hecks 3.5.0 → 3.6.0

data/lib/hecks/projections/rust_vocabulary/tests.rb

@@ -0,0 +1,144 @@
+require_relative "../../runtime/refusal_wording"
+
+module Hecks
+  module Projections
+    module RustVocabulary
+      # The `#[cfg(test)]` module each projected enum file carries, as Rust lines.
+      module Tests
+        # The body of the placeholder test, after the line that opens its loop over the sites.
+        PLACEHOLDER_BODY = [
+          "            let template = site.template();",
+          "            let mut keys: Vec<String> = Vec::new();",
+          "            let mut current: Option<String> = None;",
+          "            for ch in template.chars() {",
+          "                match (ch, current.as_mut()) {",
+          "                    ('{', _) => current = Some(String::new()),",
+          "                    ('}', Some(key)) => {",
+          "                        keys.push(key.clone());",
+          "                        current = None;",
+          "                    }",
+          "                    (_, Some(key)) => key.push(ch),",
+          "                    (_, None) => {}",
+          "                }",
+          "            }",
+          "            let dummies: Vec<(String, String)> = keys.iter().map(|k| (k.clone(), format!(\"<{k}>\"))).collect();",
+          "            let pairs: Vec<(&str, &str)> = dummies.iter().map(|(k, v)| (k.as_str(), v.as_str())).collect();",
+          "            let rendered = site.render(&pairs);",
+          "            assert!(",
+          "                !rendered.contains('{') && !rendered.contains('}'),",
+          "                \"{site:?} left an unrendered placeholder behind: {rendered:?}\"",
+          "            );",
+          "        }",
+          "    }"
+        ].freeze
+
+        # Argument lists a refusal site's render test tries: empty, single and unsorted.
+        LIST_CASES = [[], ["only \"one\""], %w[zeta alpha mid]].freeze
+
+        module_function
+
+        # @param enum [String] the enum's name
+        # @param kind [Symbol] `:order`, `:templates` or `:set`
+        # @param variants [Array<String>] the variant names
+        # @param rows [Array<Hash>] the table's rows
+        # @param by_site [Hash, nil] a template table's argument rows by site
+        # @return [Array<String>] the test module, as Rust lines
+        def tests(enum, kind, variants = [], rows = [], by_site = nil)
+          lines = ["#[cfg(test)]", "mod tests {", "    use super::*;", ""] + kind_tests(enum, kind, variants, rows, by_site)
+          lines.pop while lines.last == ""
+          lines + ["}"]
+        end
+
+        # @return [Array<String>] the tests this kind of table has
+        def kind_tests(enum, kind, variants, rows, by_site)
+          return placeholder_test(enum) + [""] + render_args_test(variants, rows, by_site) if kind == :templates
+
+          lines = name_test(enum, kind)
+          kind == :order ? lines + order_test(enum) : lines
+        end
+
+        # @return [Array<String>] the test that every row is found by its own name
+        def name_test(enum, kind)
+          list = kind == :order ? "ORDER" : "ALL"
+          name = RustVocabulary.accessor_name(RustVocabulary.name_field(kind))
+          ["    #[test]",
+           "    fn every_row_is_found_by_its_own_name() {",
+           "        for row in #{enum}::#{list}.iter() {",
+           "            assert_eq!(#{enum}::from_name(row.#{name}()), Some(*row));",
+           "        }",
+           "    }",
+           ""]
+        end
+
+        # @return [Array<String>] the test that `position` is the index in `ORDER`
+        def order_test(enum)
+          ["    #[test]",
+           "    fn position_is_the_index_in_order() {",
+           "        for (index, step) in #{enum}::ORDER.iter().enumerate() {",
+           "            assert_eq!(step.position(), index);",
+           "        }",
+           "    }",
+           ""]
+        end
+
+        # Placeholders are read off each template's own text, never a second hand-kept list.
+        #
+        # @return [Array<String>] the test that no site renders a leftover placeholder
+        def placeholder_test(enum)
+          ["    #[test]",
+           "    fn every_site_renders_with_no_leftover_placeholder() {",
+           "        for site in #{enum}::ALL {"] + PLACEHOLDER_BODY
+        end
+
+        # Pins each site's typed `render_args` to Runtime::RefusalWording.render_with, computed
+        # here, for empty, single and unsorted list arguments; scalars carry a `"` to compare
+        # quoting.
+        #
+        # @return [Array<String>] the test that the Rust wording matches Ruby's
+        def render_args_test(variants, rows, by_site)
+          asserts = variants.zip(rows).flat_map do |variant, row|
+            specs = by_site.fetch(Arguments.site_key(row))
+            argument_cases(specs).map { |arguments| assertion(variant, row, specs, arguments) }
+          end
+          ["    #[test]",
+           "    fn render_args_matches_ruby_render_site() {",
+           asserts,
+           "    }"].flatten
+        end
+
+        # @return [Array<String>] one `assert_eq!` of a variant's rendered arguments
+        def assertion(variant, row, specs, arguments)
+          expected = Runtime::RefusalWording.render_with(row.fetch("template"), specs, arguments)
+          fields = specs.map do |spec|
+            name = spec.fetch("argument")
+            "#{Arguments.rust_field(name)}: #{rust_value(arguments.fetch(name.to_sym))}"
+          end
+          ["        assert_eq!(",
+           "            #{variant}Args { #{fields.join(", ")} }.render_args(),",
+           "            #{RustVocabulary.rust_string(expected)}",
+           "        );"]
+        end
+
+        # @param value [String, Array<String>] an argument value
+        # @return [String] the Rust expression for it
+        def rust_value(value)
+          return RustVocabulary.rust_string(value) unless value.is_a?(Array)
+
+          "&[#{value.map { |item| RustVocabulary.rust_string(item) }.join(", ")}]"
+        end
+
+        # @param specs [Array<Hash>] a site's argument rows
+        # @return [Array<Hash>] the argument values to try, by argument name
+        def argument_cases(specs)
+          cases = specs.any? { |spec| spec.fetch("shape") == "list" } ? LIST_CASES : [nil]
+          cases.map do |items|
+            specs.to_h do |spec|
+              name = spec.fetch("argument")
+              [name.to_sym, spec.fetch("shape") == "list" ? items : "#{name} \"x\""]
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/hecks/projections/rust_vocabulary.rb

@@ -1,6 +1,9 @@
 require_relative "../projector"
 require_relative "../runtime/refusal_wording"
 require_relative "vocabulary"
+require_relative "rust_vocabulary/enum_body"
+require_relative "rust_vocabulary/arguments"
+require_relative "rust_vocabulary/tests"
 
 module Hecks
   module Projections
@@ -62,6 +65,10 @@ module Hecks
       def mod_file
         mods    = TABLES.values.map { |spec| "pub mod #{spec[:file]};" }.join("\n")
         exports = TABLES.values.map { |spec| "pub use #{spec[:file]}::#{spec[:enum]};" }.join("\n")
+        "#{mod_banner}\n#{mods}\n\n#{exports}\n"
+      end
+
+      def mod_banner
         <<~RUST
           // GENERATED by #{GENERATOR} (Hecks::Projections::RustVocabulary,
           // lib/hecks/projections/rust_vocabulary.rb) from the Vocabulary
@@ -71,319 +78,43 @@ module Hecks
           // One module per projected table. Every enum below is matched
           // exhaustively by its own accessors — no wildcard arm — so a row the
           // language gains fails to compile until it is handled.
-
-          #{mods}
-
-          #{exports}
         RUST
       end
 
       def table_file(table, spec, rows, argument_rows = nil)
         variants = rows.map { |row| variant_name(row, spec[:variant_from]) }
-        duplicates = variants.tally.select { |_, count| count > 1 }.keys
-        raise ArgumentError, "duplicate #{spec[:enum]} variant(s): #{duplicates.join(', ')}" if duplicates.any?
-
-        enum   = spec[:enum]
-        fields = rows.first.keys
-        by_site = spec[:kind] == :templates ? site_arguments(rows, argument_rows) : nil
-        body = [
-          header(table),
-          "#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]",
-          "pub enum #{enum} {",
-          variants.map { |variant| "    #{variant}," },
-          "}",
-          "",
-          "impl #{enum} {",
-          constants(enum, variants, spec[:kind]),
-          fields.map { |field| accessor(enum, field, variants, rows) },
-          from_name(enum, spec[:kind]),
-          extras(enum, variants, spec[:kind]),
-          "}",
-          "",
-          by_site ? argument_types(enum, variants, rows, by_site) : [],
-          tests(enum, spec[:kind], variants, rows, by_site)
-        ]
+        reject_duplicates!(spec[:enum], variants)
+        by_site = site_arguments_of(spec, rows, argument_rows)
+        body = [header(table), enum_lines(spec[:enum], variants), EnumBody.impl_lines(spec, variants, rows),
+                argument_lines(spec[:enum], variants, rows, by_site), tests_lines(spec, variants, rows, by_site)]
         "#{body.flatten.join("\n").rstrip}\n"
       end
 
-      def constants(enum, variants, kind)
-        list = variants.map { |variant| "        #{enum}::#{variant}," }
-        if kind == :order
-          ["    /// The declared step order, first to last.",
-           "    pub const ORDER: [#{enum}; #{variants.size}] = [", list, "    ];", ""]
-        else
-          ["    /// Every row, in declared order.",
-           "    pub const ALL: &'static [#{enum}] = &[", list, "    ];", ""]
-        end
-      end
-
-      def accessor(enum, field, variants, rows)
-        arms = variants.zip(rows).map { |variant, row| "            #{enum}::#{variant} => #{rust_string(row.fetch(field))}," }
-        ["    /// The row's declared `#{field}`.",
-         "    pub fn #{accessor_name(field)}(&self) -> &'static str {",
-         "        match self {",
-         arms,
-         "        }",
-         "    }",
-         ""]
+      def site_arguments_of(spec, rows, argument_rows)
+        Arguments.site_arguments(rows, argument_rows) if spec[:kind] == :templates
       end
 
-      # Built on the enum's own list and name accessor, not a string match, so no wildcard arm.
-      def from_name(enum, kind)
-        list  = kind == :order ? "ORDER" : "ALL"
-        field = kind == :templates ? "site" : name_field(kind)
-        ["    /// The row whose `#{field}` is `name`, if any.",
-         "    pub fn from_name(name: &str) -> Option<#{enum}> {",
-         "        #{enum}::#{list}.iter().copied().find(|row| row.#{accessor_name(field)}() == name)",
-         "    }",
-         ""]
+      def argument_lines(enum, variants, rows, by_site)
+        by_site ? Arguments.argument_types(enum, variants, rows, by_site) : []
       end
 
-      def extras(enum, variants, kind)
-        case kind
-        when :order
-          arms = variants.each_with_index.map { |variant, index| "            #{enum}::#{variant} => #{index}," }
-          ["    /// This step's index in `ORDER`.",
-           "    pub fn position(&self) -> usize {",
-           "        match self {",
-           arms,
-           "        }",
-           "    }"]
-        when :templates
-          ["    /// `RefusalWording.substitute`: replace every `{key}` marker, in the",
-           "    /// order given. A template is read, never evaluated. Private: call",
-           "    /// sites go through a site's typed `<Variant>Args::render_args`,",
-           "    /// which formats and supplies every declared argument.",
-           "    fn render(&self, values: &[(&str, &str)]) -> String {",
-           "        let mut text = self.template().to_string();",
-           "        for (key, value) in values {",
-           "            text = text.replace(&format!(\"{{{key}}}\"), value);",
-           "        }",
-           "        text",
-           "    }"]
-        else
-          []
-        end
+      def tests_lines(spec, variants, rows, by_site)
+        Tests.tests(spec[:enum], spec[:kind], variants, rows, by_site)
       end
 
-      # [refusal, site] => that site's argument rows; refused unless they name exactly the
-      # template's placeholders, in first-appearance order, with known formatting rules.
-      def site_arguments(rows, argument_rows)
-        grouped = argument_rows.group_by { |row| [row.fetch("refusal"), row.fetch("site")] }
-        orphans = grouped.keys - rows.map { |row| [row.fetch("refusal"), row.fetch("site")] }
-        raise ArgumentError, "RefusalSiteArgument rows name no RefusalTemplate: #{orphans.inspect}" if orphans.any?
-
-        rows.to_h do |row|
-          key   = [row.fetch("refusal"), row.fetch("site")]
-          specs = grouped.fetch(key, [])
-          wants = row.fetch("template").scan(/\{(\w+)\}/).flatten.uniq
-          names = specs.map { |spec| spec.fetch("argument") }
-          unless names == wants
-            raise ArgumentError, "RefusalSiteArgument for #{key.join('/')} declares #{names.inspect}; " \
-                                 "its template's placeholders are #{wants.inspect}"
-          end
-          specs.each { |spec| check_rule!(key, spec) }
-          [key, specs]
-        end
-      end
-
-      def check_rule!(key, spec)
-        where = "#{key.join('/')}.#{spec.fetch('argument')}"
-        unless Runtime::RefusalWording::SHAPES.include?(spec.fetch("shape"))
-          raise ArgumentError, "#{where}: unknown shape #{spec['shape'].inspect}"
-        end
-        unless Runtime::RefusalWording::QUOTINGS.include?(spec.fetch("quoting"))
-          raise ArgumentError, "#{where}: unknown quoting #{spec['quoting'].inspect}"
-        end
-        return if %w[true false].include?(spec.fetch("sorted"))
-
-        raise ArgumentError, "#{where}: sorted must be \"true\" or \"false\""
-      end
-
-      def argument_types(enum, variants, rows, by_site)
-        support = [
-          "/// Ruby's `#inspect` of a name, as a refusal quotes it: `{:?}` on a",
-          "/// `&str`, the quoting every kernel call site used before",
-          "/// RefusalSiteArgument existed.",
-          "fn quoted(text: &str) -> String {",
-          "    format!(\"{text:?}\")",
-          "}",
-          "",
-          "/// A list argument, written the way its RefusalSiteArgument row says:",
-          "/// sorted first (before quoting), each item quoted, then joined; an",
-          "/// empty list reads `when_empty`.",
-          "fn list(items: &[&str], sorted: bool, inspect: bool, separator: &str, when_empty: &str) -> String {",
-          "    let mut items = items.to_vec();",
-          "    if sorted {",
-          "        items.sort_unstable();",
-          "    }",
-          "    if items.is_empty() {",
-          "        return when_empty.to_string();",
-          "    }",
-          "    let write = |item: &&str| if inspect { quoted(item) } else { item.to_string() };",
-          "    items.iter().map(write).collect::<Vec<_>>().join(separator)",
-          "}",
-          ""
-        ]
-        support + variants.zip(rows).flat_map do |variant, row|
-          args_struct(enum, variant, row, by_site.fetch([row.fetch("refusal"), row.fetch("site")]))
-        end
+      def reject_duplicates!(enum, variants)
+        duplicates = variants.tally.select { |_, count| count > 1 }.keys
+        raise ArgumentError, "duplicate #{enum} variant(s): #{duplicates.join(", ")}" if duplicates.any?
       end
 
-      def args_struct(enum, variant, row, specs)
-        fields = specs.flat_map do |spec|
-          type = spec.fetch("shape") == "list" ? "&'a [&'a str]" : "&'a str"
-          ["    /// #{rule_reading(spec)}", "    pub #{rust_field(spec.fetch('argument'))}: #{type},"]
-        end
-        locals = specs.filter_map { |spec| formatted_local(spec) }
-        pairs  = specs.map do |spec|
-          name  = spec.fetch("argument")
-          value = formatted_local(spec) ? "#{local_name(name)}.as_str()" : "self.#{rust_field(name)}"
-          "            (#{rust_string(name)}, #{value}),"
-        end
-        ["/// `#{enum}::#{variant}`'s arguments — `RefusalWording.render_site(" \
-         "#{rust_string(row.fetch('refusal'))}, #{rust_string(row.fetch('site'))}, ...)`.",
-         "#[derive(Debug, Clone, Copy)]",
-         "pub struct #{variant}Args<'a> {",
-         fields,
-         "}",
-         "",
-         "impl #{variant}Args<'_> {",
-         "    /// The site's wording, every argument formatted by its declared row.",
-         "    pub fn render_args(&self) -> String {",
-         locals.map { |line| "        #{line}" },
-         "        #{enum}::#{variant}.render(&[",
-         pairs,
-         "        ])",
-         "    }",
+      def enum_lines(enum, variants)
+        ["#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]",
+         "pub enum #{enum} {",
+         variants.map { |variant| "    #{variant}," },
          "}",
          ""]
       end
 
-      def formatted_local(spec)
-        name  = spec.fetch("argument")
-        field = "self.#{rust_field(name)}"
-        if spec.fetch("shape") == "list"
-          "let #{local_name(name)} = list(#{field}, #{spec.fetch('sorted')}, #{spec.fetch('quoting') == 'inspect'}, " \
-            "#{rust_string(spec.fetch('separator'))}, #{rust_string(spec.fetch('when_empty'))});"
-        elsif spec.fetch("quoting") == "inspect"
-          "let #{local_name(name)} = quoted(#{field});"
-        end
-      end
-
-      def rule_reading(spec)
-        quoting = spec.fetch("quoting") == "inspect" ? ", quoted" : ""
-        return "scalar#{quoting}" unless spec.fetch("shape") == "list"
-
-        sorted = spec.fetch("sorted") == "true" ? ", sorted" : ""
-        "list#{sorted}#{quoting}, joined #{spec.fetch('separator').inspect}, empty reads #{spec.fetch('when_empty').inspect}"
-      end
-
-      def local_name(argument) = "#{argument}_text"
-
-      def rust_field(argument) = RUST_KEYWORDS.include?(argument) ? "r##{argument}" : argument
-
-      def tests(enum, kind, variants = [], rows = [], by_site = nil)
-        list = kind == :order ? "ORDER" : "ALL"
-        name = accessor_name(kind == :templates ? "site" : name_field(kind))
-        lines = ["#[cfg(test)]",
-                 "mod tests {",
-                 "    use super::*;",
-                 ""]
-        unless kind == :templates
-          lines += ["    #[test]",
-                    "    fn every_row_is_found_by_its_own_name() {",
-                    "        for row in #{enum}::#{list}.iter() {",
-                    "            assert_eq!(#{enum}::from_name(row.#{name}()), Some(*row));",
-                    "        }",
-                    "    }",
-                    ""]
-        end
-        lines += order_test(enum) if kind == :order
-        if kind == :templates
-          lines += placeholder_test(enum)
-          lines += [""] + render_args_test(variants, rows, by_site)
-        end
-        lines.pop while lines.last == ""
-        lines + ["}"]
-      end
-
-      def order_test(enum)
-        ["    #[test]",
-         "    fn position_is_the_index_in_order() {",
-         "        for (index, step) in #{enum}::ORDER.iter().enumerate() {",
-         "            assert_eq!(step.position(), index);",
-         "        }",
-         "    }",
-         ""]
-      end
-
-      # Placeholders are read off each template's own text, never a second hand-kept list.
-      def placeholder_test(enum)
-        ["    #[test]",
-         "    fn every_site_renders_with_no_leftover_placeholder() {",
-         "        for site in #{enum}::ALL {",
-         "            let template = site.template();",
-         "            let mut keys: Vec<String> = Vec::new();",
-         "            let mut current: Option<String> = None;",
-         "            for ch in template.chars() {",
-         "                match (ch, current.as_mut()) {",
-         "                    ('{', _) => current = Some(String::new()),",
-         "                    ('}', Some(key)) => {",
-         "                        keys.push(key.clone());",
-         "                        current = None;",
-         "                    }",
-         "                    (_, Some(key)) => key.push(ch),",
-         "                    (_, None) => {}",
-         "                }",
-         "            }",
-         "            let dummies: Vec<(String, String)> = keys.iter().map(|k| (k.clone(), format!(\"<{k}>\"))).collect();",
-         "            let pairs: Vec<(&str, &str)> = dummies.iter().map(|(k, v)| (k.as_str(), v.as_str())).collect();",
-         "            let rendered = site.render(&pairs);",
-         "            assert!(",
-         "                !rendered.contains('{') && !rendered.contains('}'),",
-         "                \"{site:?} left an unrendered placeholder behind: {rendered:?}\"",
-         "            );",
-         "        }",
-         "    }"]
-      end
-
-      # Pins each site's typed `render_args` to Runtime::RefusalWording.render_with, computed here,
-      # for empty, single and unsorted list arguments; scalars carry a `"` to compare quoting.
-      def render_args_test(variants, rows, by_site)
-        asserts = variants.zip(rows).flat_map do |variant, row|
-          specs = by_site.fetch([row.fetch("refusal"), row.fetch("site")])
-          argument_cases(specs).map do |arguments|
-            expected = Runtime::RefusalWording.render_with(row.fetch("template"), specs, arguments)
-            fields = specs.map do |spec|
-              value = arguments.fetch(spec.fetch("argument").to_sym)
-              rust_value = value.is_a?(Array) ? "&[#{value.map { |item| rust_string(item) }.join(', ')}]" : rust_string(value)
-              "#{rust_field(spec.fetch('argument'))}: #{rust_value}"
-            end
-            ["        assert_eq!(",
-             "            #{variant}Args { #{fields.join(', ')} }.render_args(),",
-             "            #{rust_string(expected)}",
-             "        );"]
-          end
-        end
-        ["    #[test]",
-         "    fn render_args_matches_ruby_render_site() {",
-         asserts,
-         "    }"].flatten
-      end
-
-      LIST_CASES = [[], ["only \"one\""], %w[zeta alpha mid]].freeze
-
-      def argument_cases(specs)
-        cases = specs.any? { |spec| spec.fetch("shape") == "list" } ? LIST_CASES : [nil]
-        cases.map do |items|
-          specs.to_h do |spec|
-            name = spec.fetch("argument")
-            [name.to_sym, spec.fetch("shape") == "list" ? items : "#{name} \"x\""]
-          end
-        end
-      end
-
       def name_field(kind) = kind == :order ? "step" : "name"
 
       # `refusal` reads ambiguously beside the kernel's own `Refusal` enum.

data/lib/hecks/projections/site/admin.rb

@@ -83,15 +83,19 @@ module Hecks
         private
 
         def typed_fields(row, problems)
-          unknown = row.keys - FIELDS.keys
-          problems << "Admin row has no field #{unknown.join(', ')}; fields are #{FIELDS.keys.join(', ')}" if unknown.any?
-          (REQUIRED - row.keys).each { |field| problems << "Admin row needs #{field}" }
+          check_fields(row, problems)
           row.slice(*FIELDS.keys).select do |field, value|
             value.is_a?(FIELDS.fetch(field)) ||
               (problems << "Admin row has #{field} #{value.inspect}; #{field} is a #{FIELDS.fetch(field)}")
           end
         end
 
+        def check_fields(row, problems)
+          unknown = row.keys - FIELDS.keys
+          problems << "Admin row has no field #{unknown.join(", ")}; fields are #{FIELDS.keys.join(", ")}" if unknown.any?
+          (REQUIRED - row.keys).each { |field| problems << "Admin row needs #{field}" }
+        end
+
         def check(rows, problems)
           check_paths(problems)
           check_cms_base(problems)
@@ -127,12 +131,14 @@ module Hecks
         # The hand-off to the content system is an admin endpoint: it answers only an admin.
         def check_sso(rows, problems)
           row = rows.find { |candidate| candidate.path == setting.sso }
-          if row.nil?
-            problems << "Admin sso #{setting.sso} is not a route of the table"
-          else
-            problems << "Admin sso #{setting.sso} is #{row.auth}; it must be admin" unless row.auth == "admin"
-            problems << "Admin sso #{setting.sso} is a #{row.kind}; it must be an endpoint" unless row.kind == "endpoint"
-          end
+          return problems << "Admin sso #{setting.sso} is not a route of the table" if row.nil?
+
+          check_sso_row(row, problems)
+        end
+
+        def check_sso_row(row, problems)
+          problems << "Admin sso #{setting.sso} is #{row.auth}; it must be admin" unless row.auth == "admin"
+          problems << "Admin sso #{setting.sso} is a #{row.kind}; it must be an endpoint" unless row.kind == "endpoint"
         end
       end
     end

data/lib/hecks/projections/site/admin_cms/templates/membership.rb

@@ -0,0 +1,115 @@
+# frozen_string_literal: true
+
+module Hecks
+  module Projections
+    module Site
+      module AdminCms
+        module Templates
+          # The TypeScript text of `membership`.
+          module Membership
+            # The file, with `__NAME__` placeholders.
+            TEXT = <<~'TS'
+              __BANNER__
+
+              // Is this editor still admitted? The domain's membership list decides, not the content system.
+              // Signing in (endpoints/sso.ts) proved the person was admitted then; this asks again, so that
+              // disabling or removing someone locks them out on their next request, not when their session runs out.
+              //
+              // The question is the host's own account route, which answers only for a person who holds a role
+              // and is not disabled, asked with a short account token signed by the secret the host checks (the
+              // content system's AUTH_SECRET is the host's SESSION_SECRET). The answer is remembered for a minute
+              // per email so every admin request does not cost a round trip.
+              import { accountToken, resolveAccountCookieName } from "@hecks/client";
+
+              const DEFAULT_URL = __HOST_DEFAULT__;
+              const DEFAULT_COOKIE = __COOKIE__;
+              const TOKEN_TTL_SECONDS = 60;
+              export const REMEMBER_MS = 60_000;
+
+              // The shared secret. With none set outside production the host's development default is used, as
+              // endpoints/sso.ts does; in production an unset secret refuses every question.
+              const AUTH_SECRET =
+                process.env.AUTH_SECRET || (process.env.NODE_ENV === "production" ? "" : "dev_only_change_me_in_production");
+
+              export interface MembershipCheck {
+                /** True while `email` is admitted; false when membership says not, or cannot be asked. */
+                isAdmitted(email: string): Promise<boolean>;
+              }
+
+              export interface MembershipOptions {
+                url?: string;
+                /** The host route asked: the account route (any admitted person) by default, the members list for admin roles only. */
+                path?: string;
+                /** Decides from the host's answer; the default is any 2xx. */
+                accept?: (res: Response, email: string) => Promise<boolean>;
+                secret?: string;
+                cookieName?: string;
+                fetch?: typeof fetch;
+                now?: () => number;
+              }
+
+              /** A membership check with its own one-minute memory. */
+              export function membershipCheck(opts: MembershipOptions = {}): MembershipCheck {
+                const remembered = new Map<string, { admitted: boolean; until: number }>();
+                const now = opts.now ?? Date.now;
+                const doFetch = opts.fetch ?? fetch;
+
+                return {
+                  async isAdmitted(email: string): Promise<boolean> {
+                    const key = email.trim().toLowerCase();
+                    const hit = remembered.get(key);
+                    if (hit && hit.until > now()) return hit.admitted;
+
+                    const secret = opts.secret ?? AUTH_SECRET;
+                    const url = (opts.url ?? (process.env[__HOST_ENV__] || DEFAULT_URL)).replace(/\/+$/, "");
+                    const cookieName = resolveAccountCookieName(opts.cookieName ?? (process.env.HECKS_SESSION_COOKIE || DEFAULT_COOKIE));
+                    let admitted = false;
+                    if (secret) {
+                      try {
+                        const res = await doFetch(`${url}${opts.path ?? __ACCOUNT_PATH__}`, {
+                          headers: { Cookie: `${cookieName}=${accountToken(secret, key, TOKEN_TTL_SECONDS)}` },
+                          signal: AbortSignal.timeout(5_000),
+                        });
+                        admitted = opts.accept ? res.ok && (await opts.accept(res, key)) : res.ok;
+                      } catch {
+                        // Membership cannot be asked: refuse, as the content system already refuses to
+                        // show domain-held fields it cannot read.
+                        admitted = false;
+                      }
+                    }
+                    remembered.set(key, { admitted, until: now() + REMEMBER_MS });
+                    return admitted;
+                  },
+                };
+              }
+
+              export const membership = membershipCheck();
+
+              /** The roles the host's own admin gate passes. */
+              export const ADMIN_ROLES = __ROLES__;
+
+              /** True when `rows` (the host's members list) hold `email` with an admin role and not disabled. */
+              export function holdsAdminRole(rows: unknown, email: string): boolean {
+                return (
+                  Array.isArray(rows) &&
+                  rows.some((row: any) => typeof row?.email === "string" && row.email.trim().toLowerCase() === email && ADMIN_ROLES.includes(row.role) && row.disabled !== true)
+                );
+              }
+
+              /**
+               * Admin roles only. The host's members list answers any signed-in member, so it is the list's own
+               * row for the caller that decides, as the site's admin gate does.
+               */
+              export const adminCheck = (opts: MembershipOptions = {}): MembershipCheck =>
+                membershipCheck({
+                  ...opts,
+                  path: __MEMBERS_PATH__,
+                  accept: async (res, email) => holdsAdminRole(await res.json().catch(() => null), email),
+                });
+            TS
+          end
+        end
+      end
+    end
+  end
+end