rip-lang 3.16.1 → 3.16.2

package/src/schema/schema.js

@@ -56,15 +56,47 @@ export function setSchemaRuntimeProvider(fn) { _schemaRuntimeProvider = fn; }
 // Anything else at schema top level is a schema-mode-aware compile error
 // with a helpful message.
 
-const VALID_KINDS = new Set(['input', 'shape', 'model', 'mixin', 'enum']);
+const VALID_KINDS = new Set(['input', 'shape', 'model', 'mixin', 'enum', 'union']);
 const KIND_DEFAULT = 'input';
 
+// Wire-friendly built-ins the `~type` coercion marker accepts. Each has
+// a strict coercion table in the runtime (__SCHEMA_COERCERS); anything
+// else needs an explicit transform.
+const SCHEMA_COERCIBLE_TYPES = new Set(['integer', 'number', 'boolean', 'date', 'datetime']);
+
+// `~:name` — NAMED coercers from the runtime registry
+// (__schemaRegisterCoercer). @rip-lang/server registers its read()
+// validator vocabulary (id, money, ssn, phone, name, date, …) at load;
+// apps add their own. The coercer's OUTPUT type matters at compile time
+// (shadow TS + DDL), so the shipped names carry a static output-type
+// table here; unknown (custom) names type as `any` — annotate with an
+// explicit transform when you need strictness.
+const SCHEMA_NAMED_COERCER_TYPES = {
+  id: 'integer', int: 'integer', whole: 'integer',
+  float: 'number', money: 'number', money_even: 'number',
+  cents: 'integer', cents_even: 'integer',
+  bool: 'boolean', truthy: 'boolean', falsy: 'boolean',
+  json: 'json', hash: 'json', array: 'json',
+  ids: { type: 'integer', array: true },
+  // everything else in the shipped set normalizes to a string:
+  string: 'string', text: 'string', name: 'string', address: 'string',
+  date: 'string', time: 'string', time12: 'string',
+  email: 'email', state: 'string', zip: 'zip', zipplus4: 'string',
+  ssn: 'string', sex: 'string', phone: 'string', username: 'string',
+  ip: 'string', mac: 'string', url: 'url', color: 'string',
+  uuid: 'uuid', semver: 'string', slug: 'string',
+};
+
 const HOOK_NAMES = new Set([
   'beforeValidation', 'afterValidation',
   'beforeSave', 'afterSave',
   'beforeCreate', 'afterCreate',
   'beforeUpdate', 'afterUpdate',
   'beforeDestroy', 'afterDestroy',
+  // Transaction-aware hooks: fire after the outermost transaction
+  // commits / rolls back, or immediately after save/destroy when no
+  // transaction is open. See __schemaTransaction in runtime-orm.js.
+  'afterCommit', 'afterRollback',
 ]);
 
 // Positions where `schema` can legitimately start an expression.
@@ -92,7 +124,11 @@ const EXPR_START_PREV = new Set([
 export function hasSchemas(source) {
   if (typeof source !== 'string') return false;
   if (!/\bschema\b/.test(source)) return false;
-  return /(?:^|[\s=,(\[{:])schema(?:\s*:[A-Za-z_$][\w$]*|\s*\n[ \t]+\S)/m.test(source);
+  // Matches a schema declaration (`schema :kind` / `schema` + indented
+  // body) or a runtime-namespace call (`schema.transaction`). The probe
+  // is conservative: a false positive just means typecheck pays a bit
+  // more work, never wrong behavior.
+  return /(?:^|[\s=,(\[{:])schema(?:\s*:[A-Za-z_$][\w$]*|\s*\n[ \t]+\S|\.transaction\b)/m.test(source);
 }
 
 // ============================================================================
@@ -232,8 +268,20 @@ function isSchemaStart(tokens, i) {
   //   SYMBOL? then `TERMINATOR ;`   — inline body (one-liner), with field
   //                                   entries separated by more `;`
   //                                   terminators up to the newline.
+  //   SYMBOL `, on: expr` then INDENT — declaration options (per-schema
+  //                                   adapter) before the block body.
   let j = i + 1;
-  if (tokens[j]?.[0] === 'SYMBOL') j++;
+  if (tokens[j]?.[0] === 'SYMBOL') {
+    j++;
+    // `, on: expr` option tail — scan past it to the line end.
+    if (tokens[j]?.[0] === ',' &&
+        (tokens[j + 1]?.[0] === 'PROPERTY' || tokens[j + 1]?.[0] === 'IDENTIFIER') &&
+        tokens[j + 1]?.[1] === 'on') {
+      j += 2;
+      while (j < tokens.length && tokens[j][0] !== 'TERMINATOR' &&
+             tokens[j][0] !== 'INDENT') j++;
+    }
+  }
   if (tokens[j]?.[0] === 'TERMINATOR') {
     if (tokens[j][1] === ';') return true;
     j++;
@@ -257,12 +305,36 @@ function collapseSchemaAt(lexer, tokens, i, config) {
     let k = kindToken[1];
     if (!VALID_KINDS.has(k)) {
       throw schemaError(kindToken,
-        `Unknown schema kind :${k}. Expected one of :input, :shape, :model, :mixin, :enum.`);
+        `Unknown schema kind :${k}. Expected one of :input, :shape, :model, :mixin, :enum, :union.`);
     }
     kind = k;
     j++;
   }
 
+  // Declaration options: `schema :model, on: analytics` pins the model
+  // to a specific adapter (an expression evaluated at declaration time).
+  // The expression tokens are captured raw and re-emitted at codegen.
+  let adapterTokens = null;
+  if (tokens[j]?.[0] === ',' &&
+      (tokens[j + 1]?.[0] === 'PROPERTY' || tokens[j + 1]?.[0] === 'IDENTIFIER') &&
+      tokens[j + 1]?.[1] === 'on') {
+    if (kind !== 'model') {
+      throw schemaError(tokens[j + 1],
+        `'on:' (per-schema adapter) applies to :model only — :${kind} never queries a database.`);
+    }
+    let k2 = j + 2;
+    if (tokens[k2]?.[0] === ':') k2++;
+    let exprStart = k2;
+    while (k2 < tokens.length && tokens[k2][0] !== 'TERMINATOR' &&
+           tokens[k2][0] !== 'INDENT') k2++;
+    adapterTokens = tokens.slice(exprStart, k2);
+    if (!adapterTokens.length) {
+      throw schemaError(tokens[j + 1],
+        `'on:' requires an adapter expression — 'schema :model, on: analytics'.`);
+    }
+    j = k2;
+  }
+
   let bodyTokens;
   let endIdx;
   if (tokens[j]?.[0] === 'TERMINATOR' && tokens[j][1] === ';') {
@@ -289,7 +361,14 @@ function collapseSchemaAt(lexer, tokens, i, config) {
       if (tag === '(' || tag === '[' || tag === '{' ||
           tag === 'CALL_START' || tag === 'INDEX_START' || tag === 'PARAM_START') depth++;
       else if (tag === ')' || tag === ']' || tag === '}' ||
-               tag === 'CALL_END' || tag === 'INDEX_END' || tag === 'PARAM_END') depth--;
+               tag === 'CALL_END' || tag === 'INDEX_END' || tag === 'PARAM_END') {
+        depth--;
+        // A closer the body never opened belongs to the ENCLOSING
+        // expression — `Admin = User.extend(schema :shape; perms!)`
+        // ends the inline body at the call's own `)`. Leave it in the
+        // stream for the outer parser.
+        if (depth < 0) break;
+      }
       // Inline body ends at the first depth-0 newline OR at any
       // INDENT/OUTDENT — INDENT would mean the user opened a block
       // (incompatible with inline), and OUTDENT means we're exiting
@@ -355,6 +434,7 @@ function collapseSchemaAt(lexer, tokens, i, config) {
     // don't retroactively change already-parsed schemas.
     defaultMaxString: config?.defaultMaxString ?? null,
   });
+  if (adapterTokens) descriptor.adapterTokens = adapterTokens;
 
   // Replace range `[i, endIdx-1]` with `SCHEMA SCHEMA_BODY`.
   let schemaNewTok = mkToken('SCHEMA', 'schema', schemaTok);
@@ -385,6 +465,22 @@ function parseSchemaBody(kind, bodyTokens, ctx) {
     for (let line of lines) {
       parseEnumLine(line, entries);
     }
+  } else if (kind === 'union') {
+    for (let line of lines) {
+      parseUnionLine(line, entries);
+    }
+    let onCount = entries.filter(e => e.tag === 'directive' && e.name === 'on').length;
+    let members = entries.filter(e => e.tag === 'union-member');
+    if (onCount !== 1) {
+      throw schemaError({ loc: ctx.schemaLoc },
+        onCount === 0
+          ? `:union requires an '@on :field' discriminator — untagged unions are not supported.`
+          : `:union takes exactly one '@on :field' discriminator (got ${onCount}).`);
+    }
+    if (members.length < 2) {
+      throw schemaError({ loc: ctx.schemaLoc },
+        `:union needs at least two constituent schemas (got ${members.length}).`);
+    }
   } else {
     for (let line of lines) {
       parseFieldedLine(kind, line, entries, ctx);
@@ -403,6 +499,10 @@ function parseSchemaBody(kind, bodyTokens, ctx) {
           throw schemaError({ loc: e.headerLoc || e.loc },
             `:mixin schemas don't accept @ensure refinements. Move the invariant to a :shape or :model that composes this mixin.`);
         }
+        if (e.tag === 'scope' || e.tag === 'defaultScope') {
+          throw schemaError({ loc: e.headerLoc || e.loc },
+            `:mixin schemas don't accept query scopes. '@${e.tag === 'scope' ? 'scope' : 'defaultScope'}' is :model-only.`);
+        }
         if (e.tag === 'directive' && e.name !== 'mixin') {
           throw schemaError({ loc: e.loc },
             `:mixin schemas only accept '@mixin Name' directives. '@${e.name}' is not allowed.`);
@@ -418,6 +518,10 @@ function parseSchemaBody(kind, bodyTokens, ctx) {
           throw schemaError({ loc: e.headerLoc || e.loc },
             `:input schemas are fields-only. '${e.name}' is a ${e.tag}; use :shape or :model if you need behavior.`);
         }
+        if (e.tag === 'scope' || e.tag === 'defaultScope') {
+          throw schemaError({ loc: e.headerLoc || e.loc },
+            `:input schemas don't accept query scopes. '@${e.tag === 'scope' ? 'scope' : 'defaultScope'}' is :model-only.`);
+        }
         if (e.tag === 'directive' && e.name !== 'mixin') {
           throw schemaError({ loc: e.loc },
             `:input schemas only accept '@mixin Name' and '@ensure'. '@${e.name}' is not allowed.`);
@@ -432,6 +536,10 @@ function parseSchemaBody(kind, bodyTokens, ctx) {
           throw schemaError({ loc: e.headerLoc || e.loc },
             `:shape schemas don't have lifecycle hooks. '${e.name}' runs only on :model; move it or remove it.`);
         }
+        if (e.tag === 'scope' || e.tag === 'defaultScope') {
+          throw schemaError({ loc: e.headerLoc || e.loc },
+            `:shape schemas don't accept query scopes. '@${e.tag === 'scope' ? 'scope' : 'defaultScope'}' is :model-only.`);
+        }
         if (e.tag === 'directive' && e.name !== 'mixin') {
           throw schemaError({ loc: e.loc },
             `:shape schemas only accept '@mixin Name'. '@${e.name}' is :model-only.`);
@@ -513,17 +621,24 @@ function parseFieldedLine(kind, line, entries, ctx) {
     let dname = nameTok[1];
 
     // `@ensure` is a refinement directive with its own grammar — it takes
-    // either an inline `"msg", (args) -> body` or a bracketed array of
-    // those pairs. Emits one `tag: "ensure"` entry per refinement; the
-    // per-entry shape mirrors methods so compileCallableFn-style codegen
-    // can fire.
+    // either an inline `"msg"[, :field], (args) -> body` or a bracketed
+    // array of those tuples. The optional `:field` symbol attributes the
+    // failure to a specific field so form libraries can attach the error
+    // to the right input; without it the issue stays schema-wide
+    // (`field: ''`). `@ensure!` (dammit) marks ASYNC refinements — the
+    // schema becomes async-validating (parseAsync!/safeAsync!/okAsync!).
+    // Emits one `tag: "ensure"` entry per refinement; the per-entry
+    // shape mirrors methods so compileCallableFn-style codegen can fire.
     if (dname === 'ensure') {
+      let isAsync = nameTok.data?.bang === true;
       let pairs = parseEnsurePairs(argTokens, first);
       for (let p of pairs) {
         entries.push({
           tag: 'ensure',
           name: 'ensure',
           message: p.message,
+          field: p.field || null,
+          async: isAsync,
           paramTokens: p.paramTokens,
           bodyTokens: p.bodyTokens,
           loc: p.loc,
@@ -533,6 +648,49 @@ function parseFieldedLine(kind, line, entries, ctx) {
       return;
     }
 
+    // `@scope` declares a named, composable query scope — :model-only.
+    // Two forms:
+    //
+    //   @scope :active, -> @where(active: true)          (zero-arg)
+    //   @scope :since, (d) -> @where("created_at > ?", d) (parameterized)
+    //
+    // `this` inside the body is the query builder. Emits a
+    // `tag: "scope"` entry carrying the compiled fn, parallel to
+    // `@ensure`'s shape.
+    if (dname === 'scope') {
+      let parsed = parseScopeDirective(argTokens, first);
+      entries.push({
+        tag: 'scope',
+        name: parsed.name,
+        paramTokens: parsed.paramTokens,
+        bodyTokens: parsed.bodyTokens,
+        loc: first.loc,
+        headerLoc: first.loc,
+      });
+      return;
+    }
+
+    // `@defaultScope -> body` applies to every query builder unless
+    // `.unscoped()` is called. Exactly one per model (enforced at
+    // normalize time, where duplicates across mixin expansion would
+    // also surface).
+    if (dname === 'defaultScope') {
+      let parsed = parseScopeFn(stripCallWrapper(argTokens), first, '@defaultScope');
+      if (parsed.paramTokens.length) {
+        throw schemaError(first,
+          "@defaultScope takes no parameters — write '@defaultScope -> @where(...)'.");
+      }
+      entries.push({
+        tag: 'defaultScope',
+        name: 'defaultScope',
+        paramTokens: [],
+        bodyTokens: parsed.bodyTokens,
+        loc: first.loc,
+        headerLoc: first.loc,
+      });
+      return;
+    }
+
     // Pre-parse structured args so shadow-TS and runtime-codegen share
     // the same descriptor shape. Relation and mixin directives get a
     // `[{target, optional?}]` array; other directives leave `args` unset.
@@ -582,17 +740,27 @@ function parseFieldedLine(kind, line, entries, ctx) {
   let modifiers = collectModifiers(first);
   let pos = 1;
 
-  // Adjacent `!`, `#`, `?` modifier tokens. `!` and `?` are absorbed into
-  // the IDENTIFIER's data by the main lexer. `#` arrives as a standalone
-  // token because the schema commentToken exception kicks in when `#` is
-  // adjacent to an identifier. A modifier must be unspaced from the
-  // token it follows, so we check the preceding token's `.spaced` flag
+  // Adjacent `!`, `?` modifier tokens. They are absorbed into the
+  // IDENTIFIER's data by the main lexer. A modifier must be unspaced from
+  // the token it follows, so we check the preceding token's `.spaced` flag
   // (which the whitespace pass sets to true when whitespace follows).
+  //
+  // `#` used to be a third (unique) modifier; it arrives as a standalone
+  // token because the schema commentToken exception kicks in when `#` is
+  // adjacent to an identifier. Uniqueness is now a storage concern spelled
+  // `@unique` — so a leftover `#` here is a removed-syntax migration error,
+  // not a silent no-op.
   while (pos < line.length) {
     let tk = line[pos];
     let adjacent = line[pos - 1] && !line[pos - 1].spaced;
     if (!adjacent) break;
-    if (tk[0] === '#' || tk[0] === '?' || tk[0] === '!') {
+    if (tk[0] === '#') {
+      throw schemaError(tk,
+        `The '#' unique modifier was removed. Mark uniqueness with '@unique': ` +
+        `inline as '${name}! <type> @unique', or as a directive '@unique :${name}' ` +
+        `(composite: '@unique [:a, :b]').`);
+    }
+    if (tk[0] === '?' || tk[0] === '!') {
       modifiers.push(tk[0]);
       pos++;
       continue;
@@ -609,13 +777,54 @@ function parseFieldedLine(kind, line, entries, ctx) {
   }
 
   // Type: IDENTIFIER (optionally followed by `[]` for array) OR a
-  // string-literal union like `"M" | "F" | "U"`. The type slot is
+  // string-literal union like `"M" | "F" | "U"`, optionally prefixed
+  // with `~` for coercion ("coerce, then validate"). The type slot is
   // OPTIONAL — if the next token isn't a type-starting token, the
   // field defaults to `string` and we fall through to constraint
   // parsing.
   let typeName = 'string';
   let literals = null;
-  if (typeFirst?.[0] === 'IDENTIFIER') {
+  let coerce = false;
+  let coercer = null;
+  let coercerArray = false;
+  // `~type` / `~:name` — coercion markers. Lexically unambiguous in the
+  // type slot: `~>` (computed) lexes as EFFECT and lives after a `:`, a
+  // different slot entirely. `~type` coerces via the strict built-in
+  // tables; `~:name` coerces via the named-coercer registry (the
+  // rip-server read() vocabulary, plus app registrations).
+  if (typeFirst?.[0] === 'UNARY_MATH' && typeFirst[1] === '~') {
+    let typeTok = line[pos + 1];
+    if (typeTok?.[0] === 'SYMBOL') {
+      coerce = true;
+      coercer = typeTok[1];
+      let out = SCHEMA_NAMED_COERCER_TYPES[coercer];
+      if (out && typeof out === 'object') {
+        // e.g. ~:ids → integer[] — the coercer's output is a list.
+        typeName = out.type;
+        coercerArray = true;
+      } else {
+        typeName = out || 'any';
+      }
+      pos += 2;
+      typeFirst = typeTok;
+    } else if (typeTok?.[0] === 'IDENTIFIER') {
+      if (!SCHEMA_COERCIBLE_TYPES.has(typeTok[1])) {
+        throw schemaError(typeTok,
+          `'~${typeTok[1]}' is not coercible. Built-in coercion is defined for: ${[...SCHEMA_COERCIBLE_TYPES].join(', ')}. ` +
+          `Named coercers use a symbol — '~:${typeTok[1]}' — and resolve through the registry ` +
+          `(@rip-lang/validate's vocabulary, or schema.registerCoercer). ` +
+          `For anything else, write an explicit transform: '${name}, -> …'.`);
+      }
+      coerce = true;
+      typeName = typeTok[1];
+      pos += 2;
+      typeFirst = typeTok; // for the typeConsumed / comma-rule checks below
+    } else {
+      throw schemaError(typeFirst,
+        `'~' in the type slot marks coercion and needs a type name ('~integer', '~date', …) ` +
+        `or a registered coercer symbol ('~:ssn', '~:money', …).`);
+    }
+  } else if (typeFirst?.[0] === 'IDENTIFIER') {
     typeName = typeFirst[1];
     pos++;
   } else if (typeFirst?.[0] === 'STRING') {
@@ -634,10 +843,9 @@ function parseFieldedLine(kind, line, entries, ctx) {
       throw schemaError(next || line[pos],
         `Literal unions contain string literals only. '${tag}' is not allowed as a union member. Use the '?' modifier for nullability.`);
     }
-    if (literals.length < 2) {
-      throw schemaError(typeFirst,
-        `Literal union needs at least two string literals. Use '${JSON.stringify(literals[0])}' as a default with '[${JSON.stringify(literals[0])}]' instead.`);
-    }
+    // A single literal is a constant field — `kind! "click"` — the
+    // building block of discriminated unions (each :union constituent
+    // declares its tag this way). Multi-member unions need 2+ as before.
     typeName = 'literal-union';
   }
   let array = false;
@@ -651,6 +859,11 @@ function parseFieldedLine(kind, line, entries, ctx) {
     array = true;
     pos += 2;
   }
+  if (coerce && array) {
+    throw schemaError(typeFirst,
+      `Coercion ('~${typeName}') does not apply to array types. Coerce per-element with a transform instead.`);
+  }
+  if (coercerArray) array = true;
 
   // Remaining tokens on the line are a mix of `[…]` constraints (default,
   // regex), `{…}` attrs, and `n..n` range constraints. Each form is
@@ -661,7 +874,7 @@ function parseFieldedLine(kind, line, entries, ctx) {
   // Comma-required rule: if a type was consumed and the next token is
   // `->` (no comma separator), reject with a clear diagnostic. The
   // comma is a structural boundary between the field declaration and
-  // the transform; skipping it makes `email!# email -> fn` read as
+  // the transform; skipping it makes `email! email -> fn` read as
   // if 'email' were an argument to the arrow, which it isn't.
   let typeConsumed = typeFirst?.[0] === 'IDENTIFIER' || typeFirst?.[0] === 'STRING';
   if (typeConsumed && rest[0]?.[0] === '->') {
@@ -673,6 +886,7 @@ function parseFieldedLine(kind, line, entries, ctx) {
   let rangeTokens = null;
   let regexToken = null;
   let transformTokens = null;
+  let uniqueAttr = false;
 
   if (rest.length > 0) {
     // The leading comma is only required when a type was consumed. If
@@ -681,6 +895,23 @@ function parseFieldedLine(kind, line, entries, ctx) {
     if (rest[0]?.[0] === ',') {
       rest = rest.slice(1);
     }
+    // Multi-line trailers (`password! string,\n  8..100,\n  /[A-Z]/`)
+    // arrive wrapped in one INDENT … OUTDENT pair. Strip it when it
+    // spans the whole remainder, so the inner commas are top-level for
+    // the split below — otherwise the whole continuation reads as ONE
+    // nested part and per-constraint classification never happens.
+    if (rest.length >= 2 && rest[0][0] === 'INDENT') {
+      let d = 0;
+      let lastIdx = -1;
+      for (let k = 0; k < rest.length; k++) {
+        if (rest[k][0] === 'INDENT') d++;
+        else if (rest[k][0] === 'OUTDENT') {
+          d--;
+          if (d === 0) { lastIdx = k; break; }
+        }
+      }
+      if (lastIdx === rest.length - 1) rest = rest.slice(1, -1);
+    }
     // Split top-level by commas. Multi-line trailers (`name! type,\n
     // [8, 100]`) introduce surrounding INDENT/OUTDENT tokens that
     // don't affect semantics — strip them from each part so the head
@@ -750,9 +981,26 @@ function parseFieldedLine(kind, line, entries, ctx) {
             `Transform '-> …' must be the last element on the field line for '${name}'.`);
         }
         transformTokens = part.slice(1);
+      } else if (head[0] === '@') {
+        // Trailing `@unique` — single-column uniqueness co-located on the
+        // field (mirrors Prisma's field-level `@unique`). Uniqueness is a
+        // storage property, so it rides as a field attribute, not a `!`/`?`
+        // shape modifier. Composite uniqueness uses the `@unique [...]`
+        // directive on its own line.
+        let attrTok = part[1];
+        let attrName = attrTok && (attrTok[0] === 'IDENTIFIER' || attrTok[0] === 'PROPERTY') ? attrTok[1] : null;
+        if (part.length === 2 && attrName === 'unique') {
+          if (uniqueAttr) {
+            throw schemaError(head, `Field '${name}' has more than one '@unique'.`);
+          }
+          uniqueAttr = true;
+        } else {
+          throw schemaError(head,
+            `Unknown inline attribute '@${attrName ?? ''}' on field '${name}'. The only inline attribute is '@unique'.`);
+        }
       } else {
         throw schemaError(head,
-          `Unexpected trailer for field '${name}'. Expected '[…]' default, '{…}' attrs, '/regex/', 'min..max' range, or '-> transform'.`);
+          `Unexpected trailer for field '${name}'. Expected '[…]' default, '{…}' attrs, '/regex/', 'min..max' range, '-> transform', or '@unique'.`);
       }
     }
   }
@@ -776,13 +1024,24 @@ function parseFieldedLine(kind, line, entries, ctx) {
     defaultMax = ctx.defaultMaxString;
   }
 
+  // Coercion IS the wire-value derivation; a transform is full manual
+  // control of the same step. Both on one field is a contradiction.
+  if (coerce && transformTokens) {
+    throw schemaError(first,
+      `Field '${name}' has both '~${typeName}' coercion and a '->' transform. ` +
+      `A transform replaces coercion — coerce inside it instead.`);
+  }
+
   entries.push({
     tag: 'field',
     name,
     modifiers,
+    unique: uniqueAttr,
     typeName,
     array,
     literals,
+    coerce,
+    coercer,
     constraintTokens,
     attrsTokens,
     rangeTokens,
@@ -841,27 +1100,56 @@ function parseCallableLine(kind, headerTok, line, entries) {
     throw schemaError(headerTok,
       `Expected ':' after '${name}' before arrow.`);
   }
-  // Three arrow forms:
-  //   name: -> body   — method / hook
-  //   name: ~> body   — lazy computed getter (EFFECT token)
-  //   name: !> body   — eager derived field (UNARY_MATH '!' + COMPARE '>')
-  let arrowTok = line[2];
-  let nextTok = line[3];
+  // Arrow forms:
+  //   name: -> body            — method / hook
+  //   name: (params) -> body   — parameterized method (methods only —
+  //                              hooks/computed/derived are accessor-
+  //                              shaped and take no arguments)
+  //   name: ~> body            — lazy computed getter (EFFECT token)
+  //   name: !> body            — eager derived field (UNARY_MATH '!' + COMPARE '>')
+  //
+  // Method params may carry Rip type annotations — `(other:: Money)` —
+  // which the type rewriter (an earlier lexer pass) has already stripped
+  // and stamped onto the identifier tokens as `.data.type`; we keep the
+  // raw tokens so codegen can rebuild typed params.
+  let pos = 2;
+  let paramTokens = [];
+  let hadParams = false;
+  if (line[pos] && (line[pos][0] === 'PARAM_START' || line[pos][0] === '(')) {
+    hadParams = true;
+    let depth = 1;
+    pos++;
+    while (pos < line.length && depth > 0) {
+      let tag = line[pos][0];
+      if (tag === '(' || tag === 'PARAM_START') depth++;
+      if (tag === ')' || tag === 'PARAM_END') {
+        depth--;
+        if (depth === 0) { pos++; break; }
+      }
+      paramTokens.push(line[pos]);
+      pos++;
+    }
+    if (depth !== 0) {
+      throw schemaError(line[2], `'${name}': unclosed '(' in parameters.`);
+    }
+  }
+  let arrowTok = line[pos];
+  let nextTok = line[pos + 1];
   let arrow, arrowLoc, bodyStart;
   if (arrowTok && arrowTok[0] === '->') {
     arrow = '->';
     arrowLoc = arrowTok.loc;
-    bodyStart = 3;
+    bodyStart = pos + 1;
   } else if (arrowTok && arrowTok[0] === 'EFFECT') {
     arrow = '~>';
     arrowLoc = arrowTok.loc;
-    bodyStart = 3;
+    bodyStart = pos + 1;
   } else if (arrowTok && arrowTok[0] === 'UNARY_MATH' && arrowTok[1] === '!' &&
              nextTok && nextTok[0] === 'COMPARE' && nextTok[1] === '>' &&
              !arrowTok.spaced) {
     arrow = '!>';
     arrowLoc = arrowTok.loc;
-    bodyStart = 4;
+    bodyStart = pos + 2;
   } else {
     throw schemaError(colonTok,
       `Schema top-level '${name}:' must be followed by '->' (method/hook), '~>' (computed getter), or '!>' (eager derived).`);
@@ -878,17 +1166,100 @@ function parseCallableLine(kind, headerTok, line, entries) {
   } else {
     entryTag = 'method';
   }
+  if (hadParams && entryTag !== 'method') {
+    let what = entryTag === 'hook' ? 'lifecycle hooks' :
+      entryTag === 'computed' ? 'computed getters (~>)' : 'eager-derived fields (!>)';
+    throw schemaError(colonTok,
+      `'${name}': ${what} take no parameters — only methods do.`);
+  }
   entries.push({
     tag: entryTag,
     name,
     arrow,
-    paramTokens: [],
+    paramTokens,
     bodyTokens,
     headerLoc: headerTok.loc,
     arrowLoc,
   });
 }
 
+// Strip the implicit CALL_START/CALL_END wrapper that Rip puts around
+// directive arguments (`@scope args...` is a call to the lexer).
+function stripCallWrapper(tokens) {
+  if (tokens[0]?.[0] === 'CALL_START' &&
+      tokens[tokens.length - 1]?.[0] === 'CALL_END') {
+    return tokens.slice(1, -1);
+  }
+  return tokens;
+}
+
+// Parse `@scope :name, fn` arguments. The name must be a :symbol; the fn
+// is either `-> body` (zero-arg, builder-thisbound) or `(args) -> body`.
+function parseScopeDirective(argTokens, directiveTok) {
+  let tokens = stripCallWrapper(argTokens);
+  if (!tokens.length) {
+    throw schemaError(directiveTok,
+      "@scope requires ':name, -> body' (or ':name, (args) -> body').");
+  }
+  let nameTok = tokens[0];
+  if (nameTok[0] !== 'SYMBOL') {
+    throw schemaError(nameTok,
+      "@scope name must be a :symbol — '@scope :active, -> @where(active: true)'.");
+  }
+  let name = nameTok[1];
+  if (!/^[a-z][a-zA-Z0-9]*$/.test(name)) {
+    throw schemaError(nameTok,
+      `@scope name ':${name}' must be a lowercase-first alphanumeric identifier.`);
+  }
+  let rest = tokens.slice(1);
+  if (rest[0]?.[0] === ',') rest = rest.slice(1);
+  if (!rest.length) {
+    throw schemaError(nameTok,
+      `@scope :${name} is missing its body — '@scope :${name}, -> @where(...)'.`);
+  }
+  let fn = parseScopeFn(rest, nameTok, `@scope :${name}`);
+  return { name, paramTokens: fn.paramTokens, bodyTokens: fn.bodyTokens };
+}
+
+// Parse a scope function token slice: `-> body` or `(params) -> body`.
+// Unlike @ensure predicates, the parameter list is optional — scopes
+// read the builder through `this`, so most take no arguments.
+function parseScopeFn(tokens, anchorTok, label) {
+  if (!tokens.length) {
+    throw schemaError(anchorTok, `${label}: expected '-> body' or '(args) -> body'.`);
+  }
+  let paramTokens = [];
+  let pos = 0;
+  let t0 = tokens[0];
+  if (t0[0] === '(' || t0[0] === 'PARAM_START') {
+    let depth = 1;
+    pos = 1;
+    while (pos < tokens.length && depth > 0) {
+      let tag = tokens[pos][0];
+      if (tag === '(' || tag === 'PARAM_START') depth++;
+      if (tag === ')' || tag === 'PARAM_END') {
+        depth--;
+        if (depth === 0) { pos++; break; }
+      }
+      paramTokens.push(tokens[pos]);
+      pos++;
+    }
+    if (depth !== 0) {
+      throw schemaError(t0, `${label}: unclosed '(' in parameters.`);
+    }
+  }
+  let arrowTok = tokens[pos];
+  if (!arrowTok || arrowTok[0] !== '->') {
+    throw schemaError(arrowTok || anchorTok,
+      `${label}: expected '->' ${paramTokens.length ? 'after parameters' : 'to start the body'}.`);
+  }
+  let bodyTokens = tokens.slice(pos + 1);
+  if (!bodyTokens.length) {
+    throw schemaError(arrowTok, `${label}: function body is empty.`);
+  }
+  return { paramTokens, bodyTokens };
+}
+
 // Parse `@ensure` arguments into one or more refinement pairs. Accepts two
 // forms:
 //
@@ -928,28 +1299,47 @@ function parseEnsurePairs(argTokens, directiveTok) {
     if (parts.length === 0) {
       throw schemaError(first, "@ensure [...] must contain at least one 'message, fn' pair.");
     }
-    if (parts.length % 2 !== 0) {
-      throw schemaError(first,
-        `@ensure [...] must have pairs of 'message, fn' (got ${parts.length} elements; odd count).`);
-    }
-    let pairs = [];
-    for (let i = 0; i < parts.length; i += 2) {
-      pairs.push(extractEnsurePair(parts[i], parts[i + 1], first));
-    }
-    return pairs;
+    return consumeEnsureTuples(parts, first);
   }
 
-  // Inline form: STRING, (args) -> body
+  // Inline form: STRING [, :field], (args) -> body
   let parts = splitTopLevelByComma(tokens);
   if (parts.length < 2) {
     throw schemaError(first,
       "@ensure inline form must be 'message, (x) -> body'. Did you forget the comma?");
   }
-  if (parts.length > 2) {
+  if (parts.length > 3 || (parts.length === 3 && !isEnsureFieldPart(parts[1]))) {
     throw schemaError(first,
-      `@ensure inline form takes exactly 'message, fn' (got ${parts.length} comma-separated parts). Use '@ensure [...]' for multiple refinements.`);
+      `@ensure inline form takes 'message[, :field], fn' (got ${parts.length} comma-separated parts). Use '@ensure [...]' for multiple refinements.`);
   }
-  return [extractEnsurePair(parts[0], parts[1], first)];
+  return consumeEnsureTuples(parts, first);
+}
+
+// One element that is exactly a `:field` symbol — the optional
+// attribution slot between message and predicate.
+function isEnsureFieldPart(part) {
+  return part && part.length === 1 && part[0][0] === 'SYMBOL';
+}
+
+// Walk a flat element stream consuming `message[, :field], fn` tuples.
+// Both the inline form and the array form normalize through here, so
+// the two source shapes stay indistinguishable downstream.
+function consumeEnsureTuples(parts, anchorTok) {
+  let pairs = [];
+  let i = 0;
+  while (i < parts.length) {
+    let msgPart = parts[i++];
+    let fieldPart = null;
+    if (i < parts.length && isEnsureFieldPart(parts[i])) {
+      fieldPart = parts[i++];
+    }
+    if (i >= parts.length) {
+      throw schemaError(msgPart?.[0] || anchorTok,
+        "@ensure: missing function after message" + (fieldPart ? " and :field" : "") + ".");
+    }
+    pairs.push(extractEnsurePair(msgPart, fieldPart, parts[i++], anchorTok));
+  }
+  return pairs;
 }
 
 // Walk `[ ... ]` tokens and return the inner slice. Rejects trailing
@@ -1027,11 +1417,12 @@ function splitEnsureElements(tokens) {
   return parts;
 }
 
-// Extract one refinement pair from `messagePart` and `fnPart` (two token
-// slices already split by splitTopLevelByComma). Validates shape at parse
-// time so typos surface with targeted diagnostics instead of runtime
-// "expected function" noise.
-function extractEnsurePair(messagePart, fnPart, refTok) {
+// Extract one refinement tuple from `messagePart`, optional `fieldPart`
+// (a single `:field` symbol), and `fnPart` (token slices already split
+// by splitTopLevelByComma). Validates shape at parse time so typos
+// surface with targeted diagnostics instead of runtime "expected
+// function" noise.
+function extractEnsurePair(messagePart, fieldPart, fnPart, refTok) {
   if (!messagePart || !messagePart.length) {
     throw schemaError(refTok, "@ensure: missing message (expected a string literal).");
   }
@@ -1041,6 +1432,7 @@ function extractEnsurePair(messagePart, fnPart, refTok) {
   }
   let msgTok = messagePart[0];
   let message = JSON.parse(msgTok[1]);
+  let field = fieldPart ? fieldPart[0][1] : null;
 
   if (!fnPart || !fnPart.length) {
     throw schemaError(msgTok, "@ensure: missing function after message.");
@@ -1080,7 +1472,7 @@ function extractEnsurePair(messagePart, fnPart, refTok) {
   if (!bodyTokens.length) {
     throw schemaError(arrowTok, "@ensure: predicate function body is empty.");
   }
-  return { message, paramTokens, bodyTokens, loc: msgTok.loc };
+  return { message, field, paramTokens, bodyTokens, loc: msgTok.loc };
 }
 
 // Extract param names from `(u)` or `(u, opts)` token slice. Accepts
@@ -1099,6 +1491,46 @@ function ensureParamNames(paramTokens, refTok) {
   });
 }
 
+// :union body lines: `@on :field` (the discriminator, exactly once) and
+// bare constituent schema names. Anything else is a targeted error.
+function parseUnionLine(line, entries) {
+  let first = line[0];
+  if (!first) return;
+
+  if (first[0] === '@') {
+    let nameTok = line[1];
+    if (!nameTok || nameTok[1] !== 'on') {
+      throw schemaError(nameTok || first,
+        `:union bodies accept only '@on :field' and constituent schema names. '@${nameTok?.[1] ?? ''}' is not allowed.`);
+    }
+    let args = stripCallWrapper(line.slice(2));
+    let symTok = args[0];
+    if (!symTok || symTok[0] !== 'SYMBOL') {
+      throw schemaError(symTok || nameTok,
+        `@on requires the discriminator field as a :symbol — '@on :kind'.`);
+    }
+    if (args.length > 1) {
+      throw schemaError(args[1], `@on takes exactly one :field symbol.`);
+    }
+    entries.push({
+      tag: 'directive', name: 'on',
+      args: [{ field: symTok[1] }],
+      argTokens: line.slice(2),
+      loc: first.loc,
+    });
+    return;
+  }
+
+  if (first[0] === 'IDENTIFIER' && line.length === 1) {
+    entries.push({ tag: 'union-member', name: first[1], loc: first.loc });
+    return;
+  }
+
+  throw schemaError(first,
+    `:union bodies accept only '@on :field' and bare constituent schema names (one per line). ` +
+    `Got ${first[0]}${line.length > 1 ? ' followed by ' + line[1][0] : ''}.`);
+}
+
 function parseEnumLine(line, entries) {
   let first = line[0];
   if (!first) return;
@@ -1166,7 +1598,31 @@ function emitSchemaNode(emitter, head, rest, context) {
 
   let parts = [`kind: ${JSON.stringify(descriptor.kind)}`];
   if (schemaName) parts.push(`name: ${JSON.stringify(schemaName)}`);
+  else if (emitter.options.inlineTypes && (descriptor.kind === 'shape' || descriptor.kind === 'input')) {
+    // Anonymous (expression-position) schema — e.g. `Base.extend(schema :shape …)`.
+    // Synthesize a shadow-only identity so the dts pass can key a typed
+    // `__schema` overload on it; without one the call falls to the
+    // `(d: any) => any` overload and the schema's type evaporates (an
+    // `.extend()` argument then contributes nothing to the derived type).
+    // Keyed as `__anon`, not `name`: only the shadow compile (`inlineTypes`)
+    // emits it, and the runtime never registers anonymous schemas, so
+    // cross-file name collisions in `__SchemaRegistry` are impossible.
+    // Field-bearing kinds only — :enum/:union have no field list to emit a
+    // type from, so they keep the untyped fallback.
+    let anonList = (emitter._schemaAnon ??= []);
+    let anonName = `__AnonSchema${anonList.length + 1}`;
+    parts.push(`__anon: ${JSON.stringify(anonName)}`);
+    anonList.push({ name: anonName, descriptor });
+  }
   parts.push(`entries: [${descriptor.entries.map(e => entryLiteral(emitter, e)).join(', ')}]`);
+  // `schema :model, on: <expr>` — the adapter expression evaluates at
+  // declaration time in the user's scope.
+  if (descriptor.adapterTokens) {
+    let adapterSexpr = parseBodyTokens(descriptor.adapterTokens);
+    if (adapterSexpr) {
+      parts.push(`adapter: ${emitter.emit(unwrapSingleStatement(adapterSexpr), 'value')}`);
+    }
+  }
   return `__schema({${parts.join(', ')}})`;
 }
 
@@ -1178,6 +1634,301 @@ function readDescriptor(node) {
   return null;
 }
 
+// Descriptor for a `schema …` s-expr node (`['schema', SCHEMA_BODY]`) — the
+// grammar's metadata bridge carries the descriptor on the body value. The
+// single decoder for that shape: used by the projection fold below and by
+// the dts pass (src/schema/dts.js, which may import from this module; the
+// reverse import is barred by the browser-bundle graph).
+export function schemaNodeDescriptor(node) {
+  if (!Array.isArray(node)) return null;
+  const head = node[0]?.valueOf?.() ?? node[0];
+  if (head !== 'schema') return null;
+  return readDescriptor(node[1]);
+}
+
+// ============================================================================
+// Compile-time projection folding (opt-in: options.foldProjections)
+// ============================================================================
+//
+// A derived schema like `UserView = User.pick("id", "firstName")` normally
+// compiles to a runtime method call, which (a) needs the source `User` loaded
+// and (b) only yields a descriptor at load time. Folding statically evaluates
+// the algebra against the source's descriptor and rewrites the assignment to a
+// fresh, self-contained `__schema({kind:"shape", entries:[…]})` node — no
+// reference to `User`. That's what lets a projection cross the client bundle
+// boundary (the bundler extracts the folded literal) without dragging the
+// model's ORM/DDL along.
+//
+// Folding is intentionally conservative: it only fires for a same-file source
+// schema and static string-literal keys, and it BAILS (leaving the runtime
+// call untouched) on anything it can't prove — an unknown base, dynamic args,
+// a field the source doesn't expose, an extend collision. The runtime path is
+// always a correct fallback, so a bail is never a regression. Folding is OFF
+// by default (server/CLI/check keep the runtime algebra, including its
+// `_sourceModel` back-pointer); the browser-bundle extractor turns it on.
+
+const FOLD_ALGEBRA = new Set(['pick', 'omit', 'partial', 'required', 'extend']);
+
+function foldStr(n) { return n && n.valueOf ? n.valueOf() : n; }
+
+// True when a descriptor pulls fields in via `@mixin`. The fold can't expand
+// mixins (resolution is a runtime `_normalize` concern), so any projection over
+// such a base must bail to the runtime call rather than silently emit a shape
+// missing the mixin's fields.
+function foldHasMixin(descriptor) {
+  return descriptor.entries.some(e => e.tag === 'directive' && e.name === 'mixin');
+}
+
+// The `@belongs_to <Target>` FK column name, computed exactly as the runtime
+// does (`__schemaCamel(__schemaSnake(target) + '_id')` in runtime-validate.js).
+// The naive `target[0].toLowerCase() + …` diverges for acronym targets
+// (`ABCWidget` → runtime `abcwidgetId`, naive `aBCWidgetId`).
+function foldFkName(target) {
+  const snake = target.replace(/([a-z0-9])([A-Z])/g, '$1_$2').toLowerCase();
+  return (snake + '_id').replace(/_([a-z])/g, (_, c) => c.toUpperCase());
+}
+
+// The projectable columns of a descriptor as an ordered Map(name → field
+// entry): declared fields, then a :model's implicit id / @timestamps /
+// @softDelete / @belongs_to FK columns — matching __schemaProjectableFields
+// in runtime-validate.js so a fold yields the same field set the runtime would.
+// Returns null (bail) when the base uses `@mixin`.
+function foldProjectableMap(descriptor) {
+  if (foldHasMixin(descriptor)) return null;
+  const map = new Map();
+  for (const e of descriptor.entries) {
+    if (e.tag === 'field') map.set(e.name, e);
+  }
+  if (descriptor.kind !== 'model') return map;
+  const synth = (name, typeName, required) => {
+    if (!map.has(name)) map.set(name, { tag: 'field', name, modifiers: required ? ['!'] : ['?'], typeName, array: false });
+  };
+  let timestamps = false, softDelete = false;
+  const fks = [];
+  for (const e of descriptor.entries) {
+    if (e.tag !== 'directive') continue;
+    if (e.name === 'timestamps') timestamps = true;
+    else if (e.name === 'softDelete') softDelete = true;
+    else if (e.name === 'belongs_to') {
+      const t = e.args && e.args[0] && e.args[0].target;
+      if (t) fks.push({ fk: foldFkName(t), required: e.args[0].optional !== true });
+    }
+  }
+  // Insertion order mirrors the runtime: id, timestamps, softDelete, then FKs.
+  synth('id', 'integer', true);
+  if (timestamps) { synth('createdAt', 'datetime', true); synth('updatedAt', 'datetime', true); }
+  if (softDelete) synth('deletedAt', 'datetime', false);
+  for (const { fk, required } of fks) synth(fk, 'integer', required);
+  return map;
+}
+
+// Declared fields only (no implicit :model columns) — what runtime `.extend()`
+// merges from its argument (`other._normalize().fields`). Returns null (bail)
+// when the argument uses `@mixin`.
+function foldDeclaredMap(descriptor) {
+  if (foldHasMixin(descriptor)) return null;
+  const map = new Map();
+  for (const e of descriptor.entries) {
+    if (e.tag === 'field') map.set(e.name, e);
+  }
+  return map;
+}
+
+// Rewrite a field entry's modifiers, preserving any constraint/transform token
+// fields so emission stays faithful. `mode` is 'partial' (drop !, ensure ?) or
+// 'required' (drop ?, ensure !). Unique (#) and other modifiers are kept.
+function foldRemark(entry, mode) {
+  let mods = entry.modifiers.filter(m => m !== (mode === 'partial' ? '!' : '?'));
+  const want = mode === 'partial' ? '?' : '!';
+  if (!mods.includes(want)) mods = [...mods, want];
+  return { ...entry, modifiers: mods };
+}
+
+// Apply one algebra op to an ordered field Map, returning a new Map or null
+// (bail). `op` is { method, keys?, otherName? }. `byName` resolves a same-file
+// schema descriptor for extend's argument.
+function foldApplyOp(map, op, byName) {
+  switch (op.method) {
+    case 'pick': {
+      const out = new Map();
+      for (const k of op.keys) {
+        if (!map.has(k)) return null;
+        out.set(k, map.get(k));
+      }
+      return out;
+    }
+    case 'omit': {
+      const drop = new Set(op.keys);
+      const out = new Map();
+      for (const [k, v] of map) if (!drop.has(k)) out.set(k, v);
+      return out;
+    }
+    case 'partial': {
+      const out = new Map();
+      for (const [k, v] of map) out.set(k, foldRemark(v, 'partial'));
+      return out;
+    }
+    case 'required': {
+      const req = new Set(op.keys);
+      const out = new Map();
+      for (const [k, v] of map) out.set(k, req.has(k) ? foldRemark(v, 'required') : v);
+      return out;
+    }
+    case 'extend': {
+      const other = op.otherDescriptor || byName.get(op.otherName);
+      if (!other) return null;
+      // Runtime `.extend()` merges the argument's DECLARED fields only — not a
+      // :model's implicit id/timestamp/FK columns — so use the declared map.
+      const otherMap = foldDeclaredMap(other);
+      if (!otherMap) return null; // @mixin in the argument — bail
+      const out = new Map(map);
+      for (const [k, v] of otherMap) {
+        if (out.has(k)) return null; // collision — let the runtime throw
+        out.set(k, v);
+      }
+      return out;
+    }
+    default:
+      return null;
+  }
+}
+
+// Evaluate an algebra chain against a base descriptor. Returns a folded
+// `{kind:"shape", entries}` descriptor, or null to bail to the runtime call.
+function foldProjectionDescriptor(baseDescriptor, ops, byName) {
+  let map = foldProjectableMap(baseDescriptor);
+  if (!map) return null; // base uses @mixin — bail to the runtime call
+  for (const op of ops) {
+    map = foldApplyOp(map, op, byName);
+    if (!map) return null;
+  }
+  return { kind: 'shape', entries: [...map.values()] };
+}
+
+// Parse an assignment RHS s-expr into an algebra chain { base, ops } when it's
+// `Base.pick(...)`/`.omit(...)`/… (including chains like `.pick(...).omit(...)`),
+// else null. Keys must be static string literals (or arrays of them); extend's
+// argument must be a bare identifier or an inline schema literal. Anything
+// dynamic returns null → no fold.
+function foldParseChain(rhs) {
+  const ops = [];
+  let node = rhs;
+  while (true) {
+    if (!Array.isArray(node)) return null;
+    const callee = node[0];
+    if (!Array.isArray(callee)) return null;
+    if (foldStr(callee[0]) !== '.') return null;
+    const method = foldStr(callee[2]);
+    if (!FOLD_ALGEBRA.has(method)) return null;
+    const argNodes = node.slice(1);
+    let op;
+    if (method === 'partial') {
+      if (argNodes.length) return null;
+      op = { method };
+    } else if (method === 'extend') {
+      if (argNodes.length !== 1) return null;
+      const a = argNodes[0];
+      if (Array.isArray(a)) {
+        // Inline anonymous schema as the argument (`Base.extend(schema
+        // :shape …)`) — its descriptor rides on the node itself, so it
+        // folds with no name resolution at all. Field-less kinds
+        // (:enum/:union) bail like any other unfoldable argument.
+        const inline = schemaNodeDescriptor(a);
+        if (!inline || (inline.kind !== 'shape' && inline.kind !== 'input')) return null;
+        op = { method, otherDescriptor: inline };
+      } else {
+        const name = foldStr(a);
+        if (typeof name !== 'string' || !/^[A-Za-z_$][\w$]*$/.test(name)) return null;
+        op = { method, otherName: name };
+      }
+    } else {
+      const keys = foldLiteralKeys(argNodes);
+      if (!keys || !keys.length) return null;
+      op = { method, keys };
+    }
+    ops.unshift(op);
+    const obj = callee[1];
+    if (Array.isArray(obj)) { node = obj; continue; } // inner call in the chain
+    const base = foldStr(obj);
+    if (typeof base !== 'string') return null;
+    return { base, ops };
+  }
+}
+
+// Collect static string-literal keys from call args (each a string literal, or
+// an array literal of string literals). Returns null on any non-literal arg.
+function foldLiteralKeys(argNodes) {
+  const keys = [];
+  for (const a of argNodes) {
+    if (Array.isArray(a)) {
+      if (foldStr(a[0]) !== 'array') return null;
+      for (let i = 1; i < a.length; i++) {
+        const k = foldParseStrLit(a[i]);
+        if (k == null) return null;
+        keys.push(k);
+      }
+    } else {
+      const k = foldParseStrLit(a);
+      if (k == null) return null;
+      keys.push(k);
+    }
+  }
+  return keys;
+}
+
+// A string-literal node's value carries its surrounding quotes (e.g. `"id"`).
+// Strip them; return null for anything that isn't a plain string literal.
+function foldParseStrLit(node) {
+  const v = foldStr(node);
+  if (typeof v !== 'string' || v.length < 2) return null;
+  const q = v[0];
+  if ((q !== '"' && q !== "'") || v[v.length - 1] !== q) return null;
+  const inner = v.slice(1, -1);
+  // Keys are identifiers in practice; reject anything with escapes/interpolation.
+  if (/[\\#]/.test(inner)) return null;
+  return inner;
+}
+
+// Walk the program's top-level statements, fold every foldable derived-schema
+// assignment in place, and thread folded results into the same-file schema map
+// so a later `.extend`/chain can reference an already-folded projection. Mutates
+// `sexpr`. Called by the emitter only when options.foldProjections is set.
+export function foldDerivedSchemas(sexpr) {
+  if (!Array.isArray(sexpr)) return;
+  const head = foldStr(sexpr[0]);
+  const stmts = (head === 'program' || head === 'block') ? sexpr.slice(1) : [sexpr];
+  const byName = new Map();
+  for (const stmt of stmts) {
+    if (!Array.isArray(stmt)) continue;
+    // Unwrap `export <assign>` to reach the assignment node.
+    let assign = stmt;
+    if (foldStr(stmt[0]) === 'export' && Array.isArray(stmt[1])) assign = stmt[1];
+    if (foldStr(assign[0]) !== '=' || !Array.isArray(assign[2])) continue;
+    const name = foldStr(assign[1]);
+    if (typeof name !== 'string') continue;
+
+    // Already a schema literal — register its descriptor and move on.
+    if (foldStr(assign[2][0]) === 'schema') {
+      const existing = readDescriptor(assign[2][1]);
+      if (existing) byName.set(name, existing);
+      continue;
+    }
+
+    const chain = foldParseChain(assign[2]);
+    if (!chain) continue;
+    const baseDesc = byName.get(chain.base);
+    if (!baseDesc) continue; // base not a same-file schema — leave the runtime call
+    const folded = foldProjectionDescriptor(baseDesc, chain.ops, byName);
+    if (!folded) continue;   // not statically foldable — leave the runtime call
+
+    const bridge = new String('shape');
+    bridge.descriptor = folded;
+    bridge.data = { descriptor: folded };
+    assign[2] = ['schema', bridge];
+    byName.set(name, folded);
+  }
+}
+
 function entryLiteral(emitter, e) {
   switch (e.tag) {
     case 'field': {
@@ -1188,14 +1939,23 @@ function entryLiteral(emitter, e) {
         `typeName: ${JSON.stringify(e.typeName)}`,
         `array: ${e.array ? 'true' : 'false'}`,
       ];
+      if (e.unique) obj.push('unique: true');
       if (e.literals) {
         obj.push(`literals: ${JSON.stringify(e.literals)}`);
       }
+      if (e.coerce) {
+        obj.push('coerce: true');
+        if (e.coercer) obj.push(`coercer: ${JSON.stringify(e.coercer)}`);
+      }
       let range = e.rangeTokens ? compileRangeTokens(e.rangeTokens, e) : null;
       let bracket = e.constraintTokens ? compileConstraintsLiteral(e.constraintTokens, e) : null;
       let regex = e.regexToken ? regexLiteralOf(e.regexToken) : null;
       let merged = mergeFieldConstraints(range, bracket, regex, e);
       if (merged) obj.push(`constraints: ${merged}`);
+      if (e.attrsTokens) {
+        let attrs = compileAttrsLiteral(e.attrsTokens, e);
+        if (attrs) obj.push(`attrs: ${attrs}`);
+      }
       if (e.transformTokens) {
         obj.push(`transform: ${compileTransformFn(emitter, e.transformTokens)}`);
       }
@@ -1214,6 +1974,21 @@ function entryLiteral(emitter, e) {
         `message: ${JSON.stringify(e.message)}`,
         `fn: ${fnCode}`,
       ];
+      if (e.field) obj.push(`field: ${JSON.stringify(e.field)}`);
+      if (e.async) obj.push('async: true');
+      return `{${obj.join(', ')}}`;
+    }
+    case 'scope':
+    case 'defaultScope': {
+      // Scope bodies compile like @ensure predicates (explicit params,
+      // thin-arrow `function` so `this` binds to the query builder),
+      // except the parameter list is optional.
+      let fnCode = compileScopeFn(emitter, e);
+      let obj = [
+        `tag: ${JSON.stringify(e.tag)}`,
+        `name: ${JSON.stringify(e.name)}`,
+        `fn: ${fnCode}`,
+      ];
       return `{${obj.join(', ')}}`;
     }
     case 'computed':
@@ -1233,6 +2008,9 @@ function entryLiteral(emitter, e) {
       if (e.value !== undefined) obj.push(`value: ${JSON.stringify(e.value)}`);
       return `{${obj.join(', ')}}`;
     }
+    case 'union-member': {
+      return `{tag: "union-member", name: ${JSON.stringify(e.name)}}`;
+    }
     default:
       return `{tag: "unknown"}`;
   }
@@ -1243,27 +2021,110 @@ function entryLiteral(emitter, e) {
 // emitted using the Rip thin-arrow codegen, which naturally produces a
 // `function() { ... }` (Rip `->` is NOT a JS arrow). This gives us the
 // right `this` semantics for instance-attached methods and proto getters.
+//
+// In shadow-TS (`inlineTypes`) mode the body's `@field` reads (`this.field`)
+// would otherwise trip `noImplicitAny` (TS2683), since the bare `function()`
+// has an untyped `this`. So in that mode only we prepend a TypeScript `this`
+// parameter typed to the schema's instance type (its bare name — what
+// methods/computed/derived bodies actually see, including other behavior).
+// The `this` parameter is erased at runtime and is illegal as a real JS
+// param, so it is emitted ONLY under inlineTypes; normal codegen is
+// unchanged (`function() { ... }`).
+// Build the real parameter list for a method from its captured tokens.
+// Plain identifiers only (defaults/destructuring can come later); type
+// annotations were stripped by the type rewriter and live on the
+// identifier tokens as `.data.type` — re-attach them ONLY in shadow-TS
+// mode so normal codegen emits plain `function(other) { … }`.
+function callableParams(emitter, entry) {
+  if (!entry.paramTokens || !entry.paramTokens.length) return [];
+  let parts = splitTopLevelByComma(entry.paramTokens);
+  return parts.map(part => {
+    let toks = part.filter(t =>
+      t[0] !== 'TERMINATOR' && t[0] !== 'INDENT' && t[0] !== 'OUTDENT');
+    if (toks.length !== 1 || toks[0][0] !== 'IDENTIFIER') {
+      throw schemaError(toks[0] || { loc: entry.headerLoc },
+        `'${entry.name}': method parameters must be plain identifiers (with optional ':: Type' annotations).`);
+    }
+    let p = new String(toks[0][1]);
+    if (emitter.options.inlineTypes) {
+      // Unannotated params get explicit `any` so the shadow file never
+      // trips noImplicitAny (TS7006) — same policy as transform `it`.
+      p.type = toks[0].data?.type || 'any';
+    }
+    return p;
+  });
+}
+
 function compileCallableFn(emitter, entry) {
   let bodySexpr = parseBodyTokens(entry.bodyTokens);
+  let methodParams = callableParams(emitter, entry);
   if (!bodySexpr) {
     // Empty body — emit a no-op.
     return `(function() {})`;
   }
-  // Wrap as a thin-arrow with no params. `emit` in value context produces
-  // a parenthesized function expression.
-  let arrowSexpr = ['->', [], bodySexpr];
-  return emitter.emit(arrowSexpr, 'value');
+  let params = [];
+  if (emitter.options.inlineTypes && emitter._schemaName) {
+    let thisParam = new String('this');
+    thisParam.type = emitter._schemaName;
+    params.push(thisParam);
+  }
+  params.push(...methodParams);
+  // Wrap as a thin-arrow. `emit` in value context produces a parenthesized
+  // function expression.
+  let arrowSexpr = ['->', params, bodySexpr];
+  let fnCode = emitter.emit(arrowSexpr, 'value');
+  // Shadow-TS only: stash bodies so the type emitter can infer member
+  // types via `typeof __<Name>__behavior.field` instead of falling back
+  // to `unknown` (the body is already a `function(this: <Name>) { … }`).
+  // Computed (`~>`), eager-derived (`!>`), and methods all qualify —
+  // method params carry their declared annotations (or explicit `any`),
+  // so `typeof` yields the full signature: typed params, `this`, and
+  // the inferred return. The buffer rides on the emitter instance
+  // (per-compile, no globals) and is read by emitSchemaTypes after
+  // codegen finishes.
+  let bufferable =
+    entry.tag === 'computed' || entry.tag === 'derived' || entry.tag === 'method';
+  if (emitter.options.inlineTypes && emitter._schemaName && bufferable) {
+    if (!emitter._schemaBehavior) emitter._schemaBehavior = new Map();
+    let list = emitter._schemaBehavior.get(emitter._schemaName);
+    if (!list) { list = []; emitter._schemaBehavior.set(emitter._schemaName, list); }
+    list.push({ field: entry.name, tag: entry.tag, fnExpr: fnCode });
+  }
+  return fnCode;
 }
 
 // Compile an inline field transform body (`-> body`). The body receives
-// the raw input object via Rip's implicit `it` parameter; no explicit
-// params are emitted. Transform runs on .parse() only, not on hydrate.
+// the raw input object via Rip's `it` parameter. Transform runs on
+// .parse() only, not on hydrate.
+//
+// `it` is emitted as an explicit `any`-typed param (rather than relying on
+// the implicit-`it` injection) so the shadow-TS pass doesn't trip
+// `noImplicitAny` (TS7006) — runtime output is identical (`function(it)`).
+// `any` is the correct type, not a cop-out: a transform sees the RAW,
+// pre-validation input, which legitimately carries keys that aren't
+// declared fields (e.g. `it.Id` remapped to `id`), so typing `it` to the
+// schema's own shape would wrongly reject those reads.
 function compileTransformFn(emitter, bodyTokens) {
   let bodySexpr = parseBodyTokens(bodyTokens);
   if (!bodySexpr) {
     return `(function() { return undefined; })`;
   }
-  let arrowSexpr = ['->', [], bodySexpr];
+  let itParam = new String('it');
+  itParam.type = 'any';
+  let arrowSexpr = ['->', [itParam], bodySexpr];
+  return emitter.emit(arrowSexpr, 'value');
+}
+
+// Compile a `@scope` / `@defaultScope` body into a thin-arrow function
+// expression. Params are optional ident-only (reuses the @ensure param
+// extractor); `this` is the query builder at call time.
+function compileScopeFn(emitter, entry) {
+  let bodySexpr = parseBodyTokens(entry.bodyTokens);
+  if (!bodySexpr) {
+    return `(function() { return this; })`;
+  }
+  let params = entry.paramTokens.length ? ensureParamNames(entry.paramTokens, entry) : [];
+  let arrowSexpr = ['->', params, bodySexpr];
   return emitter.emit(arrowSexpr, 'value');
 }
 
@@ -1428,6 +2289,45 @@ function mergeFieldConstraints(range, bracketLiteral, regex, fieldEntry) {
   return constraintLiteral(c);
 }
 
+// Compile a field's `{key: value}` attrs bracket into a JS object
+// literal. Known keys only — a typo'd attr silently baked into every
+// downstream schema would be worse than a hard error. Current keys:
+//
+//   was: "old_column_name"   migration-rename annotation, consumed by
+//                            the schema differ (`rip schema make`) to
+//                            emit RENAME COLUMN instead of DROP + ADD.
+//                            Removable once the migration has landed.
+const SCHEMA_FIELD_ATTRS = new Set(['was']);
+
+function compileAttrsLiteral(tokens, fieldEntry) {
+  // tokens: `{` … `}` — strip the braces, split entries on top-level commas.
+  let inner = tokens.slice(1, -1).filter(t => t[0] !== 'TERMINATOR' && t[0] !== 'INDENT' && t[0] !== 'OUTDENT');
+  let items = splitTopLevelByComma(inner);
+  let parts = [];
+  for (let item of items) {
+    if (!item.length) continue;
+    let keyTok = item[0];
+    if (keyTok[0] !== 'PROPERTY' && keyTok[0] !== 'IDENTIFIER') {
+      throw schemaError(keyTok,
+        `Field attrs must be '{key: value}' pairs. Got ${keyTok[0]}.`);
+    }
+    let key = keyTok[1];
+    if (!SCHEMA_FIELD_ATTRS.has(key)) {
+      throw schemaError(keyTok,
+        `Unknown field attr '${key}'. Known attrs: ${[...SCHEMA_FIELD_ATTRS].join(', ')}.`);
+    }
+    let valueStart = 1;
+    if (item[valueStart]?.[0] === ':') valueStart++;
+    let value = evalLiteralTokens(item.slice(valueStart), fieldEntry);
+    if (key === 'was' && typeof value !== 'string') {
+      throw schemaError(keyTok,
+        `Field attr 'was' requires a string column name, e.g. {was: "first_name"}.`);
+    }
+    parts.push(`${key}: ${serializeLiteral(value)}`);
+  }
+  return parts.length ? `{${parts.join(', ')}}` : null;
+}
+
 function constraintLiteral(c) {
   let parts = [];
   if (c.min !== undefined) parts.push(`min: ${serializeLiteral(c.min)}`);
@@ -1446,6 +2346,37 @@ function serializeLiteral(v) {
   return JSON.stringify(v);
 }
 
+// Extract a column-name list from a directive's args — a single name
+// (`field` / `:field`) or a bracketed list (`[:a, :b]`). Accepts bare
+// identifiers and `:symbol` form interchangeably; both denote field names.
+// Shared by `@unique` and `@index`.
+function collectDirectiveFieldNames(tokens) {
+  let isName = (t) => t && (t[0] === 'IDENTIFIER' || t[0] === 'PROPERTY' || t[0] === 'SYMBOL');
+  let fields = [];
+  let pos = 0;
+  if (isName(tokens[pos])) {
+    fields.push(tokens[pos][1]);
+  } else if (tokens[pos]?.[0] === '[' || tokens[pos]?.[0] === 'INDEX_START') {
+    let inner = [];
+    let depth = 1;
+    pos++;
+    while (pos < tokens.length && depth > 0) {
+      let t = tokens[pos];
+      if (t[0] === '[' || t[0] === 'INDEX_START') depth++;
+      if (t[0] === ']' || t[0] === 'INDEX_END') {
+        depth--;
+        if (depth === 0) { pos++; break; }
+      }
+      inner.push(t);
+      pos++;
+    }
+    for (let part of splitTopLevelByComma(inner)) {
+      if (isName(part[0])) fields.push(part[0][1]);
+    }
+  }
+  return fields;
+}
+
 // Compile directive args to a JS literal list or null. Each directive has
 // its own arg shape — we centralize the parsing here so Layer 2 can rely
 // on normalized structures.
@@ -1478,38 +2409,56 @@ function compileDirectiveArgsLiteral(name, tokens) {
     return `[{${parts.join(', ')}}]`;
   }
 
-  // `@index field` or `@index [a, b]` or `@index [a, b] #` for unique.
+  // `@unique :field`, `@unique field`, or `@unique [:a, :b]` — a unique
+  // constraint (model-only). Single-field uniqueness is more commonly
+  // written inline as `field! type @unique`; this directive form covers
+  // composite keys and the single-field case when you prefer it separate.
+  if (name === 'unique') {
+    let fields = collectDirectiveFieldNames(tokens);
+    if (!fields.length) {
+      throw schemaError(tokens[0] || tokens[tokens.length - 1],
+        `@unique requires a field name or list — '@unique :email' or '@unique [:a, :b]'.`);
+    }
+    return `[{fields: ${JSON.stringify(fields)}}]`;
+  }
+
+  // `@index field` or `@index [a, b]` — a non-unique index. Uniqueness is
+  // spelled `@unique`, never `@index … #` (the `#` unique flag was removed).
   if (name === 'index') {
-    let fields = [];
-    let unique = false;
-    let pos = 0;
-    if (tokens[pos]?.[0] === 'IDENTIFIER' || tokens[pos]?.[0] === 'PROPERTY') {
-      fields.push(tokens[pos][1]);
-      pos++;
-    } else if (tokens[pos]?.[0] === '[' || tokens[pos]?.[0] === 'INDEX_START') {
-      let inner = [];
-      let depth = 1;
-      pos++;
-      while (pos < tokens.length && depth > 0) {
-        let t = tokens[pos];
-        if (t[0] === '[' || t[0] === 'INDEX_START') depth++;
-        if (t[0] === ']' || t[0] === 'INDEX_END') {
-          depth--;
-          if (depth === 0) { pos++; break; }
-        }
-        inner.push(t);
-        pos++;
-      }
-      for (let part of splitTopLevelByComma(inner)) {
-        if (part[0] && (part[0][0] === 'IDENTIFIER' || part[0][0] === 'PROPERTY')) {
-          fields.push(part[0][1]);
-        }
-      }
+    let fields = collectDirectiveFieldNames(tokens);
+    return `[{fields: ${JSON.stringify(fields)}}]`;
+  }
+
+  // `@on :field` — the :union discriminator. Pre-validated by
+  // parseUnionLine; recompiled here from the raw tokens for the
+  // descriptor literal.
+  if (name === 'on') {
+    let t = stripCallWrapper(tokens)[0];
+    if (t && t[0] === 'SYMBOL') {
+      return `[{field: ${JSON.stringify(t[1])}}]`;
     }
-    if (tokens[pos]?.[0] === '#') unique = true;
-    let parts = [`fields: ${JSON.stringify(fields)}`];
-    if (unique) parts.push('unique: true');
-    return `[{${parts.join(', ')}}]`;
+    throw schemaError(t || tokens[tokens.length - 1],
+      `@on requires the discriminator field as a :symbol — '@on :kind'.`);
+  }
+
+  // `@tableWas old_name` — migration-rename annotation for the whole
+  // table. Consumed by the schema differ to emit `ALTER TABLE … RENAME
+  // TO …` instead of DROP + CREATE. Accepts an identifier or string.
+  if (name === 'tableWas') {
+    // A string arg gets the implicit-call wrapper (like @ensure); a bare
+    // identifier doesn't. Strip defensively.
+    if (tokens[0]?.[0] === 'CALL_START' && tokens[tokens.length - 1]?.[0] === 'CALL_END') {
+      tokens = tokens.slice(1, -1);
+    }
+    let t0 = tokens[0];
+    if (t0 && t0[0] === 'STRING') {
+      return `[{name: ${t0[1]}}]`;
+    }
+    if (t0 && (t0[0] === 'IDENTIFIER' || t0[0] === 'PROPERTY')) {
+      return `[{name: ${JSON.stringify(t0[1])}}]`;
+    }
+    throw schemaError(t0 || tokens[tokens.length - 1],
+      `@tableWas requires the previous table name, e.g. @tableWas legacy_users.`);
   }
 
   // @idStart N sets the seed value for the table's auto-id sequence.
@@ -1576,6 +2525,17 @@ function parseRegexLiteral(val) {
 // the result through parser.parse() via a temporary lex adapter. The
 // returned s-expression is the parsed body — either a single statement or
 // a block of statements — ready to wrap in `['->', [], body]`.
+// Unwrap a single-statement `['block', stmt]` to the statement itself —
+// used when a captured token slice is a value expression (the `on:`
+// adapter), not a function body.
+function unwrapSingleStatement(sexpr) {
+  if (Array.isArray(sexpr)) {
+    const head = sexpr[0]?.valueOf?.() ?? sexpr[0];
+    if (head === 'block' && sexpr.length === 2) return sexpr[1];
+  }
+  return sexpr;
+}
+
 function parseBodyTokens(bodyTokens) {
   if (!bodyTokens || !bodyTokens.length) return null;