primate 0.4.0 → 0.5.2

package/README.md

@@ -1,8 +1,5 @@
 # Primate: a JavaScript framework
 
-⚠️ **This software is currently its initial development phase. It is not
-considered production-ready. Expect breakage.** ⚠️
-
 Primate is a server-client JavaScript framework for web applications aimed at
 relieving you of dealing with repetitive, error-prone tasks and letting you
 concentrate on writing effective, expressive code.
@@ -10,7 +7,7 @@ concentrate on writing effective, expressive code.
 ## Installing
 
 ```
-yarn add primate
+npm install primate
 ```
 
 ## Concepts
@@ -23,11 +20,12 @@ yarn add primate
 * **Correct** data verification using field definitions in domains
 * **Secure** serving hash-verified scripts on secure HTTP with a strong CSP
 * **Roles** access control with contexts
-* **Sessions** using cookies that are `HttpOnly`, `Secure` and `Path`-limited
+* **Sessions** using cookies that are `Secure`, `SameSite=Strict`, `HttpOnly`
+and `Path`-limited
 * **Sane defaults** minimally opinionated with good, overrideable defaults
 for most features
 * **Data linking** modeling `1:1`, `1:n` and `n:m` relationships on domains via
-ad-hoc getters
+cacheable ad-hoc getters
 
 ## Getting started
 
@@ -35,7 +33,10 @@ See the [getting started][getting-started] guide.
 
 ## Resources
 
-Coming soon.
+* [Source code][source-code]
+* [Issues][issues]
+
+A full guide is coming soon.
 
 ## Versioning
 
@@ -49,3 +50,5 @@ BSD-3-Clause
 
 [ws]: https://github.com/websockets/ws
 [getting-started]: https://primatejs.com/getting-started
+[source-code]: https://adaptivecloud.dev/primate/primate
+[issues]: https://adaptivecloud.dev/primate/primate/issues

package/debris.json

@@ -0,0 +1,5 @@
+{
+  "suites": "test/suites",
+  "fixtures": "test/fixtures",
+  "explicit": false
+}

package/jsconfig.json

@@ -0,0 +1,8 @@
+{
+  "compilerOptions": {
+    "baseUrl": ".",
+    "target": "esnext",
+    "module": "esnext"
+  },
+  "exclude": ["node_modules"]
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "primate",
-  "version": "0.4.0",
+  "version": "0.5.2",
   "author": "Primate core team <core@primatejs.com>",
   "homepage": "https://primatejs.com",
   "bugs": "https://adaptivecloud.dev/primate/primate/issues",
@@ -8,18 +8,24 @@
   "description": "Server-client framework",
   "license": "BSD-3-Clause",
   "dependencies": {
-    "ws": "^8.4.2"
+    "ws": "^8.5.0"
   },
   "scripts": {
     "copy": "rm -rf output && mkdir output && cp source/* output -a",
     "instrument": "nyc instrument source ./output",
-    "stick": "node --experimental-json-modules node_modules/stick stick.json",
-    "coverage": "yarn instrument && nyc yarn run stick",
-    "test": "yarn copy && yarn run stick"
+    "debris": "node --experimental-json-modules node_modules/debris debris.json",
+    "coverage": "npm run instrument && nyc npm run debris",
+    "test": "npm run copy && npm run debris"
+  },
+  "devDependencies": {
+    "debris": "^0.2.0",
+    "eslint": "^8.11.0",
+    "eslint-plugin-json": "^3.1.0",
+    "nyc": "^15.1.0"
   },
   "type": "module",
   "exports": "./source/server/exports.js",
   "engines": {
-    "node": ">=17.3.0"
+    "node": ">=17.7.2"
   }
 }

package/source/client/Action.js

@@ -11,7 +11,7 @@ export default class Action {
 
   before() {}
 
-  async enter(data) {
+  enter(data) {
     if (data.location) {
       location.href = data.location;
     } else {
@@ -28,13 +28,13 @@ export default class Action {
     this.view = new View(data, this, root);
   }
 
-  create_and_return_view(data, root, save_history) {
+  create_and_return_view(data, root) {
     return new View(data, this, root);
   }
 
   get_form_data(target) {
     const payload = {};
-    const elements = target.elements;
+    const {elements} = target;
     for (let i = 0; i < elements.length; i++) {
       const element = elements[i];
       const type = Element.value(element, "type");
@@ -64,7 +64,7 @@ export default class Action {
   }
 
   async onsubmit(event) {
-    const target = event.target;
+    const {target} = event;
     const stop = this.fire("submit", event);
     if (stop) {
       return event.preventDefault();
@@ -108,13 +108,13 @@ export default class Action {
   }
 
   oninput() {
-    const stop = this.fire("input", event);
+    this.fire("input", event);
   }
 
   fire(type, event) {
     const listeners = this.listeners[type];
     if (listeners !== undefined) {
-      const target = event.target;
+      const {target} = event;
       for (const listener of listeners) {
         if (event.target.closest(listener.selector)) {
           listener.listener(event, target);
@@ -131,7 +131,8 @@ export default class Action {
     const index = this.listeners[event]
       .findIndex(listener => listener.selector === selector);
     const object = {selector, listener};
-    if (index === -1) {
+    const not_found = -1;
+    if (index === not_found) {
       this.listeners[event].push(object);
     } else {
       this.listeners[event].splice(index, 1, object);

package/source/client/Client.js

@@ -31,11 +31,11 @@ export default class Client {
   }
 
   async receive(data) {
-    if (back !== undefined) {
+    if (back === undefined) {
+      await this.session.execute(data);
+    } else {
       back(data);
       back = undefined;
-    } else {
-      await this.session.execute(data);
     }
   }
 

package/source/client/Context.js

@@ -16,8 +16,8 @@ export default class Context {
   async run(data) {
     const {namespace, action} = data;
     const route = `${namespace}/${action}`;
-    const module = routes?.[namespace]?.[action] ?? Action;
-    this.actions[route] = new module(action, this.session);
+    const Module = routes?.[namespace]?.[action] ?? Action;
+    this.actions[route] = new Module(action, this.session);
     const nextaction = this.actions[route];
     nextaction.enter(data);
     await this.Class.before(nextaction);

package/source/client/Element.js

@@ -1,5 +1,5 @@
-const file_listener = event => reader.readAsDataURL(event.target.files[0]);
 const reader = new FileReader();
+const file_listener = event => reader.readAsDataURL(event.target.files[0]);
 
 const replace = (attribute, source) => {
   if (attribute.includes(".")) {
@@ -20,11 +20,11 @@ const fulfill = (attribute, source) => {
   if (source === undefined) {
     return undefined;
   }
-  let value = attribute.value;
+  let {value} = attribute;
   const matches = [...value.matchAll(data_regex)];
   if (matches.length > 0) {
     for (const match of matches) {
-      const key = match[0];
+      const [key] = match;
       const new_value = replace(match[1], source);
       value = value.replace(key, new_value);
     }
@@ -34,7 +34,6 @@ const fulfill = (attribute, source) => {
   return value;
 };
 
-
 const $selector = Symbol("$selector");
 const $element = Symbol("$element");
 const $action = Symbol("$action");
@@ -47,13 +46,13 @@ const proxy_handler = {
     if (property === "on" || property === "insert") {
       return target[property].bind(target);
     }
-    if (target.element !== null) {
-      return (...args) => target[property] !== undefined
-        ? target[property](...args)
-        : receiver;
-    } else {
+    if (target.element === null) {
       return () => receiver;
     }
+
+    return (...args) => target[property] === undefined
+      ? receiver
+      : target[property](...args);
   },
 };
 
@@ -145,7 +144,7 @@ export default class Element {
   class(classes, set) {
     classes.split(" ").forEach(name => {
       this.element.classList.toggle(name, set !== false);
-    })
+    });
     return this;
   }
 
@@ -224,7 +223,7 @@ export default class Element {
   }
 
   input_file_value(value) {
-    const element = this.element;
+    const {element} = this;
     if (value !== undefined) {
       element.setAttribute("base64", value);
     }

package/source/client/View.js

@@ -3,8 +3,6 @@
 import Element from "../Element.js";
 import Node from "./Node.js";
 
-const data_regex = /\${([^}]*)}/g;
-
 export default class View {
   constructor(data, action, root) {
     this.sources = {};
@@ -87,4 +85,5 @@ export default class View {
   write(pathname, payload) {
     return this.action.write(pathname, payload);
   }
+
 }

package/source/preset/primate.json

@@ -13,13 +13,19 @@
     "ssl": {
       "key": "ssl/default.key",
       "cert": "ssl/default.crt"
-    }
+    },
+    "csp": {
+      "default-src": "'self'",
+      "object-src": "'none'",
+      "frame-ancestors": "'none'",
+      "form-action": "'self'",
+      "base-uri": "'self'"
+    },
+    "same-site": "Strict"
   },
   "paths": {
     "client": "client",
-    "data": {
-      "domains": "domains"
-    },
+    "domains": "domains",
     "public": "public",
     "server": "server",
     "static": "static"

package/source/server/Action.js

@@ -2,8 +2,8 @@ import {resolve} from "path";
 import {default as EagerPromise, eager} from "./EagerPromise.js";
 import View from "./view/View.js";
 import Projector from "./Projector.js";
-import InternalServerError from "./errors/InternalServer.js";
-import {assert} from "./invariants.js";
+import {InternalServerError} from "./errors.js";
+import {assert, defined} from "./invariants.js";
 import sanitize from "./sanitize.js";
 
 export default class Action {
@@ -20,11 +20,13 @@ export default class Action {
   static async new(request, session, context) {
     const {namespace = this.namespace, action = this.action} = request.path;
     assert(!namespace.includes("."), () => {
-      throw new InternalServerError("namespace may not include a dot"); });
+      throw new InternalServerError("namespace may not include a dot");
+    });
     const route = `${namespace}/${action}`;
     const path = resolve(`${context.directory}/${route}.js`);
     try {
-      return new (await import(path)).default(request, session, context);
+      const {"default": UserAction} = await import(path);
+      return new UserAction(request, session, context);
     } catch (error) {
       throw new Error(`route \`${route}\` missing`);
     }
@@ -42,7 +44,7 @@ export default class Action {
     const {path} = this.request;
     const namespace = path.namespace ?? this.Class.namespace;
     const action = path.action ?? this.Class.action;
-    const _id = path._id;
+    const {_id} = path;
     return {action, namespace, _id};
   }
 
@@ -51,6 +53,7 @@ export default class Action {
   }
 
   async run(type) {
+    defined(this[type]);
     this.before && await this.before();
     await this[type](sanitize(this.request.payload));
   }
@@ -82,7 +85,8 @@ export default class Action {
     const path = await eager`${this.context.directory}/${route}`;
     const _view = await View.new(path, await this.context.layouts);
     await this.context.Class.prepare(this, data);
-    const payload = await new Projector(data, await _view.elements(this.layout)).project(route);
+    const payload = await new Projector(data,
+      await _view.elements(this.layout)).project(route);
     return {payload, _view};
   }
 

package/source/server/App.js

@@ -6,7 +6,7 @@ import DynamicServer from "./servers/Dynamic.js";
 import StaticServer from "./servers/Static.js";
 import cache from "./cache.js";
 import log from "./log.js";
-import package_json from "../../package.json" assert {"type": "json" };
+import package_json from "../../package.json" assert {"type": "json"};
 
 export default class App {
   constructor(conf) {
@@ -31,11 +31,12 @@ export default class App {
 
     this.router = new Router(await this.routes, this.conf);
     const {index, hashes} = await new this.Bundler(this.conf).bundle();
-    const router = this.router;
+    const {router} = this;
 
     const conf = {index, hashes, router,
       "serve_from": this.conf.paths.public,
       "http": {
+        ...this.conf.http,
         "key": File.read_sync(resolve(this.conf.http.ssl.key)),
         "cert": File.read_sync(resolve(this.conf.http.ssl.cert)),
       },

package/source/server/Bundler.js

@@ -94,7 +94,7 @@ export default class Bundler {
     const index_html = await File.read(`${paths.public}/${this.index}`);
     await File.remove(`${paths.public}/${this.index}`);
 
-    const body = "return `"+index_html+"`";
+    const body = `return \`${index_html}\``;
     const index = new Function("conf", "client", body)(this.conf, this.client);
 
     return {index, "hashes": this.hashes};
@@ -138,7 +138,7 @@ export default class Bundler {
       client += `<script type="module" integrity="${integrity}" src="${src}">`
               + "</script>\n";
     }
-    return client + "<first-view />";
+    return `${client}<first-view />`;
   }
 
   async write_exports() {

package/source/server/Context.js

@@ -2,7 +2,7 @@ import {resolve} from "path";
 import File from "./File.js";
 import Action from "./Action.js";
 import {InternalServerError} from "./errors.js";
-import {assert, defined} from "./invariants.js";
+import {assert} from "./invariants.js";
 import cache from "./cache.js";
 import log from "./log.js";
 
@@ -87,7 +87,6 @@ export default class Context {
     const {type = "read"} = request;
     try {
       const action = await Action.new(request, session, this);
-      defined(action[type]);
       await this.Class.before(action);
       await action.run(type);
       return action.response();

package/source/server/EagerPromise.js

@@ -3,7 +3,7 @@ import {inconstructible_function} from "./attributes.js";
 const $promise = Symbol("#promise");
 
 const handler = {
-  "get": function(target, property) {
+  "get": (target, property) => {
     const promise = target[$promise];
 
     if (["then", "catch"].includes(property)) {

package/source/server/File.js

@@ -31,6 +31,10 @@ export default class File {
     return this.exists && !this.stats.isDirectory();
   }
 
+  get stream() {
+    return this.read_stream;
+  }
+
   get read_stream() {
     return fs.createReadStream(this.path, {"flags": "r"});
   }

package/source/server/Projector.js

@@ -15,7 +15,7 @@ export default class Projector {
     }
     this.documents = documents;
     this.projection = projection.reduce((sofar, domain) => {
-      const key = Object.keys(domain)[0];
+      const [key] = Object.keys(domain);
       sofar[key] = domain[key];
       return sofar;
     }, {});
@@ -39,9 +39,9 @@ export default class Projector {
   }
 
   object(document, projection, key, fields) {
-    return fields?.[key] !== undefined
-      ? this.by_cache(fields[key], key, document, projection)
-      : this.by_store(key, document, projection);
+    return fields?.[key] === undefined
+      ? this.by_store(key, document, projection)
+      : this.by_cache(fields[key], key, document, projection);
   }
 
   async one(document, projection) {
@@ -57,7 +57,7 @@ export default class Projector {
       if (typeof property === "string") {
         resolved[property] = await scalar(document, property);
       } else if (typeof property === "object") {
-        const key = Object.keys(property)[0];
+        const [key] = Object.keys(property);
         resolved[key] = await this.object(document, property, key, fields);
       }
     }
@@ -68,17 +68,17 @@ export default class Projector {
     return this[Array.isArray(document) ? "many" : "one"](document, projection);
   }
 
-  async project(route) {
+  async project() {
     return (await Promise.all(Object.keys(this.documents).map(async key => {
-      const resolved = this.projection[key] !== undefined
-        ? await this.resolve(this.documents[key], this.projection[key])
-        : undefined;
+      const resolved = this.projection[key] === undefined
+        ? undefined
+        : await this.resolve(await this.documents[key], this.projection[key]);
       return {key, resolved};
     }))).reduce((projected, {key, resolved}) => {
-      if (resolved !== undefined) {
-        projected[key] = resolved;
-      } else {
+      if (resolved === undefined) {
         log.yellow(`  \`${key}\` not projected`).nl();
+      } else {
+        projected[key] = resolved;
       }
       return projected;
     }, {});

package/source/server/Router.js

@@ -4,7 +4,7 @@ export default class Router {
     this.routes = {};
     routes.forEach(({from, to, contexts}) => contexts.forEach(context => {
       this.routes[context] = this.routes[context] ?? [];
-      this.routes[context].push({"from": new RegExp("^"+from+"$", "u"), to});
+      this.routes[context].push({"from": new RegExp(`^${from}$`, "u"), to});
     }));
   }
 
@@ -24,36 +24,29 @@ export default class Router {
     const [path, search = ""] = pathname.split("?");
 
     const route = this.route_by_context(context, path);
-    if (route !== undefined) {
-      const replace = path.replace(route.from, route.to);
-      return `${replace}${replace.includes("?") ? "" : "?"}&${search}`;
-    } else {
+    if (route === undefined) {
       return pathname;
     }
+
+    const replace = path.replace(route.from, route.to);
+    return `${replace}${replace.includes("?") ? "" : "?"}&${search}`;
   }
 
   resolve(pathname, context) {
-    return this.context(context) !== undefined
-      ? this.resolve_by_context(pathname, context)
-      : pathname;
+    return this.context(context) === undefined
+      ? pathname
+      : this.resolve_by_context(pathname, context);
   }
 
   async route(pathname, context) {
     const resolved = await this.resolve(this.debase(pathname), context);
     const url = new URL(`https://primatejs.com/${resolved}`);
     const parts = url.pathname.split("/").filter(part => part !== "");
+    const [namespace, action, _id] = parts;
     return {
-      "pathname": url.pathname,
-      "resolved": resolved,
-      "parts": parts,
-      "path": {
-        "namespace": parts[0],
-        "action": parts[1],
-        "_id": parts[2],
-      },
-      "params": {
-        ...Object.fromEntries(url.searchParams),
-      },
+      "pathname": url.pathname, resolved, parts,
+      "path": {namespace, action, _id},
+      "params": {...Object.fromEntries(url.searchParams)},
     };
   }
 }

package/source/server/Session.js

@@ -31,7 +31,7 @@ export default class Session extends Domain {
   }
 
   get cookie() {
-    return `session_id=${this._id}; Secure; SameSite=Strict; HttpOnly; Path=/`;
+    return `session_id=${this._id}; Path=/; Secure; HttpOnly`;
   }
 
   async switch_context(context, data = {}) {

package/source/server/attributes.js

@@ -11,3 +11,4 @@ export const inconstructible_function = value =>
   typeof value === "function" && !constructible(value);
 export const numeric = value => !isNaN(parseFloat(value)) && isFinite(value);
 export const boolish = value => value === "true" || value === "false";
+export const nullish = value => value === undefined || value === null;

package/source/server/domain/Domain.js

@@ -10,7 +10,7 @@ import {random} from "../crypto.js";
 const length = 12;
 
 export default class Domain {
-  static stores_directory = "data/stores";
+  static stores_directory = "stores";
   static store_file = "default.js";
 
   static {

package/source/server/domain/Field.js

@@ -1,28 +1,30 @@
-import * as types from "../types.js";
 import DomainType from "../types/Domain.js";
-import Storeable from "../types/Storeable.js";
+import Predicate from "./Predicate.js";
 import {PredicateError} from "../errors.js";
-import {defined, is_array, instances, is_constructible} from "../invariants.js";
+import Storeable from "../types/Storeable.js";
+import * as types from "../types.js";
+import cache from "../cache.js";
 import {constructible} from "../attributes.js";
+import {defined, is, maybe} from "../invariants.js";
 
 const builtins = Object.values(types).reduce((aggregate, Type) => {
   aggregate[Type.instance] = Type;
   return aggregate;
 }, {});
 
-const parse = field => constructible(field)
-  ? {"type": field}
-  : as_non_constructible(field);
+const as_array = field => ({"type": field[0], "predicates": field.slice(1)});
 
-const as_non_constructible =
-  field => typeof field === "function" ? as_function(field) : as_object(field);
+const as_object = field => field instanceof Array ? as_array(field) : field;
 
 const as_function = field => ({"in": field,
   "type": field(undefined, {}).constructor});
 
-const as_object = field => field instanceof Array ? as_array(field) : field;
+const as_non_constructible =
+  field => typeof field === "function" ? as_function(field) : as_object(field);
 
-const as_array = field => ({"type": field[0], "predicates": field.slice(1)});
+const parse = field => constructible(field)
+  ? {"type": field}
+  : as_non_constructible(field);
 
 export default class Field {
   constructor(property, definition, options) {
@@ -30,9 +32,9 @@ export default class Field {
     this.property = property;
     this.definition = parse(definition);
     this.options = options ?? {"transient": false, "optional": false};
-    is_constructible(this.Type);
-    instances(this.type.prototype, Storeable, "type must extend Storeable");
-    is_array(this.predicates);
+    is.constructible(this.Type);
+    is.subclass(this.type, Storeable);
+    maybe.array(this.definition.predicates);
   }
 
   static resolve(name) {
@@ -57,12 +59,15 @@ export default class Field {
     return this.Type.prototype instanceof DomainType.instance;
   }
 
-  get Type(){
+  get Type() {
     return this.definition.type;
   }
 
   get predicates() {
-    return this.definition.predicates ?? [];
+    return cache(this, "predicates", () => {
+      const predicates = this.definition.predicates ?? [];
+      return predicates.map(name => new Predicate(name));
+    });
   }
 
   by_id(id) {
@@ -75,23 +80,13 @@ export default class Field {
     return in_function !== undefined ? in_function(value, document) : value;
   }
 
-  override_predicates(document) {
-    return this.predicates.map(predicate => {
-      const [name, ...params] = predicate.split(":");
-      return document[name] !== undefined
-        ? {"function": document[name].bind(document), params}
-        : predicate;
-    });
-  }
-
   verify_undefined() {
     return this.options.optional ? true : "Must not be empty";
   }
 
   async verify_defined(property, document) {
     try {
-      const predicates = this.override_predicates(document);
-      await this.type.verify(property, document, predicates, this.Type);
+      await this.type.verify(property, document, this.predicates, this.Type);
       return true;
     } catch (error) {
       if (error instanceof PredicateError) {

package/source/server/domain/Predicate.js

@@ -0,0 +1,24 @@
+import Domain from "./Domain.js";
+import Storeable from "../types/Storeable.js";
+import {is} from "../invariants.js";
+
+export default class Predicate {
+  constructor(definition) {
+    is.string(definition);
+    const [name, ...params] = definition.split(":");
+    this.name = name;
+    this.params = params;
+  }
+
+  async check(property, document, Type) {
+    is.string(property);
+    is.instance(document, Domain);
+    const {name, params} = this;
+    if (document[name] === undefined) {
+      is.subclass(Type, Storeable);
+      await Type.has(name, document[property], params);
+    } else {
+      await document[name](property, ...params);
+    }
+  }
+}

package/source/server/domain/domains.js

@@ -4,7 +4,7 @@ import Field from "./Field.js";
 import Domain from "./Domain.js";
 
 const domains = {};
-const base = conf().paths.data.domains;
+const base = conf().paths.domains;
 
 for (const domain of await new File(base).list(".js")) {
   const name = domain.slice(0, -3);

package/source/server/errors/InternalServer.js

@@ -1 +1 @@
-export default class extends Error {}
+export default class InternalServerError extends Error {}

package/source/server/errors/Predicate.js

@@ -1 +1 @@
-export default class extends Error {}
+export default class PredicateError extends Error {}

package/source/server/exports.js

@@ -14,11 +14,11 @@ export {default as domains} from "./domain/domains.js";
 export {default as Storeable} from "./types/Storeable.js";
 
 export * from "./errors.js";
+export * from "./invariants.js";
 
 export {default as MemoryStore} from "./store/Memory.js";
 export {default as Store} from "./store/Store.js";
 
-export {assert, defined} from "./invariants.js";
 export {default as log} from "./log.js";
 export {default as extend_object} from "./extend_object.js";
 export {default as sanitize} from "./sanitize.js";

package/source/server/invariants.js

@@ -1,17 +1,32 @@
-import {constructible} from "./attributes.js";
+import {constructible, nullish} from "./attributes.js";
 
 const errored = error => {
-  if (typeof error === "function") { // fallback
+  if (typeof error === "function") {
+    // fallback
     error();
-  } else { // error
+  } else {
+    // error
     throw new Error(error);
   }
 };
 
 const assert = (predicate, error) => Boolean(predicate) || errored(error);
-const defined = (value, error) => assert(value !== undefined, error);
-const is_array = value => assert(Array.isArray(value), "must be array");
-const instances = (sub, parent, error) => assert(sub instanceof parent, error);
-const is_constructible = (value, error) => assert(constructible(value), error);
+const is = {
+  "array": value => assert(Array.isArray(value), "must be array"),
+  "string": value => assert(typeof value === "string", "must be string"),
+  "defined": (value, error) => assert(value !== undefined, error),
+  "undefined": value => assert(value === undefined, "must be undefined"),
+  "constructible": (value, error) => assert(constructible(value), error),
+  "instance": (object, Class) => assert(object instanceof Class,
+    `must instance ${Class.name}`),
+  "subclass": (object, Class) => assert(object?.prototype instanceof Class,
+    `must subclass ${Class.name}`),
+};
+const {defined} = is;
+
+const maybe = Object.keys(is).reduce((aggregator, property) => {
+  aggregator[property] = value => nullish(value) || is[property](value);
+  return aggregator;
+}, {});
 
-export {assert, defined, is_array, instances, is_constructible};
+export {assert, defined, is, maybe};

package/source/server/sanitize.js

@@ -1,5 +1,10 @@
 export default (payload = {}) => Object.keys(payload)
   .map(key => ({key, "value": payload[key].toString().trim()}))
-  .map(datum => { datum.value = datum.value !== "" ? datum.value : undefined;
-    return datum; })
-  .reduce((data, {key, value}) => { data[key] = value; return data; }, {});
+  .map(datum => {
+    datum.value = datum.value === "" ? undefined : datum.value;
+    return datum;
+  })
+  .reduce((data, {key, value}) => {
+    data[key] = value;
+    return data;
+  }, {});

package/source/server/servers/Dynamic.js

@@ -23,24 +23,24 @@ export default class DynamicServer extends Server {
     const {session} = socket;
     const request = JSON.parse(event);
     try {
-      await this.onmessage(request, socket);
+      await this.serve(request, socket);
       await session.log("green", `${request.type} ${request.url}`);
     } catch(error) {
       await session.log("red", error.message);
     }
   }
 
-  async onmessage(request, socket) {
+  async serve(request, socket) {
     const {router} = this.conf;
     const {session} = socket;
     const {path, params} = await session.route(router, request.url);
     const response = await session.run({...request, path, params});
     const {type} = response;
     return this[type]?.(socket, response)
-      ?? DynamicServer.send(socket, response);
+      ?? DynamicServer.serve(socket, response);
   }
 
-  static send(socket, response) {
+  static serve(socket, response) {
     socket.send(JSON.stringify(response));
   }
 

package/source/server/servers/Server.js

@@ -1,4 +1,4 @@
-export default class StaticServer {
+export default class Server {
   constructor(conf) {
     this.conf = conf;
   }

package/source/server/servers/Static.js

@@ -7,18 +7,13 @@ import Server from "./Server.js";
 import Session from "../Session.js";
 import File from "../File.js";
 import {algorithm, hash} from "../crypto.js";
-import {assert} from "../invariants.js";
 import log from "../log.js";
 import codes from "./http-codes.json" assert {"type": "json"};
 import mimes from "./mimes.json" assert {"type": "json"};
-import policy from "./content-security-policy.json" assert {"type": "json"};
 
 const regex = /\.([a-z1-9]*)$/u;
 const mime = filename => mimes[filename.match(regex)[1]] ?? mimes.binary;
 
-const csp = Object.keys(policy)
-  .reduce((policy_string, key) => policy_string + `${key} ${policy[key]};`, "");
-
 const stream = (from, response) => {
   response.setHeader("Content-Encoding", "br");
   response.writeHead(codes.OK);
@@ -30,11 +25,15 @@ const stream = (from, response) => {
 export default class StaticServer extends Server {
   async run() {
     const {http, context} = this.conf;
+    const {csp, "same-site": same_site = "Strict"} = http;
+    this.csp = Object.keys(csp).reduce((policy_string, key) =>
+      policy_string + `${key} ${csp[key]};`, "");
 
     this.server = await createServer(http, async (request, response) => {
       const session = await Session.get(request.headers.cookie, context);
       if (!session.has_cookie) {
-        response.setHeader("Set-Cookie", session.cookie);
+        const {cookie} = session;
+        response.setHeader("Set-Cookie", `${cookie}; SameSite=${same_site}`);
       }
       response.session = session;
       request.on("end", () =>
@@ -84,13 +83,13 @@ export default class StaticServer extends Server {
     const integrity = `${algorithm}-${hash(src)}`;
     const view = `<script type="module" integrity="${integrity}">${src}`
                + "</script>";
-    const file = index.replace("<first-view />", view);
+    const file = index.replace("<first-view />", () => view);
     const script_src = Array.from(hashes)
       .concat([integrity])
       .reduce((hash_string, next_hash) => hash_string + ` '${next_hash}'`, "");
 
     response.setHeader("Content-Security-Policy",
-      csp + `script-src 'self'${script_src};`);
+      this.csp + `script-src 'self'${script_src};`);
     response.setHeader("Content-Type", "text/html");
     response.setHeader("Referrer-Policy", "same-origin");
     return stream(Readable.from([file]), response);

package/source/server/store/Store.js

@@ -1,5 +1,5 @@
 import {resolve} from "path";
-const preset = "../../preset/data/stores";
+const preset = "../../preset/stores";
 
 export default class Store {
   constructor(conf = {}) {

package/source/server/types/Array.js

@@ -1,7 +1,7 @@
-import Instance from "./Instance.js";
+import InstanceType from "./Instance.js";
 import errors from "./errors/Array.json" assert {"type": "json"};
 
-export default class extends Instance {
+export default class ArrayType extends InstanceType {
   static get instance() {
     return Array;
   }

package/source/server/types/Boolean.js

@@ -1,8 +1,8 @@
-import Primitive from "./Primitive.js";
+import PrimitiveType from "./Primitive.js";
 import {boolish} from "../attributes.js";
 import errors from "./errors/Boolean.json" assert {"type": "json"};
 
-export default class extends Primitive {
+export default class BooleanType extends PrimitiveType {
   static get type() {
     return "boolean";
   }

package/source/server/types/Date.js

@@ -1,7 +1,7 @@
-import Instance from "./Instance.js";
+import InstanceType from "./Instance.js";
 import errors from "./errors/Date.json" assert {"type": "json"};
 
-export default class extends Instance {
+export default class DateType extends InstanceType {
   static get instance() {
     return Date;
   }

package/source/server/types/Domain.js

@@ -1,6 +1,6 @@
 import Storeable from "./Storeable.js";
 
-export default class extends Storeable {
+export default class DomainType extends Storeable {
   static type_error({name}) {
     return `Must be a ${name}`;
   }

package/source/server/types/Instance.js

@@ -1,6 +1,6 @@
 import Storeable from "./Storeable.js";
 
-export default class extends Storeable {
+export default class InstanceType extends Storeable {
   static is(value) {
     // no subclassing allowed, as [] instanceof Object === true et al.
     return value?.constructor === this.instance;

package/source/server/types/Number.js

@@ -1,8 +1,8 @@
-import Primitive from "./Primitive.js";
+import PrimitiveType from "./Primitive.js";
 import {numeric} from "../attributes.js";
 import errors from "./errors/Number.json" assert {"type": "json"};
 
-export default class extends Primitive {
+export default class NumberType extends PrimitiveType {
   static get type() {
     return "number";
   }

package/source/server/types/Object.js

@@ -1,7 +1,7 @@
-import Instance from "./Instance.js";
+import InstanceType from "./Instance.js";
 import errors from "./errors/Object.json" assert {"type": "json"};
 
-export default class extends Instance {
+export default class ObjectType extends InstanceType {
   static get instance() {
     return Object;
   }

package/source/server/types/Primitive.js

@@ -1,6 +1,6 @@
 import Storeable from "./Storeable.js";
 
-export default class extends Storeable {
+export default class PrimitiveType extends Storeable {
   static is(value) {
     return typeof value === this.type;
   }

package/source/server/types/Storeable.js

@@ -1,12 +1,13 @@
 import {PredicateError} from "../errors.js";
 
-export default class {
+export default class Storeable {
   static async verify(property, document, predicates, type) {
     document[property] = this.coerce(document[property]);
     if (!await this.is(document[property], type)) {
       throw new PredicateError(this.type_error(type));
     }
-    await this.has(property, document, predicates);
+    await Promise.all(predicates.map(predicate =>
+      predicate.check(property, document, this)));
   }
 
   static type_error() {
@@ -17,20 +18,13 @@ export default class {
     throw new Error("must be implemented");
   }
 
-  static async has(property, document, predicates) {
-    for (const predicate of predicates) {
-      if (typeof predicate === "object") {
-        await predicate.function(property, ...predicate.params);
-      } else {
-        const [name, ...params] = predicate.split(":");
-        if (!this[name](document[property], ...params)) {
-          let error = this.errors[name];
-          for (let i = 0; i < params.length; i++) {
-            error = error.replace(`$${i+1}`, params[i]);
-          }
-          throw new PredicateError(error);
-        }
+  static async has(name, value, params) {
+    if (!this[name](value, ...params)) {
+      let error = this.errors[name];
+      for (let i = 0; i < params.length; i++) {
+        error = error.replace(`$${i+1}`, () => params[i]);
       }
+      throw new PredicateError(error);
     }
   }
 

package/source/server/types/String.js

@@ -1,7 +1,7 @@
-import Primitive from "./Primitive.js";
+import PrimitiveType from "./Primitive.js";
 import errors from "./errors/String.json" assert {"type": "json"};
 
-export default class extends Primitive {
+export default class StringType extends PrimitiveType {
   static get type() {
     return "string";
   }

package/source/server/view/View.js

@@ -30,6 +30,6 @@ export default class View {
   }
 
   file(layout = "default") {
-    return this.layout(layout).replace($content, this.content);
+    return this.layout(layout).replace($content, () => this.content);
   }
 }

package/source/server/servers/content-security-policy.json

@@ -1,7 +0,0 @@
-{
-  "default-src": "'self'",
-  "object-src": "'none'",
-  "frame-ancestors": "'none'",
-  "form-action": "'self'",
-  "base-uri": "'self'"
-}