@camox/api-contract 0.44.0 → 0.46.0

package/src/drafts.ts

@@ -0,0 +1,197 @@
+import type { Router } from "./index.ts";
+
+/** Request header naming the draft a request reads and writes (ADR 0011). Absent means Live. */
+export const DRAFT_HEADER = "x-camox-draft";
+
+/**
+ * Request header naming, by its tag, the locale a request reads and writes content in (ADR
+ * 0015). Absent means the project's default locale.
+ */
+export const LOCALE_HEADER = "x-camox-locale";
+
+/**
+ * Request header asking the API to create the draft named by `DRAFT_HEADER` if it doesn't
+ * exist yet. Its value is `"1"`.
+ */
+export const DRAFT_CREATE_HEADER = "x-camox-draft-create";
+
+/**
+ * The `x-camox-draft` value naming the caller's own development draft in the project a request
+ * acts on (ADR 0006, ADR 0011). Dev mode and the CLI always send it.
+ */
+export const DEVELOPMENT_DRAFT = "development";
+
+/**
+ * oRPC error code for a request naming the development draft before dev mode created it: the
+ * first dev-mode sync after login does, so the site has to run locally once first.
+ */
+export const NO_DEVELOPMENT_DRAFT_ERROR = "NO_DEVELOPMENT_DRAFT";
+
+/** URL search param carrying the current draft's id in the studio and the rendered site. */
+export const DRAFT_SEARCH_PARAM = "camox-draft";
+
+/** A regular draft is a named set of edits; a development draft backs a dev server. */
+export type DraftKind = "regular" | "development";
+
+/** How a regular draft ended. */
+export type DraftOutcome = "published" | "discarded";
+
+/** Who ended a draft, how and when, from its ended-drafts record (ADR 0009, ADR 0011). */
+export type EndedDraft = {
+  draftId: string;
+  outcome: DraftOutcome;
+  endedBy: { id: string; name: string };
+  endedAt: number;
+};
+
+/**
+ * The oRPC error code a request naming an ended draft fails with. Its `data` is an `EndedDraft`,
+ * so a page can render Live and say who published or discarded the draft.
+ */
+export const DRAFT_ENDED_ERROR_CODE = "DRAFT_ENDED";
+
+/**
+ * oRPC error code for a publish whose token no longer matches Live: Live changed since the
+ * preview, so nothing was applied and the caller reviews the new preview.
+ */
+export const CONFLICTS_CHANGED_ERROR = "CONFLICTS_CHANGED";
+
+/** oRPC error code for a publish refused because the draft still has blockers. */
+export const PUBLISH_BLOCKED_ERROR = "PUBLISH_BLOCKED";
+
+/**
+ * oRPC error code for a publish refused because the draft still has pending translations: every
+ * locale goes live together, unless the caller publishes anyway (ADR 0017).
+ */
+export const TRANSLATIONS_PENDING_ERROR = "TRANSLATIONS_PENDING";
+
+/**
+ * Why the publish tool published nothing of a draft with changes, and returned a fresh preview to
+ * review again, by the error code of each: Live changed since the preview, the draft has blockers,
+ * or translations are still running.
+ */
+export const NOT_PUBLISHED_CODES = {
+  conflictsChanged: CONFLICTS_CHANGED_ERROR,
+  blocked: PUBLISH_BLOCKED_ERROR,
+  translating: TRANSLATIONS_PENDING_ERROR,
+} as const;
+
+export type NotPublishedReason = keyof typeof NOT_PUBLISHED_CODES;
+
+/**
+ * Who Camox's own work is by: the creator of the drafts it opens to catch translations up, their
+ * publisher on Live, and who ended them. Shown as "Camox".
+ */
+export const CAMOX_ACTOR = "camox";
+
+/** The name Camox's own work shows under. */
+export const CAMOX_NAME = "Camox";
+
+/**
+ * oRPC error code for a content write that names no draft. Live is read-only (ADR 0003): content
+ * changes reach it only by publishing a draft, or through a release.
+ */
+export const LIVE_READ_ONLY_ERROR = "LIVE_READ_ONLY";
+
+// Whether each procedure of a router that follows drafts writes content. Live is read-only
+// (ADR 0003), so the API rejects a content write naming no draft, and the studio starts a draft
+// for one on Live. Every procedure is listed, so a new one fails the type check until it's
+// classified and can't be forgotten. Procedures that only fill a generated value (ADR 0012),
+// like `generateSummary`, write no content. A synced block's shared content is written through
+// `blocks` and `repeatableItems`. Releases and dev-mode sync aren't listed.
+const BLOCK_WRITES: Record<keyof Router["blocks"], boolean> = {
+  get: false,
+  getPageMarkdown: false,
+  getLayoutMarkdown: false,
+  getUsageCounts: false,
+  getPagesUsing: false,
+  getSyncedContent: false,
+  create: true,
+  updateContent: true,
+  updateSettings: true,
+  updatePosition: true,
+  delete: true,
+  deleteMany: true,
+  generateSummary: false,
+  duplicate: true,
+};
+
+const COLLECTION_WRITES: Record<keyof Router["collectionDefinitions"], boolean> = {
+  list: false,
+  get: false,
+  listRecords: false,
+  getRecord: false,
+  getRecordUsageCount: false,
+  findRecordsByField: false,
+  listRecordPageValues: false,
+  recordMarkdown: false,
+  createRecord: true,
+  editRecord: true,
+  deleteRecord: true,
+};
+
+// Uploads and replacements are content writes too, outside oRPC.
+const FILE_WRITES: Record<keyof Router["files"], boolean> = {
+  list: false,
+  get: false,
+  getUsageCount: false,
+  setAlt: true,
+  setFilename: true,
+  delete: true,
+  deleteMany: true,
+  // Switching AI metadata on or off changes content (ADR 0012); generating only fills it.
+  setAiMetadata: true,
+  generateMetadata: false,
+};
+
+const PAGE_WRITES: Record<keyof Router["pages"], boolean> = {
+  getByPath: false,
+  getStructure: false,
+  list: false,
+  listBySlug: false,
+  get: false,
+  create: true,
+  update: true,
+  delete: true,
+  // Switching AI SEO on or off changes content (ADR 0012), like writing either field.
+  setSeo: true,
+  setLayout: true,
+  generateSeo: false,
+};
+
+const ITEM_WRITES: Record<keyof Router["repeatableItems"], boolean> = {
+  get: false,
+  create: true,
+  updateContent: true,
+  updateSettings: true,
+  updatePosition: true,
+  duplicate: true,
+  generateSummary: false,
+  delete: true,
+};
+
+// Correcting the default locale's tag changes no content, so it needs no draft (ADR 0015).
+const LOCALE_WRITES: Record<keyof Router["locales"], boolean> = {
+  list: false,
+  add: true,
+  remove: true,
+  setDefaultTag: false,
+  listMissing: false,
+  addBack: true,
+};
+
+// `definitions` is absent: its sync is a release or a dev sync, never a studio content write.
+const CONTENT_WRITES: Partial<Record<keyof Router, Record<string, boolean>>> = {
+  blocks: BLOCK_WRITES,
+  locales: LOCALE_WRITES,
+  collectionDefinitions: COLLECTION_WRITES,
+  files: FILE_WRITES,
+  pages: PAGE_WRITES,
+  repeatableItems: ITEM_WRITES,
+};
+
+/** Whether the procedure at `path` (`[router, procedure]`) writes content. */
+export function isContentWrite(path: readonly string[]): boolean {
+  if (path.length !== 2) return false;
+  return CONTENT_WRITES[path[0] as keyof Router]?.[path[1]] === true;
+}

package/src/icon-catalog.ts

@@ -0,0 +1,60 @@
+import type { IconifyJSON } from "@iconify/types";
+import { getIconData, iconToSVG } from "@iconify/utils";
+
+import { ICON_CATALOG_VERSION, type IconSvgData } from "./icons.ts";
+
+// Kept out of the root entry so `@iconify/utils` never reaches client bundles.
+const collections = new Map<string, Promise<IconifyJSON>>();
+
+export async function loadIconCollection(prefix: string): Promise<IconifyJSON> {
+  if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(prefix)) throw new Error("Invalid icon collection");
+  const existing = collections.get(prefix);
+  if (existing) return existing;
+  const pending = (async () => {
+    const response = await fetch(
+      `https://unpkg.com/@iconify/json@${ICON_CATALOG_VERSION}/json/${prefix}.json`,
+      { signal: AbortSignal.timeout(30_000) },
+    );
+    if (!response.ok) throw new Error(`Unable to load icon collection ${prefix}`);
+    const data = (await response.json()) as IconifyJSON;
+    if (data.prefix !== prefix || !data.icons || !data.info?.license)
+      throw new Error("Invalid icon catalog or missing license");
+    return data;
+  })();
+  collections.set(prefix, pending);
+  // Bound worker memory; failed fetches must be retryable.
+  if (collections.size > 8) collections.delete(collections.keys().next().value!);
+  try {
+    return await pending;
+  } catch (error) {
+    collections.delete(prefix);
+    throw error;
+  }
+}
+
+export function iconCollectionIds(data: IconifyJSON): string[] {
+  return [...Object.keys(data.icons), ...Object.keys(data.aliases ?? {})]
+    .filter((name) => getIconData(data, name) !== null)
+    .sort()
+    .map((name) => `${data.prefix}:${name}`);
+}
+
+export function resolveIconSvg(data: IconifyJSON, id: string): IconSvgData {
+  const [prefix, name, extra] = id.split(":");
+  if (prefix !== data.prefix || !name || extra !== undefined) throw new Error("Invalid icon ID");
+  const icon = getIconData(data, name);
+  if (!icon) throw new Error(`Unknown icon: ${id}`);
+  const svg = iconToSVG(icon);
+  return {
+    body: svg.body,
+    attributes: svg.attributes,
+    attribution: data.info
+      ? {
+          collection: data.info.name,
+          author: data.info.author.name,
+          license: data.info.license.title,
+          url: data.info.license.url,
+        }
+      : undefined,
+  };
+}

package/src/icons.ts

@@ -1,6 +1,3 @@
-import type { IconifyJSON } from "@iconify/types";
-import { getIconData, iconToSVG } from "@iconify/utils";
-
 // One immutable snapshot for declarations, schemas, picker and SVG resolution.
 export const ICON_CATALOG_VERSION = "2.2.532";
 export type IconSvgData = {
@@ -8,60 +5,6 @@ export type IconSvgData = {
   attributes: Record<string, string>;
   attribution?: { collection: string; author: string; license: string; url?: string };
 };
-const collections = new Map<string, Promise<IconifyJSON>>();
-
-export async function loadIconCollection(prefix: string): Promise<IconifyJSON> {
-  if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(prefix)) throw new Error("Invalid icon collection");
-  const existing = collections.get(prefix);
-  if (existing) return existing;
-  const pending = (async () => {
-    const response = await fetch(
-      `https://unpkg.com/@iconify/json@${ICON_CATALOG_VERSION}/json/${prefix}.json`,
-      { signal: AbortSignal.timeout(30_000) },
-    );
-    if (!response.ok) throw new Error(`Unable to load icon collection ${prefix}`);
-    const data = (await response.json()) as IconifyJSON;
-    if (data.prefix !== prefix || !data.icons || !data.info?.license)
-      throw new Error("Invalid icon catalog or missing license");
-    return data;
-  })();
-  collections.set(prefix, pending);
-  // Bound worker memory; failed fetches must be retryable.
-  if (collections.size > 8) collections.delete(collections.keys().next().value!);
-  try {
-    return await pending;
-  } catch (error) {
-    collections.delete(prefix);
-    throw error;
-  }
-}
-
-export function iconCollectionIds(data: IconifyJSON): string[] {
-  return [...Object.keys(data.icons), ...Object.keys(data.aliases ?? {})]
-    .filter((name) => getIconData(data, name) !== null)
-    .sort()
-    .map((name) => `${data.prefix}:${name}`);
-}
-
-export function resolveIconSvg(data: IconifyJSON, id: string): IconSvgData {
-  const [prefix, name, extra] = id.split(":");
-  if (prefix !== data.prefix || !name || extra !== undefined) throw new Error("Invalid icon ID");
-  const icon = getIconData(data, name);
-  if (!icon) throw new Error(`Unknown icon: ${id}`);
-  const svg = iconToSVG(icon);
-  return {
-    body: svg.body,
-    attributes: svg.attributes,
-    attribution: data.info
-      ? {
-          collection: data.info.name,
-          author: data.info.author.name,
-          license: data.info.license.title,
-          url: data.info.license.url,
-        }
-      : undefined,
-  };
-}
 
 export function scopeIconSvgIds(body: string, prefix: string): string {
   const ids = [...body.matchAll(/\sid="([^\s"]+)"/g)].map((match) => match[1]!);

package/src/ids.ts

@@ -0,0 +1,43 @@
+import { z } from "zod";
+
+/** The id of a content entity: one UUIDv7, kept in Live and every draft (ADR 0004). */
+export const uuidv7Schema = /* @__PURE__ */ z.uuidv7();
+
+/**
+ * A Project ID: a UUIDv7 in lowercase only, the form the project's Worker is named by, so an
+ * uppercase one fails here rather than silently naming no project.
+ */
+export const projectIdSchema = /* @__PURE__ */ z
+  .uuidv7()
+  .regex(/^[0-9a-f-]+$/, "A Project ID is a UUIDv7 in lowercase");
+
+/**
+ * `uuidv7Schema` as JSON Schema, for content schemas. Written out rather than derived, so site
+ * bundles, which need only this, leave zod out.
+ */
+export const uuidv7JsonSchema = {
+  type: "string",
+  format: "uuid",
+  pattern:
+    "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-7[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$",
+};
+
+/** A text link to a page: this prefix, then the page's UUIDv7. */
+export const PAGE_TEXT_LINK_PREFIX = "camox:page:";
+
+/**
+ * Mints a UUIDv7 (RFC 9562): a 48-bit millisecond timestamp, then random bits.
+ * The server mints ids; clients mint one only for optimistic inserts.
+ */
+export function generateUuidv7(): string {
+  const bytes = crypto.getRandomValues(new Uint8Array(16));
+  let timestamp = Date.now();
+  for (let index = 5; index >= 0; index--) {
+    bytes[index] = timestamp % 256;
+    timestamp = Math.floor(timestamp / 256);
+  }
+  bytes[6] = (bytes[6]! & 0x0f) | 0x70;
+  bytes[8] = (bytes[8]! & 0x3f) | 0x80;
+  const hex = Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}

package/src/index.ts

@@ -1,3 +1,7 @@
+export * from "./artifact.ts";
 export * from "./icons.ts";
-export * from "./comments.ts";
+export * from "./ids.ts";
+export * from "./reference-query.ts";
 export type { Router } from "../../../apps/api/src/router";
+export type { PublishPreview } from "../../../apps/api/src/domains/drafts/publish";
+export type { EntityKind } from "../../../apps/api/src/domains/drafts/overlay";

package/src/projects.ts

@@ -0,0 +1,67 @@
+import { z } from "zod";
+
+/**
+ * Project Slugs Camox keeps for its own hosts and pages, so no project's `<slug>.camox.site`
+ * looks like one of them.
+ */
+export const RESERVED_PROJECT_SLUGS: ReadonlySet<string> = new Set([
+  "www",
+  "api",
+  "app",
+  "dashboard",
+  "studio",
+  "sites",
+  "site",
+  "docs",
+  "blog",
+  "help",
+  "support",
+  "status",
+  "admin",
+  "auth",
+  "login",
+  "mail",
+  "email",
+  "cdn",
+  "static",
+  "assets",
+  "files",
+  "camox",
+]);
+
+/**
+ * A Project Slug: one lowercase DNS label, the only depth Universal SSL covers on `camox.site`,
+ * made of letters, digits and inner hyphens.
+ */
+export const projectSlugSchema = /* @__PURE__ */ z
+  .string()
+  .min(1, "Enter a slug")
+  .max(63, "Use at most 63 characters")
+  .regex(
+    /^[a-z0-9]+(?:-[a-z0-9]+)*$/,
+    "Use lowercase letters, digits and hyphens, without a hyphen at either end",
+  );
+
+/** Why a slug can't be given to a new project. */
+export type UnavailableSlugReason = "invalid" | "reserved" | "taken";
+
+/** What a member is told when a slug can't be used, by reason. */
+export const UNAVAILABLE_SLUG_MESSAGES: Record<UnavailableSlugReason, string> = {
+  invalid: "Use lowercase letters, digits and hyphens, without a hyphen at either end.",
+  reserved: "This slug is reserved by Camox. Choose another.",
+  taken: "This slug is already taken. Choose another.",
+};
+
+/**
+ * Where a project is in its life: `settingUp` from its creation until its first release
+ * succeeds, then `live`. `setupFailed` when its setup gave up: Camox is told and fixes it.
+ */
+export type ProjectStatus = "settingUp" | "live" | "setupFailed";
+
+/**
+ * The steps a project's setup goes through before it's live, as its page lists them: copying the
+ * Template into its repo, then its first release building it and serving it from its Worker.
+ */
+export type ProjectSetupStep = "copyTemplate" | "build" | "serve";
+
+export const PROJECT_SETUP_STEPS: readonly ProjectSetupStep[] = ["copyTemplate", "build", "serve"];

package/src/query-keys.ts

@@ -1,3 +1,5 @@
+import type { EndedDraft } from "./drafts";
+
 /**
  * Use TypeScript to enforce 'camox' as the first query key to ensure they're all namespaced.
  * This is because the Tanstack Query client on the frontend may be shared with the user's routes,
@@ -7,56 +9,88 @@ export type QueryKey = [first: "camox", ...rest: Array<string | number>];
 type QueryKeyGroup = Record<string, QueryKey | ((...args: any[]) => QueryKey)>;
 
 /**
- * Source axis on read query keys. `'live'` reads the page's live published
- * checkpoint snapshot; `'draft'` reads the live editor rows. The two render
- * through the same component — only the cache slot differs, so toggling the
- * source select is instant once both have been seeded.
- *
- * Block / page-read query keys include the source as the trailing key segment.
- * Omitting it on `invalidateQueries` is a prefix invalidation that hits every
- * source — used for navigation events and other source-agnostic invalidations.
- * Edit-time invalidations (which only touch draft data) pass `'draft'`
- * explicitly so the `'live'` cache stays untouched.
+ * The key prefixes the API's realtime invalidations name (ADR 0011). The studio caches each read
+ * under one of them, with the scope appended, so an invalidation reaches every read it should;
+ * the studio's own keys live with its reads, in the SDK.
  */
-export type ReadSource = "draft" | "live";
-
 export const queryKeys = {
-  comments: {
-    all: ["camox", "comments"],
-    list: (pageId: number) => ["camox", "comments", "list", pageId],
+  collections: {
+    record: (projectUuid: string, collectionId: string, id: string) => [
+      "camox",
+      "collections",
+      "record",
+      projectUuid,
+      collectionId,
+      id,
+    ],
+    records: (projectUuid: string, collectionId: string) => [
+      "camox",
+      "collections",
+      "records",
+      projectUuid,
+      collectionId,
+    ],
   },
   pages: {
     list: ["camox", "pages", "list"],
-    getByPath: (path: string, source?: ReadSource) =>
-      source
-        ? ["camox", "pages", "getByPath", path, source]
-        : ["camox", "pages", "getByPath", path],
+    getByPath: (path: string) => ["camox", "pages", "getByPath", path],
     getByPathAll: ["camox", "pages", "getByPath"],
-    getById: (id: number) => ["camox", "pages", "getById", id],
+    getById: (id: string) => ["camox", "pages", "getById", id],
   },
   files: {
     list: ["camox", "files", "list"],
-    get: (id: number) => ["camox", "files", "get", id],
+    get: (id: string) => ["camox", "files", "get", id],
   },
   blocks: {
-    get: (id: number, source?: ReadSource) =>
-      source ? ["camox", "blocks", "get", id, source] : ["camox", "blocks", "get", id],
+    get: (id: string) => ["camox", "blocks", "get", id],
+    // Every placement change refreshes what's under this prefix: counts, pages using a block.
     getUsageCounts: ["camox", "blocks", "getUsageCounts"],
-    getPageMarkdown: (pageId: number) => ["camox", "blocks", "getPageMarkdown", pageId],
-  },
-  repeatableItems: {
-    get: (id: number) => ["camox", "repeatableItems", "get", id],
+    // Under the usage counts prefix, so placing or removing the block refreshes it too.
+    getSyncedContent: (type: string) => ["camox", "blocks", "getUsageCounts", "synced", type],
+    getPageMarkdown: (pageId: string) => ["camox", "blocks", "getPageMarkdown", pageId],
   },
   layouts: {
     all: ["camox", "layouts"],
   },
-  environments: {
-    all: ["camox", "environments"],
-    checkCompatibility: ["camox", "environments", "checkCompatibility"],
+  drafts: {
+    all: ["camox", "drafts"],
+    // Open drafts and Live's latest publish: the same for every viewer, whatever they're in.
+    list: ["camox", "drafts", "list"],
+    // The draft a viewer is in, scoped to it like content.
+    get: ["camox", "drafts", "get"],
   },
 } satisfies Record<string, QueryKeyGroup>;
 
+/** The last segment of a query key: what the query reads, Live or a draft (ADR 0011). */
+export const LIVE_KEY_SCOPE = "live";
+
+/**
+ * A query key read from Live (`draftId` null) or from a draft. The keys above are prefixes naming
+ * what a query reads; the cache holds them with the scope appended, so each draft's queries are
+ * kept and invalidated apart.
+ */
+export function inScope(key: QueryKey, draftId: string | null): QueryKey {
+  return [...key, draftId ?? LIVE_KEY_SCOPE];
+}
+
+/** The scope a scoped query key ends in: `"live"` or a draft's id. */
+export function scopeOfKey(key: readonly unknown[]): unknown {
+  return key[key.length - 1];
+}
+
+/**
+ * Refetch the queries under these prefixes. `draftId` names the draft the change came from, so
+ * only that draft's queries refetch; a Live change (`null`) refetches every draft's too, since
+ * drafts read Live wherever they change nothing.
+ */
 export type InvalidationMessage = {
   type: "invalidate";
+  draftId: string | null;
   targets: QueryKey[];
 };
+
+/** A draft was published or discarded: its viewers go back to Live. */
+export type DraftEndedMessage = { type: "draftEnded" } & EndedDraft;
+
+/** Everything the project room broadcasts. */
+export type ProjectRoomMessage = InvalidationMessage | DraftEndedMessage;

package/src/reference-query.ts

@@ -0,0 +1,48 @@
+/**
+ * Rules for query-backed reference lists, shared by the SDK (builders) and the API (definition
+ * sync), so both accept and reject the same queries.
+ */
+
+/** The most records a query-backed list resolves to, and its default `limit`. */
+export const QUERY_LIMIT_CAP = 100;
+
+/** Record metadata a query can order by. Collections cannot name fields after them. */
+export type SystemOrderKey = "createdAt" | "publishedAt";
+export const SYSTEM_ORDER_KEYS: readonly SystemOrderKey[] = ["createdAt", "publishedAt"];
+
+export function isSystemOrderKey(key: string): key is SystemOrderKey {
+  return (SYSTEM_ORDER_KEYS as readonly string[]).includes(key);
+}
+
+/** Whether a reference list field is query-backed: code defines its records, nothing is stored. */
+export function isQueryBacked(field: object | null | undefined) {
+  return !!field && (field as { query?: unknown }).query !== undefined;
+}
+
+/**
+ * Why a query is invalid, if it is. `fieldTypeOf` gives the collection field type an ordering
+ * key names; keys must name a `String` field or system metadata.
+ */
+export function referenceQueryProblem(
+  query: unknown,
+  fieldTypeOf: (key: string) => unknown,
+): string | undefined {
+  if (!query || typeof query !== "object" || Array.isArray(query)) return "query must be an object";
+  const { orderBy, limit, ...rest } = query as Record<string, unknown>;
+  if (Object.keys(rest).length) return "query only supports orderBy and limit";
+  const validLimit =
+    typeof limit === "number" && Number.isInteger(limit) && limit >= 1 && limit <= QUERY_LIMIT_CAP;
+  if (limit !== undefined && !validLimit) {
+    return `limit must be an integer from 1 to ${QUERY_LIMIT_CAP}`;
+  }
+  if (orderBy === undefined) return;
+  const entries =
+    orderBy && typeof orderBy === "object" && !Array.isArray(orderBy)
+      ? Object.entries(orderBy)
+      : [];
+  if (entries.length !== 1) return "orderBy takes a single key";
+  const [[key, direction]] = entries;
+  if (direction !== "asc" && direction !== "desc") return 'order must be "asc" or "desc"';
+  if (isSystemOrderKey(key)) return;
+  if (fieldTypeOf(key) !== "String") return `cannot order by "${key}"`;
+}