,MAAM,WAAW,cAAc;IAC7B;;;OAGG;IACH,KAAK,CAAC,UAAU,EAAE,SAAS,YAAY,EAAE,GAAG,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAAC;IAC1E;;;OAGG;IACH,KAAK,CAAC,CAAC,SAAS,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IACzE,6BAA6B;IAC7B,GAAG,CAAC,CAAC,SAAS,EAAE,YAAY,GAAG,OAAO,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;CAC5E"}

package/dist/core/driver.js

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=driver.js.map

package/dist/core/driver.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"driver.js","sourceRoot":"","sources":["../../src/core/driver.ts"],"names":[],"mappings":""}

package/dist/core/email.d.ts

@@ -1,17 +0,0 @@
-/** The transactional-email port (Better Auth email OTP and magic link, staff invitations). The sender decides how to branch on `locale`; `category` names the template lane. */
-export interface EmailSender {
-    send(args: EmailSendArgs): Promise<void>;
-}
-export interface EmailSendArgs {
-    readonly to: string;
-    readonly subject: string;
-    /** Plain-text body — always required so non-HTML clients work. */
-    readonly text: string;
-    /** Optional HTML body. */
-    readonly html?: string;
-    /** BCP 47 locale the recipient is expected to read. */
-    readonly locale: string;
-    /** Optional categorization for templating / deliverability segmentation. */
-    readonly category?: string;
-}
-//# sourceMappingURL=email.d.ts.map

package/dist/core/email.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"email.d.ts","sourceRoot":"","sources":["../../src/core/email.ts"],"names":[],"mappings":"AAAA,gLAAgL;AAChL,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1C;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,0BAA0B;IAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,uDAAuD;IACvD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,4EAA4E;IAC5E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B"}

package/dist/core/email.js

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=email.js.map

package/dist/core/email.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"email.js","sourceRoot":"","sources":["../../src/core/email.ts"],"names":[],"mappings":""}

package/dist/core/index.d.ts

@@ -1,16 +0,0 @@
-export * from "./caller.js";
-export * from "./createMantle.js";
-export * from "./driver.js";
-export * from "./invocation.js";
-export * from "./runtime/createRuntime.js";
-export * from "./service.js";
-export * from "./withCaller.js";
-export * from "./site.js";
-export * from "./store.js";
-export * from "./email.js";
-export * from "./runtime/auth.js";
-export type { RestrictSql } from "./dialect.js";
-export * from "./runtime/verifyPlan.js";
-export { DiagnosticError, makeDiagnostic, runtimeDiagnostic, type Diagnostic, type DiagnosticCode } from "../spec/kernel/index.js";
-export { STAFF_ROLES, isStaffRole, type StaffRole } from "../spec/domain/index.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/core/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/core/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,mBAAmB,CAAC;AAClC,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,mBAAmB,CAAC;AAClC,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,cAAc,yBAAyB,CAAC;AAExC,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,iBAAiB,EAAE,KAAK,UAAU,EAAE,KAAK,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACnI,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,SAAS,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/core/index.js

@@ -1,16 +0,0 @@
-export * from "./caller.js";
-export * from "./createMantle.js";
-export * from "./driver.js";
-export * from "./invocation.js";
-export * from "./runtime/createRuntime.js";
-export * from "./service.js";
-export * from "./withCaller.js";
-export * from "./site.js";
-export * from "./store.js";
-export * from "./email.js";
-export * from "./runtime/auth.js";
-export * from "./runtime/verifyPlan.js";
-// what host and handler code throws and checks, from the root: the `/spec` barrel bundles the SQL parser into a Worker
-export { DiagnosticError, makeDiagnostic, runtimeDiagnostic } from "../spec/kernel/index.js";
-export { STAFF_ROLES, isStaffRole } from "../spec/domain/index.js";
-//# sourceMappingURL=index.js.map

package/dist/core/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/core/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,mBAAmB,CAAC;AAClC,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,mBAAmB,CAAC;AAElC,cAAc,yBAAyB,CAAC;AACxC,uHAAuH;AACvH,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,iBAAiB,EAAwC,MAAM,yBAAyB,CAAC;AACnI,OAAO,EAAE,WAAW,EAAE,WAAW,EAAkB,MAAM,yBAAyB,CAAC"}

package/dist/core/invocation.d.ts

@@ -1,66 +0,0 @@
-/** Invocation, the handler contract and the lifecycle port (ADR-0032 decisions 3 and 7, ADR-0034 decision 4). */
-import type { LifecycleHook } from "../spec/domain/index.js";
-import type { Caller } from "./caller.js";
-import type { CallerStore, StoreRow } from "./store.js";
-/** `ctx.cause.parent` chains through hooks and `ctx.invoke`; deeper than this fails `INVOCATION_DEPTH_EXCEEDED`. */
-export declare const MAX_INVOCATION_DEPTH = 8;
-/** Why a Procedure runs. `id` is stable across retries and deferred replays. */
-export type InvocationCause = {
-    readonly id: string;
-    readonly parent?: InvocationCause;
-} & ({
-    readonly kind: "http" | "mcp" | "internal";
-} | {
-    readonly kind: "schedule";
-    readonly trigger: string;
-    readonly cron: string;
-    readonly scheduledTime: number;
-} | {
-    readonly kind: "lifecycle";
-    readonly trigger: string;
-    readonly hook: LifecycleHook;
-    readonly schema: string;
-    /** After hooks: every row the statement wrote, whole and as Store's `select` returns it, whatever its own RETURNING. Before hooks: the one row, or for an insert the row about to be written. */
-    readonly rows: readonly [StoreRow, ...StoreRow[]];
-});
-/** The serializable part of a call. Every source produces one; only an Invocation crosses a wire. */
-export interface Invocation {
-    readonly procedure: string;
-    readonly input: unknown;
-    readonly caller: Caller;
-    readonly cause: InvocationCause;
-}
-/**
- * Handed to every handler. In a guard or a before hook `store.write` and `invoke` fail (before hooks are
- * read-only checks).
- */
-export interface HandlerContext<Env = unknown> {
-    readonly caller: Caller;
-    readonly cause: InvocationCause;
-    readonly env: Env;
-    waitUntil(promise: Promise<unknown>): void;
-    readonly store: CallerStore;
-    /** The one Procedure-to-Procedure entry: keeps the caller, chains `cause.parent`, re-runs the target's auth and guard. */
-    invoke(procedure: string, input: unknown): Promise<unknown>;
-}
-/** `input` is validated against the Procedure's `input` schema before the call, the return against `output`. */
-export type HandlerFn<I = unknown, O = unknown, Env = unknown> = (input: I, ctx: HandlerContext<Env>) => O | Promise<O>;
-/** Codegen narrows this to exactly the plan's refs (`HANDLER_NOT_REGISTERED` / `HANDLER_NOT_DECLARED`). */
-export type MantleHandlers<Env = unknown> = Readonly<Record<string, HandlerFn<any, any, Env>>>;
-/** One hook call: one statement and one Trigger. */
-export interface LifecycleEvent {
-    readonly id: string;
-    readonly schema: string;
-    readonly hook: LifecycleHook;
-    readonly rows: readonly [StoreRow, ...StoreRow[]];
-    readonly caller: Caller;
-    readonly parent?: InvocationCause;
-}
-/** What Store calls; the Trigger layer implements it. Store never references Procedures. */
-export interface LifecycleDispatcher {
-    /** Runs before the batch applies, in op order. A throw rejects the mutation and applies nothing. */
-    before(events: readonly LifecycleEvent[]): Promise<void>;
-    /** Runs after a successful commit, best effort: a failure never changes the committed result. */
-    after(events: readonly LifecycleEvent[]): Promise<void>;
-}
-//# sourceMappingURL=invocation.d.ts.map

package/dist/core/invocation.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"invocation.d.ts","sourceRoot":"","sources":["../../src/core/invocation.ts"],"names":[],"mappings":"AAAA,iHAAiH;AACjH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAExD,oHAAoH;AACpH,eAAO,MAAM,oBAAoB,IAAI,CAAC;AAEtC,gFAAgF;AAChF,MAAM,MAAM,eAAe,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAA;CAAE,GAAG,CACvF;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,GAAG,UAAU,CAAA;CAAE,GAC9C;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;CAAE,GAC9G;IACE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,iMAAiM;IACjM,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC;CACnD,CACJ,CAAC;AAEF,qGAAqG;AACrG,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;CACjC;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc,CAAC,GAAG,GAAG,OAAO;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;IAClB,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;IAC3C,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,0HAA0H;IAC1H,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC7D;AAED,gHAAgH;AAChH,MAAM,MAAM,SAAS,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,OAAO,EAAE,GAAG,GAAG,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;AAExH,2GAA2G;AAE3G,MAAM,MAAM,cAAc,CAAC,GAAG,GAAG,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;AAE/F,oDAAoD;AACpD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC;IAClD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC;CACnC;AAED,4FAA4F;AAC5F,MAAM,WAAW,mBAAmB;IAClC,oGAAoG;IACpG,MAAM,CAAC,MAAM,EAAE,SAAS,cAAc,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,iGAAiG;IACjG,KAAK,CAAC,MAAM,EAAE,SAAS,cAAc,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACzD"}

package/dist/core/invocation.js

@@ -1,3 +0,0 @@
-/** `ctx.cause.parent` chains through hooks and `ctx.invoke`; deeper than this fails `INVOCATION_DEPTH_EXCEEDED`. */
-export const MAX_INVOCATION_DEPTH = 8;
-//# sourceMappingURL=invocation.js.map

package/dist/core/invocation.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"invocation.js","sourceRoot":"","sources":["../../src/core/invocation.ts"],"names":[],"mappings":"AAKA,oHAAoH;AACpH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC"}

package/dist/core/observation.d.ts

@@ -1,3 +0,0 @@
-/** Best-effort metadata callbacks: delivery belongs to the host, never to the business response. */
-export declare function observe<T>(listener: ((event: T) => void | Promise<void>) | undefined, event: T): void;
-//# sourceMappingURL=observation.d.ts.map

package/dist/core/observation.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"observation.d.ts","sourceRoot":"","sources":["../../src/core/observation.ts"],"names":[],"mappings":"AAAA,oGAAoG;AACpG,wBAAgB,OAAO,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,CAGrG"}

package/dist/core/observation.js

@@ -1,10 +0,0 @@
-/** Best-effort metadata callbacks: delivery belongs to the host, never to the business response. */
-export function observe(listener, event) {
-    if (!listener)
-        return;
-    try {
-        void Promise.resolve(listener(event)).catch(() => { });
-    }
-    catch { /* The adopter owns delivery failure reporting. */ }
-}
-//# sourceMappingURL=observation.js.map

package/dist/core/observation.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"observation.js","sourceRoot":"","sources":["../../src/core/observation.ts"],"names":[],"mappings":"AAAA,oGAAoG;AACpG,MAAM,UAAU,OAAO,CAAI,QAA0D,EAAE,KAAQ;IAC7F,IAAI,CAAC,QAAQ;QAAE,OAAO;IACtB,IAAI,CAAC;QAAC,KAAK,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,kDAAkD,CAAC,CAAC;AAC7H,CAAC"}

package/dist/core/runtime/auth.d.ts

@@ -1,9 +0,0 @@
-/** `requires.auth` evaluated against the Caller only (ADR-0032 decision 8); the grammar is unchanged. */
-import { type Diagnostic } from "../../spec/kernel/index.js";
-import type { AuthPredicate, AuthorizationRequirements } from "../../spec/domain/index.js";
-import type { Caller } from "../caller.js";
-export declare function evaluatePredicate(pred: AuthPredicate, caller: Caller): boolean;
-export declare function describePredicate(pred: AuthPredicate): string;
-/** `null` when every predicate holds (or none is declared), else a 401/403 Diagnostic naming the first that fails. */
-export declare function evaluateAuthAll(requires: AuthorizationRequirements | undefined, caller: Caller, path: string): Diagnostic | null;
-//# sourceMappingURL=auth.d.ts.map

package/dist/core/runtime/auth.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/core/runtime/auth.ts"],"names":[],"mappings":"AAAA,yGAAyG;AACzG,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC7E,OAAO,KAAK,EAAE,aAAa,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAC3F,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE3C,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAM9E;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAK7D;AAED,sHAAsH;AACtH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,yBAAyB,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAchI"}

package/dist/core/runtime/auth.js

@@ -1,39 +0,0 @@
-/** `requires.auth` evaluated against the Caller only (ADR-0032 decision 8); the grammar is unchanged. */
-import { makeDiagnostic } from "../../spec/kernel/index.js";
-export function evaluatePredicate(pred, caller) {
-    // the system caller satisfies no predicate; an anonymous caller has no user, credential, role or scope
-    if (caller.kind !== "user")
-        return false;
-    if (pred === "ctx.user" || pred === "ctx.auth")
-        return true;
-    if ("ctx.auth.scope" in pred)
-        return caller.scopes.includes(pred["ctx.auth.scope"]);
-    return caller.role !== null && pred["ctx.staff"].includes(caller.role);
-}
-export function describePredicate(pred) {
-    if (pred === "ctx.user")
-        return "caller is signed in (ctx.user)";
-    if (pred === "ctx.auth")
-        return "caller presents a verified credential (ctx.auth)";
-    if ("ctx.auth.scope" in pred)
-        return `caller credential includes scope '${pred["ctx.auth.scope"]}'`;
-    return `caller is staff with role in [${pred["ctx.staff"].join(", ")}]`;
-}
-/** `null` when every predicate holds (or none is declared), else a 401/403 Diagnostic naming the first that fails. */
-export function evaluateAuthAll(requires, caller, path) {
-    const all = requires?.auth?.all ?? [];
-    for (const [i, pred] of all.entries()) {
-        if (evaluatePredicate(pred, caller))
-            continue;
-        return makeDiagnostic({
-            code: caller.kind === "user" ? "AUTH_DENIED" : "UNAUTHENTICATED",
-            phase: "runtime",
-            severity: "error",
-            path: `${path}#/requires/auth/all/${i}`,
-            expected: describePredicate(pred),
-            message: `Authorization predicate not satisfied: ${describePredicate(pred)}.`,
-        });
-    }
-    return null;
-}
-//# sourceMappingURL=auth.js.map

package/dist/core/runtime/auth.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/core/runtime/auth.ts"],"names":[],"mappings":"AAAA,yGAAyG;AACzG,OAAO,EAAE,cAAc,EAAmB,MAAM,4BAA4B,CAAC;AAI7E,MAAM,UAAU,iBAAiB,CAAC,IAAmB,EAAE,MAAc;IACnE,uGAAuG;IACvG,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACzC,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IAC5D,IAAI,gBAAgB,IAAI,IAAI;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACpF,OAAO,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAmB;IACnD,IAAI,IAAI,KAAK,UAAU;QAAE,OAAO,gCAAgC,CAAC;IACjE,IAAI,IAAI,KAAK,UAAU;QAAE,OAAO,kDAAkD,CAAC;IACnF,IAAI,gBAAgB,IAAI,IAAI;QAAE,OAAO,qCAAqC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC;IACpG,OAAO,iCAAiC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AAC1E,CAAC;AAED,sHAAsH;AACtH,MAAM,UAAU,eAAe,CAAC,QAA+C,EAAE,MAAc,EAAE,IAAY;IAC3G,MAAM,GAAG,GAAG,QAAQ,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC;IACtC,KAAK,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;QACtC,IAAI,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC;YAAE,SAAS;QAC9C,OAAO,cAAc,CAAC;YACpB,IAAI,EAAE,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,iBAAiB;YAChE,KAAK,EAAE,SAAS;YAChB,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,GAAG,IAAI,uBAAuB,CAAC,EAAE;YACvC,QAAQ,EAAE,iBAAiB,CAAC,IAAI,CAAC;YACjC,OAAO,EAAE,0CAA0C,iBAAiB,CAAC,IAAI,CAAC,GAAG;SAC9E,CAAC,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/core/runtime/createRuntime.d.ts

@@ -1,23 +0,0 @@
-import { type RuntimePlan } from "../../spec/domain/index.js";
-import { systemCaller } from "../caller.js";
-import { type InvocationCause, type MantleHandlers } from "../invocation.js";
-import type { MantleRuntime, MantleStorageAdapter } from "../service.js";
-export declare const CORE_VERSION = "0.2.0";
-export interface MantleRuntimeArgs {
-    readonly plan: RuntimePlan;
-    readonly handlers: MantleHandlers<never>;
-    readonly storage: MantleStorageAdapter;
-    /** Refuses to boot on a mismatch (`PLAN_FINGERPRINT_MISMATCH`): what Cloud compiled is what runs. */
-    readonly expectedFingerprint?: string;
-    /** Boot fails for any enabled schedule unless the entry wires schedules. */
-    readonly schedules?: boolean;
-    /** Handed to handlers as `ctx.env`. */
-    readonly env?: unknown;
-    readonly waitUntil?: (promise: Promise<unknown>, cause?: InvocationCause) => void;
-    /** Microseconds since the epoch, and new entry ids. */
-    readonly now?: () => number;
-    readonly newId?: () => string;
-}
-export declare function createMantleRuntime(args: MantleRuntimeArgs): Promise<MantleRuntime>;
-export { systemCaller };
-//# sourceMappingURL=createRuntime.d.ts.map

package/dist/core/runtime/createRuntime.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"createRuntime.d.ts","sourceRoot":"","sources":["../../../src/core/runtime/createRuntime.ts"],"names":[],"mappings":"AAKA,OAAO,EAAqI,KAAK,WAAW,EAA4C,MAAM,4BAA4B,CAAC;AAG3O,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAA8D,KAAK,eAAe,EAAiD,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAKxL,OAAO,KAAK,EAAoB,aAAa,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAG3F,eAAO,MAAM,YAAY,UAAU,CAAC;AAQpC,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC;IACzC,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;IACvC,qGAAqG;IACrG,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IACtC,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,uCAAuC;IACvC,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,EAAE,eAAe,KAAK,IAAI,CAAC;IAClF,uDAAuD;IACvD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;CAC/B;AAgBD,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,CAAC,CAqKzF;AAED,OAAO,EAAE,YAAY,EAAE,CAAC"}