@ditojs/server 2.99.1 → 3.0.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ditojs/server",
-  "version": "2.99.1",
+  "version": "3.0.0",
   "type": "module",
   "description": "Dito.js Server – Dito.js is a declarative and modern web framework, based on Objection.js, Koa.js and Vue.js",
   "repository": "https://github.com/ditojs/dito/tree/main/packages/server",
@@ -12,9 +12,6 @@
     "src/",
     "types/"
   ],
-  "scripts": {
-    "types": "tsc --noEmit --esModuleInterop ./types/index.d.ts"
-  },
   "bin": {
     "dito": "./src/cli/index.js"
   },
@@ -25,26 +22,25 @@
     "node >= 18"
   ],
   "dependencies": {
-    "@ditojs/admin": "^2.99.1",
-    "@ditojs/build": "^2.99.0",
-    "@ditojs/router": "^2.99.0",
-    "@ditojs/utils": "^2.99.0",
+    "@ditojs/admin": "^3.0.0",
+    "@ditojs/build": "^3.0.0",
+    "@ditojs/router": "^3.0.0",
+    "@ditojs/utils": "^3.0.0",
     "@koa/cors": "^5.0.0",
     "@koa/etag": "^5.0.2",
     "@koa/multer": "^4.0.0",
-    "@originjs/vite-plugin-commonjs": "^1.0.3",
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1",
     "bcryptjs": "^3.0.3",
     "bytes": "^3.1.2",
     "data-uri-to-buffer": "^8.0.0",
     "eventemitter2": "^6.4.9",
-    "file-type": "^22.0.1",
-    "helmet": "^8.1.0",
-    "koa": "^3.2.0",
+    "file-type": "^22.1.1",
+    "helmet": "^8.3.0",
+    "koa": "^3.2.1",
     "koa-bodyparser": "^4.4.1",
     "koa-compose": "^4.1.0",
-    "koa-compress": "^5.2.1",
+    "koa-compress": "^5.2.2",
     "koa-conditional-get": "^3.0.0",
     "koa-helmet": "^9.0.0",
     "koa-mount": "^4.2.0",
@@ -54,20 +50,20 @@
     "koa-static": "^5.0.0",
     "leather": "^3.0.3",
     "mime-types": "^3.0.2",
-    "multer": "^2.1.1",
+    "multer": "^2.4.0",
     "multer-s3": "github:ditojs/multer-s3#dito",
-    "nanoid": "^5.1.9",
-    "parse-duration": "^2.1.6",
+    "nanoid": "^6.0.1",
+    "parse-duration": "^2.1.9",
     "passport-local": "^1.0.0",
     "passthrough-counter": "^1.0.0",
     "picocolors": "^1.1.1",
-    "picomatch": "^4.0.4",
-    "pino": "^10.3.1",
+    "picomatch": "^4.0.7",
+    "pino": "^10.4.0",
     "pino-pretty": "^13.1.3",
     "pluralize": "^8.0.0",
     "repl": "^0.1.3",
-    "type-fest": "^5.6.0",
-    "uuid": "^14.0.0"
+    "type-fest": "^5.10.0",
+    "uuid": "^14.0.2"
   },
   "peerDependencies": {
     "@aws-sdk/client-s3": "^3.0.0",
@@ -76,19 +72,20 @@
     "objection": "^3.0.1"
   },
   "devDependencies": {
-    "@aws-sdk/client-s3": "^3.1030.0",
-    "@aws-sdk/lib-storage": "^3.1030.0",
+    "@aws-sdk/client-s3": "^3.1146.0",
+    "@aws-sdk/lib-storage": "^3.1146.0",
     "@types/koa-bodyparser": "^4.3.13",
     "@types/koa-compress": "^4.0.7",
+    "@types/koa-mount": "^4.0.5",
     "@types/koa-response-time": "^2.1.5",
-    "@types/koa-session": "^6.4.5",
     "@types/koa-static": "^4.0.4",
     "@types/koa__cors": "^5.0.1",
     "@types/koa__multer": "^2.0.8",
-    "@types/node": "^25.6.0",
-    "knex": "^3.2.9",
+    "@types/multer-s3": "^3.0.3",
+    "@types/node": "^26.6.4",
+    "knex": "^3.3.0",
     "objection": "^3.1.5",
     "typescript": "^6.0.3"
   },
-  "gitHead": "537d4483092604a1bfa055c151bccca4821de19a"
+  "gitHead": "399f683a6ca227a03cfc0978fee9055383e6b3d8"
 }

package/src/controllers/AdminController.js

@@ -3,7 +3,6 @@ import Koa from 'koa'
 import serve from 'koa-static'
 import { defineConfig, createServer } from 'vite'
 import createVuePlugin from '@vitejs/plugin-vue'
-import { viteCommonjs as createCommonJsPlugin } from '@originjs/vite-plugin-commonjs'
 import { testModuleIdentifier, getPostCssConfig } from '@ditojs/build'
 import { assignDeeply } from '@ditojs/utils'
 import { Controller } from './Controller.js'
@@ -174,11 +173,10 @@ export class AdminController extends Controller {
           root,
           base,
           mode: this.mode,
-          envFile: false,
+          envDir: false,
           configFile: false,
           plugins: [
             createVuePlugin(),
-            createCommonJsPlugin(),
             {
               // Private plugin to inject script tag above main module that
               // loads the `dito` object through its own end-point, see:
@@ -250,8 +248,7 @@ export class AdminController extends Controller {
                       'prosemirror-view'
                     ]
                   : ditoPackages
-              ),
-              ...nonEsmDependencies
+              )
             ]
           },
           resolve: {
@@ -279,12 +276,6 @@ const ditoPackages = [
   '@ditojs/utils'
 ]
 
-const nonEsmDependencies = [
-  // All non-es modules need to be explicitly included here, and some of
-  // them only work due to the use of `createCommonJsPlugin()`.
-  '@lk77/vue3-color'
-]
-
 const coreDependencies = [
   ...ditoPackages,
 
@@ -296,12 +287,11 @@ const coreDependencies = [
   'vue',
   '@vue/*',
   '@vueuse/*',
-  '@lk77/vue3-color',
+  'vue-color',
   '@kyvg/vue3-notification',
   'vue-multiselect',
   'vue-router',
   'vue-upload-component',
-  'tinycolor2',
   'focus-trap',
   'tabbable',
   'sortablejs',
@@ -314,8 +304,6 @@ const coreDependencies = [
   'nanoid',
   'punycode',
   'rope-sequence',
-  'filesize',
-  'filesize-parser',
   'tslib', // ?
   'orderedmap',
   'w3c-keyname'

package/src/models/Model.js

@@ -16,7 +16,9 @@ import {
   setValueAtDataPath,
   mapConcurrently,
   assignDeeply,
-  deprecate
+  deprecate,
+  formatPlainDate,
+  parsePlainDate
 } from '@ditojs/utils'
 import { QueryBuilder } from '../query/index.js'
 import { EventEmitter, KnexHelper } from '../lib/index.js'
@@ -443,10 +445,21 @@ export class Model extends objection.Model {
   static get dateAttributes() {
     return this._getCached(
       'jsonSchema:dateAttributes',
+      () =>
+        this.getAttributes(
+          ({ type, computed }) => !computed && type === 'date'
+        ),
+      []
+    )
+  }
+
+  static get datetimeAttributes() {
+    return this._getCached(
+      'jsonSchema:datetimeAttributes',
       () =>
         this.getAttributes(
           ({ type, computed }) => (
-            !computed && ['date', 'datetime', 'timestamp'].includes(type)
+            !computed && ['datetime', 'timestamp'].includes(type)
           )
         ),
       []
@@ -590,12 +603,20 @@ export class Model extends objection.Model {
   // @override
   $formatDatabaseJson(json) {
     const { constructor } = this
-    for (const key of constructor.dateAttributes) {
+    for (const key of constructor.datetimeAttributes) {
       const date = json[key]
       if (date?.toISOString) {
         json[key] = date.toISOString()
       }
     }
+    for (const key of constructor.dateAttributes) {
+      const date = json[key]
+      if (date?.toISOString) {
+        // Store dates as their plain date, as the database ignores the
+        // time zone when casting a timestamp to a date.
+        json[key] = formatPlainDate(date)
+      }
+    }
     if (constructor.isSQLite()) {
       // SQLite does not support boolean natively and needs conversion...
       for (const key of constructor.booleanAttributes) {
@@ -636,10 +657,17 @@ export class Model extends objection.Model {
   // @override
   $parseJson(json, { trusted = false } = {}) {
     const { constructor } = this
-    for (const key of constructor.dateAttributes) {
+    for (const key of [
+      ...constructor.dateAttributes,
+      ...constructor.datetimeAttributes
+    ]) {
       const date = json[key]
       if (date !== undefined) {
-        json[key] = isString(date) ? new Date(date) : date
+        // Parse plain dates like `2026-05-14` as local midnight, which is
+        // also how Postgres reads them for timestamps.
+        json[key] = isString(date)
+          ? parsePlainDate(date) ?? new Date(date)
+          : date
       }
     }
     // Convert plain asset files objects to AssetFile instances with references
@@ -652,13 +680,21 @@ export class Model extends objection.Model {
 
   // @override
   $formatJson(json) {
+    const { constructor } = this
     // Remove hidden attributes.
-    for (const key of this.constructor.hiddenAttributes) {
+    for (const key of constructor.hiddenAttributes) {
       delete json[key]
     }
+    // Return dates as their plain date, see `$formatDatabaseJson()`.
+    for (const key of constructor.dateAttributes) {
+      const date = json[key]
+      if (date?.toISOString) {
+        json[key] = formatPlainDate(date)
+      }
+    }
     // Sign asset files so clients can send them back with valid signatures.
     // Clone file objects to avoid mutating the model's internals.
-    this.constructor._signAssetFiles(json)
+    constructor._signAssetFiles(json)
     return json
   }
 

package/types/index.d.ts

@@ -19,7 +19,7 @@ import { Options as KoaBodyParserOptions } from 'koa-bodyparser'
 import { CompressOptions } from 'koa-compress'
 import koaMount from 'koa-mount'
 import koaResponseTime from 'koa-response-time'
-import koaSession from 'koa-session'
+import { CreateSessionOptions as KoaSessionOptions } from 'koa-session'
 import multer from '@koa/multer'
 import multerS3 from 'multer-s3'
 import * as objection from 'objection'
@@ -185,7 +185,7 @@ export interface ApplicationConfig {
      * @defaultValue `false`
      * @see https://github.com/koajs/session
      */
-    session?: boolean | (koaSession.opts & { modelClass: string })
+    session?: boolean | (KoaSessionOptions & { modelClass: string })
     /**
      * Enable passport authentication middleware
      *
@@ -413,7 +413,7 @@ export class Application<$Models extends Models = Models> {
           ctx: KoaContext,
           next: () => Promise<void>
         ) => OrPromiseOf<void>
-      ): this
+      ): unknown
       find(
         method: string,
         path: string
@@ -660,7 +660,8 @@ export class Application<$Models extends Models = Models> {
     method: HTTPMethod,
     path: string,
     transacted: boolean,
-    middlewares: OrArrayOf< (
+    middlewares: OrArrayOf<
+      (
         ctx: KoaContext,
         next: () => Promise<void>
       ) => OrPromiseOf<void>
@@ -683,21 +684,21 @@ export class Application<$Models extends Models = Models> {
 
 export interface Application
   extends Omit<
-      Koa,
-      | 'setMaxListeners'
-      | 'removeListener'
-      | 'removeAllListeners'
-      | 'prependOnceListener'
-      | 'prependListener'
-      | 'once'
-      | 'on'
-      | 'off'
-      | 'listeners'
-      | 'addListener'
-      | 'listenerCount'
-      | 'emit'
-      | 'eventNames'
-    >,
+    Koa,
+    | 'setMaxListeners'
+    | 'removeListener'
+    | 'removeAllListeners'
+    | 'prependOnceListener'
+    | 'prependListener'
+    | 'once'
+    | 'on'
+    | 'off'
+    | 'listeners'
+    | 'addListener'
+    | 'listenerCount'
+    | 'emit'
+    | 'eventNames'
+  >,
     EventEmitter {}
 
 export type SchemaType = LiteralUnion<
@@ -875,7 +876,7 @@ export interface ModelRelation<
   filter?:
     | string
     | { [name: string]: unknown[] }
-    | ((query: QueryBuilder) => void)
+    | ((query: QueryBuilder<Model>) => void)
     | Record<string, unknown>
   /**
    * Controls whether the auto-inserted foreign key property should be marked as
@@ -898,7 +899,7 @@ export interface ModelRelation<
    * As an object: `modify: { active: true }` (converted to a find-filter)
    */
   modify?:
-    | ((query: QueryBuilder) => void)
+    | ((query: QueryBuilder<Model>) => void)
     | Record<string, unknown>
 }
 
@@ -962,10 +963,15 @@ export type ModelProperty<T = any> = Schema<T> & {
  *
  * @see {@link https://github.com/ditojs/dito/blob/main/docs/model-scopes.md|Model Scopes}
  */
-export type ModelScope<$Model extends Model = Model> = (
-  query: QueryBuilder<$Model>,
-  applyParentScope: (query: QueryBuilder<$Model>) => QueryBuilder<$Model>
-) => QueryBuilder<$Model, any> | void
+// Scopes, filters and modifiers are declared through methods, to make their
+// parameters bivariant, so that models can type them with their own query
+// builders, e.g. `QueryBuilder<MyModel>` instead of `QueryBuilder<Model>`.
+export type ModelScope<$Model extends Model = Model> = {
+  bivarianceHack(
+    query: QueryBuilder<$Model>,
+    applyParentScope: (query: QueryBuilder<$Model>) => QueryBuilder<$Model>
+  ): QueryBuilder<$Model, any> | void
+}['bivarianceHack']
 
 /**
  * Map of scope names to scope functions. Scopes can be
@@ -984,10 +990,9 @@ export type ModelScopes<$Model extends Model = Model> = Record<
  * Modifiers are reusable query fragments applied via
  * `.modify('name')` on queries.
  */
-export type ModelModifier<$Model extends Model = Model> = (
-  query: QueryBuilder<$Model>,
-  ...args: any[]
-) => void
+export type ModelModifier<$Model extends Model = Model> = {
+  bivarianceHack(query: QueryBuilder<$Model>, ...args: any[]): void
+}['bivarianceHack']
 
 /**
  * Map of modifier names to modifier functions.
@@ -1001,10 +1006,9 @@ export type ModelModifiers<$Model extends Model = Model> = Record<
  * A filter handler function that modifies a query builder
  * based on external parameters (e.g. from URL query strings).
  */
-export type ModelFilterFunction<$Model extends Model = Model> = (
-  queryBuilder: QueryBuilder<$Model>,
-  ...args: any[]
-) => void
+export type ModelFilterFunction<$Model extends Model = Model> = {
+  bivarianceHack(queryBuilder: QueryBuilder<$Model>, ...args: any[]): void
+}['bivarianceHack']
 
 /**
  * Registry of known filter type names for use with
@@ -1098,6 +1102,30 @@ export interface ModelAsset {
 /** Map of property names to their asset configurations. */
 export type ModelAssets = Record<string, ModelAsset>
 
+/**
+ * Configuration for a controller's asset upload route, merged over the model's
+ * asset definition of the same data path.
+ */
+export type ControllerAsset = ModelAsset & {
+  transacted?: boolean
+}
+
+/**
+ * Map of data paths, with support for `*` and `**` wildcards, to their asset
+ * upload route configurations.
+ */
+export type ControllerAssets = {
+  [dataPath: string]:
+    | ControllerAsset
+    | OrReadOnly<string[]>
+    | ControllerAssetsAuthorize
+    | undefined
+  allow?: OrReadOnly<string[]>
+  authorize?: ControllerAssetsAuthorize
+}
+
+type ControllerAssetsAuthorize = Authorize | Record<string, Authorize>
+
 export interface ModelOptions extends objection.ModelOptions {
   graph?: boolean
   async?: boolean
@@ -1134,7 +1162,20 @@ export type ModelHooks<$Model extends Model = Model> = {
   }`]?: ModelHookFunction<$Model>
 }
 
-export class Model extends objection.Model {
+// objection's static side, minus the members that dito types with its own
+// `Model` and `QueryBuilder`. objection's versions use its own types, which
+// these can't be compatible with, e.g. modifiers receive objection's
+// QueryBuilder, while they always receive dito's at runtime.
+interface ObjectionModelStatic
+  extends Omit<
+    typeof objection.Model,
+    'modifiers' | 'query' | 'fromJson' | 'createNotFoundError'
+  > {
+  new (): objection.Model
+}
+declare const ObjectionModel: ObjectionModelStatic
+
+export class Model extends ObjectionModel {
   static query<M extends Model>(
     this: Constructor<M>,
     trxOrKnex?: objection.TransactionOrKnex
@@ -1232,7 +1273,10 @@ export class Model extends objection.Model {
 
   static get jsonAttributes(): string[]
   static get booleanAttributes(): string[]
+  /** The `date` attributes, stored and returned as plain dates. */
   static get dateAttributes(): string[]
+  /** The `datetime` and `timestamp` attributes. */
+  static get datetimeAttributes(): string[]
   static get computedAttributes(): string[]
   static get hiddenAttributes(): string[]
 
@@ -1240,8 +1284,6 @@ export class Model extends objection.Model {
   static app: Application<Models>
   /** Whether the model has been initialized by the application. */
   static initialized: boolean
-  /** The QueryBuilder class used by this model. */
-  static QueryBuilder: typeof QueryBuilder
   /** Whether to deep-clone object attributes on read. */
   static cloneObjectAttributes: boolean
   /**
@@ -1499,6 +1541,8 @@ export class Model extends objection.Model {
   $is(model: Model | null | undefined): boolean
   /** Returns `true` if all named properties are defined. */
   $has(...properties: string[]): boolean
+  /** Returns the knex instance, as in objection. */
+  $transaction(): Knex
   /** Runs a callback within a transaction. */
   $transaction(
     handler: (trx: objection.Transaction) => Promise<any>
@@ -1885,7 +1929,7 @@ export class Controller {
     base?: any,
     options?: {
       query?: Record<string, any>
-      modify?: (query: QueryBuilder<Model>) => QueryBuilder<Model>
+      modify?: (query: QueryBuilder<any>) => QueryBuilder<any>
       forUpdate?: boolean
     }
   ): Promise<Model | null>
@@ -1985,16 +2029,20 @@ export interface Controller extends EventEmitter {}
 /** A named action parameter with a JSON Schema definition. */
 export type ActionParameter = Schema & { name: string }
 
+// Handlers are declared through a method, to make their parameters, including
+// `this`, bivariant, so that controller subclasses remain assignable to their
+// base classes, e.g. in `ApplicationControllers`.
+type ControllerHandler<$Controller, $Args extends any[], $Result = any> = {
+  bivarianceHack(this: $Controller, ...args: $Args): $Result
+}['bivarianceHack']
+
 /**
  * Handler function for a model controller action. Receives
  * the Koa context and any resolved action parameters. `this`
  * is bound to the controller instance.
  */
-export type ModelControllerActionHandler<$ModelController = ModelController> = (
-  this: $ModelController,
-  ctx: KoaContext,
-  ...args: any[]
-) => any
+export type ModelControllerActionHandler<$ModelController = ModelController> =
+  ControllerHandler<$ModelController, [ctx: KoaContext, ...args: any[]]>
 
 /**
  * Handler function for a controller action. Receives the Koa
@@ -2005,8 +2053,8 @@ export type ControllerActionHandler<
   $Controller extends Controller = Controller,
   $Params = Record<string, any>
 > = keyof $Params extends never
-  ? (this: $Controller, ctx: KoaContext) => any
-  : (this: $Controller, ctx: KoaContext, params: $Params) => any
+  ? ControllerHandler<$Controller, [ctx: KoaContext]>
+  : ControllerHandler<$Controller, [ctx: KoaContext, params: $Params]>
 
 type ModelDataKey<T, K extends keyof T> = K extends
   | 'QueryBuilderType'
@@ -2171,7 +2219,9 @@ export type ModelControllerActions<$ModelController = ModelController> = {
   authorize?: Authorize
 }
 
-type ModelControllerMemberAction<$ModelController = ModelController> =
+type ModelControllerMemberAction<
+  $ModelController extends ModelControllerLike = ModelController
+> =
   | (Omit<ModelControllerActionOptions<$ModelController>, 'parameters'> & {
       parameters?: {
         [key: string]: MemberActionParameter<
@@ -2187,7 +2237,9 @@ type ModelControllerMemberAction<$ModelController = ModelController> =
  * `delete`). Member actions can use `{ from: 'member' }`
  * parameters to receive the resolved member model.
  */
-export type ModelControllerMemberActions<$ModelController = ModelController> = {
+export type ModelControllerMemberActions<
+  $ModelController extends ModelControllerLike = ModelController
+> = {
   [name: ControllerActionName]: ModelControllerMemberAction<$ModelController>
   allow?: OrReadOnly<ControllerActionName[]>
   authorize?: Authorize
@@ -2306,38 +2358,39 @@ type AfterCollectionGetHookKey = `after:collection:get`
 type AfterCustomHookKey =
   `after:${ModelControllerHookType | '*'}:${ControllerActionName | '*'}`
 
-export type ModelControllerHooks<$ModelController = ModelController> = {
-  [$Key in BeforeHookKey]?: (
-    this: $ModelController,
-    ctx: KoaContext,
-    params?: Record<string, any>
-  ) => void
+export type ModelControllerHooks<
+  $ModelController extends ModelControllerLike = ModelController
+> = {
+  [$Key in BeforeHookKey]?: ControllerHandler<
+    $ModelController,
+    [ctx: KoaContext, params?: Record<string, any>],
+    void
+  >
 } & {
-  [$Key in AfterDeleteHookKey]?: (
-    this: $ModelController,
-    ctx: KoaContext,
-    result: { count: number }
-  ) => any
+  [$Key in AfterDeleteHookKey]?: ControllerHandler<
+    $ModelController,
+    [ctx: KoaContext, result: { count: number }]
+  >
 } & {
-  [$Key in AfterItemHookKey]?: (
-    this: $ModelController,
-    ctx: KoaContext,
-    item: ModelFromModelController<$ModelController>
-  ) => any
+  [$Key in AfterItemHookKey]?: ControllerHandler<
+    $ModelController,
+    [ctx: KoaContext, item: ModelFromModelController<$ModelController>]
+  >
 } & {
-  [$Key in AfterCollectionGetHookKey]?: (
-    this: $ModelController,
-    ctx: KoaContext,
-    result:
-      | ModelFromModelController<$ModelController>[]
-      | Page<ModelFromModelController<$ModelController>>
-  ) => any
+  [$Key in AfterCollectionGetHookKey]?: ControllerHandler<
+    $ModelController,
+    [
+      ctx: KoaContext,
+      result:
+        | ModelFromModelController<$ModelController>[]
+        | Page<ModelFromModelController<$ModelController>>
+    ]
+  >
 } & {
-  [$Key in AfterCustomHookKey]?: (
-    this: $ModelController,
-    ctx: KoaContext,
-    result: any
-  ) => any
+  [$Key in AfterCustomHookKey]?: ControllerHandler<
+    $ModelController,
+    [ctx: KoaContext, result: any]
+  >
 }
 
 /**
@@ -2520,12 +2573,11 @@ export class ModelController<
    * object to assign them to the member.
    */
   member?: ModelControllerMemberActions<this>
-  assets?:
-    | boolean
-    | {
-        allow?: OrArrayOf<string>
-        authorize: Record<string, OrArrayOf<string>>
-      }
+  /**
+   * The asset upload routes, by data path, or `true` to use the model's
+   * asset definitions.
+   */
+  assets?: boolean | ControllerAssets
 
   /**
    * Lifecycle hooks that run before or after controller
@@ -2577,8 +2629,31 @@ export class ModelController<
    * @see {@link QueryParameterOptions} for pagination parameters
    */
   hooks?: ModelControllerHooks<this>
-  /** Map of relation name to RelationController instance. */
-  relations?: Record<string, RelationController>
+  /**
+   * The relations to expose as nested routes, by relation name. After setup,
+   * each configuration is replaced with its RelationController instance.
+   */
+  relations?: Record<string, ModelControllerRelation | RelationController>
+}
+
+/**
+ * Configuration of a relation route on a model controller, from which the
+ * {@link RelationController} is created. The relation's collection actions are
+ * provided as `relation`, to make sense for both one- and many-relations.
+ */
+export type ModelControllerRelation = Partial<
+  Pick<
+    RelationController,
+    | 'graph'
+    | 'transacted'
+    | 'scope'
+    | 'allowScope'
+    | 'allowFilter'
+    | 'allowParam'
+  >
+> & {
+  relation?: ModelControllerActions<RelationController>
+  member?: ModelControllerMemberActions<RelationController>
 }
 
 /**
@@ -3003,7 +3078,7 @@ export class QueryBuilder<
   R = M[]
 > extends objection.QueryBuilder<M, R> {
   /** Clones the query with scope/filter state. */
-  clone(): QueryBuilder<M, R>
+  clone(): this
   /**
    * Inherits scopes from a parent query.
    * @override
@@ -3142,7 +3217,11 @@ export class QueryBuilder<
     options?: DitoGraphOptions
   ): this
 
-  truncate(options?: { restart?: boolean; cascade?: boolean }): this
+  // Returns the query builder, which objection declares as `Promise<void>`.
+  truncate(options?: {
+    restart?: boolean
+    cascade?: boolean
+  }): this & Promise<void>
 
   ArrayQueryBuilderType: QueryBuilder<M, M[]>
   SingleQueryBuilderType: QueryBuilder<M, M>
@@ -3212,8 +3291,8 @@ export type PartialModelObject<T extends Model> = {
 export type PartialDitoModelGraph<M extends Partial<Model>> = {
   [K in objection.NonFunctionPropertyNames<M>]?: objection.Defined<
     M[K]
-  > extends Model
-    ? PartialDitoModelGraph<M[K]>
+  > extends infer D extends Model
+    ? PartialDitoModelGraph<D>
     : objection.Defined<M[K]> extends Array<infer I>
       ? I extends Partial<Model>
         ? PartialDitoModelGraph<I>[]
@@ -3606,11 +3685,11 @@ export function convertRelation(
 ): Record<string, any>
 
 export function getRelationClass(
-  relation: string | typeof objection.Relation
-): typeof objection.Relation | null
+  relation: string | objection.RelationType
+): objection.RelationType | null
 
 export function isThroughRelationClass(
-  relationClass: typeof objection.Relation
+  relationClass: objection.RelationType
 ): boolean
 
 export function addRelationSchemas(
@@ -3682,11 +3761,25 @@ export interface KoaContextState {
   [key: string]: unknown
 }
 
+/**
+ * The session on `ctx.session`, mirroring koa-session's `Session` class, which
+ * it doesn't export.
+ */
+export type KoaSession = Record<string, any> & {
+  isNew: boolean
+  readonly length: number
+  readonly populated: boolean
+  maxAge: number
+  save(callback?: (error?: Error) => void): Promise<void> | undefined
+  regenerate(callback?: (error?: Error) => void): Promise<void> | undefined
+  manuallyCommit(): Promise<void> | undefined
+}
+
 export type KoaContext<$State = KoaContextState> = Koa.ParameterizedContext<
   $State,
   {
     transaction: objection.Transaction
-    session: koaSession.ContextSession
+    session: KoaSession | null
     logger: PinoLogger
   }
 > & {
@@ -3701,9 +3794,10 @@ type OrReadOnly<T> = Readonly<T> | T
 
 type OrPromiseOf<T> = Promise<T> | T
 
-type ModelFromModelController<
-  $ModelController extends { modelClass?: Class<any> }
-> = InstanceType<Exclude<$ModelController['modelClass'], undefined>>
+type ModelControllerLike = { modelClass?: Class<Model> }
+
+type ModelFromModelController<$ModelController extends ModelControllerLike> =
+  InstanceType<Exclude<$ModelController['modelClass'], undefined>>
 
 type SerializeModelPropertyValue<T> = T extends (infer U)[]
   ? SerializeModelPropertyValue<U>[]