@aotter/mantle 0.2.0-alpha.7 → 0.2.0-alpha.9

package/dist/kernel/mcp-handler.js

@@ -1,8 +1,9 @@
 /** Request-only MCP implementation, excluded from Worker startup. */
 import { authorized, authorizeTarget } from "./authorization.js";
 import { forwarded, isAdmin, ContractError, checkOrigin, surfaceCaller, surfaceError, wire } from "./contracts.js";
+import { draining } from "./drain.js";
 import { callToolLazy as callTool } from "./mcp-call.js";
-import { RESOURCE_MIME_TYPE, linkSurface } from "./mcp-apps.js";
+import { RESOURCE_MIME_TYPE, linkSurface, resourcesOf } from "./mcp-apps.js";
 const text = (value, locale) => {
     if (typeof value === "string")
         return value;
@@ -18,11 +19,18 @@ function observe(listener, event) {
         catch { }
 }
 const paging = (schema) => ({ ...schema, properties: { ...schema.properties, limit: { type: "integer", minimum: 1, maximum: 500 }, cursor: { type: "string" } } });
+/**
+ * Characters of `JSON.stringify(page)` an MCP View page may hold. A result carries its rows twice (text block and
+ * `structuredContent`) and hosts are reported to truncate near 150k characters, so one copy stays at 60k.
+ * ponytail: one fixed number; raise it or make it an option if hosts publish their limits.
+ */
+const MCP_PAGE_BUDGET = 60_000;
 /** The scopes a challenge asks for: the credential's, plus what the request needs. */
 const union = (scopes, extra) => [...new Set([...scopes, ...extra])].join(" ");
 /** The handler for `/mcp` (public tools) and `/mcp/admin` (tools for `admin` roles); other paths are undefined. */
 export function handler(tools, options, apps = {}, reads = []) {
-    return async (request, env, ctx) => {
+    const allowed = options.allowedOrigins ?? [];
+    return draining(async (request, env, ctx) => {
         const access = options.gateway ? (await import("./host-access.js")).accessRequest(ctx, options) : undefined;
         let resolved;
         try {
@@ -30,6 +38,18 @@ export function handler(tools, options, apps = {}, reads = []) {
             const url = new URL(request.url), path = url.pathname.replace(/\/+$/, ""), surface = path === "/mcp" ? "public" : path === "/mcp/admin" ? "admin" : undefined;
             if (!surface)
                 return;
+            // MCP transport MUST: a present Origin is a browser, answered only for loopback or `allowedOrigins`. The request's own
+            // host is not implied, since a DNS-rebinding page sends Origin == its rebound Host; a missing Origin is a server client.
+            if (request.headers.has("origin")) {
+                const sdk = await import("@modelcontextprotocol/server");
+                const foreign = sdk.originValidationResponse(request, [...sdk.localhostAllowedOrigins(), ...allowed]);
+                if (foreign) {
+                    access?.finish(new ContractError("AUTH_DENIED", "Origin is not allowed.", "request:origin"));
+                    observe(options.onObservation, { kind: "request-refused", at: Date.now(), surface, status: 403 });
+                    observe(options.onRefusal, { at: Date.now(), status: 403, reason: "origin" });
+                    return foreign;
+                }
+            }
             const select = async () => (typeof tools === "function" ? await tools(request, env) : tools).filter(tool => tool.surface === surface);
             // Dynamic admin tables stay behind the admin gate; cache classification uses generated metadata only.
             let selected = surface === "public" ? await select() : [];
@@ -74,7 +94,7 @@ export function handler(tools, options, apps = {}, reads = []) {
                     observe(options.onRefusal, { at: Date.now(), status: result.status, reason: "credential" });
                 }
                 if (result.status === 401)
-                    scope ??= requiredScopes.join(" ");
+                    scope = union(scope === undefined ? requiredScopes : scope.split(" "), options.authorizationScopes ?? []);
                 return (await import("./host-caller.js")).hostFailure(error, resolved, `mcp ${path}`, bare ? undefined : 'Bearer ' + (scope ? (result.status === 403 ? 'error="insufficient_scope", ' : '') + 'scope="' + scope + '", ' : '') + 'resource_metadata="' + (options.resourceMetadata ?? url.origin + '/.well-known/oauth-protected-resource/mcp') + '"');
             };
             let caller;
@@ -100,7 +120,9 @@ export function handler(tools, options, apps = {}, reads = []) {
             }
             if (surface === "admin")
                 selected = await select();
-            const { McpServer, createMcpHandler, fromJsonSchema } = await import("@modelcontextprotocol/server");
+            // Before per-caller filtering, so every caller of a deploy sees one catalogue version.
+            const version = catalogueVersion(selected);
+            const { McpServer, ProtocolError, ProtocolErrorCode, createMcpHandler, fromJsonSchema } = await import("@modelcontextprotocol/server");
             if (request.method === "POST" && !cookieOnly && !options.gateway)
                 await parse();
             if (tooLarge && access)
@@ -149,7 +171,17 @@ export function handler(tools, options, apps = {}, reads = []) {
                 }
             }
             const app = options.apps?.[surface];
-            const links = app ? (apps[surface] = linkSurface(app, selected, apps[surface])).links : undefined;
+            let links;
+            if (app) {
+                const sources = (Array.isArray(app) ? app : [app]);
+                const dynamic = sources.some(source => typeof source === "function");
+                const resolved = resourcesOf(await Promise.all(sources.map(source => typeof source === "function" ? source({ env, request }) : source)));
+                // Equal tool names say nothing about request-bound resource identity or ownership.
+                const current = linkSurface(resolved, selected, dynamic ? undefined : apps[surface]);
+                if (!dynamic)
+                    apps[surface] = current;
+                links = current.links;
+            }
             if (options.authorize) {
                 try {
                     for (const message of Array.isArray(parsedBody) ? parsedBody : [parsedBody]) {
@@ -161,7 +193,8 @@ export function handler(tools, options, apps = {}, reads = []) {
                         tool.check?.(caller);
                         await authorizeTarget(options.authorize, tool.target ?? { kind: tool.page ? "view" : "procedure", name: tool.name }, caller);
                     }
-                    if ((Array.isArray(parsedBody) ? parsedBody : [parsedBody]).some(message => message?.method === "tools/list")) {
+                    // an App's HTML is rendered for the same tools the caller's tools/list shows
+                    if ((Array.isArray(parsedBody) ? parsedBody : [parsedBody]).some(message => message?.method === "tools/list" || message?.method === "resources/read")) {
                         const visible = [];
                         for (const tool of selected) {
                             if (caller.kind === "anonymous" && tool.closed || !options.gateway && caller.kind === "user" && caller.credential === "oauth" && tool.scopes?.some(scope => !caller.scopes.includes(scope)))
@@ -184,17 +217,31 @@ export function handler(tools, options, apps = {}, reads = []) {
                     return challenge(error);
                 }
             }
+            const serverInfo = { name: "aotter.mantle", ...options.serverInfo, version: options.serverInfo?.version ?? version };
             // Host calls execute in the SDK callback, after transport validation.
             const handler = createMcpHandler(() => {
                 const schema = (value) => fromJsonSchema(value, { getValidator() { return (input) => ({ valid: true, data: input, errorMessage: undefined }); } });
-                const server = new McpServer({ name: "aotter.mantle", version: "0.2.0", ...options.serverInfo }, { capabilities: { tools: { listChanged: false } }, ...(options.instructions ? { instructions: options.instructions } : {}) });
+                // Tools capability after construction: given to the constructor, the SDK installs its tools/call handler before the wrap below.
+                const server = new McpServer(serverInfo, options.instructions ? { instructions: options.instructions } : {});
+                server.server.registerCapabilities({ tools: { listChanged: false } });
                 if (host)
                     server.server.onclose = () => access?.finish(isRecord(parsedBody) && parsedBody.method === "initialize" ? undefined : new ContractError("INPUT_VALIDATION_FAILED", "MCP request refused.", "mcp", { status: 400 }));
-                const appMeta = links ? registerApps(server, links, parsedBody) : undefined;
+                const appMeta = links ? registerApps(server, links, parsedBody, new Set(selected.map(tool => tool.name)), { env, request }) : undefined;
+                // A host's stale copy names a tool this catalogue lacks: say so, with the catalogue version, instead of the SDK's bare "not found".
+                // Wrapped where the SDK stores it, so transport and request validation still answer first.
+                const registered = new Set(), set = server.server.setRequestHandler.bind(server.server);
+                server.server.setRequestHandler = ((method, handler) => set(method, method === "tools/call" && typeof handler === "function" ? (request, context) => {
+                    if (!registered.has(request.params.name))
+                        throw new ProtocolError(ProtocolErrorCode.InvalidParams, `No tool named ${JSON.stringify(request.params.name)} exists in the current catalogue (catalogue version ${serverInfo.version}).`);
+                    return handler(request, context);
+                } : handler));
                 for (const tool of selected) {
                     const meta = appMeta?.(tool.name);
                     if (meta === false)
                         continue;
+                    registered.add(tool.name);
+                    // Not part of structured output: the version, and on failure the current input contract.
+                    const about = (contract) => { const text = [tool.version && `tool version ${tool.version}`, contract && `input schema ${JSON.stringify(tool.page ? paging(tool.inputSchema) : tool.inputSchema)}`].filter(Boolean).join("; "); return text ? [{ type: "text", text }] : []; };
                     server.registerTool(tool.name, { ...(meta ? { _meta: meta } : {}), ...(tool.title ? { title: text(tool.title, locale) } : {}), description: text(tool.description, locale) ?? text(tool.title, locale) ?? tool.name, inputSchema: schema(tool.page ? paging(tool.inputSchema) : tool.inputSchema), ...(tool.outputSchema ? { outputSchema: schema(tool.outputSchema) } : {}), ...(tool.annotations ? { annotations: tool.annotations } : {}) }, async (raw) => {
                         const metadata = options.onObservation ? { kind: "invocation", surface, invocationId: crypto.randomUUID(), tool: tool.name, caller: Object.freeze(caller.kind === "user" ? { ...caller, scopes: Object.freeze([...caller.scopes]) } : { ...caller }) } : undefined;
                         const started = metadata ? performance.now() : 0;
@@ -206,10 +253,34 @@ export function handler(tools, options, apps = {}, reads = []) {
                                 tool.check?.(caller);
                             if (tool.run && (!host || !tool.readOnly))
                                 checkOrigin(request, caller);
-                            const data = await callTool(tool, raw, () => options.db(env), caller, options.handlers, access?.dryRun ? () => ({ dryRun: true, event: access.finish() }) : undefined);
+                            let db;
+                            const run = (input) => callTool(tool, input, () => db ??= options.db(env), caller, options.handlers, access?.dryRun ? () => ({ dryRun: true, event: access.finish() }) : undefined);
+                            let data = await run(raw);
+                            // A page is cut before the first row that overflows the budget: the same page re-runs with the limit that fits, so the cursor is the View's own.
+                            // Data can change between reads, so the re-run is measured again. A View without an order is one page and refuses a smaller limit: it stays whole.
+                            for (let tries = 0; tool.page && isRecord(data) && Array.isArray(data.rows); tries++) {
+                                const rows = data.rows, total = JSON.stringify(data).length;
+                                if (total <= MCP_PAGE_BUDGET)
+                                    break;
+                                if (rows.length === 1 || tries === 4)
+                                    break;
+                                const sizes = rows.map(row => JSON.stringify(row).length);
+                                let size = total - sizes.reduce((sum, n) => sum + n, 0) - (rows.length - 1), fit = 0;
+                                for (const n of sizes) {
+                                    size += n + (fit ? 1 : 0);
+                                    if (size > MCP_PAGE_BUDGET)
+                                        break;
+                                    fit++;
+                                }
+                                const cut = await run({ ...raw, limit: Math.max(1, fit) }).catch(() => undefined);
+                                if (cut === undefined)
+                                    break;
+                                data = cut;
+                            }
                             if (host)
                                 access?.finish();
-                            return { ...(meta ? { _meta: { "net.aotter.mantle/tool": tool.name } } : {}), content: [{ type: "text", text: JSON.stringify(data) }], ...(data && typeof data === "object" && !Array.isArray(data) ? { structuredContent: data } : {}) };
+                            const text = JSON.stringify(data), notice = tool.page && text.length > MCP_PAGE_BUDGET;
+                            return { ...(meta ? { _meta: { "net.aotter.mantle/tool": tool.name } } : {}), content: [{ type: "text", text }, ...about(false), ...(notice ? [{ type: "text", text: `This page is larger than the ${MCP_PAGE_BUDGET}-character page size budget (a single row over it, or a View without an order, is returned whole), so a host may truncate it. Continue with nextCursor, if any.` }] : [])], ...(data && typeof data === "object" && !Array.isArray(data) ? { structuredContent: data } : {}) };
                         }
                         catch (error) {
                             if (host)
@@ -220,7 +291,7 @@ export function handler(tools, options, apps = {}, reads = []) {
                             if (diagnostic.path === "request:origin")
                                 observe(options.onRefusal, { at: Date.now(), status: 403, reason: "origin" });
                             const payload = { diagnostics: [diagnostic] };
-                            return { ...(meta ? { _meta: { "net.aotter.mantle/tool": tool.name } } : {}), isError: true, content: [{ type: "text", text: JSON.stringify(payload) }], ...(tool.outputSchema ? {} : { structuredContent: payload }) };
+                            return { ...(meta ? { _meta: { "net.aotter.mantle/tool": tool.name } } : {}), isError: true, content: [{ type: "text", text: JSON.stringify(payload) }, ...about(outcome === "failed")], ...(tool.outputSchema ? {} : { structuredContent: payload }) };
                         }
                         finally {
                             if (metadata)
@@ -228,6 +299,11 @@ export function handler(tools, options, apps = {}, reads = []) {
                         }
                     });
                 }
+                // An empty catalogue still answers tools/list and refuses calls the same way.
+                if (registered.size === 0) {
+                    server.server.setRequestHandler("tools/list", () => ({ tools: [] }));
+                    server.server.setRequestHandler("tools/call", () => ({ content: [] }));
+                }
                 return server;
             }, { legacy: "stateless", maxRequestBodySize: 1024 * 1024, onerror: error => console.error("[mantle mcp] request failed", error) });
             const response = await handler.fetch(request, { parsedBody });
@@ -241,7 +317,12 @@ export function handler(tools, options, apps = {}, reads = []) {
             access?.finish(error);
             return (await import("./host-caller.js")).hostFailure(error, resolved, "mcp");
         }
-    };
+    });
+}
+/** A hash of the tools an endpoint serves (`surface:name:version`, sorted), as 32-bit FNV-1a hex: it changes with any tool's definition. */
+function catalogueVersion(tools) {
+    const text = JSON.stringify(tools.map(tool => `${tool.surface}:${tool.name}:${tool.version ?? ""}`).sort());
+    return [...text].reduce((h, c) => Math.imul(h ^ c.codePointAt(0), 16777619) >>> 0, 2166136261).toString(16).padStart(8, "0");
 }
 const CLIENT_CAPABILITIES_META_KEY = "io.modelcontextprotocol/clientCapabilities";
 const isRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
@@ -259,22 +340,24 @@ function clientUiSupport(message) {
     }
     return "unknown";
 }
-function appMeta(r) {
-    const ui = { ...(r.csp ? { csp: r.csp } : {}), ...(r.permissions ? { permissions: r.permissions } : {}), ...(r.prefersBorder !== undefined ? { prefersBorder: r.prefersBorder } : {}) };
+function appMeta(r, csp = r.csp) {
+    const ui = { ...(csp ? { csp } : {}), ...(r.permissions ? { permissions: r.permissions } : {}), ...(r.domain !== undefined ? { domain: r.domain } : {}), ...(r.prefersBorder !== undefined ? { prefersBorder: r.prefersBorder } : {}) };
     return Object.keys(ui).length > 0 ? { ui } : undefined;
 }
 /** Registration uses the official SDK; HTML loaders run only on resources/read. */
-function registerApps(server, links, message) {
+function registerApps(server, links, message, tools, request) {
     const enabled = clientUiSupport(message) !== "unsupported";
     if (enabled)
         for (const resource of links.resources) {
             const meta = appMeta(resource);
             server.registerResource(resource.name, resource.uri, { mimeType: RESOURCE_MIME_TYPE, title: resource.title, description: resource.description, ...(meta ? { _meta: meta } : {}) }, async () => {
                 try {
-                    return { contents: [{ uri: resource.uri, mimeType: RESOURCE_MIME_TYPE, text: typeof resource.html === "string" ? resource.html : await resource.html(), ...(meta ? { _meta: meta } : {}) }] };
+                    const loaded = typeof resource.html === "string" ? resource.html : await resource.html({ tools, ...request });
+                    const page = typeof loaded === "string" ? { html: loaded } : loaded, read = page.csp ? appMeta(resource, page.csp) : meta;
+                    return { contents: [{ uri: resource.uri, mimeType: RESOURCE_MIME_TYPE, text: page.html, ...(read ? { _meta: read } : {}) }] };
                 }
-                catch {
-                    console.error("[mantle mcp] resource rendering failed");
+                catch (error) {
+                    console.error("[mantle mcp] resource rendering failed:", error instanceof Error ? error.message : String(error));
                     throw new Error("Internal error.");
                 }
             });

package/dist/kernel/mcp.d.ts

@@ -1,11 +1,14 @@
 /** MCP request handling for a generated tool table; the official SDK loads on the first MCP request. */
 import type { Caller, Target, Authorize, Gateway, RequestContext, GatewayOptions } from "./contracts.js";
 import type { Conversions } from "./surface.js";
-export { callTool, callToolLazy } from "./mcp-call.js";
-export type { McpApps, McpAppResource } from "./mcp-apps.js";
+import { type McpAppsSource } from "./mcp-apps.js";
+type Call = typeof import("./mcp-call.js");
+export declare const callTool: Call["callTool"];
+export declare const callToolLazy: Call["callToolLazy"];
+export type { McpApps, McpAppsSource, McpAppResource, McpAppRender, McpAppPage, McpAppCsp } from "./mcp-apps.js";
 /** Options of a generated `mcp(...)`; it adds required `handlers` when the app declares ref Procedures. */
 export interface Options<Env, Database> extends GatewayOptions {
-    apps?: Readonly<Partial<Record<"public" | "admin", import("./mcp-apps.js").McpApps | readonly import("./mcp-apps.js").McpApps[]>>>;
+    apps?: Readonly<Partial<Record<"public" | "admin", McpAppsSource | readonly McpAppsSource[]>>>;
     authorize?: Authorize;
     gateway?: Gateway;
     fields?: import("./user-fields.js").UserFields;
@@ -27,7 +30,11 @@ export interface Options<Env, Database> extends GatewayOptions {
         }[];
     };
     requiredScopes?: readonly string[];
+    /** Additional scopes requested by an unauthenticated OAuth challenge (for example offline_access), not an API scope floor. */
+    authorizationScopes?: readonly string[];
     resourceMetadata?: string;
+    /** Browser origins MCP answers besides loopback, compared by hostname: `https://console.example` or the official SDK's bare `console.example`. The site's own origin is not implied. */
+    allowedOrigins?: readonly string[];
     onObservation?: (event: McpObservation) => void | Promise<void>;
     onRefusal?: (event: CallerRefusal) => void | Promise<void>;
 }
@@ -79,6 +86,8 @@ export interface Tool<Database, Handlers = never> {
         readonly idempotentHint?: boolean;
     };
     readonly inputSchema: unknown;
+    /** The listed definition's version; results carry it so a model holding an older definition can tell. */
+    readonly version?: string;
     /** Declares an auth requirement: anonymous callers are challenged. */
     readonly closed?: boolean;
     /** OAuth scopes the requirement names. */

package/dist/kernel/mcp.js

@@ -1,20 +1,32 @@
 import { linkApps, linkSurface, resourcesOf } from "./mcp-apps.js";
-export { callTool, callToolLazy } from "./mcp-call.js";
+export const callTool = async (...args) => (await import("./mcp-call.js")).callTool(...args);
+export const callToolLazy = async (...args) => (await import("./mcp-call.js")).callToolLazy(...args);
 /** The selected MCP routes; all request work loads only when an MCP request arrives. */
 export function mcp(tools, options, reads = []) {
     let serve;
-    // a bad App configuration fails here, not on the first request
+    // Check known static App configuration now; factories wait for the request caller gate.
     const linked = {};
     const apps = {};
     for (const surface of ["public", "admin"]) {
         const declared = options.apps?.[surface];
         if (declared) {
-            const app = resourcesOf(declared);
-            apps[surface] = app;
-            typeof tools === "function" ? linkApps(app) : linked[surface] = linkSurface(app, tools.filter(tool => tool.surface === surface));
+            // Read each static contributor's resources getter once, including mixed arrays.
+            const sources = (Array.isArray(declared) ? declared : [declared])
+                .map(source => typeof source === "function" ? source : resourcesOf(source));
+            const fixed = resourcesOf(sources.filter(source => typeof source !== "function"));
+            const dynamic = sources.some(source => typeof source === "function");
+            apps[surface] = dynamic ? sources : fixed;
+            // Known static conflicts still fail before any request or dynamic factory runs.
+            if (typeof tools === "function")
+                linkApps(fixed);
+            else {
+                const current = linkSurface(fixed, tools.filter(tool => tool.surface === surface));
+                if (!dynamic)
+                    linked[surface] = current;
+            }
         }
     }
-    options = { ...options, apps };
+    options = { ...options, apps, allowedOrigins: originHostnames(options.allowedOrigins) };
     return async (request, env, ctx) => {
         if (!/^\/mcp(?:\/admin)?\/*$/.test(new URL(request.url).pathname))
             return;
@@ -23,3 +35,16 @@ export function mcp(tools, options, reads = []) {
         return serve(request, env, ctx);
     };
 }
+/** `allowedOrigins` as the hostnames the official SDK compares; a bad entry fails here, not on each request. */
+function originHostnames(origins = []) {
+    return Object.freeze(origins.map(origin => {
+        let url;
+        try {
+            url = new URL(/^[a-z][a-z\d+.-]*:\/\//i.test(origin) ? origin : `http://${origin}`);
+        }
+        catch { }
+        if (origin.includes("*") || !url?.hostname || url.username || url.password || url.pathname !== "/" || url.search || url.hash)
+            throw new TypeError(`mcp allowedOrigins: "${origin}" is not an origin (https://host[:port]) or a host[:port]; wildcards never match.`);
+        return url.hostname;
+    }));
+}

package/dist/kernel/rest-router.js

@@ -1,11 +1,12 @@
 /** Route matching and caller enforcement load on the first request. */
 import { forwarded, ContractError, checkOrigin, surfaceCaller } from "./contracts.js";
 import { decode, invalid } from "./surface.js";
+import { draining } from "./drain.js";
 const isApi = (path) => path === "/api" || path.startsWith("/api/");
 const fail = message => invalid(message, "rest");
 /** Shared matching/auth/error envelope; selected dispatch is supplied by the surface. */
 export function router(routes, options, send) {
-    return async (request, env, ctx) => {
+    return draining(async (request, env, ctx) => {
         let caller;
         const isForwarded = forwarded(ctx, options.gateway);
         const access = options.gateway ? (await import("./host-access.js")).accessRequest(ctx, options) : undefined;
@@ -59,5 +60,5 @@ export function router(routes, options, send) {
             access?.finish(error);
             return (await import("./host-caller.js")).hostFailure(error, caller, `rest ${request.method} ${new URL(request.url).pathname}`);
         }
-    };
+    });
 }

package/dist/kernel/scalars.js

@@ -6,9 +6,10 @@
 import { ContractError } from "./contracts.js";
 export function encodeTimestamptz(v) {
     if (v instanceof Date) {
-        if (Number.isNaN(v.getTime()))
+        const micros = v.getTime() * 1000;
+        if (!Number.isSafeInteger(micros))
             throw new ContractError("SQL_TYPE", "Invalid Date is not a timestamp");
-        return v.getTime() * 1000;
+        return micros;
     }
     // hours 00-23: Date.parse would roll T24:00 over to the next day
     const m = /^(\d{4}-\d\d-\d\d)[T ]((?:[01]\d|2[0-3]):\d\d(?::\d\d)?)(?:\.(\d{1,6}))?(Z|[+-]\d\d(?::?\d\d)?)$/.exec(v.trim());

package/dist/kernel/site.d.ts

@@ -5,7 +5,7 @@ import type { Dialect } from "./dialect/common.js";
 import type { MantleSite, SiteDefaults, SiteConfig, MediaPurposePolicy } from "./site-types.js";
 export type { MantleSite, SiteDefaults, SiteConfig, MediaStorage, MediaAsset, MediaLibrary, MediaPurposePolicy } from "./site-types.js";
 export declare function createSite(db: MediaDatabase, d: Pick<Dialect, "param" | "escapeLike" | "likeEscape" | "like">, caller: Caller, defaults: SiteDefaults, policies: readonly MediaPurposePolicy[]): MantleSite;
-/** 0.2 /admin/api/site projection; the app supplies its selected capabilities and extensions. */
+/** 0.2 /admin/api/site projection; the app supplies its selected capabilities. */
 export declare function siteInfo(config: SiteConfig, options: {
     origin: string;
     media?: boolean;
@@ -14,7 +14,6 @@ export declare function siteInfo(config: SiteConfig, options: {
         public?: string | null;
         admin?: string | null;
     };
-    extensions?: readonly unknown[];
     siteSettings?: boolean;
 }): {
     publicUrl: string;
@@ -28,7 +27,6 @@ export declare function siteInfo(config: SiteConfig, options: {
         invitationEmail: boolean;
         statistics: boolean;
     };
-    extensions: readonly unknown[];
     brand: string;
     title: string;
     description: string;

package/dist/kernel/site.js

@@ -23,10 +23,10 @@ export function createSite(db, d, caller, defaults, policies) {
             return read();
         }, media(storage) { admin(); return mediaLibrary(db, d, storage, policies); } };
 }
-/** 0.2 /admin/api/site projection; the app supplies its selected capabilities and extensions. */
+/** 0.2 /admin/api/site projection; the app supplies its selected capabilities. */
 export function siteInfo(config, options) {
     const { origin, ...stored } = config;
     const publicUrl = URL.canParse(origin) ? origin : options.origin;
     const at = (path) => path ? new URL(path, publicUrl).href : null;
-    return { ...stored, publicUrl, mcpEndpoints: { public: at(options.mcpEndpoints?.public), admin: at(options.mcpEndpoints?.admin) }, capabilities: { siteSettings: options.siteSettings ?? true, media: !!options.media, invitationEmail: !!options.invitationEmail, statistics: false }, extensions: options.extensions ?? [] };
+    return { ...stored, publicUrl, mcpEndpoints: { public: at(options.mcpEndpoints?.public), admin: at(options.mcpEndpoints?.admin) }, capabilities: { siteSettings: options.siteSettings ?? true, media: !!options.media, invitationEmail: !!options.invitationEmail, statistics: false } };
 }

package/dist/kernel/web-index.js

@@ -0,0 +1,40 @@
+/** /llms.txt and /sitemap.xml bodies; loaded only when an index is requested, so page Workers do not pay for it at startup. */
+const escape = (v) => String(v).replace(/[&<>"']/g, c => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" }[c]));
+const label = (v) => String(v).replace(/[\r\n]/g, " ").replace(/[\\[\]]/g, "\\$&");
+const size = (s) => new TextEncoder().encode(s).length;
+export async function webIndex(sitemap, options, pages, list, validUrl) {
+    const cap = sitemap ? 50000 : 5000, limit = sitemap ? 50 * 1024 * 1024 : 1024 * 1024;
+    const start = sitemap ? '<?xml version="1.0" encoding="UTF-8"?><urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">' : "# " + label(options.title) + "\n\n> " + label(options.description) + "\n\n## Pages\n\n", end = sitemap ? "</urlset>" : "\n";
+    const links = [];
+    let visited = 0, requests = 0, bytes = size(start + end);
+    if (bytes > limit)
+        throw new TypeError("Web index header exceeds its byte limit.");
+    pagesLoop: for (const entry of pages) {
+        if (!entry.page.list)
+            continue;
+        let cursor;
+        do {
+            if (requests >= (sitemap ? 100 : 10))
+                break pagesLoop;
+            requests++;
+            const page = await list(entry.page.list, cursor);
+            for (const row of page.rows) {
+                if (visited++ >= cap)
+                    break pagesLoop;
+                const url = validUrl(entry.path, row, entry.page.view);
+                if (!url)
+                    continue;
+                const line = sitemap ? "<url><loc>" + escape(url) + "</loc></url>" : "- [" + label(row.title ?? url) + "](" + url + "): " + label(row.description ?? "") + "\n";
+                const length = size(line);
+                if (bytes + length > limit)
+                    break pagesLoop;
+                bytes += length;
+                links.push(line);
+            }
+            if (visited >= cap)
+                break pagesLoop;
+            cursor = page.nextCursor;
+        } while (cursor);
+    }
+    return start + links.join("") + end;
+}

package/dist/kernel/web.d.ts

@@ -2,7 +2,7 @@
 import { type Caller, type Gateway, type RequestContext } from "./contracts.js";
 import type { UserFields } from "./user-fields.js";
 import { type Conversions } from "./surface.js";
-/** An app's public Views: row type and input keys per View, and the Views a list may name (no required input). */
+/** An app's public Views: row type and input keys per View, and the Views a list may name (input that accepts no fields). */
 export interface App {
     Rows: Record<string, any>;
     Inputs: Record<string, string>;
@@ -33,6 +33,8 @@ export type Options<A extends App, Database, P extends Record<string, Page<A>>,
 /** One public View: its query-string reader, paged boundary, bind conversions and boolean input keys. */
 export interface View<Database> {
     readonly check?: (caller: Caller) => void;
+    /** The input rejects an empty query, so a list cannot name this View. */
+    readonly unlisted?: true;
     readonly query: (params: URLSearchParams) => {
         input: Record<string, unknown>;
     };

package/dist/kernel/web.js

@@ -1,9 +1,6 @@
 /** Web output for a generated public View table: /llms.txt, /sitemap.xml, Markdown pages and head tags. SQL owns visibility. */
 import { forwarded, wire, ContractError } from "./contracts.js";
 import { convert, decode } from "./surface.js";
-const escape = (v) => String(v).replace(/[&<>"']/g, c => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" }[c]));
-const label = (v) => String(v).replace(/[\r\n]/g, " ").replace(/[\\[\]]/g, "\\$&");
-const size = (s) => new TextEncoder().encode(s).length;
 const NO_STORE = { "cache-control": "no-store" };
 const notFound = () => new Response(null, { status: 404, headers: NO_STORE });
 export function web(options, table) {
@@ -13,6 +10,9 @@ export function web(options, table) {
         convert(input, view.convert);
         return view.page(db, caller, input, { limit: 500, cursor });
     };
+    for (const [path, page] of Object.entries(options.pages))
+        if (page.list && views.get(page.list)?.unlisted)
+            throw new TypeError(`Page ${path} lists View '${page.list}', whose input rejects an empty query; a list View must accept no input.`);
     const origin = new URL(options.origin);
     if (!/^https?:$/.test(origin.protocol) || origin.username || origin.password || origin.pathname !== "/" || origin.search || origin.hash)
         throw new TypeError("origin must be an HTTP(S) origin.");
@@ -73,40 +73,9 @@ export function web(options, table) {
                 const ctx = await context(request, env, execution);
                 caller = ctx.caller;
                 if (index) {
-                    const sitemap = path === "/sitemap.xml", cap = sitemap ? 50000 : 5000, limit = sitemap ? 50 * 1024 * 1024 : 1024 * 1024;
-                    const start = sitemap ? '<?xml version="1.0" encoding="UTF-8"?><urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">' : "# " + label(options.title) + "\n\n> " + label(options.description) + "\n\n## Pages\n\n", end = sitemap ? "</urlset>" : "\n";
-                    const links = [];
-                    let visited = 0, requests = 0, bytes = size(start + end);
-                    if (bytes > limit)
-                        throw new TypeError("Web index header exceeds its byte limit.");
-                    pagesLoop: for (const entry of pages) {
-                        if (!entry.page.list)
-                            continue;
-                        let cursor;
-                        do {
-                            if (requests >= (sitemap ? 100 : 10))
-                                break pagesLoop;
-                            requests++;
-                            const page = await query(entry.page.list, ctx.db, ctx.caller, new URLSearchParams(), cursor);
-                            for (const row of page.rows) {
-                                if (visited++ >= cap)
-                                    break pagesLoop;
-                                const url = validUrl(entry.path, row, entry.page.view);
-                                if (!url)
-                                    continue;
-                                const line = sitemap ? "<url><loc>" + escape(url) + "</loc></url>" : "- [" + label(row.title ?? url) + "](" + url + "): " + label(row.description ?? "") + "\n";
-                                const length = size(line);
-                                if (bytes + length > limit)
-                                    break pagesLoop;
-                                bytes += length;
-                                links.push(line);
-                            }
-                            if (visited >= cap)
-                                break pagesLoop;
-                            cursor = page.nextCursor;
-                        } while (cursor);
-                    }
-                    return response(request, start + links.join("") + end, sitemap ? "application/xml" : "text/plain", ctx.caller);
+                    const sitemap = path === "/sitemap.xml";
+                    const body = await (await import("./web-index.js")).webIndex(sitemap, options, pages, (list, cursor) => query(list, ctx.db, ctx.caller, new URLSearchParams(), cursor), validUrl);
+                    return response(request, body, sitemap ? "application/xml" : "text/plain", ctx.caller);
                 }
                 const exact = match(path);
                 if (exact)

package/dist/usecase/adminBindings.js

@@ -1,6 +1,6 @@
 import { userReferences } from "../domain/userReferences.js";
 /** Selected application bindings: compiled checks/native SQL; only the app depends on Admin adapters. */
-import { collectionOf } from "../build/compiler.js";
+import { isPrimaryCollection } from "../build/compiler.js";
 import { enumOptions } from "../build/compiler.js";
 import { databaseImport, isSqlite, literal as q } from "../domain/entry.js";
 import { conversions, authLines } from "../domain/input.js";
@@ -83,8 +83,7 @@ export function emitAdminBindings(input, refuse) {
             continue;
         }
         const defaults = Object.fromEntries(Object.entries(checks(s, true).properties ?? {}).flatMap(([key, p]) => p.default !== undefined ? [[key, p.default]] : []));
-        const descriptor = collectionOf(s, Object.values(plan.schemas));
-        const primary = !s.translates && (!descriptor.parent || descriptor.nav?.standalone === true);
+        const primary = isPrimaryCollection(s, Object.values(plan.schemas));
         const schemaCode = `{
       name:${q(s.name)},primary:${primary},descriptor:allCollections[${q(s.name)}],publishing:${!!s.publishing},readOnly:${s.schema.readOnly === true || declared.some(f => s.fields[f] === "geo")},fields:names${n},defaults:${q(defaults)},
       binding:${entrySpec},