@adminiumjs/manifest 0.3.5 → 0.3.7

package/dist/public-access.js

@@ -27,7 +27,11 @@
  * entry reaches the parent row: a draft's lines stay as hidden as the draft.
  */
 import { z } from 'zod';
+import { kindOf, rulesOf } from './capacity.js';
+import { formulaColumns } from './formula.js';
 import { refSchema, scalarSchema, settingRefSchema, valueFits, } from './refs.js';
+import { momentIssues, momentOffsetSchema, plainMomentSchema, wallTimeSchema } from './refs.js';
+import { conditionIssues, linkedConditionSchema, reachedOnlyByUndo, stateConditionSchema } from './states.js';
 /** The key every entry uses unless it names another. */
 export const CUSTOMER_KEY = 'customer';
 const keyNameSchema = z.string().regex(/^[a-z][a-z0-9-]{0,31}$/, 'a key name is kebab-case');
@@ -68,9 +72,27 @@ const lookupClaimSchema = z
 });
 /** Signing in by a link emailed to the address in `email`. */
 const linkClaimSchema = z.object({ verify: z.literal('email-link'), email: refSchema }).strict();
-/** Opening one row by the code in `column`, while it has not expired or been stopped. */
+/** The one or two columns of a row whose addresses its own link may go to. */
+const ownAddressSchema = z.union([refSchema, z.tuple([refSchema, refSchema])]);
+/**
+ * Opening one row by the code in `column`, while it has not expired or been
+ * stopped. `own`: the row's owner's own link — emailed only to the row's own
+ * address or handed once to whoever made the row — which opens a verified
+ * session and may change the row through the key's entries.
+ */
 const tokenClaimSchema = z
-    .object({ by: z.literal('token'), column: refSchema, expires: refSchema.optional(), stopped: refSchema.optional() })
+    .object({
+    by: z.literal('token'),
+    column: refSchema,
+    expires: refSchema.optional(),
+    stopped: refSchema.optional(),
+    own: z.literal(true).optional(),
+    /**
+     * With `own`: the text columns of this row whose addresses its own link
+     * may be emailed to (the holder's, and the friend a ticket is offered to).
+     */
+    address: ownAddressSchema.optional(),
+})
     .strict();
 export const claimSchema = z.union([lookupClaimSchema, linkClaimSchema, tokenClaimSchema]);
 /** How an identity entry claims: by details, by an emailed link, or by a token. */
@@ -97,12 +119,281 @@ export function shareCodeColumns(entries, table) {
     }
     return out;
 }
+/**
+ * Why a column of another row may never be printed in a list one level down
+ * (an email's `joins`, a document's list of names): a list is read for
+ * whoever the email or document goes to, one row further from them than the
+ * row they asked for, so no reader decides what it shows. A secret, personal
+ * data, a code (the one a shared link opens its row with, one Adminium makes,
+ * one a person typed), or a column an entry withholds from all but its
+ * holder. Null for a column any reader may see listed.
+ */
+export function unlistedColumn(m, table, column) {
+    const entries = m.publicAccess ?? [];
+    if (shareCodeColumns(entries, table).includes(column))
+        return 'the code a shared link opens its row with';
+    if (entries.some((entry) => entry.table === table && entry.withhold?.columns.includes(column) === true))
+        return 'withheld from all but its holder';
+    const columns = m.requiredSchema.tables.find((candidate) => candidate.ref === table)?.columns ?? [];
+    const rules = columns.find((candidate) => candidate.ref === column)?.rules;
+    if (rules?.['secret'] === true)
+        return 'a secret';
+    if (rules?.['personal'] === true)
+        return 'personal data';
+    if (rules?.['code'] !== undefined)
+        return 'a code';
+    if (columns.some((candidate) => candidate.rules?.['lookup']?.from === column))
+        return 'a code a person typed';
+    return null;
+}
+/*
+ * What the install guesses is personal data from a column's name, the way
+ * its classifier does on the table it makes — kept here so the validator
+ * refuses what the install would. A column's own `personal` wins either way.
+ */
+const PERSONAL_TEXT_NAMES = [
+    /(^|_)e?mail(_address)?(_|$)/,
+    /(^|_)(phone|mobile|tele?phone|fax)(_number)?(_|$)/,
+    /(^|_)ip(_address)?$/,
+    /(^|_)(address|street|city|zip|postal_code|postcode)(_|$)/,
+];
+const PERSONAL_NAMES = [
+    /(^|_)(ssn|social_security|tax_id|vat|passport|national_id|driver_licen[cs]e)(_|$)/,
+    /(^|_)(card_number|pan|iban|account_number|routing_number|bic|swift)(_|$)/,
+    /(^|_)(birth(date|day)?|dob|date_of_birth)(_|$)/,
+];
+const PEOPLE_TABLE = /(^|_)(users?|people|persons?|employees?|staff|members?|contacts?|customers?|profiles?|teachers?|students?|drivers?|agents?|authors?|patients?)(_|$)/;
+const PERSON_NAME = /^(first_name|last_name|full_name|display_name|name|username)$/;
+/** `userId` → `user_id`: the form a name is matched in. */
+function nameForm(name) {
+    return name
+        .replace(/([a-z0-9])([A-Z])/g, '$1_$2')
+        .replace(/([A-Z]+)([A-Z][a-z])/g, '$1_$2')
+        .replace(/[\s-]+/g, '_')
+        .toLowerCase();
+}
+/**
+ * Whether a column holds personal data: marked so (`personal: true`), or —
+ * unless marked otherwise — guessed so by its name as the install does: an
+ * address, a phone number, a birth date, an ID or account number, a person's
+ * first, last or full name on a table of people. Secrets are not personal
+ * data (they are never shown at all).
+ */
+export function personalColumn(table, column) {
+    const found = table.columns.find((candidate) => candidate.ref === column);
+    if (found === undefined)
+        return null;
+    const personal = found.rules?.['personal'];
+    if (personal === true)
+        return 'marked';
+    if (personal === false || found.rules?.['secret'] === true)
+        return null;
+    const name = nameForm(column);
+    // Kept as text on every engine: an enum is a text column the install reads by its name as any other.
+    const text = found.type === 'text' || found.type === 'enum';
+    if (text && PERSONAL_TEXT_NAMES.some((pattern) => pattern.test(name)))
+        return 'guessed';
+    if (PERSONAL_NAMES.some((pattern) => pattern.test(name)))
+        return 'guessed';
+    if (text && /^(first_name|last_name|full_name)$/.test(name)) {
+        const names = table.columns.map((candidate) => nameForm(candidate.ref));
+        const hasEmail = table.columns.some((candidate, i) => (candidate.type === 'text' || candidate.type === 'enum') && PERSONAL_TEXT_NAMES[0].test(names[i]));
+        if (PEOPLE_TABLE.test(nameForm(table.ref)) || (hasEmail && names.some((n) => PERSON_NAME.test(n))))
+            return 'guessed';
+    }
+    return null;
+}
 /**
  * A time no more than `within` minutes ahead — a past time always passes. A
  * kiosk takes an arrival from an hour before the visit, and a late one too.
  * Up to a day: a longer window is no window.
  */
 const timeWindowSchema = z.object({ within: z.number().int().min(1).max(1440) }).strict();
+/**
+ * One end of a window read from a moment (see `refs.ts`). Keyed by a date or
+ * a time of the row, it is that column's moment and names no column; keyed
+ * by one of the row's links, `column` is the linked row's. `or` lists
+ * moments of this row read in turn when the first is empty.
+ */
+const windowMomentSchema = z
+    .object({
+    column: refSchema.optional(),
+    time: wallTimeSchema.optional(),
+    plus: momentOffsetSchema.optional(),
+    minus: momentOffsetSchema.optional(),
+    or: z.array(plainMomentSchema).min(1).max(3).optional(),
+})
+    .strict()
+    .refine((m) => m.plus === undefined || m.minus === undefined, { message: 'a moment is shifted forward (plus) or back (minus), not both' });
+/**
+ * A change allowed only after one moment, before another, or between the two
+ * — and, keyed by a link, only while the linked row meets `where` (refunds
+ * switched on for the event).
+ */
+const momentWindowSchema = z
+    .object({ after: windowMomentSchema.optional(), before: windowMomentSchema.optional(), where: z.array(stateConditionSchema).min(1).max(8).optional() })
+    .strict()
+    .refine((w) => w.after !== undefined || w.before !== undefined || w.where !== undefined, { message: 'a window says after, before or where' });
+/** The moment one end of a window stands for, keyed by `key` of the entry's table. */
+function windowMoment(key, ref, linked) {
+    const { column, ...rest } = ref;
+    return linked ? { ...rest, column: column ?? '', via: key } : { ...rest, column: key };
+}
+/**
+ * Which rows of a codes table count when a typed code is looked up: a value a
+ * column must hold (`active = true`), or a date it must not be past
+ * (`notBefore: 'now'` on a `valid_until`, `orEmpty` for none) or before.
+ */
+export const codeWhereSchema = z
+    .array(z.union([
+    z.object({ column: refSchema, eq: scalarSchema }).strict(),
+    z.object({ column: refSchema, notBefore: z.enum(['now', 'today']), orEmpty: z.literal(true).optional() }).strict(),
+    z.object({ column: refSchema, notAfter: z.enum(['now', 'today']), orEmpty: z.literal(true).optional() }).strict(),
+]))
+    .max(4);
+/*
+ * ── A write with its child rows ──────────────────────────────────────────
+ * A create may carry the rows that belong to it (an order's lines, each
+ * line's options), two levels at most, in one write. `agrees` and `counts`
+ * say which choices fit together; they are checked by Adminium, never trusted
+ * from the browser.
+ */
+/** A path of foreign keys, followed one after another; the last names the column compared. */
+const pathSchema = z.array(refSchema).min(1).max(3);
+/**
+ * What an `agrees` rule compares a row's value with: a column of the row it
+ * belongs to (`parent`, followed along `path`), a column of a row this row
+ * points at (`via`), or a fixed value.
+ */
+const agreeTargetSchema = z.union([
+    z.object({ parent: refSchema, path: pathSchema.optional() }).strict(),
+    z.object({ via: refSchema, column: refSchema }).strict(),
+    z.object({ value: scalarSchema }).strict(),
+]);
+/**
+ * A value of the row that must agree with another: `column` (followed along
+ * `path` through foreign keys) equals, is at most, or is at least the target.
+ * `when` applies it only to rows whose value (along its own `path`) is one of
+ * `in`.
+ */
+export const agreeSchema = z
+    .object({
+    column: refSchema,
+    path: pathSchema.optional(),
+    when: z.object({ path: pathSchema.optional(), in: z.array(scalarSchema).min(1).max(32) }).strict().optional(),
+    eq: agreeTargetSchema.optional(),
+    lte: agreeTargetSchema.optional(),
+    gte: agreeTargetSchema.optional(),
+})
+    .strict();
+/**
+ * How many sibling rows may fall in one group: `by` follows this row's
+ * foreign keys to the group (an option's group), whose `min` and `max`
+ * columns bound the count. `every` names the groups judged even when no row
+ * falls in them (a required size left out): those whose `column` equals the
+ * parent row's.
+ */
+export const countsSchema = z
+    .object({
+    by: pathSchema,
+    every: z.object({ column: refSchema, eq: z.object({ parent: refSchema }).strict() }).strict().optional(),
+    min: refSchema,
+    max: refSchema,
+})
+    .strict();
+/** The largest a child column may add up to across one write: a number, or a column of the settings row. */
+const sumMaxSchema = z
+    .object({ column: refSchema, max: z.union([z.number().int().min(1), settingRefSchema]) })
+    .strict();
+/** The fields every level of child rows declares. */
+const childEntryShape = {
+    /** The child's foreign key to the row it belongs to. */
+    via: refSchema,
+    writable: z.array(refSchema),
+    /** What the reply shows of each child row; without it, the child's key only. */
+    select: z.array(refSchema).optional(),
+    defaults: z.record(refSchema, z.union([z.string(), z.number(), z.boolean()])).optional(),
+    writableValues: z.record(refSchema, valuesSchema).optional(),
+    requires: z.array(refSchema).min(1).max(8).optional(),
+    /** A whole-number column Adminium numbers 1, 2, 3… in the order the rows were sent. */
+    position: refSchema.optional(),
+    /** Rows per parent row. */
+    min: z.number().int().min(0).optional(),
+    max: z.number().int().min(1).max(200),
+    agrees: z.array(agreeSchema).min(1).max(8).optional(),
+    counts: z.array(countsSchema).min(1).max(2).optional(),
+    /** Columns that hold plain text only (no links), as on a create nobody signed in for. */
+    plainText: z.array(refSchema).min(1).max(8).optional(),
+    /** The most a column may add up to across the rows of one write (a dozen items to an order). */
+    sumMax: sumMaxSchema.optional(),
+};
+const childTablesSchema = (entry) => z.record(refSchema, entry).refine((children) => {
+    const count = Object.keys(children).length;
+    return count >= 1 && count <= 4;
+}, { message: 'one to four child tables at each level' });
+/** A child row one level down (an option of a line): no children of its own. */
+const grandchildEntrySchema = z.object(childEntryShape).strict();
+/** A child row of a create (an order's line), with at most one more level below it. */
+export const childEntrySchema = z.object({ ...childEntryShape, children: childTablesSchema(grandchildEntrySchema).optional() }).strict();
+/**
+ * The person a create is made for, found by the address typed into `email`
+ * or made when none has it (`fill` sets the new row's columns from the
+ * entry's), linked through `link`. The guest is never told which happened.
+ */
+const findOrCreateSchema = z
+    .object({
+    table: refSchema,
+    email: refSchema,
+    link: refSchema,
+    fill: z
+        .record(refSchema, refSchema)
+        .refine((fill) => Object.keys(fill).length <= 4, { message: 'a new person is filled from at most four columns' })
+        .optional(),
+    /**
+     * On a change through the row's own link: find the person only on the
+     * save that moves the row to this state (a ticket accepted), not on every
+     * save made while the row has no person.
+     */
+    on: z.object({ to: z.string().min(1).max(64) }).strict().optional(),
+})
+    .strict();
+/**
+ * Columns left out of a row: once it has a holder who is not the reader
+ * (`unlessHolder`, on rows read through a parent), and — `when` — while the
+ * row, or a row one of its links points at, holds these values (a ticket of
+ * an order not paid yet; a ticket a friend has not taken yet, read by its own
+ * link). A `when` holds for the readers of the key the entry is served
+ * through; a holder is every reader's.
+ */
+const withholdSchema = z
+    .object({
+    columns: z.array(refSchema).min(1).max(8),
+    unlessHolder: refSchema.optional(),
+    when: z
+        .object({ where: z.array(stateConditionSchema).min(1).max(8).optional(), linked: z.array(linkedConditionSchema).min(1).max(4).optional() })
+        .strict()
+        .refine((when) => when.where !== undefined || when.linked !== undefined, { message: 'a when names where, linked, or both' })
+        .optional(),
+})
+    .strict()
+    .refine((w) => w.unlessHolder !== undefined || w.when !== undefined, { message: 'a withhold names its holder, a when, or both' });
+/**
+ * What "delete my details" empties on a person's own row, and the time it
+ * stamps. `links`: it also stops the person's rows' own links (each gets a
+ * new code, which closes every session its old one opened) — an app's choice.
+ */
+const forgetSchema = z.object({ columns: z.array(refSchema).min(1).max(16), stamp: refSchema.optional(), links: z.literal(true).optional() }).strict();
+/**
+ * "Make a new link" for a signed-in person's row: its own link (`column`)
+ * gets a new code, which closes every session the old one opened, and the new
+ * link is emailed as the app's outbox message `kind` (sent once per code).
+ * On a row's own link it is "send it again": another link of the row (the
+ * one a confirmation email carries) is made again and mailed to the row's own
+ * address, only while the row holds `when`.
+ */
+const newLinkSchema = z
+    .object({ column: refSchema, kind: z.string().min(1).max(40), when: z.object({ where: z.array(stateConditionSchema).min(1).max(8) }).strict().optional() })
+    .strict();
 export const publicAccessSchema = z
     .object({
     table: refSchema,
@@ -123,6 +414,14 @@ export const publicAccessSchema = z
     claimedBy: z.object({ table: refSchema, column: refSchema, optional: z.literal(true).optional() }).strict().optional(),
     /** The session this entry needs: `verified` once the emailed code is confirmed. */
     level: z.enum(['lookup', 'verified']).optional(),
+    /** A create for a person found (or made) by the address typed (see `findOrCreateSchema`). */
+    identity: findOrCreateSchema.optional(),
+    /** A create answers, once, the new row's own link: this share-code column's code. */
+    shareLink: refSchema.optional(),
+    /** On an identity entry: what "delete my details" empties. */
+    forget: forgetSchema.optional(),
+    /** On a signed-in person's rows: "Make a new link" for a row's own link. */
+    newLink: newLinkSchema.optional(),
     /**
      * Rows readable only where a parent entry (the one on `table`, on the same
      * key) reads the row they belong to. `via` is this table's foreign key to
@@ -162,10 +461,20 @@ export const publicAccessSchema = z
      * past it may ask for a new price).
      */
     writableWhen: z
-        .record(refSchema, z.union([whenValuesSchema, z.literal('from-now'), z.literal('from-today'), z.literal('before-today'), timeWindowSchema]))
+        .record(refSchema, z.union([whenValuesSchema, z.literal('from-now'), z.literal('from-today'), z.literal('before-today'), timeWindowSchema, momentWindowSchema]))
         .optional(),
     /** A proof-of-work the browser solves before the write (or the claim) is taken. */
     humanCheck: z.literal(true).optional(),
+    /** The rows a create carries with it, by child table (see `childEntrySchema`). */
+    children: childTablesSchema(childEntrySchema).optional(),
+    /** Checks the created row's own values must pass (guests no more than a room sleeps). */
+    agrees: z.array(agreeSchema).min(1).max(8).optional(),
+    /** The same write may be asked for without writing, to see every figure Adminium would work out. */
+    dryRun: z.literal(true).optional(),
+    /** A money column the write may send its expected value for; a different figure writes nothing. */
+    expect: refSchema.optional(),
+    /** A column holding a key the browser mints, so a retried write lands on the same row. */
+    clientKey: refSchema.optional(),
     /** A create answers where the new row stands: the rows ordered at or before it. */
     rank: z
         .object({ orderBy: refSchema, where: z.object({ column: refSchema, eq: scalarSchema }).strict().optional() })
@@ -184,9 +493,29 @@ export const publicAccessSchema = z
         .object({
         perValue: z.object({ columns: z.array(refSchema).min(1).max(4), n: z.number().int().min(1).max(20) }).strict().optional(),
         perKeyHour: z.number().int().min(1).max(1000).optional(),
+        /**
+         * At most this many an hour from one visitor (an IPv6 subscriber's
+         * whole /64) through this entry: never more than the 60 every
+         * visitor is held to on any key, only fewer.
+         */
+        perIpHour: z.number().int().min(1).max(60).optional(),
+        plainText: z.array(refSchema).min(1).max(8).optional(),
+    })
+        .strict()
+        .optional(),
+    /**
+     * The limits on a change a guest makes, signed in or not: per value a day
+     * (each change that writes one of the columns counts against the value it
+     * writes — an address a ticket is sent on to), and columns that hold
+     * plain text only (the name it is sent to).
+     */
+    limits: z
+        .object({
+        perValue: z.object({ columns: z.array(refSchema).min(1).max(4), n: z.number().int().min(1).max(20) }).strict().optional(),
         plainText: z.array(refSchema).min(1).max(8).optional(),
     })
         .strict()
+        .refine((l) => l.perValue !== undefined || l.plainText !== undefined, { message: 'limits name a per-value cap, plain-text columns, or both' })
         .optional(),
     /** Refused while a bool in the settings row is false (only for a session-less create with `anonymous`). */
     requireSetting: z
@@ -216,6 +545,34 @@ export const publicAccessSchema = z
     })
         .strict()
         .optional(),
+    /** Availability: which of the table's limits it answers (absent: the first). */
+    rule: z.number().int().min(0).max(2).optional(),
+    /** Availability: say what is left, but only when little is (below a number, or a share of the pool). */
+    showLeft: z
+        .union([
+        z.object({ below: z.number().int().min(1) }).strict(),
+        z.object({ belowShare: z.number().int().min(1).max(100) }).strict(),
+    ])
+        .optional(),
+    /** Availability of a parent limit: the column of the pool's rows a page asks by (an event's ticket types). */
+    under: refSchema.optional(),
+    /**
+     * Rows readable only with a code that unlocks them: a row of `table`
+     * whose `column` holds the typed code, and whose `link` points at the row
+     * (a presale code revealing its ticket type).
+     */
+    unlockBy: z
+        .object({ table: refSchema, column: refSchema, link: refSchema, where: codeWhereSchema.optional() })
+        .strict()
+        .optional(),
+    /** Image columns any visitor may see, through the rows this entry reads. */
+    pictures: z.array(refSchema).min(1).max(4).optional(),
+    /**
+     * On rows reached through a parent: `columns` are left out unless
+     * `unlessHolder` is empty or names the session's own person (a ticket
+     * sent to a friend keeps its code from the buyer who sent it).
+     */
+    withhold: withholdSchema.optional(),
 })
     .strict();
 /**
@@ -238,6 +595,71 @@ export const publicKeySchema = z
 export const publicKeysSchema = z
     .record(keyNameSchema, publicKeySchema)
     .refine((keys) => !(CUSTOMER_KEY in keys), { message: '"customer" is the app\'s own key and is not declared here' });
+/**
+ * The own links of the rows a person of `identityTable` holds: each table a
+ * token claims with `own: true`, by its code column, and the columns of it
+ * that point at the person — the ones a signed-in read claims by, or a found
+ * person is linked through.
+ */
+export function ownLinksOfPerson(entries, identityTable) {
+    const out = [];
+    for (const entry of entries) {
+        const claim = entry.claim;
+        if (claim === undefined || !('by' in claim) || claim.own !== true)
+            continue;
+        if (out.some((link) => link.table === entry.table && link.column === claim.column))
+            continue;
+        const people = new Set();
+        for (const other of entries) {
+            if (other.table !== entry.table)
+                continue;
+            if (other.claimedBy !== undefined && other.claimedBy.table === identityTable)
+                people.add(other.claimedBy.column);
+            if (other.identity !== undefined && other.identity.table === identityTable)
+                people.add(other.identity.link);
+        }
+        if (people.size > 0)
+            out.push({ table: entry.table, column: claim.column, people: [...people].sort() });
+    }
+    return out;
+}
+/**
+ * How a message of `kind` about a row of `table` is addressed when it is
+ * sent again through the row's own link — as the kind's own producer
+ * declares it (the first producer of the kind, as the sender reads it), and
+ * only from the row: a column of the row, the person it links (the column
+ * named as the outbox's recipient link, else its one key to the recipient's
+ * table), or the outbox's fallback through this table. Null when nothing on
+ * the row addresses it (a setting's address, a column of another row, two
+ * keys to the recipient). The validator and the server ask this one function.
+ */
+export function resendAddressOf(outbox, kind, table, columnsOf) {
+    const find = (at, name) => columnsOf(at)?.find((c) => c.name === name);
+    const declared = (outbox.producers ?? []).find((producer) => producer.kind === kind);
+    const own = declared?.recipient;
+    if (own !== undefined && 'setting' in own)
+        return null;
+    if (own !== undefined) {
+        // The producing row is the one the producer links: it must be this row.
+        if (find(outbox.table, declared.link)?.references !== table || find(table, own.column) === undefined)
+            return null;
+        return { recipient: { ...own }, columns: [own.column] };
+    }
+    const columns = [];
+    let person;
+    const keys = (columnsOf(table) ?? []).filter((c) => c.references === outbox.recipient.table);
+    const link = find(table, outbox.recipient.via) !== undefined ? outbox.recipient.via : keys.length === 1 ? keys[0].name : undefined;
+    if (link !== undefined) {
+        columns.push(link);
+        person = { table: outbox.recipient.table, column: outbox.recipient.email };
+    }
+    const fallback = outbox.recipient.fallback;
+    if (fallback !== undefined && find(outbox.table, fallback.via)?.references === table && find(table, fallback.email) !== undefined)
+        columns.push(fallback.email);
+    if (columns.length === 0)
+        return null;
+    return { columns, ...(person === undefined ? {} : { person }) };
+}
 /** Everything in `publicAccess` and `publicKeys` that names something undeclared, or breaks a rule. */
 export function publicAccessIssues(entries, ctx) {
     const out = [];
@@ -251,8 +673,10 @@ export function publicAccessIssues(entries, ctx) {
             if (identity?.claim === undefined || claimKind(identity.claim) !== 'token') {
                 out.push({ path: [...at, 'requiresStaff'], message: `a key no staff signs in opens one row by its token: "${name}" needs an entry that claims by token` });
             }
+            // The owner's own link may change its row (what it may change is checked below); any other only reads.
+            const ownLink = identity?.claim !== undefined && 'by' in identity.claim && identity.claim.own === true;
             entries.forEach((entry, i) => {
-                if ((entry.key ?? CUSTOMER_KEY) === name && entry.methods.some((method) => method !== 'GET')) {
+                if (!ownLink && (entry.key ?? CUSTOMER_KEY) === name && entry.methods.some((method) => method !== 'GET')) {
                     out.push({ path: ['publicAccess', i, 'methods'], message: `"${name}" opens a row to whoever holds its link, so it only reads` });
                 }
             });
@@ -345,6 +769,26 @@ export function publicAccessIssues(entries, ctx) {
                     out.push({ path: at(list), message: `"${entry.table}" has no column "${ref}"` });
             }
         }
+        // An entry anyone may call (no claim, no parent, no session asked) shows no personal data: the install refuses it too.
+        const sessionOnly = entry.level !== undefined && entry.claim === undefined && entry.claimedBy === undefined && entry.visibleWith === undefined;
+        const anyone = entry.claim === undefined && entry.visibleWith === undefined && (entry.claimedBy === undefined || entry.claimedBy.optional === true) && !sessionOnly;
+        // An availability entry shows no row, whatever it names.
+        if (anyone && entry.kind !== 'availability') {
+            // No select shows every column but a code Adminium makes and a secret, as the install reads it.
+            const shown = entry.select ??
+                table.columns.filter((c) => c.rules?.['code'] === undefined && c.rules?.['secret'] !== true).map((c) => c.ref);
+            for (const ref of shown) {
+                const personal = personalColumn(table, ref);
+                if (personal !== null) {
+                    out.push({
+                        path: at('select'),
+                        message: personal === 'marked'
+                            ? `"${entry.table}.${ref}" is personal data, and anyone may call this entry, so it is not selected`
+                            : `"${entry.table}.${ref}" is read as personal data by its name, and anyone may call this entry, so it is not selected (a column that is not personal says \`personal: false\`)`,
+                    });
+                }
+            }
+        }
         for (const ref of [
             ...(entry.claim !== undefined && 'match' in entry.claim ? entry.claim.match : []),
             ...(entry.filters ?? []).map((f) => f.column),
@@ -467,7 +911,8 @@ export function publicAccessIssues(entries, ctx) {
         }
         else {
             for (const name of ['level', 'onClaim', 'maxOpen']) {
-                if (name === 'level' && entry.visibleWith !== undefined)
+                // A level on an entry with no claim of its own: a read for a session's holder alone (checked below).
+                if (name === 'level' && entry.claim === undefined)
                     continue;
                 if (entry[name] !== undefined)
                     out.push({ path: at(name), message: `${name} applies to an entry with claimedBy` });
@@ -482,7 +927,7 @@ export function publicAccessIssues(entries, ctx) {
             const v = entry.visibleWith;
             if (entry.claimedBy !== undefined)
                 out.push({ path: at('visibleWith'), message: 'an entry is claimed or visible with a parent, not both' });
-            const parents = entries.filter((other) => other !== entry && other.table === v.table && (other.key ?? CUSTOMER_KEY) === key && other.methods.includes('GET'));
+            const parents = entries.filter((other) => other !== entry && other.table === v.table && (other.key ?? CUSTOMER_KEY) === key && readsRows(other));
             if (parents.length === 0) {
                 out.push({ path: at('visibleWith', 'table'), message: `no entry reads "${v.table}" on the "${key}" key` });
             }
@@ -517,6 +962,26 @@ export function publicAccessIssues(entries, ctx) {
             if (entry.methods.includes('PATCH') && entry.writable === undefined) {
                 out.push({ path: at('writable'), message: 'a change through an entry visible with a parent names what it may write' });
             }
+            // A child's create names the parent it is made under by its link, which the create proves the session reaches.
+            if (creates && pointsUp && !writable.has(v.via)) {
+                out.push({ path: at('writable'), message: `this entry creates rows under "${v.table}", so "${v.via}" is writable: the parent a create names` });
+            }
+            /*
+             * A column of the child pointing at the key's own person (a note's
+             * `client_id`) is a copy the desk keeps, filled from the parent, never
+             * written by a browser — unless it is the link a create-only entry names
+             * its parent by (an extra added to the stay the stay's own link opened).
+             */
+            const person = entries.find((other) => other.claim !== undefined && (other.key ?? CUSTOMER_KEY) === key)?.table;
+            if (person !== undefined) {
+                for (const ref of entry.writable ?? []) {
+                    const found = column(ref);
+                    const namesParent = ref === v.via && creates && !patches;
+                    if (found?.type === 'fk' && found.references === person && !namesParent) {
+                        out.push({ path: at('writable'), message: `"${entry.table}.${ref}" points at the signed-in person's own table, so it is filled from the parent and never written publicly` });
+                    }
+                }
+            }
             if (hops(entries, i) > 2)
                 out.push({ path: at('visibleWith'), message: 'an entry is at most two steps from the entry its person claims' });
             if (root === undefined)
@@ -540,7 +1005,12 @@ export function publicAccessIssues(entries, ctx) {
         if (entry.humanCheck === true && entry.claimedBy !== undefined && identity !== undefined && identity.entry.humanCheck !== true) {
             out.push({ path: at('humanCheck'), message: `the "${key}" key's identity asks no proof, so this entry's proof could be skipped by claiming first` });
         }
-        if (entry.level === 'verified' && identity !== undefined && identity.entry.claim !== undefined && claimKind(identity.entry.claim) !== 'link' && !('verify' in identity.entry.claim && identity.entry.claim.verify !== undefined)) {
+        if (entry.level === 'verified' &&
+            identity !== undefined &&
+            identity.entry.claim !== undefined &&
+            claimKind(identity.entry.claim) !== 'link' &&
+            !('verify' in identity.entry.claim && identity.entry.claim.verify !== undefined) &&
+            !('own' in identity.entry.claim && identity.entry.claim.own === true)) {
             out.push({ path: at('level'), message: `the "${key}" key's identity sends no code, so no session is ever verified` });
         }
         if (entry.sensitive === true && entry.claimedBy !== undefined && entry.level !== 'verified') {
@@ -564,6 +1034,7 @@ export function publicAccessIssues(entries, ctx) {
             if (!writable.has(ref))
                 out.push({ path: at('requires'), message: `"${ref}" is not writable, so a write cannot fill it` });
         }
+        const states = table.states;
         for (const [ref, values] of Object.entries(entry.writableValues ?? {})) {
             if (!writable.has(ref))
                 out.push({ path: at('writableValues', ref), message: `"${ref}" is not writable` });
@@ -572,10 +1043,28 @@ export function publicAccessIssues(entries, ctx) {
                 for (const value of values) {
                     if (!valueFits(found, value))
                         out.push({ path: at('writableValues', ref), message: `${JSON.stringify(value)} is not a value of "${entry.table}.${ref}"` });
+                    // A guest's write names no state it saw: a state only an undo reaches is never theirs to write.
+                    else if (states?.column === ref && reachedOnlyByUndo(states, value))
+                        out.push({ path: at('writableValues', ref), message: `every move to ${JSON.stringify(value)} is an undo, which only a person makes` });
                 }
         }
-        if (entry.writableWhen !== undefined && !patches) {
-            out.push({ path: at('writableWhen'), message: 'writableWhen limits a change, and this entry changes nothing' });
+        /*
+         * A child's create inside a window read from its parent row (an extra
+         * added until the arrival day's check-in time): keyed by the link to the
+         * parent, every end a time of the parent's. The link names the parent a
+         * create is for, so the create writes it; the window is the parent's.
+         */
+        const createWindow = creates &&
+            !patches &&
+            entry.visibleWith !== undefined &&
+            Object.entries(entry.writableWhen ?? {}).every(([ref, when]) => ref === entry.visibleWith.via &&
+                typeof when === 'object' &&
+                !Array.isArray(when) &&
+                !('within' in when) &&
+                [when.after, when.before].some((end) => end !== undefined) &&
+                [when.after, when.before].every((end) => end === undefined || end.column !== undefined));
+        if (entry.writableWhen !== undefined && !patches && !createWindow) {
+            out.push({ path: at('writableWhen'), message: "writableWhen limits a change, and this entry changes nothing (a child's create takes a window read from its parent, keyed by the link)" });
         }
         for (const [ref, when] of Object.entries(entry.writableWhen ?? {})) {
             const found = column(ref);
@@ -590,6 +1079,26 @@ export function publicAccessIssues(entries, ctx) {
                 if (found.type !== 'date')
                     out.push({ path: at('writableWhen', ref), message: `"${when}" needs a date, and "${ref}" is not one` });
             }
+            else if (!Array.isArray(when) && !('within' in when)) {
+                out.push(...windowIssues(entry.table, ref, when, found, index, at('writableWhen', ref)));
+                // The dates that open a guest's own window are never theirs to move.
+                // A time of day read from the row itself opens it too: a later arrival time typed in would reopen a closed window.
+                const rowTime = (time) => typeof time === 'object' && time !== null && !('table' in time) && !('edge' in time) && typeof time.column === 'string' ? [time.column] : [];
+                const opening = [
+                    ref,
+                    ...[when.after, when.before].flatMap((end) => [
+                        ...(end !== undefined && end.column === undefined ? rowTime(end.time) : []),
+                        ...(end?.or ?? []).filter((m) => m.via === undefined).flatMap((m) => [m.column, ...rowTime(m.time)]),
+                    ]),
+                ];
+                for (const column of new Set(opening)) {
+                    if (createWindow && column === ref)
+                        continue;
+                    if (writable.has(column) || entry.writableValues?.[column] !== undefined || entry.defaults?.[column] !== undefined) {
+                        out.push({ path: at('writableWhen', ref), message: `"${column}" decides when this row may change, so a write through this entry may not set it` });
+                    }
+                }
+            }
             else if (!Array.isArray(when)) {
                 if (found.type !== 'timestamptz')
                     out.push({ path: at('writableWhen', ref), message: `"within" needs a timestamptz, and "${ref}" is not one` });
@@ -607,7 +1116,7 @@ export function publicAccessIssues(entries, ctx) {
             }
         }
         // The early refusal names one time, so an entry keeps one window.
-        const windows = Object.values(entry.writableWhen ?? {}).filter((when) => typeof when === 'object' && !Array.isArray(when));
+        const windows = Object.values(entry.writableWhen ?? {}).filter((when) => typeof when === 'object' && !Array.isArray(when) && ('within' in when || when.after !== undefined || when.before !== undefined));
         if (windows.length > 1) {
             out.push({ path: at('writableWhen'), message: 'one time window per entry: a change refused as too early names one time' });
         }
@@ -662,6 +1171,22 @@ export function publicAccessIssues(entries, ctx) {
                 }
             }
         }
+        if (entry.limits !== undefined) {
+            const limits = entry.limits;
+            if (!patches)
+                out.push({ path: at('limits'), message: 'limits apply to a change (PATCH); a create has anonymous' });
+            for (const [name, columns] of [['perValue', limits.perValue?.columns ?? []], ['plainText', limits.plainText ?? []]]) {
+                for (const ref of columns) {
+                    const found = column(ref);
+                    if (found === undefined)
+                        out.push({ path: at('limits', name), message: `"${entry.table}" has no column "${ref}"` });
+                    else if (found.type !== 'text')
+                        out.push({ path: at('limits', name), message: `"${entry.table}.${ref}" is not a text column` });
+                    else if (!(entry.writable ?? []).includes(ref))
+                        out.push({ path: at('limits', name), message: `"${ref}" is not writable, so a guest never sends it` });
+                }
+            }
+        }
         for (const [r, setting] of (entry.requireSetting ?? []).entries()) {
             if (index.column(setting.table, setting.column)?.type !== 'bool') {
                 out.push({ path: at('requireSetting', r), message: `"${setting.table}.${setting.column}" is not a bool of this app` });
@@ -697,9 +1222,163 @@ export function publicAccessIssues(entries, ctx) {
             if (entry.methods.some((method) => method !== 'GET'))
                 out.push({ path: at('methods'), message: 'availability is read-only' });
         }
+        out.push(...availabilityShapeIssues(entry, ctx, at));
+        if (entry.unlockBy !== undefined)
+            out.push(...unlockIssues(entry, entry.unlockBy, entries, ctx, at));
+        if (entry.pictures !== undefined)
+            out.push(...pictureIssues(entry, entry.pictures, entries, ctx, at));
+    });
+    out.push(...treeIssues(entries, ctx, identities, shareCodes));
+    out.push(...personIssues(entries, ctx, identities));
+    out.push(...ownAddressAndWithholdIssues(entries, ctx, identities));
+    return out;
+}
+/** `rule`, `showLeft` and `under`: which limit an availability entry answers, and how. */
+function availabilityShapeIssues(entry, ctx, at) {
+    const out = [];
+    const named = ['rule', 'showLeft', 'under'].filter((name) => entry[name] !== undefined);
+    if (named.length === 0)
+        return out;
+    if (entry.kind !== 'availability') {
+        for (const name of named)
+            out.push({ path: at(name), message: `${name} shapes an availability answer, and this entry reads rows` });
+        return out;
+    }
+    if (ctx.capacityOf === undefined)
+        return out;
+    const rules = rulesOf(ctx.capacityOf(entry.table));
+    if (rules.length === 0) {
+        for (const name of named)
+            out.push({ path: at(name), message: `${name} answers a limit, and "${entry.table}" has none` });
+        return out;
+    }
+    const index = entry.rule ?? 0;
+    const rule = rules[index];
+    if (rule === undefined) {
+        out.push({ path: at('rule'), message: `"${entry.table}" has ${String(rules.length)} limit${rules.length === 1 ? '' : 's'}, so rule is 0 to ${String(rules.length - 1)}` });
+        return out;
+    }
+    const kind = kindOf(rule);
+    if (entry.showLeft !== undefined && kind === 'slot') {
+        out.push({ path: at('showLeft'), message: 'what is left is shown of a pool: a parent or night limit' });
+    }
+    if (entry.under !== undefined) {
+        if (rule.kind !== 'parent') {
+            out.push({ path: at('under'), message: 'under asks a parent limit by a column of its pools' });
+        }
+        else {
+            const target = ctx.index.column(entry.table, rule.via)?.references;
+            if (target !== undefined && !ctx.index.has(target, entry.under))
+                out.push({ path: at('under'), message: `"${target}" has no column "${entry.under}"` });
+        }
+    }
+    if (rule.kind === 'night' && 'size' in rule.pool && rule.pool.size === 1) {
+        out.push({ path: at('rule'), message: 'availability answers a pool, not one row' });
+    }
+    return out;
+}
+/** An entry that shows rows only with the code that unlocks them. */
+function unlockIssues(entry, unlock, entries, ctx, at) {
+    const out = [];
+    const { index } = ctx;
+    if (entry.methods.length !== 1 || entry.methods[0] !== 'GET')
+        out.push({ path: at('methods'), message: 'an unlock only reads' });
+    for (const name of ['claim', 'claimedBy', 'visibleWith']) {
+        if (entry[name] !== undefined)
+            out.push({ path: at(name), message: 'an unlock is its own entry' });
+    }
+    if (entry.kind === 'availability')
+        out.push({ path: at('kind'), message: 'an unlock is its own entry' });
+    if (index.table(unlock.table) === undefined) {
+        out.push({ path: at('unlockBy', 'table'), message: `"${unlock.table}" is not a table of this app` });
+        return out;
+    }
+    const link = index.column(unlock.table, unlock.link);
+    if (link === undefined)
+        out.push({ path: at('unlockBy', 'link'), message: `"${unlock.table}" has no column "${unlock.link}"` });
+    else if (link.type !== 'fk' || link.references !== entry.table) {
+        out.push({ path: at('unlockBy', 'link'), message: `"${unlock.table}.${unlock.link}" does not point at "${entry.table}"` });
+    }
+    const code = index.column(unlock.table, unlock.column);
+    if (code === undefined) {
+        out.push({ path: at('unlockBy', 'column'), message: `"${unlock.table}" has no column "${unlock.column}"` });
+    }
+    else {
+        if (code.type !== 'text' || (code.unique !== true && code.rules?.code === undefined)) {
+            out.push({ path: at('unlockBy', 'column'), message: `a code finds one row: make "${unlock.table}.${code.ref}" unique (or unique with its scope)` });
+        }
+        if (code.rules?.code === undefined && code.rules?.normalize !== 'code') {
+            out.push({ path: at('unlockBy', 'column'), message: `"${unlock.table}.${code.ref}" is compared as a code: give it normalize "code"` });
+        }
+        if (shareCodeColumns(entries, unlock.table).includes(code.ref)) {
+            out.push({ path: at('unlockBy', 'column'), message: "a shared link's code is never looked up" });
+        }
+    }
+    (unlock.where ?? []).forEach((condition, k) => {
+        const path = at('unlockBy', 'where', k);
+        const filter = index.column(unlock.table, condition.column);
+        if (filter === undefined)
+            out.push({ path: [...path, 'column'], message: `"${unlock.table}" has no column "${condition.column}"` });
+        else if ('eq' in condition) {
+            if (!valueFits(filter, condition.eq))
+                out.push({ path: [...path, 'eq'], message: `${JSON.stringify(condition.eq)} is not a value of "${unlock.table}.${filter.ref}"` });
+        }
+        else if (filter.type !== 'date' && filter.type !== 'timestamptz') {
+            out.push({ path: [...path, 'column'], message: `"${unlock.table}.${filter.ref}" is not a date` });
+        }
     });
     return out;
 }
+/** Pictures every visitor may see: image columns the entry shows, which no browser writes. */
+function pictureIssues(entry, pictures, entries, ctx, at) {
+    const out = [];
+    if (entry.methods.length !== 1 || entry.methods[0] !== 'GET' || entry.kind === 'availability') {
+        out.push({ path: at('pictures'), message: 'pictures are shown through an entry that only reads rows' });
+    }
+    if (entry.claim !== undefined || entry.claimedBy !== undefined || entry.visibleWith !== undefined) {
+        out.push({ path: at('pictures'), message: "pictures are for every visitor; a signed-in person's own files are `files`" });
+    }
+    // A picture is fetched by an <img>, which carries no session: rows only a code opens are no rows it can show.
+    if (entry.unlockBy !== undefined)
+        out.push({ path: at('pictures'), message: 'pictures are for every visitor; rows a code unlocks are read only by whoever gave the code' });
+    // Nor rows read by a session's holder alone (an entry with a level and no claim of its own).
+    if (entry.level !== undefined && entry.claim === undefined && entry.claimedBy === undefined && entry.visibleWith === undefined) {
+        out.push({ path: at('pictures'), message: "pictures are for every visitor; rows read by a signed-in session alone are no picture an <img> can show" });
+    }
+    if ((entry.key ?? CUSTOMER_KEY) !== CUSTOMER_KEY)
+        out.push({ path: at('key'), message: "pictures are served through the app's customer key" });
+    const writes = new Set([...(entry.writable ?? []), ...Object.keys(entry.defaults ?? {})]);
+    const shareCodes = shareCodeColumns(entries, entry.table);
+    for (const ref of pictures) {
+        const found = ctx.index.column(entry.table, ref);
+        if (found === undefined) {
+            out.push({ path: at('pictures'), message: `"${entry.table}" has no column "${ref}"` });
+            continue;
+        }
+        if (found.type !== 'text' || found.semantic !== 'image') {
+            out.push({ path: at('pictures'), message: `"${entry.table}.${ref}" is not an image column: text with semantic "image"` });
+        }
+        if (writes.has(ref))
+            out.push({ path: at('pictures'), message: `"${ref}" is a picture anyone sees, so a browser never writes it` });
+        if (entry.select !== undefined && !entry.select.includes(ref))
+            out.push({ path: at('pictures'), message: `"${ref}" is not one of the columns the entry shows` });
+        if ((entry.files ?? []).includes(ref))
+            out.push({ path: at('pictures'), message: `"${ref}" is a signed-in person's file, not a picture for everyone` });
+        if (found.rules?.secret === true || found.rules?.code !== undefined || shareCodes.includes(ref)) {
+            out.push({ path: at('pictures'), message: `"${entry.table}.${ref}" is kept from readers, so it is no picture for everyone` });
+        }
+        if (found.rules?.personal === true)
+            out.push({ path: at('pictures'), message: `"${entry.table}.${ref}" is personal data, so it is no picture for everyone` });
+    }
+    return out;
+}
+/**
+ * Whether an entry reads a table's rows: a GET that is not an availability
+ * answer (free or full per slot, never a row), so it can be a child's parent.
+ */
+function readsRows(entry) {
+    return entry.methods.includes('GET') && entry.kind !== 'availability';
+}
 /**
  * The identity entry an entry's person is claimed through: its own claim,
  * its key's identity for a claimed entry, or — for one visible with a parent —
@@ -714,7 +1393,7 @@ function rootIdentity(entries, index, identities, seen = new Set()) {
         return identities.get(key)?.entry;
     if (entry.visibleWith === undefined || seen.has(index))
         return undefined;
-    const parent = entries.findIndex((other, i) => i !== index && other.table === entry.visibleWith.table && (other.key ?? CUSTOMER_KEY) === key && other.methods.includes('GET'));
+    const parent = entries.findIndex((other, i) => i !== index && other.table === entry.visibleWith.table && (other.key ?? CUSTOMER_KEY) === key && readsRows(other));
     return parent === -1 ? undefined : rootIdentity(entries, parent, identities, new Set([...seen, index]));
 }
 /** How many `visibleWith` steps an entry is from a claimed entry (a loop counts as too many). */
@@ -725,7 +1404,909 @@ function hops(entries, index, seen = new Set()) {
     if (seen.has(index))
         return Number.POSITIVE_INFINITY;
     const key = entry.key ?? CUSTOMER_KEY;
-    const parent = entries.findIndex((other, i) => i !== index && other.table === entry.visibleWith.table && (other.key ?? CUSTOMER_KEY) === key && other.methods.includes('GET'));
+    const parent = entries.findIndex((other, i) => i !== index && other.table === entry.visibleWith.table && (other.key ?? CUSTOMER_KEY) === key && readsRows(other));
     return parent === -1 ? 1 : 1 + hops(entries, parent, new Set([...seen, index]));
 }
+/**
+ * Everything wrong with a window read from moments: keyed by a date or a time
+ * of the row, its ends name no column and no linked condition; keyed by a
+ * link, each end names the linked row's column.
+ */
+function windowIssues(table, key, when, found, index, path) {
+    const out = [];
+    const linked = found.type === 'fk';
+    if (!linked && found.type !== 'date' && found.type !== 'timestamptz') {
+        out.push({ path, message: `"${table}.${key}" is neither a date, a time nor a link, so no window is read from it` });
+        return out;
+    }
+    for (const side of ['after', 'before']) {
+        const end = when[side];
+        if (end === undefined)
+            continue;
+        if (linked && end.column === undefined) {
+            out.push({ path: [...path, side, 'column'], message: `"${key}" is a link: name the column of the row it points at` });
+            continue;
+        }
+        if (!linked && end.column !== undefined) {
+            out.push({ path: [...path, side, 'column'], message: `the window is "${table}.${key}" itself, so it names no other column` });
+            continue;
+        }
+        out.push(...momentIssues(table, windowMoment(key, end, linked), index, [...path, side]));
+    }
+    if (when.where !== undefined) {
+        if (!linked || found.references === undefined || index.table(found.references) === undefined) {
+            out.push({ path: [...path, 'where'], message: `conditions on a linked row are keyed by a link of "${table}"` });
+        }
+        else {
+            const target = found.references;
+            when.where.forEach((condition, w) => out.push(...conditionIssues(target, condition, index, [...path, 'where', w])));
+        }
+    }
+    return out;
+}
+const ruledTable = (index, ref) => index.table(ref);
+const ruledColumn = (index, table, ref) => index.column(table, ref);
+const NUMBERS = ['int', 'bigint', 'decimal', 'money', 'float'];
+/** Whether a value fits a column an agreement compares: a key (of any type) is a number or a text. */
+function agreeValueFits(column, value) {
+    if (column.type === 'fk' || column.role === 'pk')
+        return typeof value === 'number' || typeof value === 'string';
+    return valueFits(column, value);
+}
+/** Whether two columns can be compared: two keys of one table, two numbers, or two texts. */
+function comparable(a, b, index) {
+    // A foreign key compares with another to the same table, or with that table's own key.
+    const keyOf = (c) => (c.type === 'fk' ? c.references : undefined);
+    if (a.type === 'fk' || b.type === 'fk') {
+        const [fk, other] = a.type === 'fk' ? [a, b] : [b, a];
+        if (other.type === 'fk')
+            return keyOf(fk) === keyOf(other);
+        return other.role === 'pk' && fk.references !== undefined && index.pk(fk.references)?.ref === other.ref && index.pk(fk.references)?.type === other.type;
+    }
+    const kind = (c) => (NUMBERS.includes(c.type) ? 'number' : c.type === 'enum' || c.type === 'text' ? 'text' : c.type);
+    return kind(a) === kind(b);
+}
+/**
+ * Follow `path` from `column` of `table`: every step but the last is a
+ * foreign key, the last is the column reached. The column reached, or an
+ * issue.
+ */
+function followPath(index, table, column, path) {
+    const start = index.column(table, column);
+    if (start === undefined)
+        return `"${table}" has no column "${column}"`;
+    if (path === undefined || path.length === 0)
+        return { column: start, table };
+    let at = start;
+    let atTable = table;
+    for (const step of path) {
+        if (at.type !== 'fk' || at.references === undefined)
+            return `"${atTable}.${at.ref}" is not a foreign key, so the path cannot go on to "${step}"`;
+        atTable = at.references;
+        const next = index.column(atTable, step);
+        if (next === undefined)
+            return `"${atTable}" has no column "${step}"`;
+        at = next;
+    }
+    return { column: at, table: atTable };
+}
+/** Everything wrong with one `agrees` rule of a row on `table`, whose parent row (if any) is on `parent`. */
+function agreeIssues(index, table, parent, agree, at) {
+    const out = [];
+    const reached = followPath(index, table, agree.column, agree.path);
+    if (typeof reached === 'string')
+        out.push({ path: at('path'), message: reached });
+    if (agree.when !== undefined) {
+        const when = followPath(index, table, agree.column, agree.when.path);
+        if (typeof when === 'string')
+            out.push({ path: at('when'), message: when });
+        else
+            for (const value of agree.when.in) {
+                if (!agreeValueFits(when.column, value))
+                    out.push({ path: at('when', 'in'), message: `${JSON.stringify(value)} is not a value of "${when.table}.${when.column.ref}"` });
+            }
+    }
+    const tests = ['eq', 'lte', 'gte'].filter((name) => agree[name] !== undefined);
+    if (tests.length !== 1) {
+        out.push({ path: at(), message: 'an agreement says one of eq, lte or gte' });
+        return out;
+    }
+    const test = tests[0];
+    const target = agree[test];
+    let other;
+    if ('parent' in target) {
+        if (parent === undefined) {
+            out.push({ path: at(test, 'parent'), message: 'the row a create makes has no parent row to agree with' });
+        }
+        else {
+            const found = followPath(index, parent, target.parent, target.path);
+            if (typeof found === 'string')
+                out.push({ path: at(test), message: found });
+            else
+                other = found.column;
+        }
+    }
+    else if ('via' in target) {
+        const via = index.column(table, target.via);
+        if (via?.type !== 'fk' || via.references === undefined)
+            out.push({ path: at(test, 'via'), message: `"${target.via}" is not a foreign key of "${table}"` });
+        else {
+            other = index.column(via.references, target.column);
+            if (other === undefined)
+                out.push({ path: at(test, 'column'), message: `"${via.references}" has no column "${target.column}"` });
+        }
+    }
+    else if (typeof reached !== 'string' && !agreeValueFits(reached.column, target.value)) {
+        out.push({ path: at(test, 'value'), message: `${JSON.stringify(target.value)} is not a value of "${reached.table}.${reached.column.ref}"` });
+    }
+    if (typeof reached !== 'string') {
+        if (test !== 'eq' && !NUMBERS.includes(reached.column.type)) {
+            out.push({ path: at(test), message: `"${reached.table}.${reached.column.ref}" is not a number, so it is not at most or at least another` });
+        }
+        if (other !== undefined && !comparable(reached.column, other, index)) {
+            out.push({ path: at(test), message: `"${reached.table}.${reached.column.ref}" (${reached.column.type}) cannot be compared with "${other.ref}" (${other.type})` });
+        }
+    }
+    return out;
+}
+/** Everything wrong with one `counts` rule of a row on `table`, whose parent row is on `parent`. */
+function countsIssues(index, table, parent, counts, at) {
+    const out = [];
+    let group = table;
+    for (const step of counts.by) {
+        const link = index.column(group, step);
+        if (link?.type !== 'fk' || link.references === undefined) {
+            out.push({ path: at('by'), message: `"${group}.${step}" is not a foreign key, so it leads to no group` });
+            return out;
+        }
+        group = link.references;
+    }
+    for (const name of ['min', 'max']) {
+        const found = index.column(group, counts[name]);
+        if (found === undefined)
+            out.push({ path: at(name), message: `"${group}" has no column "${counts[name]}"` });
+        else if (found.type !== 'int' && found.type !== 'bigint')
+            out.push({ path: at(name), message: `"${group}.${counts[name]}" is not a whole number` });
+    }
+    if (counts.every !== undefined) {
+        const column = index.column(group, counts.every.column);
+        if (column?.type !== 'fk')
+            out.push({ path: at('every', 'column'), message: `"${group}.${counts.every.column}" is not a foreign key of the group` });
+        const own = index.column(parent, counts.every.eq.parent);
+        if (own === undefined)
+            out.push({ path: at('every', 'eq', 'parent'), message: `"${parent}" has no column "${counts.every.eq.parent}"` });
+        else if (column !== undefined && !comparable(column, own, index)) {
+            out.push({ path: at('every', 'eq', 'parent'), message: `"${group}.${column.ref}" cannot be compared with "${parent}.${own.ref}"` });
+        }
+    }
+    return out;
+}
+/**
+ * A number a guest types that a money figure Adminium works out reads (a
+ * line's quantity, a stay's guests) is bounded: at least 0 and at most a
+ * stated maximum, or a browser could make a total negative or overflow it.
+ */
+function boundIssues(index, ctx, table, writable, at) {
+    const out = [];
+    const figures = ctx.figures?.(table);
+    if (figures === undefined)
+        return out;
+    for (const ref of writable) {
+        const column = ruledColumn(index, table, ref);
+        if (!figures.has(ref) || column === undefined || !NUMBERS.includes(column.type))
+            continue;
+        const bounds = column.rules?.validation;
+        if (bounds?.min === undefined || bounds.min < 0 || bounds.max === undefined) {
+            out.push({
+                path: at,
+                message: `"${table}.${ref}" is written by a guest and feeds a price Adminium works out, so it declares validation.min (at least 0) and validation.max`,
+            });
+        }
+    }
+    return out;
+}
+/** The rows a create carries (`children`), the checks it runs (`agrees`), and the dry run, price check and retry key. */
+function treeIssues(entries, ctx, identities, shareCodes) {
+    const out = [];
+    const { index } = ctx;
+    entries.forEach((entry, i) => {
+        const at = (...rest) => ['publicAccess', i, ...rest];
+        if (index.table(entry.table) === undefined)
+            return;
+        const creates = entry.methods.includes('POST');
+        const changes = entry.methods.includes('PATCH');
+        const key = entry.key ?? CUSTOMER_KEY;
+        const writable = entry.writable ?? [];
+        // A guest's own numbers feeding a figure are bounded, on every entry that writes.
+        if (creates || changes)
+            out.push(...boundIssues(index, ctx, entry.table, writable, at('writable')));
+        if (entry.children !== undefined) {
+            if (!creates)
+                out.push({ path: at('children'), message: 'child rows come with a create, and this entry creates nothing' });
+            if (entry.claim !== undefined)
+                out.push({ path: at('children'), message: 'an identity makes no child rows: its person is not made by a create here' });
+            if (entry.visibleWith !== undefined)
+                out.push({ path: at('children'), message: 'an entry visible with a parent is itself a child row; its create carries none' });
+            // Whoever may create without a session proves it once, for the whole tree.
+            const anonymous = entry.claimedBy === undefined || entry.claimedBy.optional === true || entry.identity !== undefined;
+            if (anonymous && entry.humanCheck !== true) {
+                out.push({ path: at('humanCheck'), message: 'a create anyone may make with its child rows asks the human check, once for the whole write' });
+            }
+        }
+        if (entry.dryRun === true && !creates && !changes)
+            out.push({ path: at('dryRun'), message: 'a dry run tries a create or a change, and this entry makes neither' });
+        if (entry.clientKey !== undefined && !creates)
+            out.push({ path: at('clientKey'), message: 'a retry key belongs to a create' });
+        // A row visible with a parent is created alone, not the tree's way: what belongs to a single create's tree would never run there.
+        const alone = entry.visibleWith !== undefined;
+        if (entry.clientKey !== undefined && alone)
+            out.push({ path: at('clientKey'), message: 'a row visible with a parent is created alone, and never looks a retry key up' });
+        if (entry.expect !== undefined && alone && !changes)
+            out.push({ path: at('expect'), message: 'a row visible with a parent is created alone, and never checks a price: a price check here belongs to a change' });
+        if (entry.dryRun === true && alone && !changes)
+            out.push({ path: at('dryRun'), message: 'a row visible with a parent is created alone, and is never tried first: a dry run here belongs to a change' });
+        if (entry.expect !== undefined) {
+            const column = index.column(entry.table, entry.expect);
+            if (!creates && !changes)
+                out.push({ path: at('expect'), message: 'a price check belongs to a create or a change' });
+            if (column === undefined)
+                out.push({ path: at('expect'), message: `"${entry.table}" has no column "${entry.expect}"` });
+            else if (column.type !== 'decimal' && column.type !== 'money')
+                out.push({ path: at('expect'), message: `"${entry.table}.${entry.expect}" is not a money column` });
+            else if (!ctx.decided(entry.table).has(entry.expect))
+                out.push({ path: at('expect'), message: `"${entry.table}.${entry.expect}" is not a figure Adminium works out, so there is nothing to check` });
+            if (!(entry.select ?? []).includes(entry.expect))
+                out.push({ path: at('expect'), message: `"${entry.expect}" is checked, so the entry shows it (select)` });
+        }
+        if (entry.clientKey !== undefined) {
+            const column = ruledColumn(index, entry.table, entry.clientKey);
+            const ref = entry.clientKey;
+            if (column === undefined)
+                out.push({ path: at('clientKey'), message: `"${entry.table}" has no column "${ref}"` });
+            else {
+                if (column.type !== 'text')
+                    out.push({ path: at('clientKey'), message: `"${entry.table}.${ref}" is not a text column` });
+                if (column.unique !== true)
+                    out.push({ path: at('clientKey'), message: `"${entry.table}.${ref}" finds one row by its key, so it is unique` });
+            }
+            if (!writable.includes(ref))
+                out.push({ path: at('clientKey'), message: `"${ref}" is sent by the browser, so it is writable` });
+            // The key answers the row it made to whoever holds it: never shown, filtered or ordered by.
+            const read = [...(entry.select ?? []), ...(entry.filters ?? []).map((f) => f.column), ...(entry.rank === undefined ? [] : [entry.rank.orderBy])];
+            if (read.includes(ref))
+                out.push({ path: at('clientKey'), message: `"${ref}" is a retry key, so no entry shows, filters or orders by it` });
+            entries.forEach((other, j) => {
+                if (j === i || other.table !== entry.table)
+                    return;
+                const shown = [...(other.select ?? []), ...(other.filters ?? []).map((f) => f.column), ...(other.rank === undefined ? [] : [other.rank.orderBy])];
+                if (shown.includes(ref))
+                    out.push({ path: ['publicAccess', j, 'select'], message: `"${entry.table}.${ref}" is a retry key, so no entry shows, filters or orders by it` });
+            });
+        }
+        (entry.agrees ?? []).forEach((agree, a) => out.push(...agreeIssues(index, entry.table, undefined, agree, (...rest) => at('agrees', a, ...rest))));
+        if (entry.children === undefined)
+            return;
+        // The people of the key (and a person found by address) are never made as a child row.
+        const people = new Set([identities.get(key)?.entry.table, entry.identity?.table].filter((t) => t !== undefined));
+        const seen = new Set([entry.table]);
+        const walk = (children, parent, level, base) => {
+            for (const [name, child] of Object.entries(children)) {
+                const here = (...rest) => [...base, name, ...rest];
+                const table = ruledTable(index, name);
+                if (table === undefined) {
+                    out.push({ path: here(), message: `"${name}" is not a table of this app` });
+                    continue;
+                }
+                if (seen.has(name))
+                    out.push({ path: here(), message: `"${name}" is in this write twice` });
+                seen.add(name);
+                if (people.has(name))
+                    out.push({ path: here(), message: `"${name}" holds the people who sign in, and a create never makes one as a child row` });
+                const via = index.column(name, child.via);
+                if (via?.type !== 'fk' || via.references !== parent)
+                    out.push({ path: here('via'), message: `"${name}.${child.via}" does not point at "${parent}"` });
+                const lists = [
+                    ['writable', child.writable],
+                    ['select', child.select ?? []],
+                    ['requires', child.requires ?? []],
+                    ['plainText', child.plainText ?? []],
+                    ['defaults', Object.keys(child.defaults ?? {})],
+                    ['writableValues', Object.keys(child.writableValues ?? {})],
+                    ['position', child.position === undefined ? [] : [child.position]],
+                ];
+                for (const [list, refs] of lists) {
+                    for (const ref of refs)
+                        if (!index.has(name, ref))
+                            out.push({ path: here(list), message: `"${name}" has no column "${ref}"` });
+                }
+                // What Adminium fills: its decided columns, the state, the link to the parent, the position, a person's key.
+                const decided = new Set([...ctx.decided(name), child.via, ...(child.position === undefined ? [] : [child.position])]);
+                if (table.states !== undefined)
+                    decided.add(table.states.column);
+                for (const ref of child.writable) {
+                    if (decided.has(ref))
+                        out.push({ path: here('writable'), message: `"${ref}" is decided by Adminium and cannot be written publicly` });
+                    const column = index.column(name, ref);
+                    if (column?.type === 'fk' && column.references !== undefined && people.has(column.references)) {
+                        out.push({ path: here('writable'), message: `"${name}.${ref}" points at the people who sign in, so it is filled by Adminium and never written publicly` });
+                    }
+                }
+                for (const ref of child.requires ?? []) {
+                    if (!child.writable.includes(ref))
+                        out.push({ path: here('requires'), message: `"${ref}" is not writable, so a write cannot fill it` });
+                }
+                for (const [ref, values] of Object.entries(child.writableValues ?? {})) {
+                    if (!child.writable.includes(ref))
+                        out.push({ path: here('writableValues', ref), message: `"${ref}" is not writable` });
+                    const column = index.column(name, ref);
+                    if (column !== undefined)
+                        for (const value of values) {
+                            if (!valueFits(column, value))
+                                out.push({ path: here('writableValues', ref), message: `${JSON.stringify(value)} is not a value of "${name}.${ref}"` });
+                        }
+                }
+                for (const ref of child.plainText ?? []) {
+                    const column = index.column(name, ref);
+                    if (column !== undefined && column.type !== 'text')
+                        out.push({ path: here('plainText'), message: `"${name}.${ref}" is not a text column` });
+                    else if (!child.writable.includes(ref))
+                        out.push({ path: here('plainText'), message: `"${ref}" is not writable, so a guest never types it` });
+                }
+                for (const ref of child.select ?? []) {
+                    if (shareCodes.get(name)?.has(ref) === true)
+                        out.push({ path: here('select'), message: `"${name}.${ref}" is the code a shared link opens its row with: no entry shows, filters or orders by it` });
+                }
+                if (child.position !== undefined) {
+                    const column = index.column(name, child.position);
+                    if (column !== undefined && column.type !== 'int' && column.type !== 'bigint')
+                        out.push({ path: here('position'), message: `"${name}.${child.position}" is not a whole number` });
+                }
+                if (child.min !== undefined && child.min > child.max)
+                    out.push({ path: here('min'), message: 'a child table asks for no more rows than it allows' });
+                if (child.sumMax !== undefined) {
+                    const sum = child.sumMax;
+                    const column = index.column(name, sum.column);
+                    if (column === undefined)
+                        out.push({ path: here('sumMax', 'column'), message: `"${name}" has no column "${sum.column}"` });
+                    else if (!NUMBERS.includes(column.type) || column.type === 'float')
+                        out.push({ path: here('sumMax', 'column'), message: `"${name}.${sum.column}" is not a number to add up` });
+                    if (typeof sum.max === 'object') {
+                        const setting = index.column(sum.max.table, sum.max.column);
+                        if (setting === undefined)
+                            out.push({ path: here('sumMax', 'max'), message: `"${sum.max.table}" has no column "${sum.max.column}"` });
+                        else if (setting.type !== 'int' && setting.type !== 'bigint')
+                            out.push({ path: here('sumMax', 'max'), message: `"${sum.max.table}.${sum.max.column}" is not a whole number` });
+                    }
+                }
+                out.push(...boundIssues(index, ctx, name, child.writable, here('writable')));
+                (child.agrees ?? []).forEach((agree, a) => out.push(...agreeIssues(index, name, parent, agree, (...rest) => here('agrees', a, ...rest))));
+                (child.counts ?? []).forEach((counts, c) => out.push(...countsIssues(index, name, parent, counts, (...rest) => here('counts', c, ...rest))));
+                if (child.children !== undefined) {
+                    if (level >= 2)
+                        out.push({ path: here('children'), message: 'child rows go two levels below the create at most' });
+                    else
+                        walk(child.children, name, level + 1, here('children'));
+                }
+            }
+        };
+        walk(entry.children, entry.table, 1, at('children'));
+    });
+    return out;
+}
+/**
+ * The columns of `table` whose value comes, directly or through a formula,
+ * from the row `link` points at: a copy or a nightly price read through it,
+ * a stamp copying one, a formula over one.
+ */
+function readThrough(table, link) {
+    const out = new Set();
+    for (const column of table.columns) {
+        const rules = column.rules;
+        if (rules?.copy?.via === link || rules?.perNight?.rate.via === link)
+            out.add(column.ref);
+    }
+    for (let changed = true; changed;) {
+        changed = false;
+        for (const column of table.columns) {
+            if (out.has(column.ref))
+                continue;
+            const rules = column.rules;
+            const set = rules?.stamp?.set;
+            const reads = [
+                ...(rules?.formula === undefined ? [] : formulaColumns(rules.formula)),
+                ...(typeof set === 'object' && set !== null && typeof set.copy === 'string' ? [set.copy] : []),
+            ];
+            if (reads.some((ref) => out.has(ref))) {
+                out.add(column.ref);
+                changed = true;
+            }
+        }
+    }
+    return out;
+}
+/** A person found by address (`identity`), a row's own link (`shareLink`, `own`), forgetting, and reads for a session alone. */
+function personIssues(entries, ctx, identities) {
+    const out = [];
+    const { index } = ctx;
+    const ownKeys = new Set([...identities].filter(([, identity]) => identity.entry.claim !== undefined && 'by' in identity.entry.claim && identity.entry.claim.own === true).map(([key]) => key));
+    /** The tables people sign in as by an emailed link, by key. */
+    const linkIdentity = (key) => {
+        const found = identities.get(key)?.entry;
+        return found?.claim !== undefined && claimKind(found.claim) === 'link' ? found : undefined;
+    };
+    entries.forEach((entry, i) => {
+        const at = (...rest) => ['publicAccess', i, ...rest];
+        const table = ruledTable(index, entry.table);
+        if (table === undefined)
+            return;
+        const key = entry.key ?? CUSTOMER_KEY;
+        const writable = entry.writable ?? [];
+        if (entry.identity !== undefined) {
+            const id = entry.identity;
+            const here = (...rest) => at('identity', ...rest);
+            // Found or made on a create; or on a change through the row's own link (a ticket accepted by a friend).
+            const change = ownKeys.has(key) && entry.methods.includes('PATCH') && !entry.methods.includes('POST');
+            if (!change && (entry.methods.length !== 1 || entry.methods[0] !== 'POST')) {
+                out.push({ path: at('methods'), message: 'a person is found by address on a create alone, or on a change through the row\'s own link' });
+            }
+            if (!change && entry.claim !== undefined)
+                out.push({ path: at('identity'), message: 'an identity entry claims its person; it does not find one by address' });
+            if (id.on !== undefined) {
+                const states = table.states;
+                const stateColumn = states === undefined ? undefined : ruledColumn(index, entry.table, states.column);
+                if (!change)
+                    out.push({ path: here('on'), message: 'a create finds its person when it is made; "on" names the move of a change through the row\'s own link' });
+                else if (states === undefined || stateColumn === undefined)
+                    out.push({ path: here('on'), message: `"${entry.table}" has no states, so no move finds the person` });
+                else {
+                    if (!valueFits(stateColumn, id.on.to))
+                        out.push({ path: here('on', 'to'), message: `"${id.on.to}" is not a state of "${entry.table}.${states.column}"` });
+                    const values = entry.writableValues?.[states.column];
+                    if (!writable.includes(states.column) || (values !== undefined && !values.includes(id.on.to))) {
+                        out.push({ path: here('on', 'to'), message: `this entry never moves "${entry.table}" to "${id.on.to}", so the person would never be found` });
+                    }
+                }
+            }
+            if (entry.visibleWith !== undefined)
+                out.push({ path: at('identity'), message: 'a row visible with a parent belongs to the parent\'s person; it does not find one by address' });
+            // The person signs in by a link to that address: on this key, or (for an own link) on any of the app's keys.
+            const signIn = change
+                ? entries.find((other) => other.table === id.table && other.claim !== undefined && claimKind(other.claim) === 'link')
+                : linkIdentity(key);
+            if (signIn === undefined || signIn.table !== id.table) {
+                out.push({ path: here('table'), message: `a person found by address signs in by a link to it: "${id.table}" needs an identity entry that claims by an emailed link${change ? '' : ` on the "${key}" key`}` });
+            }
+            const people = ruledTable(index, id.table);
+            const email = ruledColumn(index, entry.table, id.email);
+            if (email === undefined)
+                out.push({ path: here('email'), message: `"${entry.table}" has no column "${id.email}"` });
+            else {
+                if (email.type !== 'text')
+                    out.push({ path: here('email'), message: `"${entry.table}.${id.email}" is not a text column` });
+                if (email.rules?.validation?.format !== 'email')
+                    out.push({ path: here('email'), message: `"${entry.table}.${id.email}" holds an address, so it checks one (validation.format: "email")` });
+            }
+            // On a change through the row's own link, the address may instead be one the link was emailed to: holding the link proves it.
+            const proved = change && ownAddressesOf(identities.get(key)?.entry.claim).includes(id.email);
+            if (!writable.includes(id.email) && !proved)
+                out.push({ path: here('email'), message: `"${id.email}" is typed by the guest, so it is writable` });
+            if (!change && !(entry.requires ?? []).includes(id.email))
+                out.push({ path: here('email'), message: `"${id.email}" finds the person, so a create requires it` });
+            // The person's own address: one row per address, kept trimmed and in lower case, emptied when forgotten.
+            const claimed = signIn?.claim !== undefined && 'email' in signIn.claim ? signIn.claim.email : undefined;
+            const stored = claimed === undefined ? undefined : ruledColumn(index, id.table, claimed);
+            if (stored !== undefined) {
+                if (stored.unique !== true)
+                    out.push({ path: here('table'), message: `"${id.table}.${stored.ref}" finds one person by address, so it is unique` });
+                if (stored.rules?.normalize !== 'email')
+                    out.push({ path: here('table'), message: `"${id.table}.${stored.ref}" is compared as typed, so it is stored trimmed and in lower case (normalize: "email")` });
+                if (stored.nullable !== true)
+                    out.push({ path: here('table'), message: `"${id.table}.${stored.ref}" is emptied when a person is forgotten, so it is nullable` });
+                if (email !== undefined && (stored.maxLength ?? Number.POSITIVE_INFINITY) < (email.maxLength ?? Number.POSITIVE_INFINITY)) {
+                    out.push({ path: here('table'), message: `"${id.table}.${stored.ref}" holds fewer characters than "${entry.table}.${id.email}"` });
+                }
+            }
+            const link = index.column(entry.table, id.link);
+            if (link === undefined)
+                out.push({ path: here('link'), message: `"${entry.table}" has no column "${id.link}"` });
+            else {
+                if (link.type !== 'fk' || link.references !== id.table)
+                    out.push({ path: here('link'), message: `"${entry.table}.${id.link}" does not point at "${id.table}"` });
+                if (link.nullable !== true)
+                    out.push({ path: here('link'), message: `"${entry.table}.${id.link}" stays empty when the address only looks like one on file, so it is nullable` });
+            }
+            // Showing it would say whether the address was already a customer's.
+            if ((entry.select ?? []).includes(id.link))
+                out.push({ path: at('select'), message: `"${id.link}" would tell whether the address was on file, so it is never shown` });
+            if (writable.includes(id.link))
+                out.push({ path: at('writable'), message: `"${id.link}" is filled by Adminium and cannot be written publicly` });
+            if (!change) {
+                const by = entry.claimedBy;
+                if (by === undefined || by.table !== id.table || by.column !== id.link || by.optional !== true) {
+                    out.push({ path: at('claimedBy'), message: `a signed-in guest's create links them as it always has: claimedBy {table: "${id.table}", column: "${id.link}", optional: true}` });
+                }
+                if (entry.humanCheck !== true)
+                    out.push({ path: at('humanCheck'), message: 'a create that finds a person by address asks the human check' });
+                if (!(entry.anonymous?.perValue?.columns ?? []).includes(id.email)) {
+                    out.push({ path: at('anonymous', 'perValue'), message: `a create that finds a person by address is limited per address: anonymous.perValue counts "${id.email}"` });
+                }
+            }
+            if (people !== undefined) {
+                const peopleDecided = ctx.decided(id.table);
+                const filled = new Set([...(claimed === undefined ? [] : [claimed]), ...Object.keys(id.fill ?? {})]);
+                for (const [target, source] of Object.entries(id.fill ?? {})) {
+                    const column = ruledColumn(index, id.table, target);
+                    if (column === undefined)
+                        out.push({ path: here('fill', target), message: `"${id.table}" has no column "${target}"` });
+                    else if (column.type !== 'text' || column.role === 'pk' || target === claimed) {
+                        out.push({ path: here('fill', target), message: `"${id.table}.${target}" is not a text column a new person is filled with` });
+                    }
+                    else if (peopleDecided.has(target) || column.rules?.secret === true || shareCodeColumns(entries, id.table).includes(target)) {
+                        out.push({ path: here('fill', target), message: `"${id.table}.${target}" is Adminium's or a secret, so a create never fills it` });
+                    }
+                    else if (column.unique === true) {
+                        // A clash would refuse only the create that makes a person: a way to ask whether one exists.
+                        out.push({ path: here('fill', target), message: `"${id.table}.${target}" is unique, so filling it would refuse only a new person` });
+                    }
+                    if (!writable.includes(source))
+                        out.push({ path: here('fill', target), message: `"${source}" is not writable, so it holds nothing to fill with` });
+                }
+                // A person made from only what the guest typed: a column a new row could never fill refuses only strangers.
+                for (const column of people.columns) {
+                    if (column.role !== undefined || column.nullable === true || column.default !== undefined || peopleDecided.has(column.ref) || filled.has(column.ref))
+                        continue;
+                    out.push({ path: here('fill'), message: `"${id.table}.${column.ref}" must be given when a person is made, and nothing fills it` });
+                }
+                // Making a person must look like finding one: nothing numbered, counted or mailed on its create.
+                if (people.columns.some((column) => column.rules?.sequence !== undefined)) {
+                    out.push({ path: here('table'), message: `"${id.table}" numbers its rows, which a new person would take and a known one would not` });
+                }
+                if (people.capacity !== undefined || people.booking !== undefined) {
+                    out.push({ path: here('table'), message: `"${id.table}" carries a limit, which a new person would count against and a known one would not` });
+                }
+                if (ctx.mailsOnCreate?.(id.table) === true) {
+                    out.push({ path: here('table'), message: `a message is sent when a "${id.table}" row is made, which would tell a stranger's order apart from its owner's` });
+                }
+            }
+            // Nothing the creating row works out or shows reads the found person: a stranger typing the address would see it.
+            for (const ref of readThrough(table, id.link)) {
+                out.push({ path: at('identity', 'link'), message: `"${entry.table}.${ref}" reads the person "${id.link}" points at, whom a stranger may have typed the address of: nothing on "${entry.table}" reads through it` });
+            }
+            const walkChildren = (children, parent, base) => {
+                for (const [name, child] of Object.entries(children ?? {})) {
+                    const own = ruledTable(index, name);
+                    if (own === undefined)
+                        continue;
+                    const tainted = new Set([id.link, ...readThrough(table, id.link)]);
+                    for (const ref of child.select ?? []) {
+                        const copy = own.columns.find((column) => column.ref === ref)?.rules?.copy;
+                        if (copy !== undefined && copy.via === child.via && parent === entry.table && tainted.has(copy.from)) {
+                            out.push({ path: [...base, name, 'select'], message: `"${name}.${ref}" copies "${entry.table}.${copy.from}", the person found by address, so it is never shown` });
+                        }
+                    }
+                    walkChildren(child.children, name, [...base, name, 'children']);
+                }
+            };
+            walkChildren(entry.children, entry.table, at('children'));
+        }
+        if (entry.shareLink !== undefined) {
+            const ref = entry.shareLink;
+            if (!entry.methods.includes('POST'))
+                out.push({ path: at('shareLink'), message: 'a row\'s own link is answered by the create that makes it' });
+            const opens = entries.some((other) => other.table === entry.table && other.claim !== undefined && 'by' in other.claim && other.claim.column === ref && other.claim.own === true);
+            if (!opens)
+                out.push({ path: at('shareLink'), message: `"${entry.table}.${ref}" is answered as the row's own link, so a token claim on "${entry.table}" opens by it with own: true` });
+        }
+        if (entry.forget !== undefined) {
+            const claim = entry.claim;
+            const here = (...rest) => at('forget', ...rest);
+            const verifies = claim !== undefined && (claimKind(claim) === 'link' || ('verify' in claim && claim.verify === 'email-code'));
+            if (!verifies)
+                out.push({ path: at('forget'), message: 'a person forgets their details on the identity they sign in with by email' });
+            const decided = ctx.decided(entry.table);
+            for (const ref of entry.forget.columns) {
+                const column = index.column(entry.table, ref);
+                if (column === undefined)
+                    out.push({ path: here('columns'), message: `"${entry.table}" has no column "${ref}"` });
+                else if (column.role === 'pk')
+                    out.push({ path: here('columns'), message: `"${ref}" is the key of the person, which is kept` });
+                else if (column.nullable !== true && column.type !== 'bool')
+                    out.push({ path: here('columns'), message: `"${entry.table}.${ref}" is never empty, so it cannot be forgotten` });
+                else if (decided.has(ref))
+                    out.push({ path: here('columns'), message: `"${ref}" is decided by Adminium, which keeps it` });
+            }
+            const address = claim !== undefined && 'email' in claim ? claim.email : undefined;
+            if (address !== undefined && !entry.forget.columns.includes(address)) {
+                out.push({ path: here('columns'), message: `"${address}" signs the person in, so forgetting them empties it` });
+            }
+            if (entry.forget.links === true && ownLinksOfPerson(entries, entry.table).length === 0) {
+                out.push({ path: here('links'), message: `no row a "${entry.table}" person holds opens by its own link, so there is no link to stop` });
+            }
+            if (entry.forget.stamp !== undefined) {
+                const stamp = index.column(entry.table, entry.forget.stamp);
+                if (stamp === undefined)
+                    out.push({ path: here('stamp'), message: `"${entry.table}" has no column "${entry.forget.stamp}"` });
+                else if (stamp.type !== 'timestamptz' || stamp.nullable !== true)
+                    out.push({ path: here('stamp'), message: `"${entry.table}.${entry.forget.stamp}" is not a nullable timestamptz` });
+                if (entry.forget.columns.includes(entry.forget.stamp))
+                    out.push({ path: here('stamp'), message: 'the time a person was forgotten is kept, not emptied' });
+            }
+        }
+        if (entry.newLink !== undefined) {
+            const here = (...rest) => at('newLink', ...rest);
+            const signIn = identities.get(key)?.entry;
+            const verifies = signIn?.claim !== undefined && (claimKind(signIn.claim) === 'link' || ('verify' in signIn.claim && signIn.claim.verify === 'email-code'));
+            // A row's own link asks for another link of its row again: never its own code, which the asking session opened by.
+            const ownLink = entry.claim !== undefined && 'by' in entry.claim && entry.claim.own === true ? entry.claim : undefined;
+            if (ownLink !== undefined) {
+                const others = entries.filter((other) => other.table === entry.table && (other.key ?? CUSTOMER_KEY) !== key && other.claim !== undefined && 'by' in other.claim && other.claim.own === true);
+                if (!entry.methods.includes('GET'))
+                    out.push({ path: at('newLink'), message: 'a new link is asked for through a row\'s own link that reads the row (GET)' });
+                if (entry.newLink.column === ownLink.column) {
+                    out.push({ path: here('column'), message: `"${entry.table}.${ownLink.column}" is the code this link opens the row by: the session asking would be closed by its own new link` });
+                }
+                else if (!others.some((other) => other.claim.column === entry.newLink.column)) {
+                    out.push({ path: here('column'), message: `"${entry.table}.${entry.newLink.column}" is no own link another key opens "${entry.table}" by (a token claim with own: true)` });
+                }
+            }
+            else if (!entry.methods.includes('GET') || entry.claimedBy === undefined || entry.claimedBy.optional === true || !verifies) {
+                out.push({ path: at('newLink'), message: 'a new link is made for a row a person reads signed in by email (claimedBy), or through a row\'s own link, and nowhere else' });
+            }
+            else if (!ownLinksOfPerson(entries, signIn.table).some((link) => link.table === entry.table && link.column === entry.newLink.column)) {
+                out.push({ path: here('column'), message: `"${entry.table}.${entry.newLink.column}" is no own link of a row this person holds (a token claim with own: true)` });
+            }
+            const box = ctx.outbox;
+            if (box === undefined)
+                out.push({ path: here('kind'), message: 'a new link is emailed by the app\'s outbox, and the app has none' });
+            else {
+                if (box.kinds[entry.newLink.kind] === undefined)
+                    out.push({ path: here('kind'), message: `"${entry.newLink.kind}" is not one of the outbox's kinds` });
+                if (box.columns.repeatKey === undefined)
+                    out.push({ path: here('kind'), message: 'each new link is its own message, so the outbox keeps a repeatKey column' });
+                // Sent by the kind's own rules: never past a person's approval, and never skipped at send as a message already sent.
+                const declared = (box.producers ?? []).find((producer) => producer.kind === entry.newLink.kind);
+                if (declared?.hold === true)
+                    out.push({ path: here('kind'), message: `"${entry.newLink.kind}" waits for a person to approve it, so it is never sent again from a link` });
+                if (declared?.repeatBy !== undefined && declared.repeatBy !== entry.newLink.column) {
+                    out.push({ path: here('kind'), message: `"${entry.newLink.kind}" is sent once per "${declared.repeatBy}", so one sent again for a new "${entry.newLink.column}" would be skipped: its producer repeats by "${entry.newLink.column}" or by nothing` });
+                }
+                const linked = Object.values(box.links ?? {}).some((column) => index.column(box.table, column)?.references === entry.table);
+                if (!linked)
+                    out.push({ path: here('kind'), message: `the outbox links no message to "${entry.table}", so the new link could not be sent about its row` });
+                // Sent to the person who asked for it: the outbox addresses the people this entry's rows are claimed by.
+                if (entry.claimedBy !== undefined && box.recipient !== undefined && box.recipient.table !== entry.claimedBy.table) {
+                    out.push({ path: here('kind'), message: `the outbox writes to "${box.recipient.table}", not "${entry.claimedBy.table}" who asks for the new link` });
+                }
+                // Through a row's own link, sent to the row's own address: as the kind's own producer addresses it, from the row alone.
+                if (entry.claimedBy === undefined && entry.claim !== undefined && 'by' in entry.claim && box.recipient !== undefined) {
+                    const columnsOf = (at) => index.table(at)?.columns.map((c) => ({ name: c.ref, references: c.references ?? null }));
+                    const address = resendAddressOf({ table: box.table, recipient: box.recipient, producers: box.producers }, entry.newLink.kind, entry.table, columnsOf);
+                    if (address === null) {
+                        out.push({ path: here('kind'), message: `"${entry.newLink.kind}" is not addressed from a "${entry.table}" row (its producer's recipient, the person the row links, or the outbox's fallback through "${entry.table}"), so it cannot be sent again to the row's own address` });
+                    }
+                    else {
+                        // Nobody changes online where it goes: else a link holder could send it to any address in turn.
+                        const writers = entries.filter((other) => other.methods.includes('PATCH'));
+                        const onRow = writers.filter((other) => other.table === entry.table).flatMap((other) => other.writable ?? []).filter((ref) => address.columns.includes(ref));
+                        const onPerson = address.person === undefined ? [] : writers.filter((other) => other.table === address.person.table && (other.writable ?? []).includes(address.person.column)).map(() => `${address.person.table}.${address.person.column}`);
+                        for (const ref of [...new Set([...onRow.map((c) => `${entry.table}.${c}`), ...onPerson])]) {
+                            out.push({ path: here('kind'), message: `"${ref}" is where it is sent again, and an entry lets a guest change it: nothing a guest writes may say where it goes` });
+                        }
+                    }
+                }
+            }
+            // What the row must hold: through a row's own link, always said (a confirm email only while it is still to confirm).
+            if (entry.claimedBy === undefined && entry.claim !== undefined && 'by' in entry.claim && entry.claim.own === true && entry.newLink.when === undefined) {
+                out.push({ path: here('when'), message: 'sent again through a row\'s own link only while the row holds a when (an order still to confirm)' });
+            }
+            // Only columns the guest sees: a refusal must tell nothing about one they do not.
+            const shown = entry.select ?? (table.columns.filter((c) => c.rules?.code === undefined && c.rules?.secret !== true).map((c) => c.ref));
+            const withheld = new Set(entry.withhold?.columns ?? []);
+            (entry.newLink.when?.where ?? []).forEach((condition, w) => {
+                out.push(...conditionIssues(entry.table, condition, index, here('when', 'where', w)));
+                if (!shown.includes(condition.column) || withheld.has(condition.column)) {
+                    out.push({ path: here('when', 'where', w), message: `"${entry.table}.${condition.column}" is not a column this entry shows, so a new link is never asked for by it` });
+                }
+            });
+        }
+        // A read for the holder of a session alone (no claim of its own): the settings a signed-in guest may see.
+        if (entry.level !== undefined && entry.claim === undefined && entry.claimedBy === undefined && entry.visibleWith === undefined) {
+            if (entry.methods.length !== 1 || entry.methods[0] !== 'GET')
+                out.push({ path: at('methods'), message: 'a read for a signed-in guest alone only reads' });
+            if (!identities.has(key))
+                out.push({ path: at('level'), message: `the "${key}" key signs nobody in, so no session could read this` });
+            if (entry.select === undefined)
+                out.push({ path: at('select'), message: 'a read for a signed-in guest lists what it shows; without select it would show every column' });
+            const signIn = identities.get(key)?.entry.claim;
+            const verifiedOnly = signIn !== undefined && (claimKind(signIn) === 'link' || ('own' in signIn && signIn.own === true));
+            if (verifiedOnly && entry.level !== 'verified')
+                out.push({ path: at('level'), message: `the "${key}" key's sessions are verified, so this entry is read at level "verified"` });
+        }
+        // The owner's own link: it changes its row and its children, within what each entry names.
+        if (ownKeys.has(key)) {
+            if (entry.methods.includes('PATCH') && entry.writable === undefined)
+                out.push({ path: at('writable'), message: 'a change through a row\'s own link names what it may write' });
+            if (entry.methods.includes('POST') && entry.visibleWith === undefined)
+                out.push({ path: at('methods'), message: 'a row\'s own link makes only child rows of the row it opens (visibleWith)' });
+            if (entry.methods.includes('PATCH')) {
+                for (const ref of writable) {
+                    if (index.column(entry.table, ref)?.type === 'enum' && entry.writableValues?.[ref] === undefined) {
+                        out.push({ path: at('writableValues'), message: `"${ref}" is an enum a browser changes; list the values it may set` });
+                    }
+                }
+            }
+            if (entry.visibleWith !== undefined && entry.level !== 'verified') {
+                out.push({ path: at('level'), message: `the "${key}" key opens a row's own link at level "verified", so this entry is read at it` });
+            }
+        }
+    });
+    // An own link's code, its end and its stop are never written through any entry.
+    for (const key of ownKeys) {
+        const claim = identities.get(key).entry.claim;
+        const table = identities.get(key).entry.table;
+        const guarded = [claim.column, claim.expires, claim.stopped].filter((ref) => ref !== undefined);
+        entries.forEach((entry, i) => {
+            if (entry.table !== table)
+                return;
+            for (const ref of guarded) {
+                if ((entry.writable ?? []).includes(ref) || Object.prototype.hasOwnProperty.call(entry.writableValues ?? {}, ref)) {
+                    out.push({ path: ['publicAccess', i, 'writable'], message: `"${table}.${ref}" opens or closes the row's own link, so no browser writes it` });
+                }
+            }
+        });
+    }
+    return out;
+}
+/** Whether a code's `renew` names a change of `ref` among its triggers. */
+function renewsOn(renew, ref) {
+    if (renew === undefined)
+        return false;
+    const triggers = (Array.isArray(renew.on) ? renew.on : [renew.on]);
+    return triggers.some((trigger) => trigger.column === ref && trigger.changed === true);
+}
+/** The columns a row's own link may be emailed to, as a list (none for any other claim). */
+function ownAddressesOf(claim) {
+    if (claim === undefined || !('by' in claim) || claim.own !== true || claim.address === undefined)
+        return [];
+    return typeof claim.address === 'string' ? [claim.address] : claim.address;
+}
+/**
+ * Where a row's own link may be emailed (`claim.address`), and the columns
+ * left out of rows read through a parent (`withhold`).
+ */
+function ownAddressAndWithholdIssues(entries, ctx, identities) {
+    const out = [];
+    const { index } = ctx;
+    /** Whether an entry lets a browser set a column. */
+    const writes = (entry, ref) => (entry.writable ?? []).includes(ref) ||
+        Object.prototype.hasOwnProperty.call(entry.writableValues ?? {}, ref) ||
+        Object.prototype.hasOwnProperty.call(entry.defaults ?? {}, ref);
+    /** The tables a key signs a person in on: an identity that is not a token (a token opens a row, not a person). */
+    const people = new Set([...identities.values()].filter(({ entry }) => entry.claim !== undefined && claimKind(entry.claim) !== 'token').map(({ entry }) => entry.table));
+    entries.forEach((entry, i) => {
+        const at = (...rest) => ['publicAccess', i, ...rest];
+        if (index.table(entry.table) === undefined)
+            return;
+        const key = entry.key ?? CUSTOMER_KEY;
+        const column = (ref) => index.column(entry.table, ref);
+        const claim = entry.claim;
+        if (claim !== undefined && 'by' in claim && claim.address !== undefined) {
+            const refs = typeof claim.address === 'string' ? [claim.address] : claim.address;
+            if (claim.own !== true)
+                out.push({ path: at('claim', 'address'), message: "a link is emailed to its row's own address only when it is the row's own link (own: true)" });
+            if (refs.length === 2 && refs[0] === refs[1])
+                out.push({ path: at('claim', 'address'), message: `"${refs[0]}" is named twice` });
+            for (const ref of new Set(refs)) {
+                const found = column(ref);
+                if (found === undefined)
+                    out.push({ path: at('claim', 'address'), message: `"${entry.table}" has no column "${ref}"` });
+                else if (found.type !== 'text')
+                    out.push({ path: at('claim', 'address'), message: `"${entry.table}.${ref}" is not a text column holding an address` });
+                else if (ref === claim.column)
+                    out.push({ path: at('claim', 'address'), message: `"${entry.table}.${ref}" is the link's secret, not an address` });
+                // Whoever holds the link could otherwise send it on to an address of their choosing.
+                entries.forEach((other, j) => {
+                    if (other.table === entry.table && (other.key ?? CUSTOMER_KEY) === key && writes(other, ref)) {
+                        out.push({ path: ['publicAccess', j, 'writable'], message: `"${entry.table}.${ref}" is an address the row's own link is emailed to, so a change through that link may not set it` });
+                    }
+                });
+                /*
+                 * An address another entry's change writes (the buyer sends a ticket on
+                 * to a friend): the link must be new each time it goes to a new address,
+                 * or whoever it was sent to before still holds a link to the row.
+                 */
+                const changedBy = entries.findIndex((other) => other.table === entry.table && other.methods.some((m) => m === 'PATCH') && writes(other, ref));
+                const codeColumn = ruledColumn(index, entry.table, claim.column);
+                if (found !== undefined && changedBy >= 0 && !renewsOn(codeColumn?.rules?.code?.renew, ref)) {
+                    out.push({
+                        path: at('claim', 'address'),
+                        message: `"${entry.table}.${ref}" is written by a change (publicAccess ${String(changedBy)}) and the row's own link is emailed to it, so "${entry.table}.${claim.column}" renews when it changes: rules.code.renew.on {"column": "${ref}", "changed": true}`,
+                    });
+                }
+            }
+        }
+        const withhold = entry.withhold;
+        if (withhold === undefined)
+            return;
+        // A row's own link (a ticket a friend has not taken yet) holds back columns while a condition holds: it names nobody, so no holder.
+        const ownLink = claim !== undefined && claimKind(claim) === 'token' && 'own' in claim && claim.own === true;
+        if (ownLink && withhold.unlessHolder !== undefined) {
+            out.push({ path: at('withhold', 'unlessHolder'), message: "a row's own link names nobody, so it holds columns back by when alone" });
+        }
+        else if (!ownLink && entry.visibleWith === undefined && entry.claimedBy === undefined) {
+            out.push({ path: at('withhold'), message: "columns are withheld from rows read through a parent (visibleWith or claimedBy), or by a row's own link while a condition holds" });
+        }
+        else if (entry.claimedBy !== undefined && entry.claimedBy.column === withhold.unlessHolder) {
+            out.push({ path: at('withhold', 'unlessHolder'), message: `"${withhold.unlessHolder}" is the column this entry is claimed by, so every row it reads is already its holder's` });
+        }
+        if (new Set(withhold.columns).size !== withhold.columns.length)
+            out.push({ path: at('withhold', 'columns'), message: 'a column is withheld once' });
+        for (const ref of withhold.columns) {
+            if (entry.select === undefined || !entry.select.includes(ref))
+                out.push({ path: at('withhold', 'columns'), message: `"${ref}" is not one of the columns the entry shows` });
+        }
+        // What a `when` reads decides who sees the columns: never a browser's to write.
+        const ruled = ruledTable(index, entry.table);
+        if (withhold.when !== undefined && ruled !== undefined) {
+            (withhold.when.where ?? []).forEach((condition, w) => {
+                out.push(...conditionIssues(entry.table, condition, index, at('withhold', 'when', 'where', w)));
+                entries.forEach((other, j) => {
+                    if (other.table === entry.table && writes(other, condition.column)) {
+                        out.push({ path: ['publicAccess', j, 'writable'], message: `"${entry.table}.${condition.column}" decides who reads the withheld columns, so no browser writes it` });
+                    }
+                });
+            });
+            (withhold.when.linked ?? []).forEach((link, l) => {
+                const via = column(link.via);
+                const target = via?.type === 'fk' && via.references !== undefined ? ruledTable(index, via.references) : undefined;
+                if (target === undefined) {
+                    out.push({ path: at('withhold', 'when', 'linked', l, 'via'), message: `"${entry.table}.${link.via}" is not a foreign key of this app` });
+                    return;
+                }
+                link.where.forEach((condition, w) => {
+                    out.push(...conditionIssues(target.ref, condition, index, at('withhold', 'when', 'linked', l, 'where', w)));
+                    entries.forEach((other, j) => {
+                        if (other.table === target.ref && writes(other, condition.column)) {
+                            out.push({ path: ['publicAccess', j, 'writable'], message: `"${target.ref}.${condition.column}" decides who reads "${entry.table}"'s withheld columns, so no browser writes it` });
+                        }
+                    });
+                });
+                entries.forEach((other, j) => {
+                    // A child's create names the parent it is made under (one the guest reaches): that is no change of who reads it.
+                    const createsUnder = other.visibleWith?.via === link.via && !other.methods.includes('PATCH');
+                    if (other.table === entry.table && writes(other, link.via) && !createsUnder) {
+                        out.push({ path: ['publicAccess', j, 'writable'], message: `"${entry.table}.${link.via}" decides who reads the withheld columns, so no browser writes it` });
+                    }
+                });
+            });
+        }
+        const holder = withhold.unlessHolder;
+        if (holder === undefined)
+            return;
+        const link = column(holder);
+        const root = rootIdentity(entries, i, identities);
+        if (link === undefined) {
+            out.push({ path: at('withhold', 'unlessHolder'), message: `"${entry.table}" has no column "${holder}"` });
+        }
+        else if (link.type !== 'fk') {
+            out.push({ path: at('withhold', 'unlessHolder'), message: `"${entry.table}.${holder}" is not a foreign key to a person` });
+        }
+        else if (root?.claim !== undefined && claimKind(root.claim) === 'token') {
+            // A key that opens a row by its link signs no person in: the columns are withheld whenever the holder is set.
+            if (!people.has(link.references ?? '')) {
+                out.push({ path: at('withhold', 'unlessHolder'), message: `"${entry.table}.${holder}" does not point at a person any key signs in` });
+            }
+        }
+        else if (root !== undefined && link.references !== root.table) {
+            out.push({ path: at('withhold', 'unlessHolder'), message: `"${entry.table}.${holder}" does not point at "${root.table}", the person the "${key}" key signs in` });
+        }
+        // Who may read the withheld columns is never a browser's to say.
+        entries.forEach((other, j) => {
+            if (other.table === entry.table && writes(other, holder)) {
+                out.push({ path: ['publicAccess', j, 'writable'], message: `"${entry.table}.${holder}" decides who reads the withheld columns, so no browser writes it` });
+            }
+        });
+    });
+    return out;
+}
 //# sourceMappingURL=public-access.js.map