buffa-codegen 0.7.1

//! Code generation for zero-copy borrowed message view types.
//!
//! For each proto message `Foo` this module generates:
//!
//! - `FooView<'a>`: a struct whose string/bytes fields are `&'a str`/`&'a [u8]`,
//!   borrowing directly from the input buffer without allocation.
//! - A `FooKindView<'a>` enum for each oneof, mirroring the owned `FooKind`
//!   but with borrowed variants.
//! - `impl MessageView<'a> for FooView<'a>`: provides `decode_view` (zero-copy
//!   decode) and `to_owned_message` (conversion to the owned type).

use crate::generated::descriptor::field_descriptor_proto::{Label, Type};
use crate::generated::descriptor::{DescriptorProto, FieldDescriptorProto, OneofDescriptorProto};
use proc_macro2::TokenStream;
use quote::{format_ident, quote};

use crate::context::{ancillary_prefix, AncillaryKind, CodeGenContext, MessageScope, SENTINEL_MOD};
use crate::features::ResolvedFeatures;
use crate::impl_message::{
    closed_enum_decode, closed_enum_decode_with_unknown, decode_fn_token, effective_type,
    effective_type_in_map_entry, field_string_repr, field_uses_bytes, find_map_entry_fields,
    is_explicit_presence_scalar, is_packed_type, is_real_oneof_member, is_required_field,
    is_supported_field_type, map_value_use_bytes, validated_field_number, wire_type_byte,
    wire_type_check, wire_type_token,
};
use crate::message::{is_closed_enum, is_map_field, make_field_ident, rust_path_to_tokens};
use crate::oneof::{is_null_value_field, serde_helper_path};
use crate::CodeGenError;

/// Token stream that pushes a closed-enum unknown value's raw wire span to
/// `view.__buffa_unknown_fields`. Requires `before_tag` and `cur` in scope
/// (the decode loop captures `before_tag` before reading the tag).
///
/// Returns empty tokens when `preserve_unknown_fields` is false. In that case
/// `closed_enum_decode_with_unknown` collapses to `closed_enum_decode`.
fn closed_enum_view_unknown_route(preserve_unknown_fields: bool) -> TokenStream {
    if preserve_unknown_fields {
        quote! {
            let __span_len = before_tag.len() - cur.len();
            view.__buffa_unknown_fields.push_raw(&before_tag[..__span_len]);
        }
    } else {
        quote! {}
    }
}

/// Convert a borrowed bytes view to the owned field type.
///
/// When `use_bytes_type()` is active for this field, emits
/// `::buffa::view::bytes_from_source(__buffa_src, expr)` so
/// `to_owned_from_source(Some(buf))` produces a zero-copy `Bytes::slice_ref`;
/// `None` falls back to `copy_from_slice`. Otherwise emits `(expr).to_vec()`.
///
/// `expr` may be `&[u8]` (singular/optional) or `&&[u8]` (repeated-iter,
/// oneof match-ergonomics). Both branches accept either: `.to_vec()` via
/// method auto-deref, `bytes_from_source`'s `&[u8]` arg via auto-deref.
fn bytes_to_owned(
    ctx: &CodeGenContext,
    proto_fqn: &str,
    field_name: &str,
    expr: TokenStream,
) -> TokenStream {
    if field_uses_bytes(ctx, proto_fqn, field_name) {
        quote! { ::buffa::view::bytes_from_source(__buffa_src, #expr) }
    } else {
        quote! { (#expr).to_vec() }
    }
}

/// `scope.nesting` is the **message-nesting** of the owning message (0 for
/// top-level). View structs are emitted into `__buffa::view::<msg_path>::`,
/// so the view body's total depth below the package root is
/// `scope.nesting + 2`; view-oneof enums go to
/// `__buffa::view::oneof::<msg_path>::`, depth `scope.nesting + 4`.
pub(crate) fn generate_view_with_nesting(
    scope: MessageScope<'_>,
    msg: &DescriptorProto,
    rust_name: &str,
) -> Result<(TokenStream, TokenStream), CodeGenError> {
    let MessageScope {
        ctx,
        current_package,
        proto_fqn,
        features,
        nesting,
    } = scope;

    // Note: nested views are generated by generate_message, not here.
    // This function only generates the view for the current message.

    let oneof_idents = crate::oneof::resolve_oneof_idents(msg);

    let view_ident = format_ident!("{}View", rust_name);

    // Total module depth of the view-struct body below the package root.
    // All field-type / decode-arm / to-owned helpers below resolve paths
    // relative to this depth, so pass `view_scope` (not `scope`).
    let view_depth = nesting + 2;
    let view_scope = MessageScope {
        nesting: view_depth,
        ..scope
    };
    // Path prefixes from the view struct's scope to its ancillary enums.
    let view_oneof_prefix = ancillary_prefix(
        AncillaryKind::ViewOneof,
        current_package,
        proto_fqn,
        view_depth,
    );
    let owned_oneof_prefix =
        ancillary_prefix(AncillaryKind::Oneof, current_package, proto_fqn, view_depth);

    // View struct fields (excludes real-oneof members, map fields, and
    // unsupported types like groups).
    let view_fields = msg
        .field
        .iter()
        .filter(|f| is_supported_field_type(f.r#type.unwrap_or_default()))
        .map(|f| view_struct_field(view_scope, msg, f))
        .collect::<Result<Vec<_>, _>>()?
        .into_iter()
        .flatten()
        .collect::<Vec<_>>();
    let direct_fields: Vec<&TokenStream> =
        view_fields.iter().map(|(tokens, _, _)| tokens).collect();

    // One `Option<Kind<'a>>` per non-synthetic oneof.
    let oneof_view_fields =
        oneof_view_struct_fields(ctx, msg, &view_oneof_prefix, features, &oneof_idents)?;
    let oneof_struct_fields: Vec<&TokenStream> =
        oneof_view_fields.iter().map(|(tokens, _)| tokens).collect();

    // Oneof view enum definitions (go into `__buffa::view::oneof::<msg>::`).
    let oneof_view_enums = msg
        .oneof_decl
        .iter()
        .enumerate()
        .map(|(idx, oneof)| generate_oneof_view_enum(scope, msg, idx, oneof, &oneof_idents))
        .collect::<Result<Vec<_>, _>>()?;

    // decode_view match arms.
    let (scalar_arms, repeated_arms, oneof_arms) =
        build_decode_arms(view_scope, msg, &view_oneof_prefix, &oneof_idents)?;

    // to_owned_message field initialisers.
    let owned_fields = build_to_owned_fields(
        view_scope,
        msg,
        &view_oneof_prefix,
        &owned_oneof_prefix,
        &oneof_idents,
    )?;

    let unknown_fields_field = if ctx.config.preserve_unknown_fields {
        quote! { pub __buffa_unknown_fields: ::buffa::UnknownFieldsView<'a>, }
    } else {
        quote! {}
    };
    let view_encode_methods = crate::impl_message::build_view_encode_methods(
        ctx,
        msg,
        ctx.config.preserve_unknown_fields,
        features,
        &oneof_idents,
        &view_oneof_prefix,
    )?;
    let view_encode_impl = quote! {
        impl<'a> ::buffa::ViewEncode<'a> for #view_ident<'a> {
            #view_encode_methods
        }
    };

    // The view participates in the same name-keyed registries as the
    // owned message — a generic event-sourcing dispatch should not have
    // to round-trip a zero-copy view through `to_owned_message()` just
    // to read its FQN. Same consts, different `Self`.
    let message_name_impl = crate::impl_message::message_name_impl(
        current_package,
        proto_fqn,
        &quote! { <'a> },
        &quote! { #view_ident<'a> },
    );

    let serialize_impl = if ctx.config.generate_json {
        crate::feature_gates::cfg_block(
            generate_view_serialize(
                view_scope,
                msg,
                &view_ident,
                &view_oneof_prefix,
                &oneof_idents,
            )?,
            ctx.config.feature_gates().json,
        )
    } else {
        quote! {}
    };

    // Vtable-mode reflection: `impl ReflectMessage` directly on the view.
    // Skipped for map entry synthetic messages (not registered in the pool by
    // name; consumers never reflect over them directly), matching the
    // bridge-mode `Reflectable` skip.
    let is_map_entry = msg
        .options
        .as_option()
        .is_some_and(|o| o.map_entry.unwrap_or(false));
    let reflect_view_impls =
        if ctx.config.generate_reflection && ctx.config.generate_reflection_vtable && !is_map_entry
        {
            // `reflect_view_impls` emits three sibling items (the ReflectMessage
            // impl, the ReflectElement impl, and an inherent impl for the
            // memoized index). `cfg_const_block` wraps them in a single
            // `#[cfg] const _` so one gate covers all three; a bare `cfg_block`
            // would gate only the first and leak the rest.
            crate::feature_gates::cfg_const_block(
                crate::reflect_view::reflect_view_impls(
                    view_scope,
                    msg,
                    &view_ident,
                    view_depth,
                    &view_oneof_prefix,
                    &oneof_idents,
                )?,
                ctx.config.feature_gates().reflect,
            )
        } else {
            quote! {}
        };

    // When preserving unknowns we capture `before_tag` so we can compute the
    // raw byte span after `skip_field` advances the cursor.
    let before_tag_capture = if ctx.config.preserve_unknown_fields {
        quote! { let before_tag = cur; }
    } else {
        quote! {}
    };
    let unknown_field_handling = if ctx.config.preserve_unknown_fields {
        quote! {
            let span_len = before_tag.len() - cur.len();
            view.__buffa_unknown_fields.push_raw(&before_tag[..span_len]);
        }
    } else {
        quote! {}
    };

    // If no field borrows from 'a (all-scalar message with unknown-fields
    // preservation disabled), inject PhantomData<&'a ()> so the struct's
    // lifetime param is used. _decode_depth(buf: &'a [u8]) requires 'a.
    let phantom_field =
        if message_view_has_borrowing_field(ctx, msg, features, ctx.config.preserve_unknown_fields)
        {
            quote! {}
        } else {
            quote! { #[doc(hidden)] pub __buffa_phantom: ::core::marker::PhantomData<&'a ()>, }
        };

    let mod_items = quote! {
        #(#oneof_view_enums)*
    };

    // Path from the view-struct scope (depth `nesting + 2`) to its owned
    // counterpart at the mirrored owned-tree position. Same package by
    // construction; `rust_type_relative` returns `super^(n+2)::<within>`.
    let owned_path: TokenStream = {
        let dotted = format!(".{proto_fqn}");
        let p = ctx
            .rust_type_relative(&dotted, current_package, view_depth)
            .ok_or_else(|| {
                CodeGenError::Other(format!(
                    "owned type for '{proto_fqn}' not resolvable from view tree"
                ))
            })?;
        rust_path_to_tokens(&p)
    };

    let view_doc =
        crate::comments::doc_attrs_resolved(ctx.comment(proto_fqn), proto_fqn, &ctx.type_map);

    // `FooOwnedView`: a `'static` OwnedView handle with per-field accessors.
    // Skipped for map-entry synthetic messages (never decoded standalone).
    let owned_view_wrapper = if is_map_entry {
        quote! {}
    } else {
        crate::owned_view::generate_owned_view_wrapper(
            view_scope,
            msg,
            rust_name,
            &view_ident,
            &owned_path,
            &view_oneof_prefix,
            &oneof_idents,
        )?
    };

    // Fields marked `[debug_redact = true]` print a placeholder instead of
    // their value. The `Debug` derive is swapped for a manual impl only when
    // at least one field is redacted, so unaffected views keep byte-identical
    // output. Oneof payload redaction is handled by the view-oneof enum.
    // Like the owned message's Debug impl, the manual impl lists proto fields
    // only — `__buffa_unknown_fields` is deliberately excluded because unknown
    // fields can carry redacted data from a newer schema version.
    let any_redacted = view_fields.iter().any(|(_, _, redacted)| *redacted);
    let (view_debug_derive, view_debug_impl) = if any_redacted {
        let placeholder = crate::message::DEBUG_REDACT_PLACEHOLDER;
        let view_name_str = view_ident.to_string();
        let mut debug_field_names: Vec<String> = Vec::new();
        let mut debug_field_values: Vec<TokenStream> = Vec::new();
        for (_, ident, redacted) in &view_fields {
            // Label matches what the derive prints: raw-ident fields
            // (`r#type`) show as `type`.
            debug_field_names.push(ident.to_string().trim_start_matches("r#").to_string());
            debug_field_values.push(if *redacted {
                quote! { &::core::format_args!(#placeholder) }
            } else {
                quote! { &self.#ident }
            });
        }
        for (_, ident) in &oneof_view_fields {
            debug_field_names.push(ident.to_string().trim_start_matches("r#").to_string());
            debug_field_values.push(quote! { &self.#ident });
        }
        (
            quote! { #[derive(Clone, Default)] },
            quote! {
                impl<'a> ::core::fmt::Debug for #view_ident<'a> {
                    fn fmt(&self, f: &mut ::core::fmt::Formatter<'_>) -> ::core::fmt::Result {
                        f.debug_struct(#view_name_str)
                            #(.field(#debug_field_names, #debug_field_values))*
                            .finish()
                    }
                }
            },
        )
    } else {
        (quote! { #[derive(Clone, Debug, Default)] }, quote! {})
    };

    let top_level = quote! {
        #view_doc
        #view_debug_derive
        pub struct #view_ident<'a> {
            #(#direct_fields)*
            #(#oneof_struct_fields)*
            #unknown_fields_field
            #phantom_field
        }

        #view_debug_impl

        impl<'a> #view_ident<'a> {
            /// Decode from `buf`, enforcing a recursion depth limit for nested messages.
            ///
            /// Called by [`::buffa::MessageView::decode_view`] with [`::buffa::RECURSION_LIMIT`]
            /// and by generated sub-message decode arms with `depth - 1`.
            ///
            /// **Not part of the public API.** Named with a leading underscore to
            /// signal that it is for generated-code use only.
            #[doc(hidden)]
            pub fn _decode_depth(
                buf: &'a [u8],
                depth: u32,
            ) -> ::core::result::Result<Self, ::buffa::DecodeError> {
                let mut view = Self::default();
                view._merge_into_view(buf, depth)?;
                ::core::result::Result::Ok(view)
            }

            /// Merge fields from `buf` into this view (proto merge semantics).
            ///
            /// Repeated fields append; singular fields last-wins; singular
            /// MESSAGE fields merge recursively. Used by sub-message decode
            /// arms when the same field appears multiple times on the wire.
            ///
            /// **Not part of the public API.**
            #[doc(hidden)]
            pub fn _merge_into_view(
                &mut self,
                buf: &'a [u8],
                depth: u32,
            ) -> ::core::result::Result<(), ::buffa::DecodeError> {
                // `depth` may be unused for messages with no nested sub-message fields.
                let _ = depth;
                // Rebind as `view` so the arm-generating functions (which emit
                // `view.#ident`) work unchanged.
                #[allow(unused_variables)]
                let view = self;
                let mut cur: &'a [u8] = buf;
                while !cur.is_empty() {
                    #before_tag_capture
                    let tag = ::buffa::encoding::Tag::decode(&mut cur)?;
                    match tag.field_number() {
                        #(#scalar_arms)*
                        #(#repeated_arms)*
                        #(#oneof_arms)*
                        _ => {
                            ::buffa::encoding::skip_field_depth(tag, &mut cur, depth)?;
                            #unknown_field_handling
                        }
                    }
                }
                ::core::result::Result::Ok(())
            }
        }

        impl<'a> ::buffa::MessageView<'a> for #view_ident<'a> {
            type Owned = #owned_path;

            fn decode_view(
                buf: &'a [u8],
            ) -> ::core::result::Result<Self, ::buffa::DecodeError> {
                Self::_decode_depth(buf, ::buffa::RECURSION_LIMIT)
            }

            fn decode_view_with_limit(
                buf: &'a [u8],
                depth: u32,
            ) -> ::core::result::Result<Self, ::buffa::DecodeError> {
                Self::_decode_depth(buf, depth)
            }

            fn to_owned_message(&self) -> #owned_path {
                self.to_owned_from_source(None)
            }

            // useless_conversion: __buffa_unknown_fields uses `.into()` to
            // unify the `UnknownFields` (no-wrapper) and `__<Name>ExtJson`
            // (generate_json wrapper) cases; no-op in the former.
            #[allow(clippy::useless_conversion, clippy::needless_update)]
            fn to_owned_from_source(
                &self,
                __buffa_src: ::core::option::Option<&::buffa::bytes::Bytes>,
            ) -> #owned_path {
                #[allow(unused_imports)]
                use ::buffa::alloc::string::ToString as _;
                let _ = __buffa_src;
                #owned_path {
                    #(#owned_fields)*
                    ..::core::default::Default::default()
                }
            }
        }

        #view_encode_impl

        #serialize_impl

        #message_name_impl

        impl<'v> ::buffa::DefaultViewInstance for #view_ident<'v> {
            fn default_view_instance<'a>() -> &'a Self
            where
                Self: 'a,
            {
                static VALUE: ::buffa::__private::OnceBox<#view_ident<'static>>
                    = ::buffa::__private::OnceBox::new();
                VALUE.get_or_init(|| ::buffa::alloc::boxed::Box::new(
                    <#view_ident<'static>>::default(),
                ))
            }
        }

        impl ::buffa::ViewReborrow for #view_ident<'static> {
            type Reborrowed<'b> = #view_ident<'b>;
            fn reborrow<'b>(this: &'b Self) -> &'b Self::Reborrowed<'b> {
                this
            }
        }

        #owned_view_wrapper

        #reflect_view_impls
    };

    Ok((top_level, mod_items))
}

// ---------------------------------------------------------------------------
// View struct field declarations
// ---------------------------------------------------------------------------

fn view_struct_field(
    scope: MessageScope<'_>,
    msg: &DescriptorProto,
    field: &FieldDescriptorProto,
) -> Result<Option<(TokenStream, proc_macro2::Ident, bool)>, CodeGenError> {
    let MessageScope { ctx, proto_fqn, .. } = scope;
    // Real oneof members go into the oneof enum, not directly on the struct.
    if is_real_oneof_member(field) {
        return Ok(None);
    }

    let field_name = field
        .name
        .as_deref()
        .ok_or(CodeGenError::MissingField("field.name"))?;
    let label = field.label.unwrap_or_default();
    let is_repeated = label == Label::LABEL_REPEATED;
    let field_fqn = format!("{}.{}", proto_fqn, field_name);
    let proto_comment = ctx.comment(&field_fqn);

    if is_repeated && is_map_field(msg, field) {
        let ident = make_field_ident(field_name);
        let number = field.number.unwrap_or(0);
        let tag_line = format!("Field {number}: `{field_name}` (map)");
        let doc = crate::comments::doc_attrs_with_tag_resolved(
            proto_comment,
            &tag_line,
            proto_fqn,
            &ctx.type_map,
        );
        let map_ty = view_map_type(scope, msg, field, &quote! { 'a })?;
        let tokens = quote! {
            #doc
            pub #ident: #map_ty,
        };
        return Ok(Some((
            tokens,
            ident,
            crate::message::is_debug_redacted(field),
        )));
    }

    let ident = make_field_ident(field_name);
    let number = field.number.unwrap_or(0);
    let tag_line = format!("Field {number}: `{field_name}`");
    let doc = crate::comments::doc_attrs_with_tag_resolved(
        proto_comment,
        &tag_line,
        proto_fqn,
        &ctx.type_map,
    );

    let rust_type = if is_repeated {
        view_repeated_type(scope, field, &quote! { 'a })?
    } else {
        view_singular_type(scope, field, &quote! { 'a })?
    };

    // Self-referential view fields (e.g. HttpRuleView.additional_bindings)
    // can use `Self` — inside `struct FooView<'a>`, `Self` means `FooView<'a>`
    // with the lifetime applied. Override only for message-typed, non-map
    // struct fields; decode and to_owned paths use the resolved type as-is
    // via the helper functions so no conflict there.
    let self_fqn = format!(".{proto_fqn}");
    let struct_ty = if field.type_name.as_deref() == Some(self_fqn.as_str()) {
        if is_repeated {
            quote! { ::buffa::RepeatedView<'a, Self> }
        } else {
            quote! { ::buffa::MessageFieldView<Self> }
        }
    } else {
        rust_type
    };

    let tokens = quote! {
        #doc
        pub #ident: #struct_ty,
    };
    Ok(Some((
        tokens,
        ident,
        crate::message::is_debug_redacted(field),
    )))
}

/// Field type for a singular (non-repeated, non-map) view field, with `lt` as
/// the borrow lifetime (`'a` inside the view struct, `'_` in accessor return
/// position on the generated owned-view wrapper).
pub(crate) fn view_singular_type(
    scope: MessageScope<'_>,
    field: &FieldDescriptorProto,
    lt: &TokenStream,
) -> Result<TokenStream, CodeGenError> {
    let MessageScope {
        ctx,
        features: parent_features,
        ..
    } = scope;
    let features = &crate::features::resolve_field(ctx, field, parent_features);
    let ty = effective_type(ctx, field, features);

    if is_explicit_presence_scalar(field, ty, features) {
        return Ok(match ty {
            Type::TYPE_STRING => quote! { ::core::option::Option<&#lt str> },
            Type::TYPE_BYTES => quote! { ::core::option::Option<&#lt [u8]> },
            Type::TYPE_ENUM => {
                let et = resolve_enum_ty(scope, field)?;
                if is_closed_enum(features) {
                    quote! { ::core::option::Option<#et> }
                } else {
                    quote! { ::core::option::Option<::buffa::EnumValue<#et>> }
                }
            }
            _ => {
                let st = scalar_ty(ty);
                quote! { ::core::option::Option<#st> }
            }
        });
    }

    match ty {
        Type::TYPE_STRING => Ok(quote! { &#lt str }),
        Type::TYPE_BYTES => Ok(quote! { &#lt [u8] }),
        Type::TYPE_MESSAGE | Type::TYPE_GROUP => {
            let view_ty = resolve_view_ty_tokens(scope, field, lt)?;
            Ok(quote! { ::buffa::MessageFieldView<#view_ty> })
        }
        Type::TYPE_ENUM => {
            let et = resolve_enum_ty(scope, field)?;
            if is_closed_enum(features) {
                Ok(quote! { #et })
            } else {
                Ok(quote! { ::buffa::EnumValue<#et> })
            }
        }
        _ => Ok(scalar_ty(ty)),
    }
}

/// Field type for a repeated (non-map) view field, with `lt` as the borrow
/// lifetime — see [`view_singular_type`].
pub(crate) fn view_repeated_type(
    scope: MessageScope<'_>,
    field: &FieldDescriptorProto,
    lt: &TokenStream,
) -> Result<TokenStream, CodeGenError> {
    let MessageScope {
        ctx,
        features: parent_features,
        ..
    } = scope;
    let features = &crate::features::resolve_field(ctx, field, parent_features);
    let ty = effective_type(ctx, field, features);
    match ty {
        Type::TYPE_STRING => Ok(quote! { ::buffa::RepeatedView<#lt, &#lt str> }),
        Type::TYPE_BYTES => Ok(quote! { ::buffa::RepeatedView<#lt, &#lt [u8]> }),
        Type::TYPE_MESSAGE | Type::TYPE_GROUP => {
            let view_ty = resolve_view_ty_tokens(scope, field, lt)?;
            Ok(quote! { ::buffa::RepeatedView<#lt, #view_ty> })
        }
        Type::TYPE_ENUM => {
            let et = resolve_enum_ty(scope, field)?;
            if is_closed_enum(features) {
                Ok(quote! { ::buffa::RepeatedView<#lt, #et> })
            } else {
                Ok(quote! { ::buffa::RepeatedView<#lt, ::buffa::EnumValue<#et>> })
            }
        }
        _ => {
            let st = scalar_ty(ty);
            Ok(quote! { ::buffa::RepeatedView<#lt, #st> })
        }
    }
}

/// Build the `::buffa::MapView<K, V>` type for a map field, with `lt` as the
/// borrow lifetime — see [`view_singular_type`].
pub(crate) fn view_map_type(
    scope: MessageScope<'_>,
    msg: &DescriptorProto,
    field: &FieldDescriptorProto,
    lt: &TokenStream,
) -> Result<TokenStream, CodeGenError> {
    let MessageScope { ctx, features, .. } = scope;
    let (key_fd, val_fd) = find_map_entry_fields(msg, field)?;

    let key_ty = match effective_type_in_map_entry(ctx, key_fd, features) {
        Type::TYPE_STRING => quote! { &#lt str },
        // utf8_validation = NONE on a string map key → &'a [u8].
        Type::TYPE_BYTES => quote! { &#lt [u8] },
        ty => scalar_ty(ty),
    };

    let val_ty = match effective_type_in_map_entry(ctx, val_fd, features) {
        Type::TYPE_STRING => quote! { &#lt str },
        Type::TYPE_BYTES => quote! { &#lt [u8] },
        Type::TYPE_MESSAGE => {
            let view_ty = resolve_view_ty_tokens(scope, val_fd, lt)?;
            quote! { #view_ty }
        }
        Type::TYPE_ENUM => {
            let et = resolve_enum_ty(scope, val_fd)?;
            let val_features = crate::features::resolve_field(ctx, val_fd, features);
            if is_closed_enum(&val_features) {
                quote! { #et }
            } else {
                quote! { ::buffa::EnumValue<#et> }
            }
        }
        ty => scalar_ty(ty),
    };

    Ok(quote! { ::buffa::MapView<#lt, #key_ty, #val_ty> })
}

/// Does the oneof's view enum need a `'a` lifetime parameter?
///
/// String/bytes/message/group variants borrow from the input buffer;
/// scalar and enum variants don't. An all-scalar oneof must not emit
/// `<'a>` or the unused-lifetime check (E0392) fires.
pub(crate) fn oneof_view_needs_lifetime(
    ctx: &CodeGenContext,
    fields: &[&FieldDescriptorProto],
    features: &ResolvedFeatures,
) -> bool {
    fields.iter().any(|f| {
        matches!(
            effective_type(ctx, f, features),
            Type::TYPE_STRING | Type::TYPE_BYTES | Type::TYPE_MESSAGE | Type::TYPE_GROUP
        )
    })
}

/// Does the message's view struct have any field that borrows from `'a`?
///
/// Repeated, map, string, bytes, message, group fields all use `'a`.
/// Only an all-scalar/enum message with `preserve_unknown_fields=false`
/// has no borrowing fields — in that case a PhantomData marker is needed
/// to keep the `<'a>` lifetime valid for `_decode_depth(buf: &'a [u8])`.
fn message_view_has_borrowing_field(
    ctx: &CodeGenContext,
    msg: &DescriptorProto,
    features: &ResolvedFeatures,
    preserve_unknown_fields: bool,
) -> bool {
    if preserve_unknown_fields {
        // UnknownFieldsView<'a> always uses 'a.
        return true;
    }
    for f in &msg.field {
        if is_real_oneof_member(f) {
            continue; // oneof members checked below via oneof_view_needs_lifetime
        }
        // Repeated and map fields always use 'a (RepeatedView<'a, T>, MapView<'a, K, V>).
        if f.label.unwrap_or_default()
            == crate::generated::descriptor::field_descriptor_proto::Label::LABEL_REPEATED
        {
            return true;
        }
        // Singular string/bytes/message/group borrow.
        if matches!(
            effective_type(ctx, f, features),
            Type::TYPE_STRING | Type::TYPE_BYTES | Type::TYPE_MESSAGE | Type::TYPE_GROUP
        ) {
            return true;
        }
    }
    // Check oneofs: an all-scalar oneof doesn't borrow, but one with a
    // string/bytes/message/group variant does.
    for (idx, _) in msg.oneof_decl.iter().enumerate() {
        let fields: Vec<_> = msg
            .field
            .iter()
            .filter(|f| is_real_oneof_member(f) && f.oneof_index == Some(idx as i32))
            .collect();
        if oneof_view_needs_lifetime(ctx, &fields, features) {
            return true;
        }
    }
    false
}

fn oneof_view_struct_fields(
    ctx: &CodeGenContext,
    msg: &DescriptorProto,
    view_oneof_prefix: &TokenStream,
    features: &ResolvedFeatures,
    oneof_idents: &std::collections::HashMap<usize, proc_macro2::Ident>,
) -> Result<Vec<(TokenStream, proc_macro2::Ident)>, CodeGenError> {
    let mut out = Vec::new();
    for (idx, oneof) in msg.oneof_decl.iter().enumerate() {
        let enum_ident = match oneof_idents.get(&idx) {
            Some(id) => id,
            None => continue,
        };
        let fields: Vec<_> = msg
            .field
            .iter()
            .filter(|f| is_real_oneof_member(f) && f.oneof_index == Some(idx as i32))
            .collect();
        if fields.is_empty() {
            continue;
        }
        let oneof_name = oneof
            .name
            .as_deref()
            .ok_or(CodeGenError::MissingField("oneof.name"))?;
        let field_ident = make_field_ident(oneof_name);
        let generics = if oneof_view_needs_lifetime(ctx, &fields, features) {
            quote! { <'a> }
        } else {
            quote! {}
        };
        let tokens = quote! {
            pub #field_ident: ::core::option::Option<#view_oneof_prefix #enum_ident #generics>,
        };
        out.push((tokens, field_ident));
    }
    Ok(out)
}

// ---------------------------------------------------------------------------
// Oneof view enum
// ---------------------------------------------------------------------------

fn generate_oneof_view_enum(
    scope: MessageScope<'_>,
    msg: &DescriptorProto,
    idx: usize,
    _oneof: &OneofDescriptorProto,
    oneof_idents: &std::collections::HashMap<usize, proc_macro2::Ident>,
) -> Result<TokenStream, CodeGenError> {
    let MessageScope { ctx, features, .. } = scope;
    let base_ident = match oneof_idents.get(&idx) {
        Some(id) => id,
        None => return Ok(TokenStream::new()),
    };

    let fields: Vec<_> = msg
        .field
        .iter()
        .filter(|f| is_real_oneof_member(f) && f.oneof_index == Some(idx as i32))
        .collect();

    if fields.is_empty() {
        return Ok(TokenStream::new());
    }

    // View-oneof enums share the owned oneof's identifier (no `View` suffix)
    // — the `__buffa::view::oneof::` tree position disambiguates. They live
    // at depth `msg_nesting + 4` (sentinel + view + oneof + msg_path).
    let enum_body_depth = scope.nesting + 4;
    let body_scope = MessageScope {
        nesting: enum_body_depth,
        ..scope
    };

    let variants = fields
        .iter()
        .map(|f| {
            let name = f
                .name
                .as_deref()
                .ok_or(CodeGenError::MissingField("field.name"))?;
            let variant = crate::oneof::oneof_variant_ident(name);
            let ty = effective_type(ctx, f, features);
            let f_features = crate::features::resolve_field(ctx, f, features);
            let vty = match ty {
                Type::TYPE_STRING => quote! { &'a str },
                Type::TYPE_BYTES => quote! { &'a [u8] },
                Type::TYPE_MESSAGE | Type::TYPE_GROUP => {
                    let view_ty = resolve_view_ty_tokens(body_scope, f, &quote! { 'a })?;
                    quote! { ::buffa::alloc::boxed::Box<#view_ty> }
                }
                Type::TYPE_ENUM => {
                    let et = resolve_enum_ty(body_scope, f)?;
                    if is_closed_enum(&f_features) {
                        quote! { #et }
                    } else {
                        quote! { ::buffa::EnumValue<#et> }
                    }
                }
                _ => scalar_ty(ty),
            };
            Ok(quote! { #variant(#vty) })
        })
        .collect::<Result<Vec<_>, CodeGenError>>()?;

    let generics = if oneof_view_needs_lifetime(ctx, &fields, features) {
        quote! { <'a> }
    } else {
        quote! {}
    };

    // Variants whose field is `[debug_redact = true]` print a placeholder
    // instead of their payload (same rule as the owned oneof enum).
    let any_redacted = fields.iter().any(|f| crate::message::is_debug_redacted(f));
    let (debug_derive, debug_impl) = if any_redacted {
        let placeholder = crate::message::DEBUG_REDACT_PLACEHOLDER;
        let arms = fields
            .iter()
            .map(|field| {
                let name = field
                    .name
                    .as_deref()
                    .ok_or(CodeGenError::MissingField("field.name"))?;
                let ident = crate::oneof::oneof_variant_ident(name);
                let label = ident.to_string();
                Ok(if crate::message::is_debug_redacted(field) {
                    quote! {
                        Self::#ident(_) => f
                            .debug_tuple(#label)
                            .field(&::core::format_args!(#placeholder))
                            .finish(),
                    }
                } else {
                    quote! {
                        Self::#ident(value) => f.debug_tuple(#label).field(value).finish(),
                    }
                })
            })
            .collect::<Result<Vec<_>, CodeGenError>>()?;
        (
            quote! { #[derive(Clone)] },
            quote! {
                impl #generics ::core::fmt::Debug for #base_ident #generics {
                    fn fmt(&self, f: &mut ::core::fmt::Formatter<'_>) -> ::core::fmt::Result {
                        match self {
                            #(#arms)*
                        }
                    }
                }
            },
        )
    } else {
        (quote! { #[derive(Clone, Debug)] }, quote! {})
    };

    Ok(quote! {
        #debug_derive
        pub enum #base_ident #generics {
            #(#variants,)*
        }

        #debug_impl
    })
}

// ---------------------------------------------------------------------------
// decode_view match arms
// ---------------------------------------------------------------------------

#[allow(clippy::type_complexity)]
fn build_decode_arms(
    scope: MessageScope<'_>,
    msg: &DescriptorProto,
    view_oneof_prefix: &TokenStream,
    oneof_idents: &std::collections::HashMap<usize, proc_macro2::Ident>,
) -> Result<(Vec<TokenStream>, Vec<TokenStream>, Vec<TokenStream>), CodeGenError> {
    let scalar_fields: Vec<_> = msg
        .field
        .iter()
        .filter(|f| {
            if is_real_oneof_member(f) {
                return false;
            }
            f.label.unwrap_or_default() != Label::LABEL_REPEATED
                && is_supported_field_type(f.r#type.unwrap_or_default())
        })
        .collect();
    let scalar_arms = scalar_fields
        .iter()
        .map(|f| scalar_decode_arm(scope, f))
        .collect::<Result<Vec<_>, _>>()?;

    let repeated_fields: Vec<_> = msg
        .field
        .iter()
        .filter(|f| {
            f.label.unwrap_or_default() == Label::LABEL_REPEATED
                && !is_map_field(msg, f)
                && is_supported_field_type(f.r#type.unwrap_or_default())
        })
        .collect();
    let mut repeated_arms: Vec<_> = repeated_fields
        .iter()
        .map(|f| repeated_decode_arm(scope, f))
        .collect::<Result<Vec<_>, _>>()?;

    // Map fields: decode entries into MapView.
    let map_fields: Vec<_> = msg
        .field
        .iter()
        .filter(|f| f.label.unwrap_or_default() == Label::LABEL_REPEATED && is_map_field(msg, f))
        .collect();
    let map_arms = map_fields
        .iter()
        .map(|f| map_decode_arm(scope, msg, f))
        .collect::<Result<Vec<_>, _>>()?;
    repeated_arms.extend(map_arms);

    let mut oneof_arms: Vec<TokenStream> = Vec::new();
    for (idx, oneof) in msg.oneof_decl.iter().enumerate() {
        let base_ident = match oneof_idents.get(&idx) {
            Some(id) => id,
            None => continue,
        };
        let oneof_name = oneof
            .name
            .as_deref()
            .ok_or(CodeGenError::MissingField("oneof.name"))?;
        let fields: Vec<_> = msg
            .field
            .iter()
            .filter(|f| is_real_oneof_member(f) && f.oneof_index == Some(idx as i32))
            .collect();
        oneof_arms.extend(oneof_decode_arms(
            scope,
            base_ident,
            oneof_name,
            &fields,
            view_oneof_prefix,
        )?);
    }

    Ok((scalar_arms, repeated_arms, oneof_arms))
}

fn scalar_decode_arm(
    scope: MessageScope<'_>,
    field: &FieldDescriptorProto,
) -> Result<TokenStream, CodeGenError> {
    let MessageScope {
        ctx,
        features: parent_features,
        ..
    } = scope;
    let preserve_unknown_fields = ctx.config.preserve_unknown_fields;
    let features = &crate::features::resolve_field(ctx, field, parent_features);
    let field_name = field
        .name
        .as_deref()
        .ok_or(CodeGenError::MissingField("field.name"))?;
    let field_number = validated_field_number(field)?;
    let ty = effective_type(ctx, field, features);
    let ident = make_field_ident(field_name);
    let wire_type = wire_type_token(ty);
    let expected_byte = wire_type_byte(ty);

    let wire_check = wire_type_check(field_number, &wire_type, expected_byte);

    if is_explicit_presence_scalar(field, ty, features) {
        let assign = match ty {
            Type::TYPE_STRING => {
                quote! { view.#ident = Some(::buffa::types::borrow_str(&mut cur)?); }
            }
            Type::TYPE_BYTES => {
                quote! { view.#ident = Some(::buffa::types::borrow_bytes(&mut cur)?); }
            }
            Type::TYPE_ENUM => {
                if is_closed_enum(features) {
                    let unknown_route = closed_enum_view_unknown_route(preserve_unknown_fields);
                    closed_enum_decode_with_unknown(
                        &quote! { &mut cur },
                        quote! { view.#ident = Some(__v); },
                        unknown_route,
                    )
                } else {
                    quote! {
                        view.#ident = Some(::buffa::EnumValue::from(::buffa::types::decode_int32(&mut cur)?));
                    }
                }
            }
            _ => {
                let dfn = decode_fn_token(ty);
                quote! { view.#ident = Some(#dfn(&mut cur)?); }
            }
        };
        return Ok(quote! { #field_number => { #wire_check #assign } });
    }

    let assign = match ty {
        Type::TYPE_STRING => quote! { view.#ident = ::buffa::types::borrow_str(&mut cur)?; },
        Type::TYPE_BYTES => quote! { view.#ident = ::buffa::types::borrow_bytes(&mut cur)?; },
        Type::TYPE_ENUM => {
            if is_closed_enum(features) {
                let unknown_route = closed_enum_view_unknown_route(preserve_unknown_fields);
                closed_enum_decode_with_unknown(
                    &quote! { &mut cur },
                    quote! { view.#ident = __v; },
                    unknown_route,
                )
            } else {
                quote! { view.#ident = ::buffa::EnumValue::from(::buffa::types::decode_int32(&mut cur)?); }
            }
        }
        Type::TYPE_MESSAGE => {
            let vt = resolve_view_decode_tokens(scope, field)?;
            quote! {
                if depth == 0 {
                    return Err(::buffa::DecodeError::RecursionLimitExceeded);
                }
                let sub = ::buffa::types::borrow_bytes(&mut cur)?;
                // Proto merge semantics: if this field appeared before,
                // merge the new bytes into the existing view.
                match view.#ident.as_mut() {
                    Some(existing) => existing._merge_into_view(sub, depth - 1)?,
                    None => view.#ident = ::buffa::MessageFieldView::set(
                        #vt::_decode_depth(sub, depth - 1)?
                    ),
                }
            }
        }
        Type::TYPE_GROUP => {
            let vt = resolve_view_decode_tokens(scope, field)?;
            quote! {
                if depth == 0 {
                    return Err(::buffa::DecodeError::RecursionLimitExceeded);
                }
                let sub = ::buffa::types::borrow_group(&mut cur, #field_number, depth - 1)?;
                match view.#ident.as_mut() {
                    Some(existing) => existing._merge_into_view(sub, depth - 1)?,
                    None => view.#ident = ::buffa::MessageFieldView::set(
                        #vt::_decode_depth(sub, depth - 1)?
                    ),
                }
            }
        }
        _ => {
            let dfn = decode_fn_token(ty);
            quote! { view.#ident = #dfn(&mut cur)?; }
        }
    };

    Ok(quote! { #field_number => { #wire_check #assign } })
}

fn repeated_decode_arm(
    scope: MessageScope<'_>,
    field: &FieldDescriptorProto,
) -> Result<TokenStream, CodeGenError> {
    let MessageScope {
        ctx,
        features: parent_features,
        ..
    } = scope;
    let preserve_unknown_fields = ctx.config.preserve_unknown_fields;
    let features = &crate::features::resolve_field(ctx, field, parent_features);
    let field_name = field
        .name
        .as_deref()
        .ok_or(CodeGenError::MissingField("field.name"))?;
    let field_number = validated_field_number(field)?;
    let ty = effective_type(ctx, field, features);
    let ident = make_field_ident(field_name);

    // Message: always LengthDelimited, unpacked.
    if ty == Type::TYPE_MESSAGE {
        let ld_check = wire_type_check(
            field_number,
            &quote! { ::buffa::encoding::WireType::LengthDelimited },
            2u8,
        );
        let vt = resolve_view_decode_tokens(scope, field)?;
        return Ok(quote! {
            #field_number => {
                #ld_check
                if depth == 0 {
                    return Err(::buffa::DecodeError::RecursionLimitExceeded);
                }
                let sub = ::buffa::types::borrow_bytes(&mut cur)?;
                view.#ident.push(#vt::_decode_depth(sub, depth - 1)?);
            }
        });
    }

    // Group: StartGroup wire type, unpacked.
    if ty == Type::TYPE_GROUP {
        let sg_check = wire_type_check(
            field_number,
            &quote! { ::buffa::encoding::WireType::StartGroup },
            3u8,
        );
        let vt = resolve_view_decode_tokens(scope, field)?;
        return Ok(quote! {
            #field_number => {
                #sg_check
                if depth == 0 {
                    return Err(::buffa::DecodeError::RecursionLimitExceeded);
                }
                let sub = ::buffa::types::borrow_group(&mut cur, #field_number, depth - 1)?;
                view.#ident.push(#vt::_decode_depth(sub, depth - 1)?);
            }
        });
    }

    // String and bytes: unpacked only (no packed encoding for LD types).
    if !is_packed_type(ty) {
        let ld_check = wire_type_check(
            field_number,
            &quote! { ::buffa::encoding::WireType::LengthDelimited },
            2u8,
        );
        let borrow = match ty {
            Type::TYPE_STRING => quote! { ::buffa::types::borrow_str(&mut cur)? },
            Type::TYPE_BYTES => quote! { ::buffa::types::borrow_bytes(&mut cur)? },
            // Message and group are handled by early returns above; the
            // remaining types satisfy `is_packed_type` and never reach this
            // unpacked branch. Enumerated so adding a `Type` variant is a
            // compile error here rather than a runtime panic during codegen.
            Type::TYPE_MESSAGE
            | Type::TYPE_GROUP
            | Type::TYPE_ENUM
            | Type::TYPE_BOOL
            | Type::TYPE_INT32
            | Type::TYPE_INT64
            | Type::TYPE_UINT32
            | Type::TYPE_UINT64
            | Type::TYPE_SINT32
            | Type::TYPE_SINT64
            | Type::TYPE_FIXED32
            | Type::TYPE_FIXED64
            | Type::TYPE_SFIXED32
            | Type::TYPE_SFIXED64
            | Type::TYPE_FLOAT
            | Type::TYPE_DOUBLE => {
                unreachable!("view repeated decode arm: unhandled unpacked type {:?}", ty)
            }
        };
        return Ok(quote! {
            #field_number => {
                #ld_check
                view.#ident.push(#borrow);
            }
        });
    }

    // Packed numeric/enum: accept both packed (LengthDelimited) and unpacked.
    let elem_wire_type = wire_type_token(ty);
    let closed = is_closed_enum(features);
    let push_known = quote! { view.#ident.push(__v); };
    let packed_elem = if ty == Type::TYPE_ENUM {
        if closed {
            closed_enum_decode(&quote! { &mut pcur }, push_known.clone())
        } else {
            quote! { view.#ident.push(::buffa::EnumValue::from(::buffa::types::decode_int32(&mut pcur)?)); }
        }
    } else {
        let dfn = decode_fn_token(ty);
        quote! { view.#ident.push(#dfn(&mut pcur)?); }
    };

    // Fixed-size types can reserve the exact element count. For varints and
    // bools, every element occupies at least one byte, so the payload length
    // is a safe upper bound.
    let reserve_divisor: usize = match ty {
        Type::TYPE_FIXED32 | Type::TYPE_SFIXED32 | Type::TYPE_FLOAT => 4,
        Type::TYPE_FIXED64 | Type::TYPE_SFIXED64 | Type::TYPE_DOUBLE => 8,
        _ => 1,
    };
    let reserve_stmt = if reserve_divisor > 1 {
        quote! { view.#ident.reserve(payload.len() / #reserve_divisor); }
    } else {
        quote! { view.#ident.reserve(payload.len()); }
    };

    let unpacked_elem = if ty == Type::TYPE_ENUM {
        if closed {
            // Unpacked: each element has its own tag, so `before_tag` captures
            // the per-element span. Packed (above) can't do this — the tag
            // covers the whole blob — so packed unknowns are still dropped.
            let unknown_route = closed_enum_view_unknown_route(preserve_unknown_fields);
            closed_enum_decode_with_unknown(&quote! { &mut cur }, push_known, unknown_route)
        } else {
            quote! { view.#ident.push(::buffa::EnumValue::from(::buffa::types::decode_int32(&mut cur)?)); }
        }
    } else {
        let dfn = decode_fn_token(ty);
        quote! { view.#ident.push(#dfn(&mut cur)?); }
    };

    Ok(quote! {
        #field_number => {
            if tag.wire_type() == ::buffa::encoding::WireType::LengthDelimited {
                // Packed: extract payload, decode elements via local cursor.
                let payload = ::buffa::types::borrow_bytes(&mut cur)?;
                #reserve_stmt
                let mut pcur: &[u8] = payload;
                while !pcur.is_empty() { #packed_elem }
            } else if tag.wire_type() == #elem_wire_type {
                // Unpacked (backward-compat with old encoders).
                #unpacked_elem
            } else {
                return Err(::buffa::DecodeError::WireTypeMismatch {
                    field_number: #field_number,
                    expected: 2u8,
                    actual: tag.wire_type() as u8,
                });
            }
        }
    })
}

fn map_decode_arm(
    scope: MessageScope<'_>,
    msg: &DescriptorProto,
    field: &FieldDescriptorProto,
) -> Result<TokenStream, CodeGenError> {
    let MessageScope { ctx, features, .. } = scope;
    let field_name = field
        .name
        .as_deref()
        .ok_or(CodeGenError::MissingField("field.name"))?;
    let field_number = validated_field_number(field)?;
    let ident = make_field_ident(field_name);
    let (key_fd, val_fd) = find_map_entry_fields(msg, field)?;

    let ld_check = wire_type_check(
        field_number,
        &quote! { ::buffa::encoding::WireType::LengthDelimited },
        2u8,
    );

    // Default values for key and value when the entry sub-message omits them.
    let key_default = match effective_type_in_map_entry(ctx, key_fd, features) {
        Type::TYPE_STRING => quote! { "" },
        Type::TYPE_BYTES => quote! { &[][..] },
        _ => quote! { ::core::default::Default::default() },
    };
    let val_default = match effective_type_in_map_entry(ctx, val_fd, features) {
        Type::TYPE_STRING => quote! { "" },
        Type::TYPE_BYTES => quote! { &[][..] },
        _ => quote! { ::core::default::Default::default() },
    };

    let decode_key = map_view_entry_decode(scope, key_fd, &format_ident!("key"))?;
    let decode_val = map_view_entry_decode(scope, val_fd, &format_ident!("val"))?;

    Ok(quote! {
        #field_number => {
            #ld_check
            let entry_bytes = ::buffa::types::borrow_bytes(&mut cur)?;
            let mut entry_cur: &'a [u8] = entry_bytes;
            let mut key = #key_default;
            let mut val = #val_default;
            while !entry_cur.is_empty() {
                let entry_tag = ::buffa::encoding::Tag::decode(&mut entry_cur)?;
                match entry_tag.field_number() {
                    1 => { #decode_key }
                    2 => { #decode_val }
                    _ => { ::buffa::encoding::skip_field_depth(entry_tag, &mut entry_cur, depth)?; }
                }
            }
            view.#ident.push(key, val);
        }
    })
}

/// Generate the decode statement for one field inside a map-entry sub-message.
///
/// Uses zero-copy `borrow_str`/`borrow_bytes` for string/bytes fields and
/// decodes message values into view types.
fn map_view_entry_decode(
    scope: MessageScope<'_>,
    fd: &FieldDescriptorProto,
    var: &proc_macro2::Ident,
) -> Result<TokenStream, CodeGenError> {
    let MessageScope {
        ctx,
        features: parent_features,
        ..
    } = scope;
    let features = &crate::features::resolve_field(ctx, fd, parent_features);
    let ty = effective_type_in_map_entry(ctx, fd, features);
    let wire_type = wire_type_token(ty);
    let wire_byte = wire_type_byte(ty);
    let tag_check = quote! {
        if entry_tag.wire_type() != #wire_type {
            return ::core::result::Result::Err(::buffa::DecodeError::WireTypeMismatch {
                field_number: entry_tag.field_number(),
                expected: #wire_byte,
                actual: entry_tag.wire_type() as u8,
            });
        }
    };

    let assign = match ty {
        Type::TYPE_STRING => quote! { #var = ::buffa::types::borrow_str(&mut entry_cur)?; },
        Type::TYPE_BYTES => quote! { #var = ::buffa::types::borrow_bytes(&mut entry_cur)?; },
        Type::TYPE_ENUM => {
            if is_closed_enum(features) {
                closed_enum_decode(&quote! { &mut entry_cur }, quote! { #var = __v; })
            } else {
                quote! { #var = ::buffa::EnumValue::from(::buffa::types::decode_int32(&mut entry_cur)?); }
            }
        }
        Type::TYPE_MESSAGE => {
            let vt = resolve_view_decode_tokens(scope, fd)?;
            quote! {
                if depth == 0 {
                    return Err(::buffa::DecodeError::RecursionLimitExceeded);
                }
                let sub = ::buffa::types::borrow_bytes(&mut entry_cur)?;
                #var = #vt::_decode_depth(sub, depth - 1)?;
            }
        }
        _ => {
            let dfn = decode_fn_token(ty);
            quote! { #var = #dfn(&mut entry_cur)?; }
        }
    };

    Ok(quote! { #tag_check #assign })
}

fn oneof_decode_arms(
    scope: MessageScope<'_>,
    base_ident: &proc_macro2::Ident,
    oneof_name: &str,
    fields: &[&FieldDescriptorProto],
    view_oneof_prefix: &TokenStream,
) -> Result<Vec<TokenStream>, CodeGenError> {
    let MessageScope { ctx, features, .. } = scope;
    let preserve_unknown_fields = ctx.config.preserve_unknown_fields;
    let field_ident = make_field_ident(oneof_name);
    let view_enum: TokenStream = quote! { #view_oneof_prefix #base_ident };

    fields
        .iter()
        .map(|field| {
            let name = field
                .name
                .as_deref()
                .ok_or(CodeGenError::MissingField("field.name"))?;
            let field_number = validated_field_number(field)?;
            let ty = effective_type(ctx, field, features);
            let field_features = crate::features::resolve_field(ctx, field, features);
            let variant = crate::oneof::oneof_variant_ident(name);
            let wire_type = wire_type_token(ty);
            let expected_byte = wire_type_byte(ty);
            let wire_check = wire_type_check(field_number, &wire_type, expected_byte);

            let value = match ty {
                Type::TYPE_STRING => quote! { ::buffa::types::borrow_str(&mut cur)? },
                Type::TYPE_BYTES => quote! { ::buffa::types::borrow_bytes(&mut cur)? },
                Type::TYPE_MESSAGE => {
                    let vt = resolve_view_decode_tokens(scope, field)?;
                    // Proto merge semantics: if this same variant is already set,
                    // merge into the existing boxed view rather than replacing.
                    // Uses an early `return Ok(...)` since the merge path doesn't
                    // fit the `value` expression shape used by scalar variants.
                    return Ok(quote! {
                        #field_number => {
                            #wire_check
                            if depth == 0 {
                                return Err(::buffa::DecodeError::RecursionLimitExceeded);
                            }
                            let sub = ::buffa::types::borrow_bytes(&mut cur)?;
                            if let Some(#view_enum::#variant(ref mut existing)) = view.#field_ident {
                                existing._merge_into_view(sub, depth - 1)?;
                            } else {
                                view.#field_ident = Some(#view_enum::#variant(
                                    ::buffa::alloc::boxed::Box::new(
                                        #vt::_decode_depth(sub, depth - 1)?
                                    )
                                ));
                            }
                        }
                    });
                }
                Type::TYPE_GROUP => {
                    let vt = resolve_view_decode_tokens(scope, field)?;
                    return Ok(quote! {
                        #field_number => {
                            #wire_check
                            if depth == 0 {
                                return Err(::buffa::DecodeError::RecursionLimitExceeded);
                            }
                            let sub = ::buffa::types::borrow_group(&mut cur, #field_number, depth - 1)?;
                            if let Some(#view_enum::#variant(ref mut existing)) = view.#field_ident {
                                existing._merge_into_view(sub, depth - 1)?;
                            } else {
                                view.#field_ident = Some(#view_enum::#variant(
                                    ::buffa::alloc::boxed::Box::new(
                                        #vt::_decode_depth(sub, depth - 1)?
                                    )
                                ));
                            }
                        }
                    });
                }
                Type::TYPE_ENUM => {
                    if is_closed_enum(&field_features) {
                        let unknown_route =
                            closed_enum_view_unknown_route(preserve_unknown_fields);
                        let decode = closed_enum_decode_with_unknown(
                            &quote! { &mut cur },
                            quote! { view.#field_ident = Some(#view_enum::#variant(__v)); },
                            unknown_route,
                        );
                        return Ok(quote! {
                            #field_number => {
                                #wire_check
                                #decode
                            }
                        });
                    }
                    quote! { ::buffa::EnumValue::from(::buffa::types::decode_int32(&mut cur)?) }
                }
                _ => {
                    let dfn = decode_fn_token(ty);
                    quote! { #dfn(&mut cur)? }
                }
            };

            Ok(quote! {
                #field_number => {
                    #wire_check
                    view.#field_ident = Some(#view_enum::#variant(#value));
                }
            })
        })
        .collect()
}

// ---------------------------------------------------------------------------
// to_owned_message field initialisers
// ---------------------------------------------------------------------------

fn build_to_owned_fields(
    scope: MessageScope<'_>,
    msg: &DescriptorProto,
    view_oneof_prefix: &TokenStream,
    owned_oneof_prefix: &TokenStream,
    oneof_idents: &std::collections::HashMap<usize, proc_macro2::Ident>,
) -> Result<Vec<TokenStream>, CodeGenError> {
    let MessageScope { ctx, features, .. } = scope;
    let preserve_unknown_fields = ctx.config.preserve_unknown_fields;
    let mut out = Vec::new();

    for field in &msg.field {
        // Real oneof members are handled below per-group.
        if is_real_oneof_member(field) {
            continue;
        }
        let name = field
            .name
            .as_deref()
            .ok_or(CodeGenError::MissingField("field.name"))?;
        let ident = make_field_ident(name);
        let is_repeated = field.label.unwrap_or_default() == Label::LABEL_REPEATED;
        if is_repeated && is_map_field(msg, field) {
            let expr = map_to_owned_expr(scope, msg, field, &ident)?;
            out.push(quote! { #ident: #expr, });
            continue;
        }
        let ty = effective_type(ctx, field, features);
        let init = if is_repeated {
            repeated_to_owned(scope, ty, &ident, name)
        } else {
            singular_to_owned(scope, field, ty, &ident, name)?
        };
        out.push(quote! { #ident: #init, });
    }

    // Oneof groups.
    for (idx, oneof) in msg.oneof_decl.iter().enumerate() {
        let base_ident = match oneof_idents.get(&idx) {
            Some(id) => id,
            None => continue,
        };
        let oneof_name = oneof
            .name
            .as_deref()
            .ok_or(CodeGenError::MissingField("oneof.name"))?;
        let group: Vec<_> = msg
            .field
            .iter()
            .filter(|f| is_real_oneof_member(f) && f.oneof_index == Some(idx as i32))
            .collect();
        if group.is_empty() {
            continue;
        }
        let field_ident = make_field_ident(oneof_name);
        let view_enum: TokenStream = quote! { #view_oneof_prefix #base_ident };
        let owned_enum: TokenStream = quote! { #owned_oneof_prefix #base_ident };

        let match_arms = group
            .iter()
            .map(|f| {
                let fname = f
                    .name
                    .as_deref()
                    .ok_or(CodeGenError::MissingField("field.name"))?;
                let variant = crate::oneof::oneof_variant_ident(fname);
                let ty = effective_type(ctx, f, features);
                let conv = oneof_variant_to_owned(scope, ty, oneof_name, fname);
                Ok(quote! {
                    #view_enum::#variant(v) => #owned_enum::#variant(#conv),
                })
            })
            .collect::<Result<Vec<_>, CodeGenError>>()?;

        out.push(quote! {
            #field_ident: self.#field_ident.as_ref().map(|v| match v { #(#match_arms)* }),
        });
    }

    // Emit `unknown_fields` conversion so round-trip via decode_view +
    // to_owned_message preserves unknown fields. `.into()` is a no-op when
    // the owned field is `UnknownFields`; when generate_json is on it wraps
    // in the per-message `__<Name>ExtJson` newtype (which has `From<UnknownFields>`).
    if preserve_unknown_fields {
        out.push(quote! {
            __buffa_unknown_fields: self
                .__buffa_unknown_fields
                .to_owned()
                .unwrap_or_default()
                .into(),
        });
    }

    Ok(out)
}

/// Convert a string view binding to the owned `string`-field type.
///
/// The default `String` keeps the original `binding.to_string()` (which
/// auto-derefs through a `&&str` binding), so default output is byte-identical
/// to before this knob existed. Other representations build via `From<&str>`
/// with the owned field type driving `Into` inference; `Into::into` takes its
/// argument by value and does not auto-deref, so `double_ref` sites (iterator
/// and match-ergonomics bindings that are `&&str`) get one explicit `*`.
fn str_view_to_owned(
    repr: crate::StringRepr,
    binding: TokenStream,
    double_ref: bool,
) -> TokenStream {
    if repr.is_default() {
        quote! { #binding.to_string() }
    } else if double_ref {
        quote! { ::core::convert::Into::into(*#binding) }
    } else {
        quote! { ::core::convert::Into::into(#binding) }
    }
}

fn singular_to_owned(
    scope: MessageScope<'_>,
    field: &FieldDescriptorProto,
    ty: Type,
    ident: &proc_macro2::Ident,
    field_name: &str,
) -> Result<TokenStream, CodeGenError> {
    let MessageScope {
        ctx,
        proto_fqn,
        features,
        ..
    } = scope;
    if is_explicit_presence_scalar(field, ty, features) {
        return Ok(match ty {
            Type::TYPE_STRING => {
                // Option<&str>::map. The default keeps `|s| s.to_string()`; for
                // other reprs pass the `Into::into` fn directly rather than
                // wrapping it in a closure (avoids clippy::redundant_closure in
                // the consumer crate). Inference picks the target from the field.
                if field_string_repr(ctx, proto_fqn, field_name).is_default() {
                    quote! { self.#ident.map(|s| s.to_string()) }
                } else {
                    quote! { self.#ident.map(::core::convert::Into::into) }
                }
            }
            Type::TYPE_BYTES => {
                let conv = bytes_to_owned(ctx, proto_fqn, field_name, quote! { b });
                quote! { self.#ident.map(|b| #conv) }
            }
            _ => quote! { self.#ident },
        });
    }
    Ok(match ty {
        Type::TYPE_STRING => str_view_to_owned(
            field_string_repr(ctx, proto_fqn, field_name),
            quote! { self.#ident },
            false,
        ),
        Type::TYPE_BYTES => bytes_to_owned(ctx, proto_fqn, field_name, quote! { self.#ident }),
        Type::TYPE_MESSAGE | Type::TYPE_GROUP => {
            let owned_path = resolve_owned_path(scope, field)?;
            // Use rust_path_to_tokens, not syn::parse_str: the latter chokes
            // on keyword segments like `super::super::type::LatLng`.
            let owned_ty = crate::message::rust_path_to_tokens(&owned_path);
            quote! {
                match self.#ident.as_option() {
                    Some(v) => ::buffa::MessageField::<#owned_ty>::some(
                        v.to_owned_from_source(__buffa_src),
                    ),
                    None => ::buffa::MessageField::none(),
                }
            }
        }
        _ => quote! { self.#ident },
    })
}

fn repeated_to_owned(
    scope: MessageScope<'_>,
    ty: Type,
    ident: &proc_macro2::Ident,
    field_name: &str,
) -> TokenStream {
    let MessageScope { ctx, proto_fqn, .. } = scope;
    match ty {
        Type::TYPE_STRING => {
            // RepeatedView<&str>::iter() yields `&&str` (double ref).
            let conv = str_view_to_owned(
                field_string_repr(ctx, proto_fqn, field_name),
                quote! { s },
                true,
            );
            quote! { self.#ident.iter().map(|s| #conv).collect() }
        }
        Type::TYPE_BYTES => {
            // Vec<&[u8]>::iter() → b: &&[u8]. bytes_to_owned handles double-ref.
            let conv = bytes_to_owned(ctx, proto_fqn, field_name, quote! { b });
            quote! { self.#ident.iter().map(|b| #conv).collect() }
        }
        Type::TYPE_MESSAGE | Type::TYPE_GROUP => {
            quote! { self.#ident.iter().map(|v| v.to_owned_from_source(__buffa_src)).collect() }
        }
        _ => quote! { self.#ident.to_vec() },
    }
}

fn map_to_owned_expr(
    scope: MessageScope<'_>,
    msg: &DescriptorProto,
    field: &FieldDescriptorProto,
    ident: &proc_macro2::Ident,
) -> Result<TokenStream, CodeGenError> {
    let MessageScope {
        ctx,
        proto_fqn,
        features,
        ..
    } = scope;
    let (key_fd, val_fd) = find_map_entry_fields(msg, field)?;
    let field_name = field
        .name
        .as_deref()
        .ok_or(CodeGenError::MissingField("field.name"))?;
    let key_ty = effective_type_in_map_entry(ctx, key_fd, features);
    let val_ty = effective_type_in_map_entry(ctx, val_fd, features);

    let key_conv = match key_ty {
        Type::TYPE_STRING => quote! { k.to_string() },
        // utf8_validation = NONE on a string map key: &[u8] → Vec<u8>.
        Type::TYPE_BYTES => quote! { k.to_vec() },
        _ => quote! { *k },
    };

    // `bytes_fields` on the outer map field promotes `bytes` values to `Bytes`,
    // matching the owned-side map type (shared carve-out in `map_value_use_bytes`).
    // When it holds, emit `bytes_from_source` directly: the predicate already
    // implies `field_uses_bytes`, so routing through `bytes_to_owned` (which
    // re-checks it) would be redundant.
    let value_use_bytes =
        map_value_use_bytes(ctx, Some(key_ty), Some(val_ty), proto_fqn, field_name);
    let val_conv = match val_ty {
        Type::TYPE_STRING => quote! { v.to_string() },
        Type::TYPE_BYTES if value_use_bytes => {
            quote! { ::buffa::view::bytes_from_source(__buffa_src, v) }
        }
        Type::TYPE_BYTES => quote! { v.to_vec() },
        Type::TYPE_MESSAGE => {
            // Verify the owned path resolves (catches missing imports at codegen time).
            let _owned_path = resolve_owned_path(scope, val_fd)?;
            quote! { v.to_owned_from_source(__buffa_src) }
        }
        _ => quote! { *v },
    };

    Ok(quote! {
        self.#ident.iter().map(|(k, v)| (#key_conv, #val_conv)).collect()
    })
}

fn oneof_variant_to_owned(
    scope: MessageScope<'_>,
    ty: Type,
    oneof_name: &str,
    field_name: &str,
) -> TokenStream {
    let MessageScope { ctx, proto_fqn, .. } = scope;
    match ty {
        Type::TYPE_STRING => {
            // Match ergonomics on `&ViewEnum` binds `v` as `&&str` (double ref).
            str_view_to_owned(
                field_string_repr(ctx, proto_fqn, field_name),
                quote! { v },
                true,
            )
        }
        // match-ergonomics on &ViewEnum → v: &&[u8]. bytes_to_owned handles it.
        Type::TYPE_BYTES => bytes_to_owned(ctx, proto_fqn, field_name, quote! { v }),
        Type::TYPE_MESSAGE | Type::TYPE_GROUP => {
            // The owned variant is boxed unless opted out; `v` derefs through
            // the view's own `Box` either way, so only the wrapper differs.
            let owned = quote! { v.to_owned_from_source(__buffa_src) };
            if crate::oneof::variant_boxed(
                ctx,
                ty,
                &format!(".{proto_fqn}.{oneof_name}.{field_name}"),
            ) {
                quote! { ::buffa::alloc::boxed::Box::new(#owned) }
            } else {
                owned
            }
        }
        _ => quote! { *v },
    }
}

// ---------------------------------------------------------------------------
// Serialize impl generation
// ---------------------------------------------------------------------------

/// Emit `impl serde::Serialize for FooView<'_>` when `generate_json` is true.
fn generate_view_serialize(
    scope: MessageScope<'_>,
    msg: &DescriptorProto,
    view_ident: &proc_macro2::Ident,
    view_oneof_prefix: &TokenStream,
    oneof_idents: &std::collections::HashMap<usize, proc_macro2::Ident>,
) -> Result<TokenStream, CodeGenError> {
    let mut stmts: Vec<TokenStream> = Vec::new();

    for field in &msg.field {
        if is_real_oneof_member(field) {
            continue;
        }
        if !is_supported_field_type(field.r#type.unwrap_or_default()) {
            continue;
        }
        stmts.push(view_field_serialize_stmt(scope, msg, field)?);
    }

    for (idx, oneof) in msg.oneof_decl.iter().enumerate() {
        let base_ident = match oneof_idents.get(&idx) {
            Some(id) => id,
            None => continue,
        };
        let oneof_name = oneof
            .name
            .as_deref()
            .ok_or(CodeGenError::MissingField("oneof.name"))?;
        let field_ident = make_field_ident(oneof_name);
        let view_enum = quote! { #view_oneof_prefix #base_ident };
        let fields: Vec<_> = msg
            .field
            .iter()
            .filter(|f| is_real_oneof_member(f) && f.oneof_index == Some(idx as i32))
            .collect();
        if fields.is_empty() {
            continue;
        }
        let arms = fields
            .iter()
            .map(|f| view_oneof_serialize_arm(scope, f, &view_enum))
            .collect::<Result<Vec<_>, _>>()?;
        stmts.push(quote! {
            if let ::core::option::Option::Some(ref __ov) = self.#field_ident {
                match __ov { #(#arms)* }
            }
        });
    }

    Ok(quote! {
        /// Serializes this view as protobuf JSON.
        ///
        /// Implicit-presence fields with default values are omitted, `required`
        /// fields are always emitted, explicit-presence (`optional`) fields are
        /// emitted only when set, bytes fields are base64-encoded, and enum
        /// values are their proto name strings.
        ///
        /// This impl uses `serialize_map(None)` because the number of emitted
        /// fields depends on default-omission rules; serializers that require
        /// known map lengths (e.g. `bincode`) will return a runtime error.
        /// Use the owned message type for those formats.
        impl<'__a> ::serde::Serialize for #view_ident<'__a> {
            fn serialize<__S: ::serde::Serializer>(
                &self,
                __s: __S,
            ) -> ::core::result::Result<__S::Ok, __S::Error> {
                use ::serde::ser::SerializeMap as _;
                let mut __map = __s.serialize_map(::core::option::Option::None)?;
                #(#stmts)*
                __map.end()
            }
        }
    })
}

/// Generate a single serialize statement for one direct (non-oneof) view field.
fn view_field_serialize_stmt(
    scope: MessageScope<'_>,
    msg: &DescriptorProto,
    field: &FieldDescriptorProto,
) -> Result<TokenStream, CodeGenError> {
    let MessageScope {
        ctx,
        features: parent_features,
        ..
    } = scope;
    let f_features = crate::features::resolve_field(ctx, field, parent_features);

    let field_name = field
        .name
        .as_deref()
        .ok_or(CodeGenError::MissingField("field.name"))?;
    let json_name = field.json_name.as_deref().unwrap_or(field_name);
    let ident = make_field_ident(field_name);
    let label = field.label.unwrap_or_default();
    let is_repeated = label == Label::LABEL_REPEATED;
    let is_required = is_required_field(field, parent_features);
    let ty = effective_type(ctx, field, parent_features);

    // ── Map field ─────────────────────────────────────────────────────────────
    if is_repeated && is_map_field(msg, field) {
        let (key_fd, val_fd) = find_map_entry_fields(msg, field)?;
        let key_raw = effective_type_in_map_entry(ctx, key_fd, parent_features);
        let val_raw = effective_type_in_map_entry(ctx, val_fd, parent_features);
        let val_f = crate::features::resolve_field(ctx, val_fd, parent_features);

        let key_ty = match key_raw {
            Type::TYPE_STRING => quote! { &'__a str },
            Type::TYPE_BYTES => quote! { &'__a [u8] },
            kt => scalar_ty(kt),
        };
        let val_ty = match val_raw {
            Type::TYPE_STRING => quote! { &'__a str },
            Type::TYPE_BYTES => quote! { &'__a [u8] },
            Type::TYPE_MESSAGE => {
                let path = resolve_view_path(scope, val_fd)?;
                quote! { #path <'__a> }
            }
            Type::TYPE_ENUM => {
                let et = resolve_enum_ty(scope, val_fd)?;
                if is_closed_enum(&val_f) {
                    quote! { #et }
                } else {
                    quote! { ::buffa::EnumValue<#et> }
                }
            }
            vt => scalar_ty(vt),
        };

        // Key wrapper struct. Protobuf JSON requires map keys to be encoded
        // as JSON strings regardless of the key's proto type:
        // - String keys are already strings — passed through unwrapped.
        // - Bytes keys (which only arise when `utf8_validation = NONE` rewrites
        //   a `string` key to `&[u8]` in the view) are base64-encoded, mirroring
        //   the owned-side `bytes_key_*_map` helpers' `Base64Wrapper`.
        // - All other scalar keys (int32/64, uint32/64, bool — the only other
        //   key types proto allows) are stringified via `collect_str`, mirroring
        //   the owned-side `proto_map::serialize` `DisplayKey` wrapper.
        // The explicit wrappers make the view encoding byte-identical to the
        // owned encoding for any serde backend, not just `serde_json` (whose
        // `MapKeySerializer` happens to stringify primitives on its own).
        let (key_wrapper, key_expr) = match key_raw {
            Type::TYPE_STRING => (quote! {}, quote! { k }),
            Type::TYPE_BYTES => (
                quote! {
                    struct _WK<'__x>(&'__x [u8]);
                    impl ::serde::Serialize for _WK<'_> {
                        fn serialize<__S: ::serde::Serializer>(&self, __s: __S) -> ::core::result::Result<__S::Ok, __S::Error> {
                            ::buffa::json_helpers::bytes::serialize(self.0, __s)
                        }
                    }
                },
                quote! { &_WK(k) },
            ),
            _ => (
                quote! {
                    struct _WK(#key_ty);
                    impl ::serde::Serialize for _WK {
                        fn serialize<__S: ::serde::Serializer>(&self, __s: __S) -> ::core::result::Result<__S::Ok, __S::Error> {
                            __s.collect_str(&self.0)
                        }
                    }
                },
                // k: &K (Copy scalar) — explicit deref into the wrapper field.
                quote! { &_WK(*k) },
            ),
        };

        // Value wrapper struct (for types needing special encoding).
        let (val_wrapper, val_expr) = match val_raw {
            Type::TYPE_BYTES => (
                quote! {
                    struct _WV<'__x>(&'__x [u8]);
                    impl ::serde::Serialize for _WV<'_> {
                        fn serialize<__S: ::serde::Serializer>(&self, __s: __S) -> ::core::result::Result<__S::Ok, __S::Error> {
                            ::buffa::json_helpers::bytes::serialize(self.0, __s)
                        }
                    }
                },
                // v: &&[u8] — deref coercion from &&[u8] to &[u8] at _WV struct init.
                quote! { &_WV(v) },
            ),
            Type::TYPE_ENUM if is_closed_enum(&val_f) => {
                let et = resolve_enum_ty(scope, val_fd)?;
                (
                    quote! {
                        struct _WV(#et);
                        impl ::serde::Serialize for _WV {
                            fn serialize<__S: ::serde::Serializer>(&self, __s: __S) -> ::core::result::Result<__S::Ok, __S::Error> {
                                ::buffa::json_helpers::closed_enum::serialize(&self.0, __s)
                            }
                        }
                    },
                    // v: &E (Copy) — explicit deref needed for scalar struct field.
                    quote! { &_WV(*v) },
                )
            }
            vt if serde_helper_path(vt).is_some() => {
                let helper = serde_helper_path(vt).unwrap();
                (
                    quote! {
                        struct _WV(#val_ty);
                        impl ::serde::Serialize for _WV {
                            fn serialize<__S: ::serde::Serializer>(&self, __s: __S) -> ::core::result::Result<__S::Ok, __S::Error> {
                                #helper::serialize(&self.0, __s)
                            }
                        }
                    },
                    // v: &scalar — explicit deref needed for scalar struct field.
                    quote! { &_WV(*v) },
                )
            }
            _ => (quote! {}, quote! { v }),
        };

        // Include '__a only when key/val types actually reference the view lifetime.
        let key_uses_a = matches!(key_raw, Type::TYPE_STRING | Type::TYPE_BYTES);
        let val_uses_a = matches!(
            val_raw,
            Type::TYPE_STRING | Type::TYPE_BYTES | Type::TYPE_MESSAGE
        );
        let (wm_struct_decl, wm_impl_hdr, wm_impl_ty) = if key_uses_a || val_uses_a {
            (
                quote! { struct _WM<'__a, '__x>(&'__x ::buffa::MapView<'__x, #key_ty, #val_ty>); },
                quote! { impl<'__a> },
                quote! { _WM<'__a, '_> },
            )
        } else {
            (
                quote! { struct _WM<'__x>(&'__x ::buffa::MapView<'__x, #key_ty, #val_ty>); },
                quote! { impl },
                quote! { _WM<'_> },
            )
        };
        return Ok(quote! {
            if !self.#ident.is_empty() {
                #wm_struct_decl
                #wm_impl_hdr ::serde::Serialize for #wm_impl_ty {
                    fn serialize<__S: ::serde::Serializer>(&self, __s: __S) -> ::core::result::Result<__S::Ok, __S::Error> {
                        use ::serde::ser::SerializeMap as _;
                        #key_wrapper
                        #val_wrapper
                        // `iter_unique` deduplicates wire-level duplicate keys
                        // (last-write-wins), matching the owned `HashMap`
                        // decode semantics and producing valid JSON.
                        // `len()` (not `len_unique()`) is used for the size
                        // hint: it is exact for well-formed wire data, an
                        // upper bound for adversarial duplicates, and avoids
                        // a second O(n²) dedup pass on every serialize.
                        let mut __m = __s.serialize_map(::core::option::Option::Some(self.0.len()))?;
                        for (k, v) in self.0.iter_unique() {
                            __m.serialize_entry(#key_expr, #val_expr)?;
                        }
                        __m.end()
                    }
                }
                __map.serialize_entry(#json_name, &_WM(&self.#ident))?;
            }
        });
    }

    // ── Repeated field ────────────────────────────────────────────────────────
    if is_repeated {
        let seq_wrapper = match ty {
            Type::TYPE_BYTES => quote! {
                struct _WSeq<'__x>(&'__x [&'__x [u8]]);
                impl ::serde::Serialize for _WSeq<'_> {
                    fn serialize<__S: ::serde::Serializer>(&self, __s: __S) -> ::core::result::Result<__S::Ok, __S::Error> {
                        use ::serde::ser::SerializeSeq as _;
                        let mut __seq = __s.serialize_seq(::core::option::Option::Some(self.0.len()))?;
                        for v in self.0 {
                            struct _WE<'__x>(&'__x [u8]);
                            impl ::serde::Serialize for _WE<'_> {
                                fn serialize<__S: ::serde::Serializer>(&self, __s: __S) -> ::core::result::Result<__S::Ok, __S::Error> {
                                    ::buffa::json_helpers::bytes::serialize(self.0, __s)
                                }
                            }
                            __seq.serialize_element(&_WE(v))?;
                        }
                        __seq.end()
                    }
                }
            },
            Type::TYPE_ENUM if is_closed_enum(&f_features) => {
                let et = resolve_enum_ty(scope, field)?;
                quote! {
                    struct _WSeq<'__x>(&'__x [#et]);
                    impl ::serde::Serialize for _WSeq<'_> {
                        fn serialize<__S: ::serde::Serializer>(&self, __s: __S) -> ::core::result::Result<__S::Ok, __S::Error> {
                            ::buffa::json_helpers::repeated_closed_enum::serialize(self.0, __s)
                        }
                    }
                }
            }
            Type::TYPE_ENUM => {
                let et = resolve_enum_ty(scope, field)?;
                quote! {
                    struct _WSeq<'__x>(&'__x [::buffa::EnumValue<#et>]);
                    impl ::serde::Serialize for _WSeq<'_> {
                        fn serialize<__S: ::serde::Serializer>(&self, __s: __S) -> ::core::result::Result<__S::Ok, __S::Error> {
                            ::buffa::json_helpers::repeated_enum::serialize(self.0, __s)
                        }
                    }
                }
            }
            scalar_ty_val if serde_helper_path(scalar_ty_val).is_some() => {
                let elem_ty = scalar_ty(scalar_ty_val);
                quote! {
                    struct _WSeq<'__x>(&'__x [#elem_ty]);
                    impl ::serde::Serialize for _WSeq<'_> {
                        fn serialize<__S: ::serde::Serializer>(&self, __s: __S) -> ::core::result::Result<__S::Ok, __S::Error> {
                            ::buffa::json_helpers::proto_seq::serialize(self.0, __s)
                        }
                    }
                }
            }
            _ => quote! {},
        };

        let seq_val = if seq_wrapper.is_empty() {
            // Explicit deref: RepeatedView doesn't impl Serialize, but &[T] does.
            quote! { &*self.#ident }
        } else {
            // Deref coercion from &RepeatedView<'a,T> to &[T] at struct-init site.
            quote! { &_WSeq(&self.#ident) }
        };

        return Ok(quote! {
            if !self.#ident.is_empty() {
                #seq_wrapper
                __map.serialize_entry(#json_name, #seq_val)?;
            }
        });
    }

    // ── Explicit-presence (proto3 optional) scalar ────────────────────────────
    if is_explicit_presence_scalar(field, ty, &f_features) {
        // opt_* helpers from json_helpers take &Option<owned_T>, not &Option<view_T>.
        // Handle each case inline so the view's Option<&str>/Option<&[u8]> work.
        let entry = match ty {
            Type::TYPE_STRING => quote! {
                if let ::core::option::Option::Some(__v) = self.#ident {
                    __map.serialize_entry(#json_name, __v)?;
                }
            },
            Type::TYPE_BYTES => quote! {
                if let ::core::option::Option::Some(__v) = self.#ident {
                    struct _W<'__x>(&'__x [u8]);
                    impl ::serde::Serialize for _W<'_> {
                        fn serialize<__S: ::serde::Serializer>(&self, __s: __S) -> ::core::result::Result<__S::Ok, __S::Error> {
                            ::buffa::json_helpers::bytes::serialize(self.0, __s)
                        }
                    }
                    __map.serialize_entry(#json_name, &_W(__v))?;
                }
            },
            Type::TYPE_ENUM if is_closed_enum(&f_features) => {
                let et = resolve_enum_ty(scope, field)?;
                quote! {
                    if let ::core::option::Option::Some(__v) = self.#ident {
                        struct _W(#et);
                        impl ::serde::Serialize for _W {
                            fn serialize<__S: ::serde::Serializer>(&self, __s: __S) -> ::core::result::Result<__S::Ok, __S::Error> {
                                ::buffa::json_helpers::closed_enum::serialize(&self.0, __s)
                            }
                        }
                        __map.serialize_entry(#json_name, &_W(__v))?;
                    }
                }
            }
            Type::TYPE_ENUM => quote! {
                if let ::core::option::Option::Some(ref __v) = self.#ident {
                    __map.serialize_entry(#json_name, __v)?;
                }
            },
            scalar if serde_helper_path(scalar).is_some() => {
                let helper = serde_helper_path(scalar).unwrap();
                let elem_ty = scalar_ty(scalar);
                quote! {
                    if let ::core::option::Option::Some(__v) = self.#ident {
                        struct _W(#elem_ty);
                        impl ::serde::Serialize for _W {
                            fn serialize<__S: ::serde::Serializer>(&self, __s: __S) -> ::core::result::Result<__S::Ok, __S::Error> {
                                #helper::serialize(&self.0, __s)
                            }
                        }
                        __map.serialize_entry(#json_name, &_W(__v))?;
                    }
                }
            }
            _ => quote! {
                if let ::core::option::Option::Some(__v) = self.#ident {
                    __map.serialize_entry(#json_name, &__v)?;
                }
            },
        };
        return Ok(entry);
    }

    // ── Singular fields ───────────────────────────────────────────────────────
    let (skip_cond, serialize_stmt) = match ty {
        Type::TYPE_STRING => (
            quote! { !::buffa::json_helpers::skip_if::is_empty_str(self.#ident) },
            quote! { __map.serialize_entry(#json_name, self.#ident)?; },
        ),
        Type::TYPE_BYTES => (
            quote! { !::buffa::json_helpers::skip_if::is_empty_bytes(self.#ident) },
            quote! {
                struct _W<'__x>(&'__x [u8]);
                impl ::serde::Serialize for _W<'_> {
                    fn serialize<__S: ::serde::Serializer>(&self, __s: __S) -> ::core::result::Result<__S::Ok, __S::Error> {
                        ::buffa::json_helpers::bytes::serialize(self.0, __s)
                    }
                }
                __map.serialize_entry(#json_name, &_W(self.#ident))?;
            },
        ),
        Type::TYPE_MESSAGE | Type::TYPE_GROUP => (
            quote! { self.#ident.is_set() },
            quote! {
                if let ::core::option::Option::Some(__v) = self.#ident.as_option() {
                    __map.serialize_entry(#json_name, __v)?;
                }
            },
        ),
        Type::TYPE_ENUM if is_closed_enum(&f_features) => {
            let et = resolve_enum_ty(scope, field)?;
            let skip_fn = quote! { ::buffa::json_helpers::skip_if::is_default_closed_enum };
            (
                quote! { !#skip_fn(&self.#ident) },
                quote! {
                    struct _W(#et);
                    impl ::serde::Serialize for _W {
                        fn serialize<__S: ::serde::Serializer>(&self, __s: __S) -> ::core::result::Result<__S::Ok, __S::Error> {
                            ::buffa::json_helpers::closed_enum::serialize(&self.0, __s)
                        }
                    }
                    __map.serialize_entry(#json_name, &_W(self.#ident))?;
                },
            )
        }
        Type::TYPE_ENUM => (
            quote! { !::buffa::json_helpers::skip_if::is_default_enum_value(&self.#ident) },
            quote! { __map.serialize_entry(#json_name, &self.#ident)?; },
        ),
        scalar if serde_helper_path(scalar).is_some() => {
            let helper = serde_helper_path(scalar).unwrap();
            let skip_path = scalar_skip_predicate(scalar);
            let elem_ty = scalar_ty(scalar);
            (
                quote! { !#skip_path(&self.#ident) },
                quote! {
                    struct _W(#elem_ty);
                    impl ::serde::Serialize for _W {
                        fn serialize<__S: ::serde::Serializer>(&self, __s: __S) -> ::core::result::Result<__S::Ok, __S::Error> {
                            #helper::serialize(&self.0, __s)
                        }
                    }
                    __map.serialize_entry(#json_name, &_W(self.#ident))?;
                },
            )
        }
        Type::TYPE_BOOL => (
            quote! { self.#ident },
            quote! { __map.serialize_entry(#json_name, &self.#ident)?; },
        ),
        _ => (
            quote! { self.#ident != ::core::default::Default::default() },
            quote! { __map.serialize_entry(#json_name, &self.#ident)?; },
        ),
    };

    // Message fields handle skip internally via the if-let. Required fields
    // are always serialized. Both are wrapped in a block so that any local
    // `struct _W` declarations inside `serialize_stmt` do not collide when
    // multiple such fields appear in the same message.
    if matches!(ty, Type::TYPE_MESSAGE | Type::TYPE_GROUP) || is_required {
        return Ok(quote! { { #serialize_stmt } });
    }

    Ok(quote! {
        if #skip_cond {
            #serialize_stmt
        }
    })
}

/// Return the `skip_if` predicate path string for a scalar type that has a helper.
fn scalar_skip_predicate(ty: Type) -> TokenStream {
    match ty {
        Type::TYPE_BOOL => quote! { ::buffa::json_helpers::skip_if::is_false },
        Type::TYPE_INT32 | Type::TYPE_SINT32 | Type::TYPE_SFIXED32 => {
            quote! { ::buffa::json_helpers::skip_if::is_zero_i32 }
        }
        Type::TYPE_UINT32 | Type::TYPE_FIXED32 => {
            quote! { ::buffa::json_helpers::skip_if::is_zero_u32 }
        }
        Type::TYPE_INT64 | Type::TYPE_SINT64 | Type::TYPE_SFIXED64 => {
            quote! { ::buffa::json_helpers::skip_if::is_zero_i64 }
        }
        Type::TYPE_UINT64 | Type::TYPE_FIXED64 => {
            quote! { ::buffa::json_helpers::skip_if::is_zero_u64 }
        }
        Type::TYPE_FLOAT => quote! { ::buffa::json_helpers::skip_if::is_zero_f32 },
        Type::TYPE_DOUBLE => quote! { ::buffa::json_helpers::skip_if::is_zero_f64 },
        // The single call site is gated by `serde_helper_path(ty).is_some()`,
        // which only matches the scalar types above. Bytes is handled in an
        // earlier match arm.
        Type::TYPE_STRING
        | Type::TYPE_BYTES
        | Type::TYPE_ENUM
        | Type::TYPE_MESSAGE
        | Type::TYPE_GROUP => {
            unreachable!("scalar_skip_predicate called for non-scalar {:?}", ty)
        }
    }
}

/// Generate a single `match` arm for one oneof variant in the inlined oneof serialization.
///
/// The arm is used inside:
/// ```text
/// if let Some(ref __ov) = self.field { match __ov { <arm>, ... } }
/// ```
fn view_oneof_serialize_arm(
    scope: MessageScope<'_>,
    field: &FieldDescriptorProto,
    view_enum: &TokenStream,
) -> Result<TokenStream, CodeGenError> {
    let MessageScope { ctx, features, .. } = scope;
    let f_features = crate::features::resolve_field(ctx, field, features);

    let name = field
        .name
        .as_deref()
        .ok_or(CodeGenError::MissingField("field.name"))?;
    let json_name = field.json_name.as_deref().unwrap_or(name);
    let variant = crate::oneof::oneof_variant_ident(name);
    let ty = effective_type(ctx, field, features);

    // NullValue must serialize as JSON `null`, not "NULL_VALUE".
    if is_null_value_field(field) {
        return Ok(quote! {
            #view_enum::#variant(_) => {
                __map.serialize_entry(#json_name, &())?;
            }
        });
    }

    // Pattern match on &ViewEnum gives v: &inner_type (with match ergonomics).
    let arm_body = match ty {
        Type::TYPE_STRING => {
            // v: &&str — deref coercion from &&str to &str at the serialize_entry call.
            quote! { __map.serialize_entry(#json_name, v)?; }
        }
        Type::TYPE_BYTES => {
            // v: &&[u8] — deref coercion from &&[u8] to &[u8] in _W constructor.
            quote! {
                struct _W<'__x>(&'__x [u8]);
                impl ::serde::Serialize for _W<'_> {
                    fn serialize<__S: ::serde::Serializer>(&self, __s: __S) -> ::core::result::Result<__S::Ok, __S::Error> {
                        ::buffa::json_helpers::bytes::serialize(self.0, __s)
                    }
                }
                __map.serialize_entry(#json_name, &_W(v))?;
            }
        }
        Type::TYPE_MESSAGE | Type::TYPE_GROUP => {
            // v: &Box<FooView> → Box<FooView>: Serialize when FooView: Serialize.
            quote! { __map.serialize_entry(#json_name, v)?; }
        }
        Type::TYPE_ENUM if is_closed_enum(&f_features) => {
            let et = resolve_enum_ty(scope, field)?;
            quote! {
                struct _W(#et);
                impl ::serde::Serialize for _W {
                    fn serialize<__S: ::serde::Serializer>(&self, __s: __S) -> ::core::result::Result<__S::Ok, __S::Error> {
                        ::buffa::json_helpers::closed_enum::serialize(&self.0, __s)
                    }
                }
                __map.serialize_entry(#json_name, &_W(*v))?;
            }
        }
        Type::TYPE_ENUM => {
            // v: &EnumValue<E> — has its own Serialize impl.
            quote! { __map.serialize_entry(#json_name, v)?; }
        }
        scalar if serde_helper_path(scalar).is_some() => {
            let helper = serde_helper_path(scalar).unwrap();
            let sty = scalar_ty(scalar);
            // v: &scalar_type → copy and wrap.
            quote! {
                struct _W(#sty);
                impl ::serde::Serialize for _W {
                    fn serialize<__S: ::serde::Serializer>(&self, __s: __S) -> ::core::result::Result<__S::Ok, __S::Error> {
                        #helper::serialize(&self.0, __s)
                    }
                }
                __map.serialize_entry(#json_name, &_W(*v))?;
            }
        }
        _ => {
            // bool, i32, u32: direct serialize.
            quote! { __map.serialize_entry(#json_name, v)?; }
        }
    };

    Ok(quote! {
        #view_enum::#variant(v) => { #arm_body }
    })
}

// ---------------------------------------------------------------------------
// Shared helpers
// ---------------------------------------------------------------------------

/// Scalar Rust type for view fields (same as owned scalars; no borrowing needed).
fn scalar_ty(ty: Type) -> TokenStream {
    match ty {
        Type::TYPE_DOUBLE => quote! { f64 },
        Type::TYPE_FLOAT => quote! { f32 },
        Type::TYPE_INT64 | Type::TYPE_SINT64 | Type::TYPE_SFIXED64 => quote! { i64 },
        Type::TYPE_UINT64 | Type::TYPE_FIXED64 => quote! { u64 },
        Type::TYPE_INT32 | Type::TYPE_SINT32 | Type::TYPE_SFIXED32 => quote! { i32 },
        Type::TYPE_UINT32 | Type::TYPE_FIXED32 => quote! { u32 },
        Type::TYPE_BOOL => quote! { bool },
        Type::TYPE_STRING
        | Type::TYPE_BYTES
        | Type::TYPE_ENUM
        | Type::TYPE_MESSAGE
        | Type::TYPE_GROUP => unreachable!("scalar_ty called for non-scalar {:?}", ty),
    }
}

/// Resolve the enum Rust type (same as owned — enums are Copy/Clone integers).
fn resolve_enum_ty(
    scope: MessageScope<'_>,
    field: &FieldDescriptorProto,
) -> Result<TokenStream, CodeGenError> {
    let type_name = field
        .type_name
        .as_deref()
        .ok_or(CodeGenError::MissingField("field.type_name"))?;
    let path = scope
        .ctx
        .rust_type_relative(type_name, scope.current_package, scope.nesting)
        .ok_or_else(|| CodeGenError::Other(format!("enum type '{type_name}' not found")))?;
    Ok(rust_path_to_tokens(&path))
}

/// Resolve the view type tokens for a message field
/// (e.g. `".pkg.Address"` → `super^n::__buffa::view::AddressView<'a>`).
///
/// `scope.nesting` must be the **total** depth of the caller below the
/// package root (msg-nesting + kind-depth offset already applied by the
/// caller — `+2` for view-struct bodies, `+4` for view-oneof-enum bodies).
pub(crate) fn resolve_view_ty_tokens(
    scope: MessageScope<'_>,
    field: &FieldDescriptorProto,
    lt: &TokenStream,
) -> Result<TokenStream, CodeGenError> {
    let path = resolve_view_path(scope, field)?;
    Ok(quote! { #path <#lt> })
}

/// Resolve the view type tokens used for `decode_view` calls (no lifetime).
fn resolve_view_decode_tokens(
    scope: MessageScope<'_>,
    field: &FieldDescriptorProto,
) -> Result<TokenStream, CodeGenError> {
    resolve_view_path(scope, field)
}

/// Compute the path to a message field's **view struct** from `scope`.
///
/// Splits the resolved owned-type path at the target-package boundary and
/// inserts `__buffa::view::` between the halves, appending `View` to the
/// final identifier.
fn resolve_view_path(
    scope: MessageScope<'_>,
    field: &FieldDescriptorProto,
) -> Result<TokenStream, CodeGenError> {
    let type_name = field
        .type_name
        .as_deref()
        .ok_or(CodeGenError::MissingField("field.type_name"))?;
    let split = scope
        .ctx
        .rust_type_relative_split(type_name, scope.current_package, scope.nesting)
        .ok_or_else(|| CodeGenError::Other(format!("message type '{type_name}' not found")))?;

    let to_pkg = if split.to_package.is_empty() {
        TokenStream::new()
    } else {
        let p = rust_path_to_tokens(&split.to_package);
        quote! { #p :: }
    };
    let sentinel = make_field_ident(SENTINEL_MOD);
    let (within_prefix, last) = match split.within_package.rsplit_once("::") {
        Some((prefix, last)) => {
            let p = rust_path_to_tokens(prefix);
            (quote! { #p :: }, last.to_string())
        }
        None => (TokenStream::new(), split.within_package.clone()),
    };
    let view_ident = make_field_ident(&format!("{last}View"));
    Ok(quote! { #to_pkg #sentinel :: view :: #within_prefix #view_ident })
}

fn resolve_owned_path(
    scope: MessageScope<'_>,
    field: &FieldDescriptorProto,
) -> Result<String, CodeGenError> {
    let type_name = field
        .type_name
        .as_deref()
        .ok_or(CodeGenError::MissingField("field.type_name"))?;
    scope
        .ctx
        .rust_type_relative(type_name, scope.current_package, scope.nesting)
        .ok_or_else(|| CodeGenError::Other(format!("message type '{type_name}' not found")))
}