kempo-inventory 0.2.0

package/server/utils/mediaSafety.js

@@ -0,0 +1,51 @@
+/*
+  What an import will accept as a photo or file from a zip. Pure, so it can be tested without a server.
+
+  A name that ends in .png says nothing about what the bytes are, and a zip comes from whoever made it,
+  so a file is only accepted when BOTH hold: its extension is one of the photo, video, audio and PDF
+  types the media libraries take, and the first bytes of the file really are that type. A web page,
+  script or program renamed to .png (or any extension not listed) is refused.
+*/
+const SIGNATURES = {
+  png: bytes => startsWith(bytes, [0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A]),
+  jpg: bytes => startsWith(bytes, [0xFF, 0xD8, 0xFF]),
+  gif: bytes => startsWith(bytes, [0x47, 0x49, 0x46, 0x38]),
+  webp: bytes => ascii(bytes, 0, 4) === 'RIFF' && ascii(bytes, 8, 12) === 'WEBP',
+  bmp: bytes => ascii(bytes, 0, 2) === 'BM',
+  avif: bytes => ascii(bytes, 4, 8) === 'ftyp',
+  mp4: bytes => ascii(bytes, 4, 8) === 'ftyp',
+  mov: bytes => ascii(bytes, 4, 8) === 'ftyp' || ascii(bytes, 4, 8) === 'moov' || ascii(bytes, 4, 8) === 'wide',
+  m4a: bytes => ascii(bytes, 4, 8) === 'ftyp',
+  webm: bytes => startsWith(bytes, [0x1A, 0x45, 0xDF, 0xA3]),
+  mp3: bytes => ascii(bytes, 0, 3) === 'ID3' || (bytes[0] === 0xFF && (bytes[1] & 0xE0) === 0xE0),
+  wav: bytes => ascii(bytes, 0, 4) === 'RIFF' && ascii(bytes, 8, 12) === 'WAVE',
+  ogg: bytes => ascii(bytes, 0, 4) === 'OggS',
+  pdf: bytes => ascii(bytes, 0, 5) === '%PDF-',
+};
+const ALIASES = { jpeg: 'jpg' };
+
+const ascii = (bytes, from, to) => String.fromCharCode(...bytes.subarray(from, to));
+const startsWith = (bytes, signature) => signature.every((byte, i) => bytes[i] === byte);
+
+export const ALLOWED_EXTENSIONS = Object.keys(SIGNATURES).concat(Object.keys(ALIASES));
+
+export const extensionOf = name => {
+  const match = /\.([A-Za-z0-9]+)$/.exec(String(name ?? ''));
+  return match ? match[1].toLowerCase() : '';
+};
+
+/* Returns null when the file is acceptable, otherwise a short reason it is not. */
+export const refuseMedia = (name, bytes) => {
+  const extension = ALIASES[extensionOf(name)] ?? extensionOf(name);
+  const check = SIGNATURES[extension];
+  if(!check) return 'not a photo, video, audio or PDF file';
+  if(!bytes?.length) return 'empty';
+  if(!check(bytes)) return `its content is not a real .${extension} file`;
+  return null;
+};
+
+/* A name safe to hand to a file library: no path, no odd characters, a sensible length. */
+export const safeFileName = (name, fallback = 'file') => {
+  const base = String(name ?? '').split(/[\\/]/).pop().replace(/[^A-Za-z0-9._ ()-]+/g, '_').replace(/^[.\s]+/, '').slice(0, 100);
+  return base || fallback;
+};

package/server/utils/ownership.js

@@ -0,0 +1,44 @@
+import { tidyCategory } from './categoryLogic.js';
+
+/*
+  Who may change what. `owner` is '' for things people manage in the admin, or the name of the
+  extension that created it, and `actor` is whoever is making the change in the same terms: the
+  HTTP layer never names an actor ('' = a person), only an extension calling the server SDK can.
+
+  Ownership never changes what stock does: anyone with the permission can still adjust an owned
+  item's quantity. It protects what the owner builds on:
+
+    items       sku, name, category and deletion belong to the owner
+    categories  renaming (which rewrites every item's category) and deletion belong to the owner
+    fields      see fields.js
+
+  Everything else (description, tags, images, custom field values) stays editable by anyone, so an
+  extension's items still show up and can be tidied in the admin. An extension that needs to guard
+  more than this subscribes to the before_* hooks.
+*/
+export const LOCKED_ITEM_PROPERTIES = ['sku', 'name', 'category'];
+
+export const ownerLabel = owner => owner ? `the "${owner}" extension` : 'people using the admin';
+
+/* The locked properties `changes` would actually change. Sending the current value back is not a change. */
+export const lockedItemChanges = (existing, changes, actor = '') => existing.owner === actor ? [] : LOCKED_ITEM_PROPERTIES.filter(property => {
+  const value = changes[property];
+  if(value === undefined) return false;
+  return (property === 'category' ? tidyCategory(value) : String(value).trim()) !== existing[property];
+});
+
+export const notYours = (what, existing, actor = '') => ({
+  code: 403,
+  msg: `This ${what} is managed by ${ownerLabel(existing.owner)}${actor ? `, not "${actor}"` : ''}`,
+});
+
+/*
+  Whether `actor` may rename or delete a record `owner` owns, and may merge into one.
+*/
+export const mayManage = (record, actor = '') => !record || record.owner === actor;
+
+/*
+  Renaming a category rewrites the category on its items and moves its fields, so it must not
+  pull the rug from an extension that owns any of them. `holders` are the owners found there.
+*/
+export const blockingOwner = (holders, actor = '') => holders.find(owner => owner && owner !== actor) ?? null;

package/server/utils/rank.js

@@ -0,0 +1,31 @@
+const MAX = 20;
+
+/*
+  Ranks values for a typed prefix: ones that start with it first, then the most used, then
+  alphabetically. Values that differ only in case ("vallejo", "Vallejo") are one suggestion, shown
+  the way it is most often written. Pure, so it can be tested without a database.
+*/
+export const rankSuggestions = (rows, term = '', limit = 8) => {
+  const needle = term.trim().toLowerCase();
+  const merged = new Map();
+  for(const { value, uses } of rows){
+    const key = value.toLowerCase();
+    const entry = merged.get(key) ?? { total: 0, spellings: new Map() };
+    entry.total += uses;
+    entry.spellings.set(value, (entry.spellings.get(value) ?? 0) + uses);
+    merged.set(key, entry);
+  }
+
+  return [...merged.entries()]
+    .map(([key, entry]) => ({
+      key,
+      value: [...entry.spellings.entries()].sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0]))[0][0],
+      uses: entry.total,
+    }))
+    .sort((a, b) =>
+      Number(b.key.startsWith(needle)) - Number(a.key.startsWith(needle))
+      || b.uses - a.uses
+      || a.value.localeCompare(b.value))
+    .slice(0, Math.min(Math.max(limit, 1), MAX))
+    .map(({ value, uses }) => ({ value, uses }));
+};

package/server/utils/ratio.js

@@ -0,0 +1,31 @@
+/*
+  Aspect ratios for images, kept pure so they can be unit tested. A ratio is written "width:height"
+  ("4:3", "16:9", "1:1"); "4/3" and a plain number such as "1.5" are accepted too.
+*/
+export const DEFAULT_RATIOS = { category: '4:3', item: '4:3' };
+
+const LIMIT = 10; // 10:1 either way; anything wilder is almost certainly a typo
+
+/* Returns the ratio as CSS (`aspect-ratio`), e.g. "4 / 3", or null when it is not a usable ratio. */
+export const parseRatio = value => {
+  const text = String(value ?? '').trim();
+  let width;
+  let height;
+  const pair = text.match(/^(\d+(?:\.\d+)?)\s*[:/xX]\s*(\d+(?:\.\d+)?)$/);
+  if(pair){
+    width = Number(pair[1]);
+    height = Number(pair[2]);
+  } else if(/^\d+(?:\.\d+)?$/.test(text)){
+    width = Number(text);
+    height = 1;
+  } else {
+    return null;
+  }
+  if(!(width > 0) || !(height > 0)) return null;
+  const ratio = width / height;
+  if(ratio > LIMIT || ratio < 1 / LIMIT) return null;
+  return `${width} / ${height}`;
+};
+
+/* A usable ratio from the setting, or the default for `kind` when it is blank or invalid. */
+export const resolveRatio = (value, kind) => parseRatio(value) ?? parseRatio(DEFAULT_RATIOS[kind]);

package/server/utils/suggestions.js

@@ -0,0 +1,36 @@
+import db from 'kempo/server/db/index.js';
+import { sql } from 'drizzle-orm';
+import { kempoInventoryItem } from '../db/schema.js';
+import { getField, itemsInScope } from './fields.js';
+import { rankSuggestions } from './rank.js';
+
+export { rankSuggestions };
+
+/*
+  The values already used for a text field, matching what has been typed. An empty `q` gives the
+  most used values overall, which is what a field wants to offer the moment it is focused.
+*/
+export const getSuggestions = async (key, { q = '', limit = 8, category = '' } = {}) => {
+  const [lookupError, field] = await getField(key, category);
+  if(lookupError) return [lookupError, null];
+  if(field.type !== 'text') return [{ code: 400, msg: 'Only text fields can suggest values' }, null];
+
+  const term = String(q ?? '').trim();
+  /* LIKE treats % and _ as wildcards, so a typed one has to be escaped to mean itself. */
+  const pattern = `%${term.replace(/[\\%_]/g, '\\$&')}%`;
+
+  try {
+    const rows = await db.execute(sql`
+      SELECT btrim(${kempoInventoryItem.data}->>${key}) AS value, count(*)::int AS uses
+      FROM ${kempoInventoryItem}
+      WHERE ${itemsInScope(field.category)}
+        AND btrim(${kempoInventoryItem.data}->>${key}) IS NOT NULL
+        AND btrim(${kempoInventoryItem.data}->>${key}) <> ''
+        ${term ? sql`AND btrim(${kempoInventoryItem.data}->>${key}) ILIKE ${pattern}` : sql``}
+      GROUP BY 1
+      LIMIT 500`);
+    return [null, rankSuggestions([...rows], term, limit)];
+  } catch {
+    return [{ code: 500, msg: 'Failed to retrieve suggestions' }, null];
+  }
+};

package/server/utils/tagList.js

@@ -0,0 +1,25 @@
+import db from 'kempo/server/db/index.js';
+import { sql } from 'drizzle-orm';
+import { kempoInventoryItem, kempoInventoryCategory } from '../db/schema.js';
+
+/*
+  Every tag in use on items and categories, with how many items and categories carry it, most used
+  first: [{ tag, count }]. `q` narrows it to tags containing that text (for suggestions as you type).
+*/
+export const getTags = async ({ q = '', limit = 100 } = {}) => {
+  const term = String(q ?? '').trim().toLowerCase();
+  const pattern = `%${term.replace(/[\\%_]/g, '\\$&')}%`;
+  try {
+    const rows = await db.execute(sql`
+      SELECT tag, count(*)::int AS count FROM (
+        SELECT jsonb_array_elements_text(${kempoInventoryItem.tags}) AS tag FROM ${kempoInventoryItem}
+        UNION ALL
+        SELECT jsonb_array_elements_text(${kempoInventoryCategory.tags}) AS tag FROM ${kempoInventoryCategory}
+      ) t
+      ${term ? sql`WHERE tag LIKE ${pattern}` : sql``}
+      GROUP BY tag ORDER BY count DESC, tag LIMIT ${limit}`);
+    return [null, [...rows].map(r => ({ tag: r.tag, count: r.count }))];
+  } catch {
+    return [{ code: 500, msg: 'Failed to retrieve tags' }, null];
+  }
+};

package/server/utils/tags.js

@@ -0,0 +1,47 @@
+/*
+  Tags: short labels on items and categories ("acrylic", "red", "water-based") that search finds.
+  Pure helpers with no database access, so they can be unit tested.
+
+  A tag is stored lower case with its spacing tidied, so "Water-Based" and " water-based " are one tag.
+*/
+export const MAX_TAG = 40;
+export const MAX_TAGS = 30;
+
+export const tidyTag = tag => String(tag ?? '').trim().replace(/\s+/g, ' ').toLowerCase();
+
+/*
+  Accepts a list, or text separated by commas or new lines ("acrylic, red"), and returns
+  [error, tags] with the tags tidied, de-duplicated and in the order given.
+*/
+export const normalizeTags = input => {
+  if(input === undefined || input === null || input === '') return [null, []];
+  const list = Array.isArray(input) ? input : typeof input === 'string' ? input.split(/[,\n]/) : null;
+  if(!list) return [{ code: 400, msg: 'Tags must be a list' }, null];
+  const tags = [];
+  for(const raw of list){
+    if(typeof raw !== 'string') return [{ code: 400, msg: 'Each tag must be text' }, null];
+    const tag = tidyTag(raw);
+    if(!tag) continue;
+    if(tag.length > MAX_TAG) return [{ code: 400, msg: `A tag must be ${MAX_TAG} characters or fewer` }, null];
+    if(!tags.includes(tag)) tags.push(tag);
+  }
+  if(tags.length > MAX_TAGS) return [{ code: 400, msg: `At most ${MAX_TAGS} tags are allowed` }, null];
+  return [null, tags];
+};
+
+/* A `tag` query parameter: one tag, a repeated parameter, or a JSON list ('["a","b"]'), as a list. */
+export const parseTagParam = value => {
+  if(Array.isArray(value)) return value.map(tidyTag).filter(Boolean);
+  if(typeof value !== 'string' || !value.trim()) return [];
+  if(value.trim().startsWith('[')){
+    try { return parseTagParam(JSON.parse(value)); } catch { /* not JSON: treat it as a tag */ }
+  }
+  return [tidyTag(value)].filter(Boolean);
+};
+
+/* The distinct tags across several lists with how many lists each is in, most used first. */
+export const countTags = lists => {
+  const counts = new Map();
+  for(const list of lists) for(const tag of new Set(list ?? [])) counts.set(tag, (counts.get(tag) ?? 0) + 1);
+  return [...counts.entries()].map(([tag, count]) => ({ tag, count })).sort((a, b) => b.count - a.count || a.tag.localeCompare(b.tag));
+};

package/server/utils/zip.js

@@ -0,0 +1,88 @@
+/*
+  A minimal ZIP writer for exports: every entry is stored, not compressed. Photos and the other media
+  an export carries are already compressed, and the JSON is small, so compressing would cost time for
+  almost no saving, and "stored" keeps this to a few lines with no dependency. Any unzip tool opens the
+  result, and public/components/zip.js reads it (and zips made by other tools) back in the browser.
+
+  Entry names are written as UTF-8 (flag bit 11). Sizes are limited to 4 GB per file and in total, which
+  is far beyond an inventory.
+*/
+
+const TABLE = (() => {
+  const table = new Uint32Array(256);
+  for(let n = 0; n < 256; n++){
+    let c = n;
+    for(let k = 0; k < 8; k++) c = c & 1 ? 0xEDB88320 ^ (c >>> 1) : c >>> 1;
+    table[n] = c >>> 0;
+  }
+  return table;
+})();
+
+export const crc32 = bytes => {
+  let crc = 0xFFFFFFFF;
+  for(let i = 0; i < bytes.length; i++) crc = TABLE[(crc ^ bytes[i]) & 0xFF] ^ (crc >>> 8);
+  return (crc ^ 0xFFFFFFFF) >>> 0;
+};
+
+/* DOS date and time, as ZIP stores them. */
+const dosTime = date => ({
+  time: (date.getHours() << 11) | (date.getMinutes() << 5) | (date.getSeconds() >> 1),
+  date: ((Math.max(1980, date.getFullYear()) - 1980) << 9) | ((date.getMonth() + 1) << 5) | date.getDate(),
+});
+
+/*
+  Builds a ZIP file from entries: [{ name: 'dir/file.txt', data: Buffer | Uint8Array }]. Returns a Buffer.
+*/
+export const buildZip = (entries, now = new Date()) => {
+  const stamp = dosTime(now);
+  const locals = [];
+  const centrals = [];
+  let offset = 0;
+
+  for(const entry of entries){
+    const name = Buffer.from(entry.name, 'utf8');
+    const data = Buffer.from(entry.data);
+    const crc = crc32(data);
+
+    const local = Buffer.alloc(30);
+    local.writeUInt32LE(0x04034b50, 0);
+    local.writeUInt16LE(20, 4);            // version needed
+    local.writeUInt16LE(0x0800, 6);        // UTF-8 names
+    local.writeUInt16LE(0, 8);             // stored
+    local.writeUInt16LE(stamp.time, 10);
+    local.writeUInt16LE(stamp.date, 12);
+    local.writeUInt32LE(crc, 14);
+    local.writeUInt32LE(data.length, 18);
+    local.writeUInt32LE(data.length, 22);
+    local.writeUInt16LE(name.length, 26);
+    local.writeUInt16LE(0, 28);
+
+    const central = Buffer.alloc(46);
+    central.writeUInt32LE(0x02014b50, 0);
+    central.writeUInt16LE(20, 4);          // version made by
+    central.writeUInt16LE(20, 6);          // version needed
+    central.writeUInt16LE(0x0800, 8);
+    central.writeUInt16LE(0, 10);
+    central.writeUInt16LE(stamp.time, 12);
+    central.writeUInt16LE(stamp.date, 14);
+    central.writeUInt32LE(crc, 16);
+    central.writeUInt32LE(data.length, 20);
+    central.writeUInt32LE(data.length, 24);
+    central.writeUInt16LE(name.length, 28);
+    central.writeUInt32LE(offset, 42);
+
+    locals.push(local, name, data);
+    centrals.push(central, name);
+    offset += local.length + name.length + data.length;
+  }
+
+  const centralSize = centrals.reduce((sum, part) => sum + part.length, 0);
+  const end = Buffer.alloc(22);
+  end.writeUInt32LE(0x06054b50, 0);
+  end.writeUInt16LE(entries.length, 8);
+  end.writeUInt16LE(entries.length, 10);
+  end.writeUInt32LE(centralSize, 12);
+  end.writeUInt32LE(offset, 16);
+
+  return Buffer.concat([...locals, ...centrals, end]);
+};

package/server/utils/zipRead.js

@@ -0,0 +1,99 @@
+/*
+  Reads a ZIP file on the server, for importing an inventory export that has its media with it. Only the
+  import routes use it, and only after the caller has been checked against the top-tier permission. No dependencies: entries stored as they are, and entries compressed with deflate (what
+  Windows, macOS and most tools produce when they re-zip a folder) are inflated with the built-in
+  DecompressionStream.
+
+    const zip = await readZip(await file.arrayBuffer());
+    zip.names                              // ['inventory.json', 'media/1-photo.jpg', ...]
+    await zip.read('inventory.json')       // Uint8Array, or null when there is no such entry
+    await zip.text('inventory.json')       // the same, decoded as UTF-8
+
+  Entries are only ever read into memory, looked up by the exact name asked for; nothing is written to disk
+  and an entry's name is never used as a path. A deflated entry may inflate to at most `maxEntryBytes`
+  (200 MB by default). Not supported: encrypted zips, zip64 and multi-disk archives. An unsupported zip throws an Error with
+  a message fit to show a person.
+*/
+
+/*
+  Inflates a deflated entry, giving up if it grows past `limit` bytes: a zip bomb is a tiny entry that
+  inflates to gigabytes, and nothing in the zip's own headers can be trusted to say how big it is.
+*/
+const inflateRaw = async (bytes, limit) => {
+  const reader = new Blob([bytes]).stream().pipeThrough(new DecompressionStream('deflate-raw')).getReader();
+  const chunks = [];
+  let total = 0;
+  for(;;){
+    const { done, value } = await reader.read();
+    if(done) break;
+    total += value.length;
+    if(total > limit){
+      await reader.cancel();
+      throw new Error('A file in this zip is too large to read safely.');
+    }
+    chunks.push(value);
+  }
+  const out = new Uint8Array(total);
+  let at = 0;
+  for(const chunk of chunks){ out.set(chunk, at); at += chunk.length; }
+  return out;
+};
+
+export const MAX_ENTRY_BYTES = 200 * 1024 * 1024;
+
+export const MAX_ENTRIES = 20000;
+
+export const readZip = async (buffer, { maxEntryBytes = MAX_ENTRY_BYTES, maxEntries = MAX_ENTRIES } = {}) => {
+  const bytes = buffer instanceof Uint8Array ? buffer : new Uint8Array(buffer);
+  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+
+  /* The end-of-central-directory record is somewhere in the last 64 KB. */
+  let end = -1;
+  for(let i = bytes.length - 22; i >= Math.max(0, bytes.length - 22 - 65535); i--){
+    if(view.getUint32(i, true) === 0x06054b50){ end = i; break; }
+  }
+  if(end < 0) throw new Error('This is not a zip file.');
+  const count = view.getUint16(end + 10, true);
+  let pointer = view.getUint32(end + 16, true);
+  if(count === 0xFFFF || pointer === 0xFFFFFFFF) throw new Error('Zip64 archives are not supported.');
+  if(count > maxEntries) throw new Error(`This zip has more than ${maxEntries} files.`);
+
+  const decoder = new TextDecoder('utf-8');
+  const entries = new Map();
+  for(let n = 0; n < count; n++){
+    if(view.getUint32(pointer, true) !== 0x02014b50) throw new Error('The zip file is damaged.');
+    const flags = view.getUint16(pointer + 8, true);
+    const method = view.getUint16(pointer + 10, true);
+    const compressedSize = view.getUint32(pointer + 20, true);
+    const nameLength = view.getUint16(pointer + 28, true);
+    const extraLength = view.getUint16(pointer + 30, true);
+    const commentLength = view.getUint16(pointer + 32, true);
+    const localOffset = view.getUint32(pointer + 42, true);
+    const name = decoder.decode(bytes.subarray(pointer + 46, pointer + 46 + nameLength));
+    if(flags & 1) throw new Error('Encrypted zip files are not supported.');
+    if(!name.endsWith('/')) entries.set(name, { method, compressedSize, localOffset });
+    pointer += 46 + nameLength + extraLength + commentLength;
+  }
+
+  const read = async name => {
+    const entry = entries.get(name);
+    if(!entry) return null;
+    const at = entry.localOffset;
+    if(view.getUint32(at, true) !== 0x04034b50) throw new Error('The zip file is damaged.');
+    const start = at + 30 + view.getUint16(at + 26, true) + view.getUint16(at + 28, true);
+    const raw = bytes.subarray(start, start + entry.compressedSize);
+    if(entry.method === 0) return raw;
+    if(entry.method === 8) return inflateRaw(raw, maxEntryBytes);
+    throw new Error(`"${name}" uses a compression method this reader does not support.`);
+  };
+
+  return {
+    names: [...entries.keys()],
+    has: name => entries.has(name),
+    read,
+    text: async name => {
+      const data = await read(name);
+      return data ? decoder.decode(data) : null;
+    },
+  };
+};

package/update.js

@@ -0,0 +1,126 @@
+import { sql } from 'drizzle-orm';
+import db from 'kempo/server/db/index.js';
+import { getSetting, setSetting } from 'kempo/server/sdk.js';
+
+/*
+  kempo creates tables that are new in an update but never alters ones that already exist, so a
+  column added to an existing table has to be added here. Every statement is idempotent, so running
+  this on a database that already has the change is harmless.
+*/
+export default async () => {
+  // 0.15: items and categories can be owned by an extension ('' = managed by people, as before)
+  await db.execute(sql`ALTER TABLE "kempoInventoryItem" ADD COLUMN IF NOT EXISTS "owner" text NOT NULL DEFAULT ''`);
+  await db.execute(sql`ALTER TABLE "kempoInventoryCategory" ADD COLUMN IF NOT EXISTS "owner" text NOT NULL DEFAULT ''`);
+  await db.execute(sql`CREATE INDEX IF NOT EXISTS "kempoInventoryItemOwnerIdx" ON "kempoInventoryItem" ("owner")`);
+
+  // 0.14: text is stored without leading or trailing spaces. Trim what is already stored: custom field values that are text, plus names and descriptions.
+  const edge = "'^[[:space:]' || chr(160) || ']+|[[:space:]' || chr(160) || ']+$'";
+  await db.execute(sql.raw(`
+    UPDATE "kempoInventoryItem" SET "data" = (
+      SELECT COALESCE(jsonb_object_agg(e.key, CASE WHEN jsonb_typeof(e.value) = 'string' THEN to_jsonb(regexp_replace(e.value #>> '{}', ${edge}, '', 'g')) ELSE e.value END), '{}'::jsonb)
+      FROM jsonb_each("data") e)
+    WHERE EXISTS (SELECT 1 FROM jsonb_each("data") e WHERE jsonb_typeof(e.value) = 'string' AND (e.value #>> '{}') ~ (${edge}))`));
+  for(const column of ['name', 'description']){
+    await db.execute(sql.raw(`UPDATE "kempoInventoryItem" SET "${column}" = regexp_replace("${column}", ${edge}, '', 'g') WHERE "${column}" ~ (${edge})`));
+  }
+
+  // 0.13: tags are lower case. Lower-case every tag already stored, tidy its spacing, drop duplicates the change creates, keep the order.
+  for(const table of ['kempoInventoryItem', 'kempoInventoryCategory']){
+    await db.execute(sql.raw(`
+      UPDATE "${table}" SET "tags" = COALESCE((
+        SELECT jsonb_agg(t ORDER BY first) FROM (
+          SELECT lower(regexp_replace(btrim(x), '[[:space:]]+', ' ', 'g')) AS t, min(ord) AS first
+          FROM jsonb_array_elements_text("tags") WITH ORDINALITY AS a(x, ord)
+          WHERE btrim(x) <> '' GROUP BY 1
+        ) s
+      ), '[]'::jsonb)
+      WHERE "tags"::text <> lower("tags"::text)`));
+  }
+
+  // 0.12: the import size limit. Added only when missing.
+  const [, importMax] = await getSetting('kempo-inventory', 'import_max_mb', null);
+  if(importMax === null) await setSetting('kempo-inventory', 'import_max_mb', 250, 'number', false, 'The largest import file (a .json or .zip made by Export) the admin Import accepts, in MB.');
+
+  // 0.11: photo fields can force a shape and a maximum size
+  await db.execute(sql`ALTER TABLE "kempoInventoryField" ADD COLUMN IF NOT EXISTS "imageRatio" text NOT NULL DEFAULT ''`);
+  await db.execute(sql`ALTER TABLE "kempoInventoryField" ADD COLUMN IF NOT EXISTS "imageMax" integer NOT NULL DEFAULT 0`);
+
+  // 0.10: tags on items and categories
+  await db.execute(sql`ALTER TABLE "kempoInventoryItem" ADD COLUMN IF NOT EXISTS "tags" jsonb NOT NULL DEFAULT '[]'::jsonb`);
+  await db.execute(sql`ALTER TABLE "kempoInventoryCategory" ADD COLUMN IF NOT EXISTS "tags" jsonb NOT NULL DEFAULT '[]'::jsonb`);
+
+  // 0.9: optional public (signed-out) browsing. Added only when missing, and off.
+  const [, publicRead] = await getSetting('kempo-inventory', 'public_read', null);
+  if(publicRead === null) await setSetting('kempo-inventory', 'public_read', false, 'boolean', false, 'Let anyone, signed in or not, browse the inventory (items, categories, photos). They never see stock counts. Off by default: reading otherwise needs the items:read permission.');
+
+  // 0.8: photos are public by default, so read-only users can see them. Added only when missing.
+  const [, publicSetting] = await getSetting('kempo-inventory', 'public_photos', null);
+  if(publicSetting === null) await setSetting('kempo-inventory', 'public_photos', true, 'boolean', false, 'Photos uploaded to kempo-files are viewable by anyone with the link, so every person who can read the inventory sees them (kempo-files otherwise needs each of them to have its files:download permission). Turn off to keep photos behind that permission.');
+  const [, makePublic] = await getSetting('kempo-inventory', 'public_photos', true);
+  if(makePublic !== false && makePublic !== 'false'){
+    /* Photos already uploaded: every kempo-files file an item or category uses, and its thumbnails. */
+    const [{ files, thumbs }] = [...await db.execute(sql`SELECT to_regclass('"kempoFile"') AS files, to_regclass('"kempoThumbnail"') AS thumbs`)];
+    if(files){
+      await db.execute(sql`
+        UPDATE "kempoFile" SET "public" = true
+        WHERE "public" = false AND "id" IN (
+          SELECT substr(v, 7) FROM "kempoInventoryItem" i,
+            LATERAL jsonb_each(i."data") e(k, val),
+            LATERAL jsonb_array_elements_text(CASE WHEN jsonb_typeof(val) = 'array' THEN val ELSE '[]'::jsonb END) v
+          WHERE v LIKE 'files:%'
+          UNION SELECT substr("image", 7) FROM "kempoInventoryCategory" WHERE "image" LIKE 'files:%')`);
+      if(thumbs){
+        await db.execute(sql`
+          UPDATE "kempoFile" SET "public" = true
+          WHERE "public" = false AND "id" IN (
+            SELECT t."fileId" FROM "kempoThumbnail" t JOIN "kempoFile" f ON f."id" = t."sourceFileId"
+            WHERE f."public" = true AND t."fileId" IS NOT NULL)`);
+      }
+    }
+  }
+
+  // 0.7: image aspect ratio settings. Added only when missing, so a value someone chose is never overwritten.
+  for(const [name, description] of [
+    ['category_image_ratio', 'The aspect ratio category images are shown at, as width:height (4:3, 1:1, 16:9). Images are cropped to fit, never stretched.'],
+    ['item_image_ratio', 'The aspect ratio item photos are shown at, as width:height (4:3, 1:1, 16:9). Images are cropped to fit, never stretched.'],
+  ]){
+    const [, existing] = await getSetting('kempo-inventory', name, null);
+    if(existing === null) await setSetting('kempo-inventory', name, '4:3', 'string', false, description);
+  }
+
+  // 0.2: text fields can suggest values already used on other items
+  await db.execute(sql`ALTER TABLE "kempoInventoryField" ADD COLUMN IF NOT EXISTS "suggest" boolean NOT NULL DEFAULT false`);
+
+  // 0.3: categories can have an image
+  await db.execute(sql`
+    CREATE TABLE IF NOT EXISTS "kempoInventoryCategory" (
+      "id" text PRIMARY KEY,
+      "key" text NOT NULL,
+      "name" text NOT NULL,
+      "image" text,
+      "created" timestamp NOT NULL,
+      "updated" timestamp NOT NULL
+    )`);
+  await db.execute(sql`CREATE UNIQUE INDEX IF NOT EXISTS "kempoInventoryCategoryKeyIdx" ON "kempoInventoryCategory" ("key")`);
+
+  // 0.4: category is a built-in property of every item, not a custom field
+  await db.execute(sql`ALTER TABLE "kempoInventoryItem" ADD COLUMN IF NOT EXISTS "category" text NOT NULL DEFAULT ''`);
+  const oldField = [...await db.execute(sql`SELECT 1 FROM "kempoInventoryField" WHERE "key" = 'category' LIMIT 1`)];
+  if(oldField.length){
+    /* Move each item's value across (tidied the way new ones are), then drop the old field. */
+    await db.execute(sql`
+      UPDATE "kempoInventoryItem"
+      SET "category" = regexp_replace(btrim(coalesce("data"->>'category', '')), '[[:space:]]+', ' ', 'g'),
+          "data" = "data" - 'category'
+      WHERE "data"->>'category' IS NOT NULL`);
+    await db.execute(sql`DELETE FROM "kempoInventoryField" WHERE "key" = 'category'`);
+  }
+
+  // 0.5: categories can have a description
+  await db.execute(sql`ALTER TABLE "kempoInventoryCategory" ADD COLUMN IF NOT EXISTS "description" text NOT NULL DEFAULT ''`);
+
+  // 0.6: fields can belong to one category ('' = every item), so a key is unique per category
+  await db.execute(sql`ALTER TABLE "kempoInventoryField" ADD COLUMN IF NOT EXISTS "category" text NOT NULL DEFAULT ''`);
+  await db.execute(sql`DROP INDEX IF EXISTS "kempoInventoryFieldKeyIdx"`);
+  await db.execute(sql`CREATE UNIQUE INDEX IF NOT EXISTS "kempoInventoryFieldKeyIdx" ON "kempoInventoryField" ("category", "key")`);
+};