@isaijs/core 0.1.0 → 0.1.1

package/dist/{index-CBWFoL3s.d.ts → index-B6ipokoP.d.ts}

@@ -1,7 +1,7 @@
-import { a as DatabaseDriver, b as TenantDatabases, d as RateLimiter, g as Storage, l as PdfRenderer, n as Body, p as Runtime, r as Cache, s as MailDriver, u as Queue } from "./index-BKwTOLop.js";
-import { C as ObjectShape, q as StoredFile, w as Output } from "./index-BVCrbMav.js";
-import { $ as Expr, C as WithIncludes, D as PageOptions, E as Page, J as Models, Q as Embed, S as Key, T as NumberedPageOptions, V as AnyModel, X as Condition, Z as Conditional, b as RowOf, ct as ColumnNode, gt as FieldSpec, i as Row, lt as ConditionNode, n as Patch, p as Database, t as Insert, ut as Operand, v as OrderKey, w as NumberedPage, x as IncludePath } from "./types-BFc_NEx8.js";
-import { a as PROVIDERS, i as HELD, k as Manifest } from "./data-layer-BMviRJaW.js";
+import { a as DatabaseDriver, b as TenantDatabases, d as RateLimiter, g as Storage, l as PdfRenderer, n as Body, p as Runtime, r as Cache, s as MailDriver, u as Queue } from "./index-Ce5p2-EB.js";
+import { C as ObjectShape, q as StoredFile, w as Output } from "./index-C-WmIKxT.js";
+import { $ as Expr, C as WithIncludes, D as PageOptions, E as Page, J as Models, Q as Embed, S as Key, T as NumberedPageOptions, V as AnyModel, X as Condition, Z as Conditional, b as RowOf, ct as ColumnNode, gt as FieldSpec, i as Row, lt as ConditionNode, n as Patch, p as Database, t as Insert, ut as Operand, v as OrderKey, w as NumberedPage, x as IncludePath } from "./types-DpOcIuDl.js";
+import { a as PROVIDERS, i as HELD, k as Manifest } from "./data-layer-ubPfZvFV.js";
 //#region src/auth/policies.d.ts
 /** The actions every model's policy has. */
 declare const STANDARD_ACTIONS: readonly ["read", "create", "update", "delete"];
@@ -58,7 +58,7 @@ interface DefinePolicy {
 //#region src/api/fail.d.ts
 /**
  * `fail(code, message)`: the app's own business rules, for what can't be a `.check()`, a flow or a
- * unique. Always a 409; app code never picks a status (planning/requests.md → Errors).
+ * unique. Always a 409; app code never picks a status.
  */
 declare class Rejected extends Error {
   /** Stable and machine-readable (`alreadyCheckedIn`). */
@@ -148,7 +148,7 @@ type User = Models extends {
   readonly id: string;
 };
 /**
- * Who signs in on the platform's host (planning/tenancy.md → End of v1): the `PlatformUser` row,
+ * Who signs in on the platform's host: the `PlatformUser` row,
  * once it's in the `Models` registry.
  */
 type PlatformUser = Models extends {
@@ -165,8 +165,8 @@ interface RouteOptions<S extends ObjectShape = ObjectShape, A extends boolean =
   /** Callable without a session; `user` is then `User | undefined`. Signed in by default. */
   readonly anonymous?: A;
   /**
-   * Served on the platform's host, in the front door, with no tenant (isolated tenancy,
-   * planning/tenancy.md → End of v1): `db` is the platform's, `user` a platform user.
+   * Served on the platform's host, in the front door, with no tenant (isolated tenancy): `db` is
+   * the platform's, `user` a platform user.
    */
   readonly platform?: Pl;
 }
@@ -190,13 +190,13 @@ interface RouteContext<P extends string, S extends ObjectShape, A extends boolea
   readonly input: Output<S>;
   /** The raw request, for headers. */
   readonly request: Request;
-  /** The tenant this request is for (planning/tenancy.md); undefined without tenancy, and on the platform's host. */
+  /** The tenant this request is for; undefined without tenancy, and on the platform's host. */
   readonly tenant: Pl extends true ? undefined : TenantRow;
 }
 type RouteHandler<P extends string, S extends ObjectShape, A extends boolean, R = unknown, Pl extends boolean = false> = (context: RouteContext<P, S, A, Pl>) => R;
 /**
  * One declared route. The pipeline finds these among an app module's exports. `O` is what its
- * handler returns, awaited: the typed client reads it (planning/client.md).
+ * handler returns, awaited: the typed client reads it.
  */
 declare class Route<O = unknown> {
   readonly method: Method;
@@ -284,7 +284,7 @@ interface AppConfig {
    * `durableObject(env.TENANT)`) and `platform`. Without: one database, named freely (`main`).
    */
   readonly databases: Readonly<Record<string, DatabaseDriver | TenantDatabases>>;
-  /** Many tenants (planning/tenancy.md); left out, the app has one. Needs `databases.platform`. */
+  /** Many tenants; left out, the app has one. Needs `databases.platform`. */
   readonly tenancy?: TenancyConfig;
   /** Who signs in and how: `auth` from `auth.ts` (createAuth). */
   readonly auth?: Auth<any>;
@@ -330,11 +330,19 @@ type AnyColumn = {
 interface ResourceOptions {
   /** ANDed with the policy for every action (a view's `WHERE`); `byRole` is the action's permission. */
   readonly filter?: Conditional;
-  /** The output: exactly these columns, or `"all"` (hidden kinds never leave either way). */
+  /**
+   * The output: exactly these columns, or `"all"` (hidden kinds never leave either way). Refs and
+   * relations are embedded with `.pick(...)`, whose paths may follow relations
+   * (`product.variants.pick("price", "tiers.price")`); each level keeps only the rows its own
+   * model's `read` rule allows.
+   */
   readonly fields: readonly (AnyColumn | Embed)[] | "all";
   /** Named values computed in SQL (counts, sums, conditions), beside the fields. */
   readonly computed?: Readonly<Record<string, AnyColumn | Condition>>;
-  /** The only fields create and update accept, or `"all"`. */
+  /**
+   * The only fields create and update accept (a mass-assignment guard), or `"all"`. With `create`,
+   * it covers every required field without a default.
+   */
   readonly writable?: readonly AnyColumn[] | "all";
   /** Fields (or ref paths: `product.category.slug`) a client may filter by. */
   readonly filterable?: readonly AnyColumn[];
@@ -342,7 +350,7 @@ interface ResourceOptions {
   readonly sortable?: readonly (AnyColumn | string)[];
   /** Named conditions a client switches on: `?onSale`. */
   readonly filters?: Readonly<Record<string, Conditional>>;
-  /** Text fields `?q=` searches. */
+  /** Fields (or ref paths: `product.category.name`) `?search=` matches, any of them, ignoring case. */
   readonly search?: readonly AnyColumn[];
   /** The column `/:key` looks up (unique). The id by default; a singleton has none. */
   readonly key?: AnyColumn;
@@ -358,7 +366,7 @@ interface SearchField {
 }
 /**
  * A declared resource, with what the engine reads from it. `C` is its custom actions, as declared:
- * the typed client reads what each returns (planning/client.md).
+ * the typed client reads what each returns.
  */
 declare class Resource<C = Readonly<Record<string, CustomAction>>> {
   readonly model: AnyModel;
@@ -431,13 +439,13 @@ interface App {
   readonly db: Database;
   /**
    * The platform's database (isolated tenancy): for the platform's routes, services and seeds,
-   * refused inside a tenant, where `app.db` is the tenant's (planning/tenancy.md → End of v1).
+   * refused inside a tenant, where `app.db` is the tenant's.
    */
   readonly platform: {
     readonly db: Database;
   };
   /**
-   * Files from code (planning/uploads.md): `put` stores one for a write (in the current tenant's
+   * Files from code: `put` stores one for a write (in the current tenant's
    * space), `get` reads it, `url` links to it, `delete` removes it.
    */
   readonly files: AppFiles;
@@ -456,7 +464,7 @@ interface AppOptions {
   /**
    * The tenant database's history: `() => import("#migrations/tenant")`, through a
    * `#migrations/<name>` alias to `./migrations/<name>/index.ts` in `package.json` imports. Needed with
-   * isolated tenancy, where each tenant's database applies it on wake (planning/tenancy.md).
+   * isolated tenancy, where each tenant's database applies it on wake.
    */
   readonly migrations?: AppMigrations;
   /**
@@ -480,7 +488,7 @@ interface CreatedApp<Served, TenantHost = undefined> {
    */
   readonly Tenant: TenantHost;
   readonly route: RouteBuilder;
-  /** `resource(Model, options)`: what the API exposes over a model (planning/resources.md). */
+  /** `resource(Model, options)`: what the API exposes over a model. */
   readonly resource: typeof resource;
   readonly fail: typeof fail;
 }
@@ -491,7 +499,7 @@ interface CreatedApp<Served, TenantHost = undefined> {
 declare function createApp<Env, Served, TenantHost = undefined>(runtime: Runtime<Env, Served, TenantHost>, configure: (env: Env) => AppConfig, options?: AppOptions): CreatedApp<Served, TenantHost>;
 //#endregion
 //#region src/app/core.d.ts
-/** The app modules (`apps/*\/routes.ts`, `resources.ts`), each a lazy import (planning/README.md → Instances). */
+/** The app modules (`apps/*\/routes.ts`, `resources.ts`), each a lazy import. */
 type AppModules = () => readonly Promise<object>[];
 /**
  * The tenant database's history, as a lazy import of the manifest `isai makemigrations` writes
@@ -525,7 +533,7 @@ declare class NotImplementedError extends Error {
 interface InviteInput {
   readonly email: string;
   readonly role: string;
-  /** `"platform"`: the tenant's people can't take the role away (planning/tenancy.md → End of v1). */
+  /** `"platform"`: the tenant's people can't take the role away. */
   readonly held?: (typeof HELD)[number];
 }
 //#endregion
@@ -556,8 +564,10 @@ interface AuthDefinition {
   /** Who may make an account by signing in: anyone (`"open"`, the default), or the invited. */
   readonly signUp?: "open" | "invite";
   /**
-   * Signs what crosses the browser during sign-in (Google's `state`, the hand-off between hosts):
-   * 32 random bytes, base64url, kept as a secret of the deployment (`env.AUTH_SECRET`).
+   * Signs what crosses the browser during sign-in (Google's `state`, the hand-off between hosts)
+   * and private files' links: 32 random bytes, base64url, kept as a secret of the deployment
+   * (`env.AUTH_SECRET`). Sessions don't depend on it, so rotating it only ends sign-ins in progress
+   * and links already given out.
    */
   readonly secret: string;
 }
@@ -580,7 +590,7 @@ declare class Auth<Env = unknown> {
     readonly invite: "auth.invite";
     /** See the people with accounts, give and take their roles, suspend them. */
     readonly manageUsers: "auth.manageUsers";
-    /** Read the whole audit log (`GET /api/audit`), with the log on (planning/audit.md). */
+    /** Read the whole audit log (`GET /api/audit`), with the log on. */
     readonly readAudit: "audit.read";
   };
   /** The policies made with this instance's `policy()`. */
@@ -591,7 +601,7 @@ declare class Auth<Env = unknown> {
   /**
    * Gives `email` a role from `app.ts`, from code (a tenant's setup service, a seed): now, if it has
    * an account in the current database, else when it first signs in. Safe to repeat.
-   * `held: "platform"` puts the assignment beyond the tenant's reach (planning/tenancy.md → End of v1).
+   * `held: "platform"` puts the assignment beyond the tenant's reach.
    */
   invite(input: InviteInput): Promise<void>;
   /** The core's: where `invite` writes. */

package/dist/{index-BVCrbMav.d.ts → index-C-WmIKxT.d.ts}

@@ -1,4 +1,4 @@
-import { i as Result, r as Path } from "./issues-Bxq4JExX.js";
+import { i as Result, r as Path } from "./issues-CKto95IW.js";
 //#region src/validation/standard.d.ts
 /**
  * Standard Schema v1 (standardschema.dev), the interface Zod, Valibot and ArkType share. Every
@@ -39,7 +39,7 @@ interface Measure {
 }
 /**
  * How sensitive a value is: `hidden` never leaves the server; `personal` is redacted in logs,
- * exports and AI context. The output layer applies it (planning/fields.md → Sensitive fields).
+ * exports and AI context. The output layer applies it.
  */
 type Sensitivity = "hidden" | "personal";
 interface KindSpec {
@@ -76,7 +76,7 @@ interface KindSpec {
    */
   readonly fake: (fake: Fake, context: FakeContext) => unknown;
 }
-/** What a file kind accepts, and where its files go (planning/uploads.md). */
+/** What a file kind accepts, and where its files go. */
 interface FileSpec {
   /** The storage its files go to: a key of `storage` in `app.ts`. */
   readonly storage: string;
@@ -346,9 +346,8 @@ declare const slug: () => Kind<string, string, false, false>;
  */
 declare const host: () => Kind<string, string, false, false>;
 /**
- * One DNS label for a tenant's host on the platform (`demo` in `demo.thiraiangadi.shop`,
- * planning/tenancy.md → End of v1): lowercase letters, digits and inner dashes, 3–63 characters,
- * none of the reserved names.
+ * One DNS label for a tenant's host on the platform (`demo` in `demo.thiraiangadi.shop`):
+ * lowercase letters, digits and inner dashes, 3–63 characters, none of the reserved names.
  */
 declare const subdomain: () => Kind<string, string, false, false>;
 /** A slug made from text: `"Summer Fest 2026!"` → `"summer-fest-2026"`. Empty when nothing survives. */

package/dist/{index-BKwTOLop.d.ts → index-Ce5p2-EB.d.ts}

@@ -31,7 +31,7 @@ interface AppCore {
     readonly seeded: boolean;
   }>;
 }
-/** A tenant's entry points, where its database lives (planning/tenancy.md → Tenant databases). */
+/** A tenant's entry points, where its database lives. */
 interface TenantCore {
   /** Brings the tenant's database to the deployed schema: on wake, before any request. */
   wake(): Promise<void>;
@@ -125,7 +125,7 @@ interface StoredObject {
   readonly contentType?: string;
 }
 /**
- * Where files live (planning/uploads.md). A storage with a `publicUrl` is public: its files are
+ * Where files live. A storage with a `publicUrl` is public: its files are
  * served from there, by the bucket. Without one it's private, and the app serves its files
  * through signed links.
  */

package/dist/index.d.ts

@@ -1,3 +1,3 @@
-import { p as Runtime, t as AppCore } from "./index-BKwTOLop.js";
-import { C as Params, D as RouteHandler, E as RouteContext, M as fail, O as RouteOptions, S as Method, T as RouteBuilder, _ as CustomAction, b as AppConfig, d as NotImplementedError, f as AppModules, g as createApp, h as CreatedApp, j as Rejected, k as User, m as AppOptions, p as App, v as Resource, w as Route, x as Named, y as ResourceOptions } from "./index-CBWFoL3s.js";
+import { p as Runtime, t as AppCore } from "./index-Ce5p2-EB.js";
+import { C as Params, D as RouteHandler, E as RouteContext, M as fail, O as RouteOptions, S as Method, T as RouteBuilder, _ as CustomAction, b as AppConfig, d as NotImplementedError, f as AppModules, g as createApp, h as CreatedApp, j as Rejected, k as User, m as AppOptions, p as App, v as Resource, w as Route, x as Named, y as ResourceOptions } from "./index-B6ipokoP.js";
 export { type App, type AppConfig, type AppCore, type AppModules, type AppOptions, type CreatedApp, type CustomAction, type Method, type Named, NotImplementedError, type Params, Rejected, type Resource, type ResourceOptions, Route, type RouteBuilder, type RouteContext, type RouteHandler, type RouteOptions, type Runtime, type User, createApp, fail };

package/dist/index.js

@@ -1,14 +1,14 @@
-import { B as toKind, R as object, V as validate, W as ValidationError, a as fileTypeNames, f as email, m as line } from "./validation-l5JG-PFn.js";
-import { B as modelOfRow, C as database, D as planInsert, E as recordAction, F as systemClock, G as UniqueFailed, L as NeedsDatabase, O as planUpdate, R as evaluate, S as clockOf, U as NotFound, j as conditionOf, k as keyCondition, r as sync, t as migrate, w as decodeStored } from "./migrator-C65RM_K-.js";
-import { C as tooLarge, E as fail, S as tenantSuspended, T as Rejected, _ as json, b as routeNotFound, c as fromBody, d as route, f as HttpError, g as fileTypeRefused, h as fileTooLarge, l as readInput, m as errorResponse, o as parseListQuery, p as crossSiteRequest, r as resource, s as BODY_LIMIT, t as Resource, u as Route, v as lengthRequired, w as tooManyRequests, x as signInRequired, y as methodNotAllowed } from "./resource-9fjxJgmz.js";
-import { F as sensitivity, G as ulid, K as Scope, V as asActor, a as columnName, b as asCondition$1, c as fieldOf, f as Condition, m as Expr, n as toBase64url, r as Model, t as fromBase64url, u as rowOf } from "./base64url-DwWPqoOT.js";
+import { B as toKind, R as object, V as validate, W as ValidationError, a as fileTypeNames, f as email, m as line } from "./validation-FyOpSZqE.js";
+import { B as modelOfRow, C as database, D as planInsert, E as recordAction, F as systemClock, G as UniqueFailed, L as NeedsDatabase, O as planUpdate, R as evaluate, S as clockOf, U as NotFound, j as conditionOf, k as keyCondition, r as sync, t as migrate, w as decodeStored } from "./migrator-6oWUefLA.js";
+import { C as tooLarge, E as fail, S as tenantSuspended, T as Rejected, _ as json, b as routeNotFound, c as fromBody, d as route, f as HttpError, g as fileTypeRefused, h as fileTooLarge, l as readInput, m as errorResponse, o as parseListQuery, p as crossSiteRequest, r as resource, s as BODY_LIMIT, t as Resource, u as Route, v as lengthRequired, w as tooManyRequests, x as signInRequired, y as methodNotAllowed } from "./resource-C17NvNa3.js";
+import { F as sensitivity, G as ulid, K as Scope, V as asActor, a as columnName, b as asCondition$1, c as fieldOf, f as Condition, m as Expr, n as toBase64url, r as Model, t as fromBase64url, u as rowOf } from "./base64url-K_wCmvxR.js";
 import { t as kebabCase } from "./case-BnpcvhdW.js";
-import { t as PLATFORM_PREFIX } from "./tables-C3Uza4qK.js";
+import { t as PLATFORM_PREFIX } from "./tables-C4ipMFjg.js";
 import { t as Seed } from "./seed-BObmdKdP.js";
 import { n as notImplemented, t as NotImplementedError } from "./errors-mCNLlXg9.js";
-import { d as afterUpdate, f as bindFor, h as ownerFieldOf, m as isFalse, p as check, u as FALSE } from "./policies-yVzFCjxU.js";
-import { i as checkRoles, n as authPerms, r as checkAuth } from "./create-auth-Byf1-VJw.js";
-import { C as syncRoles, S as seedAs, _ as cookieOf, a as authModels, b as permissionsOf, c as hashOf, d as GoogleError, f as consentUrl, g as cookie, h as verifyIdToken, i as makers, l as sessions, n as TENANT, p as exchangeCode, r as checkTenancy, s as clearedCookie, t as PLATFORM, v as redirect, x as roleKeys, y as safeReturn } from "./config-D6PexpSC.js";
+import { d as afterUpdate, f as bindFor, h as ownerFieldOf, m as isFalse, p as check, u as FALSE } from "./policies-pFzslmSB.js";
+import { i as checkRoles, n as authPerms, r as checkAuth } from "./create-auth-y8E8cxkn.js";
+import { C as syncRoles, S as seedAs, _ as cookieOf, a as authModels, b as permissionsOf, c as hashOf, d as GoogleError, f as consentUrl, g as cookie, h as verifyIdToken, i as makers, l as sessions, n as TENANT, p as exchangeCode, r as checkTenancy, s as clearedCookie, t as PLATFORM, v as redirect, x as roleKeys, y as safeReturn } from "./config-0PGFbJh6.js";
 import { t as WrongSize } from "./storage-body-7dWyMszh.js";
 import { RegExpRouter } from "hono/router/reg-exp-router";
 import { SmartRouter } from "hono/router/smart-router";
@@ -61,10 +61,10 @@ var Router = class {
 //#endregion
 //#region src/api/output.ts
 /**
-* What a handler returns, as JSON (planning/requests.md → Output). Rows the ORM returned are found
+* What a handler returns, as JSON. Rows the ORM returned are found
 * anywhere in the value by their tag: each field goes out in its kind's JSON form, and hidden
 * fields (`password`, `secret`, hidden slots) never leave. A file field's files go out as a client
-* sees them, with a `url` and without where they're kept (planning/uploads.md → Reading).
+* sees them, with a `url` and without where they're kept.
 */
 /** The value as JSON, each file with its URL. */
 async function toJSON(value, urlOf) {
@@ -354,7 +354,7 @@ function secure(response, url) {
 //#endregion
 //#region src/auth/boundary.ts
 /**
-* The route context's `db` (planning/policies.md → Enforcement): the same queries as `app.db`,
+* The route context's `db`: the same queries as `app.db`,
 * but each one ends in `.allowed(action)` (the model's policy applies) or `.unchecked()` (it
 * doesn't, visibly). Until then it can't be awaited: a type error, and a rejection at runtime.
 *
@@ -976,7 +976,7 @@ function rescope(node, scope) {
 //#endregion
 //#region src/resources/custom.ts
 /**
-* A resource's custom actions (planning/resources.md, planning/requests.md → Custom actions):
+* A resource's custom actions:
 * `POST /api/<r>/:key/<action>` (a singleton's: `/api/<r>/<action>`) runs the app's service on one
 * row:
 *
@@ -989,7 +989,7 @@ function rescope(node, scope) {
 * and the action's own rule must hold on it (else 403, or 401 anonymous). Then the service runs:
 * trusted, with `app.db`, given the row and `{ input, user, tenant }`. What it returns is the
 * response, as a route's is (`undefined` → 204). With the audit log on, the action is an entry on
-* the row (planning/audit.md).
+* the row.
 */
 async function runCustom(resource, action, context) {
 	const declared = resource.custom[action];
@@ -1047,7 +1047,7 @@ async function assertHeld(resource, context, rowId, action) {
 //#endregion
 //#region src/audit/entries.ts
 /**
-* Audit entries as a client reads them (planning/audit.md → Reading): each changed field's
+* Audit entries as a client reads them: each changed field's
 * `[before, after]` back from how it was stored to its kind's JSON form. A hidden field (a secret,
 * a hidden slot) is `"changed"`, and a file field shows its files' ids, never where they're kept.
 */
@@ -1277,7 +1277,7 @@ function fileWrites(upload, storages) {
 //#endregion
 //#region src/resources/write.ts
 /**
-* A resource's writes and trait actions (planning/resources.md), through the route's `db`, so the
+* A resource's writes and trait actions, through the route's `db`, so the
 * model's policy applies (404 / 403 / 401) and the resource can only narrow it:
 *
 *   POST   /api/<r>                 create: only `writable` fields; the resource's `filter` holds for
@@ -1290,7 +1290,7 @@ function fileWrites(upload, storages) {
 *                                   the resource and allowed `reorder`; 204
 *
 * A ref written must name a row the user may read (else a 400 on that field). A file field takes file
-* ids: the row's own files, or uploads pending for it (planning/uploads.md); once the write succeeds
+* ids: the row's own files, or uploads pending for it; once the write succeeds
 * they're attached, and the files it dropped (a delete drops them all) are removed from storage.
 * Creates and updates answer with the row in the resource's shape, read back through it.
 */
@@ -1483,7 +1483,7 @@ async function reorder(resource, context) {
 //#endregion
 //#region src/resources/mount.ts
 /**
-* Mounting resources (planning/resources.md → Generated): each resource an app module exports is
+* Mounting resources: each resource an app module exports is
 * mounted at `/api/<export name in kebab-case>`, one route per action:
 *
 *   read      GET    /api/products · GET /api/products/:key      (a singleton: GET /api/store)
@@ -1574,7 +1574,7 @@ const engine = (resource, action, context, files) => {
 //#endregion
 //#region src/audit/routes.ts
 /**
-* The whole log (planning/audit.md → Reading), a built-in route:
+* The whole log, a built-in route:
 *
 *   GET /api/audit?model=Variant&user=01H…&createdAt__gte=2026-10-21   newest first   audit.read
 *
@@ -1840,7 +1840,7 @@ async function verify(token, purpose, secret, now) {
 //#endregion
 //#region src/auth/google.ts
 /**
-* Sign-in with Google (planning/auth.md → Sign-in with Google). Google redirects only to URIs
+* Sign-in with Google. Google redirects only to URIs
 * registered in advance, so with tenancy the redirect flow goes through one callback on the
 * platform's host and hands the sign-in back to the tenant's host; without, the callback is on the
 * app's own host and there's no hand-off.
@@ -2040,7 +2040,7 @@ function googleHost(options) {
 //#endregion
 //#region src/auth/people.ts
 /**
-* People and invites (planning/auth.md → Endpoints), built-in routes under `/api/auth/`:
+* People and invites, built-in routes under `/api/auth/`:
 *
 *   GET    /api/auth/users                      the people with accounts, with their roles    manageUsers
 *   POST   /api/auth/users/:id/roles  { role }  gives a role                                  manageUsers
@@ -2276,7 +2276,7 @@ async function invite(db, models, input) {
 //#endregion
 //#region src/auth/routes.ts
 /**
-* The auth module's built-in routes (planning/auth.md → Endpoints), under `/api/auth/`, the same in
+* The auth module's built-in routes, under `/api/auth/`, the same in
 * every app:
 *
 *   GET  /api/auth/me                   the user, their roles and permission keys (for the UI), or 401
@@ -2313,7 +2313,7 @@ function authRoutes(models, sessions, db, allKeys) {
 //#endregion
 //#region src/files/targets.ts
 /**
-* Upload targets (planning/uploads.md → Uploading): where a file may be uploaded to, named by the
+* Upload targets: where a file may be uploaded to, named by the
 * resource or route that will take it and its field, both in kebab-case. The target says who may
 * upload and which limits apply, so there's no upload config:
 *
@@ -2369,7 +2369,7 @@ function uploadTargets(modules, resources) {
 //#endregion
 //#region src/files/sniff.ts
 /**
-* What a file is, from its first bytes (planning/uploads.md): its media type, never the one the
+* What a file is, from its first bytes: its media type, never the one the
 * client declares, and an image's width and height. A file whose bytes say nothing (text, an
 * Office file inside a zip) is told apart by its name's extension.
 */
@@ -2532,7 +2532,7 @@ async function headOf(stream, bytes) {
 //#endregion
 //#region src/files/uploads.ts
 /**
-* Uploading (planning/uploads.md → Uploading): `POST /api/uploads/<target>/<field>` takes one file
+* Uploading: `POST /api/uploads/<target>/<field>` takes one file
 * as the raw body, with its name in `X-File-Name` (URI-encoded) and its size in `Content-Length`.
 *
 *   1. the target: who may upload, and the field's kind (storage, types, size)
@@ -2622,7 +2622,7 @@ function nameOf(header) {
 //#endregion
 //#region src/files/links.ts
 /**
-* Where a client reads a file (planning/uploads.md → Reading): a public storage's file at its bucket's
+* Where a client reads a file: a public storage's file at its bucket's
 * URL; a private storage's through a signed link the app serves, `/api/files/<id>?t=<signed>`.
 *
 * The link is made while writing a row the user may read, so making it is the access check. It
@@ -2760,8 +2760,25 @@ function asBytes(body) {
 //#endregion
 //#region src/files/index.ts
 /**
-* The files module (planning/uploads.md): uploads into the app's storages, file ids in writes, and
-* each file's `url` on the way out.
+* The files module: uploads into the app's storages, file ids in writes, and each file's `url` on
+* the way out.
+*
+*   storage: { default: r2(env.MEDIA, { publicUrl: env.MEDIA_URL }), private: r2(env.FILES) }   // app.ts
+*   images: f.images()                          // a model field: the kind owns count, size and type
+*   files: f.files({ storage: "private" })      // a storage other than `default`
+*
+*   POST /api/uploads/manage-products/images    raw bytes → 201 { id: "fil_…", url, … }  (pending)
+*   PATCH /api/manage-products/:key { images: ["fil_…", …] }   attaches them, in that order
+*
+* Upload first, then reference by id: a form uploads each file while it's being filled, and Save is
+* a small JSON write. Uploads go through the app, not straight to the bucket: it checks the target,
+* the type (from the bytes) and the size before anything lands, with no S3 credentials beside the
+* binding and no CORS on the bucket; a presigned upload only pays past the Workers body limit.
+*
+* Visibility belongs to the storage (a `publicUrl` or not), never a flag that could disagree with
+* the bucket. Keys are the framework's (`<tenant>/<fileId>`, or `<fileId>` without tenancy); app
+* code never builds a key, path or URL. A stored value keeps its storage and key, so old files keep
+* working if a field's storage changes.
 */
 /**
 * Checks that every file field (a model's or a route input's) stores in a storage `app.ts` has, and
@@ -2838,7 +2855,7 @@ function files(options) {
 //#endregion
 //#region src/tenancy/front-door.ts
 /**
-* The front door's tenant step (planning/tenancy.md → The front door): the host decides. The
+* The front door's tenant step: the host decides. The
 * platform's host is the platform's; any other is a `Domain` row, behind which is a `Tenant`. A
 * suspended tenant answers 503; an active one gets the whole request, where it lives.
 */
@@ -2892,7 +2909,7 @@ async function releaseOf(manifest) {
 //#endregion
 //#region src/tenancy/services.ts
 /**
-* The app's services by reference (planning/tenancy.md → Creating tenants): what crosses into a
+* The app's services by reference: what crosses into a
 * tenant is a service's place among `createApp`'s `services` modules and its export name, never
 * the function. The Worker and every tenant's object load the same bundle, so a reference names
 * the same function on both sides.
@@ -3155,7 +3172,7 @@ function createCore(config, env, options = {}) {
 		},
 		platform: { get db() {
 			if (!platform) throw new TypeError("isai: app.platform.db is the platform's database, which only an app with isolated tenancy has");
-			if (scope.current()) throw new TypeError("isai: app.platform.db isn't reachable inside a tenant; a tenant's own row is ctx.tenant (planning/tenancy.md)");
+			if (scope.current()) throw new TypeError("isai: app.platform.db isn't reachable inside a tenant; a tenant's own row is ctx.tenant");
 			return platform;
 		} },
 		files: appFiles({

package/dist/{issues-Bxq4JExX.d.ts → issues-CKto95IW.d.ts}

@@ -1,6 +1,8 @@
 //#region src/validation/issues.d.ts
 /** What a failed validation reports: one issue per problem, each at a path into the value. */
-type IssueCode = "required" | "type" | "format" | "tooShort" | "tooLong" | "tooSmall" | "tooLarge" | "notInteger" | "notAllowed" | "unknown" | "fixed";
+type IssueCode = "required" | "type" | "format" | "tooShort" | "tooLong" | "tooSmall" | "tooLarge" | "notInteger" | "notAllowed" | "unknown" | "fixed" |
+/** Another row already has this value (a unique, or a slug made from this field). */
+"taken";
 /** Where in the value: field names and list indexes (`["members", 2, "email"]`). */
 type Path = readonly (string | number)[];
 interface Issue {

package/dist/{make-DKzPd2b_.js → make-WQpkYW8N.js}

@@ -1,4 +1,4 @@
-import { F as systemClock, f as dayOf, h as snapshotOf, p as generateMigration, y as MigrationError } from "./migrator-C65RM_K-.js";
+import { F as systemClock, f as dayOf, h as snapshotOf, p as generateMigration, y as MigrationError } from "./migrator-6oWUefLA.js";
 //#region src/db/migrations/cleanup.ts
 /** Dropped tables, those that refer to others first, so no row is left pointing at a dropped one. */
 function dropOrder(tables) {
@@ -76,7 +76,22 @@ function cleanupMigration(options) {
 *
 * Generating never reads the live database. Where existing rows may clash with a change, it
 * writes the data step that resolves them, from an answer or with a `TODO` that fails the deploy
-* until it's filled in (planning/migrations.md → Generating).
+* until it's filled in.
+*
+*   add a model or a field          CREATE TABLE / ADD COLUMN (nullable in SQL); a fill data step
+*                                   for existing rows (the default, or a value asked)
+*   add a count, copy or sequence   ADD COLUMN, its triggers, a fill computed from it
+*   remove a field or a model       nothing dropped: retired until `isai cleanup` (its indexes,
+*                                   counts and copies stay; a required one is filled in new rows)
+*   rename                          nothing: `.column("old_name")` / `.table("old")`, asked about
+*   loosen a one-field rule         nothing: code only
+*   tighten one, or add a check     a check data step: passes when no row breaks it, else a `fix`
+*   add a unique                    a resolution step before the index (duplicates as chosen)
+*   remove a unique                 retired until cleanup (an earlier release may rely on it)
+*
+* Refused, each with the safe sequence: an incompatible kind change (or toggling `secret`), a field
+* becoming or ceasing to be kept by the database, a new required unique field over existing rows,
+* a rebuild (a ref's `onDelete`, an FK on an existing column), reusing a retired name.
 */
 const pad = (n) => String(n).padStart(4, "0");
 const json = (value) => JSON.stringify(value);