@dforge-core/dforge-mcp 0.2.22 → 0.2.24

package/dist/server.js

@@ -31002,7 +31002,7 @@ var import_node_crypto = require("crypto");
 var fs2 = __toESM(require("fs"));
 var path2 = __toESM(require("path"));
 
-// node_modules/.pnpm/@dforge-core+dforge-cli@0.2.17/node_modules/@dforge-core/dforge-cli/dist/lib.mjs
+// node_modules/.pnpm/@dforge-core+dforge-cli@0.2.19/node_modules/@dforge-core/dforge-cli/dist/lib.mjs
 function buildManifest(opts, moduleId) {
   const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
   const manifest = {
@@ -31283,7 +31283,7 @@ function buildZedTasks() {
 var fs = __toESM(require("fs"));
 var path = __toESM(require("path"));
 
-// node_modules/.pnpm/@dforge-core+metadata@0.0.22/node_modules/@dforge-core/metadata/dist/index.js
+// node_modules/.pnpm/@dforge-core+metadata@0.0.27/node_modules/@dforge-core/metadata/dist/index.js
 var AggType = {
   Sum: "sum",
   Count: "count",
@@ -31435,30 +31435,68 @@ function applyTemplate(value, entity) {
   const local = entity.split(".").pop() ?? entity;
   return value.replace(/\{entity\}/g, local).replace(/\{Entity\}/g, titleCaseEntity(entity));
 }
-function templateFields(fields, entity) {
-  const out = {};
-  for (const [name, def] of Object.entries(fields)) {
-    const key = applyTemplate(name, entity);
-    const next = { ...def };
-    if (typeof next.description === "string") next.description = applyTemplate(next.description, entity);
-    out[key] = next;
+function templateField(def, entity) {
+  const next = { ...def };
+  if (typeof next.description === "string") next.description = applyTemplate(next.description, entity);
+  return next;
+}
+function emptyFields() {
+  return /* @__PURE__ */ Object.create(null);
+}
+function typeKeyOf(def) {
+  return def.columnType ?? def.dbDatatype ?? def.fieldTypeCd;
+}
+function addTraitField(sink, key, def) {
+  const existing = sink.fields[key];
+  if (!Object.hasOwn(sink.fields, key)) {
+    sink.fields[key] = def;
+    sink.origin.set(key, "trait");
+    return;
+  }
+  if (sink.conflicts && !sink.conflicts.some((c) => c.field === key)) {
+    const existingType = typeKeyOf(existing);
+    const traitType = typeKeyOf(def);
+    if (existingType !== traitType) {
+      sink.conflicts.push({
+        field: key,
+        existingFrom: sink.origin.get(key) ?? "trait",
+        existingType,
+        traitType
+      });
+    }
   }
-  return out;
 }
-function expandTrait(traitCd, entityName) {
-  const trait = byCd3.get(traitCd);
-  if (!trait) return {};
-  const result = {};
-  for (const included of trait.includes ?? []) {
-    Object.assign(result, expandTrait(included, entityName));
+function expandTraitInner(traitCd, entityName, localTraits, path18, sink) {
+  if (path18.has(traitCd)) return;
+  path18.add(traitCd);
+  const trait = localTraits && Object.hasOwn(localTraits, traitCd) ? localTraits[traitCd] : byCd3.get(traitCd);
+  if (trait) {
+    for (const included of trait.includes ?? []) {
+      expandTraitInner(included, entityName, localTraits, path18, sink);
+    }
+    for (const [name, def] of Object.entries(trait.fields ?? {})) {
+      addTraitField(sink, applyTemplate(name, entityName), templateField(def, entityName));
+    }
   }
-  Object.assign(result, templateFields(trait.fields, entityName));
-  return result;
+  path18.delete(traitCd);
 }
-function expandTraits(traitCds, entityName) {
-  const result = {};
-  for (const cd of traitCds) Object.assign(result, expandTrait(cd, entityName));
-  return result;
+function expandTraits(traitCds, entityName, localTraits) {
+  const sink = { fields: emptyFields(), origin: /* @__PURE__ */ new Map() };
+  for (const cd of traitCds) {
+    expandTraitInner(cd, entityName, localTraits, /* @__PURE__ */ new Set(), sink);
+  }
+  return sink.fields;
+}
+function traitFieldConflicts(traitCds, entityName, opts = {}) {
+  const sink = { fields: emptyFields(), origin: /* @__PURE__ */ new Map(), conflicts: [] };
+  for (const [key, def] of Object.entries(opts.fields ?? {})) {
+    sink.fields[key] = def;
+    sink.origin.set(key, "field");
+  }
+  for (const cd of traitCds) {
+    expandTraitInner(cd, entityName, opts.localTraits, /* @__PURE__ */ new Set(), sink);
+  }
+  return sink.conflicts;
 }
 var NUMERIC_TOTAL = 18;
 var TEXT_BACKED = /* @__PURE__ */ new Set(["textarea", "markdown", "richtext", "code"]);
@@ -31715,14 +31753,107 @@ var traitsInput = external_exports.array(external_exports.string()).default(["id
 }).describe(
   "Entity trait codes \u2014 identity, audit, audit-full, soft-delete, sorting, postable, accumulation, ledger, period. 'identity' makes the PK '{entity}_id'. Traits expand into columns server-side at install; list only the codes."
 );
-function unknownTraits(traitCodes) {
-  return traitCodes.filter((cd) => !TRAIT_CODE_SET.has(cd));
+function unknownTraits(traitCodes, localTraits) {
+  return traitCodes.filter(
+    (cd) => !TRAIT_CODE_SET.has(cd) && localTraits?.[cd] === void 0
+  );
+}
+var TRAIT_DEF_KEYS = ["cd", "description", "includes", "fields", "references", "constraints"];
+var TRAIT_DEF_KEY_SET = new Set(TRAIT_DEF_KEYS);
+var isPlainObject3 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+function traitsShapeError(parsed) {
+  if (!isPlainObject3(parsed)) {
+    const got = Array.isArray(parsed) ? "an array" : parsed === null ? "null" : `a ${typeof parsed}`;
+    return `not a traits file: expected an object keyed by trait code, got ${got}.`;
+  }
+  for (const [cd, def] of Object.entries(parsed)) {
+    if (!isPlainObject3(def)) {
+      const got = Array.isArray(def) ? "an array" : def === null ? "null" : `a ${typeof def}`;
+      return `not a traits file: trait '${cd}' is ${got}, not a definition object.`;
+    }
+    const unexpected = Object.keys(def).filter((k) => !TRAIT_DEF_KEY_SET.has(k));
+    if (unexpected.length > 0) {
+      if (cd === "traits" && Object.keys(parsed).length === 1) {
+        return `not a traits file: the top level is keyed by trait code, so a "traits" wrapper registers one trait called 'traits' and hides the ${unexpected.length} real one(s) (${unexpected.join(", ")}). Remove the wrapper and put the definitions at the top level.`;
+      }
+      return `not a traits file: trait '${cd}' has unexpected key(s): ${unexpected.join(", ")}. A trait definition carries ${TRAIT_DEF_KEYS.join(", ")}.`;
+    }
+    if (def.fields !== void 0 && !isPlainObject3(def.fields)) {
+      return `not a traits file: trait '${cd}' has a 'fields' that is not an object keyed by column code.`;
+    }
+    const includes = def.includes;
+    if (includes !== void 0 && !(Array.isArray(includes) && includes.every((i) => typeof i === "string"))) {
+      return `not a traits file: trait '${cd}' has an 'includes' that is not an array of trait codes.`;
+    }
+  }
+  return void 0;
+}
+function readLocalTraits(moduleRoot) {
+  const file2 = path.join(moduleRoot, "traits.json");
+  if (!fs.existsSync(file2)) return {};
+  let parsed;
+  try {
+    parsed = JSON.parse(fs.readFileSync(file2, "utf8"));
+  } catch (ex) {
+    return { error: `invalid JSON: ${ex.message}.` };
+  }
+  const shape = traitsShapeError(parsed);
+  if (shape) return { error: shape };
+  return { traits: parsed };
+}
+function expandedEntity(entity, entityName, localTraits) {
+  const fields = entity.fields ?? {};
+  const traitCodes = entity.traits ?? [];
+  const traitFields = expandTraits(traitCodes, entityName, localTraits);
+  return {
+    columns: /* @__PURE__ */ new Set([...Object.keys(fields), ...Object.keys(traitFields)]),
+    fieldDefs: { ...traitFields, ...fields },
+    // The expansion above is total — a trait field the entity already has
+    // under a different type is merged away here, while the installer keeps
+    // the first and refuses the entity outright. Ask for those collisions
+    // separately, or they are invisible to every caller.
+    conflicts: traitFieldConflicts(traitCodes, entityName, {
+      localTraits,
+      fields
+    })
+  };
+}
+function describeTraitConflict(c) {
+  const kept = c.existingFrom === "field" ? "an authored field" : "another trait's field";
+  return `field '${c.field}' is contributed by a trait but already exists as ${kept} with a different type (${c.existingType ?? "untyped"} vs ${c.traitType ?? "untyped"}). The installer keeps the first and refuses the entity \u2014 rename the column, or drop the trait that brings it.`;
+}
+function localEntityCode(code2, moduleCode) {
+  if (!code2) return void 0;
+  const dot = code2.indexOf(".");
+  if (dot < 0) return code2;
+  return code2.slice(0, dot) === moduleCode ? code2.slice(dot + 1) : void 0;
+}
+function entityRecordContext(paths, manifest, entityCode, localTraits) {
+  const local = localEntityCode(entityCode, manifest.code);
+  if (!local) return void 0;
+  const relPath = (manifest.entities ?? {})[local];
+  if (!relPath) return void 0;
+  const abs = path.join(paths.root, relPath.replace(/^\.\//, ""));
+  if (!fs.existsSync(abs)) return void 0;
+  let entity;
+  try {
+    entity = JSON.parse(fs.readFileSync(abs, "utf8"));
+  } catch {
+    return void 0;
+  }
+  const traitCodes = entity.traits ?? [];
+  if (unknownTraits(traitCodes, localTraits).length > 0) return void 0;
+  return {
+    qualified: `${manifest.code}.${local}`,
+    columns: expandedEntity(entity, local, localTraits).columns
+  };
 }
-function assertKnownTraits(traitCodes, entityName) {
-  const bad = unknownTraits(traitCodes);
+function assertKnownTraits(traitCodes, entityName, localTraits) {
+  const bad = unknownTraits(traitCodes, localTraits);
   if (bad.length === 0) return;
+  const local = Object.keys(localTraits ?? {});
   throw new Error(
-    `Entity '${entityName}' declares unknown trait(s): ${bad.join(", ")}. Valid: ${TRAIT_CODES.join(", ")}. An unrecognized trait is silently ignored when columns are expanded, so its columns would quietly go missing rather than fail loudly. (See dforge://reference/traits.)`
+    `Entity '${entityName}' declares unknown trait(s): ${bad.join(", ")}. Valid: ${TRAIT_CODES.join(", ")}` + (local.length > 0 ? `, plus this module's own traits.json: ${local.join(", ")}` : "") + ". An unrecognized trait is silently ignored when columns are expanded, so its columns would quietly go missing rather than fail loudly. (See dforge://reference/traits.)"
   );
 }
 function withTraits(entity, traitCodes) {
@@ -34317,307 +34448,1447 @@ function entityDelete(args) {
 // src/tools/action-add.ts
 var path9 = __toESM(require("path"));
 
-// src/tools/dsl-check.ts
-var BLOCKS = ["params", "canExecute", "onBeforeStart", "execute"];
-var DSL_BUILTINS = /* @__PURE__ */ new Set([
-  "addDays",
-  "addMinutes",
-  "addSeconds",
-  "applyProfile",
-  "callApi",
-  "callProc",
-  "callService",
-  "currentUserId",
-  "delete",
-  "detectDocument",
-  "download",
-  "entityLink",
-  "error",
-  "exit",
-  "flush",
-  "getFileBase64",
-  "getFileInfo",
-  "getFileUrl",
-  "getRecord",
-  "getRecordOrNull",
-  "getSecret",
-  "getSetting",
-  "info",
-  "insert",
-  "nextNumber",
-  "notify",
-  "now",
-  "ocrExtract",
-  "preloadRef",
-  "query",
-  "select",
-  "sendEmail",
-  "tryParseJson",
-  "update",
-  "warn"
-]);
-var JS_RESERVED = /* @__PURE__ */ new Set([
+// node_modules/.pnpm/@dforge-core+metadata@0.0.27/node_modules/@dforge-core/metadata/dist/dsl/index.js
+var PUNCT3 = ["===", "!=="];
+var PUNCT2 = [
+  "==",
+  "!=",
+  "<=",
+  ">=",
+  "&&",
+  "||",
+  "++",
+  "--",
+  "+=",
+  "-=",
+  "*=",
+  "/=",
+  "%=",
+  "${",
+  "=>"
+];
+var CONTROL_KEYWORDS = /* @__PURE__ */ new Set([
   "if",
-  "for",
   "while",
+  "for",
   "switch",
   "catch",
-  "return",
-  "typeof",
-  "function",
-  "do",
-  "else",
-  "in",
-  "of",
-  "new",
-  "delete",
-  "void",
-  "throw",
-  "try",
-  "parseInt",
-  "parseFloat",
-  "isNaN",
-  "isFinite",
-  "String",
-  "Number",
-  "Boolean",
-  "Array",
-  "Object",
-  "Date",
-  "Math",
-  "JSON",
-  "RegExp",
-  "Error"
+  "with"
 ]);
-var VALUE_MEMBERS = /* @__PURE__ */ new Set(["userId"]);
-var FORMULA_ONLY = {
-  TODAY: "now()",
-  NOW: "now()",
-  CURRENT_USER_ID: "currentUserId()"
-};
-function blank(src) {
-  let out = "";
+function tokenize(text) {
+  const tokens = [];
   let i = 0;
-  while (i < src.length) {
-    const c = src[i];
-    if (c === "'" || c === '"') {
-      const quote = c;
-      out += " ";
-      i++;
-      while (i < src.length && src[i] !== quote) {
-        if (src[i] === "\\") {
-          out += "  ";
+  let line = 0;
+  let lineStart = 0;
+  let pendingLineBreak = true;
+  const frames = [];
+  const parenIsControl = [];
+  let closedControlParen = false;
+  const braceIsBlock = [];
+  let closedBlockBrace = false;
+  const push = (kind, start, end) => {
+    tokens.push({
+      kind,
+      text: text.slice(start, end),
+      start,
+      end,
+      line,
+      character: start - lineStart,
+      startsLine: pendingLineBreak
+    });
+    pendingLineBreak = false;
+  };
+  while (i < text.length) {
+    const frame = frames[frames.length - 1];
+    if (frame?.kind === "template") {
+      const startLine = line;
+      const startLineStart = lineStart;
+      while (i < text.length) {
+        const ch = text[i];
+        if (ch === "\\") {
           i += 2;
           continue;
         }
-        out += src[i] === "\n" ? "\n" : " ";
+        if (ch === "`" || ch === "$" && text[i + 1] === "{") break;
+        if (ch === "\n") {
+          line++;
+          lineStart = i + 1;
+        }
         i++;
       }
-      if (i < src.length) {
-        out += " ";
+      if (text[i] === "`") {
+        i++;
+        frames.pop();
+      } else if (i < text.length) {
+        i += 2;
+        frames.push({ kind: "interp", braces: 0 });
+      } else {
+        frames.pop();
+      }
+      const savedLine = line;
+      const savedLineStart = lineStart;
+      line = startLine;
+      lineStart = startLineStart;
+      push("template", frame.chunkStart, i);
+      line = savedLine;
+      lineStart = savedLineStart;
+      continue;
+    }
+    const c = text[i];
+    if (c === "\uFEFF" && i === 0) {
+      i++;
+      lineStart = i;
+      continue;
+    }
+    if (c === "\n") {
+      i++;
+      line++;
+      lineStart = i;
+      pendingLineBreak = true;
+      continue;
+    }
+    if (c === " " || c === "	" || c === "\r") {
+      i++;
+      continue;
+    }
+    if (c === "/" && text[i + 1] === "/") {
+      const start = i;
+      while (i < text.length && text[i] !== "\n") i++;
+      push("comment", start, i);
+      continue;
+    }
+    if (c === "/" && text[i + 1] === "*") {
+      const start = i;
+      const startLine = line;
+      const startLineStart = lineStart;
+      i += 2;
+      while (i < text.length && !(text[i] === "*" && text[i + 1] === "/")) {
+        if (text[i] === "\n") {
+          line++;
+          lineStart = i + 1;
+        }
         i++;
       }
+      i = Math.min(i + 2, text.length);
+      const savedLine = line;
+      const savedLineStart = lineStart;
+      line = startLine;
+      lineStart = startLineStart;
+      push("comment", start, i);
+      line = savedLine;
+      lineStart = savedLineStart;
       continue;
     }
-    if (c === "#" || c === "/" && src[i + 1] === "/") {
-      while (i < src.length && src[i] !== "\n") {
-        out += " ";
+    if (c === "'" || c === '"') {
+      const start = i;
+      const quote = c;
+      i++;
+      while (i < text.length && text[i] !== quote && text[i] !== "\n") {
+        if (text[i] === "\\") i++;
         i++;
       }
+      if (text[i] === quote) i++;
+      push("string", start, i);
       continue;
     }
-    out += c;
+    if (c === "`") {
+      frames.push({ kind: "template", chunkStart: i });
+      i++;
+      continue;
+    }
+    if (c === "/" && regexAllowedAfter(
+      tokens[tokens.length - 1],
+      closedControlParen,
+      closedBlockBrace
+    )) {
+      const end = scanRegex(text, i);
+      if (end > 0) {
+        push("regex", i, end);
+        i = end;
+        continue;
+      }
+    }
+    if (/[0-9]/.test(c)) {
+      const start = i;
+      while (i < text.length && /[0-9._eE]/.test(text[i])) i++;
+      push("number", start, i);
+      continue;
+    }
+    if (/[A-Za-z_$]/.test(c)) {
+      const start = i;
+      while (i < text.length && /[A-Za-z0-9_$]/.test(text[i])) i++;
+      push("ident", start, i);
+      continue;
+    }
+    if (c === "(") {
+      const prev = tokens[tokens.length - 1];
+      parenIsControl.push(
+        prev?.kind === "ident" && CONTROL_KEYWORDS.has(prev.text)
+      );
+    } else if (c === ")") {
+      closedControlParen = parenIsControl.pop() ?? false;
+    }
+    if (frame?.kind === "interp") {
+      if (c === "}" && frame.braces === 0) {
+        frames.pop();
+        frames[frames.length - 1].chunkStart = i;
+        i++;
+        continue;
+      }
+      if (c === "{") frame.braces++;
+      else if (c === "}") frame.braces--;
+    }
+    if (c === "{") {
+      braceIsBlock.push(isBlockBrace(tokens[tokens.length - 1]));
+    } else if (c === "}") {
+      closedBlockBrace = braceIsBlock.pop() ?? false;
+    }
+    const three = text.slice(i, i + 3);
+    if (PUNCT3.includes(three)) {
+      push("punct", i, i + 3);
+      i += 3;
+      continue;
+    }
+    const two = text.slice(i, i + 2);
+    if (PUNCT2.includes(two)) {
+      push("punct", i, i + 2);
+      i += 2;
+      continue;
+    }
+    push("punct", i, i + 1);
     i++;
   }
-  return out;
-}
-var lineOf = (src, index) => src.slice(0, index).split("\n").length;
-function readStringLiteral(src, start) {
-  const quote = src[start];
-  if (quote !== "'" && quote !== '"') return null;
-  let value = "";
+  return tokens;
+}
+function regexAllowedAfter(prev, closedControlParen, closedBlockBrace) {
+  if (!prev) return true;
+  if (prev.kind === "number" || prev.kind === "string") return false;
+  if (prev.kind === "template") return prev.text.endsWith("${");
+  if (prev.kind === "ident") return REGEX_PRECEDING_KEYWORDS.has(prev.text);
+  if (prev.kind === "regex") return false;
+  if (prev.kind === "comment") return true;
+  if (prev.text === ")") return closedControlParen;
+  if (prev.text === "}") return closedBlockBrace;
+  return !REGEX_BLOCKING_PUNCT.has(prev.text);
+}
+function isBlockBrace(prev) {
+  if (!prev) return true;
+  if (prev.kind === "ident") return BLOCK_PRECEDING_KEYWORDS.has(prev.text);
+  if (prev.kind !== "punct") return false;
+  return prev.text === ")" || prev.text === "}" || prev.text === "{" || prev.text === ";";
+}
+var BLOCK_PRECEDING_KEYWORDS = /* @__PURE__ */ new Set(["else", "do", "try", "finally"]);
+var REGEX_PRECEDING_KEYWORDS = /* @__PURE__ */ new Set([
+  "return",
+  "typeof",
+  "instanceof",
+  "in",
+  "of",
+  "new",
+  "delete",
+  "void",
+  "case",
+  "do",
+  "else",
+  "throw",
+  "yield",
+  "await"
+]);
+var REGEX_BLOCKING_PUNCT = /* @__PURE__ */ new Set(["]", "++", "--"]);
+function scanRegex(text, start) {
   let i = start + 1;
-  while (i < src.length) {
-    const c = src[i];
+  let inClass = false;
+  if (text[i] === "/" || text[i] === "*") return -1;
+  for (; i < text.length; i++) {
+    const c = text[i];
     if (c === "\\") {
-      if (i + 1 < src.length) value += src[i + 1];
+      i++;
+      continue;
+    }
+    if (c === "\n") return -1;
+    if (c === "[") inClass = true;
+    else if (c === "]") inClass = false;
+    else if (c === "/" && !inClass) {
+      i++;
+      while (i < text.length && /[a-z]/.test(text[i])) i++;
+      return i;
+    }
+  }
+  return -1;
+}
+function stringValue(token) {
+  if (token.kind !== "string") return token.text;
+  const body = token.text.slice(1, token.text.endsWith(token.text[0]) && token.text.length > 1 ? -1 : void 0);
+  return unescape2(body);
+}
+function templateChunkValue(token) {
+  if (token.kind !== "template") return token.text;
+  const body = token.text.slice(1);
+  if (body.endsWith("${")) return unescape2(body.slice(0, -2));
+  if (body.endsWith("`")) return unescape2(body.slice(0, -1));
+  return unescape2(body);
+}
+function unescape2(body) {
+  return body.replace(/\\(.)/g, (_, ch) => {
+    switch (ch) {
+      case "n":
+        return "\n";
+      case "t":
+        return "	";
+      case "r":
+        return "\r";
+      default:
+        return ch;
+    }
+  });
+}
+var BLOCK_KINDS = [
+  "params",
+  "canExecute",
+  "schema",
+  "onBeforeStart",
+  "execute"
+];
+var BLOCK_BY_LOWER = new Map(BLOCK_KINDS.map((k) => [k.toLowerCase(), k]));
+var GLOBALS = /* @__PURE__ */ new Set(["params", "old", "records"]);
+function parseDsl(text) {
+  const all = tokenize(text);
+  const tokens = all.filter((t) => t.kind !== "comment");
+  const blocks = findBlocks(text, tokens);
+  const blockAt = (offset) => blocks.find((b) => offset >= b.body.start && offset < b.body.end)?.kind ?? null;
+  const params = parseParams(tokens, blocks);
+  const fieldRefs = [];
+  const globalRefs = [];
+  const calls = [];
+  const recordsRefs = [];
+  const locals = collectLocals(tokens, params);
+  const recordsLoopVars = collectRecordsLoopVars(tokens);
+  for (let i = 0; i < tokens.length; i++) {
+    const t = tokens[i];
+    if (t.kind === "punct" && t.text === "[" && isFieldAccessStart(text, t.start)) {
+      const name = tokens[i + 1];
+      const close = tokens[i + 2];
+      if (name?.kind === "ident" && close?.text === "]") {
+        const ref = {
+          name: name.text,
+          span: { start: name.start, end: name.end },
+          outerSpan: { start: t.start, end: close.end },
+          navigation: [],
+          block: blockAt(t.start),
+          isCurrentRecord: true,
+          startIndex: i,
+          endIndex: i + 2
+        };
+        ref.endIndex = collectNavigation(tokens, i + 2, ref);
+        i = ref.endIndex;
+        fieldRefs.push(ref);
+        continue;
+      }
+    }
+    if (t.kind === "ident" && t.text === "records" && tokens[i - 1]?.text !== ".") {
+      recordsRefs.push({ start: t.start, end: t.end });
+      const field = indexedRecordField(tokens, i);
+      if (field) {
+        fieldRefs.push({
+          name: field.name.text,
+          span: { start: field.name.start, end: field.name.end },
+          outerSpan: { start: field.open.start, end: field.close.end },
+          navigation: [],
+          block: blockAt(t.start),
+          isCurrentRecord: false,
+          startIndex: field.openIndex,
+          endIndex: field.openIndex + 2
+        });
+        i = field.openIndex + 2;
+        continue;
+      }
+    }
+    if (t.kind === "ident" && recordsLoopVars.has(t.text)) {
+      const open = tokens[i + 1];
+      const name = tokens[i + 2];
+      const close = tokens[i + 3];
+      if (open?.text === "[" && name?.kind === "ident" && close?.text === "]") {
+        fieldRefs.push({
+          name: name.text,
+          span: { start: name.start, end: name.end },
+          outerSpan: { start: open.start, end: close.end },
+          navigation: [],
+          block: blockAt(t.start),
+          isCurrentRecord: false,
+          startIndex: i + 1,
+          endIndex: i + 3
+        });
+        i += 3;
+        continue;
+      }
+    }
+    if (t.kind === "ident" && GLOBALS.has(t.text)) {
+      const open = tokens[i + 1];
+      const prop = tokens[i + 2];
+      const close = tokens[i + 3];
+      if (open?.text === "[" && prop?.kind === "ident" && close?.text === "]") {
+        globalRefs.push({
+          global: t.text,
+          property: prop.text,
+          span: { start: prop.start, end: prop.end },
+          block: blockAt(t.start)
+        });
+        i += 3;
+        continue;
+      }
+    }
+    if (t.kind === "ident" && tokens[i + 1]?.text === "(") {
+      const prev = tokens[i - 1];
+      if (prev?.text === ".") continue;
+      const call = {
+        name: t.text,
+        nameSpan: { start: t.start, end: t.end },
+        block: blockAt(t.start)
+      };
+      const firstArg = tokens[i + 2];
+      if (firstArg?.kind === "string") {
+        call.firstStringArg = {
+          value: stringValue(firstArg),
+          span: { start: firstArg.start, end: firstArg.end },
+          interpolated: false,
+          endIndex: i + 2
+        };
+      } else if (firstArg?.kind === "template" && firstArg.text.startsWith("`")) {
+        call.firstStringArg = templateArg(tokens, i + 2);
+      }
+      calls.push(call);
+    }
+  }
+  return {
+    blocks,
+    params,
+    fieldRefs,
+    globalRefs,
+    calls,
+    tokens,
+    recordsRefs,
+    locals,
+    recordsLoopVars
+  };
+}
+function isFieldAccessStart(text, start) {
+  return start === 0 || !/\w/.test(text[start - 1]);
+}
+function templateArg(tokens, start) {
+  const parts = [];
+  let depth = 0;
+  let interpolated = false;
+  let last = tokens[start];
+  let endIndex = start;
+  for (let j = start; j < tokens.length; j++) {
+    const t = tokens[j];
+    if (t.kind !== "template") continue;
+    const opens = t.text.startsWith("`");
+    if (opens) depth++;
+    if (depth === 1) {
+      if (!opens) parts.push(" ");
+      parts.push(templateChunkValue(t));
+      last = t;
+      endIndex = j;
+    }
+    if (t.text.endsWith("${")) {
+      if (depth === 1) interpolated = true;
+      continue;
+    }
+    depth--;
+    if (depth === 0) break;
+  }
+  return {
+    value: parts.join(""),
+    span: { start: tokens[start].start, end: last.end },
+    interpolated,
+    endIndex
+  };
+}
+function indexedRecordField(tokens, i) {
+  const index = tokens[i + 2];
+  if (tokens[i + 1]?.text !== "[") return null;
+  if (index?.kind !== "number" || !/^\d+$/.test(index.text)) return null;
+  if (tokens[i + 3]?.text !== "]") return null;
+  const open = tokens[i + 4];
+  const name = tokens[i + 5];
+  const close = tokens[i + 6];
+  if (open?.text !== "[" || name?.kind !== "ident" || close?.text !== "]")
+    return null;
+  return { name, open, close, openIndex: i + 4 };
+}
+function collectNavigation(tokens, closeIdx, ref) {
+  let i = closeIdx;
+  for (; ; ) {
+    const dot = tokens[i + 1];
+    if (dot?.text !== ".") return i;
+    const next = tokens[i + 2];
+    if (next?.kind === "ident") {
+      if (tokens[i + 3]?.text === "(") return i;
+      ref.navigation.push({
+        name: next.text,
+        span: { start: next.start, end: next.end },
+        bracketed: false
+      });
       i += 2;
       continue;
     }
-    if (c === quote) return { value, end: i + 1 };
-    value += c;
-    i++;
+    if (next?.text === "[") {
+      const name = tokens[i + 3];
+      const close = tokens[i + 4];
+      if (name?.kind === "ident" && close?.text === "]") {
+        ref.navigation.push({
+          name: name.text,
+          span: { start: name.start, end: name.end },
+          bracketed: true
+        });
+        i += 4;
+        continue;
+      }
+    }
+    return i;
   }
-  return null;
 }
-function sqlLiterals(src) {
-  const out = [];
-  const callRe = /\b(query|callProc)\s*\(\s*/g;
-  for (const m of src.matchAll(callRe)) {
-    const argStart = (m.index ?? 0) + m[0].length;
-    const lit = readStringLiteral(src, argStart);
-    if (!lit) continue;
-    out.push({ sql: lit.value, index: m.index ?? 0, end: lit.end });
+function collectRecordsLoopVars(tokens) {
+  const vars = /* @__PURE__ */ new Set();
+  for (let i = 0; i < tokens.length - 4; i++) {
+    if (tokens[i].text !== "for" || tokens[i].kind !== "ident") continue;
+    const name = tokens[i + 1];
+    if (name.kind !== "ident") continue;
+    if (tokens[i + 2].text !== "in" || tokens[i + 3].text !== "records") continue;
+    if (tokens[i + 4].text !== "{") continue;
+    vars.add(name.text);
   }
-  return out;
+  return vars;
 }
-function parseBlocks(src) {
-  const lines = src.split("\n");
-  const found = [];
-  let offset = 0;
-  for (let i = 0; i < lines.length; i++) {
-    const m = lines[i].match(/^([A-Za-z][A-Za-z0-9_]*)\s*:\s*$/);
-    if (m) found.push({ block: m[1], start: offset + m[0].length, end: src.length, line: i + 1 });
-    offset += lines[i].length + 1;
+var DECLARATORS = /* @__PURE__ */ new Set(["var", "let", "const"]);
+function collectLocals(tokens, params) {
+  const locals = new Set(params.map((p) => p.name));
+  collectFunctionParams(tokens, locals);
+  for (let i = 0; i < tokens.length; i++) {
+    const t = tokens[i];
+    if (t.kind !== "ident") continue;
+    if (DECLARATORS.has(t.text)) {
+      collectDeclarations(tokens, i + 1, locals);
+      continue;
+    }
+    if (t.text === "for") {
+      let j = i + 1;
+      if (tokens[j]?.text === "(") j++;
+      if (tokens[j]?.kind === "ident" && DECLARATORS.has(tokens[j].text)) j++;
+      const name = tokens[j];
+      if (name?.kind === "ident" && !DECLARATORS.has(name.text)) locals.add(name.text);
+    }
   }
-  for (let i = 0; i < found.length - 1; i++) {
-    found[i].end = src.lastIndexOf("\n", found[i + 1].start - found[i + 1].block.length - 2) + 1;
+  return locals;
+}
+function collectFunctionParams(tokens, locals) {
+  for (let i = 0; i < tokens.length; i++) {
+    const t = tokens[i];
+    if (t.kind === "ident" && t.text === "function") {
+      let j = i + 1;
+      if (tokens[j]?.kind === "ident") j++;
+      if (tokens[j]?.text === "(") collectParenIdents(tokens, j, locals);
+      continue;
+    }
+    if (t.text === "=>") {
+      const prev = tokens[i - 1];
+      if (prev?.kind === "ident") locals.add(prev.text);
+      else if (prev?.text === ")") {
+        const open = matchingOpenParen(tokens, i - 1);
+        if (open >= 0) collectParenIdents(tokens, open, locals);
+      }
+      continue;
+    }
+    if (t.kind === "ident" && !CONTROL_KEYWORDS.has(t.text) && tokens[i + 1]?.text === "(") {
+      const close = matchingCloseParen(tokens, i + 1);
+      if (close >= 0 && tokens[close + 1]?.text === "{")
+        collectParenIdents(tokens, i + 1, locals);
+    }
+  }
+}
+function collectParenIdents(tokens, openIndex, locals) {
+  let depth = 0;
+  for (let i = openIndex; i < tokens.length; i++) {
+    const t = tokens[i];
+    if (t.text === "(") depth++;
+    else if (t.text === ")") {
+      depth--;
+      if (depth === 0) return;
+    } else if (t.kind === "ident") locals.add(t.text);
+  }
+}
+function matchingCloseParen(tokens, openIndex) {
+  let depth = 0;
+  for (let i = openIndex; i < tokens.length; i++) {
+    if (tokens[i].text === "(") depth++;
+    else if (tokens[i].text === ")" && --depth === 0) return i;
+  }
+  return -1;
+}
+function matchingOpenParen(tokens, closeIndex) {
+  let depth = 0;
+  for (let i = closeIndex; i >= 0; i--) {
+    if (tokens[i].text === ")") depth++;
+    else if (tokens[i].text === "(" && --depth === 0) return i;
+  }
+  return -1;
+}
+function collectDeclarations(tokens, start, locals) {
+  let j = start;
+  for (; ; ) {
+    const head = tokens[j];
+    if (!head) return;
+    if (head.text === "{" || head.text === "[") {
+      j = collectPattern(tokens, j, locals);
+    } else if (head.kind === "ident" && !DECLARATORS.has(head.text)) {
+      locals.add(head.text);
+      j++;
+    } else return;
+    let depth = 0;
+    for (; j < tokens.length; j++) {
+      const n = tokens[j];
+      if (n.text === "(" || n.text === "[" || n.text === "{") depth++;
+      else if (n.text === ")" || n.text === "]" || n.text === "}") depth--;
+      if (depth < 0) return;
+      if (depth > 0) continue;
+      if (n.text === ";") return;
+      if (n.text === ",") break;
+      if (n.startsLine) return;
+    }
+    if (j >= tokens.length) return;
+    j++;
+  }
+}
+function collectPattern(tokens, start, locals) {
+  let depth = 0;
+  let i = start;
+  for (; i < tokens.length; i++) {
+    const t = tokens[i];
+    if (t.text === "{" || t.text === "[") depth++;
+    else if (t.text === "}" || t.text === "]") {
+      depth--;
+      if (depth === 0) return i + 1;
+    } else if (t.kind === "ident") locals.add(t.text);
+  }
+  return i;
+}
+function blockLabelAt(tokens, i) {
+  const t = tokens[i];
+  if (!t || t.kind !== "ident" || !t.startsLine) return null;
+  const colon = tokens[i + 1];
+  if (colon?.text !== ":" || colon.start !== t.end) return null;
+  const kind = BLOCK_BY_LOWER.get(t.text.toLowerCase());
+  return kind ? { kind, span: { start: t.start, end: colon.end } } : null;
+}
+function findBlocks(text, tokens) {
+  const labels = [];
+  for (let i = 0; i < tokens.length; i++) {
+    const t = tokens[i];
+    if (t.character !== 0) continue;
+    const label = blockLabelAt(tokens, i);
+    if (!label) continue;
+    labels.push(label);
+    if (label.kind === "execute") break;
+  }
+  return labels.map((l, idx) => ({
+    kind: l.kind,
+    label: l.span,
+    body: {
+      start: l.span.end,
+      end: labels[idx + 1]?.span.start ?? text.length
+    }
+  }));
+}
+function parseParams(tokens, blocks) {
+  const block = blocks.find((b) => b.kind === "params");
+  if (!block) return [];
+  const inBlock = tokens.filter(
+    (t) => t.start >= block.body.start && t.start < block.body.end
+  );
+  const params = [];
+  for (let i = 0; i < inBlock.length; i++) {
+    const name = inBlock[i];
+    if (!name.startsLine && i !== 0 || name.kind !== "ident") continue;
+    if (inBlock[i + 1]?.text !== ":") continue;
+    let j = i + 2;
+    let isRef = false;
+    if (inBlock[j]?.kind === "ident" && inBlock[j].text === "ref") {
+      isRef = true;
+      j++;
+    }
+    const type = inBlock[j];
+    if (!type || type.kind !== "ident") continue;
+    if (type.line !== name.line) continue;
+    let typeEnd = type.end;
+    let typeText = type.text;
+    if (isRef) {
+      while (inBlock[j + 1] && (inBlock[j + 1].text === "-" || inBlock[j + 1].text === ".") && inBlock[j + 2]?.kind === "ident" && inBlock[j + 1].start === typeEnd && inBlock[j + 2].start === inBlock[j + 1].end) {
+        typeText += inBlock[j + 1].text + inBlock[j + 2].text;
+        typeEnd = inBlock[j + 2].end;
+        j += 2;
+      }
+    }
+    let required2 = false;
+    let label;
+    for (let k = j + 1; k < inBlock.length && !inBlock[k].startsLine; k++) {
+      const t = inBlock[k];
+      if (t.kind === "ident" && t.text === "required") required2 = true;
+      if (t.kind === "string" && label === void 0) label = stringValue(t);
+    }
+    params.push({
+      name: name.text,
+      nameSpan: { start: name.start, end: name.end },
+      type: typeText,
+      typeSpan: { start: type.start, end: typeEnd },
+      isRef,
+      required: required2,
+      label
+    });
   }
-  return found;
+  return params;
 }
-function checkDsl(src, opts = {}) {
-  const issues = [];
-  const add = (level, rule, message, line) => issues.push({ level, rule, message, ...line ? { line } : {} });
-  const code2 = blank(src);
-  const blocks = parseBlocks(src);
-  const names = blocks.map((b) => b.block);
-  if (src.trim() === "") {
-    add("error", "dsl-empty", "DSL body is empty \u2014 at minimum it needs an `execute:` block.");
-    return issues;
-  }
-  if (!names.includes("execute")) {
+var BUILTINS = [
+  // Data operations
+  {
+    name: "insert",
+    signature: "insert(entity, fields)",
+    returns: "object",
+    entityArg: 0,
+    doc: "Insert a new record. Returns the full row including auto-filled columns (PK, audit, number sequences)."
+  },
+  {
+    name: "select",
+    signature: "select(entity, opts?)",
+    returns: "object[]",
+    entityArg: 0,
+    doc: "Structured multi-row read. `opts` = `{columns, filter, orderBy, limit, offset}`. Prefer over `query()` for row-shaped reads."
+  },
+  {
+    name: "update",
+    signature: "update(entity, key, fields)",
+    returns: "number",
+    entityArg: 0,
+    doc: "Update the row(s) matched by `key`; returns rows affected. A value may be `{ inc: n }` to add to the column's current value \u2014 use that for every counter, balance and quantity."
+  },
+  {
+    name: "delete",
+    signature: "delete(entity, key)",
+    returns: "number",
+    entityArg: 0,
+    doc: "Delete the row(s) matched by `key`; returns rows affected."
+  },
+  {
+    name: "query",
+    signature: "query(sql, args?)",
+    returns: "object[]",
+    doc: "Execute parameterized SQL with `@argName` placeholders and schema-qualified table names. Escape hatch \u2014 prefer `select()` / `update()` / `delete()` when the structured shape fits."
+  },
+  {
+    name: "getRecord",
+    signature: "getRecord(entity, key)",
+    returns: "object",
+    entityArg: 0,
+    doc: "Fetch a single record by key. **Throws** a localized not-found error when absent."
+  },
+  {
+    name: "getRecordOrNull",
+    signature: "getRecordOrNull(entity, key)",
+    returns: "object | null",
+    entityArg: 0,
+    doc: "Like `getRecord`, but returns `null` instead of throwing \u2014 for an expected absence, guarded with `if (rec == null)`."
+  },
+  {
+    name: "preloadRef",
+    signature: "preloadRef(fkColumn)",
+    returns: "object",
+    doc: "Load the referenced record for a FK column. Read its fields with `ref.get('field')`."
+  },
+  // Messaging
+  {
+    name: "error",
+    signature: "error(message)",
+    returns: "never",
+    doc: "Abort the action and show an error. Rolls back all changes."
+  },
+  { name: "warn", signature: "warn(message)", returns: "void", doc: "Show a warning and continue." },
+  {
+    name: "info",
+    signature: "info(message)",
+    returns: "void",
+    doc: "Show an informational message \u2014 a receipt for work the action did, not a way to publish a computed value."
+  },
+  {
+    name: "exit",
+    signature: "exit(message?, level?)",
+    returns: "never",
+    doc: "Stop the script early **without** error, keeping changes made so far. Level `'info'` (default) or `'warn'`. This is the DSL's early return \u2014 the block compiles to a bare script, so a `return` outside a function is a syntax error wherever it sits."
+  },
+  {
+    name: "notify",
+    signature: "notify(userId, message)",
+    returns: "void",
+    doc: "Send an in-app notification to a specific user."
+  },
+  {
+    name: "sendEmail",
+    signature: "sendEmail(to, subjectOrTemplate, dataOrBody?)",
+    returns: "void",
+    doc: "Queue an outbound email. Three arguments, and the **second** picks the mode: `sendEmail(to, 'order.shipped', { ref: [code] })` sends a template, `sendEmail(to, 'Your order shipped', '<p>\u2026</p>')` sends raw HTML. A second argument with no spaces that contains `.` or `_` is read as a template code \u2014 so a raw subject like `'Shipped.'` silently becomes one; give a raw subject spaces. There is no fourth argument."
+  },
+  // External calls
+  {
+    name: "callApi",
+    signature: "callApi(url, method, headers?, body?)",
+    returns: "string",
+    doc: "HTTP request to an external API; returns the body as a string. Max 10 calls per script, 120s timeout, 5MB response."
+  },
+  {
+    name: "callService",
+    signature: "callService(name, args)",
+    returns: "any",
+    doc: "Invoke a registered host service."
+  },
+  {
+    name: "callProc",
+    signature: "callProc(procName, args)",
+    returns: "any",
+    doc: "Call a stored procedure with named parameters."
+  },
+  // Files, settings, extraction
+  {
+    name: "getFileBase64",
+    signature: "getFileBase64(fileField)",
+    returns: "string",
+    doc: "Read a file from storage as base64. Use with `callApi()` to send files to external APIs. Max 10 MB."
+  },
+  {
+    name: "getFileUrl",
+    signature: "getFileUrl(fileField)",
+    returns: "string",
+    doc: "Temporary signed download URL (relative path) for a file field \u2014 for emails and notifications, not for `callApi()`."
+  },
+  { name: "getFileInfo", signature: "getFileInfo(fileField)", returns: "object | null", doc: "File metadata for a file field." },
+  {
+    name: "download",
+    signature: "download(url, fileName?)",
+    returns: "void",
+    doc: "Set a download URL on the action result; the browser opens it when the action returns. It fetches nothing and stores nothing \u2014 the URL must already serve the bytes, e.g. the `/api/temp-file/{token}` a service handed back. To put a remote file INTO storage, fetch it with `callApi()` and write it to a file column."
+  },
+  {
+    name: "getSetting",
+    signature: "getSetting(settingCd)",
+    returns: "any",
+    doc: "Read a module setting, resolved through the folder chain (current folder \u2192 parents \u2192 module default)."
+  },
+  {
+    name: "getSecret",
+    signature: "getSecret(secretCd)",
+    returns: "string",
+    doc: "Retrieve a decrypted secret (API key, token). Managed in the admin UI."
+  },
+  {
+    name: "ocrExtract",
+    signature: "ocrExtract(fileField, endpointBaseUrl, schema?, opts?)",
+    returns: "string (v1) | object (v2)",
+    doc: "Run OCR extraction against a document. **The return type follows the mode, and only `opts.mode` selects it** \u2014 a third argument alone never does. Without `opts.mode` (v1) the third argument is forwarded as `hints` and the result is the raw bundle as a JSON **string**: `JSON.parse()` it, or every property read is `undefined`. With `{ mode: 'extract' }` the third argument is a schema object and the result is already parsed \u2014 `{ fields, confidence?, unmatched, raw_text, meta }`. `{ mode: 'summary' }` needs no schema and returns `{ summary, raw_text, meta }` parsed. `{ profile: 'module_cd.profile_cd' }` uses a registered extraction profile, implies mode `extract`, and cannot be combined with an inline schema. The OCR host must be on `Dsl:Limits:AllowedHosts`."
+  },
+  {
+    name: "detectDocument",
+    signature: "detectDocument(rawText)",
+    returns: "object | null",
+    doc: "Score text against reachable extraction profiles; returns the best match `{ profile, docType, score }` or `null`."
+  },
+  {
+    name: "applyProfile",
+    signature: "applyProfile(json, profile)",
+    returns: "object",
+    doc: "Map already-extracted JSON to target fields and return the mapped object \u2014 it never writes, so the `insert()` / `update()` stays yours. `json` is the parsed extractor output (`JSON.parse(ocrExtract(...))`). `profile` must be an **inline object**, `{ map: { target: { from, transform?, pick? } }, lines?: { from, map, key? } }` \u2014 passing a profile code throws, as profile-by-code is a later slice. `from` is a path into the extraction; `transform` is one of `firstValid:<basis>`, `lookupRef:<entity.matchField>>returnField>`, `matchCatalog:<same>`, `parseMoney` or `parseDate`. Header targets come back at the top level and the 1:N block under its `key` (default `lines`); a missing source path omits the target. Not the same thing as `ocrExtract`'s registered `opts.profile` code."
+  },
+  // Utilities
+  { name: "now", signature: "now()", returns: "datetime", doc: "Current date/time. Lowercase \u2014 this is the execute-block date function." },
+  { name: "addDays", signature: "addDays(date, n)", returns: "date", doc: "Add `n` days to a date." },
+  { name: "addMinutes", signature: "addMinutes(date, n)", returns: "datetime", doc: "Add `n` minutes." },
+  { name: "addSeconds", signature: "addSeconds(date, n)", returns: "datetime", doc: "Add `n` seconds." },
+  { name: "currentUserId", signature: "currentUserId()", returns: "long", doc: "The acting user's tenant user ID." },
+  { name: "flush", signature: "flush()", returns: "void", doc: "Flush pending writes so a following read sees them." },
+  { name: "tryParseJson", signature: "tryParseJson(value)", returns: "any | null", doc: "Parse JSON, returning `null` on failure instead of throwing." },
+  {
+    name: "nextNumber",
+    signature: "nextNumber(entity)",
+    returns: "string",
+    entityArg: 0,
+    doc: "Generate the next value from a number sequence. Usually unnecessary \u2014 the platform auto-fills on `insert()`."
+  },
+  {
+    name: "entityLink",
+    signature: "entityLink(entityCd, record, description?)",
+    returns: "link",
+    entityArg: 0,
+    doc: "Build a clickable link to a record, for an `entitylink` column. Always pass a **qualified** code \u2014 `entity_cd` is only unique per module."
+  }
+];
+var BUILTIN_BY_NAME = new Map(BUILTINS.map((b) => [b.name, b]));
+function checkDsl(text, ctx = {}) {
+  const parsed = parseDsl(text);
+  const out = [];
+  const positionAt = lineIndexer(text);
+  const add = (span, message, severity, rule) => {
+    const { line, column } = positionAt(span.start);
+    out.push({
+      rule,
+      severity,
+      message,
+      start: span.start,
+      end: span.end,
+      line,
+      column
+    });
+  };
+  const action = ctx.action;
+  const entity = ctx.currentEntity ?? null;
+  const isBatch = (action?.executionMode ?? "single") === "batch";
+  const hasColumn = columnMatcher(entity?.columns);
+  if (text.trim() === "") {
     add(
+      { start: 0, end: text.length },
+      "A DSL body needs at least an execute: block \u2014 an empty file installs an action that does nothing.",
       "error",
-      "missing-execute",
-      "no `execute:` block \u2014 it is the only required block in a .dsl file."
+      "dsl/empty-script"
     );
+    return out;
   }
-  for (const b of blocks) {
-    if (!BLOCKS.includes(b.block)) {
+  const firstToken = parsed.tokens[0];
+  const firstLabel = parsed.blocks[0]?.label ?? (firstToken ? { start: firstToken.start, end: firstToken.end } : { start: 0, end: text.length });
+  if (!parsed.blocks.some((b) => b.kind === "execute")) {
+    add(
+      firstLabel,
+      "No execute: block \u2014 it is the only required block, and the compiler runs nothing without it.",
+      "error",
+      "dsl/missing-execute"
+    );
+  }
+  const executeBlock = parsed.blocks.find((b) => b.kind === "execute");
+  if (executeBlock) {
+    for (let i = 0; i < parsed.tokens.length; i++) {
+      const token = parsed.tokens[i];
+      if (token.start <= executeBlock.label.start) continue;
+      if (token.character !== 0) continue;
+      const label = blockLabelAt(parsed.tokens, i);
+      if (!label) continue;
       add(
-        "warning",
-        "unknown-block",
-        `'${b.block}:' is not a DSL block marker \u2014 expected one of ${BLOCKS.join(", ")}. (A stray label at column 0 is parsed as a block.)`,
-        b.line
+        label.span,
+        label.kind === "execute" ? `"execute:" is declared more than once \u2014 the first one's body runs to the end of the file, so this header and everything under it are swallowed into it and parsed as JavaScript. Merge the two into one execute: block.` : `"${label.kind}:" is below execute:, whose body runs to the end of the file \u2014 the header and everything under it are swallowed into the execute: script and parsed as JavaScript. Move it above execute:.`,
+        "error",
+        "dsl/block-after-execute"
       );
     }
   }
-  const known = names.filter((n) => BLOCKS.includes(n));
-  const order = known.map((n) => BLOCKS.indexOf(n));
-  for (let i = 1; i < order.length; i++) {
-    if (order[i] < order[i - 1]) {
+  const seenBlocks = /* @__PURE__ */ new Set();
+  for (let i = 0; i < parsed.blocks.length; i++) {
+    const block = parsed.blocks[i];
+    if (seenBlocks.has(block.kind)) {
       add(
+        block.label,
+        `"${block.kind}:" is declared more than once \u2014 the compiler keeps one and silently drops the other.`,
         "error",
-        "block-order",
-        `blocks must appear in the order ${BLOCKS.join(" \u2192 ")}; found '${known[i - 1]}:' before '${known[i]}:'.`
+        "dsl/duplicate-block"
+      );
+      continue;
+    }
+    seenBlocks.add(block.kind);
+    const prev = parsed.blocks[i - 1];
+    if (prev && prev.kind !== "execute" && !BLOCK_STOPS[prev.kind].has(block.kind)) {
+      add(
+        block.label,
+        `"${block.kind}:" must come before "${prev.kind}:" \u2014 the compiler reads ${prev.kind}: up to the next header it recognises, and ${block.kind}: is not one of them, so this header and its body end up inside the ${prev.kind}: body.`,
+        "error",
+        "dsl/block-order"
+      );
+    }
+  }
+  for (const ref of parsed.fieldRefs) {
+    if (ref.block === "schema" || ref.block === "params") continue;
+    const isDslBlock = ref.block === "execute" || ref.block === "onBeforeStart";
+    const secondRef = ref.navigation.findIndex((h, idx) => idx > 0 && h.bracketed);
+    if (isDslBlock && secondRef > 0) {
+      const first = ref.navigation[secondRef];
+      const last = ref.navigation[ref.navigation.length - 1];
+      add(
+        { start: first.span.start, end: last.span.end },
+        `Ref navigation is single-hop in the DSL. Use getRecord() or select() to reach past "${ref.navigation[0].name}".`,
+        "error",
+        "dsl/multi-hop-nav"
       );
-      break;
     }
+    if (isBatch && ref.block === "execute" && LITERAL_NAMES.has(ref.name))
+      continue;
+    if (!entity) continue;
+    if (entity.columns.size === 0) continue;
+    if (hasColumn(ref.name)) continue;
+    if (ref.isCurrentRecord && parsed.locals.has(ref.name)) continue;
+    add(
+      ref.span,
+      `"${ref.name}" is not a column on ${entity.qualified}. [field] names are checked at pack time \u2014 this is a compile error, not an empty read.`,
+      "error",
+      "dsl/unknown-column"
+    );
   }
-  for (const b of BLOCKS) {
-    if (known.filter((n) => n === b).length > 1) {
-      add("error", "duplicate-block", `'${b}:' is declared more than once.`);
+  if (entity && entity.columns.size > 0) {
+    for (const ref of parsed.globalRefs) {
+      if (ref.global !== "old") continue;
+      if (ref.block !== "execute" && ref.block !== "onBeforeStart") continue;
+      if (hasColumn(ref.property)) continue;
+      add(
+        ref.span,
+        `"${ref.property}" is not a column on ${entity.qualified}. old[field] reads the pre-change value of a column, and the name is checked at pack time.`,
+        "error",
+        "dsl/unknown-column"
+      );
     }
   }
-  const execBlock = blocks.find((b) => b.block === "execute");
-  const execCode = execBlock ? code2.slice(execBlock.start, execBlock.end) : "";
-  const execOffset = execBlock ? execBlock.start : 0;
-  if (execBlock) {
-    for (const [fn, replacement] of Object.entries(FORMULA_ONLY)) {
-      const re = new RegExp(`\\b${fn}\\s*\\(\\s*\\)`, "g");
-      for (const m of execCode.matchAll(re)) {
+  const declared = new Set(parsed.params.map((p) => p.name.toLowerCase()));
+  const hasParamsBlock = parsed.blocks.some((b) => b.kind === "params");
+  for (const ref of parsed.globalRefs) {
+    if (ref.global !== "params") continue;
+    if (!hasParamsBlock || declared.has(ref.property.toLowerCase())) continue;
+    add(
+      ref.span,
+      `"${ref.property}" is not declared in the params: block.`,
+      "error",
+      "dsl/unknown-param"
+    );
+  }
+  if (action) {
+    const mode = action.executionMode ?? "single";
+    const recordsSpan = parsed.locals.has("records") ? void 0 : parsed.recordsRefs[0];
+    const bareFields = parsed.fieldRefs.filter(
+      (r) => r.block === "execute" && r.isCurrentRecord && !parsed.locals.has(r.name) && !LITERAL_NAMES.has(r.name)
+    );
+    if (mode === "batch") {
+      for (const field of bareFields) {
         add(
+          field.outerSpan,
+          `Action "${action.code}" runs in batch mode, which has no current record. Iterate instead: for x in records { x[${field.name}] }.`,
           "error",
-          "execute-formula-date",
-          `the execute: block calls ${fn}(), which is undefined at runtime \u2014 install fails with "'${fn}' is not defined". Use ${replacement} in execute:. ${fn}() is formula-only (canExecute:, formula columns).`,
-          lineOf(src, execOffset + (m.index ?? 0))
+          "dsl/batch-bare-field"
         );
       }
     }
-    for (const m of execCode.matchAll(/\buserId\s*\(/g)) {
+    if (mode !== "batch" && recordsSpan) {
       add(
-        "error",
-        "user-id-called-as-function",
-        "'userId' is a value, not a function \u2014 write 'userId' without parentheses, or 'currentUserId()'.",
-        lineOf(src, execOffset + (m.index ?? 0))
+        recordsSpan,
+        `"records" only exists in batch mode; action "${action.code}" runs in "${mode}" mode.`,
+        "warning",
+        "dsl/records-outside-batch"
       );
     }
   }
-  const recordRefs = [...code2.matchAll(/(?<![\w\]$])\[([a-z][a-z0-9_]*)\]/g)];
-  const mode = (opts.executionMode ?? "").toLowerCase();
-  if (opts.viaJob && recordRefs.length > 0) {
-    const first = recordRefs[0];
+  for (const token of parsed.tokens) {
+    if (blockOf(parsed, token.start) !== "canExecute") continue;
+    if (token.text !== "&&" && token.text !== "||") continue;
     add(
-      "error",
-      "job-record-context",
-      `uses record-context syntax [${first[1]}] but is invoked by a scheduled job \u2014 jobs run as the system user with NO current record, so [field] is a hard error. Fetch rows with select() (or query()) inside the job action instead.`,
-      lineOf(src, first.index ?? 0)
+      { start: token.start, end: token.end },
+      `canExecute is a formula, not JavaScript \u2014 write ${token.text === "&&" ? "AND" : "OR"}.`,
+      "warning",
+      "dsl/js-in-formula"
     );
   }
-  if (mode === "batch" && execBlock) {
-    const inExec = recordRefs.filter(
-      (m) => (m.index ?? 0) >= execBlock.start && (m.index ?? 0) < execBlock.end
-    );
-    if (inExec.length > 0) {
+  for (const call of parsed.calls) {
+    if (call.name === "userId") {
       add(
+        call.nameSpan,
+        "'userId' is a value, not a function \u2014 write userId without parentheses, or currentUserId(). The compiler's bare-identifier rewrite fires either way, so userId() reaches Jint as a call against a number.",
         "error",
-        "batch-record-context",
-        `executionMode is 'batch' but execute: uses record-context [${inExec[0][1]}] \u2014 in batch mode there is no current record. Iterate the selection instead: \`for rec in records { rec[field] }\`.`,
-        lineOf(src, inExec[0].index ?? 0)
+        "dsl/user-id-call"
       );
+      continue;
+    }
+    const builtin = BUILTIN_BY_NAME.get(call.name);
+    if (!builtin || builtin.entityArg === void 0) continue;
+    const arg = call.firstStringArg;
+    if (!arg) continue;
+    if (arg.interpolated) continue;
+    if (arg.value.includes(".") || ctx.moduleCode?.includes("-")) continue;
+    add(
+      arg.span,
+      `Qualify the entity code as "${ctx.moduleCode ? `${ctx.moduleCode}.` : "<module>."}${arg.value}" \u2014 entity_cd is only unique per module, so a bare code can resolve to another module's entity.`,
+      "info",
+      "dsl/unqualified-entity"
+    );
+  }
+  let depth = 0;
+  const functionDepths = [];
+  const parenStack = [];
+  let matchingParenOpen = -1;
+  for (let i = 0; i < parsed.tokens.length; i++) {
+    const token = parsed.tokens[i];
+    if (token.text === "(") parenStack.push(i);
+    else if (token.text === ")") matchingParenOpen = parenStack.pop() ?? -1;
+    if (token.text === "{") {
+      depth++;
+      if (opensFunctionBody(parsed.tokens, i, matchingParenOpen))
+        functionDepths.push(depth);
+    } else if (token.text === "}") {
+      if (functionDepths[functionDepths.length - 1] === depth)
+        functionDepths.pop();
+      depth = Math.max(0, depth - 1);
+    }
+    if (depth === 0 && token.character > 0) {
+      const label = blockLabelAt(parsed.tokens, i);
+      const isParamDecl = parsed.params.some(
+        (p) => p.nameSpan.start === token.start
+      );
+      if (label && !isParamDecl) {
+        add(
+          label.span,
+          `Block headers start at column 0. Indented, "${label.kind}:" is body text \u2014 the compiler never opens the block, and it runs as if empty.`,
+          "error",
+          "dsl/indented-block-header"
+        );
+      }
     }
+    if (token.kind !== "ident" || token.text !== "return") continue;
+    if (parsed.tokens[i - 1]?.text === ".") continue;
+    if (parsed.tokens[i + 1]?.text === ":") continue;
+    if (isMethodName(parsed.tokens, i)) continue;
+    if (functionDepths.length > 0) continue;
+    const block = blockOf(parsed, token.start);
+    if (block !== "execute" && block !== "onBeforeStart") continue;
+    add(
+      { start: token.start, end: token.end },
+      `A return outside a function is a syntax error \u2014 ${block}: compiles to a bare script. Use exit(message, level) to stop early and keep the changes made so far.`,
+      "error",
+      "dsl/top-level-return"
+    );
+  }
+  for (const call of parsed.calls) {
+    const replacement = FORMULA_ONLY.get(call.name);
+    if (!replacement) continue;
+    if (call.block !== "execute" && call.block !== "onBeforeStart") continue;
+    add(
+      call.nameSpan,
+      `${call.name}() is formula-only \u2014 in ${call.block}: it is undefined and install fails with "'${call.name}' is not defined". Write ${replacement}.`,
+      "error",
+      "dsl/formula-only-function"
+    );
   }
-  for (const { sql, index, end } of sqlLiterals(src)) {
-    const bad = sql.match(/(?<![:\w]):([a-z][a-z0-9_]*)/i);
+  const tokenAt = new Map(parsed.tokens.map((t, i) => [t.start, i]));
+  for (const call of parsed.calls) {
+    if (call.name !== "query" && call.name !== "callProc") continue;
+    const arg = call.firstStringArg;
+    if (!arg) continue;
+    const bad = /(^|[^:\w]):([a-z][a-z0-9_]*)/i.exec(stripSqlNoise(arg.value));
     if (bad) {
+      const name = bad[2];
       add(
+        arg.span,
+        `SQL binds @name, not :name \u2014 rewrite ':${name}' as '@${name}' and pass { ${name}: value } as the params argument.`,
         "error",
-        "sql-placeholder",
-        `SQL uses ':${bad[1]}' as a placeholder \u2014 dForge binds '@${bad[1]}'. Rewrite as '@${bad[1]}' and pass { ${bad[1]}: value } as the params argument.`,
-        lineOf(src, index)
+        "dsl/sql-placeholder"
       );
     }
-    const after = src.slice(end, end + 40);
-    if (/^\s*\+/.test(after)) {
+    if (arg.interpolated || parsed.tokens[arg.endIndex + 1]?.text === "+") {
+      const built = arg.interpolated ? "${\u2026} interpolation" : "concatenation";
       add(
+        arg.span,
+        // callProc's first argument is the procedure name, and an
+        // identifier cannot be bound — the @placeholder advice cannot
+        // be followed there.
+        call.name === "callProc" ? `Procedure name built by ${built} \u2014 a name is an identifier, so it cannot be bound as a @placeholder. Choose between fixed names in the script rather than splicing a value into one.` : `SQL built by ${built} \u2014 pass @placeholders and a params object instead, so values are bound rather than spliced into the statement.`,
         "warning",
-        "sql-concat",
-        "SQL string looks concatenated \u2014 build queries with @placeholders + a params object, never by string concatenation.",
-        lineOf(src, index)
+        "dsl/sql-concat"
       );
     }
   }
-  if (execBlock) {
-    const declaresFunction = /\bfunction\b/.test(execCode);
-    const returnRe = declaresFunction ? /^[ \t]{0,8}return\b/gm : /\breturn\b/g;
-    for (const m of execCode.matchAll(returnRe)) {
+  const declaredFunctions = /* @__PURE__ */ new Map();
+  for (let i = 0; i < parsed.tokens.length; i++) {
+    const token = parsed.tokens[i];
+    if (token.text !== "function") continue;
+    const name = parsed.tokens[i + 1];
+    if (name?.kind !== "ident") continue;
+    const blocks = declaredFunctions.get(name.text) ?? /* @__PURE__ */ new Set();
+    blocks.add(blockOf(parsed, token.start));
+    declaredFunctions.set(name.text, blocks);
+  }
+  const isDeclaredIn = (name, block) => {
+    const blocks = declaredFunctions.get(name);
+    return blocks !== void 0 && (blocks.has(null) || blocks.has(block));
+  };
+  const reportedUnknown = /* @__PURE__ */ new Set();
+  for (const call of parsed.calls) {
+    if (call.block !== "execute" && call.block !== "onBeforeStart") continue;
+    const name = call.name;
+    const idx = tokenAt.get(call.nameSpan.start);
+    if (idx !== void 0) {
+      const prev = parsed.tokens[idx - 1]?.text;
+      if (prev === "function" || prev === "new") continue;
+      if (isMethodName(parsed.tokens, idx)) continue;
+    }
+    if (BUILTIN_BY_NAME.has(name) || CONTROL_KEYWORDS.has(name) || KEYWORDS_BEFORE_PAREN.has(name) || JS_GLOBALS.has(name) || FORMULA_ONLY.has(name) || // Its own rule reports this one, with better wording.
+    name === "userId" || isDeclaredIn(name, call.block) || parsed.locals.has(name) || reportedUnknown.has(name)) {
+      continue;
+    }
+    reportedUnknown.add(name);
+    add(
+      call.nameSpan,
+      `"${name}()" is not a DSL host function, and nothing in this script declares it. Check it against the built-in catalog.`,
+      "warning",
+      "dsl/unknown-builtin"
+    );
+  }
+  if (ctx.action?.viaJob) {
+    const inScript = (block) => block === "execute" || block === "onBeforeStart";
+    const bound = [];
+    for (const ref of parsed.fieldRefs) {
+      if (!inScript(ref.block)) continue;
+      if (isBatch && ref.block === "execute" && LITERAL_NAMES.has(ref.name))
+        continue;
+      if (ref.isCurrentRecord && parsed.locals.has(ref.name)) continue;
+      bound.push({ span: ref.outerSpan, read: `[${ref.name}]` });
+    }
+    for (const ref of parsed.globalRefs) {
+      if (ref.global !== "old" || !inScript(ref.block)) continue;
+      bound.push({ span: ref.span, read: `old[${ref.property}]` });
+    }
+    if (!parsed.locals.has("records")) {
+      for (const span of parsed.recordsRefs) {
+        if (!inScript(blockOf(parsed, span.start))) continue;
+        bound.push({ span, read: "records" });
+      }
+    }
+    const first = bound.sort((a, b) => a.span.start - b.span.start)[0];
+    if (first) {
       add(
+        first.span,
+        `Action "${ctx.action.code}" is invoked by a scheduled job, which runs as the system user with no record bound \u2014 ${first.read} has nothing to read. Fetch rows with select() or query() instead.`,
         "error",
-        "top-level-return",
-        "top-level `return` is invalid in a DSL body. Use exit('msg', 'info') to stop and commit, or error('msg') to stop and roll back.",
-        lineOf(src, execOffset + (m.index ?? 0))
+        "dsl/job-record-context"
       );
     }
   }
-  const local = /* @__PURE__ */ new Set();
-  for (const m of code2.matchAll(/\bfunction\s+([A-Za-z_$][\w$]*)/g)) local.add(m[1]);
-  for (const m of code2.matchAll(/\bvar\s+([A-Za-z_$][\w$]*)/g)) local.add(m[1]);
-  const reported = /* @__PURE__ */ new Set();
-  for (const m of code2.matchAll(/(?<![.\w$])([A-Za-z_$][\w$]*)\s*\(/g)) {
-    const fn = m[1];
-    if (DSL_BUILTINS.has(fn) || JS_RESERVED.has(fn) || local.has(fn) || reported.has(fn) || fn in FORMULA_ONLY || VALUE_MEMBERS.has(fn)) {
+  out.push(...inlineAssignmentIssues(parsed, positionAt));
+  return out;
+}
+function columnMatcher(columns) {
+  if (!columns) return () => true;
+  if (typeof columns.keys !== "function")
+    return (name) => columns.has(name) || columns.has(name.toLowerCase());
+  const folded = /* @__PURE__ */ new Set();
+  for (const key of columns.keys()) folded.add(key.toLowerCase());
+  return (name) => folded.has(name.toLowerCase());
+}
+function isMethodName(tokens, i) {
+  if (tokens[i + 1]?.text !== "(") return false;
+  let depth = 0;
+  for (let j = i + 1; j < tokens.length; j++) {
+    const text = tokens[j].text;
+    if (text === "(") depth++;
+    else if (text === ")") {
+      depth--;
+      if (depth === 0) return tokens[j + 1]?.text === "{";
+    }
+  }
+  return false;
+}
+function opensFunctionBody(tokens, i, matchingParenOpen) {
+  const prev = tokens[i - 1];
+  if (prev?.text === "=>") return true;
+  if (prev?.text !== ")" || matchingParenOpen < 0) return false;
+  const head = tokens[matchingParenOpen - 1];
+  return head?.kind === "ident" && !CONTROL_KEYWORDS.has(head.text);
+}
+var BLOCK_STOPS = {
+  params: /* @__PURE__ */ new Set(["schema", "canExecute", "onBeforeStart", "execute"]),
+  canExecute: /* @__PURE__ */ new Set(["schema", "onBeforeStart", "execute"]),
+  schema: /* @__PURE__ */ new Set(["params", "canExecute", "onBeforeStart", "execute"]),
+  onBeforeStart: /* @__PURE__ */ new Set(["schema", "execute"]),
+  execute: /* @__PURE__ */ new Set()
+};
+var FORMULA_ONLY = /* @__PURE__ */ new Map([
+  ["TODAY", "now()"],
+  ["NOW", "now()"],
+  ["CURRENT_USER_ID", "currentUserId()"]
+]);
+var KEYWORDS_BEFORE_PAREN = /* @__PURE__ */ new Set([
+  "function",
+  "return",
+  "typeof",
+  "instanceof",
+  "new",
+  "delete",
+  "void",
+  "in",
+  "of",
+  "do",
+  "else",
+  "try",
+  "throw",
+  "yield",
+  "await"
+]);
+var JS_GLOBALS = /* @__PURE__ */ new Set([
+  "parseInt",
+  "parseFloat",
+  "isNaN",
+  "isFinite",
+  "encodeURI",
+  "decodeURI",
+  "encodeURIComponent",
+  "decodeURIComponent",
+  "String",
+  "Number",
+  "Boolean",
+  "Array",
+  "Object",
+  "Date",
+  "Math",
+  "JSON",
+  "RegExp",
+  "Error",
+  "Set",
+  "Map",
+  "WeakSet",
+  "WeakMap",
+  "Promise",
+  "Symbol",
+  "BigInt"
+]);
+var LITERAL_NAMES = /* @__PURE__ */ new Set([
+  "true",
+  "false",
+  "null",
+  "TRUE",
+  "FALSE",
+  "NULL"
+]);
+function stripSqlNoise(sql) {
+  let out = "";
+  let i = 0;
+  while (i < sql.length) {
+    const c = sql[i];
+    if (c === "'" || c === '"') {
+      const quote = c;
+      out += " ";
+      i++;
+      while (i < sql.length) {
+        if (sql[i] === quote && sql[i + 1] === quote) {
+          out += "  ";
+          i += 2;
+          continue;
+        }
+        if (sql[i] === quote) break;
+        out += sql[i] === "\n" ? "\n" : " ";
+        i++;
+      }
+      if (i < sql.length) {
+        out += " ";
+        i++;
+      }
       continue;
     }
-    reported.add(fn);
-    add(
-      "warning",
-      "unknown-builtin",
-      `calls '${fn}()', which is not a DSL host function or a locally declared one. Check the name against dforge://docs/dsl (Built-in functions).`,
-      lineOf(src, m.index ?? 0)
-    );
+    if (c === "-" && sql[i + 1] === "-") {
+      while (i < sql.length && sql[i] !== "\n") {
+        out += " ";
+        i++;
+      }
+      continue;
+    }
+    if (c === "/" && sql[i + 1] === "*") {
+      out += "  ";
+      i += 2;
+      while (i < sql.length && !(sql[i] === "*" && sql[i + 1] === "/")) {
+        out += sql[i] === "\n" ? "\n" : " ";
+        i++;
+      }
+      if (i < sql.length) {
+        out += "  ";
+        i += 2;
+      }
+      continue;
+    }
+    out += c;
+    i++;
+  }
+  return out;
+}
+function blockOf(parsed, offset) {
+  return parsed.blocks.find((b) => offset >= b.body.start && offset < b.body.end)?.kind ?? null;
+}
+function inlineAssignmentIssues(parsed, positionAt) {
+  const out = [];
+  for (const ref of parsed.fieldRefs) {
+    const assign = parsed.tokens[ref.endIndex + 1];
+    if (!assign || assign.kind !== "punct" || assign.text !== "=") continue;
+    const line = parsed.tokens[ref.startIndex].line;
+    let openedHere = false;
+    for (let i = ref.startIndex - 1; i >= 0; i--) {
+      const t = parsed.tokens[i];
+      if (t.line !== line) break;
+      if (t.text === "{") {
+        openedHere = true;
+        break;
+      }
+    }
+    if (!openedHere) continue;
+    const pos = positionAt(ref.outerSpan.start);
+    out.push({
+      rule: "dsl/inline-assignment",
+      severity: "warning",
+      message: "An assignment to a record field on the same line as the brace that opens its block mis-compiles. Put the assignment on its own line.",
+      start: ref.outerSpan.start,
+      end: ref.outerSpan.end,
+      line: pos.line,
+      column: pos.column
+    });
+  }
+  return out;
+}
+function lineIndexer(text) {
+  const starts = [0];
+  for (let i = 0; i < text.length; i++) {
+    if (text[i] === "\n") starts.push(i + 1);
+  }
+  return (offset) => {
+    let lo = 0;
+    let hi = starts.length - 1;
+    while (lo < hi) {
+      const mid = lo + hi + 1 >> 1;
+      if (starts[mid] <= offset) lo = mid;
+      else hi = mid - 1;
+    }
+    return { line: lo + 1, column: offset - starts[lo] + 1 };
+  };
+}
+
+// src/tools/dsl-check.ts
+function checkDsl2(src, opts = {}) {
+  const raw = opts.executionMode?.trim();
+  const mode = raw?.toLowerCase();
+  const executionMode = mode === "single" || mode === "each" || mode === "batch" ? mode : void 0;
+  const ctx = {
+    moduleCode: opts.moduleCode,
+    action: executionMode || opts.viaJob || opts.actionCode ? { code: opts.actionCode ?? "this action", executionMode, viaJob: opts.viaJob } : void 0,
+    currentEntity: opts.entity ?? null
+  };
+  const issues = checkDsl(src, ctx).map(toIssue);
+  if (raw && !executionMode) {
+    issues.unshift({
+      level: "warning",
+      rule: "action/unknown-execution-mode",
+      message: `executionMode '${raw}' is not one of single, each, batch \u2014 the record-context rules stood down, so a \`[field]\` read that batch mode forbids would not be reported. Fix the value in ui/actions.json.`
+    });
   }
   return issues;
 }
+function toIssue(issue2) {
+  return {
+    level: issue2.severity === "error" ? "error" : "warning",
+    rule: issue2.rule,
+    message: issue2.message,
+    line: issue2.line
+  };
+}
 
 // src/tools/action-add.ts
 var actionAddSchema = {
@@ -34640,7 +35911,19 @@ var actionAddSchema = {
   )
 };
 function actionAdd(args) {
-  const dslIssues = checkDsl(args.dslBody, { executionMode: args.executionMode });
+  const { paths, manifest } = loadManifest(args.moduleDir);
+  const { traits: localTraits, error: traitsError } = readLocalTraits(paths.root);
+  if (traitsError) {
+    throw new Error(
+      `traits.json \u2014 ${traitsError} Its traits can't be overlaid, so '${args.entityCode}' reads as declaring an unknown trait and the column rules stand down \u2014 this body would be written unchecked against the entity. Fix the file and call again.`
+    );
+  }
+  const dslIssues = checkDsl2(args.dslBody, {
+    executionMode: args.executionMode,
+    moduleCode: manifest.code,
+    actionCode: args.code,
+    entity: entityRecordContext(paths, manifest, args.entityCode, localTraits)
+  });
   const dslErrors = dslIssues.filter((i) => i.level === "error");
   if (dslErrors.length > 0) {
     throw new Error(
@@ -34649,7 +35932,6 @@ function actionAdd(args) {
     );
   }
   const dslWarnings = dslIssues.filter((i) => i.level === "warning");
-  const { paths, manifest } = loadManifest(args.moduleDir);
   const actionsJson = readJsonOrDefault(paths.actions, {});
   if (Object.prototype.hasOwnProperty.call(actionsJson, args.code)) {
     throw new Error(
@@ -34698,6 +35980,9 @@ var actionCheckSchema = {
   ),
   viaJob: external_exports.boolean().optional().describe(
     "True when a scheduled job will fire this action \u2014 jobs have NO current record, so '[field]' becomes a hard error. Detected automatically from logic/jobs.json when actionCode is used."
+  ),
+  entityCode: external_exports.string().regex(/^[a-z][a-z0-9_]*(\.[a-z][a-z0-9_]*)?$/).optional().describe(
+    "Entity the draft body acts on. With moduleDir, this turns on the column rules ('[field]' must be a real column, traits expanded) for a dslBody that isn't registered yet. Read from ui/actions.json when actionCode is used."
   )
 };
 function actionCheck(args) {
@@ -34705,37 +35990,63 @@ function actionCheck(args) {
   let mode = args.executionMode;
   let viaJob = args.viaJob ?? false;
   let label = "draft DSL body";
-  if (args.actionCode) {
-    if (!args.moduleDir) {
-      throw new Error("moduleDir is required when checking an on-disk action (actionCode).");
-    }
-    const { paths } = loadManifest(args.moduleDir);
-    const actions = readJsonOrDefault(paths.actions, {});
-    const entry = actions[args.actionCode];
-    if (!entry) {
-      throw new Error(
-        `Action '${args.actionCode}' is not in ui/actions.json. Registered actions: ${Object.keys(actions).join(", ") || "(none)"}.`
-      );
-    }
-    const script = entry.script ?? args.actionCode;
-    const dslPath = path10.join(paths.logicDir, "actions", `${script}.dsl`);
-    if (!fs7.existsSync(dslPath)) {
-      throw new Error(
-        `Action '${args.actionCode}' declares script '${script}' but logic/actions/${script}.dsl does not exist.`
-      );
-    }
-    body = fs7.readFileSync(dslPath, "utf8");
-    mode = mode ?? (entry.executionMode ?? entry.mode);
-    label = `logic/actions/${script}.dsl`;
-    if (args.viaJob === void 0) {
-      const jobFile = readJsonOrDefault(paths.jobs, {});
-      viaJob = (jobFile.jobs ?? []).some((j) => j.action === args.actionCode);
+  let entityCode = args.entityCode;
+  let moduleCode;
+  let entity;
+  const preIssues = [];
+  if (args.actionCode && !args.moduleDir) {
+    throw new Error("moduleDir is required when checking an on-disk action (actionCode).");
+  }
+  if (args.moduleDir) {
+    const { paths, manifest } = loadManifest(args.moduleDir);
+    moduleCode = manifest.code;
+    if (args.actionCode) {
+      const actions = readJsonOrDefault(paths.actions, {});
+      const entry = actions[args.actionCode];
+      if (!entry) {
+        throw new Error(
+          `Action '${args.actionCode}' is not in ui/actions.json. Registered actions: ${Object.keys(actions).join(", ") || "(none)"}.`
+        );
+      }
+      const script = entry.script ?? args.actionCode;
+      const dslPath = path10.join(paths.logicDir, "actions", `${script}.dsl`);
+      if (!fs7.existsSync(dslPath)) {
+        throw new Error(
+          `Action '${args.actionCode}' declares script '${script}' but logic/actions/${script}.dsl does not exist.`
+        );
+      }
+      body = fs7.readFileSync(dslPath, "utf8");
+      mode = mode ?? (entry.executionMode ?? entry.mode);
+      entityCode = entityCode ?? entry.entityCode;
+      label = `logic/actions/${script}.dsl`;
+      if (args.viaJob === void 0) {
+        const jobFile = readJsonOrDefault(paths.jobs, {});
+        viaJob = (jobFile.jobs ?? []).some((j) => j.action === args.actionCode);
+      }
+    }
+    const { traits: localTraits, error: traitsError } = readLocalTraits(paths.root);
+    if (traitsError) {
+      preIssues.push({
+        level: "error",
+        rule: "module/invalid-traits-json",
+        message: `traits.json \u2014 ${traitsError} This module's own traits can't be overlaid on the platform ones, so an entity using them reads as declaring an unknown trait and the column rules below stand down. Fix the file, then check again.`
+      });
     }
+    entity = entityRecordContext(paths, manifest, entityCode, localTraits);
   }
   if (body === void 0) {
     throw new Error("Pass either dslBody (a draft) or actionCode (an action already on disk).");
   }
-  const issues = checkDsl(body, { executionMode: mode, viaJob });
+  const issues = [
+    ...preIssues,
+    ...checkDsl2(body, {
+      executionMode: mode,
+      viaJob,
+      moduleCode,
+      actionCode: args.actionCode,
+      entity
+    })
+  ];
   const errors = issues.filter((i) => i.level === "error");
   const warnings = issues.filter((i) => i.level === "warning");
   const summary = errors.length === 0 && warnings.length === 0 ? `\u2713 ${label}: no DSL issues${mode ? ` (executionMode '${mode}'${viaJob ? ", job-invoked" : ""})` : ""}.` : `${label}: ${errors.length} error(s), ${warnings.length} warning(s).${errors.length ? ` First: ${errors[0].message}` : ""}`;
@@ -34946,6 +36257,12 @@ function buildSkeleton(moduleDir) {
   const { paths, manifest } = loadManifest(moduleDir);
   const entries = [];
   const counts = {};
+  const { traits: localTraits, error: traitsError } = readLocalTraits(paths.root);
+  if (traitsError) {
+    throw new Error(
+      `traits.json \u2014 ${traitsError} Its traits can't be overlaid, so the entities that use one would be skipped as declaring an unknown trait and their columns would go unlabelled \u2014 which fails the install. Fix the file and sync again.`
+    );
+  }
   const push = (section, pathParts, english, required2 = false) => {
     entries.push({ pathParts, english, required: required2 });
     counts[section] = (counts[section] ?? 0) + 1;
@@ -34967,8 +36284,8 @@ function buildSkeleton(moduleDir) {
     push("entities", ["entities", name, "label"], str(e, "description") ?? titleize(name));
     const authored = e.fields ?? {};
     const traitCodes = e.traits ?? [];
-    assertKnownTraits(traitCodes, name);
-    const traitFields = expandTraits(traitCodes, name);
+    assertKnownTraits(traitCodes, name, localTraits);
+    const traitFields = expandTraits(traitCodes, name, localTraits);
     const all = { ...traitFields, ...authored };
     for (const [fname, f] of Object.entries(all)) {
       push(
@@ -35157,21 +36474,27 @@ function seedAdd(args) {
       );
     }
   }
-  assertKnownTraits(traits2, args.entity);
-  const traitFields = expandTraits(traits2, args.entity);
-  const known = /* @__PURE__ */ new Set([...Object.keys(fields), ...Object.keys(traitFields)]);
+  const { traits: localTraits, error: traitsError } = readLocalTraits(paths.root);
+  if (traitsError) {
+    throw new Error(
+      `traits.json \u2014 ${traitsError} Its traits can't be overlaid, so an entity that uses one reads as declaring an unknown trait and its columns as unknown. Fix the file.`
+    );
+  }
+  assertKnownTraits(traits2, args.entity, localTraits);
+  const { columns: known, fieldDefs: allFields } = expandedEntity(entity, args.entity, localTraits);
+  const traitOnly = [...known].filter((c) => !(c in fields));
   known.add(pk);
   const unknown2 = /* @__PURE__ */ new Set();
   for (const r of args.records) {
     for (const k of Object.keys(r)) if (!known.has(k)) unknown2.add(k);
   }
   if (unknown2.size > 0) {
-    const traitCols = Object.keys(traitFields);
+    const traitCols = traitOnly;
     throw new Error(
       `Seed records set column(s) not defined on '${args.entity}': ${[...unknown2].join(", ")}. Its columns are: ${Object.keys(fields).join(", ") || "(none authored)"}` + (traitCols.length > 0 ? `, plus these from traits [${traits2.join(", ")}]: ${traitCols.join(", ")}.` : ".")
     );
   }
-  for (const [fname, f] of Object.entries(fields)) {
+  for (const [fname, f] of Object.entries(allFields)) {
     if (f?.columnType !== "R") continue;
     const used = args.records.some((r) => r[fname] !== void 0);
     if (used) {
@@ -35181,7 +36504,7 @@ function seedAdd(args) {
       );
     }
   }
-  for (const [fname, f] of Object.entries(fields)) {
+  for (const [fname, f] of Object.entries(allFields)) {
     const flags = typeof f?.flags === "string" ? f.flags : "";
     const isVirtual = f?.columnType === "R" || f?.columnType === "S" || f?.columnType === "F" || f?.columnType === "G";
     if (isVirtual || !flags.includes("M") || f?.formula !== void 0) continue;
@@ -35706,9 +37029,17 @@ function moduleValidate(args) {
   const err = (where, message) => issues.push({ level: "error", where, message });
   const warn = (where, message) => issues.push({ level: "warning", where, message });
   const entityMap = manifest.entities ?? {};
+  const { traits: localTraits, error: traitsError } = readLocalTraits(paths.root);
+  if (traitsError) {
+    err(
+      "traits.json",
+      `${traitsError} This module's own traits can't be overlaid on the platform ones, so entities using them read as declaring an unknown trait \u2014 expect knock-on 'not a column' errors below.`
+    );
+  }
   const entities = {};
   const columnsOf = {};
   const fieldDefsOf = {};
+  const partialColumns = /* @__PURE__ */ new Set();
   for (const [name, relPath] of Object.entries(entityMap)) {
     if (name.includes(".")) continue;
     const abs = path15.join(paths.root, relPath.replace(/^\.\//, ""));
@@ -35724,20 +37055,19 @@ function moduleValidate(args) {
       continue;
     }
     entities[name] = e;
-    const fields = e.fields ?? {};
-    const cols = new Set(Object.keys(fields));
     const traits2 = e.traits ?? [];
-    const badTraits = unknownTraits(traits2);
+    const badTraits = unknownTraits(traits2, localTraits);
     if (badTraits.length > 0) {
       err(
         `entities/${name}.json`,
         `declares unknown trait(s): ${badTraits.join(", ")}. Valid: ${TRAIT_CODES.join(", ")}. An unrecognized trait is ignored when columns are expanded, so its columns are missing from this entity \u2014 expect knock-on 'not a column' errors below.`
       );
+      partialColumns.add(name);
     }
-    const traitFields = expandTraits(traits2, name);
-    for (const c of Object.keys(traitFields)) cols.add(c);
-    columnsOf[name] = cols;
-    fieldDefsOf[name] = { ...traitFields, ...fields };
+    const { columns, fieldDefs, conflicts } = expandedEntity(e, name, localTraits);
+    for (const c of conflicts) err(`entities/${name}.json`, describeTraitConflict(c));
+    columnsOf[name] = columns;
+    fieldDefsOf[name] = fieldDefs;
   }
   const deps = new Set(Object.keys(manifest.dependencies ?? {}));
   const isKnownEntity = (code2) => {
@@ -36108,7 +37438,8 @@ function moduleValidate(args) {
       err(where, `schedules action '${act}', which is not in ui/actions.json.`);
     }
     if (act && act in actions) {
-      const script = actions[act]?.script;
+      const registered = actions[act] ?? {};
+      const script = registered.script;
       if (typeof script === "string") {
         const dslPath = path15.join(paths.logicDir, "actions", `${script}.dsl`);
         if (fs12.existsSync(dslPath)) {
@@ -36117,8 +37448,13 @@ function moduleValidate(args) {
             body = fs12.readFileSync(dslPath, "utf8");
           } catch {
           }
-          for (const issue2 of checkDsl(body, { viaJob: true })) {
-            if (issue2.rule !== "job-record-context") continue;
+          for (const issue2 of checkDsl2(body, {
+            executionMode: registered.executionMode ?? registered.mode,
+            viaJob: true,
+            actionCode: act,
+            moduleCode: manifest.code
+          })) {
+            if (issue2.rule !== "dsl/job-record-context") continue;
             issues.push({ level: issue2.level, where, message: issue2.message });
           }
         }
@@ -36147,10 +37483,20 @@ function moduleValidate(args) {
       continue;
     }
     const mode = a.executionMode ?? a.mode;
-    for (const issue2 of checkDsl(body, { executionMode: mode })) {
+    const entityCode = localEntityCode(
+      a.entityCode,
+      manifest.code
+    );
+    const columns = entityCode && !partialColumns.has(entityCode) ? columnsOf[entityCode] : void 0;
+    for (const issue2 of checkDsl2(body, {
+      executionMode: mode,
+      actionCode: acode,
+      moduleCode: manifest.code,
+      entity: entityCode && columns ? { qualified: `${manifest.code}.${entityCode}`, columns } : void 0
+    })) {
       issues.push({
         level: issue2.level,
-        where: `logic/actions/${script}.dsl`,
+        where: `logic/actions/${script}.dsl${issue2.line ? `:${issue2.line}` : ""}`,
         message: `[${acode}] ${issue2.message}`
       });
     }
@@ -36756,7 +38102,7 @@ var resources = [
   matrixExample("ui/data_views.json", "Canonical MATRIX data view: viewType 'matrix' + viewConfig with a dataset rowAxis (categories), a dropdown colAxis ('budget_line.quarter'), and an editable cell mapping rowKey/colKey/fields onto the budget_line entity."),
   matrixExample("entities/budget_line.json", "Matrix CELL entity: one record per (category, quarter) \u2014 FK+Reference to the row-axis entity plus the dropdown column that is the col axis, with the editable 'amount' value column."),
   matrixExample("entities/budget_category.json", "Matrix row-axis (dataset) entity."),
-  matrixExample("manifest.json", "Matrix example manifest (entities + dataViews + roles + seed)."),
+  matrixExample("manifest.json", "Matrix example manifest: declares only 'entities' \u2014 the data view, roles and seed files are found by convention (ui/, security/, seed-data/), and the manifest schema is additionalProperties:false."),
   matrixExample("security/roles.json", "Matrix example roles: S on the axis entity, SIUD on the editable cell entity."),
   matrixExample("seed-data/01-categories.json", "Matrix example seed: row-axis category records."),
   columnSecurityExample("entities/product.json", `Canonical ENTITY VIEWS (column-level security): one entity, two views \u2014 'storekeeper' (a plain column subset, prices absent entirely) and 'accountant' (with a per-column flags override making a column read-only in that view only, and a per-view formula override on an "F" column). Both list the primary key, which a view must.`),