@isaijs/core 0.1.0 → 0.1.3

package/dist/index.js

@@ -1,14 +1,14 @@
-import { B as toKind, R as object, V as validate, W as ValidationError, a as fileTypeNames, f as email, m as line } from "./validation-l5JG-PFn.js";
-import { B as modelOfRow, C as database, D as planInsert, E as recordAction, F as systemClock, G as UniqueFailed, L as NeedsDatabase, O as planUpdate, R as evaluate, S as clockOf, U as NotFound, j as conditionOf, k as keyCondition, r as sync, t as migrate, w as decodeStored } from "./migrator-C65RM_K-.js";
-import { C as tooLarge, E as fail, S as tenantSuspended, T as Rejected, _ as json, b as routeNotFound, c as fromBody, d as route, f as HttpError, g as fileTypeRefused, h as fileTooLarge, l as readInput, m as errorResponse, o as parseListQuery, p as crossSiteRequest, r as resource, s as BODY_LIMIT, t as Resource, u as Route, v as lengthRequired, w as tooManyRequests, x as signInRequired, y as methodNotAllowed } from "./resource-9fjxJgmz.js";
-import { F as sensitivity, G as ulid, K as Scope, V as asActor, a as columnName, b as asCondition$1, c as fieldOf, f as Condition, m as Expr, n as toBase64url, r as Model, t as fromBase64url, u as rowOf } from "./base64url-DwWPqoOT.js";
+import { G as ValidationError, H as validate, V as toKind, h as line, o as fileTypeNames, p as email, z as object } from "./validation-Cppmd0RV.js";
+import { B as NeedsDatabase, C as database, D as planInsert, E as recordAction, F as systemClock, J as UniqueFailed, K as NotFound, L as PLATFORM, O as planUpdate, R as TENANT, S as clockOf, U as modelOfRow, V as evaluate, j as conditionOf, k as keyCondition, r as sync, t as migrate, w as decodeStored, z as checkTenancy } from "./migrator-BU3_PHk8.js";
+import { C as tooLarge, E as fail, S as tenantSuspended, T as Rejected, _ as json, b as routeNotFound, c as fromBody, d as route, f as HttpError, g as fileTypeRefused, h as fileTooLarge, l as readInput, m as errorResponse, o as parseListQuery, p as crossSiteRequest, r as resource, s as BODY_LIMIT, t as Resource, u as Route, v as lengthRequired, w as tooManyRequests, x as signInRequired, y as methodNotAllowed } from "./resource-CsYksjKc.js";
+import { F as sensitivity, G as ulid, K as Scope, V as asActor, a as columnName, b as asCondition$1, c as fieldOf, f as Condition, m as Expr, n as toBase64url, r as Model, t as fromBase64url, u as rowOf } from "./base64url-C5GTYIL5.js";
 import { t as kebabCase } from "./case-BnpcvhdW.js";
-import { t as PLATFORM_PREFIX } from "./tables-C3Uza4qK.js";
+import { t as PLATFORM_PREFIX } from "./tables-IrLjsomf.js";
 import { t as Seed } from "./seed-BObmdKdP.js";
 import { n as notImplemented, t as NotImplementedError } from "./errors-mCNLlXg9.js";
-import { d as afterUpdate, f as bindFor, h as ownerFieldOf, m as isFalse, p as check, u as FALSE } from "./policies-yVzFCjxU.js";
-import { i as checkRoles, n as authPerms, r as checkAuth } from "./create-auth-Byf1-VJw.js";
-import { C as syncRoles, S as seedAs, _ as cookieOf, a as authModels, b as permissionsOf, c as hashOf, d as GoogleError, f as consentUrl, g as cookie, h as verifyIdToken, i as makers, l as sessions, n as TENANT, p as exchangeCode, r as checkTenancy, s as clearedCookie, t as PLATFORM, v as redirect, x as roleKeys, y as safeReturn } from "./config-D6PexpSC.js";
+import { d as afterUpdate, f as bindFor, h as ownerFieldOf, m as isFalse, p as check, u as FALSE } from "./policies-CKIdBFKt.js";
+import { i as checkRoles, n as authPerms, r as checkAuth } from "./create-auth-Ci0PaBoX.js";
+import { _ as permissionsOf, a as hashOf, b as syncRoles, c as GoogleError, f as verifyIdToken, g as safeReturn, h as redirect, i as clearedCookie, l as consentUrl, m as cookieOf, n as authModels, o as sessions, p as cookie, t as makers, u as exchangeCode, v as roleKeys, y as seedAs } from "./makers-DeSNM0Nd.js";
 import { t as WrongSize } from "./storage-body-7dWyMszh.js";
 import { RegExpRouter } from "hono/router/reg-exp-router";
 import { SmartRouter } from "hono/router/smart-router";
@@ -61,10 +61,10 @@ var Router = class {
 //#endregion
 //#region src/api/output.ts
 /**
-* What a handler returns, as JSON (planning/requests.md → Output). Rows the ORM returned are found
+* What a handler returns, as JSON. Rows the ORM returned are found
 * anywhere in the value by their tag: each field goes out in its kind's JSON form, and hidden
 * fields (`password`, `secret`, hidden slots) never leave. A file field's files go out as a client
-* sees them, with a `url` and without where they're kept (planning/uploads.md → Reading).
+* sees them, with a `url` and without where they're kept.
 */
 /** The value as JSON, each file with its URL. */
 async function toJSON(value, urlOf) {
@@ -109,20 +109,39 @@ function rowJSON(row, model, files) {
 	}
 	return out;
 }
-/** A file as a client sees it: its id, its `url`, then what's shown of it; never its storage or key. */
+/**
+* A file as a client sees it: its id, its `url`, then what's shown of it, and an image's `sizes`
+* (each `{ width, height, url }`, widest first); never its storage or keys.
+*/
 function fileJSON(file, files) {
-	const { id, storage: _storage, key: _key, ...shown } = file;
+	const { id, storage: _storage, key: _key, sizes, ...shown } = file;
 	const out = {
 		id,
 		...files ? { url: null } : {},
 		...shown
 	};
-	if (!files) return out;
-	const url = files.urlOf(file);
-	if (typeof url === "string") out.url = url;
-	else files.pending.push(url.then((made) => {
-		out.url = made;
-	}));
+	const linked = (into, of) => {
+		if (!files) return;
+		const url = files.urlOf(of);
+		if (typeof url === "string") into.url = url;
+		else files.pending.push(url.then((made) => {
+			into.url = made;
+		}));
+	};
+	linked(out, file);
+	if (sizes?.length) out.sizes = sizes.map(({ key, type, width, height }) => {
+		const one = {
+			width,
+			height,
+			...files ? { url: null } : {}
+		};
+		linked(one, {
+			...file,
+			key,
+			type
+		});
+		return one;
+	});
 	return out;
 }
 //#endregion
@@ -354,7 +373,7 @@ function secure(response, url) {
 //#endregion
 //#region src/auth/boundary.ts
 /**
-* The route context's `db` (planning/policies.md → Enforcement): the same queries as `app.db`,
+* The route context's `db`: the same queries as `app.db`,
 * but each one ends in `.allowed(action)` (the model's policy applies) or `.unchecked()` (it
 * doesn't, visibly). Until then it can't be awaited: a type error, and a rejection at runtime.
 *
@@ -976,7 +995,7 @@ function rescope(node, scope) {
 //#endregion
 //#region src/resources/custom.ts
 /**
-* A resource's custom actions (planning/resources.md, planning/requests.md → Custom actions):
+* A resource's custom actions:
 * `POST /api/<r>/:key/<action>` (a singleton's: `/api/<r>/<action>`) runs the app's service on one
 * row:
 *
@@ -989,7 +1008,7 @@ function rescope(node, scope) {
 * and the action's own rule must hold on it (else 403, or 401 anonymous). Then the service runs:
 * trusted, with `app.db`, given the row and `{ input, user, tenant }`. What it returns is the
 * response, as a route's is (`undefined` → 204). With the audit log on, the action is an entry on
-* the row (planning/audit.md).
+* the row.
 */
 async function runCustom(resource, action, context) {
 	const declared = resource.custom[action];
@@ -1047,7 +1066,7 @@ async function assertHeld(resource, context, rowId, action) {
 //#endregion
 //#region src/audit/entries.ts
 /**
-* Audit entries as a client reads them (planning/audit.md → Reading): each changed field's
+* Audit entries as a client reads them: each changed field's
 * `[before, after]` back from how it was stored to its kind's JSON form. A hidden field (a secret,
 * a hidden slot) is `"changed"`, and a file field shows its files' ids, never where they're kept.
 */
@@ -1179,6 +1198,8 @@ function filesOf(model, row) {
 	if (!row) return [];
 	return Object.entries(model.spec.fields).flatMap(([field, spec]) => spec.kind.spec.file ? listOf(row[field]) : []);
 }
+/** Every key a file is stored at: its own, and its sizes'. */
+const keysOf = (file) => [file.key, ...(file.sizes ?? []).map((one) => one.key)];
 /** The files a write dropped: held before, held no longer. */
 function droppedFiles(before, after) {
 	const kept = new Set(after.map((file) => file.id));
@@ -1264,20 +1285,20 @@ function fileWrites(upload, storages) {
 		},
 		settle: async (db, uploads, dropped = []) => {
 			if (uploads.length > 0) await db.deleteMany(upload).where((u) => u.fileId.in(uploads));
-			await Promise.all(dropped.map(async (file) => {
+			await Promise.all(dropped.flatMap((file) => keysOf(file).map(async (key) => {
 				try {
-					await storages[file.storage]?.delete(file.key);
+					await storages[file.storage]?.delete(key);
 				} catch (error) {
-					console.error(`isai: couldn't remove ${file.key} from storage "${file.storage}"`, error);
+					console.error(`isai: couldn't remove ${key} from storage "${file.storage}"`, error);
 				}
-			}));
+			})));
 		}
 	};
 }
 //#endregion
 //#region src/resources/write.ts
 /**
-* A resource's writes and trait actions (planning/resources.md), through the route's `db`, so the
+* A resource's writes and trait actions, through the route's `db`, so the
 * model's policy applies (404 / 403 / 401) and the resource can only narrow it:
 *
 *   POST   /api/<r>                 create: only `writable` fields; the resource's `filter` holds for
@@ -1290,7 +1311,7 @@ function fileWrites(upload, storages) {
 *                                   the resource and allowed `reorder`; 204
 *
 * A ref written must name a row the user may read (else a 400 on that field). A file field takes file
-* ids: the row's own files, or uploads pending for it (planning/uploads.md); once the write succeeds
+* ids: the row's own files, or uploads pending for it; once the write succeeds
 * they're attached, and the files it dropped (a delete drops them all) are removed from storage.
 * Creates and updates answer with the row in the resource's shape, read back through it.
 */
@@ -1483,7 +1504,7 @@ async function reorder(resource, context) {
 //#endregion
 //#region src/resources/mount.ts
 /**
-* Mounting resources (planning/resources.md → Generated): each resource an app module exports is
+* Mounting resources: each resource an app module exports is
 * mounted at `/api/<export name in kebab-case>`, one route per action:
 *
 *   read      GET    /api/products · GET /api/products/:key      (a singleton: GET /api/store)
@@ -1574,7 +1595,7 @@ const engine = (resource, action, context, files) => {
 //#endregion
 //#region src/audit/routes.ts
 /**
-* The whole log (planning/audit.md → Reading), a built-in route:
+* The whole log, a built-in route:
 *
 *   GET /api/audit?model=Variant&user=01H…&createdAt__gte=2026-10-21   newest first   audit.read
 *
@@ -1840,7 +1861,7 @@ async function verify(token, purpose, secret, now) {
 //#endregion
 //#region src/auth/google.ts
 /**
-* Sign-in with Google (planning/auth.md → Sign-in with Google). Google redirects only to URIs
+* Sign-in with Google. Google redirects only to URIs
 * registered in advance, so with tenancy the redirect flow goes through one callback on the
 * platform's host and hands the sign-in back to the tenant's host; without, the callback is on the
 * app's own host and there's no hand-off.
@@ -2040,7 +2061,7 @@ function googleHost(options) {
 //#endregion
 //#region src/auth/people.ts
 /**
-* People and invites (planning/auth.md → Endpoints), built-in routes under `/api/auth/`:
+* People and invites, built-in routes under `/api/auth/`:
 *
 *   GET    /api/auth/users                      the people with accounts, with their roles    manageUsers
 *   POST   /api/auth/users/:id/roles  { role }  gives a role                                  manageUsers
@@ -2276,7 +2297,7 @@ async function invite(db, models, input) {
 //#endregion
 //#region src/auth/routes.ts
 /**
-* The auth module's built-in routes (planning/auth.md → Endpoints), under `/api/auth/`, the same in
+* The auth module's built-in routes, under `/api/auth/`, the same in
 * every app:
 *
 *   GET  /api/auth/me                   the user, their roles and permission keys (for the UI), or 401
@@ -2313,7 +2334,7 @@ function authRoutes(models, sessions, db, allKeys) {
 //#endregion
 //#region src/files/targets.ts
 /**
-* Upload targets (planning/uploads.md → Uploading): where a file may be uploaded to, named by the
+* Upload targets: where a file may be uploaded to, named by the
 * resource or route that will take it and its field, both in kebab-case. The target says who may
 * upload and which limits apply, so there's no upload config:
 *
@@ -2369,7 +2390,7 @@ function uploadTargets(modules, resources) {
 //#endregion
 //#region src/files/sniff.ts
 /**
-* What a file is, from its first bytes (planning/uploads.md): its media type, never the one the
+* What a file is, from its first bytes: its media type, never the one the
 * client declares, and an image's width and height. A file whose bytes say nothing (text, an
 * Office file inside a zip) is told apart by its name's extension.
 */
@@ -2532,7 +2553,7 @@ async function headOf(stream, bytes) {
 //#endregion
 //#region src/files/uploads.ts
 /**
-* Uploading (planning/uploads.md → Uploading): `POST /api/uploads/<target>/<field>` takes one file
+* Uploading: `POST /api/uploads/<target>/<field>` takes one file
 * as the raw body, with its name in `X-File-Name` (URI-encoded) and its size in `Content-Length`.
 *
 *   1. the target: who may upload, and the field's kind (storage, types, size)
@@ -2542,6 +2563,11 @@ async function headOf(stream, bytes) {
 *   5. an `Upload` row: pending until a write names the file's id, for a day
 *
 * It answers 201 with the file as a client sees it, its `url` included.
+*
+* An image's smaller copy (the client makes them: `srcset` picks one) is sent the same way, with
+* `X-Size-Of: <the image's id>`. It's kept with that image while its upload is still pending, from
+* the same user to the same field, and must be smaller than it: the answer is the image, its
+* `sizes` included. A write then names only the image.
 */
 /** How long an upload waits to be attached. */
 const UPLOAD_TTL_MS = 864e5;
@@ -2579,17 +2605,50 @@ function uploadRoute(options) {
 			await body.cancel().catch(() => {});
 			throw fileTypeRefused(fileTypeNames(spec.types));
 		}
+		const db = accessOf(context.db).trusted;
+		const user = context.user;
+		const put = async (key) => {
+			try {
+				await storage.put(key, body, {
+					size,
+					contentType: sniffed.type
+				});
+			} catch (error) {
+				if (error instanceof WrongSize) throw new HttpError(400, "WrongSize", "The file's bytes don't match its Content-Length");
+				throw error;
+			}
+		};
+		const sizeOf = request.headers.get("X-Size-Of");
+		if (sizeOf !== null) {
+			const pending = await db.findOne(options.upload, { fileId: sizeOf });
+			const image = pending?.file;
+			const refused = (code, message) => {
+				body.cancel().catch(() => {});
+				return new HttpError(400, code, message);
+			};
+			if (!pending || !image || pending.target !== name || (pending.user ?? void 0) !== user?.id || pending.expiresAt.getTime() <= clockOf(db).now().getTime()) throw refused("SizeOfUnknown", "X-Size-Of must name an image uploaded here, before it's attached");
+			const { width, height } = sniffed;
+			const sizes = image.sizes ?? [];
+			if (!width || !height || !image.width || !image.height || width >= image.width || height > image.height) throw refused("NotSmaller", "A size must be an image smaller than the one it's of");
+			if (sizes.length >= 4 || sizes.some((one) => one.width === width)) throw refused("TooManySizes", `An image keeps at most 4 sizes, each of its own width`);
+			const key = `${image.key}.${width}`;
+			await put(key);
+			const file = {
+				...image,
+				sizes: [...sizes, {
+					key,
+					size,
+					type: sniffed.type,
+					width,
+					height
+				}].sort((a, b) => b.width - a.width)
+			};
+			await db.updateOne(options.upload, { fileId: sizeOf }, { file });
+			return json(201, await options.answer(file, new URL(request.url).origin));
+		}
 		const id = newFileId();
 		const key = keyOf(id, context.tenant);
-		try {
-			await storage.put(key, body, {
-				size,
-				contentType: sniffed.type
-			});
-		} catch (error) {
-			if (error instanceof WrongSize) throw new HttpError(400, "WrongSize", "The file's bytes don't match its Content-Length");
-			throw error;
-		}
+		await put(key);
 		const file = {
 			id,
 			storage: spec.storage,
@@ -2598,8 +2657,6 @@ function uploadRoute(options) {
 			size,
 			...sniffed
 		};
-		const db = accessOf(context.db).trusted;
-		const user = context.user;
 		await db.createOne(options.upload, {
 			fileId: id,
 			file,
@@ -2622,7 +2679,7 @@ function nameOf(header) {
 //#endregion
 //#region src/files/links.ts
 /**
-* Where a client reads a file (planning/uploads.md → Reading): a public storage's file at its bucket's
+* Where a client reads a file: a public storage's file at its bucket's
 * URL; a private storage's through a signed link the app serves, `/api/files/<id>?t=<signed>`.
 *
 * The link is made while writing a row the user may read, so making it is the access check. It
@@ -2720,7 +2777,7 @@ function appFiles(options) {
 		return storage;
 	};
 	return {
-		put: async (body, { name, storage = "default", size: given }) => {
+		put: async (body, { name, storage = "default", size: given, sizes: copies = [] }) => {
 			const where = storageOf(storage);
 			const bytes = body instanceof ReadableStream ? void 0 : asBytes(body);
 			const size = bytes?.byteLength ?? given;
@@ -2740,18 +2797,40 @@ function appFiles(options) {
 				size,
 				contentType: sniffed.type
 			});
+			const sizes = [];
+			for (const copy of copies) {
+				const bytes = new Uint8Array(copy);
+				const one = sniff(bytes.subarray(0, SNIFF_BYTES), name);
+				if (!one?.width || !one.height || !sniffed.width || !sniffed.height || one.width >= sniffed.width || one.height > sniffed.height) throw new TypeError(`isai: a size of ${name} must be an image smaller than it`);
+				const at = `${key}.${one.width}`;
+				await where.put(at, bytes, {
+					size: bytes.byteLength,
+					contentType: one.type
+				});
+				sizes.push({
+					key: at,
+					size: bytes.byteLength,
+					type: one.type,
+					width: one.width,
+					height: one.height
+				});
+			}
+			sizes.sort((a, b) => b.width - a.width);
 			return {
 				id,
 				storage,
 				key,
 				name,
 				size,
-				...sniffed
+				...sniffed,
+				...sizes.length ? { sizes } : {}
 			};
 		},
 		get: async (file) => (await storageOf(file.storage).get(file.key))?.body,
 		url: async (file, { origin = "" } = {}) => url(file, origin),
-		delete: (file) => storageOf(file.storage).delete(file.key)
+		delete: async (file) => {
+			await Promise.all(keysOf(file).map((key) => storageOf(file.storage).delete(key)));
+		}
 	};
 }
 function asBytes(body) {
@@ -2760,8 +2839,25 @@ function asBytes(body) {
 //#endregion
 //#region src/files/index.ts
 /**
-* The files module (planning/uploads.md): uploads into the app's storages, file ids in writes, and
-* each file's `url` on the way out.
+* The files module: uploads into the app's storages, file ids in writes, and each file's `url` on
+* the way out.
+*
+*   storage: { default: r2(env.MEDIA, { publicUrl: env.MEDIA_URL }), private: r2(env.FILES) }   // app.ts
+*   images: f.images()                          // a model field: the kind owns count, size and type
+*   files: f.files({ storage: "private" })      // a storage other than `default`
+*
+*   POST /api/uploads/manage-products/images    raw bytes → 201 { id: "fil_…", url, … }  (pending)
+*   PATCH /api/manage-products/:key { images: ["fil_…", …] }   attaches them, in that order
+*
+* Upload first, then reference by id: a form uploads each file while it's being filled, and Save is
+* a small JSON write. Uploads go through the app, not straight to the bucket: it checks the target,
+* the type (from the bytes) and the size before anything lands, with no S3 credentials beside the
+* binding and no CORS on the bucket; a presigned upload only pays past the Workers body limit.
+*
+* Visibility belongs to the storage (a `publicUrl` or not), never a flag that could disagree with
+* the bucket. Keys are the framework's (`<tenant>/<fileId>`, or `<fileId>` without tenancy); app
+* code never builds a key, path or URL. A stored value keeps its storage and key, so old files keep
+* working if a field's storage changes.
 */
 /**
 * Checks that every file field (a model's or a route input's) stores in a storage `app.ts` has, and
@@ -2838,7 +2934,7 @@ function files(options) {
 //#endregion
 //#region src/tenancy/front-door.ts
 /**
-* The front door's tenant step (planning/tenancy.md → The front door): the host decides. The
+* The front door's tenant step: the host decides. The
 * platform's host is the platform's; any other is a `Domain` row, behind which is a `Tenant`. A
 * suspended tenant answers 503; an active one gets the whole request, where it lives.
 */
@@ -2892,7 +2988,7 @@ async function releaseOf(manifest) {
 //#endregion
 //#region src/tenancy/services.ts
 /**
-* The app's services by reference (planning/tenancy.md → Creating tenants): what crosses into a
+* The app's services by reference: what crosses into a
 * tenant is a service's place among `createApp`'s `services` modules and its export name, never
 * the function. The Worker and every tenant's object load the same bundle, so a reference names
 * the same function on both sides.
@@ -3155,7 +3251,7 @@ function createCore(config, env, options = {}) {
 		},
 		platform: { get db() {
 			if (!platform) throw new TypeError("isai: app.platform.db is the platform's database, which only an app with isolated tenancy has");
-			if (scope.current()) throw new TypeError("isai: app.platform.db isn't reachable inside a tenant; a tenant's own row is ctx.tenant (planning/tenancy.md)");
+			if (scope.current()) throw new TypeError("isai: app.platform.db isn't reachable inside a tenant; a tenant's own row is ctx.tenant");
 			return platform;
 		} },
 		files: appFiles({

package/dist/{issues-Bxq4JExX.d.ts → issues-CKto95IW.d.ts}

@@ -1,6 +1,8 @@
 //#region src/validation/issues.d.ts
 /** What a failed validation reports: one issue per problem, each at a path into the value. */
-type IssueCode = "required" | "type" | "format" | "tooShort" | "tooLong" | "tooSmall" | "tooLarge" | "notInteger" | "notAllowed" | "unknown" | "fixed";
+type IssueCode = "required" | "type" | "format" | "tooShort" | "tooLong" | "tooSmall" | "tooLarge" | "notInteger" | "notAllowed" | "unknown" | "fixed" |
+/** Another row already has this value (a unique, or a slug made from this field). */
+"taken";
 /** Where in the value: field names and list indexes (`["members", 2, "email"]`). */
 type Path = readonly (string | number)[];
 interface Issue {

package/dist/{make-DKzPd2b_.js → make-DKBn79cH.js}

@@ -1,4 +1,4 @@
-import { F as systemClock, f as dayOf, h as snapshotOf, p as generateMigration, y as MigrationError } from "./migrator-C65RM_K-.js";
+import { F as systemClock, f as dayOf, h as snapshotOf, p as generateMigration, y as MigrationError } from "./migrator-BU3_PHk8.js";
 //#region src/db/migrations/cleanup.ts
 /** Dropped tables, those that refer to others first, so no row is left pointing at a dropped one. */
 function dropOrder(tables) {
@@ -76,7 +76,22 @@ function cleanupMigration(options) {
 *
 * Generating never reads the live database. Where existing rows may clash with a change, it
 * writes the data step that resolves them, from an answer or with a `TODO` that fails the deploy
-* until it's filled in (planning/migrations.md → Generating).
+* until it's filled in.
+*
+*   add a model or a field          CREATE TABLE / ADD COLUMN (nullable in SQL); a fill data step
+*                                   for existing rows (the default, or a value asked)
+*   add a count, copy or sequence   ADD COLUMN, its triggers, a fill computed from it
+*   remove a field or a model       nothing dropped: retired until `isai cleanup` (its indexes,
+*                                   counts and copies stay; a required one is filled in new rows)
+*   rename                          nothing: `.column("old_name")` / `.table("old")`, asked about
+*   loosen a one-field rule         nothing: code only
+*   tighten one, or add a check     a check data step: passes when no row breaks it, else a `fix`
+*   add a unique                    a resolution step before the index (duplicates as chosen)
+*   remove a unique                 retired until cleanup (an earlier release may rely on it)
+*
+* Refused, each with the safe sequence: an incompatible kind change (or toggling `secret`), a field
+* becoming or ceasing to be kept by the database, a new required unique field over existing rows,
+* a rebuild (a ref's `onDelete`, an FK on an existing column), reusing a retired name.
 */
 const pad = (n) => String(n).padStart(4, "0");
 const json = (value) => JSON.stringify(value);

package/dist/{config-D6PexpSC.js → makers-DeSNM0Nd.js}

@@ -1,6 +1,6 @@
-import { G as Fake, K as fakeValue } from "./validation-l5JG-PFn.js";
-import { D as planInsert, E as recordAction, S as clockOf, T as forUpkeep, V as CheckFailed } from "./migrator-C65RM_K-.js";
-import { j as IMPLICIT_FIELDS, n as toBase64url, r as Model, t as fromBase64url } from "./base64url-DwWPqoOT.js";
+import { K as Fake, q as fakeValue } from "./validation-Cppmd0RV.js";
+import { D as planInsert, E as recordAction, S as clockOf, T as forUpkeep, W as CheckFailed } from "./migrator-BU3_PHk8.js";
+import { j as IMPLICIT_FIELDS, n as toBase64url, r as Model, t as fromBase64url } from "./base64url-C5GTYIL5.js";
 //#region src/auth/roles.ts
 const same = (a, b) => a.length === b.length && a.every((value, i) => value === b[i]);
 /** What a role in `app.ts` is stored as. */
@@ -329,8 +329,15 @@ function authOf(models) {
 //#endregion
 //#region src/db/seeds/makers.ts
 /**
-* `make` and `many`: a row from the values given, the rest faked from each field's kind
-* (planning/data-layer.md → Seeds and fakes). Models carry no factory code.
+* `make` and `many`: a row from the values given, the rest faked from each field's kind. Models
+* carry no factory code; values that matter to a story go in the seed.
+*
+* For a field it isn't given, `make` writes its default if it has one; nothing for what the
+* framework or the database makes (id, timestamps, generated, maintained); a new parent for a
+* required ref; `null` for an optional field (refs too), so rows are minimal; else the kind's
+* fake, numbered for a unique field so fakes don't collide. A faked row failing a check is drawn
+* again a few times, then `make` fails naming the check. Writes go through `createOne`, so
+* validation, guards and the write stream all run.
 */
 /** Fake rows that fail a check are drawn again, this many times in all. */
 const ATTEMPTS = 20;
@@ -403,37 +410,4 @@ function failedCheck(model, input, now) {
 	}
 }
 //#endregion
-//#region src/tenancy/config.ts
-/**
-* The two database names that mean something, and only with tenancy: each tenant's own database,
-* and the platform's (planning/tenancy.md → Configuration). Every other name is just a name.
-*/
-const TENANT = "tenant";
-const PLATFORM = "platform";
-/** A host without a scheme, path or trailing dot; a port is allowed (local development). */
-const HOST = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)*(?::\d{1,5})?$/;
-/**
-* Checks the tenancy key against the databases, when the app starts. With tenancy the databases
-* are `tenant` (each tenant's) and `platform`; without it, the app has one database, named freely.
-*/
-function checkTenancy(tenancy, databases) {
-	const names = Object.keys(databases);
-	if (!tenancy) {
-		const reserved = names.find((name) => name === "tenant" || name === "platform");
-		if (reserved) throw new TypeError(`isai: databases.${reserved} is ${reserved === "tenant" ? "each tenant's database" : "the platform's database"}, which only an app with a \`tenancy\` key has; name the app's database something else (main)`);
-		if (names.length !== 1) throw new TypeError(`isai: an app without tenancy has one database (named as you like); it has ${names.length}${names.length > 1 ? `: ${names.join(", ")}. Several aren't supported yet` : ""}`);
-		if (Object.values(databases)[0]?.kind !== "database") throw new TypeError("isai: every tenant's own database (durableObject(env.TENANT)) needs a `tenancy` key");
-		return;
-	}
-	if (tenancy.mode !== "isolated") throw new TypeError(`isai: tenancy.mode "${String(tenancy.mode)}" isn't built yet; use "isolated"`);
-	if (tenancy.by !== "host") throw new TypeError(`isai: tenancy.by "${String(tenancy.by)}" isn't built yet; use "host"`);
-	if (typeof tenancy.platform !== "string" || !HOST.test(tenancy.platform.toLowerCase())) throw new TypeError(`isai: tenancy.platform must be a host, like app.example.com (no https:// or path); got "${String(tenancy.platform)}"`);
-	const model = tenancy.tenant;
-	if (model?.spec?.name !== "Tenant" || model.spec.builtin !== "tenancy") throw new TypeError("isai: tenancy.tenant is the Tenant model: builtins.Tenant, or its extension (import { Tenant } from \"#db/platform/tenants\")");
-	if (databases["tenant"]?.kind !== "tenantDatabases") throw new TypeError("isai: with isolated tenancy, databases.tenant is each tenant's database: durableObject(env.TENANT)");
-	if (databases["platform"]?.kind !== "database") throw new TypeError("isai: an app with tenancy needs databases.platform, where the Tenant and Domain tables live");
-	const other = names.find((name) => name !== "tenant" && name !== "platform");
-	if (other) throw new TypeError(`isai: with tenancy, the databases are tenant and platform; databases.${other} isn't supported yet`);
-}
-//#endregion
-export { syncRoles as C, seedAs as S, cookieOf as _, authModels as a, permissionsOf as b, hashOf as c, GoogleError as d, consentUrl as f, cookie as g, verifyIdToken as h, makers as i, sessions as l, forgetGoogleKeys as m, TENANT as n, authOf as o, exchangeCode as p, checkTenancy as r, clearedCookie as s, PLATFORM as t, GOOGLE as u, redirect as v, roleKeys as x, safeReturn as y };
+export { permissionsOf as _, hashOf as a, syncRoles as b, GoogleError as c, forgetGoogleKeys as d, verifyIdToken as f, safeReturn as g, redirect as h, clearedCookie as i, consentUrl as l, cookieOf as m, authModels as n, sessions as o, cookie as p, authOf as r, GOOGLE as s, makers as t, exchangeCode as u, roleKeys as v, seedAs as y };