@trypattern/sdk 0.1.0 → 0.1.2

package/dist/rules/checkAllFiles.js

@@ -332,6 +332,7 @@ const SRC_ENTRY_FILES = new Set([
     'App.ts',
     'models/index.ts',
     'stores/index.ts',
+    'services/index.ts',
     'actions/index.ts',
     'main.tsx',
     'routes.tsx',
@@ -345,6 +346,7 @@ const SRC_FOLDER_PATTERNS = [
     /^layouts\/[A-Z][A-Za-z]*Layout\.tsx$/,
     /^models\/[A-Z][A-Za-z]*\.ts$/,
     /^stores\/[A-Z][A-Za-z]*\.ts$/,
+    /^services\/[a-z][A-Za-z]*\.ts$/,
     /^actions\/[a-z][A-Za-z]*\.ts$/
 ];
 const PREFIXED_FOLDER_FILE = /^(components)\/([A-Z][A-Za-z]*)\/([A-Z][A-Za-z]*)\.tsx?$/;
@@ -362,6 +364,7 @@ const MODULE_FILE = /\.(ts|tsx|mts|cts)$/;
 const CLASS_HOMES = [
     { pattern: /\bextends\s+Model\s*\(/, folder: 'models/' },
     { pattern: /\bextends\s+Store\s*\(/, folder: 'stores/' },
+    { pattern: /\bdefineServices\s*\(/, folder: 'services/' },
     { pattern: /\bdefineActions\s*\(/, folder: 'actions/' }
 ];
 function isInItsFolder(path) {
@@ -474,6 +477,7 @@ function runsAccessFlows() {
     return (/from '@trypattern\/sdk\/flows'/.test(text) &&
         /accessFlows\(\s*\{\s*App\s*\}\s*\)/.test(text));
 }
+const WORKER_ENTRY = 'server/worker.ts';
 const CONVENTION_EXPORTS = {
     'schema.ts': ['tables', 'admins'],
     'seed.ts': ['seed'],
@@ -611,14 +615,18 @@ function exportFindings() {
     return [...modules].flatMap(([path, facts]) => {
         const kept = CONVENTION_EXPORTS[relative(ROOT, path)] ?? [];
         const names = used.get(path) ?? new Set();
+        const isWorkerEntry = relative(ROOT, path) === WORKER_ENTRY;
         return [
-            ...facts.passedThrough.map(({ offset }) => ({
+            ...(isWorkerEntry ? [] : facts.passedThrough).map(({ offset }) => ({
                 path,
                 offset,
                 rule: 'no-re-exports'
             })),
             ...facts.exported
-                .filter(({ name }) => !kept.includes(name) && !names.has(name) && !names.has(EVERYTHING))
+                .filter(({ name }) => !isWorkerEntry &&
+                !kept.includes(name) &&
+                !names.has(name) &&
+                !names.has(EVERYTHING))
                 .map(({ offset }) => ({ path, offset, rule: 'no-unused-exports' }))
         ];
     });

package/dist/rules/lintPlugin.js

@@ -55,6 +55,7 @@ const PRIMITIVES = new Set([
     'ContextMenu',
     'Dialog',
     'Divider',
+    'CopyButton',
     'EmptyState',
     'Form',
     'Icon',
@@ -65,6 +66,7 @@ const PRIMITIVES = new Set([
     'LoadingRows',
     'Menu',
     'PropertyRow',
+    'RadioGroup',
     'Row',
     'Screen',
     'ScrollArea',

package/dist/rules/messages.d.ts

@@ -1,4 +1,4 @@
-export declare const SRC_STRUCTURE_MESSAGE = "src/ follows the four layers, one folder each, and each folder holds only its kind. Data comes from the server through stores: Pattern gives every table in schema.ts a store, and stores/ holds the others as <Name>.ts with a class extending Store({ state, persist }) (stores/Toasts.ts, stores/IssuesView.ts), listed in `stores` in stores/index.ts. models/ holds each model, the state, answers and commands behind a screen or app chrome, as <Name>.ts with a class extending Model({ state, persist }) (models/IssueList.ts holds class IssueList), listed in `models` in models/index.ts under the route id of its page. actions/ holds the menu entries and shortcuts, one file per thing they act on (actions/issues.ts, actions/appearance.ts), each `export const issueActions = defineActions(({ page, models }) => [...])`, listed in `actions` in actions/index.ts. screens/ holds the pages you see, one file each, named <Name>Screen.tsx (IssueListScreen.tsx), each reading its model with useModel and arranging primitives, with no styles of its own. components/<Name>/ groups the pieces this app adds, and every file in it starts with the folder name (components/IssueList/IssueListRow.tsx); they take props, and only screens and layouts may call useModel. layouts/ holds <Name>Layout.tsx files (layouts/AppLayout.tsx), the frames pages render inside: which pages need sign-in, the sidebar or top bar, and where the Toaster and CommandPalette go. A piece may draw a shape no primitive gives, with tokens for every value, <Text> for its words and primitives for anything clickable. App.ts wires the app together from tables, stores, models, routes and actions. hooks/ holds hooks (use<Name>.ts); lib/ holds non-UI helpers and data (.ts only); theme/ holds theme.ts (the tokens this app re-values) and icons.ts (the icons this app adds). Primitives (Screen, Stack, Text, Button, Menu, Icon) come from @trypattern/sdk/react and are not in this project. Styles live only at the bottom of the component file that owns them; there are no style files. To reuse a look, reuse the component. Move the file where it belongs.";
+export declare const SRC_STRUCTURE_MESSAGE = "src/ follows the four layers, one folder each, and each folder holds only its kind. Data comes from the server through stores: Pattern gives every table in schema.ts a store, and stores/ holds the others as <Name>.ts with a class extending Store({ state, persist }) (stores/Toasts.ts, stores/IssuesView.ts), listed in `stores` in stores/index.ts; a store reaches the app\u2019s own server calls as this.services.<group>.<call>(). services/ holds the app\u2019s own server calls, declared once with their inputs, replies and the memory fake flows run against: services/<group>.ts holds defineServices({ <group>: { ... } }) and its memory handlers, and services/index.ts exports `services` and `memory` for App.ts (server/<group>.ts serves them with serveServices). Stores call them; models never do. models/ holds each model, the state, answers and commands behind a screen or app chrome, as <Name>.ts with a class extending Model({ state, persist }) (models/IssueList.ts holds class IssueList), listed in `models` in models/index.ts under the route id of its page. actions/ holds the menu entries and shortcuts, one file per thing they act on (actions/issues.ts, actions/appearance.ts), each `export const issueActions = defineActions(({ page, models }) => [...])`, listed in `actions` in actions/index.ts. screens/ holds the pages you see, one file each, named <Name>Screen.tsx (IssueListScreen.tsx), each reading its model with useModel and arranging primitives, with no styles of its own. components/<Name>/ groups the pieces this app adds, and every file in it starts with the folder name (components/IssueList/IssueListRow.tsx); they take props, and only screens and layouts may call useModel. layouts/ holds <Name>Layout.tsx files (layouts/AppLayout.tsx), the frames pages render inside: which pages need sign-in, the sidebar or top bar, and where the Toaster and CommandPalette go. A piece may draw a shape no primitive gives, with tokens for every value, <Text> for its words and primitives for anything clickable. App.ts wires the app together from tables, services, stores, models, routes and actions. hooks/ holds hooks (use<Name>.ts); lib/ holds non-UI helpers and data (.ts only); theme/ holds theme.ts (the tokens this app re-values) and icons.ts (the icons this app adds). Primitives (Screen, Stack, Text, Button, Menu, Icon) come from @trypattern/sdk/react and are not in this project. Styles live only at the bottom of the component file that owns them; there are no style files. To reuse a look, reuse the component. Move the file where it belongs.";
 export declare const SCRIPTS_WIRED_MESSAGE = "A project script lives in a labelled folder under scripts/ (a folder named for what it does) and is used by something: package.json, the app launcher, vite.config.ts, flows/, or another script. Delete scripts nothing uses; never leave one-off scripts behind. Checks and tools every Pattern app needs belong in @trypattern/sdk, not here.";
 export declare const NO_COMMENTS_MESSAGE = "Comments are not allowed in Pattern, including directives like @ts-expect-error or oxlint-disable: there are no escape hatches, fix the code. Express intent with names, types and structure; put lasting rationale in the error message of the rule that enforces it, or in the commit message.";
 export declare const NO_POINTER_CURSOR_MESSAGE = "cursor: pointer is not allowed in Pattern. Pattern apps feel native, and native apps keep the default arrow over links and buttons. Remove it; the reset Pattern ships already sets cursor: default.";
@@ -24,7 +24,7 @@ export declare const CLASSES_NOT_FACTORIES_MESSAGE = "A function that returns an
 export declare const ACCESS_FLOWS_MESSAGE = "flows/Access.flow.ts runs Pattern's generated access flows, which prove every table's access rules against the seed on each app test. Keep it: `import { accessFlows } from '@trypattern/sdk/flows'` and `accessFlows({ App })`.";
 export declare const SCHEMA_TABLES_MESSAGE = "schema.ts defines every saved table in one place and says who may do what: `export const tables = defineTables({ issues: { columns: { title: z.string() }, access: { read: 'signedIn', create: 'signedIn', update: 'signedIn', delete: 'signedIn' }, writes: 'optimistic' } })`. It exports a row type for each table, named for one row (`export type Issue = Row<typeof tables.issues>`), and the emails of the people who run the app, `export const admins: string[] = []`, even when there are none yet, so the question is answered on purpose. Add the line shown.";
 export declare const NO_UNUSED_EXPORTS_MESSAGE = "Export only what another file imports. Nothing imports this, so remove `export` (and the code itself if this file does not use it either). Unused exports hide dead code and make a file look like it offers more than it does. Pattern reads `tables` from schema.ts and `seed` from seed.ts, and vite.config.ts and server/worker.ts default-export their config, so those stay.";
-export declare const NO_RE_EXPORTS_MESSAGE = "Do not pass imports through: a file exports only what it defines. Import the thing from where it lives instead (command from @trypattern/sdk, a component from its own file), so every import names the real source.";
+export declare const NO_RE_EXPORTS_MESSAGE = "Do not pass imports through: a file exports only what it defines. Import the thing from where it lives instead (command from @trypattern/sdk, a component from its own file), so every import names the real source. server/worker.ts is the one exception: Cloudflare runs the Workflow and Durable Object classes its Worker exports, so it may export them from where they live.";
 export declare const EXPLICIT_ACCESS_MESSAGE = "Mark every class member public or private (or protected, to override a base class member), so a reader sees at a glance what other code may call: `public setSort = command(...)`, `public override onPageOpen()`, `private loadIssues()`. Use the word private, never #name, so there is one way to say it. Constructors need neither.";
 export declare const IMPORT_FROM_ROOT_MESSAGE = "Import project files by their path from the project root, the way errors and docs name them: `@/src/models/Issues.ts`, `@/schema.ts`. `./File.ts` is fine for a file in the same folder; never `../` or `./folder/File.ts`, so every import says exactly where the file is and moving a file never breaks the files beside it.";
 export declare const MODEL_MEMBERS_MESSAGE = "A model shows the outside world three kinds of public member, so a reader can tell them apart at a glance: getters are its answers (public get hasNext()), command() fields are what it can do (public openNext = command(() => ...)), and onPageOpen() runs when its page opens. Everything else is private, and a private helper that works something out is a method (private neighbours()), never a getter, because Pattern publishes every getter to the screen and the snapshot. A model has no `actions`: menu entries and shortcuts live in src/actions/.";

package/dist/rules/messages.js

@@ -1,4 +1,4 @@
-export const SRC_STRUCTURE_MESSAGE = 'src/ follows the four layers, one folder each, and each folder holds only its kind. Data comes from the server through stores: Pattern gives every table in schema.ts a store, and stores/ holds the others as <Name>.ts with a class extending Store({ state, persist }) (stores/Toasts.ts, stores/IssuesView.ts), listed in `stores` in stores/index.ts. models/ holds each model, the state, answers and commands behind a screen or app chrome, as <Name>.ts with a class extending Model({ state, persist }) (models/IssueList.ts holds class IssueList), listed in `models` in models/index.ts under the route id of its page. actions/ holds the menu entries and shortcuts, one file per thing they act on (actions/issues.ts, actions/appearance.ts), each `export const issueActions = defineActions(({ page, models }) => [...])`, listed in `actions` in actions/index.ts. screens/ holds the pages you see, one file each, named <Name>Screen.tsx (IssueListScreen.tsx), each reading its model with useModel and arranging primitives, with no styles of its own. components/<Name>/ groups the pieces this app adds, and every file in it starts with the folder name (components/IssueList/IssueListRow.tsx); they take props, and only screens and layouts may call useModel. layouts/ holds <Name>Layout.tsx files (layouts/AppLayout.tsx), the frames pages render inside: which pages need sign-in, the sidebar or top bar, and where the Toaster and CommandPalette go. A piece may draw a shape no primitive gives, with tokens for every value, <Text> for its words and primitives for anything clickable. App.ts wires the app together from tables, stores, models, routes and actions. hooks/ holds hooks (use<Name>.ts); lib/ holds non-UI helpers and data (.ts only); theme/ holds theme.ts (the tokens this app re-values) and icons.ts (the icons this app adds). Primitives (Screen, Stack, Text, Button, Menu, Icon) come from @trypattern/sdk/react and are not in this project. Styles live only at the bottom of the component file that owns them; there are no style files. To reuse a look, reuse the component. Move the file where it belongs.';
+export const SRC_STRUCTURE_MESSAGE = 'src/ follows the four layers, one folder each, and each folder holds only its kind. Data comes from the server through stores: Pattern gives every table in schema.ts a store, and stores/ holds the others as <Name>.ts with a class extending Store({ state, persist }) (stores/Toasts.ts, stores/IssuesView.ts), listed in `stores` in stores/index.ts; a store reaches the app’s own server calls as this.services.<group>.<call>(). services/ holds the app’s own server calls, declared once with their inputs, replies and the memory fake flows run against: services/<group>.ts holds defineServices({ <group>: { ... } }) and its memory handlers, and services/index.ts exports `services` and `memory` for App.ts (server/<group>.ts serves them with serveServices). Stores call them; models never do. models/ holds each model, the state, answers and commands behind a screen or app chrome, as <Name>.ts with a class extending Model({ state, persist }) (models/IssueList.ts holds class IssueList), listed in `models` in models/index.ts under the route id of its page. actions/ holds the menu entries and shortcuts, one file per thing they act on (actions/issues.ts, actions/appearance.ts), each `export const issueActions = defineActions(({ page, models }) => [...])`, listed in `actions` in actions/index.ts. screens/ holds the pages you see, one file each, named <Name>Screen.tsx (IssueListScreen.tsx), each reading its model with useModel and arranging primitives, with no styles of its own. components/<Name>/ groups the pieces this app adds, and every file in it starts with the folder name (components/IssueList/IssueListRow.tsx); they take props, and only screens and layouts may call useModel. layouts/ holds <Name>Layout.tsx files (layouts/AppLayout.tsx), the frames pages render inside: which pages need sign-in, the sidebar or top bar, and where the Toaster and CommandPalette go. A piece may draw a shape no primitive gives, with tokens for every value, <Text> for its words and primitives for anything clickable. App.ts wires the app together from tables, services, stores, models, routes and actions. hooks/ holds hooks (use<Name>.ts); lib/ holds non-UI helpers and data (.ts only); theme/ holds theme.ts (the tokens this app re-values) and icons.ts (the icons this app adds). Primitives (Screen, Stack, Text, Button, Menu, Icon) come from @trypattern/sdk/react and are not in this project. Styles live only at the bottom of the component file that owns them; there are no style files. To reuse a look, reuse the component. Move the file where it belongs.';
 export const SCRIPTS_WIRED_MESSAGE = 'A project script lives in a labelled folder under scripts/ (a folder named for what it does) and is used by something: package.json, the app launcher, vite.config.ts, flows/, or another script. Delete scripts nothing uses; never leave one-off scripts behind. Checks and tools every Pattern app needs belong in @trypattern/sdk, not here.';
 export const NO_COMMENTS_MESSAGE = 'Comments are not allowed in Pattern, including directives like @ts-expect-error or oxlint-disable: there are no escape hatches, fix the code. Express intent with names, types and structure; put lasting rationale in the error message of the rule that enforces it, or in the commit message.';
 export const NO_POINTER_CURSOR_MESSAGE = 'cursor: pointer is not allowed in Pattern. Pattern apps feel native, and native apps keep the default arrow over links and buttons. Remove it; the reset Pattern ships already sets cursor: default.';
@@ -24,7 +24,7 @@ export const CLASSES_NOT_FACTORIES_MESSAGE = 'A function that returns an object
 export const ACCESS_FLOWS_MESSAGE = "flows/Access.flow.ts runs Pattern's generated access flows, which prove every table's access rules against the seed on each app test. Keep it: `import { accessFlows } from '@trypattern/sdk/flows'` and `accessFlows({ App })`.";
 export const SCHEMA_TABLES_MESSAGE = "schema.ts defines every saved table in one place and says who may do what: `export const tables = defineTables({ issues: { columns: { title: z.string() }, access: { read: 'signedIn', create: 'signedIn', update: 'signedIn', delete: 'signedIn' }, writes: 'optimistic' } })`. It exports a row type for each table, named for one row (`export type Issue = Row<typeof tables.issues>`), and the emails of the people who run the app, `export const admins: string[] = []`, even when there are none yet, so the question is answered on purpose. Add the line shown.";
 export const NO_UNUSED_EXPORTS_MESSAGE = 'Export only what another file imports. Nothing imports this, so remove `export` (and the code itself if this file does not use it either). Unused exports hide dead code and make a file look like it offers more than it does. Pattern reads `tables` from schema.ts and `seed` from seed.ts, and vite.config.ts and server/worker.ts default-export their config, so those stay.';
-export const NO_RE_EXPORTS_MESSAGE = 'Do not pass imports through: a file exports only what it defines. Import the thing from where it lives instead (command from @trypattern/sdk, a component from its own file), so every import names the real source.';
+export const NO_RE_EXPORTS_MESSAGE = 'Do not pass imports through: a file exports only what it defines. Import the thing from where it lives instead (command from @trypattern/sdk, a component from its own file), so every import names the real source. server/worker.ts is the one exception: Cloudflare runs the Workflow and Durable Object classes its Worker exports, so it may export them from where they live.';
 export const EXPLICIT_ACCESS_MESSAGE = 'Mark every class member public or private (or protected, to override a base class member), so a reader sees at a glance what other code may call: `public setSort = command(...)`, `public override onPageOpen()`, `private loadIssues()`. Use the word private, never #name, so there is one way to say it. Constructors need neither.';
 export const IMPORT_FROM_ROOT_MESSAGE = 'Import project files by their path from the project root, the way errors and docs name them: `@/src/models/Issues.ts`, `@/schema.ts`. `./File.ts` is fine for a file in the same folder; never `../` or `./folder/File.ts`, so every import says exactly where the file is and moving a file never breaks the files beside it.';
 export const MODEL_MEMBERS_MESSAGE = 'A model shows the outside world three kinds of public member, so a reader can tell them apart at a glance: getters are its answers (public get hasNext()), command() fields are what it can do (public openNext = command(() => ...)), and onPageOpen() runs when its page opens. Everything else is private, and a private helper that works something out is a method (private neighbours()), never a getter, because Pattern publishes every getter to the screen and the snapshot. A model has no `actions`: menu entries and shortcuts live in src/actions/.';

package/dist/schema.d.ts

@@ -1,2 +1,4 @@
+export { call, defineServices } from './services.ts';
+export type { CallInput, CallReply, ServiceCall, ServiceMemory, Services } from './services.ts';
 export { defineTables } from './table.ts';
 export type { Access, Columns, Fields, Level, PublicRow, Row, Seed, Table, TableDefinition, TableOf, Tables, Value, Writes } from './table.ts';

package/dist/schema.js

@@ -1 +1,2 @@
+export { call, defineServices } from "./services.js";
 export { defineTables } from "./table.js";

package/dist/server/auth.js

@@ -3,6 +3,7 @@ import { deleteCookie, getCookie, setCookie } from 'hono/cookie';
 import { z } from 'zod';
 import { AUTH_URL, authServiceFor } from "./authService.js";
 import { forgetSession, readPass, startSession } from "./session.js";
+import { readTitle } from "./settings.js";
 import { deleteSession } from "./sessions.js";
 import { saveUser } from "./users.js";
 const GOOGLE_COOKIE = 'pattern_google';
@@ -28,7 +29,10 @@ function randomToken() {
         .replaceAll('=', '');
 }
 function safePath(path) {
-    return path !== undefined && path.startsWith('/') && !path.startsWith('//')
+    return path !== undefined &&
+        path.startsWith('/') &&
+        !path.startsWith('//') &&
+        !path.includes('\\')
         ? path
         : '/';
 }
@@ -91,9 +95,11 @@ export const auth = new Hono()
     const service = authServiceFor(c.env);
     if (service === undefined)
         return c.json({ error: NOT_SET_UP }, 503);
+    const appName = await readTitle(c.env.DB);
     const sent = await service.sendCode({
         email: parsed.data.email.toLowerCase(),
-        hostname: hostnameOf(c)
+        hostname: hostnameOf(c),
+        ...(appName === '' ? {} : { appName })
     });
     if (sent === undefined) {
         return c.json({ error: 'Couldn’t send a code to that address.' }, 429);

package/dist/server/createServer.d.ts

@@ -1,9 +1,11 @@
+import { Hono } from 'hono';
 import type { Tables } from '../table.ts';
-import type { ServerEnv } from './env.ts';
-export declare function createServer<Group extends Tables>({ tables, admins }: {
+import type { ServerBindings, ServerEnv } from './env.ts';
+export declare function createServer<Group extends Tables, Bindings extends ServerBindings = ServerBindings>({ tables, admins, routes }: {
     tables: Group;
     admins: readonly string[];
-}): import("hono/hono-base").HonoBase<ServerEnv, (({
+    routes?: Hono<ServerEnv<Bindings>>;
+}): import("hono/hono-base").HonoBase<ServerEnv, (((({
     "/api/health": {
         $get: {
             input: {};
@@ -105,6 +107,49 @@ export declare function createServer<Group extends Tables>({ tables, admins }: {
         };
     };
 }, "/api/auth">) & {
+    "/api/app": {
+        $get: {
+            input: {};
+            output: {
+                title: string;
+            };
+            outputFormat: "json";
+            status: import("hono/utils/http-status").ContentfulStatusCode;
+        };
+    };
+}) & {
+    "/api/app": {
+        $put: {
+            input: {};
+            output: {
+                error: string;
+            };
+            outputFormat: "json";
+            status: 401;
+        } | {
+            input: {};
+            output: {
+                error: string;
+            };
+            outputFormat: "json";
+            status: 403;
+        } | {
+            input: {};
+            output: {
+                error: string;
+            };
+            outputFormat: "json";
+            status: 400;
+        } | {
+            input: {};
+            output: {
+                title: string;
+            };
+            outputFormat: "json";
+            status: import("hono/utils/http-status").ContentfulStatusCode;
+        };
+    };
+}) & {
     "/api/me": {
         $get: {
             input: {};

package/dist/server/createServer.js

@@ -1,13 +1,16 @@
 import { Hono } from 'hono';
 import { csrf } from 'hono/csrf';
 import { adminEmails } from "../access.js";
+import { appTitle } from "../appTitle.js";
 import { auth, devSignIn } from "./auth.js";
 import { forgetSession, issuePass, needsRecheck, readPass, rememberUser } from "./session.js";
 import { renewSession } from "./sessions.js";
+import { readTitle, writeTitle } from "./settings.js";
 import { serveTables } from "./tables.js";
 import { findUser } from "./users.js";
 const PUBLIC_PATHS = ['/api/health', '/api/auth/'];
 const VIEWER_OPTIONAL_PATHS = ['/api/tables/'];
+const APP_PATH = '/api/app';
 function knowAdmins(admins) {
     const emails = adminEmails(admins);
     return (c, next) => {
@@ -18,7 +21,8 @@ function knowAdmins(admins) {
 async function attachViewer(c, next) {
     if (PUBLIC_PATHS.some((path) => c.req.path.startsWith(path)))
         return next();
-    const isOptional = VIEWER_OPTIONAL_PATHS.some((path) => c.req.path.startsWith(path));
+    const isOptional = c.req.path === APP_PATH ||
+        VIEWER_OPTIONAL_PATHS.some((path) => c.req.path.startsWith(path));
     let pass = await readPass(c);
     if (pass !== undefined && needsRecheck(pass)) {
         const user = await renewSession(c.env.DB, pass.sessionId);
@@ -38,15 +42,30 @@ async function attachViewer(c, next) {
     });
     return next();
 }
-export function createServer({ tables, admins }) {
+export function createServer({ tables, admins, routes }) {
     const authRoutes = import.meta.env.DEV ? auth.route('/', devSignIn) : auth;
-    return new Hono()
+    const server = new Hono()
         .basePath('/api')
         .use(csrf())
         .use(knowAdmins(admins))
         .use(attachViewer)
         .get('/health', (c) => c.json({ ok: true }))
         .route('/auth', authRoutes)
+        .get('/app', async (c) => c.json({ title: await readTitle(c.env.DB) }))
+        .put('/app', async (c) => {
+        const viewer = c.get('viewer');
+        if (viewer === null)
+            return c.json({ error: 'Signed out' }, 401);
+        if (!viewer.isAdmin)
+            return c.json({ error: 'forbidden' }, 403);
+        const body = await c.req.json().catch(() => undefined);
+        const title = appTitle.safeParse(Reflect.get(Object(body), 'title'));
+        if (!title.success) {
+            return c.json({ error: 'title must be 1 to 60 characters' }, 400);
+        }
+        await writeTitle(c.env.DB, title.data);
+        return c.json({ title: title.data });
+    })
         .get('/me', async (c) => {
         const viewer = c.get('viewer');
         const user = viewer === null ? undefined : await findUser(c.env.DB, viewer.userId);
@@ -57,6 +76,7 @@ export function createServer({ tables, admins }) {
         rememberUser(c, user);
         return c.json({ ...user, isAdmin: viewer?.isAdmin ?? false }, 200);
     })
-        .route('/tables', serveTables(tables))
-        .notFound((c) => c.json({ error: `No route for ${c.req.path}` }, 404));
+        .route('/tables', serveTables(tables));
+    const own = routes;
+    return (own === undefined ? server : server.route('/', own)).notFound((c) => c.json({ error: `No route for ${c.req.path}` }, 404));
 }

package/dist/server/env.d.ts

@@ -6,8 +6,8 @@ export type ServerBindings = {
     SESSION_SECRET: string;
     AUTH_SECRET?: string;
 };
-export type ServerEnv = {
-    Bindings: ServerBindings;
+export type ServerEnv<Bindings extends ServerBindings = ServerBindings> = {
+    Bindings: Bindings;
     Variables: {
         viewer: Viewer | null;
         admins: ReadonlySet<string>;

package/dist/server/index.d.ts

@@ -1,8 +1,13 @@
 export { createServer } from './createServer.ts';
 export type { ServerBindings, ServerEnv, Viewer } from './env.ts';
 export { seedSql, serveTables, sqlTable, sqlTables } from './tables.ts';
+export { refused } from '../services.ts';
+export { serveServices } from './services.ts';
+export type { ServiceHandlers } from './services.ts';
+export { sessionCookieFor } from './session.ts';
 export { sessions } from './sessions.ts';
+export { readTitle, seedTitleSql, settings, writeTitle } from './settings.ts';
 export { exchangeReply, exchangeRequest, sendCodeReply, sendCodeRequest, verifiedIdentity, verifyCodeReply, verifyCodeRequest } from './signInWire.ts';
 export type { VerifiedIdentity } from './signInWire.ts';
-export { users } from './users.ts';
+export { findUser, users } from './users.ts';
 export type { D1Database } from '@cloudflare/workers-types';

package/dist/server/index.js

@@ -1,5 +1,9 @@
 export { createServer } from "./createServer.js";
 export { seedSql, serveTables, sqlTable, sqlTables } from "./tables.js";
+export { refused } from "../services.js";
+export { serveServices } from "./services.js";
+export { sessionCookieFor } from "./session.js";
 export { sessions } from "./sessions.js";
+export { readTitle, seedTitleSql, settings, writeTitle } from "./settings.js";
 export { exchangeReply, exchangeRequest, sendCodeReply, sendCodeRequest, verifiedIdentity, verifyCodeReply, verifyCodeRequest } from "./signInWire.js";
-export { users } from "./users.js";
+export { findUser, users } from "./users.js";

package/dist/server/services.d.ts

@@ -0,0 +1,9 @@
+import type { Context, Env } from 'hono';
+import { Hono } from 'hono';
+import type { CallInput, CallReply, Services } from '../services.ts';
+export type ServiceHandlers<Group extends Services, E extends Env> = {
+    readonly [Name in keyof Group]: {
+        readonly [Call in keyof Group[Name]]: (c: Context<E>, input: CallInput<Group[Name][Call]>) => CallReply<Group[Name][Call]> | Promise<CallReply<Group[Name][Call]>>;
+    };
+};
+export declare function serveServices<Group extends Services, E extends Env>(services: Group, handlers: ServiceHandlers<Group, E>): Hono<E>;

package/dist/server/services.js

@@ -0,0 +1,47 @@
+import { Hono } from 'hono';
+import { z } from 'zod';
+import { ServiceRefused, paramNamesOf } from "../services.js";
+async function inputOf(c, call) {
+    const raw = call.method === 'get' ? c.req.query() : await c.req.json().catch(() => ({}));
+    return call.input.safeParse(raw);
+}
+const BUILT_IN_PATHS = ['/auth', '/health', '/tables', '/app', '/me'];
+function builtInPathOf(path) {
+    return BUILT_IN_PATHS.find((prefix) => path === prefix || path.startsWith(`${prefix}/`));
+}
+export function serveServices(services, handlers) {
+    for (const [group, calls] of Object.entries(services)) {
+        for (const [name, call] of Object.entries(calls)) {
+            const taken = builtInPathOf(call.path);
+            if (taken !== undefined) {
+                throw new Error(`${group}.${name} is served at ${call.path}, under Pattern's own ${taken}, where some calls are open to anyone signed out. Give it a path of its own.`);
+            }
+        }
+    }
+    const server = new Hono();
+    for (const [group, calls] of Object.entries(services)) {
+        for (const [name, call] of Object.entries(calls)) {
+            const handler = Reflect.get(Reflect.get(handlers, group), name);
+            server.on(call.method.toUpperCase(), call.path, async (c) => {
+                const parsed = await inputOf(c, call);
+                if (!parsed.success) {
+                    return c.json({ error: z.prettifyError(parsed.error) }, 400);
+                }
+                const params = Object.fromEntries(paramNamesOf(call.path).map((key) => [key, c.req.param(key) ?? '']));
+                try {
+                    const reply = await handler(c, {
+                        ...params,
+                        ...parsed.data
+                    });
+                    return c.json(call.reply.parse(reply));
+                }
+                catch (error) {
+                    if (!(error instanceof ServiceRefused))
+                        throw error;
+                    return c.json({ error: error.message }, error.status);
+                }
+            });
+        }
+    }
+    return server;
+}

package/dist/server/session.d.ts

@@ -17,6 +17,7 @@ export declare function issuePass(c: Context<ServerEnv>, user: StoredUser, sessi
     recheckAt: number;
 }>;
 export declare function startSession(c: Context<ServerEnv>, user: StoredUser): Promise<void>;
+export declare function sessionCookieFor(env: ServerEnv['Bindings'], user: StoredUser): Promise<string>;
 export declare function readPass(c: Context<ServerEnv>): Promise<{
     sessionId: string;
     userId: string;

package/dist/server/session.js

@@ -1,4 +1,5 @@
 import { deleteCookie, getSignedCookie, setCookie, setSignedCookie } from 'hono/cookie';
+import { serializeSigned } from 'hono/utils/cookie';
 import { z } from 'zod';
 import { USER_COOKIE } from "../auth/user.js";
 import { createSession } from "./sessions.js";
@@ -35,6 +36,16 @@ export async function issuePass(c, user, sessionId) {
 export async function startSession(c, user) {
     await issuePass(c, user, await createSession(c.env.DB, user.id));
 }
+export async function sessionCookieFor(env, user) {
+    const pass = {
+        sessionId: await createSession(env.DB, user.id),
+        userId: user.id,
+        email: user.email,
+        recheckAt: nowInSeconds() + RECHECK_SECONDS
+    };
+    const cookie = await serializeSigned(SESSION_COOKIE, JSON.stringify(pass), env.SESSION_SECRET);
+    return cookie.split(';')[0] ?? cookie;
+}
 export async function readPass(c) {
     const value = await getSignedCookie(c, c.env.SESSION_SECRET, SESSION_COOKIE);
     if (typeof value !== 'string')

package/dist/server/settings.d.ts

@@ -0,0 +1,49 @@
+import type { D1Database } from '@cloudflare/workers-types';
+export declare const settings: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
+    name: "settings";
+    schema: undefined;
+    columns: {
+        key: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "key";
+            tableName: "settings";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        value: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "value";
+            tableName: "settings";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+    };
+    dialect: "sqlite";
+}>;
+export declare function readTitle(d1: D1Database): Promise<string>;
+export declare function writeTitle(d1: D1Database, title: string): Promise<void>;
+export declare function seedTitleSql(title: string): string;

package/dist/server/settings.js

@@ -0,0 +1,25 @@
+import { eq } from 'drizzle-orm';
+import { drizzle } from 'drizzle-orm/d1';
+import { sqliteTable, text } from 'drizzle-orm/sqlite-core';
+export const settings = sqliteTable('settings', {
+    key: text('key').primaryKey(),
+    value: text('value').notNull()
+});
+const TITLE = 'title';
+export async function readTitle(d1) {
+    const row = await drizzle(d1)
+        .select({ value: settings.value })
+        .from(settings)
+        .where(eq(settings.key, TITLE))
+        .get();
+    return row?.value ?? '';
+}
+export async function writeTitle(d1, title) {
+    await drizzle(d1)
+        .insert(settings)
+        .values({ key: TITLE, value: title })
+        .onConflictDoUpdate({ target: settings.key, set: { value: title } });
+}
+export function seedTitleSql(title) {
+    return `INSERT OR IGNORE INTO settings (key, value) VALUES ('${TITLE}', '${title.replaceAll("'", "''")}');`;
+}

package/dist/server/signInWire.d.ts

@@ -27,6 +27,7 @@ export declare const exchangeReply: z.ZodObject<{
 export declare const sendCodeRequest: z.ZodObject<{
     email: z.ZodEmail;
     hostname: z.ZodString;
+    appName: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export declare const sendCodeReply: z.ZodObject<{
     challenge: z.ZodString;

package/dist/server/signInWire.js

@@ -12,7 +12,8 @@ export const exchangeReply = z.object({
 });
 export const sendCodeRequest = z.object({
     email: z.email(),
-    hostname: z.string()
+    hostname: z.string(),
+    appName: z.string().min(1).max(60).optional()
 });
 export const sendCodeReply = z.object({ challenge: z.string() });
 export const verifyCodeRequest = z.object({

package/dist/serviceClients.d.ts

@@ -0,0 +1,5 @@
+import type { Gate } from './gate.ts';
+import type { MemoryApiOptions } from './memoryApi.ts';
+import type { ServiceClient, ServiceMemory, Services } from './services.ts';
+export declare function httpServices<Group extends Services>(services: Group, gate: Gate, onSignedOut: () => void): ServiceClient<Group>;
+export declare function memoryServices<Group extends Services, World>(services: Group, memory: ServiceMemory<Group, World>, world: World, options: MemoryApiOptions): ServiceClient<Group>;

package/dist/serviceClients.js

@@ -0,0 +1,70 @@
+import { MemoryServer } from "./memoryApi.js";
+import { ServiceRefused, paramNamesOf } from "./services.js";
+function buildClient(services, make) {
+    return Object.fromEntries(Object.entries(services).map(([group, calls]) => [
+        group,
+        Object.fromEntries(Object.entries(calls).map(([name, call]) => [
+            name,
+            make(group, name, call)
+        ]))
+    ]));
+}
+function splitInput(call, input) {
+    const params = paramNamesOf(call.path);
+    const path = call.path.replaceAll(/:(\w+)/g, (_match, key) => encodeURIComponent(String(input[key] ?? '')));
+    const rest = Object.fromEntries(Object.entries(input).filter(([key]) => !params.includes(key)));
+    return { path, rest };
+}
+function errorOf(body, status) {
+    const error = typeof body === 'object' && body !== null
+        ? Reflect.get(body, 'error')
+        : undefined;
+    return typeof error === 'string' ? error : `HTTP ${status}`;
+}
+export function httpServices(services, gate, onSignedOut) {
+    return buildClient(services, (group, name, call) => (input = {}) => gate.pass(`${group}.${name}`, async () => {
+        const { path, rest } = splitInput(call, input);
+        const sent = call.input.parse(rest);
+        const query = call.method === 'get' && Object.keys(sent).length > 0
+            ? `?${new URLSearchParams(Object.entries(sent).map(([key, value]) => [
+                key,
+                String(value)
+            ])).toString()}`
+            : '';
+        const response = await fetch(`/api${path}${query}`, {
+            method: call.method.toUpperCase(),
+            ...(call.method === 'post'
+                ? {
+                    headers: { 'content-type': 'application/json' },
+                    body: JSON.stringify(sent)
+                }
+                : {})
+        });
+        const body = await response.json().catch(() => null);
+        if (response.status === 401)
+            onSignedOut();
+        if (!response.ok) {
+            throw new ServiceRefused(response.status, errorOf(body, response.status));
+        }
+        return call.reply.parse(body);
+    }));
+}
+export function memoryServices(services, memory, world, options) {
+    const servers = new Map();
+    return buildClient(services, (group, name, call) => (input = {}) => {
+        const server = servers.get(group) ?? new MemoryServer(group, options);
+        servers.set(group, server);
+        return server.reply(name, () => {
+            const handlers = Reflect.get(memory, group);
+            const handler = typeof handlers === 'object' && handlers !== null
+                ? Reflect.get(handlers, name)
+                : undefined;
+            if (typeof handler !== 'function') {
+                throw new Error(`The memory fake has no ${group}.${name}`);
+            }
+            const { rest } = splitInput(call, input);
+            const params = Object.fromEntries(paramNamesOf(call.path).map((key) => [key, String(input[key] ?? '')]));
+            return call.reply.parse(handler(world, { ...params, ...call.input.parse(rest) }));
+        });
+    });
+}