@ultimabase/rest 0.0.0-stage → 0.1.1

package/dist/streams.d.ts

@@ -0,0 +1,73 @@
+import type { LiveHandle, LiveMessage, RealtimeApi, Viewer } from '@ultimabase/realtime';
+import type { Logger } from 'ultimabase';
+import type { Shape } from './fields.ts';
+import type { Events } from './sse.ts';
+/**
+ * The realtime engine, what ends each open stream, the kept lists, and what
+ * keeps each open list as if its client left, by token.
+ */
+export type Live = {
+    readonly realtime: RealtimeApi;
+    readonly streams: Set<() => void>;
+    readonly kept: Map<string, Kept>;
+    readonly open: Map<string, () => void>;
+    readonly logger: Logger;
+};
+/** Where a live read writes: an open stream of events, its response aside. */
+export type Sink = Omit<Events, 'response'>;
+type Changed = Exclude<LiveMessage, {
+    readonly kind: 'closed' | 'row' | 'value';
+}>;
+/** What a live list's messages write. */
+export type Write = (message: Changed) => void;
+/** A live read to open, given the viewer and what takes its messages. */
+export type Open = (viewer: Viewer, send: (message: LiveMessage) => void) => Promise<LiveHandle>;
+/** A live list: what writes it, what read it is, its rows, and its token. */
+export type Listed = {
+    readonly write: (sink: Sink) => Write;
+    readonly signature: string;
+    readonly first: number;
+    readonly resume: string | undefined;
+};
+/** A sink that writes to its stream, or holds what it is sent while none. */
+type Relay = Sink & {
+    readonly to: (sink: Sink) => void;
+    /** Holds what it is sent from now on; `ended` runs if it ends. */
+    readonly park: (ended: () => void) => void;
+};
+type Stream = {
+    readonly viewer: Viewer;
+    readonly relay: Relay;
+    readonly keep: Keep | undefined;
+    readonly signature: string;
+    handle?: LiveHandle;
+    /** Whether its client left before its first read. */
+    ended: boolean;
+};
+type Keep = {
+    readonly token: string;
+    first: number;
+};
+/** A list whose client left, until a resume takes it or its time is up. */
+export type Kept = {
+    readonly stream: Stream;
+    readonly handle: LiveHandle;
+    readonly keep: Keep;
+    /** Takes it out, still open. */
+    readonly take: () => void;
+    readonly discard: () => void;
+};
+/**
+ * Follows the read `open` starts into `sink`; a list's changes go through
+ * `list`. Changes are dropped while the client's buffer is full, until the
+ * engine sends the window again. A closing error is sent as it comes: its
+ * read made it public.
+ */
+export declare function follow(sink: Sink, viewer: Viewer, shape: Shape, open: Open, list?: (sink: Sink) => Write): Promise<LiveHandle>;
+/**
+ * `request`'s stream of the read `open` starts, closed with the client; a
+ * list resumes the one its token keeps when it may.
+ */
+export declare function streamed(live: Live, request: Request, shape: Shape, open: Open, list?: Listed): Promise<Response>;
+export {};
+//# sourceMappingURL=streams.d.ts.map

package/dist/streams.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"streams.d.ts","sourceRoot":"","sources":["../src/streams.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACX,UAAU,EACV,WAAW,EACX,WAAW,EACX,MAAM,EACN,MAAM,sBAAsB,CAAA;AAC7B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAA;AACxC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AAExC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,UAAU,CAAA;AAGtC;;;GAGG;AACH,MAAM,MAAM,IAAI,GAAG;IAClB,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAA;IAC9B,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,CAAA;IACjC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAChC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,CAAA;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACvB,CAAA;AAED,8EAA8E;AAC9E,MAAM,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;AAE3C,KAAK,OAAO,GAAG,OAAO,CACrB,WAAW,EACX;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,KAAK,GAAG,OAAO,CAAA;CAAE,CAC7C,CAAA;AACD,yCAAyC;AACzC,MAAM,MAAM,KAAK,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,CAAA;AAE9C,yEAAyE;AACzE,MAAM,MAAM,IAAI,GAAG,CAClB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,CAAC,OAAO,EAAE,WAAW,KAAK,IAAI,KAChC,OAAO,CAAC,UAAU,CAAC,CAAA;AAExB,6EAA6E;AAC7E,MAAM,MAAM,MAAM,GAAG;IACpB,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,KAAK,CAAA;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;CACnC,CAAA;AAED,6EAA6E;AAC7E,KAAK,KAAK,GAAG,IAAI,GAAG;IACnB,QAAQ,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,IAAI,CAAA;IACjC,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,IAAI,KAAK,IAAI,CAAA;CAC1C,CAAA;AAED,KAAK,MAAM,GAAG;IACb,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,IAAI,GAAG,SAAS,CAAA;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,qDAAqD;IACrD,KAAK,EAAE,OAAO,CAAA;CACd,CAAA;AAED,KAAK,IAAI,GAAG;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AAErD,2EAA2E;AAC3E,MAAM,MAAM,IAAI,GAAG;IAClB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;IAC3B,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;IACnB,gCAAgC;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,IAAI,CAAA;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAA;CAC5B,CAAA;AAmCD;;;;;GAKG;AACH,wBAAsB,MAAM,CAC3B,IAAI,EAAE,IAAI,EACV,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,KAAK,EACZ,IAAI,EAAE,IAAI,EACV,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,KAAK,GAC1B,OAAO,CAAC,UAAU,CAAC,CAqCrB;AAmGD;;;GAGG;AACH,wBAAsB,QAAQ,CAC7B,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,KAAK,EACZ,IAAI,EAAE,IAAI,EACV,IAAI,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,QAAQ,CAAC,CAyBnB"}

package/dist/streams.js

@@ -0,0 +1,218 @@
+// An open live read over Server-Sent Events (D-154), ended with its client,
+// its caller or the application. A live list whose client left is kept 10 s,
+// what it sends held, so that the same user's request with its token takes
+// it back, grown, even before the server saw it leave. A live list's first
+// event is its token.
+import { randomUUID } from 'node:crypto';
+import { run } from '@ultimabase/http/internal';
+import { shaped } from './fields.js';
+import { eventsTo } from './sse.js';
+/** How long a list whose client left waits for a resume. */
+const keptFor = 10_000;
+const nothing = () => undefined;
+function relayOf() {
+    let current;
+    let ended = nothing;
+    const held = [];
+    return {
+        send: (event, data, id) => {
+            if (current === undefined)
+                held.push([event, data, id]);
+            else
+                current.send(event, data, id);
+        },
+        full: () => current?.full() ?? false,
+        drained: (then) => {
+            if (current === undefined)
+                then();
+            else
+                current.drained(then);
+        },
+        end: () => {
+            if (current === undefined)
+                ended();
+            else
+                current.end();
+        },
+        to: (sink) => {
+            current = sink;
+            for (const [event, data, id] of held.splice(0))
+                sink.send(event, data, id);
+        },
+        park: (then) => {
+            current = undefined;
+            ended = then;
+        },
+    };
+}
+/**
+ * Follows the read `open` starts into `sink`; a list's changes go through
+ * `list`. Changes are dropped while the client's buffer is full, until the
+ * engine sends the window again. A closing error is sent as it comes: its
+ * read made it public.
+ */
+export async function follow(sink, viewer, shape, open, list) {
+    const writes = list?.(sink);
+    let handle;
+    let dropping = false;
+    let owed = false;
+    const send = (message) => {
+        if (message.kind === 'closed') {
+            if (message.error !== undefined)
+                sink.send('error', message.error);
+            // A viewer closes when its caller changed: the client reconnects.
+            else if (!viewer.closed) {
+                sink.send('error', {
+                    code: 'INTERNAL',
+                    message: 'The live read closed.',
+                });
+            }
+            return sink.end();
+        }
+        if (dropping && message.kind === 'changes')
+            return;
+        if (!dropping && sink.full()) {
+            dropping = true;
+            sink.drained(() => {
+                if (handle === undefined)
+                    owed = true;
+                else
+                    void handle.resend();
+            });
+            return;
+        }
+        dropping = false;
+        if (message.kind === 'value') {
+            return sink.send('data', message.value, message.revision);
+        }
+        if (message.kind !== 'row')
+            return writes?.(message);
+        const { row, revision } = message;
+        sink.send('data', row && shaped(row, shape), revision);
+    };
+    handle = await open(viewer, send);
+    if (owed)
+        void handle.resend();
+    return handle;
+}
+/** Keeps `stream`'s list once its client left, until a resume takes it. */
+function park(live, stream, handle, keep) {
+    const take = () => {
+        clearTimeout(timer);
+        live.kept.delete(keep.token);
+        live.streams.delete(discard);
+    };
+    const discard = () => {
+        take();
+        handle.close();
+        stream.viewer.close();
+    };
+    const timer = setTimeout(discard, keptFor);
+    timer.unref();
+    stream.relay.park(discard);
+    live.streams.add(discard);
+    live.kept.set(keep.token, { stream, handle, keep, take, discard });
+}
+/**
+ * `request`'s stream of events, which `stream` writes to from now on; the
+ * list is kept once the client leaves, unless the stream was ended.
+ */
+function eventsFor(live, request, stream) {
+    let over = false;
+    let left = false;
+    const leave = () => {
+        if (left)
+            return;
+        left = true;
+        live.streams.delete(finish);
+        const { viewer, handle, keep } = stream;
+        if (keep !== undefined)
+            live.open.delete(keep.token);
+        if (over || handle === undefined || keep === undefined || viewer.closed) {
+            stream.ended = true;
+            handle?.close();
+            return viewer.close();
+        }
+        park(live, stream, handle, keep);
+    };
+    const events = eventsTo(request, leave);
+    const finish = () => {
+        over = true;
+        events.end();
+    };
+    live.streams.add(finish);
+    if (stream.keep !== undefined) {
+        // A resume may come before the server sees this client leave.
+        live.open.set(stream.keep.token, () => {
+            leave();
+            events.end();
+        });
+        // First, before what a kept list held.
+        events.send('resume', stream.keep.token);
+    }
+    stream.relay.to({ ...events, end: finish });
+    return { response: events.response, finish };
+}
+/** The list `list.resume` keeps, as the same read of the same user, grown. */
+async function resumed(live, request, list) {
+    const token = list.resume ?? '';
+    live.open.get(token)?.();
+    const kept = live.kept.get(token);
+    if (kept === undefined)
+        return undefined;
+    const { stream, handle, keep } = kept;
+    if (stream.signature !== list.signature || list.first < keep.first) {
+        return undefined;
+    }
+    // Out first, so that neither its time nor another request takes it.
+    kept.take();
+    // The kept read follows this request's caller; another user ends it.
+    if (!(await stream.viewer.adopt(request))) {
+        kept.discard();
+        return undefined;
+    }
+    const { response, finish } = eventsFor(live, request, stream);
+    try {
+        if (list.first > keep.first) {
+            await run(async () => handle.grow(list.first - keep.first));
+        }
+    }
+    catch (error) {
+        finish();
+        stream.viewer.close();
+        throw error;
+    }
+    keep.first = list.first;
+    return response;
+}
+/**
+ * `request`'s stream of the read `open` starts, closed with the client; a
+ * list resumes the one its token keeps when it may.
+ */
+export async function streamed(live, request, shape, open, list) {
+    if (list?.resume !== undefined) {
+        const taken = await resumed(live, request, list);
+        if (taken !== undefined)
+            return taken;
+    }
+    const viewer = await live.realtime.connect(request);
+    const stream = {
+        viewer,
+        relay: relayOf(),
+        keep: list && { token: randomUUID(), first: list.first },
+        signature: list?.signature ?? '',
+        ended: false,
+    };
+    const { response, finish } = eventsFor(live, request, stream);
+    try {
+        stream.handle = await run(async () => follow(stream.relay, viewer, shape, open, list?.write));
+    }
+    catch (error) {
+        finish();
+        viewer.close();
+        throw error;
+    }
+    if (stream.ended)
+        stream.handle.close();
+    return response;
+}

package/dist/values.d.ts

@@ -0,0 +1,7 @@
+import type { Api, Args } from './entries.ts';
+export declare const isArgs: (value: unknown) => value is Args;
+/** A filter with its dates read, through `AND`, `OR`, `NOT` and relations. */
+export declare function whereOf(api: Api, model: string, where: Args, path: string): Args;
+/** Data with its dates read, in the rows its relation writes reach too. */
+export declare function dataOf(api: Api, model: string, data: Args, path: string): Args;
+//# sourceMappingURL=values.d.ts.map

package/dist/values.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"values.d.ts","sourceRoot":"","sources":["../src/values.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,cAAc,CAAA;AAM7C,eAAO,MAAM,MAAM,UAAW,OAAO,KAAG,KAAK,IAAI,IACoB,CAAA;AA4CrE,8EAA8E;AAC9E,wBAAgB,OAAO,CACtB,GAAG,EAAE,GAAG,EACR,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,IAAI,EACX,IAAI,EAAE,MAAM,GACV,IAAI,CAuBN;AAsDD,2EAA2E;AAC3E,wBAAgB,MAAM,CACrB,GAAG,EAAE,GAAG,EACR,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,IAAI,EACV,IAAI,EAAE,MAAM,GACV,IAAI,CAkBN"}

package/dist/values.js

@@ -0,0 +1,123 @@
+import { InvalidQuery } from 'ultimabase';
+import { entryOf } from './entries.js';
+const iso = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(?::\d{2}(?:\.\d+)?)?(?:Z|[+-]\d{2}:\d{2})$/;
+export const isArgs = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
+/** A string as a `Date`; any other value left for the kernel to check. */
+function date(value, path) {
+    if (typeof value !== 'string')
+        return value;
+    const parsed = iso.test(value) ? new Date(value) : undefined;
+    if (parsed !== undefined && !Number.isNaN(parsed.getTime()))
+        return parsed;
+    throw new InvalidQuery(path, `${path} must be an ISO 8601 DateTime, such as 2026-01-31T12:00:00.000Z.`);
+}
+const isDate = (field, key) => key === 'createdAt' ||
+    key === 'updatedAt' ||
+    (field?.kind === 'scalar' && field.type === 'dateTime');
+/** A date field's filter: a value, or operators whose values are dates. */
+function dateFilter(value, path) {
+    if (!isArgs(value))
+        return date(value, path);
+    const filter = {};
+    for (const [operator, operand] of Object.entries(value)) {
+        const at = `${path}.${operator}`;
+        filter[operator] = Array.isArray(operand)
+            ? operand.map((item, index) => date(item, `${at}.${index}`))
+            : date(operand, at);
+    }
+    return filter;
+}
+const each = (value, path, map) => Array.isArray(value)
+    ? value.map((item, index) => isArgs(item) ? map(item, `${path}.${index}`) : item)
+    : isArgs(value)
+        ? map(value, path)
+        : value;
+/** A filter with its dates read, through `AND`, `OR`, `NOT` and relations. */
+export function whereOf(api, model, where, path) {
+    const fields = entryOf(api, model).model.fields;
+    const read = {};
+    for (const [key, value] of Object.entries(where)) {
+        const at = `${path}.${key}`;
+        const field = fields.find((candidate) => candidate.name === key);
+        if (key === 'AND' || key === 'OR' || key === 'NOT') {
+            read[key] = each(value, at, (inner, to) => whereOf(api, model, inner, to));
+        }
+        else if (isDate(field, key))
+            read[key] = dateFilter(value, at);
+        else if (field !== undefined && field.kind !== 'scalar' && isArgs(value)) {
+            // `is`, `some` and the others each take the target's filter.
+            const { target } = field;
+            read[key] = Object.fromEntries(Object.entries(value).map(([operator, inner]) => [
+                operator,
+                isArgs(inner)
+                    ? whereOf(api, target, inner, `${at}.${operator}`)
+                    : inner,
+            ]));
+        }
+        else
+            read[key] = value;
+    }
+    return read;
+}
+/** `item` with its `key` read, when it is an object. */
+function within(item, key, path, read) {
+    const value = item[key];
+    return isArgs(value)
+        ? { ...item, [key]: read(value, `${path}.${key}`) }
+        : item;
+}
+// The operations that create, update or delete a target's row (D-138).
+const reaching = new Set(['connectOrCreate', 'create', 'delete', 'update']);
+/**
+ * A relation write with the dates of its rows and unique targets read
+ * (D-128, D-138). A hidden model is connected, disconnected or set, never
+ * created, updated or deleted, as over GraphQL.
+ */
+function relationOf(api, model, field, value, path) {
+    const { target } = field;
+    const hidden = !entryOf(api, target).visible;
+    const row = (item, at) => dataOf(api, target, item, at);
+    const unique = (item, at) => whereOf(api, target, item, at);
+    const read = { ...value };
+    for (const [key, operand] of Object.entries(value)) {
+        const at = `${path}.${key}`;
+        if (hidden && reaching.has(key)) {
+            throw new InvalidQuery(at, `Unknown key '${at}' on ${model}.`);
+        }
+        if (key === 'create')
+            read[key] = each(operand, at, row);
+        else if (key === 'connectOrCreate') {
+            read[key] = each(operand, at, (item, to) => within(within(item, 'where', to, unique), 'create', to, row));
+        }
+        else if (key === 'update' && field.kind === 'many') {
+            read[key] = each(operand, at, (item, to) => within(within(item, 'where', to, unique), 'data', to, row));
+        }
+        else if (key === 'update')
+            read[key] = each(operand, at, row);
+        else if (key === 'delete' && field.kind === 'many') {
+            read[key] = each(operand, at, unique);
+        }
+    }
+    return read;
+}
+/** Data with its dates read, in the rows its relation writes reach too. */
+export function dataOf(api, model, data, path) {
+    const read = { ...data };
+    for (const field of entryOf(api, model).model.fields) {
+        const value = data[field.name];
+        const at = `${path}.${field.name}`;
+        if (field.kind === 'scalar') {
+            if (field.type === 'dateTime' && value !== undefined) {
+                read[field.name] = date(value, at);
+            }
+            // Number updates are the server API's only (D-132).
+            if (field.type === 'number' && isArgs(value)) {
+                throw new InvalidQuery(at, `${at} must be a number.`);
+            }
+        }
+        else if (isArgs(value)) {
+            read[field.name] = relationOf(api, model, field, value, at);
+        }
+    }
+    return read;
+}

package/package.json

@@ -1,6 +1,50 @@
 {
   "name": "@ultimabase/rest",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.1",
+  "description": "REST for UltimaBase: GraphQL's arguments and responses over resource routes, served by the HTTP plugin.",
+  "type": "module",
+  "license": "Apache-2.0",
+  "homepage": "https://ultimabase.dev/docs/rest",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/MrEkinox/ultimabase.git",
+    "directory": "packages/rest"
+  },
+  "engines": {
+    "node": ">=24.7.0"
+  },
+  "exports": {
+    ".": "./dist/index.js"
+  },
+  "files": [
+    "dist",
+    "src",
+    "!src/**/*.test.ts",
+    "!src/test"
+  ],
+  "scripts": {
+    "prepack": "rm -rf dist && yarn run -T tsc --project tsconfig.build.json"
+  },
+  "publishConfig": {
+    "exports": {
+      ".": "./dist/index.js"
+    }
+  },
+  "peerDependencies": {
+    "@ultimabase/http": "^0.1.1",
+    "@ultimabase/realtime": "^0.1.1",
+    "ultimabase": "^0.1.1"
+  },
+  "devDependencies": {
+    "@seriousme/openapi-schema-validator": "2.11.0",
+    "@types/pg": "8.23.1",
+    "@ultimabase/http": "0.1.1",
+    "@ultimabase/postgres": "0.1.1",
+    "@ultimabase/realtime": "0.1.1",
+    "ajv": "8.20.0",
+    "pg": "8.23.1",
+    "ultimabase": "0.1.1",
+    "vite": "8.3.4",
+    "vitest": "5.0.5"
+  }
 }

package/src/entries.ts

@@ -0,0 +1,82 @@
+// The models REST serves (D-129): each model's plural and limits, named and
+// bounded as GraphQL names and bounds them (D-107).
+import { plural } from '@ultimabase/http/internal'
+import type { ExposedModel, SchemaModel } from 'ultimabase'
+import { Refused } from 'ultimabase'
+
+/** A model's key of `.with` (D-129). */
+export type RestWith =
+	{ readonly plural?: string; readonly maxTake?: number } | false
+
+export type Args = { readonly [key: string]: unknown }
+
+export type Entry = {
+	readonly exposed: ExposedModel<RestWith>
+	readonly model: SchemaModel
+	/** Routed; a hidden model is read and connected through relations only. */
+	readonly visible: boolean
+	readonly plural: string
+	/** The rows a list returns without `first`, `last` or `take`. */
+	readonly take: number
+	readonly maxTake: number
+}
+
+/** What every route reads: the models and the plugin's settings. */
+export type Api = {
+	readonly entries: ReadonlyMap<string, Entry>
+	readonly pagination: 'connection' | 'list'
+	readonly take: number
+	readonly maxDepth: number
+	readonly maxRows: number
+}
+
+export function entryOf(api: Api, model: string): Entry {
+	const entry = api.entries.get(model)
+	if (entry === undefined) throw new Error(`Unknown model ${model}.`)
+	return entry
+}
+
+/** Stops startup on a route name GraphQL would refuse as a field name. */
+export function checkName(name: string, where: string): string {
+	if (/^[_A-Za-z][_0-9A-Za-z]*$/.test(name) && !name.startsWith('__')) {
+		return name
+	}
+	throw new Refused(`${where}: ${name} is not a route name.`)
+}
+
+/** `id`, `createdAt` and `updatedAt`, which every model has (D-22). */
+export const system: readonly string[] = ['id', 'createdAt', 'updatedAt']
+
+/** Each model's entry; two routed models of one plural stop startup. */
+export function entriesOf(
+	models: readonly ExposedModel<RestWith>[],
+	options: { readonly take?: number; readonly maxTake?: number },
+): ReadonlyMap<string, Entry> {
+	const take = options.take ?? 100
+	const entries = new Map<string, Entry>()
+	const owners = new Map<string, string>()
+	for (const exposed of models) {
+		const name = exposed.schema.name
+		const own = exposed.with === false ? {} : (exposed.with ?? {})
+		const given =
+			own.plural ?? plural(name.charAt(0).toLowerCase() + name.slice(1))
+		const entry = {
+			exposed,
+			model: exposed.schema,
+			visible: exposed.with !== false,
+			plural: checkName(given, name),
+			take,
+			maxTake: own.maxTake ?? options.maxTake ?? 100,
+		}
+		entries.set(name, entry)
+		if (!entry.visible) continue
+		const other = given === 'functions' ? 'the functions' : owners.get(given)
+		if (other !== undefined) {
+			throw new Refused(
+				`${name}: the route ${given} is ${other}'s; set .with({ rest: { plural } }).`,
+			)
+		}
+		owners.set(given, name)
+	}
+	return entries
+}