@loadbare/app 0.13.0 → 0.15.0

package/dist/server/lb-express.js.map

@@ -1 +1 @@
-{"version":3,"file":"lb-express.js","sourceRoot":"","sources":["../../server/lb-express.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,OAKN,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EACL,YAAY,GAGb,MAAM,qBAAqB,CAAC;AAuB7B,MAAM,UAAU,SAAS,CAAC,GAAQ,EAAE,UAAsB;IACxD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,sEAAsE;IACtE,oDAAoD;IACpD,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAE3B,MAAM,CAAC,IAAI,CAAC,GAAG,WAAW,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACrD,kEAAkE;QAClE,kBAAkB;QAClB,MAAM,IAAI,GAAI,GAAG,CAAC,MAAM,CAAC,IAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,GAAG,CAAC,IAA8B,CAAC;QACnD,oEAAoE;QACpE,kEAAkE;QAClE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC,YAAY,CAAC;QACxE,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAEnC,kEAAkE;QAClE,+DAA+D;QAC/D,aAAa;QACb,IAAI,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/D,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1D,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;YAC7D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAChB,OAAO;YACT,CAAC;YACD,oEAAoE;YACpE,uEAAuE;YACvE,GAAG,CAAC,IAAI,CACN,MAAM,MAAM,CACV,KAAK,EACL,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,IAAI,EAAE,CAAC,EAC1C,aAAa,IAAI,GAAG,CACrB,CACF,CAAC;YACF,OAAO;QACT,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,OAAO,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;YACjD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACzB,OAAO;QACT,CAAC;QAED,mEAAmE;QACnE,wEAAwE;QACxE,wEAAwE;QACxE,+BAA+B;QAC/B,IAAI,KAAkB,CAAC;QACvB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,cAAc,OAAO,CAAC,IAAI,SAAS,EAAE,GAAG,CAAC,CAAC;YACxD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACzB,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;QAC7D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAChB,OAAO;QACT,CAAC;QACD,yEAAyE;QACzE,sEAAsE;QACtE,yEAAyE;QACzE,wEAAwE;QACxE,uDAAuD;QACvD,GAAG,CAAC,IAAI,CACN,MAAM,MAAM,CACV,KAAK,EACL,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,IAAI,EAAE,CAAC,EAC1C,IAAI,OAAO,CAAC,IAAI,GAAG,CACpB,CACF,CAAC;QAEF;;;;;WAKG;QACH,KAAK,UAAU,MAAM,CACnB,KAA0B,EAC1B,IAA8C,EAC9C,IAAY;YAEZ,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,WAAW,CAChC,IAAI,CAAC,IAAI,EACT,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,EAC3B,EAAE,MAAM,EAAE,KAAK,EAAE,CAClB,CAAC;gBACF,OAAO,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC;YAC1B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CACX,aAAa,IAAI,gCAAgC,IAAI,CAAC,IAAI,IAAI;oBAC5D,aAAa,EACf,GAAG,CACJ,CAAC;gBACF,OAAO,CAAC,KAAK,CAAC,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,wEAAwE;IACxE,wEAAwE;IACxE,2EAA2E;IAC3E,4EAA4E;IAC5E,8DAA8D;IAC9D,MAAM,CAAC,GAAG,CACR,GAAG,WAAW,QAAQ,EACtB,CAAC,GAAY,EAAE,IAAa,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACjE,IAAK,GAAyB,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;YAC9D,IAAI,CAAC,GAAG,CAAC,CAAC;YACV,OAAO;QACT,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;QACnD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3B,CAAC,CACF,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["/**\n * The Express adapter — the standard hand-off from an Express router to a\n * Hub built by createHub(). Every Hub application wires this same router,\n * which is why it ships from here rather than being copied into each one.\n *\n * Express itself is a peer dependency: nothing outside this file imports it,\n * so an application that hosts Hub some other way never pays for it.\n *\n * One endpoint, and no second:\n *\n *   POST /lb/<stub>?<query string>\n *                          an empty body asks for the page's queries, or for\n *                          the page loaded at the new URL its onPageEnter\n *                          returned; a body carrying a request runs its\n *                          handler and answers with the refresh set, or with\n *                          the page loaded at the new URL the handler\n *                          returned\n *\n * The page rides on the path rather than in the body, which is what lets the\n * operation set stay closed. The query string is the one the browser is\n * showing, verbatim, and `contextFor` is handed its parms. What a parm means\n * is the application's: nothing here reads one. Every hub call is a POST, so\n * an application's own GET routes never collide with this one and no page\n * name is reserved.\n */\n\nimport express, {\n  type NextFunction,\n  type Request,\n  type Response,\n  type Router,\n} from \"express\";\nimport { LB_ENDPOINT, URL_QUERY } from \"../core/lb-constants.js\";\nimport {\n  nextLocation,\n  type HubRequest,\n  type HubResponse,\n} from \"../core/lb-types.js\";\nimport type { Hub, HubContext } from \"./lb-server.js\";\n\n/**\n * Building the context is the application's job — it is where an\n * authenticated database handle comes from — so it is injected rather than\n * assumed. Whatever established identity has already run by the time this\n * router is reached; where that happens is the application's ordering\n * decision, not Hub's.\n *\n * The query parms arrive as `parms`, and are read there rather than off\n * `req.query`. The two agree except after a request that wrote parms: the\n * page is then loaded at the new query string in the same round trip, and\n * this is called a second time for that load, with the same `req` and the\n * new `parms`. So it must be safe to call twice for one request, and a\n * write must be visible to the second context by the time its `run`\n * returns.\n *\n * Parms are user input like any other, typed into an address bar or mailed\n * in a link, and are validated where they are read.\n */\nexport type ContextFor = (req: Request, parms: URLSearchParams) => HubContext;\n\nexport function hubRoutes(hub: Hub, contextFor: ContextFor): Router {\n  const router = express.Router();\n\n  // Mounted here rather than on the app so that Hub's need for a parsed\n  // body is stated where the routes that need it are.\n  router.use(express.json());\n\n  router.post(`${LB_ENDPOINT}/*page`, async (req, res) => {\n    // A page name may hold a slash, so the path below the endpoint is\n    // gathered whole.\n    const page = (req.params.page as string[]).join(\"/\");\n    const request = req.body as HubRequest | undefined;\n    // Parsed here rather than taken from req.query, so that the parms a\n    // context is built from are the same kind of thing on both calls.\n    const parms = new URL(req.originalUrl, \"http://localhost\").searchParams;\n    const ctx = contextFor(req, parms);\n\n    // No body at all is the page load: the browser is asking for this\n    // page's queries. A body that carries something but no name is\n    // malformed.\n    if (request === undefined || Object.keys(request).length === 0) {\n      const items = await hub.dataForPage(page, ctx, { parms });\n      const moved = items.find((item) => item.query === URL_QUERY);\n      if (moved === undefined) {\n        res.json(items);\n        return;\n      }\n      // onPageEnter moved the URL, so the page loads there, and that load\n      // does not follow onPageEnter again: no page can move the URL forever.\n      res.json(\n        await loadAt(\n          moved,\n          nextLocation(page, parms, moved.row ?? {}),\n          `entering '${page}'`,\n        ),\n      );\n      return;\n    }\n\n    if (!request.name) {\n      console.warn(`loadbare: request without a name`);\n      res.status(400).json([]);\n      return;\n    }\n\n    // A thrown error is how application code (a query, a handler) says\n    // \"this request is invalid\" or hits an unexpected failure — it resolves\n    // to a real response rather than an unhandled rejection, so the browser\n    // side has something to catch.\n    let items: HubResponse;\n    try {\n      items = await hub.runRequest(page, request, ctx);\n    } catch (err) {\n      console.error(`loadbare: '${request.name}' threw`, err);\n      res.status(500).json([]);\n      return;\n    }\n\n    const moved = items.find((item) => item.query === URL_QUERY);\n    if (moved === undefined) {\n      res.json(items);\n      return;\n    }\n    // The handler returned a new row for lb-url, so the page loads there, as\n    // a cold load of the new URL would. The handler has already run: from\n    // here a failure must not read as the request failing, or the user would\n    // send it again. The item goes back alone instead, and the hub, writing\n    // the URL with nothing to land, loads the page itself.\n    res.json(\n      await loadAt(\n        moved,\n        nextLocation(page, parms, moved.row ?? {}),\n        `'${request.name}'`,\n      ),\n    );\n\n    /**\n     * The `lb-url` item and the page loaded where it leads. A load that\n     * throws is not the failure of what moved the URL: the item goes back\n     * alone, and the hub, writing the URL with nothing to land, loads the\n     * page itself.\n     */\n    async function loadAt(\n      moved: HubResponse[number],\n      next: { page: string; parms: URLSearchParams },\n      what: string,\n    ): Promise<HubResponse> {\n      try {\n        const load = await hub.dataForPage(\n          next.page,\n          contextFor(req, next.parms),\n          { follow: false },\n        );\n        return [moved, ...load];\n      } catch (err) {\n        console.error(\n          `loadbare: ${what} moved the URL, and loading '${next.page}' ` +\n            `there threw`,\n          err,\n        );\n        return [moved];\n      }\n    }\n  });\n\n  // A body that never parsed is refused like any other malformed request,\n  // rather than falling through to the application's error handler, which\n  // would print a stack and call it a server failure. Only for the hub's own\n  // path: express.json() above sees every request, and a bad body sent to one\n  // of the application's routes is the application's to answer.\n  router.use(\n    `${LB_ENDPOINT}/*page`,\n    (err: unknown, _req: Request, res: Response, next: NextFunction) => {\n      if ((err as { type?: string }).type !== \"entity.parse.failed\") {\n        next(err);\n        return;\n      }\n      console.warn(`loadbare: request body is not JSON`);\n      res.status(400).json([]);\n    },\n  );\n\n  return router;\n}\n"]}
+{"version":3,"file":"lb-express.js","sourceRoot":"","sources":["../../server/lb-express.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,OAKN,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,SAAS,GACV,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,YAAY,GAGb,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,OAAO,EAA6B,MAAM,gBAAgB,CAAC;AAiCpE,MAAM,UAAU,SAAS,CACvB,GAAQ,EACR,UAAsB,EACtB,UAA4B,EAAE;IAE9B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,sEAAsE;IACtE,oDAAoD;IACpD,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAEvC,MAAM,CAAC,IAAI,CAAC,GAAG,WAAW,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACrD,kEAAkE;QAClE,kBAAkB;QAClB,MAAM,IAAI,GAAI,GAAG,CAAC,MAAM,CAAC,IAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,GAAG,CAAC,IAA8B,CAAC;QACnD,oEAAoE;QACpE,kEAAkE;QAClE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC,YAAY,CAAC;QACxE,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAEnC,kEAAkE;QAClE,+DAA+D;QAC/D,aAAa;QACb,IAAI,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/D,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1D,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;YAC7D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAChB,OAAO;YACT,CAAC;YACD,oEAAoE;YACpE,uEAAuE;YACvE,GAAG,CAAC,IAAI,CACN,MAAM,MAAM,CACV,KAAK,EACL,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,IAAI,EAAE,CAAC,EAC1C,aAAa,IAAI,GAAG,CACrB,CACF,CAAC;YACF,OAAO;QACT,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,OAAO,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;YACjD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACzB,OAAO;QACT,CAAC;QAED,mEAAmE;QACnE,wEAAwE;QACxE,wEAAwE;QACxE,+BAA+B;QAC/B,sEAAsE;QACtE,qEAAqE;QACrE,uEAAuE;QACvE,IAAI,KAAkB,CAAC;QACvB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,OAAO,EAAE,CAAC;gBAC3B,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC7D,OAAO;YACT,CAAC;YACD,OAAO,CAAC,KAAK,CAAC,cAAc,OAAO,CAAC,IAAI,SAAS,EAAE,GAAG,CAAC,CAAC;YACxD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACzB,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;QAC7D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAChB,OAAO;QACT,CAAC;QACD,yEAAyE;QACzE,sEAAsE;QACtE,yEAAyE;QACzE,wEAAwE;QACxE,uDAAuD;QACvD,GAAG,CAAC,IAAI,CACN,MAAM,MAAM,CACV,KAAK,EACL,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,IAAI,EAAE,CAAC,EAC1C,IAAI,OAAO,CAAC,IAAI,GAAG,CACpB,CACF,CAAC;QAEF;;;;;WAKG;QACH,KAAK,UAAU,MAAM,CACnB,KAA0B,EAC1B,IAA8C,EAC9C,IAAY;YAEZ,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,WAAW,CAChC,IAAI,CAAC,IAAI,EACT,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,EAC3B,EAAE,MAAM,EAAE,KAAK,EAAE,CAClB,CAAC;gBACF,OAAO,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC;YAC1B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CACX,aAAa,IAAI,gCAAgC,IAAI,CAAC,IAAI,IAAI;oBAC5D,aAAa,EACf,GAAG,CACJ,CAAC;gBACF,OAAO,CAAC,KAAK,CAAC,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,8DAA8D;IAC9D,uEAAuE;IACvE,yEAAyE;IACzE,2EAA2E;IAC3E,+BAA+B;IAC/B,MAAM,CAAC,GAAG,CACR,GAAG,WAAW,QAAQ,EACtB,CAAC,GAAY,EAAE,IAAa,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACjE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,GAAwC,CAAC;QACjE,IAAI,IAAI,KAAK,qBAAqB,EAAE,CAAC;YACnC,OAAO,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;YACnD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACzB,OAAO;QACT,CAAC;QACD,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;YAChC,kEAAkE;YAClE,gCAAgC;YAChC,OAAO,CAAC,IAAI,CACV,+CAA+C,KAAK,UAAU;gBAC5D,4CAA4C,CAC/C,CAAC;YACF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACzB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,CAAC;IACZ,CAAC,CACF,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["/**\n * The Express adapter — the standard hand-off from an Express router to a\n * Hub built by createHub(). Every Hub application wires this same router,\n * which is why it ships from here rather than being copied into each one.\n *\n * Express itself is a peer dependency: nothing outside this file imports it,\n * so an application that hosts Hub some other way never pays for it.\n *\n * One endpoint, and no second:\n *\n *   POST /lb/<stub>?<query string>\n *                          an empty body asks for the page's queries, or for\n *                          the page loaded at the new URL its onPageEnter\n *                          returned; a body carrying a request runs its\n *                          handler and answers with the refresh set, or with\n *                          the page loaded at the new URL the handler\n *                          returned\n *\n * The page rides on the path rather than in the body, which is what lets the\n * operation set stay closed. The query string is the one the browser is\n * showing, verbatim, and `contextFor` is handed its parms. What a parm means\n * is the application's: nothing here reads one. Every hub call is a POST, so\n * an application's own GET routes never collide with this one and no page\n * name is reserved.\n */\n\nimport express, {\n  type NextFunction,\n  type Request,\n  type Response,\n  type Router,\n} from \"express\";\nimport {\n  LB_ENDPOINT,\n  LB_REFUSAL_STATUS,\n  URL_QUERY,\n} from \"../core/lb-constants.js\";\nimport {\n  nextLocation,\n  type HubRequest,\n  type HubResponse,\n} from \"../core/lb-types.js\";\nimport { Refusal, type Hub, type HubContext } from \"./lb-server.js\";\n\n/**\n * Building the context is the application's job — it is where an\n * authenticated database handle comes from — so it is injected rather than\n * assumed. Whatever established identity has already run by the time this\n * router is reached; where that happens is the application's ordering\n * decision, not Hub's.\n *\n * The query parms arrive as `parms`, and are read there rather than off\n * `req.query`. The two agree except after a request that wrote parms: the\n * page is then loaded at the new query string in the same round trip, and\n * this is called a second time for that load, with the same `req` and the\n * new `parms`. So it must be safe to call twice for one request, and a\n * write must be visible to the second context by the time its `run`\n * returns.\n *\n * Parms are user input like any other, typed into an address bar or mailed\n * in a link, and are validated where they are read.\n */\nexport type ContextFor = (req: Request, parms: URLSearchParams) => HubContext;\n\n/**\n * The router's options, one key per concern.\n *\n * `json` is handed to `express.json()` untouched, so it takes whatever that\n * takes. The one an application is likely to want is `limit`: the default\n * of 100kb refuses a page that sends a file's text as a value.\n */\nexport interface HubRoutesOptions {\n  json?: Parameters<typeof express.json>[0];\n}\n\nexport function hubRoutes(\n  hub: Hub,\n  contextFor: ContextFor,\n  options: HubRoutesOptions = {},\n): Router {\n  const router = express.Router();\n\n  // Mounted here rather than on the app so that Hub's need for a parsed\n  // body is stated where the routes that need it are.\n  router.use(express.json(options.json));\n\n  router.post(`${LB_ENDPOINT}/*page`, async (req, res) => {\n    // A page name may hold a slash, so the path below the endpoint is\n    // gathered whole.\n    const page = (req.params.page as string[]).join(\"/\");\n    const request = req.body as HubRequest | undefined;\n    // Parsed here rather than taken from req.query, so that the parms a\n    // context is built from are the same kind of thing on both calls.\n    const parms = new URL(req.originalUrl, \"http://localhost\").searchParams;\n    const ctx = contextFor(req, parms);\n\n    // No body at all is the page load: the browser is asking for this\n    // page's queries. A body that carries something but no name is\n    // malformed.\n    if (request === undefined || Object.keys(request).length === 0) {\n      const items = await hub.dataForPage(page, ctx, { parms });\n      const moved = items.find((item) => item.query === URL_QUERY);\n      if (moved === undefined) {\n        res.json(items);\n        return;\n      }\n      // onPageEnter moved the URL, so the page loads there, and that load\n      // does not follow onPageEnter again: no page can move the URL forever.\n      res.json(\n        await loadAt(\n          moved,\n          nextLocation(page, parms, moved.row ?? {}),\n          `entering '${page}'`,\n        ),\n      );\n      return;\n    }\n\n    if (!request.name) {\n      console.warn(`loadbare: request without a name`);\n      res.status(400).json([]);\n      return;\n    }\n\n    // A thrown error is how application code (a query, a handler) says\n    // \"this request is invalid\" or hits an unexpected failure — it resolves\n    // to a real response rather than an unhandled rejection, so the browser\n    // side has something to catch.\n    // A refusal carries words the handler wrote for the user, and goes to\n    // the browser with them. Anything else thrown is a failure, and goes\n    // with nothing, so a stack or a database message never reaches a page.\n    let items: HubResponse;\n    try {\n      items = await hub.runRequest(page, request, ctx);\n    } catch (err) {\n      if (err instanceof Refusal) {\n        res.status(LB_REFUSAL_STATUS).json({ refusal: err.refusal });\n        return;\n      }\n      console.error(`loadbare: '${request.name}' threw`, err);\n      res.status(500).json([]);\n      return;\n    }\n\n    const moved = items.find((item) => item.query === URL_QUERY);\n    if (moved === undefined) {\n      res.json(items);\n      return;\n    }\n    // The handler returned a new row for lb-url, so the page loads there, as\n    // a cold load of the new URL would. The handler has already run: from\n    // here a failure must not read as the request failing, or the user would\n    // send it again. The item goes back alone instead, and the hub, writing\n    // the URL with nothing to land, loads the page itself.\n    res.json(\n      await loadAt(\n        moved,\n        nextLocation(page, parms, moved.row ?? {}),\n        `'${request.name}'`,\n      ),\n    );\n\n    /**\n     * The `lb-url` item and the page loaded where it leads. A load that\n     * throws is not the failure of what moved the URL: the item goes back\n     * alone, and the hub, writing the URL with nothing to land, loads the\n     * page itself.\n     */\n    async function loadAt(\n      moved: HubResponse[number],\n      next: { page: string; parms: URLSearchParams },\n      what: string,\n    ): Promise<HubResponse> {\n      try {\n        const load = await hub.dataForPage(\n          next.page,\n          contextFor(req, next.parms),\n          { follow: false },\n        );\n        return [moved, ...load];\n      } catch (err) {\n        console.error(\n          `loadbare: ${what} moved the URL, and loading '${next.page}' ` +\n            `there threw`,\n          err,\n        );\n        return [moved];\n      }\n    }\n  });\n\n  // A body that never parsed, or was too large to read, is refused like any\n  // other malformed request, rather than falling through to the\n  // application's error handler, which would print a stack and call it a\n  // server failure. Only for the hub's own path: express.json() above sees\n  // every request, and a bad body sent to one of the application's routes is\n  // the application's to answer.\n  router.use(\n    `${LB_ENDPOINT}/*page`,\n    (err: unknown, _req: Request, res: Response, next: NextFunction) => {\n      const { type, limit } = err as { type?: string; limit?: number };\n      if (type === \"entity.parse.failed\") {\n        console.warn(`loadbare: request body is not JSON`);\n        res.status(400).json([]);\n        return;\n      }\n      if (type === \"entity.too.large\") {\n        // Named in the log, since nothing in the browser says which limit\n        // was hit or where to raise it.\n        console.warn(\n          `loadbare: request body is over the limit of ${limit} bytes; ` +\n            `raise it with hubRoutes' json.limit option`,\n        );\n        res.status(413).json([]);\n        return;\n      }\n      next(err);\n    },\n  );\n\n  return router;\n}\n"]}

package/dist/server/lb-server.d.ts

@@ -1,4 +1,4 @@
-import type { HubData, HubRequest, HubResponse, HubResult, Kind, Patch, RequestFields, Row } from "../core/lb-types.js";
+import type { HubData, HubRequest, HubResponse, HubResult, Kind, GatheredRow, HubRefusal, Patch, RequestFields, Row } from "../core/lb-types.js";
 /**
  * Whatever the application hands the engine for the duration of one request.
  *
@@ -93,6 +93,29 @@ export declare function patch(change: {
  * This is Post/Redirect/Get without the redirect.
  */
 export declare function url(columns: Record<string, string>): HubData;
+/**
+ * A handler's refusal: thrown, and answered to the browser with the words
+ * it carries. Every other error a handler throws reaches the browser as a
+ * failure with nothing in it.
+ */
+export declare class Refusal extends Error {
+    readonly refusal: HubRefusal;
+    constructor(refusal: HubRefusal);
+}
+/**
+ * Refuse a request, in words written for the user. Throw what it returns:
+ *
+ *     throw refusal("That series already has paychecks entered.");
+ *     throw refusal({ amount: "Must be more than zero" });
+ *     throw refusal("Two fields need attention.", { amount: "…" });
+ *
+ * A message alone is for the request as a whole; columns name the controls
+ * the request gathered, and each message is shown on its control. Thrown
+ * rather than returned, so a refusal can come from anywhere the handler
+ * calls, and whatever the application has open rolls back as for any
+ * throw.
+ */
+export declare function refusal(message: string | Record<string, string>, columns?: Record<string, string>): Refusal;
 /** The shape of a `<stub>.queries.ts` module. */
 export type Queries = Record<string, Query>;
 /**
@@ -107,14 +130,21 @@ export interface Handler<R = RequestFields> {
     run: (ctx: HubContext, request: R) => void | HubData | Promise<void | HubData>;
     refresh: string[];
 }
+/**
+ * `rows` holds the rows of the queries nested in the form the request came
+ * from, by query name, each with its own values: a master's details,
+ * written with it.
+ */
 export type RowInsertHandler = Handler<{
     key?: string;
     values: Record<string, string>;
+    rows?: Record<string, GatheredRow[]>;
 }>;
 /** `values` holds only the columns being set, as an SQL UPDATE sets them. */
 export type RowUpdateHandler = Handler<{
     key: string;
     values: Record<string, string>;
+    rows?: Record<string, GatheredRow[]>;
 }>;
 export type RowDeleteHandler = Handler<{
     key: string;

package/dist/server/lb-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lb-server.d.ts","sourceRoot":"","sources":["../../server/lb-server.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACV,OAAO,EACP,UAAU,EACV,WAAW,EACX,SAAS,EACT,IAAI,EACJ,KAAK,EACL,aAAa,EAEb,GAAG,EACJ,MAAM,qBAAqB,CAAC;AAa7B;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,UAAU;CAAG;AAE9B;;;;;;;;;GASG;AACH,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,UAAU,KAAK,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAClE,uDAAuD;IACvD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,0EAA0E;IAC1E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;CACtC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,yEAAyE;AACzE,wBAAgB,GAAG,CACjB,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,CAAC,GAAG,EAAE,UAAU,KAAK,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAC3C,KAAK,CAEP;AAED;;;;GAIG;AACH,wBAAgB,IAAI,CAClB,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,CAAC,GAAG,EAAE,UAAU,KAAK,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,EAChD,OAAO,GAAE,WAAgB,GACxB,KAAK,CAQP;AAED;;;;;;;;GAQG;AACH,wBAAgB,KAAK,CAAC,MAAM,EAAE;IAAE,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAA;CAAE,GAAG,KAAK,CAIvE;AAQD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAE5D;AAED,iDAAiD;AACjD,MAAM,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAE5C;;;;;;;GAOG;AACH,MAAM,WAAW,OAAO,CAAC,CAAC,GAAG,aAAa;IACxC,GAAG,EAAE,CACH,GAAG,EAAE,UAAU,EACf,OAAO,EAAE,CAAC,KACP,IAAI,GAAG,OAAO,GAAG,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,CAAC;IAC9C,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,MAAM,gBAAgB,GAAG,OAAO,CAAC;IACrC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC,CAAC,CAAC;AACH,6EAA6E;AAC7E,MAAM,MAAM,gBAAgB,GAAG,OAAO,CAAC;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC,CAAC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAExD;;;;;;;GAOG;AACH,MAAM,WAAW,IAAI;IACnB,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B,SAAS,CAAC,EAAE,gBAAgB,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,QAAQ;IACvB,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,UAAU,KAAK,IAAI,GAAG,OAAO,GAAG,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,CAAC;IAC5E,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;CAC7B;AAED,mEAAmE;AACnE,MAAM,WAAW,IAAI;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED;;;GAGG;AACH,MAAM,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AAEzC;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,eAAe,CAAC;CACzB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,GAAG;IAClB,+DAA+D;IAC/D,WAAW,CACT,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,UAAU,EACf,OAAO,CAAC,EAAE,eAAe,GACxB,OAAO,CAAC,WAAW,CAAC,CAAC;IAExB,uEAAuE;IACvE,UAAU,CACR,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,UAAU,EACnB,GAAG,EAAE,UAAU,GACd,OAAO,CAAC,WAAW,CAAC,CAAC;CACzB;AASD;;;GAGG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,KAAK,GAAG,GAAG,CA8L3C"}
+{"version":3,"file":"lb-server.d.ts","sourceRoot":"","sources":["../../server/lb-server.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACV,OAAO,EACP,UAAU,EACV,WAAW,EACX,SAAS,EACT,IAAI,EACJ,WAAW,EACX,UAAU,EACV,KAAK,EACL,aAAa,EAEb,GAAG,EACJ,MAAM,qBAAqB,CAAC;AAa7B;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,UAAU;CAAG;AAE9B;;;;;;;;;GASG;AACH,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,UAAU,KAAK,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAClE,uDAAuD;IACvD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,0EAA0E;IAC1E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;CACtC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,yEAAyE;AACzE,wBAAgB,GAAG,CACjB,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,CAAC,GAAG,EAAE,UAAU,KAAK,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAC3C,KAAK,CAEP;AAED;;;;GAIG;AACH,wBAAgB,IAAI,CAClB,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,CAAC,GAAG,EAAE,UAAU,KAAK,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,EAChD,OAAO,GAAE,WAAgB,GACxB,KAAK,CAQP;AAED;;;;;;;;GAQG;AACH,wBAAgB,KAAK,CAAC,MAAM,EAAE;IAAE,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAA;CAAE,GAAG,KAAK,CAIvE;AAQD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAE5D;AAED;;;;GAIG;AACH,qBAAa,OAAQ,SAAQ,KAAK;IAChC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;gBAEjB,OAAO,EAAE,UAAU;CAKhC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,OAAO,CACrB,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACxC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,OAAO,CAIT;AAED,iDAAiD;AACjD,MAAM,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAE5C;;;;;;;GAOG;AACH,MAAM,WAAW,OAAO,CAAC,CAAC,GAAG,aAAa;IACxC,GAAG,EAAE,CACH,GAAG,EAAE,UAAU,EACf,OAAO,EAAE,CAAC,KACP,IAAI,GAAG,OAAO,GAAG,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,CAAC;IAC9C,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,OAAO,CAAC;IACrC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;CACtC,CAAC,CAAC;AACH,6EAA6E;AAC7E,MAAM,MAAM,gBAAgB,GAAG,OAAO,CAAC;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;CACtC,CAAC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAExD;;;;;;;GAOG;AACH,MAAM,WAAW,IAAI;IACnB,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B,SAAS,CAAC,EAAE,gBAAgB,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,QAAQ;IACvB,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,UAAU,KAAK,IAAI,GAAG,OAAO,GAAG,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,CAAC;IAC5E,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;CAC7B;AAED,mEAAmE;AACnE,MAAM,WAAW,IAAI;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED;;;GAGG;AACH,MAAM,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AAEzC;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,eAAe,CAAC;CACzB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,GAAG;IAClB,+DAA+D;IAC/D,WAAW,CACT,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,UAAU,EACf,OAAO,CAAC,EAAE,eAAe,GACxB,OAAO,CAAC,WAAW,CAAC,CAAC;IAExB,uEAAuE;IACvE,UAAU,CACR,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,UAAU,EACnB,GAAG,EAAE,UAAU,GACd,OAAO,CAAC,WAAW,CAAC,CAAC;CACzB;AASD;;;GAGG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,KAAK,GAAG,GAAG,CA2P3C"}

package/dist/server/lb-server.js

@@ -60,6 +60,37 @@ const patches = new WeakSet();
 export function url(columns) {
     return { [URL_QUERY]: { ...columns } };
 }
+/**
+ * A handler's refusal: thrown, and answered to the browser with the words
+ * it carries. Every other error a handler throws reaches the browser as a
+ * failure with nothing in it.
+ */
+export class Refusal extends Error {
+    refusal;
+    constructor(refusal) {
+        super(refusal.message ?? "refused");
+        this.name = "Refusal";
+        this.refusal = refusal;
+    }
+}
+/**
+ * Refuse a request, in words written for the user. Throw what it returns:
+ *
+ *     throw refusal("That series already has paychecks entered.");
+ *     throw refusal({ amount: "Must be more than zero" });
+ *     throw refusal("Two fields need attention.", { amount: "…" });
+ *
+ * A message alone is for the request as a whole; columns name the controls
+ * the request gathered, and each message is shown on its control. Thrown
+ * rather than returned, so a refusal can come from anywhere the handler
+ * calls, and whatever the application has open rolls back as for any
+ * throw.
+ */
+export function refusal(message, columns) {
+    return typeof message === "string"
+        ? new Refusal({ message, ...(columns && { columns }) })
+        : new Refusal({ columns: message });
+}
 /** The camel-cased `Crud` key of a request Loadbare provides. */
 const CRUD_KEYS = {
     [REQUEST_ROW_INSERT]: "rowInsert",
@@ -200,6 +231,41 @@ export function createHub(pages) {
             ...stated,
         });
     }
+    /**
+     * An update or a delete for several rows: the page's `crud` entry runs once
+     * per key, as it would for each row alone, so an application writes
+     * nothing more to allow it. What each run returns is laid together, a
+     * patch onto a patch, and the refresh set runs once.
+     *
+     * A run that returns `url()` is reported and its row ignored: a URL names
+     * one view, and several rows cannot each choose it.
+     */
+    async function eachKey(page, name, fields, ctx) {
+        const { keys, ...one } = fields;
+        const query = fields.query ?? "";
+        const handler = pages[page]?.requests.crud?.[query]?.[CRUD_KEYS[name]];
+        if (!handler) {
+            console.warn(`loadbare: page '${page}' declares no ${CRUD_KEYS[name]} for '${query}'`);
+            return [];
+        }
+        if (!Array.isArray(keys) || keys.some((key) => typeof key !== "string")) {
+            console.warn(`loadbare: '${name}' carries keys that are not strings`);
+            return [];
+        }
+        let stated = {};
+        for (const key of keys) {
+            const { [URL_QUERY]: moved, ...answer } = (await handler.run(ctx, { ...one, key })) ?? {};
+            if (moved !== undefined) {
+                console.warn(`loadbare: ${CRUD_KEYS[name]} for '${query}' returned url() for ` +
+                    `one of several rows, ignoring it`);
+            }
+            stated = layered(stated, answer);
+        }
+        return items(page, {
+            ...(await run(page, handler.refresh, ctx)),
+            ...stated,
+        });
+    }
     return {
         async dataForPage(page, ctx, { follow = true, parms } = {}) {
             const entry = pages[page];
@@ -219,6 +285,15 @@ export function createHub(pages) {
         },
         runRequest(page, request, ctx) {
             const { name, ...fields } = request;
+            if (fields.rows !== undefined && !wellFormedRows(fields.rows)) {
+                console.warn(`loadbare: '${name}' carries rows that are not keys and string ` +
+                    `values by query, ignoring it`);
+                return Promise.resolve([]);
+            }
+            if (fields.keys !== undefined &&
+                (name === REQUEST_ROW_UPDATE || name === REQUEST_ROW_DELETE)) {
+                return eachKey(page, name, fields, ctx);
+            }
             if (isRowRequest(name)) {
                 const query = fields.query ?? "";
                 return settle(page, pages[page]?.requests.crud?.[query]?.[CRUD_KEYS[name]], fields, ctx, `loadbare: page '${page}' declares no ${CRUD_KEYS[name]} for '${query}'`);
@@ -227,6 +302,41 @@ export function createHub(pages) {
         },
     };
 }
+/** Gathered rows as the hub sends them: string keys and string values. */
+function wellFormedRows(rows) {
+    if (typeof rows !== "object" || rows === null || Array.isArray(rows)) {
+        return false;
+    }
+    return Object.values(rows).every((set) => Array.isArray(set) &&
+        set.every((row) => typeof row === "object" &&
+            row !== null &&
+            typeof row.key === "string" &&
+            typeof row.values === "object" &&
+            row.values !== null &&
+            Object.values(row.values).every((v) => typeof v === "string")));
+}
+/**
+ * Two answers as one: a patch laid onto a patch for the same query keeps
+ * what both name, and any other answer replaces the one before it.
+ */
+function layered(before, after) {
+    const out = { ...before };
+    for (const [name, answer] of Object.entries(after)) {
+        const was = out[name];
+        if (was && patches.has(was) && patches.has(answer)) {
+            const a = was;
+            const b = answer;
+            out[name] = patch({
+                rows: [...(a.rows ?? []), ...(b.rows ?? [])],
+                drop: [...(a.drop ?? []), ...(b.drop ?? [])],
+            });
+        }
+        else {
+            out[name] = answer;
+        }
+    }
+    return out;
+}
 /**
  * The `lb-url` item for a row a handler or `onPageEnter` returned, or
  * nothing when it returned none or one that cannot be used. Whatever
@@ -236,7 +346,7 @@ export function createHub(pages) {
 function urlItem(page, moved) {
     if (moved === undefined)
         return undefined;
-    const refused = refusal(moved);
+    const refused = unusableUrl(moved);
     if (refused === undefined) {
         return {
             query: URL_QUERY,
@@ -259,7 +369,7 @@ function leadsHere(page, parms, row) {
  * A value is a string, as a control's is and a URL's is. At least one column
  * is named: a row naming none changes nothing.
  */
-function refusal(columns) {
+function unusableUrl(columns) {
     if (typeof columns !== "object" ||
         columns === null ||
         Array.isArray(columns)) {

package/dist/server/lb-server.js.map

@@ -1 +1 @@
-{"version":3,"file":"lb-server.js","sourceRoot":"","sources":["../../server/lb-server.ts"],"names":[],"mappings":"AAAA,wDAAwD;AACxD,EAAE;AACF,oEAAoE;AACpE,4EAA4E;AAC5E,4EAA4E;AAC5E,gDAAgD;AAahD,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAC7E,OAAO,EACL,QAAQ,EACR,SAAS,EACT,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,EACf,SAAS,GACV,MAAM,yBAAyB,CAAC;AA8DjC,yEAAyE;AACzE,MAAM,UAAU,GAAG,CACjB,GAAW,EACX,GAA4C;IAE5C,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AACtC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,IAAI,CAClB,GAAW,EACX,GAAgD,EAChD,UAAuB,EAAE;IAEzB,OAAO;QACL,IAAI,EAAE,SAAS;QACf,GAAG;QACH,GAAG;QACH,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;QAC5D,GAAG,CAAC,OAAO,CAAC,iBAAiB,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC;KAC9D,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,KAAK,CAAC,MAA0C;IAC9D,MAAM,IAAI,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;IAC3B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClB,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,GAAG,IAAI,OAAO,EAAU,CAAC;AAEtC;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,GAAG,CAAC,OAA+B;IACjD,OAAO,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,GAAG,OAAO,EAAE,EAAE,CAAC;AACzC,CAAC;AAqHD,iEAAiE;AACjE,MAAM,SAAS,GAA+B;IAC5C,CAAC,kBAAkB,CAAC,EAAE,WAAW;IACjC,CAAC,kBAAkB,CAAC,EAAE,WAAW;IACjC,CAAC,kBAAkB,CAAC,EAAE,WAAW;CAClC,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,KAAY;IACpC,2EAA2E;IAC3E,mEAAmE;IACnE,sEAAsE;IACtE,qBAAqB;IACrB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG;YACf,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;YAC7B,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAC;YAC7C,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC;SAC1C,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,IAAI,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBACxC,MAAM,IAAI,KAAK,CACb,mBAAmB,IAAI,eAAe,IAAI,eAAe;oBACvD,mBAAmB,kBAAkB,gBAAgB,CACxD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,oEAAoE;QACpE,oEAAoE;QACpE,yEAAyE;QACzE,uEAAuE;QACvE,oEAAoE;QACpE,wEAAwE;QACxE,yCAAyC;QACzC,uEAAuE;QACvE,kCAAkC;QAClC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1D,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;gBAAE,SAAS;YACxC,IAAI,CAAC;gBACH,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC1B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CACb,mBAAmB,IAAI,YAAY,IAAI,MAAO,GAAa,CAAC,OAAO,EAAE,CACtE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;YACrE,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,KAAK,SAAS;gBAAE,SAAS;YACtD,KAAK,MAAM,OAAO,IAAI,CAAC,WAAW,EAAE,WAAW,CAAU,EAAE,CAAC;gBAC1D,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1C,MAAM,IAAI,KAAK,CACb,mBAAmB,IAAI,gBAAgB,IAAI,kBAAkB;wBAC3D,GAAG,OAAO,8CAA8C,CAC3D,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,SAAS,KAAK,CAAC,IAAY,EAAE,IAAa;QACxC,MAAM,GAAG,GAAmB,EAAE,CAAC;QAC/B,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAClD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,IAAI,CAAC,mBAAmB,IAAI,wBAAwB,IAAI,GAAG,CAAC,CAAC;gBACrE,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GAAiB;gBACzB,KAAK,EAAE,IAAI;gBACX,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,GAAG,EAAE,KAAK,CAAC,GAAG;aACf,CAAC;YACF,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC5B,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;oBACjD,OAAO,CAAC,IAAI,CACV,oBAAoB,IAAI,sCAAsC;wBAC5D,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,CAClD,CAAC;oBACF,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,GAAG,GAAG,MAAa,CAAC;YAC3B,CAAC;iBAAM,CAAC;gBACN,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;oBAAE,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC;;oBACzC,IAAI,CAAC,KAAK,GAAG,MAAe,CAAC;gBAClC,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;oBAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;gBACxD,IAAI,KAAK,CAAC,iBAAiB;oBAAE,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;YAC7D,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,wEAAwE;IACxE,KAAK,UAAU,GAAG,CAChB,IAAY,EACZ,KAAe,EACf,GAAe;QAEf,MAAM,IAAI,GAAY,EAAE,CAAC;QACzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,IAAI,CAAC,mBAAmB,IAAI,wBAAwB,IAAI,GAAG,CAAC,CAAC;gBACrE,SAAS;YACX,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACpC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,EAAE,CAAC;gBACzD,OAAO,CAAC,IAAI,CACV,oBAAoB,IAAI,iBAAiB,KAAK,CAAC,IAAI,gBAAgB;oBACjE,QAAQ,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,CACvD,CAAC;gBACF,SAAS;YACX,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC;QACtB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,UAAU,MAAM,CACnB,IAAY,EACZ,OAAmC,EACnC,OAAsB,EACtB,GAAe,EACf,QAAgB;QAEhB,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACvB,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,MAAM,EAAE,GACrC,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,OAAgB,CAAC,CAAC,IAAI,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAClC,IAAI,IAAI;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACxB,OAAO,KAAK,CAAC,IAAI,EAAE;YACjB,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAC1C,GAAG,MAAM;SACV,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,MAAM,GAAG,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE;YACxD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;YAC1B,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,IAAI,CAAC,sBAAsB,IAAI,GAAG,CAAC,CAAC;gBAC5C,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,MAAM,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,MAAM,EAAE,GACrC,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YAClD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnC,OAAO,CAAC,IAAI,CACV,mBAAmB,IAAI,6CAA6C;oBAClE,iCAAiC,CACpC,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACvD,IAAI,IAAI,IAAI,CAAC,CAAC,KAAK,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,GAAI,CAAC,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,CAAC;YACzE,OAAO,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACvE,CAAC;QAED,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG;YAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC;YACpC,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;gBACjC,OAAO,MAAM,CACX,IAAI,EACJ,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAE,CAC1B,EAC5B,MAAM,EACN,GAAG,EACH,mBAAmB,IAAI,iBAAiB,SAAS,CAAC,IAAI,CAAC,SAAS,KAAK,GAAG,CACzE,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,CACX,IAAI,EACJ,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,IAAI,CAA+B,EACpE,MAAM,EACN,GAAG,EACH,mBAAmB,IAAI,0BAA0B,IAAI,GAAG,CACzD,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,OAAO,CAAC,IAAY,EAAE,KAAc;IAC3C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO;YACL,KAAK,EAAE,SAAS;YAChB,IAAI,EAAE,QAAQ;YACd,GAAG,EAAE,eAAe;YACpB,GAAG,EAAE,KAAY;SAClB,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,IAAI,CACV,mBAAmB,IAAI,cAAc,SAAS,IAAI,OAAO,eAAe,CACzE,CAAC;IACF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,8EAA8E;AAC9E,SAAS,SAAS,CAAC,IAAY,EAAE,KAAsB,EAAE,GAAQ;IAC/D,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IAC5C,OAAO,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;AAC1E,CAAC;AAED;;;;;GAKG;AACH,SAAS,OAAO,CAAC,OAAgB;IAC/B,IACE,OAAO,OAAO,KAAK,QAAQ;QAC3B,OAAO,KAAK,IAAI;QAChB,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EACtB,CAAC;QACD,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,kBAAkB,CAAC;IACnD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;QAChD,OAAO,kEAAkE,CAAC;IAC5E,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC","sourcesContent":["// The server-side contract and the engine that runs it.\n//\n// This is the counterpart to core/lb-constants.ts: that file is the\n// vocabulary the browser writes, this one is the vocabulary the application\n// writes. The engine below is the whole of Loadbare on the server. It ships\n// no HTTP server, no router, and no data layer.\n\nimport type {\n  HubData,\n  HubRequest,\n  HubResponse,\n  HubResult,\n  Kind,\n  Patch,\n  RequestFields,\n  ResponseItem,\n  Row,\n} from \"../core/lb-types.js\";\nimport { isRowRequest, nextLocation, parseOrder } from \"../core/lb-types.js\";\nimport {\n  KIND_ROW,\n  KIND_ROWS,\n  LB_RESERVED_PREFIX,\n  REQUEST_ROW_DELETE,\n  REQUEST_ROW_INSERT,\n  REQUEST_ROW_UPDATE,\n  URL_COLUMN_PATH,\n  URL_QUERY,\n} from \"../core/lb-constants.js\";\n\n/**\n * Whatever the application hands the engine for the duration of one request.\n *\n * Loadbare declares it empty and never reads it. An application fills it in\n * by declaration merging, once, anywhere in its own source:\n *\n *     declare module \"@loadbare/app/server\" {\n *       interface HubContext {\n *         db: Db;\n *       }\n *     }\n *\n * That is why no type on this page takes a type parameter. The context is a\n * request-scoped handle — an authenticated database connection is the\n * expected case — so it is passed per call rather than held by the engine.\n * The page's query parms are the other expected member: a query that reads\n * one off the context takes no argument, and re-runs under `refresh` like\n * any other.\n */\nexport interface HubContext {}\n\n/**\n * A declared query: its kind, its key, and the run that answers it.\n *\n * Kind and key are properties of the name rather than of any one answer, so\n * they are declared here and never inferred from what comes back. The engine\n * sends both with every answer, so the markup repeats neither. Every query\n * has a key; an aggregate row answers with a constant one.\n *\n * Write one with `row()` or `rows()` below; nothing else builds one.\n */\nexport interface Query {\n  readonly kind: Kind;\n  readonly key: string;\n  readonly run: (ctx: HubContext) => HubResult | Promise<HubResult>;\n  /** A `rows` query's order, as `rows()` declared it. */\n  readonly order?: string;\n  /** Whether a `rows` query reads the order parm and sorts by it itself. */\n  readonly serverSortedByUrl?: boolean;\n}\n\n/**\n * What a `rows` query declares about its order.\n *\n * `order` is the order the hub places its rows by: columns separated by\n * commas, each descending when it begins with `-`, as in\n * `category_order,-opened`. The user's order, carried in the query parm\n * `lb-order-<query>`, replaces it. With neither, rows show in the order the\n * query answered them in.\n *\n * `serverSortedByUrl` says the query reads that parm and sorts by it itself,\n * which a query that pages or limits its rows must: a change of the user's\n * order then runs the query again. Without it, the hub sorts the rows it\n * already has, with no round trip.\n */\nexport interface RowsOptions {\n  order?: string;\n  serverSortedByUrl?: boolean;\n}\n\n/** A query that answers with one row, identified by its `key` column. */\nexport function row(\n  key: string,\n  run: (ctx: HubContext) => Row | Promise<Row>,\n): Query {\n  return { kind: KIND_ROW, key, run };\n}\n\n/**\n * A query that answers with all its rows. Rows land by their `key` column: a\n * row whose key is not in the answer is gone. The hub places them by the\n * order in `options`, or in the order they arrived when there is none.\n */\nexport function rows(\n  key: string,\n  run: (ctx: HubContext) => Row[] | Promise<Row[]>,\n  options: RowsOptions = {},\n): Query {\n  return {\n    kind: KIND_ROWS,\n    key,\n    run,\n    ...(options.order !== undefined && { order: options.order }),\n    ...(options.serverSortedByUrl && { serverSortedByUrl: true }),\n  };\n}\n\n/**\n * Only what changed, returned from a handler for a `rows` query. Rows named\n * here are added or updated, keys in `drop` are removed, and everything\n * unnamed is left alone — its contents, and its place in whatever order the\n * page is keeping.\n *\n * `Array.isArray` is what tells a patch from all rows, so a patch needs no\n * marker of its own and no column name is reserved to carry one.\n */\nexport function patch(change: { rows?: Row[]; drop?: unknown[] }): Patch {\n  const made = { ...change };\n  patches.add(made);\n  return made;\n}\n\n/**\n * Every object `patch()` made. A patch and a row are both plain objects, so\n * this is how the engine refuses a patch answering a `row` query.\n */\nconst patches = new WeakSet<object>();\n\n/**\n * A new row for `lb-url`, returned from a handler when only the handler can\n * know where the page belongs: the key of a row it inserted, or the absence\n * of one it deleted.\n *\n * A column other than `lb-path` is a query parm: set, or taken out when its\n * value is empty. With `lb-path` naming another page, the page is entered\n * with only the parms named here; otherwise every other parm is kept.\n *\n * The page then loads at the new URL in the same round trip, as a cold load\n * of it would, so the refresh set is not run and whatever else the handler\n * returned is dropped: both were answers for the URL the page is leaving.\n * This is Post/Redirect/Get without the redirect.\n */\nexport function url(columns: Record<string, string>): HubData {\n  return { [URL_QUERY]: { ...columns } };\n}\n\n/** The shape of a `<stub>.queries.ts` module. */\nexport type Queries = Record<string, Query>;\n\n/**\n * What a handler does, and which queries re-run once it has.\n *\n * `run` may also return answers of its own, which are laid over the\n * refreshed ones. That is how a patch reaches the browser: a query answers\n * for all its rows and cannot know why it re-ran, but the handler knows\n * exactly what it changed and can say only that.\n */\nexport interface Handler<R = RequestFields> {\n  run: (\n    ctx: HubContext,\n    request: R,\n  ) => void | HubData | Promise<void | HubData>;\n  refresh: string[];\n}\n\nexport type RowInsertHandler = Handler<{\n  key?: string;\n  values: Record<string, string>;\n}>;\n/** `values` holds only the columns being set, as an SQL UPDATE sets them. */\nexport type RowUpdateHandler = Handler<{\n  key: string;\n  values: Record<string, string>;\n}>;\nexport type RowDeleteHandler = Handler<{ key: string }>;\n\n/**\n * What the requests Loadbare provides do to one query, keyed by its name in\n * `Requests.crud`. A query with no entry here permits none of them: the wire\n * cannot reach anything the page has not published.\n *\n * Every key is the request name with the prefix stripped and the rest\n * camel-cased: `lb-row-insert` runs `rowInsert`.\n */\nexport interface Crud {\n  rowInsert?: RowInsertHandler;\n  rowUpdate?: RowUpdateHandler;\n  rowDelete?: RowDeleteHandler;\n}\n\n/**\n * The shape of a `<stub>.requests.ts` module.\n *\n * `onPageEnter` runs when the page loads, before its queries. It declares no\n * refresh set: the page's queries all run afterward, so whatever it changed\n * is already in the response. It may return `url()` instead, to move the\n * page to other query parms or another page before anything shows, as an\n * application restoring what the user last had on screen does. The page\n * then loads there in the same round trip, and `onPageEnter` running for\n * that load is not followed again.\n *\n * `handlers` holds the page's declared requests, by name. A name the page\n * did not declare is refused, so the wire cannot reach anything the page has\n * not published.\n *\n * `crud` holds what the requests Loadbare provides run, by query name.\n */\nexport interface Requests {\n  onPageEnter?: (ctx: HubContext) => void | HubData | Promise<void | HubData>;\n  handlers?: Record<string, Handler>;\n  crud?: Record<string, Crud>;\n}\n\n/** A page is three files sharing a stub; two of them are these. */\nexport interface Page {\n  queries: Queries;\n  requests: Requests;\n}\n\n/**\n * The page registry. The builder writes it from every `.requests.ts` and\n * `.queries.ts` it discovers — see docs/reference/builder.md.\n */\nexport type Pages = Record<string, Page>;\n\n/**\n * How a page load treats a `url()` its `onPageEnter` returned.\n *\n * With `follow` false it is ignored and the queries run, as they must for a\n * load that is itself at a URL something else moved to. With `parms`, the\n * query parms the page is being loaded at, one that leads to the page and\n * parms already in hand is ignored the same way, so the page loads once.\n */\nexport interface PageLoadOptions {\n  follow?: boolean;\n  parms?: URLSearchParams;\n}\n\n/**\n * The engine. Both calls answer with response items. A request whose\n * handler returned `url()`, and a page load whose `onPageEnter` did, answer\n * with the `lb-url` item alone: the caller builds a context at the new URL,\n * calls `dataForPage` with it and `follow` false, and sends the load beside the\n * item. `hubRoutes` does exactly that.\n */\nexport interface Hub {\n  /** A page load: its `onPageEnter`, then all of its queries. */\n  dataForPage(\n    page: string,\n    ctx: HubContext,\n    options?: PageLoadOptions,\n  ): Promise<HubResponse>;\n\n  /** A request: run the handler its name picks, then the refresh set. */\n  runRequest(\n    page: string,\n    request: HubRequest,\n    ctx: HubContext,\n  ): Promise<HubResponse>;\n}\n\n/** The camel-cased `Crud` key of a request Loadbare provides. */\nconst CRUD_KEYS: Record<string, keyof Crud> = {\n  [REQUEST_ROW_INSERT]: \"rowInsert\",\n  [REQUEST_ROW_UPDATE]: \"rowUpdate\",\n  [REQUEST_ROW_DELETE]: \"rowDelete\",\n};\n\n/**\n * Build the engine over a set of pages. The pages are fixed at startup; the\n * context is not, and arrives with each call.\n */\nexport function createHub(pages: Pages): Hub {\n  // Names beginning with the reserved prefix are Loadbare's — its own query,\n  // the requests it provides — so an application cannot declare one.\n  // Refused at startup, because a name is a fact about the page and not\n  // about any request.\n  for (const [page, entry] of Object.entries(pages)) {\n    const declared = [\n      ...Object.keys(entry.queries),\n      ...Object.keys(entry.requests.handlers ?? {}),\n      ...Object.keys(entry.requests.crud ?? {}),\n    ];\n    for (const name of declared) {\n      if (name.startsWith(LB_RESERVED_PREFIX)) {\n        throw new Error(\n          `loadbare: page '${page}' declares '${name}', but names ` +\n            `beginning with '${LB_RESERVED_PREFIX}' are reserved`,\n        );\n      }\n    }\n\n    // An update or a delete names its row by key, so its handler always\n    // knows which rows changed and can answer with a patch, and the hub\n    // places what the patch names by the query's order. Refreshing the whole\n    // set instead sends every row to say one thing. There is no case where\n    // that is the answer to either, so it is refused rather than warned\n    // about. An insert is not: its key exists only once the row does, and a\n    // handler may leave the query to say so.\n    // An order is a fact about the query, so a malformed one is refused at\n    // startup, as a reserved name is.\n    for (const [name, query] of Object.entries(entry.queries)) {\n      if (query.order === undefined) continue;\n      try {\n        parseOrder(query.order);\n      } catch (err) {\n        throw new Error(\n          `loadbare: page '${page}' query '${name}': ${(err as Error).message}`,\n        );\n      }\n    }\n\n    for (const [name, crud] of Object.entries(entry.requests.crud ?? {})) {\n      if (entry.queries[name]?.kind !== KIND_ROWS) continue;\n      for (const request of [\"rowUpdate\", \"rowDelete\"] as const) {\n        if (crud[request]?.refresh.includes(name)) {\n          throw new Error(\n            `loadbare: page '${page}' refreshes '${name}' after its own ` +\n              `${request}; return the changed rows in a patch instead`,\n          );\n        }\n      }\n    }\n  }\n\n  /**\n   * Answers into response items, adding the kind and key each query\n   * declared. An answer that disagrees with its declaration is a mistake in\n   * the application rather than a case to handle, and is left out: a page is\n   * better off missing one query than showing the wrong shape for it.\n   */\n  function items(page: string, data: HubData): HubResponse {\n    const out: ResponseItem[] = [];\n    for (const [name, result] of Object.entries(data)) {\n      const query = pages[page]?.queries[name];\n      if (!query) {\n        console.warn(`loadbare: page '${page}' declares no query '${name}'`);\n        continue;\n      }\n      const item: ResponseItem = {\n        query: name,\n        kind: query.kind,\n        key: query.key,\n      };\n      if (query.kind === KIND_ROW) {\n        if (Array.isArray(result) || patches.has(result)) {\n          console.warn(\n            `loadbare: query '${name}' is declared row but answered with ` +\n              `${Array.isArray(result) ? \"rows\" : \"a patch\"}`,\n          );\n          continue;\n        }\n        item.row = result as Row;\n      } else {\n        if (Array.isArray(result)) item.rows = result;\n        else item.patch = result as Patch;\n        if (query.order !== undefined) item.order = query.order;\n        if (query.serverSortedByUrl) item.serverSortedByUrl = true;\n      }\n      out.push(item);\n    }\n    return out;\n  }\n\n  /** Run queries by name, each answering with all its rows or its row. */\n  async function run(\n    page: string,\n    names: string[],\n    ctx: HubContext,\n  ): Promise<HubData> {\n    const data: HubData = {};\n    for (const name of names) {\n      const query = pages[page]?.queries[name];\n      if (!query) {\n        console.warn(`loadbare: page '${page}' declares no query '${name}'`);\n        continue;\n      }\n      const result = await query.run(ctx);\n      if (Array.isArray(result) !== (query.kind === KIND_ROWS)) {\n        console.warn(\n          `loadbare: query '${name}' is declared ${query.kind} but answered ` +\n            `with ${Array.isArray(result) ? \"rows\" : \"one row\"}`,\n        );\n        continue;\n      }\n      data[name] = result;\n    }\n    return data;\n  }\n\n  /**\n   * Run a handler, then its refresh set against the same context, laying\n   * what the handler itself returned over the refreshed queries — the\n   * narrower answer wins because it knows what actually changed.\n   *\n   * A handler that returned `url()` answers with the `lb-url` item alone.\n   * Loading the page there needs a context built at the new URL, and\n   * building one is the caller's.\n   */\n  async function settle(\n    page: string,\n    handler: Handler<never> | undefined,\n    request: RequestFields,\n    ctx: HubContext,\n    notFound: string,\n  ): Promise<HubResponse> {\n    if (!handler) {\n      console.warn(notFound);\n      return [];\n    }\n    const { [URL_QUERY]: moved, ...stated } =\n      (await handler.run(ctx, request as never)) ?? {};\n    const item = urlItem(page, moved);\n    if (item) return [item];\n    return items(page, {\n      ...(await run(page, handler.refresh, ctx)),\n      ...stated,\n    });\n  }\n\n  return {\n    async dataForPage(page, ctx, { follow = true, parms } = {}) {\n      const entry = pages[page];\n      if (!entry) {\n        console.warn(`loadbare: no page '${page}'`);\n        return [];\n      }\n      const { [URL_QUERY]: moved, ...stated } =\n        (await entry.requests.onPageEnter?.(ctx)) ?? {};\n      if (Object.keys(stated).length > 0) {\n        console.warn(\n          `loadbare: page '${page}' onPageEnter returned answers; it returns ` +\n            `url() or nothing, ignoring them`,\n        );\n      }\n      const item = follow ? urlItem(page, moved) : undefined;\n      if (item && !(parms && leadsHere(page, parms, item.row!))) return [item];\n      return items(page, await run(page, Object.keys(entry.queries), ctx));\n    },\n\n    runRequest(page, request, ctx) {\n      const { name, ...fields } = request;\n      if (isRowRequest(name)) {\n        const query = fields.query ?? \"\";\n        return settle(\n          page,\n          pages[page]?.requests.crud?.[query]?.[CRUD_KEYS[name]!] as\n            Handler<never> | undefined,\n          fields,\n          ctx,\n          `loadbare: page '${page}' declares no ${CRUD_KEYS[name]} for '${query}'`,\n        );\n      }\n      return settle(\n        page,\n        pages[page]?.requests.handlers?.[name] as Handler<never> | undefined,\n        fields,\n        ctx,\n        `loadbare: page '${page}' declares no request '${name}'`,\n      );\n    },\n  };\n}\n\n/**\n * The `lb-url` item for a row a handler or `onPageEnter` returned, or\n * nothing when it returned none or one that cannot be used. Whatever\n * returned it has already run, so a row that cannot be used is reported and\n * the call goes on as if none had been returned.\n */\nfunction urlItem(page: string, moved: unknown): ResponseItem | undefined {\n  if (moved === undefined) return undefined;\n  const refused = refusal(moved);\n  if (refused === undefined) {\n    return {\n      query: URL_QUERY,\n      kind: KIND_ROW,\n      key: URL_COLUMN_PATH,\n      row: moved as Row,\n    };\n  }\n  console.warn(\n    `loadbare: page '${page}' returned ${URL_QUERY} ${refused}, ignoring it`,\n  );\n  return undefined;\n}\n\n/** Whether a row for `lb-url` leads to the page and parms already in hand. */\nfunction leadsHere(page: string, parms: URLSearchParams, row: Row): boolean {\n  const next = nextLocation(page, parms, row);\n  return next.page === page && next.parms.toString() === parms.toString();\n}\n\n/**\n * Why a returned row for `lb-url` cannot be used, or nothing when it can.\n *\n * A value is a string, as a control's is and a URL's is. At least one column\n * is named: a row naming none changes nothing.\n */\nfunction refusal(columns: unknown): string | undefined {\n  if (\n    typeof columns !== \"object\" ||\n    columns === null ||\n    Array.isArray(columns)\n  ) {\n    return \"that is not a row\";\n  }\n  const values = Object.values(columns);\n  if (values.length === 0) return \"naming no column\";\n  if (!values.every((v) => typeof v === \"string\")) {\n    return `holding a value that is not a string; write url({ name: \"...\" })`;\n  }\n  return undefined;\n}\n"]}
+{"version":3,"file":"lb-server.js","sourceRoot":"","sources":["../../server/lb-server.ts"],"names":[],"mappings":"AAAA,wDAAwD;AACxD,EAAE;AACF,oEAAoE;AACpE,4EAA4E;AAC5E,4EAA4E;AAC5E,gDAAgD;AAehD,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAC7E,OAAO,EACL,QAAQ,EACR,SAAS,EACT,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,EACf,SAAS,GACV,MAAM,yBAAyB,CAAC;AA8DjC,yEAAyE;AACzE,MAAM,UAAU,GAAG,CACjB,GAAW,EACX,GAA4C;IAE5C,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AACtC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,IAAI,CAClB,GAAW,EACX,GAAgD,EAChD,UAAuB,EAAE;IAEzB,OAAO;QACL,IAAI,EAAE,SAAS;QACf,GAAG;QACH,GAAG;QACH,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;QAC5D,GAAG,CAAC,OAAO,CAAC,iBAAiB,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC;KAC9D,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,KAAK,CAAC,MAA0C;IAC9D,MAAM,IAAI,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;IAC3B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClB,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,GAAG,IAAI,OAAO,EAAU,CAAC;AAEtC;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,GAAG,CAAC,OAA+B;IACjD,OAAO,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,GAAG,OAAO,EAAE,EAAE,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,OAAQ,SAAQ,KAAK;IACvB,OAAO,CAAa;IAE7B,YAAY,OAAmB;QAC7B,KAAK,CAAC,OAAO,CAAC,OAAO,IAAI,SAAS,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC;QACtB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,OAAO,CACrB,OAAwC,EACxC,OAAgC;IAEhC,OAAO,OAAO,OAAO,KAAK,QAAQ;QAChC,CAAC,CAAC,IAAI,OAAO,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QACvD,CAAC,CAAC,IAAI,OAAO,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;AACxC,CAAC;AA4HD,iEAAiE;AACjE,MAAM,SAAS,GAA+B;IAC5C,CAAC,kBAAkB,CAAC,EAAE,WAAW;IACjC,CAAC,kBAAkB,CAAC,EAAE,WAAW;IACjC,CAAC,kBAAkB,CAAC,EAAE,WAAW;CAClC,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,KAAY;IACpC,2EAA2E;IAC3E,mEAAmE;IACnE,sEAAsE;IACtE,qBAAqB;IACrB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG;YACf,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;YAC7B,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAC;YAC7C,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC;SAC1C,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,IAAI,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBACxC,MAAM,IAAI,KAAK,CACb,mBAAmB,IAAI,eAAe,IAAI,eAAe;oBACvD,mBAAmB,kBAAkB,gBAAgB,CACxD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,oEAAoE;QACpE,oEAAoE;QACpE,yEAAyE;QACzE,uEAAuE;QACvE,oEAAoE;QACpE,wEAAwE;QACxE,yCAAyC;QACzC,uEAAuE;QACvE,kCAAkC;QAClC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1D,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;gBAAE,SAAS;YACxC,IAAI,CAAC;gBACH,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC1B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CACb,mBAAmB,IAAI,YAAY,IAAI,MAAO,GAAa,CAAC,OAAO,EAAE,CACtE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;YACrE,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,KAAK,SAAS;gBAAE,SAAS;YACtD,KAAK,MAAM,OAAO,IAAI,CAAC,WAAW,EAAE,WAAW,CAAU,EAAE,CAAC;gBAC1D,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1C,MAAM,IAAI,KAAK,CACb,mBAAmB,IAAI,gBAAgB,IAAI,kBAAkB;wBAC3D,GAAG,OAAO,8CAA8C,CAC3D,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,SAAS,KAAK,CAAC,IAAY,EAAE,IAAa;QACxC,MAAM,GAAG,GAAmB,EAAE,CAAC;QAC/B,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAClD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,IAAI,CAAC,mBAAmB,IAAI,wBAAwB,IAAI,GAAG,CAAC,CAAC;gBACrE,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GAAiB;gBACzB,KAAK,EAAE,IAAI;gBACX,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,GAAG,EAAE,KAAK,CAAC,GAAG;aACf,CAAC;YACF,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC5B,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;oBACjD,OAAO,CAAC,IAAI,CACV,oBAAoB,IAAI,sCAAsC;wBAC5D,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,CAClD,CAAC;oBACF,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,GAAG,GAAG,MAAa,CAAC;YAC3B,CAAC;iBAAM,CAAC;gBACN,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;oBAAE,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC;;oBACzC,IAAI,CAAC,KAAK,GAAG,MAAe,CAAC;gBAClC,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;oBAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;gBACxD,IAAI,KAAK,CAAC,iBAAiB;oBAAE,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;YAC7D,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,wEAAwE;IACxE,KAAK,UAAU,GAAG,CAChB,IAAY,EACZ,KAAe,EACf,GAAe;QAEf,MAAM,IAAI,GAAY,EAAE,CAAC;QACzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,IAAI,CAAC,mBAAmB,IAAI,wBAAwB,IAAI,GAAG,CAAC,CAAC;gBACrE,SAAS;YACX,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACpC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,EAAE,CAAC;gBACzD,OAAO,CAAC,IAAI,CACV,oBAAoB,IAAI,iBAAiB,KAAK,CAAC,IAAI,gBAAgB;oBACjE,QAAQ,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,CACvD,CAAC;gBACF,SAAS;YACX,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC;QACtB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,UAAU,MAAM,CACnB,IAAY,EACZ,OAAmC,EACnC,OAAsB,EACtB,GAAe,EACf,QAAgB;QAEhB,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACvB,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,MAAM,EAAE,GACrC,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,OAAgB,CAAC,CAAC,IAAI,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAClC,IAAI,IAAI;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACxB,OAAO,KAAK,CAAC,IAAI,EAAE;YACjB,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAC1C,GAAG,MAAM;SACV,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,UAAU,OAAO,CACpB,IAAY,EACZ,IAAY,EACZ,MAAqB,EACrB,GAAe;QAEf,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,EAAE,GAAG,MAAM,CAAC;QAChC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAE,CAEzD,CAAC;QACd,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CACV,mBAAmB,IAAI,iBAAiB,SAAS,CAAC,IAAI,CAAC,SAAS,KAAK,GAAG,CACzE,CAAC;YACF,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,EAAE,CAAC;YACxE,OAAO,CAAC,IAAI,CAAC,cAAc,IAAI,qCAAqC,CAAC,CAAC;YACtE,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,MAAM,GAAY,EAAE,CAAC;QACzB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,MAAM,EAAE,GACrC,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,GAAG,EAAE,GAAG,EAAW,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,OAAO,CAAC,IAAI,CACV,aAAa,SAAS,CAAC,IAAI,CAAC,SAAS,KAAK,uBAAuB;oBAC/D,kCAAkC,CACrC,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,EAAE;YACjB,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAC1C,GAAG,MAAM;SACV,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,MAAM,GAAG,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE;YACxD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;YAC1B,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,IAAI,CAAC,sBAAsB,IAAI,GAAG,CAAC,CAAC;gBAC5C,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,MAAM,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,MAAM,EAAE,GACrC,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YAClD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnC,OAAO,CAAC,IAAI,CACV,mBAAmB,IAAI,6CAA6C;oBAClE,iCAAiC,CACpC,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACvD,IAAI,IAAI,IAAI,CAAC,CAAC,KAAK,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,GAAI,CAAC,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,CAAC;YACzE,OAAO,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACvE,CAAC;QAED,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG;YAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC;YACpC,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9D,OAAO,CAAC,IAAI,CACV,cAAc,IAAI,8CAA8C;oBAC9D,8BAA8B,CACjC,CAAC;gBACF,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC7B,CAAC;YACD,IACE,MAAM,CAAC,IAAI,KAAK,SAAS;gBACzB,CAAC,IAAI,KAAK,kBAAkB,IAAI,IAAI,KAAK,kBAAkB,CAAC,EAC5D,CAAC;gBACD,OAAO,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;YAC1C,CAAC;YACD,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;gBACjC,OAAO,MAAM,CACX,IAAI,EACJ,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAE,CAC1B,EAC5B,MAAM,EACN,GAAG,EACH,mBAAmB,IAAI,iBAAiB,SAAS,CAAC,IAAI,CAAC,SAAS,KAAK,GAAG,CACzE,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,CACX,IAAI,EACJ,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,IAAI,CAA+B,EACpE,MAAM,EACN,GAAG,EACH,mBAAmB,IAAI,0BAA0B,IAAI,GAAG,CACzD,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,SAAS,cAAc,CAAC,IAAa;IACnC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACrE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAC9B,CAAC,GAAG,EAAE,EAAE,CACN,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAClB,GAAG,CAAC,KAAK,CACP,CAAC,GAAG,EAAE,EAAE,CACN,OAAO,GAAG,KAAK,QAAQ;YACvB,GAAG,KAAK,IAAI;YACZ,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ;YAC3B,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ;YAC9B,GAAG,CAAC,MAAM,KAAK,IAAI;YACnB,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAChE,CACJ,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,OAAO,CAAC,MAAe,EAAE,KAAc;IAC9C,MAAM,GAAG,GAAY,EAAE,GAAG,MAAM,EAAE,CAAC;IACnC,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACnD,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACnD,MAAM,CAAC,GAAG,GAAY,CAAC;YACvB,MAAM,CAAC,GAAG,MAAe,CAAC;YAC1B,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;gBAChB,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;gBAC5C,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;aAC7C,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,SAAS,OAAO,CAAC,IAAY,EAAE,KAAc;IAC3C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO;YACL,KAAK,EAAE,SAAS;YAChB,IAAI,EAAE,QAAQ;YACd,GAAG,EAAE,eAAe;YACpB,GAAG,EAAE,KAAY;SAClB,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,IAAI,CACV,mBAAmB,IAAI,cAAc,SAAS,IAAI,OAAO,eAAe,CACzE,CAAC;IACF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,8EAA8E;AAC9E,SAAS,SAAS,CAAC,IAAY,EAAE,KAAsB,EAAE,GAAQ;IAC/D,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IAC5C,OAAO,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;AAC1E,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,OAAgB;IACnC,IACE,OAAO,OAAO,KAAK,QAAQ;QAC3B,OAAO,KAAK,IAAI;QAChB,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EACtB,CAAC;QACD,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,kBAAkB,CAAC;IACnD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;QAChD,OAAO,kEAAkE,CAAC;IAC5E,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC","sourcesContent":["// The server-side contract and the engine that runs it.\n//\n// This is the counterpart to core/lb-constants.ts: that file is the\n// vocabulary the browser writes, this one is the vocabulary the application\n// writes. The engine below is the whole of Loadbare on the server. It ships\n// no HTTP server, no router, and no data layer.\n\nimport type {\n  HubData,\n  HubRequest,\n  HubResponse,\n  HubResult,\n  Kind,\n  GatheredRow,\n  HubRefusal,\n  Patch,\n  RequestFields,\n  ResponseItem,\n  Row,\n} from \"../core/lb-types.js\";\nimport { isRowRequest, nextLocation, parseOrder } from \"../core/lb-types.js\";\nimport {\n  KIND_ROW,\n  KIND_ROWS,\n  LB_RESERVED_PREFIX,\n  REQUEST_ROW_DELETE,\n  REQUEST_ROW_INSERT,\n  REQUEST_ROW_UPDATE,\n  URL_COLUMN_PATH,\n  URL_QUERY,\n} from \"../core/lb-constants.js\";\n\n/**\n * Whatever the application hands the engine for the duration of one request.\n *\n * Loadbare declares it empty and never reads it. An application fills it in\n * by declaration merging, once, anywhere in its own source:\n *\n *     declare module \"@loadbare/app/server\" {\n *       interface HubContext {\n *         db: Db;\n *       }\n *     }\n *\n * That is why no type on this page takes a type parameter. The context is a\n * request-scoped handle — an authenticated database connection is the\n * expected case — so it is passed per call rather than held by the engine.\n * The page's query parms are the other expected member: a query that reads\n * one off the context takes no argument, and re-runs under `refresh` like\n * any other.\n */\nexport interface HubContext {}\n\n/**\n * A declared query: its kind, its key, and the run that answers it.\n *\n * Kind and key are properties of the name rather than of any one answer, so\n * they are declared here and never inferred from what comes back. The engine\n * sends both with every answer, so the markup repeats neither. Every query\n * has a key; an aggregate row answers with a constant one.\n *\n * Write one with `row()` or `rows()` below; nothing else builds one.\n */\nexport interface Query {\n  readonly kind: Kind;\n  readonly key: string;\n  readonly run: (ctx: HubContext) => HubResult | Promise<HubResult>;\n  /** A `rows` query's order, as `rows()` declared it. */\n  readonly order?: string;\n  /** Whether a `rows` query reads the order parm and sorts by it itself. */\n  readonly serverSortedByUrl?: boolean;\n}\n\n/**\n * What a `rows` query declares about its order.\n *\n * `order` is the order the hub places its rows by: columns separated by\n * commas, each descending when it begins with `-`, as in\n * `category_order,-opened`. The user's order, carried in the query parm\n * `lb-order-<query>`, replaces it. With neither, rows show in the order the\n * query answered them in.\n *\n * `serverSortedByUrl` says the query reads that parm and sorts by it itself,\n * which a query that pages or limits its rows must: a change of the user's\n * order then runs the query again. Without it, the hub sorts the rows it\n * already has, with no round trip.\n */\nexport interface RowsOptions {\n  order?: string;\n  serverSortedByUrl?: boolean;\n}\n\n/** A query that answers with one row, identified by its `key` column. */\nexport function row(\n  key: string,\n  run: (ctx: HubContext) => Row | Promise<Row>,\n): Query {\n  return { kind: KIND_ROW, key, run };\n}\n\n/**\n * A query that answers with all its rows. Rows land by their `key` column: a\n * row whose key is not in the answer is gone. The hub places them by the\n * order in `options`, or in the order they arrived when there is none.\n */\nexport function rows(\n  key: string,\n  run: (ctx: HubContext) => Row[] | Promise<Row[]>,\n  options: RowsOptions = {},\n): Query {\n  return {\n    kind: KIND_ROWS,\n    key,\n    run,\n    ...(options.order !== undefined && { order: options.order }),\n    ...(options.serverSortedByUrl && { serverSortedByUrl: true }),\n  };\n}\n\n/**\n * Only what changed, returned from a handler for a `rows` query. Rows named\n * here are added or updated, keys in `drop` are removed, and everything\n * unnamed is left alone — its contents, and its place in whatever order the\n * page is keeping.\n *\n * `Array.isArray` is what tells a patch from all rows, so a patch needs no\n * marker of its own and no column name is reserved to carry one.\n */\nexport function patch(change: { rows?: Row[]; drop?: unknown[] }): Patch {\n  const made = { ...change };\n  patches.add(made);\n  return made;\n}\n\n/**\n * Every object `patch()` made. A patch and a row are both plain objects, so\n * this is how the engine refuses a patch answering a `row` query.\n */\nconst patches = new WeakSet<object>();\n\n/**\n * A new row for `lb-url`, returned from a handler when only the handler can\n * know where the page belongs: the key of a row it inserted, or the absence\n * of one it deleted.\n *\n * A column other than `lb-path` is a query parm: set, or taken out when its\n * value is empty. With `lb-path` naming another page, the page is entered\n * with only the parms named here; otherwise every other parm is kept.\n *\n * The page then loads at the new URL in the same round trip, as a cold load\n * of it would, so the refresh set is not run and whatever else the handler\n * returned is dropped: both were answers for the URL the page is leaving.\n * This is Post/Redirect/Get without the redirect.\n */\nexport function url(columns: Record<string, string>): HubData {\n  return { [URL_QUERY]: { ...columns } };\n}\n\n/**\n * A handler's refusal: thrown, and answered to the browser with the words\n * it carries. Every other error a handler throws reaches the browser as a\n * failure with nothing in it.\n */\nexport class Refusal extends Error {\n  readonly refusal: HubRefusal;\n\n  constructor(refusal: HubRefusal) {\n    super(refusal.message ?? \"refused\");\n    this.name = \"Refusal\";\n    this.refusal = refusal;\n  }\n}\n\n/**\n * Refuse a request, in words written for the user. Throw what it returns:\n *\n *     throw refusal(\"That series already has paychecks entered.\");\n *     throw refusal({ amount: \"Must be more than zero\" });\n *     throw refusal(\"Two fields need attention.\", { amount: \"…\" });\n *\n * A message alone is for the request as a whole; columns name the controls\n * the request gathered, and each message is shown on its control. Thrown\n * rather than returned, so a refusal can come from anywhere the handler\n * calls, and whatever the application has open rolls back as for any\n * throw.\n */\nexport function refusal(\n  message: string | Record<string, string>,\n  columns?: Record<string, string>,\n): Refusal {\n  return typeof message === \"string\"\n    ? new Refusal({ message, ...(columns && { columns }) })\n    : new Refusal({ columns: message });\n}\n\n/** The shape of a `<stub>.queries.ts` module. */\nexport type Queries = Record<string, Query>;\n\n/**\n * What a handler does, and which queries re-run once it has.\n *\n * `run` may also return answers of its own, which are laid over the\n * refreshed ones. That is how a patch reaches the browser: a query answers\n * for all its rows and cannot know why it re-ran, but the handler knows\n * exactly what it changed and can say only that.\n */\nexport interface Handler<R = RequestFields> {\n  run: (\n    ctx: HubContext,\n    request: R,\n  ) => void | HubData | Promise<void | HubData>;\n  refresh: string[];\n}\n\n/**\n * `rows` holds the rows of the queries nested in the form the request came\n * from, by query name, each with its own values: a master's details,\n * written with it.\n */\nexport type RowInsertHandler = Handler<{\n  key?: string;\n  values: Record<string, string>;\n  rows?: Record<string, GatheredRow[]>;\n}>;\n/** `values` holds only the columns being set, as an SQL UPDATE sets them. */\nexport type RowUpdateHandler = Handler<{\n  key: string;\n  values: Record<string, string>;\n  rows?: Record<string, GatheredRow[]>;\n}>;\nexport type RowDeleteHandler = Handler<{ key: string }>;\n\n/**\n * What the requests Loadbare provides do to one query, keyed by its name in\n * `Requests.crud`. A query with no entry here permits none of them: the wire\n * cannot reach anything the page has not published.\n *\n * Every key is the request name with the prefix stripped and the rest\n * camel-cased: `lb-row-insert` runs `rowInsert`.\n */\nexport interface Crud {\n  rowInsert?: RowInsertHandler;\n  rowUpdate?: RowUpdateHandler;\n  rowDelete?: RowDeleteHandler;\n}\n\n/**\n * The shape of a `<stub>.requests.ts` module.\n *\n * `onPageEnter` runs when the page loads, before its queries. It declares no\n * refresh set: the page's queries all run afterward, so whatever it changed\n * is already in the response. It may return `url()` instead, to move the\n * page to other query parms or another page before anything shows, as an\n * application restoring what the user last had on screen does. The page\n * then loads there in the same round trip, and `onPageEnter` running for\n * that load is not followed again.\n *\n * `handlers` holds the page's declared requests, by name. A name the page\n * did not declare is refused, so the wire cannot reach anything the page has\n * not published.\n *\n * `crud` holds what the requests Loadbare provides run, by query name.\n */\nexport interface Requests {\n  onPageEnter?: (ctx: HubContext) => void | HubData | Promise<void | HubData>;\n  handlers?: Record<string, Handler>;\n  crud?: Record<string, Crud>;\n}\n\n/** A page is three files sharing a stub; two of them are these. */\nexport interface Page {\n  queries: Queries;\n  requests: Requests;\n}\n\n/**\n * The page registry. The builder writes it from every `.requests.ts` and\n * `.queries.ts` it discovers — see docs/reference/builder.md.\n */\nexport type Pages = Record<string, Page>;\n\n/**\n * How a page load treats a `url()` its `onPageEnter` returned.\n *\n * With `follow` false it is ignored and the queries run, as they must for a\n * load that is itself at a URL something else moved to. With `parms`, the\n * query parms the page is being loaded at, one that leads to the page and\n * parms already in hand is ignored the same way, so the page loads once.\n */\nexport interface PageLoadOptions {\n  follow?: boolean;\n  parms?: URLSearchParams;\n}\n\n/**\n * The engine. Both calls answer with response items. A request whose\n * handler returned `url()`, and a page load whose `onPageEnter` did, answer\n * with the `lb-url` item alone: the caller builds a context at the new URL,\n * calls `dataForPage` with it and `follow` false, and sends the load beside the\n * item. `hubRoutes` does exactly that.\n */\nexport interface Hub {\n  /** A page load: its `onPageEnter`, then all of its queries. */\n  dataForPage(\n    page: string,\n    ctx: HubContext,\n    options?: PageLoadOptions,\n  ): Promise<HubResponse>;\n\n  /** A request: run the handler its name picks, then the refresh set. */\n  runRequest(\n    page: string,\n    request: HubRequest,\n    ctx: HubContext,\n  ): Promise<HubResponse>;\n}\n\n/** The camel-cased `Crud` key of a request Loadbare provides. */\nconst CRUD_KEYS: Record<string, keyof Crud> = {\n  [REQUEST_ROW_INSERT]: \"rowInsert\",\n  [REQUEST_ROW_UPDATE]: \"rowUpdate\",\n  [REQUEST_ROW_DELETE]: \"rowDelete\",\n};\n\n/**\n * Build the engine over a set of pages. The pages are fixed at startup; the\n * context is not, and arrives with each call.\n */\nexport function createHub(pages: Pages): Hub {\n  // Names beginning with the reserved prefix are Loadbare's — its own query,\n  // the requests it provides — so an application cannot declare one.\n  // Refused at startup, because a name is a fact about the page and not\n  // about any request.\n  for (const [page, entry] of Object.entries(pages)) {\n    const declared = [\n      ...Object.keys(entry.queries),\n      ...Object.keys(entry.requests.handlers ?? {}),\n      ...Object.keys(entry.requests.crud ?? {}),\n    ];\n    for (const name of declared) {\n      if (name.startsWith(LB_RESERVED_PREFIX)) {\n        throw new Error(\n          `loadbare: page '${page}' declares '${name}', but names ` +\n            `beginning with '${LB_RESERVED_PREFIX}' are reserved`,\n        );\n      }\n    }\n\n    // An update or a delete names its row by key, so its handler always\n    // knows which rows changed and can answer with a patch, and the hub\n    // places what the patch names by the query's order. Refreshing the whole\n    // set instead sends every row to say one thing. There is no case where\n    // that is the answer to either, so it is refused rather than warned\n    // about. An insert is not: its key exists only once the row does, and a\n    // handler may leave the query to say so.\n    // An order is a fact about the query, so a malformed one is refused at\n    // startup, as a reserved name is.\n    for (const [name, query] of Object.entries(entry.queries)) {\n      if (query.order === undefined) continue;\n      try {\n        parseOrder(query.order);\n      } catch (err) {\n        throw new Error(\n          `loadbare: page '${page}' query '${name}': ${(err as Error).message}`,\n        );\n      }\n    }\n\n    for (const [name, crud] of Object.entries(entry.requests.crud ?? {})) {\n      if (entry.queries[name]?.kind !== KIND_ROWS) continue;\n      for (const request of [\"rowUpdate\", \"rowDelete\"] as const) {\n        if (crud[request]?.refresh.includes(name)) {\n          throw new Error(\n            `loadbare: page '${page}' refreshes '${name}' after its own ` +\n              `${request}; return the changed rows in a patch instead`,\n          );\n        }\n      }\n    }\n  }\n\n  /**\n   * Answers into response items, adding the kind and key each query\n   * declared. An answer that disagrees with its declaration is a mistake in\n   * the application rather than a case to handle, and is left out: a page is\n   * better off missing one query than showing the wrong shape for it.\n   */\n  function items(page: string, data: HubData): HubResponse {\n    const out: ResponseItem[] = [];\n    for (const [name, result] of Object.entries(data)) {\n      const query = pages[page]?.queries[name];\n      if (!query) {\n        console.warn(`loadbare: page '${page}' declares no query '${name}'`);\n        continue;\n      }\n      const item: ResponseItem = {\n        query: name,\n        kind: query.kind,\n        key: query.key,\n      };\n      if (query.kind === KIND_ROW) {\n        if (Array.isArray(result) || patches.has(result)) {\n          console.warn(\n            `loadbare: query '${name}' is declared row but answered with ` +\n              `${Array.isArray(result) ? \"rows\" : \"a patch\"}`,\n          );\n          continue;\n        }\n        item.row = result as Row;\n      } else {\n        if (Array.isArray(result)) item.rows = result;\n        else item.patch = result as Patch;\n        if (query.order !== undefined) item.order = query.order;\n        if (query.serverSortedByUrl) item.serverSortedByUrl = true;\n      }\n      out.push(item);\n    }\n    return out;\n  }\n\n  /** Run queries by name, each answering with all its rows or its row. */\n  async function run(\n    page: string,\n    names: string[],\n    ctx: HubContext,\n  ): Promise<HubData> {\n    const data: HubData = {};\n    for (const name of names) {\n      const query = pages[page]?.queries[name];\n      if (!query) {\n        console.warn(`loadbare: page '${page}' declares no query '${name}'`);\n        continue;\n      }\n      const result = await query.run(ctx);\n      if (Array.isArray(result) !== (query.kind === KIND_ROWS)) {\n        console.warn(\n          `loadbare: query '${name}' is declared ${query.kind} but answered ` +\n            `with ${Array.isArray(result) ? \"rows\" : \"one row\"}`,\n        );\n        continue;\n      }\n      data[name] = result;\n    }\n    return data;\n  }\n\n  /**\n   * Run a handler, then its refresh set against the same context, laying\n   * what the handler itself returned over the refreshed queries — the\n   * narrower answer wins because it knows what actually changed.\n   *\n   * A handler that returned `url()` answers with the `lb-url` item alone.\n   * Loading the page there needs a context built at the new URL, and\n   * building one is the caller's.\n   */\n  async function settle(\n    page: string,\n    handler: Handler<never> | undefined,\n    request: RequestFields,\n    ctx: HubContext,\n    notFound: string,\n  ): Promise<HubResponse> {\n    if (!handler) {\n      console.warn(notFound);\n      return [];\n    }\n    const { [URL_QUERY]: moved, ...stated } =\n      (await handler.run(ctx, request as never)) ?? {};\n    const item = urlItem(page, moved);\n    if (item) return [item];\n    return items(page, {\n      ...(await run(page, handler.refresh, ctx)),\n      ...stated,\n    });\n  }\n\n  /**\n   * An update or a delete for several rows: the page's `crud` entry runs once\n   * per key, as it would for each row alone, so an application writes\n   * nothing more to allow it. What each run returns is laid together, a\n   * patch onto a patch, and the refresh set runs once.\n   *\n   * A run that returns `url()` is reported and its row ignored: a URL names\n   * one view, and several rows cannot each choose it.\n   */\n  async function eachKey(\n    page: string,\n    name: string,\n    fields: RequestFields,\n    ctx: HubContext,\n  ): Promise<HubResponse> {\n    const { keys, ...one } = fields;\n    const query = fields.query ?? \"\";\n    const handler = pages[page]?.requests.crud?.[query]?.[CRUD_KEYS[name]!] as\n      | Handler<never>\n      | undefined;\n    if (!handler) {\n      console.warn(\n        `loadbare: page '${page}' declares no ${CRUD_KEYS[name]} for '${query}'`,\n      );\n      return [];\n    }\n    if (!Array.isArray(keys) || keys.some((key) => typeof key !== \"string\")) {\n      console.warn(`loadbare: '${name}' carries keys that are not strings`);\n      return [];\n    }\n    let stated: HubData = {};\n    for (const key of keys) {\n      const { [URL_QUERY]: moved, ...answer } =\n        (await handler.run(ctx, { ...one, key } as never)) ?? {};\n      if (moved !== undefined) {\n        console.warn(\n          `loadbare: ${CRUD_KEYS[name]} for '${query}' returned url() for ` +\n            `one of several rows, ignoring it`,\n        );\n      }\n      stated = layered(stated, answer);\n    }\n    return items(page, {\n      ...(await run(page, handler.refresh, ctx)),\n      ...stated,\n    });\n  }\n\n  return {\n    async dataForPage(page, ctx, { follow = true, parms } = {}) {\n      const entry = pages[page];\n      if (!entry) {\n        console.warn(`loadbare: no page '${page}'`);\n        return [];\n      }\n      const { [URL_QUERY]: moved, ...stated } =\n        (await entry.requests.onPageEnter?.(ctx)) ?? {};\n      if (Object.keys(stated).length > 0) {\n        console.warn(\n          `loadbare: page '${page}' onPageEnter returned answers; it returns ` +\n            `url() or nothing, ignoring them`,\n        );\n      }\n      const item = follow ? urlItem(page, moved) : undefined;\n      if (item && !(parms && leadsHere(page, parms, item.row!))) return [item];\n      return items(page, await run(page, Object.keys(entry.queries), ctx));\n    },\n\n    runRequest(page, request, ctx) {\n      const { name, ...fields } = request;\n      if (fields.rows !== undefined && !wellFormedRows(fields.rows)) {\n        console.warn(\n          `loadbare: '${name}' carries rows that are not keys and string ` +\n            `values by query, ignoring it`,\n        );\n        return Promise.resolve([]);\n      }\n      if (\n        fields.keys !== undefined &&\n        (name === REQUEST_ROW_UPDATE || name === REQUEST_ROW_DELETE)\n      ) {\n        return eachKey(page, name, fields, ctx);\n      }\n      if (isRowRequest(name)) {\n        const query = fields.query ?? \"\";\n        return settle(\n          page,\n          pages[page]?.requests.crud?.[query]?.[CRUD_KEYS[name]!] as\n            Handler<never> | undefined,\n          fields,\n          ctx,\n          `loadbare: page '${page}' declares no ${CRUD_KEYS[name]} for '${query}'`,\n        );\n      }\n      return settle(\n        page,\n        pages[page]?.requests.handlers?.[name] as Handler<never> | undefined,\n        fields,\n        ctx,\n        `loadbare: page '${page}' declares no request '${name}'`,\n      );\n    },\n  };\n}\n\n/** Gathered rows as the hub sends them: string keys and string values. */\nfunction wellFormedRows(rows: unknown): boolean {\n  if (typeof rows !== \"object\" || rows === null || Array.isArray(rows)) {\n    return false;\n  }\n  return Object.values(rows).every(\n    (set) =>\n      Array.isArray(set) &&\n      set.every(\n        (row) =>\n          typeof row === \"object\" &&\n          row !== null &&\n          typeof row.key === \"string\" &&\n          typeof row.values === \"object\" &&\n          row.values !== null &&\n          Object.values(row.values).every((v) => typeof v === \"string\"),\n      ),\n  );\n}\n\n/**\n * Two answers as one: a patch laid onto a patch for the same query keeps\n * what both name, and any other answer replaces the one before it.\n */\nfunction layered(before: HubData, after: HubData): HubData {\n  const out: HubData = { ...before };\n  for (const [name, answer] of Object.entries(after)) {\n    const was = out[name];\n    if (was && patches.has(was) && patches.has(answer)) {\n      const a = was as Patch;\n      const b = answer as Patch;\n      out[name] = patch({\n        rows: [...(a.rows ?? []), ...(b.rows ?? [])],\n        drop: [...(a.drop ?? []), ...(b.drop ?? [])],\n      });\n    } else {\n      out[name] = answer;\n    }\n  }\n  return out;\n}\n\n/**\n * The `lb-url` item for a row a handler or `onPageEnter` returned, or\n * nothing when it returned none or one that cannot be used. Whatever\n * returned it has already run, so a row that cannot be used is reported and\n * the call goes on as if none had been returned.\n */\nfunction urlItem(page: string, moved: unknown): ResponseItem | undefined {\n  if (moved === undefined) return undefined;\n  const refused = unusableUrl(moved);\n  if (refused === undefined) {\n    return {\n      query: URL_QUERY,\n      kind: KIND_ROW,\n      key: URL_COLUMN_PATH,\n      row: moved as Row,\n    };\n  }\n  console.warn(\n    `loadbare: page '${page}' returned ${URL_QUERY} ${refused}, ignoring it`,\n  );\n  return undefined;\n}\n\n/** Whether a row for `lb-url` leads to the page and parms already in hand. */\nfunction leadsHere(page: string, parms: URLSearchParams, row: Row): boolean {\n  const next = nextLocation(page, parms, row);\n  return next.page === page && next.parms.toString() === parms.toString();\n}\n\n/**\n * Why a returned row for `lb-url` cannot be used, or nothing when it can.\n *\n * A value is a string, as a control's is and a URL's is. At least one column\n * is named: a row naming none changes nothing.\n */\nfunction unusableUrl(columns: unknown): string | undefined {\n  if (\n    typeof columns !== \"object\" ||\n    columns === null ||\n    Array.isArray(columns)\n  ) {\n    return \"that is not a row\";\n  }\n  const values = Object.values(columns);\n  if (values.length === 0) return \"naming no column\";\n  if (!values.every((v) => typeof v === \"string\")) {\n    return `holding a value that is not a string; write url({ name: \"...\" })`;\n  }\n  return undefined;\n}\n"]}