@aotter/mantle 0.2.0-alpha.9 → 0.2.0

package/dist/build/spec/domain/model/SqlIr.d.ts

@@ -101,6 +101,8 @@ export declare function storageColumns(s: {
     readonly scope?: string;
     readonly publishing?: boolean;
 }): Map<string, string>;
+/** The aggregate functions either dialect's SQL may call: outside a window and without GROUP BY, one makes a select return one row even over none. */
+export declare const AGGREGATES: ReadonlySet<string>;
 /** The native columns storage declares NOT NULL (`status` only on a publishing Schema, the only one that has it); `author_id` is nullable. */
 export declare const NATIVE_NOT_NULL: ReadonlySet<string>;
 /** Each native field a manifest names (in an index, say) -> its storage column, which SQL names. */

package/dist/build/spec/domain/model/UserFields.d.ts

@@ -1,5 +1,6 @@
 export interface UserFieldSpec {
     readonly type: "string" | "number";
+    readonly integer?: true;
     readonly multiple: boolean;
     readonly enum?: readonly (string | number)[];
 }

package/dist/bun/assets.js

@@ -1,7 +1,5 @@
-/** Bun owns files; no SQLite, runtime or compiler import enters this optional host reader. */
 import { realpath, stat } from "node:fs/promises";
 import { resolve, sep } from "node:path";
-/** Native file response, or null for missing or invalid paths. */
 export function bunAdminAssets(root) {
     const base = resolve(root);
     return async (path) => {

package/dist/domain/adminOrder.js

@@ -1,4 +1,3 @@
-/** Selected Admin orders mirror the existing UI's indexed, required fields and native controls. */
 import { adminIndexColumns, NATIVE_NOT_NULL, notNullColumns } from "../build/compiler.js";
 import { dialect as sqlite } from "../kernel/dialect/sqlite.js";
 import { dialect as postgres } from "../kernel/dialect/postgres.js";
@@ -12,7 +11,6 @@ export function adminOrder(schema) {
         return kind ? [[f, [kind, !NATIVE_NOT_NULL.has(f) && !notNull.has(f)]]] : [];
     }));
 }
-/** Deployment-only indexes; no request attempts to converge storage. */
 export function adminIndexes(schemas, isSqlite) {
     const d = isSqlite ? sqlite : postgres;
     return Object.values(schemas).flatMap(s => ["created_at", "updated_at", ...(s.publishing ? ["status"] : [])].flatMap(field => [[], ...(s.scope ? [[s.scope]] : [])].flatMap(prefix => {

package/dist/domain/columns.js

@@ -1,55 +1,42 @@
-/** What a column's Mantle type means to generated code, in one place: Views, Stores and wire forms all read it here. */
-import { viewOutputs } from "../build/compiler.js";
-/** A column's declared type, including the system version and timestamps. @internal */
-/** A JSON Schema `readOnly` property is server-maintained (counters, totals): Admin's generic writes never set it. */
+import { jsonOutputs, viewOutputs } from "../build/compiler.js";
 export const serverOwned = (schema, column) => Object.entries(schema.properties ?? {}).some(([name, property]) => name.toLowerCase() === column && property?.readOnly === true);
 export const declaredType = (fields, column) => fields[column] ?? (column === "version" ? "integer" : column === "created_at" || column === "updated_at" || column === "published_at" ? "timestamptz" : undefined);
-/** Compiler-owned schema type metadata, including aggregates that inherit a field's presentation type. @internal */
+const computedJson = (plan, view, key) => jsonOutputs(plan.views[view]).has(key);
 export function outputType(plan, view, key) {
     const columns = plan.views[view]?.columns;
     const field = columns && Object.hasOwn(columns, key) ? columns[key] : undefined;
     const schema = field && plan.schemas[field.schema];
-    return schema && declaredType(schema.fields, field.field);
+    return schema ? declaredType(schema.fields, field.field) : computedJson(plan, view, key) ? "json" : undefined;
 }
-/** Transport lineage excludes expressions/aggregates; existing temporal SQL formatting is retained. */
 export function boundaryType(plan, view, key) {
     const field = viewOutputs(plan.views[view], plan.schemas, new Map(), false, false).columns[key];
     const type = outputType(plan, view, key);
-    return field || type === "date" || type === "timestamptz" ? type : undefined;
+    return field || type === "date" || type === "timestamptz" || computedJson(plan, view, key) ? type : undefined;
 }
-/** Declared output lineage only; computed columns retain their native values. */
 export function outputConversions(plan, view, target) {
     const postgres = target.endsWith("postgres");
     const columns = viewOutputs(plan.views[view], plan.schemas, new Map(), false, false).columns;
-    return Object.keys(columns).flatMap(key => {
+    return [...Object.keys(columns), ...jsonOutputs(plan.views[view])].flatMap(key => {
         const type = outputType(plan, view, key);
         return conversion(key, type, !postgres);
     });
 }
-/** Shared static conversion recipe for Views and Admin collections. */
 export function conversion(key, type, sqlite) {
     return type && ["integer", "int8", "int4"].includes(type) ? [[key, "int"]]
         : sqlite && (type === "json" || type === "bool") ? [[key, type]] : [];
 }
-/** Client-visible declared output type, identical on every target. */
-export function wireType(type) {
+export function wireType(type, notNull = false) {
     const value = !type ? "unknown" : ["integer", "int8", "int4"].includes(type) ? "number | string"
         : scalarType(type);
-    return value === "unknown" ? value : `${value} | null`;
+    return value === "unknown" || notNull ? value : `${value} | null`;
 }
 const scalarType = (type) => type === "bool" ? "boolean" : ["integer", "int4", "int8", "real", "float8"].includes(type) ? "number" : type === "json" ? "unknown" : type === "geo" ? "{lat:number;lng:number}" : "string";
-/**
- * The driver-native value a column of this type comes back as, `| null` unless `notNull`; declared timestamps and dates arrive as the
- * SQL's wire-form text. A column with no declared type (a computed output) is `unknown`, which already includes null. @internal
- */
 export function nativeType(type, sqlite, notNull = false) {
     const native = !type ? "unknown" : ["date", "timestamptz"].includes(type) ? "string" : sqlite
         ? type === "bool" ? "number" : type === "json" ? "string" : scalarType(type)
         : ["integer", "int8"].includes(type) ? "number | string | bigint" : scalarType(type);
     return notNull || native === "unknown" ? native : `${native} | null`;
 }
-/** The value a caller of the typed Store passes for a column of this type. JSON is an object or array (the Store tells it by its JS type, so a bare string would be bound as text). @internal */
 export const inputType = (type) => type === "timestamptz" ? "string | Date" : type === "json" ? "object" : scalarType(type);
-/** Wrap only a selected transport page. */
 export const boundaryPage = (page, fields) => fields.length
     ? `(db, caller, input, paging) => ${page}(db, caller, input, paging).then(page => ({ ...page, rows: wireRows(page.rows, ${JSON.stringify(fields)}) }))` : page;

package/dist/domain/describe/chunk-SGMRVDGE.js

@@ -0,0 +1 @@
+function resolveLocalizedText(value,preferred,canonical2){if(value==null)return null;if(typeof value=="string")return value;if(Object.prototype.hasOwnProperty.call(value,preferred))return value[preferred];if(canonical2&&Object.prototype.hasOwnProperty.call(value,canonical2))return value[canonical2];let firstKey=Object.keys(value)[0];return firstKey!==void 0?value[firstKey]:null}var INPUT_RULE_KEYWORDS=["dependentRequired","anyOf","if","then","else"];function lookupLocalRef(root,ref){if(typeof ref!="string"||!ref.startsWith("#/"))return;let value=root;try{for(let key of decodeURIComponent(ref.slice(2)).split("/").map(key2=>key2.replace(/~1/g,"/").replace(/~0/g,"~")))value=value&&typeof value=="object"&&Object.hasOwn(value,key)?value[key]:void 0}catch{return}return value&&typeof value=="object"?value:void 0}function rootRefChain(input){let chain=[];for(let schema=input;schema!==void 0;schema=lookupLocalRef(input,schema.$ref)){if(chain.includes(schema))return;if(chain.push(schema),schema.$ref===void 0)return chain}}function mcpToolNameSegment(name){return name.toLowerCase().replace(/-/g,"_")}function toolTitle(name){let words=name.replace(/([a-z0-9])([A-Z])/g,"$1 $2").replace(/[-_.\s]+/g," ").trim().toLowerCase();return words.charAt(0).toUpperCase()+words.slice(1)}var viewAnnotations={readOnlyHint:!0,destructiveHint:!1};function procedureAnnotations(p){let readOnlyHint=p.mcp?.readOnlyHint??!1;return{readOnlyHint,destructiveHint:!readOnlyHint&&("ref"in p.handler||overwrites(p.handler.sql.stmts)),...p.mcp}}var overwrites=node=>!!node&&typeof node=="object"&&("DeleteStmt"in node||"UpdateStmt"in node||node.onConflictClause?.action==="ONCONFLICT_UPDATE"||Object.values(node).some(overwrites));function mcpTools(plan,surface,locale="en"){let text=t=>resolveLocalizedText(t,locale,"en")??void 0,tools=new Map,add=tool=>{let prior=tools.get(tool.name);if(prior&&(prior.kind!==tool.kind||prior.source!==tool.source))throw new TypeError(`MCP tool '${tool.name}' comes from both '${prior.source}' and '${tool.source}'.`);tools.set(tool.name,tool)};for(let t of Object.values(plan.triggers)){if(t.source.kind!=="mcp"||t.source.surface!==surface)continue;let p=plan.procedures[t.procedure],title=text(p.title);add({name:mcpToolNameSegment(t.procedure),kind:"procedure",source:t.procedure,title:title??toolTitle(t.procedure),description:text(p.description)??title??t.procedure,inputSchema:p.input,...p.output.type==="object"?{outputSchema:p.output}:{},annotations:procedureAnnotations(p),requires:p.requires})}for(let[name,v]of Object.entries(plan.views)){if(v.surface!==surface)continue;let chain=(v.input?rootRefChain(v.input)??[v.input]:[]).reverse(),props=Object.assign({},...chain.map(s=>s.properties??{})),required=[...new Set(chain.flatMap(s=>s.required??[]))];if("limit"in props||"cursor"in props)throw new TypeError(`View '${name}' declares an input named limit or cursor; the MCP tool reserves both for paging.`);let rules=chain.map(s=>Object.fromEntries(INPUT_RULE_KEYWORDS.flatMap(k=>s[k]===void 0?[]:[[k,s[k]]]))).filter(r=>Object.keys(r).length),defs=v.input?referencedDefs(v.input,props):{},title=text(v.title);add({name:mcpToolNameSegment(name),kind:"view",source:name,title:title??toolTitle(name),description:text(v.description)??title??name,inputSchema:{type:"object",properties:{...props,limit:{type:"integer",minimum:1,maximum:500},cursor:{type:"string"}},...required.length?{required}:{},...rules.length>1?{allOf:rules}:rules[0],...Object.keys(defs).length?{$defs:defs}:{}},annotations:viewAnnotations,requires:v.requires})}return[...tools.values()]}function referencedDefs(root,node,found={}){if(!node||typeof node!="object")return found;let ref=node.$ref,[head,segment]=typeof ref=="string"&&ref.startsWith("#/")?decoded(ref.slice(2)).split("/"):[],key=head==="$defs"?segment?.replace(/~1/g,"/").replace(/~0/g,"~"):void 0;key!==void 0&&!Object.hasOwn(found,key)&&root.$defs&&Object.hasOwn(root.$defs,key)&&(found[key]=root.$defs[key],referencedDefs(root,found[key],found));for(let child of Object.values(node))referencedDefs(root,child,found);return found}var decoded=pointer=>{try{return decodeURIComponent(pointer)}catch{return""}};function canonical(v){return Array.isArray(v)?`[${v.map(canonical).join(",")}]`:v&&typeof v=="object"?`{${Object.keys(v).sort().filter(k=>v[k]!==void 0).map(k=>`${JSON.stringify(k)}:${canonical(v[k])}`).join(",")}}`:JSON.stringify(v)??"null"}var publishingTransitions=[["publish",["draft"],"published"],["unpublish",["published","archived"],"draft"],["archive",["draft","published"],"archived"]];var publishingInput={type:"object",properties:{id:{type:"string",minLength:1},expectedVersion:{type:"integer",minimum:1}},required:["id","expectedVersion"],additionalProperties:!1};function mediaDefinitions(){let define=(name,description,inputSchema,action,readOnlyHint=!1)=>({name,description,inputSchema,action,annotations:{readOnlyHint,destructiveHint:action==="delete",openWorldHint:!0}}),string={type:"string"},texts={alt:{type:"string",maxLength:1e3},caption:{type:"string",maxLength:1e3}},input=(properties,required=[])=>({type:"object",properties,required,additionalProperties:!1});return[define("get_media_upload_policy","Read declared image purpose MIME slots and byte caps before preparing variants or requesting an upload. Optimization runs locally, never in the host.",input({}),"policy",!0),define("create_media_upload","Create short-lived PUT capabilities for image variants. Read site media purpose policy first; optimize images locally. Obtain attachment bytes yourself, then PUT each variant with its requiredHeaders and call commit_media_upload. Never store upload URLs as published images or ask the user to run terminal commands.",input({filename:{type:"string",maxLength:255},purpose:string,variants:{type:"array",minItems:1,items:input({mimeType:string,byteSize:{type:"integer",minimum:1},role:{type:"string",enum:["primary","alternate","fallback"]}},["mimeType","byteSize","role"])},...texts},["filename","purpose","variants"]),"create"),define("commit_media_upload","Verify all uploaded variants and commit one permanent media asset. Store the returned asset id in fields referencing media_assets.id, never a temporary upload URL. Unknown or expired upload groups require a new create_media_upload.",input({uploadGroupId:string,...texts},["uploadGroupId"]),"commit"),define("list_media_assets","List committed image assets, newest first, with their permanent variants and alt/caption. Search matches id, alt or caption; reuse only a returned cursor.",input({limit:{type:"integer",minimum:1,maximum:500},cursor:string,search:string}),"list",!0),define("get_media_asset","Read one committed media asset and its permanent variant URLs.",input({id:string},["id"]),"get",!0),define("update_media_asset","Update committed asset alt or caption; omitted fields remain unchanged and empty strings clear text.",input({id:string,...texts},["id"]),"update"),define("delete_media_asset","Delete an asset's objects and library record. Check application references first. A partial failure can be retried using the same id.",input({id:string},["id"]),"delete")]}function inspectSql(value){let schemas=new Set,readSchemas=new Set,writes=[],readOnly=!0,walk=v=>{if(!v||typeof v!="object")return;let n=v;n.RangeVar?.mantle==="table"&&(schemas.add(n.RangeVar.relname.toLowerCase()),readSchemas.add(n.RangeVar.relname.toLowerCase()));for(let kind of["InsertStmt","UpdateStmt","DeleteStmt"])n[kind]&&(readOnly=!1,n[kind].relation?.relname&&writes.push({schema:n[kind].relation.relname.toLowerCase(),operation:kind==="InsertStmt"?"create":kind==="UpdateStmt"?"update":"delete"}),n[kind].relation?.relname&&(schemas.add(n[kind].relation.relname.toLowerCase()),kind!=="InsertStmt"&&readSchemas.add(n[kind].relation.relname.toLowerCase())));Object.values(n).forEach(walk)};return walk(value),{schemas:[...schemas].sort(),readSchemas:[...readSchemas].sort(),readOnly,writes}}function mergeRestrict(policies,conjunctive){return Object.fromEntries([...new Set(policies.flatMap(p=>Object.keys(p)))].sort().map(schema=>{let rows=policies.map(p=>p[schema]??{terms:[]}),terms=[...new Map(rows.flatMap(p=>p.terms).map(t=>[canonical(t),t])).values()].filter(t=>conjunctive||rows.every(p=>p.terms.some(v=>canonical(v)===canonical(t)))),owner=rows.find(p=>p.owner)?.owner;return[schema,{...owner&&(conjunctive||rows.every(p=>p.owner===owner))?{owner}:{},terms}]}))}function inspectBehavior(plan,ir,opaque,requires,restrict,writes){let inspected=inspectSql(ir);writes&&(inspected.writes=[...writes],inspected.schemas.push(...writes.map(w=>w.schema)),inspected.readSchemas.push(...writes.filter(w=>w.operation!=="create").map(w=>w.schema)));let dependencies=[],policies=[restrict??{}],procedures=new Set,hooks=new Set,visit=name=>{if(procedures.has(name))return;procedures.add(name);let p=plan.procedures[name];if(!p)throw new TypeError(`Unknown dependency '${name}'.`);dependencies.push({procedure:name,declaration:p}),policies.push(p.restrict??{}),opaque||="ref"in p.handler;let g=inspectSql("sql"in p.handler?p.handler.sql.stmts:void 0);inspected.schemas.push(...g.schemas),inspected.readSchemas.push(...g.readSchemas),inspected.writes.push(...g.writes),inspected.readOnly&&=g.readOnly,p.requires?.guard&&visit(p.requires.guard.procedure)};for(requires?.guard&&visit(requires.guard.procedure);;){let before=hooks.size;for(let[id,t]of Object.entries(plan.triggers).sort(([a],[b])=>a<b?-1:a>b?1:0)){if(t.source.kind!=="lifecycle"||hooks.has(id))continue;let source=t.source;!opaque&&!inspected.writes.some(w=>w.schema===source.schema.toLowerCase()&&source.on.some(on=>on.endsWith(`_${w.operation}`)))||(hooks.add(id),dependencies.push({trigger:id,source}),visit(t.procedure))}if(hooks.size===before)break}let related=names=>{let all=new Set(opaque?Object.keys(plan.schemas):names);for(let name of all){let parent=plan.schemas[name]?.translates?.parent.toLowerCase();parent&&all.add(parent)}return[...all].sort()};return{...inspected,schemas:related(inspected.schemas),readSchemas:related(inspected.readSchemas),opaque,restrict:mergeRestrict(policies,!0),dependencies}}var objectInput={type:"object",properties:{}},pathTemplate=path=>path.replace(/\{([^}]+)\}/g,":$1"),adminRoutes=["GET /me","GET /site","GET /collections","GET /views-manifest","GET /operations","GET /webmcp","POST /webmcp/:tool","GET /bootstrap","GET /views/:name/export","GET /views/:name","GET /view-batch","GET /developer/views/:name","POST /operations/:name","GET /developer-console","GET /collections/:name/statistics","GET /entries","GET /entries/export","GET /entries/:id","POST /entries","PATCH /entries/:id","POST /entries/:id/publish","POST /entries/:id/unpublish","POST /entries/:id/archive","DELETE /entries/:id","GET /site-settings","PATCH /site-settings","POST /media/uploads","POST /media/uploads/:groupId/commit","GET /media","GET /media/:id","PATCH /media/:id","DELETE /media/:id","GET /admin","GET /members","PATCH /admin/:id/role","POST /admin/invitations","DELETE /admin/invitations/:id"];function targetDefinitions(plan){let out=[],tools=[...mcpTools(plan,"public"),...mcpTools(plan,"admin")];for(let[kind,entries]of[["view",plan.views],["procedure",plan.procedures]])for(let[name,p]of Object.entries(entries).sort(([a],[b])=>a<b?-1:a>b?1:0)){let view=kind==="view"?plan.views[name]:void 0,proc=kind==="procedure"?plan.procedures[name]:void 0,ir=view?.stmts??(proc&&"sql"in proc.handler?proc.handler.sql.stmts:void 0),inspected=inspectBehavior(plan,ir,!!proc&&"ref"in proc.handler,p.requires,p.restrict),tool=tools.find(t=>t.kind===kind&&t.source===name),title=resolveLocalizedText(p.title,"en","en")??name,triggers=Object.entries(plan.triggers).filter(([,t])=>kind==="procedure"&&t.procedure===name).sort(([a],[b])=>a<b?-1:a>b?1:0).map(([id,t])=>({id,source:t.source})),surfaces=[...new Set([...view?[view.surface,"admin",...view.surface==="public"?["rest"]:[]]:[],...triggers.map(t=>t.source.kind==="mcp"?t.source.surface:t.source.kind==="http"?"rest":t.source.kind)])].sort();surfaces.length||surfaces.push("internal"),out.push({id:`${kind}:${name}`,name:tool?.name??mcpToolNameSegment(name),kind,surface:view?.surface??(surfaces.includes("public")||surfaces.includes("rest")?"public":surfaces.includes("admin")?"admin":"internal"),surfaces,triggers,title,description:resolveLocalizedText(p.description,"en","en")??title,inputSchema:tool?.inputSchema??view?.input??proc?.input??objectInput,annotations:tool?.annotations??{},requires:p.requires,restrict:inspected.restrict,schemas:inspected.schemas,readSchemas:inspected.readSchemas,readOnly:!inspected.opaque&&inspected.readOnly,opaque:inspected.opaque,trustedOnly:!!proc?.trustedOnly,variants:[],behavior:{declaration:p,dependencies:inspected.dependencies}})}let addRoute=(id,dependencies,inputSchema=objectInput)=>{let admin=id.startsWith("admin:");out.push({id,name:id.replace(/[^a-zA-Z0-9_-]/g,"_"),title:id,description:id,kind:admin?"admin":"rest",surface:admin?"admin":"public",surfaces:[admin?"admin":"rest"],triggers:dependencies.flatMap(d=>d.triggers),inputSchema,annotations:{},requires:admin?{auth:{all:["ctx.admin"]}}:dependencies[0]?.requires,restrict:mergeRestrict(dependencies.map(d=>d.restrict),!1),schemas:[...new Set(dependencies.flatMap(d=>d.schemas))].sort(),readSchemas:[...new Set(dependencies.flatMap(d=>d.readSchemas))].sort(),readOnly:dependencies.length>0&&dependencies.every(d=>d.readOnly)&&(!admin||id.startsWith("admin:GET ")||id==="admin:POST /operations/:name"||id==="admin:POST /webmcp/:tool"),opaque:dependencies.some(d=>d.opaque),trustedOnly:dependencies.some(d=>d.trustedOnly),variants:dependencies,behavior:dependencies.map(d=>({id:d.id,behavior:d.behavior,surfaces:d.surfaces,triggers:d.triggers,input:d.inputSchema,requires:d.requires,restrict:d.restrict,trustedOnly:d.trustedOnly}))})},declarations=[...out],adminOperations=new Set(mcpTools(plan,"admin").filter(t=>t.kind==="procedure").map(t=>`procedure:${t.source}`));for(let d of declarations)d.kind==="view"&&d.surfaces.includes("public")&&addRoute(`rest:GET /api/views/${d.id.slice(5)}`,[d],d.inputSchema);for(let[,t]of Object.entries(plan.triggers).sort(([a],[b])=>a<b?-1:a>b?1:0))if(t.source.kind==="http"){let d=declarations.find(d2=>d2.id===`procedure:${t.procedure}`);addRoute(`rest:${t.source.method} ${pathTemplate(t.source.path)}`,[d],d.inputSchema)}let generated=[];for(let[schema,s]of Object.entries(plan.schemas).sort(([a],[b])=>a<b?-1:a>b?1:0))if(s.publishing)for(let[verb,from,to]of publishingTransitions){addRoute(`procedure:${s.name}.${verb}`,[],publishingInput);let d=out.at(-1),inspected=inspectBehavior(plan,void 0,!1,void 0,void 0,[{schema,operation:verb==="publish"?"publish":"update"}]);Object.assign(d,{kind:"procedure",name:mcpToolNameSegment(`${verb}_${s.name}`),surface:"admin",surfaces:["admin"],requires:{auth:{all:["ctx.admin"]}},schemas:[...new Set([schema,...inspected.schemas])].sort(),readSchemas:[...new Set([schema,...inspected.readSchemas])].sort(),opaque:inspected.opaque,behavior:{schema,verb,from,to,dependencies:inspected.dependencies}}),generated.push(d)}for(let tool of mediaDefinitions()){addRoute(`admin:tool:${tool.name}`,[],tool.inputSchema);let d=out.at(-1);Object.assign(d,{name:tool.name,readOnly:tool.annotations.readOnlyHint,opaque:!tool.annotations.readOnlyHint,annotations:tool.annotations,behavior:{tool,schemas:plan.schemas}}),generated.push(d)}for(let route of adminRoutes){let deps=route.includes("/views/:")||route==="GET /view-batch"?declarations.filter(d2=>d2.kind==="view"&&(route.includes("/developer/")||plan.views[d2.id.slice(5)]?.surface==="admin")):route.includes("/operations/:")?declarations.filter(d2=>adminOperations.has(d2.id)):route==="POST /webmcp/:tool"?declarations.filter(d2=>mcpTools(plan,"admin").some(t=>`${t.kind}:${t.source}`===d2.id)).concat(generated):[],generic=route.includes("/entries")||route.includes("/statistics")||route==="GET /bootstrap";addRoute(`admin:${route}`,deps,deps.length&&route!=="GET /view-batch"?{...objectInput,anyOf:deps.map(d2=>({type:"object",properties:{[route.includes("/webmcp/")?"tool":"name"]:{type:"string",const:route.includes("/webmcp/")?d2.name:d2.id.slice(d2.kind==="view"?5:10)}}}))}:objectInput);let d=out.at(-1);if(generic){let operation=route==="POST /entries"?"create":route==="DELETE /entries/:id"?"delete":route.startsWith("GET ")?void 0:route.endsWith("/publish")?"publish":"update",inspected=inspectBehavior(plan,void 0,!1,void 0,void 0,operation?Object.keys(plan.schemas).map(schema=>({schema,operation})):[]);d.schemas=Object.keys(plan.schemas).sort(),d.readSchemas=d.schemas,d.opaque=inspected.opaque,d.behavior={schemas:plan.schemas,dependencies:inspected.dependencies}}}return[...new Map(out.map(d=>[d.id,d])).values()].sort((a,b)=>a.id<b.id?-1:a.id>b.id?1:0)}async function hash(value){let digest=await crypto.subtle.digest("SHA-256",new TextEncoder().encode(canonical(value)));return[...new Uint8Array(digest)].map(b=>b.toString(16).padStart(2,"0")).join("")}function hashDefinition(plan,d){return hash({id:d.id,surfaces:d.surfaces,triggers:d.triggers,behavior:d.behavior,input:d.inputSchema,requires:d.requires,restrict:d.restrict,dialect:plan.dialect,schemas:Object.fromEntries(d.schemas.map(name=>[name,plan.schemas[name]])),userFields:plan.access?.userFields,readOnly:d.readOnly,opaque:d.opaque,trustedOnly:d.trustedOnly})}async function targetHash(plan,targetId){let target=targetDefinitions(plan).find(d=>d.id===targetId);if(!target)throw new TypeError(`Unknown target '${targetId}'.`);return hashDefinition(plan,target)}export{canonical,targetDefinitions,hash,hashDefinition,targetHash};

package/dist/domain/describe/index.js

@@ -1,115 +1 @@
-import {
-  canonical,
-  hashDefinition,
-  targetDefinitions,
-  targetHash
-} from "./chunk-ZVXBGP7Y.js";
-
-// src/domain/describe/index.ts
-function requirements(d, surface) {
-  const all = d.requires?.auth?.all ?? [];
-  return {
-    all: surface === "admin" && !all.includes("ctx.admin") ? ["ctx.admin", ...all] : all,
-    ...d.requires?.guard ? { guard: d.requires.guard.procedure } : {}
-  };
-}
-async function describeApp(plan) {
-  const targets = await Promise.all(targetDefinitions(plan).map(async (d) => {
-    const scope = Object.fromEntries(d.schemas.map((name) => {
-      const s = plan.schemas[name];
-      return [name, { ...s.scope ? { owner: s.scope } : {}, terms: s.userScopes ?? [] }];
-    }));
-    return { name: d.name, title: d.title, description: d.description, inputSchema: d.inputSchema, annotations: { ...d.annotations, readOnlyHint: d.readOnly }, _meta: {
-      surfaces: d.surfaces,
-      triggers: d.triggers,
-      id: d.id,
-      targetHash: await hashDefinition(plan, d),
-      readOnly: d.readOnly,
-      scope,
-      restrict: d.restrict,
-      opaque: d.opaque,
-      unscopedReads: d.readSchemas.some((name) => !plan.schemas[name]?.scope && !plan.schemas[name]?.userScopes?.length),
-      trustedOnly: d.trustedOnly,
-      variants: d.variants.map((v) => ({
-        id: v.id,
-        restrict: v.restrict,
-        requires: requirements(v, d.surface),
-        inputSchema: v.inputSchema,
-        readOnly: v.readOnly,
-        trustedOnly: v.trustedOnly,
-        opaque: v.opaque,
-        unscopedReads: v.readSchemas.some((name) => !plan.schemas[name]?.scope && !plan.schemas[name]?.userScopes?.length),
-        scope: Object.fromEntries(v.schemas.map((name) => {
-          const s = plan.schemas[name];
-          return [name, { ...s.scope ? { owner: s.scope } : {}, terms: s.userScopes ?? [] }];
-        }))
-      })),
-      requires: requirements(d, d.surface)
-    } };
-  }));
-  return JSON.parse(canonical({ schemaVersion: 1, access: plan.access?.userFields ?? {}, targets }));
-}
-var securityFlags = ["readOnly", "trustedOnly", "opaque", "unscopedReads"];
-var flagDirection = (field, value) => (field === "readOnly" || field === "trustedOnly" ? !value : value) ? "widened" : "narrowed";
-var inclusion = (before, after) => before.some((t) => !after.includes(t)) ? "widened" : after.some((t) => !before.includes(t)) ? "narrowed" : "changed";
-var exposureDirection = (before, after) => after.some((t) => !before.includes(t) && t !== canonical("internal")) ? "widened" : before.some((t) => !after.includes(t) && t !== canonical("internal")) ? "narrowed" : "changed";
-var combine = (directions) => directions.includes("widened") ? "widened" : directions.length && directions.every((d) => d === "narrowed") ? "narrowed" : "changed";
-var terms = (p) => [...p.owner ? [canonical({ owner: p.owner })] : [], ...p.terms.map(canonical)];
-function policyDirection(before, after, scope) {
-  const directions = [];
-  for (const schema of /* @__PURE__ */ new Set([...Object.keys(before), ...Object.keys(after)])) {
-    const x = before[schema], y = after[schema];
-    if (canonical(x) === canonical(y)) continue;
-    directions.push(scope && (!x || !y) ? x ? "narrowed" : "widened" : inclusion(x ? terms(x) : [], y ? terms(y) : []));
-  }
-  return combine(directions);
-}
-function requiresDirection(x, y) {
-  const directions = [];
-  if (canonical(x.all) !== canonical(y.all)) directions.push(inclusion(x.all.map(canonical), y.all.map(canonical)));
-  if (x.guard !== y.guard) directions.push(!y.guard ? "widened" : !x.guard ? "narrowed" : "changed");
-  return combine(directions);
-}
-function diffApp(a, b) {
-  if (a.schemaVersion !== 1 || b.schemaVersion !== 1) throw new TypeError("Unsupported describe schemaVersion.");
-  const changes = [], old = new Map(a.targets.map((t) => [t._meta.id, t])), next = new Map(b.targets.map((t) => [t._meta.id, t]));
-  for (const id of [.../* @__PURE__ */ new Set([...old.keys(), ...next.keys()])].sort()) {
-    const before = old.get(id), after = next.get(id);
-    if (!before || !after) {
-      changes.push({ id, field: "target", direction: before ? "narrowed" : "widened" });
-      continue;
-    }
-    const x = before._meta, y = after._meta, start = changes.length;
-    const record = (field, left, right, direction) => {
-      if (canonical(left) !== canonical(right)) changes.push({ id, field, direction, before: left, after: right });
-    };
-    record("scope", x.scope, y.scope, policyDirection(x.scope, y.scope, true));
-    record("restrict", x.restrict, y.restrict, policyDirection(x.restrict, y.restrict, false));
-    record("requires", x.requires, y.requires, requiresDirection(x.requires, y.requires));
-    for (const field of ["surfaces", "triggers"]) record(field, x[field], y[field], exposureDirection(x[field].map(canonical), y[field].map(canonical)));
-    for (const field of securityFlags) record(field, x[field], y[field], flagDirection(field, y[field]));
-    record("inputSchema", before.inputSchema, after.inputSchema, "changed");
-    const directions = [];
-    const variants = new Map(x.variants.map((v) => [v.id, v])), added = new Map(y.variants.map((v) => [v.id, v]));
-    for (const name of /* @__PURE__ */ new Set([...variants.keys(), ...added.keys()])) {
-      const left = variants.get(name), right = added.get(name);
-      if (canonical(left) === canonical(right)) continue;
-      if (!left || !right) directions.push(left ? "narrowed" : "widened");
-      else {
-        if (canonical(left.scope) !== canonical(right.scope)) directions.push(policyDirection(left.scope, right.scope, true));
-        if (canonical(left.restrict) !== canonical(right.restrict)) directions.push(policyDirection(left.restrict, right.restrict, false));
-        if (canonical(left.requires) !== canonical(right.requires)) directions.push(requiresDirection(left.requires, right.requires));
-        if (canonical(left.inputSchema) !== canonical(right.inputSchema)) directions.push("changed");
-        for (const field of securityFlags) if (left[field] !== right[field]) directions.push(flagDirection(field, right[field]));
-      }
-    }
-    record("variants", x.variants, y.variants, combine(directions));
-    if (changes.length === start && x.targetHash !== y.targetHash) changes.push({ id, field: "behavior", direction: "changed" });
-  }
-  return changes;
-}
-export {
-  describeApp,
-  diffApp,
-  targetHash
-};
+import{canonical,hashDefinition,targetDefinitions,targetHash}from"./chunk-SGMRVDGE.js";function requirements(d,surface){let all=d.requires?.auth?.all??[];return{all:surface==="admin"&&!all.includes("ctx.admin")?["ctx.admin",...all]:all,...d.requires?.guard?{guard:d.requires.guard.procedure}:{}}}async function describeApp(plan){let targets=await Promise.all(targetDefinitions(plan).map(async d=>{let scope=Object.fromEntries(d.schemas.map(name=>{let s=plan.schemas[name];return[name,{...s.scope?{owner:s.scope}:{},terms:s.userScopes??[]}]}));return{name:d.name,title:d.title,description:d.description,inputSchema:d.inputSchema,annotations:{...d.annotations,readOnlyHint:d.readOnly},_meta:{surfaces:d.surfaces,triggers:d.triggers,id:d.id,targetHash:await hashDefinition(plan,d),readOnly:d.readOnly,scope,restrict:d.restrict,opaque:d.opaque,unscopedReads:d.readSchemas.some(name=>!plan.schemas[name]?.scope&&!plan.schemas[name]?.userScopes?.length),trustedOnly:d.trustedOnly,variants:d.variants.map(v=>({id:v.id,restrict:v.restrict,requires:requirements(v,d.surface),inputSchema:v.inputSchema,readOnly:v.readOnly,trustedOnly:v.trustedOnly,opaque:v.opaque,unscopedReads:v.readSchemas.some(name=>!plan.schemas[name]?.scope&&!plan.schemas[name]?.userScopes?.length),scope:Object.fromEntries(v.schemas.map(name=>{let s=plan.schemas[name];return[name,{...s.scope?{owner:s.scope}:{},terms:s.userScopes??[]}]}))})),requires:requirements(d,d.surface)}}}));return JSON.parse(canonical({schemaVersion:1,access:plan.access?.userFields??{},targets}))}var securityFlags=["readOnly","trustedOnly","opaque","unscopedReads"],flagDirection=(field,value)=>(field==="readOnly"||field==="trustedOnly"?!value:value)?"widened":"narrowed",inclusion=(before,after)=>before.some(t=>!after.includes(t))?"widened":after.some(t=>!before.includes(t))?"narrowed":"changed",exposureDirection=(before,after)=>after.some(t=>!before.includes(t)&&t!==canonical("internal"))?"widened":before.some(t=>!after.includes(t)&&t!==canonical("internal"))?"narrowed":"changed",combine=directions=>directions.includes("widened")?"widened":directions.length&&directions.every(d=>d==="narrowed")?"narrowed":"changed",terms=p=>[...p.owner?[canonical({owner:p.owner})]:[],...p.terms.map(canonical)];function policyDirection(before,after,scope){let directions=[];for(let schema of new Set([...Object.keys(before),...Object.keys(after)])){let x=before[schema],y=after[schema];canonical(x)!==canonical(y)&&directions.push(scope&&(!x||!y)?x?"narrowed":"widened":inclusion(x?terms(x):[],y?terms(y):[]))}return combine(directions)}function requiresDirection(x,y){let directions=[];return canonical(x.all)!==canonical(y.all)&&directions.push(inclusion(x.all.map(canonical),y.all.map(canonical))),x.guard!==y.guard&&directions.push(y.guard?x.guard?"changed":"narrowed":"widened"),combine(directions)}function diffApp(a,b){if(a.schemaVersion!==1||b.schemaVersion!==1)throw new TypeError("Unsupported describe schemaVersion.");let changes=[],old=new Map(a.targets.map(t=>[t._meta.id,t])),next=new Map(b.targets.map(t=>[t._meta.id,t]));for(let id of[...new Set([...old.keys(),...next.keys()])].sort()){let before=old.get(id),after=next.get(id);if(!before||!after){changes.push({id,field:"target",direction:before?"narrowed":"widened"});continue}let x=before._meta,y=after._meta,start=changes.length,record=(field,left,right,direction)=>{canonical(left)!==canonical(right)&&changes.push({id,field,direction,before:left,after:right})};record("scope",x.scope,y.scope,policyDirection(x.scope,y.scope,!0)),record("restrict",x.restrict,y.restrict,policyDirection(x.restrict,y.restrict,!1)),record("requires",x.requires,y.requires,requiresDirection(x.requires,y.requires));for(let field of["surfaces","triggers"])record(field,x[field],y[field],exposureDirection(x[field].map(canonical),y[field].map(canonical)));for(let field of securityFlags)record(field,x[field],y[field],flagDirection(field,y[field]));record("inputSchema",before.inputSchema,after.inputSchema,"changed");let directions=[],variants=new Map(x.variants.map(v=>[v.id,v])),added=new Map(y.variants.map(v=>[v.id,v]));for(let name of new Set([...variants.keys(),...added.keys()])){let left=variants.get(name),right=added.get(name);if(canonical(left)!==canonical(right))if(!left||!right)directions.push(left?"narrowed":"widened");else{canonical(left.scope)!==canonical(right.scope)&&directions.push(policyDirection(left.scope,right.scope,!0)),canonical(left.restrict)!==canonical(right.restrict)&&directions.push(policyDirection(left.restrict,right.restrict,!1)),canonical(left.requires)!==canonical(right.requires)&&directions.push(requiresDirection(left.requires,right.requires)),canonical(left.inputSchema)!==canonical(right.inputSchema)&&directions.push("changed");for(let field of securityFlags)left[field]!==right[field]&&directions.push(flagDirection(field,right[field]))}}record("variants",x.variants,y.variants,combine(directions)),changes.length===start&&x.targetHash!==y.targetHash&&changes.push({id,field:"behavior",direction:"changed"})}return changes}export{describeApp,diffApp,targetHash};

package/dist/domain/describe/target-hash.js

@@ -1,12 +1 @@
-import {
-  canonical,
-  hash,
-  hashDefinition,
-  targetHash
-} from "./chunk-ZVXBGP7Y.js";
-export {
-  canonical,
-  hash,
-  hashDefinition,
-  targetHash
-};
+import{canonical,hash,hashDefinition,targetHash}from"./chunk-SGMRVDGE.js";export{canonical,hash,hashDefinition,targetHash};

package/dist/domain/entry.js

@@ -1,29 +1,15 @@
-/** Direct entry files: one View or Procedure per module, so a request bundle excludes the others. */
-/**
- * Stable, injective build-only export names, so a stale entry file cannot bind a new ordinal: every byte outside [A-Za-z0-9]
- * (including `$` and `_`) is `$` and two hex digits.
- * @internal
- */
 export const exportName = (kind, name) => kind + "_" + name.replace(/[^A-Za-z0-9]+/g, run => Array.from(new TextEncoder().encode(run), b => "$" + b.toString(16).padStart(2, "0")).join(""));
-/** A direct entry: `import` then `export`, because Bun 1.3 drops a bare `export { x as default } from` binding under "sideEffects": false. `extra` is any further re-export line. */
-/** @internal */
 export const entry = (kind, name, types, extra = "") => `import { ${exportName(kind, name)} as operation } from "../generated.js";\nexport default operation;\nexport type { ${types} } from "../generated.js";\n${extra}`;
-/** Source text of a JSON value. @internal */
 export const q = JSON.stringify;
-/** Whether a target's database is SQLite (bun:sqlite or D1). @internal */
 export const isSqlite = (target) => target === "bun-sqlite" || target === "cloudflare-d1";
-/** A View's lazy paged boundary and validated query reader, bound as `page<index>` and `<query><index>`. @internal */
 export const viewImports = (name, index, query = "query") => [`const page${index}: typeof import("./paged/views/${encodeURIComponent(name)}.js").default = async (...args) => (await import("./paged/views/${encodeURIComponent(name)}.js")).default(...args);`, `import { query as ${query}${index} } from "./validation/views/${encodeURIComponent(name)}.js";`];
-/** A generated host handle import, shared by the optional boundaries. @internal */
 export const driverFor = (target) => target === "bun-sqlite" ? "bun-sqlite" : target === "cloudflare-d1" ? "d1" : "postgres";
 export const databaseImport = (target) => driverFor(target) === "postgres" ? 'import type { Postgres as Database } from "@aotter/mantle/contracts";' : `import type { Handle as Database } from "@aotter/mantle/driver/${driverFor(target)}";`;
-/** Shared source ownership marker; only newly emitted files are wrapped. */
 export const GENERATED = "Generated by mantle generate — do not edit.";
 export function generatedFiles(files) {
     return Object.fromEntries(Object.entries(files).map(([name, source]) => [name,
         `${name.endsWith(".sql") ? "--" : "//"} ${GENERATED}\n${source}`]));
 }
-/** JavaScript data literals preserve own __proto__ keys instead of mutating the object's prototype. */
 export function literal(value) {
     if (Array.isArray(value))
         return `[${value.map(literal).join(",")}]`;

package/dist/domain/generated-tools.js

@@ -1,5 +1,4 @@
 export const publishingTransitions = [["publish", ["draft"], "published"], ["unpublish", ["published", "archived"], "draft"], ["archive", ["draft", "published"], "archived"]];
-/** Only archive withdraws an entry from both drafts and the public. */
 export const publishingAnnotations = (verb) => ({ readOnlyHint: false, destructiveHint: verb === "archive" });
 export const publishingInput = { type: "object", properties: { id: { type: "string", minLength: 1 }, expectedVersion: { type: "integer", minimum: 1 } }, required: ["id", "expectedVersion"], additionalProperties: false };
 export function mediaDefinitions() {

package/dist/domain/input.js

@@ -1,5 +1,4 @@
 import { q } from "./entry.js";
-/** The kernel's `Conversions` for the fields an input bind reads (see kernel/surface), as a literal; empty when none. */
 export function conversions(properties, binds, target) {
     const fields = Object.keys(properties ?? {}).flatMap(field => {
         const bind = binds.find(b => b.k === "input" && String(b.name).toLowerCase() === field.toLowerCase());
@@ -10,7 +9,6 @@ export function conversions(properties, binds, target) {
     });
     return fields.length ? q(fields) : "";
 }
-/** Only build-time authorization assembly; generated queries retain their existing predicates. @internal */
 export const authLines = (requires, path, binds = [], sqlite = true, trustedOnly = false) => [...(trustedOnly ? [`  deny(caller, caller.kind === "system", ${q(path)});`] : []), ...(requires?.auth?.all ?? []).map((p, index) => {
         const allowed = typeof p === "string" ? p === "ctx.admin" ? 'isAdmin(caller)' : 'isUser(caller)' : `caller.kind === "user" && caller.scopes.includes(${q(p["ctx.auth.scope"])})`;
         return `  deny(caller, ${allowed}, ${q(`${path}/requires/auth/all/${index}`)});`;

package/dist/domain/paging.js

@@ -1,17 +1,12 @@
-/** Build-time proofs for the compiler's keyset keys. No AST reaches a generated operation. */
 import { NATIVE_COLUMNS, NATIVE_NOT_NULL, notNullColumns } from "../build/compiler.js";
 import { declaredType } from "./columns.js";
-/** Storage column -> the native field a manifest index names. */
 const NATIVE_FIELDS = new Map(Object.entries(NATIVE_COLUMNS).map(([field, column]) => [column, field]));
 const fieldName = (n) => n.ColumnRef?.fields?.at(-1)?.String?.sval;
 const scalar = (n) => !!(n.ParamRef || n.A_Const || n.TypeCast && scalar(n.TypeCast.arg));
-// A user-field term lowers to the dialect's anyOf, `(col) IN (SELECT value FROM json_each((?)))` or `(col) = ANY(CAST(...(?)...))`.
 const anyOf = (raw) => raw?.length === 8 && raw[1]?.ColumnRef && raw[5]?.ParamRef && /^ (IN \(SELECT value FROM json_each\(|= ANY\()/.test(raw[3]);
-// A scope prints `/*s:field*/ kept /*|*/ kept OR 1 = 1 /*;*/`, so `{ all: true }` drops it; any other anyOf is a restrict, which it never lifts.
 const scopeTerm = (raw) => typeof raw?.[0] === "string" && raw[0].startsWith("/*s:");
 const restricts = (n) => !!n && typeof n === "object" && (anyOf(n.Raw?.parts) || !scopeTerm(n.Raw?.parts) && Object.values(n).some(restricts));
 const aggregate = (n) => !!n && !n.SubLink && !n.SelectStmt && (n.FuncCall && !n.FuncCall.over && ["count", "sum", "min", "max", "avg"].includes(n.FuncCall.funcname?.at(-1)?.String?.sval) || Object.values(n).some(v => v && typeof v === "object" && (Array.isArray(v) ? v.some(aggregate) : aggregate(v))));
-/** Only complete grouped tuples, base ids and non-fanning singleton joins are proved. */
 export function provePaging(plan, ast) {
     let reason;
     const fail = (message) => { reason = message; return undefined; };
@@ -50,7 +45,6 @@ export function provePaging(plan, ast) {
                     return fail(`Fanning join '${[...aliases.keys()].filter(alias => !before.has(alias)).join(", ")}': join on the joined Schema's id or a single-field unique key, or reduce it to one row.`);
                 if (n.JoinExpr.jointype === "JOIN_FULL" || n.JoinExpr.jointype === "JOIN_RIGHT")
                     return;
-                // The right side of LEFT JOIN may be absent: its fields cannot become NOT NULL cursor keys.
                 if (n.JoinExpr.jointype === "JOIN_LEFT")
                     for (const [alias, r] of aliases)
                         if (!before.has(alias))
@@ -73,7 +67,6 @@ export function provePaging(plan, ast) {
             else if (sub)
                 fact = select(sub.subquery.SelectStmt, ctes)?.relation;
             if (fact) {
-                // Two aliases of one Schema/CTE are distinct row sources, including a singleton joined to many rows.
                 const sources = new Map();
                 fact = { ...fact, fields: new Map([...fact.fields].map(([name, f]) => {
                         if (!sources.has(f.source))
@@ -117,8 +110,6 @@ export function provePaging(plan, ast) {
         const fixed = (n) => {
             if (n?.BoolExpr?.boolop === "AND_EXPR")
                 n.BoolExpr.args.forEach(fixed);
-            // `col IN auth.user(field)` (a scope or restrict) never fixes a prefix (#1644): the plan is prepared for a set, so
-            // native ORDER BY after it reads and sorts all the caller's rows. It is only remembered for the refusal's guidance.
             const raw = n?.Raw?.parts;
             if (scopeTerm(raw))
                 return fixed(raw[1]);
@@ -151,9 +142,7 @@ export function provePaging(plan, ast) {
         const same = (a, b) => a && b && a.name === b.name && a.source === b.source;
         if (sorts.length) {
             if (group.length) {
-                // Full GROUP BY keys, not an id from an arbitrary row in the group, make the result unique.
                 if (!group.every(g => {
-                    // GROUP BY prefers an input column over a colliding output alias; ORDER BY does the reverse.
                     const source = g.ColumnRef?.fields?.length === 1 ? [...aliases.values()].filter(r => r.names.has(fieldName(g))) : [];
                     const f = source.length ? source.length === 1 ? source[0].fields.get(fieldName(g)) : undefined : resolve(g);
                     return f?.notNull && keys.some(k => same(k, f));
@@ -175,21 +164,16 @@ export function provePaging(plan, ast) {
                         return order.every((f, n) => index[i + n] === f.name);
                     });
                     if (!serving(base.fixed)) {
-                        // SQL names a column (`created_at`), a manifest index the field (`createdAt`).
                         const index = serving(new Set([...base.fixed, ...base.sets])), named = (c) => schema.names?.[c] ?? c, field = (c) => schema.names?.[c] ?? NATIVE_FIELDS.get(c) ?? c;
                         const columns = order.map(f => named(f.name)).join(", "), fields = order.map(f => field(f.name)).join(", ");
                         if (!index)
                             return fail(`Missing index for ORDER BY (${columns}): declare a Schema index with [${fields}] in this order after any fixed equality prefix.`);
                         const prefix = index.slice(0, index.indexOf(order[0].name)), set = prefix.filter(c => !base.fixed.has(c));
-                        // The suggested order is the index from its first set-bound column: an equality-fixed column between stays in it.
                         const lead = prefix.slice(prefix.indexOf(set[0])), quoted = (cs) => cs.map(c => `'${field(c)}'`).join(", ");
-                        // The scope-first order is offered only when SQL can name every added column and none can be null. The owner
-                        // scope column is NOT NULL in storage, but a View cannot address it.
                         const notNull = notNullColumns(schema), owner = lead.filter(c => c === schema.scope), nullable = lead.filter(c => !NATIVE_NOT_NULL.has(c) && !notNull.has(c) && c !== schema.scope);
                         const dir = (f) => sorts[keys.indexOf(f)].SortBy.sortby_dir === "SORTBY_DESC" ? " DESC" : "";
                         const sorted = [...lead.map(c => named(c) + dir(order[0])), ...order.map(f => named(f.name) + dir(f))].join(", ");
                         const desc = order.some(f => dir(f)) ? ", read backwards; on PostgreSQL confirm with EXPLAIN that no Sort remains" : "";
-                        // `{ all: true }` drops only scope terms: offer it an index on the View's equality-fixed columns, unless a restrict remains.
                         const eq = [...base.fixed].filter(c => c !== "id" && !order.some(f => f.name === c));
                         const ways = [...nullable.length || owner.length ? [] : [`ORDER BY ${sorted} (same index${desc})`], ...restricts(ast) ? [] : [`for { all: true } callers only, index [${[...eq.map(field), fields].join(", ")}, id]`]];
                         const why = [...owner.length ? [`${quoted(owner)} is the owner column, which SQL cannot name`] : [], ...nullable.length ? [`${quoted(nullable)} can be null`] : []];
@@ -205,7 +189,6 @@ export function provePaging(plan, ast) {
     const result = select(ast.SelectStmt);
     return result ? { types: result.keys.map(f => f.type), single: result.relation.single } : reason ? { types: [], single: false, reason } : undefined;
 }
-/** Cast only cursor ParamRefs in the outer predicate, never authored literals or bare projections. */
 export function castCursor(ast, sources, types, postgres) {
     const typeOf = (source) => source && "cursor" in source ? types[source.cursor] : undefined;
     const typed = (type) => type && (postgres ? ["timestamptz", "date"] : ["integer", "int4", "int8"]).includes(type);

package/dist/domain/recipes.js

@@ -1,19 +1,22 @@
-const KINDS = new Set(["uid", "admin", "user", "now", "cutoff", "const", "input", "version"]);
-/** @internal */
+const KINDS = new Set(["uid", "admin", "user", "now", "cutoff", "const", "input", "version", "scoped"]);
 export function recipesOf(statement, fields, refuse, values) {
+    const field = (bound) => {
+        const name = fields.find(field => field.toLowerCase() === String(bound).toLowerCase());
+        if (name === undefined)
+            refuse(`Input bind '${bound}' has no declared field.`);
+        return name ?? String(bound);
+    };
     return statement.binds.map(b => {
         if (!KINDS.has(b.k))
             refuse(`Bind recipe '${b.k}' needs an explicit native implementation.`);
         if (b.k === "now" || b.k === "cutoff")
             values?.add(b.k);
+        if (b.k === "scoped" && b.name !== undefined)
+            return { ...b, name: field(b.name) };
         if (b.k !== "input")
             return b;
         if (b.type === "date" || b.type === "timestamptz")
             values?.add(b.type === "date" ? "date" : "timestamp");
-        const name = fields.find(field => field.toLowerCase() === String(b.name).toLowerCase());
-        if (name === undefined)
-            refuse(`Input bind '${b.name}' has no declared field.`);
-        // only a date-time or a date is converted at bind time (`encode` in kernel/binds)
-        return { k: "input", name: name ?? String(b.name), ...(b.type === "timestamptz" || b.type === "date" ? { type: b.type } : {}) };
+        return { k: "input", name: field(b.name), ...(b.type === "timestamptz" || b.type === "date" || b.type === "json" ? { type: b.type } : {}) };
     });
 }

package/dist/domain/userReferences.js

@@ -1,4 +1,3 @@
-/** Conditional capability imports keep applications without user references unchanged. */
 export function userReferences(plan, sqlite) {
     const used = !!plan.access;
     return { used, code: used ? `import * as USER from "@aotter/mantle/user-fields";\nconst USER_VALUES = { scopeInsert: USER.scopeInsert, scopedAll: USER.scopedAll, userRefs: USER.userRefs(${sqlite}, 1) };` : '', values: used ? '...USER_VALUES' : '' };

package/dist/domain/wireScalars.js

@@ -1,11 +1,6 @@
 import { declaredType } from "./columns.js";
 const raw = (...parts) => ({ Raw: { parts } });
-/** Temporal SQL forms, plus selected integer text before driver rounding. */
 const wire = (type, d, v, boundary = false) => type === "timestamptz" ? raw(...d.wireTimestamp(v)) : type === "date" ? raw(...d.wireDate(v)) : boundary && type && ["integer", "int8", "int4"].includes(type) ? raw("CAST(", v, " AS text)") : undefined;
-/**
- * Formats declared temporal outputs and selected integers in a View's top-level SELECT, preserving names.
- * Returns a refusal when the outputs cannot be matched to SELECT items by position.
- */
 export function wireScalars(ast, keys, types, d, boundary = false) {
     if (!types.some(type => type === "timestamptz" || type === "date" || boundary && type && ["integer", "int8", "int4"].includes(type)) || !ast.SelectStmt)
         return ast;
@@ -24,7 +19,6 @@ export function wireScalars(ast, keys, types, d, boundary = false) {
     const out = select(ast.SelectStmt);
     return typeof out === "string" ? out : { ...ast, SelectStmt: out };
 }
-/** The same wire form for a write's RETURNING list (Core has already expanded `*`): a column of the written table is wrapped by its declared type. */
 export function wireReturning(ast, schemas, d, boundary = false) {
     const [kind, stmt] = Object.entries(ast)[0] ?? [];
     const list = stmt?.returningClause?.exprs;

package/dist/infrastructure/adminEntries.js

@@ -1,4 +1,3 @@
-/** Selected Admin queries/procedures: Core checks, rewrites and prints every native fragment at generation. */
 import { enumOptions, protectedColumns } from "../build/compiler.js";
 import { parsePgSql } from "../build/compiler.js";
 import { compileProgram } from "../build/compiler.js";
@@ -6,6 +5,8 @@ import { adminOrder } from "../domain/adminOrder.js";
 import { declaredType, serverOwned } from "../domain/columns.js";
 import { wireScalars, wireReturning } from "../domain/wireScalars.js";
 import { recipesOf } from "../domain/recipes.js";
+import { refChecks } from "../build/compiler.js";
+import { renderTerm } from "../kernel/store.js";
 const ref = (...names) => ({ ColumnRef: { fields: names.map(sval => ({ String: { sval } })) } });
 const op = (lexpr, rexpr) => ({ A_Expr: { kind: "AEXPR_OP", name: [{ String: { sval: "=" } }], lexpr, rexpr } });
 const and = (...args) => args.length === 1 ? args[0] : { BoolExpr: { boolop: "AND_EXPR", args } };
@@ -29,14 +30,18 @@ export async function adminEntries(plan, dialect, wire, refusals) {
             const columns = [...system(s), ...fields(s)], writable = Object.keys(s.fields).filter(f => f !== s.scope && s.fields[f] !== "geo");
             const parent = s.translates && plan.schemas[s.translates.parent.toLowerCase()];
             const types = columns.map(f => declaredType(s.fields, f) ?? (f === "version" ? "integer" : f.endsWith("_lat") || f.endsWith("_lng") ? "real" : "text"));
-            // Compiler scope names belong only to relations this generated query can reference.
             const schemas = Object.create(null);
             let relation = s;
             while (relation && !Object.hasOwn(schemas, relation.name)) {
                 schemas[relation.name] = relation;
                 relation = relation.translates ? plan.schemas[relation.translates.parent.toLowerCase()] : undefined;
             }
-            const ctx = (kind, trusted, inputs) => ({ dialect, schemas, inputs, kind, mode: trusted ? "trusted" : "admin" });
+            const ctx = (kind, trusted, inputs) => ({ dialect, schemas, inputs, kind, mode: trusted ? "trusted" : "admin", uncheckedRefs: true });
+            const refs = (child) => Object.fromEntries(refChecks(s, plan.schemas).filter(r => writable.includes(r.column)).map(r => {
+                const holes = [], hole = (value) => { const token = wire.param(marker + 1 + holes.length); holes.push([token, value]); return token; };
+                const sql = `EXISTS (SELECT 1 FROM ${wire.ident(r.table)} _mantle_ref WHERE ${[`_mantle_ref.${wire.ident(r.field)} = ${hole(r.column)}`, ...r.same.map(([parent, column]) => `_mantle_ref.${wire.ident(parent)} = ${child(column, hole)}`), ...r.terms.map(t => renderTerm(wire, t, "_mantle_ref.", hole))].join(" AND ")})`;
+                return [r.column, { sql, holes }];
+            }));
             const select = `SELECT ${columns.map(c => `${wire.ident(s.name)}.${wire.ident(c)}`).join(",")} FROM ${wire.ident(s.name)}`;
             const base = await parse(select);
             const project = (ast, names, keys) => {
@@ -83,10 +88,8 @@ export async function adminEntries(plan, dialect, wire, refusals) {
                 const [compiled] = compileProgram(base, ctx("view", trusted, {}));
                 if (!compiled)
                     throw Error("Missing compiled collection View.");
-                // Keep the compiler's verified policy, but share the physical SELECT template at requests.
                 const baseInner = compiled.ast.SelectStmt.fromClause[0].RangeSubselect.subquery.SelectStmt, policy = baseInner.whereClause;
                 compiled.ast.SelectStmt.fromClause = [baseInner.fromClause[0]];
-                // The native merge is a scalar-id lookup, never a fanning join. Core owns both sides' visibility.
                 if (parent) {
                     const own = new Set(Object.keys(s.fields).flatMap(f => s.fields[f] === "geo" ? [f + "_lat", f + "_lng"] : [f]));
                     const inherited = fields(parent).filter(f => !own.has(f)), on = s.translates.on.toLowerCase(), alias = "_mantle_merge";
@@ -109,7 +112,6 @@ export async function adminEntries(plan, dialect, wire, refusals) {
                 const names = compiled.ast.SelectStmt.targetList.map((t) => t.ResTarget.name ?? t.ResTarget.val.ColumnRef.fields.at(-1).String.sval);
                 const projection = print(project({ SelectStmt: { targetList: compiled.ast.SelectStmt.targetList, op: "SETOP_NONE", limitOption: "LIMIT_OPTION_DEFAULT" } }, names, [])).replace(/^SELECT /, "");
                 const from = print({ SelectStmt: { ...compiled.ast.SelectStmt, targetList: [{ ResTarget: { val: { A_Const: { ival: { ival: 1 } } } } }] } }).replace(/^SELECT 1/, "");
-                // Core compiles all writable fields once; request-time work selects only generated fragments.
                 const inputs = { ...Object.fromEntries(writable.map(f => [f, s.fields[f]])), id: "text" };
                 const returning = columns.map(wire.ident).join(",");
                 const insertAst = writable.length ? (await parse(`INSERT INTO ${wire.ident(s.name)} (${writable.map(wire.ident).join(",")}) VALUES (${writable.map(f => `input.${wire.ident(f)}`).join(",")}) RETURNING ${returning}`))[0] : { InsertStmt: { relation: { RangeVar: { relname: s.name, mantle: "table", inh: true, relpersistence: "p" } }.RangeVar, cols: [], selectStmt: { SelectStmt: { valuesLists: [{ List: { items: [] } }] } }, returningClause: { exprs: columns.map(f => ({ ResTarget: { val: ref(f) } })) } } };
@@ -142,7 +144,8 @@ export async function adminEntries(plan, dialect, wire, refusals) {
                 for (const [i, field] of writable.entries())
                     entryFields[field] = { column: wire.ident(field), insert: expr(insert.selectStmt.SelectStmt.fromClause[0].RangeSubselect.subquery.SelectStmt.valuesLists[0].List.items[i]), ...(!protectedColumns(s).includes(field) && !serverOwned(s.schema, field) ? { update: wire.ident(field) + " = " + expr(update.targetList[updateFields.indexOf(field)].ResTarget.val) } : {}) };
                 const returnSQL = (ast) => " RETURNING " + ast.returningClause.exprs.map((t) => expr(t.ResTarget.val) + (t.ResTarget.name ? " AS " + wire.ident(t.ResTarget.name) : "")).join(",");
-                return { projection, from, policy: policy ? expr(policy) : "", binds: recipesOf(compiled, [], message => { throw Error(message); }), fields: entryFields, create: { prefix: print(create.ast).slice(0, print(create.ast).indexOf(" (")) + " (", between: ") VALUES (", suffix: ")", binds: create.binds, columns: insert.cols.slice(writable.length).map((t) => wire.ident(t.ResTarget.name)), values: insert.selectStmt.SelectStmt.targetList.slice(writable.length ? 1 : 0).map((t) => expr(t.ResTarget.val)), returning: returnSQL(insert) }, patch: { prefix: print(patch.ast).slice(0, print(patch.ast).indexOf(" SET ")) + " SET ", binds: patch.binds, sets: update.targetList.slice(updateFields.length).map((t) => wire.ident(t.ResTarget.name) + " = " + expr(t.ResTarget.val)), where: " WHERE " + expr(update.whereClause), returning: returnSQL(update) }, remove: { sql: print(remove.ast), binds: remove.binds, row: true } };
+                const created = trusted ? {} : refs((column, hole) => hole(column)), patched = trusted ? {} : refs(column => wire.ident(s.name) + "." + wire.ident(column));
+                return { projection, from, policy: policy ? expr(policy) : "", binds: recipesOf(compiled, [], message => { throw Error(message); }), fields: entryFields, create: { ...(Object.keys(created).length ? { refs: created } : {}), prefix: print(create.ast).slice(0, print(create.ast).indexOf(" (")) + " (", between: ") VALUES (", suffix: ")", binds: create.binds, columns: insert.cols.slice(writable.length).map((t) => wire.ident(t.ResTarget.name)), values: insert.selectStmt.SelectStmt.targetList.slice(writable.length ? 1 : 0).map((t) => expr(t.ResTarget.val)), returning: returnSQL(insert) }, patch: { ...(Object.keys(patched).length ? { refs: patched } : {}), prefix: print(patch.ast).slice(0, print(patch.ast).indexOf(" SET ")) + " SET ", binds: patch.binds, sets: update.targetList.slice(updateFields.length).map((t) => wire.ident(t.ResTarget.name) + " = " + expr(t.ResTarget.val)), where: " WHERE " + expr(update.whereClause), returning: returnSQL(update) }, remove: { sql: print(remove.ast), binds: remove.binds, row: true } };
             }));
             result[s.name] = { ...(s.userScopes?.length ? { userScopes: s.userScopes } : {}), cursorAliases, scoped: !!s.scope, path: "schemas/" + s.name + "/admin", marker: markerText, id: wire.ident(s.name) + "." + wire.ident("id"), fields: fieldFacts, orderFields: Object.keys(ordered), search: `(${wire.ident(s.name)}.${wire.ident("id")} = ${markerText}${s.search?.length ? ` OR ${wire.search(s.name, s.search, wire.ident(s.name), markerText)}` : ""})`, statistics: { rowsAlias, column: wire.ident(s.name) + "." + wire.ident("created_at"), time: postgres ? `extract(epoch FROM ${wire.ident(s.name)}.${wire.ident("created_at")}) * 1000000` : wire.ident(s.name) + "." + wire.ident("created_at"), subtype }, caller: modes[0], trusted: modes[1] };
         }