akanjs 3.0.0-alpha.71 → 3.0.0-alpha.73

package/client/cookie.ts

@@ -1,7 +1,7 @@
 import { getEnv } from "akanjs/base";
 import { decodeJwtPayload, Logger } from "akanjs/common";
 import type { Account } from "akanjs/fetch";
-import { cookies as serverCookies, headers as serverHeaders } from "akanjs/fetch";
+import { parseCookieHeader, cookies as serverCookies, headers as serverHeaders } from "akanjs/fetch";
 import { loadCapacitorCore } from "./capacitor";
 import { storage } from "./storage";
 import { fetch } from "./useClient";
@@ -12,23 +12,6 @@ interface CookieOptions {
   secure?: boolean;
 }
 
-function parseCookieHeader(cookieHeader: string): Map<string, { name: string; value: string }> {
-  const entries = cookieHeader
-    .split(";")
-    .map((c) => c.trim())
-    .filter(Boolean)
-    .map((c) => {
-      const eqIdx = c.indexOf("=");
-      if (eqIdx === -1) return null;
-      const name = c.slice(0, eqIdx).trim();
-      const raw = c.slice(eqIdx + 1).trim();
-      const value = typeof raw === "string" && raw.startsWith("j:") ? (JSON.parse(raw.slice(2)) as string) : raw;
-      return [name, { name, value }] as const;
-    })
-    .filter((e): e is NonNullable<typeof e> => e !== null);
-  return new Map(entries);
-}
-
 export const cookies = (): Map<string, { name: string; value: string }> => {
   if (getEnv().side === "server") return serverCookies();
   return parseCookieHeader(document.cookie);
@@ -53,21 +36,18 @@ export const setCookie = (
     .catch(() => undefined);
 };
 
-export const getCookie = (key: string): string | undefined => {
-  if (getEnv().side === "server") return cookies().get(key)?.value;
-  else
-    return document.cookie
-      .split(";")
-      .find((c) => c.trim().startsWith(`${key}=`))
-      ?.split("=")[1];
-};
+/**
+ * Reads through `cookies()` on both sides, which is the only way the two agree: a hand-rolled
+ * `split("=")[1]` truncates a value at its first `=` (base64 padding) and never decodes the `j:` form the
+ * server branch does. Capacitor's own docs say to read `document.cookie`, and `cookies()` does.
+ */
+export const getCookie = (key: string): string | undefined => cookies().get(key)?.value;
 
 export const removeCookie = (key: string, options: { path: string } = { path: "/" }) => {
-  if (getEnv().side === "server") return cookies().delete(key);
-  else {
-    
-    document.cookie = `${key}=; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/;`;
-  }
+
+  if (getEnv().side === "server") return;
+  
+  document.cookie = `${key}=; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=${options.path};`;
 };
 export const headers = (): Map<string, string> => {
   if (getEnv().side !== "server") return new Map();
@@ -77,9 +57,15 @@ export const headers = (): Map<string, string> => {
 export const getHeader = (key: string): string | undefined => {
   return headers().get(key);
 };
-/** Decodes the current JWT into account data when it belongs to this app/environment. */
+/**
+ * Decodes the current JWT into account data when it belongs to this app/environment.
+ *
+ * The two credentials read here are exactly the two the server honours — the `jwt` cookie and
+ * `Authorization: Bearer` (`AccountMiddleware`). It used to fall back to a bare `jwt` *header*, which nothing
+ * sends and no guard accepts, so a request carrying one read as signed in here and anonymous at the endpoint.
+ */
 export const getAccount = <AddData = unknown>(): Account<AddData> => {
-  const jwt = getCookie("jwt") ?? getHeader("jwt");
+  const jwt = getCookie("jwt") ?? getHeader("authorization")?.replace(/^Bearer\s+/i, "");
   const defaultAccount = { appName: getEnv().appName, environment: getEnv().environment } as Account<AddData>;
   if (!jwt) return defaultAccount;
   const account = decodeJwtPayload<Account<AddData>>(jwt);
@@ -105,7 +91,8 @@ interface InitAuthOption {
 export const initAuth = ({ jwt }: InitAuthOption = {}) => {
   const token = jwt ?? cookies().get("jwt")?.value;
   if (token) setAuth({ jwt: token });
-  Logger.verbose(`JWT set from cookie: ${token}`);
+  
+  Logger.verbose(`JWT ${token ? "restored from cookie" : "not found in cookie"}`);
 };
 
 export const resetAuth = () => {

package/client/csrTypes.ts

@@ -262,18 +262,6 @@ export type PageState = CsrState & {
   topInset: number;
   bottomInset: number;
 };
-export const defaultPageState: PageState = {
-  transition: "none",
-  topSafeArea: 0,
-  bottomSafeArea: 0,
-  topInset: 0,
-  bottomInset: 0,
-  gesture: true,
-  cache: false,
-  ssr: "stream",
-  topSafeAreaColor: "var(--color-background, Canvas)",
-  bottomSafeAreaColor: "var(--color-background, Canvas)",
-};
 
 export interface Location {
   href: string;

package/client/frameConfig.ts

@@ -120,6 +120,19 @@ export function getExplicitPageConfigKeys(configChain: PageConfig[] = []): Parti
   return explicitKeys;
 }
 
+export const defaultPageState: PageState = {
+  transition: "none",
+  topSafeArea: 0,
+  bottomSafeArea: 0,
+  topInset: 0,
+  bottomInset: 0,
+  gesture: true,
+  cache: false,
+  ssr: "stream",
+  topSafeAreaColor: "var(--color-background, Canvas)",
+  bottomSafeAreaColor: "var(--color-background, Canvas)",
+};
+
 export function resolvePageState({
   configChain = [],
   path,

package/common/Logger.ts

@@ -81,17 +81,24 @@ const ansiPattern = new RegExp(`${String.fromCharCode(27)}\\[[0-?]*[ -/]*[@-~]`,
 
 const redactedAttrKey = /password|passwd|token|jwt|authorization|cookie|secret|api[-_]?key|private[-_]?key/i;
 
+/**
+ * `process.env?.X` guards only `env` being absent, never `process` itself — an undeclared `process` is a
+ * ReferenceError, and at module scope that takes the whole client bundle with it. This is the most widely
+ * imported file in `common/`, and the unguarded form works today only because the browser build ships a shim.
+ */
+const envValue = (key: string): string | undefined => (typeof process === "undefined" ? undefined : process.env?.[key]);
+
 /** Log-level aware logger used by Akan runtime, CLI, and application services. */
 export class Logger {
   /** `AKAN_LOG_STDOUT_LEVEL` names what the container's stdout carries; without it the console level is that. */
   static level: LogLevel = Logger.#levelFromEnv(
-    process.env?.AKAN_LOG_STDOUT_LEVEL,
-    Logger.#levelFromEnv(process.env?.AKAN_PUBLIC_LOG_LEVEL, "info"),
+    envValue("AKAN_LOG_STDOUT_LEVEL"),
+    Logger.#levelFromEnv(envValue("AKAN_PUBLIC_LOG_LEVEL"), "info"),
   );
-  static fileLevel: LogLevel = Logger.#levelFromEnv(process.env?.AKAN_LOG_FILE_LEVEL, "trace");
-  static format: LogFormat = Logger.#formatFromEnv(process.env?.AKAN_LOG_FORMAT);
+  static fileLevel: LogLevel = Logger.#levelFromEnv(envValue("AKAN_LOG_FILE_LEVEL"), "trace");
+  static format: LogFormat = Logger.#formatFromEnv(envValue("AKAN_LOG_FORMAT"));
   /** Which process this is (`gateway`, `all`, `batch`, `rsc-worker`); the owner sets it at boot. */
-  static role: string | null = process.env?.SERVER_MODE ?? null;
+  static role: string | null = envValue("SERVER_MODE") ?? null;
   /**
    * Whether this process writes its own lines to the terminal. Off in every server process of an ndjson
    * deployment: the hub owner writes the one JSON stream, and a text line from anyone would corrupt it.
@@ -388,7 +395,7 @@ export class Logger {
     else console[outputStream === "error" ? "error" : "log"](msg.trim());
   }
   static {
-    if (process.env?.AKAN_PUBLIC_LOG_LEVEL === "log" && typeof window === "undefined")
+    if (envValue("AKAN_PUBLIC_LOG_LEVEL") === "log" && typeof window === "undefined")
       Logger.warn("AKAN_PUBLIC_LOG_LEVEL=log is deprecated and now means info; set AKAN_PUBLIC_LOG_LEVEL=info.");
   }
 }

package/common/TrustedProxy.ts

@@ -0,0 +1,134 @@
+import { normalizeIpAddress } from "./clientAddress";
+
+/**
+ * Whether the hop that connected is allowed to name the caller.
+ *
+ * `x-real-ip` and `x-forwarded-for` are just request headers: anyone can send them. They are the truth only when
+ * the peer that sent them is a proxy we put there — otherwise a client forges its own address and walks past
+ * every `.with(Ip)` guard, rate limit and audit line at once.
+ *
+ * The default trusts a private, loopback or link-local peer and nothing else, because that is exactly the shape
+ * of a proxy on the same network: an ingress, a service mesh, the dev machine. A gateway reachable from the
+ * internet sees a public peer, so a header from there is dropped rather than believed. `AKAN_TRUSTED_PROXIES`
+ * takes a comma-separated CIDR list for the case the proxy is not private — and `*` for "the deployment
+ * guarantees nothing untrusted can reach this port", which is the old behaviour, written down.
+ */
+export class TrustedProxy {
+  static #cidrs: { bytes: Uint8Array; bits: number }[] | null = null;
+  static #trustAll: boolean | null = null;
+
+  static configure(list: string | null | undefined) {
+    TrustedProxy.#trustAll = list?.trim() === "*";
+    TrustedProxy.#cidrs = (list ?? "")
+      .split(",")
+      .map((entry) => entry.trim())
+      .filter((entry) => entry && entry !== "*")
+      .flatMap((entry) => {
+        const parsed = TrustedProxy.#parseCidr(entry);
+        return parsed ? [parsed] : [];
+      });
+  }
+
+  static reset() {
+    TrustedProxy.#cidrs = null;
+    TrustedProxy.#trustAll = null;
+  }
+
+  static #load() {
+    if (TrustedProxy.#cidrs === null) TrustedProxy.configure(process.env.AKAN_TRUSTED_PROXIES);
+  }
+
+  static isTrusted(address: string | null | undefined): boolean {
+    if (!address) return false;
+    TrustedProxy.#load();
+    if (TrustedProxy.#trustAll) return true;
+    const bytes = TrustedProxy.#toBytes(normalizeIpAddress(address));
+    if (!bytes) return false;
+    if (TrustedProxy.#isLocalRange(bytes)) return true;
+    return (TrustedProxy.#cidrs ?? []).some((cidr) => TrustedProxy.#inRange(bytes, cidr));
+  }
+
+  /**
+   * The caller's address as recorded by a proxy, but only when the peer is one. Falls back to the peer itself,
+   * which is the right answer for a process nothing is proxying, and `null` when there is no peer either.
+   */
+  static clientAddress(headers: Headers, peerAddress: string | null | undefined): string | null {
+    if (TrustedProxy.isTrusted(peerAddress)) {
+      const realIp = headers.get("x-real-ip")?.trim();
+      if (realIp) return normalizeIpAddress(realIp);
+      const forwarded = headers.get("x-forwarded-for")?.split(",")[0]?.trim();
+      if (forwarded) return normalizeIpAddress(forwarded);
+    }
+    return peerAddress ? normalizeIpAddress(peerAddress) : null;
+  }
+
+  /** `10/8`, `172.16/12`, `192.168/16`, `127/8`, `169.254/16`, and their IPv6 counterparts `::1`, `fc00::/7`, `fe80::/10`. */
+  static #isLocalRange(bytes: Uint8Array): boolean {
+    if (bytes.length === 4) {
+      const [a = 0, b = 0] = bytes;
+      if (a === 10 || a === 127) return true;
+      if (a === 192 && b === 168) return true;
+      if (a === 172 && b >= 16 && b <= 31) return true;
+      return a === 169 && b === 254;
+    }
+    const [first = 0, second = 0] = bytes;
+    if ((first & 0xfe) === 0xfc) return true;
+    if (first === 0xfe && (second & 0xc0) === 0x80) return true;
+    return bytes.every((byte, idx) => (idx === 15 ? byte === 1 : byte === 0));
+  }
+
+  static #parseCidr(entry: string): { bytes: Uint8Array; bits: number } | null {
+    const [address, prefix] = entry.split("/");
+    const bytes = TrustedProxy.#toBytes(address ?? "");
+    if (!bytes) return null;
+    const bits = prefix === undefined ? bytes.length * 8 : Number(prefix);
+    if (!Number.isInteger(bits) || bits < 0 || bits > bytes.length * 8) return null;
+    return { bytes, bits };
+  }
+
+  static #inRange(bytes: Uint8Array, cidr: { bytes: Uint8Array; bits: number }): boolean {
+    if (bytes.length !== cidr.bytes.length) return false;
+    const wholeBytes = cidr.bits >> 3;
+    for (let idx = 0; idx < wholeBytes; idx += 1) if (bytes[idx] !== cidr.bytes[idx]) return false;
+    const restBits = cidr.bits & 7;
+    if (!restBits) return true;
+    const mask = 0xff << (8 - restBits);
+    return ((bytes[wholeBytes] ?? 0) & mask) === ((cidr.bytes[wholeBytes] ?? 0) & mask);
+  }
+
+  static #toBytes(address: string): Uint8Array | null {
+    if (address.includes(".") && !address.includes(":")) {
+      const parts = address.split(".");
+      if (parts.length !== 4) return null;
+      const bytes = new Uint8Array(4);
+      for (const [idx, part] of parts.entries()) {
+        const value = Number(part);
+        if (!/^\d{1,3}$/.test(part) || value > 255) return null;
+        bytes[idx] = value;
+      }
+      return bytes;
+    }
+    return address.includes(":") ? TrustedProxy.#ipv6ToBytes(address) : null;
+  }
+
+  static #ipv6ToBytes(address: string): Uint8Array | null {
+
+    const bare = address.split("%")[0] ?? "";
+    const halves = bare.split("::");
+    if (halves.length > 2) return null;
+    const groupsOf = (text: string) => (text ? text.split(":").filter((group) => group !== "") : []);
+    const head = groupsOf(halves[0] ?? "");
+    const tail = halves.length === 2 ? groupsOf(halves[1] ?? "") : [];
+    const filled = halves.length === 2 ? 8 - head.length - tail.length : 0;
+    if (filled < 0 || head.length + tail.length + filled !== 8) return null;
+    const groups = [...head, ...new Array(filled).fill("0"), ...tail];
+    const bytes = new Uint8Array(16);
+    for (const [idx, group] of groups.entries()) {
+      if (!/^[0-9a-f]{1,4}$/i.test(group)) return null;
+      const value = Number.parseInt(group, 16);
+      bytes[idx * 2] = value >> 8;
+      bytes[idx * 2 + 1] = value & 0xff;
+    }
+    return bytes;
+  }
+}

package/common/clamp.ts

@@ -0,0 +1,2 @@
+/** Constrains a value to `[min, max]`. */
+export const clamp = (value: number, min: number, max: number) => Math.min(Math.max(value, min), max);

package/common/dynamicRecord.ts

@@ -0,0 +1,12 @@
+/**
+ * A generated surface read by a name computed at runtime.
+ *
+ * The framework's glue layers dispatch by name: a store action reaches `fetch[key]`, a resolver reaches
+ * `service[method]`, a `Load.*` component reads `init[names.pageOfModel]`. None of those keys exist in a type,
+ * because the type is generated from the model — so every one of them used to be spelled `as any`, which the
+ * guide bans and which also silences the *value* type on the way out.
+ *
+ * This says the same thing about the index and nothing about the value: `as DynamicRecord` to index, then the
+ * read carries its own `as T`. One alias so a reader can tell name-based dispatch from an untyped object.
+ */
+export type DynamicRecord<Value = unknown> = { [key: string]: Value };

package/common/index.ts

@@ -1,5 +1,6 @@
 export { applyMixins } from "./applyMixins";
 export { capitalize } from "./capitalize";
+export { clamp } from "./clamp";
 export {
   clientAddressFromHeaders,
   clientPortFromHeaders,
@@ -7,6 +8,7 @@ export {
   normalizeIpAddress,
 } from "./clientAddress";
 export { deepObjectify } from "./deepObjectify";
+export type { DynamicRecord } from "./dynamicRecord";
 export {
   type FileUploadCapability,
   fileUploadContract,
@@ -16,7 +18,6 @@ export { formatNumber } from "./formatNumber";
 export { formatPhone } from "./formatPhone";
 export { getAllPropertyDescriptors } from "./getAllPropertyDescriptors";
 export { type AkanHmrPhase, getAkanHmrPhase, isAkanHmrApplying } from "./hmrPhase";
-export { HttpClient } from "./httpClient";
 export { isDayjs } from "./isDayjs";
 export { isEmail } from "./isEmail";
 export { isPhoneNumber } from "./isPhoneNumber";
@@ -72,6 +73,8 @@ export { pathSet } from "./pathSet";
 export { plainFieldsOf } from "./plainFieldsOf";
 export { randomPick } from "./randomPick";
 export { randomPicks } from "./randomPicks";
+export { isJsonContentType, originFromRequest } from "./requestOrigin";
+export { RestClient, type RestClientOptions, type RestRequestOptions } from "./restClient";
 export {
   assertUniqueRoutePatterns,
   compareRouteSpecificity,
@@ -99,6 +102,7 @@ export {
 export { sleep } from "./sleep";
 export { splitVersion } from "./splitVersion";
 export { getBasePathFromPathname, parseBasePaths, parseSubRouteHosts, resolveSubRouteHosts } from "./subRoute";
+export { TrustedProxy } from "./TrustedProxy";
 export type * from "./types";
 export {
   type WebsocketAuthAckData,

package/common/isValidDate.ts

@@ -10,5 +10,5 @@ export const isValidDate = (d: string | Date | Dayjs) => {
   if (typeof d === "string") {
     return dayjs(d, format).isValid();
   } else if (isDayjs(d)) return d.isValid();
-  else return d instanceof Date && !isNaN(d.getTime());
+  else return d instanceof Date && !Number.isNaN(d.getTime());
 };

package/common/requestOrigin.ts

@@ -0,0 +1,32 @@
+/**
+ * The origin a caller actually saw, and whether a body claims to be JSON. Both read only headers and a URL, so
+ * they answer the same way for the cache layer, the CSRF gate, and anything else that has to compare origins.
+ */
+export const originFromRequest = (headers: Headers, url: URL): string => {
+  
+  const forwardedProto = headers.get("x-forwarded-proto")?.split(",")[0]?.trim();
+  const forwardedHost = headers.get("x-forwarded-host")?.split(",")[0]?.trim();
+  const host = forwardedHost ?? headers.get("host")?.split(",")[0]?.trim();
+  const proto = forwardedProto ?? url.protocol.slice(0, -1);
+  if (host && proto) {
+    try {
+      return new URL(`${proto}://${host}`).origin;
+    } catch {
+    }
+  }
+  return url.origin;
+};
+
+/**
+ * Whether a request body may be read as JSON.
+ *
+ * `Request.json()` parses whatever bytes it holds regardless of this header, and the three content types a
+ * cross-site form can send — `text/plain`, `application/x-www-form-urlencoded`, `multipart/form-data` — are
+ * exactly the ones a browser sends with **no preflight**. Requiring the JSON type is therefore what puts a
+ * preflight in front of every mutation that carries a body.
+ */
+export const isJsonContentType = (contentType: string | null): boolean => {
+  if (!contentType) return false;
+  const essence = contentType.split(";")[0]?.trim().toLowerCase() ?? "";
+  return essence === "application/json" || essence.endsWith("+json");
+};

package/common/{httpClient.ts → restClient.ts}

@@ -1,39 +1,46 @@
-export interface HttpClientOptions {
+/**
+ * A plain REST client for a service that is not an Akan API: base url, headers, timeout, JSON in and out.
+ *
+ * Not `akanjs/fetch`'s `HttpClient`, which builds an Akan endpoint's path from its serialized args and restores
+ * an `Err` from the response. Two classes of the same name in one package meant an app importing both barrels
+ * got a collision, so this one is named for what it is.
+ */
+export interface RestClientOptions {
   baseUrl?: string;
   headers?: HeadersInit;
   timeout?: number;
 }
 
-export interface HttpRequestOptions extends Omit<RequestInit, "body" | "headers" | "method"> {
+export interface RestRequestOptions extends Omit<RequestInit, "body" | "headers" | "method"> {
   headers?: HeadersInit;
   timeout?: number;
 }
 
-export class HttpClient {
+export class RestClient {
   readonly baseUrl: string;
   readonly headers: Headers;
   readonly timeout: number | undefined;
 
-  constructor(options: string | HttpClientOptions = {}) {
+  constructor(options: string | RestClientOptions = {}) {
     const normalized = typeof options === "string" ? { baseUrl: options } : options;
     this.baseUrl = normalized.baseUrl?.replace(/\/+$/, "") ?? "";
     this.headers = new Headers(normalized.headers);
     this.timeout = normalized.timeout;
   }
 
-  async get<Returns>(url: string, options?: HttpRequestOptions): Promise<Returns> {
+  async get<Returns>(url: string, options?: RestRequestOptions): Promise<Returns> {
     return await this.#request<Returns>("GET", url, undefined, options);
   }
 
-  async post<Returns>(url: string, data?: unknown, options?: HttpRequestOptions): Promise<Returns> {
+  async post<Returns>(url: string, data?: unknown, options?: RestRequestOptions): Promise<Returns> {
     return await this.#request<Returns>("POST", url, data, options);
   }
 
-  async put<Returns>(url: string, data?: unknown, options?: HttpRequestOptions): Promise<Returns> {
+  async put<Returns>(url: string, data?: unknown, options?: RestRequestOptions): Promise<Returns> {
     return await this.#request<Returns>("PUT", url, data, options);
   }
 
-  async delete<Returns>(url: string, options?: HttpRequestOptions): Promise<Returns> {
+  async delete<Returns>(url: string, options?: RestRequestOptions): Promise<Returns> {
     return await this.#request<Returns>("DELETE", url, undefined, options);
   }
 
@@ -41,7 +48,7 @@ export class HttpClient {
     method: string,
     url: string,
     data?: unknown,
-    options: HttpRequestOptions = {},
+    options: RestRequestOptions = {},
   ): Promise<Returns> {
     const { body, headers } = this.#makeBody(data);
     const timeout = options.timeout ?? this.timeout;

package/constant/types.ts

@@ -104,6 +104,28 @@ export interface ProtoPatch {
 }
 
 export const DEFAULT_PAGE_SIZE = 20;
+/**
+ * The most rows one list request may take, whatever it asks for.
+ *
+ * A page size arrives from the client, so without a ceiling anyone who may read one page may read the whole
+ * table in a single request — and `LIMIT 0` or `LIMIT -1` reaches SQLite as "no limit at all", so the two ways
+ * of asking for nothing were the two ways of asking for everything. `resolvePageLimit` is the one place that
+ * decides; a caller wanting more pages asks for more pages.
+ */
+export const MAX_PAGE_SIZE = 500;
+
+/** Clamps a caller-supplied page size into `[1, MAX_PAGE_SIZE]`, falling back to `DEFAULT_PAGE_SIZE`. */
+export const resolvePageLimit = (limit: unknown, fallback: number = DEFAULT_PAGE_SIZE): number => {
+  const asked = Math.trunc(Number(limit));
+  if (!Number.isFinite(asked) || asked <= 0) return Math.min(fallback, MAX_PAGE_SIZE);
+  return Math.min(asked, MAX_PAGE_SIZE);
+};
+
+/** Clamps an offset to a non-negative integer; a negative `OFFSET` is silently read as zero by the database. */
+export const resolvePageSkip = (skip: unknown): number => {
+  const asked = Math.trunc(Number(skip));
+  return Number.isFinite(asked) && asked > 0 ? asked : 0;
+};
 export type NonFunctionalKeys<T> = {
   [K in keyof T]: T[K] extends (...args: never[]) => unknown ? never : K;
 }[keyof T];

package/dictionary/base.dictionary.ts

@@ -54,6 +54,10 @@ export const baseDictionary = serviceDictionary(["en", "ko"])
     tryReconnecting: ["Try reconnecting to the server", "서버에 다시 연결중입니다."],
     serverHasProblem: ["Maybe your server is having a problem.", "서버에 문제가 있을 수 있습니다."],
     checkServerStatus: ["Please check your server status.", "서버 상태를 확인해주세요."],
+    cameraPromptHeader: ["Choose a photo", "사진을 선택해주세요"],
+    cameraPromptPhoto: ["Choose from library", "앨범에서 선택하기"],
+    cameraPromptPicture: ["Take a photo", "사진 찍기"],
+    cameraPromptCancel: ["Cancel", "취소"],
     success: ["Success", "성공"],
     failed: ["Failed", "실패"],
     processing: ["Processing...", "처리중..."],

package/dictionary/trans.ts

@@ -67,12 +67,31 @@ export type ErrConstructor<ErrorKey extends string> = {
   Conflict: new (key: ErrorKey, data?: TranslationData, option?: ErrRestoreOption) => ErrInstance;
 };
 
+/**
+ * The toast API, before anything has claimed it.
+ *
+ * `<Messages/>` assigns the real implementations onto this object when it mounts, so a call before that — a
+ * store action on the first frame — has nowhere to go. It stays a no-op rather than throwing (a dropped toast
+ * must not take the render with it) and says so once, because a message that silently never appeared is
+ * otherwise indistinguishable from one the user missed. Server code reaches this object too, through
+ * `akanjs/dictionary`, and there nothing ever assigns over it.
+ */
+const unclaimed = (level: string) => () => {
+  if (unclaimed.warned) return null;
+  unclaimed.warned = true;
+  console.warn(
+    `msg.${level}() was called before <Messages/> mounted, so nothing was shown. Mount it in a layout, or move the call into an event handler.`,
+  );
+  return null;
+};
+unclaimed.warned = false;
+
 export const msg = {
-  info: () => null,
-  success: () => null,
-  error: () => null,
-  warning: () => null,
-  loading: () => null,
+  info: unclaimed("info"),
+  success: unclaimed("success"),
+  error: unclaimed("error"),
+  warning: unclaimed("warning"),
+  loading: unclaimed("loading"),
 } as {
   info: (key: TransMessage<Record<string, unknown>>, option?: TransMessageOption) => void;
   success: (key: TransMessage<Record<string, unknown>>, option?: TransMessageOption) => void;

package/document/dataLoader.ts

@@ -1,9 +1,5 @@
 import type { QueryOf } from "akanjs/constant";
 
-export const Id = String;
-export const ObjectId = String;
-export const Mixed = Object;
-
 type LoaderItem = Record<string, unknown>;
 type LoaderModel = {
   find: (query: QueryOf<unknown>) => Promise<LoaderItem[]> | { then: Promise<LoaderItem[]>["then"] };

package/document/filterMeta.ts

@@ -176,8 +176,8 @@ export type BaseFilterQueryKey = "any";
 export type BaseFilterKey = BaseFilterSortKey | BaseFilterQueryKey;
 
 export type FilterInstance<
-  Query extends { [key: string]: FilterInfo } = {},
-  Sort extends { [key: string]: unknown } = {},
+  Query extends { [key: string]: FilterInfo } = Record<never, never>,
+  Sort extends { [key: string]: unknown } = Record<never, never>,
 > = {
   query: Query;
   sort: Sort;

package/document/loaderInfo.ts

@@ -4,7 +4,10 @@ import type { Loader, SchemaOf } from ".";
 
 type LoaderType = "field" | "arrayField" | "query";
 
-export type ModelCls<Statics = {}, LoaderMap extends { [key: string]: LoaderInfo } = {}> = Cls<
+export type ModelCls<
+  Statics = Record<never, never>,
+  LoaderMap extends { [key: string]: LoaderInfo } = Record<never, never>,
+> = Cls<
   Statics & ExtractLoaderInfoObject<LoaderMap>,
   {
     [LOADER_META]: LoaderMap;