@trylight/app 0.1.0 → 0.1.2

package/README.md

@@ -7,9 +7,9 @@ unchanged; entities and the schema sync are new here.
 
 | Import | What |
 |---|---|
-| `@trylight/app/schema` | `entity(name, columns, access)`: a Drizzle table plus `id`, `created_at`, `updated_at`, `created_by`, `field_sources`; `lightChanges` (the audit table); `fieldSource` (the `{url, evidence}` schema) |
-| `@trylight/app` | `createApp<typeof contracts>()` → `app.table(entity)` (`list/get/create/update/delete`, `useList/useGet/useCreate/useUpdate/useDelete`, typed by the entity passed) and `app.contracts` (`useInvocation`) |
-| `@trylight/app/server` | `createLightServer({ schema, contracts })` → `light.db` (Drizzle), `light.session(request)`, `light.signIn(email, password)`, and the route handlers `light.entities`, `light.invoke.handler`, `light.chat` |
+| `@trylight/app/schema` | `entity(name, columns, access)`: a Drizzle table plus `id`, `created_at`, `updated_at`, `created_by`, `field_sources`; `lightChanges` (the audit table); `lightImages` (the app's copy of its logos and photos); `fieldSource` (the `{url, evidence}` schema) |
+| `@trylight/app` | `createApp<typeof contracts>()` → `app.table(entity)` (`list/get/create/update/delete`, `useList/useGet/useCreate/useUpdate/useDelete`, typed by the entity passed), `app.contracts` (`useInvocation`), and `imageSrc(url)` (where a logo or photo loads from) |
+| `@trylight/app/server` | `createLightServer({ schema, contracts })` → `light.db` (Drizzle), `light.session(request)`, `light.signIn(email, password)`, and the route handlers `light.entities`, `light.image`, `light.invoke.handler`, `light.chat` |
 | `@trylight/app/platform` | the door for server functions, framing, analytics/error policies, the pane bridge |
 | `@trylight/app/vite` | `lightDb()`: the dev server syncs `db/schema` into the database on every change |
 | `light-db` (bin) | `sync`, `migrate`, `check`: the app's `pnpm db:*` scripts |
@@ -21,8 +21,8 @@ through `entity()`. Each request is parsed with the table's own Zod schema
 (drizzle-zod; unknown or platform columns are refused, `field_sources` must be
 `{url, evidence}` per real column), goes through the app's door (members-only:
 a member; public: anyone reads, people signed in write; `write: "agents"`
-tables refuse the app), must come from the app's own pages, and each change is
-written with a `light_changes` row naming the person, in one transaction. An
+tables refuse the app), and must come from the app's own pages; each write
+names its person for the table's change trigger (below). An
 edited value loses its source; sources sent are merged by column. Lists sort
 by the asked column, then id. With no sign-in configured only a non-production
 server asked on loopback answers (as "Local developer"); anything else gets 503.
@@ -33,6 +33,17 @@ cached list and row at once and stays pending until the table's refetch lands
 
 Joins and aggregates stay typed server functions over `light.db`.
 
+## Images
+
+`/api/light/image?src=…` serves a logo or photo a row points at from the
+app's own copy in `light_images`: the first view by a member (or any view
+with no sign-in configured) fetches and keeps it, and every later one, and
+the CDN for a year, is the copy. Only public addresses are connected to (checked on the resolved address, each
+redirect hop included); images only (SVG served sandboxed, `nosniff`), size-
+and time-capped. A source that gives no image is a `no-store` 404, so the
+mark shows its letters and the next view asks again. Members-only apps need
+sign-in; a stranger to a public app only reads what members kept.
+
 ## Schema sync
 
 `plan()` diffs `db/schema` against the newest migration snapshot with
@@ -40,7 +51,7 @@ drizzle-kit's API, removals first and additions second, so drizzle-kit never
 has to ask whether a column was renamed (it can't without a terminal).
 The change is written as a drizzle migration (`db/migrations`,
 drizzle-kit's own layout) and applied, whatever it does to the rows there (a
-removed column's values go with it); one the rows refuse is taken back out,
+removed column's values are archived first, below); one the rows refuse is taken back out,
 so the change stays pending rather than blocking every later migrate. Changed
 indexes and constraints are dropped before the columns they cover and enums
 only after, so the two halves apply in order. Syncs and migrates each hold a Postgres advisory lock (with a
@@ -49,6 +60,22 @@ overlap, and a process that dies releases it. `migrate` applies the journal; in
 asks the platform's migrate socket to run it. `check` (in `pnpm build`)
 fails while `db/schema` has changes no migration holds.
 
+## Recoverable deletes
+
+`src/db/audit.ts`, in Postgres itself. Every entity table has a row trigger
+that records each insert, update, delete and truncate in `light_changes` (the
+new row, `{ column: { from, to } }`, or the old row), whoever wrote it: the
+actor is `light.actor_kind/_id/_name`, which the entities route and Plaza's
+`mii db write` set per transaction, or else the database role. A migration
+that drops a table or column or changes a column's type first copies what it
+destroys into `light_archive` (`light_archive_values`, called at the top of
+the migration, so in its transaction) and the migrate prints "Archived N
+values from table.column". Both tables refuse UPDATE, DELETE and TRUNCATE (a guard against mistakes:
+the owner role can still drop the trigger). DDL an agent runs itself (`drop
+table` through `mii db write`) is not archived.
+`migrate` installs the functions before applying migrations and the triggers
+after; the template's AGENTS.md has the restore SQL.
+
 ## Develop
 
 ```bash
@@ -58,4 +85,6 @@ TEST_DATABASE_URL=postgres://you@127.0.0.1:5432/postgres pnpm test   # with the
 pnpm run build                                              # dist/, what the template installs
 ```
 
-Not published yet: the template depends on this directory (`file:`).
+Published to npm; the template installs it from there, so a change here
+reaches new apps once it is published and the template's lockfile takes it.
+To publish: bump `version`, then `pnpm publish` (`prepack` builds `dist`).

package/dist/client.d.ts

@@ -4,6 +4,7 @@ import type { Entity } from "./schema.js";
 export { EntityError, LIST_LIMIT, type ListOptions, type NewRow, type Sort, type Patch, type Row, type Where } from "./entities.js";
 export type { FieldSource, FieldSources } from "./schema.js";
 export { siteOf } from "./schema.js";
+export { imageSrc } from "./images.js";
 export { InvocationError, type InvocationStatus } from "@shubh90/app-runtime/invoke";
 export declare function createApp<C extends Contracts = Record<never, never>>(): {
     table: typeof tableClient;

package/dist/client.js

@@ -12,6 +12,7 @@ import { z } from "zod/v4";
 import { ENTITIES_PATH, EntityError } from "./entities.js";
 export { EntityError, LIST_LIMIT } from "./entities.js";
 export { siteOf } from "./schema.js";
+export { imageSrc } from "./images.js";
 export { InvocationError } from "@shubh90/app-runtime/invoke";
 export function createApp() {
     return { table: tableClient, contracts: createInvoker() };

package/dist/db/audit.d.ts

@@ -0,0 +1,36 @@
+import type postgres from "postgres";
+/** Makes light_archive and the functions migrations and triggers call. Runs before migrating. */
+export declare function prepareAudit(sql: postgres.Sql): Promise<void>;
+/**
+ * The entity tables `schema` declares. Read before migrating: the triggers
+ * write into light_changes, so a schema that doesn't export it is refused
+ * before any migration applies.
+ */
+export declare function entityTables(schema: Record<string, unknown>): string[];
+/**
+ * Puts the change trigger on each of `tables` the database has (one a
+ * migration hasn't made yet is tracked on the migrate that makes it), and
+ * makes light_changes append-only. Runs after migrating.
+ */
+export declare function trackTables(sql: postgres.Sql, tables: string[]): Promise<void>;
+/** A table, or a column of one, that a migration destroys: what it archives first. */
+export type Destroyed = {
+    table: string;
+    column: string | null;
+};
+/**
+ * What going from `previous` to `current` (drizzle-kit snapshots' `tables`)
+ * destroys: dropped tables, dropped columns, and columns whose type changes
+ * (Postgres converts the values, which may not survive the trip back).
+ */
+export declare function destroyed(previous: Record<string, unknown>, current: Record<string, unknown>): Destroyed[];
+/** The statements that archive what migration `tag` destroys, to run first in it. */
+export declare function archiveStatements(archive: Destroyed[], tag: string): string[];
+/**
+ * Collects what a migrate archived, to print once its transaction commits
+ * (a migration that fails archives nothing). Other notices are dropped.
+ */
+export declare function archiveNotices(): {
+    onnotice(notice: postgres.Notice): void;
+    print(): void;
+};

package/dist/db/audit.js

@@ -0,0 +1,193 @@
+// Recoverable deletes: change triggers into light_changes, an archive step at
+// the top of destructive migrations, both tables append-only (README,
+// "Recoverable deletes"; the restore is the template AGENTS.md's).
+import { getTableName, is } from "drizzle-orm";
+import { PgTable } from "drizzle-orm/pg-core";
+import { z } from "zod/v4";
+import { isEntity, lightChanges } from "../schema.js";
+/** The SQLSTATE of the notice an archive raises, so the CLI prints just those. */
+const ARCHIVED_NOTICE = "LA001";
+/**
+ * Installed before migrations run (a migration's archive step calls these),
+ * all idempotent. No input reaches this text; the functions quote the
+ * identifiers they are given with format('%I').
+ */
+const PREPARE = `
+create table if not exists light_archive (
+  id uuid primary key default gen_random_uuid(),
+  table_name text not null,
+  -- null when the whole row was archived (its table was dropped)
+  column_name text,
+  -- the row's id; null for a table without a uuid id
+  row_id uuid,
+  value jsonb not null,
+  migration text not null,
+  archived_at timestamptz not null default now()
+);
+create index if not exists light_archive_table_idx on light_archive (table_name, column_name);
+
+create or replace function light_append_only() returns trigger language plpgsql as $$
+begin
+  raise exception '% is append-only: it is the record of what changed and what was removed, so its rows are never changed or deleted.', tg_table_name
+    using errcode = 'insufficient_privilege';
+end $$;
+create or replace trigger light_append_only before update or delete or truncate on light_archive
+  for each statement execute function light_append_only();
+
+create or replace function light_record_change() returns trigger language plpgsql as $$
+declare
+  -- A setting set local reads '' (not null) once its transaction has ended.
+  actor_kind text := coalesce(nullif(current_setting('light.actor_kind', true), ''), 'database');
+  actor_id text := nullif(current_setting('light.actor_id', true), '');
+  actor_name text := coalesce(nullif(current_setting('light.actor_name', true), ''), current_user);
+  row_id uuid;
+  action text;
+  changes jsonb;
+begin
+  if tg_op = 'TRUNCATE' then
+    execute format(
+      'insert into light_changes (table_name, row_id, action, changes, actor_kind, actor_id, actor_name)
+       select $1, t.id, ''delete'', to_jsonb(t), $2, $3, $4 from %I.%I t', tg_table_schema, tg_table_name)
+      using tg_table_name, actor_kind, actor_id, actor_name;
+    return null;
+  elsif tg_op = 'INSERT' then
+    row_id := new.id;
+    action := 'create';
+    changes := to_jsonb(new);
+  elsif tg_op = 'DELETE' then
+    row_id := old.id;
+    action := 'delete';
+    changes := to_jsonb(old);
+  else
+    row_id := new.id;
+    action := 'update';
+    select jsonb_object_agg(o.key, jsonb_build_object('from', o.value, 'to', n.value)) into changes
+      from jsonb_each(to_jsonb(old)) o join jsonb_each(to_jsonb(new)) n on n.key = o.key
+      where o.value is distinct from n.value and o.key <> 'updated_at';
+    -- An update that set every value to what it was changed nothing.
+    if changes is null then return null; end if;
+  end if;
+  insert into light_changes (table_name, row_id, action, changes, actor_kind, actor_id, actor_name)
+    values (tg_table_name, row_id, action, changes, actor_kind, actor_id, actor_name);
+  return null;
+end $$;
+
+create or replace function light_track(tbl text) returns void language plpgsql as $$
+begin
+  execute format('create or replace trigger light_record_change after insert or update or delete on %I
+    for each row execute function light_record_change()', tbl);
+  execute format('create or replace trigger light_record_truncate before truncate on %I
+    for each statement execute function light_record_change()', tbl);
+end $$;
+
+-- col null: every row of tbl, whole (the table is being dropped).
+create or replace function light_archive_values(tbl text, col text, tag text) returns void language plpgsql as $$
+declare
+  id_of_row text := case when exists (
+    select 1 from pg_attribute
+    where attrelid = format('%I', tbl)::regclass and attname = 'id' and atttypid = 'uuid'::regtype and not attisdropped
+  ) then 't.id' else 'null::uuid' end;
+  archived bigint;
+begin
+  if col is null then
+    execute format(
+      'insert into light_archive (table_name, column_name, row_id, value, migration)
+       select $1, null, %s, to_jsonb(t), $2 from %I t', id_of_row, tbl)
+      using tbl, tag;
+  else
+    execute format(
+      'insert into light_archive (table_name, column_name, row_id, value, migration)
+       select $1, $2, %s, to_jsonb(t)->$2, $3 from %I t where %I is not null', id_of_row, tbl, col)
+      using tbl, col, tag;
+  end if;
+  get diagnostics archived = row_count;
+  if archived = 0 then return; end if;
+  raise notice using errcode = '${ARCHIVED_NOTICE}', message = format('Archived %s %s from %s (migration %s).',
+    archived, case when col is null then 'rows' else 'values' end, concat_ws('.', tbl, col), tag);
+end $$;
+`;
+/** light_changes is a drizzle table (db/schema exports it), so it exists only once migrated. */
+const CHANGES_APPEND_ONLY = `
+create or replace trigger light_append_only before update or delete or truncate on light_changes
+  for each statement execute function light_append_only();
+`;
+/** Makes light_archive and the functions migrations and triggers call. Runs before migrating. */
+export async function prepareAudit(sql) {
+    await sql.unsafe(PREPARE);
+}
+/**
+ * The entity tables `schema` declares. Read before migrating: the triggers
+ * write into light_changes, so a schema that doesn't export it is refused
+ * before any migration applies.
+ */
+export function entityTables(schema) {
+    const values = Object.values(schema);
+    if (!values.some((value) => is(value, PgTable) && getTableName(value) === getTableName(lightChanges))) {
+        throw new Error("db/schema/index.ts must export lightChanges (`export { lightChanges } from \"@trylight/app/schema\";`): it records every change to the app's tables.");
+    }
+    return values.filter(isEntity).map((entity) => getTableName(entity));
+}
+/**
+ * Puts the change trigger on each of `tables` the database has (one a
+ * migration hasn't made yet is tracked on the migrate that makes it), and
+ * makes light_changes append-only. Runs after migrating.
+ */
+export async function trackTables(sql, tables) {
+    await sql `select light_track(name) from unnest(${sql.array(tables)}::text[]) as name where to_regclass(quote_ident(name)) is not null`;
+    await sql.unsafe(CHANGES_APPEND_ONLY);
+}
+const snapshotTable = z.looseObject({
+    name: z.string(),
+    columns: z.record(z.string(), z.looseObject({ type: z.string() }))
+});
+/**
+ * What going from `previous` to `current` (drizzle-kit snapshots' `tables`)
+ * destroys: dropped tables, dropped columns, and columns whose type changes
+ * (Postgres converts the values, which may not survive the trip back).
+ */
+export function destroyed(previous, current) {
+    const found = [];
+    for (const [key, entry] of Object.entries(previous)) {
+        const before = snapshotTable.parse(entry);
+        if (!(key in current)) {
+            found.push({ table: before.name, column: null });
+            continue;
+        }
+        const now = snapshotTable.parse(current[key]);
+        for (const [name, column] of Object.entries(before.columns)) {
+            const after = now.columns[name];
+            if (after === undefined || after.type !== column.type)
+                found.push({ table: before.name, column: name });
+        }
+    }
+    return found;
+}
+/** A SQL string literal, for the migration file drizzle's migrator runs. */
+function literal(text) {
+    return `'${text.replaceAll("'", "''")}'`;
+}
+/** The statements that archive what migration `tag` destroys, to run first in it. */
+export function archiveStatements(archive, tag) {
+    return archive.map(({ table, column }) => `SELECT light_archive_values(${literal(table)}, ${column === null ? "NULL" : literal(column)}, ${literal(tag)});`);
+}
+const archivedNotice = z.object({ code: z.literal(ARCHIVED_NOTICE), message: z.string() });
+/**
+ * Collects what a migrate archived, to print once its transaction commits
+ * (a migration that fails archives nothing). Other notices are dropped.
+ */
+export function archiveNotices() {
+    const messages = [];
+    return {
+        onnotice(notice) {
+            const archived = archivedNotice.safeParse(notice);
+            if (archived.success)
+                messages.push(archived.data.message);
+        },
+        print() {
+            if (messages.length === 0)
+                return;
+            console.log(messages.join("\n"));
+            console.log("Archived values stay in light_archive; AGENTS.md, \"Getting deleted data back\", says how to restore them.");
+        }
+    };
+}

package/dist/db/cli.js

@@ -9,6 +9,7 @@ import { drizzle } from "drizzle-orm/postgres-js";
 import { migrate } from "drizzle-orm/postgres-js/migrator";
 import postgres from "postgres";
 import { z } from "zod/v4";
+import { archiveNotices, entityTables, prepareAudit, trackTables } from "./audit.js";
 import { MIGRATIONS_DIR, SCHEMA_ENTRY, plan, unwriteMigration, writeMigration } from "./migrations.js";
 import { env } from "../server/env.js";
 /**
@@ -20,8 +21,10 @@ const PLATFORM_MIGRATE = "/run/mii/migrate.sock";
 /** Postgres advisory locks: one migrate, and one sync, of a database at a time. */
 const MIGRATE_LOCK_KEY = 4_815_162_342;
 const SYNC_LOCK_KEY = 4_815_162_343;
+/** Exit code of a migrate whose migrations committed but whose change triggers didn't go on. */
+const APPLIED_UNTRACKED = 2;
 // pg_advisory_lock waits for the one before it; a process that dies releases it.
-const connect = () => postgres(databaseUrl(), { max: 1, onnotice: () => undefined });
+const connect = (onnotice = () => undefined) => postgres(databaseUrl(), { max: 1, onnotice });
 const root = process.cwd();
 const envFile = join(root, ".env.local");
 if (existsSync(envFile))
@@ -56,7 +59,7 @@ async function sync() {
             console.error(error instanceof Error ? error.message : String(error));
             return 1;
         });
-        if (applied !== 0) {
+        if (applied !== 0 && applied !== APPLIED_UNTRACKED) {
             unwriteMigration(root, tag);
             console.error(`${MIGRATIONS_DIR}/${tag}.sql didn't apply, so it was taken back; change db/schema and save again.`);
         }
@@ -74,17 +77,30 @@ async function check() {
     console.error(`db/schema has changes with no migration yet; run \`pnpm db:sync\`:\n${planned.statements.join("\n")}`);
     return 1;
 }
-/** Applies every migration in db/migrations the database doesn't have. */
+/**
+ * Applies every migration in db/migrations the database doesn't have, with
+ * the audit around them (./audit.ts): its functions first, since a
+ * migration's archive step calls them; its triggers after, on the tables
+ * migrations made.
+ */
 async function applyMigrations() {
     // The agent (not root) in an app's sandbox: the platform migrates for it.
     if (userInfo().uid !== 0 && existsSync(PLATFORM_MIGRATE))
         return migrateThroughPlatform();
-    const client = connect();
+    const archived = archiveNotices();
+    const client = connect(archived.onnotice);
     try {
         await client `select pg_advisory_lock(${MIGRATE_LOCK_KEY})`;
+        const tables = entityTables(await loadSchema());
+        await prepareAudit(client);
         await migrate(drizzle(client), { migrationsFolder: join(root, MIGRATIONS_DIR) });
+        archived.print();
         console.log("Database is up to date with db/migrations.");
-        return 0;
+        // The migrations are committed: a failure here must not take their files back.
+        return await trackTables(client, tables).then(() => 0, (error) => {
+            console.error(`The change triggers didn't go on (${error instanceof Error ? error.message : String(error)}); the next migrate tries again.`);
+            return APPLIED_UNTRACKED;
+        });
     }
     finally {
         await client.end();

package/dist/db/migrations.d.ts

@@ -1,9 +1,12 @@
 import { z } from "zod/v4";
+import { type Destroyed } from "./audit.js";
 export declare const SCHEMA_ENTRY = "db/schema/index.ts";
 export declare const MIGRATIONS_DIR = "db/migrations";
 export type Plan = {
     /** The new migration's statements, in order; empty when nothing changed. */
     statements: string[];
+    /** What the statements destroy, archived first when the migration runs. */
+    archive: Destroyed[];
     snapshot: Snapshot;
 };
 /** The parts of a drizzle-kit snapshot a removal touches; the rest passes through. */
@@ -30,7 +33,7 @@ type Snapshot = z.infer<typeof snapshotSchema>;
  * What `db/schema` needs beyond the last migration, in three diffs that each
  * only remove or only add, so drizzle-kit never has to ask whether something
  * removed was renamed (it can't ask here: there is no terminal). A rename is
- * therefore a drop and an add: the old column's values go. Removed enums go last,
+ * therefore a drop and an add: the old column's values are archived. Removed enums go last,
  * after the columns that used them have changed.
  */
 export declare function plan(root: string, schema: Record<string, unknown>): Promise<Plan>;

package/dist/db/migrations.js

@@ -1,12 +1,13 @@
 // Writing a schema file is the migration: the change from the last
 // migration's snapshot to `db/schema` becomes a new drizzle migration,
 // written and applied at once, whatever it does to the rows there (a removed
-// column's values go with it).
+// column's values are archived first, in light_archive).
 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { isDeepStrictEqual } from "node:util";
 import { join } from "node:path";
 import { generateDrizzleJson, generateMigration } from "drizzle-kit/api";
 import { z } from "zod/v4";
+import { archiveStatements, destroyed } from "./audit.js";
 export const SCHEMA_ENTRY = "db/schema/index.ts";
 export const MIGRATIONS_DIR = "db/migrations";
 const entries = z.record(z.string(), z.unknown());
@@ -33,7 +34,7 @@ const snapshotSchema = z.looseObject({
  * What `db/schema` needs beyond the last migration, in three diffs that each
  * only remove or only add, so drizzle-kit never has to ask whether something
  * removed was renamed (it can't ask here: there is no terminal). A rename is
- * therefore a drop and an add: the old column's values go. Removed enums go last,
+ * therefore a drop and an add: the old column's values are archived. Removed enums go last,
  * after the columns that used them have changed.
  */
 export async function plan(root, schema) {
@@ -47,7 +48,7 @@ export async function plan(root, schema) {
         ...(await generateMigration(kept, withOldEnums)),
         ...(await generateMigration(withOldEnums, snapshot))
     ];
-    return { statements, snapshot };
+    return { statements, archive: destroyed(previous.tables, snapshot.tables), snapshot };
 }
 function only(from, keep) {
     return Object.fromEntries(Object.entries(from).filter(([key]) => key in keep));
@@ -139,7 +140,8 @@ export function writeMigration(root, planned) {
     const idx = journal.entries.length;
     const tag = `${String(idx).padStart(4, "0")}_schema`;
     mkdirSync(join(root, MIGRATIONS_DIR, "meta"), { recursive: true });
-    writeFileSync(join(root, MIGRATIONS_DIR, `${tag}.sql`), planned.statements.join("\n--> statement-breakpoint\n") + "\n");
+    const statements = [...archiveStatements(planned.archive, tag), ...planned.statements];
+    writeFileSync(join(root, MIGRATIONS_DIR, `${tag}.sql`), statements.join("\n--> statement-breakpoint\n") + "\n");
     writeFileSync(snapshotFile(root, idx), JSON.stringify(planned.snapshot, null, 2) + "\n");
     journal.entries.push({ idx, version: "7", when: Date.now(), tag, breakpoints: true });
     writeFileSync(join(root, MIGRATIONS_DIR, "meta", "_journal.json"), JSON.stringify(journal, null, 2) + "\n");

package/dist/images.d.ts

@@ -0,0 +1,7 @@
+export declare const IMAGE_PATH = "/api/light/image";
+/**
+ * Where a row's photo or logo loads from: the app's own copy (kept from the
+ * first view on) for an address on the web, the value itself for one of the
+ * app's own files.
+ */
+export declare function imageSrc(src: string): string;

package/dist/images.js

@@ -0,0 +1,12 @@
+// What the browser and the image route agree on: where a row's photo or logo
+// loads from. Nothing here may touch a database or the DOM.
+import { webUrl } from "./schema.js";
+export const IMAGE_PATH = "/api/light/image";
+/**
+ * Where a row's photo or logo loads from: the app's own copy (kept from the
+ * first view on) for an address on the web, the value itself for one of the
+ * app's own files.
+ */
+export function imageSrc(src) {
+    return webUrl.safeParse(src).success ? `${IMAGE_PATH}?src=${encodeURIComponent(src)}` : src;
+}

package/dist/schema.d.ts

@@ -1,6 +1,8 @@
 import { PgTable, type PgColumnBuilderBase, type PgTableWithColumns, type PgTableExtraConfigValue } from "drizzle-orm/pg-core";
 import type { BuildColumns, BuildExtraConfigColumns } from "drizzle-orm";
 import { z } from "zod/v4";
+/** An address on the web: http or https. */
+export declare const webUrl: z.ZodURL;
 /** Where one value was read: the page, and the words on it that say so. */
 export declare const fieldSource: z.ZodObject<{
     url: z.ZodURL;
@@ -73,9 +75,11 @@ export type Entity = PgTable & {
 };
 export declare function isEntity(value: unknown): value is Entity;
 /**
- * Every change a person makes through `app.table(...)`, with who made it, in
- * the same transaction as the change. `changes` is the new row for a create,
- * the old row for a delete, and `{ column: { from, to } }` for an update.
+ * Every change to an entity table, whoever made it, written by the table's
+ * trigger (src/db/audit.ts) in the change's transaction. `changes` is the new
+ * row for a create, the old row for a delete, and `{ column: { from, to } }`
+ * for an update. A `database` actor is a writer that didn't name itself: its
+ * name is the database role.
  */
 export declare const lightChanges: PgTableWithColumns<{
     name: "light_changes";
@@ -173,14 +177,14 @@ export declare const lightChanges: PgTableWithColumns<{
             tableName: "light_changes";
             dataType: "string";
             columnType: "PgText";
-            data: "person" | "agent";
+            data: "person" | "agent" | "database";
             driverParam: string;
             notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: ["person", "agent"];
+            enumValues: ["person", "agent", "database"];
             baseColumn: never;
             identity: undefined;
             generated: undefined;
@@ -239,4 +243,86 @@ export declare const lightChanges: PgTableWithColumns<{
     };
     dialect: "pg";
 }>;
+/**
+ * The app's own copy of each photo or logo its rows point at, kept on the
+ * first view (the image route, `@trylight/app/server`), so a source that
+ * moves or shuts down later does not take the picture with it.
+ */
+export declare const lightImages: PgTableWithColumns<{
+    name: "light_images";
+    schema: undefined;
+    columns: {
+        source_url: import("drizzle-orm/pg-core").PgColumn<{
+            name: "source_url";
+            tableName: "light_images";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        content_type: import("drizzle-orm/pg-core").PgColumn<{
+            name: "content_type";
+            tableName: "light_images";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        bytes: import("drizzle-orm/pg-core").PgColumn<{
+            name: "bytes";
+            tableName: "light_images";
+            dataType: "custom";
+            columnType: "PgCustomColumn";
+            data: Uint8Array<ArrayBufferLike>;
+            driverParam: unknown;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            pgColumnBuilderBrand: "PgCustomColumnBuilderBrand";
+        }>;
+        fetched_at: import("drizzle-orm/pg-core").PgColumn<{
+            name: "fetched_at";
+            tableName: "light_images";
+            dataType: "string";
+            columnType: "PgTimestampString";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;
 export {};

package/dist/schema.js

@@ -3,11 +3,13 @@
 // the app. Imported by drizzle-kit and the browser's types, so nothing here
 // may touch a database or the DOM.
 import { is } from "drizzle-orm";
-import { PgTable, index, jsonb, pgTable, text, timestamp, uuid } from "drizzle-orm/pg-core";
+import { PgTable, customType, index, jsonb, pgTable, text, timestamp, uuid } from "drizzle-orm/pg-core";
 import { z } from "zod/v4";
+/** An address on the web: http or https. */
+export const webUrl = z.url({ protocol: /^https?$/ });
 /** Where one value was read: the page, and the words on it that say so. */
 export const fieldSource = z.object({
-    url: z.url({ protocol: /^https?$/ }),
+    url: webUrl,
     evidence: z.string().min(1)
 });
 /** The site a source's url names, as people read it: "https://www.acme.com/about" is "acme.com". */
@@ -62,9 +64,11 @@ export function isEntity(value) {
     return is(value, PgTable) && "$access" in value;
 }
 /**
- * Every change a person makes through `app.table(...)`, with who made it, in
- * the same transaction as the change. `changes` is the new row for a create,
- * the old row for a delete, and `{ column: { from, to } }` for an update.
+ * Every change to an entity table, whoever made it, written by the table's
+ * trigger (src/db/audit.ts) in the change's transaction. `changes` is the new
+ * row for a create, the old row for a delete, and `{ column: { from, to } }`
+ * for an update. A `database` actor is a writer that didn't name itself: its
+ * name is the database role.
  */
 export const lightChanges = pgTable("light_changes", {
     id: uuid().primaryKey().defaultRandom(),
@@ -72,10 +76,22 @@ export const lightChanges = pgTable("light_changes", {
     row_id: uuid().notNull(),
     action: text({ enum: ["create", "update", "delete"] }).notNull(),
     changes: jsonb().$type().notNull(),
-    actor_kind: text({ enum: ["person", "agent"] }).notNull(),
+    actor_kind: text({ enum: ["person", "agent", "database"] }).notNull(),
     actor_id: text(),
     actor_name: text().notNull(),
     created_at: timestamp({ withTimezone: true, mode: "string" })
         .notNull()
         .defaultNow()
 }, (t) => [index("light_changes_row_idx").on(t.table_name, t.row_id)]);
+const bytea = customType({ dataType: () => "bytea" });
+/**
+ * The app's own copy of each photo or logo its rows point at, kept on the
+ * first view (the image route, `@trylight/app/server`), so a source that
+ * moves or shuts down later does not take the picture with it.
+ */
+export const lightImages = pgTable("light_images", {
+    source_url: text().primaryKey(),
+    content_type: text().notNull(),
+    bytes: bytea().notNull(),
+    fetched_at: timestamp({ withTimezone: true, mode: "string" }).notNull().defaultNow()
+});

package/dist/server/entities.js

@@ -1,14 +1,14 @@
 // The one route behind `app.table(...)`: list, get, create, update and delete
 // on any entity table, each request checked against the table's own Zod
-// schema and the app's door, and every change recorded in light_changes with
-// who made it, in the same transaction.
-import { and, asc, desc, eq, getTableColumns, getTableName, inArray, isNull } from "drizzle-orm";
+// schema and the app's door. Each write names its person for the table's
+// trigger, which records the change in light_changes (src/db/audit.ts).
+import { and, asc, desc, eq, getTableColumns, getTableName, inArray, isNull, sql } from "drizzle-orm";
 import { isDeepStrictEqual } from "node:util";
 import { createSchemaFactory } from "drizzle-zod";
 import { isSameOrigin } from "@shubh90/app-runtime/chat/server";
 import { z } from "zod/v4";
 import { ENTITIES_PATH, LIST_LIMIT } from "../entities.js";
-import { PLATFORM_COLUMNS, fieldSource, isEntity, lightChanges } from "../schema.js";
+import { PLATFORM_COLUMNS, fieldSource, isEntity } from "../schema.js";
 import { env } from "./env.js";
 /** Who writes when the app runs with no sign-in at all: a bare local dev server. */
 const LOCAL_DEVELOPER = { id: null, name: "Local developer" };
@@ -153,54 +153,39 @@ async function get(db, table, id) {
 }
 async function create(db, table, actor, data) {
     return db.transaction(async (tx) => {
-        const row = exactlyOne(await tx
+        await nameActor(tx, actor);
+        return exactlyOne(await tx
             .insert(table.entity)
             .values({ ...data, created_by: actor.id })
             .returning());
-        await audit(tx, table, rowId(row), "create", row, actor);
-        return row;
     });
 }
 async function update(db, table, actor, id, patch) {
     return db.transaction(async (tx) => {
+        await nameActor(tx, actor);
         const before = atMostOne(await tx.select().from(table.entity).where(eq(table.id, id)).for("update"));
         if (before === null)
             return null;
         const changed = Object.keys(patch).filter((key) => !isDeepStrictEqual(patch[key], before[key]));
         // A value a person sets is no longer what its source said; sources sent are merged in.
         const field_sources = { ...withoutSources(before.field_sources, changed), ...patch.field_sources };
-        const row = exactlyOne(await tx
+        return exactlyOne(await tx
             .update(table.entity)
             .set({ ...patch, field_sources })
             .where(eq(table.id, id))
             .returning());
-        const changes = Object.fromEntries([...changed, "field_sources"]
-            .filter((key) => !isDeepStrictEqual(before[key], row[key]))
-            .map((key) => [key, { from: before[key], to: row[key] }]));
-        if (Object.keys(changes).length > 0)
-            await audit(tx, table, id, "update", changes, actor);
-        return row;
     });
 }
 async function remove(db, table, actor, id) {
     return db.transaction(async (tx) => {
+        await nameActor(tx, actor);
         const row = atMostOne(await tx.delete(table.entity).where(eq(table.id, id)).returning());
-        if (row === null)
-            return null;
-        await audit(tx, table, id, "delete", row, actor);
-        return { id };
+        return row === null ? null : { id };
     });
 }
-function audit(tx, table, rowId, action, changes, actor) {
-    return tx.insert(lightChanges).values({
-        table_name: table.name,
-        row_id: rowId,
-        action,
-        changes,
-        actor_kind: "person",
-        actor_id: actor.id,
-        actor_name: actor.name
-    });
+/** Who the table's trigger records in light_changes for the rest of this transaction. */
+function nameActor(tx, actor) {
+    return tx.execute(sql `select set_config('light.actor_kind', 'person', true), set_config('light.actor_id', coalesce(${actor.id}, ''), true), set_config('light.actor_name', ${actor.name}, true)`);
 }
 /** The row a statement by primary key touched, or null when there is none. */
 function atMostOne(rows) {
@@ -218,10 +203,6 @@ function exactlyOne(rows) {
 }
 // What's stored may come from an agent's own write: read as it is, never refused here.
 const storedSources = z.record(z.string(), z.unknown());
-const storedId = z.object({ id: z.uuid() });
-function rowId(row) {
-    return storedId.parse(row).id;
-}
 function withoutSources(stored, columns) {
     const sources = storedSources.parse(stored);
     return Object.fromEntries(Object.entries(sources).filter(([column]) => !columns.includes(column)));

package/dist/server/images.d.ts

@@ -0,0 +1,40 @@
+import { type LookupFunction } from "node:net";
+import type { PostgresJsDatabase } from "drizzle-orm/postgres-js";
+import type { SessionState } from "./session.js";
+type Db = PostgresJsDatabase<Record<string, unknown>>;
+export declare const MAX_IMAGE_BYTES: number;
+export type StoredImage = {
+    readonly contentType: string;
+    readonly bytes: Uint8Array;
+};
+export type ImageLookup = {
+    readonly ok: true;
+    readonly image: StoredImage;
+} | {
+    readonly ok: false;
+    readonly reason: string;
+};
+export type ImageOptions = {
+    db: () => Db;
+    session: (request: Request) => Promise<SessionState>;
+};
+/** `/api/light/image?src=…`: a photo or logo a row points at, served from the app's own copy. */
+export declare function createImageHandler(options: ImageOptions): (request: Request) => Promise<Response>;
+/**
+ * An address on the public internet: not this machine, a private or carrier
+ * network, link-local (the cloud metadata address), multicast or reserved.
+ * An IPv4 address written as IPv6 is judged as itself.
+ */
+export declare function isPublicAddress(address: string): boolean;
+/**
+ * The name lookup of every connection the image fetch opens, redirects
+ * included: the address checked is the address connected to, so a public
+ * name that resolves (or is re-pointed between two asks) to this machine or
+ * a private network is never reached.
+ */
+export declare const publicOnlyLookup: LookupFunction;
+/** The app's copy of the image at `source`, if a member's view has kept one. */
+export declare function keptImage(db: Db, source: URL): Promise<ImageLookup>;
+/** The app's copy of the image at `source`, fetched and kept on the first ask. */
+export declare function storedImage(db: Db, source: URL): Promise<ImageLookup>;
+export {};

package/dist/server/images.js

@@ -0,0 +1,246 @@
+// The app's copy of the photos and logos its rows point at. The first time a
+// member's browser asks the image route for one it is fetched and kept in
+// light_images; every later ask is answered from there, so a source that
+// rate-limits, moves or shuts down after that does not take the picture with
+// it. Ported from the v1 template (#1063).
+import dns from "node:dns";
+import { isIP } from "node:net";
+import { eq } from "drizzle-orm";
+import ipaddr from "ipaddr.js";
+import { Agent } from "undici";
+import { z } from "zod/v4";
+import { lightImages, webUrl } from "../schema.js";
+import { env } from "./env.js";
+const FETCH_TIMEOUT_MS = 15_000;
+const MAX_REDIRECTS = 5;
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+export const MAX_IMAGE_BYTES = 5 * 1024 * 1024;
+const YEAR_SECONDS = 365 * 24 * 60 * 60;
+// An SVG is a document if someone navigates to it; the route's sandbox
+// header keeps it inert there, and in an <img> it never runs script.
+const IMAGE_TYPES = new Set([
+    "image/png",
+    "image/jpeg",
+    "image/gif",
+    "image/webp",
+    "image/avif",
+    "image/svg+xml",
+    "image/x-icon",
+    "image/vnd.microsoft.icon"
+]);
+// The bytes are an image or they are nothing, and an SVG opened on its own stays inert.
+const INERT = {
+    "Content-Security-Policy": "sandbox",
+    "X-Content-Type-Options": "nosniff"
+};
+// Node's fetch reports a DNS or connection failure as "fetch failed", with the
+// reason (ENOTFOUND, ECONNREFUSED…) only on its cause.
+const networkFailure = z.object({ cause: z.object({ code: z.string() }) });
+/** `/api/light/image?src=…`: a photo or logo a row points at, served from the app's own copy. */
+export function createImageHandler(options) {
+    return async (request) => {
+        const { user, mode } = await options.session(request);
+        if (user === null && mode === "members") {
+            return new Response("Sign in to use this app.", { status: 401 });
+        }
+        const src = webUrl.safeParse(new URL(request.url).searchParams.get("src"));
+        if (!src.success) {
+            return new Response("src must be an http(s) address.", { status: 400 });
+        }
+        const db = options.db();
+        const source = new URL(src.data);
+        // A stranger to a public app only reads the copy, so nobody signed out can
+        // make the app fetch or keep anything; a member's view fills it, as does
+        // every view where there is no sign-in to be a stranger to.
+        const stranger = user === null && env().configured;
+        const lookup = stranger ? keptImage : storedImage;
+        const found = await lookup(db, source);
+        if (!found.ok) {
+            // Nothing is kept for a source that did not answer with an image, so the
+            // next view asks it again; until then the row shows its letters.
+            return new Response(found.reason, {
+                status: 404,
+                headers: { ...INERT, "Cache-Control": "no-store" }
+            });
+        }
+        // Cached by the CDN under the source address, which only someone who
+        // already knows it can ask for; the pictures are the public web's.
+        // A copy: the driver's buffer is typed over any ArrayBufferLike, a body needs one over ArrayBuffer.
+        return new Response(new Uint8Array(found.image.bytes), {
+            headers: {
+                ...INERT,
+                "Content-Type": found.image.contentType,
+                "Cache-Control": `public, max-age=${YEAR_SECONDS}, immutable`
+            }
+        });
+    };
+}
+/**
+ * An address on the public internet: not this machine, a private or carrier
+ * network, link-local (the cloud metadata address), multicast or reserved.
+ * An IPv4 address written as IPv6 is judged as itself.
+ */
+export function isPublicAddress(address) {
+    return ipaddr.isValid(address) && ipaddr.process(address).range() === "unicast";
+}
+class NotPublicAddress extends Error {
+    address;
+    code = "ENOTPUBLIC";
+    constructor(address) {
+        super(`${address} is not a public address.`);
+        this.address = address;
+    }
+}
+/**
+ * The name lookup of every connection the image fetch opens, redirects
+ * included: the address checked is the address connected to, so a public
+ * name that resolves (or is re-pointed between two asks) to this machine or
+ * a private network is never reached.
+ */
+export const publicOnlyLookup = (hostname, options, callback) => {
+    dns.lookup(hostname, options, (error, address, family) => {
+        if (error !== null)
+            return callback(error, address, family);
+        const addresses = Array.isArray(address) ? address.map((found) => found.address) : [address];
+        const [refused = null] = addresses.filter((found) => !isPublicAddress(found));
+        if (refused !== null)
+            return callback(new NotPublicAddress(refused), address, family);
+        callback(null, address, family);
+    });
+};
+// Connects only to public addresses. A bare address in a URL skips the name
+// lookup, so fetchImage checks that one itself.
+const publicWeb = new Agent({ connect: { lookup: publicOnlyLookup } });
+const refusedAddress = z.object({ cause: z.instanceof(NotPublicAddress) });
+// A fragment never reaches the server, so two addresses that differ only
+// there are one image.
+function keyOf(source) {
+    const key = new URL(source);
+    key.hash = "";
+    return key;
+}
+/** The app's copy of the image at `source`, if a member's view has kept one. */
+export async function keptImage(db, source) {
+    const [kept = null] = await db
+        .select({ contentType: lightImages.content_type, bytes: lightImages.bytes })
+        .from(lightImages)
+        .where(eq(lightImages.source_url, keyOf(source).href));
+    if (kept === null)
+        return { ok: false, reason: "No copy of this image is kept yet." };
+    return { ok: true, image: kept };
+}
+/** The app's copy of the image at `source`, fetched and kept on the first ask. */
+export async function storedImage(db, source) {
+    const kept = await keptImage(db, source);
+    if (kept.ok)
+        return kept;
+    const key = keyOf(source);
+    const fetched = await fetchImage(key);
+    if (!fetched.ok)
+        return fetched;
+    await db
+        .insert(lightImages)
+        .values({ source_url: key.href, content_type: fetched.image.contentType, bytes: fetched.image.bytes })
+        .onConflictDoNothing();
+    return fetched;
+}
+function failureReason(error) {
+    const failure = networkFailure.safeParse(error);
+    return failure.success ? failure.data.cause.code : String(error);
+}
+async function fetchImage(source) {
+    const host = source.hostname.toLowerCase();
+    // Each hop is checked: a redirect must never be the way to make this app
+    // fetch from somewhere it would not fetch itself.
+    let url = source;
+    let response;
+    for (let hop = 0;; hop += 1) {
+        const at = url.hostname.toLowerCase();
+        const notPublic = (detail) => ({
+            ok: false,
+            reason: hop === 0
+                ? `${at} is not a public web address${detail}.`
+                : `${host} redirected to ${at}, which is not a public web address${detail}.`
+        });
+        // An IPv6 host is bracketed in a URL.
+        const bare = at.replace(/^\[(.*)\]$/, "$1");
+        if (isIP(bare) !== 0 && !isPublicAddress(bare))
+            return notPublic("");
+        const init = {
+            signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+            redirect: "manual",
+            dispatcher: publicWeb
+        };
+        try {
+            response = await fetch(url, init);
+        }
+        catch (error) {
+            const refused = refusedAddress.safeParse(error);
+            if (refused.success)
+                return notPublic(` (it resolves to ${refused.data.cause.address})`);
+            return { ok: false, reason: `${at} could not be reached (${failureReason(error)}).` };
+        }
+        const location = response.headers.get("location");
+        if (location === null || !REDIRECT_STATUSES.has(response.status))
+            break;
+        if (response.body !== null)
+            await response.body.cancel();
+        if (hop === MAX_REDIRECTS)
+            return { ok: false, reason: `${host} redirected too many times.` };
+        url = new URL(location, url);
+    }
+    if (!response.ok)
+        return { ok: false, reason: `${host} answered HTTP ${response.status}.` };
+    const contentType = mediaType(response.headers.get("content-type"));
+    if (!IMAGE_TYPES.has(contentType)) {
+        return { ok: false, reason: `${host} answered with ${contentType || "no content type"}, not an image.` };
+    }
+    let bytes;
+    try {
+        bytes = await readCapped(response, MAX_IMAGE_BYTES);
+    }
+    catch (error) {
+        return { ok: false, reason: `${host} stopped answering before the image was read (${failureReason(error)}).` };
+    }
+    if (bytes === null)
+        return { ok: false, reason: `${host}'s image is over ${MAX_IMAGE_BYTES} bytes.` };
+    // An empty 200 is what a rate-limiter or a CDN edge answers with; kept, it
+    // would be served as the picture for a year.
+    if (bytes.byteLength === 0)
+        return { ok: false, reason: `${host} answered with an empty body.` };
+    return { ok: true, image: { contentType, bytes } };
+}
+/** "image/png; charset=binary" is "image/png"; a response with none has "". */
+function mediaType(header) {
+    if (header === null)
+        return "";
+    return header.replace(/;.*$/, "").trim().toLowerCase();
+}
+// Read at most `limit` bytes, abandoning the response the moment it exceeds
+// them: content-length is advisory, so the cap is applied while reading.
+async function readCapped(response, limit) {
+    const stream = response.body;
+    if (stream === null)
+        return new Uint8Array(0);
+    const reader = stream.getReader();
+    const chunks = [];
+    let total = 0;
+    for (;;) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        total += value.byteLength;
+        if (total > limit) {
+            await reader.cancel();
+            return null;
+        }
+        chunks.push(value);
+    }
+    const out = new Uint8Array(total);
+    let at = 0;
+    for (const chunk of chunks) {
+        out.set(chunk, at);
+        at += chunk.byteLength;
+    }
+    return out;
+}

package/dist/server/index.d.ts

@@ -18,6 +18,8 @@ export declare function createLightServer<S extends Record<string, unknown>, C e
     readonly db: PostgresJsDatabase<S>;
     /** `/api/light/entities/*`: what `app.table(...)` calls. */
     entities: (request: Request) => Promise<Response>;
+    /** `/api/light/image`: a row's photo or logo, from the app's own copy (kept on the first view). */
+    image: (request: Request) => Promise<Response>;
     /** Server-side starts and reads of the app's contracts. */
     invoke: import("@shubh90/app-runtime/invoke/server").MiiInvoke<C>;
     /** `/api/mii/invoke/*`: the contract buttons, forwarded to Plaza as the person. */

package/dist/server/index.js

@@ -1,6 +1,6 @@
 // The app's server half, bound once in `src/server/light.ts`: its database,
 // its door (sign-in through Plaza), and the routes the SDK serves (entities,
-// contracts, chat). Server-only.
+// images, contracts, chat). Server-only.
 import { drizzle } from "drizzle-orm/postgres-js";
 import postgres from "postgres";
 import { createMiiAuthCore } from "@shubh90/app-runtime/auth/core";
@@ -8,6 +8,7 @@ import { createMiiChatHandler } from "@shubh90/app-runtime/chat/server";
 import { createMiiInvoke } from "@shubh90/app-runtime/invoke/server";
 import { createEntitiesHandler } from "./entities.js";
 import { env } from "./env.js";
+import { createImageHandler } from "./images.js";
 import { readSession, signIn } from "./session.js";
 export { cookieAttributes, safeNext, SESSION_COOKIE } from "@shubh90/app-runtime/auth/core";
 export { defineContracts, InvocationError } from "@shubh90/app-runtime/invoke/server";
@@ -42,6 +43,8 @@ export function createLightServer(options) {
         },
         /** `/api/light/entities/*`: what `app.table(...)` calls. */
         entities: createEntitiesHandler({ schema: options.schema, db, session }),
+        /** `/api/light/image`: a row's photo or logo, from the app's own copy (kept on the first view). */
+        image: createImageHandler({ db, session }),
         /** Server-side starts and reads of the app's contracts. */
         invoke,
         /** `/api/mii/invoke/*`: the contract buttons, forwarded to Plaza as the person. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trylight/app",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "The Light SDK every v2 org app depends on: entities (Drizzle tables with a typed client), sign-in, contracts and in-app chat.",
   "license": "UNLICENSED",
   "type": "module",
@@ -54,7 +54,9 @@
     "@shubh90/app-runtime": "^0.10.3",
     "drizzle-kit": "0.31.11",
     "drizzle-zod": "^0.8.3",
-    "tsx": "^4.23.15"
+    "ipaddr.js": "^2.5.0",
+    "tsx": "^4.23.15",
+    "undici": "^7.30.0"
   },
   "devDependencies": {
     "@eslint-community/eslint-plugin-eslint-comments": "^4.8.1",