@aotter/mantle 0.2.0-alpha.6 → 0.2.0-alpha.8

package/dist/{spec → build/spec}/domain/model/ManifestGrammar.d.ts

@@ -18,10 +18,6 @@ export type ApiVersion = typeof API_VERSION;
 /** Media-shaped `x-mcp-hint` values — the subset marking a field as
  *  holding a media asset URL. */
 export type MediaMcpHint = "media" | "media-image" | "media-video" | "media-file";
-/** `<extension>/<contribution>`: how `uiSchema` names an Admin extension contribution (ADR-lite 1376). Whether it exists is
- *  checked where the plan meets the extensions, in `createAdminSurface`. */
-export declare const UI_EXTENSION_REF: RegExp;
-export declare const isUiExtensionRef: (value: unknown) => value is string;
 export declare function isMediaMcpHint(value: unknown): value is MediaMcpHint;
 /** Loose JSON Schema shape — we don't constrain it at the type level.
  *  Manifest authoring stays JSON Schema; runtime validators translate
@@ -52,7 +48,7 @@ export type JsonSchema = {
     readonly maxItems?: number;
     readonly nullable?: boolean;
     /** Standard JSON Schema annotation. At the root of a Schema manifest,
-     *  Mantle keeps generic Admin and Staff MCP authoring read-only while
+     *  Mantle keeps generic Admin and Admin MCP authoring read-only while
      *  allowing trusted Procedure handlers to maintain the projection. */
     readonly readOnly?: boolean;
     readonly default?: unknown;
@@ -117,6 +113,8 @@ export declare const MANTLE_BIND_KEYWORD: "x-mantle-bind";
  * with `resolveLocalizedText`.
  */
 export type LocalizedText = string | Readonly<Record<string, string>>;
+/** A non-empty string or a non-empty `{ locale: non-empty string }` map. */
+export declare const isLocalizedText: (v: unknown) => v is LocalizedText;
 /**
  * Resolve a `LocalizedText` value to a single displayable string for
  * `preferred` (typically the viewer's chosen admin language), falling
@@ -202,9 +200,9 @@ export interface SchemaManifestSpec {
         readonly field: string;
         readonly expireAfterSeconds: number;
     };
-    /** Caller identity scope for Store operations: one field bound to `auth.uid()`.
-     *  The field must be required and indexed first. */
-    readonly scope?: Readonly<Record<string, "auth.uid()">>;
+    /** The Schema's row template (ADR-0046 amendment): AND-joined `column = auth.uid()` /
+     *  `column IN auth.user('field')` terms, enforced on every read and write of the Schema. */
+    readonly scope?: string;
 }
 export interface TranslatesBinding {
     /** Name of the parent Schema this translation table joins to. Must
@@ -222,7 +220,7 @@ export interface ViewCachePolicy {
     /** Maximum shared-cache staleness for anonymous REST reads, in seconds. */
     readonly sharedMaxAge: number;
 }
-export declare const VIEW_SURFACES: readonly ["public", "staff", "internal"];
+export declare const VIEW_SURFACES: readonly ["public", "admin", "internal"];
 export type ViewSurface = (typeof VIEW_SURFACES)[number];
 export interface ViewManifestSpec {
     /** Human-readable label for the admin UI's report sidebar / report
@@ -236,7 +234,7 @@ export interface ViewManifestSpec {
      *  (ADR-0029). Projected into the View's MCP tool description; absent
      *  keeps the generated "Query <surface> View '<name>'." text. */
     readonly description?: LocalizedText;
-    /** Admin's list for a `surface: staff` View: `uiSchema.list.columns`, and
+    /** Admin's list for a `surface: admin` View: `uiSchema.list.columns`, and
      *  `searchFields` / `filterFields`, which Store compiles to `LIKE` and `=`
      *  conditions on the View's outputs for Admin's search box and filters
      *  (ADR-0032 decision 5). REST and MCP are unchanged. */
@@ -248,10 +246,10 @@ export interface ViewManifestSpec {
     /** Adapter exposure policy.
      *  `"public"` auto-mounts at the public
      *  `GET /api/views/<name>` (v0.1 default; `requires` may still gate
-     *  the call). When `"staff"` the View is
+     *  the call). When `"admin"` the View is
      *  NOT mounted on the public path — it mounts at
-     *  `GET /admin/api/views/<name>` behind the staff gate and becomes
-     *  the report-sidebar source. Guards data behind a staff session; use
+     *  `GET /admin/api/views/<name>` behind the admin gate and becomes
+     *  the report-sidebar source. Guards data behind an admin session; use
      *  it for any View over sensitive rows. `"internal"` mounts on no
      *  adapter and is callable only through `runtime.store.as(ctx).view()`. */
     readonly surface: ViewSurface;
@@ -262,9 +260,11 @@ export interface ViewManifestSpec {
      *  When absent the View is public — `ExecuteViewUseCase` skips the
      *  predicate check. When present, ALL predicates must hold; the
      *  runtime enforces with `evaluateAuthAll`. Closed predicate
-     *  vocabulary: `ctx.user`, `ctx.staff`, `ctx.auth`, and
+     *  vocabulary: `ctx.user`, `ctx.admin`, `ctx.auth`, and
      *  `ctx.auth.scope`; an optional guard names one consumer Procedure. */
     readonly requires?: AuthorizationRequirements;
+    /** Extra row terms per Schema this target reads (ADR-0046): AND-ed onto that Schema's scope; never widens. */
+    readonly restrict?: Readonly<Record<string, string>>;
     /** Caller-supplied parameters, read in `sql` as `input.<name>`. MUST be
      *  `type: "object"` with declared `properties`. `limit` and `cursor` are
      *  reserved: the runtime owns them for pagination. */
@@ -275,7 +275,7 @@ export interface ViewManifestSpec {
 export declare const VIEW_INPUT_RESERVED: readonly ["limit", "cursor"];
 export type ProcedureManifest = ManifestEnvelope<"Procedure", ProcedureManifestSpec>;
 export interface ProcedureManifestSpec {
-    /** Human-readable label for the admin UI's staff-operations surface
+    /** Human-readable label for the admin UI's admin-operations surface
      *  (#430). Same string-or-locale-map `LocalizedText` shape as
      *  `Schema.spec.title`. Optional — Procedures didn't carry a title
      *  before v0.1.x; when absent the admin UI falls back to a
@@ -288,8 +288,10 @@ export interface ProcedureManifestSpec {
     readonly description?: LocalizedText;
     /** Authorization via `requires.auth.all` plus one optional
      *  `requires.guard.procedure`; static predicates are closed to
-     *  `ctx.user`, `ctx.staff`, `ctx.auth`, and `ctx.auth.scope`. */
+     *  `ctx.user`, `ctx.admin`, `ctx.auth`, and `ctx.auth.scope`. */
     readonly requires?: AuthorizationRequirements;
+    /** Extra row terms per Schema this target reads (ADR-0046): AND-ed onto that Schema's scope; never widens. */
+    readonly restrict?: Readonly<Record<string, string>>;
     /** JSON Schema for the request body. */
     readonly input: JsonSchema;
     /** Admin-only field widget choices. Does not affect input validation
@@ -301,7 +303,8 @@ export interface ProcedureManifestSpec {
      *  `{ sql }` (write statements, compiled to the plan's IR; ADR-0034). */
     readonly handler: HandlerBinding;
     /** MCP tool annotations the author declares because Core cannot infer
-     *  them for a `ref` handler (#972). Emitted verbatim on the tool;
+     *  them for a `ref` handler (#972). They override the generated defaults
+     *  (`procedureAnnotations`);
      *  An `x-mcp-hint: idempotency-key` input does not infer an
      *  `idempotentHint` annotation in 0.2. A `readOnlyHint: true` on a `sql`
      *  handler, which always writes, is rejected at validation. */
@@ -338,7 +341,7 @@ export interface HandlerSqlBinding {
     readonly sql: string;
 }
 /** Closed predicate vocabulary. `ctx.user` and `ctx.auth` are bare
- *  strings; `ctx.staff` and `ctx.auth.scope` carry scalar data under
+ *  strings; `ctx.admin` and `ctx.auth.scope` carry scalar data under
  *  literal object keys.
  */
 export interface AuthorizationRequirements {
@@ -352,37 +355,18 @@ export interface AuthorizationRequirements {
         readonly procedure: string;
     };
 }
-export type AuthPredicate = CtxUserPredicate | CtxStaffPredicate | CtxAuthPredicate | CtxAuthScopePredicate;
+export type AuthPredicate = CtxUserPredicate | "ctx.admin" | CtxAuthPredicate | CtxAuthScopePredicate;
 export type CtxUserPredicate = "ctx.user";
 /** Requires any verified credential normalized into HandlerContext.auth. */
 export type CtxAuthPredicate = "ctx.auth";
-export interface CtxStaffPredicate {
-    readonly "ctx.staff": readonly StaffRole[];
-}
 /** Requires one opaque, consumer-owned scope. Repeat under `all` for
  *  multiple required scopes. */
 export interface CtxAuthScopePredicate {
     readonly "ctx.auth.scope": string;
 }
-/**
- * Staff role hierarchy. `users` is the base identity layer (runtime);
- * `staff` is the privilege overlay (one row per privileged user). A
- * user without a staff row is a regular site member with no admin
- * access.
- *
- *   owner       — full control, manages staff, manages settings
- *   editor      — publish, approve/reject, manage all entries
- *   contributor — create and edit drafts
- *
- * `StaffRole` lives in spec because the manifest grammar references
- * it directly: `requires.auth.all: [{ "ctx.staff": [<role>, ...] }]`
- * — the parser checks each role string is in `STAFF_ROLES` at boot.
- * The `Staff` runtime row shape (with grantedBy / grantedAt) lives in
- * `mantle-runtime`; only the closed enum is grammar.
- */
-export declare const STAFF_ROLES: readonly ["owner", "editor", "contributor"];
-export type StaffRole = (typeof STAFF_ROLES)[number];
-export declare function isStaffRole(s: string): s is StaffRole;
+/** Role names are application-owned; the privileged layer comes from Better Auth. */
+export type AdminRole = string;
+export declare function isAdminRole(s: string): s is AdminRole;
 export type TriggerManifest = ManifestEnvelope<"Trigger", TriggerManifestSpec>;
 export interface TriggerManifestSpec {
     readonly source: TriggerSource;
@@ -418,11 +402,11 @@ export interface LifecycleTriggerSource {
     /** Hooks bound by this Trigger. Non-empty. */
     readonly on: readonly LifecycleHook[];
 }
-/** Surfaces an MCP-source Trigger can be bound to. `staff` ⇒
- *  `/mcp/staff` (bearer + role gate); `public` ⇒ `/mcp` (bearer only).
+/** Surfaces an MCP-source Trigger can be bound to. `admin` ⇒
+ *  `/mcp/admin` (bearer + role gate); `public` ⇒ `/mcp` (bearer only).
  *  The procedure's own `requires.auth` still gates the call —
  *  surface determines visibility in `tools/list`. */
-export declare const MCP_TRIGGER_SURFACES: readonly ["staff", "public"];
+export declare const MCP_TRIGGER_SURFACES: readonly ["admin", "public"];
 export type McpTriggerSurface = (typeof MCP_TRIGGER_SURFACES)[number];
 export interface McpTriggerSource {
     readonly kind: "mcp";
@@ -441,7 +425,6 @@ export type Manifest = SchemaManifest | ViewManifest | ProcedureManifest | Trigg
  *  every Entry interface). Adding a new reserved column is a grammar
  *  revise — touch this constant + every consumer. */
 export declare const RESERVED_ENTRY_COLUMNS: readonly ["id", "status", "version", "createdAt", "updatedAt", "authorId"];
-export type ReservedEntryColumn = (typeof RESERVED_ENTRY_COLUMNS)[number];
 /**
  * Reserved Procedure input wire names. `expectedVersion` is the observed
  * native `entry.version` at read time (not version+1). First-party Admin/SDK
@@ -450,7 +433,7 @@ export type ReservedEntryColumn = (typeof RESERVED_ENTRY_COLUMNS)[number];
  * New reserved names need an ADR (ADR-0022).
  */
 export declare const EXPECTED_VERSION_PROPERTY: "expectedVersion";
+/** Rules between an input object's fields: only View and Procedure input takes them, and AI tool catalogues advertise them as sentences. */
+export declare const INPUT_RULE_KEYWORDS: readonly ["dependentRequired", "anyOf", "if", "then", "else"];
 export declare const RESERVED_PROCEDURE_INPUT_NAMES: readonly ["expectedVersion"];
-export type ReservedProcedureInputName = (typeof RESERVED_PROCEDURE_INPUT_NAMES)[number];
 export {};
-//# sourceMappingURL=ManifestGrammar.d.ts.map

package/dist/{spec → build/spec}/domain/model/RuntimePlan.d.ts

@@ -4,9 +4,11 @@
  */
 import type { AuthorizationRequirements, JsonSchema, LocalizedText, ProcedureMcpAnnotations, ProcedureTarget, TriggerSource } from "./ManifestGrammar.js";
 import type { SqlNode, SqlPlan } from "./SqlIr.js";
+import type { UserScope, UserFieldSpec } from "./UserFields.js";
 export declare const RUNTIME_PLAN_VERSION: 6;
 /** A Schema as storage and Store see it. Keys of `fields` and `names` are lower case: SQL folds unquoted identifiers. */
 export interface PlanSchema {
+    readonly userScopes?: readonly UserScope[];
     /** The name as declared: the key of `schemas` is lower case. */
     readonly name: string;
     readonly title?: LocalizedText;
@@ -35,7 +37,13 @@ export interface PlanSchema {
     readonly unique?: readonly (readonly string[])[];
     readonly indexes?: readonly (readonly string[])[];
 }
+/** A target's extra row terms per Schema (`restrict`): AND-ed onto that Schema's scope, never dropped by `{ all: true }`. */
+export type PlanRestrict = Readonly<Record<string, {
+    readonly owner?: string;
+    readonly terms: readonly UserScope[];
+}>>;
 export interface PlanView extends SqlPlan {
+    readonly restrict?: PlanRestrict;
     readonly title?: LocalizedText;
     readonly description?: LocalizedText;
     readonly uiSchema?: Readonly<Record<string, unknown>>;
@@ -44,8 +52,10 @@ export interface PlanView extends SqlPlan {
     readonly input?: JsonSchema;
     /** The SQL as authored, which Admin shows; the IR (`stmts`) is what runs. */
     readonly source: string;
-    readonly surface: "public" | "staff" | "internal";
+    readonly surface: "public" | "admin" | "internal";
     readonly requires?: AuthorizationRequirements;
+    /** `spec.cache.sharedMaxAge`: REST lets a shared cache keep an anonymous read this many seconds. Only an unguarded public View has it. */
+    readonly sharedMaxAge?: number;
     /** Output name -> the Schema field it reads unchanged (`SELECT t.f`, `t.f AS f`, `*`, `created_at`) or a `sum`/`min`/`max` of it; the Store decodes these as `select` does. */
     readonly columns?: Readonly<Record<string, {
         readonly schema: string;
@@ -53,6 +63,8 @@ export interface PlanView extends SqlPlan {
     }>>;
 }
 export interface PlanProcedure {
+    readonly restrict?: PlanRestrict;
+    readonly trustedOnly?: true;
     readonly title?: LocalizedText;
     readonly description?: LocalizedText;
     readonly uiSchema?: Readonly<Record<string, unknown>>;
@@ -75,7 +87,68 @@ export interface PlanTrigger {
     readonly source: TriggerSource;
     readonly procedure: string;
 }
+/** A statement as the dialect printed it at `mantle generate` (ADR-0044). Binds are Core's BindSpec as JSON. */
+export interface LoweredStatement {
+    readonly sql: string;
+    readonly binds: readonly {
+        readonly k: string;
+        readonly [key: string]: unknown;
+    }[];
+    readonly kind: "read" | "row" | "set";
+    readonly schema?: string;
+    readonly verb?: "insert" | "update" | "delete";
+    /** Omitted when false. */
+    readonly hooked?: true;
+    /** Omitted when false. */
+    readonly publish?: true;
+    /** The policy AST has a RETURNING clause. */
+    readonly returns?: true;
+    /** A write's table, lower case (D1's unique-conflict op mapping). */
+    readonly target?: string;
+}
+/** A paged statement of a View under one request shape, printed. The page size is a bind (`limit`), so one statement serves every page size. */
+export interface LoweredPage {
+    readonly sql: string;
+    /** Where each extra bind comes from on a request, after the View's own binds: a cursor key, the search pattern, an equality value or the page size + 1. */
+    readonly sources: readonly ({
+        readonly cursor: number;
+    } | {
+        readonly search: true;
+    } | {
+        readonly eq: number;
+    } | {
+        readonly limit: true;
+    })[];
+    readonly flat?: true;
+    readonly names: readonly string[];
+    readonly nkeys: number;
+}
+export interface LoweredView extends LoweredStatement {
+    /** The length of the policy AST's sort clause. */
+    readonly nkeys: number;
+    /** By Core's page shape key (`pageShape`): no cursor, and a cursor whose every key is non-null. */
+    readonly paged: Readonly<Record<string, LoweredPage>>;
+}
+export type LoweredMode = "caller" | "public" | "trusted";
+/** What `mantle generate` printed for the plan's dialect (ADR-0044): text, bind recipes and paging metadata, never ASTs. */
+export interface PlanLowered {
+    /** The `@aotter/mantle` version that lowered. */
+    readonly mantle: string;
+    /** The dialect's name and version, and its `lowerKey` ("" when absent): a runtime on another uses none of it. */
+    readonly dialect: {
+        readonly name: string;
+        readonly version: string;
+        readonly key: string;
+    };
+    readonly views: Readonly<Record<string, Readonly<Partial<Record<LoweredMode, LoweredView>>>>>;
+    readonly procedures: Readonly<Record<string, Readonly<Partial<Record<"caller" | "trusted", readonly LoweredStatement[]>>>>>;
+}
 export interface RuntimePlan {
+    readonly access?: {
+        readonly roles: readonly string[];
+        readonly userFields: Readonly<Record<string, UserFieldSpec>>;
+        readonly warnings: readonly string[];
+    };
     readonly version: typeof RUNTIME_PLAN_VERSION;
     /** The dialect the SQL was compiled for (ADR-0035 decision 5); boot refuses a storage of another. */
     readonly dialect: {
@@ -88,7 +161,8 @@ export interface RuntimePlan {
     readonly views: Readonly<Record<string, PlanView>>;
     readonly procedures: Readonly<Record<string, PlanProcedure>>;
     readonly triggers: Readonly<Record<string, PlanTrigger>>;
+    /** Optional, covered by the fingerprint, and ignored by a runtime it does not match (ADR-0044). */
+    readonly lowered?: PlanLowered;
 }
-/** The native columns a View may output that decode like a field of this type: the entry's timestamps. */
+/** System-column type metadata for View output lineage. */
 export declare const NATIVE_OUTPUT_TYPES: Readonly<Record<string, string>>;
-//# sourceMappingURL=RuntimePlan.d.ts.map

package/dist/{spec → build/spec}/domain/model/SqlIr.d.ts

@@ -8,14 +8,22 @@
  * Pure types and constants only. Nothing here imports the parser.
  */
 import type { DiagnosticCode } from "../../kernel/diagnostic.js";
+import type { UserScope } from "./UserFields.js";
 export type SqlNode = Record<string, any>;
 /** The PostgreSQL grammar version a plan records (libpg-query 18: PG 18.0.4). */
 export declare const PG_GRAMMAR = 180004;
 /** The `SQL_*` codes of the diagnostic kernel; each is described in docs/handbook/reference/diagnostics.md. */
-export type SqlDiagnosticCode = Extract<DiagnosticCode, `SQL_${string}`>;
+export type SqlDiagnosticCode = Extract<DiagnosticCode, `SQL_${string}` | `USER_FIELD_${string}` | "USER_REF_SCOPE_ONLY" | "AUTH_ROLE_REMOVED">;
 export interface SqlSchemaDef {
+    /** Translation reads share their parent's current visibility on this field. */
+    readonly translates?: {
+        readonly parent: string;
+        readonly on: string;
+    };
     /** column that holds the owner; every read and write is filtered on it */
     readonly scope?: string;
+    /** AND-joined value terms of the row template, beside the owner column `scope`. */
+    readonly userScopes?: readonly UserScope[];
     /** a declared timestamptz field the author writes; a row is invisible once it is `ttlSeconds` old (a NULL never expires) */
     readonly ttl?: string;
     readonly ttlSeconds?: number;
@@ -23,6 +31,20 @@ export interface SqlSchemaDef {
     readonly publishing?: boolean;
     /** declared fields and their Mantle types: text integer real bool json timestamptz date numeric(p,s) geo */
     readonly fields: Readonly<Record<string, string>>;
+    /** lower-cased column -> the name the JSON Schema declares (the plan has it; `notNullColumns` reads it with `schema`) */
+    readonly names?: Readonly<Record<string, string>>;
+    /** the Schema's JSON Schema, of which storage reads only what is required and nullable */
+    readonly schema?: {
+        readonly required?: readonly string[];
+        readonly properties?: Readonly<Record<string, {
+            readonly type?: unknown;
+            readonly nullable?: boolean;
+            readonly enum?: readonly unknown[];
+            readonly oneOf?: readonly {
+                readonly const?: unknown;
+            }[];
+        }>>;
+    };
 }
 /**
  * What the allowlist reads off every Schema of a context: computed from `schemas` (`schemaColumns`), once per plan by a caller that
@@ -46,8 +68,8 @@ export interface SqlContext {
     /** a public View: a caller sees published rows only, even across a join */
     readonly public?: boolean;
     /**
-     * The Views a FROM may name (ADR-0037 decision 3), by name with `-` as `_`: an internal View's compiled SELECT, which the
-     * compiler inlines as a subquery, or why that View cannot be read. Compile side only.
+     * The Views a FROM may name (ADR-0037 decision 3), by name with `-` as `_`: an internal View's validated tagged SELECT, which the
+     * compiler expands as D1 CTE dependencies or native FROM subqueries, or why that View cannot be read. Compile side only.
      */
     readonly views?: Readonly<Record<string, {
         readonly select?: SqlNode;
@@ -68,8 +90,8 @@ export interface SqlPlan {
     readonly grammar: number;
     readonly stmts: readonly SqlNode[];
 }
-/** Whether an expression holds a subquery, by structure: a string literal 'SubLink' is not one. */
-export declare function hasSubLink(v: unknown): boolean;
+/** Shared-cache eligibility of validated, expanded View IR; source text is display metadata, not execution. */
+export declare function viewCacheProblem(stmts: readonly SqlNode[], schemas: Readonly<Record<string, SqlSchemaDef>>): string | undefined;
 /**
  * The columns storage creates for a Schema, each with its type: the native ones, the scope field, `status` on a publishing Schema,
  * and each field (a geo field as its `_lat` and `_lng` columns). `created_at`/`updated_at` are typed per dialect, so `native`.
@@ -79,6 +101,16 @@ export declare function storageColumns(s: {
     readonly scope?: string;
     readonly publishing?: boolean;
 }): Map<string, string>;
+/** The native columns storage declares NOT NULL (`status` only on a publishing Schema, the only one that has it); `author_id` is nullable. */
+export declare const NATIVE_NOT_NULL: ReadonlySet<string>;
+/** Each native field a manifest names (in an index, say) -> its storage column, which SQL names. */
+export declare const NATIVE_COLUMNS: Readonly<Record<string, string>>;
+/**
+ * The columns an `operational` Schema's database refuses NULL in beyond the native ones: each field its JSON Schema requires and
+ * does not allow null (a geo field as its two columns). A `publishing` Schema has none: its drafts may be incomplete. This is the one
+ * rule; the initial storage SQL of both dialects and the generated Store's `orderBy` type read it.
+ */
+export declare function notNullColumns(s: SqlSchemaDef): Set<string>;
 /** A field whose name is a column storage creates for something else (`_rid`, or another geo field's `_lat`/`_lng`), or undefined. */
 export declare function storageColumnClash(fields: Readonly<Record<string, string>>): string | undefined;
 /** The functions a Schema check may call, by their bare name: each takes one argument of a type SQLite and PostgreSQL both accept. */
@@ -93,4 +125,3 @@ export declare const CHECK_FUNCTIONS: ReadonlyMap<string, {
  * its own way. Operand types beyond the functions' arguments are the database's to check at boot.
  */
 export declare function checkShapeProblem(v: unknown, columns: ReadonlyMap<string, string>): string | undefined;
-//# sourceMappingURL=SqlIr.d.ts.map

package/dist/build/spec/domain/model/UserFields.d.ts

@@ -0,0 +1,20 @@
+export interface UserFieldSpec {
+    readonly type: "string" | "number";
+    readonly multiple: boolean;
+    readonly enum?: readonly (string | number)[];
+}
+/** One value term of a row template: `column IN auth.user('field')`. */
+export interface UserScope {
+    readonly column: string;
+    readonly field: string;
+    readonly type: "string" | "number";
+}
+export interface RowTemplate {
+    readonly owner?: string;
+    readonly terms: readonly {
+        readonly column: string;
+        readonly field: string;
+    }[];
+}
+/** AND-joined `column = auth.uid()` or `column IN auth.user('field')` terms only. */
+export declare function parseRowTemplate(text: unknown): RowTemplate | string;

package/dist/{spec → build/spec}/domain/service/PlanFingerprint.d.ts

@@ -1,4 +1,7 @@
 import type { RuntimePlan } from "../model/RuntimePlan.js";
+/** JSON with sorted keys, so equal plans serialize to equal text whatever built them. */
+export declare function canonical(v: unknown): string;
+/** 32-bit FNV-1a (hex): a short deterministic name, not a security boundary. */
+export declare const fnv: (s: string) => string;
 /** SHA-256 (hex) of the plan without its own fingerprint: it crosses a trust boundary, so it is cryptographic (ADR-0032 decision 10). */
 export declare function planFingerprint(plan: Omit<RuntimePlan, "fingerprint">): Promise<string>;
-//# sourceMappingURL=PlanFingerprint.d.ts.map

package/dist/{spec → build/spec}/kernel/diagnostic.d.ts

@@ -25,7 +25,7 @@ export type Phase = "validate" | "test" | "boot" | "runtime";
  * Single source of truth: the const array drives `DiagnosticCode`
  * (type), so adding a code is one edit.
  */
-export declare const DIAGNOSTIC_CODES: readonly ["RESOURCE_EXHAUSTED", "RESOURCE_UNAVAILABLE", "RATE_LIMITED", "OUTCOME_UNKNOWN", "PARTIAL_FAILURE", "PRECONDITION_FAILED", "INVALID_MANIFEST_ENVELOPE", "DUPLICATE_NAME", "VIEW_INPUT_INVALID_SHAPE", "VIEW_INPUT_RESERVED_NAME", "VIEW_CACHE_INVALID", "VIEW_UI_INVALID", "REQUIRED_FIELD_UNKNOWN", "INVALID_PATTERN", "JSON_SCHEMA_UNSUPPORTED", "JSON_SCHEMA_REF_INVALID", "JSON_SCHEMA_LIMIT_EXCEEDED", "AUTH_PREDICATE_NOT_IN_ENUM", "GUARD_PROCEDURE_UNKNOWN", "GUARD_SELF_REFERENCE", "GUARD_PROCEDURE_NOT_REF", "GUARD_CHAIN_NOT_ALLOWED", "SCHEMA_INDEX_INVALID", "SCHEMA_INDEX_FIELD_UNKNOWN", "UNIQUE_INDEX_FIELD_UNKNOWN", "SCHEMA_SEARCH_INVALID", "SCHEMA_SEARCH_FIELD_UNKNOWN", "SCHEMA_TTL_INVALID", "SCHEMA_UI_INVALID", "UI_EXTENSION_INVALID", "UI_EXTENSION_UNKNOWN", "UI_EXTENSION_TARGET", "UI_EXTENSION_OPTIONS", "SCHEMA_NAME_CASE_COLLISION", "FIELD_NAME_CASE_COLLISION", "MANIFEST_ROOT_NOT_FOUND", "MANIFEST_READ_FAILED", "GENERATE_FEATURE_DEPENDENCY_MISSING", "SQL_SYNTAX", "SQL_UNSUPPORTED", "SQL_FUNCTION", "SQL_RELATION", "SQL_COLUMN", "SQL_WRITE", "SQL_SHAPE", "SQL_TYPE", "FIXTURE_SCHEMA_VIOLATION", "HANDLER_NOT_REGISTERED", "HANDLER_NOT_DECLARED", "PLAN_FINGERPRINT_MISMATCH", "SCHEDULE_NOT_WIRED", "STORAGE_CHANGE_BLOCKED", "STORAGE_TABLE_NOT_OWNED", "INVOCATION_DEPTH_EXCEEDED", "TRIGGER_TARGET_PROCEDURE_UNKNOWN", "SCHEDULE_INPUT_INVALID", "SCHEDULE_AUTH_INVALID", "TRIGGER_PATH_COLLISION", "TRIGGER_PATH_INVALID", "MCP_TOOL_NAME_COLLISION", "MCP_TOOL_DESCRIPTION_MISSING", "MCP_TOOL_INPUT_UNION_AMBIGUOUS", "MCP_TOOL_INPUT_UNBOUNDED", "MANTLE_REF_INVALID", "PROCEDURE_TARGET_INVALID", "PROCEDURE_NOT_FOUND", "NOT_FOUND", "METHOD_NOT_ALLOWED", "LIFECYCLE_SCHEMA_UNKNOWN", "LIFECYCLE_HOOK_REJECTED", "LIFECYCLE_TARGET_NOT_REF", "SCHEMA_LOCALIZED_REQUIRES_SITE_LOCALES", "TRANSLATES_PARENT_UNKNOWN", "TRANSLATES_REQUIRES_LOCALIZED", "TRANSLATES_REQUIRES_CONTENT_FIELD", "TRANSLATES_FIELD_NOT_IN_PARENT", "TRANSLATES_FIELD_NOT_IN_CHILD", "TRANSLATES_PARENT_IS_LOCALIZED", "SCHEMA_TTL_TRANSLATION_UNSUPPORTED", "INPUT_VALIDATION_FAILED", "UNAUTHENTICATED", "AUTH_DENIED", "ENTITLEMENT_REQUIRED", "CONFLICT", "DISPATCHER_NOT_BUILT", "INTERNAL_ERROR", "OUTPUT_VALIDATION_FAILED", "INVALID_LOCALE", "MEDIA_NOT_CONFIGURED", "SITE_NOT_CONFIGURED", "MEDIA_UPLOAD_EXPIRED", "MEDIA_OBJECT_NOT_FOUND", "MEDIA_MIME_REJECTED", "MEDIA_SIZE_EXCEEDED", "MEDIA_SVG_REJECTED", "MEDIA_CHECKSUM_MISMATCH", "MEDIA_PURPOSE_REJECTED", "MEDIA_VARIANTS_INCOMPLETE", "MEDIA_VARIANT_SIZE_EXCEEDED", "MEDIA_VARIANTS_SUSPICIOUS_SIZE", "MEDIA_ASSET_NOT_FOUND"];
+export declare const DIAGNOSTIC_CODES: readonly ["AUTH_ROLE_REMOVED", "USER_FIELD_VALUES_UNENUMERATED", "USER_FIELD_INVALID", "USER_FIELD_CONFLICT", "USER_FIELD_POSITION", "USER_REF_SCOPE_ONLY", "USER_SCOPE_PUBLIC_ANON_EMPTY", "RESOURCE_EXHAUSTED", "RESOURCE_UNAVAILABLE", "RATE_LIMITED", "OUTCOME_UNKNOWN", "PARTIAL_FAILURE", "PRECONDITION_FAILED", "INVALID_MANIFEST_ENVELOPE", "DUPLICATE_NAME", "VIEW_INPUT_INVALID_SHAPE", "VIEW_INPUT_RESERVED_NAME", "VIEW_CACHE_INVALID", "VIEW_UI_INVALID", "REQUIRED_FIELD_UNKNOWN", "INVALID_PATTERN", "JSON_SCHEMA_UNSUPPORTED", "JSON_SCHEMA_REF_INVALID", "JSON_SCHEMA_LIMIT_EXCEEDED", "AUTH_PREDICATE_NOT_IN_ENUM", "GUARD_PROCEDURE_UNKNOWN", "GUARD_SELF_REFERENCE", "GUARD_PROCEDURE_NOT_REF", "GUARD_CHAIN_NOT_ALLOWED", "SCHEMA_INDEX_INVALID", "SCHEMA_INDEX_FIELD_UNKNOWN", "UNIQUE_INDEX_FIELD_UNKNOWN", "SCHEMA_SEARCH_INVALID", "SCHEMA_SEARCH_FIELD_UNKNOWN", "SCHEMA_TTL_INVALID", "SCHEMA_UI_INVALID", "SCHEMA_NAME_CASE_COLLISION", "SCHEMA_READER_NAME_COLLISION", "FIELD_NAME_CASE_COLLISION", "MANIFEST_ROOT_NOT_FOUND", "MANIFEST_READ_FAILED", "GENERATE_FEATURE_DEPENDENCY_MISSING", "SQL_SYNTAX", "SQL_UNSUPPORTED", "SQL_FUNCTION", "SQL_RELATION", "SQL_COLUMN", "SQL_WRITE", "SQL_SHAPE", "SQL_TYPE", "FIXTURE_SCHEMA_VIOLATION", "HANDLER_NOT_REGISTERED", "HANDLER_NOT_DECLARED", "PLAN_FINGERPRINT_MISMATCH", "SCHEDULE_NOT_WIRED", "STORAGE_CHANGE_BLOCKED", "STORAGE_TABLE_NOT_OWNED", "INVOCATION_DEPTH_EXCEEDED", "TRIGGER_TARGET_PROCEDURE_UNKNOWN", "SCHEDULE_INPUT_INVALID", "SCHEDULE_AUTH_INVALID", "TRIGGER_PATH_COLLISION", "TRIGGER_PATH_INVALID", "MCP_TOOL_NAME_COLLISION", "MCP_TOOL_DESCRIPTION_MISSING", "MCP_TOOL_INPUT_UNION_AMBIGUOUS", "MCP_TOOL_INPUT_UNBOUNDED", "MANTLE_REF_INVALID", "PROCEDURE_TARGET_INVALID", "PROCEDURE_NOT_FOUND", "NOT_FOUND", "METHOD_NOT_ALLOWED", "LIFECYCLE_SCHEMA_UNKNOWN", "LIFECYCLE_HOOK_REJECTED", "LIFECYCLE_TARGET_NOT_REF", "SCHEMA_LOCALIZED_REQUIRES_SITE_LOCALES", "TRANSLATES_PARENT_UNKNOWN", "TRANSLATES_REQUIRES_LOCALIZED", "TRANSLATES_REQUIRES_CONTENT_FIELD", "TRANSLATES_FIELD_NOT_IN_PARENT", "TRANSLATES_FIELD_NOT_IN_CHILD", "TRANSLATES_PARENT_IS_LOCALIZED", "SCHEMA_TTL_TRANSLATION_UNSUPPORTED", "INPUT_VALIDATION_FAILED", "UNAUTHENTICATED", "AUTH_DENIED", "ENTITLEMENT_REQUIRED", "CONFLICT", "DISPATCHER_NOT_BUILT", "INTERNAL_ERROR", "OUTPUT_VALIDATION_FAILED", "INVALID_LOCALE", "MEDIA_NOT_CONFIGURED", "SITE_NOT_CONFIGURED", "MEDIA_UPLOAD_EXPIRED", "MEDIA_OBJECT_NOT_FOUND", "MEDIA_MIME_REJECTED", "MEDIA_SIZE_EXCEEDED", "MEDIA_SVG_REJECTED", "MEDIA_CHECKSUM_MISMATCH", "MEDIA_PURPOSE_REJECTED", "MEDIA_VARIANTS_INCOMPLETE", "MEDIA_VARIANT_SIZE_EXCEEDED", "MEDIA_VARIANTS_SUSPICIOUS_SIZE", "MEDIA_ASSET_NOT_FOUND"];
 export type DiagnosticCode = (typeof DIAGNOSTIC_CODES)[number];
 export interface SourcePosition {
     readonly line: number;
@@ -67,21 +67,6 @@ export interface Diagnostic {
         readonly reason: "lock" | "expect" | "unique";
     };
 }
-/**
- * HTTP status mapping for codes that surface on the wire (runtime
- * phase). Codes not in this map default to 500 when surfaced over
- * HTTP. Validate / test / boot phases don't map to HTTP — they
- * surface in CLI exit codes / thrown errors / Worker init logs.
- *
- * Narrowed to a status-literal union so adding a code with a status
- * outside the v0.1 set fails compile.
- */
-export type RuntimeHttpStatus = 400 | 401 | 402 | 403 | 404 | 405 | 409 | 410 | 412 | 429 | 500 | 501 | 503 | 507;
-export declare const HTTP_STATUS_BY_CODE: Readonly<Partial<Record<DiagnosticCode, RuntimeHttpStatus>>>;
-/** Resolve a Diagnostic's HTTP status for wire egress; unknown codes
- *  default to 500. Lives in the kernel so every adapter shares one
- *  mapping. */
-export declare function httpStatusFor(d: Diagnostic): RuntimeHttpStatus;
 /**
  * Build a Diagnostic with a derived default `message`. Call sites may supply
  * contextual prose, but the structured fields remain authoritative.
@@ -120,18 +105,4 @@ export declare class DiagnosticError extends Error {
     /** First diagnostic — convenience for single-diagnostic call sites. */
     get diagnostic(): Diagnostic;
 }
-/**
- * Strip security-sensitive fields for wire egress. Per ADR-0008:
- * never expose `candidates` to untrusted callers — that leaks
- * schema information. Internal phases (validate / test / boot)
- * skip this redaction.
- */
-export declare function redactForWire(d: Diagnostic): Diagnostic;
-/**
- * Walk a JSON Pointer (RFC 6901) on a value. Returns `undefined` for
- * any miss. Best-effort — used to surface the offending value inside
- * a diagnostic, not for strict pointer dereferencing.
- */
-export declare function readJsonPointer(root: unknown, jsonPointer: string): unknown;
 export {};
-//# sourceMappingURL=diagnostic.d.ts.map

package/dist/bun/assets.d.ts

@@ -0,0 +1,2 @@
+/** Native file response, or null for missing or invalid paths. */
+export declare function bunAdminAssets(root: string): (path: string) => Promise<Response | null>;

package/dist/bun/assets.js

@@ -0,0 +1,24 @@
+/** Bun owns files; no SQLite, runtime or compiler import enters this optional host reader. */
+import { realpath, stat } from "node:fs/promises";
+import { resolve, sep } from "node:path";
+/** Native file response, or null for missing or invalid paths. */
+export function bunAdminAssets(root) {
+    const base = resolve(root);
+    return async (path) => {
+        try {
+            path = decodeURIComponent(path);
+        }
+        catch {
+            return null;
+        }
+        if (/[\u0000-\u001f\\]/.test(path))
+            return null;
+        const target = resolve(base, `.${path}`);
+        if (!target.startsWith(`${base}${sep}`))
+            return null;
+        const physical = await realpath(target).catch(() => "");
+        if (!physical || !physical.startsWith(`${await realpath(base)}${sep}`) || !(await stat(physical)).isFile())
+            return null;
+        return new Response(Bun.file(physical));
+    };
+}

package/dist/domain/adminOrder.js

@@ -0,0 +1,24 @@
+/** Selected Admin orders mirror the existing UI's indexed, required fields and native controls. */
+import { adminIndexColumns, NATIVE_NOT_NULL, notNullColumns } from "../build/compiler.js";
+import { dialect as sqlite } from "../kernel/dialect/sqlite.js";
+import { dialect as postgres } from "../kernel/dialect/postgres.js";
+import { declaredType } from "./columns.js";
+export function adminOrder(schema) {
+    const notNull = notNullColumns(schema);
+    const fields = adminIndexColumns(schema);
+    return Object.fromEntries(["id", "updated_at", ...(schema.publishing ? ["status"] : []), ...fields].flatMap(f => {
+        const type = declaredType(schema.fields, f) ?? "text";
+        const kind = type === "text" ? "text" : type === "bool" ? "bool" : type === "int4" ? "int4" : ["integer", "int8"].includes(type) ? "int" : ["real", "float8"].includes(type) ? "float" : type === "date" ? "date" : type === "timestamptz" ? "timestamp" : undefined;
+        return kind ? [[f, [kind, !NATIVE_NOT_NULL.has(f) && !notNull.has(f)]]] : [];
+    }));
+}
+/** Deployment-only indexes; no request attempts to converge storage. */
+export function adminIndexes(schemas, isSqlite) {
+    const d = isSqlite ? sqlite : postgres;
+    return Object.values(schemas).flatMap(s => ["created_at", "updated_at", ...(s.publishing ? ["status"] : [])].flatMap(field => [[], ...(s.scope ? [[s.scope]] : [])].flatMap(prefix => {
+        const columns = [...prefix, field, "id"];
+        if ([...(s.indexes ?? []), ...(s.unique ?? [])].some(i => columns.every((c, n) => i[n] === c)))
+            return [];
+        return [`CREATE INDEX ${d.ident(`_mantle_admin_${s.name}_${prefix.length ? "scoped_" : ""}${field}`)} ON ${d.ident(s.name)} (${columns.map(d.ident).join(", ")})`];
+    })));
+}

package/dist/domain/columns.js

@@ -0,0 +1,55 @@
+/** What a column's Mantle type means to generated code, in one place: Views, Stores and wire forms all read it here. */
+import { viewOutputs } from "../build/compiler.js";
+/** A column's declared type, including the system version and timestamps. @internal */
+/** A JSON Schema `readOnly` property is server-maintained (counters, totals): Admin's generic writes never set it. */
+export const serverOwned = (schema, column) => Object.entries(schema.properties ?? {}).some(([name, property]) => name.toLowerCase() === column && property?.readOnly === true);
+export const declaredType = (fields, column) => fields[column] ?? (column === "version" ? "integer" : column === "created_at" || column === "updated_at" || column === "published_at" ? "timestamptz" : undefined);
+/** Compiler-owned schema type metadata, including aggregates that inherit a field's presentation type. @internal */
+export function outputType(plan, view, key) {
+    const columns = plan.views[view]?.columns;
+    const field = columns && Object.hasOwn(columns, key) ? columns[key] : undefined;
+    const schema = field && plan.schemas[field.schema];
+    return schema && declaredType(schema.fields, field.field);
+}
+/** Transport lineage excludes expressions/aggregates; existing temporal SQL formatting is retained. */
+export function boundaryType(plan, view, key) {
+    const field = viewOutputs(plan.views[view], plan.schemas, new Map(), false, false).columns[key];
+    const type = outputType(plan, view, key);
+    return field || type === "date" || type === "timestamptz" ? type : undefined;
+}
+/** Declared output lineage only; computed columns retain their native values. */
+export function outputConversions(plan, view, target) {
+    const postgres = target.endsWith("postgres");
+    const columns = viewOutputs(plan.views[view], plan.schemas, new Map(), false, false).columns;
+    return Object.keys(columns).flatMap(key => {
+        const type = outputType(plan, view, key);
+        return conversion(key, type, !postgres);
+    });
+}
+/** Shared static conversion recipe for Views and Admin collections. */
+export function conversion(key, type, sqlite) {
+    return type && ["integer", "int8", "int4"].includes(type) ? [[key, "int"]]
+        : sqlite && (type === "json" || type === "bool") ? [[key, type]] : [];
+}
+/** Client-visible declared output type, identical on every target. */
+export function wireType(type) {
+    const value = !type ? "unknown" : ["integer", "int8", "int4"].includes(type) ? "number | string"
+        : scalarType(type);
+    return value === "unknown" ? value : `${value} | null`;
+}
+const scalarType = (type) => type === "bool" ? "boolean" : ["integer", "int4", "int8", "real", "float8"].includes(type) ? "number" : type === "json" ? "unknown" : type === "geo" ? "{lat:number;lng:number}" : "string";
+/**
+ * The driver-native value a column of this type comes back as, `| null` unless `notNull`; declared timestamps and dates arrive as the
+ * SQL's wire-form text. A column with no declared type (a computed output) is `unknown`, which already includes null. @internal
+ */
+export function nativeType(type, sqlite, notNull = false) {
+    const native = !type ? "unknown" : ["date", "timestamptz"].includes(type) ? "string" : sqlite
+        ? type === "bool" ? "number" : type === "json" ? "string" : scalarType(type)
+        : ["integer", "int8"].includes(type) ? "number | string | bigint" : scalarType(type);
+    return notNull || native === "unknown" ? native : `${native} | null`;
+}
+/** The value a caller of the typed Store passes for a column of this type. JSON is an object or array (the Store tells it by its JS type, so a bare string would be bound as text). @internal */
+export const inputType = (type) => type === "timestamptz" ? "string | Date" : type === "json" ? "object" : scalarType(type);
+/** Wrap only a selected transport page. */
+export const boundaryPage = (page, fields) => fields.length
+    ? `(db, caller, input, paging) => ${page}(db, caller, input, paging).then(page => ({ ...page, rows: wireRows(page.rows, ${JSON.stringify(fields)}) }))` : page;