@drhomet/mithaq 0.1.1 → 0.2.0

package/dist/drizzle/index.js

@@ -1,13 +1,12 @@
-import { and, asc, count as sqlCount, desc, eq, getTableColumns, getTableName, gt, gte, ilike, inArray, isNotNull, isNull, lt, lte, ne, notInArray, or, sql } from 'drizzle-orm';
+import { and, asc, count as sqlCount, sum as sqlSum, desc, eq, getTableColumns, getTableName, gt, gte, ilike, inArray, isNotNull, isNull, lt, lte, ne, notInArray, or, sql } from 'drizzle-orm';
 import { drizzle } from 'drizzle-orm/node-postgres';
 import { boolean as pgBoolean, index, integer as pgInteger, isPgEnum, jsonb, timestamp, uuid as pgUuid, pgEnum, pgSchema, pgTable, primaryKey, unique as uniqueConstraint, uniqueIndex, } from 'drizzle-orm/pg-core';
 import { isPlainIdentifier, snakeCase, uniqueRuleIndexes, versionsTableOf } from '../mithaq/resolve.js';
 import { implementationOf } from '../mithaq/rukn.js';
-import { conflict, localizedQuery } from '../asas/runner/errors.js';
+import { conflict, invalid, missing, localizedQuery } from '../asas/runner/errors.js';
 import { Refusal } from '../mithaq/refusal.js';
 import { providerOf } from '../base/rules.js';
-import { idKinds as drizzleIdKinds, kinds as drizzleKinds } from './kinds.js';
-import { rules as drizzleRules } from './rules.js';
+import { kinds as drizzleKinds } from './kinds.js';
 const modifiable = (column) => {
     for (const method of ['default', 'notNull', 'primaryKey', 'unique']) {
         if (typeof Reflect.get(column, method) !== 'function') {
@@ -49,11 +48,13 @@ const refusedSchema = (name) => typeof name !== 'string' || !isPlainIdentifier(n
 // A plain `Error`: what reaches here is a `where` an access callback returned, the
 // project's own bug; the read layer refuses a caller's first.
 const refuseLocalized = (kayan, field, what, locales) => new Error(localizedQuery({ kayan, field, what, locales }));
-// Postgres answers `23503`, refused as a conflict naming which kayan points at the
-// row, never which row. Read by schema too: another tool may share a table name.
+// Postgres answers `23503`, or from 18 on `23001` for an `ON DELETE RESTRICT` key, refused as a
+// conflict naming which kayan points at the row, never which row. Read by schema too: another
+// tool may share a table name.
+const pointedAt = new Set(['23503', '23001']);
 const referenced = ({ thrown, name, kayans, tables }) => {
     const held = thrown;
-    const error = held?.code === '23503' ? held : held?.cause?.code === '23503' ? held.cause : undefined;
+    const error = pointedAt.has(held?.code) ? held : pointedAt.has(held?.cause?.code) ? held.cause : undefined;
     if (!error)
         return thrown;
     // A kayan's join tables are built in its own table's schema.
@@ -122,6 +123,47 @@ const conditionsOf = (column, rules) => {
     });
     return checks.length === 1 ? checks[0] : and(...checks);
 };
+// Payload's own path, `$[*].a[*].b[*]`: a list at any segment, a list inside a list included, is
+// matched by any of its entries. The path and every value are bound parameters, and each key a
+// quoted jsonpath string, so nothing a caller wrote is read as SQL or jsonpath.
+const jsonConditionsOf = (column, path, rules) => {
+    const at = `$[*]${path.map((key) => `.${JSON.stringify(key)}[*]`).join('')}`;
+    const some = (test) => sql `exists (select 1 from jsonb_path_query(${column}, ${at}::jsonpath) as item(value) where ${test})`;
+    // A JSON `null` is no value, as a SQL `NULL` is: `exists` and `equals: null` read both alike.
+    const present = some(sql `item.value <> 'null'::jsonb`);
+    const text = sql `(item.value #>> '{}')`;
+    const equal = (value) => (value === null ? sql `not ${present}` : some(sql `item.value = ${JSON.stringify(value)}::jsonb`));
+    // One subquery for the whole list, against a hashed set: one per value, or `= any(array)`, compares
+    // every item with every value, which took seconds for a thousand values over 20,000 rows.
+    const listed = (value) => {
+        const { hasNull, values } = splitNulls(value);
+        const hit = values.length ? some(sql `item.value in (select unnest(${sql.param(values.map((one) => JSON.stringify(one)))}::jsonb[]))`) : sql `false`;
+        return hasNull ? or(sql `not ${present}`, hit) : hit;
+    };
+    const checks = Object.entries(rules).map(([operator, value]) => {
+        switch (operator) {
+            case 'contains':
+                return some(ilike(text, pattern(String(value))));
+            case 'like': {
+                const words = String(value).trim().split(/\s+/).filter(Boolean);
+                return words.length ? some(and(...words.map((word) => ilike(text, pattern(word))))) : undefined;
+            }
+            case 'equals':
+                return equal(value);
+            case 'not_equals':
+                return value === null ? present : and(present, sql `not ${equal(value)}`);
+            case 'exists':
+                return value ? present : sql `not ${present}`;
+            case 'in':
+                return listed(value);
+            case 'not_in':
+                return and(present, sql `not ${listed(value)}`);
+        }
+        // Unreachable past the kind's operators, but never left out of a `where` that carries an access constraint.
+        throw new Error(`Unsupported where operator "${operator}" on a json field.`);
+    });
+    return checks.length === 1 ? checks[0] : and(...checks);
+};
 const whereOf = (db, tables, kayanByName, name, where) => {
     const table = tables[name];
     const kayan = kayanByName.get(name);
@@ -135,8 +177,23 @@ const whereOf = (db, tables, kayanByName, name, where) => {
     for (const [field, rules] of Object.entries(where)) {
         if (field === 'and' || field === 'or')
             continue;
-        const [ownField, relatedField] = field.split('.');
+        const [ownField, ...path] = field.split('.');
+        const relatedField = path[0];
         const relationField = kayan.fields[ownField];
+        if (relationField?.kind === 'json') {
+            parts.push(jsonConditionsOf(table[ownField], path, rules));
+            continue;
+        }
+        // Whether a versions table's snapshot holds an id in one field, alone or in a set: the delete's
+        // reference check asks it, and a caller's read of versions refuses every path before here.
+        // Lowered, since a draft keeps a uuid as its writer sent it.
+        if (!relationField && ownField === 'version' && relatedField && table.version) {
+            const { equals, ...other } = rules;
+            if (equals === undefined || Object.keys(other).length)
+                throw new Error(`Kayan "${name}" path "${field}" takes equals alone.`);
+            parts.push(sql `lower((${table.version} -> ${relatedField})::text)::jsonb @> ${JSON.stringify(typeof equals === 'string' ? equals.toLowerCase() : equals)}::jsonb`);
+            continue;
+        }
         // A `hasMany` field has no column here, so the join table is filtered and its
         // parent ids filter this table.
         if (relationField?.hasMany) {
@@ -279,9 +336,7 @@ export const recordMigration = async ({ db, hash, createdAt, name }) => {
     await db.execute(sql `with gone as (delete from ${historyTable} where name = ${devPushMarker})
     insert into ${historyTable} (hash, created_at, name) values (${hash}, ${createdAt}, ${name})`);
 };
-/** The drizzle store target's maps: a map per kind and a map per rule. */
-export const drizzleTarget = { capability: 'store', type: 'drizzle', idKinds: drizzleIdKinds, kinds: drizzleKinds, rules: drizzleRules };
-export const drizzleAdapter = ({ db: ready, connectionString, kinds, rules, idKinds = drizzleIdKinds, push: named, prodMigrations, }) => {
+export const drizzleAdapter = ({ db: ready, connectionString, kinds, rules, idKinds, push: named, prodMigrations, }) => {
     if (prodMigrations && prodMigrations.pending !== 'run' && prodMigrations.pending !== 'refuse') {
         throw new Error(`drizzleAdapter's prodMigrations.pending is 'run' or 'refuse', not ${JSON.stringify(prodMigrations.pending)}.`);
     }
@@ -361,6 +416,27 @@ const storeOf = ({ ready, opened, db, connectionString, kinds, rules, idKinds, p
         }
         return flat;
     };
+    const declaredData = (name, values) => {
+        const described = kayanByName.get(name);
+        // A version's fields describe virtual snapshot paths, while core writes the physical snapshot column.
+        const fields = described?.fields.parent?.target?.versions?.table === name ? getTableColumns(tables[name]) : described?.fields ?? getTableColumns(tables[name]);
+        const field = Object.keys(values).find((key) => !Object.hasOwn(fields, key));
+        if (field)
+            throw invalid({ message: `Kayan "${name}" declares no field "${field}".`, key: 'error.invalid.value', params: { kayan: name, field } });
+        return values;
+    };
+    const increments = ({ name, values, insert = false }) => {
+        const data = { ...declaredData(name, values) };
+        for (const [field, value] of Object.entries(data)) {
+            if (kayanByName.get(name)?.fields[field]?.kind === 'json' || !value || typeof value !== 'object' || !('$inc' in value))
+                continue;
+            if (kayanByName.get(name)?.fields[field]?.kind !== 'integer' || !Number.isSafeInteger(value.$inc) || Object.keys(value).length !== 1) {
+                throw invalid({ message: `Kayan "${name}" field "${field}" accepts $inc only on an integer field with one safe integer.`, key: 'error.invalid.value', params: { kayan: name, field } });
+            }
+            data[field] = insert ? value.$inc : sql `${tables[name][field]} + ${value.$inc}`;
+        }
+        return data;
+    };
     // A field whose every locale column is null is one null, which matches the derived row shape.
     const expand = (name, row) => {
         const fields = localizedOf(name);
@@ -472,7 +548,11 @@ const storeOf = ({ ready, opened, db, connectionString, kinds, rules, idKinds, p
                     throw new Error(`Kayan "${kayan.name}" asks for the schema ${JSON.stringify(kayan.schemaName)}, ${refused} Give the kayan another schemaName.`);
                 }
                 const built = Object.create(null);
-                const columns = Object.values(kayan.fields).flatMap(columnsOfField(kayan.store));
+                // A table reads its own columns first, whichever place the kayan spread the timestamps in.
+                // A column never moves in a table that exists: drizzle-kit diffs columns by name.
+                const stamp = (field) => field.name === 'createdAt' || field.name === 'updatedAt';
+                const declared = Object.values(kayan.fields).flatMap(columnsOfField(kayan.store));
+                const columns = [...declared.filter((field) => !stamp(field)), ...declared.filter(stamp)];
                 // `pgTable` keys on the field name, so a localized `title` and a plain `titleAr` would
                 // both ask for `title_ar` and one field would end with no column.
                 const asked = new Set();
@@ -550,9 +630,9 @@ const storeOf = ({ ready, opened, db, connectionString, kinds, rules, idKinds, p
                     if (tables[name]) {
                         throw new Error(`Kayan "${kayan.name}" field "${field.name}" needs the join table "${name}", which is already the table of kayan "${name}". Rename one of the two, or give the kayan a dbName of its own.`);
                     }
-                    // Each end takes the type of the id it points at. `cascade` on both: the row belongs to
-                    // the pair. An upload's own builder answers `restrict`.
-                    const reference = (build, column, target) => modifiable(build({ ...field, name: column, column: `${column}_id`, target, rules: { onDelete: 'cascade' } }, tables)).notNull();
+                    // Each end takes the type of the id it points at. The parent's end cascades, since the row
+                    // belongs to its parent; the target's is the field's own `onDelete`.
+                    const reference = (build, column, target, onDelete) => modifiable(build({ ...field, name: column, column: `${column}_id`, target, rules: { onDelete } }, tables)).notNull();
                     // Named, so the check below holds them to the schema's one namespace.
                     const key = `${name}_pkey`;
                     const targetIndex = `${name}_target_id_index`;
@@ -564,8 +644,8 @@ const storeOf = ({ ready, opened, db, connectionString, kinds, rules, idKinds, p
                         indexNames.push({ where: `Kayan "${kayan.name}" field "${field.name}" join table ${what}`, kayan: kayan.name, name: named });
                     }
                     tables[name] = tableIn(schemaOf(tables[kayan.name]))(name, {
-                        parent: reference(kinds.relationship, 'parent', kayan),
-                        target: reference(implementationOf({ table: kinds, shipped: drizzleKinds, name: field.kind, own: field.kindTargets, type: 'drizzle' }), 'target', field.target),
+                        parent: reference(kinds.relationship, 'parent', kayan, 'cascade'),
+                        target: reference(implementationOf({ table: kinds, shipped: drizzleKinds, name: field.kind, own: field.kindTargets, type: 'drizzle' }), 'target', field.target, field.rules?.onDelete),
                         // The only order a set of ids has.
                         order: pgInteger('order').notNull(),
                     }, (table) => [
@@ -663,8 +743,7 @@ const storeOf = ({ ready, opened, db, connectionString, kinds, rules, idKinds, p
             if (!tablesFilter.length)
                 return;
             await refuseStrangers({ db, tables, by: 'push' });
-            // `drizzle-kit/api-postgres` imports every driver drizzle speaks, so webpack and Turbopack
-            // are told to leave the import to the runtime.
+            (await import('./migrate.js')).holdOwnKit();
             const { pushSchema } = await import(/* webpackIgnore: true */ 'drizzle-kit/api-postgres');
             // `owned`: a column of a table of the language has the type, which makes it the language's own.
             const listed = (values) => sql.join(values.map((value) => sql `${value}`), sql `, `);
@@ -725,7 +804,7 @@ const storeOf = ({ ready, opened, db, connectionString, kinds, rules, idKinds, p
             return db.transaction((tx) => run(tx));
         },
         async insert({ tx, kayan: name, data: values }) {
-            const { columns, sets } = withoutSets(name, values);
+            const { columns, sets } = withoutSets(name, declaredData(name, values));
             let result;
             try {
                 result = await tx.insert(tables[name]).values(flatten(name, columns)).returning();
@@ -741,16 +820,44 @@ const storeOf = ({ ready, opened, db, connectionString, kinds, rules, idKinds, p
             await writeSets(tx, name, held.id, sets);
             return withSets(tx, name, held);
         },
+        async upsert({ tx, kayan: name, on, data: values, where }) {
+            if (!tx)
+                throw new Error('An upsert requires a transaction.');
+            const kayan = kayanByName.get(name);
+            const table = tables[name];
+            const inserted = withoutSets(name, increments({ name, values, insert: true }));
+            const updated = withoutSets(name, increments({ name, values }));
+            const set = flatten(name, Object.fromEntries(Object.entries(updated.columns).filter(([field]) => field !== 'id' && field !== kayan.tenant && !on.includes(field))));
+            // Even a key-only upsert returns the existing row, without changing its identity.
+            if (!Object.keys(set).length)
+                set[on[0]] = table[on[0]];
+            let result;
+            try {
+                result = await tx.insert(table).values(flatten(name, inserted.columns)).onConflictDoUpdate({ target: on.map((field) => table[field]), set, setWhere: where ? whereOf(tx, tables, kayanByName, name, where) : undefined }).returning();
+            }
+            catch (thrown) {
+                throw collision(thrown, name);
+            }
+            if (!Array.isArray(result))
+                throw new Error('The drizzle store expected upsert to return rows.');
+            const [row] = result;
+            if (!row)
+                throw missing({ message: `No "${name}" row found.`, key: 'error.not_found.row', params: { kayan: name } });
+            const held = expand(name, row);
+            await writeSets(tx, name, held.id, inserted.sets);
+            return withSets(tx, name, held);
+        },
         async update({ tx, kayan: name, id, data: values, where }) {
-            const { columns, sets } = withoutSets(name, values);
+            const { columns, sets } = withoutSets(name, increments({ name, values }));
             const flat = flatten(name, columns);
             const matched = idWhere(tx, tables, kayanByName, name, id, where);
             let result;
             try {
-                // drizzle refuses an empty `set`, so a write naming only sets locks the row instead.
+                // drizzle refuses an empty `set`, so a write naming only sets locks the row instead, as an UPDATE
+                // of no key column would: a stronger lock would deadlock with a write naming the row.
                 result = Object.keys(flat).length
                     ? await tx.update(tables[name]).set(flat).where(matched).returning()
-                    : await tx.select().from(tables[name]).where(matched).for('update');
+                    : await tx.select().from(tables[name]).where(matched).for('no key update');
             }
             catch (thrown) {
                 throw collision(thrown, name);
@@ -787,8 +894,12 @@ const storeOf = ({ ready, opened, db, connectionString, kinds, rules, idKinds, p
             return { ...sets, ...expand(name, row) };
         },
         async find({ kayan: name, args: { limit, lock, page, sort, where }, tx }) {
+            if (lock && !tx)
+                throw new Error('A locked find requires a transaction.');
             const client = (tx ?? db);
             const table = tables[name];
+            if (!Object.hasOwn(kayanByName.get(name)?.fields ?? getTableColumns(table), sort.field))
+                throw invalid({ message: `Kayan "${name}" declares no field "${sort.field}".`, key: 'error.invalid.value', params: { kayan: name, field: sort.field } });
             if (kayanByName.get(name)?.fields[sort.field]?.rules?.localized) {
                 throw refuseLocalized(name, sort.field, 'sort');
             }
@@ -805,7 +916,7 @@ const storeOf = ({ ready, opened, db, connectionString, kinds, rules, idKinds, p
             const offset = limit > 0 ? (page - 1) * limit : 0;
             // `$dynamic()` keeps each branch one type, so drizzle checks `orderBy` against the table.
             const query = client.select().from(table).$dynamic().where(condition);
-            const locked = tx && lock === 'update' ? query.for('update') : query;
+            const locked = tx && lock ? query.for({ update: 'update', noKeyUpdate: 'no key update', share: 'share', keyShare: 'key share' }[lock]) : query;
             const ordered = locked.orderBy(...orderBy).offset(offset);
             const docs = limit > 0 ? await ordered.limit(limit) : await ordered;
             const rows = await client.select({ totalDocs: sqlCount() }).from(table).where(condition);
@@ -816,6 +927,14 @@ const storeOf = ({ ready, opened, db, connectionString, kinds, rules, idKinds, p
                 totalDocs: Number(rows[0]?.totalDocs ?? 0),
             };
         },
+        async sum({ tx, kayan: name, field, where }) {
+            if (!['integer', 'number', 'decimal'].includes(kayanByName.get(name)?.fields[field]?.kind ?? '')) {
+                throw invalid({ message: `Kayan "${name}" field "${field}" is not numeric, so it cannot be summed.`, key: 'error.invalid.value', params: { kayan: name, field } });
+            }
+            const client = (tx ?? db);
+            const rows = await client.select({ total: sqlSum(tables[name][field]) }).from(tables[name]).where(where ? whereOf(client, tables, kayanByName, name, where) : undefined);
+            return rows[0]?.total ?? '0';
+        },
         async count({ kayan: name, args: { where }, tx }) {
             const client = (tx ?? db);
             // The relationship filters use subqueries, so there are no joins to deduplicate.

package/dist/drizzle/kinds.d.ts

@@ -22,6 +22,7 @@ export declare const kinds: {
     datetime: (field: ResolvedField) => import("drizzle-orm/pg-core").PgTimestampBuilder;
     date: (field: ResolvedField) => import("drizzle-orm/pg-core").PgDateStringBuilder;
     join: (field: ResolvedField) => never;
+    json: (field: ResolvedField) => import("drizzle-orm/pg-core").PgJsonbBuilder;
     relationship: ColumnBuilder;
 };
 export {};

package/dist/drizzle/kinds.js

@@ -1,4 +1,4 @@
-import { boolean, date, integer, numeric, serial, text, timestamp, uuid, varchar } from 'drizzle-orm/pg-core';
+import { boolean, date, integer, jsonb, numeric, serial, text, timestamp, uuid, varchar } from 'drizzle-orm/pg-core';
 /** Length is a rule, not a kind: without a maximum a string column is `text`. */
 const string = (field) => typeof field.rules?.maxLength !== 'number'
     ? text(field.column)
@@ -37,5 +37,7 @@ export const kinds = {
     join: (field) => {
         throw new Error(`Field "${field.name}" is a join, whose rows are held by kayan "${field.target?.name}", so this store builds no column for it.`);
     },
+    // `jsonb`, as Payload's Postgres adapter stores a json field, so either reads what the other wrote.
+    json: (field) => jsonb(field.column),
     relationship,
 };

package/dist/drizzle/migrate.d.ts

@@ -1,7 +1,33 @@
+import * as modules from 'node:module';
 import { type NodePgDatabase } from 'drizzle-orm/node-postgres';
 import { type ProdMigrations } from './index.ts';
 import type { ResolvedKayan } from '../mithaq/types.ts';
 export declare const binary: string;
+/**
+ * Resolves each drizzle-orm import made under `kit` from `from` instead. drizzle-kit imports
+ * drizzle-orm without declaring it, so on its own it loads whatever copy the project hoists,
+ * such as a 0.45 beside the one the tables were built with, and fails on it.
+ */
+export declare const holdKitOrm: ({ kit, from }: {
+    kit: string;
+    from: string;
+}) => modules.ModuleHooks;
+/** The drizzle-kit this mithaq installs, and the file its drizzle-orm resolves from. */
+export declare const ownKit: {
+    kit: string;
+    from: string;
+};
+/** Holds this mithaq's drizzle-kit to its own drizzle-orm in this process, once. */
+export declare const holdOwnKit: () => {};
+/**
+ * A module to `--import` that holds `kit`'s drizzle-orm to `from`'s in a child process.
+ * ponytail: only the drizzle-kit mithaq starts is held; `drizzle-kit migrate` run by hand beside a
+ * second drizzle-orm still loads the hoisted one. Ship a `mithaq` word that applies migrations if that bites.
+ */
+export declare const kitOrm: (held: {
+    kit: string;
+    from: string;
+}) => string;
 export declare const header = "// Written by `mithaq migrate`. Commit it.";
 /** One `unresolved` item, and one reply in the hints file, are the same shape. */
 type Hint = {

package/dist/drizzle/migrate.js

@@ -6,8 +6,9 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
     }
     return path;
 };
-import { execFile } from 'node:child_process';
-import { existsSync, readFileSync } from 'node:fs';
+import { spawn } from 'node:child_process';
+import * as modules from 'node:module';
+import { closeSync, existsSync, openSync, readFileSync } from 'node:fs';
 import { mkdir, mkdtemp, readdir, readFile, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join, resolve as resolvePath } from 'node:path';
@@ -22,6 +23,34 @@ import { createHistory, devPushMarker, historyLock, historyTable, joinTableOf, m
 // `bin.cjs` is not in drizzle-kit's `exports`, so it is resolved as the root entry's
 // sibling; resolved from this file, so a consumer gets its own `mithaq`'s copy.
 export const binary = fileURLToPath(new URL('bin.cjs', import.meta.resolve('drizzle-kit')));
+/**
+ * Resolves each drizzle-orm import made under `kit` from `from` instead. drizzle-kit imports
+ * drizzle-orm without declaring it, so on its own it loads whatever copy the project hoists,
+ * such as a 0.45 beside the one the tables were built with, and fails on it.
+ */
+export const holdKitOrm = ({ kit, from }) => 
+// Node's alone: a runtime without it resolves as it did.
+modules.registerHooks?.({
+    resolve: (specifier, context, next) => {
+        if (!/^drizzle-orm($|\/)/.test(specifier) || !context.parentURL?.startsWith(kit))
+            return next(specifier, context);
+        // A require is resolved from the requiring file whatever parentURL says, so it is resolved here.
+        return context.conditions.includes('require')
+            ? { url: pathToFileURL(modules.createRequire(from).resolve(specifier)).href, shortCircuit: true }
+            : next(specifier, { ...context, parentURL: from });
+    },
+});
+/** The drizzle-kit this mithaq installs, and the file its drizzle-orm resolves from. */
+export const ownKit = { kit: new URL('.', import.meta.resolve('drizzle-kit')).href, from: import.meta.url };
+let ownHeld;
+/** Holds this mithaq's drizzle-kit to its own drizzle-orm in this process, once. */
+export const holdOwnKit = () => (ownHeld ??= holdKitOrm(ownKit) ?? true);
+/**
+ * A module to `--import` that holds `kit`'s drizzle-orm to `from`'s in a child process.
+ * ponytail: only the drizzle-kit mithaq starts is held; `drizzle-kit migrate` run by hand beside a
+ * second drizzle-orm still loads the hoisted one. Ship a `mithaq` word that applies migrations if that bites.
+ */
+export const kitOrm = (held) => `data:text/javascript,${encodeURIComponent(`import { holdKitOrm } from ${JSON.stringify(import.meta.url)}\nholdKitOrm(${JSON.stringify(held)})\n`)}`;
 const configName = 'drizzle.config.ts';
 const schemaName = 'schema.ts';
 const hintsName = 'mithaq.hints.json';
@@ -640,16 +669,19 @@ const moveHistory = async ({ db, directory, check }) => {
     order by old.id returning name`);
     console.log(`Copied ${moved.rows.length} ${moved.rows.length === 1 ? 'row' : 'rows'} of this project's history from drizzle.__drizzle_migrations into ${history}, where mithaq keeps it now. The rows in drizzle.__drizzle_migrations are left as they were.`);
 };
-// drizzle's own rule, which matches a folder to a row by `name` alone.
-const unapplied = async ({ db, directory }) => {
-    let localMigrations = [];
+const migrationsIn = (directory) => {
     try {
-        localMigrations = readMigrationFiles({ migrationsFolder: fileURLToPath(directory) });
+        return readMigrationFiles({ migrationsFolder: fileURLToPath(directory) });
     }
     catch (error) {
         if (error.code !== 'ENOENT')
             throw error;
+        return [];
     }
+};
+// drizzle's own rule, which matches a folder to a row by `name` alone.
+const unapplied = async ({ db, directory }) => {
+    const localMigrations = migrationsIn(directory);
     if (!localMigrations.length)
         return [];
     let dbMigrations = [];
@@ -674,6 +706,10 @@ export const bootMigrations = async ({ db, prodMigrations }) => {
         throw new Refusal(`prodMigrations names ${migrationsFolder} as the migrations folder, and under ${process.cwd()} it holds no ${configName}, which every folder \`mithaq migrate\` writes holds, so this boot cannot tell which migrations this database has applied. Ship the folder with the deploy, or name where it is. Nothing was checked or applied.`);
     }
     const directory = pathToFileURL(`${resolvePath(migrationsFolder)}/`);
+    // A new project's folder holds the config and no migration, which would read as nothing pending.
+    if (!migrationsIn(directory).length) {
+        throw new Refusal(`prodMigrations names ${migrationsFolder}, which holds no migration yet, so a production boot would serve a database nothing built. Write the first with \`mithaq migrate --name init\` against an empty database, ship it, and start again. Nothing was checked or applied.`);
+    }
     const history = `${migrationsTable.schema}.${migrationsTable.table}`;
     // Read from mithaq's table alone, an unmoved history says nothing was applied.
     if ((await moveHistory({ db, directory, check: true })) !== undefined) {
@@ -698,26 +734,33 @@ export const bootMigrations = async ({ db, prodMigrations }) => {
     const names = behind.map((migration) => migration.name);
     throw new Refusal(`This database has not applied ${names.join(', ')}. prodMigrations refuses a production boot while a migration is pending, so nothing was served and nothing was written. Apply ${names.length === 1 ? 'it' : 'them'} with the installed binary, \`drizzle-kit migrate --config ${join(migrationsFolder, configName)}\`, and start again.`);
 };
-// stdout alone is parsed: stderr carries import-time warnings, never the envelope.
-const kit = (cwd, argv) => new Promise((done, fail) => {
-    // Node's 1 MB default `maxBuffer` kills a child past it, and the envelope grows with the
-    // migration. Without an `error` listener a child that cannot spawn hangs the command.
-    const child = execFile(process.execPath, [binary, ...argv], { cwd, maxBuffer: 64 * 1024 * 1024 });
-    let stdout = '';
-    let stderr = '';
-    // Decoded by the stream, so a multibyte character split across chunks stays whole.
-    child.stdout?.setEncoding('utf8');
-    child.stderr?.setEncoding('utf8');
-    child.stdout?.on('data', (chunk) => {
-        stdout += chunk;
-    });
-    child.stderr?.on('data', (chunk) => {
-        stderr += chunk;
-    });
-    child.on('error', fail);
-    // The signal too, since a child killed from outside closes with no code.
-    child.on('close', (code, signal) => done({ code, signal, stdout, stderr }));
-});
+// stdout alone is parsed: stderr carries import-time warnings, never the envelope. Both go to files:
+// drizzle-kit exits right after printing, and Node writes to a pipe asynchronously off Linux, so
+// an envelope past the pipe's 64 KB was cut short, where a file is written synchronously.
+const kit = async (cwd, argv) => {
+    const scratch = await mkdtemp(join(tmpdir(), 'mithaq-kit-'));
+    const [out, err] = [join(scratch, 'stdout'), join(scratch, 'stderr')];
+    // Opened inside the `try`, so one that fails to open leaves none behind.
+    const opened = [];
+    try {
+        for (const path of [out, err])
+            opened.push(openSync(path, 'w'));
+        const [outFd, errFd] = opened;
+        const { code, signal } = await new Promise((done, fail) => {
+            const child = spawn(process.execPath, ['--import', kitOrm(ownKit), binary, ...argv], { cwd, stdio: ['ignore', outFd, errFd] });
+            // Without an `error` listener a child that cannot spawn hangs the command.
+            child.on('error', fail);
+            // The signal too, since a child killed from outside closes with no code.
+            child.on('close', (code, signal) => done({ code, signal }));
+        });
+        return { code, signal, stdout: await readFile(out, 'utf8'), stderr: await readFile(err, 'utf8') };
+    }
+    finally {
+        for (const fd of opened)
+            closeSync(fd);
+        await rm(scratch, { recursive: true, force: true });
+    }
+};
 const envelopeOf = async (cwd, argv) => {
     const { code, signal, stdout, stderr } = await kit(cwd, argv);
     try {

package/dist/drizzle/rules.d.ts

@@ -69,7 +69,7 @@ export declare const rules: {
             primaryKey(): import("drizzle-orm/pg-core").AnyPgColumnBuilder & /*elided*/ any;
             unique(): import("drizzle-orm/pg-core").AnyPgColumnBuilder & /*elided*/ any;
         };
-        value: string | number | boolean | Date | readonly unknown[] | import("../mithaq/user.ts").Ref;
+        value: Date | readonly unknown[] | import("../mithaq/user.ts").Ref | import("../index.ts").Json;
         field: import("../index.ts").ResolvedField;
     }) => import("drizzle-orm/pg-core").AnyPgColumnBuilder & {
         default(value: unknown): import("drizzle-orm/pg-core").AnyPgColumnBuilder & any;

package/dist/index.d.ts

@@ -4,42 +4,32 @@ export { betterAuth, betterAuthStrategy } from './auth/better-auth/index.ts';
 export { defaultLockTime, defaultMaxLoginAttempts, defaultTokenExpiration, local, localAuthFields, localAuthOperations, localAuthStrategy } from './auth/local/index.ts';
 export { actorPermissions, actorRoles, authActor } from './asas/actor.ts';
 export { assignableRole, grantedPermissions, writableRoleName } from './rbac/steps.ts';
-export { betterAuthTarget, type BetterAuthAccessOptions } from './auth/better-auth/access.ts';
-export { betterAuthTenant } from './auth/better-auth/tenant.ts';
-export { heldPermissions, rbacTarget, type AccessOptions, type AccessTarget, type Assigned, type CommandActor, type SystemRole, type SystemRoles } from './rbac/index.ts';
+export * from './targets.ts';
+export { heldPermissions, type Assigned, type CommandActor } from './rbac/index.ts';
 export { holdsPermission, requestOrganization } from './auth/better-auth/index.ts';
 export type { AssignedResolver, AuthStrategy, KayanAuth } from './asas/actor.ts';
-export type { AuthConfig, HttpPlug, Operation, OperationTable } from './asas/build.ts';
-export { fetchHttp, type FetchHttpOptions } from './asas/http/fetch.ts';
-export { AfterCommitError, AsasError, conflict, denied, invalid, missing, Notice, type MessageKey } from './asas/runner/errors.ts';
+export type { AuthConfig, HttpPlug, Operation, OperationTable, Vocabulary } from './asas/build.ts';
+export { defaultMaxBodyBytes, fetchHttp, type FetchHttpOptions } from './asas/http/fetch.ts';
+export { AfterCommitError, AsasError, conflict, denied, invalid, missing, retryConflict, Notice, type MessageKey } from './asas/runner/errors.ts';
 export { audit, count, defaultOperations, defaultGlobalOperations, defaults, find, findOne, findVersionByID, findVersions, insert, remove, restoreVersion, update, updateMany, deleteMany, validate, type BulkResult, type Context, type CommonStep, type CommonTools, type ContextOf, type Ctx, type CtxOf, type AuditHandler, type Derives, type FieldsOf, type DerivedSchemas, type DerivedShapes, type SchemasOf, type Lists, type OperationDeclaration, type OperationEffect, type OperationStep, type OperationSteps, type ProjectStep, type SlotSteps, type Operations, type OperationDefaults, type ReadMode, type ReadStep, type ReadTools, type ResolvedOperation, type Sealed, type Step, type StepsOf, type Tools, type WriteStep, type WriteTools, } from './asas/runner/steps.ts';
-export { defaultAuthorize } from './asas/runner/write.ts';
 export type { Authorize, BoundKayans, ByID, CreateOf, Globals, IdOf, Options, Procedures, ReadOptions, Row, RowOf, UpdateOf, Version, Writes } from './asas/runner/write.ts';
 export type { Where } from './mithaq/where.ts';
 export { defaultFields, defaultGlobalFields, defaultIdField, defaultTimestampFields } from './base/fields.ts';
 export { uploadFields } from './storage/storage.ts';
 export { accessFor, fieldAccessFor } from './mithaq/types.ts';
-export type { Access, AccessArgs, AccessResult, AdminAccess, AdminAccessArgs, CompoundIndex, FieldAccess, FieldAccessArgs, Field, Kayan, KayanService, LabelFunction, Localized, LocalesOf, MessageMap, MessageTree, ResolvedField, ResolvedKayan, RuntimeField } from './mithaq/types.ts';
+export type { Access, AccessArgs, AccessResult, AdminAccess, AdminAccessArgs, CompoundIndex, FieldAccess, FieldAccessArgs, Field, FilterOptions, JsonSchema, Kayan, KayanService, LabelFunction, Localized, LocalesOf, MessageMap, MessageTree, ResolvedField, ResolvedKayan, RuntimeField } from './mithaq/types.ts';
 export type { Copy, MessageRegistry, MessageScope, MessagesResolver, ProjectMessages } from './mithaq/messages.ts';
-export { defaultKinds, kind, type Kind, type OnDelete } from './base/kinds.ts';
-export type { RichTextNode, RichTextValue } from './rich-text/rich-text.ts';
+export { defaultJsonMaxBytes, defaultKinds, isJson, kind, type Json, type Kind, type OnDelete } from './base/kinds.ts';
+export { jsonSchemaCheck } from './base/json-schema.ts';
+export type { RichTextNode, RichTextValue } from './rich-text/value.ts';
 export { defineRukn, type KayanConfigs, type Rukn } from './mithaq/rukn.ts';
 export { base } from './base/index.ts';
-export { richText } from './rich-text/index.ts';
 export { storage, upload } from './storage/index.ts';
 export { versions } from './versions/index.ts';
 export { defineMithaq, isAccess, isScreen, isService, isStorage, isStore, isTenant, isVersions, type Command, type CommandInput, type Language, type SchemaTarget, type Store, type Target, type TenantField, type TenantTarget } from './mithaq/language.ts';
 export { Refusal } from './mithaq/refusal.ts';
 export { defaultRules, providerOf, rule, type ProvidedBy, type Provider, type Rule, type Rules, type RuleValue } from './base/rules.ts';
-export { drizzleAdapter, drizzleTarget, type Adapter, type ColumnBuilder, type ColumnRule, } from './drizzle/index.ts';
-export { kinds as drizzleKinds } from './drizzle/kinds.ts';
-export { defaultBulkLimit, defaultDepth, defaultJoinLimit, defaultLimit, defaultMaxLimit, serviceTarget, type ServiceTarget } from './service/index.ts';
-export { versionsTarget, type KayanVersions, type VersionsTarget } from './versions/index.ts';
 export { draftFields, versionOperations } from './versions/versions.ts';
-export { adapterOf, allowedType, checkReference, defaultFileSize, fileHeaders, readForFile, sanitizeFilename, signReference, storageTarget, withUploadReference, type KayanStorage, type StorageAdapter, type StorageConfig, type StorageKayan, type StorageStep, type StorageTarget, type StoredFile, type SweepArgs, type UploadInstructions, type UploadReference, type UploadRequest, type Verified, type VerifyArgs, } from './storage/storage.ts';
-export { screenKinds, folderOf, screenTarget, type ScreenKind, type ScreenButton, type ScreenFrame, type ScreenLayout, type ScreenOwnPage, type ScreenRegions, type Ui, type ScreenField, type ScreenKayan, type ScreenLeaf, type ScreenNode, type ScreenPage, type ScreenRef, type ScreenTarget, } from './screen/index.ts';
-export { rules as drizzleRules } from './drizzle/rules.ts';
+export { adapterOf, allowedType, checkReference, fileHeaders, readForFile, sanitizeFilename, signReference, withUploadReference, type KayanStorage, type StorageAdapter, type StorageKayan, type StorageStep, type StoredFile, type SweepArgs, type UploadInstructions, type UploadReference, type UploadRequest, type Verified, type VerifyArgs, } from './storage/storage.ts';
+export { folderOf, type ScreenKind, type ScreenButton, type ScreenFrame, type ScreenLayout, type ScreenOwnPage, type ScreenRegions, type Ui, type ScreenField, type ScreenKayan, type ScreenLeaf, type ScreenNode, type ScreenPage, type ScreenRef, } from './screen/index.ts';
 export type { InferInput, InferOutput, StandardSchemaV1 } from './mithaq/standard-schema.ts';
-export { zodTarget, type ZodRule, type ZodShape } from './zod/index.ts';
-export { kinds as zodKinds } from './zod/kinds.ts';
-export { rules as zodRules } from './zod/rules.ts';

package/dist/index.js

@@ -3,34 +3,24 @@ export { betterAuth, betterAuthStrategy } from './auth/better-auth/index.js';
 export { defaultLockTime, defaultMaxLoginAttempts, defaultTokenExpiration, local, localAuthFields, localAuthOperations, localAuthStrategy } from './auth/local/index.js';
 export { actorPermissions, actorRoles, authActor } from './asas/actor.js';
 export { assignableRole, grantedPermissions, writableRoleName } from './rbac/steps.js';
-export { betterAuthTarget } from './auth/better-auth/access.js';
-export { betterAuthTenant } from './auth/better-auth/tenant.js';
-export { heldPermissions, rbacTarget } from './rbac/index.js';
+export * from './targets.js';
+export { heldPermissions } from './rbac/index.js';
 export { holdsPermission, requestOrganization } from './auth/better-auth/index.js';
-export { fetchHttp } from './asas/http/fetch.js';
-export { AfterCommitError, AsasError, conflict, denied, invalid, missing, Notice } from './asas/runner/errors.js';
+export { defaultMaxBodyBytes, fetchHttp } from './asas/http/fetch.js';
+export { AfterCommitError, AsasError, conflict, denied, invalid, missing, retryConflict, Notice } from './asas/runner/errors.js';
 export { audit, count, defaultOperations, defaultGlobalOperations, defaults, find, findOne, findVersionByID, findVersions, insert, remove, restoreVersion, update, updateMany, deleteMany, validate, } from './asas/runner/steps.js';
-export { defaultAuthorize } from './asas/runner/write.js';
 export { defaultFields, defaultGlobalFields, defaultIdField, defaultTimestampFields } from './base/fields.js';
 export { uploadFields } from './storage/storage.js';
 export { accessFor, fieldAccessFor } from './mithaq/types.js';
-export { defaultKinds, kind } from './base/kinds.js';
+export { defaultJsonMaxBytes, defaultKinds, isJson, kind } from './base/kinds.js';
+export { jsonSchemaCheck } from './base/json-schema.js';
 export { defineRukn } from './mithaq/rukn.js';
 export { base } from './base/index.js';
-export { richText } from './rich-text/index.js';
 export { storage, upload } from './storage/index.js';
 export { versions } from './versions/index.js';
 export { defineMithaq, isAccess, isScreen, isService, isStorage, isStore, isTenant, isVersions } from './mithaq/language.js';
 export { Refusal } from './mithaq/refusal.js';
 export { defaultRules, providerOf, rule } from './base/rules.js';
-export { drizzleAdapter, drizzleTarget, } from './drizzle/index.js';
-export { kinds as drizzleKinds } from './drizzle/kinds.js';
-export { defaultBulkLimit, defaultDepth, defaultJoinLimit, defaultLimit, defaultMaxLimit, serviceTarget } from './service/index.js';
-export { versionsTarget } from './versions/index.js';
 export { draftFields, versionOperations } from './versions/versions.js';
-export { adapterOf, allowedType, checkReference, defaultFileSize, fileHeaders, readForFile, sanitizeFilename, signReference, storageTarget, withUploadReference, } from './storage/storage.js';
-export { screenKinds, folderOf, screenTarget, } from './screen/index.js';
-export { rules as drizzleRules } from './drizzle/rules.js';
-export { zodTarget } from './zod/index.js';
-export { kinds as zodKinds } from './zod/kinds.js';
-export { rules as zodRules } from './zod/rules.js';
+export { adapterOf, allowedType, checkReference, fileHeaders, readForFile, sanitizeFilename, signReference, withUploadReference, } from './storage/storage.js';
+export { folderOf, } from './screen/index.js';