@lotics/cli 0.285.0 → 0.287.0

package/dist/src/cli.js

@@ -22071,16 +22071,13 @@ var uploadTicketResultSchema = zod_default.object({
   file_name: zod_default.string(),
   mime_type: zod_default.string(),
   size_bytes: zod_default.number(),
-  sha256: zod_default.string(),
-  /** True when these bytes were already in the workspace and no second copy was
-   *  stored. Stated rather than left to inference, because the caller then gets
-   *  back a `file_name` it did not send — the stored file's, not the one it
-   *  uploaded under — and a silent difference reads as a bug. */
-  deduplicated: zod_default.boolean()
+  sha256: zod_default.string().describe("sha256 of the bytes received, so a caller can prove they arrived intact.")
 });
 var fileSizeSchema = zod_default.number().int().positive().max(MAX_UPLOAD_FILE_SIZE);
+var CLIENT_FILE_ID_REFUSAL = "This page is out of date. Reload it to upload files.";
+var refusedClientFileIdSchema = zod_default.never({ error: CLIENT_FILE_ID_REFUSAL }).optional().describe("Never sent: the server mints the file id.");
 var directUploadInitRequestSchema = zod_default.object({
-  file_id: zod_default.string().optional(),
+  file_id: refusedClientFileIdSchema,
   filename: zod_default.string(),
   mime_type: zod_default.string(),
   file_size: fileSizeSchema
@@ -22100,7 +22097,7 @@ var directUploadCompleteRequestSchema = zod_default.object({
   )
 });
 var multipartInitRequestSchema = zod_default.object({
-  file_id: zod_default.string().optional(),
+  file_id: refusedClientFileIdSchema,
   filename: zod_default.string(),
   mime_type: zod_default.string(),
   file_size: fileSizeSchema,
@@ -25053,6 +25050,12 @@ function everyOptionMarked(nameOf) {
   };
 }
 
+// ../shared/src/diacritics.ts
+var COMBINING_MARKS = /[̀-ͯ]/g;
+function foldDiacritics(value) {
+  return value.normalize("NFD").replace(COMBINING_MARKS, "").replace(/[đĐ]/g, (c) => c === "\u0111" ? "d" : "D");
+}
+
 // ../shared/src/schemas/table_filters.ts
 var tableRecordNumberFieldFilterSchema = zod_default.object({
   type: zod_default.literal("number"),
@@ -25408,6 +25411,7 @@ var VALID_OPERATORS = {
   record_id: RECORD_ID_OPS
 };
 var VALID_FILTER_TYPES = Object.keys(VALID_OPERATORS);
+var DEFAULT_MAX_DEPTH = 4;
 var MAX_TRAVERSAL_PATH_LENGTH = 3;
 var NO_VALUE_OPERATORS = /* @__PURE__ */ new Set([
   "is_empty",
@@ -25425,10 +25429,10 @@ function listElementIssue(value) {
   const actual = item === null ? "null" : Array.isArray(item) ? "array" : typeof item;
   return `item ${index} is ${actual}`;
 }
-function conditionValueIssue(type, operator, value, fieldKey) {
+function conditionValueIssue({ type, operator, value, fieldKey }, check2) {
   if (NO_VALUE_OPERATORS.has(operator)) return null;
   if (value === null || value === void 0) return null;
-  if (isTemplateExpression(value)) return null;
+  if (check2.templates === "filled" && isTemplateExpression(value)) return null;
   if (type === "date") {
     const parsed = tableRecordDateFieldFilterSchema.safeParse({
       type,
@@ -25486,7 +25490,8 @@ function conditionValueIssue(type, operator, value, fieldKey) {
       return null;
   }
 }
-function conditionIssues(node, path17, fieldMap) {
+function conditionIssues(node, path17, check2) {
+  const { fieldMap } = check2;
   if (!node || typeof node !== "object") {
     return [`${path17}: expected condition object, got ${typeof node}`];
   }
@@ -25557,11 +25562,14 @@ function conditionIssues(node, path17, fieldMap) {
       filterType === "number" ? `Filter on "${obj.field_key}": unit_option is the key of an option, got ${Array.isArray(obj.unit_option) ? "array" : typeof obj.unit_option}.` : `Filter on "${obj.field_key}": unit_option names the unit a number is compared in, and a ${filterType} condition compares none.`
     ];
   }
-  const valueIssue = conditionValueIssue(filterType, obj.operator, obj.value, obj.field_key);
+  const valueIssue = conditionValueIssue(
+    { type: filterType, operator: obj.operator, value: obj.value, fieldKey: obj.field_key },
+    check2
+  );
   return valueIssue ? [valueIssue] : [];
 }
 function validateFilterCondition(condition, path17 = "filter") {
-  return conditionIssues(condition, path17, void 0);
+  return conditionIssues(condition, path17, { fieldMap: void 0, maxDepth: DEFAULT_MAX_DEPTH, templates: "filled" });
 }
 function inheritedFilterType(type, format2, fallback) {
   switch (type) {
@@ -27398,6 +27406,106 @@ function sample(arr) {
   return arr[Math.floor(Math.random() * arr.length)];
 }
 
+// ../shared/src/expression_limits.ts
+var MAX_RESULT_LENGTH = 1e5;
+var MAX_STRING_LENGTH = 1e7;
+var MAX_RANDOM_LENGTH = 1e3;
+var MAX_RUN_BUILT_BYTES = 512 * 1024 * 1024;
+var MAX_PERSISTED_JSON_LENGTH = 64 * 1024 * 1024;
+var ExpressionLimitError = class extends Error {
+  constructor(message2) {
+    super(message2);
+    this.name = "ExpressionLimitError";
+  }
+};
+function jsonLengthUpTo(value, max2) {
+  const top = jsonValue(value, "");
+  if (isOmitted(top)) return 0;
+  let length2 = 0;
+  const pending = [top];
+  while (pending.length > 0 && length2 <= max2) {
+    const member = pending.pop();
+    if (typeof member === "string") {
+      length2 += member.length + 2;
+      if (length2 <= max2) length2 += escapedLength(member) - member.length;
+    } else if (typeof member === "number") {
+      length2 += Number.isFinite(member) ? String(member).length : 4;
+    } else if (typeof member === "boolean") {
+      length2 += member ? 4 : 5;
+    } else if (typeof member === "bigint") {
+      length2 += String(member).length;
+    } else if (member === null || typeof member !== "object") {
+      length2 += 4;
+    } else if (Array.isArray(member)) {
+      length2 += member.length === 0 ? 2 : member.length + 1;
+      for (let index = 0; index < member.length && length2 <= max2; index++) {
+        const element = jsonValue(member[index], String(index));
+        if (isOmitted(element)) length2 += 4;
+        else pending.push(element);
+      }
+    } else {
+      length2 += 2;
+      let members = 0;
+      for (const key of Object.keys(member)) {
+        if (length2 > max2) break;
+        const held = jsonValue(Reflect.get(member, key), key);
+        if (isOmitted(held)) continue;
+        length2 += escapedLength(key) + 2 + (members === 0 ? 1 : 2);
+        members += 1;
+        pending.push(held);
+      }
+    }
+  }
+  return length2;
+}
+function jsonValue(value, key) {
+  if (typeof value !== "object" || value === null) return value;
+  const toJSON = Reflect.get(value, "toJSON");
+  if (typeof toJSON !== "function") return value;
+  const written = Reflect.apply(toJSON, value, [key]);
+  return written;
+}
+function isOmitted(value) {
+  return value === void 0 || typeof value === "function" || typeof value === "symbol";
+}
+var ESCAPED = /["\\\u0000-\u001f\ud800-\udfff]/;
+function escapedLength(text) {
+  if (!ESCAPED.test(text)) return text.length;
+  let length2 = 0;
+  for (let at2 = 0; at2 < text.length; at2++) {
+    const code = text.charCodeAt(at2);
+    if (code === 34 || code === 92 || code === 8 || code === 9 || code === 10 || code === 12 || code === 13) {
+      length2 += 2;
+    } else if (code < 32) {
+      length2 += 6;
+    } else if (code >= 55296 && code <= 56319 && isLowSurrogate(text.charCodeAt(at2 + 1))) {
+      length2 += 2;
+      at2 += 1;
+    } else {
+      length2 += code >= 55296 && code <= 57343 ? 6 : 1;
+    }
+  }
+  return length2;
+}
+function isLowSurrogate(code) {
+  return code >= 56320 && code <= 57343;
+}
+function textLengthUpTo(value, max2) {
+  return textLength(value, max2, /* @__PURE__ */ new Set());
+}
+function textLength(value, max2, joining) {
+  if (!Array.isArray(value)) return String(value).length;
+  if (joining.has(value)) return 0;
+  joining.add(value);
+  let length2 = Math.max(0, value.length - 1);
+  for (let index = 0; index < value.length && length2 <= max2; index++) {
+    const element = value[index];
+    if (element != null) length2 += textLength(element, max2 - length2, joining);
+  }
+  joining.delete(value);
+  return length2;
+}
+
 // ../shared/src/expression_array.ts
 var expression_array_exports = {};
 __export(expression_array_exports, {
@@ -27461,12 +27569,36 @@ function compareValues(a, b) {
 function isCallback(v) {
   return typeof v === "function";
 }
+function assertCallbackInput(helper, arr) {
+  if (arr.length > MAX_RESULT_LENGTH) {
+    throw new ExpressionLimitError(`${helper}: too many elements for a callback (max ${MAX_RESULT_LENGTH})`);
+  }
+}
+async function callEach(arr, cb) {
+  const results = Array.from({ length: arr.length });
+  let next = 0;
+  let failed = false;
+  const work = async () => {
+    while (!failed && next < arr.length) {
+      const i = next;
+      next += 1;
+      results[i] = await Promise.resolve().then(() => cb(arr[i], i)).catch((error52) => {
+        failed = true;
+        throw error52;
+      });
+    }
+  };
+  const extra = arr.length > 1 ? cb.workers?.claim(arr.length - 1) ?? 0 : 0;
+  await Promise.all(Array.from({ length: 1 + extra }, work)).finally(() => cb.workers?.release(extra));
+  return results;
+}
 function sumBy(arr, fieldOrCb) {
   if (arr == null) return isCallback(fieldOrCb) ? Promise.resolve(0) : 0;
   if (!Array.isArray(arr)) {
     throw new Error("sumBy: expected array, got " + typeof arr);
   }
   if (isCallback(fieldOrCb)) {
+    assertCallbackInput("sumBy", arr);
     return sumByCallback(arr, fieldOrCb);
   }
   if (typeof fieldOrCb !== "string") {
@@ -27478,7 +27610,7 @@ function sumBy(arr, fieldOrCb) {
   }, 0);
 }
 async function sumByCallback(arr, cb) {
-  const values2 = await Promise.all(arr.map((item, idx) => cb(item, idx)));
+  const values2 = await callEach(arr, cb);
   return values2.reduce((sum2, val) => sum2 + (typeof val === "number" ? val : 0), 0);
 }
 function meanBy(arr, fieldOrCb) {
@@ -27489,7 +27621,8 @@ function meanBy(arr, fieldOrCb) {
     throw new Error("meanBy: array cannot be empty");
   }
   if (isCallback(fieldOrCb)) {
-    return Promise.all(arr.map((item, idx) => fieldOrCb(item, idx))).then(
+    assertCallbackInput("meanBy", arr);
+    return callEach(arr, fieldOrCb).then(
       (vals) => vals.reduce((acc, v) => acc + (typeof v === "number" ? v : 0), 0) / arr.length
     );
   }
@@ -27511,6 +27644,7 @@ function minBy(arr, fieldOrCb) {
     throw new Error("minBy: array cannot be empty");
   }
   if (isCallback(fieldOrCb)) {
+    assertCallbackInput("minBy", arr);
     return selectByCallback(arr, fieldOrCb, (cmp) => cmp < 0);
   }
   const field = fieldOrCb;
@@ -27537,6 +27671,7 @@ function maxBy(arr, fieldOrCb) {
     throw new Error("maxBy: array cannot be empty");
   }
   if (isCallback(fieldOrCb)) {
+    assertCallbackInput("maxBy", arr);
     return selectByCallback(arr, fieldOrCb, (cmp) => cmp > 0);
   }
   const field = fieldOrCb;
@@ -27556,7 +27691,7 @@ function maxBy(arr, fieldOrCb) {
   return maxItem;
 }
 async function selectByCallback(arr, cb, keep) {
-  const keys2 = await Promise.all(arr.map((item, idx) => cb(item, idx)));
+  const keys2 = await callEach(arr, cb);
   let bestItem = arr[0];
   let bestKey = keys2[0];
   for (let i = 1; i < arr.length; i++) {
@@ -27575,7 +27710,8 @@ function countBy(arr, fieldOrCb) {
     throw new Error("countBy: expected array, got " + typeof arr);
   }
   if (isCallback(fieldOrCb)) {
-    return Promise.all(arr.map((item, idx) => fieldOrCb(item, idx))).then((keys2) => {
+    assertCallbackInput("countBy", arr);
+    return callEach(arr, fieldOrCb).then((keys2) => {
       const result2 = {};
       for (const val of keys2) {
         const key = val == null ? "null" : String(val);
@@ -27602,7 +27738,8 @@ function pluck(arr, fieldOrCb) {
     throw new Error("pluck: expected array, got " + typeof arr);
   }
   if (isCallback(fieldOrCb)) {
-    return Promise.all(arr.map((item, idx) => fieldOrCb(item, idx)));
+    assertCallbackInput("pluck", arr);
+    return callEach(arr, fieldOrCb);
   }
   if (typeof fieldOrCb !== "string") {
     throw new Error("pluck: second arg must be a function or field path string");
@@ -27615,6 +27752,7 @@ function filter(arr, fieldOrCb, value) {
     throw new Error("filter: expected array, got " + typeof arr);
   }
   if (isCallback(fieldOrCb)) {
+    assertCallbackInput("filter", arr);
     return filterByCallback(arr, fieldOrCb);
   }
   if (typeof fieldOrCb !== "string") {
@@ -27626,7 +27764,7 @@ function filter(arr, fieldOrCb, value) {
   });
 }
 async function filterByCallback(arr, cb) {
-  const results = await Promise.all(arr.map((item, idx) => cb(item, idx)));
+  const results = await callEach(arr, cb);
   return arr.filter((_, i) => Boolean(results[i]));
 }
 function find(arr, fieldOrCb, value) {
@@ -27635,6 +27773,7 @@ function find(arr, fieldOrCb, value) {
     throw new Error("find: expected array, got " + typeof arr);
   }
   if (isCallback(fieldOrCb)) {
+    assertCallbackInput("find", arr);
     return findByCallback(arr, fieldOrCb);
   }
   if (typeof fieldOrCb !== "string") {
@@ -27662,6 +27801,7 @@ function sortBy(arr, fieldOrCb, order) {
     throw new Error('sortBy: order must be "asc" or "desc"');
   }
   if (isCallback(fieldOrCb)) {
+    assertCallbackInput("sortBy", arr);
     return sortByCallback(arr, fieldOrCb, order);
   }
   if (typeof fieldOrCb !== "string") {
@@ -27670,7 +27810,7 @@ function sortBy(arr, fieldOrCb, order) {
   return sortBySync(arr, fieldOrCb, order);
 }
 async function sortByCallback(arr, cb, order) {
-  const keys2 = await Promise.all(arr.map((item, idx) => cb(item, idx)));
+  const keys2 = await callEach(arr, cb);
   const indexed = arr.map((item, i) => ({ item, key: keys2[i] }));
   indexed.sort((a, b) => {
     const cmp = compareValues(a.key, b.key);
@@ -27703,7 +27843,8 @@ function groupBy(arr, fieldOrCb) {
     throw new Error("groupBy: expected array, got " + typeof arr);
   }
   if (isCallback(fieldOrCb)) {
-    return Promise.all(arr.map((item, idx) => fieldOrCb(item, idx))).then((keys2) => {
+    assertCallbackInput("groupBy", arr);
+    return callEach(arr, fieldOrCb).then((keys2) => {
       const result2 = {};
       for (let i = 0; i < arr.length; i++) {
         const key = keys2[i] == null ? "null" : String(keys2[i]);
@@ -27752,7 +27893,8 @@ function uniqueBy(arr, fieldOrCb) {
     throw new Error("uniqueBy: expected array, got " + typeof arr);
   }
   if (isCallback(fieldOrCb)) {
-    return Promise.all(arr.map((item, idx) => fieldOrCb(item, idx))).then((keys2) => {
+    assertCallbackInput("uniqueBy", arr);
+    return callEach(arr, fieldOrCb).then((keys2) => {
       const seen2 = /* @__PURE__ */ new Set();
       return arr.filter((_, i) => {
         if (seen2.has(keys2[i])) return false;
@@ -27783,7 +27925,7 @@ function flatten(arr) {
     total += Array.isArray(item) ? item.length : 1;
   }
   if (total > MAX_RESULT_LENGTH) {
-    throw new Error(`flatten: too large (max ${MAX_RESULT_LENGTH} elements)`);
+    throw new ExpressionLimitError(`flatten: too large (max ${MAX_RESULT_LENGTH} elements)`);
   }
   const result = [];
   for (const item of arr) {
@@ -27882,6 +28024,7 @@ function some(arr, fieldOrCb, value) {
     throw new Error("some: expected array, got " + typeof arr);
   }
   if (isCallback(fieldOrCb)) {
+    assertCallbackInput("some", arr);
     return (async () => {
       for (let i = 0; i < arr.length; i++) {
         if (await fieldOrCb(arr[i], i)) return true;
@@ -27901,6 +28044,7 @@ function every(arr, fieldOrCb, value) {
     throw new Error("every: expected array, got " + typeof arr);
   }
   if (isCallback(fieldOrCb)) {
+    assertCallbackInput("every", arr);
     return (async () => {
       for (let i = 0; i < arr.length; i++) {
         if (!await fieldOrCb(arr[i], i)) return false;
@@ -27936,6 +28080,8 @@ function differenceBy(arr1, arr2, fieldOrCb) {
     throw new Error("differenceBy: second argument expected array, got " + typeof arr2);
   }
   if (isCallback(fieldOrCb)) {
+    assertCallbackInput("differenceBy", arr1);
+    assertCallbackInput("differenceBy", arr2);
     return keyedSetOp(arr1, arr2, fieldOrCb, false);
   }
   const field = fieldOrCb;
@@ -27965,6 +28111,8 @@ function intersectionBy(arr1, arr2, fieldOrCb) {
     throw new Error("intersectionBy: second argument expected array, got " + typeof arr2);
   }
   if (isCallback(fieldOrCb)) {
+    assertCallbackInput("intersectionBy", arr1);
+    assertCallbackInput("intersectionBy", arr2);
     return keyedSetOp(arr1, arr2, fieldOrCb, true);
   }
   const field = fieldOrCb;
@@ -27975,10 +28123,8 @@ function intersectionBy(arr1, arr2, fieldOrCb) {
   return arr1.filter((item) => set2.has(getField(item, field)));
 }
 async function keyedSetOp(arr1, arr2, cb, keepWhenPresent) {
-  const [keys1, keys2] = await Promise.all([
-    Promise.all(arr1.map((item, idx) => cb(item, idx))),
-    Promise.all(arr2.map((item, idx) => cb(item, idx)))
-  ]);
+  const keys1 = await callEach(arr1, cb);
+  const keys2 = await callEach(arr2, cb);
   const set2 = new Set(keys2);
   return arr1.filter((_, i) => set2.has(keys1[i]) === keepWhenPresent);
 }
@@ -27993,20 +28139,13 @@ async function reduce(arr, callback, initial) {
   if (arguments.length < 3) {
     throw new Error("reduce: initial value is required \u2014 reduce(arr, (acc, x) => ..., initial)");
   }
-  const startedAt2 = Date.now();
+  assertCallbackInput("reduce", arr);
   let acc = initial;
   for (let i = 0; i < arr.length; i++) {
-    if (i % 1024 === 0 && Date.now() - startedAt2 > REDUCE_TIME_BUDGET_MS) {
-      throw new Error(
-        `reduce: exceeded time budget of ${REDUCE_TIME_BUDGET_MS}ms after ${i} iterations`
-      );
-    }
     acc = await callback(acc, arr[i], i);
   }
   return acc;
 }
-var REDUCE_TIME_BUDGET_MS = 5e3;
-var MAX_RESULT_LENGTH = 1e5;
 function range(startOrEnd, end) {
   const start = end === void 0 ? 0 : startOrEnd;
   const stop = end === void 0 ? startOrEnd : end;
@@ -28016,13 +28155,13 @@ function range(startOrEnd, end) {
   const len = stop - start;
   if (len <= 0) return [];
   if (len > MAX_RESULT_LENGTH) {
-    throw new Error(`range: too large (max ${MAX_RESULT_LENGTH} elements)`);
+    throw new ExpressionLimitError(`range: too large (max ${MAX_RESULT_LENGTH} elements)`);
   }
   return Array.from({ length: len }, (_, i) => start + i);
 }
 function list(...items) {
   if (items.length > MAX_RESULT_LENGTH) {
-    throw new Error(`list: too large (max ${MAX_RESULT_LENGTH} elements)`);
+    throw new ExpressionLimitError(`list: too large (max ${MAX_RESULT_LENGTH} elements)`);
   }
   return items;
 }
@@ -28058,7 +28197,7 @@ function concatArrays(arrays) {
     total += arr.length;
   }
   if (total > MAX_RESULT_LENGTH) {
-    throw new Error(`concat: too large (max ${MAX_RESULT_LENGTH} elements)`);
+    throw new ExpressionLimitError(`concat: too large (max ${MAX_RESULT_LENGTH} elements)`);
   }
   const result = [];
   for (let i = 0; i < arrays.length; i++) {
@@ -28111,7 +28250,10 @@ function join(arr, separator) {
   if (typeof separator !== "string") {
     throw new Error("join: separator must be a string");
   }
-  return arr.map(String).join(separator);
+  const parts = arr.map(String);
+  const separatorsLength = Math.max(0, parts.length - 1) * separator.length;
+  assertStringLength("join", parts.reduce((total, part) => total + part.length, separatorsLength));
+  return parts.join(separator);
 }
 function split(str, separator) {
   if (str == null) return [];
@@ -28121,7 +28263,11 @@ function split(str, separator) {
   if (typeof separator !== "string") {
     throw new Error("split: separator must be a string");
   }
-  return str.split(separator);
+  const parts = str.split(separator, MAX_RESULT_LENGTH + 1);
+  if (parts.length > MAX_RESULT_LENGTH) {
+    throw new ExpressionLimitError(`split: too many parts (max ${MAX_RESULT_LENGTH})`);
+  }
+  return parts;
 }
 function trim(str) {
   if (str == null) return "";
@@ -28176,8 +28322,26 @@ function replaceAll(str, search, replacement) {
   if (typeof replacement !== "string") {
     throw new Error("replaceAll: replacement must be a string");
   }
+  const matches = matchCount(str, search);
+  if (matches >= MAX_STRING_LENGTH) {
+    throw new ExpressionLimitError(`replaceAll: too many matches (max ${MAX_STRING_LENGTH})`);
+  }
+  assertStringLength("replaceAll", str.length + matches * (replacement.length - search.length));
   return str.split(search).join(replacement);
 }
+function matchCount(str, search) {
+  if (search === "") return Math.max(0, str.length - 1);
+  let matches = 0;
+  for (let at2 = str.indexOf(search); at2 !== -1; at2 = str.indexOf(search, at2 + search.length)) {
+    matches += 1;
+  }
+  return matches;
+}
+function assertStringLength(helper, length2) {
+  if (length2 > MAX_STRING_LENGTH) {
+    throw new ExpressionLimitError(`${helper}: result too long (max ${MAX_STRING_LENGTH} characters)`);
+  }
+}
 function startsWith(str, prefix) {
   if (str == null) return false;
   if (typeof str !== "string") {
@@ -28222,6 +28386,7 @@ function padStart(str, length2, char) {
   if (typeof char !== "string") {
     throw new Error("padStart: char must be a string");
   }
+  assertStringLength("padStart", length2);
   return str.padStart(length2, char);
 }
 function padEnd(str, length2, char) {
@@ -28235,6 +28400,7 @@ function padEnd(str, length2, char) {
   if (typeof char !== "string") {
     throw new Error("padEnd: char must be a string");
   }
+  assertStringLength("padEnd", length2);
   return str.padEnd(length2, char);
 }
 function length(value) {
@@ -28820,6 +28986,9 @@ function toNumber(val) {
 }
 function toString(val) {
   if (val == null) return "";
+  if (typeof val !== "string" && textLengthUpTo(val, MAX_STRING_LENGTH) > MAX_STRING_LENGTH) {
+    throw new ExpressionLimitError(`toString: result too long (max ${MAX_STRING_LENGTH} characters)`);
+  }
   return String(val);
 }
 function isNull(val) {
@@ -28843,6 +29012,9 @@ function parseJson(value) {
   }
 }
 function toJson(value) {
+  if (jsonLengthUpTo(value, MAX_STRING_LENGTH) > MAX_STRING_LENGTH) {
+    throw new ExpressionLimitError(`toJson: result too long (max ${MAX_STRING_LENGTH} characters)`);
+  }
   return JSON.stringify(value) ?? "null";
 }
 function typeOf(value) {
@@ -31121,9 +31293,15 @@ function getDateExpressionFunctions(defaultTimezone) {
 
 // ../shared/src/js_expression.ts
 var DANGEROUS_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+var ExpressionNotPermittedError = class extends Error {
+  constructor(message2) {
+    super(message2);
+    this.name = "ExpressionNotPermittedError";
+  }
+};
 function assertSafeKey(key) {
   if (typeof key === "string" && DANGEROUS_KEYS.has(key)) {
-    throw new Error(`Access to "${key}" is not permitted in expressions`);
+    throw new ExpressionNotPermittedError(`Access to "${key}" is not permitted in expressions`);
   }
 }
 function isNothing(value) {
@@ -31149,7 +31327,7 @@ var SafeEvalAstFactory = class extends EvalAstFactory {
   }
   binary(left, op, right) {
     if (op === "=") {
-      throw new Error("Assignment is not permitted in expressions");
+      throw new ExpressionNotPermittedError("Assignment is not permitted in expressions");
     }
     const multiplicative = MULTIPLICATIVE_OPERATORS.get(op);
     if (multiplicative) {
@@ -31215,6 +31393,18 @@ var SafeEvalAstFactory = class extends EvalAstFactory {
       }
     };
   }
+  arrowFunction(params, body) {
+    const parsed = super.arrowFunction(params, body);
+    return {
+      type: "ArrowFunction",
+      params,
+      body,
+      evaluate() {
+        throw new ExpressionNotPermittedError("An arrow function cannot run in this expression");
+      },
+      getIds: (idents) => parsed.getIds(idents)
+    };
+  }
   index(receiver, argument) {
     return {
       type: "Index",
@@ -31295,13 +31485,20 @@ function createTimezoneAwareFunctions(defaultTimezone) {
   };
 }
 var numericAlphabet = customAlphabet("0123456789");
+function assertRandomLength(helper, length2) {
+  if (length2 > MAX_RANDOM_LENGTH) {
+    throw new ExpressionLimitError(`${helper}: length ${length2} is over ${MAX_RANDOM_LENGTH}.`);
+  }
+}
 function randomNumber(length2) {
+  assertRandomLength("randomNumber", length2);
   return numericAlphabet(length2);
 }
 var alphanumericAlphabet = customAlphabet(
   "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"
 );
 function randomAlphaNumeric(length2) {
+  assertRandomLength("randomAlphaNumeric", length2);
   return alphanumericAlphabet(length2);
 }
 
@@ -32518,7 +32715,7 @@ function validateContract(contract) {
     }
   }
   for (const entity of contract.entities) {
-    const ownFields = fieldsOnEntity(entity.alias);
+    const ownFields2 = fieldsOnEntity(entity.alias);
     for (const field of entity.fields) {
       const fieldPath = `entities.${entity.alias}.fields.${field.alias}`;
       const stated = statedFigureSelect(field);
@@ -32618,7 +32815,7 @@ function validateContract(contract) {
           for (const token2 of parseFieldRefTokens(field.formula.expression)) {
             const option = contractOptionRef(token2);
             const ref = option?.field ?? token2;
-            if (!ownFields.has(ref)) {
+            if (!ownFields2.has(ref)) {
               errors.push({
                 severity: "error",
                 rule: "field.formula",
@@ -32789,12 +32986,6 @@ var bindingSchema = zod_default.object({
   apps: bindingMapSchema.default({})
 });
 
-// ../shared/src/diacritics.ts
-var COMBINING_MARKS = /[̀-ͯ]/g;
-function foldDiacritics(value) {
-  return value.normalize("NFD").replace(COMBINING_MARKS, "").replace(/[đĐ]/g, (c) => c === "\u0111" ? "d" : "D");
-}
-
 // ../shared/src/formula.ts
 function getSyntheticValue(field) {
   switch (field.type) {
@@ -33963,7 +34154,7 @@ function computedTypeFindings(entities) {
 }
 
 // ../shared/src/schemas/app_spec_version.ts
-var APP_SPEC_VERSION = 14;
+var APP_SPEC_VERSION = 15;
 
 // ../shared/src/schemas/app_query_aggregate.ts
 var AGGREGATE_MAX_BY = 3;
@@ -34159,6 +34350,8 @@ var specEntitySchema = zod_default.object({
   figure: specColumnAliasSchema.optional(),
   /** Every row (register, picker). */
   list: specReadSchema,
+  /** The fields a row of `list` carries, where fewer than `fields`: a record's own ride `one`. */
+  listed: zod_default.array(specColumnAliasSchema).min(1).optional(),
   /** One row by its id; `param` names the id. */
   one: specReadSchema.optional(),
   /** The workflows that write this entity's rows; absent, this app does not. `fields` are what an add asks where nothing narrower is stated. */
@@ -35448,6 +35641,9 @@ var queryGroupNodeSchema = zod_default.object({
   by: zod_default.array(queryGroupKeySchema).describe(
     "Group keys: input column names, or `{ bucket: { source, granularity, output } }` date buckets. A bucket truncates a date/datetime column to the bucket START as a `date` column (wall-clock semantics; `week` starts on ISO Monday; null source \u2192 null bucket). Empty = single-row aggregate."
   ),
+  sets: zod_default.array(zod_default.array(zod_default.string())).min(1).optional().describe(
+    "Several groupings answered by one read: each lists the `by` outputs it groups by (`[]` = one row over every row). A key outside a row's set is null there, and `__grouping` holds the set's bits: one per `by` key it leaves out, the last key the lowest. Absent: one grouping by every key."
+  ),
   aggregates: zod_default.array(queryAggregateColumnSchema).min(1)
 });
 var queryWindowNodeSchema = zod_default.object({
@@ -37679,15 +37875,15 @@ function listBack(model, record2, list2, rows) {
   const backs = rows.fields.filter((one) => one.type === "select_record_link" && one.target_entity === record2.alias && (list2.paired_field_alias === void 0 || one.alias === list2.paired_field_alias));
   return backs.length === 1 ? backs[0]?.alias : void 0;
 }
-function actFields(act) {
+function actFields(act, record2 = true) {
   return [
     ...act.asks.flatMap((ask) => typeof ask === "string" ? [ask] : ask.default === void 0 ? [] : [ask.default]),
     ...act.requires,
-    ...act.recommends,
+    ...record2 ? act.recommends : [],
     ...act.when.map((gate) => gate.field),
     ...(act.templates ?? []).flatMap((one) => one.when.map((gate) => gate.field)),
     ...Object.keys(act.set),
-    ...act.into === void 0 ? [] : [act.into],
+    ...record2 && act.into !== void 0 ? [act.into] : [],
     ...act.intake === void 0 ? [] : [...act.intake.fields, ...act.intake.parties.map((party) => party.link)]
   ];
 }
@@ -37708,36 +37904,7 @@ function appDrawnFields(given, app) {
   const add = (alias2, fields) => {
     drawn.set(alias2, unique2([...drawn.get(alias2) ?? [], ...fields]));
   };
-  const own2 = [
-    ...app.scope === void 0 ? [] : [app.scope.field],
-    ...app.register.columns,
-    ...app.register.filters.map(filterField),
-    ...app.register.search ?? [],
-    ...(app.register.sort ?? []).map((key) => key.field),
-    ...app.register.group === void 0 ? [] : [app.register.group],
-    ...app.register.create ?? [],
-    // A chip it opens on narrows the rows in view by a column the read returns, and an add writes what `where` keeps;
-    // a lane is the row its link names.
-    ...[...app.register.where, ...app.register.opens].map((one) => one.field),
-    ...app.register.lanes === void 0 ? [] : [app.register.lanes.field, app.register.lanes.start, ...app.register.lanes.end === void 0 ? [] : [app.register.lanes.end], ...(app.register.lanes.loads ?? []).map((load) => load.value)],
-    ...app.register.roster?.of === void 0 ? [] : [app.register.roster.of],
-    ...app.register.gantt === void 0 ? [] : ganttFields(app.register.gantt),
-    ...app.register.readings.flatMap(readingFields),
-    // A tab narrows, bounds and orders the rows by columns the read returns.
-    ...app.register.tabs.flatMap((tab) => [
-      ...tab.term === void 0 ? [] : tab.term.kind === "in" ? [tab.term.field] : [tab.term.from, tab.term.to],
-      ...tab.where.map((one) => one.field),
-      ...(tab.sort ?? []).map((key) => key.field)
-    ]),
-    ...app.record.sections.flatMap((section) => [...section.fields, ...section.when.map((gate) => gate.field)]),
-    ...resolvedBlocks(app.record).flatMap((block) => [
-      ...block.kind === "files" ? block.fields : block.kind === "text" ? [block.field] : [],
-      ...block.when.map((gate) => gate.field)
-    ]),
-    ...app.acts.flatMap((act) => act.of === void 0 ? actFields(act) : []),
-    ...app.checks.flatMap((check2) => check2.of === void 0 ? [check2.field] : [])
-  ];
-  add(app.entity, own2);
+  add(app.entity, ownFields(app, true));
   for (const alias2 of [app.entity, ...resolvedBlocks(app.record).flatMap((block) => block.kind === "rows" ? [block.entity] : [])]) {
     const about = recordDisplay(model, alias2)?.description;
     if (about !== void 0) add(alias2, [about]);
@@ -37815,22 +37982,57 @@ function appDrawnFields(given, app) {
   for (const [alias2, writes] of plan) {
     add(alias2, [...writes.create ?? [], ...writes.update, ...writes.stamps.map((stamp) => stamp.field)]);
     const written = /* @__PURE__ */ new Set([...writes.create ?? [], ...writes.update]);
-    const entity = entityOf(model, alias2);
     for (const [field, rule] of Object.entries(model.write_rules?.[alias2]?.fields ?? {})) {
       if (rule.suggest !== void 0 && written.has(field)) {
         const offered = suggestRef(rule.suggest);
         add(offered.entity, [offered.field]);
       }
-      if (rule.default_from === void 0 || !written.has(field) || entity === void 0) continue;
-      const [via = "", source = ""] = rule.default_from.split(".");
-      const link = fieldOf(entity, via);
-      if (link?.type !== "select_record_link") continue;
-      add(alias2, [via]);
-      add(link.target_entity, [source]);
+      const start = written.has(field) ? startOf(model, alias2, rule) : void 0;
+      if (start === void 0) continue;
+      add(alias2, [start.via]);
+      add(start.target, [start.source]);
     }
   }
   return followLinks(model, drawn);
 }
+function ownFields(app, record2) {
+  return [
+    ...app.scope === void 0 ? [] : [app.scope.field],
+    ...app.register.columns,
+    ...app.register.filters.map(filterField),
+    ...app.register.search ?? [],
+    ...(app.register.sort ?? []).map((key) => key.field),
+    ...app.register.group === void 0 ? [] : [app.register.group],
+    ...record2 ? app.register.create ?? [] : [],
+    // A chip it opens on narrows the rows in view by a column the read returns, and an add writes what `where` keeps;
+    // a lane is the row its link names.
+    ...[...app.register.where, ...app.register.opens].map((one) => one.field),
+    ...app.register.lanes === void 0 ? [] : [app.register.lanes.field, app.register.lanes.start, ...app.register.lanes.end === void 0 ? [] : [app.register.lanes.end], ...(app.register.lanes.loads ?? []).map((load) => load.value)],
+    ...app.register.roster?.of === void 0 ? [] : [app.register.roster.of],
+    ...app.register.gantt === void 0 ? [] : ganttFields(app.register.gantt),
+    ...app.register.readings.flatMap(readingFields),
+    // A tab narrows, bounds and orders the rows by columns the read returns.
+    ...app.register.tabs.flatMap((tab) => [
+      ...tab.term === void 0 ? [] : tab.term.kind === "in" ? [tab.term.field] : [tab.term.from, tab.term.to],
+      ...tab.where.map((one) => one.field),
+      ...(tab.sort ?? []).map((key) => key.field)
+    ]),
+    // A report narrows the rows in view by what it states, as a chip does, and one file per value splits them.
+    ...app.register.export === void 0 || app.register.export === true ? [] : app.register.export.flatMap((report) => [...report.where.map((one) => one.field), ...report.per === void 0 ? [] : [report.per]]),
+    // A section's condition gates, on a row, an act that states none of its own.
+    ...app.record.sections.flatMap((section) => [...record2 ? section.fields : [], ...section.when.map((gate) => gate.field)]),
+    ...record2 ? resolvedBlocks(app.record).flatMap((block) => [...block.kind === "files" ? block.fields : block.kind === "text" ? [block.field] : [], ...block.when.map((gate) => gate.field)]) : [],
+    ...app.acts.flatMap((act) => act.of === void 0 ? actFields(act, record2) : []),
+    ...app.checks.flatMap((check2) => check2.of === void 0 ? [check2.field] : [])
+  ];
+}
+function startOf(model, alias2, rule) {
+  const entity = entityOf(model, alias2);
+  if (rule.default_from === void 0 || entity === void 0) return void 0;
+  const [via = "", source = ""] = rule.default_from.split(".");
+  const link = fieldOf(entity, via);
+  return link?.type === "select_record_link" ? { via, target: link.target_entity, source } : void 0;
+}
 function readingsDrawnFields(model, readings) {
   const drawn = /* @__PURE__ */ new Map();
   for (const reading of readings) drawn.set(reading.entity, unique2([...drawn.get(reading.entity) ?? [], ...readingFields(reading)]));
@@ -41775,8 +41977,8 @@ function resultSideEffects(result) {
 }
 
 // src/version.ts
-var VERSION = "0.285.0";
-var APP_SDK_VERSION = "0.111.4";
+var VERSION = "0.287.0";
+var APP_SDK_VERSION = "0.113.0";
 
 // src/timezone.ts
 function machineTimezone() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lotics/cli",
-  "version": "0.285.0",
+  "version": "0.287.0",
   "description": "Lotics SDK and CLI for AI agents",
   "type": "module",
   "bin": {