@aotter/mantle 0.2.0-alpha.7 → 0.2.0-alpha.8

package/README.md

@@ -34,7 +34,7 @@ For transports, `paged/views/<name>.ts` returns `{ rows, nextCursor? }` with key
 [surface deltas](./docs/handbook/reference/surface.md) define the REST/MCP wire contract.
 Proved internal Views also get paging without a public route/tool: one SELECT
 per page, validated scalar cursor keys and hidden-key removal. Schema tuples
-need indexed order after fixed equality prefixes; complete groups and singleton
+need indexed order after fixed equality prefixes ([index prefixes](./docs/handbook/reference/schema.md#index-prefixes-for-paged-views)); complete groups and singleton
 joins are supported. Grouping still scans/aggregates its source: inspect EXPLAIN.
 Unsupported internal SQL retains its bare module.
 
@@ -97,16 +97,21 @@ For `cloudflare-d1` and `cloudflare-postgres`, generation configures Wrangler to
 `mantle bundle <entry> <outdir>` automatically. Node 22.22 or newer is required. Run from the project root;
 regenerate after manifest or auth option changes.
 
-`--entry` defaults to `src/worker.ts`, `--outdir` to `dist`. `--wrangler` defaults to the
+`--entry` defaults to `src/worker.ts`, `--outdir` to `dist`; with `--admin`, `--assets` (Wrangler's `assets.directory`) defaults to `<outdir>/client`. `--wrangler` defaults to the
 existing `wrangler.jsonc`, `wrangler.json` or `wrangler.toml`, otherwise `wrangler.jsonc`.
 JSONC edits preserve comments and unrelated settings and are idempotent. A new config
 needs its `name`, `compatibility_date` and bindings filled in. TOML only prints instructions.
 
-esbuild emits minified split ESM; Wrangler uploads it with `no_bundle`,
-`find_additional_modules`, `base_dir` and an ESModule rule. `nodejs_compat` is ensured.
+esbuild emits minified split ESM into `<outdir>/worker`; Wrangler uploads it with `no_bundle`,
+`find_additional_modules`, `base_dir` and an ESModule rule. Generation ensures
+`nodejs_compat` and defaults to `global_fetch_strictly_public`, including explicit
+environment flag overrides; see [Workers deployment](./docs/handbook/cloudflare/deploy-and-operate.md).
 The metafile guard rejects `better-auth` / `@better-auth/*` in the static startup graph:
 use `authLoader(() => import(...))` ([Auth](./docs/handbook/cloudflare/authentication.md#worker-entry)).
-The output directory is cleaned first; keep source and generated code elsewhere.
+The Worker directory is cleaned first; keep source and generated code elsewhere. A Worker that imports
+`@aotter/mantle-admin/server` also gets Admin, built with Vite into `<assets>/admin` (default `<outdir>/client/admin`)
+from `admin.tsx` beside the entry or the built-in entry. The built-in entry is skipped while the installed
+Admin and its direct dependencies are unchanged; an `admin.tsx` entry builds every time.
 
 ## D1 Sessions
 

package/dist/auth/caller.js

@@ -91,7 +91,8 @@ export async function resolveCaller(request, auth, options = {}) {
         const { oauthProviderResourceClient } = await import("@better-auth/oauth-provider/resource-client");
         const { createDpopReplayStore } = await import("better-auth/oauth2");
         const context = await instance.$context;
-        const verifier = oauthProviderResourceClient(instance).getActions();
+        // Issuance uses the normalized auth context URL, not the raw origin-only baseURL option.
+        const verifier = oauthProviderResourceClient({ options: { ...instance.options, baseURL: context.baseURL, basePath: "" }, $context: instance.$context }).getActions();
         let claims;
         try {
             claims = await verifier.verifyAccessTokenRequest(request, { verifyOptions: { audience: options.audience }, dpop: { replayStore: createDpopReplayStore(context.internalAdapter) } });

package/dist/auth/identity.d.ts

@@ -1,6 +1,6 @@
 /** Optional identity operations. Better Auth owns access control, writes and user hooks. */
 import { type AuthInstance } from "./caller.js";
-import { type Caller, type Postgres } from "../kernel/contracts.js";
+import { type Caller, type Postgres, type Unsafe } from "../kernel/contracts.js";
 import type { Dialect } from "../kernel/dialect/common.js";
 import { type Reader } from "../kernel/driver/d1.js";
 type User = {
@@ -94,7 +94,7 @@ declare function directory(auth: IdentityAuth, _caller: Caller, headers: Headers
 };
 export type IdentityDirectory = ReturnType<typeof directory>;
 export declare const d1Identity: (db: Reader, auth: IdentityAuth, caller: Caller, headers: Headers) => IdentityDirectory;
-export declare const postgresIdentity: (db: Postgres, auth: IdentityAuth, caller: Caller, headers: Headers) => IdentityDirectory;
+export declare const postgresIdentity: (db: Unsafe, auth: IdentityAuth, caller: Caller, headers: Headers) => IdentityDirectory;
 /**
  * Server-side reads of Better Auth users for code without a session (cron, system callers): no SQL against Better Auth's
  * tables, each instance's own table mapping, banned users excluded. Read-only; writes stay with the caller-bound directory.

package/dist/auth/oauth.d.ts

@@ -1,11 +1,43 @@
 import type { oauthProvider } from "@better-auth/oauth-provider";
 import type { AuthInstance } from "./caller.js";
-/** Fail closed for unbound tokens; reconsent cannot resurrect an issued JWT. */
+/**
+ * Fail closed for unbound tokens; reconsent cannot resurrect an issued JWT. As in Better Auth, an `offline_access` grant outlives
+ * the browser session: without a live session it stands on an unrevoked, unexpired offline refresh token for the same user and client.
+ */
 export declare function assertActiveUserGrant(auth: AuthInstance, claims: Record<string, unknown>, audience: string | readonly string[]): Promise<{
     id: string;
 }>;
 /** Add first to oauthProvider/mcp extensions; Better Auth retains ownership of referenceId. */
 export declare const oauthGrantExtension: NonNullable<Parameters<typeof oauthProvider>[0]["extensions"]>[number];
+export declare const OAUTH_GRANT_REVOCATION = "mantle-oauth-grant-revocation";
+/**
+ * Add to the Better Auth plugins with the OAuth provider. An `offline_access` grant outlives sign-out and session expiry
+ * (as in Better Auth), but a successful password reset, a password change that signs out other devices, an admin ban
+ * (`/admin/ban-user`, or `/admin/update-user` setting `banned: true`), an admin session revocation or an admin password
+ * change ends every OAuth grant of that user: tokens, consents and unredeemed codes. So does an email OTP or magic-link
+ * sign-in attempt on an unverified user: Better Auth strips what was set up before that proof, possibly by someone else
+ * who registered the address first, and Mantle ends that party's grants before the attempt is checked.
+ */
+export declare function oauthGrantRevocation(): {
+    id: "mantle-oauth-grant-revocation";
+    hooks: {
+        before: ({
+            matcher: (ctx: import("better-auth").HookEndpointContext) => boolean;
+            handler: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+                context: {
+                    mantleResetPasswordUser: string;
+                };
+            } | undefined>>;
+        } | {
+            matcher: (ctx: import("better-auth").HookEndpointContext) => boolean;
+            handler: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>>;
+        })[];
+        after: {
+            matcher: (ctx: import("better-auth").HookEndpointContext) => boolean;
+            handler: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>>;
+        }[];
+    };
+};
 export interface OAuthConsentRequest {
     readonly clientName: string;
     readonly redirectUri: string;

package/dist/auth/oauth.js

@@ -1,3 +1,4 @@
+import { createAuthMiddleware } from "@better-auth/core/api";
 import { nativeAuthRead } from "./adapter.js";
 import { ContractError } from "../kernel/contracts.js";
 const pair = (field, value) => ({ field, value });
@@ -10,39 +11,147 @@ const array = (value) => {
         return null;
     }
 };
-/** Fail closed for unbound tokens; reconsent cannot resurrect an issued JWT. */
+/**
+ * Fail closed for unbound tokens; reconsent cannot resurrect an issued JWT. As in Better Auth, an `offline_access` grant outlives
+ * the browser session: without a live session it stands on an unrevoked, unexpired offline refresh token for the same user and client.
+ */
 export async function assertActiveUserGrant(auth, claims, audience) {
     const { sub, azp, sid, mantle_consent_id: id, mantle_consent_reference: reference, mantle_skip_consent: skip } = claims;
-    if (![sub, azp, sid].every(x => typeof x === "string" && x.length) || !(skip === true && id === null || typeof id === "string" && id.length))
+    const tokenScopes = typeof claims.scope === "string" ? claims.scope.split(/\s+/).filter(Boolean) : array(claims.scope);
+    const offline = !!tokenScopes?.includes("offline_access");
+    if (![sub, azp].every(x => typeof x === "string" && x.length) || !(offline && sid == null || typeof sid === "string" && sid.length) || !(skip === true && id === null || typeof id === "string" && id.length))
         throw new ContractError("UNAUTHENTICATED", "OAuth token is not bound to a user session.");
     const { exec, param, now, table, column } = nativeAuthRead(auth.options);
-    const c = (field) => `c.${column("oauthConsent", field)}`, s = (field) => `s.${column("session", field)}`, client = (field) => `client.${column("oauthClient", field)}`;
-    const { rows } = await exec(`SELECT ${s("userId")} AS id, ${c("id")} AS "consentId", ${c("referenceId")} AS reference, ${c("resources")} AS resources, ${c("scopes")} AS scopes,
+    const at = now(Date.now());
+    const c = (field) => `c.${column("oauthConsent", field)}`, s = (field) => `s.${column("session", field)}`, client = (field) => `client.${column("oauthClient", field)}`, r = (field) => column("oauthRefreshToken", field);
+    const { rows } = await exec(`SELECT ${s("id")} AS session, ${c("id")} AS "consentId", ${c("referenceId")} AS reference, ${c("resources")} AS resources, ${c("scopes")} AS scopes,
       ${client("skipConsent")} AS "skipConsent", ${client("disabled")} AS disabled, ${client("scopes")} AS "clientScopes"
-    FROM ${table("oauthClient")} client JOIN ${table("session")} s ON ${s("id")} = ${param(1)} AND ${s("userId")} = ${param(2)} AND ${s("expiresAt")} > ${param(3)}
-    LEFT JOIN ${table("oauthConsent")} c ON ${c("id")} = ${param(4)} AND ${c("userId")} = ${s("userId")} AND ${c("clientId")} = ${client("clientId")}
-    WHERE ${client("clientId")} = ${param(5)}`, [sid, sub, now(Date.now()), id, azp]);
+    FROM ${table("oauthClient")} client LEFT JOIN ${table("session")} s ON ${s("id")} = ${param(1)} AND ${s("userId")} = ${param(2)} AND ${s("expiresAt")} > ${param(3)}
+    LEFT JOIN ${table("oauthConsent")} c ON ${c("id")} = ${param(4)} AND ${c("userId")} = ${param(2)} AND ${c("clientId")} = ${client("clientId")}
+    WHERE ${client("clientId")} = ${param(5)}`, [sid ?? null, sub, at, id, azp]);
     const grant = rows[0];
+    const live = !!grant?.session || offline && !!grant && (await exec(`SELECT ${r("scopes")} AS scopes FROM ${table("oauthRefreshToken")}
+    WHERE ${r("userId")} = ${param(1)} AND ${r("clientId")} = ${param(2)} AND ${r("revoked")} IS NULL AND ${r("expiresAt")} > ${param(3)}`, [sub, azp, at])).rows.some(row => array(row.scopes)?.includes("offline_access"));
     const provider = auth.options.plugins?.find(plugin => plugin.id === "oauth-provider");
     const firstParty = skip === true && id === null && !!grant?.skipConsent;
     const resources = firstParty ? (typeof claims.aud === "string" ? [claims.aud] : array(claims.aud)) : array(grant?.resources);
     const scopes = firstParty ? array(grant?.clientScopes) ?? provider?.options?.scopes : array(grant?.scopes);
     const requested = typeof audience === "string" ? [audience] : audience;
     const tokenAudiences = typeof claims.aud === "string" ? [claims.aud] : array(claims.aud) ?? [];
-    const tokenScopes = typeof claims.scope === "string" ? claims.scope.split(/\s+/).filter(Boolean) : array(claims.scope);
-    if (!grant || grant.disabled || !firstParty && (!grant.consentId || (grant.reference ?? null) !== reference) || !resources || !scopes || !tokenScopes || !requested.some(x => resources.includes(x) && tokenAudiences.includes(x)) || !tokenScopes.every(x => scopes.includes(x)))
+    if (!grant || !live || grant.disabled || !firstParty && (!grant.consentId || (grant.reference ?? null) !== reference) || !resources || !scopes || !tokenScopes || !requested.some(x => resources.includes(x) && tokenAudiences.includes(x)) || !tokenScopes.every(x => scopes.includes(x)))
         throw new ContractError("UNAUTHENTICATED", "OAuth authorization grant is no longer active.");
-    return { id: grant.id };
+    return { id: sub };
 }
 /** Add first to oauthProvider/mcp extensions; Better Auth retains ownership of referenceId. */
 export const oauthGrantExtension = {
-    claims: { accessToken: async ({ ctx, user, client, referenceId }) => {
+    claims: { accessToken: async ({ ctx, user, client, referenceId, grantType, scopes, sessionId }) => {
+            // Narrowing away offline_access on refresh would mint a session-bound token for a session that has already ended.
+            if (grantType === "refresh_token" && !scopes.includes("offline_access")) {
+                const session = sessionId ? await ctx.context.adapter.findOne({ model: "session", where: [pair("id", sessionId)] }) : null;
+                if (!session || new Date(session.expiresAt).getTime() <= Date.now())
+                    throw ctx.error("BAD_REQUEST", { error: "invalid_grant", error_description: "The browser session for this grant has ended; keep offline_access or sign in again." });
+            }
             if (client.skipConsent)
                 return { mantle_consent_id: null, mantle_skip_consent: true };
             const consent = user && await ctx.context.adapter.findOne({ model: "oauthConsent", where: [pair("userId", user.id), pair("clientId", client.clientId), { field: "referenceId", value: referenceId ?? null }] });
             return { mantle_consent_id: consent?.id ?? null, mantle_consent_reference: referenceId ?? null };
         } },
 };
+export const OAUTH_GRANT_REVOCATION = "mantle-oauth-grant-revocation";
+/** Password resets (all channels) and an admin password change: the old credential may be compromised, so every session ends too. */
+const RESETS = ["/reset-password", "/email-otp/reset-password", "/phone-number/reset-password", "/admin/set-user-password"];
+const ENDING = [...RESETS, "/change-password", "/admin/ban-user", "/admin/update-user", "/admin/revoke-user-sessions"];
+const RESET_USER = "mantleResetPasswordUser";
+/** Better Auth's email-proof sign-ins: on an unverified user they delete its accounts and sessions (revokeUnprovenAccountAccess). */
+const PROVING = ["/sign-in/email-otp", "/magic-link/verify"];
+/**
+ * Add to the Better Auth plugins with the OAuth provider. An `offline_access` grant outlives sign-out and session expiry
+ * (as in Better Auth), but a successful password reset, a password change that signs out other devices, an admin ban
+ * (`/admin/ban-user`, or `/admin/update-user` setting `banned: true`), an admin session revocation or an admin password
+ * change ends every OAuth grant of that user: tokens, consents and unredeemed codes. So does an email OTP or magic-link
+ * sign-in attempt on an unverified user: Better Auth strips what was set up before that proof, possibly by someone else
+ * who registered the address first, and Mantle ends that party's grants before the attempt is checked.
+ */
+export function oauthGrantRevocation() {
+    return {
+        id: OAUTH_GRANT_REVOCATION,
+        hooks: {
+            // Better Auth consumes the reset token, so its user rides this request's own context to the after hook.
+            before: [{ matcher: ctx => ctx.path === "/reset-password", handler: createAuthMiddleware(async (ctx) => {
+                        // Better Auth reads the token from the body or the query, in that order.
+                        const token = ctx.body?.token || ctx.query?.token;
+                        const value = typeof token === "string" && token ? await ctx.context.internalAdapter.findVerificationValue(`reset-password:${token}`) : null;
+                        if (value)
+                            return { context: { [RESET_USER]: value.value } };
+                    }) }, { matcher: ctx => PROVING.includes(ctx.path ?? ""), handler: createAuthMiddleware(async (ctx) => {
+                        // Before the endpoint, while the user is still unverified and the magic-link token is unconsumed: once Better Auth
+                        // marks the address verified, no later request would tell the pre-registrant's grants apart. A failure here fails
+                        // the request before verification, so a retry ends them. A failed attempt ends them too: an unverified user's grants
+                        // are exactly the pre-hijack risk.
+                        const email = ctx.path === "/sign-in/email-otp" ? ctx.body?.email : await magicLinkEmail(ctx.context, ctx.query?.token);
+                        const found = typeof email === "string" && email ? await ctx.context.internalAdapter.findUserByEmail(email.toLowerCase()) : null;
+                        if (found && !found.user.emailVerified)
+                            await endGrants(ctx.context.adapter, found.user.id);
+                    }) }],
+            // After the endpoint: its own validation and permission checks have passed and it succeeded.
+            after: [{ matcher: ctx => ENDING.includes(ctx.path ?? ""), handler: createAuthMiddleware(async (ctx) => {
+                        const returned = ctx.context.returned, path = ctx.path ?? "";
+                        if (returned instanceof Error || returned instanceof Response && !returned.ok)
+                            return;
+                        const body = ctx.body;
+                        const userId = path === "/reset-password" ? ctx[RESET_USER]
+                            : path === "/email-otp/reset-password" ? typeof body?.email === "string" && (await ctx.context.internalAdapter.findUserByEmail(body.email.toLowerCase()))?.user.id
+                                : path === "/phone-number/reset-password" ? typeof body?.phoneNumber === "string" && (await ctx.context.adapter.findOne({ model: "user", where: [pair("phoneNumber", body.phoneNumber)] }))?.id
+                                    // Better Auth itself ends the other sessions and keeps the current one.
+                                    : path === "/change-password" ? body?.revokeOtherSessions === true && (ctx.context.session?.user.id ?? returned?.user?.id)
+                                        : path === "/admin/update-user" ? body?.data?.banned === true && body.userId
+                                            : body?.userId;
+                        if (typeof userId !== "string" || !userId)
+                            return;
+                        // Sessions first: a live session (perhaps the attacker's) could otherwise authorize a new grant after endGrants.
+                        if (RESETS.includes(path))
+                            await ctx.context.internalAdapter.deleteUserSessions(userId);
+                        await endGrants(ctx.context.adapter, userId);
+                    }) }],
+        },
+    };
+}
+/** The email a magic-link token names, read without consuming it; the token is stored as the magic-link plugin's `storeToken` says. */
+async function magicLinkEmail(context, token) {
+    if (typeof token !== "string" || !token)
+        return;
+    const store = context.options.plugins?.find(plugin => plugin.id === "magic-link")?.options?.storeToken ?? "plain";
+    const hash = typeof store === "object" && store && "hash" in store && typeof store.hash === "function" ? store.hash : undefined;
+    const stored = store === "plain" ? token : hash ? await hash(token)
+        : store === "hashed" ? btoa(String.fromCharCode(...new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(token))))).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "") : undefined;
+    const value = stored === undefined ? null : await context.internalAdapter.findVerificationValue(`magic-link:${stored}`);
+    try {
+        return value ? JSON.parse(value.value).email : undefined;
+    }
+    catch {
+        return;
+    }
+}
+/** Ends a user's grants (for one client, or all): consents, tokens and unredeemed authorization codes. */
+async function endGrants(db, userId, clientId) {
+    const where = [pair("userId", userId), ...clientId ? [pair("clientId", clientId)] : []];
+    // Delete first: even if cleanup fails, every issued JWT fails the live-grant check immediately.
+    await db.deleteMany({ model: "oauthConsent", where });
+    for (const model of ["oauthRefreshToken", "oauthAccessToken"])
+        await db.updateMany({ model, where: [...where, { field: "revoked", value: null }], update: { revoked: new Date() } });
+    // An unredeemed code would mint a new token lineage after reconsent.
+    const code = (v) => { const x = authCode(v); return x?.userId === userId && (!clientId || x.query.client_id === clientId); };
+    const codes = [userId, clientId].filter(x => x !== undefined).map(x => ({ field: "value", operator: "contains", value: JSON.stringify(x) }));
+    for (let offset = 0;;) {
+        const page = await db.findMany({ model: "verification", where: codes, limit: 100, offset, sortBy: { field: "id", direction: "asc" } });
+        const ids = page.filter(v => code(v.value)).map(v => v.id);
+        if (ids.length)
+            await db.deleteMany({ model: "verification", where: [{ field: "id", operator: "in", value: ids }] });
+        if (page.length < 100)
+            break;
+        offset += page.length - ids.length;
+    }
+}
 /** A verification value that is an authorization code, with its user and client; else undefined. */
 function authCode(text) {
     let value;
@@ -93,23 +202,7 @@ export function oauthConsents(auth) {
             const consent = await db.findOne({ model: "oauthConsent", where: [pair("id", consentId), pair("userId", userId)] });
             if (!consent)
                 return false;
-            const where = [pair("userId", userId), pair("clientId", consent.clientId)];
-            // Delete first: even if cleanup fails, every issued JWT fails the live-grant check immediately.
-            await db.deleteMany({ model: "oauthConsent", where });
-            for (const model of ["oauthRefreshToken", "oauthAccessToken"])
-                await db.updateMany({ model, where: [...where, { field: "revoked", value: null }], update: { revoked: new Date() } });
-            // An unredeemed code would mint a new token lineage after reconsent.
-            const code = (v) => { const x = authCode(v); return x?.userId === userId && x.query.client_id === consent.clientId; };
-            const codes = [{ field: "value", operator: "contains", value: JSON.stringify(userId) }, { field: "value", operator: "contains", value: JSON.stringify(consent.clientId) }];
-            for (let offset = 0;;) {
-                const page = await db.findMany({ model: "verification", where: codes, limit: 100, offset, sortBy: { field: "id", direction: "asc" } });
-                const ids = page.filter(v => code(v.value)).map(v => v.id);
-                if (ids.length)
-                    await db.deleteMany({ model: "verification", where: [{ field: "id", operator: "in", value: ids }] });
-                if (page.length < 100)
-                    break;
-                offset += page.length - ids.length;
-            }
+            await endGrants(db, userId, consent.clientId);
             return true;
         },
     };

package/dist/auth/routes.js

@@ -1,5 +1,6 @@
 /** Optional app-mounted auth routes; consent and raw admin routes resolve fresh authority. Better Auth owns tokens. */
 import { checkOrigin, surfaceFailure, ContractError } from "../kernel/contracts.js";
+import { draining } from "../kernel/drain.js";
 import { guardAuthAdminRequest } from "./admin.js";
 import { resolveCaller } from "./caller.js";
 const PRIVATE = { "cache-control": "private, no-store" };
@@ -17,7 +18,7 @@ export function authRoutes(loader, options) {
     if (options.connectedAppsPage && (!options.connectedAppsPage.startsWith("/") || options.connectedAppsPage.startsWith("//") || /[\\\r\n]/.test(options.connectedAppsPage)))
         throw new Error("connectedAppsPage must be a same-origin absolute path.");
     const resolve = options.resolver ?? ((request) => resolveCaller(request, loader));
-    return async (request) => {
+    return draining(async (request) => {
         const { pathname } = new URL(request.url);
         const route = `${request.method} ${pathname}`;
         if (pathname === `${base}/methods` && request.method === "GET")
@@ -47,7 +48,7 @@ export function authRoutes(loader, options) {
         catch (error) {
             return surfaceFailure(error, undefined, `auth ${route}`);
         }
-    };
+    });
 }
 function consentSurface(auth, options) {
     const { listOAuthConsents: list, revokeOAuthConsent: revoke } = auth;

package/dist/build/compiler.d.ts

@@ -1,119 +1,3 @@
-export interface AdminNavGroup {
-    readonly id: string;
-    readonly title: LocalizedText;
-    readonly order?: number;
-}
-export type LocalizedText = string | Readonly<Record<string, string>>;
-export interface AdminExtension {
-    readonly apiVersion?: 1;
-    readonly id: string;
-    readonly title?: LocalizedText;
-    readonly module?: string;
-    readonly integrity?: string;
-    readonly source?: unknown;
-    readonly contributes: AdminExtensionContributions;
-}
-export interface AdminExtensionContributions {
-    readonly pages?: readonly AdminExtensionPage[];
-    readonly settings?: readonly AdminExtensionSettings[];
-    readonly actions?: readonly AdminExtensionAction[];
-    readonly panels?: readonly AdminExtensionPanel[];
-    readonly fields?: readonly AdminExtensionField[];
-}
-export interface AdminExtensionField {
-    readonly id: string;
-    readonly target: AdminFieldTarget;
-    readonly role?: AdminRole;
-    readonly when?: AdminExtensionWhen;
-    readonly optionsSchema?: JsonSchema;
-}
-export type JsonSchema = {
-    readonly $defs?: Readonly<Record<string, JsonSchema>>;
-    readonly $ref?: string;
-    readonly oneOf?: readonly JsonSchema[];
-    readonly const?: unknown;
-    readonly type?: string | readonly string[];
-    readonly properties?: Readonly<Record<string, JsonSchema>>;
-    readonly required?: readonly string[];
-    readonly items?: JsonSchema;
-    readonly enum?: readonly unknown[];
-    readonly format?: string;
-    readonly pattern?: string;
-    readonly minLength?: number;
-    readonly maxLength?: number;
-    readonly minimum?: number;
-    readonly maximum?: number;
-    readonly minItems?: number;
-    readonly maxItems?: number;
-    readonly nullable?: boolean;
-    readonly readOnly?: boolean;
-    readonly default?: unknown;
-    readonly additionalProperties?: boolean | JsonSchema;
-    readonly description?: LocalizedText;
-    readonly title?: LocalizedText;
-    readonly "x-mantle-ref"?: string | MantleRefTarget;
-    readonly "x-mcp-hint"?: string;
-    readonly [key: string]: unknown;
-};
-export interface MantleRefTarget {
-    readonly schema: string;
-    readonly field: string;
-}
-export interface AdminExtensionWhen {
-    readonly schema?: readonly string[];
-    readonly field?: readonly string[];
-    readonly format?: readonly string[];
-}
-export type AdminRole = string;
-export type AdminFieldTarget = (typeof ADMIN_EXTENSION_TARGETS.field)[number];
-export declare const ADMIN_EXTENSION_TARGETS: {
-    readonly action: readonly [
-        "record/v1",
-        "list.selection/v1",
-        "list.toolbar/v1"
-    ];
-    readonly panel: readonly [
-        "record.sidebar/v1",
-        "home/v1"
-    ];
-    readonly field: readonly [
-        "field.input/v1",
-        "field.cell/v1"
-    ];
-};
-export interface AdminExtensionPanel {
-    readonly id: string;
-    readonly title: LocalizedText;
-    readonly role: AdminRole;
-    readonly target: AdminPanelTarget;
-    readonly when?: AdminExtensionWhen;
-}
-export type AdminPanelTarget = (typeof ADMIN_EXTENSION_TARGETS.panel)[number];
-export interface AdminExtensionAction {
-    readonly id: string;
-    readonly title: LocalizedText;
-    readonly role: AdminRole;
-    readonly target: AdminActionTarget;
-    readonly presentation: "run" | "confirm" | "dialog";
-    readonly destructive?: boolean;
-    readonly when?: AdminExtensionWhen;
-}
-export type AdminActionTarget = (typeof ADMIN_EXTENSION_TARGETS.action)[number];
-export interface AdminExtensionSettings {
-    readonly id: string;
-    readonly title: LocalizedText;
-    readonly role: AdminRole;
-    readonly schema: JsonSchema;
-}
-export interface AdminExtensionPage {
-    readonly id: string;
-    readonly title: LocalizedText;
-    readonly role: AdminRole;
-    readonly nav?: {
-        readonly group: string;
-        readonly order?: number;
-    };
-}
 export interface SiteDefaults {
     readonly locales?: ReadonlyArray<string>;
     readonly brand?: string;
@@ -293,10 +177,6 @@ export declare const DIAGNOSTIC_CODES: readonly [
     "SCHEMA_SEARCH_FIELD_UNKNOWN",
     "SCHEMA_TTL_INVALID",
     "SCHEMA_UI_INVALID",
-    "UI_EXTENSION_INVALID",
-    "UI_EXTENSION_UNKNOWN",
-    "UI_EXTENSION_TARGET",
-    "UI_EXTENSION_OPTIONS",
     "SCHEMA_NAME_CASE_COLLISION",
     "SCHEMA_READER_NAME_COLLISION",
     "FIELD_NAME_CASE_COLLISION",
@@ -534,6 +414,39 @@ export interface CtxAuthScopePredicate {
 }
 export type CtxAuthPredicate = "ctx.auth";
 export type CtxUserPredicate = "ctx.user";
+export type JsonSchema = {
+    readonly $defs?: Readonly<Record<string, JsonSchema>>;
+    readonly $ref?: string;
+    readonly oneOf?: readonly JsonSchema[];
+    readonly const?: unknown;
+    readonly type?: string | readonly string[];
+    readonly properties?: Readonly<Record<string, JsonSchema>>;
+    readonly required?: readonly string[];
+    readonly items?: JsonSchema;
+    readonly enum?: readonly unknown[];
+    readonly format?: string;
+    readonly pattern?: string;
+    readonly minLength?: number;
+    readonly maxLength?: number;
+    readonly minimum?: number;
+    readonly maximum?: number;
+    readonly minItems?: number;
+    readonly maxItems?: number;
+    readonly nullable?: boolean;
+    readonly readOnly?: boolean;
+    readonly default?: unknown;
+    readonly additionalProperties?: boolean | JsonSchema;
+    readonly description?: LocalizedText;
+    readonly title?: LocalizedText;
+    readonly "x-mantle-ref"?: string | MantleRefTarget;
+    readonly "x-mcp-hint"?: string;
+    readonly [key: string]: unknown;
+};
+export interface MantleRefTarget {
+    readonly schema: string;
+    readonly field: string;
+}
+export type LocalizedText = string | Readonly<Record<string, string>>;
 export type PlanRestrict = Readonly<Record<string, {
     readonly owner?: string;
     readonly terms: readonly UserScope[];
@@ -586,6 +499,13 @@ export interface UserFieldSpec {
 export declare const RESERVED_PROCEDURE_INPUT_NAMES: readonly [
     "expectedVersion"
 ];
+export declare const INPUT_RULE_KEYWORDS: readonly [
+    "dependentRequired",
+    "anyOf",
+    "if",
+    "then",
+    "else"
+];
 export declare const EXPECTED_VERSION_PROPERTY: "expectedVersion";
 export declare const RESERVED_ENTRY_COLUMNS: readonly [
     "id",
@@ -680,6 +600,7 @@ export interface TranslatesBinding {
     readonly on: string;
 }
 export type Manifest = SchemaManifest | ViewManifest | ProcedureManifest | TriggerManifest;
+export type AdminRole = string;
 export declare function isAdminRole(s: string): s is AdminRole;
 export declare const PROCEDURE_MCP_ANNOTATION_KEYS: readonly [
     "readOnlyHint",
@@ -696,6 +617,7 @@ export declare const VIEW_INPUT_RESERVED: readonly [
     "cursor"
 ];
 export declare function resolveLocalizedText(value: LocalizedText | null | undefined, preferred: string, canonical?: string | null): string | null;
+export declare const isLocalizedText: (v: unknown) => v is LocalizedText;
 export declare const MANTLE_BIND_KEYWORD: "x-mantle-bind";
 export declare const MCP_HINT_KEYWORD: "x-mcp-hint";
 export declare function resolveMantleRef(property: unknown): MantleRefTarget | null;
@@ -706,8 +628,6 @@ export declare function enumOptions(property: JsonSchema | undefined): {
 export declare const MANTLE_REF_KEYWORD: "x-mantle-ref";
 export type MediaMcpHint = "media" | "media-image" | "media-video" | "media-file";
 export declare function isMediaMcpHint(value: unknown): value is MediaMcpHint;
-export declare const isUiExtensionRef: (value: unknown) => value is string;
-export declare const UI_EXTENSION_REF: RegExp;
 export interface Diagnostic {
     readonly code: DiagnosticCode;
     readonly phase: Phase;
@@ -769,6 +689,7 @@ export declare const CHECK_FUNCTIONS: ReadonlyMap<string, {
 }>;
 export declare function storageColumnClash(fields: Readonly<Record<string, string>>): string | undefined;
 export declare function notNullColumns(s: SqlSchemaDef): Set<string>;
+export declare const NATIVE_COLUMNS: Readonly<Record<string, string>>;
 export declare const NATIVE_NOT_NULL: ReadonlySet<string>;
 export declare function storageColumns(s: {
     readonly fields?: Readonly<Record<string, string>>;
@@ -787,4 +708,5 @@ export interface RowTemplate {
 export declare function parseRowTemplate(text: unknown): RowTemplate | string;
 export declare const NATIVE_OUTPUT_TYPES: Readonly<Record<string, string>>;
 export declare function planFingerprint(plan: Omit<RuntimePlan, "fingerprint">): Promise<string>;
+export declare const fnv: (s: string) => string;
 export declare function canonical(v: unknown): string;