rip-lang 3.16.1 → 3.16.2

package/README.md

@@ -38,7 +38,7 @@ get '/users/:id' ->                 # RESTful API endpoint, comma-less
 
 **What makes Rip different:**
 - **Modern output** — ES2022 with native classes, `?.`, `??`, modules
-- **New operators** — `!`, `//`, `%%`, `=~`, `|>`, `.new()`, and more
+- **New operators** — `!`, `//`, `%%`, `=~`, `.new()`, and more
 - **Reactive operators** — `:=`, `~=`, `~>` as language syntax
 - **Optional types** — `::` annotations, `type` aliases, `.d.ts` emission
 - **Zero dependencies** — everything included, even the parser generator
@@ -262,7 +262,6 @@ All use `globalThis` with `??=` — override any by redeclaring locally.
 | `[-n]` (negative index) | `arr[-1]` | Last element via `.at()` |
 | `*` (string repeat) | `"-" * 40` | String repeat via `.repeat()` |
 | `<` `<=` (chained) | `1 < x < 10` | Chained comparisons |
-| `\|>` (pipe) | `x \|> fn` or `x \|> fn(y)` | Pipe operator (first-arg insertion) |
 | `not in` | `x not in arr` | Negated membership test |
 | `not of` | `k not of obj` | Negated key existence |
 | `.=` (method assign) | `x .= trim()` | `x = x.trim()` — compound method assignment |
@@ -341,7 +340,7 @@ Status = schema
 # DB-backed model
 User = schema :model
   name!   string
-  email!# email
+  email! email @unique
   @timestamps
   @has_many Order
   beforeValidation: -> @email = @email.toLowerCase()

package/bin/rip

@@ -3,7 +3,7 @@
 import { readFileSync, readdirSync, writeFileSync, existsSync, statSync, unlinkSync, lstatSync, readlinkSync, rmSync, mkdirSync, symlinkSync, realpathSync } from 'fs';
 import { execSync, spawnSync, spawn } from 'child_process';
 import { fileURLToPath } from 'url';
-import { dirname, basename, join } from 'path';
+import { dirname, basename, join, resolve, relative } from 'path';
 import { Compiler, formatError } from '../src/compiler.js';
 // Side-effect imports — register CLI-side runtime providers. The browser
 // bundle imports a different schema loader so server-only fragments
@@ -245,12 +245,21 @@ async function main() {
       const home = process.env.HOME || process.env.USERPROFILE;
       const scopeDir = join(home, '.bun', 'install', 'global', 'node_modules', '@rip-lang');
       if (existsSync(scopeDir) && statSync(scopeDir).isDirectory()) {
-        console.log();
-        for (const name of readdirSync(scopeDir).sort()) {
-          try {
-            const pkg = JSON.parse(readFileSync(join(scopeDir, name, 'package.json'), 'utf-8'));
+        // Sort by the displayed package name (e.g. `@rip-lang/ui`,
+        // `vscode-rip`) rather than the on-disk directory entry — most
+        // entries match either way, but a package whose `name` field
+        // diverges from its directory (the VS Code extension lives in
+        // packages/vscode/ but publishes as `vscode-rip`) would
+        // otherwise sort by its directory and look misplaced.
+        const pkgs = readdirSync(scopeDir)
+          .map((name) => { try { return JSON.parse(readFileSync(join(scopeDir, name, 'package.json'), 'utf-8')); } catch { return null; } })
+          .filter(Boolean)
+          .sort((a, b) => a.name.localeCompare(b.name));
+        if (pkgs.length) {
+          console.log();
+          for (const pkg of pkgs) {
             console.log(`  ${pkg.name.padEnd(24)} ${pkg.version}`);
-          } catch {}
+          }
         }
       }
     } catch {}
@@ -291,6 +300,15 @@ async function main() {
       const name = candidate;
       const subArgs = args.slice(scriptFileIndex + 1);
 
+      // 0. Sibling subcommand in this CLI's own bin/ — works from any
+      // cwd (getRepoRoot below resolves the CWD's git checkout, which
+      // is unrelated when running `rip schema …` inside an app dir).
+      const selfSibling = join(__dirname, `rip-${name}`);
+      if (existsSync(selfSibling)) {
+        const r = spawnSync(selfSibling, subArgs, { stdio: 'inherit', env: process.env });
+        process.exit(r.status ?? 1);
+      }
+
       const repoRoot = getRepoRoot();
       if (repoRoot) {
         // 1. Repo package: bin/rip-<name>
@@ -487,8 +505,21 @@ async function main() {
     }
 
     if (showShadow) {
-      const { compileForCheck } = await import('../src/typecheck.js');
-      const entry = compileForCheck(inputFile || '<stdin>', source, new Compiler());
+      const { compileForCheck, readProjectConfig, globToRegex } = await import('../src/typecheck.js');
+      // Honor the project's `rip` config so the shadow matches what `rip
+      // check` actually does. Without `checkAll`, an unannotated file gets a
+      // `// @ts-nocheck` it wouldn't get under the project's real settings.
+      const config = readProjectConfig(inputFile ? dirname(resolve(inputFile)) : process.cwd());
+      const checkAll = config.checkAll === true;
+      // An excluded file is skipped entirely — surface that, since the shadow
+      // below reflects nocheck logic that never runs for excluded files.
+      if (inputFile && config._configDir && Array.isArray(config.exclude)) {
+        const rel = relative(config._configDir, resolve(inputFile));
+        if (config.exclude.map(globToRegex).some(p => p.test(rel)) && !quiet) {
+          console.log(`// NOTE: ${rel} matches rip.exclude — \`rip check\` skips this file entirely.\n`);
+        }
+      }
+      const entry = compileForCheck(inputFile || '<stdin>', source, new Compiler(), { checkAll });
       if (!quiet) console.log(`// == Shadow TypeScript (what \`rip check\` sees) == //\n`);
       console.log(entry.tsContent);
     }

package/bin/rip-schema

@@ -0,0 +1,175 @@
+#!/usr/bin/env bun
+//
+// rip-schema — schema evolution CLI (`rip schema …`).
+//
+//   rip schema status  [entry.rip] [--dir DIR]
+//   rip schema plan    [entry.rip]
+//   rip schema make <name> [entry.rip] [--dir DIR] [--allow-lossy] [--allow-destructive]
+//   rip schema migrate [entry.rip] [--dir DIR] [--repair]
+//
+// `entry.rip` is a file whose import registers every :model schema
+// (your models file — it may also call connect() to point the adapter
+// at the database). When omitted, conventional locations are tried.
+//
+// Database connection comes from the entry file's own connect() call,
+// or from RIP_DB_URL / RIP_DB_TOKEN for the default duckdb-harbor
+// adapter.
+//
+// Migration files are plain SQL — numbered, hand-editable, checked into
+// git (default directory: ./migrations). `make` writes them from the
+// model-vs-database diff; `migrate` applies pending ones in order and
+// records (version, name, checksum) in the `_rip_migrations` table.
+
+// Registers the .rip module loader AND the full (migration-mode) schema
+// runtime — globalThis.schema gains plan/status/make/migrate/introspect.
+import '../rip-loader.js';
+
+import { existsSync } from 'fs';
+import { resolve } from 'path';
+
+const ENTRY_CANDIDATES = [
+  'models.rip', 'api/models.rip', 'app/models.rip', 'db/models.rip', 'src/models.rip',
+];
+
+const args = process.argv.slice(2);
+const cmd = args[0];
+
+if (!cmd || cmd === '--help' || cmd === '-h') {
+  usage(0);
+} else if (!['status', 'plan', 'make', 'migrate'].includes(cmd)) {
+  console.error(`rip schema: unknown subcommand '${cmd}'\n`);
+  usage(1);
+}
+
+const rest = args.slice(1);
+const flags = {
+  dir: 'migrations',
+  allowLossy: false,
+  allowDestructive: false,
+  repair: false,
+};
+const positional = [];
+for (let i = 0; i < rest.length; i++) {
+  const a = rest[i];
+  if (a === '--dir') flags.dir = rest[++i];
+  else if (a === '--allow-lossy') flags.allowLossy = true;
+  else if (a === '--allow-destructive') flags.allowDestructive = true;
+  else if (a === '--repair') flags.repair = true;
+  else if (a.startsWith('-')) die(`unknown flag: ${a}`);
+  else positional.push(a);
+}
+
+// `make` takes a migration name first; every command takes an optional
+// models entry. Disambiguate by file existence: a positional that names
+// an existing file is the entry, anything else (for make) is the name.
+let name = null;
+let entry = null;
+for (const p of positional) {
+  if (existsSync(p) && /\.(rip|js|ts)$/.test(p)) entry = p;
+  else if (cmd === 'make' && !name) name = p;
+  else die(`unexpected argument: ${p} (no such file)`);
+}
+if (cmd === 'make' && !name) die("usage: rip schema make <name> [entry.rip] — a migration name is required");
+if (!entry) entry = ENTRY_CANDIDATES.find(c => existsSync(c)) || null;
+if (!entry) {
+  die(
+    'no models entry found. Pass one explicitly (rip schema ' + cmd + ' [name] path/to/models.rip)\n' +
+    'or create one of: ' + ENTRY_CANDIDATES.join(', '));
+}
+
+// Importing the entry registers every :model it declares (directly or
+// transitively) and runs any connect() it performs.
+await import(resolve(entry));
+
+const schema = globalThis.schema;
+if (!schema || typeof schema.plan !== 'function') {
+  die('schema runtime did not load — does the entry file declare or import any schemas?');
+}
+
+const color = (c, s) => process.stdout.isTTY ? `\x1b[${c}m${s}\x1b[0m` : s;
+const dim = (s) => color('2', s);
+const CLASS_COLOR = { safe: '32', lossy: '33', destructive: '31', blocked: '31;1' };
+const tag = (cls) => color(CLASS_COLOR[cls] || '0', `[${cls}]`);
+
+function printSteps(steps) {
+  if (!steps.length) {
+    console.log(color('32', '✓ database matches the declared models — no changes'));
+    return;
+  }
+  for (const s of steps) {
+    console.log(`${tag(s.class)} ${s.kind} ${s.table}`);
+    for (const n of s.notes) console.log(dim(`    ${n}`));
+    for (const line of s.sql) console.log(`    ${line}`);
+  }
+  const counts = {};
+  for (const s of steps) counts[s.class] = (counts[s.class] || 0) + 1;
+  console.log('\n' + Object.entries(counts).map(([k, v]) => `${v} ${k}`).join(', '));
+}
+
+try {
+  if (cmd === 'plan') {
+    printSteps(await schema.plan());
+
+  } else if (cmd === 'status') {
+    const st = await schema.status({ dir: flags.dir });
+    console.log(`applied:  ${st.applied.length ? st.applied.map(a => a.version + '_' + a.name).join(', ') : '(none)'}`);
+    console.log(`pending:  ${st.pending.length ? st.pending.map(f => f.version + '_' + f.name).join(', ') : '(none)'}`);
+    if (st.mismatched.length) {
+      console.log(color('31', `edited after apply: ${st.mismatched.join(', ')} — restore the files or migrate --repair`));
+    }
+    console.log('');
+    if (st.steps.length && !st.pending.length && (st.applied.length || st.files.length)) {
+      console.log(color('33', 'drift: the database differs from the models in ways no pending migration explains'));
+    }
+    printSteps(st.steps);
+
+  } else if (cmd === 'make') {
+    const out = await schema.make(name, {
+      dir: flags.dir,
+      allowLossy: flags.allowLossy,
+      allowDestructive: flags.allowDestructive,
+    });
+    if (!out) {
+      console.log(color('32', '✓ no changes — nothing to write'));
+    } else {
+      printSteps(out.steps);
+      console.log(`\nwrote ${out.file}`);
+      console.log(dim('review the file, then apply with: rip schema migrate'));
+    }
+
+  } else if (cmd === 'migrate') {
+    const out = await schema.migrate({ dir: flags.dir, repair: flags.repair });
+    if (!out.ran.length) console.log(color('32', '✓ no pending migrations'));
+    else for (const r of out.ran) console.log(`applied ${r}`);
+  }
+  process.exit(0);
+} catch (e) {
+  die(e?.message || String(e));
+}
+
+function usage(code) {
+  console.log(`\
+rip schema — diff declared :model schemas against the database and manage migrations.
+
+Usage:
+  rip schema status  [entry.rip] [--dir DIR]        applied / pending / drift + the current plan
+  rip schema plan    [entry.rip]                    print the classified diff (no files touched)
+  rip schema make <name> [entry.rip] [--dir DIR]    write migrations/NNNN_<name>.sql from the diff
+                     [--allow-lossy] [--allow-destructive]
+  rip schema migrate [entry.rip] [--dir DIR]        apply pending migration files in order
+                     [--repair]
+
+entry.rip       file that declares/imports every :model (default: ${ENTRY_CANDIDATES.join(' | ')})
+--dir DIR       migrations directory (default: migrations)
+--allow-lossy   include steps that may lose data on existing rows (type changes, SET NOT NULL)
+--allow-destructive   include DROP TABLE / DROP COLUMN steps
+--repair        re-record checksums for applied migrations whose files changed
+
+Connection: the entry's connect() call, or RIP_DB_URL / RIP_DB_TOKEN.`);
+  process.exit(code);
+}
+
+function die(msg) {
+  console.error(`rip schema: ${msg}`);
+  process.exit(1);
+}

package/docs/RIP-APP.md

@@ -31,6 +31,8 @@ shaped the way it is, and how to use it well.
     - [Real apps: bundles + file-based routing](#real-apps-bundles--file-based-routing)
   - [3. The subsystems](#3-the-subsystems)
     - [Stash](#stash)
+    - [Sources and render gates](#sources-and-render-gates)
+    - [createMutation](#createmutation)
     - [createResource](#createresource)
     - [Timing helpers](#timing-helpers)
     - [Components store](#components-store)
@@ -230,10 +232,97 @@ beforeunload-flush mechanism both rely on this. Apps needing
 isolated state silos should use plain `__state(...)` signals or
 namespace under different keys on `app.data`.
 
+### Sources and render gates
+
+Server data lives in the stash as **source** keys — cells that know how
+to load themselves. `app/stash.rip` becomes the app's data manifest:
+
+```rip
+import { source } from '@rip-lang/app'
+
+export stash =
+  cart: { items: [] }                                       # plain client state
+  user: source { fetch: -> User.parse(api.get!('user').json!()) }
+  products: source                                          # five minutes of freshness is plenty
+    fetch: -> Product.array.parse(api.get!('products').json!())   # validated Product[]
+    staleTime: '5 min'
+  order: source { fetch: (id:: string) -> Order.parse(api.get!("orders/#{id}").json!()) }
+```
+
+A source is **lazy** (loads on first touch, not at startup) and **not a
+promise** — it owns its in-flight load internally; its value is part of
+the stash's reactive fabric like any other key:
+
+- **Reading is reading.** An ungated read (`@app.data.user`) is honest —
+  `User | null` — and kicks the load without blocking; the null branch is
+  the skeleton branch. A gated binding (`user <~ @app.data.user` in a
+  route or layout) is loaded before the component constructs and types
+  non-null.
+- **Writing is assigning.** `@app.data.user = u` writes through to the
+  cell; every consumer updates in place. A write bumps the cell's
+  generation and aborts any in-flight load — an old fetch can never
+  clobber a newer write. `@app.data.user = null` means *invalidate*.
+- **Keyed families.** A `fetch` with a required first param is one cell
+  per key: `@app.data.order(id)` is an ungated keyed read; a route gates
+  with `order <~ @app.data.order(params.id)`. Entries live under an LRU
+  cap and revalidate like singletons.
+- **Freshness.** `staleTime` (ms, a duration string like `'5 min'`, or
+  `'forever'`) controls revalidation. The default `0` is
+  stale-while-revalidate: every gate serves the cached value instantly
+  and refetches in the background. A gate only ever *blocks* on unloaded
+  cells.
+- **Errors are never cached.** A failed initial load returns the cell to
+  unloaded (the next gate retries) and rejects the navigation into the
+  nearest `onError` boundary as `{ status, message, error, path }`. A
+  failed refetch keeps the last-good value and records the error on the
+  handle — mounted gates are never yanked (the live-binding invariant).
+- **The handle.** `app.data.source(path, key?)` returns reactive
+  `{ value, loading, error, refetch(), reset() }` for screens that render
+  *through* loading/error instead of gating.
+- **One reset.** `app.data.reset()` restores plain keys to their declared
+  defaults, unloads every source (aborting in-flight loads, clearing
+  keyed caches), and purges the persisted snapshot — signout in one call.
+- **Serialization is a projection.** `persistStash` persists plain keys
+  and skips source keys (server data is refetchable; the gate reloads on
+  restore). `app.data.peek(path)` is the non-triggering read for code
+  *about* the stash (serializers, devtools).
+- **Preloading.** Off by default; opt in with `serve({ preload: 'intent' })`
+  in the root entry. Once on, resting the pointer on (or focusing) a
+  router-owned link for ~50ms warms the gates the destination would *newly*
+  mount — a layout already mounted under the current route is skipped, so
+  hovering siblings never re-fetches shared shell data. Navigation joins
+  loads already in flight (one in-flight load per source). Sweeping past a
+  link cancels before it fires, and preload failures never surface — the
+  cell records them and navigation's own gate retries.
+
+Testing gated components needs no mocks: a write marks a cell loaded, so
+seed and construct — `app.data.user = fixtureUser`, then `new Profile(...)`.
+
+### createMutation
+
+The write-side primitive. Reads are per-key (`source`); writes are
+per-action — a mutation wraps the action and exposes reactive
+`pending` / `succeeded` / `error`. Invoke it directly with the payload
+(it *is* the action; there is no `.mutate`):
+
+```rip
+updateUser = createMutation ((data) -> User.parse(api.patch!('user', { json: data }).json!())),
+  onSuccess: (u) => @app.data.user = u           # write-back — every reader updates, no refetch
+  onError:   (e) => errors = parseApiError!(e)
+
+submit: (e) -> e.preventDefault(); updateUser(form)
+# render: the submit button reads updateUser.pending; banners read succeeded/error
+```
+
+Callbacks (and a source's `fetch:`) are plain options on a runtime call —
+nothing binds their `this`. Use `=>` for anything touching component
+members.
+
 ### createResource
 
-Async data with race protection, abort support, and reactive loading
-state.
+The standalone packaging of the same async cell, for **instance-local**
+async (a search box's per-instance results are component state, not app
+data). Same race protection, abort support, and reactive loading state.
 
 ```rip
 user = createResource ->

package/docs/RIP-DUCKDB.md

@@ -31,6 +31,7 @@ you're in the right place.
 6. [When you genuinely need to mutate a referenced indexed column](#6-when-you-genuinely-need-to-mutate)
 7. [Escape hatches](#7-escape-hatches)
 8. [Should I use DuckDB for OLTP at all?](#8-should-i-use-duckdb-for-oltp-at-all)
+9. [Transactions, sequences, and migration edges](#9-transactions-sequences-and-migration-edges)
 
 ---
 
@@ -184,7 +185,7 @@ was originally documented from:
 ```coffee
 Partner = schema :model
   name!  string
-  slug!# string
+  slug! string @unique
 
 Patient = schema :model
   mrn?       string
@@ -461,12 +462,74 @@ DuckDB is a fine fit when:
 - You want analytics queries to live in the same engine as the
   transactional data
 
+### Turning a mutation-shaped workload into an append-shaped one
+
+A workload that looks write-heavy on paper is often append-heavy in
+disguise. The standard move — shared by change feeds, event logs,
+audit trails, and sync protocols (Replicache / Zero-style) — is an
+**append-only log with a monotonic version column** beside the entity
+tables: a write appends a new row instead of mutating an indexed
+parent in place, and readers pull `WHERE version > :cursor`. This
+plays directly to DuckDB's strengths (append-heavy writes, fast
+monotonic range scans) and routes around the one real weak spot from
+§1 — in-place updates to indexed / FK rows, which an append never
+performs. The trade is the usual one for log-structured designs: the
+log grows and wants periodic compaction (prune history below the
+lowest live reader cursor, `CHECKPOINT` to flush), and "current state"
+becomes a view or materialization over the log rather than the rows
+themselves. When a write-heavy feature can be expressed this way, the
+"poor fit" case above (routinely mutating indexed identifiers) often
+stops applying — and harbor's single-port `/sql` with NDJSON streaming
+is a natural transport for serving the resulting feed.
+
 For a project where you're not sure: prototype with DuckDB, watch
 the FK behavior, and switch to PostgreSQL or SQLite if you find
 yourself reaching for the escape hatches more than once or twice.
 
 ---
 
+## 9. Transactions, sequences, and migration edges
+
+Findings from running the Rip Schema transaction and migration
+machinery against live DuckDB (via duckdb-harbor) — each one shapes
+runtime or differ behavior:
+
+**FK-referenced tables are frozen for DDL too.** The §1 rule isn't
+just about UPDATE/DELETE — most `ALTER TABLE` operations (add column,
+drop column, type changes) on a table referenced by another table's FK
+fail with `Dependency Error: Cannot alter entry "users" because there
+are entries that depend on it`. Changing such a table means recreating
+the referencing tables around it. The migration differ classifies
+these steps as **`blocked`** in `rip schema status` and refuses to
+write them into a migration file — the rebuild is a human decision.
+Unreferenced tables alter normally.
+
+**No `SAVEPOINT`.** DuckDB supports flat transactions only. A nested
+`schema.transaction!` therefore *joins* the outer transaction rather
+than creating an independently-rollbackable unit — one rollback undoes
+the whole nest. Don't design flows that need partial rollback.
+
+**Sequences are non-transactional.** `nextval()` consumed inside a
+rolled-back transaction is not returned — a failed `create!` leaves a
+gap in the `id` sequence. Gaps are normal and harmless; never write
+code that assumes ids are contiguous, and never predict "the next id"
+from the last one you saw.
+
+**Harbor sessions work in every auth mode.** Transactions ride
+duckdb-harbor's session protocol (`POST /sql/sessions/new`, then
+per-statement `session_id`). Own-session lifecycle is scoped as
+`__HARBOR_SELF__:sessions:create` / `:delete` — allowed by default for
+any caller, including unauthenticated local-dev mode
+(`harbor_serve(..., token := NULL)`), where sessions are owned by the
+synthetic `harbor.local-dev` principal. A 403 from
+`schema.transaction!` means a custom `harbor_authorization_function`
+explicitly denies the `__HARBOR_SELF__:sessions:` scope — add a branch
+matching it. (Earlier harbor versions misfiled session creation as an
+admin action; that required `RIP_DB_TOKEN` plus an admin grant and is
+the reason older notes here said transactions need a token.)
+
+---
+
 ## See also
 
 - [`docs/RIP-SCHEMA.md`](./RIP-SCHEMA.md) — the schema/ORM documentation,

package/docs/RIP-INTRO.md

@@ -78,7 +78,7 @@ Read as families, not atoms:
 |---|---|---|
 | Existence / safety | `x?` · `x ?? y` · `a?.b` · `a?.[0]` · `a?.()` · `a?[0]` · `a?(x)` · `el?.prop = v` · `?!` (presence / Houdini) · `?? throw` | Nothing-safe access and guards |
 | Dammit / await | `fetch! url` · `user.save!` · `User.find! 1` | One glyph: "call it and await" |
-| Void / required | `def process!` (suppresses implicit return) · `name! string` (required field) · `email!#` (required + unique) | Same `!` glyph, context-disambiguated |
+| Void / required | `def process!` (suppresses implicit return) · `name! string` (required field) · `email! email @unique` (required + unique) | Same `!` glyph, context-disambiguated |
 | Math | `//` floor div · `%%` true mod · `1 < x < 10` chained compare · `arr[-1]` negative index · `"-" * 40` string repeat | Math you can read |
 | Regex | `str =~ /re/` with `_[1]` captures · `str[/re/, 1]` · `///...///` heregex | Pattern matching as an expression |
 | Assignment sugar | `.=` method-assign (`x .= trim()`) · `?.=` optional-chain assign · `*>obj = {a:1}` merge-assign | "Mutate this thing" |
@@ -188,7 +188,7 @@ Status = schema
 # DB-backed model
 User = schema :model
   name!   string
-  email!# email
+  email! email @unique
   role?   "admin" | "user"
   @timestamps
   @has_many Order
@@ -363,7 +363,7 @@ A close second is **non-reactive reads due to aliasing / stash access patterns**
 | `fetch!` | dammit — call + await |
 | `def fn!` | void — suppress implicit return |
 | `name! string` | required field (in `schema` body) |
-| `email!#` | required + unique (in `schema :model` body) |
+| `email! email @unique` | required + unique (in `schema :model` body) |
 | `MAX =! 100` | readonly const |
 
 ### The `?` family
@@ -383,7 +383,7 @@ A close second is **non-reactive reads due to aliasing / stash access patterns**
 | Line form | Example |
 |---|---|
 | Field (type implicit string) | `name! 1..50` |
-| Field + modifiers | `email!# email` (required + unique) |
+| Field + modifiers | `email! email @unique` (required + unique) |
 | Field + range | `password! 8..100` |
 | Field + literal union | `sex? "M" \| "F" \| "U"` |
 | Inline field transform | `email!, -> it.email.toLowerCase()` |

package/docs/RIP-LANG.md

@@ -346,12 +346,12 @@ Multiple lines
 | `[-n]` | Negative index | `arr[-1]` | `arr.at(-1)` |
 | `*` | String repeat | `"-" * 40` | `"-".repeat(40)` |
 | `<` `<=` | Chained comparison | `1 < x < 10` | `(1 < x) && (x < 10)` |
-| `\|>` | Pipe | `x \|> fn` or `x \|> fn(y)` | `fn(x)` or `fn(x, y)` |
 | `.=` | Method assign | `x .= trim()` | `x = x.trim()` |
 | `*>` | Merge assign | `*>obj = {a: 1}` | `Object.assign(obj, {a: 1})` |
 | `not in` | Not in | `x not in arr` | Negated membership test |
 | `not of` | Not of | `k not of obj` | Negated key existence |
 | `<=>` | Two-way bind | `value <=> name` | Bidirectional reactive binding (render blocks) |
+| `<~` | Render-ready | `user <~ @app.data.user` | Load-before-render binding (component bodies) |
 | `*{ }` | Map literal | `*{/pat/: val}` | `new Map([[/pat/, val]])` |
 | `:name` | Symbol literal | `:redo` | `Symbol.for("redo")` — Ruby-style interned symbol |
 
@@ -700,32 +700,6 @@ arr[i]           # → arr[i]      — variable index
 
 Only literal negative numbers trigger the `.at()` transform. Variable indexes pass through as-is.
 
-## Pipe Operator (`|>`)
-
-Pipes a value into a function as its first argument. Chains left-to-right:
-
-```coffee
-# Simple reference — value becomes the sole argument
-5 |> double                      # → double(5)
-10 |> Math.sqrt                  # → Math.sqrt(10)
-"hello" |> console.log           # → console.log("hello")
-
-# Multi-arg — value is inserted as the FIRST argument
-5 |> add(3)                      # → add(5, 3)
-data |> filter(isActive)         # → filter(data, isActive)
-"World" |> greet("!")            # → greet("World", "!")
-
-# Chaining — reads left-to-right like a pipeline
-5 |> double |> add(1) |> console.log
-# → console.log(add(double(5), 1))
-
-# Works with dotted methods
-users |> Array.from              # → Array.from(users)
-data |> JSON.stringify(null, 2)  # → JSON.stringify(data, null, 2)
-```
-
-This is the **Elixir-style** pipe — strictly better than F#'s (which only supports bare function references) and cleaner than Hack's (which requires a `%` placeholder). No special syntax to learn; if the right side is a call, the left value goes first.
-
 ---
 
 # 4. Functions
@@ -907,6 +881,7 @@ Rip's reactive features are **language-level operators**, not library imports.
 | `:=` | State | "gets state" | Reactive state variable |
 | `~=` | Computed | "always equals" | Computed value (auto-updates) |
 | `~>` | Effect | "always calls" | Side effect on dependency change |
+| `<~` | Render-ready | "loads from" | Server-backed state, loaded before render (component bodies) |
 | `=!` | Readonly | "equals, dammit!" | Constant (`const`) |
 
 ## Reactive Behavior
@@ -968,6 +943,35 @@ ticker ~>
   -> clearInterval interval  # Cleanup function
 ```
 
+## Render-Ready State (`<~`)
+
+The fourth creation form completes the reactivity grid: `<~` binds a
+component member to a server-backed stash key (a `source` — see the
+App framework docs) and declares that the key must be **loaded before
+the component renders**. The binding is therefore non-null — no `if user`
+guards, no loading flags:
+
+```coffee
+export Profile = component
+  user <~ @app.data.user               # loaded before render → non-null
+  form := { ...user }                  # synchronous — the value is present
+  order <~ @app.data.order(params.id)  # keyed source: one cell per id
+  theme <~ @app.data.settings.theme    # subpath: loads the nearest source
+```
+
+Rules, all enforced at compile time or deterministically at mount:
+
+- `<~` is only valid at the top of a **component body**, and only in
+  routes and layouts (a reusable child takes gated values as props).
+- The right-hand side must be a literal `@app.data.…` path — the compiler
+  hoists it into a static gate-set the renderer reads before construction.
+- A keyed gate's key expression may only reference `params` / `query`.
+- The path must resolve to a `source` key — gating a plain key is an error.
+
+An **ungated** read of the same key (`user ~= @app.data.user`) is the
+progressive-rendering form: it types as `T | null`, kicks the load without
+blocking, and the null branch is the skeleton branch.
+
 ## Auto-Unwrapping
 
 Reactive variables automatically unwrap in most contexts:
@@ -1879,7 +1883,7 @@ Status = schema
 # DB-backed model with ORM and migrations
 User = schema :model
   name!   string
-  email!# email
+  email! email @unique
   @timestamps
   @has_many Order
   beforeValidation: -> @email = @email.toLowerCase()
@@ -2368,11 +2372,6 @@ Each would need design discussion before building.
   `user ~>? fetch!("/api/users/#{id}").json!` gives `user.loading`,
   `user.error`, `user.data`. Park until real-world usage shows demand.
 
-- **Pipe operator (`|>`) — Hack-style placeholder** — Currently Rip uses
-  Elixir-style first-arg insertion. A `%` placeholder for arbitrary position
-  (`data |> fn(1, %, 3)`) could be added later if needed. Current design
-  covers 95%+ of cases.
-
 ---
 
 ## Resources