@protobase/server 0.26.6 → 0.26.8

package/dist/rest/rpc-route.js

@@ -0,0 +1,70 @@
+import { restError } from "./rest-error.js";
+import { jsonType, onlyElement, pageResponse, wantsObject } from "./respond.js";
+import { callSource, chooseFunction, findFunctions } from "./functions.js";
+import { parsePrefer } from "./parse-prefer.js";
+import { parseQuery } from "./parse-query.js";
+import { readRows } from "./read-rows.js";
+import { asCaller, queryParams, readBody } from "./rest-context.js";
+import { Hono } from "hono";
+import { sql } from "kysely";
+//#region src/rest/rpc-route.ts
+const reserved = /* @__PURE__ */ new Set([
+	"select",
+	"order",
+	"limit",
+	"offset",
+	"on_conflict",
+	"columns"
+]);
+/**
+* Calls a function of the `public` schema: by POST with its arguments in a JSON object, or the whole body as its one
+* unnamed json argument; by GET with them in the query string, in a read-only transaction. A function returning rows
+* is read like a table, with `select`, filters, `order`, a range and a count; one returning one row gives an object,
+* a scalar its JSON value, `void` 204.
+*/
+const call = async (deps, c) => {
+	const name = c.req.param("fn");
+	const get = c.req.method === "GET";
+	const params = queryParams(c);
+	const body = get ? void 0 : await readBody(c, {});
+	const prefer = parsePrefer(c.req.header("prefer") ?? null);
+	const object = wantsObject(c.req.raw);
+	return asCaller(deps, c, get, async (trx) => {
+		const candidates = await findFunctions(trx, name);
+		const inputs = new Set(candidates.flatMap((info) => info.inputs.map((input) => input.name)));
+		const given = get ? params.map(([key]) => key).filter((key) => !reserved.has(key) && inputs.has(key)) : typeof body === "object" && body !== null && !Array.isArray(body) ? Object.keys(body) : [];
+		const chosen = chooseFunction(name, candidates, given);
+		const args = get ? Object.fromEntries(params.filter(([key]) => given.includes(key))) : body;
+		const source = callSource(chosen, args);
+		const query = parseQuery(params, c.req.header("range") ?? null, new Set(given));
+		const shape = query.select.map((item) => {
+			if (item.kind === "embed") throw restError(400, "PGRST100", `"${item.name}" embeds a resource in a function's rows, which /rest/v1 does not support yet`);
+			return item;
+		});
+		if (chosen.info.returns === "void") {
+			await sql`select 1 from ${source.from}`.execute(trx);
+			return new Response(null, {
+				status: 204,
+				headers: { "content-range": "0-0/*" }
+			});
+		}
+		if (!chosen.info.set) {
+			const page = await readRows(trx, source, shape, query);
+			return new Response(onlyElement(page.body), {
+				status: 200,
+				headers: {
+					"content-range": "0-0/*",
+					"content-type": jsonType
+				}
+			});
+		}
+		return pageResponse(await readRows(trx, source, shape, query, prefer.count), query.range.offset, object);
+	});
+};
+const rpcRoute = (deps) => {
+	const app = new Hono();
+	app.on(["GET", "POST"], "/rpc/:fn", (c) => call(deps, c));
+	return app;
+};
+//#endregion
+export { rpcRoute };

package/dist/rest/shape-sql.js

@@ -0,0 +1,23 @@
+import { pathName } from "./field-path.js";
+import { lateralName } from "./embed-shape.js";
+import { fieldSql } from "./filter-sql.js";
+import { sql } from "kysely";
+//#region src/rest/shape-sql.ts
+/**
+* The select list of a shape on the rows of `source`: `*` its columns, a field under its alias, its JSON path's last
+* key or its column, cast when asked, and an embed's JSON from its lateral subquery (see `joinsSql`) under its key; an
+* embed of nothing shows nothing. Cast types are checked to be bare type names when parsed.
+*/
+const selectSql = (source, items) => sql.join(items.flatMap((item) => {
+	if (item.kind === "all") return [sql`${sql.id(source)}.*`];
+	if (item.kind === "embed") return item.shown ? [sql`${sql.id(lateralName(item))}.body as ${sql.id(item.key)}`] : [];
+	const value = fieldSql(source, item.field);
+	const cast = item.cast === void 0 ? value : sql`cast(${value} as ${sql.raw(item.cast)})`;
+	return [sql`${cast} as ${sql.id(item.alias ?? pathName(item.field))}`];
+}));
+/** ` order by ...` for the terms; nothing without any. */
+const orderSql = (source, terms) => terms.length === 0 ? sql`` : sql` order by ${sql.join(terms.map((term) => sql`${fieldSql(source, term.field)}${sql.raw(term.direction ? ` ${term.direction}` : "")}${sql.raw(term.nulls ? ` nulls ${term.nulls}` : "")}`))}`;
+/** ` limit ... offset ...` for the range. */
+const rangeSql = (range) => sql`${range.limit === void 0 ? sql`` : sql` limit ${range.limit}`}${range.offset === 0 ? sql`` : sql` offset ${range.offset}`}`;
+//#endregion
+export { orderSql, rangeSql, selectSql };

package/dist/rest/split-list.js

@@ -0,0 +1,38 @@
+import { parseError } from "./rest-error.js";
+//#region src/rest/split-list.ts
+const closers = {
+	"(": ")",
+	"{": "}"
+};
+/**
+* Splits `text` at the commas outside double quotes, parentheses and braces: `a,in.(1,2),b.cs.{x,y}` gives three parts. A
+* backslash in quotes escapes the next character. An unclosed quote, parenthesis or brace does not parse.
+*/
+const splitList = (text) => {
+	const parts = [];
+	const open = [];
+	let quoted = false;
+	let start = 0;
+	for (let i = 0; i < text.length; i++) {
+		const char = text[i];
+		if (quoted) {
+			if (char === "\\") i++;
+			else if (char === "\"") quoted = false;
+			continue;
+		}
+		if (char === "\"") quoted = true;
+		else if (char in closers) open.push(closers[char]);
+		else if (char === open.at(-1)) open.pop();
+		else if (char === "," && open.length === 0) {
+			parts.push(text.slice(start, i));
+			start = i + 1;
+		}
+	}
+	if (quoted || open.length > 0) throw parseError(`"${text}" has an unclosed quote, parenthesis or brace`);
+	parts.push(text.slice(start));
+	return parts;
+};
+/** A value in double quotes without them and with its escapes undone; any other value as it is. */
+const unquote = (text) => text.length >= 2 && text.startsWith("\"") && text.endsWith("\"") ? text.slice(1, -1).replace(/\\(.)/g, "$1") : text;
+//#endregion
+export { splitList, unquote };

package/dist/rest/table-routes.js

@@ -0,0 +1,196 @@
+import { tableId } from "../sql-parts.js";
+import { restError } from "./rest-error.js";
+import { contentRange } from "./content-range.js";
+import { checkSingle, jsonType, objectType, onlyElement, pageResponse, wantsObject } from "./respond.js";
+import { parsePrefer } from "./parse-prefer.js";
+import { parseQuery } from "./parse-query.js";
+import { embedsOf, resolveShape } from "./embed-shape.js";
+import { readRows } from "./read-rows.js";
+import { asCaller, queryParams, readBody } from "./rest-context.js";
+import { scanRefusal, uncoveredReads } from "./rest-scan.js";
+import { deleteRows, insertRows, updateRows } from "./write-rows.js";
+import { Hono } from "hono";
+import { sql } from "kysely";
+//#region src/rest/table-routes.ts
+/**
+* The resource whose table `name` is, in the `public` schema or the search path's: `/rest/v1` serves the tables the app
+* declares as resources, as PostgREST serves those of its exposed schema. Any other is 404 (PGRST205).
+*/
+const servedEntry = (deps, name) => deps.registry.entries.find((one) => one.model.table.name === name && (one.model.table.schema ?? "public") === "public");
+const tableEntry = (deps, name) => {
+	const entry = servedEntry(deps, name);
+	if (!entry) throw restError(404, "PGRST205", `Could not find the table 'public.${name}' in the schema cache`);
+	return entry;
+};
+/** The select list of the query on rows of `entry`'s table, its embeds resolved through the foreign keys of served tables. */
+const shapeOf = async (deps, foreignKeys, entry, query) => {
+	if (!query.select.some((item) => item.kind === "embed")) return query.select;
+	const served = (name) => {
+		const target = servedEntry(deps, name);
+		return target && tableId(target.model);
+	};
+	return resolveShape({
+		foreignKeys: await foreignKeys(),
+		served,
+		embedded: query.embedded
+	}, entry.model.table.name, query.select);
+};
+const targetOf = (entry) => ({
+	table: tableId(entry.model),
+	alias: entry.model.table.name
+});
+/**
+* Refuses filters and a sort no index serves, as the scan guard does on `/api/v1`, on the table and on every embedded
+* one, whose join columns need an index too; in `warn` mode, a warning header instead.
+*/
+const scanCheck = async (deps, entry, filters, order, shape = []) => {
+	if (deps.guard.mode === "off") return {};
+	const reads = [{
+		entry,
+		filters,
+		order,
+		joined: []
+	}, ...embedsOf(shape).map((embed) => ({
+		entry: tableEntry(deps, embed.table),
+		filters: embed.params.filters,
+		order: embed.params.order,
+		joined: embed.relationship.join.map((pair) => pair.target)
+	}))];
+	for (const read of reads) {
+		const [first] = uncoveredReads(await deps.guard.indexesOf(read.entry), read.filters, read.order, read.joined);
+		if (!first) continue;
+		const refusal = scanRefusal(read.entry.model.table, first);
+		if (deps.guard.mode === "warn") return { "X-Protobase-Warning": refusal.body.message };
+		throw refusal;
+	}
+	return {};
+};
+const returningOf = (prefer, shape) => prefer.return === "representation" ? { shape } : void 0;
+const counted = (prefer, total) => prefer.count === void 0 ? void 0 : total;
+/** A write's response: the rows it returns when asked for, as an array or one object; else no body, with `emptyStatus`. */
+const writeResponse = (written, object, status, emptyStatus, range) => {
+	if (written.body === void 0) return new Response(null, {
+		status: emptyStatus,
+		headers: { "content-range": range }
+	});
+	return new Response(object ? onlyElement(written.body) : written.body, {
+		status,
+		headers: {
+			"content-range": range,
+			"content-type": object ? objectType : jsonType
+		}
+	});
+};
+const withHeaders = (response, headers) => {
+	for (const [name, value] of Object.entries(headers)) response.headers.set(name, value);
+	return response;
+};
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/**
+* The rows and columns of an insert's body: an object or an array of objects. The columns are `columns` when given,
+* as supabase-js sends with several rows; otherwise the keys, which every row must then share (PGRST102).
+*/
+const insertRowsOf = (body, query) => {
+	const rows = Array.isArray(body) ? body : [body];
+	if (!rows.every(isRecord)) throw restError(400, "PGRST102", "Empty or invalid json");
+	if (query.columns) return {
+		rows,
+		columns: query.columns
+	};
+	const columns = Object.keys(rows[0] ?? {});
+	const same = (row) => Object.keys(row).length === columns.length && columns.every((column) => Object.hasOwn(row, column));
+	if (!rows.every(same)) throw restError(400, "PGRST102", "All object keys must match");
+	return {
+		rows,
+		columns
+	};
+};
+const read = async (deps, foreignKeys, c) => {
+	const entry = tableEntry(deps, c.req.param("table"));
+	const query = parseQuery(queryParams(c), c.req.header("range") ?? null);
+	const prefer = parsePrefer(c.req.header("prefer") ?? null);
+	const shape = await shapeOf(deps, foreignKeys, entry, query);
+	const warning = await scanCheck(deps, entry, query.filters, query.order, shape);
+	const alias = entry.model.table.name;
+	const source = {
+		from: sql`${tableId(entry.model)} as ${sql.id(alias)}`,
+		alias
+	};
+	const page = await asCaller(deps, c, true, (trx) => readRows(trx, source, shape, query, prefer.count));
+	return pageResponse(page, query.range.offset, wantsObject(c.req.raw), warning);
+};
+const insert = async (deps, foreignKeys, c) => {
+	const entry = tableEntry(deps, c.req.param("table"));
+	const query = parseQuery(queryParams(c));
+	const prefer = parsePrefer(c.req.header("prefer") ?? null);
+	const object = wantsObject(c.req.raw);
+	const shape = await shapeOf(deps, foreignKeys, entry, query);
+	const warning = await scanCheck(deps, entry, [], [], shape);
+	const { rows, columns } = insertRowsOf(await readBody(c), query);
+	if (columns.length === 0 && rows.length > 1) throw restError(400, "PGRST102", "Several rows without any column cannot be inserted at once");
+	if (rows.length === 0 && object) checkSingle(0);
+	const conflict = query.onConflict ?? entry.model.primaryKey.map((name) => entry.model.fields[name].column);
+	const written = rows.length === 0 ? {
+		total: 0,
+		...prefer.return === "representation" && { body: "[]" }
+	} : await asCaller(deps, c, false, async (trx) => {
+		const result = await insertRows(trx, targetOf(entry), {
+			rows,
+			columns,
+			defaults: prefer.missing === "default",
+			resolution: prefer.resolution,
+			conflict
+		}, returningOf(prefer, shape));
+		if (object) checkSingle(result.total);
+		return result;
+	});
+	const status = written.inserted === 0 ? 200 : 201;
+	return withHeaders(writeResponse(written, object, status, status, `*/${counted(prefer, written.total) ?? "*"}`), warning);
+};
+const update = async (deps, foreignKeys, c) => {
+	const entry = tableEntry(deps, c.req.param("table"));
+	const query = parseQuery(queryParams(c));
+	const prefer = parsePrefer(c.req.header("prefer") ?? null);
+	const object = wantsObject(c.req.raw);
+	const body = await readBody(c);
+	if (!isRecord(body)) throw restError(400, "PGRST102", "Empty or invalid json");
+	const shape = await shapeOf(deps, foreignKeys, entry, query);
+	const warning = await scanCheck(deps, entry, query.filters, [], shape);
+	const written = Object.keys(body).length === 0 ? {
+		total: 0,
+		...prefer.return === "representation" && { body: "[]" }
+	} : await asCaller(deps, c, false, async (trx) => {
+		const result = await updateRows(trx, targetOf(entry), body, query.filters, returningOf(prefer, shape));
+		if (object) checkSingle(result.total);
+		return result;
+	});
+	return withHeaders(writeResponse(written, object, 200, 204, contentRange(0, written.total, counted(prefer, written.total))), warning);
+};
+const remove = async (deps, foreignKeys, c) => {
+	const entry = tableEntry(deps, c.req.param("table"));
+	const query = parseQuery(queryParams(c));
+	const prefer = parsePrefer(c.req.header("prefer") ?? null);
+	const object = wantsObject(c.req.raw);
+	const shape = await shapeOf(deps, foreignKeys, entry, query);
+	const warning = await scanCheck(deps, entry, query.filters, [], shape);
+	const written = await asCaller(deps, c, false, async (trx) => {
+		const result = await deleteRows(trx, targetOf(entry), query.filters, returningOf(prefer, shape));
+		if (object) checkSingle(result.total);
+		return result;
+	});
+	return withHeaders(writeResponse(written, object, 200, 204, `*/${counted(prefer, written.total) ?? "*"}`), warning);
+};
+/**
+* `/rest/v1/<table>`: read with GET and HEAD, insert and upsert with POST, update with PATCH, delete with DELETE. Reads
+* and the rows a write returns embed related rows through `foreignKeys`.
+*/
+const tableRoutes = (deps, foreignKeys) => {
+	const app = new Hono();
+	app.get("/:table", (c) => read(deps, foreignKeys, c));
+	app.post("/:table", (c) => insert(deps, foreignKeys, c));
+	app.patch("/:table", (c) => update(deps, foreignKeys, c));
+	app.delete("/:table", (c) => remove(deps, foreignKeys, c));
+	return app;
+};
+//#endregion
+export { tableRoutes };

package/dist/rest/whole-number.js

@@ -0,0 +1,9 @@
+import { parseError } from "./rest-error.js";
+//#region src/rest/whole-number.ts
+/** The whole number a `limit` or `offset` parameter named `name` gives. */
+const wholeNumber = (name, text) => {
+	if (!/^\d+$/.test(text)) throw parseError(`"failed to parse ${name} (${text})"`, `${name} takes a whole number`);
+	return Number(text);
+};
+//#endregion
+export { wholeNumber };

package/dist/rest/write-rows.js

@@ -0,0 +1,50 @@
+import { whereSql } from "./filter-sql.js";
+import { selectSql } from "./shape-sql.js";
+import { joinsSql } from "./embed-sql.js";
+import { sql } from "kysely";
+//#region src/rest/write-rows.ts
+const returningSql = (target, returning, upsert) => {
+	const row = returning ? sql`${sql.id(target.alias)} as pgrst_row` : sql`1 as pgrst_one`;
+	return upsert ? sql` returning ${row}, (${sql.id(target.alias)}.xmax = 0) as pgrst_inserted` : sql` returning ${row}`;
+};
+const run = async (trx, target, payload, write, returning, upsert) => {
+	const inserted = upsert ? sql`(select count(*) from pgrst_source where pgrst_inserted)` : sql`null::bigint`;
+	const body = returning ? sql`(select coalesce(json_agg(pgrst_rows), '[]')::text from (select ${selectSql(target.alias, returning.shape)} from (select (pgrst_source.pgrst_row).* from pgrst_source) as ${sql.id(target.alias)}${joinsSql(target.alias, returning.shape)}) as pgrst_rows)` : sql`null::text`;
+	const { rows: [result] } = await sql`
+    with pgrst_payload as (select ${JSON.stringify(payload ?? null)}::json as body), pgrst_source as (${write}${returningSql(target, returning, upsert)})
+    select (select count(*) from pgrst_source) as total, ${inserted} as inserted, ${body} as body
+  `.execute(trx);
+	return {
+		total: Number(result.total),
+		...result.inserted !== null && { inserted: Number(result.inserted) },
+		...result.body !== null && { body: result.body }
+	};
+};
+const valuesSql = (target, insert) => {
+	const columns = sql.join(insert.columns.map((column) => sql.id(column)));
+	if (!insert.defaults) return sql`(${columns}) select ${sql.join(insert.columns.map((column) => sql`pgrst_body.${sql.id(column)}`))} from pgrst_payload, json_populate_recordset(null::${target.table}, pgrst_payload.body) as pgrst_body`;
+	const rows = insert.rows.map((row, i) => sql`(${sql.join(insert.columns.map((column) => Object.hasOwn(row, column) ? sql`(json_populate_record(null::${target.table}, (select body -> ${sql.raw(String(i))} from pgrst_payload))).${sql.id(column)}` : sql`default`))})`);
+	return sql`(${columns}) values ${sql.join(rows)}`;
+};
+const conflictSql = (insert) => {
+	if (!insert.resolution) return sql``;
+	const target = sql.join(insert.conflict.map((column) => sql.id(column)));
+	if (insert.resolution === "ignore-duplicates") return sql` on conflict (${target}) do nothing`;
+	return sql` on conflict (${target}) do update set ${sql.join(insert.columns.map((column) => sql`${sql.id(column)} = excluded.${sql.id(column)}`))}`;
+};
+/** Inserts the rows, or upserts them with a resolution, in one statement. */
+const insertRows = (trx, target, insert, returning) => {
+	const values = insert.columns.length === 0 ? sql` default values` : sql` ${valuesSql(target, insert)}`;
+	const write = sql`insert into ${target.table} as ${sql.id(target.alias)}${values}${conflictSql(insert)}`;
+	return run(trx, target, insert.rows, write, returning, insert.resolution !== void 0);
+};
+/** Sets the columns of the body on every row the filters keep. */
+const updateRows = (trx, target, values, filters, returning) => {
+	const set = sql.join(Object.keys(values).map((column) => sql`${sql.id(column)} = pgrst_body.${sql.id(column)}`));
+	const from = sql`json_populate_record(null::${target.table}, (select body from pgrst_payload)) as pgrst_body`;
+	return run(trx, target, values, sql`update ${target.table} as ${sql.id(target.alias)} set ${set} from ${from}${whereSql(target.alias, filters)}`, returning, false);
+};
+/** Deletes every row the filters keep. */
+const deleteRows = (trx, target, filters, returning) => run(trx, target, null, sql`delete from ${target.table} as ${sql.id(target.alias)}${whereSql(target.alias, filters)}`, returning, false);
+//#endregion
+export { deleteRows, insertRows, updateRows };

package/dist/scan-guard.js

@@ -28,7 +28,7 @@ const createScanGuard = (db, options = {}) => {
 		return read;
 	};
 	/** Throws a 400 problem for a column no index serves in `reject` mode; in `warn` mode returns the warning text. */
-	return async (entry, query, context) => {
+	const check = async (entry, query, context) => {
 		if (mode === "off") return void 0;
 		const columns = uncoveredColumns(context.model, await indexesOf(entry), query, context.scope);
 		const first = columns[0];
@@ -40,6 +40,10 @@ const createScanGuard = (db, options = {}) => {
 			suggestion: first.suggestion
 		});
 	};
+	return Object.assign(check, {
+		mode,
+		indexesOf
+	});
 };
 //#endregion
 export { createScanGuard };

package/dist/transactions.js

@@ -13,9 +13,9 @@ const writeTransaction = (db, timeoutMs, run, settings = {}) => db.transaction()
 	return run(trx);
 });
 /** Same, and Postgres refuses any write inside it. */
-const readTransaction = (db, timeoutMs, run) => writeTransaction(db, timeoutMs, async (trx) => {
+const readTransaction = (db, timeoutMs, run, settings = {}) => writeTransaction(db, timeoutMs, async (trx) => {
 	await sql`set transaction read only`.execute(trx);
 	return run(trx);
-});
+}, settings);
 //#endregion
 export { readTransaction, writeTransaction };

package/dist/view-access.js

@@ -3,6 +3,7 @@ import { cardPhotosErrors } from "./view-card-photos.js";
 import { cardFavoriteErrors } from "./view-card-favorite.js";
 import { searchesOfFor } from "./view-saved-search.js";
 import { relatedColumnErrors } from "./view-related-column.js";
+import { actionWhenFields } from "./view-action-when.js";
 import { conditionReadable, resolveFieldPath } from "@protobase/layout";
 import { addressErrors, chartFields, hrefPlaceholders, navRecentErrors, promptFields, pruneByShape, shapes, tableDisplay } from "@protobase/schema/internal";
 import { isRecordCondition } from "@protobase/schema";
@@ -258,12 +259,17 @@ const aiShape = (model) => shapes.map((run) => {
 	} : void 0;
 });
 const inputsShape = (models) => shapes.map((inputs) => inputs.every((input) => input.resource === void 0 || Object.hasOwn(models, input.resource)) ? inputs : void 0);
+const actionWhenShape = (model) => shapes.map((when) => actionWhenFields(when).every((name) => Object.hasOwn(model.fields, name)) ? when : void 0);
 const actionShape = (model, models, createPages) => shapes.object({
 	name: shapes.data,
 	label: shapes.data,
 	icon: shapes.data,
 	confirm: shapes.data,
 	bulk: shapes.data,
+	when: actionWhenShape(model),
+	otherwise: shapes.data,
+	reason: shapes.data,
+	variant: shapes.data,
 	run: shapes.oneOf({
 		update: shapes.object({
 			kind: shapes.data,
@@ -274,7 +280,11 @@ const actionShape = (model, models, createPages) => shapes.object({
 		ai: aiShape(model)
 	}),
 	inputs: inputsShape(models)
-}, { requires: ["run", "inputs"] });
+}, { requires: [
+	"run",
+	"inputs",
+	"when"
+] });
 const viewShape = (resource, model, models, prompted, createPages) => {
 	const nav = shapes.object({
 		hidden: shapes.data,

package/dist/view-action-when.js

@@ -0,0 +1,23 @@
+import { parseCondition } from "@protobase/layout";
+import { actionConditionError } from "@protobase/schema/internal";
+//#region src/view-action-when.ts
+/** The fields an action's `when` reads, or none when it has none or does not parse, which startup refuses. */
+const actionWhenFields = (when) => {
+	if (when === void 0) return [];
+	const parsed = parseCondition(when);
+	return parsed.ok ? parsed.paths : [];
+};
+/**
+* An action's `when` parses and reads only fields the record has: a list decides it for every row from the row alone,
+* so it follows no relation and counts no records. A view written as data is checked as the builder checks its options.
+*/
+const actionWhenErrors = (view, model) => view.actions.flatMap((action) => {
+	const option = actionConditionError(action);
+	if (option) return [`action "${action.name}": ${option}`];
+	if (action.when === void 0) return [];
+	const parsed = parseCondition(action.when);
+	if (!parsed.ok) return [`action "${action.name}": "when" is not a valid condition: ${parsed.message}`];
+	return parsed.paths.filter((path) => !Object.hasOwn(model.fields, path)).map((path) => `action "${action.name}": "when" names "${path}", but an action's condition reads only fields ${model.name} has`);
+});
+//#endregion
+export { actionWhenErrors, actionWhenFields };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.26.6",
+  "version": "0.26.8",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -32,9 +32,9 @@
   "dependencies": {
     "@better-auth/passkey": "^1.7.7",
     "@better-auth/sso": "^1.7.7",
-    "@protobase/layout": "0.26.6",
-    "@protobase/query": "0.26.6",
-    "@protobase/schema": "0.26.6",
+    "@protobase/layout": "0.26.8",
+    "@protobase/query": "0.26.8",
+    "@protobase/schema": "0.26.8",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",