@isaijs/core 0.1.4 → 0.1.6

package/dist/auth/index.d.ts

@@ -1,3 +1,3 @@
-import { r as AuthTablesOptions } from "../data-layer-D1BFo3wO.js";
-import { A as Permissions, F as DefinePolicy, I as Perms, L as Policy, N as AnyPolicy, P as Bound, R as Rules, a as OAuthMethod, c as Roles, i as Methods, l as SignInMethod, n as AuthConfig, o as Provider, r as AuthDefinition, s as RoleDefinition, t as Auth, u as createAuth, z as StandardAction } from "../index-DlgVg3D8.js";
+import { r as AuthTablesOptions } from "../data-layer-43pme0Gy.js";
+import { A as Permissions, F as Policy, I as Rules, L as StandardAction, M as Bound, N as DefinePolicy, P as Perms, a as OAuthMethod, c as Roles, i as Methods, j as AnyPolicy, l as SignInMethod, n as AuthConfig, o as Provider, r as AuthDefinition, s as RoleDefinition, t as Auth, u as createAuth } from "../index-a7ElyL3B.js";
 export { type AnyPolicy, Auth, type AuthConfig, type AuthDefinition, type AuthTablesOptions, type Bound, type DefinePolicy, type Methods, type OAuthMethod, type Permissions, type Perms, Policy, type Provider, type RoleDefinition, type Roles, type Rules, type SignInMethod, type StandardAction, createAuth };

package/dist/auth/index.js

@@ -1,3 +1,3 @@
-import { t as Policy } from "../policies-D_G5Rmxv.js";
-import { a as createAuth, t as Auth } from "../create-auth-9y_43vJf.js";
+import { t as Policy } from "../policies-KsqmlX67.js";
+import { a as createAuth, t as Auth } from "../create-auth-BFKvQVOG.js";
 export { Auth, Policy, createAuth };

package/dist/case-DpXlJCL9.js

@@ -0,0 +1,63 @@
+//#region src/internal/ulid.ts
+/**
+* ULIDs: 48 bits of milliseconds + 80 random bits, Crockford base32, 26 characters.
+* Generated in JS (works inside a D1 batch, the same on every driver) and sortable by time.
+*
+* Monotonic: ids made in the same millisecond (or after the clock stepped back) reuse the
+* last time and add one to the last random part, so ids always sort in the order they were
+* made within an isolate or process.
+*/
+const ALPHABET = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
+const RANDOM_LENGTH = 16;
+function encodeTime(time) {
+	let rest = time;
+	let text = "";
+	for (let i = 0; i < 10; i++) {
+		text = ALPHABET.charAt(rest % 32) + text;
+		rest = Math.floor(rest / 32);
+	}
+	return text;
+}
+function randomDigits() {
+	return Array.from(crypto.getRandomValues(new Uint8Array(RANDOM_LENGTH)), (byte) => byte % 32);
+}
+/** Adds one to base-32 digits in place; false when they were all at the maximum. */
+function increment(digits) {
+	for (let i = digits.length - 1; i >= 0; i--) {
+		if ((digits[i] ?? 0) < 31) {
+			digits[i] = (digits[i] ?? 0) + 1;
+			return true;
+		}
+		digits[i] = 0;
+	}
+	return false;
+}
+function monotonicUlid() {
+	let lastTime = -1;
+	let lastRandom = [];
+	return (now) => {
+		const time = now.getTime();
+		if (time > lastTime) {
+			lastTime = time;
+			lastRandom = randomDigits();
+		} else if (!increment(lastRandom)) {
+			lastTime += 1;
+			lastRandom = randomDigits();
+		}
+		return encodeTime(lastTime) + lastRandom.map((digit) => ALPHABET.charAt(digit)).join("");
+	};
+}
+/** The process-wide generator every write uses. */
+const ulid = monotonicUlid();
+//#endregion
+//#region src/internal/case.ts
+/** `manageProducts` → `manage-products`, `markPaid` → `mark-paid`: path segments. */
+function kebabCase(name) {
+	return snakeCase(name).replace(/_/g, "-");
+}
+/** `RegistrationMember` → `registration_member`, `startsAt` → `starts_at`. */
+function snakeCase(name) {
+	return name.replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/([A-Z])([A-Z][a-z])/g, "$1_$2").toLowerCase();
+}
+//#endregion
+export { snakeCase as n, ulid as r, kebabCase as t };

package/dist/cli/index.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { V as toKind, z as object } from "../validation-Cppmd0RV.js";
-import { M as dialectFor, m as emptySnapshot, r as sync, t as migrate, y as MigrationError } from "../migrator-BU3_PHk8.js";
-import { a as lookupsOf, i as filterableOf, n as isRequired, t as Resource, u as Route } from "../resource-CkzoR3Rq.js";
-import { F as sensitivity, c as fieldOf, r as Model } from "../base64url-C5GTYIL5.js";
-import { t as kebabCase } from "../case-BnpcvhdW.js";
-import { i as makeMigrations, n as checkSteps, t as checkMigrations } from "../make-DKBn79cH.js";
+import { F as dialectFor, m as emptySnapshot, r as sync, t as migrate, y as MigrationError } from "../migrator-B25prc9n.js";
+import { a as lookupsOf, i as filterableOf, n as isRequired, t as Resource, u as Route } from "../resource-BQK7bkPQ.js";
+import { o as fieldOf, p as sensitivity, t as Model } from "../model-Dc3HunKb.js";
+import { t as kebabCase } from "../case-DpXlJCL9.js";
+import { i as makeMigrations, n as checkSteps, t as checkMigrations } from "../make-ByA-84h8.js";
 import { d1 } from "../adapters/database/d1/index.js";
 import { spawn } from "node:child_process";
 import { parseArgs } from "node:util";
@@ -57,7 +57,11 @@ function typeOf(node, models, registry) {
 //#endregion
 //#region src/codegen/client.ts
 /** Names the client has for itself; an export can't take them. */
-const TAKEN = /* @__PURE__ */ new Set(["auth", "onSignedOut"]);
+const TAKEN = /* @__PURE__ */ new Set([
+	"auth",
+	"onSignedOut",
+	"onPending"
+]);
 function generateClient(source) {
 	const names = [...source.resources.map((r) => r.name), ...source.routes.map((r) => r.name)];
 	const clash = names.find((name, i) => names.indexOf(name) !== i || TAKEN.has(name));

package/dist/client/index.d.ts

@@ -181,6 +181,11 @@ interface ClientBase<U> {
   readonly auth: AuthApi<U>;
   /** Called on any 401 (but `auth.me()`'s): the session ended or never was. Returns an unsubscribe. */
   onSignedOut(listener: () => void): () => void;
+  /**
+   * Called with how many writes are waiting to be saved: now, then on every change (0 once all
+   * are). Returns an unsubscribe.
+   */
+  onPending(listener: (count: number) => void): () => void;
 }
 /** The client for an app's endpoints; the generated `createApi` types it. */
 export declare function createClient(endpoints: Endpoints, options?: ClientOptions): unknown;

package/dist/client/index.js

@@ -1,4 +1,4 @@
-import { t as kebabCase } from "../case-BnpcvhdW.js";
+import { r as ulid, t as kebabCase } from "../case-DpXlJCL9.js";
 //#region src/client/errors.ts
 /**
 * A failed call: the API's one error shape,
@@ -160,19 +160,50 @@ async function encoded(canvas, name, clear) {
 *               (a singleton's calls take no key)
 *   routes      api.<name>(args)                           (path params and input in one object)
 *   auth        api.auth.me() · signIn() · signOut() · users · invites
+*
+* Writes survive a dropping connection. Every write (any call but a GET) carries an
+* `Idempotency-Key` of its own, and goes out through one queue, in the order it was made: a
+* product isn't created before the upload it names. A write the network lost (`fetch` threw, the
+* connection went offline under it, or a 5xx came from a proxy rather than the app) is sent again
+* with the same key, so the server runs it once (`api/idempotency.ts`); so is one the server says
+* is still running (409 `InProgress`). It waits 1 s, 2 s, 4 s… up to 30 s between tries, and for
+* the browser to be back online, and never gives up: the call resolves once it's saved. An answer
+* from the app (a 400, a refusal, a 500) fails the call as it did. `api.onPending(count => …)`
+* says how many writes are waiting, for a "saving…" sign; while any are, the page asks before
+* it's closed. Reads aren't queued or retried: a frontend's cache retries them.
 */
 const QUERY_METHODS = /* @__PURE__ */ new Set(["GET", "DELETE"]);
+/** The waits between a lost write's tries, in ms; the last repeats. */
+const BACKOFF = [
+	1e3,
+	2e3,
+	4e3,
+	8e3,
+	16e3,
+	3e4
+];
 /** The client for an app's endpoints; the generated `createApi` types it. */
 function createClient(endpoints, options = {}) {
 	const base = (options.baseUrl ?? "/api").replace(/\/$/, "");
 	const send = options.fetch ?? ((input, init) => fetch(input, init));
 	const listeners = /* @__PURE__ */ new Set();
-	async function call(method, path, { query, body, headers: extra, signedOutIsAnswer = false } = {}) {
+	const writes = writeQueue();
+	function call(method, path, options = {}) {
+		if (method === "GET") return attempt(method, path, options);
+		const key = { "Idempotency-Key": ulid(/* @__PURE__ */ new Date()) };
+		return writes.add(() => retried((signal) => attempt(method, path, {
+			...options,
+			key,
+			signal
+		})));
+	}
+	async function attempt(method, path, { query, body, headers: extra, key, signal, signedOutIsAnswer = false }) {
 		const search = query && query.size > 0 ? `?${query.toString().replace(/=(?=&|$)/g, "")}` : "";
 		const headers = {
 			Accept: "application/json",
 			...options.headers,
-			...extra
+			...extra,
+			...key
 		};
 		const file = body instanceof Blob ? body : void 0;
 		if (file) {
@@ -183,8 +214,10 @@ function createClient(endpoints, options = {}) {
 		const response = await send(`${base}${path}${search}`, {
 			method,
 			headers,
-			...body === void 0 ? {} : { body: file ?? JSON.stringify(body) }
+			...body === void 0 ? {} : { body: file ?? JSON.stringify(body) },
+			...signal ? { signal } : {}
 		});
+		if (key && await lost(response)) throw new Lost();
 		if (response.status === 401 && signedOutIsAnswer) return void 0;
 		if (!response.ok) {
 			const error = await errorOf(response);
@@ -199,7 +232,8 @@ function createClient(endpoints, options = {}) {
 		onSignedOut(listener) {
 			listeners.add(listener);
 			return () => listeners.delete(listener);
-		}
+		},
+		onPending: writes.onPending
 	};
 	for (const [name, endpoint] of Object.entries(endpoints)) {
 		if (Object.hasOwn(api, name)) throw new TypeError(`isai: the client's ${name} is taken`);
@@ -207,6 +241,86 @@ function createClient(endpoints, options = {}) {
 	}
 	return api;
 }
+/** A try the network lost: sent again. */
+var Lost = class extends Error {};
+/**
+* A write's answer that isn't the app's: a 5xx from a proxy (every answer from the app carries
+* `X-Request-Id`), or the app saying the same key is still running.
+*/
+async function lost(response) {
+	if (response.status >= 500) return !response.headers.has("X-Request-Id");
+	if (response.status !== 409) return false;
+	return (await response.clone().json().catch(() => ({}))).error?.code === "InProgress";
+}
+/**
+* `run` until it's answered: again after each try the network lost, waiting longer each time and
+* for the browser to be online. A try in flight is aborted when the browser goes offline, since a
+* request on a dropped connection may never end.
+*/
+async function retried(run) {
+	for (let tries = 0;; tries++) {
+		const aborted = new AbortController();
+		const stop = on("offline", () => aborted.abort());
+		try {
+			return await run(aborted.signal);
+		} catch (error) {
+			if (!(error instanceof Lost) && !(error instanceof TypeError) && !aborted.signal.aborted) throw error;
+		} finally {
+			stop();
+		}
+		await Promise.all([pause(BACKOFF[Math.min(tries, BACKOFF.length - 1)]), online()]);
+	}
+}
+const pause = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/** Resolves once the browser is online (at once outside one). */
+function online() {
+	if (globalThis.navigator?.onLine !== false) return Promise.resolve();
+	return new Promise((resolve) => {
+		const stop = on("online", () => {
+			stop();
+			resolve();
+		});
+	});
+}
+/** Listens for a window event; nothing outside a browser. Returns the unsubscribe. */
+function on(event, listener) {
+	const target = globalThis;
+	if (typeof target.addEventListener !== "function") return () => {};
+	target.addEventListener(event, listener);
+	return () => globalThis.removeEventListener(event, listener);
+}
+/**
+* Writes one at a time, in the order they were added, each settling as it's done. A failed one
+* doesn't hold back the next. While any are waiting, closing the page asks first.
+*/
+function writeQueue() {
+	let last = Promise.resolve();
+	let pending = 0;
+	const listeners = /* @__PURE__ */ new Set();
+	let stopAsking;
+	const changed = (by) => {
+		pending += by;
+		if (pending > 0) stopAsking ??= on("beforeunload", (event) => event.preventDefault());
+		else {
+			stopAsking?.();
+			stopAsking = void 0;
+		}
+		for (const listener of [...listeners]) listener(pending);
+	};
+	return {
+		add(write) {
+			changed(1);
+			const done = last.then(write);
+			last = done.catch(() => void 0);
+			return done.finally(() => changed(-1));
+		},
+		onPending(listener) {
+			listeners.add(listener);
+			listener(pending);
+			return () => listeners.delete(listener);
+		}
+	};
+}
 const segment = (value) => encodeURIComponent(String(value));
 function resourceCalls(call, endpoint) {
 	const base = endpoint.resource;

package/dist/{create-auth-9y_43vJf.js → create-auth-BFKvQVOG.js}

@@ -1,6 +1,6 @@
-import { t as fromBase64url } from "./base64url-C5GTYIL5.js";
-import { n as PROVIDERS } from "./tables-IrLjsomf.js";
-import { a as byRole, c as tenant, i as anyone, l as user, n as PolicyRegistry, o as owner, s as readsTenant } from "./policies-D_G5Rmxv.js";
+import { I as fromBase64url } from "./model-Dc3HunKb.js";
+import { n as PROVIDERS } from "./tables-DgSwge7s.js";
+import { a as byRole, c as tenant, i as anyone, l as user, n as PolicyRegistry, o as owner, s as readsTenant } from "./policies-KsqmlX67.js";
 //#region src/auth/create-auth.ts
 const methods = { oauth: (provider, options) => ({
 	kind: "oauth",
@@ -23,8 +23,8 @@ var Auth = class {
 	perms = authPerms;
 	/** The policies made with this instance's `policy()`. */
 	policies = new PolicyRegistry();
-	/** Set by the app's core when it starts: `invite` on its current database. */
-	invites;
+	/** Set by the app's core when it starts: `invite` and `revoke` on its current database. */
+	people;
 	constructor(define) {
 		this.define = define;
 	}
@@ -34,12 +34,20 @@ var Auth = class {
 	* `held: "platform"` puts the assignment beyond the tenant's reach.
 	*/
 	invite(input) {
-		if (!this.invites) return Promise.reject(/* @__PURE__ */ new Error("isai: auth.invite is used before the runtime started the app"));
-		return this.invites(input);
+		if (!this.people) return Promise.reject(/* @__PURE__ */ new Error("isai: auth.invite is used before the runtime started the app"));
+		return this.people.invite(input);
 	}
-	/** The core's: where `invite` writes. */
-	attach(invites) {
-		this.invites = invites;
+	/**
+	* Takes a role from `email`, from code (replacing a tenant's owner): its invite to the role is
+	* deleted, and the role taken away if it has an account in the current database. Safe to repeat.
+	*/
+	revoke(input) {
+		if (!this.people) return Promise.reject(/* @__PURE__ */ new Error("isai: auth.revoke is used before the runtime started the app"));
+		return this.people.revoke(input);
+	}
+	/** The core's: where `invite` and `revoke` write. */
+	attach(people) {
+		this.people = people;
 	}
 	/** The config, for this env. Checked here for itself; against the databases by the core. */
 	resolve(env) {

package/dist/{data-layer-D1BFo3wO.d.ts → data-layer-43pme0Gy.d.ts}

@@ -1,7 +1,7 @@
 import { a as DatabaseDriver, o as DialectName } from "./index-Ce5p2-EB.js";
 import { t as Issue } from "./issues-CKto95IW.js";
 import { M as IdInput, Y as StoredFile } from "./index-CYcklQ1l.js";
-import { A as Dialect, G as Model, H as Columns, I as Clock, K as ModelSpec, M as RetiredSnapshot, N as SchemaSnapshot, U as ComputedFields, V as AnyModel, W as Fields, X as Condition, at as count, b as RowOf, dt as Kinds, et as Now, f as seed, ft as SchemaDefaults, ht as Field, i as Row, it as any, mt as AnyField, n as Patch, ot as not, p as Database, q as ModelRegistry, rt as all, yt as Slot } from "./types-S6zF5IXV.js";
+import { $ as Expr, A as Dialect, G as Model, H as Columns, I as Clock, K as ModelSpec, M as RetiredSnapshot, N as SchemaSnapshot, U as ComputedFields, V as AnyModel, W as Fields, X as Condition, at as count, b as RowOf, dt as Kinds, et as Now, f as seed, ft as SchemaDefaults, ht as Field, i as Row, it as any, mt as AnyField, n as Patch, ot as not, p as Database, q as ModelRegistry, rt as all, yt as Slot } from "./types-BgOkJy5d.js";
 //#region src/db/schema/traits.d.ts
 type ComputedDefinitions = Record<string, (row: any) => Condition>;
 interface TraitSpec {
@@ -948,6 +948,17 @@ type Base = Kinds & {
 type ProjectKinds<P> = { readonly [K in keyof P]: P[K] extends AnyField ? () => P[K] : P[K]; };
 /** The placeholder for conditions over a model's rows: `const event = row(Event)`. */
 declare function row<M extends AnyModel>(target: M): Columns<M["~fields"], M["name"]>;
+/** Every row of a model, for a rule that counts them. See `rows`. */
+interface TableRows<Rows> {
+  /** How many rows there are, or how many match. */
+  count(build?: (row: Rows) => Condition): Expr<number>;
+}
+/**
+ * Every row of a model, for a rule over all of them: `rows(Product).count()` in a policy's create
+ * rule caps how many a tenant may have (`create: rows(Product).count().lt(tenant.maxProducts)`).
+ * A create checks it with one query before the insert; two creates at once may both pass.
+ */
+declare function rows<M extends AnyModel>(target: M): TableRows<Columns<M["~fields"], M["name"]>>;
 declare function createDataLayer<P extends Record<string, ProjectKind> = {}, const U extends readonly AnyTableSet[] = []>(define?: (base: Base) => DataLayerDefinition<P, U>): {
   model: {
     <const Name extends string, const T extends readonly AnyTrait[], F extends Fields>(name: Name, ...rest: [...traits: T, fields: F]): Model<Name, TraitFields<T> & F>;
@@ -979,6 +990,7 @@ declare function createDataLayer<P extends Record<string, ProjectKind> = {}, con
   };
   defaults: Readonly<SchemaDefaults>;
   row: typeof row;
+  rows: typeof rows;
   all: typeof all;
   any: typeof any;
   not: typeof not;

package/dist/{data-layer-_TZtuy-F.js → data-layer-C5oJZ8V1.js}

@@ -1,7 +1,7 @@
 import { F as quantity, k as datetime, m as host, r as isPhoneRegion } from "./validation-Cppmd0RV.js";
-import "./migrator-BU3_PHk8.js";
-import { C as not, M as field, N as fieldKinds, S as count, s as defineModel, u as rowOf, v as all, w as now, y as any } from "./base64url-C5GTYIL5.js";
-import { a as TableSet, i as platformAuthDefinitions, o as defineBuiltins, r as authTables } from "./tables-IrLjsomf.js";
+import "./migrator-B25prc9n.js";
+import { D as now, E as not, S as any, T as count, a as defineModel, c as rowOf, d as fieldKinds, u as field, x as all, y as Relation } from "./model-Dc3HunKb.js";
+import { a as TableSet, i as platformAuthDefinitions, o as defineBuiltins, r as authTables } from "./tables-DgSwge7s.js";
 import { n as seed } from "./seed-BObmdKdP.js";
 //#region src/db/fields/slot.ts
 var Slot = class {
@@ -233,6 +233,18 @@ const isOptions = (value) => typeof value === "object" && value !== null && !(va
 function row(target) {
 	return rowOf(target.spec, target.registry);
 }
+/**
+* Every row of a model, for a rule over all of them: `rows(Product).count()` in a policy's create
+* rule caps how many a tenant may have (`create: rows(Product).count().lt(tenant.maxProducts)`).
+* A create checks it with one query before the insert; two creates at once may both pass.
+*/
+function rows(target) {
+	const { spec, registry } = target;
+	return new Relation({
+		table: spec.table,
+		column: ""
+	}, (inner) => rowOf(spec, registry, inner));
+}
 function checkDefaults(defaults) {
 	const { phoneRegion, currency } = defaults;
 	if (phoneRegion !== void 0 && !isPhoneRegion(phoneRegion)) throw new TypeError(`isai: defaults.phoneRegion "${phoneRegion}" isn't a region (an ISO country code such as "IN")`);
@@ -286,6 +298,7 @@ function createDataLayer(define) {
 		traits: builtinTraits(),
 		defaults,
 		row,
+		rows,
 		all,
 		any,
 		not,

package/dist/db/index.d.ts

@@ -1,4 +1,4 @@
 import { a as ValidationError } from "../issues-CKto95IW.js";
-import { $ as Expr, A as Dialect, B as newSecretKey, F as snapshotOf, G as Model, I as Clock, J as Models, K as ModelSpec, L as FixedClock, M as RetiredSnapshot, N as SchemaSnapshot, O as Write, P as emptySnapshot, R as fixedClock, V as AnyModel, X as Condition, Y as Column, _ as database, _t as Storage, a as Visible, at as count, bt as slot, c as Many, d as SeedContext, dt as Kinds, et as Now, ft as SchemaDefaults, g as Transaction, gt as FieldSpec, h as RawValue, ht as Field, i as Row, it as any, j as Rule, k as WriteListener, l as Overrides, lt as ConditionNode, m as DatabaseOptions, n as Patch, nt as Total, o as Make, ot as not, p as Database, pt as fieldKinds, r as Planned, rt as all, st as now, t as Insert, tt as Relation, u as Seed, v as OrderKey, vt as sensitivity, y as Query, yt as Slot, z as systemClock } from "../types-S6zF5IXV.js";
-import { A as MigrateOptions, B as NotFound, C as MigrationErrorCode, D as Cleanup, E as UnsafeMigration, F as DataStep, H as UniqueFailed, I as TODO, L as dataStep, M as migrate, N as migrateFresh, O as cleanupMigration, P as sync, R as CheckFailed, S as MigrationError, T as UnsafeChange, U as dialectFor, V as ReferenceFailed, W as sqlite, _ as Generated, b as manifest, c as acquireLock, d as setReleaseStatus, f as startRelease, g as makeMigrations, h as makeCleanup, j as Migration, k as Manifest, l as releaseLock, m as checkMigrations, n as row, o as Release, p as applyRules, s as ReleaseStatus, t as createDataLayer, u as rollback, v as generateMigration, w as SuspectedRename, x as structureStep, y as cleanupStep, z as DatabaseError } from "../data-layer-D1BFo3wO.js";
+import { $ as Expr, A as Dialect, B as newSecretKey, F as snapshotOf, G as Model, I as Clock, J as Models, K as ModelSpec, L as FixedClock, M as RetiredSnapshot, N as SchemaSnapshot, O as Write, P as emptySnapshot, R as fixedClock, V as AnyModel, X as Condition, Y as Column, _ as database, _t as Storage, a as Visible, at as count, bt as slot, c as Many, d as SeedContext, dt as Kinds, et as Now, ft as SchemaDefaults, g as Transaction, gt as FieldSpec, h as RawValue, ht as Field, i as Row, it as any, j as Rule, k as WriteListener, l as Overrides, lt as ConditionNode, m as DatabaseOptions, n as Patch, nt as Total, o as Make, ot as not, p as Database, pt as fieldKinds, r as Planned, rt as all, st as now, t as Insert, tt as Relation, u as Seed, v as OrderKey, vt as sensitivity, y as Query, yt as Slot, z as systemClock } from "../types-BgOkJy5d.js";
+import { A as MigrateOptions, B as NotFound, C as MigrationErrorCode, D as Cleanup, E as UnsafeMigration, F as DataStep, H as UniqueFailed, I as TODO, L as dataStep, M as migrate, N as migrateFresh, O as cleanupMigration, P as sync, R as CheckFailed, S as MigrationError, T as UnsafeChange, U as dialectFor, V as ReferenceFailed, W as sqlite, _ as Generated, b as manifest, c as acquireLock, d as setReleaseStatus, f as startRelease, g as makeMigrations, h as makeCleanup, j as Migration, k as Manifest, l as releaseLock, m as checkMigrations, n as row, o as Release, p as applyRules, s as ReleaseStatus, t as createDataLayer, u as rollback, v as generateMigration, w as SuspectedRename, x as structureStep, y as cleanupStep, z as DatabaseError } from "../data-layer-43pme0Gy.js";
 export { type AnyModel, CheckFailed, type Cleanup, type Clock, Column, Condition, type ConditionNode, type DataStep, Database, DatabaseError, type DatabaseOptions, type Dialect, Expr, Field, type FieldSpec, type FixedClock, type Generated, type Insert, type Kinds, type Make, type Manifest, type Many, type MigrateOptions, type Migration, MigrationError, type MigrationErrorCode, Model, type ModelSpec, type Models, NotFound, Now, type OrderKey, type Overrides, type Patch, type Planned, Query, type RawValue, ReferenceFailed, Relation, type Release, type ReleaseStatus, type RetiredSnapshot, type Row, type Rule, type SchemaDefaults, type SchemaSnapshot, Seed, type SeedContext, Slot, type Storage, type SuspectedRename, TODO, Total, Transaction, UniqueFailed, type UnsafeChange, UnsafeMigration, ValidationError, type Visible, type Write, type WriteListener, acquireLock, all, any, applyRules, checkMigrations, cleanupMigration, cleanupStep, count, createDataLayer, dataStep, database, dialectFor, emptySnapshot, fieldKinds, fixedClock, generateMigration, makeCleanup, makeMigrations, manifest, migrate, migrateFresh, newSecretKey, not, now, releaseLock, rollback, row, sensitivity, setReleaseStatus, slot, snapshotOf, sqlite, startRelease, structureStep, sync, systemClock };

package/dist/db/index.js

@@ -1,9 +1,9 @@
 import { G as ValidationError } from "../validation-Cppmd0RV.js";
-import { A as Query, C as database, F as systemClock, G as DatabaseError, I as newSecretKey, J as UniqueFailed, K as NotFound, M as dialectFor, N as sqlite, P as fixedClock, W as CheckFailed, _ as TODO, b as Database, c as rollback, d as applyRules, g as UnsafeMigration, h as snapshotOf, i as acquireLock, l as setReleaseStatus, m as emptySnapshot, n as migrateFresh, p as generateMigration, q as ReferenceFailed, r as sync, s as releaseLock, t as migrate, u as startRelease, v as dataStep, x as Transaction, y as MigrationError } from "../migrator-BU3_PHk8.js";
-import { C as not, F as sensitivity, N as fieldKinds, P as Field, S as count, _ as Total, d as Column, f as Condition, g as Relation, h as Now, m as Expr, r as Model, v as all, w as now, y as any } from "../base64url-C5GTYIL5.js";
-import { i as slot, n as row, r as Slot, t as createDataLayer } from "../data-layer-_TZtuy-F.js";
+import { C as database, F as dialectFor, G as newSecretKey, H as fixedClock, I as sqlite, J as NotFound, K as CheckFailed, M as Query, U as systemClock, X as UniqueFailed, Y as ReferenceFailed, _ as TODO, b as Database, c as rollback, d as applyRules, g as UnsafeMigration, h as snapshotOf, i as acquireLock, l as setReleaseStatus, m as emptySnapshot, n as migrateFresh, p as generateMigration, q as DatabaseError, r as sync, s as releaseLock, t as migrate, u as startRelease, v as dataStep, x as Transaction, y as MigrationError } from "../migrator-B25prc9n.js";
+import { D as now, E as not, S as any, T as count, _ as Expr, b as Total, d as fieldKinds, f as Field, h as Condition, m as Column, p as sensitivity, t as Model, v as Now, x as all, y as Relation } from "../model-Dc3HunKb.js";
+import { i as slot, n as row, r as Slot, t as createDataLayer } from "../data-layer-C5oJZ8V1.js";
 import { t as Seed } from "../seed-BObmdKdP.js";
-import { a as cleanupMigration, i as makeMigrations, r as makeCleanup, t as checkMigrations } from "../make-DKBn79cH.js";
+import { a as cleanupMigration, i as makeMigrations, r as makeCleanup, t as checkMigrations } from "../make-ByA-84h8.js";
 //#region src/db/migrations/files.ts
 /** A structure step file: adds tables and columns. Applied once, never edited. */
 function structureStep(options) {

package/dist/{index-DlgVg3D8.d.ts → index-a7ElyL3B.d.ts}

@@ -1,7 +1,22 @@
 import { a as DatabaseDriver, b as TenantDatabases, d as RateLimiter, g as Storage, l as PdfRenderer, n as Body, p as Runtime, r as Cache, s as MailDriver, u as Queue } from "./index-Ce5p2-EB.js";
 import { C as ObjectShape, Y as StoredFile, w as Output } from "./index-CYcklQ1l.js";
-import { $ as Expr, C as WithIncludes, D as PageOptions, E as Page, J as Models, Q as Embed, S as Key, T as NumberedPageOptions, V as AnyModel, X as Condition, Z as Conditional, b as RowOf, ct as ColumnNode, gt as FieldSpec, i as Row, lt as ConditionNode, n as Patch, p as Database, t as Insert, ut as Operand, v as OrderKey, w as NumberedPage, x as IncludePath } from "./types-S6zF5IXV.js";
-import { a as PROVIDERS, i as HELD, k as Manifest } from "./data-layer-D1BFo3wO.js";
+import { $ as Expr, C as WithIncludes, D as PageOptions, E as Page, J as Models, Q as Embed, S as Key, T as NumberedPageOptions, V as AnyModel, X as Condition, Z as Conditional, b as RowOf, ct as ColumnNode, gt as FieldSpec, i as Row, lt as ConditionNode, n as Patch, p as Database, t as Insert, u as Seed, ut as Operand, v as OrderKey, w as NumberedPage, x as IncludePath } from "./types-BgOkJy5d.js";
+import { a as PROVIDERS, i as HELD, k as Manifest } from "./data-layer-43pme0Gy.js";
+//#region src/api/fail.d.ts
+/**
+ * `fail(code, message)`: the app's own business rules, for what can't be a `.check()`, a flow or a
+ * unique. Always a 409; app code never picks a status.
+ */
+declare class Rejected extends Error {
+  /** Stable and machine-readable (`alreadyCheckedIn`). */
+  readonly code: string;
+  readonly name = "Rejected";
+  constructor(
+  /** Stable and machine-readable (`alreadyCheckedIn`). */
+  code: string, message: string);
+}
+declare function fail(code: string, message: string): never;
+//#endregion
 //#region src/auth/policies.d.ts
 /** The actions every model's policy has. */
 declare const STANDARD_ACTIONS: readonly ["read", "create", "update", "delete"];
@@ -16,6 +31,15 @@ interface BuiltinUser {
   readonly emailVerifiedAt: Date | null;
   readonly suspendedAt: Date | null;
 }
+type UserRow = Models extends {
+  readonly User: infer U extends AnyModel;
+} ? Row<U> : BuiltinUser;
+type TenantRow$1 = Models extends {
+  readonly Tenant: infer T extends AnyModel;
+} ? Row<T> : {
+  readonly id: string;
+  readonly name: string;
+};
 type Rules = Readonly<Record<string, Conditional>>;
 /** Each action's permission key, and `all` of them. */
 type Perms<Action extends string> = { readonly [K in Action]: string; } & {
@@ -55,21 +79,6 @@ interface DefinePolicy {
   <const N extends string, const R extends Rules>(name: N, rules: R): Policy<keyof R & string>;
 }
 //#endregion
-//#region src/api/fail.d.ts
-/**
- * `fail(code, message)`: the app's own business rules, for what can't be a `.check()`, a flow or a
- * unique. Always a 409; app code never picks a status.
- */
-declare class Rejected extends Error {
-  /** Stable and machine-readable (`alreadyCheckedIn`). */
-  readonly code: string;
-  readonly name = "Rejected";
-  constructor(
-  /** Stable and machine-readable (`alreadyCheckedIn`). */
-  code: string, message: string);
-}
-declare function fail(code: string, message: string): never;
-//#endregion
 //#region src/auth/roles.d.ts
 /** What a user's roles give them: every permission (`{ all: true }`), or these keys. */
 interface Permissions {
@@ -519,6 +528,12 @@ interface TenantHandle {
    * are copied (structured clones), so they're plain values.
    */
   run<S extends Service>(service: S, ...args: Parameters<S>): Promise<Awaited<ReturnType<S>>>;
+  /**
+   * Runs a seed from `db/seeds.ts` in the tenant, as `inTenant` does from the platform's seed: it
+   * fills only an empty database, so on one with rows it does nothing. On a deployed app too (a
+   * tenant filled with demo data).
+   */
+  run(seed: Seed): Promise<void>;
 }
 /** The app's seeds (`db/seeds.ts`), as a lazy import: `() => import("#db/seeds")`. */
 type AppSeeds = () => Promise<object>;
@@ -538,6 +553,11 @@ interface InviteInput {
   /** `"platform"`: the tenant's people can't take the role away. */
   readonly held?: (typeof HELD)[number];
 }
+/** What `auth.revoke` takes: an email, and the key of a role from `app.ts`. */
+interface RevokeInput {
+  readonly email: string;
+  readonly role: string;
+}
 //#endregion
 //#region src/auth/create-auth.d.ts
 type Provider = (typeof PROVIDERS)[number];
@@ -585,6 +605,11 @@ interface AuthConfig {
   /** Every permission key: every policy's actions, and `auth.perms`. */
   permissionKeys(): readonly string[];
 }
+/** `auth.invite` and `auth.revoke`, on the app's current database: the core's to attach. */
+interface AuthPeople {
+  invite(input: InviteInput): Promise<void>;
+  revoke(input: RevokeInput): Promise<void>;
+}
 declare class Auth<Env = unknown> {
   private readonly define;
   readonly perms: {
@@ -597,8 +622,8 @@ declare class Auth<Env = unknown> {
   };
   /** The policies made with this instance's `policy()`. */
   readonly policies: PolicyRegistry;
-  /** Set by the app's core when it starts: `invite` on its current database. */
-  private invites;
+  /** Set by the app's core when it starts: `invite` and `revoke` on its current database. */
+  private people;
   constructor(define: (env: Env) => AuthDefinition);
   /**
    * Gives `email` a role from `app.ts`, from code (a tenant's setup service, a seed): now, if it has
@@ -606,8 +631,13 @@ declare class Auth<Env = unknown> {
    * `held: "platform"` puts the assignment beyond the tenant's reach.
    */
   invite(input: InviteInput): Promise<void>;
-  /** The core's: where `invite` writes. */
-  attach(invites: (input: InviteInput) => Promise<void>): void;
+  /**
+   * Takes a role from `email`, from code (replacing a tenant's owner): its invite to the role is
+   * deleted, and the role taken away if it has an account in the current database. Safe to repeat.
+   */
+  revoke(input: RevokeInput): Promise<void>;
+  /** The core's: where `invite` and `revoke` write. */
+  attach(people: AuthPeople): void;
   /** The config, for this env. Checked here for itself; against the databases by the core. */
   resolve(env: Env): AuthConfig;
 }
@@ -616,18 +646,21 @@ type RoleDefinition = {
   readonly all: true;
 } | readonly string[];
 type Roles = Readonly<Record<string, RoleDefinition>>;
+/**
+ * What `createAuth` gives. Written out so `user` and `tenant` stay typed by the app's `Models`
+ * (its `User` and `Tenant` columns): an inferred type would be fixed to the built-in rows when
+ * isai's declarations are built.
+ */
+interface CreatedAuth<Env> {
+  readonly auth: Auth<Env>;
+  readonly policy: DefinePolicy;
+  readonly user: Bound<UserRow>;
+  readonly tenant: Bound<TenantRow$1>;
+  readonly owner: Condition;
+  readonly byRole: Condition;
+  readonly anyone: Condition;
+}
 /** The auth instance, from `auth.ts`, with `policy()` and the placeholders policies are written with. */
-declare function createAuth<Env = unknown>(define: (env: Env) => AuthDefinition): {
-  auth: Auth<Env>;
-  policy: DefinePolicy;
-  user: Bound<BuiltinUser>;
-  tenant: Bound<{
-    readonly id: string;
-    readonly name: string;
-  }>;
-  owner: Condition;
-  byRole: Condition;
-  anyone: Condition;
-};
+declare function createAuth<Env = unknown>(define: (env: Env) => AuthDefinition): CreatedAuth<Env>;
 //#endregion
-export { Permissions as A, Params as C, RouteHandler as D, RouteContext as E, DefinePolicy as F, Perms as I, Policy as L, fail as M, AnyPolicy as N, RouteOptions as O, Bound as P, Rules as R, Method as S, RouteBuilder as T, CustomAction as _, OAuthMethod as a, AppConfig as b, Roles as c, NotImplementedError as d, AppModules as f, createApp as g, CreatedApp as h, Methods as i, Rejected as j, User as k, SignInMethod as l, AppOptions as m, AuthConfig as n, Provider as o, App as p, AuthDefinition as r, RoleDefinition as s, Auth as t, createAuth as u, Resource as v, Route as w, Named as x, ResourceOptions as y, StandardAction as z };
+export { Permissions as A, Params as C, RouteHandler as D, RouteContext as E, Policy as F, Rules as I, StandardAction as L, Bound as M, DefinePolicy as N, RouteOptions as O, Perms as P, Rejected as R, Method as S, RouteBuilder as T, CustomAction as _, OAuthMethod as a, AppConfig as b, Roles as c, NotImplementedError as d, AppModules as f, createApp as g, CreatedApp as h, Methods as i, AnyPolicy as j, User as k, SignInMethod as l, AppOptions as m, AuthConfig as n, Provider as o, App as p, AuthDefinition as r, RoleDefinition as s, Auth as t, createAuth as u, Resource as v, Route as w, Named as x, ResourceOptions as y, fail as z };

package/dist/index.d.ts

@@ -1,3 +1,3 @@
 import { p as Runtime, t as AppCore } from "./index-Ce5p2-EB.js";
-import { C as Params, D as RouteHandler, E as RouteContext, M as fail, O as RouteOptions, S as Method, T as RouteBuilder, _ as CustomAction, b as AppConfig, d as NotImplementedError, f as AppModules, g as createApp, h as CreatedApp, j as Rejected, k as User, m as AppOptions, p as App, v as Resource, w as Route, x as Named, y as ResourceOptions } from "./index-DlgVg3D8.js";
+import { C as Params, D as RouteHandler, E as RouteContext, O as RouteOptions, R as Rejected, S as Method, T as RouteBuilder, _ as CustomAction, b as AppConfig, d as NotImplementedError, f as AppModules, g as createApp, h as CreatedApp, k as User, m as AppOptions, p as App, v as Resource, w as Route, x as Named, y as ResourceOptions, z as fail } from "./index-a7ElyL3B.js";
 export { type App, type AppConfig, type AppCore, type AppModules, type AppOptions, type CreatedApp, type CustomAction, type Method, type Named, NotImplementedError, type Params, Rejected, type Resource, type ResourceOptions, Route, type RouteBuilder, type RouteContext, type RouteHandler, type RouteOptions, type Runtime, type User, createApp, fail };