@flaredev/core 0.1.0

package/dist/index.js

@@ -0,0 +1,770 @@
+import {
+  RESERVED_FIELD_NAMES,
+  ResourceDefinitionError,
+  camelCase,
+  columnName,
+  createValidators,
+  defaultFieldLabel,
+  defineResource,
+  fieldSchema,
+  fileKeyPrefix,
+  humanize,
+  kebabCase,
+  pascalCase,
+  pluralize,
+  snakeCase,
+  storedFields,
+  words
+} from "./chunk-DARDHZPX.js";
+
+// src/password.ts
+var ALGORITHM = "pbkdf2-sha256";
+var PBKDF2_ITERATIONS = 1e5;
+var SALT_BYTES = 16;
+var HASH_BITS = 256;
+var encoder = new TextEncoder();
+async function derive(password, salt, iterations) {
+  const key = await crypto.subtle.importKey("raw", encoder.encode(password.normalize("NFKC")), "PBKDF2", false, [
+    "deriveBits"
+  ]);
+  const bits = await crypto.subtle.deriveBits(
+    { name: "PBKDF2", hash: "SHA-256", salt, iterations },
+    key,
+    HASH_BITS
+  );
+  return new Uint8Array(bits);
+}
+function toBase64(bytes) {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary);
+}
+function fromBase64(value) {
+  return Uint8Array.from(atob(value), (char) => char.charCodeAt(0));
+}
+function timingSafeEqual(a, b) {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) diff |= a[i] ^ b[i];
+  return diff === 0;
+}
+async function hashPassword(password) {
+  const salt = crypto.getRandomValues(new Uint8Array(SALT_BYTES));
+  const hash = await derive(password, salt, PBKDF2_ITERATIONS);
+  return `${ALGORITHM}$${PBKDF2_ITERATIONS}$${toBase64(salt)}$${toBase64(hash)}`;
+}
+async function verifyPassword({ hash, password }) {
+  const [algorithm, iterationsText, saltText, hashText] = hash.split("$");
+  const iterations = Number(iterationsText);
+  if (algorithm !== ALGORITHM || !Number.isInteger(iterations) || iterations < 1 || !saltText || !hashText) {
+    return false;
+  }
+  try {
+    const expected = fromBase64(hashText);
+    const actual = await derive(password, fromBase64(saltText), iterations);
+    return timingSafeEqual(actual, expected);
+  } catch {
+    return false;
+  }
+}
+
+// src/signing.ts
+var encoder2 = new TextEncoder();
+var decoder = new TextDecoder();
+function base64UrlEncode(bytes) {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function base64UrlDecode(value) {
+  if (!/^[A-Za-z0-9_-]*$/.test(value)) throw new Error("Invalid base64url");
+  const base64 = value.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - value.length % 4) % 4);
+  return Uint8Array.from(atob(base64), (char) => char.charCodeAt(0));
+}
+async function importSigningKey(secret, purpose) {
+  if (!secret) throw new Error("A signing secret is required.");
+  const root = await crypto.subtle.importKey("raw", encoder2.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, [
+    "sign"
+  ]);
+  const derived = await crypto.subtle.sign("HMAC", root, encoder2.encode(`flare:${purpose}`));
+  return crypto.subtle.importKey("raw", derived, { name: "HMAC", hash: "SHA-256" }, false, ["sign", "verify"]);
+}
+async function signToken(key, payload) {
+  const body = base64UrlEncode(encoder2.encode(JSON.stringify(payload)));
+  const signature = new Uint8Array(await crypto.subtle.sign("HMAC", key, encoder2.encode(body)));
+  return `${body}.${base64UrlEncode(signature)}`;
+}
+async function verifyToken(key, token) {
+  const parts = token.split(".");
+  if (parts.length !== 2) return null;
+  const [body, signature] = parts;
+  try {
+    const valid = await crypto.subtle.verify(
+      "HMAC",
+      key,
+      base64UrlDecode(signature),
+      encoder2.encode(body)
+    );
+    if (!valid) return null;
+    return JSON.parse(decoder.decode(base64UrlDecode(body)));
+  } catch {
+    return null;
+  }
+}
+
+// src/mail.ts
+var RESEND_ENDPOINT = "https://api.resend.com/emails";
+var RETRYABLE = /* @__PURE__ */ new Set([429, 500, 502, 503, 504]);
+function createMailer(options) {
+  const doFetch = options.fetch ?? fetch;
+  const maxRetries = options.maxRetries ?? 2;
+  const sleep = options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  const log = options.log ?? ((message) => console.info(message));
+  async function send(message) {
+    const from = message.from ?? options.from;
+    if (!options.apiKey) {
+      log(
+        [
+          "[flare/mail] RESEND_API_KEY is not set; email logged instead of sent:",
+          `  From: ${from}`,
+          `  To: ${[message.to].flat().join(", ")}`,
+          `  Subject: ${message.subject}`,
+          "",
+          message.text ?? message.html
+        ].join("\n")
+      );
+      return { data: { id: "logged" }, error: null };
+    }
+    const headers = {
+      Authorization: `Bearer ${options.apiKey}`,
+      "Content-Type": "application/json"
+    };
+    if (message.idempotencyKey) headers["Idempotency-Key"] = message.idempotencyKey;
+    const body = JSON.stringify({
+      from,
+      to: [message.to].flat(),
+      subject: message.subject,
+      html: message.html,
+      ...message.text !== void 0 && { text: message.text },
+      ...message.replyTo !== void 0 && { reply_to: [message.replyTo].flat() }
+    });
+    for (let attempt = 0; ; attempt++) {
+      let response;
+      try {
+        response = await doFetch(RESEND_ENDPOINT, { method: "POST", headers, body });
+      } catch (cause) {
+        if (message.idempotencyKey && attempt < maxRetries) {
+          await sleep(backoff(attempt));
+          continue;
+        }
+        return failure("network_error", cause instanceof Error ? cause.message : String(cause), null);
+      }
+      if (response.ok) {
+        const { id } = await response.json();
+        return { data: { id }, error: null };
+      }
+      const payload = await response.json().catch(() => ({}));
+      const name = payload.name ?? "application_error";
+      const retryable = RETRYABLE.has(response.status) || name === "concurrent_idempotent_requests";
+      if (retryable && message.idempotencyKey && attempt < maxRetries) {
+        const retryAfter = Number(response.headers.get("retry-after"));
+        await sleep(Number.isFinite(retryAfter) && retryAfter > 0 ? retryAfter * 1e3 : backoff(attempt));
+        continue;
+      }
+      return failure(name, payload.message ?? response.statusText, response.status);
+    }
+  }
+  return { send };
+}
+function backoff(attempt) {
+  return 500 * 2 ** attempt + Math.floor(Math.random() * 250);
+}
+function failure(name, message, statusCode) {
+  return { data: null, error: { name, message, statusCode } };
+}
+var escapeHtml = (value) => value.replace(/[&<>"']/g, (char) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[char]);
+function renderTransactionalEmail(email) {
+  if (email.action && !/^https?:\/\//i.test(email.action.url)) {
+    throw new Error("Email action URLs must be absolute http(s) URLs.");
+  }
+  const font = `font-family:ui-sans-serif,-apple-system,"Segoe UI",Helvetica,Arial,sans-serif`;
+  const paragraphs = email.paragraphs.map((p) => `<p style="margin:0 0 16px;font-size:14px;line-height:22px;color:#0a0a0a">${escapeHtml(p)}</p>`).join("");
+  const action = email.action ? `<table role="presentation" cellpadding="0" cellspacing="0" style="margin:8px 0 24px"><tr><td style="border-radius:6px;background:#0a0a0a"><a href="${escapeHtml(email.action.url)}" style="display:inline-block;padding:10px 18px;font-size:14px;font-weight:600;color:#ffffff;text-decoration:none">${escapeHtml(email.action.label)}</a></td></tr></table><p style="margin:0 0 16px;font-size:12px;line-height:18px;color:#6b7280">Or paste this link into your browser:<br><a href="${escapeHtml(email.action.url)}" style="color:#6b7280;word-break:break-all">${escapeHtml(email.action.url)}</a></p>` : "";
+  const footer = email.footer ? `<p style="margin:24px 0 0;padding-top:16px;border-top:1px solid #e5e5e7;font-size:12px;line-height:18px;color:#6b7280">${escapeHtml(email.footer)}</p>` : "";
+  const preheader = email.preheader ? `<div style="display:none;max-height:0;overflow:hidden;opacity:0">${escapeHtml(email.preheader)}</div>` : "";
+  const html = `<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>${escapeHtml(email.heading)}</title></head><body style="margin:0;padding:0;background:#f7f7f8;${font}">${preheader}<table role="presentation" width="100%" cellpadding="0" cellspacing="0" style="background:#f7f7f8;padding:32px 16px"><tr><td align="center"><table role="presentation" width="100%" cellpadding="0" cellspacing="0" style="max-width:480px;background:#ffffff;border:1px solid #e5e5e7;border-radius:8px"><tr><td style="padding:32px;${font}"><p style="margin:0 0 24px;font-size:14px;font-weight:600;color:#6b7280">${escapeHtml(email.appName)}</p><h1 style="margin:0 0 16px;font-size:20px;line-height:28px;font-weight:600;color:#0a0a0a">${escapeHtml(email.heading)}</h1>${paragraphs}${action}${footer}</td></tr></table></td></tr></table></body></html>`;
+  const text2 = [
+    email.heading,
+    "",
+    ...email.paragraphs.flatMap((p) => [p, ""]),
+    ...email.action ? [`${email.action.label}: ${email.action.url}`, ""] : [],
+    ...email.footer ? ["--", email.footer] : []
+  ].join("\n").trimEnd();
+  return { html, text: text2 };
+}
+
+// src/sniff.ts
+var SNIFF_BYTES = 32;
+var ascii = (text2) => Array.from(text2, (char) => char.charCodeAt(0));
+function startsWith(head, signature, offset = 0) {
+  if (head.length < offset + signature.length) return false;
+  return signature.every((byte, index) => head[offset + index] === byte);
+}
+var text = (head, offset, length) => String.fromCharCode(...head.subarray(offset, offset + length));
+var isoBrand = (head) => startsWith(head, ascii("ftyp"), 4) ? text(head, 8, 4) : null;
+var riffType = (head) => startsWith(head, ascii("RIFF")) ? text(head, 8, 4) : null;
+var ZIP = [80, 75, 3, 4];
+var EMPTY_ZIP = [80, 75, 5, 6];
+var OLE2 = [208, 207, 17, 224, 161, 177, 26, 225];
+var EBML = [26, 69, 223, 163];
+var isZip = (head) => startsWith(head, ZIP) || startsWith(head, EMPTY_ZIP);
+var EXACT = {
+  "image/png": (head) => startsWith(head, [137, 80, 78, 71, 13, 10, 26, 10]),
+  "image/jpeg": (head) => startsWith(head, [255, 216, 255]),
+  "image/gif": (head) => startsWith(head, ascii("GIF87a")) || startsWith(head, ascii("GIF89a")),
+  "image/webp": (head) => riffType(head) === "WEBP",
+  "image/avif": (head) => ["avif", "avis", "mif1", "msf1"].includes(isoBrand(head) ?? ""),
+  "application/pdf": (head) => startsWith(head, ascii("%PDF-")),
+  "application/zip": isZip,
+  // Office Open XML and OpenDocument files are zip archives.
+  "application/vnd.openxmlformats-officedocument.wordprocessingml.document": isZip,
+  "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet": isZip,
+  "application/vnd.oasis.opendocument.text": isZip,
+  "application/vnd.oasis.opendocument.spreadsheet": isZip,
+  // Legacy .doc / .xls are OLE2 compound files.
+  "application/msword": (head) => startsWith(head, OLE2),
+  "application/vnd.ms-excel": (head) => startsWith(head, OLE2)
+};
+function isMediaContainer(head) {
+  return isoBrand(head) !== null || startsWith(head, EBML) || startsWith(head, ascii("OggS")) || ["AVI ", "WAVE"].includes(riffType(head) ?? "") || startsWith(head, ascii("fLaC")) || startsWith(head, ascii("ID3")) || // MPEG audio frame sync (MP3/AAC without an ID3 tag).
+  head.length >= 2 && head[0] === 255 && (head[1] & 224) === 224 || // MPEG program stream.
+  startsWith(head, [0, 0, 1, 186]);
+}
+var isText = (head) => head.every((byte) => byte >= 32 || byte === 9 || byte === 10 || byte === 12 || byte === 13);
+function sniffMatches(contentType, head) {
+  const type = contentType.split(";")[0].trim().toLowerCase();
+  const exact = EXACT[type];
+  if (exact) return exact(head);
+  if (type.startsWith("video/") || type.startsWith("audio/")) return isMediaContainer(head);
+  if (type === "text/plain" || type === "text/csv") return isText(head);
+  return void 0;
+}
+
+// src/storage.ts
+var SIGNING_PURPOSE = "storage";
+var DEFAULT_EXPIRES_IN = 15 * 60;
+function matchesContentType(contentType, allowed) {
+  const type = contentType.split(";")[0].trim().toLowerCase();
+  if (!/^[a-z0-9!#$&^_.+-]+\/[a-z0-9!#$&^_.+-]+$/.test(type)) return false;
+  return allowed.some((pattern) => {
+    const p = pattern.trim().toLowerCase();
+    return p.endsWith("/*") ? type.startsWith(p.slice(0, -1)) : type === p;
+  });
+}
+function createObjectKey(filename, prefix = "uploads") {
+  const now = /* @__PURE__ */ new Date();
+  const month = String(now.getUTCMonth() + 1).padStart(2, "0");
+  const safe = filename.normalize("NFKD").replace(/[^\w.-]+/g, "-").replace(/-+/g, "-").replace(/^[-.]+|[-.]+$/g, "").slice(-80) || "file";
+  return `${prefix.replace(/\/+$/, "")}/${now.getUTCFullYear()}/${month}/${crypto.randomUUID()}-${safe}`;
+}
+var INLINE_SAFE = /^(image\/(png|jpeg|gif|webp|avif)|application\/pdf|text\/plain|video\/[\w.+-]+|audio\/[\w.+-]+)$/;
+function isInlineSafe(contentType) {
+  return INLINE_SAFE.test(contentType.split(";")[0].trim().toLowerCase());
+}
+function isValidKey(key) {
+  return key.length > 0 && key.length <= 1024 && !key.startsWith("/") && !key.split("/").includes("..");
+}
+async function discard(body) {
+  try {
+    await drain(body.getReader());
+  } catch {
+  }
+}
+async function drain(reader) {
+  try {
+    while (!(await reader.read()).done) ;
+  } catch {
+  }
+}
+async function readHead(body, bytes) {
+  const reader = body.getReader();
+  const chunks = [];
+  let size = 0;
+  while (size < bytes) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    chunks.push(value);
+    size += value.byteLength;
+  }
+  const head = new Uint8Array(Math.min(size, bytes));
+  let offset = 0;
+  for (const chunk of chunks) {
+    if (offset >= head.length) break;
+    const part = chunk.subarray(0, head.length - offset);
+    head.set(part, offset);
+    offset += part.length;
+  }
+  return { head, chunks, reader };
+}
+function replay(chunks, reader, length) {
+  const source = new ReadableStream({
+    start(controller) {
+      for (const chunk of chunks) controller.enqueue(chunk);
+    },
+    async pull(controller) {
+      const { done, value } = await reader.read();
+      if (done) controller.close();
+      else controller.enqueue(value);
+    },
+    cancel: (reason) => reader.cancel(reason)
+  });
+  const FixedLength = globalThis.FixedLengthStream;
+  if (!FixedLength) return source;
+  const fixed = new FixedLength(length);
+  source.pipeTo(fixed.writable).catch(() => {
+  });
+  return fixed.readable;
+}
+function error(status, message) {
+  return Response.json({ error: message }, { status });
+}
+function createStorage(options) {
+  const routePath = options.routePath ?? "/api/storage";
+  const defaultExpiresIn = options.expiresIn ?? DEFAULT_EXPIRES_IN;
+  let keyPromise;
+  const signingKey = () => keyPromise ??= importSigningKey(options.secret, SIGNING_PURPOSE);
+  const expiry = (seconds = defaultExpiresIn) => Math.floor(Date.now() / 1e3) + seconds;
+  const urlFor = (token) => `${options.baseURL?.replace(/\/+$/, "") ?? ""}${routePath}?token=${token}`;
+  async function handle(request) {
+    const token = new URL(request.url).searchParams.get("token");
+    if (!token) return error(400, "Missing token.");
+    const payload = await verifyToken(await signingKey(), token);
+    if (!payload || typeof payload.exp !== "number" || !isValidKey(payload.key)) {
+      return error(403, "Invalid token.");
+    }
+    if (payload.exp < Date.now() / 1e3) return error(403, "Token expired.");
+    if (request.method === "PUT") {
+      if (payload.op !== "put") return error(403, "Token does not allow uploads.");
+      const contentType = request.headers.get("content-type") ?? "";
+      if (!matchesContentType(contentType, payload.types)) {
+        return error(415, `Content-Type must be one of: ${payload.types.join(", ")}.`);
+      }
+      const length = Number(request.headers.get("content-length"));
+      if (!request.headers.has("content-length") || !Number.isInteger(length) || length < 0) {
+        return error(411, "Content-Length is required.");
+      }
+      if (length > payload.max) return error(413, `File exceeds the ${payload.max}-byte limit.`);
+      if (!request.body) return error(400, "Missing request body.");
+      const { head, chunks, reader } = await readHead(request.body, SNIFF_BYTES);
+      if (sniffMatches(contentType, head) === false) {
+        await drain(reader);
+        return error(415, `The file's contents don't match its type (${contentType.split(";")[0].trim()}).`);
+      }
+      await options.bucket.put(payload.key, replay(chunks, reader, length), { httpMetadata: { contentType } });
+      return Response.json({ key: payload.key }, { status: 201 });
+    }
+    if (request.method === "GET" || request.method === "HEAD") {
+      if (payload.op !== "get") return error(403, "Token does not allow reads.");
+      const object = await options.bucket.get(payload.key);
+      if (!object) return error(404, "Not found.");
+      const headers = new Headers({
+        "content-type": object.httpMetadata?.contentType ?? "application/octet-stream",
+        "content-length": String(object.size),
+        etag: object.httpEtag,
+        "cache-control": "private, max-age=300",
+        "x-content-type-options": "nosniff"
+      });
+      const inline = !payload.name && isInlineSafe(headers.get("content-type"));
+      if (!inline) {
+        headers.set("content-security-policy", "default-src 'none'; sandbox");
+      }
+      const filename = payload.name ?? payload.key.split("/").pop();
+      headers.set(
+        "content-disposition",
+        `${inline ? "inline" : "attachment"}; filename*=UTF-8''${encodeURIComponent(filename)}`
+      );
+      return new Response(request.method === "HEAD" ? null : object.body, { headers });
+    }
+    return new Response(null, { status: 405, headers: { allow: "GET, HEAD, PUT" } });
+  }
+  return {
+    bucket: options.bucket,
+    /** A URL the browser can PUT the file body to, with the `Content-Type` header set. */
+    async createUploadUrl(upload) {
+      if (!isValidKey(upload.key)) throw new Error(`Invalid object key: ${upload.key}`);
+      if (upload.contentTypes.length === 0) throw new Error("contentTypes must list at least one type.");
+      const exp = expiry(upload.expiresIn);
+      const token = await signToken(await signingKey(), {
+        op: "put",
+        key: upload.key,
+        types: upload.contentTypes,
+        max: upload.maxBytes,
+        exp
+      });
+      return { url: urlFor(token), method: "PUT", key: upload.key, expiresAt: new Date(exp * 1e3) };
+    },
+    /** A temporary URL that serves the object. */
+    async createReadUrl(read) {
+      if (!isValidKey(read.key)) throw new Error(`Invalid object key: ${read.key}`);
+      const payload = { op: "get", key: read.key, exp: expiry(read.expiresIn) };
+      if (read.downloadAs) payload.name = read.downloadAs;
+      return urlFor(await signToken(await signingKey(), payload));
+    },
+    delete: (key) => options.bucket.delete(key),
+    /** Handles `PUT <routePath>?token=` (upload) and `GET <routePath>?token=` (read). */
+    async handleRequest(request) {
+      const response = await handle(request);
+      if (request.body && !request.bodyUsed) await discard(request.body);
+      return response;
+    }
+  };
+}
+
+// src/billing.ts
+var SUBSCRIPTION_STATUSES = [
+  "none",
+  "incomplete",
+  "trialing",
+  "active",
+  "past_due",
+  "paused",
+  "canceled",
+  "unpaid"
+];
+var LIVE = /* @__PURE__ */ new Set(["incomplete", "trialing", "active", "past_due", "paused"]);
+var isLiveSubscription = (status) => LIVE.has(status ?? "none");
+var grantsAccess = (status) => status === "active" || status === "trialing" || status === "past_due";
+function toSubscriptionStatus(stripeStatus) {
+  if (stripeStatus === "incomplete_expired") return "canceled";
+  return SUBSCRIPTION_STATUSES.includes(stripeStatus) ? stripeStatus : "none";
+}
+function currentPeriodEnd(subscription) {
+  const ends = (subscription.items?.data ?? []).map((item) => item.current_period_end).filter((value) => typeof value === "number");
+  return ends.length ? Math.max(...ends) * 1e3 : null;
+}
+var subscriptionPriceId = (subscription) => subscription.items?.data?.[0]?.price?.id ?? null;
+function subscriptionState(subscription) {
+  const status = toSubscriptionStatus(subscription.status);
+  const ended = subscription.ended_at ? subscription.ended_at * 1e3 : null;
+  const scheduled = subscription.cancel_at ? subscription.cancel_at * 1e3 : null;
+  const end = status === "canceled" ? ended ?? currentPeriodEnd(subscription) : scheduled ?? currentPeriodEnd(subscription);
+  return {
+    stripeSubscriptionId: subscription.id,
+    subscriptionStatus: status,
+    subscriptionEndsAt: end ? new Date(end) : null,
+    cancelAtPeriodEnd: Boolean(subscription.cancel_at_period_end) || scheduled !== null,
+    priceId: subscriptionPriceId(subscription)
+  };
+}
+function shouldApplySubscription(stored, incoming) {
+  if (!stored.stripeSubscriptionId || stored.stripeSubscriptionId === incoming.id) return true;
+  return isLiveSubscription(toSubscriptionStatus(incoming.status)) || !isLiveSubscription(stored.subscriptionStatus);
+}
+var checkoutPaid = (session) => session.payment_status !== "unpaid";
+function randomLetters(length = 8) {
+  const bytes = crypto.getRandomValues(new Uint8Array(length));
+  return Array.from(bytes, (byte) => String.fromCharCode(97 + byte % 26)).join("");
+}
+
+// src/resource/fields.ts
+var FILE_CATEGORIES = {
+  image: ["image/png", "image/jpeg", "image/gif", "image/webp", "image/avif"],
+  pdf: ["application/pdf"],
+  video: ["video/*"],
+  audio: ["audio/*"],
+  text: ["text/plain"],
+  csv: ["text/csv"],
+  document: [
+    "application/msword",
+    "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+    "application/vnd.oasis.opendocument.text"
+  ],
+  spreadsheet: [
+    "application/vnd.ms-excel",
+    "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+    "application/vnd.oasis.opendocument.spreadsheet"
+  ],
+  archive: ["application/zip"]
+};
+function mimeTypesFor(accept) {
+  return [...new Set(accept.flatMap((category) => FILE_CATEGORIES[category]))];
+}
+var DEFAULT_FILE_MAX_BYTES = 10 * 1024 * 1024;
+var fileMaxBytes = (field2) => field2.maxBytes ?? DEFAULT_FILE_MAX_BYTES;
+function build(kind, options, extra = {}) {
+  return { kind, ...extra, ...options, required: options?.required !== false };
+}
+var field = {
+  string: (options) => build("string", options),
+  text: (options) => build("text", options, { list: false, searchable: false }),
+  int: (options) => build("int", options),
+  float: (options) => build("float", options),
+  boolean: (options) => build("boolean", options),
+  date: (options) => build("date", options),
+  datetime: (options) => build("datetime", options),
+  enum: (values, options) => build("enum", options, { options: values }),
+  file: (accept, options) => build("file", options, { accept, list: false, sortable: false }),
+  belongsTo: (target, options) => build("belongsTo", options, { target }),
+  hasMany: (target, options) => ({ kind: "hasMany", target, ...options, required: false })
+};
+
+// src/resource/relations.ts
+var RelationError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "RelationError";
+  }
+};
+var relationNameFor = (table, key) => `${table}_${columnName(key)}`;
+function relationGraph(resources) {
+  const byName = new Map(resources.map((resource) => [resource.name, resource]));
+  const graph = { byResource: {}, pending: [] };
+  for (const resource of resources) {
+    const relations = { belongsTo: [], hasMany: [] };
+    for (const [key, def] of storedFields(resource)) {
+      if (def.kind !== "belongsTo") continue;
+      if (!byName.has(def.target)) {
+        throw new RelationError(`${resource.name}.${key} belongs to "${def.target}", but there is no ${def.target} resource.`);
+      }
+      relations.belongsTo.push({
+        key,
+        name: key.replace(/Id$/, ""),
+        target: def.target,
+        required: def.required,
+        onDelete: def.onDelete ?? "restrict",
+        relationName: relationNameFor(resource.table, key)
+      });
+    }
+    graph.byResource[resource.name] = relations;
+  }
+  for (const resource of resources) {
+    for (const [key, def] of Object.entries(resource.fields)) {
+      if (def.kind !== "hasMany") continue;
+      const target = byName.get(def.target);
+      if (!target) {
+        graph.pending.push({ resource: resource.name, key, target: def.target });
+        continue;
+      }
+      const foreignKey = def.foreignKey ?? `${camelCase(resource.name)}Id`;
+      const back = graph.byResource[target.name].belongsTo.find((relation) => relation.key === foreignKey);
+      if (!back || back.target !== resource.name) {
+        throw new RelationError(
+          `${resource.name}.${key} is hasMany(${target.name}), but ${target.name} has no ${foreignKey}: belongsTo(${resource.name}) field. Add it to ${target.name}, or set foreignKey to the field that points back.`
+        );
+      }
+      graph.byResource[resource.name].hasMany.push({ key, target: target.name, foreignKey, relationName: back.relationName });
+    }
+  }
+  for (const resource of resources) {
+    const { belongsTo, hasMany } = graph.byResource[resource.name];
+    const taken = new Set(Object.keys(resource.fields));
+    for (const { key, name } of belongsTo) {
+      if (taken.has(name)) {
+        throw new RelationError(`${resource.name}.${key} exposes relation "${name}", which collides with the ${resource.name}.${name} field. Rename one of them.`);
+      }
+      taken.add(name);
+    }
+    for (const { key } of hasMany) {
+      if (belongsTo.some((relation) => relation.name === key)) {
+        throw new RelationError(`${resource.name}.${key} collides with a belongsTo relation of the same name.`);
+      }
+    }
+  }
+  return graph;
+}
+
+// src/resource/display.ts
+var TONES = [
+  ["success", /^(paid|fulfilled|active|approved|completed?|delivered|done|published|resolved|shipped|succeeded|success|verified|won)$/],
+  ["danger", /^(banned|blocked|cancel+ed|churned|declined|error|expired|failed|lost|overdue|refunded|rejected|suspended)$/],
+  ["warning", /^(awaiting|draft|in[-_ ]?review|on[-_ ]?hold|pending|processing|review|trial|unpaid|unverified)$/]
+];
+function statusTone(value) {
+  if (typeof value !== "string") return "neutral";
+  const normalized = value.trim().toLowerCase();
+  return TONES.find(([, pattern]) => pattern.test(normalized))?.[0] ?? "neutral";
+}
+function optionLabel(def, value) {
+  if (def.kind === "enum" && def.optionLabels?.[value]) return def.optionLabels[value];
+  const text2 = value.replace(/[_-]+/g, " ").trim();
+  return text2 ? text2[0].toUpperCase() + text2.slice(1) : value;
+}
+function formatValue(def, value, options = {}) {
+  if (value === null || value === void 0 || value === "") return "\u2014";
+  const locale = options.locale ?? "en-US";
+  switch (def.kind) {
+    case "boolean":
+      return value ? "Yes" : "No";
+    case "int":
+      return new Intl.NumberFormat(locale, { maximumFractionDigits: 0 }).format(Number(value));
+    case "float":
+      return new Intl.NumberFormat(locale, { maximumFractionDigits: 2 }).format(Number(value));
+    case "date": {
+      const date = /* @__PURE__ */ new Date(`${String(value)}T00:00:00Z`);
+      return Number.isNaN(date.getTime()) ? String(value) : new Intl.DateTimeFormat(locale, { dateStyle: "medium", timeZone: "UTC" }).format(date);
+    }
+    case "datetime":
+    case "timestamp": {
+      const date = value instanceof Date ? value : new Date(value);
+      return Number.isNaN(date.getTime()) ? String(value) : new Intl.DateTimeFormat(locale, { dateStyle: "medium", timeStyle: "short", timeZone: options.timeZone ?? "UTC" }).format(date);
+    }
+    case "enum":
+      return optionLabel(def, String(value));
+    case "file":
+      return String(value).split("/").pop().replace(/^[0-9a-f-]{36}-/, "");
+    default:
+      return String(value);
+  }
+}
+
+// src/resource/form.ts
+function initialFormValues(resource, record) {
+  const values = {};
+  for (const [key, def] of storedFields(resource)) {
+    const source = record ? record[key] : "default" in def ? def.default : void 0;
+    if (def.kind === "boolean") values[key] = source === true || source === 1;
+    else if (source === null || source === void 0) values[key] = "";
+    else if (source instanceof Date) values[key] = source.toISOString();
+    else values[key] = String(source);
+  }
+  return values;
+}
+function formValuesToInput(resource, values, mode) {
+  const input = {};
+  for (const [key, def] of storedFields(resource)) {
+    const raw = values[key];
+    if (def.kind === "boolean") {
+      input[key] = raw === true;
+      continue;
+    }
+    const text2 = typeof raw === "string" ? raw : "";
+    const empty = text2.trim() === "";
+    if (empty) {
+      const hasDefault = "default" in def && def.default !== void 0;
+      if (mode === "create" && hasDefault) continue;
+      if (!def.required) input[key] = null;
+      else if (def.kind === "string" || def.kind === "text") input[key] = text2;
+      continue;
+    }
+    if (def.kind === "int" || def.kind === "float") {
+      const number = Number(text2.trim());
+      input[key] = Number.isFinite(number) ? number : text2;
+      continue;
+    }
+    input[key] = text2;
+  }
+  return input;
+}
+function issuesByField(issues) {
+  const errors = {};
+  for (const issue of issues) {
+    const path = Array.isArray(issue.path) ? issue.path.map(String).join(".") : issue.path;
+    const key = path.split(".")[0] || "_form";
+    errors[key] ??= issue.message;
+  }
+  return errors;
+}
+
+// src/resource/policy.ts
+var ROLE = /^(\*|[a-z][a-z0-9_-]{0,31})$/;
+var PolicyError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "PolicyError";
+  }
+};
+function definePolicy(config) {
+  if (!/^[A-Z][A-Za-z0-9]*$/.test(config.resource)) {
+    throw new PolicyError(`Policy resource "${config.resource}" must be a PascalCase resource name.`);
+  }
+  const clean = (action) => {
+    const roles = config[action] ?? [];
+    for (const role of roles) {
+      if (!ROLE.test(role)) throw new PolicyError(`Policy ${config.resource}.${action}: invalid role "${role}" (lowercase letters, digits, _ or -, or "*").`);
+    }
+    return [...new Set(roles)];
+  };
+  return { resource: config.resource, read: clean("read"), create: clean("create"), update: clean("update"), delete: clean("delete") };
+}
+function can(policy, role, action) {
+  if (!policy) return true;
+  const allowed = policy[action === "list" ? "read" : action];
+  if (allowed.includes("*")) return Boolean(role);
+  return Boolean(role) && allowed.includes(role);
+}
+function allowedActions(policy, role) {
+  return {
+    read: can(policy, role, "read"),
+    create: can(policy, role, "create"),
+    update: can(policy, role, "update"),
+    delete: can(policy, role, "delete")
+  };
+}
+
+// src/seed.ts
+function defineSeed(seed) {
+  return seed;
+}
+
+// src/index.ts
+var FLARE_VERSION = "0.1.0";
+export {
+  DEFAULT_FILE_MAX_BYTES,
+  FILE_CATEGORIES,
+  FLARE_VERSION,
+  PBKDF2_ITERATIONS,
+  PolicyError,
+  RESERVED_FIELD_NAMES,
+  RelationError,
+  ResourceDefinitionError,
+  SNIFF_BYTES,
+  SUBSCRIPTION_STATUSES,
+  allowedActions,
+  camelCase,
+  can,
+  checkoutPaid,
+  columnName,
+  createMailer,
+  createObjectKey,
+  createStorage,
+  createValidators,
+  currentPeriodEnd,
+  defaultFieldLabel,
+  definePolicy,
+  defineResource,
+  defineSeed,
+  field,
+  fieldSchema,
+  fileKeyPrefix,
+  fileMaxBytes,
+  formValuesToInput,
+  formatValue,
+  grantsAccess,
+  hashPassword,
+  humanize,
+  importSigningKey,
+  initialFormValues,
+  isLiveSubscription,
+  issuesByField,
+  kebabCase,
+  matchesContentType,
+  mimeTypesFor,
+  optionLabel,
+  pascalCase,
+  pluralize,
+  randomLetters,
+  relationGraph,
+  renderTransactionalEmail,
+  shouldApplySubscription,
+  signToken,
+  snakeCase,
+  sniffMatches,
+  statusTone,
+  storedFields,
+  subscriptionPriceId,
+  subscriptionState,
+  toSubscriptionStatus,
+  verifyPassword,
+  verifyToken,
+  words
+};