@drhomet/mithaq 0.1.1 → 0.2.0

package/dist/screen/generate.js

@@ -1,7 +1,7 @@
 import { execFile } from 'node:child_process';
-import { existsSync } from 'node:fs';
+import { existsSync, realpathSync } from 'node:fs';
 import { mkdir, readdir, readFile, rm, writeFile } from 'node:fs/promises';
-import { join, relative } from 'node:path';
+import { dirname, isAbsolute, join, relative, sep } from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { promisify } from 'node:util';
 import { isIdentifierName } from '@babel/helper-validator-identifier';
@@ -63,7 +63,47 @@ export type ScreenClient = Client<Pages>
 };
 // One literal, lazy `import.meta.glob` per package over exactly the files the
 // references name: Vite resolves a glob at build and takes no variable.
-const globOf = ({ screen, client, root, app, appName, linked }) => {
+const globOf = ({ screen, client, root, app, appName, from }) => {
+    // Each base is written from the screen's own folder into the project, the
+    // folder holding both the language and the app: the workspace root of a
+    // monorepo, the package itself otherwise. `files.ts` is committed, so a base
+    // never names a folder outside it, which differs from machine to machine.
+    const realApp = realpathSync(fileURLToPath(app));
+    const here = join(realApp, relative(fileURLToPath(app), fileURLToPath(from)));
+    const ours = realpathSync(fileURLToPath(root)).split(sep);
+    const theirs = realApp.split(sep);
+    let shared = 0;
+    while (shared < ours.length && ours[shared] === theirs[shared])
+        shared++;
+    const project = ours.slice(0, shared).join(sep) || sep;
+    const inProject = (folder) => !isAbsolute(relative(project, folder)) && relative(project, folder).split(sep)[0] !== '..';
+    const baseOf = (folder) => {
+        if (!inProject(folder))
+            throw new Refusal(`The ${screen} screen's files are read from ${folder}, outside the project at ${project}.`);
+        return `${relative(here, folder).replaceAll('\\', '/')}/`;
+    };
+    const linkFrom = ({ start, name }) => {
+        for (let folder = start;; folder = dirname(folder)) {
+            const link = join(folder, 'node_modules', name);
+            if (existsSync(link))
+                return link;
+            if (folder === project || dirname(folder) === folder)
+                return undefined;
+        }
+    };
+    // A workspace package is read where it is, which npm, pnpm, yarn and Bun
+    // agree on. Any other is read through its `node_modules` link, because the
+    // folder behind it names a version and a hash, or lies outside the project.
+    // An app that depends on the asas alone links no feature package under an
+    // isolated install (pnpm, Bun), so the asas, which depends on each, is asked next.
+    const installed = (name) => {
+        const link = linkFrom({ start: realApp, name }) ?? linkFrom({ start: ours.join(sep), name });
+        if (!link)
+            throw new Refusal(`The ${screen} screen names files of ${name}, which no node_modules in the project holds. Install it in the app.`);
+        const real = realpathSync(link);
+        return baseOf(inProject(real) && !relative(project, real).split(sep).includes('node_modules') ? real : link);
+    };
+    const linked = app.href === root.href ? '/' : baseOf(ours.join(sep));
     const byPackage = new Map();
     for (const key of new Set(referencesIn(client).map((reference) => reference.slice(0, reference.indexOf('#'))))) {
         const name = key.startsWith('./') ? '' : key.slice(0, key.indexOf(':'));
@@ -92,7 +132,7 @@ export const files = ${own}
 // Every file the \`${screen}\` screen's references name, each loaded when a page draws it, keyed as the reference prints it.
 const named = (name: string, files: Record<string, () => Promise<unknown>>) => Object.fromEntries(Object.entries(files).map(([file, load]) => [\`\${name}:\${file}\`, load]))
 export const files = {
-${bare.length ? `  ...${own},\n` : ''}${named.map((name) => `  ...named(${sourceString(name)}, ${glob(byPackage.get(name), name === appName ? '/' : `/node_modules/${name}/`)}),\n`).join('')}}
+${bare.length ? `  ...${own},\n` : ''}${named.map((name) => `  ...named(${sourceString(name)}, ${glob(byPackage.get(name), name === appName ? '/' : installed(name))}),\n`).join('')}}
 `;
 };
 const routesOf = (screen, client, prefix) => {
@@ -153,14 +193,13 @@ export const generateScreens = async ({ root, screens, into, locales = [], check
     const prefix = decodeURIComponent(into.pathname.slice(routesAt + '/routes'.length));
     // The app is the package holding `into`, and Vite's root is its folder.
     const app = packageOf(into) ?? root;
-    const linked = app.href === root.href ? '/' : `/node_modules/${JSON.parse(await readFile(new URL('package.json', root), 'utf8')).name}/`;
     const appName = JSON.parse(await readFile(new URL('package.json', app), 'utf8').catch(() => '{}')).name;
     const wanted = Object.entries(screens).flatMap(([key, client]) => {
         const from = new URL(`${key}/`, into);
         return [
             [new URL('screen.json', from), `${JSON.stringify(client, null, 2)}\n`],
             [new URL('types.ts', from), typesOf(client, locales)],
-            [new URL('files.ts', from), globOf({ screen: key, client, root, app, appName, linked })],
+            [new URL('files.ts', from), globOf({ screen: key, client, root, app, appName, from })],
             ...routesOf(key, client, prefix).map(([file, source]) => [new URL(file, into), source]),
         ];
     });
@@ -209,6 +248,9 @@ export const run = async (project, check) => {
         if (folder(at))
             byFolder.set(at, {});
     for (const [name, client] of Object.entries(screens)) {
+        // `false` is a project saying no app of its own serves this screen, so nothing is written for it.
+        if (!folder(into) && into[name] === false)
+            continue;
         const at = folder(into) ?? folder(into[name]);
         if (!at)
             throw new Refusal(`generate.screens names no folder for the screen ${name}. Name one: \`screens: { ${name}: 'src/routes/(screens)/' }\`.`);

package/dist/screen/index.d.ts

@@ -53,6 +53,10 @@ export declare const screenKinds: {
         cell: "relationship";
         control: "relationship";
     };
+    readonly json: {
+        cell: "json";
+        control: "json";
+    };
     readonly join: {
         cell: "join";
         control: "join";
@@ -216,6 +220,12 @@ export type ScreenList<Locale extends string = string, Ref extends string | Ui =
     readonly sort?: FieldName | `-${FieldName}`;
     /** The page size a list opens with, which the URL's own `limit` overrides. */
     readonly limit?: number;
+    /** The list's tabs, each a `where` it holds every page to; the first is the one it opens on. */
+    readonly tabs?: readonly {
+        readonly tab: string;
+        readonly label: Localized<Locale>;
+        readonly where?: Where;
+    }[];
 };
 /** A button that runs one of the kayan's operations, wherever it sits: `button` names the operation. */
 export type ScreenButton<Locale extends string = string, Ref extends string | Ui = string | Ui> = {
@@ -235,7 +245,7 @@ export type ScreenButton<Locale extends string = string, Ref extends string | Ui
 export type ScreenPage<Locale extends string = string, Ref extends string | Ui = string | Ui, FieldName extends string = string> = {
     readonly path: string;
     readonly page: ScreenFrame<Locale, Ref, FieldName>;
-    /** `create` and `edit` only: the record opens over the list, in one of shadcn's three. */
+    /** `create` and `edit` only: the record opens over the list, in shadcn's dialog or sheet, or a full-page drawer as Payload's document drawer. */
     readonly mode?: 'dialog' | 'drawer' | 'sheet';
     readonly component?: never;
 } | {
@@ -274,6 +284,8 @@ type FieldData = {
     on?: string;
     /** Relationship only: whether this field holds a set of rows rather than one. */
     hasMany?: true;
+    /** Relationship only: whether its picker reads `for` this field, so the server holds the rows to its `filterOptions`. */
+    filterOptions?: true;
 };
 /** One field as a screen draws it: the data a browser needs, and this screen's drawing facts decided. */
 export type ClientField = FieldData & {
@@ -337,6 +349,11 @@ export type ListClient = {
     row?: ButtonClient[];
     sort?: string;
     limit?: number;
+    tabs?: {
+        tab: string;
+        label: Localized;
+        where?: Where;
+    }[];
     /** A list of another kayan: its name, and its relationship holding this page's row. */
     of?: string;
     where?: string;

package/dist/screen/index.js

@@ -2,7 +2,7 @@ import { existsSync, readFileSync } from 'node:fs';
 import { builtInScreenKinds, choiceControls, packageName, registryCells, registryControls } from './client.js';
 import { unsortable } from '../mithaq/types.js';
 import { defaultKinds } from '../base/kinds.js';
-import { assertFieldWhere } from '../asas/runner/write.js';
+import { assertFieldWhere, assertWhere } from '../asas/runner/write.js';
 import { bulkSeals, readSeals, sealOf, storeSeals } from '../asas/runner/steps.js';
 import { kindOf } from './studio.js';
 import { implementationOf } from '../mithaq/rukn.js';
@@ -40,13 +40,14 @@ export const clientFieldOf = (name, field) => ({
                 ? { relationTo: field.relationTo().name }
                 : {}),
     ...(field.hasMany === true && { hasMany: true }),
+    ...(typeof field.filterOptions === 'function' && { filterOptions: true }),
     ...(typeof field.on === 'string' && { on: field.on }),
 });
 const word = /^[\p{ID_Start}$_][\p{ID_Continue}$]*$/u;
 const targetKeys = ['capability', 'type', 'path', 'kayan', 'controls', 'providers', 'pages', 'layouts', 'components'];
 const leafKeys = ['field', 'component', 'cell', 'placeholder', 'description', 'readOnly', 'width', 'when'];
 const buttonKeys = ['button', 'label', 'fields', 'reload', 'component', 'confirm', 'when'];
-const listKeys = ['columns', 'filters', 'search', 'empty', 'menu', 'toolbar', 'bulk', 'row', 'sort', 'limit', 'of', 'where'];
+const listKeys = ['columns', 'filters', 'search', 'empty', 'menu', 'toolbar', 'bulk', 'row', 'sort', 'limit', 'tabs', 'of', 'where'];
 const modes = ['dialog', 'sheet', 'drawer'];
 /** Every key of `value` is one `known` names, so nothing reaches `screen.json` unnamed. */
 const named = (at, value, known, what) => {
@@ -177,6 +178,11 @@ export const screensOf = (language, resolved) => {
             const map = place === 'layout' ? 'layouts' : 'components';
             if (Object.hasOwn(maps[map], value))
                 return maps[map][value];
+            // A kind no registry control or cell draws names itself, and the project's components map draws it under that name.
+            if (place === 'control' && value === kind && !Object.hasOwn(shippedControls, value) && !registryControls.includes(value))
+                return value;
+            if (place === 'cell' && value === kind && !shippedCells.includes(value) && !registryCells.includes(value))
+                return value;
             const shipped = place === 'control' ? Object.keys(shippedControls) : place === 'cell' ? shippedCells : [];
             if (!shipped.includes(value)) {
                 throw new Error(`${at} names "${value}", which is no name in this screen's ${map} and no ${place} the registry ships.`);
@@ -199,7 +205,7 @@ export const screensOf = (language, resolved) => {
                 throw new Error(`${screen} controls has no row for kind "${kind}", and every kind of the language needs one.`);
             controls[kind] = {
                 control: ref(`${screen} controls "${kind}" control`, 'control', row.control, kind),
-                cell: ref(`${screen} controls "${kind}" cell`, 'cell', row.cell),
+                cell: ref(`${screen} controls "${kind}" cell`, 'cell', row.cell, kind),
             };
         }
         for (const name of target.kayan) {
@@ -224,7 +230,7 @@ export const screensOf = (language, resolved) => {
                 ...(typeof field.suffix === 'object' && { suffix: field.suffix }),
                 ...(typeof field.description === 'object' && { description: field.description }),
                 component,
-                cell: own.cell ? ref(`${where} targets.${key}.cell`, 'cell', own.cell) : controls[field.kind].cell,
+                cell: own.cell ? ref(`${where} targets.${key}.cell`, 'cell', own.cell, field.kind) : controls[field.kind].cell,
                 ...(typeof own.width === 'string' && { width: own.width }),
                 ...(own.filter === true && { filter: true }),
                 ...(own.searchable === true && { searchable: true }),
@@ -370,7 +376,7 @@ export const screensOf = (language, resolved) => {
                     ...(typeof readOnly === 'boolean' && { readOnly }),
                     ...(typeof width === 'string' && { width }),
                     ...(place === 'control' && { component: control }),
-                    ...((place === 'cell' || cell) && { cell: cell ? ref(`${node} "${name}" cell`, 'cell', cell) : field.cell }),
+                    ...((place === 'cell' || cell) && { cell: cell ? ref(`${node} "${name}" cell`, 'cell', cell, field.kind) : field.cell }),
                     ...(placeholder !== undefined && { placeholder: copy(`${node} "${name}" placeholder`, placeholder) }),
                     ...(description !== undefined && { description: copy(`${node} "${name}" description`, description) }),
                     decided,
@@ -443,7 +449,7 @@ export const screensOf = (language, resolved) => {
                         return { ...drawn, list: { of, where: where, ...drawn.list } };
                     }
                     held.list++;
-                    const { columns, filters, search, empty, menu, sort, limit } = one.list;
+                    const { columns, filters, search, empty, menu, sort, limit, tabs } = one.list;
                     // Where a button sits decides which operations it may run: bulk over ticked rows,
                     // row over its row, toolbar over none.
                     const buttons = (region) => {
@@ -480,6 +486,17 @@ export const screensOf = (language, resolved) => {
                     if (limit !== undefined && !(Number.isInteger(limit) && limit >= 1 && limit <= maxLimit)) {
                         throw new Error(`${node} list limit is ${JSON.stringify(limit)}, and a limit is a whole number from 1 to ${maxLimit}.`);
                     }
+                    if (tabs !== undefined && (!Array.isArray(tabs) || !tabs.length))
+                        throw new Error(`${node} list tabs is no list of tabs.`);
+                    const tabbed = tabs?.map((tab, at) => {
+                        const said = `${node} list tab ${at}`;
+                        named(said, tab, ['tab', 'label', 'where'], 'tab');
+                        // Written into the URL as itself, so a word, once per list.
+                        if (typeof tab.tab !== 'string' || !/^[A-Za-z][A-Za-z0-9]*$/.test(tab.tab) || tabs.findIndex((other) => other.tab === tab.tab) !== at) {
+                            throw new Error(`${said} is named ${JSON.stringify(tab.tab)}, and a tab is named once in a list, in letters and digits.`);
+                        }
+                        return { tab: tab.tab, label: copy(`${said} label`, tab.label), ...(tab.where !== undefined && { where: assertWhere(kayan, tab.where) }) };
+                    });
                     return {
                         list: {
                             columns: columns.map((column) => leafOf(`${node} list column`, column, 'cell')),
@@ -492,6 +509,7 @@ export const screensOf = (language, resolved) => {
                             ...(row && { row }),
                             ...(sort !== undefined && { sort }),
                             ...(limit !== undefined && { limit }),
+                            ...(tabbed && { tabs: tabbed }),
                         },
                         ...drawnBy(node, one),
                     };

package/dist/screen/react.d.ts

@@ -18,10 +18,12 @@ export type ScreenState = LocaleState & {
             name: string;
             path: string;
         }[];
+        /** `names` is each locale's name, the JSON the project's auth setup writes; `name` is the default locale's. */
         organizations?: readonly {
             id: string;
             name: string;
             slug?: string;
+            names?: string;
         }[];
         activeOrganizationId?: string | null;
     };

package/dist/storage/index.d.ts

@@ -1,11 +1,10 @@
 import type { StandardSchemaV1 } from '../mithaq/standard-schema.ts';
 import type { ResolvedField } from '../mithaq/types.ts';
-import type { Tables } from '../drizzle/index.ts';
 import { type StorageConfig } from './storage.ts';
 /** A relationship to a kayan that holds files, drawn as a file picker. */
 export declare const upload: import("../base/kinds.ts").Kind<string | number, "defaultValue" | "index" | "onDelete" | "providedBy" | "required" | "unique"> & {
     targets: {
-        readonly drizzle: (field: ResolvedField, tables: Tables) => import("drizzle-orm/pg-core").AnyPgColumnBuilder;
+        readonly drizzle: import("../targets.ts").ColumnBuilder;
         readonly zod: (field: ResolvedField) => import("zod").ZodArray<import("zod").ZodGUID | import("zod").ZodInt32 | import("zod").ZodString> | import("zod").ZodGUID | import("zod").ZodInt32 | import("zod").ZodString;
         readonly standardSchema: (field: ResolvedField) => StandardSchemaV1<unknown, number | string>;
         readonly screen: {
@@ -25,7 +24,7 @@ export declare const storage: (config: StorageConfig) => {
     readonly kinds: {
         readonly upload: import("../base/kinds.ts").Kind<string | number, "defaultValue" | "index" | "onDelete" | "providedBy" | "required" | "unique"> & {
             targets: {
-                readonly drizzle: (field: ResolvedField, tables: Tables) => import("drizzle-orm/pg-core").AnyPgColumnBuilder;
+                readonly drizzle: import("../targets.ts").ColumnBuilder;
                 readonly zod: (field: ResolvedField) => import("zod").ZodArray<import("zod").ZodGUID | import("zod").ZodInt32 | import("zod").ZodString> | import("zod").ZodGUID | import("zod").ZodInt32 | import("zod").ZodString;
                 readonly standardSchema: (field: ResolvedField) => StandardSchemaV1<unknown, number | string>;
                 readonly screen: {

package/dist/storage/index.js

@@ -21,8 +21,7 @@ export const upload = kind((value) => typeof value === 'number' || typeof value
     // A file a row still names is never deleted from under it, whether or not the field is required.
     onDelete: 'restrict',
     targets: {
-        // A set's join table restricts too, where a relationship's cascades.
-        drizzle: (field, tables) => drizzleKinds.relationship(field.hasMany ? { ...field, rules: { ...field.rules, onDelete: 'restrict' } } : field, tables),
+        drizzle: drizzleKinds.relationship,
         zod: zodKinds.relationship,
         standardSchema: (field) => ({
             '~standard': {

package/dist/storage/storage.d.ts

@@ -226,6 +226,8 @@ export type StorageConfig = {
     adapter: string;
     /** The largest file in bytes a kayan holds when its `targets.storage` names no `fileSize`. */
     fileSize: number;
+    /** The largest request body `uploadInstructions` reads, answered 413 past it: `defaultMaxBodyBytes` or the project's own. */
+    maxBodyBytes: number;
     /** The object key, decided before the upload. */
     key: (args: {
         prefix: string;

package/dist/storage/storage.js

@@ -4,8 +4,9 @@ import { createHmac, timingSafeEqual } from 'node:crypto';
 import { drizzle } from 'drizzle-orm/node-postgres';
 import { isStorage } from '../mithaq/language.js';
 import { providerOf } from '../base/rules.js';
-import { AsasError, codes, denied, invalid, missing } from '../asas/runner/errors.js';
+import { AsasError, retryConflict, codes, denied, invalid, missing } from '../asas/runner/errors.js';
 import { sealOf } from '../asas/runner/steps.js';
+import { assertMaxBodyBytes, boundedBody } from '../asas/http/fetch.js';
 import { allowedType } from './allowed-type.js';
 /** Written by the runner when the row is made, from the signed upload, and by nobody after. */
 const fileColumn = { create: 'application', update: 'never' };
@@ -181,6 +182,7 @@ export const resolveStorage = ({ language, resolved, storeOf, active }) => {
     if (!Number.isSafeInteger(given.fileSize) || given.fileSize < 1) {
         throw new Error(`storage.fileSize is ${JSON.stringify(given.fileSize)}, and it is a whole number of bytes above 0.`);
     }
+    assertMaxBodyBytes('storage', given.maxBodyBytes);
     if (typeof given.onError !== 'function')
         throw new Error('storage names no "onError" function, which a file route hands what it threw before it answers 500. Name the project\'s own, such as console.error.');
     const adapters = Object.entries(given.adapters ?? {});
@@ -323,9 +325,13 @@ export const storageRoutes = ({ kayan, config, read, authorize, admin, }) => {
             return null;
         try {
             if (verb === 'uploadInstructions' && id === undefined && request.method === 'POST') {
+                // Bounded before the actor is asked, so no caller holds the server to a body of any size.
+                const read = await boundedBody(request, config.maxBodyBytes);
+                if (read instanceof Response)
+                    return read;
                 let input;
                 try {
-                    input = await request.json();
+                    input = JSON.parse(await read.text());
                 }
                 catch {
                     input = undefined;
@@ -347,6 +353,7 @@ export const storageRoutes = ({ kayan, config, read, authorize, admin, }) => {
             return new Response(served.body, { status: served.status, statusText: served.statusText, headers });
         }
         catch (thrown) {
+            thrown = retryConflict(thrown);
             if (thrown instanceof AsasError)
                 return refusal(thrown);
             config.onError(thrown);

package/dist/targets.d.ts

@@ -0,0 +1,14 @@
+export { drizzleAdapter, type Adapter, type ColumnBuilder, type ColumnRule } from './drizzle/index.ts';
+export { kinds as drizzleKinds, idKinds as drizzleIdKinds } from './drizzle/kinds.ts';
+export { rules as drizzleRules } from './drizzle/rules.ts';
+export { zodTarget, type ZodRule, type ZodShape } from './zod/index.ts';
+export { kinds as zodKinds, idKinds as zodIdKinds } from './zod/kinds.ts';
+export { rules as zodRules } from './zod/rules.ts';
+export { defaultBulkLimit, defaultDepth, defaultJoinLimit, defaultLimit, defaultMaxLimit, serviceTarget, type ServiceTarget } from './service/index.ts';
+export { defaultAuthorize } from './asas/runner/write.ts';
+export { rbacTarget, type AccessOptions, type AccessTarget, type SystemRole, type SystemRoles } from './rbac/index.ts';
+export { betterAuthTarget, memberRoleTarget, type BetterAuthAccessOptions } from './auth/better-auth/access.ts';
+export { betterAuthTenant } from './auth/better-auth/tenant.ts';
+export { screenKinds, screenTarget, type ScreenTarget } from './screen/index.ts';
+export { defaultFileSize, storageTarget, type StorageConfig, type StorageTarget } from './storage/storage.ts';
+export { versionsTarget, type KayanVersions, type VersionsTarget } from './versions/index.ts';

package/dist/targets.js

@@ -0,0 +1,16 @@
+// Every target factory mithaq ships and the named defaults its options take, so a project's
+// `targets` block reads from one place: `import { drizzleAdapter, serviceTarget } from 'mithaq/targets'`.
+export { drizzleAdapter } from './drizzle/index.js';
+export { kinds as drizzleKinds, idKinds as drizzleIdKinds } from './drizzle/kinds.js';
+export { rules as drizzleRules } from './drizzle/rules.js';
+export { zodTarget } from './zod/index.js';
+export { kinds as zodKinds, idKinds as zodIdKinds } from './zod/kinds.js';
+export { rules as zodRules } from './zod/rules.js';
+export { defaultBulkLimit, defaultDepth, defaultJoinLimit, defaultLimit, defaultMaxLimit, serviceTarget } from './service/index.js';
+export { defaultAuthorize } from './asas/runner/write.js';
+export { rbacTarget } from './rbac/index.js';
+export { betterAuthTarget, memberRoleTarget } from './auth/better-auth/access.js';
+export { betterAuthTenant } from './auth/better-auth/tenant.js';
+export { screenKinds, screenTarget } from './screen/index.js';
+export { defaultFileSize, storageTarget } from './storage/storage.js';
+export { versionsTarget } from './versions/index.js';

package/dist/vite.d.ts

@@ -0,0 +1,7 @@
+import { type Plugin } from 'vite';
+/**
+ * Serves the admin's pieces from the installed `mithaq-admin`, and a file the project ejected into `ejected`
+ * in place of the package's file of the same name, for every importer: the app, the package's own pieces and
+ * other ejected files. Deleting the ejected file returns the project to the package's.
+ */
+export declare const mithaqAdmin: (ejected: string) => Plugin;

package/dist/vite.js

@@ -0,0 +1,81 @@
+import { existsSync, readdirSync, readFileSync, realpathSync, statSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { dirname, join } from 'node:path';
+import { normalizePath } from 'vite';
+/**
+ * Serves the admin's pieces from the installed `mithaq-admin`, and a file the project ejected into `ejected`
+ * in place of the package's file of the same name, for every importer: the app, the package's own pieces and
+ * other ejected files. Deleting the ejected file returns the project to the package's.
+ */
+export const mithaqAdmin = (ejected) => {
+    // Resolved from the project, so a store layout finds the copy the project installed.
+    const registry = join(dirname(createRequire(join(ejected, 'x')).resolve('mithaq-admin/package.json')), 'registry/');
+    return {
+        name: 'mithaq-admin',
+        enforce: 'pre',
+        // Pre-bundled, a piece the app imports and the same piece a sibling imports are two modules in dev.
+        // No `server.warmup` of the package: measured cold, it served the first page 0.7 s later and loaded the
+        // client 1 s sooner, and it set the optimizer discovering dependencies no page asked for yet.
+        config: () => ({ optimizeDeps: { exclude: ['mithaq-admin'] } }),
+        // The dependency scan stops at the excluded package, so what only the pieces import (Lexical, TanStack Form, and
+        // through the app's own primitives, Base UI) would be found by the first page that needs it, re-optimized mid-page
+        // into a second React, and the page reloaded. Named up front instead, but only what the project installed from a
+        // registry: an optional peer it left out (Lexical without rich text) fails the whole optimization, and a linked
+        // workspace package is served as source, where an include would stop the scan finding what it imports. And only
+        // what nothing excludes, since an include wins over an exclude: last, after every plugin has named its own.
+        configEnvironment: { order: 'post', handler(name, { optimizeDeps, resolve }) {
+                if (name !== 'client')
+                    return;
+                // ponytail: an exclude a plugin adds later than configEnvironment (in configResolved) is not seen here and loses
+                // to the include; read the resolved config there if a plugin ever does.
+                const excluded = optimizeDeps?.exclude ?? [];
+                const folders = createRequire(join(ejected, 'x')).resolve.paths('x') ?? [];
+                const alias = resolve?.alias ?? [];
+                const aliases = Array.isArray(alias) ? alias : Object.entries(alias).map(([find, replacement]) => ({ find, replacement }));
+                /** The file of the app's a relative or aliased specifier names, '' where none is, or nothing for a package. */
+                const local = (specifier, from) => {
+                    const entry = aliases.find(({ find }) => (typeof find === 'string' ? specifier === find || specifier.startsWith(`${find}/`) : find.test(specifier)));
+                    const path = specifier.startsWith('.') ? join(dirname(from), specifier) : entry && specifier.replace(entry.find, entry.replacement);
+                    return path === undefined ? undefined : (['', '.tsx', '.ts'].map((extension) => path + extension).find((file) => statSync(file, { throwIfNoEntry: false })?.isFile()) ?? '');
+                };
+                // The pieces, and the app's own files they reach, such as the primitives the published package leaves out.
+                // What a project ejects into its language package (mail, steps, storage) runs on the server alone.
+                const files = new Set(readdirSync(registry, { recursive: true, encoding: 'utf8' }).filter((file) => /\.tsx?$/.test(file) && !/^(mail|steps|storage)\//.test(normalizePath(file))).map((file) => join(registry, file)));
+                const imports = new Set();
+                for (const file of files) {
+                    // ponytail: a regex over the source, which a ` from '...'` inside a string or a comment fools into one more
+                    // include; parse the files if a piece ever reads that way.
+                    for (const [, type, specifier] of readFileSync(file, 'utf8').matchAll(/^(?:import|export)\s+(type\s)?(?:[^'";]*?\sfrom\s*)?['"]([^'"]+)['"]/gm)) {
+                        if (type)
+                            continue;
+                        const found = local(specifier, file);
+                        if (found)
+                            files.add(found);
+                        else if (found === undefined)
+                            imports.add(specifier);
+                    }
+                }
+                const include = [...imports].filter((specifier) => {
+                    // `mithaq` too, which the app's own code imports, so the scan finds it: named here, its rich text would be
+                    // bundled where no Lexical is installed.
+                    if (/^(\/|node:|mithaq(\/|$))/.test(specifier))
+                        return false;
+                    const pkg = specifier.split('/').slice(0, specifier.startsWith('@') ? 2 : 1).join('/');
+                    const installed = folders.map((folder) => join(folder, pkg)).find((folder) => existsSync(join(folder, 'package.json')));
+                    return !excluded.includes(pkg) && !excluded.includes(specifier) && !!installed && normalizePath(realpathSync(installed)).includes('/node_modules/');
+                });
+                return { optimizeDeps: { include: include.sort() } };
+            } },
+        // By the specifier, not by resolving it: published as `@drhomet/mithaq-admin`, a piece in a store's folder cannot
+        // reach `mithaq-admin/<file>` by walking up, so the plugin answers for every importer.
+        resolveId(source) {
+            const [, file] = /^mithaq-admin\/(.+\.tsx?)$/.exec(source) ?? [];
+            // A piece names a sibling by its file alone, so a climb out of the package is no import of ours.
+            if (!file || file.split('/').includes('..'))
+                return;
+            const own = join(ejected, file);
+            // The real path, as Vite names every other module, so a symlinked folder is never a second module.
+            return normalizePath(existsSync(own) ? realpathSync(own) : join(registry, file));
+        },
+    };
+};

package/dist/zod/index.d.ts

@@ -32,6 +32,7 @@ type ZodShapes<F extends Record<string, RuntimeField>> = {
 declare const listShape: z.ZodObject<{
     data: z.ZodOptional<z.ZodUnknown>;
     depth: z.ZodOptional<z.ZodUnknown>;
+    for: z.ZodOptional<z.ZodUnknown>;
     limit: z.ZodOptional<z.ZodUnknown>;
     page: z.ZodOptional<z.ZodUnknown>;
     sort: z.ZodOptional<z.ZodUnknown>;
@@ -58,8 +59,9 @@ declare const target: {
         textArray: (field?: ResolvedField) => z.ZodArray<z.ZodEnum<{
             [x: string]: string;
         }> | z.ZodString>;
-        uuid: (field?: ResolvedField) => z.ZodGUID;
+        uuid: (field?: ResolvedField) => z.ZodGUID | z.ZodInt32 | z.ZodString;
         relationship: (field: ResolvedField) => z.ZodArray<z.ZodGUID | z.ZodInt32 | z.ZodString> | z.ZodGUID | z.ZodInt32 | z.ZodString;
+        json: (field?: ResolvedField) => z.ZodCustom<import("../base/kinds.ts").Json, import("../base/kinds.ts").Json>;
         join: (field?: ResolvedField) => z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     };
     readonly rules: {
@@ -158,7 +160,7 @@ declare const target: {
         }) => z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
         defaultValue: ({ shape }: {
             shape: z.ZodType;
-            value: string | number | boolean | Date | readonly unknown[] | import("../index.ts").Ref;
+            value: Date | readonly unknown[] | import("../index.ts").Ref | import("../base/kinds.ts").Json;
             field: ResolvedField;
         }) => z.ZodOptional<z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>;
         defaultNow: ({ shape, value: on }: {
@@ -178,7 +180,14 @@ declare const target: {
     }, fields: F) => ZodShapes<F>;
 };
 /** The zod schema target. */
-export declare const zodTarget: typeof target & {
+export declare const zodTarget: <const Kinds extends Record<string, ZodShape>, const Rules extends Record<string, ZodRule>, const IdKinds extends readonly string[]>({ kinds, rules, idKinds }: {
+    kinds: Kinds;
+    rules: Rules;
+    idKinds: IdKinds;
+}) => Omit<typeof target, 'kinds' | 'rules' | 'idKinds'> & {
+    kinds: Kinds;
+    rules: Rules;
+    idKinds: IdKinds;
     readonly derives?: ZodDerives;
 };
 export {};

package/dist/zod/index.js

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { storedRichText } from '../rich-text/rich-text.js';
+import { storedRichText } from '../rich-text/value.js';
 import { providerOf } from '../base/rules.js';
 import { idKinds as zodIdKinds, kinds as zodKinds } from './kinds.js';
 import { implementationOf } from '../mithaq/rukn.js';
@@ -74,6 +74,7 @@ const rowSchema = (schema, fields) => z.object(Object.fromEntries(Object.entries
 const listShape = z.strictObject({
     data: z.unknown().optional(),
     depth: z.unknown().optional(),
+    for: z.unknown().optional(),
     limit: z.unknown().optional(),
     page: z.unknown().optional(),
     sort: z.unknown().optional(),
@@ -88,11 +89,11 @@ const target = {
     rules: zodRules,
     derive(fields) {
         const built = fieldShapes(fields, this.kinds, this.rules);
-        // A stored row is read against its kinds alone, with no rule and no `options`,
-        // so a rule or option added after rows were stored refuses their next save, never their read.
+        // A stored row is read against its kinds alone, with no rule, `options`, `jsonSchema` or `maxBytes`,
+        // so one added after rows were stored refuses their next save, never their read.
         const kinds = Object.fromEntries(Object.entries(fields).map(([name, field]) => [
             name,
-            { ...field, options: undefined, ...(field.kind === 'richText' && { richText: storedRichText }) },
+            { ...field, options: undefined, jsonSchema: undefined, maxBytes: undefined, ...(field.kind === 'richText' && { richText: storedRichText }) },
         ]));
         const stored = fieldShapes(kinds, this.kinds, { localized: this.rules.localized });
         const drafted = fieldShapes(Object.fromEntries(Object.entries(kinds).map(([name, field]) => [name, field.kind === 'richText' ? { ...field, richText: fields[name].richText, rules: { ...field.rules, required: false } } : field])), this.kinds, { localized: this.rules.localized });
@@ -118,4 +119,4 @@ const target = {
     },
 };
 /** The zod schema target. */
-export const zodTarget = target;
+export const zodTarget = ({ kinds, rules, idKinds }) => ({ ...target, kinds, rules, idKinds });

package/dist/zod/kinds.d.ts

@@ -1,5 +1,6 @@
 import { z } from 'zod';
 import type { ResolvedField } from '../mithaq/types.ts';
+import { type Json } from '../base/kinds.ts';
 export declare const errorOf: (field?: ResolvedField, element?: boolean) => ((issue: {
     input: unknown;
 }) => string) | undefined;
@@ -27,8 +28,9 @@ export declare const kinds: {
     textArray: (field?: ResolvedField) => z.ZodArray<z.ZodEnum<{
         [x: string]: string;
     }> | z.ZodString>;
-    uuid: (field?: ResolvedField) => z.ZodGUID;
+    uuid: (field?: ResolvedField) => z.ZodGUID | z.ZodInt32 | z.ZodString;
     relationship: (field: ResolvedField) => z.ZodArray<z.ZodGUID | z.ZodInt32 | z.ZodString> | z.ZodGUID | z.ZodInt32 | z.ZodString;
+    json: (field?: ResolvedField) => z.ZodCustom<Json, Json>;
     join: (field?: ResolvedField) => z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 };
 export {};

package/dist/zod/kinds.js

@@ -1,5 +1,7 @@
 import { z } from 'zod';
+import { isJson } from '../base/kinds.js';
 import { isDecimal } from '../base/decimal.js';
+import { jsonSchemaCheck } from '../base/json-schema.js';
 // A missing key, or a `null` on a required field, is the `required` rule refusing;
 // anything else is the kind refusing the value. A field with no kayan keeps zod's text.
 export const errorOf = (field, element = false) => field?.kayan
@@ -12,7 +14,8 @@ const idShapes = {
     number: (error) => z.int32({ error }),
     text: (error) => z.string({ error }),
     // `guid`, not `uuid`: `z.uuid()` also demands an RFC version and variant, which Postgres does not.
-    uuid: (error) => z.guid({ error }),
+    // Lower-cased, the spelling Postgres answers, so a step comparing ids as text sees one id.
+    uuid: (error) => z.guid({ error }).toLowerCase(),
 };
 /** The kinds this target shapes an id of, the same three the store's columns are. */
 export const idKinds = Object.keys(idShapes);
@@ -40,10 +43,16 @@ export const kinds = {
     date: (field) => z.iso.date({ error: errorOf(field) }),
     // The same error on each element, so a bad element reads as the field's own sentence.
     textArray: (field) => z.array(textShape(field, true), { error: errorOf(field) }),
-    uuid: (field) => z.guid({ error: errorOf(field) }),
+    uuid: (field) => idShape('uuid', errorOf(field)),
     relationship: (field) => field.hasMany
         ? z.array(idShape(field.target.fields.id.kind, errorOf(field, true)), { error: errorOf(field) })
         : idShape(field.target.fields.id.kind, errorOf(field)),
+    // Only what JSON can say, so a value reads back as it was written; `z.json()` lets a cycle through.
+    // A `jsonSchema` only judges: what is stored is the value as sent.
+    json: (field) => {
+        const shape = z.custom((value) => isJson(value) && !(field?.maxBytes && new TextEncoder().encode(JSON.stringify(value)).length > field.maxBytes), { error: errorOf(field) });
+        return field?.jsonSchema ? shape.refine(jsonSchemaCheck(field), { error: errorOf(field) }) : shape;
+    },
     // Left loose: the child's row shape may not be derived yet, and the child's own read already parsed the rows.
     join: (field) => z.array(z.record(z.string(), z.unknown()), { error: errorOf(field) }),
 };

package/dist/zod/rules.d.ts

@@ -99,7 +99,7 @@ export declare const rules: {
     }) => z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
     defaultValue: ({ shape }: {
         shape: z.ZodType;
-        value: string | number | boolean | Date | readonly unknown[] | import("../index.ts").Ref;
+        value: Date | readonly unknown[] | import("../index.ts").Ref | import("../index.ts").Json;
         field: ResolvedField;
     }) => z.ZodOptional<z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>;
     /** The moment the defaults step writes, which leaves the key optional as a literal does. */