@isaijs/core 0.1.5 → 0.1.8

package/dist/index.js

@@ -1,14 +1,14 @@
-import { G as ValidationError, H as validate, V as toKind, h as line, o as fileTypeNames, p as email, z as object } from "./validation-Cppmd0RV.js";
-import { A as planUpdate, B as NeedsDatabase, C as database, D as recordAction, J as NotFound, L as PLATFORM, N as conditionOf, O as withTableTotals, P as modelOfRow, R as TENANT, S as clockOf, T as driverOf, U as systemClock, V as evaluate, X as UniqueFailed, j as keyCondition, k as planInsert, r as sync, t as migrate, w as decodeStored, z as checkTenancy } from "./migrator-B25prc9n.js";
-import { C as tooLarge, E as fail, S as tenantSuspended, T as Rejected, _ as json, b as routeNotFound, c as fromBody, d as route, f as HttpError, g as fileTypeRefused, h as fileTooLarge, l as readInput, m as errorResponse, o as parseListQuery, p as crossSiteRequest, r as resource, s as BODY_LIMIT, t as Resource, u as Route, v as lengthRequired, w as tooManyRequests, x as signInRequired, y as methodNotAllowed } from "./resource-BQK7bkPQ.js";
-import { C as asCondition$1, I as fromBase64url, L as toBase64url, U as asActor, _ as Expr, c as rowOf, h as Condition, o as fieldOf, p as sensitivity, q as Scope, r as columnName, t as Model } from "./model-Dc3HunKb.js";
+import { U as toKind, V as object, W as validate, _ as line, c as fileTypeNames, h as email, q as ValidationError } from "./validation-C3MCRBQO.js";
+import { A as planUpdate, B as checkTenancy, C as database, D as recordAction, F as modelOfRow, H as evaluate, N as conditionOf, O as withTableTotals, P as withIncludeRule, R as PLATFORM, S as clockOf, T as driverOf, V as NeedsDatabase, W as systemClock, Y as NotFound, Z as UniqueFailed, j as keyCondition, k as planInsert, r as sync, t as migrate, w as decodeStored, z as TENANT } from "./migrator-DxTpns_-.js";
+import { C as tooLarge, E as fail, S as tenantSuspended, T as Rejected, _ as json, b as routeNotFound, c as fromBody, d as route, f as HttpError, g as fileTypeRefused, h as fileTooLarge, l as readInput, m as errorResponse, o as parseListQuery, p as crossSiteRequest, r as resource, s as BODY_LIMIT, t as Resource, u as Route, v as lengthRequired, w as tooManyRequests, x as signInRequired, y as methodNotAllowed } from "./resource-BIMAiOre.js";
+import { C as asCondition$1, I as fromBase64url, L as toBase64url, U as asActor, _ as Expr, c as rowOf, h as Condition, o as fieldOf, p as sensitivity, q as Scope, r as columnName, t as Model } from "./model-6pJBqqGd.js";
 import { r as ulid, t as kebabCase } from "./case-DpXlJCL9.js";
 import { n as notImplemented, t as NotImplementedError } from "./errors-mCNLlXg9.js";
-import { t as PLATFORM_PREFIX } from "./tables-DgSwge7s.js";
+import { t as PLATFORM_PREFIX } from "./tables-DjW96Ubl.js";
 import { t as Seed } from "./seed-BObmdKdP.js";
-import { d as afterUpdate, f as bindFor, h as ownerFieldOf, m as isFalse, p as check, u as FALSE } from "./policies-KsqmlX67.js";
-import { i as checkRoles, n as authPerms, r as checkAuth } from "./create-auth-BHdX68Ng.js";
-import { _ as permissionsOf, a as hashOf, b as syncRoles, c as GoogleError, f as verifyIdToken, g as safeReturn, h as redirect, i as clearedCookie, l as consentUrl, m as cookieOf, n as authModels, o as sessions, p as cookie, t as makers, u as exchangeCode, v as roleKeys, y as seedAs } from "./makers-P9kg68C8.js";
+import { d as afterUpdate, f as bindFor, h as ownerFieldOf, m as isFalse, p as check, u as FALSE } from "./policies-C_oiSgmY.js";
+import { i as checkRoles, n as authPerms, r as checkAuth } from "./create-auth-BCvMwlVD.js";
+import { _ as permissionsOf, a as hashOf, b as syncRoles, c as GoogleError, f as verifyIdToken, g as safeReturn, h as redirect, i as clearedCookie, l as consentUrl, m as cookieOf, n as authModels, o as sessions, p as cookie, t as makers, u as exchangeCode, v as roleKeys, y as seedAs } from "./makers-A0Pj6Tda.js";
 import { t as WrongSize } from "./storage-body-7dWyMszh.js";
 import { RegExpRouter } from "hono/router/reg-exp-router";
 import { SmartRouter } from "hono/router/smart-router";
@@ -503,18 +503,6 @@ function accessOf(db) {
 	return access;
 }
 const asCondition = (node) => () => new Condition(node);
-/** The paths a chain's `.include()` calls loaded. */
-const includesOf$1 = (steps) => steps.flatMap(([method, args]) => method === "include" ? args : []);
-/** The rows in a query's result: a list, a page, or one row (`first()`); none in a count. */
-function rowsIn(result) {
-	if (Array.isArray(result)) return result;
-	if (result && typeof result === "object") {
-		const rows = result.rows;
-		if (Array.isArray(rows)) return rows;
-		if (modelOfRow(result)) return [result];
-	}
-	return [];
-}
 /** The route `db` and `can` for one request. */
 function boundary(options) {
 	const { db, policies, asker } = options;
@@ -543,7 +531,7 @@ function boundary(options) {
 	const readable = async (model, key, steps) => {
 		const read = await filter(model, "read");
 		if (!read) return void 0;
-		const query = db.findMany(model).where(asCondition(keyCondition(model.spec, key))).where(asCondition(read));
+		const query = db.findMany(model)[withIncludeRule](includeRule(model)).where(asCondition(keyCondition(model.spec, key))).where(asCondition(read));
 		return replay(query, steps.filter(([method]) => method === "include")).first();
 	};
 	/** Whether the row with this id meets the action's condition. */
@@ -569,48 +557,20 @@ function boundary(options) {
 		};
 	};
 	/**
-	* Related rows loaded with `.include()` keep only what their own model's `read` rule allows: a
-	* ref the user can't read becomes `null`, a list keeps its readable rows. Level by level, one
-	* query per model and level, for every row at once.
+	* Related rows loaded with `.include()` keep only what their own model's `read` rule allows: the
+	* rule is in each level's query (`db/orm/include.ts`), so a ref the user can't read is `null` and
+	* a list keeps its readable rows, with nothing read twice. One verdict per model, per query.
 	*/
-	const underTheirPolicies = async (registry, rows, paths) => {
-		const byFirst = /* @__PURE__ */ new Map();
-		for (const path of paths) {
-			const [first, ...rest] = path.split(".");
-			if (first === void 0) continue;
-			byFirst.set(first, [...byFirst.get(first) ?? [], ...rest.length > 0 ? [rest.join(".")] : []]);
-		}
-		for (const [field, deeper] of byFirst) {
-			const holders = rows;
-			const related = holders.flatMap((row) => {
-				const value = row[field];
-				return Array.isArray(value) ? value : value && typeof value === "object" ? [value] : [];
-			});
-			if (related.length === 0) continue;
-			const spec = modelOfRow(related[0]);
-			if (!spec) continue;
-			const target = new Model(spec, registry);
-			const read = await readableIds(target, related.map((r) => r.id));
-			for (const row of holders) {
-				const value = row[field];
-				if (Array.isArray(value)) row[field] = value.filter((r) => read.has(r.id));
-				else if (value && typeof value === "object") {
-					if (!read.has(value.id)) row[field] = null;
-				}
+	const includeRule = (model) => {
+		const verdicts = /* @__PURE__ */ new Map();
+		return (spec) => {
+			let found = verdicts.get(spec.name);
+			if (!found) {
+				found = verdict(new Model(spec, model.registry), "read").then((v) => v.kind === "denied" ? false : v.node);
+				verdicts.set(spec.name, found);
 			}
-			const kept = holders.flatMap((row) => {
-				const value = row[field];
-				return Array.isArray(value) ? value : value && typeof value === "object" ? [value] : [];
-			});
-			if (deeper.length > 0) await underTheirPolicies(registry, kept, deeper);
-		}
-	};
-	/** The ids, among these, of rows of `target` its `read` rule lets this request see. */
-	const readableIds = async (target, ids) => {
-		const verdictOf = await verdict(target, "read");
-		if (verdictOf.kind === "denied") return /* @__PURE__ */ new Set();
-		const found = await db.findMany(target).where((r) => r.id.in([...new Set(ids)])).where(asCondition(verdictOf.node));
-		return new Set(found.map((r) => r.id));
+			return found;
+		};
 	};
 	/**
 	* The plan with the placeholders in its own `where`s bound (`byRole`, `user`, `tenant`), as a
@@ -657,9 +617,7 @@ function boundary(options) {
 					t: "or",
 					items: []
 				};
-				const result = await replay(db.findMany(model).where(asCondition(node)), plan.steps);
-				await underTheirPolicies(model.registry, rowsIn(result), includesOf$1(plan.steps));
-				return result;
+				return replay(db.findMany(model)[withIncludeRule](includeRule(model)).where(asCondition(node)), plan.steps);
 			}
 			case "updateMany":
 			case "deleteMany": {
@@ -674,7 +632,6 @@ function boundary(options) {
 			case "findOne": {
 				const key = plan.args[0];
 				const row = await readable(model, key, plan.steps);
-				if (row !== void 0) await underTheirPolicies(model.registry, [row], includesOf$1(plan.steps));
 				if (row !== void 0 && action !== "read") {
 					const node = required(await verdict(model, action));
 					if (!await holdsOn(model, row.id, node)) throw deny();
@@ -1692,6 +1649,53 @@ const engine = (resource, action, context, files) => {
 	}
 };
 //#endregion
+//#region src/tasks/schedule.ts
+var Schedule = class {
+	when;
+	run;
+	constructor(when, run) {
+		this.when = when;
+		this.run = run;
+	}
+};
+const DAILY = /^([01]\d|2[0-3]):00$/;
+/** `schedule(when, run)` in `#app`. */
+function schedule(when, run) {
+	if ("daily" in when && !DAILY.test(when.daily)) throw new TypeError(`isai: a daily schedule runs at a whole hour ("03:00"), not "${when.daily}"`);
+	if (!("daily" in when) && when.hourly !== true) throw new TypeError("isai: a schedule is { hourly: true } or { daily: \"HH:00\" }");
+	return new Schedule(when, run);
+}
+/** Every schedule among the app modules' exports. */
+function schedulesIn(modules) {
+	const found = /* @__PURE__ */ new Set();
+	for (const module of modules) for (const value of Object.values(module)) if (value instanceof Schedule) found.add(value);
+	return [...found];
+}
+/** The hour (0–23) `now` falls in, in `timezone`. */
+function hourIn(now, timezone = "UTC") {
+	const hour = new Intl.DateTimeFormat("en-GB", {
+		timeZone: timezone,
+		hour: "2-digit",
+		hourCycle: "h23"
+	}).format(now);
+	return Number(hour);
+}
+/** Whether `when` is due in the hour `now` falls in. */
+function isDue(when, now, timezone) {
+	return "daily" in when ? Number(when.daily.slice(0, 2)) === hourIn(now, timezone) : true;
+}
+/**
+* The timer check: runs every schedule due in `now`'s hour, one after another. One that fails is
+* logged and the rest still run.
+*/
+async function tick(schedules, now, timezone) {
+	for (const due of schedules.filter((one) => isDue(one.when, now, timezone))) try {
+		await due.run({ now });
+	} catch (error) {
+		console.error(`isai: a schedule (${JSON.stringify(due.when)}) failed`, error);
+	}
+}
+//#endregion
 //#region src/audit/routes.ts
 /**
 * The whole log, a built-in route:
@@ -2393,6 +2397,21 @@ async function invite(db, models, input) {
 		}
 	});
 }
+/**
+* `auth.revoke` from code, undoing `auth.invite`: the email's invite to the role is deleted, and if
+* it has an account here, the role is taken away (held by the platform or not). Its sessions stay,
+* with what its other roles allow. Safe to repeat. No permission or last-owner check: services are
+* trusted, so give the role to someone else first.
+*/
+async function revoke(db, models, input) {
+	const { User, Role, UserRole, Invite } = models;
+	const role = await db.findOne(Role, { key: input.role });
+	if (!role) throw new TypeError(`isai: auth.revoke takes the role "${input.role}", which app.ts's roles don't have`);
+	const invite = await db.findOne(Invite, { email: input.email });
+	if (invite?.role === role.id) await db.deleteOne(Invite, { id: invite.id });
+	const user = await db.findOne(User, { email: input.email });
+	if (user) await db.deleteMany(UserRole).where((h) => h.user.is(user.id)).where((h) => h.role.is(role.id));
+}
 //#endregion
 //#region src/auth/routes.ts
 /**
@@ -2478,6 +2497,7 @@ function uploadTargets(modules, resources) {
 					route,
 					key
 				},
+				...route.upload ? { check: route.upload } : {},
 				allow: async (context) => {
 					if (!route.anonymous && !context.user) throw signInRequired();
 				}
@@ -2705,6 +2725,20 @@ function uploadRoute(options) {
 			throw fileTypeRefused(fileTypeNames(spec.types));
 		}
 		const db = accessOf(context.db).trusted;
+		if (target.check) {
+			const { bytes } = await db.findMany(options.upload).totals((u) => ({ bytes: u.size.sum() }));
+			try {
+				await target.check(context, {
+					field: target.route?.key ?? field,
+					size,
+					type: sniffed.type,
+					pending: bytes ?? 0
+				});
+			} catch (error) {
+				await body.cancel().catch(() => {});
+				throw error;
+			}
+		}
 		const user = context.user;
 		const put = async (key) => {
 			try {
@@ -2742,7 +2776,10 @@ function uploadRoute(options) {
 					height
 				}].sort((a, b) => b.width - a.width)
 			};
-			await db.updateOne(options.upload, { fileId: sizeOf }, { file });
+			await db.updateOne(options.upload, { fileId: sizeOf }, {
+				file,
+				size: Number(pending.size ?? 0) + size
+			});
 			return json(201, await options.answer(file, new URL(request.url).origin));
 		}
 		const id = newFileId();
@@ -2759,6 +2796,7 @@ function uploadRoute(options) {
 		await db.createOne(options.upload, {
 			fileId: id,
 			file,
+			size,
 			target: name,
 			user: user?.id ?? null,
 			expiresAt: new Date(clockOf(db).now().getTime() + UPLOAD_TTL_MS)
@@ -2868,8 +2906,10 @@ function dispositionOf(type, name) {
 }
 //#endregion
 //#region src/files/service.ts
+/** How many expired uploads one sweep reads at a time. */
+const SWEEP_BATCH = 100;
 function appFiles(options) {
-	const { storages, url, tenant } = options;
+	const { storages, url, tenant, db: dbOf, upload: uploadOf } = options;
 	const storageOf = (name) => {
 		const storage = storages[name];
 		if (!storage) throw new TypeError(`isai: there's no storage "${name}" in app.ts`);
@@ -2929,6 +2969,30 @@ function appFiles(options) {
 		url: async (file, { origin = "" } = {}) => url(file, origin),
 		delete: async (file) => {
 			await Promise.all(keysOf(file).map((key) => storageOf(file.storage).delete(key)));
+		},
+		sweep: async () => {
+			const upload = uploadOf();
+			if (!upload) throw new TypeError("isai: app.files.sweep needs base.uploads({ database }) in db/index.ts");
+			const db = dbOf();
+			const now = clockOf(db).now();
+			let removed = 0;
+			for (;;) {
+				const expired = await db.findMany(upload).where((u) => u.expiresAt.lte(now)).limit(SWEEP_BATCH).all();
+				if (expired.length === 0) return { removed };
+				await Promise.all(expired.flatMap((row) => {
+					const file = row.file;
+					return keysOf(file).map(async (key) => {
+						try {
+							await storageOf(file.storage).delete(key);
+						} catch (error) {
+							console.error(`isai: couldn't remove ${key} from storage "${file.storage}"`, error);
+						}
+					});
+				}));
+				const ids = expired.map((row) => String(row.fileId));
+				await db.deleteMany(upload).where((u) => u.fileId.in(ids));
+				removed += ids.length;
+			}
 		}
 	};
 }
@@ -3139,13 +3203,32 @@ function createCore(config, env, options = {}) {
 		checkRoles(auth, config.tenancy.roles, "tenancy.roles");
 	}
 	const models = auth ? authModels(auth.user) : void 0;
-	if (models) config.auth?.attach((input) => invite(currentDb(), models, input));
-	const single = named.kind === "database" ? database({
+	if (models) config.auth?.attach({
+		invite: (input) => invite(currentDb(), models, input),
+		revoke: (input) => revoke(currentDb(), models, input)
+	});
+	const scope = new Scope();
+	/** Tells `onWrite` what each committed write on `db` touched, and in which tenant. */
+	const watched = (db, name) => {
+		const { onWrite } = config;
+		if (onWrite) db.subscribe(async (writes) => {
+			const tenant = scope.current()?.tenant;
+			try {
+				await onWrite(writes, {
+					database: name,
+					...tenant ? { tenant } : {}
+				});
+			} catch (error) {
+				console.error(`isai: onWrite failed after a write to the ${name} database`, error);
+			}
+		});
+		return db;
+	};
+	const single = named.kind === "database" ? watched(database({
 		driver: named,
 		name,
 		...zoned
-	}) : void 0;
-	const scope = new Scope();
+	}), name) : void 0;
 	const registry = serviceRegistry(services, seeds);
 	/** The app's database: with tenancy, the current tenant's (inside one), and nothing outside. */
 	const currentDb = () => {
@@ -3247,11 +3330,11 @@ function createCore(config, env, options = {}) {
 		});
 		return pipeline;
 	};
-	const platform = named.kind === "tenantDatabases" ? database({
+	const platform = named.kind === "tenantDatabases" ? watched(database({
 		driver: config.databases[PLATFORM],
 		name: PLATFORM,
 		...zoned
-	}) : void 0;
+	}), PLATFORM) : void 0;
 	const platformModels = auth && platform && config.tenancy ? authModels(new Model(config.tenancy.tenant.registry.get(`${PLATFORM_PREFIX}User`), config.tenancy.tenant.registry), PLATFORM_PREFIX) : void 0;
 	const platformDb = () => platform;
 	let platformReady;
@@ -3323,6 +3406,7 @@ function createCore(config, env, options = {}) {
 			registry,
 			models,
 			woken: syncedRoles,
+			watched: (db) => watched(db, TENANT),
 			run: (db, tenant, fn) => scope.run({
 				db,
 				tenant
@@ -3358,7 +3442,12 @@ function createCore(config, env, options = {}) {
 		files: appFiles({
 			storages,
 			url,
-			tenant: () => scope.current()?.tenant
+			tenant: () => scope.current()?.tenant,
+			db: currentDb,
+			upload: () => {
+				const models = auth?.user.registry ?? config.tenancy?.tenant.registry;
+				return models?.has("Upload") ? new Model(models.get("Upload"), models) : void 0;
+			}
 		}),
 		handle,
 		openTenant,
@@ -3393,7 +3482,7 @@ function createCore(config, env, options = {}) {
 			return await named.call(id, ref, args, tenant);
 		} }),
 		runTask: async () => notImplemented("app.runTask"),
-		tick: async () => notImplemented("app.tick")
+		tick: async (now) => tick(schedulesIn((await loadModules()).modules), now, timezone)
 	};
 }
 /**
@@ -3404,11 +3493,11 @@ function createCore(config, env, options = {}) {
 */
 function tenantCore(databases, host, options) {
 	const driver = databases.open(host);
-	const db = database({
+	const db = options.watched(database({
 		driver,
 		name: TENANT,
 		...options.zoned
-	});
+	}));
 	let woken;
 	let recorded = false;
 	const wake = () => {
@@ -3569,8 +3658,9 @@ function createApp(runtime, configure, options = {}) {
 		Tenant: runtime.tenant?.(start),
 		route,
 		resource,
-		fail
+		fail,
+		schedule
 	};
 }
 //#endregion
-export { NotImplementedError, Rejected, Route, createApp, fail };
+export { NotImplementedError, Rejected, Route, Schedule, createApp, fail };

package/dist/{make-ByA-84h8.js → make-jMJABOWI.js}

@@ -1,4 +1,4 @@
-import { U as systemClock, f as dayOf, h as snapshotOf, p as generateMigration, y as MigrationError } from "./migrator-B25prc9n.js";
+import { W as systemClock, f as dayOf, h as snapshotOf, p as generateMigration, y as MigrationError } from "./migrator-DxTpns_-.js";
 //#region src/db/migrations/cleanup.ts
 /** Dropped tables, those that refer to others first, so no row is left pointing at a dropped one. */
 function dropOrder(tables) {
@@ -88,10 +88,12 @@ function cleanupMigration(options) {
 *   tighten one, or add a check     a check data step: passes when no row breaks it, else a `fix`
 *   add a unique                    a resolution step before the index (duplicates as chosen)
 *   remove a unique                 retired until cleanup (an earlier release may rely on it)
+*   change a ref's onDelete or      a rebuild: the table and every table referencing it, copied
+*   table, or a table's storage     whole in one step (`operations.ts` → rebuild)
 *
 * Refused, each with the safe sequence: an incompatible kind change (or toggling `secret`), a field
 * becoming or ceasing to be kept by the database, a new required unique field over existing rows,
-* a rebuild (a ref's `onDelete`, an FK on an existing column), reusing a retired name.
+* reusing a retired name, a rebuild of tables that reference each other.
 */
 const pad = (n) => String(n).padStart(4, "0");
 const json = (value) => JSON.stringify(value);
@@ -299,13 +301,17 @@ function describeOperation(operation, tables) {
 			what: `add ${tables[operation.table]?.model ?? operation.table}.${operation.column.field}`,
 			how: "ADD COLUMN"
 		};
+		case "rebuild": return {
+			what: `rebuild ${operation.tables.map((table) => table.model).join(", ")}`,
+			how: "copies every row"
+		};
 		default: return {
 			what: operation.op,
 			how: ""
 		};
 	}
 }
-const slugOf = (operation) => operation.op === "createTable" ? `create_${operation.table.name}` : operation.op === "addColumn" ? `add_${operation.table}_${operation.column.name}` : operation.op;
+const slugOf = (operation) => operation.op === "createTable" ? `create_${operation.table.name}` : operation.op === "addColumn" ? `add_${operation.table}_${operation.column.name}` : operation.op === "rebuild" ? `rebuild_${operation.tables[0]?.name ?? "tables"}` : operation.op;
 /** A template literal holding SQL (no backtick or `${` is left live). */
 const literal = (text) => `\`${text.replaceAll("\\", "\\\\").replaceAll("`", "\\`").replaceAll("${", "\\${")}\``;
 function structureSource(name, after, statements, day, framework) {
@@ -482,6 +488,18 @@ function makeMigrations(options) {
 /** The structure operations between two snapshots, for naming the step and the plan. */
 function snapshotOperations(previous, next) {
 	const operations = [];
+	const rebuilt = Object.values(next.tables).filter((table) => {
+		const before = previous.tables[table.name];
+		if (!before) return false;
+		const references = new Map(before.columns.map((c) => [c.name, JSON.stringify(c.references)]));
+		return Boolean(before.withoutRowid) !== Boolean(table.withoutRowid) || table.columns.some((c) => references.has(c.name) && references.get(c.name) !== JSON.stringify(c.references));
+	});
+	if (rebuilt.length > 0) operations.push({
+		op: "rebuild",
+		tables: rebuilt,
+		copy: {},
+		triggers: []
+	});
 	for (const table of Object.values(next.tables)) {
 		const before = previous.tables[table.name];
 		if (!before) {

package/dist/{makers-P9kg68C8.js → makers-A0Pj6Tda.js}

@@ -1,6 +1,6 @@
-import { K as Fake, q as fakeValue } from "./validation-Cppmd0RV.js";
-import { D as recordAction, E as forUpkeep, K as CheckFailed, S as clockOf, k as planInsert } from "./migrator-B25prc9n.js";
-import { I as fromBase64url, L as toBase64url, l as IMPLICIT_FIELDS, t as Model } from "./model-Dc3HunKb.js";
+import { J as Fake, Y as fakeValue } from "./validation-C3MCRBQO.js";
+import { D as recordAction, E as forUpkeep, S as clockOf, k as planInsert, q as CheckFailed } from "./migrator-DxTpns_-.js";
+import { I as fromBase64url, L as toBase64url, l as IMPLICIT_FIELDS, t as Model } from "./model-6pJBqqGd.js";
 //#region src/auth/roles.ts
 const same = (a, b) => a.length === b.length && a.every((value, i) => value === b[i]);
 /** What a role in `app.ts` is stored as. */