@aotter/mantle 0.2.0-alpha.6 → 0.2.0-alpha.8

package/dist/kernel/web-gateway.js

@@ -0,0 +1,68 @@
+/** Selected web authorization loads on a request, outside the ordinary web startup graph. */
+import { web } from "./web.js";
+import { gatewayCaller, hostFailure } from "./host-caller.js";
+import { accessRequest } from "./host-access.js";
+import { authorizeTarget } from "./authorization.js";
+import { forwarded, ContractError } from "./contracts.js";
+export function gatewayWeb(options, table) {
+    const run = async (method, request, env, ctx) => {
+        let caller, failure, ran = false;
+        const access = options.gateway ? accessRequest(ctx, options) : undefined;
+        try {
+            const pathname = new URL(request.url).pathname, path = method === "fetch" ? pathname.replace(/\.md$/, "") : pathname;
+            const page = Object.entries(options.pages).sort(([a], [b]) => (a.match(/\{[^{}]+\}/g)?.length ?? 0) - (b.match(/\{[^{}]+\}/g)?.length ?? 0)).find(([template]) => new RegExp("^" + template.split(/(\{[^{}]+\})/).map(part => part.startsWith("{") ? "[^/]+" : part.replace(/[.*+?^$()|[\]\\]/g, "\\$&")).join("") + "$").test(path))?.[1];
+            const index = pathname === "/llms.txt" || pathname === "/sitemap.xml";
+            if (method === "fetch" ? !["GET", "HEAD"].includes(request.method) || !index && (!pathname.endsWith(".md") || !page?.markdown) : !page)
+                return method === "head" ? "" : undefined;
+            const name = page?.view ?? Object.values(options.pages).find(p => p.list)?.list;
+            await access?.select(name ? `view:${name}` : "web");
+            caller = forwarded(ctx, options.gateway) ? gatewayCaller(ctx, options.gateway, options.fields) : typeof options.caller === "function" ? await options.caller(request, env, { readOnly: true }) : options.caller ?? { kind: "anonymous" };
+            const site = web({ ...options, gateway: undefined, authorize: undefined, onAccess: undefined, caller }, table.map(([name, view]) => [name, { ...view, page: async (...args) => {
+                        try {
+                            ran = true;
+                            await access?.select(`view:${name}`, caller);
+                            await access?.check(true);
+                            view.check?.(caller);
+                            if (options.authorize)
+                                await authorizeTarget(options.authorize, { kind: "view", name }, caller);
+                            if (access?.dryRun)
+                                return { rows: [] };
+                            return view.page(...args);
+                        }
+                        catch (error) {
+                            failure = error;
+                            throw error;
+                        }
+                    } }]));
+            // The ordinary renderer validates query/path fields; wrapped pages decide before any SQL.
+            const result = await site[method](request, env, options.gateway ? undefined : ctx);
+            if (failure)
+                throw failure;
+            if (result === undefined)
+                return;
+            if (access && result instanceof Response && result.status >= 400) {
+                const payload = await result.clone().json().catch(() => null);
+                if (payload?.error)
+                    throw new ContractError(payload.error.code, "", payload.error.path, { status: result.status, fields: payload.error.field ? { field: payload.error.field } : undefined });
+            }
+            if (!ran)
+                return result;
+            if (access?.dryRun) {
+                const response = access.response();
+                return method === "fetch" ? response : "";
+            }
+            access?.finish();
+            return result;
+        }
+        catch (error) {
+            access?.finish(error);
+            if (method === "head")
+                throw error;
+            return hostFailure(error, caller, "web");
+        }
+    };
+    return {
+        fetch: (request, env, ctx) => run("fetch", request, env, ctx),
+        head: (request, env, ctx) => run("head", request, env, ctx),
+    };
+}

package/dist/kernel/web-head.js

@@ -0,0 +1,15 @@
+/** HTML head formatting loads only when the application asks for head tags. */
+const escape = (v) => String(v).replace(/[&<>"']/g, c => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" }[c]));
+export function headTags(canonical, row, markdown, locales) {
+    let tags = '<link rel="canonical" href="' + escape(canonical) + '">';
+    if (markdown)
+        tags += '<link rel="alternate" type="text/markdown" href="' + escape(canonical + ".md") + '">';
+    if (locales?.[0])
+        tags += '<link rel="alternate" hreflang="' + escape(locales[0]) + '" href="' + escape(canonical) + '">';
+    for (const key of Object.keys(row))
+        if (key.endsWith("_lat") && typeof row[key] === "number" && typeof row[key.slice(0, -4) + "_lng"] === "number") {
+            tags += '<meta name="geo.position" content="' + escape(row[key]) + ";" + escape(row[key.slice(0, -4) + "_lng"]) + '">';
+            break;
+        }
+    return tags;
+}

package/dist/kernel/web-response.js

@@ -0,0 +1,8 @@
+/** Response hashing is needed only when a Web route actually renders. */
+export async function webResponse(request, body, type, cacheControl) {
+    const hash = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(body));
+    const etag = '"' + Array.from(new Uint8Array(hash), b => b.toString(16).padStart(2, '0')).join('') + '"';
+    const headers = { 'content-type': type + '; charset=utf-8', 'cache-control': cacheControl, etag };
+    const cached = request.headers.get('if-none-match')?.split(',').some(tag => tag.trim() === '*' || tag.trim().replace(/^W\//, '') === etag);
+    return new Response(cached || request.method === 'HEAD' ? null : body, { status: cached ? 304 : 200, headers });
+}

package/dist/kernel/web.d.ts

@@ -0,0 +1,77 @@
+/** Web output for a generated public View table: /llms.txt, /sitemap.xml, Markdown pages and head tags. SQL owns visibility. */
+import { type Caller, type Gateway, type RequestContext } from "./contracts.js";
+import type { UserFields } from "./user-fields.js";
+import { type Conversions } from "./surface.js";
+/** An app's public Views: row type and input keys per View, and the Views a list may name (input that accepts no fields). */
+export interface App {
+    Rows: Record<string, any>;
+    Inputs: Record<string, string>;
+    List: string;
+}
+type At<T, K> = K extends keyof T ? T[K] : never;
+type Params<S extends string> = S extends `${string}{${infer P}}${infer Rest}` ? P | Params<Rest> : never;
+/** A page: the View that reads one row, an optional list View enumerating its URLs, and an optional Markdown text field. */
+export type Page<A extends App> = {
+    [V in keyof A["Rows"] & string]: {
+        view: V;
+        list?: A["List"];
+        markdown?: {
+            [K in keyof A["Rows"][V]]: A["Rows"][V][K] extends string | null ? K : never;
+        }[keyof A["Rows"][V]] & string;
+    };
+}[keyof A["Rows"] & string];
+type ListKeys<A extends App, T> = T extends {
+    list: infer L extends string;
+} ? keyof At<A["Rows"], L> : string;
+/** `{name}` parameters must equal the View input, and be columns of the list and of the View. */
+export type Pages<A extends App, P extends Record<string, Page<A>>> = {
+    [K in keyof P]: K extends string ? [Params<K>] extends [At<A["Inputs"], P[K]["view"]>] ? [At<A["Inputs"], P[K]["view"]>] extends [Params<K>] ? [Params<K>] extends [ListKeys<A, P[K]>] ? [Params<K>] extends [keyof At<A["Rows"], P[K]["view"]>] ? P[K] : never : never : never : never : never;
+};
+export type Options<A extends App, Database, P extends Record<string, Page<A>>, E> = Omit<WebOptions<Database, E>, "pages"> & {
+    pages: P & Pages<A, P>;
+};
+/** One public View: its query-string reader, paged boundary, bind conversions and boolean input keys. */
+export interface View<Database> {
+    readonly check?: (caller: Caller) => void;
+    /** The input rejects an empty query, so a list cannot name this View. */
+    readonly unlisted?: true;
+    readonly query: (params: URLSearchParams) => {
+        input: Record<string, unknown>;
+    };
+    readonly page: (db: Database, caller: Caller, input: never, paging: {
+        limit: number;
+        cursor?: string;
+    }) => Promise<{
+        rows: Record<string, unknown>[];
+        nextCursor?: string;
+    }>;
+    readonly convert?: Conversions;
+    readonly booleans?: readonly string[];
+}
+export interface WebHandler<E> {
+    fetch(request: Request, env?: E, ctx?: RequestContext): Promise<Response | undefined>;
+    head(request: Request, env?: E, ctx?: RequestContext): Promise<string>;
+}
+export type WebOptions<Database, E> = {
+    db: Database;
+    caller?: Caller | ((request: Request, env: E, authority: {
+        readonly readOnly: boolean;
+    }) => Caller | Promise<Caller>);
+    origin: string;
+    title: string;
+    description: string;
+    locales?: readonly string[];
+    pages: Record<string, {
+        view: string;
+        list?: string;
+        markdown?: string;
+    }>;
+    cacheControl?: string;
+    gateway?: Gateway;
+    fields?: UserFields;
+    authorize?: import("./contracts.js").Authorize;
+    onAccess?: import("./contracts.js").GatewayOptions["onAccess"];
+    accessTargets?: import("./contracts.js").GatewayOptions["accessTargets"];
+};
+export declare function web<Database, E>(options: WebOptions<Database, E>, table: readonly (readonly [string, View<Database>])[]): WebHandler<E>;
+export {};

package/dist/kernel/web.js

@@ -0,0 +1,158 @@
+/** Web output for a generated public View table: /llms.txt, /sitemap.xml, Markdown pages and head tags. SQL owns visibility. */
+import { forwarded, wire, ContractError } from "./contracts.js";
+import { convert, decode } from "./surface.js";
+const escape = (v) => String(v).replace(/[&<>"']/g, c => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" }[c]));
+const label = (v) => String(v).replace(/[\r\n]/g, " ").replace(/[\\[\]]/g, "\\$&");
+const size = (s) => new TextEncoder().encode(s).length;
+const NO_STORE = { "cache-control": "no-store" };
+const notFound = () => new Response(null, { status: 404, headers: NO_STORE });
+export function web(options, table) {
+    const views = new Map(table);
+    const query = (name, db, caller, params, cursor) => {
+        const view = views.get(name), input = { ...view.query(params).input };
+        convert(input, view.convert);
+        return view.page(db, caller, input, { limit: 500, cursor });
+    };
+    for (const [path, page] of Object.entries(options.pages))
+        if (page.list && views.get(page.list)?.unlisted)
+            throw new TypeError(`Page ${path} lists View '${page.list}', whose input rejects an empty query; a list View must accept no input.`);
+    const origin = new URL(options.origin);
+    if (!/^https?:$/.test(origin.protocol) || origin.username || origin.password || origin.pathname !== "/" || origin.search || origin.hash)
+        throw new TypeError("origin must be an HTTP(S) origin.");
+    const pages = Object.entries(options.pages).map(([path, page]) => {
+        if (!path.startsWith("/") || /[?#]/.test(path))
+            throw new TypeError("Page templates must be absolute paths without queries or fragments.");
+        const keys = [];
+        const pattern = path.split(/(\{[^{}]+\})/).map(part => part.startsWith("{") ? (keys.push(part.slice(1, -1)), "([^/]+)") : part.replace(/[.*+?^$()|[\]\\]/g, "\\$&")).join("");
+        return { path, page, keys, pattern: new RegExp("^" + pattern + "$") };
+    }).sort((a, b) => a.keys.length - b.keys.length);
+    const context = async (request, env, ctx) => ({ db: options.db, caller: forwarded(ctx, options.gateway)
+            ? (await import("./host-caller.js")).gatewayCaller(ctx, options.gateway, options.fields)
+            : typeof options.caller === "function" ? await options.caller(request, env, { readOnly: ["GET", "HEAD"].includes(request.method) }) : options.caller ?? { kind: "anonymous" } });
+    const urlFor = (path, row, view) => origin.origin + path.replace(/\{([^{}]+)\}/g, (_, key) => {
+        let value = row[key];
+        if (views.get(view).booleans?.includes(key) && (value === 0 || value === 1))
+            value = Boolean(value);
+        if (value === null || value === undefined)
+            throw new TypeError("List View must return every page parameter: " + key);
+        const segment = String(value);
+        if (segment === "." || segment === "..")
+            return "";
+        return encodeURIComponent(segment).replace(/[()]/g, c => "%" + c.charCodeAt(0).toString(16).toUpperCase());
+    });
+    const validUrl = (path, row, view) => { if ([...path.matchAll(/\{([^{}]+)\}/g)].some(([, key]) => row[key] === "." || row[key] === ".."))
+        return; return urlFor(path, row, view); };
+    const match = (path) => {
+        for (const entry of pages) {
+            const hit = entry.pattern.exec(path);
+            if (!hit)
+                continue;
+            return { ...entry, params: new URLSearchParams(decode(entry.keys, hit, "Malformed URL parameter.", "web/path")) };
+        }
+    };
+    const read = async (entry, ctx) => (await query(entry.page.view, ctx.db, ctx.caller, entry.params)).rows[0];
+    const response = async (request, body, type, caller) => {
+        const { webResponse } = await import('./web-response.js');
+        return webResponse(request, body, type, caller.kind === "anonymous" ? (options.cacheControl ?? "public, max-age=60") : "private, no-store");
+    };
+    if (options.gateway || options.authorize) {
+        let handle;
+        const load = async () => handle ??= (await import("./web-gateway.js")).gatewayWeb(options, table);
+        return {
+            fetch: async (request, env, ctx) => (await load()).fetch(request, env, ctx),
+            head: async (request, env, ctx) => (await load()).head(request, env, ctx),
+        };
+    }
+    return {
+        async fetch(request, env, execution) {
+            let caller;
+            try {
+                if (request.method !== "GET" && request.method !== "HEAD")
+                    return;
+                const path = new URL(request.url).pathname, index = path === "/llms.txt" || path === "/sitemap.xml";
+                const entry = !index && path.endsWith(".md") ? match(path.slice(0, -3)) : undefined, markdown = entry?.page.markdown;
+                if (!index && !markdown)
+                    return;
+                const ctx = await context(request, env, execution);
+                caller = ctx.caller;
+                if (index) {
+                    const sitemap = path === "/sitemap.xml", cap = sitemap ? 50000 : 5000, limit = sitemap ? 50 * 1024 * 1024 : 1024 * 1024;
+                    const start = sitemap ? '<?xml version="1.0" encoding="UTF-8"?><urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">' : "# " + label(options.title) + "\n\n> " + label(options.description) + "\n\n## Pages\n\n", end = sitemap ? "</urlset>" : "\n";
+                    const links = [];
+                    let visited = 0, requests = 0, bytes = size(start + end);
+                    if (bytes > limit)
+                        throw new TypeError("Web index header exceeds its byte limit.");
+                    pagesLoop: for (const entry of pages) {
+                        if (!entry.page.list)
+                            continue;
+                        let cursor;
+                        do {
+                            if (requests >= (sitemap ? 100 : 10))
+                                break pagesLoop;
+                            requests++;
+                            const page = await query(entry.page.list, ctx.db, ctx.caller, new URLSearchParams(), cursor);
+                            for (const row of page.rows) {
+                                if (visited++ >= cap)
+                                    break pagesLoop;
+                                const url = validUrl(entry.path, row, entry.page.view);
+                                if (!url)
+                                    continue;
+                                const line = sitemap ? "<url><loc>" + escape(url) + "</loc></url>" : "- [" + label(row.title ?? url) + "](" + url + "): " + label(row.description ?? "") + "\n";
+                                const length = size(line);
+                                if (bytes + length > limit)
+                                    break pagesLoop;
+                                bytes += length;
+                                links.push(line);
+                            }
+                            if (visited >= cap)
+                                break pagesLoop;
+                            cursor = page.nextCursor;
+                        } while (cursor);
+                    }
+                    return response(request, start + links.join("") + end, sitemap ? "application/xml" : "text/plain", ctx.caller);
+                }
+                const exact = match(path);
+                if (exact)
+                    try {
+                        if (await read(exact, ctx))
+                            return;
+                    }
+                    catch (error) {
+                        if (wire(error).status !== 400)
+                            throw error;
+                    }
+                const row = await read(entry, ctx);
+                if (!row)
+                    return notFound();
+                const body = row[markdown];
+                if (body == null)
+                    return notFound();
+                if (typeof body !== "string")
+                    throw new TypeError("Markdown field must return text.");
+                return response(request, body, "text/markdown", ctx.caller);
+            }
+            catch (error) {
+                return (await import("./host-caller.js")).hostFailure(error, caller, "web");
+            }
+        },
+        async head(request, env, execution) {
+            try {
+                const path = new URL(request.url).pathname, entry = match(path);
+                if (!entry)
+                    return "";
+                const ctx = await context(request, env, execution), row = await read(entry, ctx);
+                if (!row)
+                    return "";
+                const canonical = validUrl(entry.path, row, entry.page.view);
+                if (!canonical)
+                    return "";
+                return (await import("./web-head.js")).headTags(canonical, row, !!entry.page.markdown, options.locales);
+            }
+            catch (error) {
+                if (error instanceof ContractError && error.code === "HOST_CONTRACT")
+                    throw error;
+                return "";
+            }
+        },
+    };
+}

package/dist/kernel/where.js

@@ -0,0 +1,27 @@
+const COMPARE = { gt: ">", gte: ">=", lt: "<", lte: "<=" };
+/**
+ * `column` is already quoted. `bind` registers one parameter and returns its placeholder. `insensitive` folds both sides of
+ * eq/ne/in/notIn with LOWER (text only) and picks the dialect's case-insensitive LIKE. A null eq/ne is IS [NOT] NULL.
+ * `like` takes a finished pattern (`escapeLike` the literal parts).
+ * @internal
+ */
+export function condition(d, column, operator, value, bind, insensitive = false) {
+    const lhs = insensitive ? `LOWER(${column})` : column;
+    const rhs = (v) => insensitive ? `LOWER(${bind(v)})` : bind(v);
+    switch (operator) {
+        case "in":
+        case "notIn": {
+            const list = Array.isArray(value) ? value : [value];
+            if (!list.length)
+                return operator === "in" ? "1 = 0" : "1 = 1";
+            return `${lhs} ${operator === "in" ? "IN" : "NOT IN"} (${list.map(rhs).join(", ")})`;
+        }
+        case "like": return `${column} ${d.like(insensitive)} ${bind(value)}${d.likeEscape}`;
+        case "eq":
+        case "ne":
+            if (value === null)
+                return `${column} IS ${operator === "eq" ? "" : "NOT "}NULL`;
+            return `${lhs} ${operator === "eq" ? "=" : "<>"} ${rhs(value)}`;
+        default: return `${column} ${COMPARE[operator]} ${bind(value)}`;
+    }
+}

package/dist/testing/index.d.ts

@@ -1,37 +1 @@
-/**
- * `@aotter/mantle/testing`: the dialect compliance suite (ADR-0035 decision 8). A dialect author calls
- * `runStorageConformance({ create, compile })` with their dialect's storage adapter on a real engine and asserts `report.ok`;
- * no test framework is imported. Behavior runs through the dialect (convergence, executor, policy, codec); fixtures are
- * seeded and read with plain SQL, typed values through the dialect's codec. A printer-corpus item the compile side refuses as
- * unsupported passes by that refusal; in every other case a refusal fails the case. The cases compile their SQL
- * with the CLI's parser, so they run in Node, not in a Worker.
- */
-import type { DatabaseDriver } from "../core/driver.js";
-import type { MantleStorageAdapter } from "../core/service.js";
-import type { SqlDialect } from "../spec/index.js";
-export interface StorageConformanceFixture {
-    /** The dialect's runtime side over the fresh database: `prepare` converges it and returns the executor. */
-    readonly storage: MantleStorageAdapter;
-    /** The same database, for the fixture's own plain-SQL seeding and reads. */
-    readonly driver: DatabaseDriver;
-    /** Release the database, even after a failure. */
-    readonly cleanup: () => void | Promise<void>;
-}
-export interface StorageConformanceOptions {
-    /** A fresh, empty database on the engine under test, for each case. Never supply a live database. */
-    readonly create: () => Promise<StorageConformanceFixture>;
-    /** The dialect's compile side (`<dialect>/compile`); D1 when omitted. */
-    readonly compile?: SqlDialect;
-}
-export interface StorageConformanceReport {
-    readonly ok: boolean;
-    /** Every check that ran, with its case, in order. */
-    readonly checks: readonly string[];
-    readonly failures: readonly {
-        readonly check: string;
-        readonly message: string;
-    }[];
-}
-/** Runs every case on its own database. A failing case never suppresses cleanup or the cases after it. */
-export declare function runStorageConformance(options: StorageConformanceOptions): Promise<StorageConformanceReport>;
-//# sourceMappingURL=index.d.ts.map
+export { userCaller as authenticatedAs } from "../kernel/user-caller.js";

package/dist/testing/index.js

@@ -1,43 +1 @@
-import { useCompileSide } from "./harness.js";
-import { Report } from "./report.js";
-import * as requisition from "./cases/requisition.js";
-import * as stock from "./cases/stock.js";
-import * as reportView from "./cases/report-view.js";
-import * as beforeHook from "./cases/before-hook.js";
-import * as policy from "./cases/policy.js";
-import * as searchPlaces from "./cases/search-places.js";
-import * as printer from "./cases/printer.js";
-import * as store from "./cases/store.js";
-const CASES = [
-    ["requisition", requisition], ["stock", stock], ["report-view", reportView], ["before-hook", beforeHook],
-    ["policy", policy], ["search-places", searchPlaces], ["printer", printer], ["store", store],
-];
-/** Runs every case on its own database. A failing case never suppresses cleanup or the cases after it. */
-export async function runStorageConformance(options) {
-    const r = new Report();
-    useCompileSide(options.compile);
-    try {
-        for (const [name, c] of CASES) {
-            const fixture = await options.create();
-            try {
-                await c.run(r, fixture);
-            }
-            catch (e) {
-                r.section(`${name} (crashed)`);
-                r.check("case ran to the end", false, e instanceof Error ? (e.stack ?? e.message) : String(e));
-            }
-            finally {
-                await fixture.cleanup();
-            }
-        }
-    }
-    finally {
-        useCompileSide(undefined);
-    }
-    return {
-        ok: r.failed.length === 0,
-        checks: r.checks.map((c) => `${c.case}: ${c.name}`),
-        failures: r.failed.map((c) => ({ check: `${c.case}: ${c.name}`, message: c.detail ?? "" })),
-    };
-}
-//# sourceMappingURL=index.js.map
+export { userCaller as authenticatedAs } from "../kernel/user-caller.js";

package/dist/usecase/adminBindings.js

@@ -0,0 +1,141 @@
+import { userReferences } from "../domain/userReferences.js";
+/** Selected application bindings: compiled checks/native SQL; only the app depends on Admin adapters. */
+import { isPrimaryCollection } from "../build/compiler.js";
+import { enumOptions } from "../build/compiler.js";
+import { databaseImport, isSqlite, literal as q } from "../domain/entry.js";
+import { conversions, authLines } from "../domain/input.js";
+import { recipesOf } from "../domain/recipes.js";
+import { boundaryType, conversion, serverOwned } from "../domain/columns.js";
+import { adminOrder } from "../domain/adminOrder.js";
+import { emitValidation } from "./validation.js";
+const scalar = (type) => ["text", "integer", "int4", "int8", "real", "float8", "bool", "date", "timestamptz"].includes(type ?? "");
+const wire = (fields, sqlite) => {
+    const columns = fields.flatMap(([name, type]) => conversion(name, type, sqlite));
+    const geo = fields.filter(([, type]) => type === "geo").map(([field]) => `row[${q(field)}]=row[${q(field + "_lat")}] == null || row[${q(field + "_lng")}] == null ? null : {lat:row[${q(field + "_lat")}],lng:row[${q(field + "_lng")}]};delete row[${q(field + "_lat")}];delete row[${q(field + "_lng")}];`);
+    return `(raw:Row):Row=>{const row=${columns.length ? `wireRows([raw],${q(columns)})[0]!` : geo.length ? "{...raw}" : "raw"};${geo.join("")}return row;}`;
+};
+/** Core's titled string choices are enum checks; constrained or general oneOf remains refused. */
+function adminProperty(property) {
+    const choices = enumOptions(property);
+    if (!property.oneOf || property.enum || !choices || !property.oneOf.every(branch => Object.entries(branch).every(([key, value]) => key === "const" || key === "title" || key === "type" && value === "string")) || new Set(choices.map(c => c.value)).size !== choices.length)
+        return property;
+    const { oneOf, ...base } = property;
+    return { ...base, enum: choices.map(c => c.value) };
+}
+function checks(s, full) {
+    const properties = Object.fromEntries(Object.entries(s.schema.properties ?? {}).filter(([name]) => name.toLowerCase() !== s.scope && s.fields[name.toLowerCase()] !== "geo").map(([name, property]) => [name, adminProperty(property)]));
+    return { ...s.schema, properties, required: full ? (s.schema.required ?? []).filter(name => Object.hasOwn(properties, name) && !(s.userScopes ?? []).some(u => u.column === name.toLowerCase())) : [], additionalProperties: false };
+}
+const allowed = (requires, path) => {
+    const lines = authLines(requires, path);
+    return lines.length ? `(caller:Caller)=>{try{${lines.join("")}return true;}catch{return false;}}` : "(_caller:Caller)=>true";
+};
+/** Share repeated compiler SQL constants; generated modules evaluate no decoder or kernel at import. */
+function sqlConstants(value) {
+    const counts = new Map();
+    const visit = (v) => { if (typeof v === "string" && v.length > 80)
+        counts.set(v, (counts.get(v) ?? 0) + 1);
+    else if (Array.isArray(v))
+        v.forEach(visit);
+    else if (v && typeof v === "object")
+        Object.values(v).forEach(visit); };
+    visit(value);
+    const pool = new Map([...counts].filter(([, count]) => count > 1).map(([text], n) => [text, `sql${n}`]));
+    const literal = (v) => typeof v === "string" ? pool.get(v) ?? q(v) : Array.isArray(v) ? "[" + v.map(literal).join(",") + "]" : v && typeof v === "object" ? "{" + Object.entries(v).map(([name, child]) => `${name === "__proto__" ? `[${q(name)}]` : q(name)}:${literal(child)}`).join(",") + "}" : q(v);
+    return { code: literal(value), constants: [...pool].map(([text, name]) => `const ${name}=${q(text)};`) };
+}
+export function emitAdminBindings(input, refuse) {
+    if (!input.admin)
+        return {};
+    const { plan, lowered, target } = input, sqlite = isSqlite(target), refs = Object.values(plan.procedures).some(p => "ref" in p.handler), files = {};
+    const user = userReferences(plan, sqlite);
+    const imports = [...(user.used ? [user.code, 'import {userBinds} from "@aotter/mantle/user-fields";'] : []), databaseImport(target), 'import {wireRows,type Caller,type Row} from "@aotter/mantle/contracts";', 'import {deny,isAdmin,isUser} from "@aotter/mantle/contracts";', 'import {invalid} from "@aotter/mantle/surface";', 'import type {Handlers} from "./generated.js";', 'import {bootstrap,allCollections} from "./admin-descriptors.js";', 'import type {View,Operation} from "@aotter/mantle-admin/server";', 'import type {EntrySchema} from "@aotter/mantle-admin/server/entries";'];
+    imports.push('import {nativePage,nativeStatistics,nativeText} from "@aotter/mantle-admin/server/native";', `import * as D from "@aotter/mantle/dialect/${sqlite ? "sqlite" : "postgres"}";`, `import {read,procedure} from "@aotter/mantle/driver/${target === "bun-sqlite" ? "bun-sqlite" : target === "cloudflare-d1" ? "d1" : "postgres"}";`, `const adapter={read,procedure,values:${sqlite ? (user.used ? "{...D,...USER_VALUES}" : "D") : `{...D,${user.used ? "...USER_VALUES," : ""}timestamp:(v:Parameters<typeof D.timestamp>[0])=>{if(typeof v==="string"&&/^0000-/.test(v.trim()))invalid("PostgreSQL timestamps require a nonzero year.","admin/input");return D.timestamp(v);},date:(v:string)=>{if(/^0000-/.test(v.trim()))invalid("PostgreSQL dates require a nonzero year.","admin/input");return D.date(v);}}`},param:D.param,escapeLike:D.escapeLike,sqlite:${sqlite}} as const;`);
+    const schemas = [], views = [], adminViews = [], operations = [], pageSpecs = [];
+    for (const [n, s] of Object.values(plan.schemas).entries()) {
+        const schemaPath = `schemas/${s.name}/admin`, declared = Object.keys(s.fields).filter(f => f !== s.scope), writable = declared.filter(f => scalar(s.fields[f]) || s.fields[f] === "json");
+        // readOnly properties are server-maintained: values() pins them to their default, and they have no Admin UPDATE.
+        const server = Object.fromEntries(writable.filter(f => serverOwned(s.schema, f)).map(f => [f, Object.entries(s.schema.properties ?? {}).find(([k]) => k.toLowerCase() === f)?.[1]?.default ?? null]));
+        // Experimental geo collections remain readable; edits require a declared Procedure.
+        const validators = emitValidation({ views: {}, procedures: { full: { input: checks(s, true) }, partial: { input: checks(s, false) } } }, (path, message) => refuse(schemaPath + "/" + path, message));
+        for (const mode of ["full", "partial"]) {
+            const name = `validation/admin/${encodeURIComponent(s.name)}-${mode}.ts`;
+            files[name] = validators[`validation/procedures/${mode}.ts`].replaceAll(`procedures/${mode}/input`, schemaPath + "/input");
+            imports.push(`import {validate as ${mode}${n}} from "./${name.replace(/\.ts$/, ".js")}";`);
+        }
+        const names = Object.fromEntries(writable.map(f => [s.names[f] ?? f, f])), allNames = { ...names, id: "id", version: "version", createdAt: "created_at", updatedAt: "updated_at", authorId: "author_id", ...(s.publishing ? { status: "status", publishedAt: "published_at" } : {}) };
+        const temporal = writable.filter(f => ["date", "timestamptz"].includes(s.fields[f])).map(f => s.names[f] ?? f);
+        const yearZero = sqlite ? "" : `for(const key of ${q(temporal)})if(typeof data[key]==="string"&&/^0000-/.test(data[key].trim()))invalid("PostgreSQL dates require a nonzero year.",${q(schemaPath)});`;
+        const coercers = Object.entries(allNames).filter(([, f]) => scalar(s.fields[f] ?? (f === "version" ? "integer" : "text"))).map(([name, f]) => {
+            const type = s.fields[f] ?? (f === "version" ? "integer" : "text");
+            const value = type === "bool" ? `raw === "true" ? true : raw === "false" ? false : fail("Expected true or false.")` : ["integer", "int4", "int8", "real", "float8"].includes(type) ? `number(raw,${["integer", "int4", "int8"].includes(type)})` : `raw`;
+            return `case ${q(name)}:return {column:${q(f)},value:${value}};`;
+        });
+        const order = adminOrder(s), orderNames = Object.fromEntries(Object.keys(order).map(f => [f === "updated_at" ? "updatedAt" : s.names[f] ?? f, f]));
+        const parent = s.translates && plan.schemas[s.translates.parent.toLowerCase()];
+        const inherited = parent ? Object.keys(parent.fields).filter(f => f !== parent.scope && !Object.hasOwn(s.fields, f)) : [];
+        const rowNames = { ...(parent ? parent.names : {}), ...s.names };
+        const rowFields = [...declared.map(f => [f, s.fields[f]]), ...inherited.map(f => [f, parent && parent.fields[f]]), ...["version"].map(f => [f, "integer"])];
+        const named = `(raw:Row):Row=>{const row=row${n}(raw);return Object.fromEntries(Object.entries(row).map(([key,value])=>[Object.hasOwn(fieldNames${n},key)?fieldNames${n}[key as keyof typeof fieldNames${n}]:key,value]));}`;
+        const entrySpec = `entrySpecs[${q(s.name)}]`;
+        if (!input.adminEntries?.[s.name]) {
+            refuse(schemaPath, "Missing compiler-authorized entry queries and Procedures.");
+            continue;
+        }
+        const defaults = Object.fromEntries(Object.entries(checks(s, true).properties ?? {}).flatMap(([key, p]) => p.default !== undefined ? [[key, p.default]] : []));
+        const primary = isPrimaryCollection(s, Object.values(plan.schemas));
+        const schemaCode = `{
+      name:${q(s.name)},primary:${primary},descriptor:allCollections[${q(s.name)}],publishing:${!!s.publishing},readOnly:${s.schema.readOnly === true || declared.some(f => s.fields[f] === "geo")},fields:names${n},defaults:${q(defaults)},
+      binding:${entrySpec},
+      query:query${n},validate:(data,full)=>{const checked=Object.fromEntries(Object.entries(data).filter(([key,v])=>v!==null||${q(s.schema.required ?? [])}.includes(key)));(full?full${n}:partial${n})(checked);${sqlite ? "" : "nativeText(data);"}${yearZero}return data;},
+      values:values${n},row:${named},
+      ${sqlite ? "" : "native:nativeText,"}
+      ${s.publishing ? `transition:async(db,caller,verb,id,expectedVersion)=>{const run=await ({publish:()=>import("./procedures/${encodeURIComponent(s.name + ".publish")}.js"),unpublish:()=>import("./procedures/${encodeURIComponent(s.name + ".unpublish")}.js"),archive:()=>import("./procedures/${encodeURIComponent(s.name + ".archive")}.js")})[verb]();const version=wireRows([{version:expectedVersion}],[["version","int"]])[0]!.version;return run.default(db,caller,{id,expectedVersion:version} as Parameters<typeof run.default>[2]);},` : ""}
+    }`;
+        schemas.push(schemaCode);
+        files[`admin/entries-${encodeURIComponent(s.name)}.ts`] = `import {invalid} from "@aotter/mantle/surface";\nimport {wireRows,type Row} from "@aotter/mantle/contracts";\nimport type {EntryPageQuery} from "@aotter/mantle-admin/server/entries";\nimport {entriesQuery,scalarNumber,nativeText} from "@aotter/mantle-admin/server/native";\nconst fail=(message:string):never=>invalid(message,${q(schemaPath)});\nconst number=(raw:string,integer:boolean)=>scalarNumber(raw,integer,${q(schemaPath)});\nimport * as D from "@aotter/mantle/dialect/${sqlite ? "sqlite" : "postgres"}";\nexport const names=${q(names)} as const;\nfunction encode(column:string,value:unknown):unknown{if(value==null)return value;switch(column){${[...writable, ...["created_at", "updated_at", ...(s.publishing ? ["published_at"] : [])]].map(f => { const type = s.fields[f] ?? "timestamptz"; return type === "date" || type === "timestamptz" ? `case ${q(f)}:return D.${type === "date" ? "date" : "timestamp"}(value as string);` : type === "json" ? `case ${q(f)}:return JSON.stringify(value);` : sqlite && type === "bool" ? `case ${q(f)}:return Number(value);` : ""; }).join("")}default:return value;}}\nconst server:Row=${q(server)};\n// Server-maintained (readOnly) fields: create stores their default, an edit drops them (the console echoes whole records).\nexport const values=(data:Row,patch=false):Row=>Object.fromEntries(Object.entries(data).flatMap(([key,value])=>{const column=names[key as keyof typeof names];return Object.hasOwn(server,column)?patch?[]:[[column,encode(column,server[column])]]:[[column,encode(column,value)]];}));\nexport const row=${wire(rowFields, sqlite)};\nfunction coerce(name:string,raw:string):{column:string;value:string|number|boolean}{${sqlite ? "" : "nativeText(raw);" + (temporal.length ? "if(" + q(temporal) + ".includes(name)&&/^0000-/.test(raw.trim()))fail(\"PostgreSQL dates require a nonzero year.\");" : "")}switch(name){${coercers.join("")}default:return fail("Unknown scalar filter field.");}}\nimport {validate as checkFilter} from "../validation/admin/${encodeURIComponent(s.name)}-partial.js";\nfunction field(name:string,raw:string){const f=coerce(name,raw);if(Object.hasOwn(names,name))checkFilter({[name]:f.value});return {...f,value:encode(f.column,f.value) as string|number|boolean};}\nexport const query=(params:URLSearchParams):EntryPageQuery|null=>entriesQuery(params,{path:${q(schemaPath)},orderFields:${q(orderNames)},publishing:${!!s.publishing},sqlite:${sqlite},field});\n`;
+        imports.push(`const fieldNames${n}=${q(rowNames)} as const;`);
+        imports.push(`import {names as names${n},row as row${n},query as query${n},values as values${n}} from "./admin/entries-${encodeURIComponent(s.name)}.js";`);
+    }
+    for (const [name, v] of Object.entries(plan.views).filter(([, v]) => v.surface !== "internal")) {
+        const n = views.length, encoded = encodeURIComponent(name), converted = conversions(v.input?.properties, (lowered.views[name]?.public ?? lowered.views[name]?.caller)?.binds ?? [], target);
+        imports.push(`import {query as queryView${n}} from "./validation/views/${encoded}.js";`);
+        const rename = Object.fromEntries(Object.entries(v.columns ?? {}).map(([key, col]) => [key, key === col.field ? plan.schemas[col.schema].names[col.field] ?? key : key]));
+        imports.push(`const viewNames${n}=${q(rename)} as const;`);
+        const pageData = input.adminPages?.[name];
+        if (!pageData) {
+            refuse(`views/${name}/admin`, "Missing compiler-authorized matching pages.");
+            continue;
+        }
+        const kinds = (v.uiSchema?.list ?? {});
+        const filters = Object.fromEntries((kinds.filterFields ?? []).map(field => {
+            const lineage = v.columns?.[field] ?? v.columns?.[field.toLowerCase()], schema = lineage && plan.schemas[lineage.schema];
+            return [field, adminProperty(schema?.schema.properties?.[schema.names[lineage.field] ?? lineage.field] ?? { type: "string" })];
+        }));
+        const filterChecks = emitValidation({ procedures: { filters: { input: { type: "object", properties: filters, additionalProperties: false } } }, views: {} }, (path, msg) => refuse(`views/${name}/admin/` + path, msg));
+        files[`validation/admin/view-${encoded}.ts`] = filterChecks["validation/procedures/filters.ts"];
+        imports.push(`import {validate as filters${n}} from "./validation/admin/view-${encoded}.js";`);
+        const filterTransforms = Object.keys(filters).flatMap(field => { const col = v.columns?.[field] ?? v.columns?.[field.toLowerCase()], type = col && plan.schemas[col.schema]?.fields[col.field]; const convert = type === "date" && sqlite ? "encodeDate" : type === "timestamptz" && sqlite ? "encodeTimestamptz" : type === "bool" && sqlite ? "Number" : undefined; return convert ? [`if(Object.hasOwn(filters,${q(field)}))filters[${q(field)}]=${convert}(filters[${q(field)}] as ${type === "bool" ? "boolean" : "string"});`] : []; });
+        if (filterTransforms.some(t => t.includes("encode")))
+            imports.push('import {encodeDate,encodeTimestamptz} from "@aotter/mantle/scalars";');
+        const filterReads = Object.entries(filters).map(([field, s]) => { const type = [s.type].flat().find(t => t && t !== "null"); return `if(params.has(${q("filter." + field)})&&params.get(${q("filter." + field)})!=="")filters[${q(field)}]=${type === "boolean" ? `params.get(${q("filter." + field)})==="true"?true:params.get(${q("filter." + field)})==="false"?false:invalid("Expected true or false.",${q("views/" + name)})` : ["number", "integer"].includes(type ?? "") ? `Number(params.get(${q("filter." + field)}))` : `params.get(${q("filter." + field)})!`};`; });
+        const cursorKinds = (input.paging?.[name]?.types ?? []).map(type => type === "bool" ? "bool" : type === "integer" || type === "int8" ? "int" : type === "int4" ? "int4" : type.startsWith("numeric(") ? "numeric" : type === "real" || type === "float8" ? "float" : type === "date" ? "date" : type === "timestamptz" ? "timestamp" : "text");
+        const modes = Object.fromEntries(Object.entries({ caller: pageData.caller, trusted: pageData.trusted }).map(([mode, p]) => [mode, { ...p, binds: recipesOf(p, Object.keys(v.input?.properties ?? {}), message => refuse(`views/${name}/admin`, message)) }]));
+        pageSpecs.push(`const viewPage${n}=${q({ path: "views/" + name, cap: v.stmts[0]?.SelectStmt.limitCount?.A_Const?.ival?.ival ?? 500, cursorKinds, ...modes })} as const;`);
+        imports.push(`const allowsView${n}=${allowed(v.requires, `views/${name}`)};`);
+        if (v.surface === "admin")
+            adminViews.push(`view${n}`);
+        views.push(`{${user.used ? `check:(caller)=>{${authLines(undefined, `views/${name}`, pageData.caller.binds, sqlite).join("")}},` : ""}name:${q(name)},allows:allowsView${n},query:(params)=>{const result=queryView${n}(params),filters:Record<string,unknown>=Object.create(null);${filterReads.join("")}filters${n}(filters);${filterTransforms.join("")}${sqlite ? "" : "nativeText(result.input);nativeText(filters);"}${kinds.searchFields?.length ? `const search=params.get("search")?.trim();` : ""}return {...result,match:{filters${kinds.searchFields?.length ? ",...(search?{search}:{})" : ""}}};},page:(db,caller,input,paging)=>{deny(caller,allowsView${n}(caller),${q("views/" + name)});return nativePage(viewPage${n},adapter,db,caller,input,paging);},${converted ? `convert:${converted},` : ""}row:(raw)=>{const row=(${wire((input.viewKeys[name] ?? []).map(key => [key, boundaryType(plan, name, key)]), sqlite)})(raw);return Object.fromEntries(Object.entries(row).map(([key,value])=>[Object.hasOwn(viewNames${n},key)?viewNames${n}[key as keyof typeof viewNames${n}]:key,value]));}}`);
+    }
+    for (const [name, p] of Object.entries(plan.procedures).filter(([name]) => Object.values(plan.triggers).some(t => t.procedure === name && t.source.kind === "mcp" && t.source.surface === "admin"))) {
+        const n = operations.length, ref = "ref" in p.handler, encoded = encodeURIComponent(name), converted = conversions(p.input?.properties, lowered.procedures[name]?.caller?.flatMap(s => s.binds) ?? [], target);
+        imports.push(`import {validate as operation${n}} from "./validation/procedures/${encoded}.js";`);
+        operations.push(`{${input.description.targets.find(t => t._meta.id === `procedure:${name}`)?._meta.readOnly ? "readOnly:true," : ""}${user.used || p.trustedOnly ? `check:(caller)=>{${authLines(undefined, `procedures/${name}`, lowered.procedures[name]?.caller?.flatMap(s => s.binds), sqlite, p.trustedOnly).join("")}},` : ""}name:${q(name)},allows:${allowed(p.requires, `procedures/${name}`)},validate:operation${n},${converted ? `convert:${converted},` : ""}run:${ref ? `async(db,caller,input)=>(await import("./generated.js")).store(db,caller,{handlers:options.handlers}).procedures[${q(name)}](input)` : `async(db,caller,input)=>(await import("./procedures/${encoded}.js")).default(db,caller,input)`}}`);
+    }
+    const entryData = sqlConstants(input.adminEntries);
+    imports.push(...views.map((view, n) => `const view${n}=${view} satisfies View<Database>;`), ...pageSpecs, ...entryData.constants, `const entrySpecs=${entryData.code} as const;`);
+    imports.push(`export const statisticsView=(db:Database,caller:Caller,collection:keyof typeof entrySpecs,args:{from:number;to:number;bucketMs:number})=>nativeStatistics(entrySpecs,adapter,db,caller,collection,args);`);
+    const metadataGuards = [...Object.entries(plan.views).map(([name, v]) => `case ${q("view:" + name)}: return (${allowed(v.requires, `views/${name}`)})(caller);`), ...Object.entries(plan.procedures).map(([name, p]) => `case ${q("procedure:" + name)}: return (${allowed(p.requires, `procedures/${name}`)})(caller);`), ...Object.values(plan.schemas).filter(s => s.publishing).flatMap(s => ["publish", "unpublish", "archive"].map(verb => `case ${q("procedure:" + s.name + "." + verb)}: return isAdmin(caller);`))];
+    files["admin-bindings.ts"] = `${imports.filter(Boolean).join("\n")}\nexport function adminBindings${refs ? "<const H extends Handlers>(options:{handlers:H & Record<Exclude<keyof H,keyof Handlers>,never>})" : "(_options?:{handlers?:Handlers})"}{\nreturn {metadata:{...bootstrap,accessTargets:()=>import("./access-targets.js").then(m=>m.targets),${plan.access ? `userFields:${q(plan.access.userFields)} as const,` : ""}allows:(target:import("@aotter/mantle/contracts").Target,caller:Caller)=>{switch(target.kind+":"+target.name){${metadataGuards.join("")}default:return target.kind==="schema";}}},adapter,schemas:[${schemas.join(",\n")}] satisfies readonly EntrySchema<Database>[],views:[${adminViews.join(",")}],developerViews:[${views.map((_, n) => `view${n}`).join(",")}],operations:[${operations.join(",\n")}] satisfies readonly Operation<Database,${refs ? "Handlers" : "never"}>[]};\n}\n`;
+    return files;
+}