@segmentstream-cloud/ontology 0.6.0 → 0.7.0

package/dist/manifest.d.ts

@@ -1,4 +1,4 @@
-import { Schema } from "effect";
+import { Effect, Schema } from "effect";
 import type { ResolvedConnection, ResolvedEntity } from "./analyze.js";
 import type { Role } from "./role.js";
 import { type SignInOptions, type SignInPolicy } from "./sign-in.js";
@@ -9,7 +9,7 @@ import { type SignInOptions, type SignInPolicy } from "./sign-in.js";
  * `signIn` came later within version 2 and is optional too, as are the actions' `connections` and the
  * top-level `connections`, which are written only when an action calls a connection.
  */
-export declare const MANIFEST_VERSION = 3;
+export declare const MANIFEST_VERSION = 4;
 /** The phrase used for a direction the author did not phrase. */
 export declare const DEFAULT_PHRASE = "has";
 export declare const SelectOptionManifest: Schema.Struct<{
@@ -88,7 +88,7 @@ export type ActionManifest = typeof ActionManifest.Type;
 /**
  * The permissions of an entity's reads and generated actions, so that readers need not rebuild the
  * convention. The built-in user has only `read`; `link` and `unlink` exist with a `rel.many`. The
- * generated `upsertBy<Property>` requires both `create` and `update`.
+ * generated `upsert_by_<property>` requires both `create` and `update`.
  */
 export declare const EntityPermissionsManifest: Schema.Struct<{
     readonly read: Schema.String;
@@ -220,12 +220,270 @@ export declare const SignInManifest: Schema.Struct<{
     readonly policy: Schema.String;
 }>;
 export type SignInManifest = typeof SignInManifest.Type;
-/**
- * The ontology catalog: the contract between the SDK, backend-next, the console and the CLI. Decoding
- * ignores unknown fields and accepts any `version`. The closed sets (property types, cardinalities,
- * `onDelete`) are validated because the migration planner must map every value to storage.
- */
-export declare const OntologyManifest: Schema.Struct<{
+/** The JSON contract written by version 4; decoded SDK models remain camelCase. */
+export declare const OntologyManifestWire: Schema.encodeKeys<Schema.Struct<{
+    readonly entities: Schema.$Array<Schema.encodeKeys<Schema.Struct<{
+        readonly properties: Schema.$Array<Schema.encodeKeys<Schema.Struct<{
+            readonly column: Schema.optionalKey<Schema.String>;
+            readonly scope: Schema.optionalKey<Schema.$Array<Schema.String>>;
+            readonly name: Schema.String;
+            readonly type: Schema.Literals<readonly ["text", "email", "url", "integer", "number", "boolean", "date", "timestamp", "select", "json"]>;
+            readonly label: Schema.String;
+            readonly description: Schema.optionalKey<Schema.String>;
+            readonly optional: Schema.Boolean;
+            readonly unique: Schema.Boolean;
+            readonly managed: Schema.Boolean;
+            readonly default: Schema.optionalKey<Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+            readonly display: Schema.optionalKey<Schema.String>;
+            readonly renamedFrom: Schema.optionalKey<Schema.String>;
+            readonly min: Schema.optionalKey<Schema.Number>;
+            readonly max: Schema.optionalKey<Schema.Number>;
+            readonly maxLength: Schema.optionalKey<Schema.Number>;
+            readonly options: Schema.optionalKey<Schema.$Array<Schema.Struct<{
+                readonly value: Schema.String;
+                readonly label: Schema.String;
+                readonly description: Schema.String;
+            }>>>;
+        }>, {
+            readonly renamedFrom: "renamed_from";
+            readonly maxLength: "max_length";
+        }>>;
+        readonly relationships: Schema.$Array<Schema.encodeKeys<Schema.Struct<{
+            readonly on: Schema.optionalKey<Schema.encodeKeys<Schema.Struct<{
+                readonly property: Schema.String;
+                readonly targetProperty: Schema.String;
+            }>, {
+                readonly targetProperty: "target_property";
+            }>>;
+            readonly onDelete: Schema.optionalKey<Schema.decodeTo<Schema.Literals<readonly ["setNull", "cascade", "restrict"]>, Schema.Literals<readonly ["set_null", "cascade", "restrict"]>, never, never>>;
+            readonly name: Schema.String;
+            readonly to: Schema.String;
+            readonly inverse: Schema.String;
+            readonly cardinality: Schema.Literals<readonly ["one", "many"]>;
+            /** `rel.one` only. */
+            readonly optional: Schema.optionalKey<Schema.Boolean>;
+            /** `rel.many` only. */
+            readonly ordered: Schema.optionalKey<Schema.Boolean>;
+            /** Forward and inverse phrases; unphrased directions read "has". */
+            readonly phrase: Schema.Tuple<readonly [Schema.String, Schema.String]>;
+            readonly description: Schema.String;
+        }>, {
+            readonly onDelete: "on_delete";
+        }>>;
+        readonly source: Schema.optionalKey<Schema.Struct<{
+            readonly asset: Schema.String;
+            readonly key: Schema.$Array<Schema.String>;
+            readonly currency: Schema.optionalKey<Schema.String>;
+        }>>;
+        readonly measures: Schema.optionalKey<Schema.$Array<Schema.Struct<{
+            readonly name: Schema.String;
+            readonly label: Schema.String;
+            readonly description: Schema.String;
+            readonly unit: Schema.Literals<readonly ["number", "currency", "ratio", "percent"]>;
+            readonly format: Schema.Literals<readonly ["decimal", "currency", "percent"]>;
+            readonly expression: Schema.Codec<Schema.Json, Schema.Json, never, never>;
+        }>>>;
+        readonly id: Schema.String;
+        readonly name: Schema.String;
+        readonly label: Schema.String;
+        readonly plural: Schema.String;
+        readonly title: Schema.String;
+        readonly description: Schema.String;
+        readonly builtIn: Schema.Boolean;
+        readonly renamedFrom: Schema.optionalKey<Schema.String>;
+        readonly guide: Schema.optionalKey<Schema.String>;
+        readonly indexes: Schema.$Array<Schema.Struct<{
+            readonly properties: Schema.$Array<Schema.String>;
+            readonly unique: Schema.Boolean;
+        }>>;
+        readonly actions: Schema.$Array<Schema.Struct<{
+            readonly name: Schema.String;
+            readonly description: Schema.String;
+            /**
+             * The permission a principal needs to run the action, for example `lead:changeStatus`. Always
+             * written; absent from version 1 manifests, where it reads as `<entity>:<action name>`.
+             */
+            readonly permission: Schema.optionalKey<Schema.String>;
+            /** JSON Schema (draft 2020-12) of the input object. */
+            readonly input: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+            /**
+             * The keys of the workspace connections the action calls before its transaction. Written only
+             * when there are some; absent reads as none.
+             */
+            readonly connections: Schema.optionalKey<Schema.$Array<Schema.String>>;
+        }>>;
+        /** Always written; absent from version 1 manifests. */
+        readonly permissions: Schema.optionalKey<Schema.Struct<{
+            readonly read: Schema.String;
+            readonly create: Schema.optionalKey<Schema.String>;
+            readonly update: Schema.optionalKey<Schema.String>;
+            readonly delete: Schema.optionalKey<Schema.String>;
+            readonly link: Schema.optionalKey<Schema.String>;
+            readonly unlink: Schema.optionalKey<Schema.String>;
+        }>>;
+    }>, {
+        readonly builtIn: "built_in";
+        readonly renamedFrom: "renamed_from";
+    }>>;
+    readonly roles: Schema.$Array<Schema.encodeKeys<Schema.Struct<{
+        readonly name: Schema.String;
+        readonly description: Schema.String;
+        readonly builtIn: Schema.Boolean;
+        /**
+         * What the role may do, wildcards included; for the built-in `member`, what every active app user
+         * may do. Always written; absent from version 1 manifests.
+         */
+        readonly permissions: Schema.optionalKey<Schema.$Array<Schema.String>>;
+    }>, {
+        readonly builtIn: "built_in";
+    }>>;
+    readonly version: Schema.Int;
+    /** `sha256:` and the hex digest of the canonical JSON of the manifest without `hash`. */
+    readonly hash: Schema.String;
+    /** Always written; absent from manifests built before sign-in policies, which read as `invited`. */
+    readonly signIn: Schema.optionalKey<Schema.Struct<{
+        readonly policy: Schema.String;
+    }>>;
+    /** The connections the actions call. Written only when there are some; absent reads as none. */
+    readonly connections: Schema.optionalKey<Schema.$Array<Schema.Struct<{
+        readonly key: Schema.String;
+        readonly description: Schema.String;
+    }>>>;
+}>, {
+    readonly signIn: "sign_in";
+}>;
+/** Historical readers accept either metadata spelling and any manifest version. */
+export declare const OntologyManifest: Schema.Union<readonly [Schema.encodeKeys<Schema.Struct<{
+    readonly entities: Schema.$Array<Schema.encodeKeys<Schema.Struct<{
+        readonly properties: Schema.$Array<Schema.encodeKeys<Schema.Struct<{
+            readonly column: Schema.optionalKey<Schema.String>;
+            readonly scope: Schema.optionalKey<Schema.$Array<Schema.String>>;
+            readonly name: Schema.String;
+            readonly type: Schema.Literals<readonly ["text", "email", "url", "integer", "number", "boolean", "date", "timestamp", "select", "json"]>;
+            readonly label: Schema.String;
+            readonly description: Schema.optionalKey<Schema.String>;
+            readonly optional: Schema.Boolean;
+            readonly unique: Schema.Boolean;
+            readonly managed: Schema.Boolean;
+            readonly default: Schema.optionalKey<Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+            readonly display: Schema.optionalKey<Schema.String>;
+            readonly renamedFrom: Schema.optionalKey<Schema.String>;
+            readonly min: Schema.optionalKey<Schema.Number>;
+            readonly max: Schema.optionalKey<Schema.Number>;
+            readonly maxLength: Schema.optionalKey<Schema.Number>;
+            readonly options: Schema.optionalKey<Schema.$Array<Schema.Struct<{
+                readonly value: Schema.String;
+                readonly label: Schema.String;
+                readonly description: Schema.String;
+            }>>>;
+        }>, {
+            readonly renamedFrom: "renamed_from";
+            readonly maxLength: "max_length";
+        }>>;
+        readonly relationships: Schema.$Array<Schema.encodeKeys<Schema.Struct<{
+            readonly on: Schema.optionalKey<Schema.encodeKeys<Schema.Struct<{
+                readonly property: Schema.String;
+                readonly targetProperty: Schema.String;
+            }>, {
+                readonly targetProperty: "target_property";
+            }>>;
+            readonly onDelete: Schema.optionalKey<Schema.decodeTo<Schema.Literals<readonly ["setNull", "cascade", "restrict"]>, Schema.Literals<readonly ["set_null", "cascade", "restrict"]>, never, never>>;
+            readonly name: Schema.String;
+            readonly to: Schema.String;
+            readonly inverse: Schema.String;
+            readonly cardinality: Schema.Literals<readonly ["one", "many"]>;
+            /** `rel.one` only. */
+            readonly optional: Schema.optionalKey<Schema.Boolean>;
+            /** `rel.many` only. */
+            readonly ordered: Schema.optionalKey<Schema.Boolean>;
+            /** Forward and inverse phrases; unphrased directions read "has". */
+            readonly phrase: Schema.Tuple<readonly [Schema.String, Schema.String]>;
+            readonly description: Schema.String;
+        }>, {
+            readonly onDelete: "on_delete";
+        }>>;
+        readonly source: Schema.optionalKey<Schema.Struct<{
+            readonly asset: Schema.String;
+            readonly key: Schema.$Array<Schema.String>;
+            readonly currency: Schema.optionalKey<Schema.String>;
+        }>>;
+        readonly measures: Schema.optionalKey<Schema.$Array<Schema.Struct<{
+            readonly name: Schema.String;
+            readonly label: Schema.String;
+            readonly description: Schema.String;
+            readonly unit: Schema.Literals<readonly ["number", "currency", "ratio", "percent"]>;
+            readonly format: Schema.Literals<readonly ["decimal", "currency", "percent"]>;
+            readonly expression: Schema.Codec<Schema.Json, Schema.Json, never, never>;
+        }>>>;
+        readonly id: Schema.String;
+        readonly name: Schema.String;
+        readonly label: Schema.String;
+        readonly plural: Schema.String;
+        readonly title: Schema.String;
+        readonly description: Schema.String;
+        readonly builtIn: Schema.Boolean;
+        readonly renamedFrom: Schema.optionalKey<Schema.String>;
+        readonly guide: Schema.optionalKey<Schema.String>;
+        readonly indexes: Schema.$Array<Schema.Struct<{
+            readonly properties: Schema.$Array<Schema.String>;
+            readonly unique: Schema.Boolean;
+        }>>;
+        readonly actions: Schema.$Array<Schema.Struct<{
+            readonly name: Schema.String;
+            readonly description: Schema.String;
+            /**
+             * The permission a principal needs to run the action, for example `lead:changeStatus`. Always
+             * written; absent from version 1 manifests, where it reads as `<entity>:<action name>`.
+             */
+            readonly permission: Schema.optionalKey<Schema.String>;
+            /** JSON Schema (draft 2020-12) of the input object. */
+            readonly input: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+            /**
+             * The keys of the workspace connections the action calls before its transaction. Written only
+             * when there are some; absent reads as none.
+             */
+            readonly connections: Schema.optionalKey<Schema.$Array<Schema.String>>;
+        }>>;
+        /** Always written; absent from version 1 manifests. */
+        readonly permissions: Schema.optionalKey<Schema.Struct<{
+            readonly read: Schema.String;
+            readonly create: Schema.optionalKey<Schema.String>;
+            readonly update: Schema.optionalKey<Schema.String>;
+            readonly delete: Schema.optionalKey<Schema.String>;
+            readonly link: Schema.optionalKey<Schema.String>;
+            readonly unlink: Schema.optionalKey<Schema.String>;
+        }>>;
+    }>, {
+        readonly builtIn: "built_in";
+        readonly renamedFrom: "renamed_from";
+    }>>;
+    readonly roles: Schema.$Array<Schema.encodeKeys<Schema.Struct<{
+        readonly name: Schema.String;
+        readonly description: Schema.String;
+        readonly builtIn: Schema.Boolean;
+        /**
+         * What the role may do, wildcards included; for the built-in `member`, what every active app user
+         * may do. Always written; absent from version 1 manifests.
+         */
+        readonly permissions: Schema.optionalKey<Schema.$Array<Schema.String>>;
+    }>, {
+        readonly builtIn: "built_in";
+    }>>;
+    readonly version: Schema.Int;
+    /** `sha256:` and the hex digest of the canonical JSON of the manifest without `hash`. */
+    readonly hash: Schema.String;
+    /** Always written; absent from manifests built before sign-in policies, which read as `invited`. */
+    readonly signIn: Schema.optionalKey<Schema.Struct<{
+        readonly policy: Schema.String;
+    }>>;
+    /** The connections the actions call. Written only when there are some; absent reads as none. */
+    readonly connections: Schema.optionalKey<Schema.$Array<Schema.Struct<{
+        readonly key: Schema.String;
+        readonly description: Schema.String;
+    }>>>;
+}>, {
+    readonly signIn: "sign_in";
+}>, Schema.Struct<{
     readonly version: Schema.Int;
     /** `sha256:` and the hex digest of the canonical JSON of the manifest without `hash`. */
     readonly hash: Schema.String;
@@ -342,8 +600,208 @@ export declare const OntologyManifest: Schema.Struct<{
         readonly key: Schema.String;
         readonly description: Schema.String;
     }>>>;
-}>;
+}>]>;
 export type OntologyManifest = typeof OntologyManifest.Type;
+/** Retain the complete document when decoding a persisted or published manifest. */
+export declare const decodeManifestDocument: (value: unknown) => Effect.Effect<{
+    readonly entities: readonly {
+        readonly name: string;
+        readonly id: string;
+        readonly description: string;
+        readonly label: string;
+        readonly actions: readonly {
+            readonly name: string;
+            readonly description: string;
+            readonly input: {
+                readonly [x: string]: Schema.Json;
+            };
+            readonly permission?: string | undefined;
+            readonly connections?: readonly string[] | undefined;
+        }[];
+        readonly title: string;
+        readonly properties: readonly {
+            readonly optional: boolean;
+            readonly name: string;
+            readonly label: string;
+            readonly type: "number" | "boolean" | "text" | "integer" | "date" | "timestamp" | "select" | "email" | "url" | "json";
+            readonly unique: boolean;
+            readonly managed: boolean;
+            readonly column?: string | undefined;
+            readonly description?: string | undefined;
+            readonly default?: Schema.Json | undefined;
+            readonly scope?: readonly string[] | undefined;
+            readonly maxLength?: number | undefined;
+            readonly min?: number | undefined;
+            readonly max?: number | undefined;
+            readonly options?: readonly {
+                readonly value: string;
+                readonly label: string;
+                readonly description: string;
+            }[] | undefined;
+            readonly renamedFrom?: string | undefined;
+            readonly display?: string | undefined;
+        }[];
+        readonly relationships: readonly {
+            readonly name: string;
+            readonly description: string;
+            readonly phrase: readonly [string, string];
+            readonly cardinality: "one" | "many";
+            readonly to: string;
+            readonly inverse: string;
+            readonly optional?: boolean | undefined;
+            readonly on?: {
+                readonly property: string;
+                readonly targetProperty: string;
+            } | undefined;
+            readonly onDelete?: "setNull" | "cascade" | "restrict" | undefined;
+            readonly ordered?: boolean | undefined;
+        }[];
+        readonly indexes: readonly {
+            readonly properties: readonly string[];
+            readonly unique: boolean;
+        }[];
+        readonly plural: string;
+        readonly builtIn: boolean;
+        readonly source?: {
+            readonly key: readonly string[];
+            readonly asset: string;
+            readonly currency?: string | undefined;
+        } | undefined;
+        readonly measures?: readonly {
+            readonly name: string;
+            readonly label: string;
+            readonly description: string;
+            readonly unit: "number" | "currency" | "ratio" | "percent";
+            readonly format: "currency" | "percent" | "decimal";
+            readonly expression: Schema.Json;
+        }[] | undefined;
+        readonly renamedFrom?: string | undefined;
+        readonly guide?: string | undefined;
+        readonly permissions?: {
+            readonly read: string;
+            readonly create?: string | undefined;
+            readonly update?: string | undefined;
+            readonly delete?: string | undefined;
+            readonly link?: string | undefined;
+            readonly unlink?: string | undefined;
+        } | undefined;
+    }[];
+    readonly roles: readonly {
+        readonly name: string;
+        readonly description: string;
+        readonly builtIn: boolean;
+        readonly permissions?: readonly string[] | undefined;
+    }[];
+    readonly version: number;
+    readonly hash: string;
+    readonly connections?: readonly {
+        readonly key: string;
+        readonly description: string;
+    }[] | undefined;
+    readonly signIn?: {
+        readonly policy: string;
+    } | undefined;
+} | {
+    readonly entities: readonly {
+        readonly name: string;
+        readonly id: string;
+        readonly description: string;
+        readonly label: string;
+        readonly actions: readonly {
+            readonly name: string;
+            readonly description: string;
+            readonly input: {
+                readonly [x: string]: Schema.Json;
+            };
+            readonly permission?: string | undefined;
+            readonly connections?: readonly string[] | undefined;
+        }[];
+        readonly title: string;
+        readonly properties: readonly {
+            readonly optional: boolean;
+            readonly name: string;
+            readonly label: string;
+            readonly type: "number" | "boolean" | "text" | "integer" | "date" | "timestamp" | "select" | "email" | "url" | "json";
+            readonly unique: boolean;
+            readonly managed: boolean;
+            readonly column?: string | undefined;
+            readonly description?: string | undefined;
+            readonly default?: Schema.Json | undefined;
+            readonly scope?: readonly string[] | undefined;
+            readonly maxLength?: number | undefined;
+            readonly min?: number | undefined;
+            readonly max?: number | undefined;
+            readonly options?: readonly {
+                readonly value: string;
+                readonly label: string;
+                readonly description: string;
+            }[] | undefined;
+            readonly renamedFrom?: string | undefined;
+            readonly display?: string | undefined;
+        }[];
+        readonly relationships: readonly {
+            readonly name: string;
+            readonly description: string;
+            readonly phrase: readonly [string, string];
+            readonly cardinality: "one" | "many";
+            readonly to: string;
+            readonly inverse: string;
+            readonly optional?: boolean | undefined;
+            readonly on?: {
+                readonly property: string;
+                readonly targetProperty: string;
+            } | undefined;
+            readonly onDelete?: "setNull" | "cascade" | "restrict" | undefined;
+            readonly ordered?: boolean | undefined;
+        }[];
+        readonly indexes: readonly {
+            readonly properties: readonly string[];
+            readonly unique: boolean;
+        }[];
+        readonly plural: string;
+        readonly builtIn: boolean;
+        readonly source?: {
+            readonly key: readonly string[];
+            readonly asset: string;
+            readonly currency?: string | undefined;
+        } | undefined;
+        readonly measures?: readonly {
+            readonly name: string;
+            readonly label: string;
+            readonly description: string;
+            readonly unit: "number" | "currency" | "ratio" | "percent";
+            readonly format: "currency" | "percent" | "decimal";
+            readonly expression: Schema.Json;
+        }[] | undefined;
+        readonly renamedFrom?: string | undefined;
+        readonly guide?: string | undefined;
+        readonly permissions?: {
+            readonly read: string;
+            readonly create?: string | undefined;
+            readonly update?: string | undefined;
+            readonly delete?: string | undefined;
+            readonly link?: string | undefined;
+            readonly unlink?: string | undefined;
+        } | undefined;
+    }[];
+    readonly roles: readonly {
+        readonly name: string;
+        readonly description: string;
+        readonly builtIn: boolean;
+        readonly permissions?: readonly string[] | undefined;
+    }[];
+    readonly version: number;
+    readonly hash: string;
+    readonly connections?: readonly {
+        readonly key: string;
+        readonly description: string;
+    }[] | undefined;
+    readonly signIn?: {
+        readonly policy: string;
+    } | undefined;
+}, Schema.SchemaError, never>;
+/** Encode only ontology-owned metadata. JSON values and JSON Schema keywords remain opaque. */
+export declare function encodeManifest(manifest: OntologyManifest): Readonly<Record<string, unknown>>;
 /**
  * The sign-in policy a manifest declares. A manifest without one, or with a policy this reader does
  * not know, reads as `invited`: the closed choice, so that a misread never lets strangers in.

package/dist/manifest.js

@@ -1,6 +1,6 @@
 import { measureExpression } from "./measure.js";
 import { createHash } from "node:crypto";
-import { Schema } from "effect";
+import { Effect, Schema, SchemaTransformation } from "effect";
 import { humanize, MEMBER_ROLE } from "./names.js";
 import { PROPERTY_TYPES } from "./property.js";
 import { ON_DELETE } from "./relationship.js";
@@ -12,7 +12,7 @@ import { DEFAULT_SIGN_IN_POLICY, isSignInPolicy, } from "./sign-in.js";
  * `signIn` came later within version 2 and is optional too, as are the actions' `connections` and the
  * top-level `connections`, which are written only when an action calls a connection.
  */
-export const MANIFEST_VERSION = 3;
+export const MANIFEST_VERSION = 4;
 /** The phrase used for a direction the author did not phrase. */
 export const DEFAULT_PHRASE = "has";
 export const SelectOptionManifest = Schema.Struct({
@@ -81,7 +81,7 @@ export const ActionManifest = Schema.Struct({
 /**
  * The permissions of an entity's reads and generated actions, so that readers need not rebuild the
  * convention. The built-in user has only `read`; `link` and `unlink` exist with a `rel.many`. The
- * generated `upsertBy<Property>` requires both `create` and `update`.
+ * generated `upsert_by_<property>` requires both `create` and `update`.
  */
 export const EntityPermissionsManifest = Schema.Struct({
     read: Schema.String,
@@ -149,7 +149,7 @@ export const SignInManifest = Schema.Struct({
  * ignores unknown fields and accepts any `version`. The closed sets (property types, cardinalities,
  * `onDelete`) are validated because the migration planner must map every value to storage.
  */
-export const OntologyManifest = Schema.Struct({
+const OntologyManifestModel = Schema.Struct({
     version: Schema.Int,
     /** `sha256:` and the hex digest of the canonical JSON of the manifest without `hash`. */
     hash: Schema.String,
@@ -160,6 +160,46 @@ export const OntologyManifest = Schema.Struct({
     /** The connections the actions call. Written only when there are some; absent reads as none. */
     connections: Schema.optionalKey(Schema.Array(ConnectionManifest)),
 });
+const PropertyManifestWire = PropertyManifest.pipe(Schema.encodeKeys({ renamedFrom: "renamed_from", maxLength: "max_length" }));
+const OnDeleteWire = Schema.Literals(["set_null", "cascade", "restrict"]).pipe(Schema.decodeTo(Schema.Literals(ON_DELETE), SchemaTransformation.transform({
+    decode: (value) => (value === "set_null" ? "setNull" : value),
+    encode: (value) => (value === "setNull" ? "set_null" : value),
+})));
+const RelationshipManifestWire = Schema.Struct({
+    ...RelationshipManifest.fields,
+    on: Schema.optionalKey(Schema.Struct({ property: Schema.String, targetProperty: Schema.String }).pipe(Schema.encodeKeys({ targetProperty: "target_property" }))),
+    onDelete: Schema.optionalKey(OnDeleteWire),
+}).pipe(Schema.encodeKeys({ onDelete: "on_delete" }));
+const EntityManifestWire = Schema.Struct({
+    ...EntityManifest.fields,
+    properties: Schema.Array(PropertyManifestWire),
+    relationships: Schema.Array(RelationshipManifestWire),
+}).pipe(Schema.encodeKeys({ builtIn: "built_in", renamedFrom: "renamed_from" }));
+const RoleManifestWire = RoleManifest.pipe(Schema.encodeKeys({ builtIn: "built_in" }));
+/** The JSON contract written by version 4; decoded SDK models remain camelCase. */
+export const OntologyManifestWire = Schema.Struct({
+    ...OntologyManifestModel.fields,
+    entities: Schema.Array(EntityManifestWire),
+    roles: Schema.Array(RoleManifestWire),
+}).pipe(Schema.encodeKeys({ signIn: "sign_in" }));
+/** Historical readers accept either metadata spelling and any manifest version. */
+export const OntologyManifest = Schema.Union([OntologyManifestWire, OntologyManifestModel]);
+const originalDocuments = new WeakMap();
+/** Retain the complete document when decoding a persisted or published manifest. */
+export const decodeManifestDocument = (value) => Schema.decodeUnknownEffect(OntologyManifest)(value).pipe(Effect.map((manifest) => {
+    originalDocuments.set(manifest, value);
+    return manifest;
+}));
+/** Encode only ontology-owned metadata. JSON values and JSON Schema keywords remain opaque. */
+export function encodeManifest(manifest) {
+    const original = originalDocuments.get(manifest);
+    if (original !== undefined) {
+        return original;
+    }
+    return manifest.version < MANIFEST_VERSION
+        ? manifest
+        : Schema.encodeSync(OntologyManifestWire)(manifest);
+}
 /**
  * The sign-in policy a manifest declares. A manifest without one, or with a policy this reader does
  * not know, reads as `invited`: the closed choice, so that a misread never lets strangers in.
@@ -200,7 +240,7 @@ export function canonicalJson(value) {
 }
 /** The manifest as a file: canonical key order, two-space indentation and a final newline. */
 export function formatManifest(manifest) {
-    return `${serialize(manifest, "  ", 0)}\n`;
+    return `${serialize(encodeManifest(manifest), "  ", 0)}\n`;
 }
 /** The hash of a manifest, computed over its canonical JSON without the `hash` field. */
 export function manifestHash(manifest) {
@@ -330,7 +370,7 @@ export function buildManifest(input) {
             }
             : {}),
     };
-    return { ...body, hash: manifestHash(body) };
+    return { ...body, hash: manifestHash(encodeManifest({ ...body, hash: "" })) };
 }
 /** The keys of every connection the manifest's actions call, without duplicates. */
 export function actionConnectionKeys(manifest) {

package/dist/migrate/apply.d.ts

@@ -1,7 +1,7 @@
 import { Duration, Effect } from "effect";
 import type { SqlClient } from "effect/unstable/sql";
 import type { SqlError } from "effect/unstable/sql/SqlError";
-import { OntologyManifest } from "../manifest.js";
+import { type OntologyManifest } from "../manifest.js";
 import { CatalogInvalid, CatalogMismatch, MigrationFailed, MigrationRefused } from "./errors.js";
 import { type MigrationPlan } from "./model.js";
 import { type MigrationOptions } from "./plan.js";

package/dist/migrate/apply.js

@@ -1,5 +1,5 @@
 import { Duration, Effect, Schema } from "effect";
-import { canonicalJson, OntologyManifest } from "../manifest.js";
+import { canonicalJson, decodeManifestDocument, encodeManifest, manifestHash, } from "../manifest.js";
 import { CatalogInvalid, CatalogMismatch, MigrationFailed, MigrationRefused } from "./errors.js";
 import { isNoopMigration } from "./model.js";
 import { planMigration } from "./plan.js";
@@ -11,7 +11,7 @@ const DEFAULT_STATEMENT_TIMEOUT = "5 minutes";
 const DEFAULT_LOCK_TIMEOUT = "5 seconds";
 const Presence = Schema.Struct({ present: Schema.Boolean });
 const CatalogRow = Schema.Struct({ hash: Schema.String, manifest: Schema.String });
-const decodeManifest = Schema.decodeUnknownEffect(OntologyManifest);
+const decodeManifest = decodeManifestDocument;
 const readCatalogRow = (sql, options) => Effect.gen(function* () {
     const presence = yield* sql
         .unsafe(`SELECT to_regclass($1) IS NOT NULL AS present`, [CATALOG])
@@ -47,7 +47,8 @@ export const readCatalog = (input) => Effect.gen(function* () {
         message: "The _ontology manifest does not match the contract.",
         cause,
     })));
-    if (manifest.hash !== row.hash) {
+    if (manifest.hash !== row.hash ||
+        manifestHash(parsed) !== row.hash) {
         return yield* new CatalogInvalid({
             message: "The _ontology hash does not match the manifest it records.",
             cause: { recordedHash: row.hash, manifestHash: manifest.hash },
@@ -121,7 +122,7 @@ export const applyMigration = (plan, options) => Effect.gen(function* () {
               "hash" = excluded."hash",
               "manifest" = excluded."manifest",
               "applied_at" = now()
-          `, [plan.target.version, plan.target.hash, canonicalJson(plan.target)]);
+          `, [plan.target.version, plan.target.hash, canonicalJson(encodeManifest(plan.target))]);
     }));
     return { hash: plan.target.hash, appliedSteps: plan.steps.length, changed: true };
 }).pipe(Effect.withSpan("ontology.migrate.apply", {