@adminiumjs/manifest 0.3.27 → 0.3.29

package/dist/roles.d.ts

@@ -36,9 +36,249 @@
  *
  * `writableValues` holds what a column is moved TO; this, what it is moved
  * FROM. It is judged on the stored row, whatever columns the update changes.
+ *
+ * `rows` says which ROWS the role's read, update or delete reaches, when it
+ * does not reach every row. A rep reads the deals they own and a manager the
+ * deals of the teams they lead:
+ *
+ * ```json
+ * "rows": { "read": { "reach": "own" }, "update": { "reach": "own" } }
+ * ```
+ *
+ * A row is somebody's by what its table says of it (`belongs`, below): a
+ * column that holds a staff member, a table that lists people against the
+ * row, or the row it hangs off. `unowned` adds the rows that are nobody's
+ * yet, and `while` keeps only the rows whose column holds one of some values
+ * now. Roles add up here too: someone whose other role reads the table with
+ * no `rows` reads every row.
+ *
+ * An action may also name SEVERAL reaches, any one of which is enough: an
+ * account manager reads every won deal, and an open one only while he is
+ * listed on it —
+ *
+ * ```json
+ * "rows": { "read": [{ "reach": "all", "while": { "column": "state", "in": ["won"] } }, { "reach": "own" }] }
+ * ```
+ *
+ * Each reach is its own whole test (its `while` and its `by` hold for it
+ * alone), as two roles' reaches are.
  */
 import { z } from 'zod';
 import { type ColumnShape, type ReferenceIssue, type TableIndex } from './refs.js';
+/** How far one action reaches: the person's own rows, their teams', or every row (only `while` some value). */
+export declare const ROW_REACHES: readonly ["own", "team", "all"];
+export declare const rowReachSchema: z.ZodObject<{
+    reach: z.ZodEnum<{
+        own: "own";
+        team: "team";
+        all: "all";
+    }>;
+    unowned: z.ZodOptional<z.ZodLiteral<true>>;
+    while: z.ZodOptional<z.ZodObject<{
+        column: z.ZodString;
+        in: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+    }, z.core.$strict>>;
+    by: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type RowReach = z.infer<typeof rowReachSchema>;
+/** The actions a row limit narrows. A create makes a new row: it is held by the links and people it names. */
+export declare const ROW_LIMIT_ACTIONS: readonly ["read", "update", "delete"];
+/** The most reaches one action names. */
+export declare const ROW_REACHES_MAX = 4;
+/** One action's reach, or several of which any one is enough (every won deal, or an open one the person is listed on). */
+export declare const rowReachesSchema: z.ZodUnion<readonly [z.ZodObject<{
+    reach: z.ZodEnum<{
+        own: "own";
+        team: "team";
+        all: "all";
+    }>;
+    unowned: z.ZodOptional<z.ZodLiteral<true>>;
+    while: z.ZodOptional<z.ZodObject<{
+        column: z.ZodString;
+        in: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+    }, z.core.$strict>>;
+    by: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>, z.ZodArray<z.ZodObject<{
+    reach: z.ZodEnum<{
+        own: "own";
+        team: "team";
+        all: "all";
+    }>;
+    unowned: z.ZodOptional<z.ZodLiteral<true>>;
+    while: z.ZodOptional<z.ZodObject<{
+        column: z.ZodString;
+        in: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+    }, z.core.$strict>>;
+    by: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>>]>;
+export type RowReaches = z.infer<typeof rowReachesSchema>;
+/** An action's reaches as a list, whether the manifest wrote one or several. */
+export declare function reachList(reaches: RowReaches | undefined): readonly RowReach[];
+/** Which rows a role's read, update and delete reach, each on its own. */
+export declare const rowsLimitSchema: z.ZodObject<{
+    read: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+        reach: z.ZodEnum<{
+            own: "own";
+            team: "team";
+            all: "all";
+        }>;
+        unowned: z.ZodOptional<z.ZodLiteral<true>>;
+        while: z.ZodOptional<z.ZodObject<{
+            column: z.ZodString;
+            in: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+        }, z.core.$strict>>;
+        by: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>, z.ZodArray<z.ZodObject<{
+        reach: z.ZodEnum<{
+            own: "own";
+            team: "team";
+            all: "all";
+        }>;
+        unowned: z.ZodOptional<z.ZodLiteral<true>>;
+        while: z.ZodOptional<z.ZodObject<{
+            column: z.ZodString;
+            in: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+        }, z.core.$strict>>;
+        by: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>]>>;
+    update: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+        reach: z.ZodEnum<{
+            own: "own";
+            team: "team";
+            all: "all";
+        }>;
+        unowned: z.ZodOptional<z.ZodLiteral<true>>;
+        while: z.ZodOptional<z.ZodObject<{
+            column: z.ZodString;
+            in: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+        }, z.core.$strict>>;
+        by: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>, z.ZodArray<z.ZodObject<{
+        reach: z.ZodEnum<{
+            own: "own";
+            team: "team";
+            all: "all";
+        }>;
+        unowned: z.ZodOptional<z.ZodLiteral<true>>;
+        while: z.ZodOptional<z.ZodObject<{
+            column: z.ZodString;
+            in: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+        }, z.core.$strict>>;
+        by: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>]>>;
+    delete: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+        reach: z.ZodEnum<{
+            own: "own";
+            team: "team";
+            all: "all";
+        }>;
+        unowned: z.ZodOptional<z.ZodLiteral<true>>;
+        while: z.ZodOptional<z.ZodObject<{
+            column: z.ZodString;
+            in: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+        }, z.core.$strict>>;
+        by: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>, z.ZodArray<z.ZodObject<{
+        reach: z.ZodEnum<{
+            own: "own";
+            team: "team";
+            all: "all";
+        }>;
+        unowned: z.ZodOptional<z.ZodLiteral<true>>;
+        while: z.ZodOptional<z.ZodObject<{
+            column: z.ZodString;
+            in: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+        }, z.core.$strict>>;
+        by: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>]>>;
+}, z.core.$strict>;
+export type RowsLimit = z.infer<typeof rowsLimitSchema>;
+/** Who a person who is limited to some rows may put in a staff column: themselves, someone they reach, or anyone. */
+export declare const STAFF_SET_RULES: readonly ["self", "team", "anyone"];
+/** What a listing row must hold to count: one of some values in a column, or a column empty (or not). */
+export declare const listingWhileSchema: z.ZodUnion<readonly [z.ZodObject<{
+    column: z.ZodString;
+    in: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+}, z.core.$strict>, z.ZodObject<{
+    column: z.ZodString;
+    isNull: z.ZodBoolean;
+}, z.core.$strict>]>;
+export type ListingWhile = z.infer<typeof listingWhileSchema>;
+/**
+ * One way a person belongs to a row of the table:
+ *
+ *  - `column`: the staff member this column holds; with `person`, the column
+ *    is a link and `person` the staff column of the row it points at (a
+ *    ticket's agent, whose own row holds the staff member);
+ *  - `through`: a table that lists people against the row — its `link` holds
+ *    this row's key (or this row's `on` column), its `user` the staff member
+ *    (or, with `person`, a link to the row that holds one), `from` / `to`
+ *    the days the listing counts on, both `date` columns (cover for a colleague on leave),
+ *    and `while` a column of the listing it counts only while it holds one of
+ *    some values, or while it is empty or not (`isNull`): a member row whose
+ *    `ended_at` is set lists nobody;
+ *  - `via`: whoever belongs to the row this link points at (a quote's deal).
+ */
+export declare const belongsWaySchema: z.ZodUnion<readonly [z.ZodObject<{
+    column: z.ZodString;
+    person: z.ZodOptional<z.ZodString>;
+    set: z.ZodOptional<z.ZodEnum<{
+        self: "self";
+        team: "team";
+        anyone: "anyone";
+    }>>;
+}, z.core.$strict>, z.ZodObject<{
+    through: z.ZodObject<{
+        table: z.ZodString;
+        link: z.ZodString;
+        on: z.ZodOptional<z.ZodString>;
+        user: z.ZodString;
+        person: z.ZodOptional<z.ZodString>;
+        from: z.ZodOptional<z.ZodString>;
+        to: z.ZodOptional<z.ZodString>;
+        while: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+            column: z.ZodString;
+            in: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+        }, z.core.$strict>, z.ZodObject<{
+            column: z.ZodString;
+            isNull: z.ZodBoolean;
+        }, z.core.$strict>]>>;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    via: z.ZodString;
+}, z.core.$strict>]>;
+export type BelongsWay = z.infer<typeof belongsWaySchema>;
+/** The ways people belong to a table's rows: any one is enough. */
+export declare const belongsSchema: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+    column: z.ZodString;
+    person: z.ZodOptional<z.ZodString>;
+    set: z.ZodOptional<z.ZodEnum<{
+        self: "self";
+        team: "team";
+        anyone: "anyone";
+    }>>;
+}, z.core.$strict>, z.ZodObject<{
+    through: z.ZodObject<{
+        table: z.ZodString;
+        link: z.ZodString;
+        on: z.ZodOptional<z.ZodString>;
+        user: z.ZodString;
+        person: z.ZodOptional<z.ZodString>;
+        from: z.ZodOptional<z.ZodString>;
+        to: z.ZodOptional<z.ZodString>;
+        while: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+            column: z.ZodString;
+            in: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+        }, z.core.$strict>, z.ZodObject<{
+            column: z.ZodString;
+            isNull: z.ZodBoolean;
+        }, z.core.$strict>]>>;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    via: z.ZodString;
+}, z.core.$strict>]>>;
+/** How many links a `via` may follow before it reaches a table people belong to directly. */
+export declare const BELONGS_VIA_MAX_STEPS = 2;
 /** One table's limit. */
 export declare const roleLimitSchema: z.ZodObject<{
     writable: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -47,6 +287,83 @@ export declare const roleLimitSchema: z.ZodObject<{
     readable: z.ZodOptional<z.ZodArray<z.ZodString>>;
     creatable: z.ZodOptional<z.ZodArray<z.ZodString>>;
     creatableValues: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>>;
+    rows: z.ZodOptional<z.ZodObject<{
+        read: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+            reach: z.ZodEnum<{
+                own: "own";
+                team: "team";
+                all: "all";
+            }>;
+            unowned: z.ZodOptional<z.ZodLiteral<true>>;
+            while: z.ZodOptional<z.ZodObject<{
+                column: z.ZodString;
+                in: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+            }, z.core.$strict>>;
+            by: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>, z.ZodArray<z.ZodObject<{
+            reach: z.ZodEnum<{
+                own: "own";
+                team: "team";
+                all: "all";
+            }>;
+            unowned: z.ZodOptional<z.ZodLiteral<true>>;
+            while: z.ZodOptional<z.ZodObject<{
+                column: z.ZodString;
+                in: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+            }, z.core.$strict>>;
+            by: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>]>>;
+        update: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+            reach: z.ZodEnum<{
+                own: "own";
+                team: "team";
+                all: "all";
+            }>;
+            unowned: z.ZodOptional<z.ZodLiteral<true>>;
+            while: z.ZodOptional<z.ZodObject<{
+                column: z.ZodString;
+                in: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+            }, z.core.$strict>>;
+            by: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>, z.ZodArray<z.ZodObject<{
+            reach: z.ZodEnum<{
+                own: "own";
+                team: "team";
+                all: "all";
+            }>;
+            unowned: z.ZodOptional<z.ZodLiteral<true>>;
+            while: z.ZodOptional<z.ZodObject<{
+                column: z.ZodString;
+                in: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+            }, z.core.$strict>>;
+            by: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>]>>;
+        delete: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+            reach: z.ZodEnum<{
+                own: "own";
+                team: "team";
+                all: "all";
+            }>;
+            unowned: z.ZodOptional<z.ZodLiteral<true>>;
+            while: z.ZodOptional<z.ZodObject<{
+                column: z.ZodString;
+                in: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+            }, z.core.$strict>>;
+            by: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>, z.ZodArray<z.ZodObject<{
+            reach: z.ZodEnum<{
+                own: "own";
+                team: "team";
+                all: "all";
+            }>;
+            unowned: z.ZodOptional<z.ZodLiteral<true>>;
+            while: z.ZodOptional<z.ZodObject<{
+                column: z.ZodString;
+                in: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+            }, z.core.$strict>>;
+            by: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>]>>;
+    }, z.core.$strict>>;
 }, z.core.$strict>;
 export type RoleLimit = z.infer<typeof roleLimitSchema>;
 /** Per table ref, the limit on the role's update there. */
@@ -57,6 +374,83 @@ export declare const roleLimitsSchema: z.ZodRecord<z.ZodString, z.ZodObject<{
     readable: z.ZodOptional<z.ZodArray<z.ZodString>>;
     creatable: z.ZodOptional<z.ZodArray<z.ZodString>>;
     creatableValues: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>>;
+    rows: z.ZodOptional<z.ZodObject<{
+        read: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+            reach: z.ZodEnum<{
+                own: "own";
+                team: "team";
+                all: "all";
+            }>;
+            unowned: z.ZodOptional<z.ZodLiteral<true>>;
+            while: z.ZodOptional<z.ZodObject<{
+                column: z.ZodString;
+                in: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+            }, z.core.$strict>>;
+            by: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>, z.ZodArray<z.ZodObject<{
+            reach: z.ZodEnum<{
+                own: "own";
+                team: "team";
+                all: "all";
+            }>;
+            unowned: z.ZodOptional<z.ZodLiteral<true>>;
+            while: z.ZodOptional<z.ZodObject<{
+                column: z.ZodString;
+                in: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+            }, z.core.$strict>>;
+            by: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>]>>;
+        update: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+            reach: z.ZodEnum<{
+                own: "own";
+                team: "team";
+                all: "all";
+            }>;
+            unowned: z.ZodOptional<z.ZodLiteral<true>>;
+            while: z.ZodOptional<z.ZodObject<{
+                column: z.ZodString;
+                in: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+            }, z.core.$strict>>;
+            by: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>, z.ZodArray<z.ZodObject<{
+            reach: z.ZodEnum<{
+                own: "own";
+                team: "team";
+                all: "all";
+            }>;
+            unowned: z.ZodOptional<z.ZodLiteral<true>>;
+            while: z.ZodOptional<z.ZodObject<{
+                column: z.ZodString;
+                in: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+            }, z.core.$strict>>;
+            by: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>]>>;
+        delete: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+            reach: z.ZodEnum<{
+                own: "own";
+                team: "team";
+                all: "all";
+            }>;
+            unowned: z.ZodOptional<z.ZodLiteral<true>>;
+            while: z.ZodOptional<z.ZodObject<{
+                column: z.ZodString;
+                in: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+            }, z.core.$strict>>;
+            by: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>, z.ZodArray<z.ZodObject<{
+            reach: z.ZodEnum<{
+                own: "own";
+                team: "team";
+                all: "all";
+            }>;
+            unowned: z.ZodOptional<z.ZodLiteral<true>>;
+            while: z.ZodOptional<z.ZodObject<{
+                column: z.ZodString;
+                in: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+            }, z.core.$strict>>;
+            by: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>]>>;
+    }, z.core.$strict>>;
 }, z.core.$strict>>;
 /** What the checks read of a role. */
 export interface RoleShape {
@@ -66,7 +460,26 @@ export interface RoleShape {
     limits?: Readonly<Record<string, RoleLimit>> | undefined;
 }
 /** Every `limits` problem across the app's roles. */
-export declare function roleLimitIssues<C extends ColumnShape>(roles: readonly RoleShape[], index: TableIndex<C>): ReferenceIssue[];
+export declare function roleLimitIssues<C extends ColumnShape>(roles: readonly RoleShape[], index: TableIndex<C>, rowTables?: RowTables): ReferenceIssue[];
+/** What the row checks read of a table beside its columns. */
+export interface BelongsTableShape {
+    ref: string;
+    belongs?: readonly BelongsWay[] | undefined;
+    private?: true | undefined;
+}
+/** What `roleLimitIssues` asks of the tables' row words. */
+export interface RowTables {
+    belongs: (ref: string) => boolean;
+    privateTables: () => readonly string[];
+}
+export declare function rowTablesOf(tables: readonly BelongsTableShape[]): RowTables;
+/**
+ * Every problem of the tables' `belongs` and `private`: a column that is not
+ * there or not of the kind the way needs, a `via` that never reaches a table
+ * people belong to directly, and a private table that is reached any way but
+ * by its own staff columns.
+ */
+export declare function belongsIssues<C extends ColumnShape>(tables: readonly BelongsTableShape[], index: TableIndex<C>, isStaff: (table: string, column: string) => boolean): ReferenceIssue[];
 /** What a role may do on a table of an add-on: read it, add rows, change rows. Never delete, export or import. */
 export declare const ROLE_ADD_ON_ACTIONS: readonly ["read", "create", "update"];
 /**
@@ -90,6 +503,83 @@ export declare const roleAddOnTableSchema: z.ZodObject<{
         readable: z.ZodOptional<z.ZodArray<z.ZodString>>;
         creatable: z.ZodOptional<z.ZodArray<z.ZodString>>;
         creatableValues: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>>;
+        rows: z.ZodOptional<z.ZodObject<{
+            read: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+                reach: z.ZodEnum<{
+                    own: "own";
+                    team: "team";
+                    all: "all";
+                }>;
+                unowned: z.ZodOptional<z.ZodLiteral<true>>;
+                while: z.ZodOptional<z.ZodObject<{
+                    column: z.ZodString;
+                    in: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+                }, z.core.$strict>>;
+                by: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>, z.ZodArray<z.ZodObject<{
+                reach: z.ZodEnum<{
+                    own: "own";
+                    team: "team";
+                    all: "all";
+                }>;
+                unowned: z.ZodOptional<z.ZodLiteral<true>>;
+                while: z.ZodOptional<z.ZodObject<{
+                    column: z.ZodString;
+                    in: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+                }, z.core.$strict>>;
+                by: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>>]>>;
+            update: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+                reach: z.ZodEnum<{
+                    own: "own";
+                    team: "team";
+                    all: "all";
+                }>;
+                unowned: z.ZodOptional<z.ZodLiteral<true>>;
+                while: z.ZodOptional<z.ZodObject<{
+                    column: z.ZodString;
+                    in: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+                }, z.core.$strict>>;
+                by: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>, z.ZodArray<z.ZodObject<{
+                reach: z.ZodEnum<{
+                    own: "own";
+                    team: "team";
+                    all: "all";
+                }>;
+                unowned: z.ZodOptional<z.ZodLiteral<true>>;
+                while: z.ZodOptional<z.ZodObject<{
+                    column: z.ZodString;
+                    in: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+                }, z.core.$strict>>;
+                by: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>>]>>;
+            delete: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+                reach: z.ZodEnum<{
+                    own: "own";
+                    team: "team";
+                    all: "all";
+                }>;
+                unowned: z.ZodOptional<z.ZodLiteral<true>>;
+                while: z.ZodOptional<z.ZodObject<{
+                    column: z.ZodString;
+                    in: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+                }, z.core.$strict>>;
+                by: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>, z.ZodArray<z.ZodObject<{
+                reach: z.ZodEnum<{
+                    own: "own";
+                    team: "team";
+                    all: "all";
+                }>;
+                unowned: z.ZodOptional<z.ZodLiteral<true>>;
+                while: z.ZodOptional<z.ZodObject<{
+                    column: z.ZodString;
+                    in: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+                }, z.core.$strict>>;
+                by: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>>]>>;
+        }, z.core.$strict>>;
     }, z.core.$strict>>;
 }, z.core.$strict>;
 export type RoleAddOnTable = z.infer<typeof roleAddOnTableSchema>;
@@ -108,6 +598,83 @@ export declare const roleAddOnTablesSchema: z.ZodArray<z.ZodObject<{
         readable: z.ZodOptional<z.ZodArray<z.ZodString>>;
         creatable: z.ZodOptional<z.ZodArray<z.ZodString>>;
         creatableValues: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>>;
+        rows: z.ZodOptional<z.ZodObject<{
+            read: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+                reach: z.ZodEnum<{
+                    own: "own";
+                    team: "team";
+                    all: "all";
+                }>;
+                unowned: z.ZodOptional<z.ZodLiteral<true>>;
+                while: z.ZodOptional<z.ZodObject<{
+                    column: z.ZodString;
+                    in: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+                }, z.core.$strict>>;
+                by: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>, z.ZodArray<z.ZodObject<{
+                reach: z.ZodEnum<{
+                    own: "own";
+                    team: "team";
+                    all: "all";
+                }>;
+                unowned: z.ZodOptional<z.ZodLiteral<true>>;
+                while: z.ZodOptional<z.ZodObject<{
+                    column: z.ZodString;
+                    in: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+                }, z.core.$strict>>;
+                by: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>>]>>;
+            update: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+                reach: z.ZodEnum<{
+                    own: "own";
+                    team: "team";
+                    all: "all";
+                }>;
+                unowned: z.ZodOptional<z.ZodLiteral<true>>;
+                while: z.ZodOptional<z.ZodObject<{
+                    column: z.ZodString;
+                    in: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+                }, z.core.$strict>>;
+                by: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>, z.ZodArray<z.ZodObject<{
+                reach: z.ZodEnum<{
+                    own: "own";
+                    team: "team";
+                    all: "all";
+                }>;
+                unowned: z.ZodOptional<z.ZodLiteral<true>>;
+                while: z.ZodOptional<z.ZodObject<{
+                    column: z.ZodString;
+                    in: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+                }, z.core.$strict>>;
+                by: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>>]>>;
+            delete: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+                reach: z.ZodEnum<{
+                    own: "own";
+                    team: "team";
+                    all: "all";
+                }>;
+                unowned: z.ZodOptional<z.ZodLiteral<true>>;
+                while: z.ZodOptional<z.ZodObject<{
+                    column: z.ZodString;
+                    in: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+                }, z.core.$strict>>;
+                by: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>, z.ZodArray<z.ZodObject<{
+                reach: z.ZodEnum<{
+                    own: "own";
+                    team: "team";
+                    all: "all";
+                }>;
+                unowned: z.ZodOptional<z.ZodLiteral<true>>;
+                while: z.ZodOptional<z.ZodObject<{
+                    column: z.ZodString;
+                    in: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+                }, z.core.$strict>>;
+                by: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>>]>>;
+        }, z.core.$strict>>;
     }, z.core.$strict>>;
 }, z.core.$strict>>;
 /** Every problem of the roles' grants on add-on tables that the app's own manifest can see. */
@@ -115,4 +682,83 @@ export declare function roleAddOnTableIssues(roles: readonly {
     key: string;
     tables?: readonly RoleAddOnTable[] | undefined;
 }[], named: ReadonlySet<string>): ReferenceIssue[];
+/**
+ * The ways a manifest's own tables could carry a private table's rows out
+ * from under it, or lean on it and stop working: each is refused where it is
+ * written. A private table's rows are read on the screen by the people they
+ * belong to; nothing is kept from them elsewhere, nothing else is reached
+ * through them, and nothing Adminium does by itself runs on them.
+ */
+export declare function privateShapeIssues(tables: readonly {
+    ref: string;
+    private?: true | undefined;
+    belongs?: readonly unknown[] | undefined;
+    states?: {
+        timed?: unknown;
+        effects?: readonly {
+            via?: string;
+        }[] | undefined;
+    } | undefined;
+    postings?: unknown;
+    adjust?: unknown;
+    columns: readonly {
+        ref: string;
+        type?: string;
+        references?: string | undefined;
+        rules?: {
+            rollup?: {
+                from: string;
+            } | undefined;
+            copy?: {
+                via: string;
+            } | undefined;
+            lookup?: {
+                table: unknown;
+            } | undefined;
+        } | undefined;
+    }[];
+}[]): ReferenceIssue[];
+/**
+ * A STORED TOTAL IS EVERY ROW'S. A `rollup` column is written whole — a count
+ * or a sum over every child row, whoever reads it. Beside a list of those
+ * child rows that its reader sees only part of, it says "14" over six rows,
+ * and hands a rep the size of everybody else's book. So a role that reaches
+ * only some rows of a table is not also shown a stored total of that table:
+ * the app works the figure out when it is read (a measure, which counts the
+ * reader's rows), or keeps the column from that role (`readable`).
+ *
+ * Not refused: a total over rows that are reached exactly as their parent is
+ * (the child's `belongs` is `via` the very link the total counts by) —
+ * whoever reads the parent reaches every one of them.
+ */
+export declare function storedTotalIssues(tables: readonly {
+    ref: string;
+    belongs?: readonly unknown[] | undefined;
+    columns: readonly {
+        ref: string;
+        rules?: {
+            rollup?: {
+                from: string;
+                via: string;
+            } | undefined;
+        } | undefined;
+    }[];
+}[], roles: readonly {
+    key: string;
+    permissions?: readonly string[] | undefined;
+    limits?: Readonly<Record<string, {
+        rows?: {
+            read?: unknown;
+        } | undefined;
+        readable?: readonly string[] | undefined;
+    } | undefined>> | undefined;
+}[]): ReferenceIssue[];
+/**
+ * Every place one of those blocks names a private table. A private table's
+ * rows are read by the people they belong to and by nothing that acts for
+ * anyone else, so a rule, a public entry, a document or a mail that names
+ * one is refused where it is written. Reads the plain document: a block it
+ * does not know the shape of is walked all the same.
+ */
+export declare function privateTableIssues(document: Readonly<Record<string, unknown>>, privateTables: readonly string[]): ReferenceIssue[];
 //# sourceMappingURL=roles.d.ts.map