@isaijs/core 0.1.0 → 0.1.3

package/dist/{migrator-C65RM_K-.js → migrator-BU3_PHk8.js}

@@ -1,5 +1,5 @@
-import { W as ValidationError, j as id } from "./validation-l5JG-PFn.js";
-import { A as unbound, B as aroundUpsert, E as fieldsOf, G as ulid, H as assertNotLog, I as actionEntry, L as aroundCreate, O as readsNow, R as aroundDelete, T as storageOf, W as wrap, a as columnName, c as fieldOf, f as Condition, h as Now, i as assertNotEncrypted, j as IMPLICIT_FIELDS, k as readsOtherRows, m as Expr, n as toBase64url, o as columnNode, t as fromBase64url$1, u as rowOf$1, x as conditionNode, z as aroundUpdate } from "./base64url-DwWPqoOT.js";
+import { G as ValidationError, M as id } from "./validation-Cppmd0RV.js";
+import { A as unbound, B as aroundUpsert, E as fieldsOf, G as ulid, H as assertNotLog, I as actionEntry, L as aroundCreate, O as readsNow, R as aroundDelete, T as storageOf, W as wrap, a as columnName, c as fieldOf, f as Condition, h as Now, i as assertNotEncrypted, j as IMPLICIT_FIELDS, k as readsOtherRows, m as Expr, n as toBase64url, o as columnNode, t as fromBase64url$1, u as rowOf$1, x as conditionNode, z as aroundUpdate } from "./base64url-C5GTYIL5.js";
 import { t as NotImplementedError } from "./errors-mCNLlXg9.js";
 //#region src/db/errors.ts
 var DatabaseError = class extends Error {
@@ -16,15 +16,32 @@ var CheckFailed = class extends DatabaseError {
 		this.check = check;
 	}
 };
-/** A unique field (or combination) already has this value. */
+/**
+* A unique field (or combination) already has this value. `fields` are the unique's own; `issues`
+* put one on each for a form, except that a field made from another (a slug from its title) puts
+* it on that one, the field a person typed.
+*/
 var UniqueFailed = class extends DatabaseError {
 	model;
 	fields;
 	name = "UniqueFailed";
+	issues;
 	constructor(model, fields, options) {
 		super(`${model}: ${fields.join(", ")} must be unique`, options);
 		this.model = model;
 		this.fields = fields;
+		this.issues = fields.map((field) => {
+			const source = options?.from?.[field];
+			return source === void 0 ? {
+				path: [field],
+				code: "taken",
+				message: "Already taken"
+			} : {
+				path: [source],
+				code: "taken",
+				message: "Already taken, or too like one that is"
+			};
+		});
 	}
 };
 /** A ref points at a row that doesn't exist, or a delete is restricted by rows that reference it. */
@@ -261,6 +278,39 @@ function evaluate(node, row, now, zone = utc) {
 	}
 }
 //#endregion
+//#region src/tenancy/config.ts
+/**
+* The two database names that mean something, and only with tenancy: each tenant's own database,
+* and the platform's. Every other name is just a name.
+*/
+const TENANT = "tenant";
+const PLATFORM = "platform";
+/** A host without a scheme, path or trailing dot; a port is allowed (local development). */
+const HOST = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)*(?::\d{1,5})?$/;
+/**
+* Checks the tenancy key against the databases, when the app starts. With tenancy the databases
+* are `tenant` (each tenant's) and `platform`; without it, the app has one database, named freely.
+*/
+function checkTenancy(tenancy, databases) {
+	const names = Object.keys(databases);
+	if (!tenancy) {
+		const reserved = names.find((name) => name === "tenant" || name === "platform");
+		if (reserved) throw new TypeError(`isai: databases.${reserved} is ${reserved === "tenant" ? "each tenant's database" : "the platform's database"}, which only an app with a \`tenancy\` key has; name the app's database something else (main)`);
+		if (names.length !== 1) throw new TypeError(`isai: an app without tenancy has one database (named as you like); it has ${names.length}${names.length > 1 ? `: ${names.join(", ")}. Several aren't supported yet` : ""}`);
+		if (Object.values(databases)[0]?.kind !== "database") throw new TypeError("isai: every tenant's own database (durableObject(env.TENANT)) needs a `tenancy` key");
+		return;
+	}
+	if (tenancy.mode !== "isolated") throw new TypeError(`isai: tenancy.mode "${String(tenancy.mode)}" isn't built yet; use "isolated"`);
+	if (tenancy.by !== "host") throw new TypeError(`isai: tenancy.by "${String(tenancy.by)}" isn't built yet; use "host"`);
+	if (typeof tenancy.platform !== "string" || !HOST.test(tenancy.platform.toLowerCase())) throw new TypeError(`isai: tenancy.platform must be a host, like app.example.com (no https:// or path); got "${String(tenancy.platform)}"`);
+	const model = tenancy.tenant;
+	if (model?.spec?.name !== "Tenant" || model.spec.builtin !== "tenancy") throw new TypeError("isai: tenancy.tenant is the Tenant model: builtins.Tenant, or its extension (import { Tenant } from \"#db/platform/tenants\")");
+	if (databases["tenant"]?.kind !== "tenantDatabases") throw new TypeError("isai: with isolated tenancy, databases.tenant is each tenant's database: durableObject(env.TENANT)");
+	if (databases["platform"]?.kind !== "database") throw new TypeError("isai: an app with tenancy needs databases.platform, where the Tenant and Domain tables live");
+	const other = names.find((name) => name !== "tenant" && name !== "platform");
+	if (other) throw new TypeError(`isai: with tenancy, the databases are tenant and platform; databases.${other} isn't supported yet`);
+}
+//#endregion
 //#region src/internal/secret-box.ts
 /**
 * Encrypted values for `secret` fields: AES-256-GCM through Web Crypto, on every runtime.
@@ -947,6 +997,20 @@ const audit = {
 * Migration operations and rules as SQLite DDL. Tables hold only what can't live elsewhere:
 * columns (nullable; "required" is a rule in code), the primary key and foreign keys. Uniques
 * are separate indexes and guards are triggers, so changing either never rebuilds a table.
+*
+* Where each rule runs (one-field rules in code, everything else in the database):
+*
+*   required, a kind's limits and format, choices    JS only, in the ORM's write path
+*   unique                                           a unique index (concurrent writes both see "free")
+*   ref                                              a foreign key, and an index
+*   a number's limits (≥ 0, a narrowed min / max)    a guard, on updates only: `stock - 2` is SQL's
+*   rules over counts and `.from()` copies           a guard: the database changes them
+*   a `.check()` over several columns                a guard: a partial update needs the stored values
+*
+* A guard is a trigger that raises (`RAISE(ABORT, 'isai:check:<model>.<rule>')`, parsed into the
+* same `CheckFailed` JS gives), because a D1 batch rolls back only on an error. One insert trigger
+* per table; update triggers are scoped to the columns their rules read (`BEFORE UPDATE OF …`).
+* Writers outside the ORM (raw SQL, the D1 console) skip the one-field rules; guards still apply.
 */
 const TYPES = {
 	text: "TEXT",
@@ -1293,7 +1357,15 @@ function translate(error, dialect, models) {
 		case "unique": {
 			const model = models.find((m) => m.table === violation.table);
 			const fields = model ? violation.columns.map((c) => fieldAt(model, c)) : violation.columns;
-			return new UniqueFailed(model?.name ?? violation.table, fields, { cause: error });
+			const from = {};
+			for (const field of fields) {
+				const source = model && fieldOf(model, field)?.generate?.from;
+				if (source) from[field] = source;
+			}
+			return new UniqueFailed(model?.name ?? violation.table, fields, {
+				cause: error,
+				from
+			});
 		}
 		case "reference": return new ReferenceFailed("A referenced row doesn't exist, or other rows still refer to this one", { cause: error });
 		default: return error;
@@ -1925,7 +1997,7 @@ var FindOne = class FindOne extends Maybe {
 * The write pipeline's first half, in JS, before any SQL: fill implicit and generated fields,
 * read every value through its kind (defaults, normalisation, one-field rules), then run the
 * checks the write can decide. Rules over values the database holds are guards, enforced in
-* SQL (planning/migrations.md).
+* SQL.
 */
 const MANAGED$1 = new Set(IMPLICIT_FIELDS);
 /** The one row of a `traits.singleton()` model has this id, so a second create fails as a duplicate. */
@@ -2198,9 +2270,29 @@ var DeleteMany = class DeleteMany extends Conditions {
 //#endregion
 //#region src/db/orm/database.ts
 /**
-* The database handle (`app.db` in services). Async everywhere, one API on every driver
-* (planning/orm.md → The API): `…One` by a key, `…Many` by a condition or a list.
-* Rows are plain data: no identity map, no change tracking.
+* The database handle (`app.db` in services). Async everywhere, one API on every driver:
+* `…One` by a key (one of the model's declared uniques: `{ id }`, `{ email }`, `{ event, user }`),
+* `…Many` by a condition (chained `.where()`, so policies, filters and client queries combine) or a
+* list. Rows are plain data: no identity map, no change tracking.
+*
+*   await db.findOne(Event, { id }).mustExist()                 // Row, or NotFound (a 404)
+*   await db.findMany(Event).where((e) => e.startsAt.after(now)).order("startsAt").limit(20)
+*   await db.updateOne(Variant, { id }, { stock: (v) => v.stock.minus(2) })   // an SQL expression
+*   await db.upsertOne(Registration, { event, user }, { create: { … }, update: { … } })
+*   await app.db.atomic((tx) => { const order = tx.createOne(Order, { … }); tx.createOne(Line, { order, … }) })
+*
+* - Absence isn't an error: `findOne`, `updateOne`, `deleteOne` give `undefined` unless
+*   `.mustExist()`. A refused write always throws its typed error.
+* - Conflicts belong to `upsert…`: `createOne` / `createMany` always fail on a duplicate.
+* - `updateMany` / `deleteMany` refuse to run without a `.where()` (every row is
+*   `.where(() => all())`), and take no order or limit (SQLite has no `UPDATE … LIMIT`).
+* - No `.select()`: a row is always the model's full row. Shaping output is a resource's job,
+*   hiding sensitive values the output layer's.
+* - `now` (and `now.plus("8d")`) is a value in writes, resolved once per write or `atomic`, from the
+*   framework's clock (which tests set), so every row in it gets the same instant.
+* - `atomic` is write-only on every driver: D1 can't run an interactive transaction, and a rule
+*   that depended on the driver would make app code depend on the target. Read before it; enforce
+*   rules with constraints (`quantity` ≥ 0), counters (`f.count`) or conditional writes.
 */
 function isRawValue(value) {
 	return value === null || typeof value === "string" || typeof value === "number" || value instanceof Uint8Array;
@@ -2484,7 +2576,7 @@ function forUpkeep(db) {
 	return db[UPKEEP]();
 }
 /**
-* An action on a row, in the audit log (`markPaid`, `signIn`; planning/audit.md): who took it, from
+* An action on a row, in the audit log (`markPaid`, `signIn`): who took it, from
 * the request, unless `user` says (a sign-in, before the request has a user). Nothing when the
 * model isn't recorded. Internal, like `forUpkeep`.
 */
@@ -3469,4 +3561,4 @@ async function migrateFresh(driver, models, options = {}) {
 	await sync(driver, manifest, options);
 }
 //#endregion
-export { Query as A, modelOfRow as B, database as C, planInsert as D, recordAction as E, systemClock as F, UniqueFailed as G, DatabaseError as H, newSecretKey as I, NeedsDatabase as L, dialectFor as M, sqlite as N, planUpdate as O, fixedClock as P, evaluate as R, clockOf as S, forUpkeep as T, NotFound as U, CheckFailed as V, ReferenceFailed as W, TODO as _, currentRelease as a, Database as b, rollback as c, applyRules as d, dayOf as f, UnsafeMigration as g, snapshotOf as h, acquireLock as i, conditionOf as j, keyCondition as k, setReleaseStatus as l, emptySnapshot as m, migrateFresh as n, holdOf as o, generateMigration as p, sync as r, releaseLock as s, migrate as t, startRelease as u, dataStep as v, decodeStored as w, Transaction as x, MigrationError as y, utc as z };
+export { Query as A, NeedsDatabase as B, database as C, planInsert as D, recordAction as E, systemClock as F, DatabaseError as G, utc as H, newSecretKey as I, UniqueFailed as J, NotFound as K, PLATFORM as L, dialectFor as M, sqlite as N, planUpdate as O, fixedClock as P, TENANT as R, clockOf as S, forUpkeep as T, modelOfRow as U, evaluate as V, CheckFailed as W, TODO as _, currentRelease as a, Database as b, rollback as c, applyRules as d, dayOf as f, UnsafeMigration as g, snapshotOf as h, acquireLock as i, conditionOf as j, keyCondition as k, setReleaseStatus as l, emptySnapshot as m, migrateFresh as n, holdOf as o, generateMigration as p, ReferenceFailed as q, sync as r, releaseLock as s, migrate as t, startRelease as u, dataStep as v, decodeStored as w, Transaction as x, MigrationError as y, checkTenancy as z };

package/dist/{policies-yVzFCjxU.js → policies-CKIdBFKt.js}

@@ -1,7 +1,7 @@
-import { D as nodesOf, U as isRecorded, a as columnName, f as Condition, m as Expr, u as rowOf, x as conditionNode } from "./base64url-DwWPqoOT.js";
+import { D as nodesOf, U as isRecorded, a as columnName, f as Condition, m as Expr, u as rowOf, x as conditionNode } from "./base64url-C5GTYIL5.js";
 //#region src/auth/enforce.ts
 /**
-* Checking a policy (planning/policies.md → How a check runs): its action's condition, with the
+* Checking a policy: its action's condition, with the
 * placeholders bound for this request, then simplified so constant parts drop out:
 *
 *   anyone          → true
@@ -236,7 +236,7 @@ async function bindFor(node, policies, model, action, asker) {
 //#endregion
 //#region src/auth/policies.ts
 /**
-* Policies (planning/policies.md): who may do what to a model's rows, one policy per model, each
+* Policies: who may do what to a model's rows, one policy per model, each
 * action a condition. Every action is a permission, keyed `<model in camelCase>.<action>`
 * (`product.publish`), which roles in `app.ts` list. A model's policy always has `read`,
 * `create`, `update` and `delete`, `byRole` unless it says otherwise.

package/dist/ports/index.d.ts

@@ -1,2 +1,2 @@
-import { _ as StoredObject, a as DatabaseDriver, b as TenantDatabases, c as MailMessage, d as RateLimiter, f as Row, g as Storage, h as Sql, i as DatabaseCapabilities, l as PdfRenderer, m as ServiceRef, n as Body, o as DialectName, p as Runtime, r as Cache, s as MailDriver, t as AppCore, u as Queue, v as TaskMessage, y as TenantCore } from "../index-BKwTOLop.js";
+import { _ as StoredObject, a as DatabaseDriver, b as TenantDatabases, c as MailMessage, d as RateLimiter, f as Row, g as Storage, h as Sql, i as DatabaseCapabilities, l as PdfRenderer, m as ServiceRef, n as Body, o as DialectName, p as Runtime, r as Cache, s as MailDriver, t as AppCore, u as Queue, v as TaskMessage, y as TenantCore } from "../index-Ce5p2-EB.js";
 export { AppCore, Body, Cache, DatabaseCapabilities, DatabaseDriver, DialectName, MailDriver, MailMessage, PdfRenderer, Queue, RateLimiter, Row, Runtime, ServiceRef, Sql, Storage, StoredObject, TaskMessage, TenantCore, TenantDatabases };

package/dist/{resource-9fjxJgmz.js → resource-CsYksjKc.js}

@@ -1,12 +1,12 @@
-import { B as toKind, R as object, V as validate, W as ValidationError } from "./validation-l5JG-PFn.js";
-import { G as UniqueFailed, U as NotFound, V as CheckFailed, W as ReferenceFailed } from "./migrator-C65RM_K-.js";
-import { a as columnName, b as asCondition, j as IMPLICIT_FIELDS, l as computedFieldOf, m as Expr, p as Embed } from "./base64url-DwWPqoOT.js";
-import { r as actionsOf } from "./policies-yVzFCjxU.js";
+import { G as ValidationError, H as validate, V as toKind, z as object } from "./validation-Cppmd0RV.js";
+import { J as UniqueFailed, K as NotFound, W as CheckFailed, q as ReferenceFailed } from "./migrator-BU3_PHk8.js";
+import { a as columnName, b as asCondition, j as IMPLICIT_FIELDS, l as computedFieldOf, m as Expr, p as Embed } from "./base64url-C5GTYIL5.js";
+import { r as actionsOf } from "./policies-CKIdBFKt.js";
 import { n as RESERVED, t as LOOKUPS } from "./syntax-CrUZFrS7.js";
 //#region src/api/fail.ts
 /**
 * `fail(code, message)`: the app's own business rules, for what can't be a `.check()`, a flow or a
-* unique. Always a 409; app code never picks a status (planning/requests.md → Errors).
+* unique. Always a 409; app code never picks a status.
 */
 var Rejected = class extends Error {
 	code;
@@ -24,8 +24,25 @@ function fail(code, message) {
 //#endregion
 //#region src/api/errors.ts
 /**
-* The one error format (planning/requests.md → Errors): `{ error: { code, message, … }, requestId }`.
-* The status comes from the error; app code never picks one.
+* The one error format: `{ error: { code, message, … }, requestId }`. `code` is stable and
+* machine-readable, `message` is for people, and typed errors add their own fields (`issues`,
+* `model`, `check`, `fields`, `action`). `requestId` is also the `X-Request-Id` header.
+*
+* The status comes from the error; app code never picks one:
+*
+*   400  ValidationError        input, or a write, fails its kinds (`issues`, each with its path)
+*   401  SignInRequired         no session, or an anonymous request a policy denies
+*   403  NotAllowed             a row the user can read, without the action
+*   403  CrossSiteRequest       a cookie session's write from a site the app doesn't trust
+*   404  NotFound               `.mustExist()`, a row the user can't read, an unknown path or host
+*   405  MethodNotAllowed       a known path with another method (`Allow`)
+*   409  UniqueFailed (`fields`, and `issues` for a form), CheckFailed, ReferenceFailed, or the
+*        app's own code from `fail`
+*   411/413/415                 uploads without a size, too large, of a refused type; a body over
+*                               the JSON limit (413) or not JSON (415)
+*   429  TooManyRequests        anonymous writes past the per-IP limit (`Retry-After`)
+*   503  TenantSuspended        a suspended tenant
+*   500  InternalError          anything else: logged with its stack as one JSON line, nothing sent
 */
 /** An error the pipeline raises itself, already carrying its status and code. */
 var HttpError = class extends Error {
@@ -47,7 +64,7 @@ const methodNotAllowed = (allowed) => new HttpError(405, "MethodNotAllowed", "Th
 const tooLarge = (limit) => new HttpError(413, "TooLarge", `The body must be at most ${limit / 1024 / 1024} MB`);
 /** Over the per-IP limit for anonymous writes. */
 const tooManyRequests = () => new HttpError(429, "TooManyRequests", "Too many requests; try again in a minute", { "Retry-After": "60" });
-/** A tenant a platform admin suspended: its data is kept, and it answers nothing (planning/tenancy.md). */
+/** A tenant a platform admin suspended: its data is kept, and it answers nothing. */
 const tenantSuspended = () => new HttpError(503, "TenantSuspended", "This site is suspended");
 const lengthRequired = () => new HttpError(411, "LengthRequired", "Send the file's size (Content-Length)");
 const fileTooLarge = (maxBytes) => new HttpError(413, "TooLarge", `The file must be at most ${maxBytes / 1024 / 1024} MB`);
@@ -85,7 +102,8 @@ function describe(error) {
 			code: "UniqueFailed",
 			message: error.message,
 			model: error.model,
-			fields: error.fields
+			fields: error.fields,
+			issues: error.issues
 		}
 	};
 	if (error instanceof CheckFailed) return {
@@ -170,7 +188,7 @@ function failure(error, requestId, place) {
 const QUERY_METHODS = /* @__PURE__ */ new Set(["GET", "DELETE"]);
 /**
 * One declared route. The pipeline finds these among an app module's exports. `O` is what its
-* handler returns, awaited: the typed client reads it (planning/client.md).
+* handler returns, awaited: the typed client reads it.
 */
 var Route = class {
 	method;
@@ -209,8 +227,12 @@ const route = {
 //#endregion
 //#region src/api/input.ts
 /**
-* `input` (planning/requests.md → Input): the JSON body on writes, the query string on GET / DELETE,
-* validated by the endpoint's kinds. Unknown keys are issues, never dropped.
+* `input`: the JSON body on writes, the query string on GET / DELETE, validated by the endpoint's
+* kinds in their JSON forms (money in minor units, dates in ISO 8601, refs by id). Unknown keys are
+* issues, never dropped, so a client's typo doesn't pass silently.
+*
+* One source per method: on writes the query string belongs to the framework, never `input`.
+* `params` are strings typed from the path and aren't validated: a malformed id finds no row (404).
 */
 /** The largest JSON body a request may send. Uploads have their own path. */
 const BODY_LIMIT = 1048576;
@@ -295,7 +317,7 @@ async function readText(request) {
 //#endregion
 //#region src/resources/query.ts
 /**
-* A resource list's query syntax (planning/resources.md → Client query syntax): Django's lookups,
+* A resource list's query syntax: Django's lookups,
 * as Django REST framework and django-filter take them.
 *
 *   GET /api/products?category__slug=rice&price__gte=1000&price__lt=5000&onSale&search=basmati
@@ -513,7 +535,7 @@ function filterFor(field, op, raw) {
 //#endregion
 //#region src/resources/resource.ts
 /**
-* `resource(Model, options)` (planning/resources.md): what the API exposes over a model, a named
+* `resource(Model, options)`: what the API exposes over a model, a named
 * shape the model's policy always applies to and that can only narrow it. Each resource exported
 * from an app module is mounted at `/api/<export name in kebab-case>` (mount.ts).
 *
@@ -525,6 +547,11 @@ function filterFor(field, op, raw) {
 *     custom: { archive },
 *   })
 *
+* Models are never exposed directly: adding a model never publishes an API. A resource over a model
+* without a policy denies every request, so declaring one isn't enough to open it. A role-dependent
+* view of the same rows is two resources (`products`, `manageProducts`), never one with hidden
+* fields; the resource *is* the shape, so there's no `?fields=` or `?include=`.
+*
 * A resource is checked when it's declared, against its model: its columns are the model's,
 * its key is unique, `create` covers the required fields, the owner column is never writable, a
 * singleton has no key. Its actions are checked against the model's policy when the app loads.
@@ -552,7 +579,7 @@ function fieldAt(model, node) {
 const NAME = /^[a-z][A-Za-z0-9]*$/;
 /**
 * A declared resource, with what the engine reads from it. `C` is its custom actions, as declared:
-* the typed client reads what each returns (planning/client.md).
+* the typed client reads what each returns.
 */
 var Resource = class {
 	model;

package/dist/{tables-C3Uza4qK.js → tables-IrLjsomf.js}

@@ -1,7 +1,7 @@
-import { r as Model, s as defineModel } from "./base64url-DwWPqoOT.js";
+import { r as Model, s as defineModel } from "./base64url-C5GTYIL5.js";
 //#region src/db/schema/builtins.ts
 /**
-* Built-in tables (planning/auth.md → Extending): sets of models a part of isai owns, switched on
+* Built-in tables: sets of models a part of isai owns, switched on
 * in `db/index.ts` with `use: [base.tenancy({ database: "platform" })]`. They're defined in the
 * schema's registry by `createDataLayer`, so they exist without being declared, and refs reach them
 * by name (`f.ref("Tenant")`). An app adds columns to one with `builtins.Tenant.extend({ … })`,
@@ -77,7 +77,7 @@ function authTables(f, options) {
 	return new TableSet("auth", options.database, authDefinitions(f, "", false));
 }
 /**
-* The platform's own copy (planning/tenancy.md → End of v1), in the platform database with
+* The platform's own copy, in the platform database with
 * `base.tenancy()`: the same tables, prefixed (`PlatformUser`, `PlatformSession`…), since model
 * names are one namespace across the app's databases. Sealed: the platform's are never extended.
 */
@@ -164,7 +164,7 @@ function authDefinitions(f, prefix, sealAll) {
 				user: f.ref(named("User"), { related: "roles" }).cascade(),
 				role: f.ref(named("Role"), { related: "holders" }).cascade(),
 				/**
-				* Held by the platform (planning/tenancy.md → End of v1): the tenant's people, the owner
+				* Held by the platform: the tenant's people, the owner
 				* included, can't take it away or suspend its holder.
 				*/
 				held: f.choice(HELD).optional()

package/dist/testing/index.d.ts

@@ -1,5 +1,5 @@
-import { a as DatabaseDriver, g as Storage } from "../index-BKwTOLop.js";
-import { I as Clock, L as FixedClock, R as fixedClock, V as AnyModel, i as Row, l as Overrides, p as Database, s as Makers, u as Seed } from "../types-BFc_NEx8.js";
+import { a as DatabaseDriver, g as Storage } from "../index-Ce5p2-EB.js";
+import { I as Clock, L as FixedClock, R as fixedClock, V as AnyModel, i as Row, l as Overrides, p as Database, s as Makers, u as Seed } from "../types-S6zF5IXV.js";
 //#region src/testing/conformance/database.d.ts
 /**
  * Makes the driver under test. Every call must return a driver on an **empty** database:

package/dist/testing/index.js

@@ -1,8 +1,8 @@
 import { t as __exportAll } from "../rolldown-runtime-D7D4PA-g.js";
-import { M as dialectFor, P as fixedClock, a as currentRelease, b as Database, c as rollback, i as acquireLock, k as keyCondition, l as setReleaseStatus, m as emptySnapshot, n as migrateFresh, o as holdOf, p as generateMigration, r as sync, s as releaseLock, t as migrate, u as startRelease, v as dataStep, y as MigrationError, z as utc } from "../migrator-C65RM_K-.js";
-import { n as toBase64url, r as Model } from "../base64url-DwWPqoOT.js";
-import { t as createDataLayer } from "../data-layer-BNtz40PV.js";
-import { S as seedAs, i as makers, m as forgetGoogleKeys, n as TENANT, o as authOf, t as PLATFORM, u as GOOGLE } from "../config-D6PexpSC.js";
+import { H as utc, L as PLATFORM, M as dialectFor, P as fixedClock, R as TENANT, a as currentRelease, b as Database, c as rollback, i as acquireLock, k as keyCondition, l as setReleaseStatus, m as emptySnapshot, n as migrateFresh, o as holdOf, p as generateMigration, r as sync, s as releaseLock, t as migrate, u as startRelease, v as dataStep, y as MigrationError } from "../migrator-BU3_PHk8.js";
+import { n as toBase64url, r as Model } from "../base64url-C5GTYIL5.js";
+import { t as createDataLayer } from "../data-layer-_TZtuy-F.js";
+import { d as forgetGoogleKeys, r as authOf, s as GOOGLE, t as makers, y as seedAs } from "../makers-DeSNM0Nd.js";
 import { describe, expect, it } from "vitest";
 //#region src/testing/conformance/database.ts
 /**
@@ -720,7 +720,7 @@ var conformance_exports = /* @__PURE__ */ __exportAll({
 //#endregion
 //#region src/testing/database.ts
 /**
-* A database per test (planning/data-layer.md → Seeds and fakes): migrated fresh from the
+* A database per test: migrated fresh from the
 * models, filled from a seed, with `make` and `many` for the test's own rows.
 *
 *   let t: TestDatabase
@@ -842,7 +842,7 @@ async function fakeGoogle(client) {
 //#endregion
 //#region src/testing/tenant.ts
 /**
-* A tenant per test (planning/tenancy.md → Development and tests): a fresh platform database with
+* A tenant per test: a fresh platform database with
 * the tenant's row, and the tenant's own database migrated fresh from the app's models and filled
 * from a seed that runs in it (`tenant` in its context), as `inTenant` runs one.
 *

package/dist/{types-BFc_NEx8.d.ts → types-S6zF5IXV.d.ts}

@@ -1,5 +1,5 @@
-import { a as DatabaseDriver, f as Row$1, h as Sql, o as DialectName } from "./index-BKwTOLop.js";
-import { E as list, G as FileType, K as ImageType, M as IdInput, T as Shape, at as Measure, et as AnyKind, g as KindDefinition, h as Definable, it as KindTypes, ot as Sensitivity, q as StoredFile, ut as StandardProps, w as Output, x as Input$2 } from "./index-BVCrbMav.js";
+import { a as DatabaseDriver, f as Row$1, h as Sql, o as DialectName } from "./index-Ce5p2-EB.js";
+import { E as list, G as FileType, M as IdInput, T as Shape, Y as StoredFile, ct as Sensitivity, ft as StandardProps, g as KindDefinition, h as Definable, nt as AnyKind, ot as KindTypes, q as ImageType, st as Measure, w as Output, x as Input$2 } from "./index-CYcklQ1l.js";
 //#region src/db/fields/slot.d.ts
 interface SlotSpec {
   /** Namespaced by module: `auth.owner`. */
@@ -168,8 +168,11 @@ declare class Field<Output, Input = Output, Optional extends boolean = false, Ha
   flow(this: Field<Output, Input, Optional, HasDefault, Meta>, transitions: { readonly [From in Output & string]?: readonly (Output & string)[]; }): Field<Output, Input, Optional, HasDefault, Meta>;
   /**
    * A copy of a related row's value (`.from((s) => s.criterion.maxScore)`), so the row's checks and
-   * uniques can use it. The database writes it on create and keeps it equal to its source; it's
-   * never written. The path's first ref must be `.fixed()`.
+   * uniques can use it. The database writes it on create and keeps it equal to its source (triggers
+   * on each table along the path, so raw SQL writes are seen too); it's never written. The path's
+   * first ref must be `.fixed()`; when every step and the final field are fixed, it's written once
+   * and no trigger is made. A plain path to one column only: a derived value is `.computed()`, and a
+   * value frozen as it was is a snapshot, not a copy.
    */
   from(build: (row: any) => Expr<unknown, unknown>): Field<Output, Input, Optional, HasDefault, Meta & {
     readonly maintained: true;
@@ -276,7 +279,7 @@ declare function fieldKinds(defaults: () => SchemaDefaults): {
   }) => Field<Output<S>, Input$2<S>, false, false, {}>;
   /** A list, for shapes (`f.json({ shape: f.list(...) })`, route inputs). Not a column itself. */
   list: typeof list;
-  /** A file; `{ storage }` names a storage other than `default` (planning/uploads.md). */
+  /** A file; `{ storage }` names a storage other than `default`. */
   file: (options?: {
     readonly types?: readonly FileType[];
     readonly storage?: string;
@@ -636,7 +639,7 @@ interface RelationTarget {
   readonly field: string;
   readonly spec: FieldSpec;
 }
-/** The audit log's settings, when `base.audit` is in the `use` list (planning/audit.md). */
+/** The audit log's settings, when `base.audit` is in the `use` list. */
 interface AuditConfig {
   /** The database the log lives in; only writes to it are recorded. */
   readonly database: string;
@@ -690,7 +693,7 @@ interface ModelSpec {
   /** The built-in table set it comes from (`tenancy`); undefined for the app's own models. */
   readonly builtin?: string;
   /**
-   * Whether the audit log records its writes (planning/audit.md): its own `.audit(…)`, else the
+   * Whether the audit log records its writes: its own `.audit(…)`, else the
    * module's `byDefault`; `"never"` for built-ins that are never recorded (Session, the log itself).
    */
   readonly audit?: boolean | "never";
@@ -774,7 +777,7 @@ declare class Model<Name extends string = string, F extends Fields = Fields, Uni
   table(name: string): Model<Name, F, Uniques>;
   /**
    * A rule over the row, written as a condition. It runs in JS on every write; when it reads
-   * more than one field it is also a database guard (planning/migrations.md).
+   * more than one field it is also a database guard.
    */
   check(name: string, build: (row: OwnColumns<ImplicitFields & F>) => Condition): Model<Name, F, Uniques>;
   /** The spec with these computed fields added (`computed`, `reading`). */
@@ -880,7 +883,7 @@ interface IndexSnapshot {
   readonly unique: boolean;
 }
 /**
- * A rule the database enforces itself (planning/migrations.md): a `.check()` over more than one
+ * A rule the database enforces itself: a `.check()` over more than one
  * column, or a number's limit (`min` / `max`), which an SQL expression could otherwise break.
  * For a limit, `name` is the field.
  */
@@ -1060,7 +1063,7 @@ interface TotalsQuery {
 /** What a write returns: the stored rows, or only their ids (when the caller just counts them). */
 type Returning = "rows" | "ids";
 /**
- * One audited statement's entries (planning/audit.md): each entry's id is `stamp.<row id>`, so a
+ * One audited statement's entries: each entry's id is `stamp.<row id>`, so a
  * later statement in the batch finds this statement's entries by the stamp. The rest is who and
  * where, the same on every entry.
  */
@@ -1119,7 +1122,7 @@ interface Dialect {
    */
   reorder(model: ModelSpec, ids: readonly string[], context: SqlContext): Sql;
   /**
-   * The audit log's statements, placed around a write in its batch (planning/audit.md). `log` is
+   * The audit log's statements, placed around a write in its batch. `log` is
    * the `AuditEntry` model; `model` the one written.
    */
   readonly audit: {
@@ -1550,7 +1553,7 @@ interface Makers {
 }
 /**
  * What a seed's function is given: `make` and `many` on its database and, with tenancy, the tenant
- * it runs in and `inTenant` to fill one (planning/tenancy.md → Creating tenants).
+ * it runs in and `inTenant` to fill one.
  */
 interface SeedContext extends Makers {
   /** The tenant a seed runs in (its `Tenant` row), when `inTenant` ran it; undefined otherwise. */

package/dist/validation/index.d.ts

@@ -1,3 +1,3 @@
-import { a as ValidationError, i as Result, n as IssueCode, r as Path, t as Issue } from "../issues-Bxq4JExX.js";
-import { $ as FakeContext, A as validate, B as money, C as ObjectShape, D as object, E as list, F as datetime, G as FileType, H as sequence, I as fakeUlid, J as file, K as ImageType, L as flag, M as IdInput, N as choice, O as serialize, P as date, Q as Fake, R as id, S as LIST_MAX, T as Shape, U as phone, V as quantity, W as phoneKind, X as image, Y as files, Z as images, _ as define, a as newToken, at as Measure, b as CarriesKind, c as slug, ct as kind, d as text, dt as StandardResult, et as AnyKind, f as textKind, ft as StandardSchemaV1, g as KindDefinition, h as Definable, i as markdown, it as KindTypes, j as CalendarDate, k as toKind, l as slugify, lt as StandardIssue, m as url, n as host, nt as Kind, o as personName, ot as Sensitivity, p as token, q as StoredFile, r as line, rt as KindSpec, s as secret, st as TypeText, t as email, tt as FileSpec, u as subdomain, ut as StandardProps, v as json, w as Output, x as Input, y as urls, z as int } from "../index-BVCrbMav.js";
-export { type AnyKind, type CalendarDate, type CarriesKind, type Definable, Fake, type FakeContext, type FileSpec, type FileType, type IdInput, type ImageType, type Input, type Issue, type IssueCode, Kind, type KindDefinition, type KindSpec, type KindTypes, LIST_MAX, type Measure, type ObjectShape, type Output, type Path, type Result, type Sensitivity, type Shape, type StandardIssue, type StandardProps, type StandardResult, type StandardSchemaV1, type StoredFile, type TypeText, ValidationError, choice, date, datetime, define, email, fakeUlid, file, files, flag, host, id, image, images, int, json, kind, line, list, markdown, money, newToken, object, personName, phone, phoneKind, quantity, secret, sequence, serialize, slug, slugify, subdomain, text, textKind, toKind, token, url, urls, validate };
+import { a as ValidationError, i as Result, n as IssueCode, r as Path, t as Issue } from "../issues-CKto95IW.js";
+import { $ as images, A as validate, B as money, C as ObjectShape, D as object, E as list, F as datetime, G as FileType, H as sequence, I as fakeUlid, J as SIZES_MAX, K as ImageSize, L as flag, M as IdInput, N as choice, O as serialize, P as date, Q as image, R as id, S as LIST_MAX, T as Shape, U as phone, V as quantity, W as phoneKind, X as file, Y as StoredFile, Z as files, _ as define, a as newToken, at as KindSpec, b as CarriesKind, c as slug, ct as Sensitivity, d as text, dt as StandardIssue, et as Fake, f as textKind, ft as StandardProps, g as KindDefinition, h as Definable, i as markdown, it as Kind, j as CalendarDate, k as toKind, l as slugify, lt as TypeText, m as url, mt as StandardSchemaV1, n as host, nt as AnyKind, o as personName, ot as KindTypes, p as token, pt as StandardResult, q as ImageType, r as line, rt as FileSpec, s as secret, st as Measure, t as email, tt as FakeContext, u as subdomain, ut as kind, v as json, w as Output, x as Input, y as urls, z as int } from "../index-CYcklQ1l.js";
+export { type AnyKind, type CalendarDate, type CarriesKind, type Definable, Fake, type FakeContext, type FileSpec, type FileType, type IdInput, type ImageSize, type ImageType, type Input, type Issue, type IssueCode, Kind, type KindDefinition, type KindSpec, type KindTypes, LIST_MAX, type Measure, type ObjectShape, type Output, type Path, type Result, SIZES_MAX, type Sensitivity, type Shape, type StandardIssue, type StandardProps, type StandardResult, type StandardSchemaV1, type StoredFile, type TypeText, ValidationError, choice, date, datetime, define, email, fakeUlid, file, files, flag, host, id, image, images, int, json, kind, line, list, markdown, money, newToken, object, personName, phone, phoneKind, quantity, secret, sequence, serialize, slug, slugify, subdomain, text, textKind, toKind, token, url, urls, validate };

package/dist/validation/index.js

@@ -1 +1 @@
-export { G as Fake, H as Kind, I as LIST_MAX, W as ValidationError, E as choice, D as date, O as datetime, l as define, f as email, k as fakeUlid, i as file, o as files, A as flag, p as host, j as id, s as image, c as images, M as int, u as json, U as kind, m as line, L as list, h as markdown, N as money, g as newToken, R as object, _ as personName, t as phone, n as phoneKind, P as quantity, v as secret, F as sequence, z as serialize, y as slug, b as slugify, x as subdomain, S as text, C as textKind, B as toKind, w as token, T as url, d as urls, V as validate } from "../validation-l5JG-PFn.js";
+export { K as Fake, U as Kind, L as LIST_MAX, i as SIZES_MAX, G as ValidationError, D as choice, O as date, k as datetime, u as define, p as email, A as fakeUlid, a as file, s as files, j as flag, m as host, M as id, c as image, l as images, N as int, d as json, W as kind, h as line, R as list, g as markdown, P as money, _ as newToken, z as object, v as personName, t as phone, n as phoneKind, F as quantity, y as secret, I as sequence, B as serialize, b as slug, x as slugify, S as subdomain, C as text, w as textKind, V as toKind, T as token, E as url, f as urls, H as validate } from "../validation-Cppmd0RV.js";

package/dist/{validation-l5JG-PFn.js → validation-Cppmd0RV.js}

@@ -904,9 +904,8 @@ const RESERVED_SUBDOMAINS = /* @__PURE__ */ new Set([
 	"system"
 ]);
 /**
-* One DNS label for a tenant's host on the platform (`demo` in `demo.thiraiangadi.shop`,
-* planning/tenancy.md → End of v1): lowercase letters, digits and inner dashes, 3–63 characters,
-* none of the reserved names.
+* One DNS label for a tenant's host on the platform (`demo` in `demo.thiraiangadi.shop`):
+* lowercase letters, digits and inner dashes, 3–63 characters, none of the reserved names.
 */
 const subdomain = () => textKind("subdomain", {
 	min: 3,
@@ -1079,6 +1078,8 @@ function define(definition) {
 }
 //#endregion
 //#region src/validation/kinds/files.ts
+/** At most this many smaller copies of one image. */
+const SIZES_MAX = 4;
 /** File types by their usual name, with the media types each covers. */
 const FILE_TYPES = {
 	pdf: ["application/pdf"],
@@ -1140,7 +1141,21 @@ const reference = object({
 		fake: () => "text/plain"
 	}),
 	width: int().min(1).optional(),
-	height: int().min(1).optional()
+	height: int().min(1).optional(),
+	sizes: list(object({
+		key: textKind("fileKey", {
+			max: 1024,
+			fake: (fake) => `fake/${fakeUlid(fake)}`
+		}),
+		size: quantity(),
+		type: textKind("mediaType", {
+			max: 255,
+			normalize: (value) => value.toLowerCase(),
+			fake: () => "image/webp"
+		}),
+		width: int().min(1),
+		height: int().min(1)
+	})).max(4).optional()
 });
 function fileKind(name, spec) {
 	const { types, maxBytes } = spec;
@@ -1151,11 +1166,12 @@ function fileKind(name, spec) {
 		read: (value, path) => {
 			const read = reference.parse(value, path);
 			if (!read.ok) return read;
-			const { width, height, ...rest } = read.value;
+			const { width, height, sizes, ...rest } = read.value;
 			const file = {
 				...rest,
 				...width ? { width } : {},
-				...height ? { height } : {}
+				...height ? { height } : {},
+				...sizes?.length ? { sizes } : {}
 			};
 			const issues = [];
 			if (!types.has(file.type)) issues.push({
@@ -1297,4 +1313,4 @@ function phone(options = {}) {
 	return phoneKind(() => region);
 }
 //#endregion
-export { flag as A, toKind as B, textKind as C, date as D, choice as E, sequence as F, Fake as G, Kind as H, LIST_MAX as I, fakeValue as K, list as L, int as M, money as N, datetime as O, quantity as P, object as R, text as S, url as T, kind as U, validate as V, ValidationError as W, personName as _, fileTypeNames as a, slugify as b, images as c, urls as d, email as f, newToken as g, markdown as h, file as i, id as j, fakeUlid as k, define as l, line as m, phoneKind as n, files as o, host as p, isPhoneRegion as r, image as s, phone as t, json as u, secret as v, token as w, subdomain as x, slug as y, serialize as z };
+export { fakeUlid as A, serialize as B, text as C, choice as D, url as E, quantity as F, ValidationError as G, validate as H, sequence as I, Fake as K, LIST_MAX as L, id as M, int as N, date as O, money as P, list as R, subdomain as S, token as T, Kind as U, toKind as V, kind as W, newToken as _, file as a, slug as b, image as c, json as d, urls as f, markdown as g, line as h, SIZES_MAX as i, flag as j, datetime as k, images as l, host as m, phoneKind as n, fileTypeNames as o, email as p, fakeValue as q, isPhoneRegion as r, files as s, phone as t, define as u, personName as v, textKind as w, slugify as x, secret as y, object as z };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@isaijs/core",
-  "version": "0.1.0",
+  "version": "0.1.3",
   "description": "A batteries-included, type-safe TypeScript backend framework. Cloudflare first, no lock-in.",
   "type": "module",
   "license": "MIT",