@mnstry/atelier 0.2.0-alpha.13 → 0.2.0-alpha.15

package/src/extensions/postgres.mjs

@@ -0,0 +1,66 @@
+import { ExtensionError } from './contracts.mjs'
+import { assertVerifiedScope, digest } from './server.mjs'
+
+import { assertApplicationRole, boundedSqlResult, assertSqlOperationId } from './sql-scope.mjs'
+
+// The callback receives the provider's native transaction, retaining its query APIs.
+export async function withPostgresScope(database, scope, run) {
+  assertVerifiedScope(scope)
+  return database.begin(async sql => {
+    assertVerifiedScope(scope)
+    await assertApplicationRole(sql)
+    await sql`SELECT set_config('extension.installation_id', ${scope.installationId}, true),
+      set_config('extension.tenant_ref', ${scope.tenantRef}, true), set_config('extension.subject_ref', ${scope.subjectRef}, true),
+      set_config('statement_timeout', '10000', true), set_config('lock_timeout', '10000', true),
+      set_config('idle_in_transaction_session_timeout', '10000', true)`
+    assertVerifiedScope(scope)
+    const result = await run(sql)
+    // An expired handler cannot commit delayed work under a captured effect scope.
+    assertVerifiedScope(scope)
+    return result
+  })
+}
+export async function oncePostgresOperation(database, scope, input, run) {
+  assertVerifiedScope(scope)
+  if (digest(input) !== scope.payloadDigest) throw new ExtensionError('invalid-input')
+  return withPostgresScope(database, scope, async sql => {
+    await sql`INSERT INTO extension_data.operations
+      (installation_id,tenant_ref,subject_ref,operation_id,action_id,generation,release_digest,payload_digest)
+      VALUES (${scope.installationId},${scope.tenantRef},${scope.subjectRef},${scope.operationId},${scope.actionId},
+        ${scope.generation},${scope.releaseDigest},${scope.payloadDigest}) ON CONFLICT DO NOTHING`
+    const [row] = await sql`SELECT action_id,generation::text,release_digest,payload_digest,completed,result
+      FROM extension_data.operations WHERE installation_id=${scope.installationId} AND tenant_ref=${scope.tenantRef}
+        AND subject_ref=${scope.subjectRef} AND operation_id=${scope.operationId} FOR UPDATE`
+    if (!row || row.action_id !== scope.actionId || row.generation !== scope.generation ||
+        row.release_digest !== scope.releaseDigest || row.payload_digest !== scope.payloadDigest) throw new ExtensionError('idempotency-conflict', 409)
+    if (row.completed) return row.result
+    const result = boundedSqlResult(await run(sql))
+    await sql`UPDATE extension_data.operations SET completed=true,result=${sql.json(result)}
+      WHERE installation_id=${scope.installationId} AND tenant_ref=${scope.tenantRef}
+        AND subject_ref=${scope.subjectRef} AND operation_id=${scope.operationId}`
+    return result
+  })
+}
+export async function lookupPostgresOperation(database, scope, operationId) {
+  assertVerifiedScope(scope)
+  assertSqlOperationId(operationId)
+  return withPostgresScope(database, scope, async sql => {
+    const [row] = await sql`SELECT operation_id,action_id,generation::text,release_digest,payload_digest,result
+      FROM extension_data.operations WHERE installation_id=${scope.installationId} AND tenant_ref=${scope.tenantRef}
+        AND subject_ref=${scope.subjectRef} AND operation_id=${operationId} AND completed=true`
+    return row ? { schema: 'mnstry.extension-provider-operation/v1', installationId: scope.installationId,
+      operationId: row.operation_id, actionId: row.action_id, generation: row.generation, releaseDigest: row.release_digest,
+      payloadDigest: row.payload_digest, result: row.result, resultDigest: digest(row.result) } : null
+  })
+}
+export async function postgresHealth(database) {
+  return database.begin(async sql => {
+    await sql`SELECT set_config('statement_timeout','10000',true),set_config('lock_timeout','10000',true)`
+    await assertApplicationRole(sql)
+    const [version] = await sql`SHOW server_version_num`
+    if (Math.floor(Number(version?.server_version_num) / 10000) !== 17) throw new ExtensionError('unavailable', 503)
+    await sql`SELECT installation_id,tenant_ref,subject_ref,operation_id,action_id,generation,
+      release_digest,payload_digest,completed,result FROM extension_data.operations LIMIT 0`
+    return { ready: true, profile: 'postgres-sql', postgresMajor: 17 }
+  })
+}

package/src/extensions/prisma.d.mts

@@ -0,0 +1,13 @@
+import type { Json, ProviderOperationProof } from './contracts.mjs'
+import type { VerifiedScope } from './server.mjs'
+export interface PrismaTransaction {
+  $queryRaw<T=unknown>(query: TemplateStringsArray, ...values: unknown[]): Promise<T>
+  $executeRaw(query: TemplateStringsArray, ...values: unknown[]): Promise<number>
+}
+export interface PrismaDatabase<Transaction extends PrismaTransaction> {
+  $transaction<T>(run:(transaction:Transaction)=>Promise<T>, options?: { maxWait?:number;timeout?:number }): Promise<T>
+}
+export function withPrismaScope<Transaction extends PrismaTransaction,T>(database:PrismaDatabase<Transaction>,scope:VerifiedScope,run:(transaction:Transaction)=>Promise<T>):Promise<T>
+export function oncePrismaOperation<Transaction extends PrismaTransaction>(database:PrismaDatabase<Transaction>,scope:VerifiedScope,input:Json,run:(transaction:Transaction)=>Promise<Json>):Promise<Json>
+export function lookupPrismaOperation<Transaction extends PrismaTransaction>(database:PrismaDatabase<Transaction>,scope:VerifiedScope,operationId:string):Promise<ProviderOperationProof|null>
+export function prismaHealth<Transaction extends PrismaTransaction>(database:PrismaDatabase<Transaction>):Promise<{ready:true;profile:'prisma-7-postgres';postgresMajor:17}>

package/src/extensions/prisma.mjs

@@ -0,0 +1,63 @@
+import { ExtensionError } from './contracts.mjs'
+import { assertVerifiedScope, digest } from './server.mjs'
+import { assertApplicationRole, boundedSqlResult, assertSqlOperationId } from './sql-scope.mjs'
+
+export async function withPrismaScope(database, scope, run) {
+  assertVerifiedScope(scope)
+  return database.$transaction(async tx => {
+    assertVerifiedScope(scope)
+    await assertApplicationRole(tx.$queryRaw.bind(tx))
+    await tx.$queryRaw`SELECT set_config('extension.installation_id',${scope.installationId},true),
+      set_config('extension.tenant_ref',${scope.tenantRef},true),set_config('extension.subject_ref',${scope.subjectRef},true),
+      set_config('statement_timeout','10000',true),set_config('lock_timeout','10000',true),
+      set_config('idle_in_transaction_session_timeout','10000',true)`
+    assertVerifiedScope(scope)
+    const result = await run(tx)
+    assertVerifiedScope(scope)
+    return result
+  }, { maxWait: 10000, timeout: 12000 })
+}
+export async function oncePrismaOperation(database, scope, input, run) {
+  assertVerifiedScope(scope)
+  if (digest(input) !== scope.payloadDigest) throw new ExtensionError('invalid-input')
+  return withPrismaScope(database, scope, async tx => {
+    await tx.$executeRaw`INSERT INTO extension_data.operations
+      (installation_id,tenant_ref,subject_ref,operation_id,action_id,generation,release_digest,payload_digest)
+      VALUES (${scope.installationId},${scope.tenantRef},${scope.subjectRef},${scope.operationId},${scope.actionId},
+        ${BigInt(scope.generation)},${scope.releaseDigest},${scope.payloadDigest}) ON CONFLICT DO NOTHING`
+    const [row] = await tx.$queryRaw`SELECT action_id,generation::text,release_digest,payload_digest,completed,result
+      FROM extension_data.operations WHERE installation_id=${scope.installationId} AND tenant_ref=${scope.tenantRef}
+      AND subject_ref=${scope.subjectRef} AND operation_id=${scope.operationId} FOR UPDATE`
+    if (!row || row.action_id !== scope.actionId || row.generation !== scope.generation ||
+      row.release_digest !== scope.releaseDigest || row.payload_digest !== scope.payloadDigest) throw new ExtensionError('idempotency-conflict',409)
+    if (row.completed) return row.result
+    const result = boundedSqlResult(await run(tx))
+    await tx.$executeRaw`UPDATE extension_data.operations SET completed=true,result=${JSON.stringify(result)}::jsonb
+      WHERE installation_id=${scope.installationId} AND tenant_ref=${scope.tenantRef}
+      AND subject_ref=${scope.subjectRef} AND operation_id=${scope.operationId}`
+    return result
+  })
+}
+export async function lookupPrismaOperation(database, scope, operationId) {
+  assertVerifiedScope(scope)
+  assertSqlOperationId(operationId)
+  return withPrismaScope(database, scope, async tx => {
+    const [row] = await tx.$queryRaw`SELECT operation_id,action_id,generation::text,release_digest,payload_digest,result
+      FROM extension_data.operations WHERE installation_id=${scope.installationId} AND tenant_ref=${scope.tenantRef}
+      AND subject_ref=${scope.subjectRef} AND operation_id=${operationId} AND completed=true`
+    return row ? { schema:'mnstry.extension-provider-operation/v1',installationId:scope.installationId,
+      operationId:row.operation_id,actionId:row.action_id,generation:row.generation,releaseDigest:row.release_digest,
+      payloadDigest:row.payload_digest,result:row.result,resultDigest:digest(row.result) } : null
+  })
+}
+export async function prismaHealth(database) {
+  return database.$transaction(async tx => {
+    await tx.$queryRaw`SELECT set_config('statement_timeout','10000',true),set_config('lock_timeout','10000',true)`
+    await assertApplicationRole(tx.$queryRaw.bind(tx))
+    const [row] = await tx.$queryRaw`SHOW server_version_num`
+    if (Math.floor(Number(row?.server_version_num)/10000)!==17) throw new ExtensionError('unavailable',503)
+    await tx.$queryRaw`SELECT installation_id,tenant_ref,subject_ref,operation_id,action_id,generation,
+      release_digest,payload_digest,completed,result FROM extension_data.operations LIMIT 0`
+    return { ready:true,profile:'prisma-7-postgres',postgresMajor:17 }
+  }, { maxWait:10000,timeout:12000 })
+}

package/src/extensions/project.mjs

@@ -0,0 +1,432 @@
+import { constants as fsConstants } from 'node:fs'
+import { createHash, randomUUID } from 'node:crypto'
+import { lstat, open, mkdir, readFile, readdir, realpath, rename, rm, writeFile } from 'node:fs/promises'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { canonicalJson, parseManifest, parseReleaseBundle } from './contracts.mjs'
+import { sqlProjectFiles } from './scaffold-sql.mjs'
+import { convexProjectFiles } from './scaffold-convex.mjs'
+import { releaseDigest } from './server.mjs'
+import { loadExtensionPacks, RESERVED_NAMESPACE_PATTERN } from '../extension-packs/loader.mjs'
+
+const hash = bytes => createHash('sha256').update(bytes).digest('hex')
+const manifestName = 'extension.manifest.json'
+const packName = 'atelier.extension-pack.json'
+const backend = `import type { Sql } from 'postgres'
+import { exact, ExtensionError, parseProviderOperationProof, type ExtensionManifest, type Json } from '@mnstry/atelier/extensions'
+import { createExtensionHandler, createRootAdmissionConsumer, defineAction, defineExtension, type VerifierOptions } from '@mnstry/atelier/extensions/server'
+import { lookupPostgresOperation, oncePostgresOperation, postgresHealth, withPostgresScope } from '@mnstry/atelier/extensions/postgres'
+
+function counter(value: unknown): { value: number } {
+  const input = exact(value, ['value'])
+  if (!Number.isSafeInteger(input.value) || Number(input.value) < 0 || Number(input.value) > 1000000) throw new ExtensionError('invalid-input')
+  return { value: Number(input.value) }
+}
+const empty = (value: unknown) => { exact(value, []); return {} }
+const json = (value: unknown) => value as Json
+/** The consuming host owns process startup, verified public keys, deployment and secrets. */
+export function createBackend(options: { database: Sql; manifest: ExtensionManifest; rootOrigin: string;
+  verifier: Omit<VerifierOptions, 'consume'>; allowLocalTesting?: boolean }) {
+  const database = options.database
+  const extension = defineExtension({ manifest: options.manifest,
+    verifier: { ...options.verifier, consume: createRootAdmissionConsumer({ origin: options.rootOrigin, allowLocalTesting: options.allowLocalTesting }) },
+    actions: {
+      'counter.set': defineAction({ input: counter, output: counter, run: ({ scope }, input) => oncePostgresOperation(database, scope, input, async sql => {
+        await sql\`INSERT INTO extension_data.counters (installation_id,tenant_ref,subject_ref,value)
+          VALUES (\${scope.installationId},\${scope.tenantRef},\${scope.subjectRef},\${input.value})
+          ON CONFLICT (installation_id,tenant_ref,subject_ref) DO UPDATE SET value=excluded.value\`
+        return input
+      }) }),
+      'counter.get': defineAction({ input: empty, output: counter, run: ({ scope }) => withPostgresScope(database, scope, async sql => {
+        const [row] = await sql\`SELECT value FROM extension_data.counters WHERE installation_id=\${scope.installationId}
+          AND tenant_ref=\${scope.tenantRef} AND subject_ref=\${scope.subjectRef}\`
+        return { value: row?.value ?? 0 }
+      }) }),
+      'counter.export': defineAction({ input: empty, output: json, run: ({ scope }) => withPostgresScope(database, scope, async sql => {
+        const [row] = await sql\`SELECT value FROM extension_data.counters WHERE installation_id=\${scope.installationId}
+          AND tenant_ref=\${scope.tenantRef} AND subject_ref=\${scope.subjectRef}\`
+        return { schema: 'sample.counter-export/v1', value: row?.value ?? 0 }
+      }) }),
+      'counter.delete': defineAction({ input: empty, output: json, run: ({ scope }, input) => oncePostgresOperation(database, scope, input, async sql => {
+        const rows = await sql\`DELETE FROM extension_data.counters WHERE installation_id=\${scope.installationId}
+          AND tenant_ref=\${scope.tenantRef} AND subject_ref=\${scope.subjectRef} RETURNING value\`
+        await sql\`DELETE FROM extension_data.operations WHERE installation_id=\${scope.installationId}
+          AND tenant_ref=\${scope.tenantRef} AND subject_ref=\${scope.subjectRef} AND operation_id<>\${scope.operationId}\`
+        return { deleted: rows.length, retention: 'provider-live-rows-deleted', backups: 'operator-policy' }
+      }) }),
+      'counter.lookup': defineAction({ input: value => { const input = exact(value, ['operationId']);
+        if (typeof input.operationId !== 'string' || !/^[A-Za-z0-9_-]{16,128}$/.test(input.operationId)) throw new ExtensionError('invalid-input')
+        return { operationId: input.operationId } }, output: value => value === null ? null : parseProviderOperationProof(value),
+        run: ({ scope }, input) => lookupPostgresOperation(database, scope, input.operationId) }),
+    },
+  })
+  return { handler: createExtensionHandler(extension), health: () => postgresHealth(database) }
+}
+`
+const migration = `-- Apply only to the customer-owned extension database with a separate migration role.
+-- Create extension_app LOGIN and its secret outside this file. Never use a root runtime DSN.
+CREATE SCHEMA extension_data;
+REVOKE ALL ON SCHEMA extension_data FROM PUBLIC;
+CREATE TABLE extension_data.counters (
+  installation_id text NOT NULL, tenant_ref text NOT NULL, subject_ref text NOT NULL,
+  value integer NOT NULL CHECK(value BETWEEN 0 AND 1000000),
+  PRIMARY KEY(installation_id,tenant_ref,subject_ref)
+);
+CREATE TABLE extension_data.operations (
+  installation_id text NOT NULL, tenant_ref text NOT NULL, subject_ref text NOT NULL,
+  operation_id text NOT NULL, action_id text NOT NULL, generation bigint NOT NULL CHECK(generation>0),
+  release_digest text NOT NULL CHECK(release_digest ~ '^[a-f0-9]{64}$'),
+  payload_digest text NOT NULL CHECK(payload_digest ~ '^[a-f0-9]{64}$'),
+  completed boolean NOT NULL DEFAULT false, result jsonb,
+  PRIMARY KEY(installation_id,tenant_ref,subject_ref,operation_id)
+);
+ALTER TABLE extension_data.counters ENABLE ROW LEVEL SECURITY;
+ALTER TABLE extension_data.counters FORCE ROW LEVEL SECURITY;
+ALTER TABLE extension_data.operations ENABLE ROW LEVEL SECURITY;
+ALTER TABLE extension_data.operations FORCE ROW LEVEL SECURITY;
+CREATE POLICY counter_scope ON extension_data.counters TO extension_app
+  USING(installation_id=current_setting('extension.installation_id',true) AND tenant_ref=current_setting('extension.tenant_ref',true)
+    AND subject_ref=current_setting('extension.subject_ref',true))
+  WITH CHECK(installation_id=current_setting('extension.installation_id',true) AND tenant_ref=current_setting('extension.tenant_ref',true)
+    AND subject_ref=current_setting('extension.subject_ref',true));
+CREATE POLICY operation_scope ON extension_data.operations TO extension_app
+  USING(installation_id=current_setting('extension.installation_id',true) AND tenant_ref=current_setting('extension.tenant_ref',true)
+    AND subject_ref=current_setting('extension.subject_ref',true))
+  WITH CHECK(installation_id=current_setting('extension.installation_id',true) AND tenant_ref=current_setting('extension.tenant_ref',true)
+    AND subject_ref=current_setting('extension.subject_ref',true));
+REVOKE ALL ON ALL TABLES IN SCHEMA extension_data FROM PUBLIC;
+GRANT USAGE ON SCHEMA extension_data TO extension_app;
+GRANT SELECT,INSERT,UPDATE,DELETE ON ALL TABLES IN SCHEMA extension_data TO extension_app;
+`
+const schema = (properties, required = Object.keys(properties)) => ({ type: 'object', additionalProperties: false, properties, required })
+const counterSchema = schema({ value: { type: 'integer', minimum: 0, maximum: 1000000 } })
+const readme = `# Custom counter extension
+
+This project owns its custom data. Atelier generated files only; no account, database,
+process, listener, deployment or root installation was created.
+
+1. Install the SDK and run npm run typecheck. Keep the generated lockfile.
+   The candidate SDK 0.2.0-alpha.15 is unpublished. Until its release, run
+   npm pack --ignore-scripts in the reviewed Atelier checkout and install its
+   resulting tarball here with npm install /absolute/path/to/mnstry-atelier-0.2.0-alpha.15.tgz.
+   After reviewing that dependency edit, run atelier extension seal --directory .
+   Once the pinned SDK version is published, ordinary npm install can resolve it.
+2. Select a customer-owned PostgreSQL 17 database. Create a restricted extension_app
+   login and apply migrations/001-initial.sql with a separate migration role.
+   Keep its DSN in your backend secret store. Do not use the root runtime database.
+3. Call createBackend from src/backend.ts in your own host. Supply the pinned manifest,
+   verified root public keys and installation binding. Mount handler and health using
+   your host's lifecycle. This generated module never starts a server.
+4. Register the endpoint through your studio's supported connection workflow. Use the
+   authenticated admin SDK to configure, verify and enable its exact release. Installation
+   does not grant member consent or paid-product access.
+5. Supply your supported host's authenticated fetch to createHttpHostTransport. Invoke
+   counter.set/get/export/delete with the installation generation and release digest.
+   Record a result only after the member permits that separate root action.
+6. When a reply is lost, use lookupOperation/recoverOperation. Never automatically
+   replay the write or refresh a stale generation. Disable before upgrading; verify
+   the new release before enabling it. Retain-data removal and explicit deletion differ.
+
+Atelier keeps this component under the existing non-executing extension-pack system.
+Declare atelier.extension-pack.json in your project's existing
+ext["mnstry.atelier"].extensionPacks, then use the normal pack validation and lock
+adoption workflow. Its pack identity matches the extension ID. The pack's runtime
+manifest reference is a digest-bound projection; loading it never runs the backend
+or grants root access. Init does not edit another project's configuration or lock.
+Run atelier extension validate --directory . after edits. Run atelier extension seal
+--directory . to regenerate source/schema/release digests after reviewing those edits.
+Sealing records bytes; it does not establish trust, deployment, health or qualification.
+The sample deletes its live rows and earlier provider receipts; backup retention remains
+the operator's responsibility. Provider qualification and actual Web/native acceptance
+are separate from scaffolding. Drizzle and Prisma have native project profiles. The native Convex starter has separate provider and host qualification requirements.
+`
+async function scaffoldProject({ directory, extensionId = 'sample.counter', profile = 'postgres-sql' }) {
+  if(!['postgres-sql','drizzle-db-first','drizzle-code-first','prisma-7-postgres','convex-native'].includes(profile))throw new Error('unsupported profile')
+  if (extensionId.length > 128 || !/^[a-z][a-z0-9-]*\.[a-z][a-z0-9-]*$/.test(extensionId) || RESERVED_NAMESPACE_PATTERN.test(extensionId.split('.')[0])) throw new Error('invalid extension id')
+  const target = path.resolve(directory)
+  await mkdir(target) // Exclusive reservation: an existing directory is never adopted or overwritten.
+  const identity = await lstat(target)
+  try {
+    const packageRoot = fileURLToPath(new URL('../..', import.meta.url))
+    const kit = JSON.parse(await readFile(path.join(packageRoot, 'package.json'), 'utf8'))
+    const files = {
+      'package.json': JSON.stringify({ name: extensionId, version: '1.0.0', private: true, type: 'module',
+        files: ['src','tsconfig.json'], scripts: { typecheck: 'tsc --noEmit' }, dependencies: { '@mnstry/atelier': kit.version, postgres: '3.4.7' },
+        devDependencies: { typescript: '5.8.3', '@types/node': '22.18.0' }, engines: { node: '>=22.18.0 <23' } }, null, 2) + '\n',
+      'tsconfig.json': JSON.stringify({ compilerOptions: { strict: true, target: 'ES2022', module: 'NodeNext', moduleResolution: 'NodeNext', noEmit: true, skipLibCheck: true }, include: ['src/**/*.ts'] }, null, 2) + '\n',
+      'src/backend.ts': backend, 'migrations/001-initial.sql': migration, 'README.md': readme,
+      '.gitignore': 'node_modules/\n.env\n.env.*\n!env.example\n', 'env.example': '# Backend secret reference only; do not commit credentials.\nEXTENSION_DATABASE_URL=\n',
+    }
+    if(profile!=='postgres-sql' && profile!=='convex-native') {
+      const provider=sqlProjectFiles(profile,backend,migration)
+      Object.assign(files,provider.files)
+      const pkg=JSON.parse(files['package.json'])
+      delete pkg.dependencies.postgres
+      Object.assign(pkg.dependencies,provider.dependencies)
+      Object.assign(pkg.devDependencies,provider.devDependencies)
+      Object.assign(pkg.scripts,provider.scripts)
+      files['package.json']=JSON.stringify(pkg,null,2)+'\n'
+      files['README.md']=provider.instructions+'\n\n'+readme.replace('login and apply migrations/001-initial.sql with a separate migration role.','login and apply the reviewed native-profile migrations described above.')
+    }
+    if(profile==='convex-native') {
+      const provider=convexProjectFiles()
+      delete files['src/backend.ts']
+      delete files['migrations/001-initial.sql']
+      Object.assign(files,provider.files)
+      const pkg=JSON.parse(files['package.json'])
+      delete pkg.dependencies.postgres
+      Object.assign(pkg.dependencies,provider.dependencies)
+      pkg.files.push('convex','convex.json','migrations')
+      pkg.scripts.typecheck='tsc --noEmit && tsc --noEmit -p convex/tsconfig.json'
+      files['package.json']=JSON.stringify(pkg,null,2)+'\n'
+      files['.gitignore']+='convex/_generated/\n.convex/\n'
+      files['migrations/001-initial.json']=JSON.stringify({schemaVersion:'1',profile:'convex-native',strategy:'native-declarative-schema',backfill:'none'},null,2)+'\n'
+    }
+    const resultSchemas = {
+      set: counterSchema, get: counterSchema,
+      export: schema({ schema: { const: 'sample.counter-export/v1' }, value: counterSchema.properties.value }),
+      delete: schema({ deleted: { type: 'integer', minimum: 0, maximum: 1 }, retention: { const: 'provider-live-rows-deleted' }, backups: { const: 'operator-policy' } }),
+      lookup: { anyOf: [{ type: 'null' }, schema({ schema: { const: 'mnstry.extension-provider-operation/v1' },
+        installationId: { type: 'string', pattern: '^[A-Za-z0-9_-]{16,128}$' }, operationId: { type: 'string', pattern: '^[A-Za-z0-9_-]{16,128}$' },
+        actionId: { type: 'string' }, generation: { type: 'string', pattern: '^[1-9][0-9]{0,18}$' },
+        releaseDigest: { type: 'string', pattern: '^[a-f0-9]{64}$' }, payloadDigest: { type: 'string', pattern: '^[a-f0-9]{64}$' },
+        resultDigest: { type: 'string', pattern: '^[a-f0-9]{64}$' }, result: {} })] },
+    }
+    for (const action of ['set', 'get', 'export', 'delete', 'lookup']) {
+      const input = action === 'set' ? counterSchema : action === 'lookup' ? schema({ operationId: { type: 'string', pattern: '^[A-Za-z0-9_-]{16,128}$' } }) : schema({})
+      files[`schemas/counter-${action}-input.json`] = JSON.stringify(input, null, 2) + '\n'
+      files[`schemas/counter-${action}-output.json`] = JSON.stringify(resultSchemas[action], null, 2) + '\n'
+    }
+    for (const [relative, contents] of Object.entries(files)) {
+      const file = path.join(target, relative); await mkdir(path.dirname(file), { recursive: true }); await writeFile(file, contents, { flag: 'wx' })
+    }
+    const manifest = { schema: 'mnstry.extension-manifest/v1', extensionId, releaseVersion: '1.0.0', releaseDigest: '0'.repeat(64), protocol: 'mnstry.extension/v1',
+      compatibility: { sdkMajor: 1, rootContracts: ['extension.result.record/v1'], hosts: ['web'] },
+      deployment: { profile, bundleDigest: '0'.repeat(64), schemaDigest: '0'.repeat(64) },
+      actions: ['set', 'get', 'export', 'delete', 'lookup'].map(action => ({ id: `counter.${action}`,
+        effect: ['set', 'delete'].includes(action) ? 'write' : 'read', scope: 'member',
+        inputSchemaRef: `schemas/counter-${action}-input.json`, outputSchemaRef: `schemas/counter-${action}-output.json`, timeoutMs: 10000 })),
+      recovery: { lookupActionId: 'counter.lookup' }, permissions: { rootReads: [], rootWrites: ['extension.result.record/v1'], egress: [] }, surfaces: [],
+      data: { classes: ['sample.counter'], retention: 'until-user-delete', exportVersion: 1, schemaVersion: '1', readableSchemaVersions: ['1'] } }
+    const result = await sealProject(target, manifest)
+    return { directory: target, profile, releaseDigest: result.releaseDigest, qualified: false }
+  } catch (error) {
+    const current = await lstat(target).catch(() => null)
+    if (current?.isDirectory() && current.dev === identity.dev && current.ino === identity.ino) await rm(target, { recursive: true })
+    throw error
+  }
+}
+async function boundedSourceBytes(file,expected) {
+  if(!expected.isFile()||expected.size>1024*1024)throw new Error('extension source file exceeds 1 MiB or is not regular')
+  const handle=await open(file,fsConstants.O_RDONLY|(fsConstants.O_NOFOLLOW??0)|(fsConstants.O_NONBLOCK??0))
+  try {
+    const actual=await handle.stat({bigint:true})
+    if(!actual.isFile()||actual.dev!==expected.dev||actual.ino!==expected.ino)throw new Error('extension source changed while opening')
+    const chunks=[];let length=0
+    for(;;) {
+      const buffer=Buffer.alloc(64*1024)
+      const {bytesRead}=await handle.read(buffer,0,buffer.length,null)
+      if(bytesRead===0)break
+      length+=bytesRead
+      if(length>1024*1024)throw new Error('extension source file exceeds 1 MiB')
+      chunks.push(buffer.subarray(0,bytesRead))
+    }
+    return Buffer.concat(chunks,length)
+  } finally { await handle.close() }
+}
+async function projectFiles(root, subpath, collectBytes) {
+  const result = new Map()
+  const base = await realpath(root)
+  const identity = stat => `${stat.dev}:${stat.ino}`
+  const metadata = new Set()
+  for(const name of [manifestName,packName]) {
+    try { const stat=await lstat(path.join(base,name),{bigint:true}); if(stat.isFile())metadata.add(identity(stat)) }
+    catch(error) { if(error.code!=='ENOENT')throw error }
+  }
+  async function checked(parts) {
+    let file=base, stat
+    for(const part of parts) {
+      const folded=part.toLowerCase()
+      if(!part||/[\\/\u0000-\u001f\u007f]/u.test(part)||part==='.'||part==='..'||folded==='node_modules'||
+        (part.startsWith('.')&&!['.gitignore','.gitattributes'].includes(folded)))
+        throw new Error('extension source contains an unsupported hidden or dependency path or filename')
+      file=path.join(file,part);stat=await lstat(file,{bigint:true})
+      if(stat.isSymbolicLink())throw new Error('extension project symlinks are unsupported')
+    }
+    if(await realpath(file)!==file)throw new Error('extension source path is outside its literal project path or has different casing')
+    if(stat.isFile()&&metadata.has(identity(stat)))throw new Error('extension source cannot include generated identity files')
+    return {file,stat,key:parts.join('/')}
+  }
+  async function walk(parts) {
+    const {file,stat,key}=await checked(parts)
+    if(stat.isDirectory()) {
+      for(const entry of (await readdir(file)).sort())await walk([...parts,entry])
+    } else if(stat.isFile()) {
+      if(result.has(key))throw new Error('extension source inputs contain a duplicate path')
+      const bytes=await boundedSourceBytes(file,stat)
+      if(identity((await checked(parts)).stat)!==identity(stat))throw new Error('extension source changed while reading')
+      result.set(key,hash(bytes))
+      collectBytes?.(key,bytes)
+    } else throw new Error('extension project requires regular files')
+  }
+  for(const relative of subpath)await walk(relative.split('/'))
+  return Object.fromEntries(result)
+}
+async function bundleFiles(target) {
+  const paths=['package.json','tsconfig.json','src']
+  const packageFile=path.join(target,'package.json')
+  const packageStat=await lstat(packageFile,{bigint:true})
+  if(!packageStat.isFile()||packageStat.size>1024*1024)throw new Error('extension package must be a bounded regular file')
+  const pkg=JSON.parse((await boundedSourceBytes(packageFile,packageStat)).toString('utf8'))
+  if(pkg.files!==undefined){
+    if(!Array.isArray(pkg.files)||pkg.files.length>128)throw new Error('invalid extension source inputs')
+    for(const file of pkg.files){
+      if(typeof file!=='string'||!/^[A-Za-z0-9_.-]+(?:\/[A-Za-z0-9_.-]+)*$/.test(file)||
+        file.split('/').some(part=>part==='.'||part==='..'||part.startsWith('.'))||
+        [manifestName,packName].includes(file.toLowerCase())||file.split('/').some(part=>part.toLowerCase()==='node_modules'))
+        throw new Error('extension source inputs require literal project-relative paths')
+      paths.push(file)
+    }
+  }
+  for(const file of ['package-lock.json','npm-shrinkwrap.json','drizzle.config.ts','drizzle-introspect.config.ts','prisma.config.ts','prisma']) {
+    try { await lstat(path.join(target,file)); paths.push(file) }
+    catch(error) { if(error.code!=='ENOENT')throw error }
+  }
+  return projectFiles(target,[...new Set(paths)])
+}
+async function preflightPackSeal(target,manifest) {
+  const file=path.join(target,packName)
+  if(!(await lstat(file)).isFile())throw new Error('extension pack must be a regular file')
+  const original=await readFile(file,'utf8')
+  loadExtensionPacks(packProject(target,manifest),{verifyLock:false})
+  const preview=JSON.parse(original)
+  preview.ext ??= {}; preview.ext['mnstry.atelier'] ??= {}
+  preview.ext['mnstry.atelier'].runtimeManifest={schema:manifest.schema,path:manifestName,releaseDigest:manifest.releaseDigest,fileDigest:'0'.repeat(64)}
+  canonicalJson(preview)
+  return original
+}
+export async function sealProject(directory, initialManifest) {
+  const target = path.resolve(directory)
+  const manifestFile = path.join(target, manifestName)
+  if (!initialManifest && !(await lstat(manifestFile)).isFile()) throw new Error('extension manifest must be a regular file')
+  const originalManifest = initialManifest ? null : await readFile(manifestFile, 'utf8')
+  const manifest = parseManifest(initialManifest ?? JSON.parse(originalManifest))
+  const bundle = await bundleFiles(target)
+  const schemas = await projectFiles(target, ['schemas', 'migrations'])
+  manifest.deployment.bundleDigest = hash(canonicalJson(bundle)); manifest.deployment.schemaDigest = hash(canonicalJson(schemas))
+  manifest.releaseDigest = releaseDigest(manifest)
+  // Re-read before committing the digest; concurrent edits cannot produce a knowingly stale seal.
+  if (canonicalJson(bundle) !== canonicalJson(await bundleFiles(target)) ||
+      canonicalJson(schemas) !== canonicalJson(await projectFiles(target, ['schemas', 'migrations']))) throw new Error('extension changed during sealing')
+  const originalPack = initialManifest ? null : await preflightPackSeal(target,manifest)
+  const temporary = path.join(target, `.extension-seal-${randomUUID()}.json`)
+  try {
+    await writeFile(temporary, JSON.stringify(manifest, null, 2) + '\n', { flag: 'wx' })
+    if (initialManifest) {
+      // Creation keeps an exclusive manifest reservation as well.
+      await writeFile(manifestFile, await readFile(temporary), { flag: 'wx' })
+    } else {
+      if (!(await lstat(manifestFile)).isFile() || await readFile(manifestFile, 'utf8') !== originalManifest)
+        throw new Error('extension manifest changed during sealing')
+      if(await preflightPackSeal(target,manifest)!==originalPack)throw new Error('extension pack changed during sealing')
+      await rename(temporary, manifestFile)
+    }
+  } finally { await rm(temporary, { force: true }) }
+  await writePackProjection(target, manifest, Boolean(initialManifest))
+  return manifest
+}
+export async function validateProject(directory) {
+  const target = path.resolve(directory)
+  const manifestFile = path.join(target, manifestName)
+  if (!(await lstat(manifestFile)).isFile()) throw new Error('extension manifest must be a regular file')
+  const manifest = parseManifest(JSON.parse(await readFile(manifestFile, 'utf8')))
+  if (manifest.releaseDigest !== releaseDigest(manifest) || manifest.deployment.bundleDigest !== hash(canonicalJson(await bundleFiles(target))) ||
+      manifest.deployment.schemaDigest !== hash(canonicalJson(await projectFiles(target, ['schemas', 'migrations'])))) throw new Error('extension seal is stale')
+  for (const action of manifest.actions) {
+    for (const name of ['inputSchemaRef', 'outputSchemaRef']) JSON.parse(await readFile(path.join(target, action[name]), 'utf8'))
+  }
+  await validatePackProjection(target, manifest)
+  return { valid: true, profile: manifest.deployment.profile, extensionId: manifest.extensionId, releaseDigest: manifest.releaseDigest, qualified: false, packAdoption: 'pending' }
+}
+
+function packProject(target, manifest) {
+  return { configDir: target, config: { ext: { 'mnstry.atelier': { extensionPacks: [
+    { id: manifest.extensionId, version: 'v1', path: packName, enabled: true },
+  ] } } } }
+}
+async function runtimeReference(target, manifest) {
+  return { schema: manifest.schema, path: manifestName, releaseDigest: manifest.releaseDigest,
+    fileDigest: hash(await readFile(path.join(target,manifestName))) }
+}
+async function writePackProjection(target, manifest, initial) {
+  const file=path.join(target,packName)
+  let previous=null, pack
+  if (initial) {
+    pack={ schema:'mnstry-atelier-extension-pack@v1',id:manifest.extensionId,namespace:manifest.extensionId.split('.')[0],version:'v1',
+      terms:[],migrations:[],fixtures:[manifestName],lenses:[],readinessRules:[],actionRules:[],exportMappings:[] }
+  } else {
+    if (!(await lstat(file)).isFile()) throw new Error('extension pack must be a regular file')
+    previous=await readFile(file,'utf8'); pack=JSON.parse(previous)
+    loadExtensionPacks(packProject(target,manifest),{verifyLock:false})
+  }
+  pack.ext ??= {}; pack.ext['mnstry.atelier'] ??= {}
+  pack.ext['mnstry.atelier'].runtimeManifest=await runtimeReference(target,manifest)
+  const temporary=path.join(target,`.extension-pack-${randomUUID()}.json`)
+  try {
+    await writeFile(temporary,JSON.stringify(pack,null,2)+'\n',{flag:'wx'})
+    if(initial) await writeFile(file,await readFile(temporary),{flag:'wx'})
+    else {
+      if(!(await lstat(file)).isFile() || await readFile(file,'utf8')!==previous) throw new Error('extension pack changed during sealing')
+      await rename(temporary,file)
+    }
+  } finally { await rm(temporary,{force:true}) }
+  await validatePackProjection(target,manifest)
+}
+async function validatePackProjection(target,manifest) {
+  const file=path.join(target,packName)
+  if(!(await lstat(file)).isFile()) throw new Error('extension pack must be a regular file')
+  const report=loadExtensionPacks(packProject(target,manifest),{verifyLock:false})
+  if(report.packs.length!==1) throw new Error('extension pack projection is invalid')
+  const pack=JSON.parse(await readFile(file,'utf8'))
+  if(canonicalJson(pack.ext?.['mnstry.atelier']?.runtimeManifest)!==canonicalJson(await runtimeReference(target,manifest)))
+    throw new Error('extension pack runtime reference is stale')
+}
+
+export function scaffoldPostgres(options) { return scaffoldSqlProject({...options,profile:'postgres-sql'}) }
+
+
+/** Export the exact sealed schema bytes and migration digests through the same
+ * checked file walk used by sealing. No new file inventory or host is created. */
+export async function exportReleaseBundle(directory) {
+  const target=await realpath(path.resolve(directory))
+  await validateProject(target)
+  const manifestFile=path.join(target,manifestName), stat=await lstat(manifestFile,{bigint:true})
+  const original=(await boundedSourceBytes(manifestFile,stat)).toString('utf8')
+  const manifest=parseManifest(JSON.parse(original)), schemaFiles=new Map()
+  let schemaBytes=0
+  const digests=await projectFiles(target,['schemas','migrations'],(name,bytes)=>{
+    if(!name.startsWith('schemas/'))return
+    schemaBytes+=bytes.length
+    if(bytes.length>65536||schemaBytes>131072)throw new Error('extension registration schema bundle is too large')
+    const decoded=new TextDecoder('utf-8',{fatal:true}).decode(bytes)
+    // Fatal decoding rejects invalid UTF-8; round-trip equality also refuses
+    // normalization such as BOM removal before exact sealed bytes are exported.
+    if(!Buffer.from(decoded,'utf8').equals(bytes))throw new Error('extension schema encoding changes sealed bytes')
+    schemaFiles.set(name,decoded)
+  })
+  if(manifest.releaseDigest!==releaseDigest(manifest)||manifest.deployment.schemaDigest!==hash(canonicalJson(digests))||
+    manifest.deployment.bundleDigest!==hash(canonicalJson(await bundleFiles(target))))throw new Error('extension seal is stale')
+  for(const [name,bytes] of schemaFiles)if(hash(Buffer.from(bytes,'utf8'))!==digests[name])throw new Error('extension schema export differs from sealed bytes')
+  const migrationDigests=new Map(Object.entries(digests).filter(([name])=>name.startsWith('migrations/')))
+  const result=parseReleaseBundle({manifest,schemaFiles:Object.fromEntries(schemaFiles),migrationDigests:Object.fromEntries(migrationDigests)})
+  if((await boundedSourceBytes(manifestFile,await lstat(manifestFile,{bigint:true}))).toString('utf8')!==original||
+    canonicalJson(digests)!==canonicalJson(await projectFiles(target,['schemas','migrations'])))throw new Error('extension changed during export')
+  await validatePackProjection(target,manifest)
+  return result
+}
+
+export function scaffoldSqlProject(options) {
+  if(options?.profile==='convex-native')return Promise.reject(new Error('unsupported SQL profile'))
+  return scaffoldProject(options)
+}
+export function scaffoldConvexProject(options) { return scaffoldProject({...options,profile:'convex-native'}) }