@isaijs/core 0.1.3 → 0.1.5

package/dist/index.js

@@ -1,14 +1,14 @@
 import { G as ValidationError, H as validate, V as toKind, h as line, o as fileTypeNames, p as email, z as object } from "./validation-Cppmd0RV.js";
-import { B as NeedsDatabase, C as database, D as planInsert, E as recordAction, F as systemClock, J as UniqueFailed, K as NotFound, L as PLATFORM, O as planUpdate, R as TENANT, S as clockOf, U as modelOfRow, V as evaluate, j as conditionOf, k as keyCondition, r as sync, t as migrate, w as decodeStored, z as checkTenancy } from "./migrator-BU3_PHk8.js";
-import { C as tooLarge, E as fail, S as tenantSuspended, T as Rejected, _ as json, b as routeNotFound, c as fromBody, d as route, f as HttpError, g as fileTypeRefused, h as fileTooLarge, l as readInput, m as errorResponse, o as parseListQuery, p as crossSiteRequest, r as resource, s as BODY_LIMIT, t as Resource, u as Route, v as lengthRequired, w as tooManyRequests, x as signInRequired, y as methodNotAllowed } from "./resource-CsYksjKc.js";
-import { F as sensitivity, G as ulid, K as Scope, V as asActor, a as columnName, b as asCondition$1, c as fieldOf, f as Condition, m as Expr, n as toBase64url, r as Model, t as fromBase64url, u as rowOf } from "./base64url-C5GTYIL5.js";
-import { t as kebabCase } from "./case-BnpcvhdW.js";
-import { t as PLATFORM_PREFIX } from "./tables-IrLjsomf.js";
-import { t as Seed } from "./seed-BObmdKdP.js";
+import { A as planUpdate, B as NeedsDatabase, C as database, D as recordAction, J as NotFound, L as PLATFORM, N as conditionOf, O as withTableTotals, P as modelOfRow, R as TENANT, S as clockOf, T as driverOf, U as systemClock, V as evaluate, X as UniqueFailed, j as keyCondition, k as planInsert, r as sync, t as migrate, w as decodeStored, z as checkTenancy } from "./migrator-B25prc9n.js";
+import { C as tooLarge, E as fail, S as tenantSuspended, T as Rejected, _ as json, b as routeNotFound, c as fromBody, d as route, f as HttpError, g as fileTypeRefused, h as fileTooLarge, l as readInput, m as errorResponse, o as parseListQuery, p as crossSiteRequest, r as resource, s as BODY_LIMIT, t as Resource, u as Route, v as lengthRequired, w as tooManyRequests, x as signInRequired, y as methodNotAllowed } from "./resource-BQK7bkPQ.js";
+import { C as asCondition$1, I as fromBase64url, L as toBase64url, U as asActor, _ as Expr, c as rowOf, h as Condition, o as fieldOf, p as sensitivity, q as Scope, r as columnName, t as Model } from "./model-Dc3HunKb.js";
+import { r as ulid, t as kebabCase } from "./case-DpXlJCL9.js";
 import { n as notImplemented, t as NotImplementedError } from "./errors-mCNLlXg9.js";
-import { d as afterUpdate, f as bindFor, h as ownerFieldOf, m as isFalse, p as check, u as FALSE } from "./policies-CKIdBFKt.js";
-import { i as checkRoles, n as authPerms, r as checkAuth } from "./create-auth-Ci0PaBoX.js";
-import { _ as permissionsOf, a as hashOf, b as syncRoles, c as GoogleError, f as verifyIdToken, g as safeReturn, h as redirect, i as clearedCookie, l as consentUrl, m as cookieOf, n as authModels, o as sessions, p as cookie, t as makers, u as exchangeCode, v as roleKeys, y as seedAs } from "./makers-DeSNM0Nd.js";
+import { t as PLATFORM_PREFIX } from "./tables-DgSwge7s.js";
+import { t as Seed } from "./seed-BObmdKdP.js";
+import { d as afterUpdate, f as bindFor, h as ownerFieldOf, m as isFalse, p as check, u as FALSE } from "./policies-KsqmlX67.js";
+import { i as checkRoles, n as authPerms, r as checkAuth } from "./create-auth-BHdX68Ng.js";
+import { _ as permissionsOf, a as hashOf, b as syncRoles, c as GoogleError, f as verifyIdToken, g as safeReturn, h as redirect, i as clearedCookie, l as consentUrl, m as cookieOf, n as authModels, o as sessions, p as cookie, t as makers, u as exchangeCode, v as roleKeys, y as seedAs } from "./makers-P9kg68C8.js";
 import { t as WrongSize } from "./storage-body-7dWyMszh.js";
 import { RegExpRouter } from "hono/router/reg-exp-router";
 import { SmartRouter } from "hono/router/smart-router";
@@ -59,6 +59,99 @@ var Router = class {
 	}
 };
 //#endregion
+//#region src/api/idempotency.ts
+/**
+* Retries made safe: a write with an `Idempotency-Key` header runs once, and the same key again
+* gets the first answer back (`Idempotent-Replayed: true`) without the handler running. The
+* generated client sends a key with every write and retries a write the network lost with the
+* same one (`client/client.ts`), so a phone whose connection drops never makes a write twice.
+*
+*   the same key again…                     answer
+*   same route, user and body               the first answer, replayed
+*   while the first is still running        409 InProgress (Retry-After: 1)
+*   another route, user or body             422 IdempotencyKeyReused
+*   after 24 h                              a new request
+*
+* Every write honours a key: there's no switch per endpoint. Keys live in the `_isai_idempotency`
+* table of the database the request runs against (a tenant's own, with isolated tenancy); expired
+* ones are deleted as new ones are written. What's kept is the pipeline's own answers (JSON, or
+* 204), errors from 400 to 499 too; a 5xx, an answer that sets a cookie, or a handler's own
+* stream isn't kept, so its retry runs again. A run whose answer was never kept (the isolate died
+* halfway) is taken over by a retry after a minute.
+*/
+/** The header a client sends, and the one a replayed answer carries. */
+const IDEMPOTENCY_KEY = "Idempotency-Key";
+const REPLAYED = "Idempotent-Replayed";
+/** How long a key is kept. */
+const KEPT_FOR = 864e5;
+/** Keys are a client's random ids (ULIDs, UUIDs): printable, and short. */
+const KEY = /^[\x21-\x7e]{1,255}$/;
+const TABLE = `"_isai_idempotency"`;
+const inProgress = () => new HttpError(409, "InProgress", "This request is still running; try again in a moment", { "Retry-After": "1" });
+const keyReused = () => new HttpError(422, "IdempotencyKeyReused", "This Idempotency-Key was used for another request");
+const badKey = () => new HttpError(400, "BadIdempotencyKey", "An Idempotency-Key is 1 to 255 printable characters");
+/**
+* `run` once for the request's key, or the answer it gave before. `scope` is what the key must
+* match besides the body: the route and the user. Without a key, `run` simply runs.
+*/
+async function idempotent(db, request, scope, run) {
+	const key = request.headers.get(IDEMPOTENCY_KEY);
+	if (key === null) return run();
+	if (!KEY.test(key)) throw badKey();
+	const driver = driverOf(db);
+	const now = clockOf(db).now().getTime();
+	const body = await digest(request);
+	const query = (text, ...params) => driver.query({
+		text,
+		params
+	});
+	await query(`DELETE FROM ${TABLE} WHERE "created_at" < ?`, now - KEPT_FOR);
+	if ((await query(`INSERT INTO ${TABLE} ("key", "scope", "body", "created_at") VALUES (?, ?, ?, ?) ON CONFLICT ("key") DO NOTHING RETURNING "key"`, key, scope, body, now)).length === 0) {
+		const [kept] = await query(`SELECT "scope", "body", "status", "response", "content_type", "created_at" FROM ${TABLE} WHERE "key" = ?`, key);
+		if (!kept) return run();
+		if (kept.scope !== scope || kept.body !== body) throw keyReused();
+		if (kept.status !== null) return replay(kept);
+		if (kept.created_at > now - 6e4) throw inProgress();
+		if ((await query(`UPDATE ${TABLE} SET "created_at" = ? WHERE "key" = ? AND "status" IS NULL AND "created_at" = ? RETURNING "key"`, now, key, kept.created_at)).length === 0) throw inProgress();
+	}
+	let response;
+	try {
+		response = await run();
+	} catch (error) {
+		await query(`DELETE FROM ${TABLE} WHERE "key" = ?`, key);
+		throw error;
+	}
+	if (!keepable(response)) {
+		await query(`DELETE FROM ${TABLE} WHERE "key" = ?`, key);
+		return response;
+	}
+	const text = response.status === 204 ? null : await response.text();
+	const type = response.headers.get("Content-Type");
+	await query(`UPDATE ${TABLE} SET "status" = ?, "response" = ?, "content_type" = ? WHERE "key" = ?`, response.status, text, type, key);
+	return new Response(text, response);
+}
+/** An answer worth replaying: a client's (not a 5xx), with nothing a replay couldn't repeat. */
+function keepable(response) {
+	if (response.status >= 500 || response.headers.has("Set-Cookie")) return false;
+	if (response.status === 204) return true;
+	return response.headers.get("Content-Type")?.startsWith("application/json") ?? false;
+}
+function replay(kept) {
+	return new Response(kept.response, {
+		status: kept.status ?? 200,
+		headers: {
+			...kept.content_type ? { "Content-Type": kept.content_type } : {},
+			[REPLAYED]: "true"
+		}
+	});
+}
+/** The body's SHA-256 (hex), read from a copy so the handler still has it. */
+async function digest(request) {
+	const bytes = request.body ? await request.clone().arrayBuffer() : /* @__PURE__ */ new ArrayBuffer(0);
+	const hash = new Uint8Array(await crypto.subtle.digest("SHA-256", bytes));
+	return Array.from(hash, (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+//#endregion
 //#region src/api/output.ts
 /**
 * What a handler returns, as JSON. Rows the ORM returned are found
@@ -219,7 +312,7 @@ function createPipeline(options) {
 				if (!signedIn && !SAFE_METHODS.has(request.method) && options.anonymousLimit) {
 					if (!await options.anonymousLimit.allow(clientIp(request))) throw tooManyRequests();
 				}
-				return await dispatch(request, url, extra, signedIn, place);
+				return await dispatch(request, url, requestId, extra, signedIn, place);
 			} catch (error) {
 				return errorResponse(error, requestId, place);
 			}
@@ -234,7 +327,7 @@ function createPipeline(options) {
 		});
 	}
 	/** The framework's own endpoints, then the route the path matches. */
-	async function dispatch(request, url, extra, signedIn, place) {
+	async function dispatch(request, url, requestId, extra, signedIn, place) {
 		const own = await options.framework?.(request, url);
 		if (own) return own;
 		if (!url.pathname.startsWith(`/api/`) && url.pathname !== "/api") throw routeNotFound();
@@ -249,6 +342,12 @@ function createPipeline(options) {
 		if (!SAFE_METHODS.has(request.method) && isCrossSite(request, url, allowedOrigin)) throw crossSiteRequest();
 		const user = signedIn?.user;
 		if (!user && !route.anonymous) throw signInRequired();
+		const run = () => answer(request, url, route, match.params, extra, user);
+		if (SAFE_METHODS.has(request.method) || !options.idempotency) return run();
+		return idempotent(options.idempotency(), request, `${place.route} ${user?.id ?? ""}`, () => run().catch((error) => errorResponse(error, requestId, place)));
+	}
+	/** A matched route's input, its handler, and its output. */
+	async function answer(request, url, route, params, extra, user) {
 		const tenant = extra.tenant;
 		const { db, can } = (options.context ?? noData)(user, extra.tenant);
 		const files = route.input === "own" ? void 0 : options.files?.(route);
@@ -265,7 +364,7 @@ function createPipeline(options) {
 			db,
 			can,
 			user,
-			params: match.params,
+			params,
 			input,
 			request,
 			tenant
@@ -353,7 +452,7 @@ function preflight(crossOrigin) {
 		status: 204,
 		headers: {
 			"Access-Control-Allow-Methods": "GET, POST, PUT, PATCH, DELETE",
-			"Access-Control-Allow-Headers": "Authorization, Content-Type",
+			"Access-Control-Allow-Headers": "Authorization, Content-Type, Idempotency-Key",
 			"Access-Control-Max-Age": "86400"
 		}
 	});
@@ -602,7 +701,7 @@ function boundary(options) {
 			}
 			case "createOne":
 			case "createMany": {
-				const node = required(await verdict(model, action));
+				const node = await withTableTotals(db, model.spec, required(await verdict(model, action)));
 				const inputs = (plan.op === "createOne" ? [plan.args[0]] : plan.args[0]).map((input) => withOwner(model, input));
 				const now = clockOf(db).now();
 				for (const input of inputs) {
@@ -944,7 +1043,7 @@ function rescope(node, scope) {
 			};
 			case "aggregate": return {
 				...o,
-				relation: o.relation.owner.scope === 0 ? {
+				relation: o.relation.owner?.scope === 0 ? {
 					...o.relation,
 					owner: {
 						...o.relation.owner,
@@ -971,7 +1070,7 @@ function rescope(node, scope) {
 		};
 		case "some": return {
 			...node,
-			relation: node.relation.owner.scope === 0 ? {
+			relation: node.relation.owner?.scope === 0 ? {
 				...node.relation,
 				owner: {
 					...node.relation.owner,
@@ -3125,6 +3224,7 @@ function createCore(config, env, options = {}) {
 				door,
 				...config.api?.rateLimit?.anonymous ? { anonymousLimit: config.api.rateLimit.anonymous } : {},
 				context: contextOf(currentDb, models, auth?.policies),
+				idempotency: currentDb,
 				builtins: [...uploads.routes, ...models && signIns ? [
 					...authRoutes(models, signIns, currentDb, () => auth?.permissionKeys() ?? []),
 					...peopleRoutes(models, signIns, currentDb),
@@ -3196,6 +3296,7 @@ function createCore(config, env, options = {}) {
 			...config.api?.rateLimit?.anonymous ? { anonymousLimit: config.api.rateLimit.anonymous } : {},
 			builtins: [...authRoutes(models, signIns, platformDb, () => auth.permissionKeys()), ...peopleRoutes(models, signIns, platformDb)],
 			context: contextOf(platformDb, models, auth.policies),
+			idempotency: platformDb,
 			session: sessionOf(signIns),
 			framework: firstOf([
 				googlePlatform({

package/dist/{make-DKBn79cH.js → make-ByA-84h8.js}

@@ -1,4 +1,4 @@
-import { F as systemClock, f as dayOf, h as snapshotOf, p as generateMigration, y as MigrationError } from "./migrator-BU3_PHk8.js";
+import { U as systemClock, f as dayOf, h as snapshotOf, p as generateMigration, y as MigrationError } from "./migrator-B25prc9n.js";
 //#region src/db/migrations/cleanup.ts
 /** Dropped tables, those that refer to others first, so no row is left pointing at a dropped one. */
 function dropOrder(tables) {

package/dist/{makers-DeSNM0Nd.js → makers-P9kg68C8.js}

@@ -1,6 +1,6 @@
 import { K as Fake, q as fakeValue } from "./validation-Cppmd0RV.js";
-import { D as planInsert, E as recordAction, S as clockOf, T as forUpkeep, W as CheckFailed } from "./migrator-BU3_PHk8.js";
-import { j as IMPLICIT_FIELDS, n as toBase64url, r as Model, t as fromBase64url } from "./base64url-C5GTYIL5.js";
+import { D as recordAction, E as forUpkeep, K as CheckFailed, S as clockOf, k as planInsert } from "./migrator-B25prc9n.js";
+import { I as fromBase64url, L as toBase64url, l as IMPLICIT_FIELDS, t as Model } from "./model-Dc3HunKb.js";
 //#region src/auth/roles.ts
 const same = (a, b) => a.length === b.length && a.every((value, i) => value === b[i]);
 /** What a role in `app.ts` is stored as. */

package/dist/{migrator-BU3_PHk8.js → migrator-B25prc9n.js}

@@ -1,5 +1,6 @@
 import { G as ValidationError, M as id } from "./validation-Cppmd0RV.js";
-import { A as unbound, B as aroundUpsert, E as fieldsOf, G as ulid, H as assertNotLog, I as actionEntry, L as aroundCreate, O as readsNow, R as aroundDelete, T as storageOf, W as wrap, a as columnName, c as fieldOf, f as Condition, h as Now, i as assertNotEncrypted, j as IMPLICIT_FIELDS, k as readsOtherRows, m as Expr, n as toBase64url, o as columnNode, t as fromBase64url$1, u as rowOf$1, x as conditionNode, z as aroundUpdate } from "./base64url-C5GTYIL5.js";
+import { A as mapOperands, B as aroundDelete, F as unbound, H as aroundUpsert, I as fromBase64url$1, K as wrap, L as toBase64url, M as readsNow, N as readsOtherRows, O as storageOf, P as tableTotals, R as actionEntry, V as aroundUpdate, W as assertNotLog, _ as Expr, c as rowOf$1, h as Condition, i as columnNode, k as fieldsOf, l as IMPLICIT_FIELDS, n as assertNotEncrypted, o as fieldOf, r as columnName, v as Now, w as conditionNode, z as aroundCreate } from "./model-Dc3HunKb.js";
+import { r as ulid } from "./case-DpXlJCL9.js";
 import { t as NotImplementedError } from "./errors-mCNLlXg9.js";
 //#region src/db/errors.ts
 var DatabaseError = class extends Error {
@@ -60,16 +61,79 @@ var NotFound = class extends DatabaseError {
 	}
 };
 //#endregion
-//#region src/db/orm/tag.ts
-const MODEL = Symbol.for("isai.model");
-function tagRow(row, model) {
-	row[MODEL] = model;
-	return row;
-}
-/** The model a value was read from, when it's a row the ORM returned (or a copy of one). */
-function modelOfRow(value) {
-	return value[MODEL];
+//#region src/internal/secret-box.ts
+/**
+* Encrypted values for `secret` fields: AES-256-GCM through Web Crypto, on every runtime.
+*
+* A sealed value is `v1.<key id>.<iv>.<ciphertext>` (base64url): a fresh 96-bit IV each time,
+* and the key's id (from its hash) so a value sealed with another key fails clearly, and old keys
+* can be kept for reading when rotation comes.
+*/
+const VERSION = "v1";
+/** A new key's text: 32 random bytes, base64url (what `secretKey` takes). */
+function newSecretKey() {
+	return toBase64url(crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32)));
 }
+var SecretBox = class {
+	ready;
+	/** `key`: 32 bytes, base64url (`newSecretKey()`). */
+	constructor(key) {
+		const bytes = fromBase64url$1(key);
+		if (bytes?.length !== 32) throw new TypeError("isai: secretKey must be 32 bytes, base64url (make one with newSecretKey())");
+		this.ready = (async () => {
+			const hash = new Uint8Array(await crypto.subtle.digest("SHA-256", bytes));
+			return {
+				key: await crypto.subtle.importKey("raw", bytes, "AES-GCM", false, ["encrypt", "decrypt"]),
+				id: toBase64url(hash.slice(0, 6))
+			};
+		})();
+	}
+	async seal(plaintext) {
+		const { key, id } = await this.ready;
+		const iv = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(12));
+		const data = new TextEncoder().encode(plaintext);
+		const sealed = new Uint8Array(await crypto.subtle.encrypt({
+			name: "AES-GCM",
+			iv
+		}, key, data));
+		return [
+			VERSION,
+			id,
+			toBase64url(iv),
+			toBase64url(sealed)
+		].join(".");
+	}
+	/** The plaintext, or why it can't be read. */
+	async open(sealed) {
+		const { key, id } = await this.ready;
+		const [version, keyId, ivText, dataText, ...rest] = sealed.split(".");
+		const iv = fromBase64url$1(ivText ?? "");
+		const data = fromBase64url$1(dataText ?? "");
+		if (version !== VERSION || rest.length > 0 || iv?.length !== 12 || !data) return {
+			ok: false,
+			reason: "isn't an encrypted value"
+		};
+		if (keyId !== id) return {
+			ok: false,
+			reason: "was encrypted with another key"
+		};
+		try {
+			const plain = await crypto.subtle.decrypt({
+				name: "AES-GCM",
+				iv
+			}, key, data);
+			return {
+				ok: true,
+				value: new TextDecoder().decode(plain)
+			};
+		} catch {
+			return {
+				ok: false,
+				reason: "failed its integrity check (changed or corrupted)"
+			};
+		}
+	}
+};
 //#endregion
 //#region src/internal/timezone.ts
 /**
@@ -142,6 +206,21 @@ function zone(name) {
 }
 const utc = zone("UTC");
 //#endregion
+//#region src/db/clock/index.ts
+const systemClock = { now: () => /* @__PURE__ */ new Date() };
+function fixedClock(start) {
+	let current = new Date(start);
+	return {
+		now: () => new Date(current),
+		set: (to) => {
+			current = new Date(to);
+		},
+		advance: (ms) => {
+			current = new Date(current.getTime() + ms);
+		}
+	};
+}
+//#endregion
 //#region src/db/conditions/evaluate.ts
 /**
 * Interprets a condition in JS against a row that isn't stored yet (`next`, checks before
@@ -311,95 +390,6 @@ function checkTenancy(tenancy, databases) {
 	if (other) throw new TypeError(`isai: with tenancy, the databases are tenant and platform; databases.${other} isn't supported yet`);
 }
 //#endregion
-//#region src/internal/secret-box.ts
-/**
-* Encrypted values for `secret` fields: AES-256-GCM through Web Crypto, on every runtime.
-*
-* A sealed value is `v1.<key id>.<iv>.<ciphertext>` (base64url): a fresh 96-bit IV each time,
-* and the key's id (from its hash) so a value sealed with another key fails clearly, and old keys
-* can be kept for reading when rotation comes.
-*/
-const VERSION = "v1";
-/** A new key's text: 32 random bytes, base64url (what `secretKey` takes). */
-function newSecretKey() {
-	return toBase64url(crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32)));
-}
-var SecretBox = class {
-	ready;
-	/** `key`: 32 bytes, base64url (`newSecretKey()`). */
-	constructor(key) {
-		const bytes = fromBase64url$1(key);
-		if (bytes?.length !== 32) throw new TypeError("isai: secretKey must be 32 bytes, base64url (make one with newSecretKey())");
-		this.ready = (async () => {
-			const hash = new Uint8Array(await crypto.subtle.digest("SHA-256", bytes));
-			return {
-				key: await crypto.subtle.importKey("raw", bytes, "AES-GCM", false, ["encrypt", "decrypt"]),
-				id: toBase64url(hash.slice(0, 6))
-			};
-		})();
-	}
-	async seal(plaintext) {
-		const { key, id } = await this.ready;
-		const iv = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(12));
-		const data = new TextEncoder().encode(plaintext);
-		const sealed = new Uint8Array(await crypto.subtle.encrypt({
-			name: "AES-GCM",
-			iv
-		}, key, data));
-		return [
-			VERSION,
-			id,
-			toBase64url(iv),
-			toBase64url(sealed)
-		].join(".");
-	}
-	/** The plaintext, or why it can't be read. */
-	async open(sealed) {
-		const { key, id } = await this.ready;
-		const [version, keyId, ivText, dataText, ...rest] = sealed.split(".");
-		const iv = fromBase64url$1(ivText ?? "");
-		const data = fromBase64url$1(dataText ?? "");
-		if (version !== VERSION || rest.length > 0 || iv?.length !== 12 || !data) return {
-			ok: false,
-			reason: "isn't an encrypted value"
-		};
-		if (keyId !== id) return {
-			ok: false,
-			reason: "was encrypted with another key"
-		};
-		try {
-			const plain = await crypto.subtle.decrypt({
-				name: "AES-GCM",
-				iv
-			}, key, data);
-			return {
-				ok: true,
-				value: new TextDecoder().decode(plain)
-			};
-		} catch {
-			return {
-				ok: false,
-				reason: "failed its integrity check (changed or corrupted)"
-			};
-		}
-	}
-};
-//#endregion
-//#region src/db/clock/index.ts
-const systemClock = { now: () => /* @__PURE__ */ new Date() };
-function fixedClock(start) {
-	let current = new Date(start);
-	return {
-		now: () => new Date(current),
-		set: (to) => {
-			current = new Date(to);
-		},
-		advance: (ms) => {
-			current = new Date(current.getTime() + ms);
-		}
-	};
-}
-//#endregion
 //#region src/db/dialects/sqlite/values.ts
 function encode(storage, value) {
 	if (value === null || value === void 0) return null;
@@ -446,7 +436,7 @@ function rowOf(state, scope) {
 	if (row === void 0) throw new TypeError("isai: a column is used outside the callback it belongs to");
 	return row;
 }
-function value(encoded, state) {
+function value$1(encoded, state) {
 	if (state.scope.values.mode === "inline") return literal(encoded);
 	state.scope.values.params.push(encoded);
 	return "?";
@@ -473,6 +463,11 @@ function column$1(node, state) {
 /** The relation's rows as `FROM … WHERE <they reference the owner>`, with their scope bound to a new alias. */
 function relationSource(relation, state) {
 	const owner = relation.owner;
+	if (!owner) {
+		const name = alias(state);
+		state.rows.set(relation.scope, name);
+		return `FROM ${quote(relation.table)} AS ${name} WHERE 1`;
+	}
 	const last = owner.path.at(-1);
 	const ownerRow = rowOf(state, owner.scope);
 	const ownerId = last ? columnThrough(state, ownerRow, owner.path.slice(0, -1), last.column) : `${ownerRow}."id"`;
@@ -483,11 +478,11 @@ function relationSource(relation, state) {
 function operand(node, partner, state) {
 	switch (node.t) {
 		case "column": return column$1(node, state);
-		case "value": return value(partner ? encode(partner, node.value) : node.value, state);
+		case "value": return value$1(partner ? encode(partner, node.value) : node.value, state);
 		case "now": {
 			if (!state.scope.now) throw new TypeError("isai: `now` can't be used here");
 			const at = state.scope.now.getTime() + node.offsetMs;
-			return value(partner === "date" ? state.scope.zone.localDate(at) : at, state);
+			return value$1(partner === "date" ? state.scope.zone.localDate(at) : at, state);
 		}
 		case "truth": return `(${compileIn(node.condition, state)})`;
 		case "local": {
@@ -581,13 +576,13 @@ function compileIn(node, state) {
 			if (node.values.length === 0) return "0";
 			const left = operand(node.operand, void 0, state);
 			const storage = storageOf(node.operand);
-			return `${left} IN (${(isSequence(node.operand) ? node.values.map(sequenceNumber) : node.values).map((v) => value(storage ? encode(storage, v) : v, state)).join(", ")})`;
+			return `${left} IN (${(isSequence(node.operand) ? node.values.map(sequenceNumber) : node.values).map((v) => value$1(storage ? encode(storage, v) : v, state)).join(", ")})`;
 		}
 		case "text": {
 			const target = operand(node.operand, void 0, state);
-			if (node.op === "icontains") return `instr(lower(${target}), lower(${value(node.value, state)})) > 0`;
-			if (node.op === "istartswith") return `instr(lower(${target}), lower(${value(node.value, state)})) = 1`;
-			return `instr(${target}, ${value(node.value, state)}) ${node.op === "startsWith" ? "= 1" : "> 0"}`;
+			if (node.op === "icontains") return `instr(lower(${target}), lower(${value$1(node.value, state)})) > 0`;
+			if (node.op === "istartswith") return `instr(lower(${target}), lower(${value$1(node.value, state)})) = 1`;
+			return `instr(${target}, ${value$1(node.value, state)}) ${node.op === "startsWith" ? "= 1" : "> 0"}`;
 		}
 		case "some": return `EXISTS (SELECT 1 ${relationSource(node.relation, state)} AND ${compileIn(node.where, state)})`;
 		case "and": return node.items.length === 0 ? "1" : balanced(node.items, "AND", state);
@@ -851,6 +846,12 @@ function count(model, where, context) {
 		return writer.sql(`SELECT COUNT(*) AS ${quote("count")} FROM ${quote(model.table)}${writer.where(where)}`);
 	});
 }
+function value(model, node, context) {
+	return withinLimit(context, (mode) => {
+		const writer = new Writer(model, mode, context);
+		return writer.sql(`SELECT ${compileOperand(node, writer.scope)} AS ${quote("value")}`);
+	});
+}
 function exists(model, where, context) {
 	return withinLimit(context, (mode) => {
 		const writer = new Writer(model, mode, context);
@@ -1287,6 +1288,7 @@ const sqlite = {
 	totals,
 	decodeTotals,
 	exists,
+	value,
 	update,
 	delete: remove,
 	reorder,
@@ -1306,7 +1308,8 @@ const sqlite = {
 			`CREATE TABLE IF NOT EXISTS ${MIGRATIONS} ("name" TEXT PRIMARY KEY, "kind" TEXT NOT NULL, "checksum" TEXT NOT NULL, "release" TEXT NOT NULL, "applied_at" INTEGER NOT NULL, "cursor" TEXT, "rerun" INTEGER NOT NULL DEFAULT 0)`,
 			`CREATE TABLE IF NOT EXISTS "_isai_releases" ("id" TEXT PRIMARY KEY, "seq" INTEGER NOT NULL UNIQUE, "commit" TEXT, "worker_version" TEXT, "status" TEXT NOT NULL, "schema" TEXT NOT NULL, "by" TEXT, "reason" TEXT, "started_at" INTEGER NOT NULL, "live_at" INTEGER, "rolled_back_at" INTEGER)`,
 			`CREATE TABLE IF NOT EXISTS "_isai_lock" ("id" INTEGER PRIMARY KEY CHECK ("id" = 1), "holder" TEXT, "command" TEXT, "since" INTEGER, "expires" INTEGER, "hold_release" TEXT, "hold_reason" TEXT)`,
-			`CREATE TABLE IF NOT EXISTS ${SEQUENCES} ("name" TEXT PRIMARY KEY, "value" INTEGER NOT NULL)`
+			`CREATE TABLE IF NOT EXISTS ${SEQUENCES} ("name" TEXT PRIMARY KEY, "value" INTEGER NOT NULL)`,
+			`CREATE TABLE IF NOT EXISTS "_isai_idempotency" ("key" TEXT PRIMARY KEY, "scope" TEXT NOT NULL, "body" TEXT NOT NULL, "status" INTEGER, "response" TEXT, "content_type" TEXT, "created_at" INTEGER NOT NULL)`
 		],
 		rules: rulesOf,
 		refill,
@@ -1327,6 +1330,17 @@ function dialectFor(name) {
 	throw new NotImplementedError(`the ${name} dialect`);
 }
 //#endregion
+//#region src/db/orm/tag.ts
+const MODEL = Symbol.for("isai.model");
+function tagRow(row, model) {
+	row[MODEL] = model;
+	return row;
+}
+/** The model a value was read from, when it's a row the ORM returned (or a copy of one). */
+function modelOfRow(value) {
+	return value[MODEL];
+}
+//#endregion
 //#region src/db/orm/translate.ts
 /** The field stored in `column`. */
 function fieldAt(model, column) {
@@ -2395,6 +2409,8 @@ var Transaction = class {
 };
 const UPKEEP = Symbol("isai:upkeep");
 const CLOCK = Symbol("isai:clock");
+const DRIVER = Symbol("isai:driver");
+const TOTALS = Symbol("isai:totals");
 const RECORD = Symbol("isai:record");
 const DECODE = Symbol("isai:decode");
 var Database = class Database {
@@ -2419,6 +2435,23 @@ var Database = class Database {
 	[CLOCK]() {
 		return this.engine.clock;
 	}
+	/** See `withTableTotals`. */
+	async [TOTALS](model, node) {
+		const values = /* @__PURE__ */ new Map();
+		for (const total of tableTotals(node)) {
+			const [row] = await this.engine.run(this.engine.dialect.value(model, total, this.engine.context()), [model]);
+			values.set(total, Number(row?.value ?? 0));
+		}
+		if (values.size === 0) return node;
+		return mapOperands(node, (o) => values.has(o) ? {
+			t: "value",
+			value: values.get(o)
+		} : o);
+	}
+	/** See `driverOf`. */
+	[DRIVER]() {
+		return this.engine.driver;
+	}
 	/**
 	* The post-commit write stream: `listener` is called after every committed write with what it
 	* created, changed and deleted (an `atomic`'s writes in one call). Returns the unsubscribe.
@@ -2591,6 +2624,17 @@ function decodeStored(db, model, row) {
 function clockOf(db) {
 	return db[CLOCK]();
 }
+/**
+* The rule's totals over whole tables (`rows(Product).count()`), each run as a query and replaced
+* by its value, so the rule can be checked against a row in JS (a create's new row). Internal.
+*/
+async function withTableTotals(db, model, node) {
+	return db[TOTALS](model, node);
+}
+/** The driver under a database, for the framework's own `_isai_*` tables (idempotency keys). */
+function driverOf(db) {
+	return db[DRIVER]();
+}
 function database(options) {
 	return new Database(options);
 }
@@ -3561,4 +3605,4 @@ async function migrateFresh(driver, models, options = {}) {
 	await sync(driver, manifest, options);
 }
 //#endregion
-export { Query as A, NeedsDatabase as B, database as C, planInsert as D, recordAction as E, systemClock as F, DatabaseError as G, utc as H, newSecretKey as I, UniqueFailed as J, NotFound as K, PLATFORM as L, dialectFor as M, sqlite as N, planUpdate as O, fixedClock as P, TENANT as R, clockOf as S, forUpkeep as T, modelOfRow as U, evaluate as V, CheckFailed as W, TODO as _, currentRelease as a, Database as b, rollback as c, applyRules as d, dayOf as f, UnsafeMigration as g, snapshotOf as h, acquireLock as i, conditionOf as j, keyCondition as k, setReleaseStatus as l, emptySnapshot as m, migrateFresh as n, holdOf as o, generateMigration as p, ReferenceFailed as q, sync as r, releaseLock as s, migrate as t, startRelease as u, dataStep as v, decodeStored as w, Transaction as x, MigrationError as y, checkTenancy as z };
+export { planUpdate as A, NeedsDatabase as B, database as C, recordAction as D, forUpkeep as E, dialectFor as F, newSecretKey as G, fixedClock as H, sqlite as I, NotFound as J, CheckFailed as K, PLATFORM as L, Query as M, conditionOf as N, withTableTotals as O, modelOfRow as P, TENANT as R, clockOf as S, driverOf as T, systemClock as U, evaluate as V, utc as W, UniqueFailed as X, ReferenceFailed as Y, TODO as _, currentRelease as a, Database as b, rollback as c, applyRules as d, dayOf as f, UnsafeMigration as g, snapshotOf as h, acquireLock as i, keyCondition as j, planInsert as k, setReleaseStatus as l, emptySnapshot as m, migrateFresh as n, holdOf as o, generateMigration as p, DatabaseError as q, sync as r, releaseLock as s, migrate as t, startRelease as u, dataStep as v, decodeStored as w, Transaction as x, MigrationError as y, checkTenancy as z };