latticesql 4.1.0 → 4.2.1

package/dist/cli.js

@@ -205,10 +205,10 @@ function getOrCreateMasterKey() {
 }
 function readIdentity() {
   const dir = ensureConfigDir();
-  const path2 = join2(dir, IDENTITY_FILENAME);
-  if (!existsSync2(path2)) return { ...EMPTY_IDENTITY };
+  const path3 = join2(dir, IDENTITY_FILENAME);
+  if (!existsSync2(path3)) return { ...EMPTY_IDENTITY };
   try {
-    const parsed = JSON.parse(readFileSync(path2, "utf8"));
+    const parsed = JSON.parse(readFileSync(path3, "utf8"));
     return {
       display_name: typeof parsed.display_name === "string" ? parsed.display_name : "",
       email: typeof parsed.email === "string" ? parsed.email : ""
@@ -219,26 +219,26 @@ function readIdentity() {
 }
 function writeIdentity(identity) {
   const dir = ensureConfigDir();
-  const path2 = join2(dir, IDENTITY_FILENAME);
+  const path3 = join2(dir, IDENTITY_FILENAME);
   const body = JSON.stringify(
     { display_name: identity.display_name, email: identity.email },
     null,
     2
   );
-  writeFileSync(path2, body + "\n", "utf8");
+  writeFileSync(path3, body + "\n", "utf8");
   if (platform2() !== "win32") {
     try {
-      chmodSync2(path2, 384);
+      chmodSync2(path3, 384);
     } catch {
     }
   }
 }
 function readPreferences() {
   const dir = ensureConfigDir();
-  const path2 = join2(dir, PREFERENCES_FILENAME);
-  if (!existsSync2(path2)) return { ...DEFAULT_PREFERENCES };
+  const path3 = join2(dir, PREFERENCES_FILENAME);
+  if (!existsSync2(path3)) return { ...DEFAULT_PREFERENCES };
   try {
-    const parsed = JSON.parse(readFileSync(path2, "utf8"));
+    const parsed = JSON.parse(readFileSync(path3, "utf8"));
     const agg = typeof parsed.aggressiveness === "number" ? parsed.aggressiveness : NaN;
     return {
       show_system_tables: typeof parsed.show_system_tables === "boolean" ? parsed.show_system_tables : DEFAULT_PREFERENCES.show_system_tables,
@@ -252,7 +252,7 @@ function readPreferences() {
 }
 function writePreferences(prefs) {
   const dir = ensureConfigDir();
-  const path2 = join2(dir, PREFERENCES_FILENAME);
+  const path3 = join2(dir, PREFERENCES_FILENAME);
   const body = JSON.stringify(
     {
       show_system_tables: prefs.show_system_tables,
@@ -263,10 +263,10 @@ function writePreferences(prefs) {
     null,
     2
   );
-  writeFileSync(path2, body + "\n", "utf8");
+  writeFileSync(path3, body + "\n", "utf8");
   if (platform2() !== "win32") {
     try {
-      chmodSync2(path2, 384);
+      chmodSync2(path3, 384);
     } catch {
     }
   }
@@ -299,7 +299,9 @@ function withCredentialLock(fn) {
       fd = openSync(lockPath, "wx");
       break;
     } catch (err) {
-      if (err.code !== "EEXIST") throw err;
+      const code = err.code;
+      const contended = code === "EEXIST" || process.platform === "win32" && (code === "EPERM" || code === "EACCES");
+      if (!contended) throw err;
       try {
         if (Date.now() - statSync(lockPath).mtimeMs > LOCK_STALE_MS) {
           unlinkSync(lockPath);
@@ -328,8 +330,8 @@ function withCredentialLock(fn) {
     }
   }
 }
-function writeFileAtomic(path2, data) {
-  const tmp = `${path2}.${String(process.pid)}.${randomBytes2(4).toString("hex")}.tmp`;
+function writeFileAtomic(path3, data) {
+  const tmp = `${path3}.${String(process.pid)}.${randomBytes2(4).toString("hex")}.tmp`;
   writeFileSync(tmp, data, "utf8");
   if (platform2() !== "win32") {
     try {
@@ -337,7 +339,7 @@ function writeFileAtomic(path2, data) {
     } catch {
     }
   }
-  renameSync(tmp, path2);
+  renameSync(tmp, path3);
 }
 function mutateCredentials(mutate) {
   withCredentialLock(() => {
@@ -348,11 +350,11 @@ function mutateCredentials(mutate) {
 }
 function loadCredentials() {
   const dir = ensureConfigDir();
-  const path2 = join2(dir, DB_CREDENTIALS_FILENAME);
-  if (!existsSync2(path2)) return {};
+  const path3 = join2(dir, DB_CREDENTIALS_FILENAME);
+  if (!existsSync2(path3)) return {};
   const key = deriveKey(getOrCreateMasterKey());
   try {
-    const ciphertext = readFileSync(path2, "utf8").trim();
+    const ciphertext = readFileSync(path3, "utf8").trim();
     const plaintext = decrypt(ciphertext, key);
     const parsed = JSON.parse(plaintext);
     if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
@@ -367,10 +369,10 @@ function loadCredentials() {
 }
 function saveCredentials(creds) {
   const dir = ensureConfigDir();
-  const path2 = join2(dir, DB_CREDENTIALS_FILENAME);
+  const path3 = join2(dir, DB_CREDENTIALS_FILENAME);
   const key = deriveKey(getOrCreateMasterKey());
   const ciphertext = encrypt(JSON.stringify(creds), key);
-  writeFileAtomic(path2, ciphertext + "\n");
+  writeFileAtomic(path3, ciphertext + "\n");
 }
 function listDbCredentials() {
   return Object.keys(loadCredentials()).sort();
@@ -418,11 +420,11 @@ function healRawDbUrl(configPath) {
 }
 function loadS3Configs() {
   const dir = ensureConfigDir();
-  const path2 = join2(dir, S3_CONFIG_FILENAME);
-  if (!existsSync2(path2)) return {};
+  const path3 = join2(dir, S3_CONFIG_FILENAME);
+  if (!existsSync2(path3)) return {};
   const key = deriveKey(getOrCreateMasterKey());
   try {
-    const parsed = JSON.parse(decrypt(readFileSync(path2, "utf8").trim(), key));
+    const parsed = JSON.parse(decrypt(readFileSync(path3, "utf8").trim(), key));
     if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
       return parsed;
     }
@@ -436,12 +438,12 @@ function loadS3Configs() {
 }
 function saveS3Configs(cfgs) {
   const dir = ensureConfigDir();
-  const path2 = join2(dir, S3_CONFIG_FILENAME);
+  const path3 = join2(dir, S3_CONFIG_FILENAME);
   const key = deriveKey(getOrCreateMasterKey());
-  writeFileSync(path2, encrypt(JSON.stringify(cfgs), key) + "\n", "utf8");
+  writeFileSync(path3, encrypt(JSON.stringify(cfgs), key) + "\n", "utf8");
   if (platform2() !== "win32") {
     try {
-      chmodSync2(path2, 384);
+      chmodSync2(path3, 384);
     } catch {
     }
   }
@@ -461,11 +463,11 @@ function deleteDbCredential(label) {
 }
 function loadAssistantCredentials() {
   const dir = ensureConfigDir();
-  const path2 = join2(dir, ASSISTANT_CREDENTIALS_FILENAME);
-  if (!existsSync2(path2)) return {};
+  const path3 = join2(dir, ASSISTANT_CREDENTIALS_FILENAME);
+  if (!existsSync2(path3)) return {};
   const key = deriveKey(getOrCreateMasterKey());
   try {
-    const ciphertext = readFileSync(path2, "utf8").trim();
+    const ciphertext = readFileSync(path3, "utf8").trim();
     const plaintext = decrypt(ciphertext, key);
     const parsed = JSON.parse(plaintext);
     if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
@@ -480,13 +482,13 @@ function loadAssistantCredentials() {
 }
 function saveAssistantCredentials(creds) {
   const dir = ensureConfigDir();
-  const path2 = join2(dir, ASSISTANT_CREDENTIALS_FILENAME);
+  const path3 = join2(dir, ASSISTANT_CREDENTIALS_FILENAME);
   const key = deriveKey(getOrCreateMasterKey());
   const ciphertext = encrypt(JSON.stringify(creds), key);
-  writeFileSync(path2, ciphertext + "\n", "utf8");
+  writeFileSync(path3, ciphertext + "\n", "utf8");
   if (platform2() !== "win32") {
     try {
-      chmodSync2(path2, 384);
+      chmodSync2(path3, 384);
     } catch {
     }
   }
@@ -997,10 +999,10 @@ function manifestPath(outputDir) {
   return join5(outputDir, ".lattice", "manifest.json");
 }
 function readManifest(outputDir) {
-  const path2 = manifestPath(outputDir);
-  if (!existsSync5(path2)) return null;
+  const path3 = manifestPath(outputDir);
+  if (!existsSync5(path3)) return null;
   try {
-    return JSON.parse(readFileSync4(path2, "utf8"));
+    return JSON.parse(readFileSync4(path3, "utf8"));
   } catch {
     return null;
   }
@@ -1188,20 +1190,130 @@ var init_render_cursor = __esm({
   }
 });
 
+// src/db/load-sqlite.ts
+import path from "path";
+import { createRequire } from "module";
+import { spawnSync } from "child_process";
+function runtimeRequire() {
+  const importMetaUrl = import.meta.url;
+  return importMetaUrl ? createRequire(importMetaUrl) : (
+    // CJS fallback — Node provides `require` on every CJS module scope. Under
+    // tsup's CJS output `import.meta.url` is rewritten to undefined, so this
+    // branch keeps the loader working in the published .cjs bundle.
+    __require
+  );
+}
+function asCtor(mod) {
+  return mod.default ?? mod;
+}
+function isAbiMismatch(err) {
+  const message = err instanceof Error ? err.message : String(err);
+  const code = err.code;
+  return message.includes("NODE_MODULE_VERSION") || code === "ERR_DLOPEN_FAILED" || message.includes("was compiled against a different Node.js version");
+}
+function autoRebuildDisabled() {
+  const v2 = process.env.LATTICE_SQLITE_NO_AUTOREBUILD;
+  if (!v2) return false;
+  const normalized = v2.trim().toLowerCase();
+  return normalized !== "" && normalized !== "0" && normalized !== "false" && normalized !== "no";
+}
+function installRootFor(req) {
+  const pkgJsonPath = req.resolve("better-sqlite3/package.json");
+  return path.resolve(path.dirname(pkgJsonPath), "..", "..");
+}
+function defaultRebuild(installRoot) {
+  const npmBin = process.platform === "win32" ? "npm.cmd" : "npm";
+  const res = spawnSync(npmBin, ["rebuild", "better-sqlite3"], {
+    cwd: installRoot,
+    stdio: ["ignore", "pipe", "pipe"],
+    encoding: "utf8",
+    timeout: 5 * 60 * 1e3
+  });
+  if (res.error) {
+    return { ok: false, reason: res.error.message };
+  }
+  if (res.status !== 0) {
+    const stderr = res.stderr.trim();
+    const tail = stderr ? stderr.slice(-300) : `npm rebuild exited with code ${String(res.status)}`;
+    return { ok: false, reason: tail };
+  }
+  return { ok: true };
+}
+function resolveSqliteCtor(options = {}) {
+  const req = options.require ?? runtimeRequire();
+  const rebuild = options.rebuild ?? defaultRebuild;
+  const resolveInstallRoot = options.installRoot ?? installRootFor;
+  const log = options.log ?? ((msg) => process.stderr.write(msg + "\n"));
+  let firstError;
+  try {
+    return asCtor(req("better-sqlite3"));
+  } catch (err) {
+    firstError = err;
+  }
+  if (!isAbiMismatch(firstError)) {
+    throw new Error(PEER_DEP_MISSING_MESSAGE);
+  }
+  if (autoRebuildDisabled()) {
+    throw new Error(
+      rebuildFailedMessage("automatic rebuild is disabled (LATTICE_SQLITE_NO_AUTOREBUILD)")
+    );
+  }
+  log("[latticesql] SQLite engine built for a different Node runtime \u2014 rebuilding better-sqlite3\u2026");
+  let installRoot;
+  try {
+    installRoot = resolveInstallRoot(req);
+  } catch (err) {
+    throw new Error(
+      rebuildFailedMessage(
+        "could not locate the better-sqlite3 install root (" + (err instanceof Error ? err.message : String(err)) + ")"
+      )
+    );
+  }
+  const outcome = rebuild(installRoot);
+  if (!outcome.ok) {
+    throw new Error(rebuildFailedMessage(outcome.reason));
+  }
+  try {
+    return asCtor(req("better-sqlite3"));
+  } catch (err) {
+    throw new Error(
+      rebuildFailedMessage(
+        "the rebuilt module still failed to load (" + (err instanceof Error ? err.message : String(err)) + ")"
+      )
+    );
+  }
+}
+function rebuildFailedMessage(reason) {
+  return "latticesql: the better-sqlite3 native module doesn\u2019t match this Node runtime and an automatic rebuild did not complete (" + reason + "). Run `npm rebuild better-sqlite3` (or reinstall) and retry.";
+}
+function loadSqlite() {
+  if (_ctor) return _ctor;
+  _ctor = resolveSqliteCtor();
+  return _ctor;
+}
+var PEER_DEP_MISSING_MESSAGE, _ctor;
+var init_load_sqlite = __esm({
+  "src/db/load-sqlite.ts"() {
+    "use strict";
+    PEER_DEP_MISSING_MESSAGE = "better-sqlite3 is a required peer dependency of latticesql \u2014 install it (npm install better-sqlite3).";
+    _ctor = null;
+  }
+});
+
 // src/db/sqlite.ts
-import Database from "better-sqlite3";
 var SQLiteAdapter;
 var init_sqlite = __esm({
   "src/db/sqlite.ts"() {
     "use strict";
+    init_load_sqlite();
     SQLiteAdapter = class {
       dialect = "sqlite";
       _db = null;
       _path;
       _wal;
       _busyTimeout;
-      constructor(path2, options) {
-        this._path = path2;
+      constructor(path3, options) {
+        this._path = path3;
         this._wal = options?.wal ?? true;
         this._busyTimeout = options?.busyTimeout ?? 5e3;
       }
@@ -1210,7 +1322,8 @@ var init_sqlite = __esm({
         return this._db;
       }
       open() {
-        this._db = new Database(this._path);
+        const Ctor = loadSqlite();
+        this._db = new Ctor(this._path);
         this._db.pragma(`busy_timeout = ${this._busyTimeout.toString()}`);
         if (this._wal) {
           this._db.pragma("journal_mode = WAL");
@@ -1382,16 +1495,16 @@ var init_sqlite = __esm({
 });
 
 // src/db/postgres.ts
-import path from "path";
+import path2 from "path";
 import { fileURLToPath } from "url";
-import { createRequire } from "module";
+import { createRequire as createRequire2 } from "module";
 function moduleContext() {
   if (_moduleContext) return _moduleContext;
   const importMetaUrl = import.meta.url;
   if (importMetaUrl) {
     _moduleContext = {
-      dir: path.dirname(fileURLToPath(importMetaUrl)),
-      require: createRequire(importMetaUrl)
+      dir: path2.dirname(fileURLToPath(importMetaUrl)),
+      require: createRequire2(importMetaUrl)
     };
   } else {
     _moduleContext = { dir: __dirname, require: __require };
@@ -3320,14 +3433,14 @@ var init_core = __esm({
       columnRef(f6) {
         const col = `"${ident(f6.col)}"`;
         if (f6.jsonPath === void 0) return { sql: col, params: [] };
-        const path2 = Array.isArray(f6.jsonPath) ? f6.jsonPath : [f6.jsonPath];
+        const path3 = Array.isArray(f6.jsonPath) ? f6.jsonPath : [f6.jsonPath];
         const numeric = isNumericComparison(f6);
         if (this.adapter.dialect === "postgres") {
           const extract2 = `((${col})::jsonb #>> ?::text[])`;
           const sql2 = numeric ? `(${extract2})::numeric` : extract2;
-          return { sql: sql2, params: [path2] };
+          return { sql: sql2, params: [path3] };
         }
-        const jsonpath = `$.${path2.join(".")}`;
+        const jsonpath = `$.${path3.join(".")}`;
         const extract = `json_extract(${col}, ?)`;
         const sql = numeric ? `CAST(${extract} AS REAL)` : extract;
         return { sql, params: [jsonpath] };
@@ -5902,8 +6015,8 @@ var init_pipeline = __esm({
 
 // src/render/interpolate.ts
 function interpolate(template, row) {
-  return template.replace(/\{\{([^}]+)\}\}/g, (_, path2) => {
-    const parts = path2.trim().split(".");
+  return template.replace(/\{\{([^}]+)\}\}/g, (_, path3) => {
+    const parts = path3.trim().split(".");
     let val = row;
     for (const part of parts) {
       if (val == null || typeof val !== "object") return "";
@@ -6052,13 +6165,13 @@ function uniqueDirName(displayName, existing) {
   }
 }
 function readRegistry(root6) {
-  const path2 = registryPath(root6);
-  if (!existsSync11(path2)) return { ...EMPTY_REGISTRY, workspaces: [] };
+  const path3 = registryPath(root6);
+  if (!existsSync11(path3)) return { ...EMPTY_REGISTRY, workspaces: [] };
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync8(path2, "utf-8"));
+    parsed = JSON.parse(readFileSync8(path3, "utf-8"));
   } catch (e6) {
-    throw new Error(`Lattice: corrupt workspace registry at "${path2}": ${e6.message}`);
+    throw new Error(`Lattice: corrupt workspace registry at "${path3}": ${e6.message}`);
   }
   const reg = parsed;
   return {
@@ -6068,11 +6181,11 @@ function readRegistry(root6) {
   };
 }
 function writeRegistry(root6, registry) {
-  const path2 = registryPath(root6);
-  const tmp = `${path2}.tmp-${String(process.pid)}`;
+  const path3 = registryPath(root6);
+  const tmp = `${path3}.tmp-${String(process.pid)}`;
   writeFileSync4(tmp, `${JSON.stringify(registry, null, 2)}
 `, "utf-8");
-  renameSync3(tmp, path2);
+  renameSync3(tmp, path3);
 }
 function listWorkspaces(root6) {
   return readRegistry(root6).workspaces;
@@ -6277,6 +6390,7 @@ function deriveCanonicalContexts(tables) {
       childrenOf.set(rel.table, list);
     }
   }
+  const byName = new Map(tables.map((t8) => [t8.name, t8.definition]));
   const out = [];
   for (const { name, definition } of tables) {
     const files = {};
@@ -6292,11 +6406,32 @@ function deriveCanonicalContexts(tables) {
       };
     }
     for (const child of childrenOf.get(name) ?? []) {
-      files[`${child.table.toUpperCase()}.md`] = {
-        source: { type: "hasMany", table: child.table, foreignKey: child.foreignKey },
-        render: renderRelated(child.table),
-        omitIfEmpty: true
-      };
+      const childDef = byName.get(child.table);
+      const childBt = childDef ? belongsToRelations(childDef) : [];
+      const [rel0, rel1] = childBt;
+      if (childDef && rel0 && rel1 && isRenderJunction(childDef, childBt)) {
+        const localRel = rel0.foreignKey === child.foreignKey ? rel0 : rel1;
+        const remoteRel = localRel === rel0 ? rel1 : rel0;
+        const fileKey = remoteRel.table === name ? `${child.table.toUpperCase()}__${remoteRel.foreignKey.toUpperCase()}.md` : `${remoteRel.table.toUpperCase()}.md`;
+        files[fileKey] = {
+          source: {
+            type: "manyToMany",
+            junctionTable: child.table,
+            localKey: localRel.foreignKey,
+            remoteKey: remoteRel.foreignKey,
+            remoteTable: remoteRel.table,
+            references: remoteRel.references ?? "id"
+          },
+          render: renderRelated(remoteRel.table),
+          omitIfEmpty: true
+        };
+      } else {
+        files[`${child.table.toUpperCase()}.md`] = {
+          source: { type: "hasMany", table: child.table, foreignKey: child.foreignKey },
+          render: renderRelated(child.table),
+          omitIfEmpty: true
+        };
+      }
     }
     out.push({
       table: name,
@@ -6309,6 +6444,15 @@ function deriveCanonicalContexts(tables) {
   }
   return out;
 }
+function isRenderJunction(def, bt) {
+  if (bt.length !== 2) return false;
+  const fks = new Set(bt.map((r6) => r6.foreignKey));
+  if (fks.size !== 2) return false;
+  const pk = Array.isArray(def.primaryKey) ? def.primaryKey : def.primaryKey != null ? [def.primaryKey] : [];
+  if (pk.length === 2 && pk.every((c6) => fks.has(c6))) return true;
+  const SYSTEM2 = /* @__PURE__ */ new Set(["id", "created_at", "updated_at", "deleted_at"]);
+  return Object.keys(def.columns).every((c6) => fks.has(c6) || SYSTEM2.has(c6));
+}
 function belongsToRelations(def) {
   return Object.values(def.relations ?? {}).filter(
     (r6) => r6.type === "belongsTo"
@@ -6702,6 +6846,19 @@ var init_vector_index = __esm({
   }
 });
 
+// src/search/limits.ts
+function clampTopK(topK) {
+  if (!Number.isFinite(topK)) return 1;
+  return Math.min(Math.max(1, Math.floor(topK)), SEARCH_TOPK_MAX);
+}
+var SEARCH_TOPK_MAX;
+var init_limits = __esm({
+  "src/search/limits.ts"() {
+    "use strict";
+    SEARCH_TOPK_MAX = 1e3;
+  }
+});
+
 // src/search/embeddings.ts
 async function ensureEmbeddingsTable(adapter) {
   let cols = [];
@@ -6848,9 +7005,10 @@ function cosineSimilarity(a6, b6) {
 }
 async function searchByEmbedding(adapter, table, queryText, config, topK, minScore, pkColumn = "id") {
   const queryVector = await config.embed(queryText);
+  const k6 = clampTopK(topK);
   let ranked;
   if (await vectorIndexAvailable(adapter) && await hasVectorIndex(adapter, table)) {
-    const hits = await searchVectorIndex(adapter, table, queryVector, topK * 4, minScore);
+    const hits = await searchVectorIndex(adapter, table, queryVector, k6 * 4, minScore);
     ranked = hits.map((h6) => ({
       pk: h6.pk,
       score: h6.score,
@@ -6858,7 +7016,7 @@ async function searchByEmbedding(adapter, table, queryText, config, topK, minSco
       content: h6.content
     }));
   } else {
-    ranked = await scanChunks(adapter, table, queryVector, minScore);
+    ranked = await scanChunks(adapter, table, queryVector, minScore, config.maxScanChunks);
   }
   const bestByRow = /* @__PURE__ */ new Map();
   for (const r6 of ranked) {
@@ -6883,11 +7041,20 @@ async function searchByEmbedding(adapter, table, queryText, config, topK, minSco
       if (r6.content !== null) result.matchedContent = r6.content;
     }
     results.push(result);
-    if (results.length >= topK) break;
+    if (results.length >= k6) break;
   }
   return results;
 }
-async function scanChunks(adapter, table, queryVector, minScore) {
+async function scanChunks(adapter, table, queryVector, minScore, maxScanChunks) {
+  if (maxScanChunks !== void 0) {
+    const countRows = await allAsyncOrSync(
+      adapter,
+      `SELECT COUNT(*) AS n FROM "${EMBEDDINGS_TABLE}" WHERE "table_name" = ?`,
+      [table]
+    );
+    const n3 = Number(countRows[0]?.n ?? 0);
+    if (n3 > maxScanChunks) throw new EmbeddingScanTooLargeError(table, n3, maxScanChunks);
+  }
   const stored = await allAsyncOrSync(
     adapter,
     `SELECT "row_pk", "chunk_index", "content", "embedding", "vec_dim" FROM "${EMBEDDINGS_TABLE}" WHERE "table_name" = ?`,
@@ -6997,13 +7164,14 @@ async function refreshEmbeddings(adapter, table, config, pkColumn = "id", opts =
   }
   return { embedded, skipped, removed };
 }
-var EMBEDDINGS_TABLE, EmbeddingDimensionMismatchError;
+var EMBEDDINGS_TABLE, EmbeddingDimensionMismatchError, EmbeddingScanTooLargeError;
 var init_embeddings = __esm({
   "src/search/embeddings.ts"() {
     "use strict";
     init_adapter();
     init_chunking();
     init_vector_index();
+    init_limits();
     EMBEDDINGS_TABLE = "_lattice_embeddings";
     EmbeddingDimensionMismatchError = class extends Error {
       constructor(table, expected, found) {
@@ -7016,6 +7184,17 @@ var init_embeddings = __esm({
         this.name = "EmbeddingDimensionMismatchError";
       }
     };
+    EmbeddingScanTooLargeError = class extends Error {
+      constructor(table, found, limit) {
+        super(
+          `Embedding scan on "${table}" would read ${String(found)} stored chunk vectors, over the configured maxScanChunks of ${String(limit)}. Add a native vector index (pgvector) for this table or raise maxScanChunks \u2014 Lattice will not silently truncate the scan, which would return incomplete results.`
+        );
+        this.table = table;
+        this.found = found;
+        this.limit = limit;
+        this.name = "EmbeddingScanTooLargeError";
+      }
+    };
   }
 });
 
@@ -7368,7 +7547,7 @@ async function fetchLiveRows2(adapter, table, ids, pkColumn) {
   return out;
 }
 async function hybridSearch(adapter, table, query, opts = {}) {
-  const topK = opts.topK ?? 10;
+  const topK = clampTopK(opts.topK ?? 10);
   const rrfK = opts.rrfK ?? 60;
   const pool = opts.poolSize ?? Math.max(topK * 4, 20);
   const pkColumn = opts.pkColumn ?? "id";
@@ -7469,6 +7648,7 @@ var init_hybrid = __esm({
     init_fts();
     init_ranking();
     init_rerank();
+    init_limits();
   }
 });
 
@@ -7725,18 +7905,18 @@ function computedColumnOrder(table, computed) {
   const names = new Set(Object.keys(computed));
   const order = [];
   const state2 = /* @__PURE__ */ new Map();
-  const visit = (name, path2) => {
+  const visit = (name, path3) => {
     const st = state2.get(name);
     if (st === "done") return;
     if (st === "visiting") {
-      const start = path2.indexOf(name);
-      throw new ComputedColumnCycleError(table, [...path2.slice(start), name]);
+      const start = path3.indexOf(name);
+      throw new ComputedColumnCycleError(table, [...path3.slice(start), name]);
     }
     state2.set(name, "visiting");
     const spec = computed[name];
     if (spec) {
       for (const dep of spec.deps) {
-        if (names.has(dep)) visit(dep, [...path2, name]);
+        if (names.has(dep)) visit(dep, [...path3, name]);
       }
     }
     state2.set(name, "done");
@@ -8196,6 +8376,26 @@ RETURNS boolean LANGUAGE sql STABLE SECURITY DEFINER AS $fn$
   );
 $fn$;
 
+-- Delete-event visibility, decided from the PRE-DELETE snapshot the delete trigger
+-- captures (the live row + its ownership record are gone after a delete, so
+-- lattice_row_visible can't be used). Keyed on session_user, SECURITY DEFINER \u2014
+-- the same per-recipient gate. MUST MIRROR lattice_row_visible's rule: the row is
+-- visible iff this member owned it, OR it was 'everyone', OR it was 'custom' and
+-- this member was a grantee. A NULL owner snapshot (a legacy delete emitted before
+-- the snapshot columns, or a row with no ownership record) yields false \u2014 fail
+-- closed, never forward. (tests/integration assert this agrees with
+-- lattice_row_visible for all three visibility states \u2014 the no-drift guard.)
+CREATE OR REPLACE FUNCTION lattice_delete_visible(
+  p_owner_role text, p_visibility text, p_grantees text[]
+)
+RETURNS boolean LANGUAGE sql STABLE SECURITY DEFINER AS $fn$
+  SELECT p_owner_role IS NOT NULL AND (
+       p_owner_role = session_user
+    OR p_visibility = 'everyone'
+    OR (p_visibility = 'custom' AND session_user = ANY(COALESCE(p_grantees, ARRAY[]::text[])))
+  );
+$fn$;
+
 -- Shared owner gate: raises unless the connected member owns (p_table, p_pk).
 -- p_action is spliced into the message so every caller keeps its exact wording.
 -- SECURITY DEFINER + session_user (never current_user), the cloud identity invariant.
@@ -8370,6 +8570,14 @@ CREATE TABLE IF NOT EXISTS "__lattice_changes" (
   "created_at" timestamptz NOT NULL DEFAULT now()
 );
 
+-- Pre-delete visibility snapshot columns (added to existing clouds via ADD COLUMN
+-- IF NOT EXISTS). A delete event carries the row's visibility AT DELETE TIME so the
+-- live fan-out can gate it per recipient even though the ownership record is gone.
+-- NULL on upserts.
+ALTER TABLE "__lattice_changes" ADD COLUMN IF NOT EXISTS "del_owner_role" text;
+ALTER TABLE "__lattice_changes" ADD COLUMN IF NOT EXISTS "del_visibility" text;
+ALTER TABLE "__lattice_changes" ADD COLUMN IF NOT EXISTS "del_grantees"   text[];
+
 CREATE OR REPLACE FUNCTION lattice_notify_change() RETURNS trigger
 LANGUAGE plpgsql AS $fn$
 BEGIN
@@ -8379,7 +8587,10 @@ BEGIN
     'pk', NEW."pk",
     'op', NEW."op",
     'owner_role', NEW."owner_role",
-    'created_at', NEW."created_at"
+    'created_at', NEW."created_at",
+    'del_owner_role', NEW."del_owner_role",
+    'del_visibility', NEW."del_visibility",
+    'del_grantees', NEW."del_grantees"
   )::text);
   RETURN NEW;
 END $fn$;
@@ -8585,10 +8796,22 @@ BEGIN
       VALUES (${lit}, ${pkNew}, 'upsert', session_user);
     RETURN NEW;
   ELSIF TG_OP = 'DELETE' THEN
+    -- Snapshot the row's visibility BEFORE the cascade removes its ownership +
+    -- grant records, so the realtime fan-out can gate the delete event per
+    -- recipient (the live predicate can't \u2014 these records are gone post-delete).
+    -- The grantee list is captured here because the grant rows are deleted in the
+    -- same statement below; after that the 'custom' audience is unrecoverable.
+    INSERT INTO "__lattice_changes"
+      ("table_name","pk","op","owner_role","del_owner_role","del_visibility","del_grantees")
+      VALUES (${lit}, ${pkOld}, 'delete', session_user,
+        (SELECT o."owner_role" FROM "__lattice_owners" o
+           WHERE o."table_name" = ${lit} AND o."pk" = ${pkOld}),
+        (SELECT o."visibility" FROM "__lattice_owners" o
+           WHERE o."table_name" = ${lit} AND o."pk" = ${pkOld}),
+        COALESCE((SELECT array_agg(g."grantee_role") FROM "__lattice_row_grants" g
+           WHERE g."table_name" = ${lit} AND g."pk" = ${pkOld}), ARRAY[]::text[]));
     DELETE FROM "__lattice_owners"     WHERE "table_name" = ${lit} AND "pk" = ${pkOld};
     DELETE FROM "__lattice_row_grants" WHERE "table_name" = ${lit} AND "pk" = ${pkOld};
-    INSERT INTO "__lattice_changes" ("table_name","pk","op","owner_role")
-      VALUES (${lit}, ${pkOld}, 'delete', session_user);
     RETURN OLD;
   END IF;
   RETURN NEW;
@@ -11830,7 +12053,7 @@ function parsePageParam(raw, kind) {
 }
 function readJson(req, opts = {}) {
   const maxBytes = opts.maxBytes ?? DEFAULT_BODY_MAX_BYTES;
-  return new Promise((resolve16, reject) => {
+  return new Promise((resolve17, reject) => {
     let raw = "";
     let overflowed = false;
     req.setEncoding("utf8");
@@ -11846,7 +12069,7 @@ function readJson(req, opts = {}) {
     req.on("end", () => {
       if (overflowed) return;
       try {
-        resolve16(raw ? JSON.parse(raw) : {});
+        resolve17(raw ? JSON.parse(raw) : {});
       } catch {
         reject(new Error("Invalid JSON body"));
       }
@@ -11866,11 +12089,12 @@ ${err.stack ?? ""}`);
     sendJson(res, { error: err.message }, status);
   }
 }
-var DEFAULT_BODY_MAX_BYTES, MAX_ROWS_PAGE, DEFAULT_ROWS_PAGE, BodyTooLargeError;
+var DEFAULT_BODY_MAX_BYTES, MAX_INGEST_BYTES, MAX_ROWS_PAGE, DEFAULT_ROWS_PAGE, BodyTooLargeError;
 var init_http = __esm({
   "src/gui/http.ts"() {
     "use strict";
     DEFAULT_BODY_MAX_BYTES = 1e6;
+    MAX_INGEST_BYTES = 5e7;
     MAX_ROWS_PAGE = 1e3;
     DEFAULT_ROWS_PAGE = 500;
     BodyTooLargeError = class extends Error {
@@ -13430,7 +13654,7 @@ var init_oauth = __esm({
 
 // src/gui/assistant-routes.ts
 function readBuffer(req, maxBytes = 25e6) {
-  return new Promise((resolve16, reject) => {
+  return new Promise((resolve17, reject) => {
     const chunks = [];
     let size = 0;
     req.on("data", (c6) => {
@@ -13439,7 +13663,7 @@ function readBuffer(req, maxBytes = 25e6) {
       else chunks.push(c6);
     });
     req.on("end", () => {
-      resolve16(Buffer.concat(chunks));
+      resolve17(Buffer.concat(chunks));
     });
     req.on("error", reject);
   });
@@ -14740,7 +14964,7 @@ async function takeHostSlot(host, minIntervalMs = urlIngestConfig().hostMinInter
   const earliest = Math.max(now2, hostNextAllowed.get(key) ?? 0);
   hostNextAllowed.set(key, earliest + minIntervalMs);
   const wait = earliest - now2;
-  if (wait > 0) await new Promise((resolve16) => setTimeout(resolve16, wait));
+  if (wait > 0) await new Promise((resolve17) => setTimeout(resolve17, wait));
 }
 var Semaphore, FetchBudget, sharedGate, hostNextAllowed;
 var init_fetch_policy = __esm({
@@ -14756,7 +14980,7 @@ var init_fetch_policy = __esm({
         if (this.permits > 0) {
           this.permits -= 1;
         } else {
-          await new Promise((resolve16) => this.waiters.push(resolve16));
+          await new Promise((resolve17) => this.waiters.push(resolve17));
         }
         let released = false;
         return () => {
@@ -14993,8 +15217,8 @@ function fileContentGroups(rows, fuzzy, threshold) {
     const t8 = get(r6, "extracted_text");
     return typeof t8 === "string" && t8.trim().length > 0;
   }).map((r6) => {
-    const norm2 = normalizeText(get(r6, "extracted_text"));
-    const key = fuzzy ? "txt:" + norm2.slice(0, 2e3) : "txt:" + createHash5("sha256").update(norm2).digest("hex");
+    const norm3 = normalizeText(get(r6, "extracted_text"));
+    const key = fuzzy ? "txt:" + norm3.slice(0, 2e3) : "txt:" + createHash5("sha256").update(norm3).digest("hex");
     return { id: String(get(r6, "id")), key, createdAt: cellStrOrNull(get(r6, "created_at")) };
   });
   const txtGroups = findDuplicateGroups(txtItems, {
@@ -15260,11 +15484,11 @@ function stripHtml(html) {
   const text = decodeXmlEntities(stripTags(noScript));
   return text.replace(/[ \t\f\r]+/g, " ").replace(/ *\n */g, "\n").replace(/\n{3,}/g, "\n\n").trim();
 }
-async function unzip(path2) {
+async function unzip(path3) {
   const fflate = await loadParser("fflate");
   if (!fflate || typeof fflate.unzipSync !== "function") return null;
   try {
-    const buf = await readFile(path2);
+    const buf = await readFile(path3);
     let total = 0;
     return fflate.unzipSync(new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength), {
       filter: (file) => {
@@ -15293,35 +15517,35 @@ var init_helpers2 = __esm({
 
 // src/gui/ai/doc/ooxml.ts
 import { readFile as readFile2 } from "fs/promises";
-async function extractDocx(path2) {
+async function extractDocx(path3) {
   const mod = await loadParser("mammoth");
   const lib = mod?.default ?? mod;
   if (!lib || typeof lib.extractRawText !== "function") return null;
   try {
-    const { value } = await lib.extractRawText({ path: path2 });
+    const { value } = await lib.extractRawText({ path: path3 });
     return nullIfEmpty(value);
   } catch {
     return null;
   }
 }
-async function extractDoc(path2) {
+async function extractDoc(path3) {
   const mod = await loadParser(
     "word-extractor"
   );
   const Ctor = mod && "default" in mod ? mod.default : mod;
   if (typeof Ctor !== "function") return null;
   try {
-    const doc = await new Ctor().extract(path2);
+    const doc = await new Ctor().extract(path3);
     return nullIfEmpty(doc.getBody());
   } catch {
     return null;
   }
 }
-async function extractPdf(path2) {
+async function extractPdf(path3) {
   const unpdf = await loadParser("unpdf");
   if (!unpdf || typeof unpdf.getDocumentProxy !== "function") return null;
   try {
-    const buf = await readFile2(path2);
+    const buf = await readFile2(path3);
     const data = new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);
     const text = await withTimeout(
       (async () => {
@@ -15353,8 +15577,8 @@ function slideText(xml) {
   }
   return paras.join("\n");
 }
-async function extractPptx(path2) {
-  const entries = await unzip(path2);
+async function extractPptx(path3) {
+  const entries = await unzip(path3);
   if (!entries) return null;
   const slides = Object.keys(entries).filter((n3) => /^ppt\/slides\/slide\d+\.xml$/.test(n3)).sort((a6, b6) => partNumber(a6) - partNumber(b6));
   if (slides.length === 0) return null;
@@ -15372,8 +15596,8 @@ async function extractPptx(path2) {
   }
   return nullIfEmpty(parts.join("\n\n"));
 }
-async function extractXlsx(path2) {
-  const entries = await unzip(path2);
+async function extractXlsx(path3) {
+  const entries = await unzip(path3);
   if (!entries) return null;
   const shared = [];
   const ssBytes = entries["xl/sharedStrings.xml"];
@@ -15431,8 +15655,8 @@ function odfWhitespace(s2) {
 function odfParagraph(inner) {
   return decodeXmlEntities(stripTags(odfWhitespace(inner))).trim();
 }
-async function extractOdfText(path2) {
-  const entries = await unzip(path2);
+async function extractOdfText(path3) {
+  const entries = await unzip(path3);
   if (!entries) return null;
   const contentBytes = entries["content.xml"];
   if (!contentBytes) return null;
@@ -15454,8 +15678,8 @@ async function extractOdfText(path2) {
   }
   return nullIfEmpty(lines.join("\n"));
 }
-async function extractOds(path2) {
-  const entries = await unzip(path2);
+async function extractOds(path3) {
+  const entries = await unzip(path3);
   if (!entries) return null;
   const contentBytes = entries["content.xml"];
   if (!contentBytes) return null;
@@ -15514,8 +15738,8 @@ function resolveHref(baseDir, href) {
   }
   return normalizeZipPath(baseDir + h6);
 }
-async function extractEpub(path2) {
-  const entries = await unzip(path2);
+async function extractEpub(path3) {
+  const entries = await unzip(path3);
   if (!entries) return null;
   let order = [];
   const container = entries["META-INF/container.xml"];
@@ -15599,9 +15823,9 @@ function rtfToText(rtf) {
   s2 = s2.replace(/[{}]/g, "");
   return s2.replace(/[ \t]+/g, (m4) => m4.includes("	") ? "	" : " ").replace(/[ \t]\n/g, "\n").replace(/\n{3,}/g, "\n\n").trim();
 }
-async function extractRtf(path2) {
+async function extractRtf(path3) {
   try {
-    const raw = await readFile3(path2, "latin1");
+    const raw = await readFile3(path3, "latin1");
     if (!raw.startsWith("{\\rtf")) return null;
     return nullIfEmpty(rtfToText(raw));
   } catch {
@@ -15647,27 +15871,27 @@ var init_other = __esm({
 });
 
 // src/gui/ai/doc-extractors.ts
-async function extractDocument(path2, ext) {
+async function extractDocument(path3, ext) {
   switch (ext) {
     case ".docx":
-      return extractDocx(path2);
+      return extractDocx(path3);
     case ".doc":
-      return extractDoc(path2);
+      return extractDoc(path3);
     case ".pdf":
-      return extractPdf(path2);
+      return extractPdf(path3);
     case ".pptx":
-      return extractPptx(path2);
+      return extractPptx(path3);
     case ".xlsx":
-      return extractXlsx(path2);
+      return extractXlsx(path3);
     case ".odt":
     case ".odp":
-      return extractOdfText(path2);
+      return extractOdfText(path3);
     case ".ods":
-      return extractOds(path2);
+      return extractOds(path3);
     case ".epub":
-      return extractEpub(path2);
+      return extractEpub(path3);
     case ".rtf":
-      return extractRtf(path2);
+      return extractRtf(path3);
     default:
       return null;
   }
@@ -15690,17 +15914,17 @@ function languageOf(name) {
 function truncate(s2) {
   return s2.length > MAX_TEXT2 ? s2.slice(0, MAX_TEXT2) : s2;
 }
-async function parseFile(path2, mimeHint, originalName) {
-  const name = originalName ?? basename4(path2);
+async function parseFile(path3, mimeHint, originalName) {
+  const name = originalName ?? basename4(path3);
   const ext = extname(name).toLowerCase();
   const lang = languageOf(name);
   if (lang) {
-    return { text: truncate(await readFile4(path2, "utf8")), language: lang };
+    return { text: truncate(await readFile4(path3, "utf8")), language: lang };
   }
   if (mimeHint && TEXT_MIME.test(mimeHint) || TEXT_EXT.has(ext)) {
-    return { text: truncate(await readFile4(path2, "utf8")) };
+    return { text: truncate(await readFile4(path3, "utf8")) };
   }
-  const doc = await extractDocument(path2, ext);
+  const doc = await extractDocument(path3, ext);
   if (doc != null) {
     return { text: truncate(doc) };
   }
@@ -15770,7 +15994,7 @@ var init_extract = __esm({
 });
 
 // src/ai/llm-client.ts
-import { createRequire as createRequire3 } from "module";
+import { createRequire as createRequire4 } from "module";
 var DEFAULT_MODEL;
 var init_llm_client = __esm({
   "src/ai/llm-client.ts"() {
@@ -16324,7 +16548,7 @@ var init_url_safety = __esm({
 import { JSDOM } from "jsdom";
 import { Readability } from "@mozilla/readability";
 import { basename as basename5 } from "path";
-import { createRequire as createRequire4 } from "module";
+import { createRequire as createRequire5 } from "module";
 async function crawlUrl(rawUrl, opts = {}) {
   const u2 = await assertSafeUrl(rawUrl, opts.allowPrivate ?? false);
   const fetchImpl = opts.fetcher ?? fetch;
@@ -16571,7 +16795,7 @@ async function renderViaPlaywright(url, timeoutMs, warnIfMissing = false) {
   let chromium;
   try {
     const importMetaUrl = import.meta.url;
-    const req = importMetaUrl ? createRequire4(importMetaUrl) : __require;
+    const req = importMetaUrl ? createRequire5(importMetaUrl) : __require;
     const pw = req("playwright");
     chromium = pw.chromium;
   } catch {
@@ -16743,8 +16967,8 @@ function isWriteConflict(e6) {
 function normalizeUrl(s2) {
   try {
     const u2 = new URL(s2.trim());
-    const path2 = u2.pathname.replace(/\/+$/, "");
-    return `${u2.protocol}//${u2.host.toLowerCase()}${path2}${u2.search}`;
+    const path3 = u2.pathname.replace(/\/+$/, "");
+    return `${u2.protocol}//${u2.host.toLowerCase()}${path3}${u2.search}`;
   } catch {
     return null;
   }
@@ -17502,7 +17726,7 @@ var init_tools = __esm({
 });
 
 // src/gui/ai/chat.ts
-import { createRequire as createRequire5 } from "module";
+import { createRequire as createRequire6 } from "module";
 function capToolResult(s2) {
   if (s2.length <= MAX_TOOL_RESULT_CHARS) return s2;
   if (s2.length > MAX_TOOL_RESULT_SKIP)
@@ -17735,7 +17959,7 @@ async function* runChat(opts) {
 function loadSdk() {
   if (!_sdk) {
     const importMetaUrl = import.meta.url;
-    const req = importMetaUrl ? createRequire5(importMetaUrl) : __require;
+    const req = importMetaUrl ? createRequire6(importMetaUrl) : __require;
     try {
       _sdk = req("@anthropic-ai/sdk");
     } catch (err) {
@@ -18972,7 +19196,7 @@ var init_sleep = __esm({
   "node_modules/@smithy/core/dist-es/submodules/client/util-waiter/utils/sleep.js"() {
     "use strict";
     sleep = (seconds) => {
-      return new Promise((resolve16) => setTimeout(resolve16, seconds * 1e3));
+      return new Promise((resolve17) => setTimeout(resolve17, seconds * 1e3));
     };
   }
 });
@@ -19141,8 +19365,8 @@ var init_createWaiter = __esm({
     init_waiter2();
     abortTimeout = (abortSignal) => {
       let onAbort;
-      const promise = new Promise((resolve16) => {
-        onAbort = () => resolve16({ state: WaiterState.ABORTED });
+      const promise = new Promise((resolve17) => {
+        onAbort = () => resolve17({ state: WaiterState.ABORTED });
         if (typeof abortSignal.addEventListener === "function") {
           abortSignal.addEventListener("abort", onAbort);
         } else {
@@ -21562,14 +21786,14 @@ var init_readFile = __esm({
     "use strict";
     filePromises = {};
     fileIntercept = {};
-    readFile6 = (path2, options) => {
-      if (fileIntercept[path2] !== void 0) {
-        return fileIntercept[path2];
+    readFile6 = (path3, options) => {
+      if (fileIntercept[path3] !== void 0) {
+        return fileIntercept[path3];
       }
-      if (!filePromises[path2] || options?.ignoreCache) {
-        filePromises[path2] = fsReadFile(path2, "utf8");
+      if (!filePromises[path3] || options?.ignoreCache) {
+        filePromises[path3] = fsReadFile(path3, "utf8");
       }
-      return filePromises[path2];
+      return filePromises[path3];
     };
   }
 });
@@ -21687,8 +21911,8 @@ var init_externalDataInterceptor = __esm({
       getFileRecord() {
         return fileIntercept;
       },
-      interceptFile(path2, contents) {
-        fileIntercept[path2] = Promise.resolve(contents);
+      interceptFile(path3, contents) {
+        fileIntercept[path3] = Promise.resolve(contents);
       },
       getTokenRecord() {
         return tokenIntercept;
@@ -22022,13 +22246,13 @@ var init_resolveDefaultsModeConfig = __esm({
       }
       return { hostname: "169.254.169.254", path: "/" };
     };
-    imdsHttpGet = async ({ hostname, path: path2 }) => {
+    imdsHttpGet = async ({ hostname, path: path3 }) => {
       const { request } = await import("http");
-      return new Promise((resolve16, reject) => {
+      return new Promise((resolve17, reject) => {
         const req = request({
           method: "GET",
           hostname: hostname.replace(/^\[(.+)]$/, "$1"),
-          path: path2,
+          path: path3,
           timeout: 1e3,
           signal: AbortSignal.timeout(1e3)
         });
@@ -22050,7 +22274,7 @@ var init_resolveDefaultsModeConfig = __esm({
           const chunks = [];
           res.on("data", (chunk) => chunks.push(chunk));
           res.on("end", () => {
-            resolve16(Buffer.concat(chunks));
+            resolve17(Buffer.concat(chunks));
             req.destroy();
           });
         });
@@ -22229,8 +22453,8 @@ var init_createConfigValueProvider = __esm({
               return endpoint.url.href;
             }
             if ("hostname" in endpoint) {
-              const { protocol, hostname, port, path: path2 } = endpoint;
-              return `${protocol}//${hostname}${port ? ":" + port : ""}${path2}`;
+              const { protocol, hostname, port, path: path3 } = endpoint;
+              return `${protocol}//${hostname}${port ? ":" + port : ""}${path3}`;
             }
           }
           return endpoint;
@@ -22667,18 +22891,18 @@ var init_getAttrPathList = __esm({
   "node_modules/@smithy/core/dist-es/submodules/endpoints/util-endpoints/lib/getAttrPathList.js"() {
     "use strict";
     init_types3();
-    getAttrPathList = (path2) => {
-      const parts = path2.split(".");
+    getAttrPathList = (path3) => {
+      const parts = path3.split(".");
       const pathList = [];
       for (const part of parts) {
         const squareBracketIndex = part.indexOf("[");
         if (squareBracketIndex !== -1) {
           if (part.indexOf("]") !== part.length - 1) {
-            throw new EndpointError(`Path: '${path2}' does not end with ']'`);
+            throw new EndpointError(`Path: '${path3}' does not end with ']'`);
           }
           const arrayIndex = part.slice(squareBracketIndex + 1, -1);
           if (Number.isNaN(parseInt(arrayIndex))) {
-            throw new EndpointError(`Invalid array index: '${arrayIndex}' in path: '${path2}'`);
+            throw new EndpointError(`Invalid array index: '${arrayIndex}' in path: '${path3}'`);
           }
           if (squareBracketIndex !== 0) {
             pathList.push(part.slice(0, squareBracketIndex));
@@ -22700,9 +22924,9 @@ var init_getAttr = __esm({
     "use strict";
     init_types3();
     init_getAttrPathList();
-    getAttr = (value, path2) => getAttrPathList(path2).reduce((acc, index) => {
+    getAttr = (value, path3) => getAttrPathList(path3).reduce((acc, index) => {
       if (typeof acc !== "object") {
-        throw new EndpointError(`Index '${index}' in '${path2}' not found in '${JSON.stringify(value)}'`);
+        throw new EndpointError(`Index '${index}' in '${path3}' not found in '${JSON.stringify(value)}'`);
       } else if (Array.isArray(acc)) {
         const i6 = parseInt(index);
         return acc[i6 < 0 ? acc.length + i6 : i6];
@@ -22768,8 +22992,8 @@ var init_parseURL = __esm({
             return value;
           }
           if (typeof value === "object" && "hostname" in value) {
-            const { hostname: hostname2, port, protocol: protocol2 = "", path: path2 = "", query = {} } = value;
-            const url = new URL(`${protocol2}//${hostname2}${port ? `:${port}` : ""}${path2}`);
+            const { hostname: hostname2, port, protocol: protocol2 = "", path: path3 = "", query = {} } = value;
+            const url = new URL(`${protocol2}//${hostname2}${port ? `:${port}` : ""}${path3}`);
             url.search = Object.entries(query).map(([k6, v2]) => `${k6}=${v2}`).join("&");
             return url;
           }
@@ -23810,7 +24034,7 @@ async function collectStream(stream) {
   return collected;
 }
 function readToBase64(blob) {
-  return new Promise((resolve16, reject) => {
+  return new Promise((resolve17, reject) => {
     const reader = new FileReader();
     reader.onloadend = () => {
       if (reader.readyState !== 2) {
@@ -23819,7 +24043,7 @@ function readToBase64(blob) {
       const result = reader.result ?? "";
       const commaIndex = result.indexOf(",");
       const dataOffset = commaIndex > -1 ? commaIndex + 1 : result.length;
-      resolve16(result.substring(dataOffset));
+      resolve17(result.substring(dataOffset));
     };
     reader.onabort = () => reject(new Error("Read aborted"));
     reader.onerror = () => reject(reader.error);
@@ -23947,7 +24171,7 @@ var init_stream_collector = __esm({
       if (isReadableStreamInstance(stream)) {
         return collectReadableStream(stream);
       }
-      return new Promise((resolve16, reject) => {
+      return new Promise((resolve17, reject) => {
         const collector = new Collector();
         stream.pipe(collector);
         stream.on("error", (err) => {
@@ -23957,7 +24181,7 @@ var init_stream_collector = __esm({
         collector.on("error", reject);
         collector.on("finish", function() {
           const bytes = new Uint8Array(Buffer.concat(this.bufferedBytes));
-          resolve16(bytes);
+          resolve17(bytes);
         });
       });
     };
@@ -24104,11 +24328,11 @@ var init_SerdeContext = __esm({
 // node_modules/tslib/tslib.es6.mjs
 function __awaiter(thisArg, _arguments, P2, generator) {
   function adopt(value) {
-    return value instanceof P2 ? value : new P2(function(resolve16) {
-      resolve16(value);
+    return value instanceof P2 ? value : new P2(function(resolve17) {
+      resolve17(value);
     });
   }
-  return new (P2 || (P2 = Promise))(function(resolve16, reject) {
+  return new (P2 || (P2 = Promise))(function(resolve17, reject) {
     function fulfilled(value) {
       try {
         step(generator.next(value));
@@ -24124,7 +24348,7 @@ function __awaiter(thisArg, _arguments, P2, generator) {
       }
     }
     function step(result) {
-      result.done ? resolve16(result.value) : adopt(result.value).then(fulfilled, rejected);
+      result.done ? resolve17(result.value) : adopt(result.value).then(fulfilled, rejected);
     }
     step((generator = generator.apply(thisArg, _arguments || [])).next());
   });
@@ -25321,7 +25545,7 @@ async function* readableToIterable(readStream) {
     streamEnded = true;
   });
   while (!generationEnded) {
-    const value = await new Promise((resolve16) => setTimeout(() => resolve16(records.shift()), 0));
+    const value = await new Promise((resolve17) => setTimeout(() => resolve17(records.shift()), 0));
     if (value) {
       yield value;
     }
@@ -25880,11 +26104,11 @@ var init_HttpBindingProtocol = __esm({
           const opTraits = translateTraits(operationSchema.traits);
           if (opTraits.http) {
             request.method = opTraits.http[0];
-            const [path2, search] = opTraits.http[1].split("?");
+            const [path3, search] = opTraits.http[1].split("?");
             if (request.path == "/") {
-              request.path = path2;
+              request.path = path3;
             } else {
-              request.path += path2;
+              request.path += path3;
             }
             const traitSearchParams = new URLSearchParams(search ?? "");
             for (const [key, value] of traitSearchParams) {
@@ -26866,7 +27090,7 @@ var init_retryMiddleware = __esm({
     init_constants5();
     init_parseRetryAfterHeader();
     init_util2();
-    cooldown = (ms) => new Promise((resolve16) => setTimeout(resolve16, ms));
+    cooldown = (ms) => new Promise((resolve17) => setTimeout(resolve17, ms));
     isRetryStrategyV2 = (retryStrategy) => typeof retryStrategy.acquireInitialRetryToken !== "undefined" && typeof retryStrategy.refreshRetryTokenForRetry !== "undefined" && typeof retryStrategy.recordSuccess !== "undefined";
     getRetryErrorInfo = (error, logger2) => {
       const errorInfo = {
@@ -26965,7 +27189,7 @@ var init_DefaultRateLimiter = __esm({
         this.refillTokenBucket();
         while (amount > this.availableTokens) {
           const delay = (amount - this.availableTokens) / this.fillRate * 1e3;
-          await new Promise((resolve16) => _DefaultRateLimiter.setTimeoutFn(resolve16, delay));
+          await new Promise((resolve17) => _DefaultRateLimiter.setTimeoutFn(resolve17, delay));
           this.refillTokenBucket();
         }
         this.availableTokens = this.availableTokens - amount;
@@ -27863,9 +28087,9 @@ var init_createPaginator = __esm({
       command = withCommand(command) ?? command;
       return await client.send(command, ...args);
     };
-    get2 = (fromObject, path2) => {
+    get2 = (fromObject, path3) => {
       let cursor = fromObject;
-      const pathComponents = path2.split(".");
+      const pathComponents = path3.split(".");
       for (const step of pathComponents) {
         if (!cursor || typeof cursor !== "object") {
           return void 0;
@@ -30357,10 +30581,10 @@ ${longDate}
 ${credentialScope}
 ${toHex(hashedRequest)}`;
       }
-      getCanonicalPath({ path: path2 }) {
+      getCanonicalPath({ path: path3 }) {
         if (this.uriEscapePath) {
           const normalizedPathSegments = [];
-          for (const pathSegment of path2.split("/")) {
+          for (const pathSegment of path3.split("/")) {
             if (pathSegment?.length === 0)
               continue;
             if (pathSegment === ".")
@@ -30371,11 +30595,11 @@ ${toHex(hashedRequest)}`;
               normalizedPathSegments.push(pathSegment);
             }
           }
-          const normalizedPath = `${path2?.startsWith("/") ? "/" : ""}${normalizedPathSegments.join("/")}${normalizedPathSegments.length > 0 && path2?.endsWith("/") ? "/" : ""}`;
+          const normalizedPath = `${path3?.startsWith("/") ? "/" : ""}${normalizedPathSegments.join("/")}${normalizedPathSegments.length > 0 && path3?.endsWith("/") ? "/" : ""}`;
           const doubleEncoded = escapeUri(normalizedPath);
           return doubleEncoded.replace(/%2F/g, "/");
         }
-        return path2;
+        return path3;
       }
       validateResolvedCredentials(credentials) {
         if (typeof credentials !== "object" || typeof credentials.accessKeyId !== "string" || typeof credentials.secretAccessKey !== "string") {
@@ -30635,8 +30859,8 @@ var init_SignatureV4 = __esm({
           priorSignature: signableMessage.priorSignature,
           eventStreamCredentials
         });
-        return promise.then((signature) => {
-          return { message: signableMessage.message, signature };
+        return promise.then((signature2) => {
+          return { message: signableMessage.message, signature: signature2 };
         });
       }
       async signString(stringToSign, { signingDate = /* @__PURE__ */ new Date(), signingRegion, signingService, eventStreamCredentials } = {}) {
@@ -30664,8 +30888,8 @@ var init_SignatureV4 = __esm({
           request.headers[SHA256_HEADER] = payloadHash;
         }
         const canonicalHeaders = getCanonicalHeaders(request, unsignableHeaders, signableHeaders);
-        const signature = await this.getSignature(longDate, scope, this.getSigningKey(credentials, region, shortDate, signingService), this.createCanonicalRequest(request, canonicalHeaders, payloadHash));
-        request.headers[AUTH_HEADER] = `${ALGORITHM_IDENTIFIER} Credential=${credentials.accessKeyId}/${scope}, SignedHeaders=${this.getCanonicalHeaderList(canonicalHeaders)}, Signature=${signature}`;
+        const signature2 = await this.getSignature(longDate, scope, this.getSigningKey(credentials, region, shortDate, signingService), this.createCanonicalRequest(request, canonicalHeaders, payloadHash));
+        request.headers[AUTH_HEADER] = `${ALGORITHM_IDENTIFIER} Credential=${credentials.accessKeyId}/${scope}, SignedHeaders=${this.getCanonicalHeaderList(canonicalHeaders)}, Signature=${signature2}`;
         return request;
       }
       async getSignature(longDate, credentialScope, keyPromise, canonicalRequest) {
@@ -35292,16 +35516,16 @@ var init_Matcher = __esm({
        * @returns {string|undefined}
        */
       getCurrentTag() {
-        const path2 = this._matcher.path;
-        return path2.length > 0 ? path2[path2.length - 1].tag : void 0;
+        const path3 = this._matcher.path;
+        return path3.length > 0 ? path3[path3.length - 1].tag : void 0;
       }
       /**
        * Get current namespace.
        * @returns {string|undefined}
        */
       getCurrentNamespace() {
-        const path2 = this._matcher.path;
-        return path2.length > 0 ? path2[path2.length - 1].namespace : void 0;
+        const path3 = this._matcher.path;
+        return path3.length > 0 ? path3[path3.length - 1].namespace : void 0;
       }
       /**
        * Get current node's attribute value.
@@ -35309,9 +35533,9 @@ var init_Matcher = __esm({
        * @returns {*}
        */
       getAttrValue(attrName) {
-        const path2 = this._matcher.path;
-        if (path2.length === 0) return void 0;
-        return path2[path2.length - 1].values?.[attrName];
+        const path3 = this._matcher.path;
+        if (path3.length === 0) return void 0;
+        return path3[path3.length - 1].values?.[attrName];
       }
       /**
        * Check if current node has an attribute.
@@ -35319,9 +35543,9 @@ var init_Matcher = __esm({
        * @returns {boolean}
        */
       hasAttr(attrName) {
-        const path2 = this._matcher.path;
-        if (path2.length === 0) return false;
-        const current = path2[path2.length - 1];
+        const path3 = this._matcher.path;
+        if (path3.length === 0) return false;
+        const current = path3[path3.length - 1];
         return current.values !== void 0 && attrName in current.values;
       }
       /**
@@ -35329,18 +35553,18 @@ var init_Matcher = __esm({
        * @returns {number}
        */
       getPosition() {
-        const path2 = this._matcher.path;
-        if (path2.length === 0) return -1;
-        return path2[path2.length - 1].position ?? 0;
+        const path3 = this._matcher.path;
+        if (path3.length === 0) return -1;
+        return path3[path3.length - 1].position ?? 0;
       }
       /**
        * Get current node's repeat counter (occurrence count of this tag name).
        * @returns {number}
        */
       getCounter() {
-        const path2 = this._matcher.path;
-        if (path2.length === 0) return -1;
-        return path2[path2.length - 1].counter ?? 0;
+        const path3 = this._matcher.path;
+        if (path3.length === 0) return -1;
+        return path3[path3.length - 1].counter ?? 0;
       }
       /**
        * Get current node's sibling index (alias for getPosition).
@@ -46253,7 +46477,7 @@ var init_node_http = __esm({
 
 // node_modules/@smithy/credential-provider-imds/dist-es/remoteProvider/httpRequest.js
 function httpRequest(options) {
-  return new Promise((resolve16, reject) => {
+  return new Promise((resolve17, reject) => {
     const req = node_http.request({
       method: "GET",
       ...options,
@@ -46278,7 +46502,7 @@ function httpRequest(options) {
         chunks.push(chunk);
       });
       res.on("end", () => {
-        resolve16(Buffer.concat(chunks));
+        resolve17(Buffer.concat(chunks));
         req.destroy();
       });
     });
@@ -46923,21 +47147,21 @@ async function writeRequestBody(httpRequest2, request, maxContinueTimeoutMs = MI
   let sendBody = true;
   if (!externalAgent && expect === "100-continue") {
     sendBody = await Promise.race([
-      new Promise((resolve16) => {
-        timeoutId = Number(timing.setTimeout(() => resolve16(true), Math.max(MIN_WAIT_TIME, maxContinueTimeoutMs)));
+      new Promise((resolve17) => {
+        timeoutId = Number(timing.setTimeout(() => resolve17(true), Math.max(MIN_WAIT_TIME, maxContinueTimeoutMs)));
       }),
-      new Promise((resolve16) => {
+      new Promise((resolve17) => {
         httpRequest2.on("continue", () => {
           timing.clearTimeout(timeoutId);
-          resolve16(true);
+          resolve17(true);
         });
         httpRequest2.on("response", () => {
           timing.clearTimeout(timeoutId);
-          resolve16(false);
+          resolve17(false);
         });
         httpRequest2.on("error", () => {
           timing.clearTimeout(timeoutId);
-          resolve16(false);
+          resolve17(false);
         });
       })
     ]);
@@ -47035,13 +47259,13 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
         return socketWarningTimestamp;
       }
       constructor(options) {
-        this.configProvider = new Promise((resolve16, reject) => {
+        this.configProvider = new Promise((resolve17, reject) => {
           if (typeof options === "function") {
             options().then((_options) => {
-              resolve16(this.resolveDefaultConfig(_options));
+              resolve17(this.resolveDefaultConfig(_options));
             }).catch(reject);
           } else {
-            resolve16(this.resolveDefaultConfig(options));
+            resolve17(this.resolveDefaultConfig(options));
           }
         });
       }
@@ -47072,7 +47296,7 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
             timing.clearTimeout(socketTimeoutId);
             timing.clearTimeout(keepAliveTimeoutId);
           };
-          const resolve16 = async (arg) => {
+          const resolve17 = async (arg) => {
             await writeRequestBodyPromise;
             clearTimeouts();
             _resolve(arg);
@@ -47106,12 +47330,12 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
             const password = request.password ?? "";
             auth = `${username}:${password}`;
           }
-          let path2 = request.path;
+          let path3 = request.path;
           if (queryString) {
-            path2 += `?${queryString}`;
+            path3 += `?${queryString}`;
           }
           if (request.fragment) {
-            path2 += `#${request.fragment}`;
+            path3 += `#${request.fragment}`;
           }
           let hostname = request.hostname ?? "";
           if (hostname[0] === "[" && hostname.endsWith("]")) {
@@ -47123,7 +47347,7 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
             headers: request.headers,
             host: hostname,
             method: request.method,
-            path: path2,
+            path: path3,
             port: request.port,
             agent,
             auth
@@ -47136,7 +47360,7 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
               headers: getTransformedHeaders(res.headers),
               body: res
             });
-            resolve16({ response: httpResponse });
+            resolve17({ response: httpResponse });
           });
           req.on("error", (err) => {
             if (NODEJS_TIMEOUT_ERROR_CODES2.includes(err.code)) {
@@ -47288,7 +47512,7 @@ var init_stream_collector2 = __esm({
       if (isReadableStreamInstance2(stream)) {
         return collectReadableStream2(stream);
       }
-      return new Promise((resolve16, reject) => {
+      return new Promise((resolve17, reject) => {
         const collector = new Collector2();
         stream.pipe(collector);
         stream.on("error", (err) => {
@@ -47298,7 +47522,7 @@ var init_stream_collector2 = __esm({
         collector.on("error", reject);
         collector.on("finish", function() {
           const bytes = new Uint8Array(Buffer.concat(this.bufferedBytes));
-          resolve16(bytes);
+          resolve17(bytes);
         });
       });
     };
@@ -47420,7 +47644,7 @@ var init_retry_wrapper = __esm({
           try {
             return await toRetry();
           } catch (e6) {
-            await new Promise((resolve16) => setTimeout(resolve16, delayMs));
+            await new Promise((resolve17) => setTimeout(resolve17, delayMs));
           }
         }
         return await toRetry();
@@ -52655,14 +52879,14 @@ var init_readableStreamHasher = __esm({
       const hash = new hashCtor();
       const hashCalculator = new HashCalculator(hash);
       readableStream.pipe(hashCalculator);
-      return new Promise((resolve16, reject) => {
+      return new Promise((resolve17, reject) => {
         readableStream.on("error", (err) => {
           hashCalculator.end();
           reject(err);
         });
         hashCalculator.on("error", reject);
         hashCalculator.on("finish", () => {
-          hash.digest().then(resolve16).catch(reject);
+          hash.digest().then(resolve17).catch(reject);
         });
       });
     };
@@ -57184,8 +57408,8 @@ var init_dist_es22 = __esm({
 });
 
 // src/cli.ts
-import { resolve as resolve15, dirname as dirname18 } from "path";
-import { readFileSync as readFileSync23 } from "fs";
+import { resolve as resolve16, dirname as dirname18 } from "path";
+import { readFileSync as readFileSync25 } from "fs";
 import { execSync } from "child_process";
 import { parse as parse3 } from "yaml";
 
@@ -57453,7 +57677,7 @@ init_http();
 import { createServer } from "http";
 import { spawn as spawn2 } from "child_process";
 import { WebSocketServer, WebSocket } from "ws";
-import { dirname as dirname17, resolve as resolve14 } from "path";
+import { dirname as dirname17, resolve as resolve15 } from "path";
 
 // src/gui/active-db.ts
 init_adapter();
@@ -57461,9 +57685,17 @@ init_members();
 init_native_entities();
 async function changeVisibleToActiveRole(db, payload) {
   if (db.getDialect() !== "postgres") return true;
-  if (payload.op === "delete" || payload.op === "DELETE") return true;
   if (!payload.table_name || !payload.pk) return false;
   try {
+    if (isDeleteOp(payload.op)) {
+      if (payload.del_owner_role == null) return false;
+      const row2 = await getAsyncOrSync(
+        db.adapter,
+        `SELECT lattice_delete_visible(?, ?, ?::text[]) AS v`,
+        [payload.del_owner_role, payload.del_visibility ?? null, payload.del_grantees ?? []]
+      );
+      return row2?.v === true || row2?.v === "t" || row2?.v === 1;
+    }
     const row = await getAsyncOrSync(db.adapter, `SELECT lattice_row_visible(?, ?) AS v`, [
       payload.table_name,
       payload.pk
@@ -58082,12 +58314,12 @@ init_postgres();
 
 // src/gui/realtime.ts
 import { EventEmitter } from "events";
-import { createRequire as createRequire2 } from "module";
+import { createRequire as createRequire3 } from "module";
 var _pgModule = null;
 function loadPg() {
   if (_pgModule) return _pgModule;
   const importMetaUrl = import.meta.url;
-  const requireFromHere = importMetaUrl ? createRequire2(importMetaUrl) : (
+  const requireFromHere = importMetaUrl ? createRequire3(importMetaUrl) : (
     // CJS fallback — Node provides `require` on every CJS module scope.
     __require
   );
@@ -58313,9 +58545,9 @@ var RealtimeBroker = class {
         () => "ended"
         // a graceful-close error is still "closed enough"
       );
-      const timedOut = new Promise((resolve16) => {
+      const timedOut = new Promise((resolve17) => {
         timer = setTimeout(() => {
-          resolve16("timeout");
+          resolve17("timeout");
         }, this.stopEndTimeoutMs);
         timer.unref?.();
       });
@@ -58360,7 +58592,10 @@ function parsePayload(raw) {
       pk: typeof obj2.pk === "string" ? obj2.pk : null,
       op: obj2.op,
       owner_role: typeof obj2.owner_role === "string" ? obj2.owner_role : null,
-      created_at: typeof obj2.created_at === "string" ? obj2.created_at : ""
+      created_at: typeof obj2.created_at === "string" ? obj2.created_at : "",
+      del_owner_role: typeof obj2.del_owner_role === "string" ? obj2.del_owner_role : null,
+      del_visibility: typeof obj2.del_visibility === "string" ? obj2.del_visibility : null,
+      del_grantees: Array.isArray(obj2.del_grantees) ? obj2.del_grantees.filter((g6) => typeof g6 === "string") : null
     };
   } catch {
     return null;
@@ -59341,9 +59576,9 @@ function startBackgroundRender(active) {
 }
 function settleWithin(p3, ms) {
   let timer;
-  const timeout = new Promise((resolve16) => {
+  const timeout = new Promise((resolve17) => {
     timer = setTimeout(() => {
-      resolve16("timeout");
+      resolve17("timeout");
     }, ms);
     timer.unref?.();
   });
@@ -59398,9 +59633,9 @@ var SWITCH_OPEN_TIMEOUT_MS = 2e4;
 async function openWithinTimeout(open, timeoutMs = SWITCH_OPEN_TIMEOUT_MS, dispose = disposeActive) {
   const opening = open();
   let timer;
-  const timedOut = new Promise((resolve16) => {
+  const timedOut = new Promise((resolve17) => {
     timer = setTimeout(() => {
-      resolve16("timeout");
+      resolve17("timeout");
     }, timeoutMs);
     timer.unref?.();
   });
@@ -59458,7 +59693,7 @@ async function applySchemaConfig(active, entry, direction, autoRender) {
   const doc = loadConfigDoc(active.configPath);
   const inv = direction === "inverse";
   const ddl = [];
-  const has = (path2) => doc.getIn(path2) !== void 0;
+  const has = (path3) => doc.getIn(path3) !== void 0;
   const reAddEntity = async (name, def) => {
     if (has(["entities", name])) {
       throw new Error(`Cannot restore "${name}": an entity with that name already exists`);
@@ -61071,6 +61306,65 @@ var chatCss = `    /* \u2500\u2500 Chat bubbles + tool pills \u2500\u2500\u2500\
     }
   `;
 
+// src/gui/app/styles/inline-import.ts
+var inlineImportCss = `
+    /* \u2500\u2500 Inline import confirm card (assistant rail) \u2500\u2500 */
+    .cd-sub { margin: 10px 0 6px; font-size: 12px; color: var(--text-muted, #9aa3ad); }
+    .cd-row { display: flex; gap: 8px; align-items: center; flex-wrap: wrap; margin-top: 8px; }
+    .cd-path {
+      flex: 1 1 220px; min-width: 0; box-sizing: border-box; height: 34px; padding: 0 10px;
+      border-radius: 6px; border: 1px solid #2a2f36;
+      background: var(--panel, #0e1116); color: var(--text, #e6e8eb); font-size: 13px;
+    }
+    .cd-status { margin-top: 12px; font-size: 13px; line-height: 1.5; }
+    .cd-status.ok { color: #bef264; }
+    .cd-status.err { color: #f87171; }
+    .cd-status a { color: var(--accent, #bef264); }
+    .cd-btn {
+      height: 34px; padding: 0 14px; border-radius: 6px; border: 1px solid #2a2f36;
+      background: transparent; color: var(--text, #e6e8eb); font-size: 13px;
+      font-weight: 600; cursor: pointer;
+    }
+    .cd-btn:hover { background: rgba(255, 255, 255, 0.06); }
+    .cd-btn.cd-primary { background: #bef264; color: #0b0d10; border-color: #bef264; }
+    .cd-btn.cd-primary:hover { filter: brightness(1.06); }
+    .cd-import-list { margin: 10px 0 0; padding-left: 18px; font-size: 13px; line-height: 1.6; }
+    .cd-import-list li { margin: 2px 0; }
+    .imp-sub { margin: 16px 0 6px; font-size: 13px; color: var(--text, #e6e8eb); }
+    .imp-modes { display: flex; flex-direction: column; gap: 8px; margin: 0 0 6px; }
+    .imp-modes label {
+      display: flex; gap: 8px; align-items: flex-start; font-size: 13px; line-height: 1.4;
+      padding: 8px 10px; border: 1px solid #2a2f36; border-radius: 6px; cursor: pointer;
+    }
+    .imp-modes label:hover { background: rgba(255, 255, 255, 0.04); }
+    .imp-modes input { margin-top: 2px; }
+    .imp-modes b { color: var(--text, #e6e8eb); }
+    .imp-percol {
+      display: flex; gap: 8px; align-items: flex-start; font-size: 13px; line-height: 1.4;
+      margin: 8px 0 0; cursor: pointer; color: var(--text-dim, #aeb6c2);
+    }
+    .imp-percol input { margin-top: 2px; }
+    .imp-match { border-left: 3px solid var(--accent, #7dd3fc); font-weight: 500; }
+    .feed-item.import-confirm .imp-confirm-body { margin-top: 4px; }
+
+    /* \u2500\u2500 Live import progress in the card's log \u2500\u2500 */
+    .feed-item.import-confirm .imp-card-log,
+    .feed-item.import-live .imp-card-log {
+      margin-top: 4px;
+      font: 12px/1.6 ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+      max-height: 200px; overflow-y: auto; color: var(--text-muted, #9aa3ad);
+    }
+    .imp-card-line { white-space: pre-wrap; word-break: break-word; }
+    .imp-card-line.imp-done { color: var(--accent, #bef264); }
+    .imp-card-line.imp-err { color: #f87171; }
+    .imp-card-line.imp-spin::after {
+      content: ''; display: inline-block; width: 10px; height: 10px; margin-left: 7px;
+      border: 2px solid currentColor; border-right-color: transparent; border-radius: 50%;
+      vertical-align: -1px; animation: imp-spin-kf 0.7s linear infinite;
+    }
+    @keyframes imp-spin-kf { to { transform: rotate(360deg); } }
+`;
+
 // src/gui/app/styles/index.ts
 var css = [
   tokensCss,
@@ -61092,7 +61386,8 @@ var css = [
   fsWorkspaceCss,
   settingsDrawerCss,
   assistantRailCss,
-  chatCss
+  chatCss,
+  inlineImportCss
 ].join("");
 
 // src/gui/app/modules/display-config.ts
@@ -68663,6 +68958,11 @@ var createDatabaseWizardJs = `    // \u2500\u2500\u2500\u2500\u2500\u2500\u2500\
       // survivor if it was a duplicate). Multi-file drops do not navigate.
       if (files.length === 1) {
         uploadFile(files[0]).then(function (j) {
+          // A structured source the server flagged as confirmable comes back with
+          // an autoImport proposal \u2014 render the inline confirm card instead of
+          // navigating to the file record. A silent import (autoImport.imported,
+          // no reason) or a plain file keeps the open-the-record behavior.
+          if (j && j.autoImport && j.autoImport.reason) { renderInlineImportCard(j.autoImport); return; }
           if (j && (j.duplicateOf || j.id)) openSearchHit('files', j.duplicateOf || j.id);
         });
         return;
@@ -68672,7 +68972,15 @@ var createDatabaseWizardJs = `    // \u2500\u2500\u2500\u2500\u2500\u2500\u2500\
       var bar = ingestProgress(files.length);
       var thunks = [];
       for (var i = 0; i < files.length; i++) {
-        (function (f) { thunks.push(function () { return uploadFile(f); }); })(files[i]);
+        (function (f) {
+          thunks.push(function () {
+            return uploadFile(f).then(function (j) {
+              // A structured source within a batch still gets its own inline
+              // confirm card (the batch as a whole does not navigate).
+              if (j && j.autoImport && j.autoImport.reason) renderInlineImportCard(j.autoImport);
+            });
+          });
+        })(files[i]);
       }
       runIngestBatch(thunks, INGEST_MAX_CONCURRENCY, bar.update).then(bar.done);
     }
@@ -68828,6 +69136,237 @@ var createDatabaseWizardJs = `    // \u2500\u2500\u2500\u2500\u2500\u2500\u2500\
   })();
   `;
 
+// src/gui/app/modules/inline-import.ts
+var inlineImportJs = `
+    // \u2500\u2500 Inline structured-source import (confirm card in the assistant rail) \u2500\u2500
+    function iiRailFeed() { return document.getElementById('rail-feed'); }
+    function iiRailEmptyGone() {
+      var e = document.getElementById('rail-empty');
+      if (e) e.parentNode && e.parentNode.removeChild(e);
+    }
+
+    // Read a newline-delimited-JSON response body, invoking onEvent(obj) per line.
+    // Self-contained on purpose \u2014 this segment must not depend on any other.
+    function iiStreamNdjson(url, payload, onEvent) {
+      fetch(url, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify(payload),
+      }).then(function (res) {
+        if (!res.body || !res.body.getReader) {
+          return res.text().then(function (t) {
+            t.split('\\n').forEach(function (line) {
+              if (line.trim()) { try { onEvent(JSON.parse(line)); } catch (e) { /* skip */ } }
+            });
+          });
+        }
+        var reader = res.body.getReader();
+        var dec = new TextDecoder();
+        var buf = '';
+        function pump() {
+          return reader.read().then(function (chunk) {
+            if (chunk.done) {
+              if (buf.trim()) { try { onEvent(JSON.parse(buf)); } catch (e) { /* skip */ } }
+              return;
+            }
+            buf += dec.decode(chunk.value, { stream: true });
+            var idx;
+            while ((idx = buf.indexOf('\\n')) >= 0) {
+              var line = buf.slice(0, idx);
+              buf = buf.slice(idx + 1);
+              if (line.trim()) { try { onEvent(JSON.parse(line)); } catch (e) { /* skip */ } }
+            }
+            return pump();
+          });
+        }
+        return pump();
+      }).catch(function (err) {
+        onEvent({ phase: 'error', message: err && err.message ? err.message : 'Request failed' });
+      });
+    }
+
+    // Render the confirm card for a structured drop the server flagged as
+    // needing confirmation. autoImport is the upload response's proposal:
+    // { reason, fileId, plan:{entities,dimensions,linkages}, views, asOf,
+    //   asOfCandidates, asOfColumns, schemaMatch, matchedCount, totalEntities }.
+    function renderInlineImportCard(autoImport) {
+      if (!autoImport || !autoImport.fileId) return;
+      var plan = autoImport.plan || {};
+      var ents = plan.entities || [];
+      var dims = plan.dimensions || [];
+      var links = plan.linkages || [];
+      var views = autoImport.views || [];
+      var candidates = autoImport.asOfCandidates || [];
+      var asOfColumns = autoImport.asOfColumns || [];
+      var schemaMatch = autoImport.schemaMatch || {};
+      var headerText = autoImport.reason === 'needs-confirm'
+        ? 'Add a dated snapshot'
+        : 'Import as a new dataset';
+
+      iiRailEmptyGone();
+      var feedEl = iiRailFeed();
+      var card = document.createElement('div');
+      card.className = 'feed-item import-confirm';
+      var icon = document.createElement('div');
+      icon.className = 'feed-icon';
+      icon.textContent = '\u2913';
+      var bodyEl = document.createElement('div');
+      bodyEl.className = 'feed-body';
+      var title = document.createElement('div');
+      title.className = 'feed-summary';
+      title.textContent = headerText;
+      bodyEl.appendChild(title);
+
+      var parts = [];
+      if (schemaMatch.isKnownDocument) {
+        parts.push('<div class="cd-status ok imp-match">Recognized as a new period of an existing document &mdash; ' +
+          schemaMatch.matchedCount + ' of ' + schemaMatch.totalEntities +
+          ' tables match what you already imported. It will be added as a dated snapshot.</div>');
+      }
+      parts.push('<div class="cd-status ok">Found ' + ents.length + ' entities, ' + dims.length +
+        ' dimensions, ' + links.length + ' links' +
+        (views.length ? ', ' + views.length + ' reconstructed views (no duplicated rows)' : '') +
+        '.</div><ul class="cd-import-list">');
+      ents.forEach(function (e) {
+        parts.push('<li><b>' + escapeHtml(e.name) + '</b> &mdash; ' + e.rowCount + ' rows, ' +
+          (e.columns ? e.columns.length : 0) + ' cols &middot; ' +
+          (e.naturalKey ? 'key ' + escapeHtml(e.naturalKey) : 'keyless') + '</li>');
+      });
+      dims.forEach(function (d) {
+        parts.push('<li><b>' + escapeHtml(d.name) + '</b> (dimension) &mdash; ' + d.distinctValues + ' values</li>');
+      });
+      views.forEach(function (v) {
+        parts.push('<li><b>' + escapeHtml(v.name) + '</b> (view of ' + escapeHtml(v.master) + ' where ' +
+          escapeHtml(v.filterColumn) + ' = ' + escapeHtml(String(v.filterValue)) + ') &mdash; ' +
+          v.matchedRows + ' rows, not duplicated</li>');
+      });
+      parts.push('</ul>');
+
+      parts.push('<h4 class="imp-sub">As of date</h4>');
+      var best = candidates[0];
+      parts.push('<p class="cd-sub">' +
+        (best ? 'Detected from ' + escapeHtml(best.evidence) + ' &mdash; edit if wrong.'
+              : 'No date found in the file or its name &mdash; set the snapshot date, or leave blank to import undated.') +
+        ' A newer file is kept as a separate dated snapshot beside the prior one.</p>');
+      parts.push('<div class="cd-row"><input class="cd-path" id="ii-asof" type="date" value="' + escapeHtml(autoImport.asOf || '') + '" aria-label="As of date" /></div>');
+      if (candidates.length > 1) {
+        parts.push('<div class="cd-sub">Other candidates: ' + candidates.slice(1, 5).map(function (c) {
+          return '<a href="#" class="ii-asof-alt" data-date="' + escapeHtml(c.date) + '" title="' + escapeHtml(c.evidence) + '">' + escapeHtml(c.date) + '</a>';
+        }).join(', ') + '</div>');
+      }
+      if (asOfColumns.length) {
+        var colOpts = asOfColumns.slice(0, 6).map(function (c) {
+          return '<option value="' + escapeHtml(c.column) + '" title="' + escapeHtml(c.evidence) + '">' +
+            escapeHtml(c.column) + ' (' + escapeHtml(c.entity) + ', ' + c.distinctDates +
+            ' date' + (c.distinctDates === 1 ? '' : 's') + ')</option>';
+        }).join('');
+        parts.push('<label class="imp-percol"><input type="checkbox" id="ii-asof-percol"> ' +
+          '<span>Date varies per row &mdash; use a date column instead (one file, many periods)</span></label>');
+        parts.push('<div class="cd-row" id="ii-asof-col-row" style="display:none"><select class="cd-path" id="ii-asof-col">' + colOpts + '</select></div>');
+      }
+
+      parts.push('<h4 class="imp-sub">What should Lattice bring in?</h4>');
+      parts.push('<div class="imp-modes">' +
+        '<label><input type="radio" name="ii-mode" value="both" checked> <span><b>Data model + contents</b> \u2014 the schema, the taxonomy, and all the rows.</span></label>' +
+        '<label><input type="radio" name="ii-mode" value="schema"> <span><b>Data model / schema only</b> \u2014 tables, dimension values, and views. No rows.</span></label>' +
+        '<label><input type="radio" name="ii-mode" value="contents"> <span><b>Contents only</b> \u2014 the rows and their links, into tables that already exist.</span></label>' +
+      '</div>');
+      parts.push('<div class="cd-row"><button class="cd-btn cd-primary" id="ii-apply" type="button">Import into Lattice</button></div>');
+      parts.push('<div class="imp-card-log" id="ii-log"></div>');
+
+      var content = document.createElement('div');
+      content.className = 'imp-confirm-body';
+      content.innerHTML = parts.join('');
+      bodyEl.appendChild(content);
+      card.appendChild(icon);
+      card.appendChild(bodyEl);
+      if (feedEl) { feedEl.appendChild(card); feedEl.scrollTop = feedEl.scrollHeight; }
+
+      content.querySelectorAll('.ii-asof-alt').forEach(function (a) {
+        a.addEventListener('click', function (e) {
+          e.preventDefault();
+          var input = document.getElementById('ii-asof');
+          if (input) input.value = a.getAttribute('data-date') || '';
+        });
+      });
+      var perCol = document.getElementById('ii-asof-percol');
+      if (perCol) perCol.addEventListener('change', function () {
+        var row = document.getElementById('ii-asof-col-row');
+        var dateEl = document.getElementById('ii-asof');
+        if (row) row.style.display = perCol.checked ? '' : 'none';
+        if (dateEl) dateEl.disabled = perCol.checked;
+      });
+
+      var applyBtn = document.getElementById('ii-apply');
+      if (applyBtn) applyBtn.addEventListener('click', function () {
+        runInlineImport(autoImport.fileId, title, content);
+      });
+    }
+
+    // POST the confirmed proposal to /api/import/apply and stream the pipeline
+    // live into the card's log. On 'done' show a success summary + refresh the
+    // Objects nav in place; on 'error' show the message.
+    function runInlineImport(fileId, title, content) {
+      var sel = content.querySelector('input[name="ii-mode"]:checked');
+      var mode = sel ? sel.value : 'both';
+      var asofEl = document.getElementById('ii-asof');
+      var asOf = asofEl ? asofEl.value : '';
+      var perColEl = document.getElementById('ii-asof-percol');
+      var colSel = document.getElementById('ii-asof-col');
+      var asOfColumn = (perColEl && perColEl.checked && colSel) ? colSel.value : '';
+      var applyBtn = document.getElementById('ii-apply');
+      if (applyBtn) applyBtn.disabled = true;
+
+      var feedEl = iiRailFeed();
+      var log = document.getElementById('ii-log');
+      function addLine(text, cls) {
+        if (!log) return null;
+        var d = document.createElement('div');
+        d.className = 'imp-card-line' + (cls ? ' ' + cls : '');
+        d.textContent = text;
+        log.appendChild(d);
+        while (log.childNodes.length > 60) log.removeChild(log.firstChild);
+        log.scrollTop = log.scrollHeight;
+        if (feedEl) feedEl.scrollTop = feedEl.scrollHeight;
+        return d;
+      }
+      title.textContent = 'Importing your data\u2026';
+      addLine('Starting\u2026');
+
+      iiStreamNdjson('/api/import/apply', { fileId: fileId, mode: mode, asOf: asOf, asOfColumn: asOfColumn }, function (evt) {
+        if (!evt) return;
+        if (evt.phase === 'done') {
+          var r = evt.result || {};
+          var rbt = r.rowsByTable || {};
+          var names = Object.keys(rbt);
+          var total = 0;
+          names.forEach(function (n) { total += (rbt[n] || 0); });
+          title.textContent = 'Imported ' + names.length + ' tables' + (mode === 'schema' ? '' : ', ' + total + ' rows');
+          var upd = addLine('Updating your objects\u2026', 'imp-spin');
+          refreshEntities().then(function () {
+            renderSidebar();
+            renderRoute();
+            var count = (state.entities && state.entities.tables) ? state.entities.tables.length : names.length;
+            if (upd) {
+              upd.className = 'imp-card-line imp-done';
+              upd.textContent = '\u2713 Done \u2014 ' + count + ' objects in your workspace';
+            }
+          }).catch(function () {
+            if (upd) {
+              upd.className = 'imp-card-line imp-err';
+              upd.textContent = 'Imported, but refreshing the view failed \u2014 reload to see your objects.';
+            }
+          });
+        } else if (evt.phase === 'error') {
+          title.textContent = 'Import failed';
+          addLine('Error: ' + (evt.message || 'import failed'), 'imp-err');
+        } else if (evt.message) {
+          addLine(evt.message);
+        }
+      });
+    }
+`;
+
 // src/gui/app/modules/index.ts
 var appJs = [
   displayConfigJs,
@@ -68856,7 +69395,8 @@ var appJs = [
   dataModelJs,
   latticeTeamsJs,
   onboardingJs,
-  createDatabaseWizardJs
+  createDatabaseWizardJs,
+  inlineImportJs
 ].join("");
 
 // src/gui/app/analytics.ts
@@ -69696,9 +70236,9 @@ function rewriteDbLine(configPath, newValue) {
 function parseSaveBody(body) {
   const type = body.type;
   if (type === "sqlite") {
-    const path2 = typeof body.path === "string" && body.path.trim() ? body.path.trim() : "";
-    if (!path2) return null;
-    return { type: "sqlite", path: path2 };
+    const path3 = typeof body.path === "string" && body.path.trim() ? body.path.trim() : "";
+    if (!path3) return null;
+    return { type: "sqlite", path: path3 };
   }
   if (type === "postgres") {
     const label = typeof body.label === "string" && body.label.trim() ? body.label.trim() : "";
@@ -71432,16 +71972,16 @@ init_extract();
 import { statSync as statSync8 } from "fs";
 import { writeFile as writeFile2, rm } from "fs/promises";
 import { tmpdir as tmpdir2 } from "os";
-import { basename as basename10, extname as extname2, resolve as resolve10, join as join28 } from "path";
+import { basename as basename11, extname as extname2, resolve as resolve11, join as join28 } from "path";
 
 // src/ai/vision.ts
 init_llm_client();
-import { createRequire as createRequire6 } from "module";
+import { createRequire as createRequire7 } from "module";
 import { readFile as readFile8 } from "fs/promises";
 var DEFAULT_PROMPT = "Describe this image for a knowledge base in 2-4 factual sentences: what it shows, any visible text, and notable details. No preamble.";
 var MAX_DIM = 1568;
-async function describeImage(auth, path2, opts = {}) {
-  const data = (await normalizeImage(path2, opts.maxBytes ?? 14e5)).toString("base64");
+async function describeImage(auth, path3, opts = {}) {
+  const data = (await normalizeImage(path3, opts.maxBytes ?? 14e5)).toString("base64");
   const sender = opts.sender ?? defaultSender(auth);
   const text = await sender({
     media_type: "image/jpeg",
@@ -71452,8 +71992,8 @@ async function describeImage(auth, path2, opts = {}) {
   return text.trim();
 }
 var DEFAULT_PDF_PROMPT = "Read this document for a knowledge base. First transcribe its readable text, then add a 2-4 sentence factual summary of what it is and its key details. It may be a scanned/image-only PDF \u2014 read the text from the page images. No preamble.";
-async function describePdf(auth, path2, opts = {}) {
-  const buf = await readFile8(path2);
+async function describePdf(auth, path3, opts = {}) {
+  const buf = await readFile8(path3);
   const maxBytes = opts.maxBytes ?? 3e7;
   if (buf.length > maxBytes) {
     throw new Error(
@@ -71468,19 +72008,19 @@ async function describePdf(auth, path2, opts = {}) {
   });
   return text.trim();
 }
-async function normalizeImage(path2, maxBytes) {
+async function normalizeImage(path3, maxBytes) {
   const sharpMod = await import("sharp");
   const sharp = sharpMod.default;
   let quality = 80;
-  let buf = await renderJpeg(sharp, path2, quality);
+  let buf = await renderJpeg(sharp, path3, quality);
   while (buf.length > maxBytes && quality > 35) {
     quality -= 15;
-    buf = await renderJpeg(sharp, path2, quality);
+    buf = await renderJpeg(sharp, path3, quality);
   }
   return buf;
 }
-function renderJpeg(sharp, path2, quality) {
-  return sharp(path2).rotate().resize({ width: MAX_DIM, height: MAX_DIM, fit: "inside", withoutEnlargement: true }).jpeg({ quality }).toBuffer();
+function renderJpeg(sharp, path3, quality) {
+  return sharp(path3).rotate().resize({ width: MAX_DIM, height: MAX_DIM, fit: "inside", withoutEnlargement: true }).jpeg({ quality }).toBuffer();
 }
 function buildVisionAnthropicConfig(auth) {
   const config = {};
@@ -71498,7 +72038,7 @@ function buildVisionAnthropicConfig(auth) {
 function defaultSender(auth) {
   return async (input) => {
     const importMetaUrl = import.meta.url;
-    const req = importMetaUrl ? createRequire6(importMetaUrl) : __require;
+    const req = importMetaUrl ? createRequire7(importMetaUrl) : __require;
     const sdk = req("@anthropic-ai/sdk");
     const Anthropic = sdk.Anthropic ?? sdk.default;
     if (!Anthropic) throw new Error("Could not resolve Anthropic from '@anthropic-ai/sdk'");
@@ -71525,7 +72065,7 @@ function defaultSender(auth) {
 function defaultPdfSender(auth) {
   return async (input) => {
     const importMetaUrl = import.meta.url;
-    const req = importMetaUrl ? createRequire6(importMetaUrl) : __require;
+    const req = importMetaUrl ? createRequire7(importMetaUrl) : __require;
     const sdk = req("@anthropic-ai/sdk");
     const Anthropic = sdk.Anthropic ?? sdk.default;
     if (!Anthropic) throw new Error("Could not resolve Anthropic from '@anthropic-ai/sdk'");
@@ -71555,13 +72095,13 @@ import { createHash as createHash10 } from "crypto";
 import { createReadStream as createReadStream2, existsSync as existsSync25, mkdirSync as mkdirSync11, statSync as statSync7, copyFileSync as copyFileSync4 } from "fs";
 import { basename as basename9, join as join27 } from "path";
 async function hashFile(srcPath) {
-  return new Promise((resolve16, reject) => {
+  return new Promise((resolve17, reject) => {
     const hash = createHash10("sha256");
     const stream = createReadStream2(srcPath);
     stream.on("data", (chunk) => hash.update(chunk));
     stream.on("error", reject);
     stream.on("end", () => {
-      resolve16(hash.digest("hex"));
+      resolve17(hash.digest("hex"));
     });
   });
 }
@@ -71593,8 +72133,1158 @@ init_http();
 init_enrich();
 init_ingest_url();
 init_file_row();
-import { createHash as createHash11 } from "crypto";
+import { createHash as createHash12 } from "crypto";
 init_dedup_service();
+
+// src/gui/import-auto.ts
+import { readFileSync as readFileSync22 } from "fs";
+
+// src/import/infer.ts
+var SAMPLE = 300;
+var PREFERRED_KEYS = ["code", "id", "slug", "key", "ticker", "symbol"];
+var NEVER_KEY = /* @__PURE__ */ new Set([
+  "description",
+  "notes",
+  "summary",
+  "desc",
+  "comment",
+  "comments",
+  "bio",
+  "text",
+  "body"
+]);
+var FREETEXT = /* @__PURE__ */ new Set([...NEVER_KEY, "name", "title", "company", "label"]);
+var DIM_MAX_DISTINCT = 64;
+var DIM_MAX_RATIO = 0.5;
+var LINK_MIN_CONFIDENCE = 0.3;
+function isPlainObject(v2) {
+  return typeof v2 === "object" && v2 !== null && !Array.isArray(v2);
+}
+function sourceRecords(data, entity) {
+  const v2 = data[entity.sourceKey];
+  if (!Array.isArray(v2)) return [];
+  if (entity.columnar) {
+    const cols = data[entity.sourceKey + "Cols"];
+    if (!Array.isArray(cols)) return [];
+    return v2.map((row) => {
+      const o3 = {};
+      cols.forEach((c6, i6) => o3[c6] = row[i6]);
+      return o3;
+    });
+  }
+  return v2.filter(isPlainObject);
+}
+function normalizeName(key) {
+  const s2 = key.replace(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
+  if (!s2) return "field";
+  return /^[a-z]/.test(s2) ? s2 : "f_" + s2;
+}
+var ISO_DATE = /^\d{4}-\d{2}-\d{2}$/;
+var ISO_DATETIME = /^\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}/;
+function inferFieldType(values) {
+  const present = values.filter((v2) => v2 !== null && v2 !== void 0 && v2 !== "");
+  if (present.length === 0) return "text";
+  if (present.every((v2) => typeof v2 === "number")) {
+    return present.every((v2) => Number.isInteger(v2)) ? "integer" : "real";
+  }
+  if (present.every((v2) => typeof v2 === "boolean")) return "boolean";
+  if (present.every((v2) => typeof v2 === "string")) {
+    if (present.every((v2) => ISO_DATE.test(v2))) return "date";
+    if (present.every((v2) => ISO_DATETIME.test(v2))) return "datetime";
+  }
+  return "text";
+}
+function norm2(v2) {
+  return String(v2).trim().toLowerCase();
+}
+function isNumericValue(v2) {
+  if (typeof v2 === "number") return Number.isFinite(v2);
+  if (typeof v2 !== "string") return false;
+  const s2 = v2.replace(/[\s,$%()]/g, "");
+  return s2 !== "" && Number.isFinite(Number(s2));
+}
+function profileColumns(records) {
+  const keys = /* @__PURE__ */ new Set();
+  for (const r6 of records.slice(0, SAMPLE)) for (const k6 of Object.keys(r6)) keys.add(k6);
+  const out = /* @__PURE__ */ new Map();
+  for (const key of keys) {
+    let isArray = false;
+    const sample = [];
+    const valueSet = /* @__PURE__ */ new Set();
+    const distinctSet = /* @__PURE__ */ new Set();
+    let nonNull = 0;
+    let numeric = 0;
+    for (const r6 of records) {
+      const v2 = r6[key];
+      if (v2 === null || v2 === void 0 || v2 === "") continue;
+      nonNull++;
+      if (Array.isArray(v2)) {
+        isArray = true;
+        for (const e6 of v2) {
+          if (e6 !== null && e6 !== void 0 && e6 !== "") {
+            valueSet.add(norm2(e6));
+            distinctSet.add(norm2(e6));
+          }
+        }
+      } else {
+        if (sample.length < SAMPLE) sample.push(v2);
+        if (typeof v2 === "string") valueSet.add(norm2(v2));
+        distinctSet.add(norm2(v2));
+        if (isNumericValue(v2)) numeric++;
+      }
+    }
+    out.set(key, {
+      sourceKey: key,
+      isArray,
+      type: isArray ? "text" : inferFieldType(sample),
+      // Cardinality counts ALL distinct values (numbers + strings). Counting only
+      // string values let a mostly-numeric column with a few text sentinels (e.g.
+      // a "TEV/EBITDA" of numbers + "NM") look low-cardinality and slip in as a
+      // junk dimension.
+      distinct: distinctSet.size,
+      valueSet,
+      numericFraction: nonNull > 0 ? numeric / nonNull : 0
+    });
+  }
+  return out;
+}
+function pickNaturalKey(records, profiles) {
+  const n3 = records.length;
+  const isUnique = (key) => {
+    const seen = /* @__PURE__ */ new Set();
+    for (const r6 of records) {
+      const v2 = r6[key];
+      if (v2 === null || v2 === void 0 || v2 === "") return false;
+      const k6 = norm2(v2);
+      if (seen.has(k6)) return false;
+      seen.add(k6);
+    }
+    return seen.size === n3;
+  };
+  for (const pref of PREFERRED_KEYS) {
+    for (const [key, p3] of profiles) {
+      if (p3.isArray) continue;
+      if (normalizeName(key) === pref && isUnique(key)) return key;
+    }
+  }
+  for (const [key, p3] of profiles) {
+    if (p3.isArray) continue;
+    if (NEVER_KEY.has(normalizeName(key))) continue;
+    if ((p3.type === "text" || p3.type === "integer") && isUnique(key)) return key;
+  }
+  return null;
+}
+function inferSchema(data, opts = {}) {
+  const skipped = [];
+  const consumedColsKeys = /* @__PURE__ */ new Set();
+  for (const key of Object.keys(data)) {
+    const v2 = data[key];
+    const cols = data[key + "Cols"];
+    if (Array.isArray(v2) && v2.length > 0 && Array.isArray(v2[0]) && Array.isArray(cols) && cols.every((c6) => typeof c6 === "string")) {
+      consumedColsKeys.add(key + "Cols");
+    }
+  }
+  const sources = [];
+  for (const key of Object.keys(data)) {
+    if (consumedColsKeys.has(key)) continue;
+    const v2 = data[key];
+    if (!Array.isArray(v2) || v2.length === 0) {
+      skipped.push({
+        key,
+        reason: isPlainObject(v2) ? "object (derived/rollup)" : "scalar/empty (meta or derived)"
+      });
+      continue;
+    }
+    let records;
+    let columnar = false;
+    if (isPlainObject(v2[0])) {
+      records = v2.filter(isPlainObject);
+    } else if (Array.isArray(v2[0]) && Array.isArray(data[key + "Cols"])) {
+      const cols = data[key + "Cols"];
+      records = v2.map((row) => {
+        const o3 = {};
+        cols.forEach((c6, i6) => o3[c6] = row[i6]);
+        return o3;
+      });
+      columnar = true;
+    } else {
+      skipped.push({ key, reason: "array of scalars (not a record set)" });
+      continue;
+    }
+    const name = opts.rename?.[key] ?? normalizeName(key);
+    const profiles = profileColumns(records);
+    sources.push({
+      name,
+      sourceKey: key,
+      records,
+      columnar,
+      profiles,
+      naturalKey: pickNaturalKey(records, profiles)
+    });
+  }
+  const linkages = [];
+  const consumedFields = /* @__PURE__ */ new Map();
+  const linkedTargets = /* @__PURE__ */ new Map();
+  const consume = (e6, f6) => {
+    let set = consumedFields.get(e6);
+    if (!set) {
+      set = /* @__PURE__ */ new Set();
+      consumedFields.set(e6, set);
+    }
+    set.add(f6);
+  };
+  const markTarget = (e6, t8) => {
+    let set = linkedTargets.get(e6);
+    if (!set) {
+      set = /* @__PURE__ */ new Set();
+      linkedTargets.set(e6, set);
+    }
+    set.add(t8);
+  };
+  function bestTarget(self, values) {
+    if (values.size === 0) return null;
+    let best = null;
+    for (const t8 of sources) {
+      if (t8.name === self.name || !t8.naturalKey) continue;
+      const p3 = t8.profiles.get(t8.naturalKey);
+      if (!p3 || p3.valueSet.size === 0) continue;
+      let matched = 0;
+      for (const v2 of values) if (p3.valueSet.has(v2)) matched++;
+      if (matched > 0 && (best === null || matched > best.matched)) {
+        best = { target: t8, column: t8.naturalKey, matched };
+      }
+    }
+    return best;
+  }
+  for (const pass of ["array", "scalar"]) {
+    for (const e6 of sources) {
+      for (const [field, p3] of e6.profiles) {
+        if (pass === "array" ? !p3.isArray : p3.isArray) continue;
+        if (pass === "scalar") {
+          if (field === e6.naturalKey) continue;
+          if (FREETEXT.has(normalizeName(field)) || NEVER_KEY.has(normalizeName(field))) continue;
+          if (p3.type !== "text") continue;
+        }
+        if (consumedFields.get(e6.name)?.has(field)) continue;
+        const best = bestTarget(e6, p3.valueSet);
+        if (!best) continue;
+        const confidence = best.matched / p3.valueSet.size;
+        if (confidence < LINK_MIN_CONFIDENCE) continue;
+        if (linkedTargets.get(e6.name)?.has(best.target.name)) {
+          consume(e6.name, field);
+          continue;
+        }
+        const link = {
+          kind: pass === "array" ? "many-to-many" : "many-to-one",
+          fromEntity: e6.name,
+          fromField: field,
+          toEntity: best.target.name,
+          toKey: normalizeName(best.column),
+          matched: best.matched,
+          unresolved: p3.valueSet.size - best.matched,
+          confidence
+        };
+        if (pass === "array") link.junction = `${e6.name}_${best.target.name}`;
+        linkages.push(link);
+        consume(e6.name, field);
+        markTarget(e6.name, best.target.name);
+      }
+    }
+  }
+  const dimColumnNames = /* @__PURE__ */ new Map();
+  for (const e6 of sources) {
+    for (const [field, p3] of e6.profiles) {
+      if (p3.isArray || p3.type !== "text" || p3.numericFraction > 0.5) continue;
+      const nn = normalizeName(field);
+      let arr = dimColumnNames.get(nn);
+      if (!arr) {
+        arr = [];
+        dimColumnNames.set(nn, arr);
+      }
+      arr.push(e6);
+    }
+  }
+  const dimensions = [];
+  const dimByName = /* @__PURE__ */ new Map();
+  for (const e6 of sources) {
+    for (const [field, p3] of e6.profiles) {
+      if (p3.isArray || p3.type !== "text" || p3.numericFraction > 0.5) continue;
+      if (field === e6.naturalKey) continue;
+      if (consumedFields.get(e6.name)?.has(field)) continue;
+      const nn = normalizeName(field);
+      if (FREETEXT.has(nn)) continue;
+      const ratio = p3.distinct / Math.max(1, e6.records.length);
+      const sharedAcross = dimColumnNames.get(nn)?.length ?? 1;
+      const isDim = p3.distinct >= 1 && p3.distinct <= DIM_MAX_DISTINCT && (ratio <= DIM_MAX_RATIO || sharedAcross >= 2);
+      if (!isDim) continue;
+      let dim = dimByName.get(nn);
+      if (!dim) {
+        dim = { name: nn, sourceField: field, fromEntities: [], distinctValues: 0 };
+        dimByName.set(nn, dim);
+        dimensions.push(dim);
+      }
+      if (!dim.fromEntities.includes(e6.name)) dim.fromEntities.push(e6.name);
+      linkages.push({
+        kind: "dimension",
+        fromEntity: e6.name,
+        fromField: field,
+        toEntity: nn,
+        toKey: "value",
+        junction: `${e6.name}_${nn}`,
+        matched: p3.distinct,
+        unresolved: 0,
+        confidence: 1
+      });
+      consume(e6.name, field);
+    }
+  }
+  for (const dim of dimensions) {
+    const all = /* @__PURE__ */ new Set();
+    for (const name of dim.fromEntities) {
+      const e6 = sources.find((s2) => s2.name === name);
+      if (!e6) continue;
+      for (const [f6, p3] of e6.profiles) {
+        if (normalizeName(f6) === dim.name) for (const v2 of p3.valueSet) all.add(v2);
+      }
+    }
+    dim.distinctValues = all.size;
+  }
+  const entities = sources.map((e6) => {
+    const columns = [];
+    for (const [field, p3] of e6.profiles) {
+      if (p3.isArray) continue;
+      if (consumedFields.get(e6.name)?.has(field)) continue;
+      columns.push({ name: normalizeName(field), sourceKey: field, type: p3.type });
+    }
+    return {
+      name: e6.name,
+      sourceKey: e6.sourceKey,
+      columns,
+      naturalKey: e6.naturalKey ? normalizeName(e6.naturalKey) : null,
+      naturalKeySource: e6.naturalKey,
+      rowCount: e6.records.length,
+      columnar: e6.columnar
+    };
+  });
+  return { entities, dimensions, linkages, skipped };
+}
+
+// src/import/dedupe-views.ts
+init_normalize();
+var SAMPLE2 = 300;
+var VIEW_MIN_OVERLAP = 0.8;
+function buildEntityData(plan, data) {
+  return plan.entities.map((e6) => {
+    const records = sourceRecords(data, e6);
+    const colSet = /* @__PURE__ */ new Set();
+    const colSource = /* @__PURE__ */ new Map();
+    for (const r6 of records.slice(0, SAMPLE2)) {
+      for (const k6 of Object.keys(r6)) {
+        const n3 = normalizeName(k6);
+        colSet.add(n3);
+        if (!colSource.has(n3)) colSource.set(n3, k6);
+      }
+    }
+    const normRows = records.map((r6) => {
+      const o3 = {};
+      for (const k6 of Object.keys(r6)) o3[normalizeName(k6)] = r6[k6];
+      return o3;
+    });
+    return { name: e6.name, sourceKey: e6.sourceKey, cols: [...colSet], colSource, normRows };
+  });
+}
+function pickIdentity(a6, shared) {
+  let bestCol = null;
+  let bestDistinct = -1;
+  for (const c6 of shared) {
+    const vals = /* @__PURE__ */ new Set();
+    let textish = 0;
+    let total = 0;
+    for (const r6 of a6.normRows) {
+      const v2 = r6[c6];
+      if (v2 === null || v2 === void 0 || v2 === "") continue;
+      total++;
+      if (typeof v2 === "string") textish++;
+      vals.add(normalizeText(v2));
+    }
+    if (total === 0 || textish / total < 0.7) continue;
+    if (vals.size > bestDistinct) {
+      bestDistinct = vals.size;
+      bestCol = c6;
+    }
+  }
+  return bestCol;
+}
+function dedupeAndDetectViews(plan, data) {
+  const entities = buildEntityData(plan, data);
+  const views = [];
+  const asView = /* @__PURE__ */ new Set();
+  const colKeeps = [];
+  for (const a6 of entities) {
+    if (a6.cols.length < 2 || a6.normRows.length === 0) continue;
+    const tabName = normalizeText(a6.sourceKey);
+    if (!tabName) continue;
+    const aColSet = new Set(a6.cols);
+    let best = null;
+    for (const b6 of entities) {
+      if (b6.name === a6.name || asView.has(b6.name)) continue;
+      if (b6.normRows.length < a6.normRows.length) continue;
+      const bColSet = new Set(b6.cols);
+      const shared = a6.cols.filter((c6) => bColSet.has(c6));
+      if (shared.length < Math.max(2, Math.ceil(a6.cols.length * 0.5))) continue;
+      const identity = pickIdentity(a6, shared);
+      if (!identity) continue;
+      const aIds = new Set(
+        a6.normRows.map((r6) => normalizeText(r6[identity])).filter((v2) => v2 !== "")
+      );
+      if (aIds.size === 0) continue;
+      for (const disc of b6.cols) {
+        if (aColSet.has(disc)) continue;
+        const sub = b6.normRows.filter((r6) => normalizeText(r6[disc]) === tabName);
+        if (sub.length === 0) continue;
+        const bIds = new Set(sub.map((r6) => normalizeText(r6[identity])).filter((v2) => v2 !== ""));
+        let inter = 0;
+        for (const id of aIds) if (bIds.has(id)) inter++;
+        const overlap = inter / aIds.size;
+        if (overlap < VIEW_MIN_OVERLAP) continue;
+        const rawRow = sub.find((r6) => typeof r6[disc] === "string" || typeof r6[disc] === "number");
+        const raw = rawRow ? rawRow[disc] : void 0;
+        if (typeof raw !== "string" && typeof raw !== "number") continue;
+        if (best === null || overlap > best.overlap || overlap === best.overlap && b6.cols.length > best.master.cols.length) {
+          best = { master: b6, disc, value: String(raw), matched: sub.length, overlap };
+        }
+      }
+    }
+    if (!best) continue;
+    views.push({
+      name: a6.name,
+      master: best.master.name,
+      filterColumn: best.disc,
+      filterValue: best.value,
+      matchedRows: best.matched
+    });
+    asView.add(a6.name);
+    colKeeps.push({ master: best.master, col: best.disc });
+  }
+  for (const { master, col } of colKeeps) {
+    const masterEntity = plan.entities.find((e6) => e6.name === master.name);
+    if (!masterEntity || masterEntity.columns.some((c6) => c6.name === col)) continue;
+    masterEntity.columns.push({
+      name: col,
+      sourceKey: master.colSource.get(col) ?? col,
+      type: inferFieldType(master.normRows.map((r6) => r6[col]))
+    });
+  }
+  if (views.length === 0) return { plan, views };
+  const nextPlan = {
+    entities: plan.entities.filter((e6) => !asView.has(e6.name)),
+    linkages: plan.linkages.filter((l4) => !asView.has(l4.fromEntity)),
+    dimensions: plan.dimensions.map((d6) => ({ ...d6, fromEntities: d6.fromEntities.filter((n3) => !asView.has(n3)) })).filter((d6) => d6.fromEntities.length > 0),
+    skipped: plan.skipped
+  };
+  return { plan: nextPlan, views };
+}
+
+// src/import/excel.ts
+import { resolve as resolve10 } from "path";
+var HEADER_SCAN_ROWS = 25;
+function cellValue(v2) {
+  if (v2 === null || v2 === void 0) return null;
+  if (v2 instanceof Date) return v2.toISOString().slice(0, 10);
+  if (typeof v2 === "object") {
+    const o3 = v2;
+    if ("result" in o3) return cellValue(o3.result);
+    if ("text" in o3) return o3.text;
+    if ("richText" in o3 && Array.isArray(o3.richText)) {
+      return o3.richText.map((t8) => t8.text ?? "").join("");
+    }
+    return null;
+  }
+  return v2;
+}
+function isFilled(v2) {
+  return v2 !== null && v2 !== void 0 && v2 !== "";
+}
+function sheetToRecords(ws) {
+  const rowCount = ws.rowCount;
+  const colCount = ws.columnCount;
+  if (rowCount < 2 || colCount < 2) return [];
+  const nonEmpty = (r6) => {
+    let n3 = 0;
+    for (let c6 = 1; c6 <= colCount; c6++) if (isFilled(cellValue(ws.getCell(r6, c6).value))) n3++;
+    return n3;
+  };
+  const threshold = Math.max(3, Math.floor(colCount * 0.4));
+  let headerRow = -1;
+  for (let r6 = 1; r6 <= Math.min(HEADER_SCAN_ROWS, rowCount); r6++) {
+    if (nonEmpty(r6) >= threshold && r6 < rowCount && nonEmpty(r6 + 1) >= 2) {
+      headerRow = r6;
+      break;
+    }
+  }
+  if (headerRow < 0) return [];
+  const cols = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (let c6 = 1; c6 <= colCount; c6++) {
+    const hv = cellValue(ws.getCell(headerRow, c6).value);
+    if (!isFilled(hv)) continue;
+    const base = String(hv).replace(/\s+/g, " ").trim();
+    if (!base) continue;
+    let name = base;
+    let i6 = 2;
+    while (seen.has(name)) name = base + " " + String(i6++);
+    seen.add(name);
+    cols.push({ c: c6, name });
+  }
+  if (cols.length === 0) return [];
+  const records = [];
+  for (let r6 = headerRow + 1; r6 <= rowCount; r6++) {
+    const row = {};
+    let any = false;
+    for (const { c: c6, name } of cols) {
+      const v2 = cellValue(ws.getCell(r6, c6).value);
+      if (isFilled(v2)) {
+        row[name] = v2;
+        any = true;
+      }
+    }
+    if (!any) break;
+    const first = cols[0] ? row[cols[0].name] : void 0;
+    if (typeof first === "string" && /^total\b/i.test(first.trim())) continue;
+    records.push(row);
+  }
+  return records;
+}
+var preambleCache = /* @__PURE__ */ new Map();
+function excelPreambleText(absPath) {
+  return preambleCache.get(resolve10(absPath)) ?? "";
+}
+function sheetPreamble(ws) {
+  const lines = [];
+  const rowCount = Math.min(10, ws.rowCount);
+  const colCount = Math.min(8, ws.columnCount);
+  for (let r6 = 1; r6 <= rowCount; r6++) {
+    const cells = [];
+    for (let c6 = 1; c6 <= colCount; c6++) {
+      const v2 = cellValue(ws.getCell(r6, c6).value);
+      if (isFilled(v2)) cells.push(String(v2));
+    }
+    if (cells.length) lines.push(cells.join(" "));
+  }
+  return lines.join("\n");
+}
+async function excelToRecords(absPath) {
+  let mod;
+  try {
+    mod = await import("exceljs");
+  } catch {
+    throw new Error(
+      'Reading Excel files needs the "exceljs" package \u2014 install it with: npm install exceljs'
+    );
+  }
+  const ExcelJS = mod.default ?? mod;
+  const wb = new ExcelJS.Workbook();
+  await wb.xlsx.readFile(absPath);
+  const out = {};
+  const preamble = [];
+  const props = wb.properties;
+  if (props?.title) preamble.push(props.title);
+  for (const ws of wb.worksheets) {
+    preamble.push(ws.name, sheetPreamble(ws));
+    const records = sheetToRecords(ws);
+    if (records.length > 0) out[ws.name] = records;
+  }
+  preambleCache.set(resolve10(absPath), preamble.filter(Boolean).join("\n"));
+  return out;
+}
+
+// src/import/match.ts
+var BOOKKEEPING = /* @__PURE__ */ new Set(["id", "as_of", "content_key", "deleted_at"]);
+var MATCH_THRESHOLD = 0.6;
+function signature(columns) {
+  const out = /* @__PURE__ */ new Set();
+  for (const c6 of columns) {
+    const n3 = normalizeName(c6);
+    if (!n3 || BOOKKEEPING.has(n3) || n3.endsWith("_id")) continue;
+    out.add(n3);
+  }
+  return out;
+}
+function containment(a6, b6) {
+  if (a6.size === 0) return 0;
+  let hit = 0;
+  for (const c6 of a6) if (b6.has(c6)) hit++;
+  return hit / a6.size;
+}
+function matchSchemaToExisting(existing, plan) {
+  const ex = existing.map((t8) => ({ name: t8.name, sig: signature(t8.columns) }));
+  const matches = [];
+  const rename = {};
+  for (const ent of plan.entities) {
+    const sig = signature(ent.columns.map((c6) => c6.name));
+    if (sig.size === 0) continue;
+    let best = null;
+    for (const t8 of ex) {
+      if (normalizeName(t8.name) === normalizeName(ent.name)) {
+        best = { name: t8.name, overlap: 1 };
+        break;
+      }
+      const overlap = containment(sig, t8.sig);
+      if (overlap > (best?.overlap ?? 0)) best = { name: t8.name, overlap };
+    }
+    if (best && best.overlap >= MATCH_THRESHOLD) {
+      matches.push({ from: ent.name, to: best.name, overlap: best.overlap });
+      if (best.name !== ent.name) rename[ent.name] = best.name;
+    }
+  }
+  const totalEntities = plan.entities.length;
+  const matchedCount = matches.length;
+  const isKnownDocument = totalEntities > 0 && matchedCount >= Math.ceil(totalEntities / 2);
+  return { matches, rename, matchedCount, totalEntities, isKnownDocument };
+}
+function renameEntities(plan, views, rename) {
+  if (Object.keys(rename).length === 0) return { plan, views };
+  const r6 = (n3) => rename[n3] ?? n3;
+  return {
+    plan: {
+      ...plan,
+      entities: plan.entities.map((e6) => ({ ...e6, name: r6(e6.name) })),
+      dimensions: plan.dimensions.map((d6) => ({ ...d6, fromEntities: d6.fromEntities.map(r6) })),
+      linkages: plan.linkages.map((l4) => ({
+        ...l4,
+        fromEntity: r6(l4.fromEntity),
+        toEntity: r6(l4.toEntity),
+        ...l4.junction ? { junction: l4.junction } : {}
+      }))
+    },
+    views: views.map((v2) => ({ ...v2, name: r6(v2.name), master: r6(v2.master) }))
+  };
+}
+
+// src/import/materialize.ts
+init_parser();
+import { createHash as createHash11 } from "crypto";
+import { existsSync as existsSync26 } from "fs";
+init_normalize();
+
+// src/import/asof.ts
+var MONTHS2 = {
+  jan: 1,
+  january: 1,
+  feb: 2,
+  february: 2,
+  mar: 3,
+  march: 3,
+  apr: 4,
+  april: 4,
+  may: 5,
+  jun: 6,
+  june: 6,
+  jul: 7,
+  july: 7,
+  aug: 8,
+  august: 8,
+  sep: 9,
+  sept: 9,
+  september: 9,
+  oct: 10,
+  october: 10,
+  nov: 11,
+  november: 11,
+  dec: 12,
+  december: 12
+};
+var ASOF_KEYWORDS = /\b(as[ -]?of|as at|period (?:end(?:ed|ing)?|of)|fye|fiscal year end(?:ed|ing)?|year[ -]?end(?:ed|ing)?|quarter[ -]?end(?:ed|ing)?|valuation date|report(?:ing)? date|effective date|dated)\b/i;
+function isoFrom(y2, m4, d6) {
+  if (m4 < 1 || m4 > 12 || d6 < 1 || d6 > 31) return null;
+  if (y2 < 2010 || y2 > 2099) return null;
+  return `${String(y2)}-${String(m4).padStart(2, "0")}-${String(d6).padStart(2, "0")}`;
+}
+function findDates(text) {
+  const hits = [];
+  const push = (date2, match, index) => {
+    if (date2) hits.push({ date: date2, match, index });
+  };
+  for (const m4 of text.matchAll(/(20\d{2})[-._/](\d{1,2})[-._/](\d{1,2})/g)) {
+    push(isoFrom(Number(m4[1]), Number(m4[2]), Number(m4[3])), m4[0], m4.index);
+  }
+  for (const m4 of text.matchAll(/(\d{1,2})[-._/](\d{1,2})[-._/](\d{2,4})/g)) {
+    let y2 = Number(m4[3]);
+    if (y2 < 100) y2 += 2e3;
+    push(isoFrom(y2, Number(m4[1]), Number(m4[2])), m4[0], m4.index);
+  }
+  for (const m4 of text.matchAll(/([A-Za-z]{3,9})\.?\s+(\d{1,2})(?:st|nd|rd|th)?,?\s+(20\d{2})/g)) {
+    const mon = MONTHS2[(m4[1] ?? "").toLowerCase()];
+    if (mon) push(isoFrom(Number(m4[3]), mon, Number(m4[2])), m4[0], m4.index);
+  }
+  for (const m4 of text.matchAll(/(\d{1,2})(?:st|nd|rd|th)?\s+([A-Za-z]{3,9})\.?,?\s+(20\d{2})/g)) {
+    const mon = MONTHS2[(m4[2] ?? "").toLowerCase()];
+    if (mon) push(isoFrom(Number(m4[3]), mon, Number(m4[1])), m4[0], m4.index);
+  }
+  return hits;
+}
+function parseCellDate(value) {
+  if (value instanceof Date) {
+    return isoFrom(value.getUTCFullYear(), value.getUTCMonth() + 1, value.getUTCDate());
+  }
+  if (typeof value === "string") return findDates(value)[0]?.date ?? null;
+  return null;
+}
+function scanText(text, label) {
+  if (!text) return [];
+  const out = [];
+  for (const hit of findDates(text)) {
+    const before = text.slice(Math.max(0, hit.index - 40), hit.index);
+    const keyworded = ASOF_KEYWORDS.test(before) || ASOF_KEYWORDS.test(hit.match);
+    const snippet = text.slice(Math.max(0, hit.index - 24), hit.index + hit.match.length + 4).replace(/\s+/g, " ").trim();
+    out.push({
+      date: hit.date,
+      source: "content",
+      confidence: keyworded ? 0.95 : 0.7,
+      evidence: `${label}: "${snippet}"`
+    });
+  }
+  return out;
+}
+function scanFilename(fileName) {
+  if (!fileName) return [];
+  const base = fileName.replace(/\.[A-Za-z0-9]+$/, "");
+  return findDates(base).map((hit, i6, all) => ({
+    date: hit.date,
+    source: "filename",
+    confidence: i6 === all.length - 1 ? 0.6 : 0.45,
+    evidence: `file name: "${hit.match}"`
+  }));
+}
+function detectAsOfCandidates(inputs) {
+  const all = [];
+  for (const t8 of inputs.texts ?? []) all.push(...scanText(t8.text, t8.label));
+  if (inputs.fileName) all.push(...scanFilename(inputs.fileName));
+  const byDate = /* @__PURE__ */ new Map();
+  for (const c6 of all) {
+    const prev = byDate.get(c6.date);
+    if (!prev || c6.confidence > prev.confidence) byDate.set(c6.date, c6);
+  }
+  return [...byDate.values()].sort((a6, b6) => b6.confidence - a6.confidence);
+}
+
+// src/import/materialize.ts
+function coerce2(v2, type) {
+  if (v2 === null || v2 === void 0 || v2 === "") return null;
+  if (type === "boolean") return v2 === true || v2 === "true" || v2 === 1 ? 1 : 0;
+  return v2;
+}
+function contentKey(record) {
+  const parts = Object.keys(record).sort().map((k6) => k6 + "=" + JSON.stringify(record[k6] ?? null));
+  return createHash11("sha256").update(parts.join("|")).digest("hex");
+}
+function persistTable(configPath, name, fields) {
+  if (!configPath || !existsSync26(configPath)) return;
+  try {
+    const doc = loadConfigDoc(configPath);
+    doc.setIn(["entities", name], { fields, outputFile: name.toUpperCase() + ".md" });
+    saveConfigDoc(configPath, doc);
+  } catch {
+  }
+}
+async function materializeImport(ctx, data, plan, views = [], opts = {}) {
+  const { db, configPath } = ctx;
+  const mode = opts.mode ?? "both";
+  const doSchema = mode === "schema" || mode === "both";
+  const doContents = mode === "contents" || mode === "both";
+  const asOf = opts.asOf?.trim() ? opts.asOf.trim() : null;
+  const asOfColumn = opts.asOfColumn?.trim() ? opts.asOfColumn.trim() : null;
+  const dated = asOf !== null || asOfColumn !== null;
+  const asOfSourceKey = (entity) => asOfColumn ? entity.columns.find((c6) => c6.name === asOfColumn)?.sourceKey ?? null : null;
+  const rowAsOf = (entity, record) => {
+    const sk = asOfSourceKey(entity);
+    if (sk) {
+      const d6 = parseCellDate(record[sk]);
+      if (d6) return d6;
+    }
+    return asOf;
+  };
+  const recordKey = (entity, record) => {
+    const a6 = rowAsOf(entity, record);
+    return a6 ? contentKey({ ...record, __as_of: a6 }) : contentKey(record);
+  };
+  const scopedKey = (a6, keyVal) => (a6 ?? "") + "|" + normalizeText(keyVal);
+  const report = async (p3) => {
+    await opts.onProgress?.(p3);
+  };
+  const tablesCreated = [];
+  const rowsByTable = {};
+  const links = [];
+  const viewResults = [];
+  const byName = new Map(plan.entities.map((e6) => [e6.name, e6]));
+  for (const entity of plan.entities) {
+    const keyless = entity.naturalKey === null;
+    const columns = { id: "TEXT PRIMARY KEY" };
+    const fieldTypes = {};
+    const cfgFields = { id: { type: "uuid", primaryKey: true } };
+    for (const c6 of entity.columns) {
+      columns[c6.name] = fieldToSqliteBaseType(c6.type);
+      fieldTypes[c6.name] = c6.type;
+      cfgFields[c6.name] = { type: c6.type };
+    }
+    const needsContentKey = keyless || dated;
+    if (needsContentKey) {
+      columns.content_key = "TEXT";
+      cfgFields.content_key = { type: "text" };
+    }
+    if (dated) {
+      columns.as_of = "TEXT";
+      cfgFields.as_of = { type: "text" };
+    }
+    columns.deleted_at = "TEXT";
+    cfgFields.deleted_at = { type: "text" };
+    if (!db.getRegisteredTableNames().includes(entity.name)) tablesCreated.push(entity.name);
+    await db.defineLate(entity.name, { columns, fieldTypes, primaryKey: "id" });
+    persistTable(configPath, entity.name, cfgFields);
+    await report({
+      phase: "entities",
+      table: entity.name,
+      message: `Created table ${entity.name}`
+    });
+    if (doContents) {
+      const records = sourceRecords(data, entity);
+      const rows = records.map((r6) => {
+        const row = {};
+        for (const c6 of entity.columns) row[c6.name] = coerce2(r6[c6.sourceKey], c6.type);
+        if (needsContentKey) row.content_key = recordKey(entity, r6);
+        if (dated) row.as_of = rowAsOf(entity, r6);
+        return row;
+      });
+      await db.seed({
+        data: rows,
+        table: entity.name,
+        naturalKey: dated ? "content_key" : entity.naturalKey ?? "content_key"
+      });
+      const n3 = await db.count(entity.name);
+      rowsByTable[entity.name] = n3;
+      await report({
+        phase: "entities",
+        table: entity.name,
+        count: n3,
+        message: `Loaded ${String(n3)} rows into ${entity.name}`
+      });
+    }
+  }
+  for (const dim of plan.dimensions) {
+    if (!db.getRegisteredTableNames().includes(dim.name)) tablesCreated.push(dim.name);
+    await db.defineLate(dim.name, {
+      columns: { id: "TEXT PRIMARY KEY", value: "TEXT", deleted_at: "TEXT" },
+      fieldTypes: { value: "text" },
+      primaryKey: "id"
+    });
+    persistTable(configPath, dim.name, {
+      id: { type: "uuid", primaryKey: true },
+      value: { type: "text" },
+      deleted_at: { type: "text" }
+    });
+    if (doSchema) {
+      const values = /* @__PURE__ */ new Map();
+      for (const ename of dim.fromEntities) {
+        const ent = byName.get(ename);
+        if (!ent) continue;
+        const records = sourceRecords(data, ent);
+        const first = records[0];
+        const srcKey = first ? Object.keys(first).find((k6) => normalizeName(k6) === dim.name) : void 0;
+        if (!srcKey) continue;
+        for (const r6 of records) {
+          const v2 = r6[srcKey];
+          if (typeof v2 !== "string" && typeof v2 !== "number") continue;
+          const key = normalizeText(v2);
+          if (key !== "" && !values.has(key)) values.set(key, String(v2));
+        }
+      }
+      await db.seed({
+        data: [...values.values()].map((value) => ({ value })),
+        table: dim.name,
+        naturalKey: "value"
+      });
+      const n3 = await db.count(dim.name);
+      rowsByTable[dim.name] = n3;
+      await report({
+        phase: "dimensions",
+        table: dim.name,
+        count: n3,
+        message: `Dimension ${dim.name}: ${String(n3)} values`
+      });
+    }
+  }
+  const idMapCache = /* @__PURE__ */ new Map();
+  async function idMap(table, keyCol, datedTarget) {
+    const cacheKey = table + ":" + keyCol + ":" + (datedTarget ? "D" : "");
+    const cached = idMapCache.get(cacheKey);
+    if (cached) return cached;
+    const map = /* @__PURE__ */ new Map();
+    for (const r6 of await db.query(table)) {
+      const k6 = r6[keyCol];
+      if (k6 === null || k6 === void 0) continue;
+      const mapKey = datedTarget ? scopedKey(r6.as_of, k6) : normalizeText(k6);
+      map.set(mapKey, String(r6.id));
+    }
+    idMapCache.set(cacheKey, map);
+    return map;
+  }
+  for (const link of plan.linkages) {
+    const from = byName.get(link.fromEntity);
+    if (!from) continue;
+    const jName = link.junction ?? `${link.fromEntity}_${link.toEntity}`;
+    const fromFk = `${link.fromEntity}_id`;
+    const toFk = `${link.toEntity}_id`;
+    const jCols = {
+      id: "TEXT PRIMARY KEY",
+      [fromFk]: "TEXT",
+      [toFk]: "TEXT"
+    };
+    const jCfg = {
+      id: { type: "uuid", primaryKey: true },
+      [fromFk]: { type: "uuid", ref: link.fromEntity },
+      [toFk]: { type: "uuid", ref: link.toEntity }
+    };
+    if (dated) {
+      jCols.as_of = "TEXT";
+      jCfg.as_of = { type: "text" };
+    }
+    if (!db.getRegisteredTableNames().includes(jName)) tablesCreated.push(jName);
+    await db.defineLate(jName, { columns: jCols, primaryKey: "id" });
+    persistTable(configPath, jName, jCfg);
+    if (!doContents) continue;
+    const fromKeyCol = from.naturalKey ?? "content_key";
+    const toIsEntity = byName.has(link.toEntity);
+    const fromMap = await idMap(link.fromEntity, fromKeyCol, dated);
+    const toMap = await idMap(link.toEntity, link.toKey, toIsEntity && dated);
+    const seen = /* @__PURE__ */ new Set();
+    for (const r6 of await db.query(jName)) {
+      seen.add(String(r6[fromFk]) + "|" + String(r6[toFk]));
+    }
+    const unresolved = /* @__PURE__ */ new Set();
+    let created = 0;
+    for (const record of sourceRecords(data, from)) {
+      const a6 = rowAsOf(from, record);
+      const fromKeyVal = from.naturalKey === null ? recordKey(from, record) : record[from.naturalKeySource ?? ""];
+      const fromId = fromMap.get(dated ? scopedKey(a6, fromKeyVal) : normalizeText(fromKeyVal));
+      if (!fromId) continue;
+      const raw = record[link.fromField];
+      const refs = Array.isArray(raw) ? raw : [raw];
+      for (const ref of refs) {
+        if (ref === null || ref === void 0 || ref === "") continue;
+        const toId = toMap.get(toIsEntity && dated ? scopedKey(a6, ref) : normalizeText(ref));
+        if (!toId) {
+          unresolved.add(normalizeText(ref));
+          continue;
+        }
+        const edge = fromId + "|" + toId;
+        if (seen.has(edge)) continue;
+        seen.add(edge);
+        await db.insert(
+          jName,
+          dated ? { [fromFk]: fromId, [toFk]: toId, as_of: a6 } : { [fromFk]: fromId, [toFk]: toId }
+        );
+        created++;
+      }
+    }
+    rowsByTable[jName] = created;
+    links.push({ junction: jName, created, unresolved: unresolved.size });
+    await report({
+      phase: "links",
+      table: jName,
+      count: created,
+      message: `Linked ${String(created)} ${jName}`
+    });
+  }
+  if (doSchema) {
+    for (const v2 of views) {
+      const filt = v2.filterValue.replace(/'/g, "''");
+      await execSql(db, `DROP VIEW IF EXISTS "${v2.name}"`);
+      await execSql(
+        db,
+        `CREATE VIEW "${v2.name}" AS SELECT * FROM "${v2.master}" WHERE "${v2.filterColumn}" = '${filt}'`
+      );
+      const cols = await db.introspectColumns(v2.name);
+      await db.defineLate(v2.name, {
+        columns: Object.fromEntries(cols.map((c6) => [c6, "TEXT"])),
+        render: () => ""
+      });
+      if (!tablesCreated.includes(v2.name)) tablesCreated.push(v2.name);
+      const rows = await db.count(v2.name);
+      rowsByTable[v2.name] = rows;
+      viewResults.push({ name: v2.name, master: v2.master, rows });
+      await report({
+        phase: "views",
+        table: v2.name,
+        count: rows,
+        message: `View ${v2.name}: ${String(rows)} rows`
+      });
+    }
+  }
+  await report({ phase: "done", message: "Import complete" });
+  return { mode, asOf, asOfColumn, tablesCreated, rowsByTable, links, views: viewResults };
+}
+
+// src/gui/import-auto.ts
+init_native_entities();
+
+// src/gui/import-detect.ts
+import { basename as basename10 } from "path";
+
+// src/gui/ai/asof-llm.ts
+init_assistant_routes();
+init_chat();
+var MAX_CHARS = 6e3;
+var SYSTEM = 'You extract the single "as of" / report / snapshot / period-end date from the text of a data file (a financial statement, track record, export, etc.). Reply with ONLY that date as ISO YYYY-MM-DD, or the exact word NONE if the text has no such date. Output nothing else \u2014 no prose, no quotes.';
+function parseLlmDate(reply) {
+  if (!reply) return null;
+  const m4 = /(20\d{2})-(\d{2})-(\d{2})/.exec(reply);
+  if (!m4) return null;
+  const y2 = Number(m4[1]);
+  const mo = Number(m4[2]);
+  const d6 = Number(m4[3]);
+  if (mo < 1 || mo > 12 || d6 < 1 || d6 > 31 || y2 < 2010 || y2 > 2099) return null;
+  return `${String(y2)}-${String(mo).padStart(2, "0")}-${String(d6).padStart(2, "0")}`;
+}
+async function asOfFromLlm(db, text) {
+  const trimmed = text.trim();
+  if (!trimmed) return null;
+  try {
+    const auth = await resolveClaudeAuth(db);
+    if (!auth) return null;
+    const client = createAnthropicClient(auth);
+    const result = await client.runTurn({
+      model: DEFAULT_MODEL2,
+      system: SYSTEM,
+      temperature: 0,
+      tools: [],
+      messages: [{ role: "user", content: `File text:
+${trimmed.slice(0, MAX_CHARS)}` }],
+      onText: () => {
+      }
+    });
+    const date2 = parseLlmDate(result.text);
+    return date2 ? { date: date2, source: "llm", confidence: 0.85, evidence: "Claude read the file" } : null;
+  } catch (e6) {
+    console.warn("[import] as-of LLM fallback failed:", e6.message);
+    return null;
+  }
+}
+
+// src/gui/import-detect.ts
+async function detectImportAsOf(db, data, opts = {}) {
+  const fileName = opts.fileName ?? (opts.abs ? basename10(opts.abs).replace(/^[0-9a-f]{8}-/, "") : "");
+  const texts = [];
+  for (const [k6, v2] of Object.entries(data)) {
+    if (!Array.isArray(v2)) texts.push({ label: "data", text: `${k6}: ${JSON.stringify(v2)}` });
+  }
+  if (opts.abs && /\.xlsx?$/i.test(opts.abs)) {
+    const pre = excelPreambleText(opts.abs);
+    if (pre) texts.push({ label: "title", text: pre });
+  }
+  let candidates = detectAsOfCandidates({ fileName, texts });
+  if (!candidates[0] || candidates[0].confidence < 0.7) {
+    const llm = await asOfFromLlm(db, texts.map((t8) => t8.text).join("\n"));
+    if (llm) candidates = [...candidates, llm].sort((a6, b6) => b6.confidence - a6.confidence);
+  }
+  return candidates;
+}
+
+// src/import/asof-columns.ts
+var STRONG_NAME = /(as[_ -]?of|as[_ -]?at|report(?:ing)?[_ -]?date|valuation[_ -]?date|effective[_ -]?date|period[_ -]?end|snapshot[_ -]?date|statement[_ -]?date|fye)/i;
+var WEAK_NAME = /(^|_)(date|period|quarter|asof)($|_)/i;
+function detectAsOfColumns(data, plan) {
+  const out = [];
+  for (const entity of plan.entities) {
+    const records = sourceRecords(data, entity);
+    if (records.length < 2) continue;
+    for (const col of entity.columns) {
+      const strong = STRONG_NAME.test(col.name);
+      const weak = WEAK_NAME.test(col.name);
+      if (!strong && !weak) continue;
+      const vals = records.map((r6) => r6[col.sourceKey]).filter((v2) => v2 !== null && v2 !== void 0 && v2 !== "");
+      if (vals.length < Math.max(3, Math.floor(records.length * 0.5))) continue;
+      const dates = vals.map(parseCellDate).filter((d6) => d6 !== null);
+      if (dates.length / vals.length < 0.8) continue;
+      const distinctDates = new Set(dates).size;
+      const typed = col.type === "date" || col.type === "datetime";
+      let confidence = strong ? 0.9 : 0.6;
+      if (typed) confidence += 0.03;
+      if (distinctDates > 1) confidence += 0.04;
+      out.push({
+        entity: entity.name,
+        column: col.name,
+        confidence: Math.min(confidence, 0.97),
+        distinctDates,
+        evidence: `column "${col.name}" \u2014 ${String(distinctDates)} distinct date${distinctDates === 1 ? "" : "s"} across ${String(vals.length)} rows`
+      });
+    }
+  }
+  return out.sort((a6, b6) => b6.confidence - a6.confidence);
+}
+
+// src/gui/import-auto.ts
+function existingDataTables(db) {
+  const native = new Set(NATIVE_ENTITY_NAMES);
+  const out = [];
+  for (const t8 of db.getRegisteredTableNames()) {
+    if (native.has(t8)) continue;
+    const columns = Object.keys(db.getRegisteredColumns(t8) ?? {});
+    if (columns.length > 0) out.push({ name: t8, columns });
+  }
+  return out;
+}
+async function readStructured(abs, name) {
+  if (/\.xlsx?$/i.test(name)) return excelToRecords(abs);
+  return JSON.parse(readFileSync22(abs, "utf8"));
+}
+async function autoImportStructured(db, configPath, abs, name) {
+  if (!/\.(xlsx?|json)$/i.test(name)) return null;
+  let data;
+  try {
+    data = await readStructured(abs, name);
+  } catch {
+    return null;
+  }
+  const { plan: inferredPlan, views: inferredViews } = dedupeAndDetectViews(
+    inferSchema(data),
+    data
+  );
+  if (inferredPlan.entities.length === 0) return null;
+  const schemaMatch = matchSchemaToExisting(existingDataTables(db), inferredPlan);
+  const asOfCandidates = await detectImportAsOf(db, data, { abs, fileName: name });
+  const asOf = asOfCandidates[0]?.date ?? null;
+  const asOfColumns = detectAsOfColumns(data, inferredPlan);
+  const proposal = {
+    plan: inferredPlan,
+    views: inferredViews,
+    asOfCandidates,
+    asOfColumns,
+    schemaMatch,
+    matchedCount: schemaMatch.matchedCount,
+    totalEntities: schemaMatch.totalEntities,
+    tables: [],
+    rows: 0
+  };
+  if (!schemaMatch.isKnownDocument) {
+    return { imported: false, reason: "new-dataset", asOf, ...proposal };
+  }
+  if (!asOf) {
+    return { imported: false, reason: "needs-confirm", asOf: null, ...proposal };
+  }
+  const { plan, views } = renameEntities(inferredPlan, inferredViews, schemaMatch.rename);
+  const result = await materializeImport({ db, configPath }, data, plan, views, { asOf });
+  const rows = Object.values(result.rowsByTable).reduce((a6, b6) => a6 + b6, 0);
+  return {
+    imported: true,
+    asOf,
+    matchedCount: schemaMatch.matchedCount,
+    totalEntities: schemaMatch.totalEntities,
+    tables: Object.keys(result.rowsByTable),
+    rows
+  };
+}
+
+// src/gui/ingest-routes.ts
 var MIME_BY_EXT = {
   ".pdf": "application/pdf",
   ".png": "image/png",
@@ -71696,28 +73386,28 @@ ${err.stack ?? ""}`
     return null;
   }
 }
-async function extractImage(db, path2, mime) {
+async function extractImage(db, path3, mime) {
   if (!mime.startsWith("image/")) return null;
   const auth = await resolveClaudeAuth(db);
   if (!auth) return null;
   try {
-    const text = await describeImage(auth, path2);
+    const text = await describeImage(auth, path3);
     return text.trim() ? { text, skip: false } : null;
   } catch (e6) {
     console.warn("[ingest] image vision failed:", e6.message);
     return null;
   }
 }
-async function extractSource(db, path2, mime, name) {
-  const vision = await extractImage(db, path2, mime);
+async function extractSource(db, path3, mime, name) {
+  const vision = await extractImage(db, path3, mime);
   if (vision) return vision;
-  const parsed = await parseFile(path2, mime, name);
+  const parsed = await parseFile(path3, mime, name);
   if (!parsed.skip) return parsed;
   if (mime === "application/pdf") {
     const auth = await resolveClaudeAuth(db);
     if (auth) {
       try {
-        const text = await describePdf(auth, path2);
+        const text = await describePdf(auth, path3);
         if (text.trim()) return { ...parsed, text, skip: false };
       } catch (e6) {
         console.warn("[ingest] Claude PDF read failed:", e6.message);
@@ -71730,7 +73420,6 @@ function looksLikeUrl(s2) {
   const t8 = s2.trim();
   return /^https?:\/\/\S+$/i.test(t8) && !/\s/.test(t8);
 }
-var MAX_INGEST_BYTES = 5e7;
 function readBuffer2(req, maxBytes = MAX_INGEST_BYTES) {
   return new Promise((resolve_, reject) => {
     const chunks = [];
@@ -71792,9 +73481,15 @@ async function dispatchIngestRoute(req, res, ctx) {
     const tmp = join28(tmpdir2(), `lattice-ingest-${crypto.randomUUID()}${extname2(name2)}`);
     let result;
     let blob = null;
+    let autoImport = null;
     try {
       await writeFile2(tmp, buf);
       result = await extractSource(ctx.db, tmp, mime2, name2);
+      try {
+        autoImport = await autoImportStructured(ctx.db, ctx.configPath ?? null, tmp, name2);
+      } catch (e6) {
+        console.warn("[ingest] auto-import skipped:", e6.message);
+      }
       if (ctx.latticeRoot && !realPath && shouldRetainUploadBlob(mime2, name2)) {
         try {
           const meta = await attachBlob(tmp, ctx.latticeRoot);
@@ -71810,7 +73505,7 @@ async function dispatchIngestRoute(req, res, ctx) {
     let s3Status = null;
     const s3cfg = resolveActiveS3Config(ctx.configPath);
     if (s3cfg) {
-      const sha256 = blob?.sha256 ?? createHash11("sha256").update(buf).digest("hex");
+      const sha256 = blob?.sha256 ?? createHash12("sha256").update(buf).digest("hex");
       const key = s3Key(s3cfg.prefix, sha256);
       try {
         const store = await createS3Store(s3cfg);
@@ -71833,7 +73528,7 @@ async function dispatchIngestRoute(req, res, ctx) {
       }
     }
     const fileId = crypto.randomUUID();
-    const fileSha = blob?.sha256 ?? s3Ref?.sha256 ?? createHash11("sha256").update(buf).digest("hex");
+    const fileSha = blob?.sha256 ?? s3Ref?.sha256 ?? createHash12("sha256").update(buf).digest("hex");
     const uploadRow = {
       id: fileId,
       ...fileIdentity(name2, fileId),
@@ -71871,6 +73566,7 @@ async function dispatchIngestRoute(req, res, ctx) {
       },
       forcePrivate2 ? "private" : void 0
     );
+    if (autoImport?.reason) autoImport.fileId = id2;
     try {
       const dedupCtx = {
         db: ctx.db,
@@ -71898,6 +73594,15 @@ async function dispatchIngestRoute(req, res, ctx) {
         e6 instanceof Error ? e6.message : String(e6)
       );
     }
+    if (autoImport?.imported) {
+      ctx.feed.publish({
+        table: autoImport.tables[0] ?? "files",
+        op: "insert",
+        rowId: null,
+        source: "system",
+        summary: `Imported the ${autoImport.asOf ?? ""} snapshot of "${name2}" \u2014 ${String(autoImport.rows)} rows across ${String(autoImport.tables.length)} tables`
+      });
+    }
     let suggestedLinks = [];
     if (!result.skip) {
       const links = await enrichOrFail(mctx, ctx.db, id2, result.text, name2, ctx, res, forcePrivate2);
@@ -71910,6 +73615,7 @@ async function dispatchIngestRoute(req, res, ctx) {
         id: id2,
         extraction_status: result.skip ? "skipped" : "extracted",
         suggestedLinks,
+        ...autoImport ? { autoImport } : {},
         // Present only when S3 is enabled for this workspace. 'failed' tells the
         // uploader the bytes did NOT reach the shared bucket — other members would
         // 404 until it's re-uploaded — so the GUI can warn rather than imply a
@@ -71995,7 +73701,7 @@ async function dispatchIngestRoute(req, res, ctx) {
     sendJson(res, { error: "path is required" }, 400);
     return true;
   }
-  const abs = resolve10(rawPath);
+  const abs = resolve11(rawPath);
   let size = 0;
   try {
     const st = statSync8(abs);
@@ -72012,7 +73718,7 @@ async function dispatchIngestRoute(req, res, ctx) {
     sendJson(res, { error: "file too large" }, 413);
     return true;
   }
-  const name = basename10(abs);
+  const name = basename11(abs);
   const mime = mimeFor(name);
   const localFileId = crypto.randomUUID();
   const localRow = {
@@ -72078,6 +73784,146 @@ ${err.stack ?? ""}`
   return true;
 }
 
+// src/gui/import-routes.ts
+init_adapter();
+init_http();
+import { existsSync as existsSync27, readFileSync as readFileSync23, statSync as statSync9 } from "fs";
+import { isAbsolute as isAbsolute4, join as join29 } from "path";
+init_native_entities();
+function badRequest(message) {
+  const e6 = new Error(message);
+  e6.statusCode = 400;
+  return e6;
+}
+function localPathOf2(row, latticeRoot) {
+  if (row.ref_kind === "local_ref" && row.ref_uri) return row.ref_uri;
+  if ((row.ref_kind === "blob" || row.ref_kind === "cloud_ref") && row.blob_path) {
+    return isAbsolute4(row.blob_path) ? row.blob_path : latticeRoot ? join29(latticeRoot, row.blob_path) : null;
+  }
+  return null;
+}
+function existingDataTables2(db) {
+  const native = new Set(NATIVE_ENTITY_NAMES);
+  const out = [];
+  for (const t8 of db.getRegisteredTableNames()) {
+    if (native.has(t8)) continue;
+    const columns = Object.keys(db.getRegisteredColumns(t8) ?? {});
+    if (columns.length > 0) out.push({ name: t8, columns });
+  }
+  return out;
+}
+async function readImportSourceFromFile(db, fileId, latticeRoot) {
+  const row = await getAsyncOrSync(
+    db.adapter,
+    `SELECT "id","original_name","mime","ref_kind","ref_uri","blob_path"
+       FROM "files" WHERE "id" = ? AND "deleted_at" IS NULL LIMIT 1`,
+    [fileId]
+  );
+  if (!row) throw badRequest("Unknown import file: " + fileId);
+  const path3 = localPathOf2(row, latticeRoot);
+  if (!path3 || !existsSync27(path3)) {
+    throw badRequest("The import file\u2019s bytes are not available locally.");
+  }
+  const sizeBytes = statSync9(path3).size;
+  if (sizeBytes > MAX_INGEST_BYTES) {
+    throw badRequest(
+      `The import file is too large (${String(Math.round(sizeBytes / 1e6))} MB); the limit is ${String(Math.round(MAX_INGEST_BYTES / 1e6))} MB.`
+    );
+  }
+  const name = row.original_name ?? "";
+  const mime = row.mime ?? "";
+  if (/\.xlsx?$/i.test(name) || mime.includes("spreadsheet") || mime.includes("excel")) {
+    return excelToRecords(path3);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync23(path3, "utf8"));
+  } catch {
+    throw badRequest("The import file is not valid JSON.");
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw badRequest("Expected a JSON object whose keys are record arrays.");
+  }
+  return parsed;
+}
+async function dispatchImportRoute(req, res, deps) {
+  const pathname = new URL(req.url ?? "/", "http://localhost").pathname;
+  if (req.method !== "POST" || pathname !== "/api/import/apply") return false;
+  const body = await readJson(req).catch(() => ({}));
+  const fileId = typeof body.fileId === "string" ? body.fileId : "";
+  const mode = body.mode === "schema" || body.mode === "contents" ? body.mode : "both";
+  const asOf = typeof body.asOf === "string" && /^\d{4}-\d{2}-\d{2}$/.test(body.asOf.trim()) ? body.asOf.trim() : null;
+  const asOfColumn = typeof body.asOfColumn === "string" && body.asOfColumn.trim() ? body.asOfColumn.trim() : null;
+  if (!fileId) {
+    sendJson(res, { error: "fileId is required" }, 400);
+    return true;
+  }
+  res.writeHead(200, {
+    "content-type": "application/x-ndjson; charset=utf-8",
+    "cache-control": "no-store"
+  });
+  const emit = (p3) => {
+    res.write(JSON.stringify(p3) + "\n");
+  };
+  try {
+    emit({ phase: "parse", message: "Reading source\u2026" });
+    const data = await readImportSourceFromFile(deps.db, fileId, deps.latticeRoot);
+    emit({ phase: "infer", message: "Analyzing schema\u2026" });
+    const { plan: inferredPlan, views: inferredViews } = dedupeAndDetectViews(
+      inferSchema(data),
+      data
+    );
+    emit({
+      phase: "infer",
+      message: `Found ${String(inferredPlan.entities.length)} entities, ${String(inferredPlan.dimensions.length)} dimensions, ${String(inferredPlan.linkages.length)} links`
+    });
+    const match = matchSchemaToExisting(existingDataTables2(deps.db), inferredPlan);
+    const { plan, views } = renameEntities(inferredPlan, inferredViews, match.rename);
+    if (views.length > 0) {
+      emit({
+        phase: "detect",
+        message: `Detected ${String(views.length)} reconstructable views (no duplicated rows)`
+      });
+    }
+    if (match.isKnownDocument) {
+      emit({
+        phase: "detect",
+        message: `Recognized as a new period of an existing document \u2014 ${String(match.matchedCount)} of ${String(match.totalEntities)} tables matched`
+      });
+    }
+    if (asOfColumn) {
+      emit({ phase: "infer", message: `Dating each row by its "${asOfColumn}" column` });
+    } else if (asOf) {
+      emit({ phase: "infer", message: `Importing as a snapshot dated ${asOf}` });
+    }
+    const result = await materializeImport(
+      { db: deps.db, configPath: deps.configPath },
+      data,
+      plan,
+      views,
+      {
+        mode,
+        asOf,
+        asOfColumn,
+        onProgress: async (p3) => {
+          emit({ ...p3 });
+          await new Promise((r6) => setImmediate(r6));
+        }
+      }
+    );
+    for (const t8 of result.tablesCreated) {
+      deps.validTables.add(t8);
+      const cols = deps.db.getRegisteredColumns(t8);
+      if (cols && "deleted_at" in cols) deps.softDeletable.add(t8);
+    }
+    emit({ phase: "done", ok: true, result });
+  } catch (e6) {
+    emit({ phase: "error", message: e6.message });
+  }
+  res.end();
+  return true;
+}
+
 // src/gui/read-routes.ts
 init_http();
 init_data();
@@ -72366,7 +74212,13 @@ async function handleReadRoutes(req, res, ctx, deps) {
     return true;
   }
   if (method === "GET" && pathname === "/api/history") {
-    const limit = Number(url.searchParams.get("limit") ?? "200");
+    const limitRaw = url.searchParams.get("limit");
+    const parsedLimit = parsePageParam(limitRaw, "limit");
+    if (parsedLimit === "invalid") {
+      sendJson(res, { error: "limit must be a non-negative integer" }, 400);
+      return true;
+    }
+    const limit = limitRaw === null ? 200 : parsedLimit;
     const filterTable = url.searchParams.get("table");
     const raw = await active.db.query("_lattice_gui_audit", { limit });
     let entries = raw.map(parseAudit).sort((a6, b6) => b6.ts.localeCompare(a6.ts));
@@ -73410,8 +75262,8 @@ async function handleHistoryRoutes(req, res, ctx, deps) {
 
 // src/gui/workspaces-routes.ts
 init_http();
-import { resolve as resolve11 } from "path";
-import { existsSync as existsSync26, rmSync } from "fs";
+import { resolve as resolve12 } from "path";
+import { existsSync as existsSync28, rmSync } from "fs";
 init_workspace();
 init_lattice_root();
 init_user_config();
@@ -73419,7 +75271,7 @@ function cleanupWorkspaceFiles(root6, ws) {
   if (!ws.configPath && ws.kind === "local") {
     rmSync(workspaceDir(root6, ws.dir), { recursive: true, force: true });
   } else if (ws.kind === "cloud") {
-    if (ws.configPath && existsSync26(ws.configPath)) {
+    if (ws.configPath && existsSync28(ws.configPath)) {
       rmSync(ws.configPath, { force: true });
     }
     const labelMatch = /^\$\{LATTICE_DB:([A-Za-z0-9._-]+)\}$/.exec(ws.db.trim());
@@ -73573,7 +75425,7 @@ async function handleWorkspacesRoutes(req, res, ctx, deps) {
       return true;
     }
     const wsPaths = resolveWorkspacePaths(latticeRoot, ws);
-    const isActive = resolve11(active.configPath) === resolve11(wsPaths.configPath);
+    const isActive = resolve12(active.configPath) === resolve12(wsPaths.configPath);
     let switchedTo = null;
     if (isActive) {
       const fallback = listWorkspaces(latticeRoot).find((w2) => w2.id !== ws.id);
@@ -73622,40 +75474,40 @@ async function handleWorkspacesRoutes(req, res, ctx, deps) {
 
 // src/gui/databases-routes.ts
 init_http();
-import { basename as basename12, resolve as resolve13 } from "path";
-import { existsSync as existsSync28 } from "fs";
+import { basename as basename13, resolve as resolve14 } from "path";
+import { existsSync as existsSync30 } from "fs";
 init_parser();
 
 // src/gui/config-paths.ts
 init_parser();
-import { basename as basename11, dirname as dirname16, join as join29, resolve as resolve12 } from "path";
+import { basename as basename12, dirname as dirname16, join as join30, resolve as resolve13 } from "path";
 import {
-  existsSync as existsSync27,
+  existsSync as existsSync29,
   mkdirSync as mkdirSync12,
-  readFileSync as readFileSync22,
+  readFileSync as readFileSync24,
   readdirSync as readdirSync8,
   unlinkSync as unlinkSync5,
   writeFileSync as writeFileSync10
 } from "fs";
 import { parseDocument as parseDocument7 } from "yaml";
 function resolveOutputDirForConfig(configPath) {
-  const base = dirname16(resolve12(configPath));
+  const base = dirname16(resolve13(configPath));
   for (const dir of ["context", ".", "generated"]) {
-    const abs = resolve12(base, dir);
-    if (existsSync27(join29(abs, ".lattice", "manifest.json"))) return abs;
+    const abs = resolve13(base, dir);
+    if (existsSync29(join30(abs, ".lattice", "manifest.json"))) return abs;
   }
-  return resolve12(base, "context");
+  return resolve13(base, "context");
 }
 function friendlyConfigName(parsedName, configPath) {
   if (parsedName && parsedName.trim().length > 0) return parsedName.trim();
-  return basename11(configPath).replace(/\.(ya?ml)$/, "");
+  return basename12(configPath).replace(/\.(ya?ml)$/, "");
 }
 function listConfigs(activeConfigPath) {
   const dir = dirname16(activeConfigPath);
   const entries = [];
   for (const fname of readdirSync8(dir)) {
     if (!fname.endsWith(".yml") && !fname.endsWith(".yaml")) continue;
-    const full = join29(dir, fname);
+    const full = join30(dir, fname);
     try {
       const parsed = parseConfigFile(full);
       entries.push({
@@ -73666,7 +75518,7 @@ function listConfigs(activeConfigPath) {
         // `label` is the friendly DB name — what the user sees in the
         // dropdown + settings. Falls back to the basename when unset.
         label: friendlyConfigName(parsed.name, full),
-        dbFile: basename11(parsed.dbPath),
+        dbFile: basename12(parsed.dbPath),
         active: full === activeConfigPath,
         // `${LATTICE_DB:...}` and postgres:// configs resolve to a
         // postgres URL; everything else is a local SQLite file. This
@@ -73683,37 +75535,37 @@ function createBlankConfig(activeConfigPath, dbName) {
   const dir = dirname16(activeConfigPath);
   const slug = dbName.toLowerCase().replace(/[^a-z0-9_-]+/g, "-").replace(/^-+|-+$/g, "");
   if (!slug) throw new Error("Workspace name must contain at least one alphanumeric character");
-  const configPath = join29(dir, `${slug}.config.yml`);
-  if (existsSync27(configPath)) throw new Error(`Config already exists: ${slug}.config.yml`);
+  const configPath = join30(dir, `${slug}.config.yml`);
+  if (existsSync29(configPath)) throw new Error(`Config already exists: ${slug}.config.yml`);
   const yaml = `db: ./data/${slug}.db
 
 entities: {}
 `;
   writeFileSync10(configPath, yaml, "utf8");
-  mkdirSync12(join29(dir, "data"), { recursive: true });
+  mkdirSync12(join30(dir, "data"), { recursive: true });
   return configPath;
 }
 function sqliteFileForConfig(configPath) {
-  const dbVal = parseDocument7(readFileSync22(configPath, "utf8")).get("db");
+  const dbVal = parseDocument7(readFileSync24(configPath, "utf8")).get("db");
   const raw = (typeof dbVal === "string" ? dbVal : "").trim();
   if (!raw) return null;
   if (isPostgresUrl(raw) || raw.startsWith("${LATTICE_DB:")) return null;
   if (raw === ":memory:" || raw.startsWith("file:")) return null;
-  return resolve12(dirname16(configPath), raw);
+  return resolve13(dirname16(configPath), raw);
 }
 function deleteDatabaseFiles(targetConfigPath) {
   const sqliteFile = sqliteFileForConfig(targetConfigPath);
   unlinkSync5(targetConfigPath);
   let deletedDbFile = null;
-  if (sqliteFile && existsSync27(sqliteFile)) {
+  if (sqliteFile && existsSync29(sqliteFile)) {
     unlinkSync5(sqliteFile);
     deletedDbFile = sqliteFile;
     for (const suffix of ["-wal", "-shm", "-journal"]) {
       const sidecar = sqliteFile + suffix;
-      if (existsSync27(sidecar)) unlinkSync5(sidecar);
+      if (existsSync29(sidecar)) unlinkSync5(sidecar);
     }
   }
-  return { deletedConfig: basename11(targetConfigPath), deletedDbFile };
+  return { deletedConfig: basename12(targetConfigPath), deletedDbFile };
 }
 
 // src/gui/databases-routes.ts
@@ -73729,7 +75581,7 @@ async function handleDatabasesRoutes(req, res, ctx, deps) {
     sendJson(res, {
       current: {
         path: active.configPath,
-        dbFile: basename12(parsedActive.dbPath),
+        dbFile: basename13(parsedActive.dbPath),
         label: friendlyLabel,
         kind
       },
@@ -73743,8 +75595,8 @@ async function handleDatabasesRoutes(req, res, ctx, deps) {
       sendJson(res, { error: "path must be a string" }, 400);
       return true;
     }
-    const newPath = resolve13(body.path);
-    if (!existsSync28(newPath)) {
+    const newPath = resolve14(body.path);
+    if (!existsSync30(newPath)) {
       sendJson(res, { error: `Config not found: ${newPath}` }, 400);
       return true;
     }
@@ -73786,16 +75638,16 @@ async function handleDatabasesRoutes(req, res, ctx, deps) {
       sendJson(res, { error: "path must be a non-empty string" }, 400);
       return true;
     }
-    const target = resolve13(body.path);
+    const target = resolve14(body.path);
     const known = listConfigs(active.configPath);
-    const match = known.find((c6) => resolve13(c6.path) === target);
+    const match = known.find((c6) => resolve14(c6.path) === target);
     if (!match) {
       sendJson(res, { error: `Not a known database config: ${target}` }, 400);
       return true;
     }
     let switchedTo = null;
-    if (resolve13(active.configPath) === target) {
-      const fallback = known.find((c6) => resolve13(c6.path) !== target);
+    if (resolve14(active.configPath) === target) {
+      const fallback = known.find((c6) => resolve14(c6.path) !== target);
       if (!fallback) {
         sendJson(
           res,
@@ -73886,20 +75738,26 @@ async function listenWithPortFallback(server, startPort, host) {
   throw new Error(`No available port found starting at ${String(startPort)}`);
 }
 async function startGuiServer(options) {
-  const bootConfigPath = options.configPath ? resolve14(options.configPath) : null;
-  const bootOutputDir = options.outputDir ? resolve14(options.outputDir) : null;
+  const bootConfigPath = options.configPath ? resolve15(options.configPath) : null;
+  const bootOutputDir = options.outputDir ? resolve15(options.outputDir) : null;
   const startPort = options.port ?? 4317;
   const host = options.host ?? "127.0.0.1";
+  const isLoopbackHost2 = host === "localhost" || host === "::1" || host.startsWith("127.");
+  if (!isLoopbackHost2) {
+    console.warn(
+      `[lattice] GUI is binding to a non-loopback address (${host}); its data routes are UNAUTHENTICATED and will be reachable from the network.`
+    );
+  }
   const autoRender = options.autoRender ?? false;
   const guiVersion = options.version ?? "";
   const sessionId = crypto.randomUUID();
   let updateService = null;
   let activeRef = bootConfigPath && bootOutputDir ? await openConfig(bootConfigPath, bootOutputDir, autoRender, options.realtimeWatchdogMs) : null;
-  const latticeRoot = (bootConfigPath ? findLatticeRoot(dirname17(bootConfigPath)) : null) ?? (options.latticeRoot ? resolve14(options.latticeRoot) : null);
+  const latticeRoot = (bootConfigPath ? findLatticeRoot(dirname17(bootConfigPath)) : null) ?? (options.latticeRoot ? resolve15(options.latticeRoot) : null);
   let currentWorkspaceId = null;
   if (latticeRoot && bootConfigPath) {
     const launched = listWorkspaces(latticeRoot).find(
-      (w2) => resolve14(resolveWorkspacePaths(latticeRoot, w2).configPath) === resolve14(bootConfigPath)
+      (w2) => resolve15(resolveWorkspacePaths(latticeRoot, w2).configPath) === resolve15(bootConfigPath)
     );
     if (launched) {
       currentWorkspaceId = launched.id;
@@ -74244,6 +76102,22 @@ async function startGuiServer(options) {
               });
             }
           },
+          // ── Structured-source import (apply) ──
+          // The importer is reachable only via dropping a file in the assistant
+          // chat; this materializes the user-confirmed proposal, re-reading the
+          // file's bytes from its `fileId` (its retained blob).
+          {
+            handle: async (req2, res2) => {
+              if (!pathname.startsWith("/api/import/")) return false;
+              return await dispatchImportRoute(req2, res2, {
+                db: active.db,
+                configPath: active.configPath,
+                latticeRoot: dirname17(active.configPath),
+                validTables: active.validTables,
+                softDeletable: active.softDeletable
+              });
+            }
+          },
           // ── Files: blob serving + open-in-finder ──
           {
             handle: async (req2, res2) => {
@@ -74434,6 +76308,7 @@ ${e6.stack ?? ""}`
     server,
     port,
     url,
+    whenConverged: () => activeRef?.converged ?? Promise.resolve(),
     close: () => new Promise((resolveClose, reject) => {
       updateService?.stop();
       for (const client of wss.clients) {
@@ -74742,10 +76617,10 @@ function printHelp() {
   );
 }
 function getVersion() {
-  if (true) return "4.1.0";
+  if (true) return "4.2.1";
   try {
     const pkgPath = new URL("../package.json", import.meta.url).pathname;
-    const pkg = JSON.parse(readFileSync23(pkgPath, "utf-8"));
+    const pkg = JSON.parse(readFileSync25(pkgPath, "utf-8"));
     return pkg.version;
   } catch {
     return "unknown";
@@ -74776,10 +76651,10 @@ async function runUpdate() {
   }
 }
 function runGenerate(args) {
-  const configPath = resolve15(args.config);
+  const configPath = resolve16(args.config);
   let raw;
   try {
-    raw = readFileSync23(configPath, "utf-8");
+    raw = readFileSync25(configPath, "utf-8");
   } catch {
     console.error(`Error: cannot read config file at "${configPath}"`);
     process.exit(1);
@@ -74796,7 +76671,7 @@ function runGenerate(args) {
     process.exit(1);
   }
   const configDir2 = dirname18(configPath);
-  const outDir = resolve15(args.out);
+  const outDir = resolve16(args.out);
   try {
     const result = generateAll({ config, configDir: configDir2, outDir, scaffold: args.scaffold });
     console.log(`Generated ${String(result.filesWritten.length)} file(s):`);
@@ -74809,8 +76684,8 @@ function runGenerate(args) {
   }
 }
 async function runRender(args) {
-  const outputDir = resolve15(args.output);
-  const configPath = resolve15(args.config);
+  const outputDir = resolve16(args.output);
+  const configPath = resolve16(args.config);
   let parsed;
   try {
     parsed = parseConfigFile(configPath);
@@ -74838,7 +76713,7 @@ async function runRender(args) {
   }
 }
 async function runDoctor(args) {
-  const db = new Lattice({ config: resolve15(args.config) });
+  const db = new Lattice({ config: resolve16(args.config) });
   try {
     await db.init();
     const report = await db.diagnoseRetrieval();
@@ -74865,7 +76740,7 @@ async function runSearch(args) {
     console.error("Error: --table <table> is required for search");
     process.exit(1);
   }
-  const db = new Lattice({ config: resolve15(args.config) });
+  const db = new Lattice({ config: resolve16(args.config) });
   try {
     await db.init();
     const results = await db.hybridSearch(args.table, args.query, { topK: args.topK ?? 10 });
@@ -74897,8 +76772,8 @@ async function runSearch(args) {
   }
 }
 async function runReconcile(args, isDryRun) {
-  const outputDir = resolve15(args.output);
-  const db = new Lattice({ config: resolve15(args.config) });
+  const outputDir = resolve16(args.output);
+  const db = new Lattice({ config: resolve16(args.config) });
   try {
     await db.init();
     const start = Date.now();
@@ -74957,8 +76832,8 @@ function formatTimestamp() {
   return `${hh}:${mm}:${ss}`;
 }
 async function runWatch(args) {
-  const outputDir = resolve15(args.output);
-  const db = new Lattice({ config: resolve15(args.config) });
+  const outputDir = resolve16(args.output);
+  const db = new Lattice({ config: resolve16(args.config) });
   try {
     await db.init();
   } catch (e6) {
@@ -75027,7 +76902,7 @@ async function runGui(args) {
     if (args.root) process.env.LATTICE_ROOT = args.root;
     const boot = ensureRootForGui({
       startDir: args.root ?? process.cwd(),
-      configPath: resolve15(args.config),
+      configPath: resolve16(args.config),
       explicitConfig: args.config !== "./lattice.config.yml"
     });
     console.log(