@ketvietlab/ketjs 0.1.2 → 0.1.3

package/dist/kernel/classification.js

@@ -0,0 +1,73 @@
+// What the deployment's data actually is, read off the manifest.
+//
+// An obligation to export or erase somebody's data cannot be met against a schema
+// nobody has classified, and neither can a question as simple as "which columns
+// would leak if this table went out the door". Both are answered here, from the
+// same composed manifest the migration and the agent descriptor read, so the answer
+// cannot drift from what the deployment actually runs.
+//
+// The inventory deliberately reports what is *not* classified as well. An inventory
+// of only the fields somebody remembered to tag is the one thing worse than no
+// inventory: it looks complete.
+const typeOf = (field) => `${field.base === 'ref' ? `ref:${field.target}` : field.base}${field.optional ? '?' : ''}`;
+export function classificationInventory(manifest) {
+    const personal = [];
+    const sensitive = [];
+    const unclassified = [];
+    let fields = 0;
+    for (const [model, def] of Object.entries(manifest.models).sort(([a], [b]) => a.localeCompare(b))) {
+        let classified = false;
+        for (const [field, spec] of Object.entries(def.fields).sort(([a], [b]) => a.localeCompare(b))) {
+            fields += 1;
+            if (!spec.personal && !spec.sensitive)
+                continue;
+            classified = true;
+            const entry = {
+                model,
+                field,
+                by: spec.by,
+                type: typeOf(spec),
+                personal: Boolean(spec.personal),
+                sensitive: Boolean(spec.sensitive),
+            };
+            if (entry.personal)
+                personal.push(entry);
+            if (entry.sensitive)
+                sensitive.push(entry);
+        }
+        if (!classified)
+            unclassified.push(model);
+    }
+    return {
+        personal,
+        sensitive,
+        unclassified,
+        counts: {
+            models: Object.keys(manifest.models).length,
+            fields,
+            personal: personal.length,
+            sensitive: sensitive.length,
+            unclassified: unclassified.length,
+        },
+    };
+}
+const row = (entry, width) => `  ${`${entry.model}.${entry.field}`.padEnd(width)}  ${entry.type.padEnd(18)} by ${entry.by}`;
+export function formatClassification(inventory) {
+    const all = [...inventory.personal, ...inventory.sensitive];
+    const width = Math.max(24, ...all.map((entry) => `${entry.model}.${entry.field}`.length));
+    const lines = [];
+    lines.push(`personal data (${inventory.counts.personal} field(s))`);
+    lines.push(...(inventory.personal.length ? inventory.personal.map((e) => row(e, width)) : ['  none']));
+    lines.push('');
+    lines.push(`sensitive (${inventory.counts.sensitive} field(s)) — never leaves the system`);
+    lines.push(...(inventory.sensitive.length ? inventory.sensitive.map((e) => row(e, width)) : ['  none']));
+    lines.push('');
+    lines.push(`${inventory.counts.unclassified} of ${inventory.counts.models} model(s) classify no field at all`);
+    // Named rather than counted, because the list is the work queue.
+    if (inventory.unclassified.length) {
+        for (const model of inventory.unclassified)
+            lines.push(`  ${model}`);
+    }
+    return lines.join('\n');
+}
+//# sourceMappingURL=classification.js.map

package/dist/kernel/classification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"classification.js","sourceRoot":"","sources":["../../../../../../packages/ketjs/src/kernel/classification.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,EAAE;AACF,kFAAkF;AAClF,gFAAgF;AAChF,gFAAgF;AAChF,oFAAoF;AACpF,uDAAuD;AACvD,EAAE;AACF,oFAAoF;AACpF,+EAA+E;AAC/E,gCAAgC;AAsBhC,MAAM,MAAM,GAAG,CAAC,KAA2D,EAAU,EAAE,CACrF,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAA;AAE5F,MAAM,UAAU,uBAAuB,CAAC,QAAkB;IACxD,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,SAAS,GAAsB,EAAE,CAAA;IACvC,MAAM,YAAY,GAAa,EAAE,CAAA;IACjC,IAAI,MAAM,GAAG,CAAC,CAAA;IAEd,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClG,IAAI,UAAU,GAAG,KAAK,CAAA;QACtB,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9F,MAAM,IAAI,CAAC,CAAA;YACX,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,SAAS;gBAAE,SAAQ;YAC/C,UAAU,GAAG,IAAI,CAAA;YACjB,MAAM,KAAK,GAAoB;gBAC7B,KAAK;gBACL,KAAK;gBACL,EAAE,EAAE,IAAI,CAAC,EAAE;gBACX,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC;gBAClB,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAChC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;aACnC,CAAA;YACD,IAAI,KAAK,CAAC,QAAQ;gBAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACxC,IAAI,KAAK,CAAC,SAAS;gBAAE,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC5C,CAAC;QACD,IAAI,CAAC,UAAU;YAAE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC3C,CAAC;IAED,OAAO;QACL,QAAQ;QACR,SAAS;QACT,YAAY;QACZ,MAAM,EAAE;YACN,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM;YAC3C,MAAM;YACN,QAAQ,EAAE,QAAQ,CAAC,MAAM;YACzB,SAAS,EAAE,SAAS,CAAC,MAAM;YAC3B,YAAY,EAAE,YAAY,CAAC,MAAM;SAClC;KACF,CAAA;AACH,CAAC;AAED,MAAM,GAAG,GAAG,CAAC,KAAsB,EAAE,KAAa,EAAU,EAAE,CAC5D,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,KAAK,CAAC,EAAE,EAAE,CAAA;AAE/F,MAAM,UAAU,oBAAoB,CAAC,SAAkC;IACrE,MAAM,GAAG,GAAG,CAAC,GAAG,SAAS,CAAC,QAAQ,EAAE,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;IAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAA;IACzF,MAAM,KAAK,GAAa,EAAE,CAAA;IAE1B,KAAK,CAAC,IAAI,CAAC,kBAAkB,SAAS,CAAC,MAAM,CAAC,QAAQ,YAAY,CAAC,CAAA;IACnE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAA;IACtG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACd,KAAK,CAAC,IAAI,CAAC,cAAc,SAAS,CAAC,MAAM,CAAC,SAAS,sCAAsC,CAAC,CAAA;IAC1F,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAA;IACxG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACd,KAAK,CAAC,IAAI,CACR,GAAG,SAAS,CAAC,MAAM,CAAC,YAAY,OAAO,SAAS,CAAC,MAAM,CAAC,MAAM,oCAAoC,CACnG,CAAA;IACD,iEAAiE;IACjE,IAAI,SAAS,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;QAClC,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,YAAY;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC,CAAA;IACtE,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC"}

package/dist/kernel/compose.d.ts

@@ -1,6 +1,10 @@
-import type { KetModule, Manifest } from '../types.ts';
+import type { KetModule, Manifest, ModulePermissionsDef } from '../types.ts';
+import type { RoleTemplateDef } from '../types.ts';
 export declare function compose(modules: KetModule[], opts?: {
-    appRequires?: string[];
+    requiredRegions?: string[];
     headless?: boolean;
+    requirePermissionCoverage?: boolean;
+    roleTemplates?: Record<string, RoleTemplateDef>;
+    modulePermissionDeclarations?: Record<string, ModulePermissionsDef>;
 }): Manifest;
 //# sourceMappingURL=compose.d.ts.map

package/dist/kernel/compose.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"compose.d.ts","sourceRoot":"","sources":["../../../../../packages/ketjs/src/kernel/compose.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAiB,MAAM,aAAa,CAAA;AAOrE,wBAAgB,OAAO,CACrB,OAAO,EAAE,SAAS,EAAE,EACpB,IAAI,GAAE;IAAE,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAO,GACxD,QAAQ,CA68BV"}
+{"version":3,"file":"compose.d.ts","sourceRoot":"","sources":["../../../../../packages/ketjs/src/kernel/compose.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAiB,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAK3F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAiDlD,wBAAgB,OAAO,CACrB,OAAO,EAAE,SAAS,EAAE,EACpB,IAAI,GAAE;IACJ,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,yBAAyB,CAAC,EAAE,OAAO,CAAA;IACnC,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;IAC/C,4BAA4B,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA;CAC/D,GACL,QAAQ,CAsqCV"}

package/dist/kernel/compose.js

@@ -7,7 +7,48 @@
 import { topoSort } from './graph.js';
 import { Diagnostics } from './errors.js';
 import { parseType } from './types.js';
+import { validateSchedule } from './schedule.js';
 import { ambiguousRoutes, parseRoutePattern } from './routes.js';
+import { tableNameFor } from '../data/migrate.js';
+import { compilePermissionBundles } from './permissions.js';
+const FIELD_KEYS = new Set(['type', 'personal', 'sensitive']);
+/**
+ * Accept both field forms.
+ *
+ * The vocabulary is closed: a key nobody knows is a build error rather than a flag
+ * that silently does nothing, which is how a field ends up believed to be protected
+ * when it is not.
+ */
+function normalizeField(declared) {
+    if (typeof declared === 'string') {
+        return { ok: true, type: declared, personal: false, sensitive: false };
+    }
+    if (declared === null || typeof declared !== 'object') {
+        return { ok: false, code: 'E_BAD_FIELD', reason: 'a field is a type string or an object with a type' };
+    }
+    const unknown = Object.keys(declared).filter((k) => !FIELD_KEYS.has(k));
+    if (unknown.length) {
+        return {
+            ok: false,
+            code: 'E_BAD_FIELD',
+            reason: `unknown field key(s) ${unknown.join(', ')} (accepted: ${[...FIELD_KEYS].join(', ')})`,
+        };
+    }
+    if (typeof declared.type !== 'string') {
+        return { ok: false, code: 'E_BAD_FIELD', reason: 'a field object needs a type string' };
+    }
+    for (const flag of ['personal', 'sensitive']) {
+        if (declared[flag] !== undefined && typeof declared[flag] !== 'boolean') {
+            return { ok: false, code: 'E_BAD_FIELD', reason: `"${flag}" must be a boolean` };
+        }
+    }
+    return {
+        ok: true,
+        type: declared.type,
+        personal: declared.personal === true,
+        sensitive: declared.sensitive === true,
+    };
+}
 const qualify = (mod, name) => `${mod}.${name}`;
 const jointKey = (mod, name) => `${mod}:${name}`;
 export function compose(modules, opts = {}) {
@@ -23,9 +64,20 @@ export function compose(modules, opts = {}) {
         joints: {},
         fills: [],
         functions: {},
+        permissions: {
+            version: 1,
+            digest: '',
+            coverageRequired: false,
+            modules: {},
+            bundles: {},
+            functions: {},
+            exemptions: {},
+            roleTemplates: {},
+        },
         jobs: {},
         views: {},
-        regions: { required: [...(opts.appRequires ?? [])], provided: {} },
+        reports: {},
+        regions: { required: [...(opts.requiredRegions ?? [])], provided: {} },
         islands: {},
         sections: {},
         contentTypes: {},
@@ -35,27 +87,81 @@ export function compose(modules, opts = {}) {
         assets: {},
         styles: [],
         routes: {},
+        routePrefixes: {},
         patches: [],
         messages: {},
     };
+    for (const m of order) {
+        for (const raw of m.reserves ?? []) {
+            const prefix = raw.trim();
+            if (!prefix.startsWith('/') || !prefix.endsWith('/') || prefix.includes('{')) {
+                diag.add({
+                    code: 'E_ROUTE_PREFIX',
+                    module: m.name,
+                    message: `"${m.name}" reserves invalid route prefix "${raw}"`,
+                    hint: 'a reserved prefix is an absolute static path ending in /',
+                });
+                continue;
+            }
+            const conflict = Object.entries(manifest.routePrefixes).find(([other]) => prefix.startsWith(other) || other.startsWith(prefix));
+            if (conflict) {
+                diag.add({
+                    code: 'E_ROUTE_PREFIX_CLASH',
+                    module: m.name,
+                    message: `"${m.name}" and "${conflict[1]}" reserve overlapping prefixes "${prefix}" and "${conflict[0]}"`,
+                    hint: 'one module must own the whole public namespace',
+                });
+                continue;
+            }
+            manifest.routePrefixes[prefix] = m.name;
+        }
+    }
+    const major = (version) => {
+        const match = /^(?:\^)?(\d+)(?:\.|$)/.exec(version.trim());
+        return match ? Number(match[1]) : null;
+    };
+    for (const m of order) {
+        for (const [dependency, range] of Object.entries(m.compatible ?? {})) {
+            if (!m.depends.includes(dependency)) {
+                diag.add({
+                    code: 'E_MODULE_COMPATIBILITY_DEPENDENCY',
+                    module: m.name,
+                    message: `"${m.name}" declares compatibility with "${dependency}" without depending on it`,
+                    hint: `add "${dependency}" to depends`,
+                });
+                continue;
+            }
+            const actual = order.find((candidate) => candidate.name === dependency)?.version;
+            const wantedMajor = major(range);
+            const actualMajor = actual ? major(actual) : null;
+            const matches = range.startsWith('^')
+                ? wantedMajor != null && actualMajor === wantedMajor
+                : actual === range;
+            if (!matches) {
+                diag.add({
+                    code: 'E_MODULE_VERSION_SKEW',
+                    module: m.name,
+                    message: `"${m.name}" requires "${dependency}" ${range}, but the deployment has ${actual ?? 'nothing'}`,
+                    hint: 'upgrade the extension and its contract owner together',
+                });
+            }
+        }
+    }
     for (const m of order) {
         manifest.modules[m.name] = {
             version: m.version,
             kind: m.kind,
             depends: [...m.depends],
-            app: m.app,
             title: m.title,
             summary: m.summary,
             category: m.category,
-            install: m.install ?? 'manual',
-            removable: m.removable !== false,
         };
     }
     // --- the served surface -------------------------------------------------
     //
     // Assets, stylesheets and routes are composed for the same reason models are:
-    // otherwise the app hand-assembles them, which means knowing another module's
-    // file layout and going on serving it after that module is switched off.
+    // otherwise the deployment hand-assembles them, which means knowing another module's
+    // file layout and going on serving it after that module leaves the composition.
     //
     // `order` is dependency order, so a module that extends another contributes its
     // stylesheet after it and can override it. That ordering is the point.
@@ -93,6 +199,21 @@ export function compose(modules, opts = {}) {
                 });
                 continue;
             }
+            const reservation = Object.entries(manifest.routePrefixes).find(([prefix]) => path.startsWith(prefix));
+            if (reservation) {
+                const [prefix, owner] = reservation;
+                const contribution = typeof make === 'function' ? null : make.through;
+                const allowed = m.name === owner || (contribution === owner && m.depends.includes(owner));
+                if (!allowed) {
+                    diag.add({
+                        code: 'E_ROUTE_RESERVED',
+                        module: m.name,
+                        message: `"${m.name}" claims "${path}", inside the prefix reserved by "${owner}"`,
+                        hint: `depend on "${owner}" and use its published route factory for "${prefix}"`,
+                    });
+                    continue;
+                }
+            }
             const taken = manifest.routes[path];
             if (taken) {
                 diag.add({
@@ -117,13 +238,33 @@ export function compose(modules, opts = {}) {
             manifest.routes[path] =
                 typeof make === 'function'
                     ? { by: m.name, anonymous: false, make }
-                    : { by: m.name, anonymous: make.anonymous === true, make: make.handler };
+                    : {
+                        by: m.name,
+                        anonymous: make.anonymous === true,
+                        ...(make.through ? { through: make.through } : {}),
+                        ...(make.contract ? { contract: make.contract } : {}),
+                        make: make.handler,
+                    };
         }
     }
     // --- models -------------------------------------------------------------
+    const physicalTables = new Map();
     for (const m of order) {
         for (const [modelName, def] of Object.entries(m.models)) {
             const key = qualify(m.name, modelName);
+            const physicalTable = tableNameFor(key);
+            const existingPhysicalModel = physicalTables.get(physicalTable);
+            if (existingPhysicalModel && existingPhysicalModel !== key) {
+                diag.add({
+                    code: 'E_TABLE_NAME_COLLISION',
+                    module: m.name,
+                    message: `models "${existingPhysicalModel}" and "${key}" both map to table "${physicalTable}"`,
+                    hint: 'rename one model or module so every composed model has a unique physical table',
+                });
+            }
+            else {
+                physicalTables.set(physicalTable, key);
+            }
             if (manifest.models[key]) {
                 diag.add({
                     code: 'E_MODEL_DUPLICATE',
@@ -162,7 +303,7 @@ export function compose(modules, opts = {}) {
                 fields['createdAt'] = { base: 'datetime', optional: true, by: '(timestamps)' };
                 fields['updatedAt'] = { base: 'datetime', optional: true, by: '(timestamps)' };
             }
-            for (const [fname, tspec] of Object.entries(def.fields ?? {})) {
+            for (const [fname, declared] of Object.entries(def.fields ?? {})) {
                 if (def.timestamps && (fname === 'createdAt' || fname === 'updatedAt')) {
                     diag.add({
                         code: 'E_TIMESTAMP_FIELD_RESERVED',
@@ -172,6 +313,14 @@ export function compose(modules, opts = {}) {
                     });
                     continue;
                 }
+                // A field is a type string, or an object when it has more to say. The two
+                // forms compose to the same thing, so nothing downstream learns the difference.
+                const spec = normalizeField(declared);
+                if (!spec.ok) {
+                    diag.add({ code: spec.code, module: m.name, message: `${key}.${fname}: ${spec.reason}` });
+                    continue;
+                }
+                const tspec = spec.type;
                 const t = parseType(tspec);
                 if (!t.ok) {
                     diag.add({ code: 'E_BAD_TYPE', module: m.name, message: `${key}.${fname}: ${t.reason}` });
@@ -186,7 +335,14 @@ export function compose(modules, opts = {}) {
                     });
                     continue;
                 }
-                fields[fname] = { base: t.base, optional: t.optional, target: t.target, by: m.name };
+                fields[fname] = {
+                    base: t.base,
+                    optional: t.optional,
+                    target: t.target,
+                    by: m.name,
+                    ...(spec.personal ? { personal: true } : {}),
+                    ...(spec.sensitive ? { sensitive: true } : {}),
+                };
             }
             const indexes = {};
             for (const [indexName, index] of Object.entries(def.indexes ?? {})) {
@@ -225,6 +381,7 @@ export function compose(modules, opts = {}) {
                 owner: m.name,
                 scope: def.scope,
                 timestamps: def.timestamps === true,
+                append: def.append === true,
                 fields,
                 indexes,
             };
@@ -252,7 +409,7 @@ export function compose(modules, opts = {}) {
                 });
                 continue;
             }
-            for (const [fname, tspec] of Object.entries(addl)) {
+            for (const [fname, declared] of Object.entries(addl)) {
                 // Checked ahead of the collision below so the message names the real cause:
                 // these columns are the isolation boundary, not a name somebody took first.
                 if (fname === 'companyId' || fname === 'branchId') {
@@ -274,6 +431,15 @@ export function compose(modules, opts = {}) {
                     });
                     continue;
                 }
+                // Extension takes both field forms too. A bridge is exactly the module that
+                // adds a phone number to somebody else's partner, so it is exactly the module
+                // that has to be able to say the column is personal data.
+                const spec = normalizeField(declared);
+                if (!spec.ok) {
+                    diag.add({ code: spec.code, module: m.name, message: `${target}.${fname}: ${spec.reason}` });
+                    continue;
+                }
+                const tspec = spec.type;
                 const t = parseType(tspec);
                 if (!t.ok) {
                     diag.add({ code: 'E_BAD_TYPE', module: m.name, message: `${target}.${fname}: ${t.reason}` });
@@ -290,7 +456,14 @@ export function compose(modules, opts = {}) {
                     });
                     continue;
                 }
-                model.fields[fname] = { base: t.base, optional: t.optional, target: t.target, by: m.name };
+                model.fields[fname] = {
+                    base: t.base,
+                    optional: t.optional,
+                    target: t.target,
+                    by: m.name,
+                    ...(spec.personal ? { personal: true } : {}),
+                    ...(spec.sensitive ? { sensitive: true } : {}),
+                };
             }
         }
     }
@@ -436,7 +609,7 @@ export function compose(modules, opts = {}) {
                 diag.add({
                     code: 'E_FILL_UNKNOWN_JOINT',
                     module: m.name,
-                    message: `fills joint "${key}", which no installed module publishes`,
+                    message: `fills joint "${key}", which no composed module publishes`,
                     hint: near.length
                         ? `did you mean "${near[0]}"?`
                         : `published joints: ${Object.keys(manifest.joints).join(', ') || '(none)'}`,
@@ -477,7 +650,7 @@ export function compose(modules, opts = {}) {
                 diag.add({
                     code: 'E_OMIT_UNKNOWN_JOINT',
                     module: m.name,
-                    message: `omits joint "${key}", which no installed module publishes`,
+                    message: `omits joint "${key}", which no composed module publishes`,
                     hint: `published joints: ${Object.keys(manifest.joints).join(', ') || '(none)'}`,
                 });
                 continue;
@@ -544,6 +717,55 @@ export function compose(modules, opts = {}) {
             };
         }
     }
+    manifest.permissions = compilePermissionBundles(order, manifest, {
+        requireCoverage: opts.requirePermissionCoverage,
+        roleTemplates: opts.roleTemplates,
+        moduleDeclarations: opts.modulePermissionDeclarations,
+    });
+    // --- printable reports ---------------------------------------------------
+    for (const m of order) {
+        for (const [name, def] of Object.entries(m.reports ?? {})) {
+            const id = qualify(m.name, name);
+            if (!/^[a-z][a-zA-Z0-9_]*$/.test(name)) {
+                diag.add({ code: 'E_REPORT_NAME', module: m.name, message: `invalid report name "${name}"` });
+                continue;
+            }
+            if (!manifest.models[def.target]) {
+                diag.add({
+                    code: 'E_REPORT_UNKNOWN_MODEL',
+                    module: m.name,
+                    message: `report "${id}" targets unknown model "${def.target}"`,
+                });
+                continue;
+            }
+            const source = manifest.functions[def.source];
+            if (!source) {
+                diag.add({
+                    code: 'E_REPORT_UNKNOWN_SOURCE',
+                    module: m.name,
+                    message: `report "${id}" uses unknown function "${def.source}"`,
+                });
+                continue;
+            }
+            if (source.effects.some((effect) => effect.startsWith('write:') || effect.startsWith('enqueue:'))) {
+                diag.add({
+                    code: 'E_REPORT_SOURCE_WRITES',
+                    module: m.name,
+                    message: `report "${id}" source "${def.source}" is not read-only`,
+                });
+                continue;
+            }
+            if (!def.template.trim()) {
+                diag.add({
+                    code: 'E_REPORT_TEMPLATE_EMPTY',
+                    module: m.name,
+                    message: `report "${id}" has no template`,
+                });
+                continue;
+            }
+            manifest.reports[id] = { ...def, by: m.name, id };
+        }
+    }
     // --- background jobs -----------------------------------------------------
     //
     // Jobs run later and often on another process, but they touch the same data.
@@ -590,6 +812,37 @@ export function compose(modules, opts = {}) {
                 if (!parsed.ok)
                     diag.add({ code: 'E_BAD_TYPE', module: m.name, message: `${key} input ${input}: ${parsed.reason}` });
             }
+            if (def.schedule) {
+                try {
+                    validateSchedule(def.schedule);
+                }
+                catch (error) {
+                    diag.add({
+                        code: 'E_BAD_SCHEDULE',
+                        module: m.name,
+                        message: `job "${key}": ${error.message}`,
+                        hint: error.hint ?? null,
+                    });
+                    continue;
+                }
+                // Nobody is there to supply arguments to a schedule, so a required input is
+                // a job that can only ever fail validation at three in the morning.
+                const required = Object.entries(def.input ?? {})
+                    .filter(([, spec]) => {
+                    const parsed = parseType(spec);
+                    return parsed.ok && !parsed.optional;
+                })
+                    .map(([name]) => name);
+                if (required.length) {
+                    diag.add({
+                        code: 'E_SCHEDULED_JOB_INPUT',
+                        module: m.name,
+                        message: `scheduled job "${key}" requires input ${required.join(', ')}`,
+                        hint: 'a schedule enqueues no arguments — make them optional, or drop the schedule',
+                    });
+                    continue;
+                }
+            }
             for (const effect of def.effects ?? []) {
                 // Enqueue targets are validated after every job has been collected, so a
                 // producer may refer to a job contributed later in dependency order.
@@ -627,6 +880,7 @@ export function compose(modules, opts = {}) {
                 idempotent: true,
                 maxAttempts,
                 timeoutMs,
+                ...(def.schedule ? { schedule: def.schedule } : {}),
             };
         }
     }
@@ -934,7 +1188,7 @@ export function compose(modules, opts = {}) {
                 });
         }
     }
-    // --- theme <-> app region contract ---------------------------------------
+    // --- theme <-> deployment region contract --------------------------------
     for (const m of order) {
         for (const r of m.provides)
             (manifest.regions.provided[r] ??= []).push(m.name);
@@ -947,7 +1201,7 @@ export function compose(modules, opts = {}) {
             if (!manifest.regions.required.includes(r))
                 manifest.regions.required.push(r);
     }
-    // A headless app renders nothing, so the region contract does not apply to it.
+    // A headless deployment renders nothing, so the region contract does not apply to it.
     // Requirements are still recorded, so adding a theme later checks them.
     for (const r of opts.headless ? [] : manifest.regions.required) {
         if (!manifest.regions.provided[r]) {