typion 0.0.0-stage → 0.1.1

package/dist/operations-D3rOacLX.js

@@ -0,0 +1,1811 @@
+import { a as InternalError, d as ValidationError, i as ForbiddenError, n as ConfigError, p as isTypionError, r as ConflictError, s as NotFoundError, t as BadRequestError, u as UnsupportedError } from "./errors-D-CKO-px.js";
+import { r as readColumnKind } from "./column-kinds-Bkm4NJI2.js";
+import { i as normalizeIssues } from "./issues-DLqCBQT1.js";
+import { PgTable, getTableConfig } from "drizzle-orm/pg-core";
+import { DrizzleError, SQL, TransactionRollbackError, and, eq, getTableColumns, getTableName, gt, gte, ilike, inArray, is, isNotNull, isNull, like, lt, lte, ne, not, notIlike, notInArray, notLike, or, relationsFilterToSQL, sql } from "drizzle-orm";
+//#region src/define/plugin.ts
+const PLUGIN_ID = /^[a-z][a-zA-Z0-9_]*$/;
+const SETUP_FEATURES = /* @__PURE__ */ new Set(["localization", "multiTenant"]);
+function defineFeaturePlugin(spec) {
+	if (typeof spec.id !== "string" || !PLUGIN_ID.test(spec.id)) throw new ConfigError(`definePlugin: '${String(spec.id)}' is not a valid plugin id (letters, digits, underscore; lowercase first letter)`);
+	for (const [key, table] of Object.entries(spec.tables ?? {})) if (!is(table, PgTable)) throw new ConfigError(`Plugin '${spec.id}': tables.${key} is not a pg table`);
+	for (const [feature, tables] of Object.entries(spec.featureTables ?? {})) {
+		if (!SETUP_FEATURES.has(feature)) throw new ConfigError(`Plugin '${spec.id}': featureTables.${feature} is not a feature a setup configures (${[...SETUP_FEATURES].join(", ")})`);
+		for (const [key, table] of Object.entries(tables)) if (!(key in (spec.tables ?? {})) || !is(table, PgTable)) throw new ConfigError(`Plugin '${spec.id}': featureTables.${feature}.${key} is not a pg table standing for one of its tables`);
+	}
+	return spec;
+}
+function definePlugin(spec) {
+	if (spec.traits !== void 0) throw new ConfigError(`Plugin '${String(spec.id)}': entity traits are the core's; a plugin adds and reacts (ADR-077)`);
+	return defineFeaturePlugin(spec);
+}
+function assertRequirements(spec, hostTables) {
+	for (const [key, shape] of Object.entries(spec.requires ?? {})) {
+		const host = hostTables[key];
+		if (!is(host, PgTable)) throw new ConfigError(`Plugin '${spec.id}' requires a table '${key}' that the engine's tables do not provide`);
+		if (!is(shape, PgTable)) continue;
+		const hostColumns = getTableColumns(host);
+		for (const column of Object.keys(getTableColumns(shape))) if (!(column in hostColumns)) throw new ConfigError(`Plugin '${spec.id}' requires column '${column}' on table '${key}', which the engine's table lacks`);
+	}
+}
+function assertDependencies(spec, before, installed) {
+	for (const needed of spec.dependsOn ?? []) {
+		if (needed === spec.id) throw new ConfigError(`Plugin '${spec.id}' cannot depend on itself`);
+		if (before.has(needed)) continue;
+		throw new ConfigError(installed.has(needed) ? `Plugin '${spec.id}' needs plugin '${needed}' installed before it` : `Plugin '${spec.id}' needs plugin '${needed}', which is not installed`);
+	}
+}
+function checkDependencies(plugins) {
+	const installed = new Set(plugins.map((plugin) => plugin.id));
+	const before = /* @__PURE__ */ new Set();
+	for (const plugin of plugins) {
+		assertDependencies(plugin, before, installed);
+		before.add(plugin.id);
+	}
+}
+function collectEntities(spec) {
+	if (spec.entities === void 0) return {};
+	const tables = spec.tables ?? {};
+	const define = (name, options) => {
+		if (!(name in tables)) throw new ConfigError(`Plugin '${spec.id}' defines entity '${name}' but owns no table with that key`);
+		return {
+			name,
+			options: options ?? {}
+		};
+	};
+	const entities = spec.entities(define);
+	for (const [key, def] of Object.entries(entities)) if (def.name !== key) throw new ConfigError(`Plugin '${spec.id}': entity registered as '${key}' is defined as '${def.name}'`);
+	return entities;
+}
+function resolvePlugins(plugins, hostTables) {
+	const seen = /* @__PURE__ */ new Set();
+	const installed = new Set(plugins.map((plugin) => plugin.id));
+	const claimedTables = /* @__PURE__ */ new Map();
+	const runtimes = [];
+	for (const plugin of plugins) {
+		const spec = plugin;
+		if (seen.has(spec.id)) throw new ConfigError(`Duplicate plugin id '${spec.id}'`);
+		assertDependencies(spec, seen, installed);
+		seen.add(spec.id);
+		assertRequirements(spec, hostTables);
+		const tables = { ...spec.tables };
+		for (const [feature, variants] of Object.entries(spec.featureTables ?? {})) if (installed.has(feature)) Object.assign(tables, variants);
+		for (const key of Object.keys(tables)) {
+			if (key in hostTables) throw new ConfigError(`Plugin '${spec.id}' table '${key}' collides with a table of the engine`);
+			const owner = claimedTables.get(key);
+			if (owner !== void 0) throw new ConfigError(`Plugin '${spec.id}' table '${key}' collides with a table of plugin '${owner}'`);
+			claimedTables.set(key, spec.id);
+		}
+		runtimes.push({
+			id: spec.id,
+			spec,
+			columnKinds: spec.columnKinds ?? null,
+			traits: spec.traits ?? null,
+			tables,
+			entities: collectEntities(spec),
+			hooks: spec.hooks ?? null,
+			routes: spec.routes ?? [],
+			errors: spec.errors ?? {}
+		});
+	}
+	columnKindsOf(runtimes);
+	traitOperations(runtimes);
+	traitRules(runtimes);
+	return runtimes;
+}
+const CORE_OPS = /* @__PURE__ */ new Set([
+	"find",
+	"findOne",
+	"findById",
+	"count",
+	"page",
+	"create",
+	"update",
+	"updateMany",
+	"delete",
+	"deleteMany",
+	"query",
+	"queryOne",
+	"run",
+	"schemas"
+]);
+const byPlugins = /* @__PURE__ */ new WeakMap();
+function traitOperations(plugins) {
+	let operations = byPlugins.get(plugins);
+	if (operations !== void 0) return operations;
+	const out = /* @__PURE__ */ new Map();
+	for (const plugin of plugins) for (const [name, spec] of Object.entries(plugin.traits?.operations ?? {})) {
+		const path = name.split(".");
+		if (path.some((part) => part === "") || CORE_OPS.has(path[0])) throw new ConfigError(`Plugin '${plugin.id}': '${name}' cannot name an operation`);
+		const owner = out.get(name);
+		if (owner !== void 0) throw new ConfigError(`Operation '${name}' is added by both plugin '${owner.plugin.id}' and plugin '${plugin.id}'`);
+		for (const other of out.keys()) if (other.startsWith(`${name}.`) || name.startsWith(`${other}.`)) throw new ConfigError(`Operation '${name}' and operation '${other}' cannot both exist: one would hide the other`);
+		out.set(name, {
+			name,
+			plugin,
+			spec
+		});
+	}
+	operations = out;
+	byPlugins.set(plugins, operations);
+	return operations;
+}
+const CORE_RULES = /* @__PURE__ */ new Map([
+	["read", "filter"],
+	["create", "boolean"],
+	["update", "filter"],
+	["delete", "filter"]
+]);
+const rulesByPlugins = /* @__PURE__ */ new WeakMap();
+function traitRules(plugins) {
+	let rules = rulesByPlugins.get(plugins);
+	if (rules !== void 0) return rules;
+	const out = /* @__PURE__ */ new Map();
+	for (const plugin of plugins) for (const [name, kind] of Object.entries(plugin.traits?.rules ?? {})) {
+		if (CORE_RULES.has(name)) throw new ConfigError(`Plugin '${plugin.id}': rule '${name}' is one of the engine's`);
+		if (kind !== "filter" && kind !== "boolean") throw new ConfigError(`Plugin '${plugin.id}': rule '${name}' must be 'filter' or 'boolean'`);
+		const owner = out.get(name);
+		if (owner !== void 0) throw new ConfigError(`Rule '${name}' is added by both plugin '${owner.plugin}' and plugin '${plugin.id}'`);
+		out.set(name, {
+			name,
+			plugin: plugin.id,
+			kind
+		});
+	}
+	rules = out;
+	rulesByPlugins.set(plugins, rules);
+	return rules;
+}
+const kindsByPlugins = /* @__PURE__ */ new WeakMap();
+function columnKindsOf(runtimes) {
+	let kinds = kindsByPlugins.get(runtimes);
+	if (kinds !== void 0) return kinds;
+	kinds = /* @__PURE__ */ new Map();
+	for (const runtime of runtimes) for (const [id, spec] of Object.entries(runtime.columnKinds?.kinds ?? {})) {
+		const owner = kinds.get(id);
+		if (owner !== void 0) throw new ConfigError(`Column kind '${id}' is handled by both plugin '${owner.plugin}' and plugin '${runtime.id}'`);
+		kinds.set(id, {
+			...spec,
+			id,
+			plugin: runtime.id
+		});
+	}
+	kindsByPlugins.set(runtimes, kinds);
+	return kinds;
+}
+function isPromise(value) {
+	return typeof value?.then === "function";
+}
+function validatePluginEntityOptions(runtimes, entity, pluginOptions) {
+	for (const runtime of runtimes) {
+		const schema = runtime.spec.entityOptions?.schema;
+		if (schema === void 0) continue;
+		const result = schema["~standard"].validate(pluginOptions);
+		if (isPromise(result)) throw new ConfigError(`Plugin '${runtime.id}': entityOptions.schema must validate synchronously (entity '${entity}')`);
+		if (result.issues !== void 0 && result.issues.length > 0) throw new ConfigError(`Entity '${entity}': invalid options for plugin '${runtime.id}': ${result.issues.map((issue) => issue.message).join("; ")}`, "config", {
+			entity,
+			details: {
+				plugin: runtime.id,
+				issues: result.issues
+			}
+		});
+	}
+}
+//#endregion
+//#region src/define/entity.ts
+const ALLOW_ALL = Symbol.for("typion.allowAll");
+function allowAll() {
+	return {
+		read: true,
+		create: true,
+		update: true,
+		delete: true,
+		[ALLOW_ALL]: true
+	};
+}
+function defineEntity(name, options) {
+	return {
+		name,
+		options: options ?? {}
+	};
+}
+const CORE_OPTION_KEYS = /* @__PURE__ */ new Set([
+	"idColumn",
+	"fields",
+	"access",
+	"hooks",
+	"validate",
+	"defaultOrder",
+	"maxLimit",
+	"links"
+]);
+function fail(entity, message) {
+	throw new ConfigError(`Entity '${entity}': ${message}`, "config", { entity });
+}
+function resolvePrimaryKey(entity, table, columns, idColumn) {
+	const tableLevel = getTableConfig(table).primaryKeys.flatMap((pk) => pk.columns);
+	const columnLevel = Object.entries(columns).filter(([, c]) => c.primary);
+	if (tableLevel.length + columnLevel.length > 1 || tableLevel.length > 1) fail(entity, "composite primary keys are not supported (v1 requires a single-column pk)");
+	const pkColumn = columnLevel[0]?.[1] ?? tableLevel[0];
+	if (pkColumn === void 0) fail(entity, `table '${getTableName(table)}' has no primary key`);
+	const pkKey = Object.entries(columns).find(([, c]) => c === pkColumn)?.[0];
+	if (pkKey !== idColumn) fail(entity, `the primary key is '${pkKey}', not '${idColumn}'; set idColumn: '${pkKey}' on the entity`);
+	return idColumn;
+}
+const ALL_GROUPS = [
+	"read",
+	"create",
+	"update",
+	"delete"
+];
+const NO_TABLES = {};
+function resolveTraits(name, table, options, columns, plugins, derived) {
+	const traits = {};
+	const managed = [];
+	for (const plugin of plugins) {
+		const spec = plugin.traits;
+		if (spec === null) continue;
+		const tables = derived.get(plugin.id) ?? NO_TABLES;
+		const resolved = spec.resolve === void 0 ? {} : spec.resolve({
+			entity: name,
+			table,
+			columns,
+			options,
+			derived: tables
+		});
+		if (resolved === null) {
+			if (tables !== NO_TABLES) fail(name, `plugin '${plugin.id}' derived tables for it but does not act on it`);
+			continue;
+		}
+		for (const key of resolved.managed ?? []) {
+			if (!(key in columns)) fail(name, `plugin '${plugin.id}' manages '${key}', which is not a column`);
+			if (!managed.includes(key)) managed.push(key);
+		}
+		const own = Object.keys(spec.rules ?? {});
+		for (const rule of resolved.rules ?? []) if (!own.includes(rule)) fail(name, `plugin '${plugin.id}' has no rule '${rule}'`);
+		traits[plugin.id] = {
+			plugin: plugin.id,
+			state: resolved.state,
+			options: resolved.options ?? ALL_GROUPS,
+			rules: resolved.rules ?? own
+		};
+	}
+	return {
+		traits,
+		managed
+	};
+}
+function checkAccess(name, access, traits, plugins) {
+	const rules = traitRules(plugins);
+	for (const key of Object.keys(access)) {
+		if (CORE_RULES.has(key)) continue;
+		const rule = rules.get(key);
+		if (rule === void 0) fail(name, `access.${key} is not a rule`);
+		if (!traits[rule.plugin]?.rules.includes(key)) fail(name, `access.${key} is a rule of plugin '${rule.plugin}', which does not give it to this entity`);
+	}
+}
+function relationMeta(relations, entity) {
+	const out = {};
+	for (const [key, rel] of Object.entries(relations[entity]?.relations ?? {})) out[key] = {
+		key,
+		target: rel.targetTableName,
+		type: rel.relationType,
+		optional: rel.relationType === "one" ? rel.optional ?? true : false,
+		through: rel.through !== void 0
+	};
+	return out;
+}
+function buildEntityMeta(input) {
+	const { name, table } = input;
+	if (typeof input.options !== "object" || input.options === null) fail(name, "options must be an object");
+	const options = input.options;
+	const columns = getTableColumns(table);
+	const pkKey = resolvePrimaryKey(name, table, columns, options.idColumn ?? "id");
+	const { traits, managed: managedKeys } = resolveTraits(name, table, options, columns, input.plugins, input.derived);
+	const managed = new Set(managedKeys);
+	const access = options.access ?? {};
+	checkAccess(name, access, traits, input.plugins);
+	const fields = options.fields ?? {};
+	for (const key of Object.keys(fields)) if (!(key in columns)) fail(name, `fields.${key} does not name a column`);
+	const kinds = columnKindsOf(input.plugins);
+	const columnMeta = {};
+	for (const [key, column] of Object.entries(columns)) {
+		const field = fields[key] ?? {};
+		const read = field.read === void 0 ? true : field.read;
+		const write = field.write !== void 0 ? field.write : managed.has(key) ? "system" : "user";
+		columnMeta[key] = {
+			key,
+			name: column.name,
+			column,
+			dataType: column.dataType,
+			columnType: column.columnType,
+			notNull: column.notNull,
+			hasDefault: column.hasDefault,
+			generated: column.generated !== void 0 || column.generatedIdentity !== void 0,
+			enumValues: column.enumValues,
+			kind: field.kind ?? readColumnKind(column),
+			columnKind: kinds.get(readColumnKind(column) ?? "") ?? null,
+			read,
+			write
+		};
+	}
+	const pk = columnMeta[pkKey];
+	if (pk.read === false) fail(name, `the primary key '${pkKey}' cannot be hidden`);
+	const defaultOrder = options.defaultOrder ?? null;
+	if (defaultOrder !== null) {
+		for (const key of Object.keys(defaultOrder)) if (!(key in columns)) fail(name, `defaultOrder.${key} does not name a column`);
+	}
+	if (options.maxLimit !== void 0 && (!Number.isInteger(options.maxLimit) || options.maxLimit < 1)) fail(name, "maxLimit must be a positive integer");
+	const relations = relationMeta(input.relations, name);
+	for (const key of options.links ?? []) if (relations[key]?.through !== true) fail(name, `links: '${key}' is not a many-to-many relation through a table`);
+	const pluginOptions = {};
+	for (const [key, value] of Object.entries(options)) if (!CORE_OPTION_KEYS.has(key)) pluginOptions[key] = value;
+	validatePluginEntityOptions(input.plugins, name, pluginOptions);
+	const config = getTableConfig(table);
+	return {
+		name,
+		table,
+		tableName: config.name,
+		pgSchema: config.schema,
+		pk,
+		columns: columnMeta,
+		visibleKeys: Object.keys(columnMeta).filter((k) => columnMeta[k]?.read !== false),
+		kindKeys: Object.keys(columnMeta).filter((k) => columnMeta[k]?.columnKind !== null),
+		dynamicReadKeys: Object.keys(columnMeta).filter((k) => typeof columnMeta[k]?.read === "function"),
+		managedKeys,
+		relations,
+		links: new Set(options.links ?? []),
+		traits,
+		access,
+		hooks: options.hooks ?? {},
+		validate: options.validate ?? null,
+		defaultOrder,
+		maxLimit: options.maxLimit ?? input.maxLimit,
+		pluginOptions,
+		owner: input.owner
+	};
+}
+//#endregion
+//#region src/runtime/context.ts
+var CommitQueue = class {
+	onError;
+	items = [];
+	constructor(onError) {
+		this.onError = onError;
+	}
+	get size() {
+		return this.items.length;
+	}
+	push(fn) {
+		this.items.push(fn);
+	}
+	mark() {
+		return this.items.length;
+	}
+	truncate(mark) {
+		this.items.length = Math.min(this.items.length, mark);
+	}
+	async flush() {
+		const items = this.items;
+		this.items = [];
+		for (const fn of items) try {
+			await fn();
+		} catch (error) {
+			this.onError(error);
+		}
+	}
+	discard() {
+		this.items = [];
+	}
+};
+function buildContext(parts) {
+	const user = parts.user;
+	const actorId = typeof user.actorId === "string" ? user.actorId : null;
+	const userMeta = user.meta;
+	const meta = parts.meta ?? (typeof userMeta === "object" && userMeta !== null ? userMeta : {});
+	return {
+		...user,
+		mode: parts.mode,
+		now: parts.now,
+		requestId: crypto.randomUUID(),
+		request: parts.request,
+		actorId,
+		systemReason: parts.systemReason,
+		meta
+	};
+}
+function operationMeta(ctx, entity, operation, now) {
+	return {
+		entity,
+		operation,
+		mode: ctx.mode,
+		requestId: ctx.requestId,
+		now,
+		systemReason: ctx.systemReason
+	};
+}
+//#endregion
+//#region src/runtime/errors.ts
+function normalizeError(runtime, error) {
+	if (isTypionError(error) || error instanceof TransactionRollbackError) return error;
+	if (error instanceof DrizzleError && !error.query) {
+		if (/relational filter field|not enough data provided|relation/i.test(error.message)) return new BadRequestError(error.message, { cause: error });
+	}
+	const mapped = runtime.dialect.mapError(error);
+	return mapped instanceof ConflictError ? described(runtime, mapped) : mapped ?? error;
+}
+function constraintKeys(entity, constraint) {
+	const columns = Object.entries(getTableColumns(entity.table));
+	const keyOf = (name) => columns.find(([, column]) => column.name === name)?.[0];
+	const keys = (names) => names.map(keyOf).filter((key) => key !== void 0);
+	const config = getTableConfig(entity.table);
+	const index = config.indexes.find((i) => i.config.name === constraint);
+	if (index !== void 0) return keys(index.config.columns.map((c) => c?.name));
+	const unique = config.uniqueConstraints.find((u) => u.getName() === constraint);
+	if (unique !== void 0) return keys(unique.columns.map((c) => c.name));
+	const foreign = config.foreignKeys.find((f) => f.getName() === constraint);
+	if (foreign !== void 0) return keys(foreign.reference().columns.map((c) => c.name));
+	const own = columns.find(([, column]) => column.isUnique && (column.uniqueName === constraint || column.uniqueName === void 0 && (constraint === `${config.name}_${column.name}_unique` || constraint === `${config.name}_${column.name}_key`)));
+	return own === void 0 ? [] : [own[0]];
+}
+function described(runtime, error) {
+	if (error.kind !== "unique" && error.kind !== "foreign_key" || error.constraint === void 0) return error;
+	const table = error.details?.table;
+	const entity = Object.values(runtime.def.entities).find((e) => e.tableName === table);
+	if (entity === void 0) return error;
+	const covered = constraintKeys(entity, error.constraint);
+	const written = covered.filter((key) => !entity.managedKeys.includes(key));
+	const keys = written.length > 0 ? written : covered;
+	const what = keys.length === 0 ? `'${error.constraint}'` : keys.join(", ");
+	const unique = error.kind === "unique";
+	return new ConflictError(unique ? `Entity '${entity.name}': a row with this ${what} exists already` : `Entity '${entity.name}': a reference does not hold (${what})`, error.kind, {
+		entity: entity.name,
+		constraint: error.constraint,
+		details: {
+			sqlstate: error.details?.sqlstate,
+			constraint: error.constraint
+		},
+		cause: error.cause,
+		...keys.length === 0 ? {} : { issues: [{
+			path: [keys[0]],
+			message: unique ? "already exists" : "does not hold"
+		}] }
+	});
+}
+async function guard(runtime, fn) {
+	try {
+		return await fn();
+	} catch (error) {
+		throw normalizeError(runtime, error);
+	}
+}
+//#endregion
+//#region src/runtime/filters.ts
+const FALSE_FILTER = { RAW: sql`false` };
+function isPlainObject(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+	const proto = Object.getPrototypeOf(value);
+	return proto === Object.prototype || proto === null;
+}
+function isEmptyFilter(filter) {
+	return filter === void 0 || Object.values(filter).every((v) => v === void 0);
+}
+function andFilters(parts) {
+	const present = parts.filter((p) => !isEmptyFilter(p));
+	if (present.length === 0) return void 0;
+	if (present.length === 1) return present[0];
+	return { AND: present };
+}
+function asRelationsFilter(filter) {
+	return filter;
+}
+//#endregion
+//#region src/runtime/read/kinds.ts
+const optionsByPlugins = /* @__PURE__ */ new WeakMap();
+function pluginOptions(plugins) {
+	let options = optionsByPlugins.get(plugins);
+	if (options === void 0) {
+		const read = /* @__PURE__ */ new Map();
+		const write = /* @__PURE__ */ new Map();
+		const create = /* @__PURE__ */ new Map();
+		const update = /* @__PURE__ */ new Map();
+		const del = /* @__PURE__ */ new Map();
+		for (const plugin of plugins) {
+			for (const [key, type] of Object.entries(plugin.columnKinds?.readOptions ?? {})) read.set(key, type);
+			for (const [key, type] of Object.entries(plugin.columnKinds?.writeOptions ?? {})) write.set(key, type);
+			const traits = plugin.traits?.options;
+			for (const [group, target] of [
+				["read", read],
+				["create", create],
+				["update", update],
+				["delete", del]
+			]) for (const [key, type] of Object.entries(traits?.[group] ?? {})) target.set(key, type);
+		}
+		options = {
+			read,
+			write,
+			create,
+			update,
+			delete: del
+		};
+		optionsByPlugins.set(plugins, options);
+	}
+	return options;
+}
+function checkOptionType(key, type, value) {
+	if (value !== void 0 && typeof value !== type) throw new BadRequestError(`${key} must be a ${type}`);
+}
+function traitOptions(entity, plugins, group, given) {
+	const out = /* @__PURE__ */ new Map();
+	for (const plugin of plugins) {
+		const keys = plugin.traits?.options?.[group];
+		if (keys === void 0) continue;
+		const values = {};
+		for (const [key, type] of Object.entries(keys)) {
+			checkOptionType(key, type, given[key]);
+			if (given[key] !== void 0) values[key] = given[key];
+		}
+		const names = Object.keys(values);
+		if (names.length === 0) continue;
+		const trait = entity.traits[plugin.id];
+		if (trait === void 0 || !trait.options.includes(group)) throw new UnsupportedError(`Entity '${entity.name}' does not take ${names.map((k) => `'${k}'`).join(", ")}: plugin '${plugin.id}' does not act on it`, { entity: entity.name });
+		out.set(plugin.id, values);
+	}
+	return out;
+}
+function kindPlugins(entity) {
+	const out = /* @__PURE__ */ new Set();
+	for (const key of entity.kindKeys) {
+		const kind = entity.columns[key]?.columnKind;
+		if (kind !== null && kind !== void 0) out.add(kind.plugin);
+	}
+	return out;
+}
+function writeStates(entity, plugins, ctx, given) {
+	const present = kindPlugins(entity);
+	const states = /* @__PURE__ */ new Map();
+	for (const plugin of plugins) {
+		const spec = plugin.columnKinds;
+		if (spec === void 0 || spec === null) continue;
+		const options = {};
+		for (const [key, type] of Object.entries(spec.writeOptions ?? {})) {
+			checkOptionType(key, type, given[key]);
+			if (given[key] !== void 0) options[key] = given[key];
+		}
+		if (!present.has(plugin.id)) {
+			const names = Object.keys(options);
+			if (names.length > 0) throw new UnsupportedError(`Entity '${entity.name}' does not take ${names.map((k) => `'${k}'`).join(", ")}: it has no columns of plugin '${plugin.id}'`, { entity: entity.name });
+			continue;
+		}
+		if (spec.write !== void 0) states.set(plugin.id, spec.write({
+			options,
+			ctx
+		}));
+	}
+	return states;
+}
+function readStates(plugins, ctx, config) {
+	const states = /* @__PURE__ */ new Map();
+	for (const plugin of plugins) {
+		const spec = plugin.columnKinds;
+		if (spec?.read === void 0) continue;
+		const options = {};
+		for (const [key, type] of Object.entries(spec.readOptions ?? {})) {
+			checkOptionType(key, type, config[key]);
+			if (config[key] !== void 0) options[key] = config[key];
+		}
+		states.set(plugin.id, spec.read({
+			options,
+			ctx
+		}));
+	}
+	return states;
+}
+function kindExpression(kind, column, states, dialect, sample) {
+	if (kind?.expression === void 0) return void 0;
+	return kind.expression({
+		column,
+		state: states.get(kind.plugin),
+		sample,
+		dialect
+	});
+}
+async function projectCells(cells, states) {
+	const byKind = /* @__PURE__ */ new Map();
+	for (const cell of cells) {
+		let list = byKind.get(cell.kind);
+		if (list === void 0) {
+			list = [];
+			byKind.set(cell.kind, list);
+		}
+		list.push(cell);
+	}
+	for (const [kind, list] of byKind) {
+		const project = kind.project;
+		if (project === void 0) continue;
+		const values = await project(list.map(({ row, key }) => row[key]), states.get(kind.plugin));
+		list.forEach(({ row, key }, i) => {
+			row[key] = values[i];
+		});
+	}
+}
+function assertScalar(key, value) {
+	if (isPlainObject(value) || Array.isArray(value)) throw new BadRequestError(`Filter on column '${key}': only primitive values can be compared through its kind`);
+}
+function asArray(key, op, value) {
+	if (!Array.isArray(value)) throw new BadRequestError(`Filter '${key}.${op}' expects an array`);
+	for (const item of value) assertScalar(key, item);
+	return value;
+}
+function asPattern(key, op, value) {
+	if (typeof value !== "string") throw new BadRequestError(`Filter '${key}.${op}' expects a string`);
+	return value;
+}
+function kindFilterSQL(expr, key, filter) {
+	const build = (f) => {
+		if (!isPlainObject(f)) {
+			if (f === null) throw new BadRequestError(`Filter '${key}': use { isNull: true } instead of null`);
+			assertScalar(key, f);
+			return eq(expr(f), f);
+		}
+		const parts = [];
+		for (const [op, value] of Object.entries(f)) {
+			if (value === void 0) continue;
+			switch (op) {
+				case "eq":
+				case "ne":
+				case "gt":
+				case "gte":
+				case "lt":
+				case "lte": {
+					assertScalar(key, value);
+					const fn = {
+						eq,
+						ne,
+						gt,
+						gte,
+						lt,
+						lte
+					}[op];
+					parts.push(fn(expr(value), value));
+					break;
+				}
+				case "in": {
+					const items = asArray(key, op, value);
+					parts.push(items.length === 0 ? sql`false` : inArray(expr(items[0]), items));
+					break;
+				}
+				case "notIn": {
+					const items = asArray(key, op, value);
+					if (items.length > 0) parts.push(notInArray(expr(items[0]), items));
+					break;
+				}
+				case "like":
+					parts.push(like(expr(null), asPattern(key, op, value)));
+					break;
+				case "ilike":
+					parts.push(ilike(expr(null), asPattern(key, op, value)));
+					break;
+				case "notLike":
+					parts.push(notLike(expr(null), asPattern(key, op, value)));
+					break;
+				case "notIlike":
+					parts.push(notIlike(expr(null), asPattern(key, op, value)));
+					break;
+				case "isNull":
+					if (value === true) parts.push(isNull(expr(null)));
+					break;
+				case "isNotNull":
+					if (value === true) parts.push(isNotNull(expr(null)));
+					break;
+				case "NOT": {
+					const inner = build(value);
+					if (inner !== void 0) parts.push(not(inner));
+					break;
+				}
+				case "OR":
+				case "AND": {
+					if (!Array.isArray(value)) throw new BadRequestError(`Filter '${key}.${op}' expects an array`);
+					const inner = value.map(build);
+					parts.push(op === "OR" ? or(...inner) : and(...inner));
+					break;
+				}
+				default: throw new BadRequestError(`Unknown filter operator '${op}' on '${key}'`);
+			}
+		}
+		return and(...parts);
+	};
+	return build(filter) ?? sql`true`;
+}
+//#endregion
+//#region src/runtime/access.ts
+const ALLOW = { kind: "allow" };
+const DENY = { kind: "deny" };
+function forbidden(entity, rule, meta, why) {
+	return new ForbiddenError(`Entity '${entity}': ${why}`, {
+		entity,
+		operation: meta.operation,
+		rule
+	});
+}
+function ruleKind(entity, rule, bound) {
+	const core = CORE_RULES.get(rule);
+	if (core !== void 0) return core;
+	const declared = traitRules(bound.runtime.plugins).get(rule);
+	if (declared === void 0 || !entity.traits[declared.plugin]?.rules.includes(rule)) throw new InternalError(`Entity '${entity.name}' has no rule '${rule}'`, { entity: entity.name });
+	return declared.kind;
+}
+async function evaluateRule(entity, rule, bound, meta, extra = {}) {
+	const kind = ruleKind(entity, rule, bound);
+	if (bound.$mode === "system") return ALLOW;
+	const access = entity.access;
+	const value = access[rule];
+	if (value === void 0) {
+		if (access[ALLOW_ALL] === true) return ALLOW;
+		throw forbidden(entity.name, rule, meta, `no access.${rule} rule, so '${meta.operation}' is denied in user mode (declare the rule or spread allowAll())`);
+	}
+	const result = typeof value === "function" ? await value({
+		ctx: bound.ctx,
+		meta,
+		typion: bound.systemTwin(`access.${rule} of '${entity.name}'`),
+		...extra
+	}) : value;
+	if (result === true) return ALLOW;
+	if (result === false) return DENY;
+	if (isPlainObject(result) && kind === "filter") {
+		const states = readStates(bound.runtime.plugins, bound.ctx, {});
+		return {
+			kind: "filter",
+			filter: ruleFilter(bound, meta.operation, entity.name, result, states)
+		};
+	}
+	throw new InternalError(`Entity '${entity.name}': access.${rule} must return a boolean${kind === "filter" ? " or a filter object" : ""}`, { entity: entity.name });
+}
+function ruleFilter(bound, operation, tableKey, filter, states) {
+	const runtime = bound.runtime;
+	const entity = runtime.entityOrNull(tableKey);
+	const relations = runtime.relations[tableKey]?.relations ?? {};
+	const plain = {};
+	const extra = [];
+	for (const [key, value] of Object.entries(filter)) {
+		if (value === void 0) continue;
+		if ((key === "AND" || key === "OR") && Array.isArray(value)) {
+			plain[key] = value.map((part) => isPlainObject(part) ? ruleFilter(bound, operation, tableKey, part, states) : part);
+			continue;
+		}
+		if (key === "NOT" && isPlainObject(value)) {
+			plain.NOT = ruleFilter(bound, operation, tableKey, value, states);
+			continue;
+		}
+		const relation = relations[key];
+		if (relation !== void 0) {
+			const target = runtime.entityOrNull(relation.targetTableName);
+			const kept = target === null ? void 0 : pluginFilter(target, bound, operation, NO_TRAIT_OPTIONS, READING);
+			if (isPlainObject(value)) {
+				plain[key] = andFilters([kept, ruleFilter(bound, operation, relation.targetTableName, value, states)]) ?? {};
+				continue;
+			}
+			if (value === true) {
+				plain[key] = kept ?? true;
+				continue;
+			}
+			if (value === false) {
+				if (kept === void 0) plain[key] = false;
+				else extra.push({ NOT: { [key]: kept } });
+				continue;
+			}
+		}
+		const kind = entity?.columns[key]?.columnKind;
+		if (kind?.expression === void 0) {
+			plain[key] = value;
+			continue;
+		}
+		extra.push({ RAW: (t) => kindFilterSQL((sample) => kindExpression(kind, t[key], states, runtime.dialect, sample), key, value) });
+	}
+	return extra.length === 0 ? plain : { AND: [plain, ...extra] };
+}
+const UNPARTITIONED = /* @__PURE__ */ new Map();
+function partitionOf(entity, bound, operation) {
+	let out;
+	for (const plugin of bound.runtime.plugins) {
+		const partition = plugin.traits?.partition;
+		const trait = entity.traits[plugin.id];
+		if (partition === void 0 || trait === void 0) continue;
+		const values = partition({
+			entity,
+			state: trait.state,
+			operation,
+			ctx: bound.ctx
+		});
+		if (values === void 0) continue;
+		for (const [column, value] of Object.entries(values)) {
+			if (!(column in entity.columns)) throw new InternalError(`Plugin '${plugin.id}' partitions '${entity.name}' by '${column}', which is not a column`, { entity: entity.name });
+			if (value === null || value === void 0) throw new ForbiddenError(`Entity '${entity.name}' is partitioned by '${column}', and the call has no value for it`, {
+				entity: entity.name,
+				operation,
+				rule: `partition:${plugin.id}`
+			});
+			out ??= /* @__PURE__ */ new Map();
+			out.set(column, {
+				value,
+				plugin: plugin.id
+			});
+		}
+	}
+	return out ?? UNPARTITIONED;
+}
+function partitionFilter(partition) {
+	if (partition.size === 0) return void 0;
+	const filter = {};
+	for (const [column, { value }] of partition) filter[column] = { eq: value };
+	return filter;
+}
+const READING = { writing: false };
+const WRITING = { writing: true };
+function pluginFilter(entity, bound, operation, options, use) {
+	return andFilters([partitionFilter(partitionOf(entity, bound, operation)), traitFilter(entity, bound, operation, options, use)]);
+}
+const NO_TRAIT_OPTIONS = /* @__PURE__ */ new Map();
+const NO_OPTIONS = {};
+function traitFilter(entity, bound, operation, options, use) {
+	const parts = [];
+	for (const plugin of bound.runtime.plugins) {
+		const filter = plugin.traits?.filter;
+		const trait = entity.traits[plugin.id];
+		if (filter === void 0 || trait === void 0 || plugin.id === use.skip) continue;
+		parts.push(filter({
+			entity,
+			state: trait.state,
+			operation,
+			writing: use.writing,
+			options: options.get(plugin.id) ?? NO_OPTIONS,
+			ctx: bound.ctx
+		}));
+	}
+	return andFilters(parts);
+}
+function filterToSQL(relations, tableKey, table, filter) {
+	if (filter === void 0) return void 0;
+	const tableRelations = relations[tableKey]?.relations ?? {};
+	return relationsFilterToSQL(table, asRelationsFilter(filter), tableRelations, relations);
+}
+function fieldReadDenied(entity, bound, meta) {
+	if (bound.$mode === "system") return [];
+	const denied = [];
+	for (const key of entity.dynamicReadKeys) {
+		const rule = entity.columns[key].read;
+		if (typeof rule === "function" && !rule({
+			ctx: bound.ctx,
+			meta
+		})) denied.push(key);
+	}
+	return denied;
+}
+function fieldWriteCheck(entity, bound, meta, data, allowed = /* @__PURE__ */ new Set()) {
+	for (const key of Object.keys(data)) {
+		if (data[key] === void 0 || allowed.has(key)) continue;
+		const column = entity.columns[key];
+		if (column === void 0) continue;
+		const write = column.write;
+		if (write === false || write === "system" && bound.$mode === "user" || typeof write === "function" && bound.$mode === "user" && !write({
+			ctx: bound.ctx,
+			meta
+		})) throw new ForbiddenError(`Entity '${entity.name}': column '${key}' is not writable here`, {
+			entity: entity.name,
+			operation: meta.operation,
+			rule: `fields.${key}.write`
+		});
+	}
+}
+//#endregion
+//#region src/runtime/equal.ts
+function deepEqual(a, b) {
+	if (Object.is(a, b)) return true;
+	if (a instanceof Date || b instanceof Date) return a instanceof Date && b instanceof Date && a.getTime() === b.getTime();
+	if (typeof a !== "object" || typeof b !== "object" || a === null || b === null) return false;
+	if (Array.isArray(a) !== Array.isArray(b)) return false;
+	if (Array.isArray(a) && Array.isArray(b)) return a.length === b.length && a.every((item, i) => deepEqual(item, b[i]));
+	const left = a;
+	const right = b;
+	const keys = /* @__PURE__ */ new Set([...Object.keys(left), ...Object.keys(right)]);
+	for (const key of keys) if (!deepEqual(left[key], right[key])) return false;
+	return true;
+}
+//#endregion
+//#region src/runtime/write/pipeline.ts
+async function runOperation(bound, entity, operation, fn) {
+	const { runtime } = bound;
+	await runtime.ready();
+	const meta = operationMeta(bound.ctx, entity.name, operation, runtime.now());
+	const bag = /* @__PURE__ */ new Map();
+	try {
+		if (bound.$tx !== null && bound.queue !== null) {
+			const queue = bound.queue;
+			const mark = queue.mark();
+			try {
+				return await bound.$tx.transaction((tx) => fn({
+					bound: bound.joined(tx, queue),
+					tx,
+					meta,
+					bag,
+					queue,
+					entity
+				}));
+			} catch (error) {
+				queue.truncate(mark);
+				throw error;
+			}
+		}
+		const queue = new CommitQueue((error) => runtime.afterCommitError(error, {
+			entity: entity.name,
+			operation,
+			requestId: bound.ctx.requestId
+		}));
+		let result;
+		try {
+			result = await bound.$executor.transaction((tx) => fn({
+				bound: bound.joined(tx, queue),
+				tx,
+				meta,
+				bag,
+				queue,
+				entity
+			}));
+		} catch (error) {
+			queue.discard();
+			throw error;
+		}
+		await queue.flush();
+		return result;
+	} catch (error) {
+		throw normalizeError(runtime, error);
+	}
+}
+function hookBase(scope) {
+	return {
+		ctx: scope.bound.ctx,
+		meta: scope.meta,
+		typion: scope.bound,
+		tx: scope.tx,
+		bag: scope.bag
+	};
+}
+function globalBase(scope) {
+	return {
+		...hookBase(scope),
+		entityMeta: scope.entity
+	};
+}
+function globalHooks(scope) {
+	const out = [];
+	for (const plugin of scope.bound.runtime.plugins) {
+		const hooks = plugin.hooks;
+		if (hooks === null) continue;
+		if (hooks.entities !== void 0 && !hooks.entities.includes(scope.entity.name)) continue;
+		out.push(hooks);
+	}
+	return out;
+}
+async function beforeOperation(scope, args) {
+	for (const hooks of globalHooks(scope)) await hooks.beforeOperation?.({
+		entity: scope.entity.name,
+		op: scope.meta.operation,
+		args,
+		...globalBase(scope)
+	});
+}
+async function afterOperation(scope, result) {
+	for (const hooks of globalHooks(scope)) await hooks.afterOperation?.({
+		entity: scope.entity.name,
+		op: scope.meta.operation,
+		result,
+		...globalBase(scope)
+	});
+}
+async function afterLink(scope, outcome) {
+	for (const hooks of globalHooks(scope)) await hooks.afterLink?.({
+		entity: scope.entity.name,
+		...outcome,
+		...globalBase(scope)
+	});
+}
+const argsByPlugins = /* @__PURE__ */ new WeakMap();
+function defaultHookArgs(plugins) {
+	let args = argsByPlugins.get(plugins);
+	if (args === void 0) {
+		const out = {
+			change: {},
+			afterChange: {},
+			afterDelete: {}
+		};
+		for (const plugin of plugins) {
+			const defaults = plugin.traits?.hookArgs;
+			Object.assign(out.change, defaults?.change);
+			Object.assign(out.afterChange, defaults?.afterChange);
+			Object.assign(out.afterDelete, defaults?.afterDelete);
+		}
+		args = out;
+		argsByPlugins.set(plugins, args);
+	}
+	return args;
+}
+async function entityChangeHook(scope, name, input) {
+	const hook = scope.entity.hooks[name];
+	if (hook === void 0) return input.data;
+	const { args, ...rest } = input;
+	return await hook({
+		...args,
+		...rest,
+		...hookBase(scope)
+	}) ?? input.data;
+}
+function beforeValidate(scope, input) {
+	return entityChangeHook(scope, "beforeValidate", input);
+}
+async function beforeChange(scope, input) {
+	let data = await entityChangeHook(scope, "beforeChange", input);
+	const { args, ...rest } = input;
+	for (const hooks of globalHooks(scope)) {
+		if (hooks.beforeChange === void 0) continue;
+		data = await hooks.beforeChange({
+			...args,
+			entity: scope.entity.name,
+			...rest,
+			data,
+			...globalBase(scope)
+		}) ?? data;
+	}
+	return data;
+}
+async function afterChange(scope, outcome) {
+	const { args, ...rest } = outcome;
+	const hook = scope.entity.hooks.afterChange;
+	await hook?.({
+		...args,
+		...rest,
+		...hookBase(scope)
+	});
+	for (const hooks of globalHooks(scope)) await hooks.afterChange?.({
+		...args,
+		entity: scope.entity.name,
+		...rest,
+		...globalBase(scope)
+	});
+}
+async function beforeDelete(scope, doc, options) {
+	const hook = scope.entity.hooks.beforeDelete;
+	await hook?.({
+		doc,
+		options,
+		...hookBase(scope)
+	});
+}
+async function afterDelete(scope, outcome) {
+	const { doc, previous, removed, options, args } = outcome;
+	const hook = scope.entity.hooks.afterDelete;
+	await hook?.({
+		...args,
+		doc,
+		options,
+		...hookBase(scope)
+	});
+	for (const hooks of globalHooks(scope)) await hooks.afterDelete?.({
+		...args,
+		entity: scope.entity.name,
+		doc,
+		previous,
+		removed,
+		options,
+		...globalBase(scope)
+	});
+}
+function queueAfterCommit(scope, doc, previous) {
+	const { entity, meta, queue } = scope;
+	const ctx = scope.bound.ctx;
+	const hook = entity.hooks.afterCommit;
+	if (hook !== void 0) queue.push(() => hook({
+		op: meta.operation,
+		doc,
+		previous,
+		ctx,
+		meta
+	}));
+	for (const hooks of globalHooks(scope)) {
+		const global = hooks.afterCommit;
+		if (global === void 0) continue;
+		queue.push(() => global({
+			entity: entity.name,
+			op: meta.operation,
+			doc,
+			previous,
+			ctx,
+			meta
+		}));
+	}
+}
+//#endregion
+//#region src/runtime/write/validate.ts
+function runtimeColumn(entity, key) {
+	return entity.columns[key]?.column;
+}
+function isGeneratedAlways(entity, key) {
+	const column = runtimeColumn(entity, key);
+	return column.generated?.type === "always" || column.generatedIdentity?.type === "always";
+}
+function assertData(data, what = "data") {
+	if (!isPlainObject(data)) throw new BadRequestError(`${what} must be an object`);
+	return data;
+}
+function assertScalars(entity, data) {
+	const issues = [];
+	for (const [key, value] of Object.entries(data)) {
+		if (!isPlainObject(value) && !Array.isArray(value)) continue;
+		const column = entity.columns[key];
+		if (column === void 0 || column.columnKind !== null) continue;
+		const type = column.dataType.split(" ")[0];
+		if (type === "string" || type === "number" || type === "boolean" || type === "bigint") issues.push({
+			path: [key],
+			message: `Expected a ${type}, not ${Array.isArray(value) ? "an array" : "an object"}`
+		});
+	}
+	if (issues.length > 0) throw new ValidationError(`Entity '${entity.name}': invalid data`, issues, { entity: entity.name });
+}
+function applyDefaults(entity, data) {
+	const out = { ...data };
+	for (const key of Object.keys(entity.columns)) {
+		if (out[key] !== void 0) continue;
+		const column = runtimeColumn(entity, key);
+		if (typeof column.defaultFn === "function") out[key] = column.defaultFn();
+		else if (column.default !== void 0 && !is(column.default, SQL)) out[key] = typeof column.default === "object" ? structuredClone(column.default) : column.default;
+	}
+	return out;
+}
+function applyKindWrites(entity, base, data, states) {
+	const out = { ...data };
+	if (states === null) return out;
+	for (const key of entity.kindKeys) {
+		const kind = entity.columns[key]?.columnKind;
+		if (kind?.write === void 0 || data[key] === void 0) continue;
+		out[key] = kind.write({
+			value: data[key],
+			stored: base?.[key],
+			state: states.get(kind.plugin)
+		});
+	}
+	return out;
+}
+async function runSchema(schema, value, entity) {
+	const result = await schema["~standard"].validate(value);
+	if (result.issues !== void 0) {
+		const issues = normalizeIssues(result.issues);
+		const summary = issues.slice(0, 3).map((i) => `${i.path.map(String).join(".") || "(root)"}: ${i.message}`).join("; ");
+		throw new ValidationError(`Invalid ${entity.name}: ${summary}`, issues, { entity: entity.name });
+	}
+	return result.value;
+}
+function insertable(entity, row) {
+	const out = {};
+	for (const key of Object.keys(entity.columns)) if (row[key] !== void 0 && !isGeneratedAlways(entity, key)) out[key] = row[key];
+	return out;
+}
+async function validateCreate(runtime, entity, data) {
+	const unknown = Object.keys(data).filter((k) => data[k] !== void 0 && !(k in entity.columns));
+	if (unknown.length > 0) throw new ValidationError(`Invalid ${entity.name}: unknown key${unknown.length > 1 ? "s" : ""} ${unknown.join(", ")}`, unknown.map((k) => ({
+		path: [k],
+		message: `Unknown key '${k}'`
+	})), { entity: entity.name });
+	const base = await runSchema(runtime.schema(entity, "insert"), insertable(entity, data), entity);
+	const user = entity.validate?.insert;
+	return user === void 0 ? base : runSchema(user, base, entity);
+}
+async function validateUpdate(runtime, entity, base, patch) {
+	const unknown = Object.keys(patch).filter((k) => patch[k] !== void 0 && !(k in entity.columns));
+	if (unknown.length > 0) throw new ValidationError(`Invalid ${entity.name}: unknown key${unknown.length > 1 ? "s" : ""} ${unknown.join(", ")}`, unknown.map((k) => ({
+		path: [k],
+		message: `Unknown key '${k}'`
+	})), { entity: entity.name });
+	const merged = await runSchema(runtime.schema(entity, "insert"), insertable(entity, {
+		...base,
+		...patch
+	}), entity);
+	const validated = {};
+	for (const key of Object.keys(patch)) {
+		if (patch[key] === void 0) continue;
+		validated[key] = key in merged ? merged[key] : patch[key];
+	}
+	const user = entity.validate?.update;
+	return user === void 0 ? validated : runSchema(user, validated, entity);
+}
+function stripHidden(entity, row) {
+	const out = {};
+	for (const [key, value] of Object.entries(row)) if (entity.columns[key]?.read !== false) out[key] = value;
+	return out;
+}
+//#endregion
+//#region src/runtime/write/references.ts
+function keysOf(table, columns) {
+	const entries = Object.entries(getTableColumns(table));
+	return columns.map((column) => entries.find(([, c]) => c === column)?.[0]);
+}
+function* oneTargets(entity, bound) {
+	for (const relation of Object.values(entity.relations)) {
+		if (relation.type !== "one" || relation.through) continue;
+		const target = bound.runtime.entityOrNull(relation.target);
+		if (target !== null) yield {
+			relation,
+			target
+		};
+	}
+}
+function referencesDeletable(entity, bound) {
+	for (const { target } of oneTargets(entity, bound)) if (target.traits.softDelete !== void 0) return true;
+	return false;
+}
+const NO_PARTITION = /* @__PURE__ */ new Map();
+async function checkReferences(scope, row, written, options) {
+	const { entity, bound, tx, meta } = scope;
+	const partitioned = partitionOf(entity, bound, meta.operation).size > 0;
+	const issues = [];
+	for (const { relation, target } of oneTargets(entity, bound)) {
+		const partition = partitioned ? partitionOf(target, bound, "findById") : NO_PARTITION;
+		const kept = traitFilter(target, bound, "findById", traitOptions(target, bound.runtime.plugins, "read", options.withDeleted === true && target.traits.softDelete !== void 0 ? { withDeleted: true } : {}), WRITING);
+		if (partition.size === 0 && kept === void 0) continue;
+		const rel = bound.runtime.relations[entity.name]?.relations[relation.key];
+		const sources = keysOf(entity.table, rel.sourceColumns);
+		const targets = keysOf(target.table, rel.targetColumns);
+		if (sources.some((key) => key === void 0 || key === entity.pk.key)) continue;
+		if (!sources.some((key) => written.has(key))) continue;
+		const values = sources.map((key) => row[key]);
+		if (values.some((value) => value === null || value === void 0)) continue;
+		const filter = andFilters([
+			...targets.map((key, i) => ({ [key]: { eq: values[i] } })),
+			partitionFilter(partition),
+			kept
+		]);
+		const where = filterToSQL(bound.runtime.relations, target.name, target.table, filter);
+		if (Number(await tx.$count(target.table, where)) === 0) issues.push({
+			path: [sources[0]],
+			message: `No ${target.name} row ${values.map(String).join(", ")}`
+		});
+	}
+	if (issues.length > 0) throw new ValidationError(`Entity '${entity.name}': a reference points at no row`, issues, { entity: entity.name });
+}
+//#endregion
+//#region src/runtime/write/mutations.ts
+function referenceOptionKeys(entity, bound) {
+	return referencesDeletable(entity, bound) ? ["withDeleted"] : [];
+}
+const NO_KEYS = /* @__PURE__ */ new Set();
+const NO_VALUES = {};
+function column(table, key) {
+	return table[key];
+}
+function assertId(entity, id) {
+	if (id === void 0 || id === null || typeof id === "object") throw new BadRequestError(`${entity.name}: a scalar id is required`, { entity: entity.name });
+}
+function writeOptionKeys(bound) {
+	return [...pluginOptions(bound.runtime.plugins).write.keys()];
+}
+async function resultOf(scope, doc, options) {
+	const { entity, bound } = scope;
+	const out = stripHidden(entity, doc);
+	for (const key of fieldReadDenied(entity, bound, scope.meta)) if (key in out) out[key] = null;
+	const cells = entity.kindKeys.flatMap((key) => {
+		const kind = entity.columns[key]?.columnKind;
+		return kind === null || kind === void 0 || !(key in out) ? [] : [{
+			row: out,
+			key,
+			kind
+		}];
+	});
+	if (cells.length > 0) await projectCells(cells, readStates(bound.runtime.plugins, bound.ctx, options));
+	return out;
+}
+function assertOptions(options, keys) {
+	if (options === void 0) return {};
+	if (!isPlainObject(options)) throw new BadRequestError("options must be an object");
+	for (const key of Object.keys(options)) if (!keys.includes(key)) throw new BadRequestError(`Unknown option '${key}'`);
+	return options;
+}
+async function writeRule(scope, rule, extra) {
+	const outcome = await evaluateRule(scope.entity, rule, scope.bound, scope.meta, extra);
+	if (outcome.kind === "deny") throw forbidden(scope.entity.name, rule, scope.meta, `access.${rule} denies '${scope.meta.operation}'`);
+	return outcome.kind === "filter" ? outcome.filter : void 0;
+}
+function partitionAllowance(scope, data) {
+	const { entity, bound, meta } = scope;
+	const partition = partitionOf(entity, bound, meta.operation);
+	let allowed;
+	for (const [key, { value, plugin }] of partition) {
+		const given = data[key];
+		if (given === void 0) continue;
+		if (!deepEqual(given, value)) throw new ForbiddenError(`Entity '${entity.name}': '${key}' cannot be set outside the call's partition`, {
+			entity: entity.name,
+			operation: meta.operation,
+			rule: `partition:${plugin}`
+		});
+		(allowed ??= /* @__PURE__ */ new Set()).add(key);
+	}
+	return {
+		allowed: allowed ?? NO_KEYS,
+		partition
+	};
+}
+async function lockRow(scope, id, parts) {
+	const { entity, bound } = scope;
+	const filter = andFilters([{ [entity.pk.key]: { eq: id } }, ...parts]);
+	const where = filterToSQL(bound.runtime.relations, entity.name, entity.table, filter);
+	const row = (await bound.runtime.dialect.lockSelect(scope.tx, entity.table, where))[0];
+	if (row === void 0) throw new NotFoundError(`${entity.name} '${String(id)}' not found`, { entity: entity.name });
+	return row;
+}
+function changedKeys(entity, before, after) {
+	return Object.keys(entity.columns).filter((key) => before === null ? after[key] !== void 0 && after[key] !== null : !deepEqual(before[key], after[key]));
+}
+function hookArgs(scope) {
+	const defaults = defaultHookArgs(scope.bound.runtime.plugins);
+	return {
+		change: { ...defaults.change },
+		afterChange: { ...defaults.afterChange },
+		afterDelete: { ...defaults.afterDelete }
+	};
+}
+function addArgs(args, given) {
+	if (given === void 0) return;
+	Object.assign(args.change, given.change);
+	Object.assign(args.afterChange, given.afterChange);
+	Object.assign(args.afterDelete, given.afterDelete);
+}
+function* actingPlugins(scope) {
+	for (const plugin of scope.bound.runtime.plugins) {
+		const trait = scope.entity.traits[plugin.id];
+		if (plugin.traits !== null && trait !== void 0) yield {
+			plugin,
+			trait,
+			traits: plugin.traits
+		};
+	}
+}
+async function record(scope, input, into) {
+	for (const { plugin, trait, traits } of actingPlugins(scope)) {
+		if (traits.record === void 0) continue;
+		const recorded = await traits.record({
+			entity: scope.entity,
+			state: trait.state,
+			operation: input.operation,
+			step: input.step,
+			row: input.row,
+			previous: input.previous,
+			written: input.written,
+			options: input.options.get(plugin.id) ?? NO_VALUES,
+			now: scope.meta.now,
+			tx: scope.tx,
+			ctx: scope.bound.ctx
+		});
+		if (recorded !== void 0 && recorded !== null) Object.assign(into, recorded);
+	}
+}
+async function planUpdate(scope, row, op, options) {
+	const args = hookArgs(scope);
+	let base;
+	let keep = false;
+	for (const { plugin, trait, traits } of actingPlugins(scope)) {
+		if (traits.update === void 0) continue;
+		const plan = await traits.update({
+			entity: scope.entity,
+			state: trait.state,
+			operation: op,
+			options: options.get(plugin.id) ?? NO_VALUES,
+			row,
+			tx: scope.tx,
+			ctx: scope.bound.ctx
+		});
+		if (plan === void 0) continue;
+		if (base === void 0 && !keep) {
+			base = plan.base;
+			keep = plan.keep === true;
+		}
+		addArgs(args, plan.args);
+	}
+	return {
+		base: base ?? row,
+		keep,
+		args
+	};
+}
+async function updateCore(scope, args) {
+	const { entity, tx, bound } = scope;
+	const { original, op, plan } = args;
+	const { base, keep } = plan;
+	const change = plan.args.change;
+	let patch = await beforeValidate(scope, {
+		op,
+		data: args.patch,
+		original,
+		args: change
+	});
+	patch = await validateUpdate(bound.runtime, entity, base, patch);
+	patch = await beforeChange(scope, {
+		op,
+		data: patch,
+		original,
+		args: change
+	});
+	await checkReferences(scope, {
+		...base,
+		...patch
+	}, new Set(Object.keys(patch).filter((key) => patch[key] !== void 0)), { withDeleted: args.withDeleted });
+	let doc;
+	if (keep) doc = {
+		...base,
+		...patch
+	};
+	else {
+		if (Object.keys(patch).filter((k) => patch[k] !== void 0).length === 0) return { doc: original };
+		const pk = column(entity.table, entity.pk.key);
+		const updated = (await tx.update(entity.table).set(patch).where(eq(pk, original[entity.pk.key])).returning())[0];
+		if (updated === void 0) throw new InternalError(`${entity.name}: locked row vanished`);
+		doc = updated;
+	}
+	const after = {
+		...change,
+		...plan.args.afterChange
+	};
+	await record(scope, {
+		operation: op,
+		step: "update",
+		row: doc,
+		previous: base,
+		written: !keep,
+		options: args.options
+	}, after);
+	await afterChange(scope, {
+		op,
+		doc,
+		previous: base,
+		changes: changedKeys(entity, base, doc),
+		args: after
+	});
+	return { doc };
+}
+async function updateDocument(scope, original, data, opts) {
+	const plan = await planUpdate(scope, original, opts.op, opts.options);
+	return updateCore(scope, {
+		original,
+		patch: applyKindWrites(scope.entity, plan.base, data, opts.states),
+		op: opts.op,
+		plan,
+		options: opts.options,
+		withDeleted: opts.withDeleted
+	});
+}
+function planCreate(scope, row, options) {
+	const args = hookArgs(scope);
+	const set = {};
+	const rules = [];
+	for (const { plugin, trait, traits } of actingPlugins(scope)) {
+		if (traits.create === void 0) continue;
+		const plan = traits.create({
+			entity: scope.entity,
+			state: trait.state,
+			options: options.get(plugin.id) ?? NO_VALUES,
+			row,
+			now: scope.meta.now,
+			ctx: scope.bound.ctx
+		});
+		if (plan === void 0) continue;
+		for (const [key, value] of Object.entries(plan.set ?? {})) {
+			if (!(key in scope.entity.columns)) throw new InternalError(`Plugin '${plugin.id}' sets '${key}' on '${scope.entity.name}', which is not a column`, { entity: scope.entity.name });
+			set[key] = value;
+		}
+		for (const rule of plan.rules ?? []) if (!rules.includes(rule)) rules.push(rule);
+		addArgs(args, plan.args);
+	}
+	return {
+		set,
+		rules,
+		args
+	};
+}
+function createOptionKeys(bound) {
+	return [...pluginOptions(bound.runtime.plugins).create.keys()];
+}
+function updateOptionKeys(bound) {
+	return [...pluginOptions(bound.runtime.plugins).update.keys()];
+}
+async function create(entity, bound, input, rawOptions) {
+	const data = assertData(input);
+	assertScalars(entity, data);
+	const options = assertOptions(rawOptions, [
+		...createOptionKeys(bound),
+		...writeOptionKeys(bound),
+		...referenceOptionKeys(entity, bound)
+	]);
+	const values = traitOptions(entity, bound.runtime.plugins, "create", options);
+	return runOperation(bound, entity, "create", async (scope) => {
+		await beforeOperation(scope, {
+			data,
+			options
+		});
+		await writeRule(scope, "create", { data });
+		const { allowed, partition } = partitionAllowance(scope, data);
+		fieldWriteCheck(entity, scope.bound, scope.meta, data, allowed);
+		let row = applyKindWrites(entity, null, data, writeStates(entity, bound.runtime.plugins, bound.ctx, options));
+		for (const [key, { value }] of partition) row[key] = value;
+		const plan = planCreate(scope, row, values);
+		const checks = [];
+		for (const rule of plan.rules) {
+			const filter = await writeRule(scope, rule, {});
+			if (filter !== void 0) checks.push({
+				rule,
+				filter
+			});
+		}
+		Object.assign(row, plan.set);
+		const change = plan.args.change;
+		row = await beforeValidate(scope, {
+			op: "create",
+			data: row,
+			original: null,
+			args: change
+		});
+		row = applyDefaults(entity, row);
+		row = await validateCreate(bound.runtime, entity, row);
+		row = await beforeChange(scope, {
+			op: "create",
+			data: row,
+			original: null,
+			args: change
+		});
+		await checkReferences(scope, row, new Set(Object.keys(row)), options);
+		const doc = (await scope.tx.insert(entity.table).values(row).returning())[0];
+		if (doc === void 0) throw new InternalError(`${entity.name}: insert returned no row`);
+		for (const { rule, filter } of checks) {
+			const where = filterToSQL(bound.runtime.relations, entity.name, entity.table, andFilters([{ [entity.pk.key]: { eq: doc[entity.pk.key] } }, filter]));
+			if (Number(await scope.tx.$count(entity.table, where)) === 0) throw forbidden(entity.name, rule, scope.meta, `access.${rule} denies this row`);
+		}
+		const after = {
+			...change,
+			...plan.args.afterChange
+		};
+		await record(scope, {
+			operation: "create",
+			step: "create",
+			row: doc,
+			previous: null,
+			written: true,
+			options: values
+		}, after);
+		await afterChange(scope, {
+			op: "create",
+			doc,
+			previous: null,
+			changes: changedKeys(entity, null, doc),
+			args: after
+		});
+		await afterOperation(scope, doc);
+		queueAfterCommit(scope, doc, null);
+		return resultOf(scope, doc, options);
+	});
+}
+async function update(entity, bound, id, input, rawOptions) {
+	assertId(entity, id);
+	const data = assertData(input);
+	assertScalars(entity, data);
+	const options = assertOptions(rawOptions, [
+		...updateOptionKeys(bound),
+		...writeOptionKeys(bound),
+		...referenceOptionKeys(entity, bound)
+	]);
+	const values = traitOptions(entity, bound.runtime.plugins, "update", options);
+	return runOperation(bound, entity, "update", async (scope) => {
+		await beforeOperation(scope, {
+			id,
+			data,
+			options
+		});
+		const rule = await writeRule(scope, "update", { data });
+		const { allowed, partition } = partitionAllowance(scope, data);
+		fieldWriteCheck(entity, scope.bound, scope.meta, data, allowed);
+		const original = await lockRow(scope, id, [
+			partitionFilter(partition),
+			traitFilter(entity, scope.bound, scope.meta.operation, values, WRITING),
+			rule
+		]);
+		const result = await updateDocument(scope, original, data, {
+			states: writeStates(entity, bound.runtime.plugins, bound.ctx, options),
+			op: "update",
+			options: values,
+			withDeleted: options.withDeleted === true
+		});
+		await afterOperation(scope, result.doc);
+		queueAfterCommit(scope, result.doc, original);
+		return resultOf(scope, result.doc, options);
+	});
+}
+function mergedOptions(values) {
+	return Object.assign({}, ...values.values());
+}
+async function keepRow(scope, original, values) {
+	const { entity, tx } = scope;
+	const pk = column(entity.table, entity.pk.key);
+	for (const { plugin, trait, traits } of actingPlugins(scope)) {
+		const keep = traits.remove;
+		if (keep === void 0) continue;
+		const kept = keep({
+			entity,
+			state: trait.state,
+			options: values.get(plugin.id) ?? NO_VALUES,
+			row: original,
+			now: scope.meta.now,
+			update: async (patch) => {
+				const row = (await tx.update(entity.table).set(patch).where(eq(pk, original[entity.pk.key])).returning())[0];
+				if (row === void 0) throw new InternalError(`${entity.name}: locked row vanished`);
+				return row;
+			}
+		});
+		if (kept !== void 0) return kept;
+	}
+}
+async function deleteDocument(scope, original, values) {
+	const { entity, tx } = scope;
+	const options = mergedOptions(values);
+	await beforeDelete(scope, original, options);
+	const kept = await keepRow(scope, original, values);
+	let doc;
+	if (kept !== void 0) doc = kept;
+	else {
+		const pk = column(entity.table, entity.pk.key);
+		const gone = (await tx.delete(entity.table).where(eq(pk, original[entity.pk.key])).returning())[0];
+		if (gone === void 0) throw new InternalError(`${entity.name}: locked row vanished`);
+		doc = gone;
+	}
+	const args = hookArgs(scope).afterDelete;
+	const removed = kept === void 0;
+	await record(scope, {
+		operation: "delete",
+		step: "delete",
+		row: doc,
+		previous: original,
+		written: removed,
+		options: values
+	}, args);
+	const outcome = {
+		doc,
+		previous: original,
+		removed,
+		options,
+		args
+	};
+	await afterDelete(scope, outcome);
+	return outcome.doc;
+}
+function deleteOptionKeys(bound) {
+	return [...pluginOptions(bound.runtime.plugins).delete.keys()];
+}
+async function remove(entity, bound, id, rawOptions) {
+	assertId(entity, id);
+	const options = assertOptions(rawOptions, deleteOptionKeys(bound));
+	const values = traitOptions(entity, bound.runtime.plugins, "delete", options);
+	return runOperation(bound, entity, "delete", async (scope) => {
+		await beforeOperation(scope, {
+			id,
+			options
+		});
+		const rule = await writeRule(scope, "delete", { options: mergedOptions(values) });
+		const original = await lockRow(scope, id, [pluginFilter(entity, scope.bound, scope.meta.operation, values, WRITING), rule]);
+		const doc = await deleteDocument(scope, original, values);
+		await afterOperation(scope, doc);
+		queueAfterCommit(scope, doc, original);
+		return resultOf(scope, doc, {});
+	});
+}
+//#endregion
+//#region src/runtime/write/operations.ts
+function entityOperations(entity, plugins) {
+	return [...traitOperations(plugins).values()].filter((op) => entity.traits[op.plugin.id] !== void 0);
+}
+function entityOperation(entity, plugins, name) {
+	const op = traitOperations(plugins).get(name);
+	return op !== void 0 && entity.traits[op.plugin.id] !== void 0 ? op : null;
+}
+function operationInput(op, args) {
+	const input = {};
+	op.spec.args.forEach((key, i) => {
+		if (args[i] !== void 0) input[key] = args[i];
+	});
+	const trailing = args[op.spec.args.length];
+	if (op.spec.options !== void 0 && trailing !== void 0) {
+		if (!isPlainObject(trailing)) throw new BadRequestError(`${op.name}: options must be an object`);
+		for (const [key, value] of Object.entries(trailing)) if (value !== void 0) input[key] = value;
+	}
+	return input;
+}
+function operationMethods(entity, plugins, run) {
+	const out = {};
+	for (const op of entityOperations(entity, plugins)) {
+		const path = op.name.split(".");
+		let node = out;
+		for (const part of path.slice(0, -1)) node = node[part] ??= {};
+		node[path[path.length - 1]] = (...args) => run(op, args);
+	}
+	return out;
+}
+function kit(entity, bound, op, input) {
+	const name = op.name;
+	return {
+		update: (id, patch, options) => {
+			assertId(entity, id);
+			return runOperation(bound, entity, name, async (scope) => {
+				await beforeOperation(scope, input);
+				const rule = options?.rule ?? "update";
+				const filter = await writeRule(scope, rule, rule === "update" ? { data: {} } : {});
+				const original = await lockRow(scope, id, [pluginFilter(entity, scope.bound, name, NO_TRAIT_OPTIONS, WRITING), filter]);
+				const given = typeof patch === "function" ? await patch({
+					row: original,
+					tx: scope.tx,
+					now: scope.meta.now,
+					ctx: scope.bound.ctx
+				}) : patch;
+				if (given === void 0) return resultOf(scope, original, {});
+				const values = options?.options === void 0 ? NO_TRAIT_OPTIONS : /* @__PURE__ */ new Map([[op.plugin.id, options.options]]);
+				const plan = await planUpdate(scope, original, name, values);
+				const result = await updateCore(scope, {
+					original,
+					patch: { ...given },
+					op: name,
+					plan,
+					options: values
+				});
+				await afterOperation(scope, result.doc);
+				queueAfterCommit(scope, result.doc, original);
+				return resultOf(scope, result.doc, {});
+			});
+		},
+		read: async (fn, options) => {
+			await bound.runtime.ready();
+			return guard(bound.runtime, async () => {
+				const meta = operationMeta(bound.ctx, entity.name, name, bound.runtime.now());
+				const rule = options?.rule ?? "read";
+				const outcome = await evaluateRule(entity, rule, bound, meta);
+				if (outcome.kind === "deny") throw forbidden(entity.name, rule, meta, `access.${rule} denies '${name}'`);
+				if (outcome.kind === "filter") throw new ForbiddenError(`Entity '${entity.name}': access.${rule} must allow '${name}' as a whole, not return a filter`, {
+					entity: entity.name,
+					operation: name,
+					rule
+				});
+				const partition = {};
+				for (const [key, { value }] of partitionOf(entity, bound, name)) partition[key] = value;
+				return fn({
+					executor: bound.$executor,
+					partition,
+					now: meta.now,
+					ctx: bound.ctx
+				});
+			});
+		}
+	};
+}
+async function runEntityOperation(entity, bound, name, input) {
+	const op = entityOperation(entity, bound.runtime.plugins, name);
+	if (op === null) throw new UnsupportedError(`Entity '${entity.name}' has no operation '${name}'`, { entity: entity.name });
+	const given = input ?? {};
+	if (!isPlainObject(given)) throw new BadRequestError(`${name}: the input must be an object`);
+	const options = op.spec.options ?? {};
+	for (const [key, value] of Object.entries(given)) {
+		const type = options[key];
+		if (type !== void 0) checkOptionType(key, type, value);
+		else if (!op.spec.args.includes(key)) throw new BadRequestError(`${name}: unknown input '${key}'`);
+	}
+	const trait = entity.traits[op.plugin.id];
+	return op.spec.run({
+		entity,
+		state: trait?.state,
+		input: given,
+		kit: kit(entity, bound, op, given)
+	});
+}
+//#endregion
+export { allowAll as $, evaluateRule as A, pluginOptions as B, afterOperation as C, NO_TRAIT_OPTIONS as D, runOperation as E, partitionFilter as F, FALSE_FILTER as G, readStates as H, pluginFilter as I, guard as J, andFilters as K, traitFilter as L, fieldWriteCheck as M, filterToSQL as N, READING as O, forbidden as P, operationMeta as Q, kindExpression as R, afterLink as S, queueAfterCommit as T, traitOptions as U, projectCells as V, writeStates as W, CommitQueue as X, normalizeError as Y, buildContext as Z, updateDocument as _, runEntityOperation as a, resolvePlugins as at, assertData as b, create as c, lockRow as d, buildEntityMeta as et, mergedOptions as f, update as g, remove as h, operationMethods as i, definePlugin as it, fieldReadDenied as j, WRITING as k, deleteDocument as l, referenceOptionKeys as m, entityOperations as n, checkDependencies as nt, assertId as o, traitOperations as ot, partitionAllowance as p, isPlainObject as q, operationInput as r, defineFeaturePlugin as rt, assertOptions as s, entityOperation as t, defineEntity as tt, deleteOptionKeys as u, writeOptionKeys as v, beforeOperation as w, assertScalars as x, writeRule as y, kindFilterSQL as z };
+
+//# sourceMappingURL=operations-D3rOacLX.js.map