@trypattern/sdk 0.1.12 → 0.1.13

package/dist/rules/checkAllFiles.js

@@ -390,6 +390,14 @@ function isExported(node) {
     return (ts.canHaveModifiers(node) &&
         (ts.getModifiers(node) ?? []).some((modifier) => modifier.kind === ts.SyntaxKind.ExportKeyword));
 }
+function definesTables(node, source) {
+    if (ts.isCallExpression(node)) {
+        return node.expression.getText(source) === 'defineTables';
+    }
+    return (ts.isObjectLiteralExpression(node) &&
+        node.properties.some((property) => ts.isSpreadAssignment(property) &&
+            definesTables(property.expression, source)));
+}
 function schemaFindings() {
     if (!existsSync(SCHEMA_FILE))
         return [];
@@ -411,8 +419,7 @@ function schemaFindings() {
             node.declarationList.declarations.some((declaration) => ts.isIdentifier(declaration.name) &&
                 declaration.name.text === 'tables' &&
                 declaration.initializer !== undefined &&
-                ts.isCallExpression(declaration.initializer) &&
-                declaration.initializer.expression.getText(source) === 'defineTables')) {
+                definesTables(declaration.initializer, source))) {
             exportsTables = true;
         }
         if (ts.isCallExpression(node) &&
@@ -697,6 +704,11 @@ function themeScaleFindings() {
     }
     return findings;
 }
+function readsStarterRows(path, text, finding) {
+    return (finding.rule === 'import-from-root' &&
+        relative(ROOT, path) === 'seed.ts' &&
+        /^['"]\.\/starter\/rows\.ts['"]/.test(text.slice(finding.offset)));
+}
 const findingLines = [];
 const violatedRules = new Set();
 let scannedCount = 0;
@@ -707,6 +719,8 @@ for (const path of ownedFiles(ROOT)) {
         continue;
     scannedCount += 1;
     for (const finding of scanner(text)) {
+        if (readsStarterRows(path, text, finding))
+            continue;
         violatedRules.add(finding.rule);
         findingLines.push(`${relative(ROOT, path)}:${lineAndColumn(text, finding.offset)}: pattern(${finding.rule})`);
     }

package/dist/rules/lintPlugin.js

@@ -50,6 +50,7 @@ const PRIMITIVES = new Set([
     'Avatar',
     'Badge',
     'Button',
+    'Calendar',
     'Card',
     'Checkbox',
     'Choice',

package/dist/schema.d.ts

@@ -1,6 +1,8 @@
 export { call, defineServices } from './services.ts';
 export type { CallInput, CallReply, ServiceCall, ServiceMemory, Services } from './services.ts';
 export { media } from './media.ts';
-export type { Media, MediaImage } from './media.ts';
+export { bookingTables } from './bookings.ts';
+export type { BookingDay, BookingRequest, BookingRequestFields, BookingRules, BookingSlot, BookingStatus, BookingWindow } from './bookings.ts';
+export type { Media, MediaImage, Starter, StarterPhoto } from './media.ts';
 export { defineTables } from './table.ts';
 export type { Access, Columns, Fields, Level, PublicRow, Row, Seed, Table, TableDefinition, TableOf, Tables, Value, Writes } from './table.ts';

package/dist/schema.js

@@ -1,3 +1,4 @@
 export { call, defineServices } from "./services.js";
 export { media } from "./media.js";
+export { bookingTables } from "./bookings.js";
 export { defineTables } from "./table.js";

package/dist/server/bookings.d.ts

@@ -0,0 +1,12 @@
+import type { Context } from 'hono';
+import type { BookingRequest } from '../bookings.ts';
+import type { ServerBlock, ServerEnv } from './env.ts';
+export type BookingsOptions = {
+    timezone: string;
+};
+export type BookingEmail = {
+    kind: 'requested' | 'accepted' | 'declined';
+    request: BookingRequest;
+};
+export declare function sendBookingEmail(c: Context<ServerEnv>, email: BookingEmail): Promise<void>;
+export declare function bookings({ timezone }: BookingsOptions): ServerBlock;

package/dist/server/bookings.js

@@ -0,0 +1,142 @@
+import { FULL, RULES_ID, UNAVAILABLE, bookingBlackout, bookingRequests, bookingRules, bookingServices, bookingTables, daysOf, isValidTimezone, rulesOf, rulesProblem, slotFor, takenKey, windowsOn } from "../bookings.js";
+import { refused } from "../services.js";
+import { serveServices } from "./services.js";
+import { readRow, readRows } from "./tables.js";
+const HOLDING_SQL = "status IN ('requested', 'accepted')";
+export async function sendBookingEmail(c, email) {
+    if (!import.meta.env.DEV)
+        return;
+    const to = email.kind === 'requested' ? 'the owner' : email.request.email;
+    console.log(`Booking email (${email.kind}) to ${to} from ${new URL(c.req.url).host}: ${email.request.name}, ${email.request.date} ${email.request.window}`);
+}
+function requireAdmin(c) {
+    const viewer = c.get('viewer');
+    if (viewer === null)
+        throw refused(401, 'Signed out');
+    if (!viewer.isAdmin)
+        throw refused(403, 'forbidden');
+}
+async function readRules(d1) {
+    const [row, blackouts] = await Promise.all([
+        readRow(d1, bookingRules, RULES_ID),
+        readRows(d1, bookingTables.bookingBlackouts)
+    ]);
+    const parsedRow = row === undefined ? undefined : bookingRules.row.parse(row);
+    return rulesOf(parsedRow, blackouts
+        .map((blackout) => bookingBlackout.parse(blackout))
+        .toSorted((a, b) => a.date.localeCompare(b.date)));
+}
+async function takenBetween(d1, first, last) {
+    const { results } = await d1
+        .prepare(`SELECT date, "window" AS slot, COUNT(*) AS count FROM booking_requests WHERE date >= ?1 AND date <= ?2 AND ${HOLDING_SQL} GROUP BY date, "window"`)
+        .bind(first, last)
+        .all();
+    return new Map(results.map((row) => [takenKey(row.date, row.slot), Number(row.count)]));
+}
+async function availabilityFor(c, timezone, first, last) {
+    const [rules, taken] = await Promise.all([
+        readRules(c.env.DB),
+        takenBetween(c.env.DB, first, last)
+    ]);
+    return { rules, taken, now: new Date(), timezone };
+}
+async function readRequest(d1, id) {
+    const row = await readRow(d1, bookingRequests, id);
+    return row === undefined ? undefined : bookingRequests.row.parse(row);
+}
+async function decide(c, id, status) {
+    requireAdmin(c);
+    const from = status === 'accepted' ? ['requested'] : ['requested', 'accepted'];
+    const existing = await readRequest(c.env.DB, id);
+    if (existing === undefined)
+        throw refused(404, 'No such request');
+    if (!from.includes(existing.status)) {
+        throw refused(409, `This request is already ${existing.status}`);
+    }
+    const { meta } = await c.env.DB.prepare(`UPDATE booking_requests SET status = ?1 WHERE id = ?2 AND status IN (${from.map((item) => `'${item}'`).join(', ')})`)
+        .bind(status, id)
+        .run();
+    if (meta.changes === 0)
+        throw refused(409, 'This request just changed');
+    const decided = { ...existing, status };
+    await sendBookingEmail(c, { kind: status, request: decided });
+    return decided;
+}
+function monthRange(month) {
+    return { first: `${month}-01`, last: `${month}-31` };
+}
+export function bookings({ timezone }) {
+    if (!isValidTimezone(timezone)) {
+        throw new Error(`bookings({ timezone: '${timezone}' }) is not a time zone: use an IANA name such as 'America/Toronto'`);
+    }
+    const routes = serveServices(bookingServices, {
+        bookings: {
+            days: async (c, { month }) => {
+                const { first, last } = monthRange(month);
+                const facts = await availabilityFor(c, timezone, first, last);
+                return [...daysOf(month, facts)];
+            },
+            windows: async (c, { date }) => {
+                const facts = await availabilityFor(c, timezone, date, date);
+                return [...windowsOn(date, facts)];
+            },
+            request: async (c, fields) => {
+                const facts = await availabilityFor(c, timezone, fields.date, fields.date);
+                const slot = slotFor(fields.date, fields.window, facts);
+                if (slot === undefined)
+                    throw refused(400, UNAVAILABLE);
+                if (slot.remaining === 0)
+                    throw refused(409, FULL);
+                const id = crypto.randomUUID();
+                const status = facts.rules.autoAccept ? 'accepted' : 'requested';
+                const { meta } = await c.env.DB.prepare(`INSERT INTO booking_requests (id, offering, date, "window", name, email, phone, address, notes, status) SELECT ?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10 WHERE (SELECT COUNT(*) FROM booking_requests WHERE date = ?3 AND "window" = ?4 AND ${HOLDING_SQL}) < ?11`)
+                    .bind(id, fields.offering, fields.date, fields.window, fields.name, fields.email, fields.phone ?? '', fields.address ?? '', fields.notes ?? '', status, slot.capacity)
+                    .run();
+                if (meta.changes === 0)
+                    throw refused(409, FULL);
+                const saved = await readRequest(c.env.DB, id);
+                if (saved === undefined)
+                    throw new Error('The request was not saved');
+                await sendBookingEmail(c, {
+                    kind: status === 'accepted' ? 'accepted' : 'requested',
+                    request: saved
+                });
+                return saved;
+            },
+            requests: async (c) => {
+                requireAdmin(c);
+                const rows = await readRows(c.env.DB, bookingRequests);
+                return rows.map((row) => bookingRequests.row.parse(row));
+            },
+            accept: (c, { id }) => decide(c, id, 'accepted'),
+            decline: (c, { id }) => decide(c, id, 'declined'),
+            rules: async (c) => {
+                requireAdmin(c);
+                return readRules(c.env.DB);
+            },
+            saveRules: async (c, rules) => {
+                requireAdmin(c);
+                const problem = rulesProblem(rules);
+                if (problem !== undefined)
+                    throw refused(400, problem);
+                const d1 = c.env.DB;
+                await d1.batch([
+                    d1
+                        .prepare('INSERT INTO booking_rules (id, windows, lead_time_hours, days_ahead, auto_accept) VALUES (?1, ?2, ?3, ?4, ?5) ON CONFLICT (id) DO UPDATE SET windows = excluded.windows, lead_time_hours = excluded.lead_time_hours, days_ahead = excluded.days_ahead, auto_accept = excluded.auto_accept')
+                        .bind(RULES_ID, JSON.stringify(rules.windows), rules.leadTimeHours, rules.daysAhead, rules.autoAccept ? 1 : 0),
+                    d1.prepare('DELETE FROM booking_blackouts'),
+                    ...rules.blackouts.map((blackout) => d1
+                        .prepare('INSERT INTO booking_blackouts (id, date, reason) VALUES (?1, ?2, ?3)')
+                        .bind(`blackout-${blackout.date}`, blackout.date, blackout.reason))
+                ]);
+                return readRules(d1);
+            }
+        }
+    });
+    return {
+        name: 'bookings',
+        tables: bookingTables,
+        openPaths: ['/api/bookings/'],
+        routes
+    };
+}

package/dist/server/createServer.d.ts

@@ -1,12 +1,13 @@
 import { Hono } from 'hono';
 import type { Tables } from '../table.ts';
-import type { ServerBindings, ServerEnv } from './env.ts';
+import type { ServerBindings, ServerBlock, ServerEnv } from './env.ts';
 import type { Pages } from './pages.ts';
-export declare function createServer<Group extends Tables, Bindings extends ServerBindings = ServerBindings>({ tables, admins, routes, pages }: {
+export declare function createServer<Group extends Tables, Bindings extends ServerBindings = ServerBindings>({ tables, admins, routes, pages, blocks }: {
     tables: Group;
     admins: readonly string[];
     routes?: Hono<ServerEnv<Bindings>>;
     pages?: Pages;
+    blocks?: readonly ServerBlock[];
 }): import("hono/hono-base").HonoBase<ServerEnv, import("hono/types").BlankSchema | import("hono/types").MergeSchemaPath<(((({
     "/api/health": {
         $get: {

package/dist/server/createServer.js

@@ -2,6 +2,7 @@ import { Hono } from 'hono';
 import { csrf } from 'hono/csrf';
 import { adminEmails } from "../access.js";
 import { appTitle } from "../appTitle.js";
+import { blockWiringProblem } from "../blocks.js";
 import { media } from "../media.js";
 import { auth, devSignIn } from "./auth.js";
 import { serveDatabase } from "./database.js";
@@ -23,14 +24,17 @@ function knowAdmins(admins) {
         return next();
     };
 }
-async function attachViewer(c, next) {
+function attachViewer(optionalPaths) {
+    return (c, next) => viewerOf(c, next, [...VIEWER_OPTIONAL_PATHS, ...optionalPaths]);
+}
+async function viewerOf(c, next, optionalPaths) {
     const bearer = bearerOf(c);
     if (bearer !== undefined)
         return attachPatternViewer(c, next, bearer);
     if (PUBLIC_PATHS.some((path) => c.req.path.startsWith(path)))
         return next();
     const isOptional = c.req.path === APP_PATH ||
-        VIEWER_OPTIONAL_PATHS.some((path) => c.req.path.startsWith(path));
+        optionalPaths.some((path) => c.req.path.startsWith(path));
     let pass = await readPass(c);
     if (pass !== undefined && needsRecheck(pass)) {
         const user = await renewSession(c.env.DB, pass.sessionId);
@@ -50,14 +54,17 @@ async function attachViewer(c, next) {
     });
     return next();
 }
-export function createServer({ tables, admins, routes, pages }) {
+export function createServer({ tables, admins, routes, pages, blocks = [] }) {
+    const wiring = blockWiringProblem(tables, blocks, 'server');
+    if (wiring !== undefined)
+        throw new Error(wiring);
     const authRoutes = import.meta.env.DEV ? auth.route('/', devSignIn) : auth;
     const hasMedia = Object.values(tables).some((table) => table === media);
     const server = new Hono()
         .basePath('/api')
         .use(csrf())
         .use(knowAdmins(admins))
-        .use(attachViewer)
+        .use(attachViewer(blocks.flatMap((block) => block.openPaths)))
         .get('/health', (c) => c.json({ ok: true }))
         .route('/auth', authRoutes)
         .get('/app', async (c) => c.json({ title: await readTitle(c.env.DB) }))
@@ -89,6 +96,8 @@ export function createServer({ tables, admins, routes, pages }) {
         .route('/tables', serveTables(tables));
     if (hasMedia)
         server.post('/media', uploadMedia);
+    for (const block of blocks)
+        server.route('/', block.routes);
     const own = routes;
     const root = new Hono();
     if (hasMedia)

package/dist/server/env.d.ts

@@ -1,5 +1,7 @@
 import type { D1Database, Fetcher, R2Bucket } from '@cloudflare/workers-types';
+import type { Hono } from 'hono';
 import type { Viewer } from '../access.ts';
+import type { Tables } from '../table.ts';
 export type { Viewer };
 export type ServerBindings = {
     DB: D1Database;
@@ -15,3 +17,9 @@ export type ServerEnv<Bindings extends ServerBindings = ServerBindings> = {
         admins: ReadonlySet<string>;
     };
 };
+export type ServerBlock = {
+    readonly name: string;
+    readonly tables: Tables;
+    readonly openPaths: readonly string[];
+    readonly routes: Hono<ServerEnv>;
+};

package/dist/server/index.d.ts

@@ -1,5 +1,7 @@
 export { createServer } from './createServer.ts';
-export type { ServerBindings, ServerEnv, Viewer } from './env.ts';
+export type { ServerBindings, ServerBlock, ServerEnv, Viewer } from './env.ts';
+export { bookings } from './bookings.ts';
+export type { BookingsOptions } from './bookings.ts';
 export { seedSql, serveTables, sqlTable, sqlTables } from './tables.ts';
 export { refused } from '../services.ts';
 export { serveServices } from './services.ts';

package/dist/server/index.js

@@ -1,4 +1,5 @@
 export { createServer } from "./createServer.js";
+export { bookings } from "./bookings.js";
 export { seedSql, serveTables, sqlTable, sqlTables } from "./tables.js";
 export { refused } from "../services.js";
 export { serveServices } from "./services.js";

package/dist/server/media.d.ts

@@ -1,5 +1,18 @@
 import type { Context } from 'hono';
 import type { ServerEnv } from './env.ts';
+export declare const IMMUTABLE = "public, max-age=31536000, immutable";
+export type PhotoFacts = {
+    key: string;
+    type: string;
+    width: number;
+    height: number;
+    bytes: number;
+};
+export type PhotoProblem = {
+    problem: string;
+    status: 413 | 415;
+};
+export declare function photoFacts(buffer: ArrayBuffer): Promise<PhotoFacts | PhotoProblem>;
 export declare function uploadMedia(c: Context<ServerEnv>): Promise<(Response & import("hono").TypedResponse<{
     error: string;
 }, 401, "json">) | (Response & import("hono").TypedResponse<{
@@ -8,9 +21,9 @@ export declare function uploadMedia(c: Context<ServerEnv>): Promise<(Response &
     error: string;
 }, 503, "json">) | (Response & import("hono").TypedResponse<{
     error: string;
-}, 413, "json">) | (Response & import("hono").TypedResponse<{
-    error: string;
 }, 400, "json">) | (Response & import("hono").TypedResponse<{
     error: string;
-}, 415, "json">) | (Response & import("hono").TypedResponse<{}, 201, "json">)>;
+}, 413 | 415, "json">) | (Response & import("hono").TypedResponse<{}, 200, "json">) | (Response & import("hono").TypedResponse<{
+    error: string;
+}, 409, "json">) | (Response & import("hono").TypedResponse<{}, 201, "json">)>;
 export declare function serveMedia(c: Context<ServerEnv>): Promise<Response>;

package/dist/server/media.js

@@ -1,11 +1,13 @@
+import { eq } from 'drizzle-orm';
 import { drizzle } from 'drizzle-orm/d1';
 import { MEDIA_LIMIT_BYTES, media, mediaPath } from "../media.js";
 import { isHeic, readImageHeader } from "./imageHeader.js";
-import { sqlTable } from "./tables.js";
+import { column, sqlTable } from "./tables.js";
 const FORM_OVERHEAD_BYTES = 64 * 1024;
 const ALT_LIMIT = 500;
 const KEY = /^images\/[0-9a-f]{16}\.(?:jpg|png|webp|gif|avif)$/;
-const IMMUTABLE = 'public, max-age=31536000, immutable';
+const MEDIA_ID = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
+export const IMMUTABLE = 'public, max-age=31536000, immutable';
 const PLACEHOLDER = {
     width: 24,
     quality: 50,
@@ -18,6 +20,7 @@ const NO_ALT = 'Describe this photo for someone who can’t see it: alt is requi
 const TOO_LARGE = 'Photos can be up to 10 MB.';
 const HEIC = 'This is an iPhone HEIC photo, which browsers can’t show. Send it as a JPEG instead.';
 const UNKNOWN_TYPE = 'Photos must be JPEG, PNG, WebP, GIF or AVIF.';
+const BAD_ID = 'id must be 1 to 64 letters, numbers, hyphens or underscores.';
 const target = sqlTable(media);
 function hex(bytes) {
     return [...new Uint8Array(bytes)]
@@ -55,6 +58,25 @@ async function placeholderOf(c, key) {
         return null;
     }
 }
+export async function photoFacts(buffer) {
+    if (buffer.byteLength > MEDIA_LIMIT_BYTES) {
+        return { problem: TOO_LARGE, status: 413 };
+    }
+    const bytes = new Uint8Array(buffer);
+    if (isHeic(bytes))
+        return { problem: HEIC, status: 415 };
+    const header = readImageHeader(bytes);
+    if (header === undefined)
+        return { problem: UNKNOWN_TYPE, status: 415 };
+    const digest = await crypto.subtle.digest('SHA-256', buffer);
+    return {
+        key: `images/${hex(digest).slice(0, 16)}.${header.extension}`,
+        type: header.type,
+        width: header.width,
+        height: header.height,
+        bytes: bytes.byteLength
+    };
+}
 export async function uploadMedia(c) {
     const viewer = c.get('viewer');
     if (viewer === null)
@@ -71,6 +93,7 @@ export async function uploadMedia(c) {
     const form = await c.req.formData().catch(() => undefined);
     const file = form?.get('file');
     const alt = form?.get('alt');
+    const id = form?.get('id') ?? null;
     if (!(file instanceof File)) {
         return c.json({ error: 'Send the photo as the form field "file".' }, 400);
     }
@@ -80,31 +103,38 @@ export async function uploadMedia(c) {
     if (alt.trim().length > ALT_LIMIT) {
         return c.json({ error: `Keep alt to ${ALT_LIMIT} characters.` }, 400);
     }
+    if (id !== null && (typeof id !== 'string' || !MEDIA_ID.test(id))) {
+        return c.json({ error: BAD_ID }, 400);
+    }
     if (file.size > MEDIA_LIMIT_BYTES)
         return c.json({ error: TOO_LARGE }, 413);
     const buffer = await file.arrayBuffer();
-    const bytes = new Uint8Array(buffer);
-    if (isHeic(bytes))
-        return c.json({ error: HEIC }, 415);
-    const header = readImageHeader(bytes);
-    if (header === undefined)
-        return c.json({ error: UNKNOWN_TYPE }, 415);
-    const digest = await crypto.subtle.digest('SHA-256', buffer);
-    const key = `images/${hex(digest).slice(0, 16)}.${header.extension}`;
-    await bucket.put(key, buffer, {
-        httpMetadata: { contentType: header.type, cacheControl: IMMUTABLE }
+    const facts = await photoFacts(buffer);
+    if ('problem' in facts)
+        return c.json({ error: facts.problem }, facts.status);
+    const database = drizzle(c.env.DB);
+    if (id !== null) {
+        const existing = await database
+            .select()
+            .from(target)
+            .where(eq(column(target, 'id'), id))
+            .get();
+        if (existing !== undefined) {
+            return Reflect.get(existing, 'key') === facts.key
+                ? c.json(existing, 200)
+                : c.json({ error: `Another photo already has the id ${id}.` }, 409);
+        }
+    }
+    await bucket.put(facts.key, buffer, {
+        httpMetadata: { contentType: facts.type, cacheControl: IMMUTABLE }
     });
-    const row = await drizzle(c.env.DB)
+    const row = await database
         .insert(target)
         .values({
-        id: crypto.randomUUID(),
-        key,
-        width: header.width,
-        height: header.height,
-        placeholder: await placeholderOf(c, key),
-        alt: alt.trim(),
-        type: header.type,
-        bytes: bytes.byteLength
+        id: id ?? crypto.randomUUID(),
+        ...facts,
+        placeholder: await placeholderOf(c, facts.key),
+        alt: alt.trim()
     })
         .returning()
         .get();
@@ -113,6 +143,23 @@ export async function uploadMedia(c) {
 function unquoted(etag) {
     return etag.replace(/^W\//, '').replaceAll('"', '').trim();
 }
+async function fromLiveSite(key) {
+    const origin = import.meta.env['PATTERN_LIVE_ORIGIN'];
+    if (typeof origin !== 'string')
+        return undefined;
+    const response = await fetch(`${origin}${mediaPath(key)}`).catch(() => undefined);
+    if (response === undefined || !response.ok) {
+        await response?.body?.cancel();
+        return undefined;
+    }
+    return new Response(response.body, {
+        headers: {
+            'cache-control': IMMUTABLE,
+            'content-type': response.headers.get('content-type') ?? 'application/octet-stream',
+            'x-content-type-options': 'nosniff'
+        }
+    });
+}
 export async function serveMedia(c) {
     const key = decodeURIComponent(c.req.path.slice('/media/'.length));
     const bucket = c.env.MEDIA;
@@ -121,8 +168,10 @@ export async function serveMedia(c) {
     }
     const seen = c.req.header('if-none-match');
     const object = await bucket.get(key, seen === undefined ? {} : { onlyIf: { etagDoesNotMatch: unquoted(seen) } });
-    if (object === null)
-        return c.text('No such photo', 404);
+    if (object === null) {
+        const live = import.meta.env.DEV ? await fromLiveSite(key) : undefined;
+        return live ?? c.text('No such photo', 404);
+    }
     const headers = new Headers({
         'cache-control': IMMUTABLE,
         'content-type': object.httpMetadata?.contentType ?? 'application/octet-stream',

package/dist/server/patternViewer.js

@@ -1,25 +1,31 @@
-import { verifiedTablesAssertion } from "../patternAccess.js";
+import { MEDIA_WRITE, TABLES_READ, verifiedAssertion } from "../patternAccess.js";
 import { PATTERN_KEYS } from "./patternKeys.js";
 const BEARER = /^bearer\s+/i;
 const SCHEMA_PATH = '/api/schema';
 const TABLES_PATH = '/api/tables/';
+const MEDIA_PATH = '/api/media';
 export function bearerOf(c) {
     const header = c.req.header('authorization') ?? '';
     return BEARER.test(header) ? header.replace(BEARER, '').trim() : undefined;
 }
-function isReadByPattern(c) {
-    const { path } = c.req;
-    return (c.req.method === 'GET' &&
-        (path === SCHEMA_PATH || path.startsWith(TABLES_PATH)));
+function scopeOf(c) {
+    const { path, method } = c.req;
+    if (method === 'GET' &&
+        (path === SCHEMA_PATH || path.startsWith(TABLES_PATH))) {
+        return TABLES_READ;
+    }
+    return method === 'POST' && path === MEDIA_PATH ? MEDIA_WRITE : undefined;
 }
 export async function attachPatternViewer(c, next, token) {
-    const email = isReadByPattern(c)
-        ? await verifiedTablesAssertion(token, {
+    const scope = scopeOf(c);
+    const email = scope === undefined
+        ? undefined
+        : await verifiedAssertion(token, {
             hostname: new URL(c.req.url).hostname,
             keys: PATTERN_KEYS,
-            now: Math.floor(Date.now() / 1000)
-        })
-        : undefined;
+            now: Math.floor(Date.now() / 1000),
+            scope
+        });
     if (email === undefined)
         return c.json({ error: 'Signed out' }, 401);
     c.set('viewer', { userId: `pattern:${email}`, isAdmin: true });

package/dist/server/tables.d.ts

@@ -10,7 +10,9 @@ type SqlTable = SQLiteTableWithColumns<{
 }>;
 export declare function sqlTable(table: Table): SqlTable;
 export declare function sqlTables<Group extends Tables>(tables: Group): Record<keyof Group, SqlTable>;
+export declare function column(target: SqlTable, key: string): SqlTable["_"]["columns"][string];
 export declare function seedSql<Group extends Tables>(tables: Group, seed: Seed<Group>): string;
+export declare function starterSql<Group extends Tables>(tables: Group, rows: Seed<Group>): string;
 export declare function readRows(d1: D1Database, table: Table): Promise<readonly Record<string, unknown>[]>;
 export declare function readRow(d1: D1Database, table: Table, id: string): Promise<Record<string, unknown> | undefined>;
 export declare function serveTables<Group extends Tables>(tables: Group): import("hono/hono-base").HonoBase<ServerEnv, {

package/dist/server/tables.js

@@ -47,7 +47,7 @@ export function sqlTable(table) {
 export function sqlTables(tables) {
     return Object.fromEntries(Object.entries(tables).map(([key, table]) => [key, sqlTable(table)]));
 }
-function column(target, key) {
+export function column(target, key) {
     const found = Reflect.get(target, key);
     if (found === undefined)
         throw new Error(`No column ${key}`);
@@ -99,6 +99,22 @@ export function seedSql(tables, seed) {
     });
     return [...users, ...rowsSql].join('\n');
 }
+export function starterSql(tables, rows) {
+    return Object.values(tables)
+        .flatMap((table) => {
+        const listed = seededRows(rows, table.name);
+        if (listed.length === 0 || table.owned)
+            return [];
+        const keys = ['id', 'createdAt', ...Object.keys(table.columns)];
+        const values = listed
+            .map((row) => `(${keys.map((key) => sqlLiteral((row[key] ?? null))).join(', ')})`)
+            .join(',\n  ');
+        return [
+            `INSERT OR IGNORE INTO ${snakeCase(table.name)} (${keys.map(snakeCase).join(', ')}) VALUES\n  ${values};`
+        ];
+    })
+        .join('\n');
+}
 function selection(table, target) {
     return Object.fromEntries([
         'id',

package/dist/start.js

@@ -17,6 +17,8 @@ const TEST_SEED = 'patternSeed';
 const INLINE_DATA_ID = 'pattern-data';
 const TEST_ADMINS = 'patternAdmins';
 const TEST_WORLD = 'patternWorld';
+const TEST_TITLE = 'patternTitle';
+const TEST_SIGNED_IN_AS = 'patternSignedInAs';
 function testSeed() {
     const seed = Reflect.get(window, TEST_SEED);
     return typeof seed === 'object' && seed !== null ? seed : {};
@@ -27,6 +29,14 @@ function testAdmins() {
         ? admins.filter((email) => typeof email === 'string')
         : [];
 }
+function testTitle() {
+    const title = Reflect.get(window, TEST_TITLE);
+    return typeof title === 'string' ? title : '';
+}
+function testSignedInAs() {
+    const email = Reflect.get(window, TEST_SIGNED_IN_AS);
+    return typeof email === 'string' ? email : null;
+}
 function readInlineData() {
     const text = document.getElementById(INLINE_DATA_ID)?.textContent ?? '';
     if (text === '')
@@ -58,7 +68,9 @@ export function startApp(App, { theme = [], icons = {}, onInteraction } = {}) {
     const app = new App(router, {
         api: browserApi(tables, inMemory ? testSeed() : {}, gate, {
             inMemory,
+            signedInAs: inMemory ? testSignedInAs() : null,
             admins: inMemory ? testAdmins() : [],
+            title: inMemory ? testTitle() : '',
             ...(services === undefined ? {} : { services }),
             ...(memory === undefined ? {} : { memory }),
             world