@isaijs/core 0.1.6 → 0.1.9

package/dist/{index-a7ElyL3B.d.ts → index-Bb9Px6SR.d.ts}

@@ -1,7 +1,7 @@
-import { a as DatabaseDriver, b as TenantDatabases, d as RateLimiter, g as Storage, l as PdfRenderer, n as Body, p as Runtime, r as Cache, s as MailDriver, u as Queue } from "./index-Ce5p2-EB.js";
-import { C as ObjectShape, Y as StoredFile, w as Output } from "./index-CYcklQ1l.js";
-import { $ as Expr, C as WithIncludes, D as PageOptions, E as Page, J as Models, Q as Embed, S as Key, T as NumberedPageOptions, V as AnyModel, X as Condition, Z as Conditional, b as RowOf, ct as ColumnNode, gt as FieldSpec, i as Row, lt as ConditionNode, n as Patch, p as Database, t as Insert, u as Seed, ut as Operand, v as OrderKey, w as NumberedPage, x as IncludePath } from "./types-BgOkJy5d.js";
-import { a as PROVIDERS, i as HELD, k as Manifest } from "./data-layer-43pme0Gy.js";
+import { a as DatabaseDriver, b as TenantDatabases, d as RateLimiter, f as Row, g as Storage, l as PdfRenderer, n as Body, p as Runtime, r as Cache, s as MailDriver, u as Queue } from "./index-Ce5p2-EB.js";
+import { C as ObjectShape, Y as StoredFile, w as Output } from "./index-CaR3hb0i.js";
+import { $ as Expr, C as WithIncludes, D as PageOptions, E as Page, J as Models, O as Write, Q as Embed, S as Key, T as NumberedPageOptions, V as AnyModel, X as Condition, Z as Conditional, b as RowOf, ct as ColumnNode, gt as FieldSpec, i as Row$1, lt as ConditionNode, n as Patch, p as Database, t as Insert, u as Seed, ut as Operand, v as OrderKey, w as NumberedPage, x as IncludePath } from "./types-D5SIVeej.js";
+import { a as PROVIDERS, i as HELD, k as Manifest } from "./data-layer-nvm_ivGQ.js";
 //#region src/api/fail.d.ts
 /**
  * `fail(code, message)`: the app's own business rules, for what can't be a `.check()`, a flow or a
@@ -33,10 +33,10 @@ interface BuiltinUser {
 }
 type UserRow = Models extends {
   readonly User: infer U extends AnyModel;
-} ? Row<U> : BuiltinUser;
+} ? Row$1<U> : BuiltinUser;
 type TenantRow$1 = Models extends {
   readonly Tenant: infer T extends AnyModel;
-} ? Row<T> : {
+} ? Row$1<T> : {
   readonly id: string;
   readonly name: string;
 };
@@ -133,12 +133,12 @@ type Simplify<T> = { [K in keyof T]: T[K]; } & {};
 type OwnedInsert<M extends AnyModel> = Simplify<Omit<Insert<M>, OwnerKeys<M>> & Partial<Pick<Insert<M>, OwnerKeys<M> & keyof Insert<M>>>>;
 /** The route context's `db`. Transactions, upserts and raw SQL are for services (`app.db`). */
 interface RouteDatabase {
-  findOne<M extends AnyModel>(model: M, key: Key<M>): CheckedOne<M, Row<M>>;
-  findMany<M extends AnyModel>(model: M): CheckedQuery<M, Row<M>>;
-  createOne<M extends AnyModel>(model: M, input: OwnedInsert<M>): Ends<Row<M>>;
-  createMany<M extends AnyModel>(model: M, inputs: readonly OwnedInsert<M>[]): Ends<Row<M>[]>;
-  updateOne<M extends AnyModel>(model: M, key: Key<M>, patch: Patch<M>): CheckedMaybe<Row<M>>;
-  deleteOne<M extends AnyModel>(model: M, key: Key<M>): CheckedMaybe<Row<M>>;
+  findOne<M extends AnyModel>(model: M, key: Key<M>): CheckedOne<M, Row$1<M>>;
+  findMany<M extends AnyModel>(model: M): CheckedQuery<M, Row$1<M>>;
+  createOne<M extends AnyModel>(model: M, input: OwnedInsert<M>): Ends<Row$1<M>>;
+  createMany<M extends AnyModel>(model: M, inputs: readonly OwnedInsert<M>[]): Ends<Row$1<M>[]>;
+  updateOne<M extends AnyModel>(model: M, key: Key<M>, patch: Patch<M>): CheckedMaybe<Row$1<M>>;
+  deleteOne<M extends AnyModel>(model: M, key: Key<M>): CheckedMaybe<Row$1<M>>;
   updateMany<M extends AnyModel>(model: M, patch: Patch<M>): CheckedMany<M>;
   deleteMany<M extends AnyModel>(model: M): CheckedMany<M>;
 }
@@ -153,7 +153,7 @@ type Method = "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
  */
 type User = Models extends {
   readonly User: infer U extends AnyModel;
-} ? Row<U> : {
+} ? Row$1<U> : {
   readonly id: string;
 };
 /**
@@ -162,7 +162,7 @@ type User = Models extends {
  */
 type PlatformUser = Models extends {
   readonly PlatformUser: infer U extends AnyModel;
-} ? Row<U> : {
+} ? Row$1<U> : {
   readonly id: string;
 };
 type ParamNames<P extends string> = P extends `${string}:${infer Name}/${infer Rest}` ? Name | ParamNames<`/${Rest}`> : P extends `${string}:${infer Name}` ? Name : never;
@@ -178,14 +178,28 @@ interface RouteOptions<S extends ObjectShape = ObjectShape, A extends boolean =
    * the platform's, `user` a platform user.
    */
   readonly platform?: Pl;
+  /**
+   * Runs before each upload to this route's file inputs is stored, once its size and type are
+   * known: throw (`fail`) to refuse it. `pending` is the bytes of every upload not yet attached, so
+   * a cap counts them: `upload: async (_, { size, pending }) => { if (used() + pending + size > cap) fail(…) }`.
+   */
+  readonly upload?: UploadCheck<A, Pl>;
 }
+/** An upload about to be stored: its route input's key, bytes, media type, and the bytes pending. */
+interface UploadInfo {
+  readonly field: string;
+  readonly size: number;
+  readonly type: string;
+  readonly pending: number;
+}
+type UploadCheck<A extends boolean = boolean, Pl extends boolean = boolean> = (context: RouteContext<string, Record<never, never>, A, Pl>, upload: UploadInfo) => unknown;
 /**
  * The current tenant's row, with tenancy: the app's `Tenant` (its own columns too) once it's in the
  * `Models` registry; `undefined` in a single-tenant app.
  */
 type TenantRow = Models extends {
   readonly Tenant: infer T extends AnyModel;
-} ? Row<T> : undefined;
+} ? Row$1<T> : undefined;
 interface RouteContext<P extends string, S extends ObjectShape, A extends boolean, Pl extends boolean = false> {
   /**
    * The app's database at the boundary: each query ends in `.allowed(action)` (the model's policy
@@ -219,6 +233,8 @@ declare class Route<O = unknown> {
   readonly handler: (context: RouteContext<string, ObjectShape, boolean>) => unknown;
   /** Served on the platform's host instead of a tenant's. */
   readonly platform: boolean;
+  /** Checks each upload to its file inputs before it's stored (`upload` in its options). */
+  readonly upload?: UploadCheck | undefined;
   /** Type only: what the handler returns. */
   readonly "~output": O;
   constructor(method: Method, path: string,
@@ -228,7 +244,9 @@ declare class Route<O = unknown> {
    */
   input: ObjectShape | "own", anonymous: boolean, handler: (context: RouteContext<string, ObjectShape, boolean>) => unknown,
   /** Served on the platform's host instead of a tenant's. */
-  platform?: boolean);
+  platform?: boolean,
+  /** Checks each upload to its file inputs before it's stored (`upload` in its options). */
+  upload?: UploadCheck | undefined);
 }
 /** A route that takes no input. */
 type NoInput = Record<never, never>;
@@ -285,6 +303,16 @@ interface TenancyConfig {
 type Named<T> = {
   readonly default: T;
 } & Readonly<Record<string, T>>;
+/** Where a committed write happened, for `onWrite`. */
+interface WriteContext {
+  /** The database's name (`tenant`, `platform`, or the one database's). */
+  readonly database: string;
+  /**
+   * The tenant whose request or service made it (isolated tenancy). None on the platform's
+   * database, nor for what a tenant's database writes as it wakes (the roles from `app.ts`).
+   */
+  readonly tenant?: Row;
+}
 /** The application layer: what `app.ts` returns from `createApp`'s configure callback. */
 interface AppConfig {
   /**
@@ -314,6 +342,14 @@ interface AppConfig {
     readonly language: string;
     readonly timezone: string;
   };
+  /**
+   * Called after every committed write on any of the app's databases, with what it created,
+   * changed and deleted (an `atomic`'s writes in one call): for what has to follow a change outside
+   * the database, such as purging a cache of pages built from it. Rows the database changes
+   * itself (cascade deletes, counts) aren't listed, nor are migrations' writes. It runs before the
+   * write returns; a failure is logged and never fails the write, which is already committed.
+   */
+  readonly onWrite?: (writes: readonly Write[], context: WriteContext) => void | Promise<void>;
   readonly api?: {
     /**
      * Anonymous writes (POST, PUT, PATCH, DELETE with no session) are counted per client IP:
@@ -430,6 +466,13 @@ interface AppFiles {
   }): Promise<string>;
   /** Removes the file (and its sizes) from its storage. */
   delete(file: StoredFile): Promise<void>;
+  /**
+   * Removes the uploads no write attached before their expiry, from storage and the `Upload` table,
+   * in the current database (the tenant's, inside one). Run it from a schedule.
+   */
+  sweep(): Promise<{
+    readonly removed: number;
+  }>;
 }
 //#endregion
 //#region src/tenancy/services.d.ts
@@ -437,6 +480,40 @@ interface AppFiles {
 type AppServices = () => readonly Promise<object>[];
 type Service = (...args: any[]) => unknown;
 //#endregion
+//#region src/tasks/schedule.d.ts
+/**
+ * Schedules: work the app runs on the clock, each a named export of an app module listed in `apps`
+ * (`apps/<name>/tasks.ts`), found like routes.
+ *
+ *   export const nightly = schedule({ daily: "03:00" }, async ({ now }) => { … })
+ *   export const hourly = schedule({ hourly: true }, async () => { … })
+ *
+ * Times are in the app's timezone (`fallbackLocale.timezone`, else UTC), on the hour. The runtime
+ * calls `app.tick(now)` from one hourly timer (on `workers`, the cron line `"0 * * * *"` in
+ * `wrangler.jsonc`), and each tick runs the schedules due in that hour. A tick that's missed is
+ * skipped, never caught up, so a schedule's work is safe to leave to the next time it runs.
+ *
+ * A schedule runs outside any tenant: with isolated tenancy it reaches a tenant through
+ * `app.tenant(id).run(service)`, and the platform through `app.platform.db`.
+ */
+/** When a schedule runs: every hour, or once a day at a whole hour (`"03:00"`). */
+type When = {
+  readonly hourly: true;
+} | {
+  readonly daily: `${number}:00`;
+};
+interface ScheduleContext {
+  /** The tick's time: the hour it's for. */
+  readonly now: Date;
+}
+declare class Schedule {
+  readonly when: When;
+  readonly run: (context: ScheduleContext) => unknown;
+  constructor(when: When, run: (context: ScheduleContext) => unknown);
+}
+/** `schedule(when, run)` in `#app`. */
+declare function schedule(when: When, run: (context: ScheduleContext) => unknown): Schedule;
+//#endregion
 //#region src/app/create-app.d.ts
 /**
  * The app instance services import from `#app`. It's usable at module scope; what it
@@ -468,7 +545,7 @@ interface App {
 }
 interface AppOptions {
   /**
-   * Every `apps/<name>/routes.ts` and `resources.ts`, each as a lazy import, like Django's
+   * Every `apps/<name>/routes.ts`, `resources.ts` and `tasks.ts`, each as a lazy import, like Django's
    * INSTALLED_APPS. Lazy, because those modules import `#app` themselves.
    */
   readonly apps?: AppModules;
@@ -502,6 +579,8 @@ interface CreatedApp<Served, TenantHost = undefined> {
   /** `resource(Model, options)`: what the API exposes over a model. */
   readonly resource: typeof resource;
   readonly fail: typeof fail;
+  /** `schedule({ daily: "03:00" }, run)`: work on the clock, exported from an app module. */
+  readonly schedule: typeof schedule;
 }
 /**
  * `configure` runs once, the first time the runtime starts the core with an env.
@@ -663,4 +742,4 @@ interface CreatedAuth<Env> {
 /** The auth instance, from `auth.ts`, with `policy()` and the placeholders policies are written with. */
 declare function createAuth<Env = unknown>(define: (env: Env) => AuthDefinition): CreatedAuth<Env>;
 //#endregion
-export { Permissions as A, Params as C, RouteHandler as D, RouteContext as E, Policy as F, Rules as I, StandardAction as L, Bound as M, DefinePolicy as N, RouteOptions as O, Perms as P, Rejected as R, Method as S, RouteBuilder as T, CustomAction as _, OAuthMethod as a, AppConfig as b, Roles as c, NotImplementedError as d, AppModules as f, createApp as g, CreatedApp as h, Methods as i, AnyPolicy as j, User as k, SignInMethod as l, AppOptions as m, AuthConfig as n, Provider as o, App as p, AuthDefinition as r, RoleDefinition as s, Auth as t, createAuth as u, Resource as v, Route as w, Named as x, ResourceOptions as y, fail as z };
+export { RouteContext as A, Rules as B, AppConfig as C, Params as D, Method as E, AnyPolicy as F, Rejected as H, Bound as I, DefinePolicy as L, RouteOptions as M, User as N, Route as O, Permissions as P, Perms as R, ResourceOptions as S, WriteContext as T, fail as U, StandardAction as V, Schedule as _, OAuthMethod as a, CustomAction as b, Roles as c, NotImplementedError as d, AppModules as f, createApp as g, CreatedApp as h, Methods as i, RouteHandler as j, RouteBuilder as k, SignInMethod as l, AppOptions as m, AuthConfig as n, Provider as o, App as p, AuthDefinition as r, RoleDefinition as s, Auth as t, createAuth as u, ScheduleContext as v, Named as w, Resource as x, When as y, Policy as z };

package/dist/{index-CYcklQ1l.d.ts → index-CaR3hb0i.d.ts}

@@ -222,6 +222,8 @@ declare function file(options?: FileOptions & {
 declare function image(options?: FileOptions & {
   readonly types?: readonly ImageType[];
 }): Kind<StoredFile>;
+/** A PDF or an image to print or read whole (never resized), up to 100 MB. */
+declare function document(options?: FileOptions): Kind<StoredFile>;
 /** Up to 10 files. */
 declare const files: (options?: FileOptions & {
   readonly types?: readonly FileType[];
@@ -230,6 +232,8 @@ declare const files: (options?: FileOptions & {
 declare const images: (options?: FileOptions & {
   readonly types?: readonly ImageType[];
 }) => Kind<StoredFile[], StoredFile[], false, false>;
+/** Up to 100 documents (PDFs and images, each up to 100 MB). */
+declare const documents: (options?: FileOptions) => Kind<StoredFile[], StoredFile[], false, false>;
 //#endregion
 //#region src/validation/kinds/phone.d.ts
 /**
@@ -382,4 +386,4 @@ declare const email: () => Kind<string, string, false, false>;
 /** An http(s) URL, up to 2,048 characters. */
 declare const url: () => Kind<string, string, false, false>;
 //#endregion
-export { images as $, validate as A, money as B, ObjectShape as C, object as D, list as E, datetime as F, FileType as G, sequence as H, fakeUlid as I, SIZES_MAX as J, ImageSize as K, flag as L, IdInput as M, choice as N, serialize as O, date as P, image as Q, id as R, LIST_MAX as S, Shape as T, phone as U, quantity as V, phoneKind as W, file as X, StoredFile as Y, files as Z, define as _, newToken as a, KindSpec as at, CarriesKind as b, slug as c, Sensitivity as ct, text as d, StandardIssue as dt, Fake as et, textKind as f, StandardProps as ft, KindDefinition as g, Definable as h, markdown as i, Kind as it, CalendarDate as j, toKind as k, slugify as l, TypeText as lt, url as m, StandardSchemaV1 as mt, host as n, AnyKind as nt, personName as o, KindTypes as ot, token as p, StandardResult as pt, ImageType as q, line as r, FileSpec as rt, secret as s, Measure as st, email as t, FakeContext as tt, subdomain as u, kind as ut, json as v, Output as w, Input as x, urls as y, int as z };
+export { files as $, validate as A, money as B, ObjectShape as C, object as D, list as E, datetime as F, FileType as G, sequence as H, fakeUlid as I, SIZES_MAX as J, ImageSize as K, flag as L, IdInput as M, choice as N, serialize as O, date as P, file as Q, id as R, LIST_MAX as S, Shape as T, phone as U, quantity as V, phoneKind as W, document as X, StoredFile as Y, documents as Z, define as _, newToken as a, FileSpec as at, CarriesKind as b, slug as c, KindTypes as ct, text as d, TypeText as dt, image as et, textKind as f, kind as ft, KindDefinition as g, StandardSchemaV1 as gt, Definable as h, StandardResult as ht, markdown as i, AnyKind as it, CalendarDate as j, toKind as k, slugify as l, Measure as lt, url as m, StandardProps as mt, host as n, Fake as nt, personName as o, Kind as ot, token as p, StandardIssue as pt, ImageType as q, line as r, FakeContext as rt, secret as s, KindSpec as st, email as t, images as tt, subdomain as u, Sensitivity as ut, json as v, Output as w, Input as x, urls as y, int as z };

package/dist/index.d.ts

@@ -1,3 +1,3 @@
 import { p as Runtime, t as AppCore } from "./index-Ce5p2-EB.js";
-import { C as Params, D as RouteHandler, E as RouteContext, O as RouteOptions, R as Rejected, S as Method, T as RouteBuilder, _ as CustomAction, b as AppConfig, d as NotImplementedError, f as AppModules, g as createApp, h as CreatedApp, k as User, m as AppOptions, p as App, v as Resource, w as Route, x as Named, y as ResourceOptions, z as fail } from "./index-a7ElyL3B.js";
-export { type App, type AppConfig, type AppCore, type AppModules, type AppOptions, type CreatedApp, type CustomAction, type Method, type Named, NotImplementedError, type Params, Rejected, type Resource, type ResourceOptions, Route, type RouteBuilder, type RouteContext, type RouteHandler, type RouteOptions, type Runtime, type User, createApp, fail };
+import { A as RouteContext, C as AppConfig, D as Params, E as Method, H as Rejected, M as RouteOptions, N as User, O as Route, S as ResourceOptions, T as WriteContext, U as fail, _ as Schedule, b as CustomAction, d as NotImplementedError, f as AppModules, g as createApp, h as CreatedApp, j as RouteHandler, k as RouteBuilder, m as AppOptions, p as App, v as ScheduleContext, w as Named, x as Resource, y as When } from "./index-Bb9Px6SR.js";
+export { type App, type AppConfig, type AppCore, type AppModules, type AppOptions, type CreatedApp, type CustomAction, type Method, type Named, NotImplementedError, type Params, Rejected, type Resource, type ResourceOptions, Route, type RouteBuilder, type RouteContext, type RouteHandler, type RouteOptions, type Runtime, Schedule, type ScheduleContext, type User, type When, type WriteContext, createApp, fail };

package/dist/index.js

@@ -1,14 +1,14 @@
-import { G as ValidationError, H as validate, V as toKind, h as line, o as fileTypeNames, p as email, z as object } from "./validation-Cppmd0RV.js";
-import { A as planUpdate, B as NeedsDatabase, C as database, D as recordAction, J as NotFound, L as PLATFORM, N as conditionOf, O as withTableTotals, P as modelOfRow, R as TENANT, S as clockOf, T as driverOf, U as systemClock, V as evaluate, X as UniqueFailed, j as keyCondition, k as planInsert, r as sync, t as migrate, w as decodeStored, z as checkTenancy } from "./migrator-B25prc9n.js";
-import { C as tooLarge, E as fail, S as tenantSuspended, T as Rejected, _ as json, b as routeNotFound, c as fromBody, d as route, f as HttpError, g as fileTypeRefused, h as fileTooLarge, l as readInput, m as errorResponse, o as parseListQuery, p as crossSiteRequest, r as resource, s as BODY_LIMIT, t as Resource, u as Route, v as lengthRequired, w as tooManyRequests, x as signInRequired, y as methodNotAllowed } from "./resource-BQK7bkPQ.js";
-import { C as asCondition$1, I as fromBase64url, L as toBase64url, U as asActor, _ as Expr, c as rowOf, h as Condition, o as fieldOf, p as sensitivity, q as Scope, r as columnName, t as Model } from "./model-Dc3HunKb.js";
+import { U as toKind, V as object, W as validate, _ as line, c as fileTypeNames, h as email, q as ValidationError } from "./validation-C3MCRBQO.js";
+import { A as planUpdate, B as checkTenancy, C as database, D as recordAction, F as modelOfRow, H as evaluate, N as conditionOf, O as withTableTotals, P as withIncludeRule, R as PLATFORM, S as clockOf, T as driverOf, V as NeedsDatabase, W as systemClock, Y as NotFound, Z as UniqueFailed, j as keyCondition, k as planInsert, r as sync, t as migrate, w as decodeStored, z as TENANT } from "./migrator-vvvKa0Vk.js";
+import { C as tooLarge, E as fail, S as tenantSuspended, T as Rejected, _ as json, b as routeNotFound, c as fromBody, d as route, f as HttpError, g as fileTypeRefused, h as fileTooLarge, l as readInput, m as errorResponse, o as parseListQuery, p as crossSiteRequest, r as resource, s as BODY_LIMIT, t as Resource, u as Route, v as lengthRequired, w as tooManyRequests, x as signInRequired, y as methodNotAllowed } from "./resource-DCg6LvMH.js";
+import { C as asCondition$1, I as fromBase64url, L as toBase64url, U as asActor, _ as Expr, c as rowOf, h as Condition, o as fieldOf, p as sensitivity, q as Scope, r as columnName, t as Model } from "./model-6pJBqqGd.js";
 import { r as ulid, t as kebabCase } from "./case-DpXlJCL9.js";
 import { n as notImplemented, t as NotImplementedError } from "./errors-mCNLlXg9.js";
-import { t as PLATFORM_PREFIX } from "./tables-DgSwge7s.js";
+import { t as PLATFORM_PREFIX } from "./tables-DjW96Ubl.js";
 import { t as Seed } from "./seed-BObmdKdP.js";
-import { d as afterUpdate, f as bindFor, h as ownerFieldOf, m as isFalse, p as check, u as FALSE } from "./policies-KsqmlX67.js";
-import { i as checkRoles, n as authPerms, r as checkAuth } from "./create-auth-BFKvQVOG.js";
-import { _ as permissionsOf, a as hashOf, b as syncRoles, c as GoogleError, f as verifyIdToken, g as safeReturn, h as redirect, i as clearedCookie, l as consentUrl, m as cookieOf, n as authModels, o as sessions, p as cookie, t as makers, u as exchangeCode, v as roleKeys, y as seedAs } from "./makers-P9kg68C8.js";
+import { d as afterUpdate, f as bindFor, h as ownerFieldOf, m as isFalse, p as check, u as FALSE } from "./policies-C_oiSgmY.js";
+import { i as checkRoles, n as authPerms, r as checkAuth } from "./create-auth-BCvMwlVD.js";
+import { _ as permissionsOf, a as hashOf, b as syncRoles, c as GoogleError, f as verifyIdToken, g as safeReturn, h as redirect, i as clearedCookie, l as consentUrl, m as cookieOf, n as authModels, o as sessions, p as cookie, t as makers, u as exchangeCode, v as roleKeys, y as seedAs } from "./makers-DjkBP74P.js";
 import { t as WrongSize } from "./storage-body-7dWyMszh.js";
 import { RegExpRouter } from "hono/router/reg-exp-router";
 import { SmartRouter } from "hono/router/smart-router";
@@ -503,18 +503,6 @@ function accessOf(db) {
 	return access;
 }
 const asCondition = (node) => () => new Condition(node);
-/** The paths a chain's `.include()` calls loaded. */
-const includesOf$1 = (steps) => steps.flatMap(([method, args]) => method === "include" ? args : []);
-/** The rows in a query's result: a list, a page, or one row (`first()`); none in a count. */
-function rowsIn(result) {
-	if (Array.isArray(result)) return result;
-	if (result && typeof result === "object") {
-		const rows = result.rows;
-		if (Array.isArray(rows)) return rows;
-		if (modelOfRow(result)) return [result];
-	}
-	return [];
-}
 /** The route `db` and `can` for one request. */
 function boundary(options) {
 	const { db, policies, asker } = options;
@@ -543,7 +531,7 @@ function boundary(options) {
 	const readable = async (model, key, steps) => {
 		const read = await filter(model, "read");
 		if (!read) return void 0;
-		const query = db.findMany(model).where(asCondition(keyCondition(model.spec, key))).where(asCondition(read));
+		const query = db.findMany(model)[withIncludeRule](includeRule(model)).where(asCondition(keyCondition(model.spec, key))).where(asCondition(read));
 		return replay(query, steps.filter(([method]) => method === "include")).first();
 	};
 	/** Whether the row with this id meets the action's condition. */
@@ -569,48 +557,20 @@ function boundary(options) {
 		};
 	};
 	/**
-	* Related rows loaded with `.include()` keep only what their own model's `read` rule allows: a
-	* ref the user can't read becomes `null`, a list keeps its readable rows. Level by level, one
-	* query per model and level, for every row at once.
+	* Related rows loaded with `.include()` keep only what their own model's `read` rule allows: the
+	* rule is in each level's query (`db/orm/include.ts`), so a ref the user can't read is `null` and
+	* a list keeps its readable rows, with nothing read twice. One verdict per model, per query.
 	*/
-	const underTheirPolicies = async (registry, rows, paths) => {
-		const byFirst = /* @__PURE__ */ new Map();
-		for (const path of paths) {
-			const [first, ...rest] = path.split(".");
-			if (first === void 0) continue;
-			byFirst.set(first, [...byFirst.get(first) ?? [], ...rest.length > 0 ? [rest.join(".")] : []]);
-		}
-		for (const [field, deeper] of byFirst) {
-			const holders = rows;
-			const related = holders.flatMap((row) => {
-				const value = row[field];
-				return Array.isArray(value) ? value : value && typeof value === "object" ? [value] : [];
-			});
-			if (related.length === 0) continue;
-			const spec = modelOfRow(related[0]);
-			if (!spec) continue;
-			const target = new Model(spec, registry);
-			const read = await readableIds(target, related.map((r) => r.id));
-			for (const row of holders) {
-				const value = row[field];
-				if (Array.isArray(value)) row[field] = value.filter((r) => read.has(r.id));
-				else if (value && typeof value === "object") {
-					if (!read.has(value.id)) row[field] = null;
-				}
+	const includeRule = (model) => {
+		const verdicts = /* @__PURE__ */ new Map();
+		return (spec) => {
+			let found = verdicts.get(spec.name);
+			if (!found) {
+				found = verdict(new Model(spec, model.registry), "read").then((v) => v.kind === "denied" ? false : v.node);
+				verdicts.set(spec.name, found);
 			}
-			const kept = holders.flatMap((row) => {
-				const value = row[field];
-				return Array.isArray(value) ? value : value && typeof value === "object" ? [value] : [];
-			});
-			if (deeper.length > 0) await underTheirPolicies(registry, kept, deeper);
-		}
-	};
-	/** The ids, among these, of rows of `target` its `read` rule lets this request see. */
-	const readableIds = async (target, ids) => {
-		const verdictOf = await verdict(target, "read");
-		if (verdictOf.kind === "denied") return /* @__PURE__ */ new Set();
-		const found = await db.findMany(target).where((r) => r.id.in([...new Set(ids)])).where(asCondition(verdictOf.node));
-		return new Set(found.map((r) => r.id));
+			return found;
+		};
 	};
 	/**
 	* The plan with the placeholders in its own `where`s bound (`byRole`, `user`, `tenant`), as a
@@ -657,9 +617,7 @@ function boundary(options) {
 					t: "or",
 					items: []
 				};
-				const result = await replay(db.findMany(model).where(asCondition(node)), plan.steps);
-				await underTheirPolicies(model.registry, rowsIn(result), includesOf$1(plan.steps));
-				return result;
+				return replay(db.findMany(model)[withIncludeRule](includeRule(model)).where(asCondition(node)), plan.steps);
 			}
 			case "updateMany":
 			case "deleteMany": {
@@ -674,7 +632,6 @@ function boundary(options) {
 			case "findOne": {
 				const key = plan.args[0];
 				const row = await readable(model, key, plan.steps);
-				if (row !== void 0) await underTheirPolicies(model.registry, [row], includesOf$1(plan.steps));
 				if (row !== void 0 && action !== "read") {
 					const node = required(await verdict(model, action));
 					if (!await holdsOn(model, row.id, node)) throw deny();
@@ -1692,6 +1649,53 @@ const engine = (resource, action, context, files) => {
 	}
 };
 //#endregion
+//#region src/tasks/schedule.ts
+var Schedule = class {
+	when;
+	run;
+	constructor(when, run) {
+		this.when = when;
+		this.run = run;
+	}
+};
+const DAILY = /^([01]\d|2[0-3]):00$/;
+/** `schedule(when, run)` in `#app`. */
+function schedule(when, run) {
+	if ("daily" in when && !DAILY.test(when.daily)) throw new TypeError(`isai: a daily schedule runs at a whole hour ("03:00"), not "${when.daily}"`);
+	if (!("daily" in when) && when.hourly !== true) throw new TypeError("isai: a schedule is { hourly: true } or { daily: \"HH:00\" }");
+	return new Schedule(when, run);
+}
+/** Every schedule among the app modules' exports. */
+function schedulesIn(modules) {
+	const found = /* @__PURE__ */ new Set();
+	for (const module of modules) for (const value of Object.values(module)) if (value instanceof Schedule) found.add(value);
+	return [...found];
+}
+/** The hour (0–23) `now` falls in, in `timezone`. */
+function hourIn(now, timezone = "UTC") {
+	const hour = new Intl.DateTimeFormat("en-GB", {
+		timeZone: timezone,
+		hour: "2-digit",
+		hourCycle: "h23"
+	}).format(now);
+	return Number(hour);
+}
+/** Whether `when` is due in the hour `now` falls in. */
+function isDue(when, now, timezone) {
+	return "daily" in when ? Number(when.daily.slice(0, 2)) === hourIn(now, timezone) : true;
+}
+/**
+* The timer check: runs every schedule due in `now`'s hour, one after another. One that fails is
+* logged and the rest still run.
+*/
+async function tick(schedules, now, timezone) {
+	for (const due of schedules.filter((one) => isDue(one.when, now, timezone))) try {
+		await due.run({ now });
+	} catch (error) {
+		console.error(`isai: a schedule (${JSON.stringify(due.when)}) failed`, error);
+	}
+}
+//#endregion
 //#region src/audit/routes.ts
 /**
 * The whole log, a built-in route:
@@ -2493,6 +2497,7 @@ function uploadTargets(modules, resources) {
 					route,
 					key
 				},
+				...route.upload ? { check: route.upload } : {},
 				allow: async (context) => {
 					if (!route.anonymous && !context.user) throw signInRequired();
 				}
@@ -2720,6 +2725,20 @@ function uploadRoute(options) {
 			throw fileTypeRefused(fileTypeNames(spec.types));
 		}
 		const db = accessOf(context.db).trusted;
+		if (target.check) {
+			const { bytes } = await db.findMany(options.upload).totals((u) => ({ bytes: u.size.sum() }));
+			try {
+				await target.check(context, {
+					field: target.route?.key ?? field,
+					size,
+					type: sniffed.type,
+					pending: bytes ?? 0
+				});
+			} catch (error) {
+				await body.cancel().catch(() => {});
+				throw error;
+			}
+		}
 		const user = context.user;
 		const put = async (key) => {
 			try {
@@ -2757,7 +2776,10 @@ function uploadRoute(options) {
 					height
 				}].sort((a, b) => b.width - a.width)
 			};
-			await db.updateOne(options.upload, { fileId: sizeOf }, { file });
+			await db.updateOne(options.upload, { fileId: sizeOf }, {
+				file,
+				size: Number(pending.size ?? 0) + size
+			});
 			return json(201, await options.answer(file, new URL(request.url).origin));
 		}
 		const id = newFileId();
@@ -2774,6 +2796,7 @@ function uploadRoute(options) {
 		await db.createOne(options.upload, {
 			fileId: id,
 			file,
+			size,
 			target: name,
 			user: user?.id ?? null,
 			expiresAt: new Date(clockOf(db).now().getTime() + UPLOAD_TTL_MS)
@@ -2883,8 +2906,10 @@ function dispositionOf(type, name) {
 }
 //#endregion
 //#region src/files/service.ts
+/** How many expired uploads one sweep reads at a time. */
+const SWEEP_BATCH = 100;
 function appFiles(options) {
-	const { storages, url, tenant } = options;
+	const { storages, url, tenant, db: dbOf, upload: uploadOf } = options;
 	const storageOf = (name) => {
 		const storage = storages[name];
 		if (!storage) throw new TypeError(`isai: there's no storage "${name}" in app.ts`);
@@ -2944,6 +2969,30 @@ function appFiles(options) {
 		url: async (file, { origin = "" } = {}) => url(file, origin),
 		delete: async (file) => {
 			await Promise.all(keysOf(file).map((key) => storageOf(file.storage).delete(key)));
+		},
+		sweep: async () => {
+			const upload = uploadOf();
+			if (!upload) throw new TypeError("isai: app.files.sweep needs base.uploads({ database }) in db/index.ts");
+			const db = dbOf();
+			const now = clockOf(db).now();
+			let removed = 0;
+			for (;;) {
+				const expired = await db.findMany(upload).where((u) => u.expiresAt.lte(now)).limit(SWEEP_BATCH).all();
+				if (expired.length === 0) return { removed };
+				await Promise.all(expired.flatMap((row) => {
+					const file = row.file;
+					return keysOf(file).map(async (key) => {
+						try {
+							await storageOf(file.storage).delete(key);
+						} catch (error) {
+							console.error(`isai: couldn't remove ${key} from storage "${file.storage}"`, error);
+						}
+					});
+				}));
+				const ids = expired.map((row) => String(row.fileId));
+				await db.deleteMany(upload).where((u) => u.fileId.in(ids));
+				removed += ids.length;
+			}
 		}
 	};
 }
@@ -3158,12 +3207,28 @@ function createCore(config, env, options = {}) {
 		invite: (input) => invite(currentDb(), models, input),
 		revoke: (input) => revoke(currentDb(), models, input)
 	});
-	const single = named.kind === "database" ? database({
+	const scope = new Scope();
+	/** Tells `onWrite` what each committed write on `db` touched, and in which tenant. */
+	const watched = (db, name) => {
+		const { onWrite } = config;
+		if (onWrite) db.subscribe(async (writes) => {
+			const tenant = scope.current()?.tenant;
+			try {
+				await onWrite(writes, {
+					database: name,
+					...tenant ? { tenant } : {}
+				});
+			} catch (error) {
+				console.error(`isai: onWrite failed after a write to the ${name} database`, error);
+			}
+		});
+		return db;
+	};
+	const single = named.kind === "database" ? watched(database({
 		driver: named,
 		name,
 		...zoned
-	}) : void 0;
-	const scope = new Scope();
+	}), name) : void 0;
 	const registry = serviceRegistry(services, seeds);
 	/** The app's database: with tenancy, the current tenant's (inside one), and nothing outside. */
 	const currentDb = () => {
@@ -3265,11 +3330,11 @@ function createCore(config, env, options = {}) {
 		});
 		return pipeline;
 	};
-	const platform = named.kind === "tenantDatabases" ? database({
+	const platform = named.kind === "tenantDatabases" ? watched(database({
 		driver: config.databases[PLATFORM],
 		name: PLATFORM,
 		...zoned
-	}) : void 0;
+	}), PLATFORM) : void 0;
 	const platformModels = auth && platform && config.tenancy ? authModels(new Model(config.tenancy.tenant.registry.get(`${PLATFORM_PREFIX}User`), config.tenancy.tenant.registry), PLATFORM_PREFIX) : void 0;
 	const platformDb = () => platform;
 	let platformReady;
@@ -3341,6 +3406,7 @@ function createCore(config, env, options = {}) {
 			registry,
 			models,
 			woken: syncedRoles,
+			watched: (db) => watched(db, TENANT),
 			run: (db, tenant, fn) => scope.run({
 				db,
 				tenant
@@ -3376,7 +3442,12 @@ function createCore(config, env, options = {}) {
 		files: appFiles({
 			storages,
 			url,
-			tenant: () => scope.current()?.tenant
+			tenant: () => scope.current()?.tenant,
+			db: currentDb,
+			upload: () => {
+				const models = auth?.user.registry ?? config.tenancy?.tenant.registry;
+				return models?.has("Upload") ? new Model(models.get("Upload"), models) : void 0;
+			}
 		}),
 		handle,
 		openTenant,
@@ -3411,7 +3482,7 @@ function createCore(config, env, options = {}) {
 			return await named.call(id, ref, args, tenant);
 		} }),
 		runTask: async () => notImplemented("app.runTask"),
-		tick: async () => notImplemented("app.tick")
+		tick: async (now) => tick(schedulesIn((await loadModules()).modules), now, timezone)
 	};
 }
 /**
@@ -3422,11 +3493,11 @@ function createCore(config, env, options = {}) {
 */
 function tenantCore(databases, host, options) {
 	const driver = databases.open(host);
-	const db = database({
+	const db = options.watched(database({
 		driver,
 		name: TENANT,
 		...options.zoned
-	});
+	}));
 	let woken;
 	let recorded = false;
 	const wake = () => {
@@ -3587,8 +3658,9 @@ function createApp(runtime, configure, options = {}) {
 		Tenant: runtime.tenant?.(start),
 		route,
 		resource,
-		fail
+		fail,
+		schedule
 	};
 }
 //#endregion
-export { NotImplementedError, Rejected, Route, createApp, fail };
+export { NotImplementedError, Rejected, Route, Schedule, createApp, fail };