@isaijs/core 0.1.4 → 0.1.6

package/dist/{base64url-C5GTYIL5.js → model-Dc3HunKb.js}

@@ -1,5 +1,5 @@
 import { A as fakeUlid, C as text, D as choice, E as url, F as quantity, I as sequence, M as id, N as int, O as date, P as money, R as list, S as subdomain, T as token, W as kind, _ as newToken, a as file, b as slug, c as image, d as json, f as urls, g as markdown, h as line, j as flag, k as datetime, l as images, n as phoneKind, p as email, s as files, u as define, v as personName, w as textKind, x as slugify, y as secret } from "./validation-Cppmd0RV.js";
-import { n as snakeCase } from "./case-BnpcvhdW.js";
+import { n as snakeCase, r as ulid } from "./case-DpXlJCL9.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 //#region src/internal/scope.ts
 /**
@@ -19,58 +19,6 @@ var Scope = class {
 	}
 };
 //#endregion
-//#region src/internal/ulid.ts
-/**
-* ULIDs: 48 bits of milliseconds + 80 random bits, Crockford base32, 26 characters.
-* Generated in JS (works inside a D1 batch, the same on every driver) and sortable by time.
-*
-* Monotonic: ids made in the same millisecond (or after the clock stepped back) reuse the
-* last time and add one to the last random part, so ids always sort in the order they were
-* made within an isolate or process.
-*/
-const ALPHABET = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
-const RANDOM_LENGTH = 16;
-function encodeTime(time) {
-	let rest = time;
-	let text = "";
-	for (let i = 0; i < 10; i++) {
-		text = ALPHABET.charAt(rest % 32) + text;
-		rest = Math.floor(rest / 32);
-	}
-	return text;
-}
-function randomDigits() {
-	return Array.from(crypto.getRandomValues(new Uint8Array(RANDOM_LENGTH)), (byte) => byte % 32);
-}
-/** Adds one to base-32 digits in place; false when they were all at the maximum. */
-function increment(digits) {
-	for (let i = digits.length - 1; i >= 0; i--) {
-		if ((digits[i] ?? 0) < 31) {
-			digits[i] = (digits[i] ?? 0) + 1;
-			return true;
-		}
-		digits[i] = 0;
-	}
-	return false;
-}
-function monotonicUlid() {
-	let lastTime = -1;
-	let lastRandom = [];
-	return (now) => {
-		const time = now.getTime();
-		if (time > lastTime) {
-			lastTime = time;
-			lastRandom = randomDigits();
-		} else if (!increment(lastRandom)) {
-			lastTime += 1;
-			lastRandom = randomDigits();
-		}
-		return encodeTime(lastTime) + lastRandom.map((digit) => ALPHABET.charAt(digit)).join("");
-	};
-}
-/** The process-wide generator every write uses. */
-const ulid = monotonicUlid();
-//#endregion
 //#region src/db/orm/audit.ts
 /**
 * The audit log in the ORM's write path: which writes are recorded, who makes them, and the
@@ -196,287 +144,21 @@ function actionEntry(engine, model, rowId, action, context, user) {
 	return engine.dialect.insert(log, [entry], context);
 }
 //#endregion
-//#region src/db/fields/field.ts
-var Field = class Field {
-	spec;
-	constructor(spec) {
-		this.spec = spec;
-	}
-	/** The kind behind the field, so a field works anywhere a shape does (route inputs, `validate`). */
-	get "~kind"() {
-		return this.spec.kind;
-	}
-	get "~standard"() {
-		return this.spec.kind["~standard"];
-	}
-	/** The field may be empty (`null`). Fields are required by default. */
-	optional() {
-		return new Field({
-			...this.spec,
-			kind: this.spec.kind.optional()
-		});
-	}
-	/** The value written when a create leaves the field out. */
-	default(value) {
-		return new Field({
-			...this.spec,
-			kind: this.spec.kind.default(value)
-		});
-	}
-	/** Narrows the kind's lower limit, for a business rule. */
-	min(limit) {
-		return new Field({
-			...this.spec,
-			kind: this.spec.kind.min(limit)
-		});
-	}
-	/** Narrows the kind's upper limit, for a business rule ("at most 8 images"). */
-	max(limit) {
-		return new Field({
-			...this.spec,
-			kind: this.spec.kind.max(limit)
-		});
-	}
-	unique() {
-		return new Field({
-			...this.spec,
-			unique: true
-		});
-	}
-	/** Stores the field in a column with another name (a field renamed in code keeps its column). */
-	column(name) {
-		return new Field({
-			...this.spec,
-			column: name
-		});
-	}
-	/** Set on create and never changed: updates can't name it (a type error, and a `fixed` issue). */
-	fixed() {
-		return new Field({
-			...this.spec,
-			fixed: true
-		});
-	}
-	/**
-	* The changes a choice allows, from each value to the ones it may become; any other change of a
-	* stored value fails (`notAllowed`), whoever writes it. A value missing from the keys is final.
-	*
-	*   f.choice(["pending", "confirmed", "cancelled"]).flow({ pending: ["confirmed", "cancelled"], confirmed: ["cancelled"] })
-	*/
-	flow(transitions) {
-		const choices = this.spec.kind.spec.choices;
-		if (!choices) throw new TypeError("isai: .flow() is for a choice");
-		for (const [from, to] of Object.entries(transitions)) for (const value of [from, ...to]) if (!choices.includes(value)) throw new TypeError(`isai: .flow() names "${value}", which isn't a choice`);
-		return new Field({
-			...this.spec,
-			flow: transitions
-		});
-	}
-	/**
-	* A copy of a related row's value (`.from((s) => s.criterion.maxScore)`), so the row's checks and
-	* uniques can use it. The database writes it on create and keeps it equal to its source (triggers
-	* on each table along the path, so raw SQL writes are seen too); it's never written. The path's
-	* first ref must be `.fixed()`; when every step and the final field are fixed, it's written once
-	* and no trigger is made. A plain path to one column only: a derived value is `.computed()`, and a
-	* value frozen as it was is a snapshot, not a copy.
-	*/
-	from(build) {
-		if (this.spec.maintained || this.spec.computed || this.spec.generate) throw new TypeError("isai: .from() is for a plain field (not one the database or the framework makes)");
-		return new Field({
-			...this.spec,
-			maintained: {
-				by: "copy",
-				build,
-				node: void 0
-			}
-		});
-	}
-	/** Fills a module's slot. The field's values must be the slot's (a `string` slot takes no `f.int()`). */
-	slot(slot) {
-		if (this.spec.slots.some((filled) => filled.name === slot.spec.name)) throw new TypeError(`isai: the field already fills the slot ${slot.spec.name}`);
-		return new Field({
-			...this.spec,
-			slots: [...this.spec.slots, slot.spec]
-		});
-	}
-	/** On a ref: the row this one belongs to. At most one per model. */
-	parent() {
-		this.refSpec("parent");
-		return new Field({
-			...this.spec,
-			parent: true
-		});
-	}
-	/** On a ref: deleting the referenced row deletes this one. */
-	cascade() {
-		return new Field({
-			...this.spec,
-			ref: {
-				...this.refSpec("cascade"),
-				onDelete: "cascade"
-			}
-		});
-	}
-	/** On an optional ref: deleting the referenced row empties this field. */
-	setNull() {
-		return new Field({
-			...this.spec,
-			ref: {
-				...this.refSpec("setNull"),
-				onDelete: "setNull"
-			}
-		});
-	}
-	refSpec(modifier) {
-		if (!this.spec.ref) throw new TypeError(`isai: ${modifier}() is only for ref fields`);
-		return this.spec.ref;
-	}
-};
-/**
-* How sensitive a field's values are, from its kind and the slots it fills; `hidden` wins over
-* `personal`. Rows in services stay complete: the output layer applies it.
-*/
-function sensitivity(spec) {
-	const marks = [spec.kind.spec.sensitive, ...spec.slots.map((slot) => slot.sensitive)];
-	if (marks.includes("hidden")) return "hidden";
-	if (marks.includes("personal")) return "personal";
-}
-//#endregion
-//#region src/db/fields/kinds.ts
-/**
-* The built-in field kinds: each is a kind from `isai/validation` with its storage. Kinds own
-* their limits and rules; columns never repeat them.
-*/
-function fieldSpec(kind, storage, options) {
-	return {
-		kind,
-		storage,
-		unique: false,
-		column: void 0,
-		ref: void 0,
-		fixed: false,
-		parent: false,
-		generate: void 0,
-		computed: void 0,
-		flow: void 0,
-		maintained: void 0,
-		encrypted: false,
-		slots: [],
-		...options
-	};
-}
-/** A field of a kind, stored as `storage`. */
-function field(kind, storage, options = {}) {
-	return new Field(fieldSpec(kind, storage, options));
-}
-/** A field the framework fills when a create leaves it out, so writes may omit it. */
-function filled(kind, storage, options = {}) {
-	return new Field(fieldSpec(kind, storage, options));
+//#region src/internal/base64url.ts
+/** base64url without padding: how isai writes random bytes as text (keys, tokens, signatures). */
+function toBase64url(bytes) {
+	return btoa(String.fromCharCode(...bytes)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
-const STORAGE_OF = {
-	text: "text",
-	integer: "integer",
-	number: "real",
-	boolean: "boolean"
-};
-/** The kinds every project gets as `f`. `defaults` is read when a value is checked. */
-function fieldKinds(defaults) {
-	function slug$1(options = {}) {
-		const { from } = options;
-		if (from === void 0) return field(slug(), "text", { unique: true });
-		return filled(slug(), "text", {
-			unique: true,
-			generate: {
-				from,
-				make: (values) => slugify(String(values[from] ?? "")) || void 0
-			}
-		});
+/** The bytes, or undefined when `text` isn't base64url. */
+function fromBase64url(text) {
+	if (!/^[A-Za-z0-9_-]*$/.test(text)) return void 0;
+	try {
+		const binary = atob(text.replace(/-/g, "+").replace(/_/g, "/"));
+		return Uint8Array.from(binary, (c) => c.charCodeAt(0));
+	} catch {
+		return;
 	}
-	return {
-		line: () => field(line(), "text"),
-		text: () => field(text(), "text"),
-		markdown: () => field(markdown(), "text"),
-		personName: () => field(personName(), "text"),
-		email: () => field(email(), "text"),
-		phone: () => field(phoneKind(() => defaults().phoneRegion), "text"),
-		url: () => field(url(), "text"),
-		urls: () => field(urls(), "json"),
-		slug: slug$1,
-		/** A tenant's subdomain on the platform: one DNS label, 3–63, not a reserved name. */
-		subdomain: () => field(subdomain(), "text"),
-		/** Encrypted at rest with the database's `secretKey`, and hidden. Never compared, ordered or unique. */
-		secret: () => field(secret(), "text", { encrypted: true }),
-		/**
-		* A human-friendly number made by the database on create (`f.sequence({ prefix: "ORD-" })`):
-		* `ORD-0042` in code and JSON, stored as its number, so it orders as one.
-		*/
-		sequence: (options = {}) => field(sequence(options), "integer", {
-			unique: true,
-			maintained: { by: "sequence" }
-		}),
-		/**
-		* How many rows of a reverse relation there are (`f.count({ of: "members" })`), or how many match
-		* `where` (over their own fields). Kept by the database as they're created, changed and deleted,
-		* so checks can use it (`e.confirmedCount.lte(e.capacity)`).
-		*/
-		count: (options) => field(quantity(), "integer", { maintained: {
-			by: "count",
-			of: options.of,
-			where: options.where
-		} }),
-		/** Random and unique, made on create. */
-		token: () => filled(token(), "text", {
-			unique: true,
-			generate: {
-				from: void 0,
-				make: newToken
-			}
-		}),
-		int: () => field(int(), "integer"),
-		quantity: () => field(quantity(), "integer"),
-		money: () => field(money(), "integer"),
-		flag: () => field(flag(), "boolean"),
-		datetime: () => field(datetime(), "datetime"),
-		date: () => field(date(), "date"),
-		choice: (values) => field(choice(values), "text"),
-		/** A JSON value of a shape (`{ shape: { name: f.line() } }`, or `f.list(...)`). */
-		json: (options) => field(json(options.shape), "json"),
-		/** A list, for shapes (`f.json({ shape: f.list(...) })`, route inputs). Not a column itself. */
-		list,
-		/** A file; `{ storage }` names a storage other than `default`. */
-		file: (options = {}) => field(file(options), "json"),
-		image: (options = {}) => field(image(options), "json"),
-		files: (options = {}) => field(files(options), "json"),
-		images: (options = {}) => field(images(options), "json"),
-		/** A row of another model, by its id. Restricts deletes of that row unless `.cascade()` / `.setNull()`. */
-		ref: (model, options = {}) => new Field(fieldSpec(id(`a ${model} id`), "text", { ref: {
-			model,
-			onDelete: "restrict",
-			related: options.related
-		} })),
-		/** A project kind: a base type, a normalisation and a rule. */
-		define: (definition) => field(define(definition), STORAGE_OF[definition.type])
-	};
 }
-/**
-* The fields every model has without declaring them. The framework fills them on every write
-* (a ULID, the clock's time), so their type says "defaulted" and writes may omit them.
-*/
-function implicitFields() {
-	return {
-		id: filled(textKind("id", {
-			max: 255,
-			fake: fakeUlid
-		}), "text"),
-		createdAt: filled(datetime(), "datetime"),
-		updatedAt: filled(datetime(), "datetime")
-	};
-}
-const IMPLICIT_FIELDS = [
-	"id",
-	"createdAt",
-	"updatedAt"
-];
 //#endregion
 //#region src/db/conditions/ast.ts
 /** Every node in a tree, depth first. */
@@ -529,6 +211,64 @@ function* nodesOf(node) {
 		case "placeholder": return;
 	}
 }
+/**
+* The condition with each operand `swap` replaces (it returns the operand itself to keep it),
+* looking inside arithmetic and conditions used as values. A relation's own rows (an aggregate's
+* `where`, a `some`) are left as they are.
+*/
+function mapOperands(node, swap) {
+	const operand = (o) => {
+		const swapped = swap(o);
+		if (swapped !== o) return swapped;
+		switch (o.t) {
+			case "math": return {
+				...o,
+				left: operand(o.left),
+				right: operand(o.right)
+			};
+			case "coalesce": return {
+				...o,
+				items: o.items.map(operand)
+			};
+			case "local": return {
+				...o,
+				operand: operand(o.operand)
+			};
+			case "truth": return {
+				...o,
+				condition: mapOperands(o.condition, swap)
+			};
+			default: return o;
+		}
+	};
+	switch (node.t) {
+		case "compare": return {
+			...node,
+			left: operand(node.left),
+			right: operand(node.right)
+		};
+		case "isNull":
+		case "in":
+		case "text": return {
+			...node,
+			operand: operand(node.operand)
+		};
+		case "and":
+		case "or": return {
+			...node,
+			items: node.items.map((item) => mapOperands(item, swap))
+		};
+		case "not": return {
+			...node,
+			item: mapOperands(node.item, swap)
+		};
+		default: return node;
+	}
+}
+/** A condition's totals over a whole table (`rows(Product).count()`): aggregates with no owner. */
+function tableTotals(node) {
+	return [...nodesOf(node)].filter((n) => n.t === "aggregate" && !n.relation.owner);
+}
 /** The row's own fields a condition reads, in first-seen order (refs and relations excluded). */
 function fieldsOf(node) {
 	const fields = /* @__PURE__ */ new Set();
@@ -845,88 +585,370 @@ var Relation = class {
 	sum(build, where) {
 		return this.aggregate("sum", build, where, void 0);
 	}
-	/** The smallest value over the related rows, or those that match (null when there are none). */
-	min(build, where) {
-		return this.aggregate("min", build, where, void 0);
+	/** The smallest value over the related rows, or those that match (null when there are none). */
+	min(build, where) {
+		return this.aggregate("min", build, where, void 0);
+	}
+	/** The largest value over the related rows, or those that match (null when there are none). */
+	max(build, where) {
+		return this.aggregate("max", build, where, void 0);
+	}
+	aggregate(fn, value, where, storage) {
+		const scope = newScope();
+		const rows = this.rows(scope);
+		const valueNode = value?.(rows).node;
+		return new Expr({
+			t: "aggregate",
+			fn,
+			relation: {
+				...this.relation,
+				scope
+			},
+			value: valueNode,
+			where: where?.(rows).node,
+			storage: storage ?? (valueNode ? storageOf(valueNode) : void 0) ?? "real"
+		});
+	}
+};
+/** The storage of an operand's value, when it's known (for encoding the literals compared with it). */
+function storageOf(node) {
+	switch (node.t) {
+		case "column":
+		case "aggregate": return node.storage;
+		case "now": return "datetime";
+		case "math": return node.op === "/" ? "real" : storageOf(node.left) ?? storageOf(node.right);
+		case "coalesce": return node.items.map(storageOf).find((storage) => storage !== void 0);
+		case "local": return node.unit === "date" ? "date" : "text";
+		case "truth": return "boolean";
+		case "total": return node.storage;
+		case "value":
+		case "bound": return;
+	}
+}
+/** A computed value's node: an expression, or a condition used as a value. */
+function valueNode(value) {
+	if (value instanceof Condition) return {
+		t: "truth",
+		condition: value.node
+	};
+	if (value instanceof Expr) return value.node;
+	throw new TypeError("isai: a computed field must be an expression or a condition");
+}
+/** A condition's node, from a condition or a boolean computed field. */
+function conditionNode(value) {
+	if (value instanceof Condition) return value.node;
+	if (value instanceof Expr && value.node.t === "truth") return value.node.condition;
+	if (value instanceof Expr) return {
+		t: "compare",
+		op: "=",
+		left: value.node,
+		right: {
+			t: "value",
+			value: true
+		}
+	};
+	throw new TypeError("isai: a condition is expected here (row(Model).field.is(…), any(…), byRole)");
+}
+/** As a condition: a condition, or a boolean computed field. */
+const asCondition = (value) => value instanceof Condition ? value : new Condition(conditionNode(value));
+function all(...conditions) {
+	return new Condition({
+		t: "and",
+		items: conditions.map(conditionNode)
+	});
+}
+/** Any of them (OR). */
+function any(...conditions) {
+	return new Condition({
+		t: "or",
+		items: conditions.map(conditionNode)
+	});
+}
+function not(condition) {
+	return asCondition(condition).not();
+}
+//#endregion
+//#region src/db/fields/field.ts
+var Field = class Field {
+	spec;
+	constructor(spec) {
+		this.spec = spec;
+	}
+	/** The kind behind the field, so a field works anywhere a shape does (route inputs, `validate`). */
+	get "~kind"() {
+		return this.spec.kind;
+	}
+	get "~standard"() {
+		return this.spec.kind["~standard"];
+	}
+	/** The field may be empty (`null`). Fields are required by default. */
+	optional() {
+		return new Field({
+			...this.spec,
+			kind: this.spec.kind.optional()
+		});
+	}
+	/** The value written when a create leaves the field out. */
+	default(value) {
+		return new Field({
+			...this.spec,
+			kind: this.spec.kind.default(value)
+		});
+	}
+	/** Narrows the kind's lower limit, for a business rule. */
+	min(limit) {
+		return new Field({
+			...this.spec,
+			kind: this.spec.kind.min(limit)
+		});
+	}
+	/** Narrows the kind's upper limit, for a business rule ("at most 8 images"). */
+	max(limit) {
+		return new Field({
+			...this.spec,
+			kind: this.spec.kind.max(limit)
+		});
+	}
+	unique() {
+		return new Field({
+			...this.spec,
+			unique: true
+		});
+	}
+	/** Stores the field in a column with another name (a field renamed in code keeps its column). */
+	column(name) {
+		return new Field({
+			...this.spec,
+			column: name
+		});
+	}
+	/** Set on create and never changed: updates can't name it (a type error, and a `fixed` issue). */
+	fixed() {
+		return new Field({
+			...this.spec,
+			fixed: true
+		});
+	}
+	/**
+	* The changes a choice allows, from each value to the ones it may become; any other change of a
+	* stored value fails (`notAllowed`), whoever writes it. A value missing from the keys is final.
+	*
+	*   f.choice(["pending", "confirmed", "cancelled"]).flow({ pending: ["confirmed", "cancelled"], confirmed: ["cancelled"] })
+	*/
+	flow(transitions) {
+		const choices = this.spec.kind.spec.choices;
+		if (!choices) throw new TypeError("isai: .flow() is for a choice");
+		for (const [from, to] of Object.entries(transitions)) for (const value of [from, ...to]) if (!choices.includes(value)) throw new TypeError(`isai: .flow() names "${value}", which isn't a choice`);
+		return new Field({
+			...this.spec,
+			flow: transitions
+		});
+	}
+	/**
+	* A copy of a related row's value (`.from((s) => s.criterion.maxScore)`), so the row's checks and
+	* uniques can use it. The database writes it on create and keeps it equal to its source (triggers
+	* on each table along the path, so raw SQL writes are seen too); it's never written. The path's
+	* first ref must be `.fixed()`; when every step and the final field are fixed, it's written once
+	* and no trigger is made. A plain path to one column only: a derived value is `.computed()`, and a
+	* value frozen as it was is a snapshot, not a copy.
+	*/
+	from(build) {
+		if (this.spec.maintained || this.spec.computed || this.spec.generate) throw new TypeError("isai: .from() is for a plain field (not one the database or the framework makes)");
+		return new Field({
+			...this.spec,
+			maintained: {
+				by: "copy",
+				build,
+				node: void 0
+			}
+		});
+	}
+	/** Fills a module's slot. The field's values must be the slot's (a `string` slot takes no `f.int()`). */
+	slot(slot) {
+		if (this.spec.slots.some((filled) => filled.name === slot.spec.name)) throw new TypeError(`isai: the field already fills the slot ${slot.spec.name}`);
+		return new Field({
+			...this.spec,
+			slots: [...this.spec.slots, slot.spec]
+		});
+	}
+	/** On a ref: the row this one belongs to. At most one per model. */
+	parent() {
+		this.refSpec("parent");
+		return new Field({
+			...this.spec,
+			parent: true
+		});
 	}
-	/** The largest value over the related rows, or those that match (null when there are none). */
-	max(build, where) {
-		return this.aggregate("max", build, where, void 0);
+	/** On a ref: deleting the referenced row deletes this one. */
+	cascade() {
+		return new Field({
+			...this.spec,
+			ref: {
+				...this.refSpec("cascade"),
+				onDelete: "cascade"
+			}
+		});
 	}
-	aggregate(fn, value, where, storage) {
-		const scope = newScope();
-		const rows = this.rows(scope);
-		const valueNode = value?.(rows).node;
-		return new Expr({
-			t: "aggregate",
-			fn,
-			relation: {
-				...this.relation,
-				scope
-			},
-			value: valueNode,
-			where: where?.(rows).node,
-			storage: storage ?? (valueNode ? storageOf(valueNode) : void 0) ?? "real"
+	/** On an optional ref: deleting the referenced row empties this field. */
+	setNull() {
+		return new Field({
+			...this.spec,
+			ref: {
+				...this.refSpec("setNull"),
+				onDelete: "setNull"
+			}
 		});
 	}
-};
-/** The storage of an operand's value, when it's known (for encoding the literals compared with it). */
-function storageOf(node) {
-	switch (node.t) {
-		case "column":
-		case "aggregate": return node.storage;
-		case "now": return "datetime";
-		case "math": return node.op === "/" ? "real" : storageOf(node.left) ?? storageOf(node.right);
-		case "coalesce": return node.items.map(storageOf).find((storage) => storage !== void 0);
-		case "local": return node.unit === "date" ? "date" : "text";
-		case "truth": return "boolean";
-		case "total": return node.storage;
-		case "value":
-		case "bound": return;
+	refSpec(modifier) {
+		if (!this.spec.ref) throw new TypeError(`isai: ${modifier}() is only for ref fields`);
+		return this.spec.ref;
 	}
+};
+/**
+* How sensitive a field's values are, from its kind and the slots it fills; `hidden` wins over
+* `personal`. Rows in services stay complete: the output layer applies it.
+*/
+function sensitivity(spec) {
+	const marks = [spec.kind.spec.sensitive, ...spec.slots.map((slot) => slot.sensitive)];
+	if (marks.includes("hidden")) return "hidden";
+	if (marks.includes("personal")) return "personal";
 }
-/** A computed value's node: an expression, or a condition used as a value. */
-function valueNode(value) {
-	if (value instanceof Condition) return {
-		t: "truth",
-		condition: value.node
+//#endregion
+//#region src/db/fields/kinds.ts
+/**
+* The built-in field kinds: each is a kind from `isai/validation` with its storage. Kinds own
+* their limits and rules; columns never repeat them.
+*/
+function fieldSpec(kind, storage, options) {
+	return {
+		kind,
+		storage,
+		unique: false,
+		column: void 0,
+		ref: void 0,
+		fixed: false,
+		parent: false,
+		generate: void 0,
+		computed: void 0,
+		flow: void 0,
+		maintained: void 0,
+		encrypted: false,
+		slots: [],
+		...options
 	};
-	if (value instanceof Expr) return value.node;
-	throw new TypeError("isai: a computed field must be an expression or a condition");
 }
-/** A condition's node, from a condition or a boolean computed field. */
-function conditionNode(value) {
-	if (value instanceof Condition) return value.node;
-	if (value instanceof Expr && value.node.t === "truth") return value.node.condition;
-	if (value instanceof Expr) return {
-		t: "compare",
-		op: "=",
-		left: value.node,
-		right: {
-			t: "value",
-			value: true
-		}
-	};
-	throw new TypeError("isai: a condition is expected here (row(Model).field.is(…), any(…), byRole)");
+/** A field of a kind, stored as `storage`. */
+function field(kind, storage, options = {}) {
+	return new Field(fieldSpec(kind, storage, options));
 }
-/** As a condition: a condition, or a boolean computed field. */
-const asCondition = (value) => value instanceof Condition ? value : new Condition(conditionNode(value));
-function all(...conditions) {
-	return new Condition({
-		t: "and",
-		items: conditions.map(conditionNode)
-	});
+/** A field the framework fills when a create leaves it out, so writes may omit it. */
+function filled(kind, storage, options = {}) {
+	return new Field(fieldSpec(kind, storage, options));
 }
-/** Any of them (OR). */
-function any(...conditions) {
-	return new Condition({
-		t: "or",
-		items: conditions.map(conditionNode)
-	});
+const STORAGE_OF = {
+	text: "text",
+	integer: "integer",
+	number: "real",
+	boolean: "boolean"
+};
+/** The kinds every project gets as `f`. `defaults` is read when a value is checked. */
+function fieldKinds(defaults) {
+	function slug$1(options = {}) {
+		const { from } = options;
+		if (from === void 0) return field(slug(), "text", { unique: true });
+		return filled(slug(), "text", {
+			unique: true,
+			generate: {
+				from,
+				make: (values) => slugify(String(values[from] ?? "")) || void 0
+			}
+		});
+	}
+	return {
+		line: () => field(line(), "text"),
+		text: () => field(text(), "text"),
+		markdown: () => field(markdown(), "text"),
+		personName: () => field(personName(), "text"),
+		email: () => field(email(), "text"),
+		phone: () => field(phoneKind(() => defaults().phoneRegion), "text"),
+		url: () => field(url(), "text"),
+		urls: () => field(urls(), "json"),
+		slug: slug$1,
+		/** A tenant's subdomain on the platform: one DNS label, 3–63, not a reserved name. */
+		subdomain: () => field(subdomain(), "text"),
+		/** Encrypted at rest with the database's `secretKey`, and hidden. Never compared, ordered or unique. */
+		secret: () => field(secret(), "text", { encrypted: true }),
+		/**
+		* A human-friendly number made by the database on create (`f.sequence({ prefix: "ORD-" })`):
+		* `ORD-0042` in code and JSON, stored as its number, so it orders as one.
+		*/
+		sequence: (options = {}) => field(sequence(options), "integer", {
+			unique: true,
+			maintained: { by: "sequence" }
+		}),
+		/**
+		* How many rows of a reverse relation there are (`f.count({ of: "members" })`), or how many match
+		* `where` (over their own fields). Kept by the database as they're created, changed and deleted,
+		* so checks can use it (`e.confirmedCount.lte(e.capacity)`).
+		*/
+		count: (options) => field(quantity(), "integer", { maintained: {
+			by: "count",
+			of: options.of,
+			where: options.where
+		} }),
+		/** Random and unique, made on create. */
+		token: () => filled(token(), "text", {
+			unique: true,
+			generate: {
+				from: void 0,
+				make: newToken
+			}
+		}),
+		int: () => field(int(), "integer"),
+		quantity: () => field(quantity(), "integer"),
+		money: () => field(money(), "integer"),
+		flag: () => field(flag(), "boolean"),
+		datetime: () => field(datetime(), "datetime"),
+		date: () => field(date(), "date"),
+		choice: (values) => field(choice(values), "text"),
+		/** A JSON value of a shape (`{ shape: { name: f.line() } }`, or `f.list(...)`). */
+		json: (options) => field(json(options.shape), "json"),
+		/** A list, for shapes (`f.json({ shape: f.list(...) })`, route inputs). Not a column itself. */
+		list,
+		/** A file; `{ storage }` names a storage other than `default`. */
+		file: (options = {}) => field(file(options), "json"),
+		image: (options = {}) => field(image(options), "json"),
+		files: (options = {}) => field(files(options), "json"),
+		images: (options = {}) => field(images(options), "json"),
+		/** A row of another model, by its id. Restricts deletes of that row unless `.cascade()` / `.setNull()`. */
+		ref: (model, options = {}) => new Field(fieldSpec(id(`a ${model} id`), "text", { ref: {
+			model,
+			onDelete: "restrict",
+			related: options.related
+		} })),
+		/** A project kind: a base type, a normalisation and a rule. */
+		define: (definition) => field(define(definition), STORAGE_OF[definition.type])
+	};
 }
-function not(condition) {
-	return asCondition(condition).not();
+/**
+* The fields every model has without declaring them. The framework fills them on every write
+* (a ULID, the clock's time), so their type says "defaulted" and writes may omit them.
+*/
+function implicitFields() {
+	return {
+		id: filled(textKind("id", {
+			max: 255,
+			fake: fakeUlid
+		}), "text"),
+		createdAt: filled(datetime(), "datetime"),
+		updatedAt: filled(datetime(), "datetime")
+	};
 }
+const IMPLICIT_FIELDS = [
+	"id",
+	"createdAt",
+	"updatedAt"
+];
 //#endregion
 //#region src/db/schema/rows.ts
 /**
@@ -1292,20 +1314,4 @@ function defineModel(registry, name, declared, traits = [], origin = {}) {
 	return Object.keys(computed).length > 0 ? model.computed(computed) : model;
 }
 //#endregion
-//#region src/internal/base64url.ts
-/** base64url without padding: how isai writes random bytes as text (keys, tokens, signatures). */
-function toBase64url(bytes) {
-	return btoa(String.fromCharCode(...bytes)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-/** The bytes, or undefined when `text` isn't base64url. */
-function fromBase64url(text) {
-	if (!/^[A-Za-z0-9_-]*$/.test(text)) return void 0;
-	try {
-		const binary = atob(text.replace(/-/g, "+").replace(/_/g, "/"));
-		return Uint8Array.from(binary, (c) => c.charCodeAt(0));
-	} catch {
-		return;
-	}
-}
-//#endregion
-export { unbound as A, aroundUpsert as B, not as C, nodesOf as D, fieldsOf as E, sensitivity as F, ulid as G, assertNotLog as H, actionEntry as I, Scope as K, aroundCreate as L, field as M, fieldKinds as N, readsNow as O, Field as P, aroundDelete as R, count as S, storageOf as T, isRecorded as U, asActor as V, wrap as W, Total as _, columnName as a, asCondition as b, fieldOf as c, Column as d, Condition as f, Relation as g, Now as h, assertNotEncrypted as i, IMPLICIT_FIELDS as j, readsOtherRows as k, computedFieldOf as l, Expr as m, toBase64url as n, columnNode as o, Embed as p, Model as r, defineModel as s, fromBase64url as t, rowOf as u, all as v, now as w, conditionNode as x, any as y, aroundUpdate as z };
+export { mapOperands as A, aroundDelete as B, asCondition as C, now as D, not as E, unbound as F, isRecorded as G, aroundUpsert as H, fromBase64url as I, wrap as K, toBase64url as L, readsNow as M, readsOtherRows as N, storageOf as O, tableTotals as P, actionEntry as R, any as S, count as T, asActor as U, aroundUpdate as V, assertNotLog as W, Expr as _, defineModel as a, Total as b, rowOf as c, fieldKinds as d, Field as f, Embed as g, Condition as h, columnNode as i, nodesOf as j, fieldsOf as k, IMPLICIT_FIELDS as l, Column as m, assertNotEncrypted as n, fieldOf as o, sensitivity as p, Scope as q, columnName as r, computedFieldOf as s, Model as t, field as u, Now as v, conditionNode as w, all as x, Relation as y, aroundCreate as z };