@aotter/mantle 0.2.0-alpha.7 → 0.2.0-alpha.9

package/dist/build/spec/domain/model/ManifestGrammar.d.ts

@@ -18,10 +18,6 @@ export type ApiVersion = typeof API_VERSION;
 /** Media-shaped `x-mcp-hint` values — the subset marking a field as
  *  holding a media asset URL. */
 export type MediaMcpHint = "media" | "media-image" | "media-video" | "media-file";
-/** `<extension>/<contribution>`: how `uiSchema` names an Admin extension contribution (ADR-lite 1376). Whether it exists is
- *  checked where the plan meets the extensions, in `createAdminSurface`. */
-export declare const UI_EXTENSION_REF: RegExp;
-export declare const isUiExtensionRef: (value: unknown) => value is string;
 export declare function isMediaMcpHint(value: unknown): value is MediaMcpHint;
 /** Loose JSON Schema shape — we don't constrain it at the type level.
  *  Manifest authoring stays JSON Schema; runtime validators translate
@@ -117,6 +113,8 @@ export declare const MANTLE_BIND_KEYWORD: "x-mantle-bind";
  * with `resolveLocalizedText`.
  */
 export type LocalizedText = string | Readonly<Record<string, string>>;
+/** A non-empty string or a non-empty `{ locale: non-empty string }` map. */
+export declare const isLocalizedText: (v: unknown) => v is LocalizedText;
 /**
  * Resolve a `LocalizedText` value to a single displayable string for
  * `preferred` (typically the viewer's chosen admin language), falling
@@ -305,7 +303,8 @@ export interface ProcedureManifestSpec {
      *  `{ sql }` (write statements, compiled to the plan's IR; ADR-0034). */
     readonly handler: HandlerBinding;
     /** MCP tool annotations the author declares because Core cannot infer
-     *  them for a `ref` handler (#972). Emitted verbatim on the tool;
+     *  them for a `ref` handler (#972). They override the generated defaults
+     *  (`procedureAnnotations`);
      *  An `x-mcp-hint: idempotency-key` input does not infer an
      *  `idempotentHint` annotation in 0.2. A `readOnlyHint: true` on a `sql`
      *  handler, which always writes, is rejected at validation. */
@@ -434,5 +433,7 @@ export declare const RESERVED_ENTRY_COLUMNS: readonly ["id", "status", "version"
  * New reserved names need an ADR (ADR-0022).
  */
 export declare const EXPECTED_VERSION_PROPERTY: "expectedVersion";
+/** Rules between an input object's fields: only View and Procedure input takes them, and AI tool catalogues advertise them as sentences. */
+export declare const INPUT_RULE_KEYWORDS: readonly ["dependentRequired", "anyOf", "if", "then", "else"];
 export declare const RESERVED_PROCEDURE_INPUT_NAMES: readonly ["expectedVersion"];
 export {};

package/dist/build/spec/domain/model/SqlIr.d.ts

@@ -103,6 +103,8 @@ export declare function storageColumns(s: {
 }): Map<string, string>;
 /** The native columns storage declares NOT NULL (`status` only on a publishing Schema, the only one that has it); `author_id` is nullable. */
 export declare const NATIVE_NOT_NULL: ReadonlySet<string>;
+/** Each native field a manifest names (in an index, say) -> its storage column, which SQL names. */
+export declare const NATIVE_COLUMNS: Readonly<Record<string, string>>;
 /**
  * The columns an `operational` Schema's database refuses NULL in beyond the native ones: each field its JSON Schema requires and
  * does not allow null (a geo field as its two columns). A `publishing` Schema has none: its drafts may be incomplete. This is the one

package/dist/build/spec/domain/service/PlanFingerprint.d.ts

@@ -1,5 +1,7 @@
 import type { RuntimePlan } from "../model/RuntimePlan.js";
 /** JSON with sorted keys, so equal plans serialize to equal text whatever built them. */
 export declare function canonical(v: unknown): string;
+/** 32-bit FNV-1a (hex): a short deterministic name, not a security boundary. */
+export declare const fnv: (s: string) => string;
 /** SHA-256 (hex) of the plan without its own fingerprint: it crosses a trust boundary, so it is cryptographic (ADR-0032 decision 10). */
 export declare function planFingerprint(plan: Omit<RuntimePlan, "fingerprint">): Promise<string>;

package/dist/build/spec/kernel/diagnostic.d.ts

@@ -25,7 +25,7 @@ export type Phase = "validate" | "test" | "boot" | "runtime";
  * Single source of truth: the const array drives `DiagnosticCode`
  * (type), so adding a code is one edit.
  */
-export declare const DIAGNOSTIC_CODES: readonly ["AUTH_ROLE_REMOVED", "USER_FIELD_VALUES_UNENUMERATED", "USER_FIELD_INVALID", "USER_FIELD_CONFLICT", "USER_FIELD_POSITION", "USER_REF_SCOPE_ONLY", "USER_SCOPE_PUBLIC_ANON_EMPTY", "RESOURCE_EXHAUSTED", "RESOURCE_UNAVAILABLE", "RATE_LIMITED", "OUTCOME_UNKNOWN", "PARTIAL_FAILURE", "PRECONDITION_FAILED", "INVALID_MANIFEST_ENVELOPE", "DUPLICATE_NAME", "VIEW_INPUT_INVALID_SHAPE", "VIEW_INPUT_RESERVED_NAME", "VIEW_CACHE_INVALID", "VIEW_UI_INVALID", "REQUIRED_FIELD_UNKNOWN", "INVALID_PATTERN", "JSON_SCHEMA_UNSUPPORTED", "JSON_SCHEMA_REF_INVALID", "JSON_SCHEMA_LIMIT_EXCEEDED", "AUTH_PREDICATE_NOT_IN_ENUM", "GUARD_PROCEDURE_UNKNOWN", "GUARD_SELF_REFERENCE", "GUARD_PROCEDURE_NOT_REF", "GUARD_CHAIN_NOT_ALLOWED", "SCHEMA_INDEX_INVALID", "SCHEMA_INDEX_FIELD_UNKNOWN", "UNIQUE_INDEX_FIELD_UNKNOWN", "SCHEMA_SEARCH_INVALID", "SCHEMA_SEARCH_FIELD_UNKNOWN", "SCHEMA_TTL_INVALID", "SCHEMA_UI_INVALID", "UI_EXTENSION_INVALID", "UI_EXTENSION_UNKNOWN", "UI_EXTENSION_TARGET", "UI_EXTENSION_OPTIONS", "SCHEMA_NAME_CASE_COLLISION", "SCHEMA_READER_NAME_COLLISION", "FIELD_NAME_CASE_COLLISION", "MANIFEST_ROOT_NOT_FOUND", "MANIFEST_READ_FAILED", "GENERATE_FEATURE_DEPENDENCY_MISSING", "SQL_SYNTAX", "SQL_UNSUPPORTED", "SQL_FUNCTION", "SQL_RELATION", "SQL_COLUMN", "SQL_WRITE", "SQL_SHAPE", "SQL_TYPE", "FIXTURE_SCHEMA_VIOLATION", "HANDLER_NOT_REGISTERED", "HANDLER_NOT_DECLARED", "PLAN_FINGERPRINT_MISMATCH", "SCHEDULE_NOT_WIRED", "STORAGE_CHANGE_BLOCKED", "STORAGE_TABLE_NOT_OWNED", "INVOCATION_DEPTH_EXCEEDED", "TRIGGER_TARGET_PROCEDURE_UNKNOWN", "SCHEDULE_INPUT_INVALID", "SCHEDULE_AUTH_INVALID", "TRIGGER_PATH_COLLISION", "TRIGGER_PATH_INVALID", "MCP_TOOL_NAME_COLLISION", "MCP_TOOL_DESCRIPTION_MISSING", "MCP_TOOL_INPUT_UNION_AMBIGUOUS", "MCP_TOOL_INPUT_UNBOUNDED", "MANTLE_REF_INVALID", "PROCEDURE_TARGET_INVALID", "PROCEDURE_NOT_FOUND", "NOT_FOUND", "METHOD_NOT_ALLOWED", "LIFECYCLE_SCHEMA_UNKNOWN", "LIFECYCLE_HOOK_REJECTED", "LIFECYCLE_TARGET_NOT_REF", "SCHEMA_LOCALIZED_REQUIRES_SITE_LOCALES", "TRANSLATES_PARENT_UNKNOWN", "TRANSLATES_REQUIRES_LOCALIZED", "TRANSLATES_REQUIRES_CONTENT_FIELD", "TRANSLATES_FIELD_NOT_IN_PARENT", "TRANSLATES_FIELD_NOT_IN_CHILD", "TRANSLATES_PARENT_IS_LOCALIZED", "SCHEMA_TTL_TRANSLATION_UNSUPPORTED", "INPUT_VALIDATION_FAILED", "UNAUTHENTICATED", "AUTH_DENIED", "ENTITLEMENT_REQUIRED", "CONFLICT", "DISPATCHER_NOT_BUILT", "INTERNAL_ERROR", "OUTPUT_VALIDATION_FAILED", "INVALID_LOCALE", "MEDIA_NOT_CONFIGURED", "SITE_NOT_CONFIGURED", "MEDIA_UPLOAD_EXPIRED", "MEDIA_OBJECT_NOT_FOUND", "MEDIA_MIME_REJECTED", "MEDIA_SIZE_EXCEEDED", "MEDIA_SVG_REJECTED", "MEDIA_CHECKSUM_MISMATCH", "MEDIA_PURPOSE_REJECTED", "MEDIA_VARIANTS_INCOMPLETE", "MEDIA_VARIANT_SIZE_EXCEEDED", "MEDIA_VARIANTS_SUSPICIOUS_SIZE", "MEDIA_ASSET_NOT_FOUND"];
+export declare const DIAGNOSTIC_CODES: readonly ["AUTH_ROLE_REMOVED", "USER_FIELD_VALUES_UNENUMERATED", "USER_FIELD_INVALID", "USER_FIELD_CONFLICT", "USER_FIELD_POSITION", "USER_REF_SCOPE_ONLY", "USER_SCOPE_PUBLIC_ANON_EMPTY", "RESOURCE_EXHAUSTED", "RESOURCE_UNAVAILABLE", "RATE_LIMITED", "OUTCOME_UNKNOWN", "PARTIAL_FAILURE", "PRECONDITION_FAILED", "INVALID_MANIFEST_ENVELOPE", "DUPLICATE_NAME", "VIEW_INPUT_INVALID_SHAPE", "VIEW_INPUT_RESERVED_NAME", "VIEW_CACHE_INVALID", "VIEW_UI_INVALID", "REQUIRED_FIELD_UNKNOWN", "INVALID_PATTERN", "JSON_SCHEMA_UNSUPPORTED", "JSON_SCHEMA_REF_INVALID", "JSON_SCHEMA_LIMIT_EXCEEDED", "AUTH_PREDICATE_NOT_IN_ENUM", "GUARD_PROCEDURE_UNKNOWN", "GUARD_SELF_REFERENCE", "GUARD_PROCEDURE_NOT_REF", "GUARD_CHAIN_NOT_ALLOWED", "SCHEMA_INDEX_INVALID", "SCHEMA_INDEX_FIELD_UNKNOWN", "UNIQUE_INDEX_FIELD_UNKNOWN", "SCHEMA_SEARCH_INVALID", "SCHEMA_SEARCH_FIELD_UNKNOWN", "SCHEMA_TTL_INVALID", "SCHEMA_UI_INVALID", "SCHEMA_NAME_CASE_COLLISION", "SCHEMA_READER_NAME_COLLISION", "FIELD_NAME_CASE_COLLISION", "MANIFEST_ROOT_NOT_FOUND", "MANIFEST_READ_FAILED", "GENERATE_FEATURE_DEPENDENCY_MISSING", "SQL_SYNTAX", "SQL_UNSUPPORTED", "SQL_FUNCTION", "SQL_RELATION", "SQL_COLUMN", "SQL_WRITE", "SQL_SHAPE", "SQL_TYPE", "FIXTURE_SCHEMA_VIOLATION", "HANDLER_NOT_REGISTERED", "HANDLER_NOT_DECLARED", "PLAN_FINGERPRINT_MISMATCH", "SCHEDULE_NOT_WIRED", "STORAGE_CHANGE_BLOCKED", "STORAGE_TABLE_NOT_OWNED", "INVOCATION_DEPTH_EXCEEDED", "TRIGGER_TARGET_PROCEDURE_UNKNOWN", "SCHEDULE_INPUT_INVALID", "SCHEDULE_AUTH_INVALID", "TRIGGER_PATH_COLLISION", "TRIGGER_PATH_INVALID", "MCP_TOOL_NAME_COLLISION", "MCP_TOOL_DESCRIPTION_MISSING", "MCP_TOOL_INPUT_UNION_AMBIGUOUS", "MCP_TOOL_INPUT_UNBOUNDED", "MANTLE_REF_INVALID", "PROCEDURE_TARGET_INVALID", "PROCEDURE_NOT_FOUND", "NOT_FOUND", "METHOD_NOT_ALLOWED", "LIFECYCLE_SCHEMA_UNKNOWN", "LIFECYCLE_HOOK_REJECTED", "LIFECYCLE_TARGET_NOT_REF", "SCHEMA_LOCALIZED_REQUIRES_SITE_LOCALES", "TRANSLATES_PARENT_UNKNOWN", "TRANSLATES_REQUIRES_LOCALIZED", "TRANSLATES_REQUIRES_CONTENT_FIELD", "TRANSLATES_FIELD_NOT_IN_PARENT", "TRANSLATES_FIELD_NOT_IN_CHILD", "TRANSLATES_PARENT_IS_LOCALIZED", "SCHEMA_TTL_TRANSLATION_UNSUPPORTED", "INPUT_VALIDATION_FAILED", "UNAUTHENTICATED", "AUTH_DENIED", "ENTITLEMENT_REQUIRED", "CONFLICT", "DISPATCHER_NOT_BUILT", "INTERNAL_ERROR", "OUTPUT_VALIDATION_FAILED", "INVALID_LOCALE", "MEDIA_NOT_CONFIGURED", "SITE_NOT_CONFIGURED", "MEDIA_UPLOAD_EXPIRED", "MEDIA_OBJECT_NOT_FOUND", "MEDIA_MIME_REJECTED", "MEDIA_SIZE_EXCEEDED", "MEDIA_SVG_REJECTED", "MEDIA_CHECKSUM_MISMATCH", "MEDIA_PURPOSE_REJECTED", "MEDIA_VARIANTS_INCOMPLETE", "MEDIA_VARIANT_SIZE_EXCEEDED", "MEDIA_VARIANTS_SUSPICIOUS_SIZE", "MEDIA_ASSET_NOT_FOUND"];
 export type DiagnosticCode = (typeof DIAGNOSTIC_CODES)[number];
 export interface SourcePosition {
     readonly line: number;

package/dist/domain/describe/{chunk-ZIQVLA7X.js → chunk-ZVXBGP7Y.js}

@@ -11,11 +11,43 @@ function resolveLocalizedText(value, preferred, canonical2) {
   const firstKey = Object.keys(value)[0];
   return firstKey !== void 0 ? value[firstKey] : null;
 }
+var INPUT_RULE_KEYWORDS = ["dependentRequired", "anyOf", "if", "then", "else"];
+
+// src/build/spec/domain/service/RootRefChain.ts
+function lookupLocalRef(root, ref) {
+  if (typeof ref !== "string" || !ref.startsWith("#/")) return void 0;
+  let value = root;
+  try {
+    for (const key of decodeURIComponent(ref.slice(2)).split("/").map((key2) => key2.replace(/~1/g, "/").replace(/~0/g, "~"))) value = value && typeof value === "object" && Object.hasOwn(value, key) ? value[key] : void 0;
+  } catch {
+    return void 0;
+  }
+  return value && typeof value === "object" ? value : void 0;
+}
+function rootRefChain(input) {
+  const chain = [];
+  for (let schema = input; schema !== void 0; schema = lookupLocalRef(input, schema.$ref)) {
+    if (chain.includes(schema)) return void 0;
+    chain.push(schema);
+    if (schema.$ref === void 0) return chain;
+  }
+  return void 0;
+}
 
 // src/build/spec/domain/service/McpToolNaming.ts
 function mcpToolNameSegment(name) {
   return name.toLowerCase().replace(/-/g, "_");
 }
+function toolTitle(name) {
+  const words = name.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/[-_.\s]+/g, " ").trim().toLowerCase();
+  return words.charAt(0).toUpperCase() + words.slice(1);
+}
+var viewAnnotations = { readOnlyHint: true, destructiveHint: false };
+function procedureAnnotations(p) {
+  const readOnlyHint = p.mcp?.readOnlyHint ?? false;
+  return { readOnlyHint, destructiveHint: !readOnlyHint && ("ref" in p.handler || overwrites(p.handler.sql.stmts)), ...p.mcp };
+}
+var overwrites = (node) => !!node && typeof node === "object" && ("DeleteStmt" in node || "UpdateStmt" in node || node.onConflictClause?.action === "ONCONFLICT_UPDATE" || Object.values(node).some(overwrites));
 function mcpTools(plan, surface, locale = "en") {
   const text = (t) => resolveLocalizedText(t, locale, "en") ?? void 0;
   const tools = /* @__PURE__ */ new Map();
@@ -32,33 +64,61 @@ function mcpTools(plan, surface, locale = "en") {
       name: mcpToolNameSegment(t.procedure),
       kind: "procedure",
       source: t.procedure,
-      ...title ? { title } : {},
+      title: title ?? toolTitle(t.procedure),
       description: text(p.description) ?? title ?? t.procedure,
       inputSchema: p.input,
       // structuredContent must be an object
       ...p.output.type === "object" ? { outputSchema: p.output } : {},
-      ...p.mcp ? { annotations: p.mcp } : {},
+      annotations: procedureAnnotations(p),
       requires: p.requires
     });
   }
   for (const [name, v] of Object.entries(plan.views)) {
     if (v.surface !== surface) continue;
-    const props = v.input?.properties ?? {};
+    const chain = (v.input ? rootRefChain(v.input) ?? [v.input] : []).reverse();
+    const props = Object.assign({}, ...chain.map((s) => s.properties ?? {}));
+    const required = [...new Set(chain.flatMap((s) => s.required ?? []))];
     if ("limit" in props || "cursor" in props) throw new TypeError(`View '${name}' declares an input named limit or cursor; the MCP tool reserves both for paging.`);
+    const rules = chain.map((s) => Object.fromEntries(INPUT_RULE_KEYWORDS.flatMap((k) => s[k] === void 0 ? [] : [[k, s[k]]]))).filter((r) => Object.keys(r).length);
+    const defs = v.input ? referencedDefs(v.input, props) : {};
     const title = text(v.title);
     add({
       name: mcpToolNameSegment(name),
       kind: "view",
       source: name,
-      ...title ? { title } : {},
+      title: title ?? toolTitle(name),
       description: text(v.description) ?? title ?? name,
-      inputSchema: { type: "object", properties: { ...props, limit: { type: "integer", minimum: 1, maximum: 500 }, cursor: { type: "string" } }, ...v.input?.required ? { required: v.input.required } : {} },
-      annotations: { readOnlyHint: true },
+      inputSchema: {
+        type: "object",
+        properties: { ...props, limit: { type: "integer", minimum: 1, maximum: 500 }, cursor: { type: "string" } },
+        ...required.length ? { required } : {},
+        ...rules.length > 1 ? { allOf: rules } : rules[0],
+        ...Object.keys(defs).length ? { $defs: defs } : {}
+      },
+      annotations: viewAnnotations,
       requires: v.requires
     });
   }
   return [...tools.values()];
 }
+function referencedDefs(root, node, found = {}) {
+  if (!node || typeof node !== "object") return found;
+  const ref = node.$ref, [head, segment] = typeof ref === "string" && ref.startsWith("#/") ? decoded(ref.slice(2)).split("/") : [];
+  const key = head === "$defs" ? segment?.replace(/~1/g, "/").replace(/~0/g, "~") : void 0;
+  if (key !== void 0 && !Object.hasOwn(found, key) && root.$defs && Object.hasOwn(root.$defs, key)) {
+    found[key] = root.$defs[key];
+    referencedDefs(root, found[key], found);
+  }
+  for (const child of Object.values(node)) referencedDefs(root, child, found);
+  return found;
+}
+var decoded = (pointer) => {
+  try {
+    return decodeURIComponent(pointer);
+  } catch {
+    return "";
+  }
+};
 
 // src/build/spec/domain/service/PlanFingerprint.ts
 function canonical(v) {
@@ -187,6 +247,7 @@ var adminRoutes = [
   "GET /bootstrap",
   "GET /views/:name/export",
   "GET /views/:name",
+  "GET /view-batch",
   "GET /developer/views/:name",
   "POST /operations/:name",
   "GET /developer-console",
@@ -310,9 +371,9 @@ function targetDefinitions(plan) {
     generated.push(d);
   }
   for (const route of adminRoutes) {
-    const deps = route.includes("/views/:") ? declarations.filter((d2) => d2.kind === "view" && (route.includes("/developer/") || plan.views[d2.id.slice(5)]?.surface === "admin")) : route.includes("/operations/:") ? declarations.filter((d2) => adminOperations.has(d2.id)) : route === "POST /webmcp/:tool" ? declarations.filter((d2) => mcpTools(plan, "admin").some((t) => `${t.kind}:${t.source}` === d2.id)).concat(generated) : [];
+    const deps = route.includes("/views/:") || route === "GET /view-batch" ? declarations.filter((d2) => d2.kind === "view" && (route.includes("/developer/") || plan.views[d2.id.slice(5)]?.surface === "admin")) : route.includes("/operations/:") ? declarations.filter((d2) => adminOperations.has(d2.id)) : route === "POST /webmcp/:tool" ? declarations.filter((d2) => mcpTools(plan, "admin").some((t) => `${t.kind}:${t.source}` === d2.id)).concat(generated) : [];
     const generic = route.includes("/entries") || route.includes("/statistics") || route === "GET /bootstrap";
-    addRoute(`admin:${route}`, deps, deps.length ? { ...objectInput, anyOf: deps.map((d2) => ({ type: "object", properties: { [route.includes("/webmcp/") ? "tool" : "name"]: { type: "string", const: route.includes("/webmcp/") ? d2.name : d2.id.slice(d2.kind === "view" ? 5 : 10) } } })) } : objectInput);
+    addRoute(`admin:${route}`, deps, deps.length && route !== "GET /view-batch" ? { ...objectInput, anyOf: deps.map((d2) => ({ type: "object", properties: { [route.includes("/webmcp/") ? "tool" : "name"]: { type: "string", const: route.includes("/webmcp/") ? d2.name : d2.id.slice(d2.kind === "view" ? 5 : 10) } } })) } : objectInput);
     const d = out.at(-1);
     if (generic) {
       const operation = route === "POST /entries" ? "create" : route === "DELETE /entries/:id" ? "delete" : route.startsWith("GET ") ? void 0 : route.endsWith("/publish") ? "publish" : "update";

package/dist/domain/describe/index.js

@@ -3,7 +3,7 @@ import {
   hashDefinition,
   targetDefinitions,
   targetHash
-} from "./chunk-ZIQVLA7X.js";
+} from "./chunk-ZVXBGP7Y.js";
 
 // src/domain/describe/index.ts
 function requirements(d, surface) {

package/dist/domain/describe/target-hash.js

@@ -3,7 +3,7 @@ import {
   hash,
   hashDefinition,
   targetHash
-} from "./chunk-ZIQVLA7X.js";
+} from "./chunk-ZVXBGP7Y.js";
 export {
   canonical,
   hash,

package/dist/domain/describe/targets.d.ts

@@ -36,5 +36,5 @@ export declare function inspectSql(value: unknown): {
     }[];
 };
 /** Built-in Admin API templates, relative to the configured Admin API base. */
-export declare const adminRoutes: readonly ["GET /me", "GET /site", "GET /collections", "GET /views-manifest", "GET /operations", "GET /webmcp", "POST /webmcp/:tool", "GET /bootstrap", "GET /views/:name/export", "GET /views/:name", "GET /developer/views/:name", "POST /operations/:name", "GET /developer-console", "GET /collections/:name/statistics", "GET /entries", "GET /entries/export", "GET /entries/:id", "POST /entries", "PATCH /entries/:id", "POST /entries/:id/publish", "POST /entries/:id/unpublish", "POST /entries/:id/archive", "DELETE /entries/:id", "GET /site-settings", "PATCH /site-settings", "POST /media/uploads", "POST /media/uploads/:groupId/commit", "GET /media", "GET /media/:id", "PATCH /media/:id", "DELETE /media/:id", "GET /admin", "GET /members", "PATCH /admin/:id/role", "POST /admin/invitations", "DELETE /admin/invitations/:id"];
+export declare const adminRoutes: readonly ["GET /me", "GET /site", "GET /collections", "GET /views-manifest", "GET /operations", "GET /webmcp", "POST /webmcp/:tool", "GET /bootstrap", "GET /views/:name/export", "GET /views/:name", "GET /view-batch", "GET /developer/views/:name", "POST /operations/:name", "GET /developer-console", "GET /collections/:name/statistics", "GET /entries", "GET /entries/export", "GET /entries/:id", "POST /entries", "PATCH /entries/:id", "POST /entries/:id/publish", "POST /entries/:id/unpublish", "POST /entries/:id/archive", "DELETE /entries/:id", "GET /site-settings", "PATCH /site-settings", "POST /media/uploads", "POST /media/uploads/:groupId/commit", "GET /media", "GET /media/:id", "PATCH /media/:id", "DELETE /media/:id", "GET /admin", "GET /members", "PATCH /admin/:id/role", "POST /admin/invitations", "DELETE /admin/invitations/:id"];
 export declare function targetDefinitions(plan: RuntimePlan): TargetDefinition[];

package/dist/domain/generated-tools.js

@@ -1,4 +1,6 @@
 export const publishingTransitions = [["publish", ["draft"], "published"], ["unpublish", ["published", "archived"], "draft"], ["archive", ["draft", "published"], "archived"]];
+/** Only archive withdraws an entry from both drafts and the public. */
+export const publishingAnnotations = (verb) => ({ readOnlyHint: false, destructiveHint: verb === "archive" });
 export const publishingInput = { type: "object", properties: { id: { type: "string", minLength: 1 }, expectedVersion: { type: "integer", minimum: 1 } }, required: ["id", "expectedVersion"], additionalProperties: false };
 export function mediaDefinitions() {
     const define = (name, description, inputSchema, action, readOnlyHint = false) => ({ name, description, inputSchema, action, annotations: { readOnlyHint, destructiveHint: action === "delete", openWorldHint: true } });

package/dist/domain/paging.js

@@ -1,8 +1,15 @@
 /** Build-time proofs for the compiler's keyset keys. No AST reaches a generated operation. */
-import { NATIVE_NOT_NULL, notNullColumns } from "../build/compiler.js";
+import { NATIVE_COLUMNS, NATIVE_NOT_NULL, notNullColumns } from "../build/compiler.js";
 import { declaredType } from "./columns.js";
+/** Storage column -> the native field a manifest index names. */
+const NATIVE_FIELDS = new Map(Object.entries(NATIVE_COLUMNS).map(([field, column]) => [column, field]));
 const fieldName = (n) => n.ColumnRef?.fields?.at(-1)?.String?.sval;
 const scalar = (n) => !!(n.ParamRef || n.A_Const || n.TypeCast && scalar(n.TypeCast.arg));
+// A user-field term lowers to the dialect's anyOf, `(col) IN (SELECT value FROM json_each((?)))` or `(col) = ANY(CAST(...(?)...))`.
+const anyOf = (raw) => raw?.length === 8 && raw[1]?.ColumnRef && raw[5]?.ParamRef && /^ (IN \(SELECT value FROM json_each\(|= ANY\()/.test(raw[3]);
+// A scope prints `/*s:field*/ kept /*|*/ kept OR 1 = 1 /*;*/`, so `{ all: true }` drops it; any other anyOf is a restrict, which it never lifts.
+const scopeTerm = (raw) => typeof raw?.[0] === "string" && raw[0].startsWith("/*s:");
+const restricts = (n) => !!n && typeof n === "object" && (anyOf(n.Raw?.parts) || !scopeTerm(n.Raw?.parts) && Object.values(n).some(restricts));
 const aggregate = (n) => !!n && !n.SubLink && !n.SelectStmt && (n.FuncCall && !n.FuncCall.over && ["count", "sum", "min", "max", "avg"].includes(n.FuncCall.funcname?.at(-1)?.String?.sval) || Object.values(n).some(v => v && typeof v === "object" && (Array.isArray(v) ? v.some(aggregate) : aggregate(v))));
 /** Only complete grouped tuples, base ids and non-fanning singleton joins are proved. */
 export function provePaging(plan, ast) {
@@ -59,7 +66,7 @@ export function provePaging(plan, ast) {
                     const type = declaredType(schema.fields, name) ?? (name === "version" ? "integer" : "text");
                     fields.set(name, { schema, name, type, notNull: NATIVE_NOT_NULL.has(name) || notNull.has(name), source });
                 }
-                fact = { fields, names: new Set(fields.keys()), single: false, unique: true, fixed: new Set() };
+                fact = { fields, names: new Set(fields.keys()), single: false, unique: true, fixed: new Set(), sets: new Set() };
             }
             else if (r?.mantle === "cte")
                 fact = ctes.get(r.relname);
@@ -72,7 +79,7 @@ export function provePaging(plan, ast) {
                         if (!sources.has(f.source))
                             sources.set(f.source, {});
                         return [name, { ...f, source: sources.get(f.source) }];
-                    })), fixed: new Set(fact.fixed) };
+                    })), fixed: new Set(fact.fixed), sets: new Set(fact.sets) };
                 aliases.set(r?.alias?.aliasname ?? r?.relname ?? sub.alias.aliasname, fact);
             }
             return fact;
@@ -86,7 +93,7 @@ export function provePaging(plan, ast) {
             if (!base || !r.single)
                 base = r;
         }
-        base ??= { fields: new Map(), names: new Set(), single: true, unique: false, fixed: new Set() };
+        base ??= { fields: new Map(), names: new Set(), single: true, unique: false, fixed: new Set(), sets: new Set() };
         const targets = new Map((s.targetList ?? []).map((t) => [t.ResTarget.name ?? fieldName(t.ResTarget.val), t.ResTarget.val]));
         const resolve = (n, output = true) => {
             const fields = n?.ColumnRef?.fields;
@@ -110,16 +117,15 @@ export function provePaging(plan, ast) {
         const fixed = (n) => {
             if (n?.BoolExpr?.boolop === "AND_EXPR")
                 n.BoolExpr.args.forEach(fixed);
-            // `col IN auth.user(field)` (a scope or restrict) is fixed like an equality, fanning out over the caller's values:
-            // ADR-0046 §Paging, cost elements × limit. A scope prints `/*s:field*/ kept /*|*/ kept OR 1 = 1 /*;*/`; `kept` is
-            // the dialect's anyOf lowering, `(col) IN (SELECT value FROM json_each((?)))` or `(col) = ANY(CAST(...(?)...))`.
+            // `col IN auth.user(field)` (a scope or restrict) never fixes a prefix (#1644): the plan is prepared for a set, so
+            // native ORDER BY after it reads and sorts all the caller's rows. It is only remembered for the refusal's guidance.
             const raw = n?.Raw?.parts;
-            if (raw && typeof raw[0] === "string" && raw[0].startsWith("/*s:"))
+            if (scopeTerm(raw))
                 return fixed(raw[1]);
-            if (raw?.length === 8 && raw[1]?.ColumnRef && raw[5]?.ParamRef && /^ (IN \(SELECT value FROM json_each\(|= ANY\()/.test(raw[3])) {
+            if (anyOf(raw)) {
                 const col = resolve(raw[1], false);
                 if (col && col.source === base.fields.get("id")?.source)
-                    base.fixed.add(col.name);
+                    base.sets.add(col.name);
                 return;
             }
             const e = n?.A_Expr;
@@ -162,19 +168,39 @@ export function provePaging(plan, ast) {
                     const schema = order[0].schema;
                     if (order.some(f => f.source !== base.fields.get("id")?.source))
                         return;
-                    const indexed = [...(schema.indexes ?? []), ...(schema.unique ?? [])].some(index => {
+                    const serving = (prefix) => [...(schema.indexes ?? []), ...(schema.unique ?? [])].find(index => {
                         let i = 0;
-                        while (i < index.length && base.fixed.has(index[i]) && index[i] !== order[0].name)
+                        while (i < index.length && prefix.has(index[i]) && index[i] !== order[0].name)
                             i++;
                         return order.every((f, n) => index[i + n] === f.name);
                     });
-                    if (!indexed)
-                        return fail(`Missing index for ORDER BY (${order.map(f => f.name).join(", ")}): declare a Schema index with these ordered columns after any fixed equality prefix.`);
+                    if (!serving(base.fixed)) {
+                        // SQL names a column (`created_at`), a manifest index the field (`createdAt`).
+                        const index = serving(new Set([...base.fixed, ...base.sets])), named = (c) => schema.names?.[c] ?? c, field = (c) => schema.names?.[c] ?? NATIVE_FIELDS.get(c) ?? c;
+                        const columns = order.map(f => named(f.name)).join(", "), fields = order.map(f => field(f.name)).join(", ");
+                        if (!index)
+                            return fail(`Missing index for ORDER BY (${columns}): declare a Schema index with [${fields}] in this order after any fixed equality prefix.`);
+                        const prefix = index.slice(0, index.indexOf(order[0].name)), set = prefix.filter(c => !base.fixed.has(c));
+                        // The suggested order is the index from its first set-bound column: an equality-fixed column between stays in it.
+                        const lead = prefix.slice(prefix.indexOf(set[0])), quoted = (cs) => cs.map(c => `'${field(c)}'`).join(", ");
+                        // The scope-first order is offered only when SQL can name every added column and none can be null. The owner
+                        // scope column is NOT NULL in storage, but a View cannot address it.
+                        const notNull = notNullColumns(schema), owner = lead.filter(c => c === schema.scope), nullable = lead.filter(c => !NATIVE_NOT_NULL.has(c) && !notNull.has(c) && c !== schema.scope);
+                        const dir = (f) => sorts[keys.indexOf(f)].SortBy.sortby_dir === "SORTBY_DESC" ? " DESC" : "";
+                        const sorted = [...lead.map(c => named(c) + dir(order[0])), ...order.map(f => named(f.name) + dir(f))].join(", ");
+                        const desc = order.some(f => dir(f)) ? ", read backwards; on PostgreSQL confirm with EXPLAIN that no Sort remains" : "";
+                        // `{ all: true }` drops only scope terms: offer it an index on the View's equality-fixed columns, unless a restrict remains.
+                        const eq = [...base.fixed].filter(c => c !== "id" && !order.some(f => f.name === c));
+                        const ways = [...nullable.length || owner.length ? [] : [`ORDER BY ${sorted} (same index${desc})`], ...restricts(ast) ? [] : [`for { all: true } callers only, index [${[...eq.map(field), fields].join(", ")}, id]`]];
+                        const why = [...owner.length ? [`${quoted(owner)} is the owner column, which SQL cannot name`] : [], ...nullable.length ? [`${quoted(nullable)} can be null`] : []];
+                        const unavailable = why.length ? ` Scope-first ORDER BY unavailable: ${why.join("; ")}${ways.length ? "." : ""}` : "";
+                        return fail(`ORDER BY (${columns}) needs index [${index.map(field).join(", ")}] past ${quoted(set)}, which a user-field scope or restrict binds to a set of values: every page would sort all of the caller's rows.${unavailable}${ways.length ? ` Bounded: ${ways.join("; ")}` : ""} (handbook: reference/schema.md#index-prefixes-for-paged-views).`);
+                    }
                 }
             }
         }
         const single = base.single || !group.length && (s.targetList ?? []).some((t) => aggregate(t.ResTarget.val)) || s.limitCount?.A_Const?.ival?.ival === 1 || base.unique && base.fixed.has("id");
-        return { relation: { fields, names: new Set(targets.keys()), single, unique: !group.length && base.unique && !!same(fields.get("id"), base.fields.get("id")), fixed: base.fixed }, keys: keys };
+        return { relation: { fields, names: new Set(targets.keys()), single, unique: !group.length && base.unique && !!same(fields.get("id"), base.fields.get("id")), fixed: base.fixed, sets: base.sets }, keys: keys };
     };
     const result = select(ast.SelectStmt);
     return result ? { types: result.keys.map(f => f.type), single: result.relation.single } : reason ? { types: [], single: false, reason } : undefined;

package/dist/infrastructure/bundle.js

@@ -1,7 +1,9 @@
-import { existsSync, readFileSync, realpathSync, rmSync } from "node:fs";
-import { relative, resolve, sep } from "node:path";
+import { existsSync, readFileSync, realpathSync, rmSync, writeFileSync } from "node:fs";
+import { createRequire } from "node:module";
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { pathToFileURL } from "node:url";
 import { build } from "esbuild";
-import { INPUTS_FILE, authTableSql, extraRoles, staleInputs } from "./inputs.js";
+import { INPUTS_FILE, authTableSql, extraRoles, generatedTarget, staleInputs } from "./inputs.js";
 /** Only static imports run at startup; dynamic imports remain separate uploaded modules. */
 export function startupGraph(metafile, entry) {
     const visited = new Set();
@@ -25,6 +27,8 @@ const refused = [
     [/(?:^|\/)node_modules\/@modelcontextprotocol\//, "Load MCP through a request-time import(...)."],
     // the compiler: the package's own generator layers (installed, or workspace dist/source) and its parser, YAML and SQL dependencies
     [/(?:^|\/)node_modules\/(?:@aotter\/mantle\/dist\/(?:build|infrastructure)\/|yaml\/|pgsql-deparser\/|libpg-query\/)|(?:^|\/)mantle\/(?:dist|src)\/(?:build|infrastructure)\//, "Generator code must not run in a Worker; import runtime entry points such as @aotter/mantle/rest."],
+    // Admin's UI is built into <assets>/admin by the app's admin.tsx; the Worker serves it, never runs it.
+    [/(?:^|\/)node_modules\/@aotter\/mantle-admin\/dist\/admin-app\/|(?:^|\/)mantle-admin\/(?:dist\/admin-app|admin\/src)\//, "Admin's UI (@aotter/mantle-admin/app, /hooks) runs in the browser: import it only from src/admin.tsx, which `mantle bundle` builds into the assets directory."],
 ];
 export function guardStartup(metafile, entry) {
     for (const name of startupGraph(metafile, entry)) {
@@ -37,14 +41,118 @@ export function guardStartup(metafile, entry) {
         }
     }
 }
+/** The physical spelling of a path, including a nonexistent tail below its nearest existing ancestor. */
+const physical = (input) => {
+    let found = resolve(input);
+    const tail = [];
+    while (!existsSync(found)) {
+        const parent = dirname(found);
+        if (parent === found)
+            return found;
+        tail.unshift(basename(found));
+        found = parent;
+    }
+    return resolve(realpathSync(found), ...tail);
+};
+/** Whether `inner` is `outer` or inside it. */
+const within = (outer, inner) => {
+    const path = relative(physical(outer), physical(inner));
+    return path === "" || (path !== ".." && !path.startsWith(`..${sep}`) && !isAbsolute(path));
+};
+/** A directory a build empties must not be the working directory or hold the source entry. */
+function assertCleanable(label, dir, entry) {
+    if (physical(dir) === physical(process.cwd()))
+        throw new Error(`${label} must not be the working directory: it is cleaned before building.`);
+    if (within(dir, entry))
+        throw new Error(`${label} must not contain the source entry: it is cleaned before building.`);
+}
+/**
+ * `mantle bundle <entry> <outdir> [--assets <dir>]`: the Worker into `<outdir>/worker`, and Admin into `<assets>/admin`
+ * (default `<outdir>/client`) when the Worker serves it (`@aotter/mantle-admin/server`; `/mcp` and the other subpaths alone do not).
+ * A server whose generated output records a `bun-*` target runs as TypeScript, so only its Admin is built.
+ */
+export async function bundleApp(entry, outdir, assets = join(outdir, "client")) {
+    const source = realpathSync(entry);
+    // what is cleaned lies under these two, so neither may be the working directory or hold the source
+    assertCleanable("Bundle outdir", outdir, source);
+    assertCleanable("The assets directory", assets, source);
+    // The app's own modules only: enough to find its generated output and whether it imports the Admin server.
+    const { metafile: own } = await build({ entryPoints: [entry], bundle: true, write: false, metafile: true, packages: "external", format: "esm", platform: "neutral", logLevel: "silent" });
+    if (generatedDirs(own).some(dir => generatedTarget(join(dir, "generated.ts"))?.startsWith("bun-"))) {
+        // Packages are external here, so only the app's own imports of the Admin server are seen; one reached through another package is not.
+        if (Object.values(own.inputs).some(input => input.imports.some(imported => /^@aotter\/mantle-admin\/server(?:\/|$)/.test(imported.path))))
+            await bundleAdmin(source, outdir, join(assets, "admin"));
+        else
+            console.warn("note: no Admin built: the entry's own modules do not import @aotter/mantle-admin/server (an import through another package is not seen).");
+        return;
+    }
+    const worker = join(outdir, "worker");
+    // Wrangler uploads every module under the Worker directory and every file under the assets directory.
+    if (within(worker, assets) || within(assets, worker))
+        throw new Error(`The assets directory ${assets} must not overlap the Worker directory ${worker}.`);
+    const metafile = await bundle(entry, worker);
+    if (Object.keys(metafile.inputs).some(input => /(?:^|\/)mantle-admin\/(?:dist|src)\/server\/index\.[jt]s$/.test(input.replaceAll("\\", "/")))) {
+        await bundleAdmin(source, outdir, join(assets, "admin"));
+    }
+}
+/**
+ * Admin from `<dirname(entry)>/admin.tsx`, or the built-in entry; an optional `admin.mcp.tsx` selects the host-safe graph.
+ * Uses `@aotter/mantle-admin/build` as the app installed
+ * it. The built-in entry is skipped when the installed Admin and its direct dependencies are unchanged since the last
+ * build; an application entry always builds, because what it imports is only known by building it.
+ */
+async function bundleAdmin(entry, outdir, out) {
+    const source = join(dirname(entry), "admin.tsx"), custom = existsSync(source);
+    const mcpSource = join(dirname(entry), "admin.mcp.tsx"), customMcp = existsSync(mcpSource);
+    assertCleanable("The Admin output directory", out, entry);
+    const require = createRequire(entry);
+    let builder;
+    try {
+        builder = require.resolve("@aotter/mantle-admin/build");
+    }
+    catch {
+        throw new Error(`The Worker serves Admin, but @aotter/mantle-admin/build does not resolve from ${relative(process.cwd(), entry)}. Install @aotter/mantle-admin at the version of @aotter/mantle-admin/server.`);
+    }
+    const stamp = join(outdir, ".admin-inputs");
+    // the installed path too: a patched or linked Admin keeps its version but not its path
+    const manifest = realpathSync(lookup(require, "@aotter/mantle-admin") ?? require.resolve("@aotter/mantle-admin/package.json"));
+    const key = custom || customMcp ? undefined : JSON.stringify({ out: resolve(out), path: dirname(manifest), packages: installed(manifest) });
+    if (key && existsSync(join(out, "index.html")) && existsSync(join(out, "mcp-app.html")) && existsSync(stamp) && readFileSync(stamp, "utf8") === key) {
+        console.log(`Admin inputs unchanged; kept ${relative(process.cwd(), out)}.`);
+        return;
+    }
+    rmSync(stamp, { force: true });
+    const { buildAdmin } = await import(pathToFileURL(builder).href);
+    await buildAdmin({ entry: custom ? source : undefined, ...(customMcp ? { mcpEntry: mcpSource } : {}), outDir: out });
+    if (key)
+        writeFileSync(stamp, key);
+}
+/** The package.json a bare import of `name` finds, read from disk (`exports` may hide it, and require caches realpaths). */
+const lookup = (require, name) => require.resolve.paths(name)?.map(dir => join(dir, name, "package.json")).find(file => existsSync(file));
+/** The package's version and the installed version of each of its dependencies and peers (React comes from the application). */
+function installed(manifest) {
+    const { name, version, dependencies = {}, peerDependencies = {} } = JSON.parse(readFileSync(manifest, "utf8"));
+    const require = createRequire(manifest);
+    const versions = { [name]: version };
+    for (const dependency of Object.keys({ ...peerDependencies, ...dependencies }).sort()) {
+        const found = lookup(require, dependency);
+        versions[dependency] = found ? JSON.parse(readFileSync(found, "utf8")).version : null;
+    }
+    return versions;
+}
+/** The generated directories among a build's inputs, refusing stale ones. */
+function generatedDirs(metafile) {
+    const dirs = [...new Set(Object.keys(metafile.inputs).map(input => resolve(input, "..")).filter(dir => existsSync(resolve(dir, INPUTS_FILE))))];
+    for (const dir of dirs) {
+        const input = resolve(dir, "generated.ts"), stale = staleInputs(input);
+        if (stale.length)
+            throw new Error(`Generated output in ${relative(process.cwd(), resolve(input, ".."))} is stale (${stale.join("; ")}). Run your generate script (mantle generate ...) and rebuild.`);
+    }
+    return dirs;
+}
 export async function bundle(entry, outdir) {
     entry = realpathSync(entry);
-    if (resolve(outdir) === process.cwd())
-        throw new Error("Bundle outdir must not be the working directory: it is cleaned before building.");
-    const fromOutput = relative(resolve(outdir), resolve(entry));
-    if (fromOutput === "" || (!fromOutput.startsWith(`..${sep}`) && fromOutput !== "..")) {
-        throw new Error("Bundle outdir must not contain the source entry: it is cleaned before building.");
-    }
+    assertCleanable("Bundle outdir", outdir, entry);
     rmSync(outdir, { recursive: true, force: true });
     const result = await build({
         entryPoints: [entry], outdir, bundle: true, splitting: true, format: "esm", platform: "neutral",
@@ -64,12 +172,7 @@ export async function bundle(entry, outdir) {
         throw new Error("@aotter/mantle/testing is only for tests and cannot be bundled for production.");
     // A build is what `wrangler dev` and deploys run: generated code must match the manifests it came from.
     // Any bundled module from a generated directory finds its fingerprint (type-only imports leave generated.ts out).
-    const generatedDirs = new Set(Object.keys(result.metafile.inputs).map(input => resolve(input, "..")).filter(dir => existsSync(resolve(dir, INPUTS_FILE))));
-    for (const dir of generatedDirs) {
-        const input = resolve(dir, "generated.ts"), stale = staleInputs(input);
-        if (stale.length)
-            throw new Error(`Generated output in ${relative(process.cwd(), resolve(input, ".."))} is stale (${stale.join("; ")}). Run your generate script (mantle generate ...) and rebuild.`);
-    }
+    generatedDirs(result.metafile);
     const appSources = Object.keys(result.metafile.inputs).filter(input => !/node_modules|(?:^|\/)generated\/|^\.\.\//.test(input) && /\.[cm]?[jt]s$/.test(input)).map(input => [input, readFileSync(input, "utf8")]);
     for (const [input, source] of appSources) {
         const tables = authTableSql(source);

package/dist/infrastructure/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { existsSync } from "node:fs";
 import { readFile } from "node:fs/promises";
-import { resolve, relative } from "node:path";
+import { join, resolve, relative } from "node:path";
 import { pathToFileURL } from "node:url";
 import { parseArgs } from "node:util";
 import { configureWrangler } from "./wrangler.js";
@@ -19,10 +19,10 @@ async function load(path) {
     }
 }
 const targets = ["bun-sqlite", "bun-postgres", "cloudflare-d1", "cloudflare-postgres"];
-const usage = "Usage: mantle generate <target> <output-directory> <manifest>... [--check] [--admin] [--site <module>] [--auth <module>]... (one per Better Auth instance) [--admin-extensions <module>] [--wrangler <path>] [--entry <worker entry>] [--outdir <bundle directory>]\n       mantle bundle <entry> <outdir>\n       mantle describe <target> <manifest>... [--diff <old.json>]";
+const usage = "Usage: mantle generate <target> <output-directory> <manifest>... [--check] [--admin] [--site <module>] [--auth <module>]... (one per Better Auth instance) [--wrangler <path>] [--entry <worker entry>] [--outdir <bundle directory>] [--assets <static assets directory>]\n       mantle bundle <entry> <outdir> [--assets <static assets directory>]\n       mantle describe <target> <manifest>... [--diff <old.json>]";
 try {
     const { values, positionals } = parseArgs({ allowPositionals: true, options: {
-            diff: { type: "string" }, check: { type: "boolean" }, admin: { type: "boolean" }, site: { type: "string" }, "admin-extensions": { type: "string" }, auth: { type: "string", multiple: true }, wrangler: { type: "string" }, entry: { type: "string", default: "src/worker.ts" }, outdir: { type: "string", default: "dist" },
+            diff: { type: "string" }, check: { type: "boolean" }, admin: { type: "boolean" }, site: { type: "string" }, auth: { type: "string", multiple: true }, wrangler: { type: "string" }, entry: { type: "string", default: "src/worker.ts" }, outdir: { type: "string", default: "dist" }, assets: { type: "string" },
         } });
     const command = positionals[0] === "bundle" || positionals[0] === "generate" || positionals[0] === "describe" ? positionals.shift() : "generate";
     if (command === "describe") {
@@ -45,9 +45,9 @@ try {
     }
     else if (command === "bundle") {
         const [entry, outdir] = positionals;
-        if (!entry || !outdir || positionals.length !== 2 || values.admin || values.site || values.auth || values["admin-extensions"] || values.wrangler || values.check)
+        if (!entry || !outdir || positionals.length !== 2 || values.admin || values.site || values.auth || values.wrangler || values.check)
             throw new Error(usage);
-        await (await import("./bundle.js")).bundle(entry, outdir);
+        await (await import("./bundle.js")).bundleApp(entry, outdir, values.assets);
     }
     else {
         const [target, destination, ...paths] = positionals;
@@ -66,23 +66,19 @@ try {
         const site = values.site ? (await load(values.site)).siteDefaults : undefined;
         if (values.site && !site)
             throw new Error(`${values.site} must export siteDefaults.`);
-        const extensionModule = values["admin-extensions"] ? await load(values["admin-extensions"]) : undefined;
-        // The Admin presentation module: extensions and/or the project's sidebar groups.
-        const adminExtensions = extensionModule?.adminExtensions ?? extensionModule?.default ?? (extensionModule?.navGroups ? [] : undefined);
-        const navGroups = extensionModule?.navGroups;
-        if (values["admin-extensions"] && !Array.isArray(adminExtensions))
-            throw new Error(`${values["admin-extensions"]} must export an adminExtensions array (named or default) or navGroups.`);
         const { generateFromSources } = await (auth.length ? import("./generateAuth.js") : import("./generate.js"));
-        const result = await generateFromSources({ target: target, sources: { sources }, admin: values.admin, auth, site, adminExtensions, navGroups });
+        const result = await generateFromSources({ target: target, sources: { sources }, admin: values.admin, auth, site });
         if (!result.ok)
             throw new Error(JSON.stringify(result.diagnostics, null, 2));
         for (const warning of result.warnings ?? [])
             console.warn(`warning: ${warning}`);
-        const read = [...paths, ...(values.auth ?? []), ...[values.site, values["admin-extensions"]].filter((path) => !!path)];
-        const changed = await writeArtifacts(destination, { ...result.files, [INPUTS_FILE]: inputsFingerprint(destination, read) }, values.check);
+        const read = [...paths, ...(values.auth ?? []), ...(values.site ? [values.site] : [])];
+        const changed = await writeArtifacts(destination, { ...result.files, [INPUTS_FILE]: inputsFingerprint(destination, read, target) }, values.check);
         if (target.startsWith("cloudflare-")) {
             const wrangler = values.wrangler ?? ["wrangler.jsonc", "wrangler.json", "wrangler.toml"].find(existsSync) ?? "wrangler.jsonc";
-            if (configureWrangler(wrangler, values.entry, values.outdir, destination, values.check))
+            const assets = values.admin ? values.assets ?? join(values.outdir, "client") : undefined;
+            const publicFetchRequired = auth.some(options => options.plugins?.some((plugin) => plugin.id === "oauth-provider" || plugin.id === "cimd"));
+            if (configureWrangler(wrangler, values.entry, values.outdir, destination, values.check, assets, publicFetchRequired))
                 changed.push(wrangler);
         }
         if (values.check && changed.length)

package/dist/infrastructure/generate.d.ts

@@ -1,5 +1,5 @@
 /** Build-time assembly only. None of these imports enter generated applications. */
-import { d1Dialect, type AdminExtension, type ManifestSourceSet } from "../build/compiler.js";
+import { d1Dialect, type ManifestSourceSet } from "../build/compiler.js";
 import type { GenerateResult, Target } from "../domain/generation.js";
 /** Core's own new-entry-id lowering for a dialect, printed once as an SQL expression: the Store's inserts carry the same one its compiled INSERTs do. */
 export declare const coreNewId: (dialect: Pick<typeof d1Dialect, "print" | "lowering">, schemas: Parameters<NonNullable<typeof d1Dialect.print>>[1]) => string;
@@ -8,7 +8,5 @@ export interface GenerateRequest {
     readonly admin?: boolean;
     readonly sources: ManifestSourceSet; /** Select the optional generated site/media capability and deployment tables. */
     readonly site?: import("../build/compiler.js").SiteDefaults;
-    readonly adminExtensions?: readonly AdminExtension[]; /** Project sidebar groups (`navGroups` of the `--admin-extensions` module). */
-    readonly navGroups?: readonly import("../build/compiler.js").AdminNavGroup[];
 }
 export declare function generateFromSources(request: GenerateRequest, schema?: () => readonly string[]): Promise<GenerateResult>;