@fabrika/db 0.8.2 → 0.9.0-cloudflare.1

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@fabrika/db",
-	"version": "0.8.2",
+	"version": "0.9.0-cloudflare.1",
 	"type": "module",
 	"repository": {
 		"type": "git",
@@ -12,47 +12,78 @@
 	},
 	"files": [
 		"src",
-		"!src/**/__tests__/**"
+		"!src/**/__tests__/**",
+		"types"
 	],
 	"exports": {
 		".": {
 			"bun": "./src/index.ts",
-			"types": "./src/index.ts",
+			"types": "./types/src/index.d.ts",
 			"default": "./src/index.ts"
 		},
 		"./capability": {
 			"bun": "./src/capability.ts",
-			"types": "./src/capability.ts",
+			"types": "./types/src/capability.d.ts",
 			"default": "./src/capability.ts"
 		},
 		"./tables": {
 			"bun": "./src/tables.ts",
-			"types": "./src/tables.ts",
+			"types": "./types/src/tables.d.ts",
 			"default": "./src/tables.ts"
 		},
 		"./framework": {
 			"bun": "./src/framework.ts",
-			"types": "./src/framework.ts",
+			"types": "./types/src/framework.d.ts",
 			"default": "./src/framework.ts"
 		},
 		"./migrations": {
 			"bun": "./src/migrations.ts",
-			"types": "./src/migrations.ts",
+			"types": "./types/src/migrations.d.ts",
 			"default": "./src/migrations.ts"
 		},
+		"./migrations-sqlite": {
+			"bun": "./src/migrations-sqlite.ts",
+			"types": "./types/src/migrations-sqlite.d.ts",
+			"default": "./src/migrations-sqlite.ts"
+		},
 		"./production": {
 			"bun": "./src/production.ts",
-			"types": "./src/production.ts",
+			"types": "./types/src/production.d.ts",
 			"default": "./src/production.ts"
 		},
+		"./postgres": {
+			"bun": "./src/postgres.ts",
+			"types": "./types/src/postgres.d.ts",
+			"default": "./src/postgres.ts"
+		},
+		"./sqlite": {
+			"bun": "./src/sqlite.ts",
+			"types": "./types/src/sqlite.d.ts",
+			"default": "./src/sqlite.ts"
+		},
+		"./sqlite-migrate": {
+			"bun": "./src/sqlite-migrate.ts",
+			"types": "./types/src/sqlite-migrate.d.ts",
+			"default": "./src/sqlite-migrate.ts"
+		},
+		"./codegen-sqlite": {
+			"bun": "./src/codegen-sqlite.ts",
+			"types": "./types/src/codegen-sqlite.d.ts",
+			"default": "./src/codegen-sqlite.ts"
+		},
+		"./testing-sqlite": {
+			"bun": "./src/testing-sqlite.ts",
+			"types": "./types/src/testing-sqlite.d.ts",
+			"default": "./src/testing-sqlite.ts"
+		},
 		"./codegen": {
 			"bun": "./src/codegen.ts",
-			"types": "./src/codegen.ts",
+			"types": "./types/src/codegen.d.ts",
 			"default": "./src/codegen.ts"
 		},
 		"./testing": {
 			"bun": "./src/testing.ts",
-			"types": "./src/testing.ts",
+			"types": "./types/src/testing.d.ts",
 			"default": "./src/testing.ts"
 		}
 	},
@@ -61,8 +92,9 @@
 		"test": "bun test"
 	},
 	"dependencies": {
-		"@fabrika/auth-core": "0.8.2",
-		"@fabrika/platform-node": "0.8.2",
+		"@fabrika/auth-core": "0.9.0-cloudflare.1",
+		"@fabrika/platform": "0.9.0-cloudflare.1",
+		"@fabrika/platform-node": "0.9.0-cloudflare.1",
 		"kysely": "0.29.6",
 		"kysely-postgres-js": "5.0.1",
 		"zod": "^3.25.76"

package/src/admissions.ts

@@ -2,12 +2,13 @@
 // (`@fabrika/db/migrations`): the per-minute buckets a procedure's admission takes from, shared by every instance of the
 // application, the digests of the challenge tokens it accepted, and its hourly byte budget (`bytesPerHour`). Each is
 // keyed by the endpoint id; the tables keep the names and the `form` column they were created with. Only `@fabrika/app`'s
-// dispatcher reaches them, through `frameworkTablesOf`. Each operation is one statement, so two instances never read a
-// counter and then write it, and each prunes a bounded batch of expired rows of its own table, so no table grows past
-// what the last minutes or hours hold.
+// dispatcher reaches them, through `frameworkTablesOf`. Each operation is one statement (on SQLite, a prune and the
+// write in one transaction), so two instances never read a counter and then write it, and each prunes a bounded batch
+// of expired rows of its own table, so no table grows past what the last minutes or hours hold.
 
-import { runFixedStatement, sessionOf } from './database'
+import { runFixedStatement, type Session, sessionOf } from './database'
 import { QueryRefusedError } from './errors'
+import { SQLITE_NOW, sqliteNowPlus } from './job-leases'
 import { FORM_ADMISSIONS_TABLE, FORM_BYTES_TABLE, FORM_CHALLENGES_TABLE } from './migrations'
 import type { DataLayerRuntime } from './store'
 
@@ -49,6 +50,18 @@ insert into ${A} (form, bucket, window_start, count) values ($1, $2, date_trunc(
 on conflict (form, bucket, window_start) do update set count = ${A}.count + 1 where ${A}.count < $3::int
 returning count`
 
+// SQLite has no data-modifying CTE, so the prune is a statement of its own before the take, in one transaction; no row
+// is locked, as no other event reaches the Durable Object while it is open.
+const SQLITE_MINUTE = `strftime('%Y-%m-%dT%H:%M:00.000Z', 'now')`
+
+const SQLITE_PRUNE_ADMISSIONS = `delete from ${A} where (form, bucket, window_start) in (
+	select form, bucket, window_start from ${A} where window_start < ${SQLITE_MINUTE} limit ${PRUNE_BATCH}
+)`
+
+const SQLITE_TAKE = `insert into ${A} (form, bucket, window_start, count) values (?1, ?2, ${SQLITE_MINUTE}, 1)
+on conflict (form, bucket, window_start) do update set count = ${A}.count + 1 where ${A}.count < ?3
+returning count`
+
 const B = FORM_BYTES_TABLE
 
 const SQL_RESERVE_BYTES = `with pruned as (
@@ -61,9 +74,22 @@ insert into ${B} (form, window_start, bytes) select $1, date_trunc('hour', now()
 on conflict (form, window_start) do update set bytes = ${B}.bytes + excluded.bytes where ${B}.bytes + excluded.bytes <= $3::bigint
 returning bytes`
 
+const SQLITE_HOUR = `strftime('%Y-%m-%dT%H:00:00.000Z', 'now')`
+
+const SQLITE_PRUNE_BYTES = `delete from ${B} where (form, window_start) in (
+	select form, window_start from ${B} where window_start < ${SQLITE_HOUR} limit ${PRUNE_BATCH}
+)`
+
+const SQLITE_RESERVE_BYTES = `insert into ${B} (form, window_start, bytes) select ?1, ${SQLITE_HOUR}, ?2 where ?2 <= ?3
+on conflict (form, window_start) do update set bytes = ${B}.bytes + excluded.bytes where ${B}.bytes + excluded.bytes <= ?3
+returning bytes`
+
 const SQL_RELEASE_BYTES = `update ${B} set bytes = greatest(bytes - $2::bigint, 0)
 where form = $1 and window_start = date_trunc('hour', now()) returning bytes`
 
+const SQLITE_RELEASE_BYTES = `update ${B} set bytes = max(bytes - ?2, 0)
+where form = ?1 and window_start = ${SQLITE_HOUR} returning bytes`
+
 const SQL_RECORD_CHALLENGE = `with pruned as (
 	delete from ${C} where (form, token_digest) in (
 		select form, token_digest from ${C} where expires_at <= now() and (form, token_digest) <> ($1, $2)
@@ -74,6 +100,33 @@ insert into ${C} (form, token_digest, expires_at) values ($1, $2, now() + $3::bi
 on conflict (form, token_digest) do update set expires_at = excluded.expires_at where ${C}.expires_at <= now()
 returning form`
 
+const SQLITE_PRUNE_CHALLENGES = `delete from ${C} where (form, token_digest) in (
+	select form, token_digest from ${C} where expires_at <= ${SQLITE_NOW} and (form, token_digest) <> (?1, ?2) limit ${PRUNE_BATCH}
+)`
+
+const SQLITE_RECORD_CHALLENGE = `insert into ${C} (form, token_digest, expires_at) values (?1, ?2, ${sqliteNowPlus('?3')})
+on conflict (form, token_digest) do update set expires_at = excluded.expires_at where ${C}.expires_at <= ${SQLITE_NOW}
+returning form`
+
+/**
+ * The rows `statement` answers. On Postgres it is one statement, its prune a CTE; on SQLite the prune (with
+ * `pruneParameters`) runs first, in the same transaction.
+ */
+async function pruneAndWrite(
+	session: Session,
+	statement: { readonly postgres: string; readonly sqlite: string; readonly prune: string },
+	parameters: readonly (string | number)[],
+	pruneParameters: readonly (string | number)[],
+): Promise<readonly unknown[]> {
+	if (session.dialect === 'postgres') {
+		return runFixedStatement(session, statement.postgres, parameters)
+	}
+	return session.transaction(async (transaction) => {
+		await runFixedStatement(transaction, statement.prune, pruneParameters)
+		return runFixedStatement(transaction, statement.sqlite, parameters)
+	})
+}
+
 function positiveInteger(value: number, what: string): number {
 	if (!Number.isSafeInteger(value) || value < 1) {
 		throw new QueryRefusedError('invalid_argument', `${what} must be a whole number of at least 1`)
@@ -85,27 +138,40 @@ export function admissions(runtime: () => DataLayerRuntime): Admissions {
 	const session = () => sessionOf(runtime())
 	return Object.freeze({
 		async take(endpoint: string, bucket: string, limit: number): Promise<boolean> {
-			const rows = await runFixedStatement(session(), SQL_TAKE, [endpoint, bucket, positiveInteger(limit, 'a bucket limit')])
+			const rows = await pruneAndWrite(
+				session(),
+				{ postgres: SQL_TAKE, sqlite: SQLITE_TAKE, prune: SQLITE_PRUNE_ADMISSIONS },
+				[endpoint, bucket, positiveInteger(limit, 'a bucket limit')],
+				[],
+			)
 			return rows.length > 0
 		},
 
 		async recordChallenge(endpoint: string, tokenDigest: string, retainMs: number): Promise<boolean> {
-			const rows = await runFixedStatement(session(), SQL_RECORD_CHALLENGE, [endpoint, tokenDigest, positiveInteger(retainMs, 'a retention')])
+			const rows = await pruneAndWrite(
+				session(),
+				{ postgres: SQL_RECORD_CHALLENGE, sqlite: SQLITE_RECORD_CHALLENGE, prune: SQLITE_PRUNE_CHALLENGES },
+				[endpoint, tokenDigest, positiveInteger(retainMs, 'a retention')],
+				[endpoint, tokenDigest],
+			)
 			return rows.length > 0
 		},
 
 		async reserveBytes(endpoint: string, bytes: number, limit: number): Promise<boolean> {
-			const rows = await runFixedStatement(session(), SQL_RESERVE_BYTES, [
-				endpoint,
-				positiveInteger(bytes, 'a reservation'),
-				positiveInteger(limit, 'a byte budget'),
-			])
+			const rows = await pruneAndWrite(
+				session(),
+				{ postgres: SQL_RESERVE_BYTES, sqlite: SQLITE_RESERVE_BYTES, prune: SQLITE_PRUNE_BYTES },
+				[endpoint, positiveInteger(bytes, 'a reservation'), positiveInteger(limit, 'a byte budget')],
+				[],
+			)
 			return rows.length > 0
 		},
 
 		async releaseBytes(endpoint: string, bytes: number): Promise<void> {
 			if (bytes > 0) {
-				await runFixedStatement(session(), SQL_RELEASE_BYTES, [endpoint, positiveInteger(bytes, 'a release')])
+				const current = session()
+				const statement = current.dialect === 'sqlite' ? SQLITE_RELEASE_BYTES : SQL_RELEASE_BYTES
+				await runFixedStatement(current, statement, [endpoint, positiveInteger(bytes, 'a release')])
 			}
 		},
 	})

package/src/application-rows.ts

@@ -0,0 +1,108 @@
+// The rule of the application rows an endpoint access case seeds (`appRows`): which tables, columns and values they
+// may name, which foreign keys link one given row to another, and the order they are seeded in. `@fabrika/check`
+// reports each refusal from source, and `@fabrika/db/testing` throws it before it seeds anything, both in the words of
+// `applicationRowRefusalText`. Browser-safe.
+
+import { inSet } from './builtins'
+import { type ForeignKey, modelOf, type TableModels } from './policy'
+
+/** Why the values of a set of application rows cannot be seeded as given. */
+export type ApplicationRowRefusal =
+	/** `table` is no application table: `mode` is its scope mode, or `null` when no policy names it. */
+	| { readonly kind: 'table'; readonly table: string; readonly mode: string | null }
+	/** `column` is no column of `table`'s column list. */
+	| { readonly kind: 'column'; readonly table: string; readonly column: string }
+	/** `column` is the row's key, version or creator, which the seeding stamps. */
+	| { readonly kind: 'stamped'; readonly table: string; readonly column: string }
+	/** `column` is a file column, which the seeding fills with a live, scanned file. */
+	| { readonly kind: 'file'; readonly table: string; readonly column: string }
+	/** `column` is given an array or an object, where a column takes one value. */
+	| { readonly kind: 'value'; readonly table: string; readonly column: string; readonly given: 'array' | 'object' }
+	/** The values give `columns`, some but not all columns of the foreign key `key`. */
+	| { readonly kind: 'partial-key'; readonly table: string; readonly columns: readonly string[]; readonly key: ForeignKey }
+	/** The foreign keys that link `tables` form a cycle, so no order seeds each after the rows it links to. */
+	| { readonly kind: 'cycle'; readonly tables: readonly string[] }
+
+export interface ApplicationRowsPlan {
+	/** The application tables, each after every given table it links to. */
+	readonly order: readonly string[]
+	/** Each application table's foreign keys to another given table that the values leave to the link. */
+	readonly links: Readonly<Record<string, readonly ForeignKey[]>>
+	/** Every refusal, by table then column; a cycle last. Empty when the rows can be seeded. */
+	readonly refusals: readonly ApplicationRowRefusal[]
+}
+
+/** The plan of seeding one row of each table `rows` names (table → column → value). */
+export function planApplicationRows(models: TableModels, rows: Readonly<Record<string, Readonly<Record<string, unknown>>>>): ApplicationRowsPlan {
+	const given = Object.keys(rows).sort()
+	const refusals: ApplicationRowRefusal[] = []
+	const links: Record<string, readonly ForeignKey[]> = {}
+	for (const table of given) {
+		const model = modelOf(models, table)
+		const scope = model?.scope
+		if (model === undefined || scope?.mode !== 'app') {
+			refusals.push({ kind: 'table', table, mode: scope?.mode ?? null })
+			continue
+		}
+		const values: Readonly<Record<string, unknown>> = (Object.hasOwn(rows, table) ? rows[table] : undefined) ?? {}
+		const named = Object.keys(values).sort()
+		const stamped = [scope.key, model.version, model.createdBy]
+		for (const column of named) {
+			const value = values[column]
+			if (!inSet(model.columns, column)) {
+				refusals.push({ kind: 'column', table, column })
+			} else if (stamped.includes(column)) {
+				refusals.push({ kind: 'stamped', table, column })
+			} else if (Object.hasOwn(model.files, column)) {
+				refusals.push({ kind: 'file', table, column })
+			} else if (value !== null && typeof value === 'object') {
+				refusals.push({ kind: 'value', table, column, given: Array.isArray(value) ? 'array' : 'object' })
+			}
+		}
+		// A foreign key is given whole or not at all: the seeding fills one it is not given (the seeded row of a given
+		// table, else null or a referenced row), never the rest of one.
+		for (const key of model.foreignKeys) {
+			const set = key.columns.filter((column) => named.includes(column))
+			if (set.length > 0 && set.length < key.columns.length) refusals.push({ kind: 'partial-key', table, columns: set, key })
+		}
+		links[table] = model.foreignKeys.filter((key) =>
+			key.table !== table && given.includes(key.table) && key.columns.every((column) => !named.includes(column))
+		)
+	}
+	// A table comes after every given table it links to; a cycle among them has no such order.
+	const order: string[] = []
+	const pending = given.filter((table) => Object.hasOwn(links, table))
+	while (pending.length > 0) {
+		const next = pending.findIndex((table) => (links[table] ?? []).every((key) => !pending.includes(key.table)))
+		if (next === -1) {
+			refusals.push({ kind: 'cycle', tables: [...pending] })
+			break
+		}
+		order.push(...pending.splice(next, 1))
+	}
+	return { order, links, refusals }
+}
+
+/** A refusal in the words both the checker and the test kit use, so the two never describe one rule differently. */
+export function applicationRowRefusalText(refusal: ApplicationRowRefusal): string {
+	switch (refusal.kind) {
+		case 'table':
+			return `${refusal.table} is ${
+				refusal.mode === null ? 'no table of src/db/tables.ts' : `a ${refusal.mode} table`
+			}, and an application row is seeded only in an application table (scope: { app })`
+		case 'column':
+			return `${refusal.table}.${refusal.column} is no column of ${refusal.table}`
+		case 'stamped':
+			return `${refusal.table}.${refusal.column} is the row's key, version or creator, which the seeding stamps`
+		case 'file':
+			return `${refusal.table}.${refusal.column} is a file column, which the seeding fills with a live, scanned file`
+		case 'value':
+			return `${refusal.table}.${refusal.column} is given ${refusal.given === 'array' ? 'an array' : 'an object'}, and a seeded column takes one value`
+		case 'partial-key':
+			return `${refusal.table}.${refusal.columns.join(', ')} is part of the foreign key to ${refusal.key.table} (${
+				refusal.key.columns.join(', ')
+			}), which is given whole or not at all`
+		case 'cycle':
+			return `the foreign keys of ${refusal.tables.join(', ')} form a cycle, so the seeding cannot seed each row after the row it refers to`
+	}
+}

package/src/capability.ts

@@ -62,6 +62,11 @@ export interface WithinGrant {
 	 * every statement judges a row by the chain columns it carries now: a scope moved out of a container is out.
 	 */
 	readonly containers: readonly ContainerGrant[]
+	/**
+	 * The dimensions inside `dimension` (the listed object's own and the containers between) in which the caller holds
+	 * the action: a row that lies in one of their values is listed, as a single-object read of it is allowed.
+	 */
+	readonly contained: readonly ContainerGrant[]
 }
 
 /** An `app` endpoint's grant: the action everywhere in the application, which the proxy checked was held globally. */

package/src/codegen-sqlite.ts

@@ -0,0 +1,154 @@
+// @fabrika/db/codegen-sqlite — `fabrika db codegen` for an application on Cloudflare (ADR-0065): applies its bundles to
+// an in-memory SQLite database, reads its tables back and renders `SCHEMA_FILE` with the Postgres codegen's renderer.
+// Runs in the CLI, on Bun.
+
+import { Database } from 'bun:sqlite'
+import { z } from 'zod/v4'
+import { CodegenError, type DescribedColumn, type ForeignKeyColumns, type NamedColumn, renderTables, type ScalarType } from './codegen'
+import { migrateSqlite, type SqliteMigrationBundle, type SqliteMigrationTarget } from './sqlite-migrate'
+
+const STRING: ScalarType = { select: 'string' }
+const NUMBER: ScalarType = { select: 'number' }
+
+/** A column's TypeScript types and list field by its declared type, without a length (`VARCHAR(80)` → `VARCHAR`). */
+const DECLARED_TYPES: ReadonlyMap<string, { readonly scalar: ScalarType; readonly list: DescribedColumn['list'] }> = new Map([
+	['TEXT', { scalar: STRING, list: undefined }],
+	['VARCHAR', { scalar: STRING, list: undefined }],
+	['CHAR', { scalar: STRING, list: undefined }],
+	['UUID', { scalar: STRING, list: undefined }],
+	['INTEGER', { scalar: NUMBER, list: undefined }],
+	['INT', { scalar: NUMBER, list: undefined }],
+	['BIGINT', { scalar: NUMBER, list: undefined }],
+	['SMALLINT', { scalar: NUMBER, list: undefined }],
+	['REAL', { scalar: NUMBER, list: undefined }],
+	['DOUBLE', { scalar: NUMBER, list: undefined }],
+	['FLOAT', { scalar: NUMBER, list: undefined }],
+	['BOOLEAN', { scalar: { select: 'boolean' }, list: 'booleans' }],
+	['TIMESTAMP', { scalar: { select: 'Date', write: 'Date | string' }, list: 'timestamps' }],
+	['TIMESTAMPTZ', { scalar: { select: 'Date', write: 'Date | string' }, list: 'timestamps' }],
+	['DATETIME', { scalar: { select: 'Date', write: 'Date | string' }, list: 'timestamps' }],
+	['DATE', { scalar: STRING, list: 'dates' }],
+	['BLOB', { scalar: { select: 'Uint8Array' }, list: undefined }],
+])
+
+interface SqliteColumn extends NamedColumn {
+	readonly declared: string
+	readonly nullable: boolean
+	readonly generated: DescribedColumn['generated']
+}
+
+const tableSchema = z.object({ name: z.string(), type: z.string(), wr: z.number() })
+
+const columnSchema = z.object({
+	name: z.string(),
+	type: z.string(),
+	notnull: z.number(),
+	dflt_value: z.string().nullable(),
+	pk: z.number(),
+	/** 0 an ordinary column, 2 or 3 a generated one. */
+	hidden: z.number(),
+})
+
+const foreignKeySchema = z.object({ id: z.number(), seq: z.number(), table: z.string(), from: z.string(), to: z.string().nullable() })
+
+/** Runs multi-statement text the way a Durable Object's `sql.exec` does; `prepare` alone compiles only its first statement. */
+function bunTarget(db: Database): SqliteMigrationTarget {
+	return {
+		exec(query, ...bindings) {
+			const statement = db.prepare<Record<string, unknown>, (string | number | null)[]>(query)
+			try {
+				if (bindings.length > 0 || statement.columnNames.length > 0) {
+					const rows = statement.all(...bindings)
+					return { toArray: () => rows }
+				}
+			} finally {
+				statement.finalize()
+			}
+			db.run(query)
+			return { toArray: () => [] }
+		},
+		transactionSync: (fn) => db.transaction(fn)(),
+	}
+}
+
+function describeSqlite(column: SqliteColumn): DescribedColumn {
+	const base = column.declared.trim().toUpperCase().replace(/\s*\(.*\)$/s, '')
+	const mapped = DECLARED_TYPES.get(base)
+	if (mapped === undefined) {
+		throw new CodegenError(
+			`${column.table_name}.${column.column_name} has declared type '${column.declared}', which the data layer does not read or bind on SQLite (supported: ${
+				[...DECLARED_TYPES.keys()].join(', ')
+			})`,
+		)
+	}
+	return { scalar: mapped.scalar, nullable: column.nullable, generated: column.generated, list: mapped.list }
+}
+
+function primaryKeyOf(db: Database, table: string): string[] {
+	const columns = z.array(columnSchema).parse(db.query('SELECT * FROM pragma_table_xinfo(?) WHERE pk > 0 ORDER BY pk').all(table))
+	return columns.map((column) => column.name)
+}
+
+/** Every column of the application's ordinary tables, and their foreign keys in declaration order. */
+function introspect(db: Database): { columns: SqliteColumn[]; foreignKeys: ForeignKeyColumns[] } {
+	const tables = z.array(tableSchema).parse(
+		db.query(`SELECT name, type, wr FROM pragma_table_list WHERE schema = 'main' AND type IN ('table', 'virtual') ORDER BY name`).all(),
+	).filter((table) => !table.name.startsWith('sqlite_') && !table.name.startsWith('fabrika_'))
+	const columns: SqliteColumn[] = []
+	const foreignKeys: ForeignKeyColumns[] = []
+	for (const table of tables) {
+		if (table.type === 'virtual') throw new CodegenError(`table ${table.name} is a virtual table, which the data layer does not read`)
+		const declared = z.array(columnSchema).parse(db.query('SELECT * FROM pragma_table_xinfo(?) ORDER BY cid').all(table.name))
+		const keyColumns = declared.filter((column) => column.pk > 0)
+		for (const column of declared) {
+			// An INTEGER PRIMARY KEY of a rowid table is the rowid: never null, assigned when an insert omits it.
+			const rowid = table.wr === 0 && keyColumns.length === 1 && column.pk === 1 && column.type.trim().toUpperCase() === 'INTEGER'
+			columns.push({
+				table_name: table.name,
+				column_name: column.name,
+				declared: column.type,
+				nullable: !rowid && column.notnull === 0,
+				generated: column.hidden === 2 || column.hidden === 3 ? 'always' : rowid || column.dflt_value !== null ? 'default' : 'no',
+			})
+		}
+		const references = z.array(foreignKeySchema).parse(db.query('SELECT * FROM pragma_foreign_key_list(?) ORDER BY id DESC, seq').all(table.name))
+		for (const id of new Set(references.map((reference) => reference.id))) {
+			const parts = references.filter((reference) => reference.id === id)
+			const referenced = parts[0]?.table
+			if (referenced === undefined) continue
+			// `REFERENCES parent` without columns names the parent's primary key.
+			const implicit = parts.some((part) => part.to === null) ? primaryKeyOf(db, referenced) : []
+			const referencedColumns: string[] = []
+			for (const [index, part] of parts.entries()) {
+				const name = part.to ?? implicit[index]
+				if (name === undefined) {
+					throw new CodegenError(`${table.name}: a foreign key to ${referenced} names no columns, and ${referenced} has no primary key of that width`)
+				}
+				referencedColumns.push(name)
+			}
+			foreignKeys.push({
+				table_name: table.name,
+				columns: parts.map((part) => part.from),
+				referenced_table: referenced,
+				referenced_columns: referencedColumns,
+			})
+		}
+	}
+	return { columns, foreignKeys }
+}
+
+/**
+ * Applies `bundles` (the framework's `fabrika`, then the application's `app`) to a fresh in-memory database and renders
+ * the module for `SCHEMA_FILE` from its application tables. Deterministic for given migrations.
+ */
+export async function generateSqliteSchema(bundles: readonly SqliteMigrationBundle[]): Promise<string> {
+	const db = new Database(':memory:')
+	try {
+		db.run('PRAGMA foreign_keys = ON')
+		await migrateSqlite(bunTarget(db), bundles)
+		const { columns, foreignKeys } = introspect(db)
+		return renderTables(columns, foreignKeys, describeSqlite)
+	} finally {
+		db.close()
+	}
+}

package/src/codegen.ts

@@ -12,7 +12,7 @@ const FRAMEWORK_TABLE_PREFIX = 'fabrika_'
 const HEADER = '// @generated by fabrika db codegen from the migrated database. Do not edit: write a migration, then run fabrika db codegen.'
 
 /** A column's TypeScript types: what a read returns, and what an insert or update may bind when that differs. */
-interface ScalarType {
+export interface ScalarType {
 	readonly select: string
 	readonly write?: string
 }
@@ -206,8 +206,43 @@ interface Rendered {
 	readonly uses: 'ColumnType' | 'Generated' | 'GeneratedAlways' | undefined
 }
 
-function columnType(column: CatalogColumn): Rendered {
+/** What the renderer needs of a column beyond its name, whichever database it was read from. */
+export interface DescribedColumn {
+	readonly scalar: ScalarType
+	readonly nullable: boolean
+	readonly generated: 'no' | 'default' | 'always'
+	/** The column list field that names the column: a day, a timestamp, or (on SQLite) a boolean. */
+	readonly list: 'dates' | 'timestamps' | 'booleans' | undefined
+}
+
+/** A foreign key as the renderer reads it: the columns of `table_name` that reference `referenced_table`. */
+export interface ForeignKeyColumns {
+	readonly table_name: string
+	readonly columns: readonly string[]
+	readonly referenced_table: string
+	readonly referenced_columns: readonly string[]
+}
+
+/** A column as the renderer groups it, before its type is described. */
+export interface NamedColumn {
+	readonly table_name: string
+	readonly column_name: string
+}
+
+function describePostgres(column: CatalogColumn): DescribedColumn {
 	const scalar = scalarType(column)
+	const list = column.type_type !== 'b'
+		? undefined
+		: column.type_name === 'date'
+		? 'dates'
+		: column.type_name === 'timestamp' || column.type_name === 'timestamptz'
+		? 'timestamps'
+		: undefined
+	return { scalar, nullable: column.nullable, generated: column.generated, list }
+}
+
+function columnType(column: DescribedColumn): Rendered {
+	const { scalar } = column
 	const nullable = column.nullable ? ' | null' : ''
 	const select = `${scalar.select}${nullable}`
 	const write = scalar.write === undefined ? select : `${scalar.write}${nullable}`
@@ -226,7 +261,19 @@ function columnType(column: CatalogColumn): Rendered {
  * `fabrika db codegen --verify` can compare text.
  */
 export function renderSchema(catalog: readonly CatalogColumn[], foreignKeys: readonly CatalogForeignKey[] = []): string {
-	const tables = new Map<string, CatalogColumn[]>()
+	return renderTables(catalog, foreignKeys, describePostgres)
+}
+
+/**
+ * `renderSchema` over columns of any database: `describe` gives each column's types and list field, and refuses a
+ * type the data layer does not read. A foreign key's `constraint_name` is not rendered; keys keep the given order.
+ */
+export function renderTables<C extends NamedColumn>(
+	catalog: readonly C[],
+	foreignKeys: readonly ForeignKeyColumns[],
+	describe: (column: C) => DescribedColumn,
+): string {
+	const tables = new Map<string, C[]>()
 	for (const column of catalog) {
 		if (column.table_name.startsWith(FRAMEWORK_TABLE_PREFIX)) continue
 		for (const name of [column.table_name, column.column_name]) {
@@ -243,13 +290,16 @@ export function renderSchema(catalog: readonly CatalogColumn[], foreignKeys: rea
 	const owners = new Map<string, string>()
 	const used = new Set<string>()
 	const interfaces: string[] = []
+	const described = new Map<C, DescribedColumn>()
 	for (const table of names) {
 		const name = interfaceName(table)
 		const owner = owners.get(name)
 		if (owner !== undefined) throw new CodegenError(`tables ${owner} and ${table} would both generate ${name}; rename one in a migration`)
 		owners.set(name, table)
 		const fields = (tables.get(table) ?? []).map((column) => {
-			const rendered = columnType(column)
+			const description = describe(column)
+			described.set(column, description)
+			const rendered = columnType(description)
 			if (rendered.uses !== undefined) used.add(rendered.uses)
 			return `\t${column.column_name}: ${rendered.type}\n`
 		})
@@ -271,14 +321,14 @@ export function renderSchema(catalog: readonly CatalogColumn[], foreignKeys: rea
 		return `\t\tforeignKeys: [\n${rendered.join('')}\t\t],\n`
 	}
 	/**
-	 * A table's columns of `types` as the list field `field`: the `date` columns, which the layer answers as `YYYY-MM-DD`,
-	 * and the timestamps, whose written text it checks. A table without one has no such field.
+	 * A table's columns listed in `field`: the days, which the layer answers as `YYYY-MM-DD`, the timestamps, whose
+	 * written text it checks, and SQLite's booleans, which it reads from 0 or 1. A table without one has no such field.
 	 */
-	const listOf = (table: string, field: string, types: readonly string[]): string => {
-		const listed = (tables.get(table) ?? []).filter((column) => column.type_type === 'b' && types.includes(column.type_name))
+	const listOf = (table: string, field: DescribedColumn['list']): string => {
+		const listed = (tables.get(table) ?? []).filter((column) => described.get(column)?.list === field)
 		return listed.length === 0 ? '' : `\t\t${field}: [${listed.map((column) => quote(column.column_name)).join(', ')}],\n`
 	}
-	const datesOf = (table: string): string => `${listOf(table, 'dates', ['date'])}${listOf(table, 'timestamps', ['timestamp', 'timestamptz'])}`
+	const datesOf = (table: string): string => `${listOf(table, 'dates')}${listOf(table, 'timestamps')}${listOf(table, 'booleans')}`
 	const columns = names
 		.map((table) =>
 			`\t'${table}': {\n\t\tcolumns: [\n${(tables.get(table) ?? []).map((column) => `\t\t\t'${column.column_name}',\n`).join('')}\t\t],\n${