primitive-admin 1.1.0-alpha.9 → 1.1.0

package/dist/src/lib/token-inject.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-inject.js","sourceRoot":"","sources":["../../../src/lib/token-inject.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,YAAY,EAAe,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,sFAAsF;AACtF,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,CAAC;AAKxC,oEAAoE;AACpE,MAAM,cAAc,GAAG,KAAK,CAAC;AAC7B,mEAAmE;AACnE,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAE9B;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,KAAa;IAC3C,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC3D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,OAAO,mCAAmC,sBAAsB,CAAC,KAAK,CAAC,IAAI,CAAC;AAC9E,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,gBAAgB,CAAC,IAAe,EAAE,KAAa;IAC7D,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,SAAS;YACZ,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;QAC7B,KAAK,OAAO;YACV,OAAO,KAAK,CAAC;QACf,KAAK,KAAK;YACR,OAAO,4BAA4B,KAAK,EAAE,CAAC;QAC7C;YACE,MAAM,IAAI,KAAK,CACb,yBAAyB,IAAI,yCAAyC,CACvE,CAAC;IACN,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,oBAAoB;IAClC,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,sCAAsC;AACtC,SAAS,UAAU;IACjB,eAAe;IACf,MAAM,IAAI,GAAG,KAAK,GAAG,cAAc,CAAC;IACpC,OAAO,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,MAAM,UAAU,GACd,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAC3B,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QAC/B,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO;YAC5B,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;YAC7B,CAAC,CAAC;gBACE,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,YAAY,EAAE,WAAW,CAAC,EAAE;gBACnD,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,aAAa,EAAE,SAAS,CAAC,EAAE;gBACjD,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE;aAC7B,CAAC;IAEV,KAAK,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,UAAU,EAAE,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAClD,IAAI,GAAG,CAAC,KAAK;gBAAE,SAAS,CAAC,+BAA+B;YACxD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,qBAAqB;QACvB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAeD;;;;;;;;;;GAUG;AACH,SAAS,WAAW,CAAC,SAA6B;IAChD,OAAO;QACL,6BAA6B,EAAE,SAAS,IAAI,GAAG;QAC/C,8BAA8B,EAAE,cAAc;QAC9C,8BAA8B,EAAE,GAAG;QACnC,IAAI,EAAE,QAAQ;KACf,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAa,EACb,OAA0B,EAAE;IAE5B,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAC;IACtC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,QAAQ,CAAC;IAEnC,IAAI,WAAwB,CAAC;IAC7B,MAAM,IAAI,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QACzC,WAAW,GAAG,OAAO,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,IAAI,MAAM,GAAG,KAAK,CAAC;IAEnB,MAAM,MAAM,GAAW,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC/C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAE7C,4EAA4E;QAC5E,2EAA2E;QAC3E,yEAAyE;QACzE,mBAAmB;QACnB,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACzB,GAAG,CAAC,GAAG,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QAED,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC7B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;YAC9D,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QACD,yEAAyE;QACzE,kEAAkE;QAClE,IAAI,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,MAAM,EAAE,CAAC;YAC9C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;YAC9D,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QACD,IAAI,MAAM,EAAE,CAAC;YACX,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;YAC9D,GAAG,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;YAChC,OAAO;QACT,CAAC;QACD,qEAAqE;QACrE,wDAAwD;QACxD,MAAM,GAAG,IAAI,CAAC;QACd,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QAC9D,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACf,yEAAyE;QACzE,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;YACpB,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC;IAE3C,MAAM,GAAG,GAAG,oBAAoB,IAAI,GAAG,IAAI,QAAQ,MAAM,EAAE,CAAC;IAC5D,MAAM,IAAI,GAAG,GAAG,EAAE;QAChB,IAAI,CAAC;YACH,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;IACH,CAAC,CAAC;IAEF,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC3C,CAAC;AAED,iFAAiF;AACjF,SAAS,eAAe,CAAC,MAAc;IACrC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,QAAQ,GAAG,CAAC,CAAC;QAEjB,MAAM,SAAS,GAAG,GAAG,EAAE;YACrB,QAAQ,IAAI,CAAC,CAAC;YACd,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;YAE1B,MAAM,OAAO,GAAG,CAAC,GAA0B,EAAE,EAAE;gBAC7C,MAAM,CAAC,cAAc,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;gBAChD,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,IAAI,QAAQ,GAAG,mBAAmB,EAAE,CAAC;oBAChE,SAAS,EAAE,CAAC;gBACd,CAAC;qBAAM,CAAC;oBACN,MAAM,CACJ,IAAI,KAAK,CACP,iDAAiD,QAAQ,gBAAgB,GAAG,CAAC,OAAO,EAAE,CACvF,CACF,CAAC;gBACJ,CAAC;YACH,CAAC,CAAC;YAEF,MAAM,WAAW,GAAG,GAAG,EAAE;gBACvB,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACxC,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC,CAAC;YAEF,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;YACtC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QACnC,CAAC,CAAC;QAEF,SAAS,EAAE,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/src/lib/toml-database-config.d.ts

@@ -0,0 +1,123 @@
+/**
+ * Helpers for emitting `DatabaseTypeOperation` configs as native TOML.
+ *
+ * Background (issue #752): historically `config pull` serialized
+ * `definition` and `params` as JSON strings stuffed into a single TOML
+ * field, which produced unreviewable 800-char one-liners. This module
+ * lets us emit them as nested TOML tables when they're representable,
+ * while preserving the existing file's shape so we don't generate
+ * surprise diffs.
+ *
+ * Three responsibilities:
+ *   1. `detectExistingOperationForms()` — read the raw TOML source and
+ *      decide, per operation name, whether the file uses JSON-string
+ *      form ("legacy") or nested-table form ("native") for each of
+ *      `definition` and `params`. This drives form preservation on
+ *      `config pull`.
+ *   2. `canEmitNative()` — recursively check whether a JS value can be
+ *      represented in TOML **without data loss**. Returns a reason string
+ *      if not. Catches `null`/`undefined` (and arrays containing `null`),
+ *      which every TOML serializer silently drops on write. Heterogeneous
+ *      arrays are fine — the config round-trip uses `smol-toml` (TOML 1.0),
+ *      which emits and re-parses them faithfully (issue #1450).
+ *   3. `buildDatabaseTypeTomlData()` — builds the JS object that we
+ *      hand to `stringifyConfigToml`. Per operation, decides JSON-string vs
+ *      native based on (existing form, can-emit, override mode).
+ */
+import { type FieldForm } from "./toml-native-form.js";
+export { type FieldForm, classifyInlineFieldForm, canEmitNative, } from "./toml-native-form.js";
+export interface OperationFormHints {
+    /** Map of op name → existing form for `definition`. Missing op = "default". */
+    definition: Map<string, FieldForm>;
+    /** Map of op name → existing form for `params`. Missing op = "default". */
+    params: Map<string, FieldForm>;
+}
+/**
+ * Inspect the raw TOML source for a database-type file and decide which
+ * form each operation's `definition`/`params` currently use.
+ *
+ * Detection is intentionally simple: we walk `[[operations]]` blocks in
+ * source order and, for each one, look for either a `definition = '...'`
+ * line (legacy) or an `[operations.definition]` / `[operations.definition.X]`
+ * sub-header (native).
+ */
+export declare function detectExistingOperationForms(rawToml: string): OperationFormHints;
+/**
+ * Normalize a `params` value into a sorted array of
+ * `{ name, type, required, ... }` rows, suitable for emitting as
+ * `[[operations.params]]`. Accepts both shapes the wire/parser supports:
+ *   - object form: `{ projectId: { type: "string", required: true } }`
+ *   - array form:  `[{ name: "projectId", type: "string", required: true }]`
+ */
+export declare function normalizeParamsToArray(params: any): any[] | null;
+export interface BuildOptions {
+    /** Per-op form hints derived from `detectExistingOperationForms`. */
+    hints?: OperationFormHints;
+    /**
+     * Override the default form for ops with no hint. Used by `config pull`
+     * to keep behavior backwards-compatible if we ever flip the default,
+     * and by `config migrate-toml` to force native everywhere.
+     */
+    defaultForm?: FieldForm;
+    /** Sink for human-readable fallback messages. */
+    logger?: (message: string) => void;
+    /**
+     * Server `DatabaseTypeSubscription` rows to emit as `[[subscriptions]]`
+     * blocks (issue #803). Already sanitized by the controller's
+     * `sanitizeSubscription` (so `select`/`emit` are arrays and `params` is an
+     * object). Omitted on the `migrate-toml` path (no subscriptions to merge).
+     */
+    subscriptions?: any[];
+}
+/**
+ * Build the JS object to pass to `stringifyConfigToml` for a database-type
+ * config file. Per operation:
+ *   - If the chosen form is "native" AND `definition` is TOML-emittable,
+ *     emit `[operations.definition]` (nested table).
+ *   - Else emit `definition = '<json string>'` and log a message.
+ *   - Same logic independently for `params`, but the native form for
+ *     params is `[[operations.params]]` (array-of-tables).
+ */
+export declare function buildDatabaseTypeTomlData(typeConfig: any, operations: any[], ruleSetIdToName: Map<string, string>, options?: BuildOptions): any;
+/**
+ * Thrown when a `[[subscriptions]]` block declares both `accessRule` and
+ * `access` with different values. We never silently drop the field
+ * (issue #803 maintainer decision): prefer `access` when they agree, error
+ * when they conflict so the operator fixes the source of truth.
+ */
+export declare class SubscriptionAccessKeyConflictError extends Error {
+    subscriptionKey: string | undefined;
+    constructor(subscriptionKey: string | undefined);
+}
+/**
+ * Resolve the subscription `access` CEL expression from a TOML row.
+ *
+ * The server's wire key is `access`; the issue author (and the guides) used
+ * `accessRule`. We accept both: prefer `access` when present, fall back to
+ * `accessRule`, and never silently drop the field. If both are present with
+ * different values, throw so the conflict is surfaced rather than guessed.
+ */
+export declare function resolveSubscriptionAccess(sub: any): string | undefined;
+/**
+ * Normalize a `[[subscriptions]]` TOML row into the server's wire shape.
+ *
+ * Mirrors `normalizeOperationFromToml`. Maps the `accessRule`→`access`
+ * alias (issue #803), and passes `select` / `emit` / `params` through in
+ * native form — the server stores them as JSON strings and re-parses on
+ * read (`sanitizeSubscription`), so the parse → push → pull round-trip is
+ * symmetric with operations' `definition` / `params`.
+ *
+ * `filter` stays required server-side; we forward whatever is present (or
+ * undefined) and let the controller's clean named 400 surface.
+ */
+export declare function normalizeSubscriptionFromToml(sub: any): any;
+/**
+ * After parsing TOML, normalize the `definition` and `params` of each
+ * operation row into the JS objects the server expects. Handles both
+ * native and legacy forms transparently. The server payload is the
+ * source of truth; native TOML is purely a source-control affordance.
+ *
+ * Mirrors `parseDatabaseTypeToml` in `sync.ts`, but is broken out here
+ * so the migrate-toml command can call it without re-implementing.
+ */
+export declare function normalizeOperationFromToml(op: any): any;

package/dist/src/lib/toml-database-config.js

@@ -0,0 +1,544 @@
+/**
+ * Helpers for emitting `DatabaseTypeOperation` configs as native TOML.
+ *
+ * Background (issue #752): historically `config pull` serialized
+ * `definition` and `params` as JSON strings stuffed into a single TOML
+ * field, which produced unreviewable 800-char one-liners. This module
+ * lets us emit them as nested TOML tables when they're representable,
+ * while preserving the existing file's shape so we don't generate
+ * surprise diffs.
+ *
+ * Three responsibilities:
+ *   1. `detectExistingOperationForms()` — read the raw TOML source and
+ *      decide, per operation name, whether the file uses JSON-string
+ *      form ("legacy") or nested-table form ("native") for each of
+ *      `definition` and `params`. This drives form preservation on
+ *      `config pull`.
+ *   2. `canEmitNative()` — recursively check whether a JS value can be
+ *      represented in TOML **without data loss**. Returns a reason string
+ *      if not. Catches `null`/`undefined` (and arrays containing `null`),
+ *      which every TOML serializer silently drops on write. Heterogeneous
+ *      arrays are fine — the config round-trip uses `smol-toml` (TOML 1.0),
+ *      which emits and re-parses them faithfully (issue #1450).
+ *   3. `buildDatabaseTypeTomlData()` — builds the JS object that we
+ *      hand to `stringifyConfigToml`. Per operation, decides JSON-string vs
+ *      native based on (existing form, can-emit, override mode).
+ */
+import { parseConfigToml } from "./config-toml.js";
+import { serializeDeclaredAccessManifest } from "./toml-metadata-config.js";
+import { DATABASE_TYPE_TABLE } from "./config-surface.js";
+import { projectRecordToToml } from "./config-payload.js";
+import { classifyInlineFieldForm, canEmitNative, } from "./toml-native-form.js";
+// `FieldForm`, `classifyInlineFieldForm`, and `canEmitNative` moved to the
+// neutral `toml-native-form.ts` module (issue #1446) so workflow-schema
+// serialization can share them without importing a database-specific module.
+// Re-exported here so existing importers keep working.
+export { classifyInlineFieldForm, canEmitNative, } from "./toml-native-form.js";
+/**
+ * Inspect the raw TOML source for a database-type file and decide which
+ * form each operation's `definition`/`params` currently use.
+ *
+ * Detection is intentionally simple: we walk `[[operations]]` blocks in
+ * source order and, for each one, look for either a `definition = '...'`
+ * line (legacy) or an `[operations.definition]` / `[operations.definition.X]`
+ * sub-header (native).
+ */
+export function detectExistingOperationForms(rawToml) {
+    const lines = rawToml.split(/\r?\n/);
+    const operations = [];
+    let current = null;
+    // `inSubTable` flips to true the moment we descend into a sub-table of
+    // the current operation (e.g. `[operations.definition]` or
+    // `[[operations.params]]`). Once true, subsequent `name = "..."` /
+    // `definition = "..."` / `params = "..."` lines belong to the sub-table,
+    // not to the operation itself, so we must not let them overwrite the
+    // op-level fields (review feedback r3246634568).
+    let inSubTable = false;
+    for (const rawLine of lines) {
+        const line = rawLine.trim();
+        if (line === "[[operations]]") {
+            if (current)
+                operations.push(current);
+            current = { name: null, definition: null, params: null };
+            inSubTable = false;
+            continue;
+        }
+        if (!current)
+            continue;
+        // Sub-header for this op's definition or params.
+        if (/^\[operations\.definition(\..+)?\]/.test(line) || /^\[\[operations\.definition\..+\]\]/.test(line)) {
+            if (current.definition === null)
+                current.definition = "native";
+            inSubTable = true;
+            continue;
+        }
+        if (/^\[\[operations\.params\]\]/.test(line) || /^\[operations\.params(\..+)?\]/.test(line)) {
+            if (current.params === null)
+                current.params = "native";
+            inSubTable = true;
+            continue;
+        }
+        // A new top-level array-of-tables block ends the operation's scope
+        // for our purposes. We don't fully parse TOML here; we just stop
+        // ascribing later lines to this op.
+        if (/^\[\[/.test(line) && !line.startsWith("[[operations.")) {
+            operations.push(current);
+            current = null;
+            inSubTable = false;
+            continue;
+        }
+        if (/^\[/.test(line) && !line.startsWith("[operations.")) {
+            operations.push(current);
+            current = null;
+            inSubTable = false;
+            continue;
+        }
+        // Op-level fields. Skip if we've already descended into a sub-table —
+        // a `name = "id"` inside `[[operations.params]]` belongs to the param,
+        // not to the operation. Same for any other key we recognize here.
+        if (inSubTable)
+            continue;
+        const m = line.match(/^([a-zA-Z_][a-zA-Z0-9_]*)\s*=\s*(.*)$/);
+        if (!m)
+            continue;
+        const key = m[1];
+        const value = m[2];
+        if (key === "name") {
+            const nameMatch = value.match(/^["'](.+)["']\s*$/);
+            if (nameMatch)
+                current.name = nameMatch[1];
+        }
+        else if (key === "definition" && current.definition === null) {
+            // Distinguish the inline-table form (`definition = { ... }`) from the
+            // legacy JSON-string form (`definition = '...'`) so an inline author
+            // round-trips through native emission, not back to a JSON string
+            // (issue #1255).
+            current.definition = classifyInlineFieldForm(value);
+        }
+        else if (key === "params" && current.params === null) {
+            current.params = classifyInlineFieldForm(value);
+        }
+    }
+    if (current)
+        operations.push(current);
+    const definition = new Map();
+    const params = new Map();
+    for (const op of operations) {
+        if (!op.name)
+            continue;
+        if (op.definition)
+            definition.set(op.name, op.definition);
+        if (op.params)
+            params.set(op.name, op.params);
+    }
+    return { definition, params };
+}
+/**
+ * Normalize a `params` value into a sorted array of
+ * `{ name, type, required, ... }` rows, suitable for emitting as
+ * `[[operations.params]]`. Accepts both shapes the wire/parser supports:
+ *   - object form: `{ projectId: { type: "string", required: true } }`
+ *   - array form:  `[{ name: "projectId", type: "string", required: true }]`
+ */
+export function normalizeParamsToArray(params) {
+    if (params == null)
+        return null;
+    if (Array.isArray(params)) {
+        return params
+            .map((p) => ({ ...p }))
+            .filter((p) => p && typeof p === "object");
+    }
+    if (typeof params === "object") {
+        return Object.entries(params).map(([name, spec]) => ({
+            name,
+            ...(spec && typeof spec === "object" ? spec : {}),
+        }));
+    }
+    return null;
+}
+/**
+ * Default form for a new operation (no existing form hint): native.
+ * That matches the issue's "new file from server → native by default"
+ * requirement.
+ */
+const DEFAULT_FORM = "native";
+/**
+ * Build the JS object to pass to `stringifyConfigToml` for a database-type
+ * config file. Per operation:
+ *   - If the chosen form is "native" AND `definition` is TOML-emittable,
+ *     emit `[operations.definition]` (nested table).
+ *   - Else emit `definition = '<json string>'` and log a message.
+ *   - Same logic independently for `params`, but the native form for
+ *     params is `[[operations.params]]` (array-of-tables).
+ */
+export function buildDatabaseTypeTomlData(typeConfig, operations, ruleSetIdToName, options = {}) {
+    const hints = options.hints;
+    const defaultForm = options.defaultForm ?? DEFAULT_FORM;
+    const log = options.logger ?? (() => { });
+    // #2644 — the `[type]` key set comes from the vendored definition, so a
+    // scalar added there is written with no edit here. Only the two keys whose
+    // emitted VALUE is their own carry a producer:
+    //
+    //   `ruleSetName` — prefer the parsed-from-key-based-reference name when
+    //     present (`_ruleSetName` is set by `parseDatabaseTypeToml` when the
+    //     source TOML uses the modern `ruleSetName = "..."` form), so the
+    //     parse → serialize cycle is a no-op for the rule-set field even when the
+    //     caller passes an empty `ruleSetIdToName` map (e.g. `config migrate-toml`,
+    //     review feedback r3246633010). The empty string is the "no rule set"
+    //     spelling these files have always used, and is emitted always.
+    //   `timestamps` (#748) — an inline table under `[type]`; the server returns
+    //     the parsed `{ create?, update?, models? }` object, which serializes 1:1
+    //     so a pull → push cycle is idempotent.
+    const data = {
+        type: projectRecordToToml(DATABASE_TYPE_TABLE, typeConfig, {
+            ruleSetId: (record) => {
+                if (record?._ruleSetName)
+                    return record._ruleSetName;
+                return record?.ruleSetId
+                    ? ruleSetIdToName.get(record.ruleSetId) || ""
+                    : "";
+            },
+        }),
+    };
+    if (typeConfig.triggers) {
+        data.triggers = typeConfig.triggers;
+    }
+    // Issue #666: inline schema TOML. The server-side `schema` field is a raw
+    // TOML string of `[models.*.fields.*]` blocks. Parse + merge into the same
+    // TOML object so the result serializes as `[models.<Name>.fields.<field>]`
+    // headers (matches the round-2 plan-of-record CLI sync layout).
+    if (typeConfig.schema && typeof typeConfig.schema === "string") {
+        try {
+            const parsedSchema = parseConfigToml(typeConfig.schema);
+            if (parsedSchema?.models) {
+                data.models = parsedSchema.models;
+            }
+        }
+        catch {
+            // If the stored TOML is malformed (operationally surprising), don't
+            // crash the serializer — fall through without the models block.
+        }
+    }
+    // Declared-access manifest (issue #1304, P-C): merge the top-level
+    // `[metadata]` + `secrets` fragments so a pull→push→pull cycle round-trips.
+    // Emitted before the operations-only early return so a type with a manifest
+    // but no operations still writes it.
+    Object.assign(data, serializeDeclaredAccessManifest(typeConfig.metadataManifest));
+    // Subscriptions (issue #803) — emitted as `[[subscriptions]]` array-of-
+    // tables, independent of operations. Built before the operations-only
+    // early return so a type with subscriptions but no operations still emits
+    // them.
+    const subscriptionRows = buildSubscriptionRows(options.subscriptions, log);
+    if (operations.length === 0) {
+        if (subscriptionRows.length > 0) {
+            data.subscriptions = subscriptionRows;
+        }
+        return data;
+    }
+    data.operations = operations.map((op) => {
+        const opRow = {
+            name: op.name,
+            type: op.type,
+            modelName: op.modelName,
+        };
+        if (op.access) {
+            opRow.access = op.access;
+        }
+        // ---- definition ----
+        const defForm = hints?.definition.get(op.name) ?? defaultForm;
+        const defValue = typeof op.definition === "string"
+            ? safeParseJson(op.definition)
+            : op.definition;
+        let definitionEmitted = false;
+        if (defForm === "native" && defValue && typeof defValue === "object") {
+            const reason = canEmitNative(defValue);
+            if (reason) {
+                log(`Operation '${op.name}': cannot emit \`definition\` as native TOML (${reason}); falling back to JSON string for this field.`);
+            }
+            else {
+                opRow.definition = defValue;
+                definitionEmitted = true;
+            }
+        }
+        if (!definitionEmitted) {
+            opRow.definition = typeof op.definition === "object"
+                ? JSON.stringify(op.definition)
+                : op.definition;
+        }
+        // ---- params ----
+        if (op.params != null) {
+            const paramsForm = hints?.params.get(op.name) ?? defaultForm;
+            let paramsEmitted = false;
+            if (paramsForm === "native") {
+                const paramsParsed = typeof op.params === "string"
+                    ? safeParseJson(op.params)
+                    : op.params;
+                const paramsArray = normalizeParamsToArray(paramsParsed);
+                if (paramsArray && paramsArray.length > 0) {
+                    const reason = canEmitNative(paramsArray);
+                    if (reason) {
+                        log(`Operation '${op.name}': cannot emit \`params\` as native TOML (${reason}); falling back to JSON string for this field.`);
+                    }
+                    else {
+                        opRow.params = paramsArray;
+                        paramsEmitted = true;
+                    }
+                }
+                else if (paramsArray && paramsArray.length === 0) {
+                    // Empty params: skip entirely rather than emitting an empty table.
+                    paramsEmitted = true;
+                }
+            }
+            if (!paramsEmitted) {
+                opRow.params = typeof op.params === "object"
+                    ? JSON.stringify(op.params)
+                    : op.params;
+            }
+        }
+        return opRow;
+    });
+    if (subscriptionRows.length > 0) {
+        data.subscriptions = subscriptionRows;
+    }
+    return data;
+}
+/**
+ * Build the `[[subscriptions]]` rows for a database-type TOML file from the
+ * server's sanitized subscription list (issue #803).
+ *
+ * Emits the canonical TOML key order and uses the wire key `access` (we read
+ * both `access` and `accessRule` on parse, but always emit `access` so a
+ * pull → push round-trip is stable). `select` / `emit` are plain string
+ * arrays; `params` is an inline object. Falls back to a JSON string for any
+ * field that TOML can't represent natively (mirrors operations'
+ * `definition` / `params` fallback), so an exotic `params` shape never
+ * breaks serialization.
+ */
+function buildSubscriptionRows(subscriptions, log) {
+    if (!Array.isArray(subscriptions) || subscriptions.length === 0)
+        return [];
+    return subscriptions.map((sub) => {
+        const row = {
+            subscriptionKey: sub.subscriptionKey,
+            displayName: sub.displayName,
+            modelName: sub.modelName,
+        };
+        if (sub.description != null && sub.description !== "") {
+            row.description = sub.description;
+        }
+        if (sub.filter != null) {
+            row.filter = sub.filter;
+        }
+        if (sub.access != null) {
+            row.access = sub.access;
+        }
+        // `select` / `emit`: server sanitizes to arrays (or null). Emit when a
+        // non-empty array is present.
+        if (Array.isArray(sub.select) && sub.select.length > 0) {
+            row.select = sub.select;
+        }
+        if (Array.isArray(sub.emit) && sub.emit.length > 0) {
+            row.emit = sub.emit;
+        }
+        // `params`: server sanitizes to an object (or {}). Emit when non-empty.
+        if (sub.params &&
+            typeof sub.params === "object" &&
+            !Array.isArray(sub.params) &&
+            Object.keys(sub.params).length > 0) {
+            const reason = canEmitNative(sub.params);
+            if (reason) {
+                log(`Subscription '${sub.subscriptionKey}': cannot emit \`params\` as native TOML (${reason}); falling back to JSON string.`);
+                row.params = JSON.stringify(sub.params);
+            }
+            else {
+                row.params = sub.params;
+            }
+        }
+        // `status`: only emit when not the default "active" so round-tripped
+        // files stay clean.
+        if (sub.status && sub.status !== "active") {
+            row.status = sub.status;
+        }
+        return row;
+    });
+}
+function safeParseJson(s) {
+    try {
+        return JSON.parse(s);
+    }
+    catch {
+        return s;
+    }
+}
+/**
+ * Thrown when a `[[subscriptions]]` block declares both `accessRule` and
+ * `access` with different values. We never silently drop the field
+ * (issue #803 maintainer decision): prefer `access` when they agree, error
+ * when they conflict so the operator fixes the source of truth.
+ */
+export class SubscriptionAccessKeyConflictError extends Error {
+    subscriptionKey;
+    constructor(subscriptionKey) {
+        super(`Subscription ${subscriptionKey ? `'${subscriptionKey}' ` : ""}declares both \`access\` and \`accessRule\` with different values. ` +
+            `Use one (prefer \`access\`, the wire/server key) or make them identical.`);
+        this.subscriptionKey = subscriptionKey;
+        this.name = "SubscriptionAccessKeyConflictError";
+    }
+}
+/**
+ * Resolve the subscription `access` CEL expression from a TOML row.
+ *
+ * The server's wire key is `access`; the issue author (and the guides) used
+ * `accessRule`. We accept both: prefer `access` when present, fall back to
+ * `accessRule`, and never silently drop the field. If both are present with
+ * different values, throw so the conflict is surfaced rather than guessed.
+ */
+export function resolveSubscriptionAccess(sub) {
+    const hasAccess = sub.access !== undefined && sub.access !== null;
+    const hasAccessRule = sub.accessRule !== undefined && sub.accessRule !== null;
+    if (hasAccess && hasAccessRule && sub.access !== sub.accessRule) {
+        throw new SubscriptionAccessKeyConflictError(sub.subscriptionKey);
+    }
+    if (hasAccess)
+        return sub.access;
+    if (hasAccessRule)
+        return sub.accessRule;
+    return undefined;
+}
+/**
+ * Normalize a `[[subscriptions]]` TOML row into the server's wire shape.
+ *
+ * Mirrors `normalizeOperationFromToml`. Maps the `accessRule`→`access`
+ * alias (issue #803), and passes `select` / `emit` / `params` through in
+ * native form — the server stores them as JSON strings and re-parses on
+ * read (`sanitizeSubscription`), so the parse → push → pull round-trip is
+ * symmetric with operations' `definition` / `params`.
+ *
+ * `filter` stays required server-side; we forward whatever is present (or
+ * undefined) and let the controller's clean named 400 surface.
+ */
+export function normalizeSubscriptionFromToml(sub) {
+    const normalized = {
+        subscriptionKey: sub.subscriptionKey,
+        displayName: sub.displayName,
+        modelName: sub.modelName,
+        filter: sub.filter,
+        access: resolveSubscriptionAccess(sub),
+    };
+    // Optional fields are *always* assigned (explicit `null` when absent),
+    // mirroring how `normalizeOperationFromToml` always assigns `params`
+    // (`= null` when absent). This is load-bearing for the update path: when an
+    // operator deletes one of these lines from a `[[subscriptions]]` block and
+    // re-pushes, the explicit `null` survives `JSON.stringify` in the PUT body
+    // (only `undefined` keys are dropped), passes the controller's
+    // `if (body.X !== undefined)` guard, and clears the prior server value.
+    // Leaving these `undefined` would silently retain the old server value and
+    // re-emit the just-deleted field on the next pull (a spurious diff, and for
+    // `select` a tighter-than-intended projection left live).
+    normalized.description =
+        sub.description !== undefined ? sub.description : null;
+    if (sub.status !== undefined) {
+        normalized.status = sub.status;
+    }
+    // `select` / `emit` are plain string arrays in native TOML form. The
+    // server validates and JSON-stringifies them; we forward as-is (or `null`
+    // to clear a removed line).
+    normalized.select = sub.select !== undefined ? sub.select : null;
+    normalized.emit = sub.emit !== undefined ? sub.emit : null;
+    // `params` accepts either native object form
+    // (`{ projectId = { type = "string" } }`) or the array-of-tables form
+    // (`[[subscriptions.params]]` rows with a `name` key). Convert array form
+    // back to the object the server expects, mirroring operations' params.
+    // Always assign (`null` when absent) so a removed `params` clears.
+    if (sub.params != null) {
+        if (Array.isArray(sub.params)) {
+            const obj = {};
+            for (const row of sub.params) {
+                if (!row || typeof row !== "object" || !row.name)
+                    continue;
+                const { name, ...rest } = row;
+                obj[name] = rest;
+            }
+            normalized.params = obj;
+        }
+        else if (typeof sub.params === "object") {
+            normalized.params = sub.params;
+        }
+        else {
+            normalized.params = null;
+        }
+    }
+    else {
+        normalized.params = null;
+    }
+    return normalized;
+}
+/**
+ * After parsing TOML, normalize the `definition` and `params` of each
+ * operation row into the JS objects the server expects. Handles both
+ * native and legacy forms transparently. The server payload is the
+ * source of truth; native TOML is purely a source-control affordance.
+ *
+ * Mirrors `parseDatabaseTypeToml` in `sync.ts`, but is broken out here
+ * so the migrate-toml command can call it without re-implementing.
+ */
+export function normalizeOperationFromToml(op) {
+    const normalized = {
+        name: op.name,
+        type: op.type,
+        modelName: op.modelName,
+        // `access` is optional — when the parent type sets `defaultAccess`,
+        // an operation may inherit by omitting this key. Keep null so the
+        // server-side controller decides whether to require it. A blank
+        // expression is the same inheritance spelled out (#3267): the handler
+        // stores `null` for it (`accessProvided` is a trimmed-length check), so
+        // comparing `""` against that null was a difference no push could close.
+        access: typeof op.access === "string" && op.access.trim().length === 0
+            ? null
+            : (op.access ?? null),
+    };
+    if (typeof op.definition === "string") {
+        normalized.definition = safeParseJson(op.definition);
+    }
+    else {
+        // Preserve undefined-vs-set parity with the legacy parser by always
+        // assigning the key.
+        normalized.definition = op.definition;
+    }
+    if (op.params != null) {
+        if (typeof op.params === "string") {
+            normalized.params = safeParseJson(op.params);
+        }
+        else if (Array.isArray(op.params)) {
+            // Convert array form back into object form for the server payload.
+            const obj = {};
+            for (const row of op.params) {
+                if (!row || typeof row !== "object" || !row.name)
+                    continue;
+                const { name, ...rest } = row;
+                obj[name] = rest;
+            }
+            normalized.params = obj;
+        }
+        else if (typeof op.params === "object") {
+            normalized.params = op.params;
+        }
+    }
+    else {
+        normalized.params = null;
+    }
+    // An empty params set declares no params (#3267): `params = []`, an empty
+    // `[operations.params]` table and a `[[operations.params]]` row naming no
+    // param all mean what an absent key means. The server reads them the same
+    // way (its declared-param set is empty either way), but the serializer
+    // writes nothing back for an empty set — so `{}` on this side compared
+    // against the null that round-trips was a difference the push it planned
+    // could never close. Sending null converges the server's copy as well.
+    if (normalized.params !== null &&
+        typeof normalized.params === "object" &&
+        Object.keys(normalized.params).length === 0) {
+        normalized.params = null;
+    }
+    return normalized;
+}
+//# sourceMappingURL=toml-database-config.js.map