v3.6.0 trusted callbacks and tableless SELECT

CSharpDB.slnx

@@ -21,6 +21,7 @@
     <Project Path="samples/collection-indexing/CollectionIndexingSample.csproj" />
     <Project Path="samples/csv-bulk-import/CsvBulkImportSample.csproj" />
     <Project Path="samples/efcore-provider/EfCoreProviderSample.csproj" />
+    <Project Path="samples/trusted-csharp-host/TrustedCSharpHostSample.csproj" />
   </Folder>
   <Folder Name="/src/">
     <Project Path="src/CSharpDB/CSharpDB.csproj" />
@@ -53,6 +54,7 @@
     <Project Path="tests/CSharpDB.Daemon.Tests/CSharpDB.Daemon.Tests.csproj" />
     <Project Path="tests/CSharpDB.Admin.Forms.Tests/CSharpDB.Admin.Forms.Tests.csproj" />
     <Project Path="tests/CSharpDB.Admin.Reports.Tests/CSharpDB.Admin.Reports.Tests.csproj" />
+    <Project Path="tests/CSharpDB.ExtensionSandbox.Worker/CSharpDB.ExtensionSandbox.Worker.csproj" />
     <Project Path="tests/CSharpDB.Benchmarks/CSharpDB.Benchmarks.csproj" />
     <Project Path="tests/CSharpDB.DataGen/CSharpDB.DataGen.csproj" />
   </Folder>

Directory.Build.props

@@ -0,0 +1,6 @@
+<Project>
+  <PropertyGroup>
+    <!-- Keep ignored/generated local outputs out of SDK-style default item globs. -->
+    <DefaultItemExcludes>$(DefaultItemExcludes);artifacts/**;**/artifacts/**;.tmp/**;**/.tmp/**;tmp/**;**/tmp/**;temp/**;**/temp/**;publish/**;**/publish/**</DefaultItemExcludes>
+  </PropertyGroup>
+</Project>

Directory.Build.targets

@@ -0,0 +1,8 @@
+<Project>
+  <Target Name="PurgeAdminArtifacts"
+          BeforeTargets="BeforeBuild"
+          Condition="'$(MSBuildProjectName)' == 'CSharpDB.Admin'">
+    <RemoveDir Directories="$(MSBuildProjectDirectory)\artifacts"
+               Condition="Exists('$(MSBuildProjectDirectory)\artifacts')" />
+  </Target>
+</Project>

README.md

@@ -210,6 +210,8 @@ The native library exports 20 C functions. See the [Native Library Reference](ht
 | [Architecture Guide](https://csharpdb.com/architecture.html) | Engine design deep dive |
 | [Tools & Ecosystem](https://csharpdb.com/docs/ecosystem.html) | APIs, hosts, designers, and integrations |
 | [EF Core Provider](https://csharpdb.com/docs/entity-framework-core.html) | Embedded EF Core 10 provider guide |
+| [Trusted C# Callbacks](docs/trusted-csharp-functions/README.md) | Register in-process C# functions, commands, and validation rules for SQL, forms, reports, and pipelines |
+| [Trusted C# Host Sample](samples/trusted-csharp-host/README.md) | VS Code-ready C# host project for trusted functions, commands, validation rules, and form actions |
 | [Admin UI Guide](https://csharpdb.com/docs/admin-ui.html) | Querying, schema, pipelines, forms, reports, and storage |
 | [CSharpDB.Client](src/CSharpDB.Client/README.md) | Unified client API and transports |
 | [Pipelines](https://csharpdb.com/docs/pipelines.html) | ETL package model and visual designer |

docs/admin-collections-ui/README.md

@@ -0,0 +1,59 @@
+# Admin Collections UI
+
+## Summary
+
+The Admin app now treats document collections as first-class objects alongside
+tables, views, forms, and reports. The first implementation is a browser and
+JSON editor built on the existing collection client APIs:
+
+- list collection names
+- browse documents by page
+- fetch one document by exact key
+- create or update a document
+- delete a document
+
+This deliberately avoids new engine, HTTP, gRPC, or client contracts. Collection
+path-index management, document-content search, collection rename, and
+collection drop remain future work.
+
+## User Experience
+
+- Object Explorer has a `Collections` filter chip and group.
+- The collection group menu supports `New Collection...` and `Refresh`.
+- Collection item menus support `Open`, `New Document...`, and `Copy Name`.
+- The command palette includes `New Collection` plus one entry for each existing
+  collection.
+- Each collection opens in a dedicated `collection:{name}` tab using the same
+  toolbar, pager, grid, and detail-panel language as table data tabs.
+
+## Collection Tab Behavior
+
+- The grid shows row number, document key, JSON kind, and a compact preview.
+- The detail panel shows indented JSON for the selected document.
+- Existing document keys are read-only.
+- New documents require a nonblank key and valid JSON before save is enabled.
+- Save writes through `PutDocumentAsync(collectionName, key, document)`.
+- Delete writes through `DeleteDocumentAsync(collectionName, key)` after
+  confirmation.
+- Successful writes notify Admin change listeners and refresh the current page.
+- Exact-key lookup uses `GetDocumentAsync(collectionName, key)`.
+
+## Defaults
+
+- Default page size is `25`.
+- Supported page sizes are `10`, `25`, `50`, and `100`.
+- Collection names use the same simple identifier shape as the direct client:
+  `^[A-Za-z_][A-Za-z0-9_]*$`.
+- Deleting all documents leaves the collection itself in place because there is
+  no drop-collection API today.
+- Generated collection model metadata is not surfaced; documents are edited as
+  raw JSON.
+
+## Verification
+
+Run the focused Admin checks after collection UI changes:
+
+```powershell
+dotnet build src/CSharpDB.Admin/CSharpDB.Admin.csproj
+dotnet test tests/CSharpDB.Admin.Forms.Tests/CSharpDB.Admin.Forms.Tests.csproj
+```

docs/admin-forms-access-parity/README.md

@@ -22,6 +22,16 @@ The current forms surface already includes:
 - schema-change warnings
 - designer undo/redo, copy/paste, duplicate, layers, alignment, tab order, and
   mobile/tablet/desktop breakpoint editing
+- trusted host command registration for form lifecycle events
+- designer editing for form-level event bindings
+- command button controls that invoke trusted host commands
+- trusted command-backed selected-control events
+- declarative form action sequences for run-command, reusable sequence,
+  set-field, show-message, stop, built-in navigation, save, delete, refresh,
+  and go-to-record steps
+- conditional action steps and reusable named form action sequences
+- visual designer editing for form and selected-control action sequences
+- generated automation metadata for export/import host callback requirements
 
 ## Added Review Findings
 
@@ -96,9 +106,9 @@ Expected fix:
 
 | Feature | Status | Notes |
 | --- | --- | --- |
-| Command button control | Planned | Add buttons that can run form actions. |
-| Action model | Planned | Support actions such as open form, save, delete, navigate, apply filter, clear filter, run SQL/procedure, and show message. |
-| Event hooks | Planned | Add form/control events such as on load, before save, after save, before field change, after field change, and button click. |
+| Command button control | Partial | Trusted command buttons can invoke host-registered C# commands, action-only click sequences, reusable action sequences, and built-in rendered-form navigation/save/delete actions; richer button styling and command presets remain future work. |
+| Action model | Partial | Declarative action sequences support run-command, reusable sequence, set-field, show-message, stop, built-in navigation/save/delete/refresh/go-to, simple per-step conditions, visual designer editing, and generated automation metadata for form and selected-control events; open form, apply filter, clear filter, run SQL/procedure, loops, and conditional UI rules remain future work. |
+| Event hooks | Partial | Form lifecycle events, command-button clicks, and selected control events can call trusted commands; additional Access-style events remain future work. |
 | Conditional UI rules | Planned | Add visible/enabled/read-only expressions for controls. |
 
 ### Phase 5: Broader Control and Property Coverage
@@ -124,3 +134,17 @@ workflows." The highest leverage model changes are:
 - form-mode model
 
 Those foundations should be added before expanding the control palette too far.
+
+## Developer Extensibility
+
+Custom form controls can now be registered without changing saved form JSON. See
+[Form Control Extensibility](form-control-extensibility.md) for the registry API,
+component contexts, generic property schema, and the sample rating control.
+
+Host-owned validation callbacks can be registered for field-level and form-level
+save checks. See
+[Trusted Validation Rules](../trusted-csharp-functions/validation-rules.md) for
+registration, designer metadata, policy, diagnostics, and sample code.
+
+For Access-style expression functions and macro/action candidates, see
+[Access-Style Functions and Macros](access-style-functions-and-macros.md).

docs/admin-forms-access-parity/access-style-functions-and-macros.md

@@ -0,0 +1,244 @@
+# Access-Style Functions and Macros
+
+This note captures the Access-parity function and macro set we want available
+in Admin Forms. The goal is not to clone every Access/VBA surface area at once.
+The goal is to include the small, familiar built-in set that makes form
+expressions, validation, conditional formatting, buttons, and simple workflows
+feel productive without requiring host code for every common task.
+
+## Design Direction
+
+- Keep simple expression functions built into the formula engine.
+- Keep user-facing form actions as declarative Admin Form actions where possible.
+- Route dangerous or host-specific actions through trusted callbacks, policy, and
+  diagnostics.
+- Treat database-owned C# code modules as the later `RunCode` target.
+- Preserve the existing saved form wire shape by storing action and expression
+  settings in metadata/property bags.
+
+Implementation note: Admin Forms formulas now include the expression functions
+listed below as built-ins. Macro/action commands remain roadmap items unless
+already covered by the existing form action model.
+
+## Included Expression Functions
+
+### Null and Conditional
+
+These should be first because they appear constantly in form defaults,
+calculated controls, validation messages, and visibility/enabled rules.
+
+| Function | Purpose | Priority |
+| --- | --- | --- |
+| `Nz(value, fallback)` | Replace null/empty values with a fallback. | V1 |
+| `IsNull(value)` | Test for null. | V1 |
+| `IsEmpty(value)` | Test for empty/unset values where applicable. | V1 |
+| `IIf(condition, trueValue, falseValue)` | Inline conditional. | V1 |
+| `Switch(condition1, value1, ...)` | Multi-branch conditional. | V2 |
+| `Choose(index, value1, value2, ...)` | Pick from positional values. | V2 |
+
+### Text
+
+| Function | Purpose | Priority |
+| --- | --- | --- |
+| `Len(value)` | Text length. | V1 |
+| `Left(value, count)` | Left substring. | V1 |
+| `Right(value, count)` | Right substring. | V1 |
+| `Mid(value, start, count)` | Middle substring. | V1 |
+| `Trim(value)` | Trim both ends. | V1 |
+| `LTrim(value)` | Trim left. | V2 |
+| `RTrim(value)` | Trim right. | V2 |
+| `UCase(value)` | Uppercase text. | V1 |
+| `LCase(value)` | Lowercase text. | V1 |
+| `InStr(value, search)` | Find substring position. | V1 |
+| `Replace(value, search, replacement)` | Replace text. | V1 |
+| `StrComp(left, right, comparison)` | Compare strings. | V2 |
+| `Val(value)` | Parse leading numeric text. | V2 |
+
+### Date and Time
+
+| Function | Purpose | Priority |
+| --- | --- | --- |
+| `Date()` | Current date. | V1 |
+| `Time()` | Current time. | V1 |
+| `Now()` | Current date/time. | V1 |
+| `Year(value)` | Extract year. | V1 |
+| `Month(value)` | Extract month number. | V1 |
+| `Day(value)` | Extract day of month. | V1 |
+| `Hour(value)` | Extract hour. | V2 |
+| `Minute(value)` | Extract minute. | V2 |
+| `Second(value)` | Extract second. | V2 |
+| `DateAdd(interval, amount, value)` | Add date/time interval. | V1 |
+| `DateDiff(interval, start, end)` | Difference between dates. | V1 |
+| `DatePart(interval, value)` | Extract date/time part. | V2 |
+| `DateSerial(year, month, day)` | Construct date. | V2 |
+| `TimeSerial(hour, minute, second)` | Construct time. | V2 |
+| `Weekday(value)` | Day of week number. | V2 |
+| `MonthName(month)` | Month display name. | V2 |
+
+### Number and Conversion
+
+| Function | Purpose | Priority |
+| --- | --- | --- |
+| `Abs(value)` | Absolute value. | V1 |
+| `Round(value, digits)` | Round number. | V1 |
+| `Int(value)` | Floor-like integer conversion. | V1 |
+| `Fix(value)` | Truncate toward zero. | V2 |
+| `Sgn(value)` | Sign of number. | V2 |
+| `CStr(value)` | Convert to string. | V1 |
+| `CInt(value)` | Convert to integer. | V1 |
+| `CLng(value)` | Convert to long integer. | V2 |
+| `CDbl(value)` | Convert to double. | V1 |
+| `CBool(value)` | Convert to boolean. | V1 |
+| `CDate(value)` | Convert to date/time. | V1 |
+| `Format(value, format)` | Format date/number/text. | V2 |
+
+### Domain Aggregates
+
+Domain aggregate functions are important for Access familiarity, but they need a
+careful implementation because they read other rows/tables during form
+evaluation.
+
+| Function | Purpose | Priority |
+| --- | --- | --- |
+| `DLookup(expr, domain, criteria)` | Read one value from a table/query. | V2 |
+| `DCount(expr, domain, criteria)` | Count matching rows. | V2 |
+| `DSum(expr, domain, criteria)` | Sum matching rows. | V2 |
+| `DAvg(expr, domain, criteria)` | Average matching rows. | V2 |
+| `DMin(expr, domain, criteria)` | Minimum matching value. | V2 |
+| `DMax(expr, domain, criteria)` | Maximum matching value. | V2 |
+
+V2 should enforce query/table access through the same callback and diagnostics
+boundary used for trusted extensions where relevant. These functions should also
+have row limits and clear error handling so formula evaluation cannot become an
+unbounded database workload.
+
+## Included Macro and Action Commands
+
+### Record Actions
+
+These map cleanly to existing form runtime behavior and should remain
+declarative actions rather than host callbacks.
+
+| Action | Purpose | Priority |
+| --- | --- | --- |
+| `NewRecord` | Start a new record. | V1 |
+| `SaveRecord` | Save the current record. | V1 |
+| `DeleteRecord` | Delete the current record. | V1 |
+| `UndoRecord` | Revert unsaved edits. | V1 |
+| `RefreshRecord` | Reload the current record. | V1 |
+| `Requery` | Reload the form record source. | V1 |
+| `GoToRecord` | Navigate to a specific record. | V1 |
+| `FindRecord` | Search/navigate by criteria. | V2 |
+| `NextRecord` | Navigate forward. | V1 |
+| `PreviousRecord` | Navigate backward. | V1 |
+
+### Form, Window, and Report Actions
+
+| Action | Purpose | Priority |
+| --- | --- | --- |
+| `OpenForm` | Open another saved form. | V1 |
+| `CloseForm` | Close current or named form. | V1 |
+| `OpenReport` | Open a saved report. | V2 |
+| `CloseReport` | Close a report surface. | V2 |
+| `PreviewReport` | Open report preview. | V2 |
+| `PrintReport` | Print or export through report pipeline. | V2 |
+
+### Filter and Sort Actions
+
+| Action | Purpose | Priority |
+| --- | --- | --- |
+| `ApplyFilter` | Apply a form filter. | V1 |
+| `ClearFilter` | Clear current filter. | V1 |
+| `SetOrderBy` | Apply sort order. | V1 |
+| `ClearOrderBy` | Clear sort order. | V1 |
+| `SearchRecords` | Search over configured searchable fields. | V2 |
+
+### UI and Control Actions
+
+These are needed for Access-style command buttons and conditional workflows.
+
+| Action | Purpose | Priority |
+| --- | --- | --- |
+| `SetValue` | Set a field/control value. | V1 |
+| `SetProperty` | Set visible/enabled/read-only/text/style properties. | V1 |
+| `SetFocus` | Move focus to a control. | V1 |
+| `EnableControl` | Set enabled state. | V1 |
+| `DisableControl` | Clear enabled state. | V1 |
+| `ShowControl` | Set visible state. | V1 |
+| `HideControl` | Clear visible state. | V1 |
+| `LockControl` | Set read-only state. | V1 |
+| `UnlockControl` | Clear read-only state. | V1 |
+| `MsgBox` | Show a message dialog. | V1 |
+| `InputBox` | Prompt for a value. | V2 |
+
+### Flow Actions
+
+| Action | Purpose | Priority |
+| --- | --- | --- |
+| `If` / `Else` | Conditional action branching. | V1 |
+| `StopMacro` | Stop the current action sequence. | V1 |
+| `RunMacro` | Run a named action sequence. | V1 |
+| `RunActionSequence` | Existing explicit reusable sequence action. | V1 |
+| `OnError` | Configure failure handling. | V2 |
+
+### Data and Query Actions
+
+These must be gated carefully because they can mutate data outside the current
+form record.
+
+| Action | Purpose | Priority |
+| --- | --- | --- |
+| `OpenQuery` | Open a saved query result. | V2 |
+| `RunQuery` | Execute a saved query. | V2 trusted |
+| `RunProcedure` | Execute a saved procedure. | V2 trusted |
+| `RunSQL` | Execute SQL text. | Later trusted |
+| `ExportData` | Export records. | Later trusted |
+| `ImportData` | Import records. | Later trusted |
+
+### Code Bridge Actions
+
+| Action | Purpose | Priority |
+| --- | --- | --- |
+| `RunCommand` | Invoke host-registered trusted command callback. | Existing |
+| `RunCode` | Invoke database-owned C# code module function. | Later |
+
+`RunCode` should wait for the database code modules work. It should compile and
+execute database-owned C# through a trusted build/runtime model, not arbitrary
+source text embedded directly inside form JSON.
+
+### Temp and Session Variables
+
+| Action | Purpose | Priority |
+| --- | --- | --- |
+| `SetTempVar` | Store a session-scoped value. | V2 |
+| `RemoveTempVar` | Remove one session value. | V2 |
+| `RemoveAllTempVars` | Clear session values. | V2 |
+
+Temp variables should be scoped to the current user/session and be available to
+form expressions, filters, and action sequences.
+
+## Recommended Implementation Order
+
+1. Add core formula functions: `Nz`, `IIf`, `Date`, `Now`, common text helpers,
+   numeric helpers, and conversions.
+2. Add declarative form actions: `MsgBox`, `SetValue`, `SetProperty`,
+   `SetFocus`, `ApplyFilter`, `ClearFilter`, `Requery`, `OpenForm`, and
+   `CloseForm`.
+3. Add domain aggregates with clear access checks, row limits, and diagnostics.
+4. Add temp/session variables and make them visible to expressions and actions.
+5. Add `RunCode` after database code modules exist.
+6. Add import/export/file/app-launch style actions only as trusted operations.
+
+## Notes on Access Compatibility
+
+Microsoft Access exposes many functions and macro commands. CSharpDB should use
+the familiar names where it makes sense, but implementation should follow the
+CSharpDB security and diagnostics model. Anything that can call host code,
+modify unrelated data, access files, or run arbitrary SQL should go through an
+explicit trusted boundary.
+
+Useful Microsoft references:
+
+- [Access functions by category](https://support.microsoft.com/en-us/office/access-functions-by-category-b8b136c3-2716-4d39-94a2-658ce330ed83)
+- [Introduction to macros](https://support.microsoft.com/en-gb/office/introduction-to-macros-a39c2a26-e745-4957-8d06-89e0b435aac3)
+- [Access macro commands](https://learn.microsoft.com/en-ie/office/client-developer/access/desktop-database-reference/macro-commands)