@drhomet/mithaq 0.0.0-stage → 0.2.0

package/dist/asas/runner/steps.js

@@ -0,0 +1,277 @@
+import { isRef } from '../../mithaq/user.js';
+import { declaredFieldAccess } from '../../mithaq/rows.js';
+import { providerOf } from '../../base/rules.js';
+import { invalid } from './errors.js';
+import { snapshot } from './runtime.js';
+import { rawStepStore } from './store.js';
+// The assertion checks the list stays inside `OperationStep<never>`, not the direction it names.
+export const atEffect = (list) => list;
+// A map only this module writes: a tag on the function would let any function buy
+// the position that skips parsing.
+const seals = new WeakMap();
+// The derived shapes exist only after `resolve`, so the function waits for `build`.
+const outputs = new WeakMap();
+/** A step is compared by the seal it carries, so a validate function's step is one too. */
+const seal = (name, step) => {
+    seals.set(step, name);
+    return step;
+};
+/** What position this step holds, or nothing at all for a step of the app's own. */
+export const sealOf = (step) => seals.get(step);
+// Each copy of mithaq in the process lists its seals here, so a step a second install sealed is
+// named rather than miscounted. Anything can write this map, so its answer only ever refuses.
+const copies = (globalThis[Symbol.for('mithaq.copies')] ??= new Map());
+copies.set(import.meta.url, (step) => seals.get(step));
+/** Where the other copy of mithaq that sealed this step was loaded from, if one did. */
+export const foreignCopyOf = (step) => [...copies].find(([url, of]) => url !== import.meta.url && of(step))?.[0];
+/** Hold an operation's `output` function until `build` has the derived shapes. */
+export const holdOutput = (operation, of) => {
+    outputs.set(operation, of);
+};
+/** The schema function this operation's `output` carries, or nothing for a bare schema. */
+export const outputOf = (operation) => outputs.get(operation);
+/** The list's store step, the one that makes, changes or removes the row. */
+export const storeSeals = ['insert', 'remove', 'update'];
+export const readSeals = ['count', 'find', 'findOne'];
+// Apart from `storeSeals`: `write` reads that list to place its single-row guards, which
+// a bulk list never reaches.
+export const bulkSeals = ['deleteMany', 'updateMany'];
+// Each its own acting step, so each is its own permission key.
+export const versionSeals = ['findVersions', 'findVersionByID', 'restoreVersion'];
+/** The read no actor holds, which a secret column carries. One function, so a column is known by it. */
+export const neverRead = () => false;
+// An audit row outlives the column and is read by whoever reads the log, so no secret goes in it.
+const withoutSecrets = (kayan, data) => data && typeof data === 'object'
+    ? Object.freeze(Object.fromEntries(Object.entries(data).filter(([name]) => declaredFieldAccess(kayan.fields[name]?.access?.read) !== neverRead)))
+    : data;
+/**
+ * The audit step a project lists in the service target's `afterSteps`. A step after the store
+ * that changes persistence must return the persisted row in `ctx.data`. Listing it without a sink fails the build.
+ */
+export const audit = seal('audit', async (ctx, tools) => {
+    if (!tools)
+        return ctx;
+    await tools.audit?.({
+        context: ctx.context,
+        effect: tools.effect,
+        kayan: ctx.kayan,
+        operation: tools.operation,
+        dataBefore: withoutSecrets(ctx.kayan, ctx.dataBefore),
+        dataAfter: withoutSecrets(ctx.kayan, ctx.dataAfter ?? snapshot(ctx.data) ?? ctx.data),
+        store: 'store' in tools ? rawStepStore(tools.store) : undefined,
+        tx: ctx.tx,
+        user: ctx.user,
+    });
+    return ctx;
+});
+// A row's filter and a default read the same reference off the same actor, so they agree.
+const defaultOf = (field, ctx, tools) => {
+    const value = field.rules?.defaultValue;
+    // Copied whole, so a step changing one row's list or object never changes the next row's default.
+    if (!isRef(value))
+        return typeof value === 'object' && value !== null ? structuredClone(value) : value;
+    if (!ctx.user) {
+        throw new Error(`Kayan "${ctx.kayan.name}" operation "${tools.operation}" field "${field.name}" defaults to "user.${value.$user}", and this write was given no actor. Pass one: create(data, { actor }).`);
+    }
+    // An own key only: a JSON reference could name `__proto__`.
+    const actor = ctx.user;
+    const found = Object.hasOwn(actor, value.$user) ? actor[value.$user] : undefined;
+    // A key the actor does not carry would otherwise be written as null while the row filter
+    // naming it refuses to run.
+    if (found === null || found === undefined) {
+        throw new Error(`Kayan "${ctx.kayan.name}" operation "${tools.operation}" field "${field.name}" defaults to "user.${value.$user}", and the actor carries nothing there.`);
+    }
+    return found;
+};
+/**
+ * Fills what the write left out. On a list that only changes a row only `nowOnUpdate` fields
+ * are filled, or `createdAt` would take the edit's moment. The runner runs it; a list naming it is refused.
+ */
+export const defaults = seal('defaults', (ctx, tools) => {
+    const data = { ...ctx.data };
+    const insert = tools.kind === 'insert';
+    for (const field of Object.values(ctx.kayan.fields)) {
+        if (data[field.name] !== undefined)
+            continue;
+        if (field.rules?.[insert ? 'defaultNow' : 'nowOnUpdate'] === true)
+            data[field.name] = field.now();
+        else if (insert) {
+            const value = defaultOf(field, ctx, tools);
+            if (value !== undefined)
+                data[field.name] = value;
+        }
+    }
+    return { ...ctx, data };
+});
+// The refusal's params carry each path and rule, so a client need not parse the English message.
+const issuesOf = (issues) => issues.map((issue) => ({
+    path: (issue.path ?? [])
+        .map((segment) => String(typeof segment === 'object' ? segment.key : segment))
+        .join('.'),
+    message: issue.message,
+    // What a schema said beside its message, such as the node type a rich
+    // text value holds that its editor does not.
+    ...(issue.params ? { params: issue.params } : {}),
+}));
+/** Every issue as one message, each prefixed by the path it happened at. */
+const issueMessage = (issues) => issuesOf(issues)
+    .map(({ message, path }) => (path ? `${path}: ${message}` : message))
+    .join('; ');
+/** The refusal a list of Standard Schema issues becomes, shared by the parse and the oRPC boundary so every 400 has one shape. */
+export const issueRefusal = (issues, vendor = 'unknown') => invalid({
+    message: issueMessage(issues) || `The "${vendor}" schema refused the value and reported no issues.`,
+    key: 'error.invalid.value',
+    params: { issues: issuesOf(issues) },
+});
+/** A plain object copied without a prototype, because zod reads an unsent key off the prototype. */
+export const withoutPrototype = (value) => value !== null && typeof value === 'object' && Object.getPrototypeOf(value) === Object.prototype
+    ? Object.assign(Object.create(null), value)
+    : value;
+/** Validates through Standard Schema's own `validate`, sync or async, never one library's `parse`. */
+export const validated = async (schema, value) => {
+    const result = await schema['~standard'].validate(withoutPrototype(value));
+    if (result.issues)
+        throw issueRefusal(result.issues, schema['~standard'].vendor);
+    return result.value;
+};
+/**
+ * The runner's parse. A field the client does not supply is absent from the wire shape, so a value the
+ * runner put there is set aside, the rest parsed, and the set-aside values put back. `id` is never set aside.
+ */
+export const parse = async ({ schema, ctx, tools }) => {
+    const on = tools.kind === 'insert' ? 'create' : tools.kind === 'update' ? 'update' : undefined;
+    if (!on)
+        return { ...ctx, data: (await validated(schema, ctx.data)) };
+    const sent = tools.sent ?? [];
+    const server = Object.create(null);
+    const client = Object.create(null);
+    for (const [name, value] of Object.entries(ctx.data)) {
+        const field = Object.hasOwn(ctx.kayan.fields, name) ? ctx.kayan.fields[name] : undefined;
+        const mine = !!field && name !== 'id' && !sent.includes(name) && providerOf(field, on) !== 'client';
+        (mine ? server : client)[name] = value;
+    }
+    return { ...ctx, data: { ...(await validated(schema, client)), ...server } };
+};
+/** A marker, refused by name in a list: the parse is the runner's own. The shape it carried is the operation's `input`. */
+export const validate = seal('validate', (() => validate));
+// The derived shapes are strict, so no undeclared key reaches the store.
+const columns = (ctx) => Object.fromEntries(Object.entries(ctx.data).filter(([name]) => name in ctx.kayan.fields));
+/** Make the row, and what came back is what the rest of the list sees. */
+export const insert = seal('insert', async (ctx, tools) => {
+    const row = await tools.store.insert({ tx: ctx.tx, kayan: ctx.kayan, data: columns(ctx) });
+    return { ...ctx, data: { ...ctx.data, ...row }, dataAfter: snapshot(row) };
+});
+/** Change the one row the id names; everything else in `data` is the change. An id alone is refused with a 400. */
+export const update = seal('update', async (ctx, tools) => {
+    // The runner sets `kind` to `insert` for a global's first update, so `defaults` fills create-time defaults too.
+    if (tools.kind === 'insert')
+        return insert(ctx, tools);
+    const values = columns(ctx);
+    delete values.id;
+    if (!Object.keys(values).length) {
+        throw invalid({
+            message: `Kayan "${ctx.kayan.name}" operation "${tools.operation}" reached the update step with nothing but an id, so there is nothing to change.`,
+            key: 'error.invalid.empty_update',
+            params: { kayan: ctx.kayan.name, operation: tools.operation },
+        });
+    }
+    const row = await tools.store.update({ tx: ctx.tx, kayan: ctx.kayan, id: ctx.data.id, data: values, where: tools.where });
+    return { ...ctx, data: { ...ctx.data, ...row }, dataAfter: snapshot(row) };
+});
+/** Remove the one row the id names, and hand back what was removed. */
+export const remove = seal('remove', async (ctx, tools) => {
+    const data = await tools.store.remove({ tx: ctx.tx, kayan: ctx.kayan, id: ctx.data.id, where: tools.where });
+    return { ...ctx, data, dataAfter: snapshot(data) };
+});
+// The seal and nothing else: `bulk` supplies `tools.many`.
+const manyStep = async (ctx, tools) => {
+    if (!tools.many) {
+        throw new Error(`Kayan "${ctx.kayan.name}" operation "${tools.operation}" has a bulk step and no bulk runner, so nothing would be written.`);
+    }
+    return { ...ctx, data: (await tools.many(ctx.data)) };
+};
+/**
+ * Change every row the `where` matches. A wrapper of its own, because a seal is keyed on
+ * the step object and two seals on one object would answer for both.
+ */
+export const updateMany = seal('updateMany', (ctx, tools) => manyStep(ctx, tools));
+/** Remove every row the `where` matches, or mark it where the language names a soft delete. */
+export const deleteMany = seal('deleteMany', (ctx, tools) => manyStep(ctx, tools));
+const managedRead = async (ctx, tools) => {
+    const data = await tools.read(ctx.data);
+    return { ...ctx, data, dataAfter: snapshot(data) };
+};
+/** One row, the way `Store.find` with a limit of one answers for it. */
+export const findOne = seal('findOne', (ctx, tools) => managedRead(ctx, tools));
+/** A paginated page of rows. */
+export const find = seal('find', (ctx, tools) => managedRead(ctx, tools));
+/** How many rows the `where` matches, as `{ totalDocs }`, through the store's own `count` where it has one. */
+export const count = seal('count', (ctx, tools) => managedRead(ctx, tools));
+/** A page of one kayan's versions, read through the row's own read access. */
+export const findVersions = seal('findVersions', (ctx, tools) => managedRead(ctx, tools));
+/** One version by its own id. */
+export const findVersionByID = seal('findVersionByID', (ctx, tools) => managedRead(ctx, tools));
+/** Write one version back to its row; the runner turns it into the row's own update before anything is asked. */
+export const restoreVersion = seal('restoreVersion', (ctx, tools) => update(ctx, tools));
+const sealedSteps = { audit, count, defaults, deleteMany, find, findOne, findVersionByID, findVersions, insert, remove, restoreVersion, update, updateMany, validate };
+/** The shipped lists a kayan spreads into its own `targets.service.operations`: `operations: { ...defaultOperations, archive }`. */
+export const defaultOperations = {
+    create: { steps: [insert] },
+    update: { steps: [update] },
+    delete: { steps: [remove] },
+    find: { steps: [find] },
+    findByID: { steps: [findOne] },
+    // A list like any other, so a kayan overrides it or leaves it out.
+    count: { steps: [count] },
+    // No default is filled for a bulk: each row's single-row write fills its own.
+    updateMany: { steps: [updateMany] },
+    deleteMany: { steps: [deleteMany] },
+};
+// A global is found by being the only row, so its read takes a depth alone.
+const globalRead = {
+    '~standard': {
+        version: 1,
+        vendor: 'mithaq',
+        validate: (value) => {
+            if (!value || typeof value !== 'object' || Array.isArray(value))
+                return { issues: [{ message: 'Invalid input: expected object' }] };
+            const stray = Object.keys(value).filter((key) => key !== 'depth');
+            if (stray.length)
+                return { issues: stray.map((key) => ({ message: `Unrecognized key: "${key}"` })) };
+            return { value: 'depth' in value ? { depth: value.depth } : {} };
+        },
+    },
+};
+/** The two lists a global spreads into its own `targets.service.operations`: `findOne` and `update`. */
+export const defaultGlobalOperations = {
+    // `update` first, the order a global's two are published in.
+    update: { steps: [update] },
+    findOne: { input: () => globalRead, steps: [findOne] },
+};
+/** The shipped lists by name, which is what a steps function is handed as `operations`. */
+const defaultLists = Object.fromEntries(Object.entries(defaultOperations).map(([name, { steps }]) => [name, steps]));
+/** The four keys an operation writes a list under, which is where a function may sit. */
+const listKeys = ['steps', 'beforeTransaction', 'afterSteps', 'afterCommit'];
+// Every steps function runs once, here, so what `resolve` seals is data.
+export const resolveOperations = (declared, slots = {}) => {
+    const given = {
+        operations: defaultLists,
+        steps: sealedSteps,
+        beforeSteps: slots.beforeSteps ?? [],
+        afterSteps: slots.afterSteps ?? [],
+        afterCommit: slots.afterCommit ?? [],
+    };
+    if (!declared)
+        return {};
+    const resolved = Object.create(null);
+    for (const [name, declaration] of Object.entries(declared)) {
+        if (declaration === undefined)
+            continue;
+        const held = declaration;
+        const ran = Object.fromEntries(listKeys
+            .filter((key) => typeof held[key] === 'function')
+            .map((key) => [key, held[key](given)]));
+        resolved[name] = Object.keys(ran).length ? { ...declaration, ...ran } : declaration;
+    }
+    return resolved;
+};

package/dist/asas/runner/store.d.ts

@@ -0,0 +1,4 @@
+import type { RawStepStore, StepStore } from '../../mithaq/language.ts';
+import type { RuntimeWriteTools, WriteTools } from './steps.ts';
+export declare const rawStepStore: (store: StepStore) => RawStepStore;
+export declare const stepTools: (tools: RuntimeWriteTools) => WriteTools;

package/dist/asas/runner/store.js

@@ -0,0 +1,21 @@
+import { invalid } from './errors.js';
+// Audit sinks still implement the adapter contract; no raw handle is a property a step can reach.
+const raw = new WeakMap();
+const declaredStore = (store) => {
+    const wrapped = Object.freeze(Object.fromEntries(Object.entries(store).map(([word, call]) => [word, (args) => {
+            const kayan = args.kayan;
+            if (!kayan || typeof kayan !== 'object' || typeof kayan.name !== 'string' || !kayan.fields || typeof kayan.fields !== 'object') {
+                throw invalid({ message: 'A step store call names its kayan by its declaration, not a string.', key: 'error.invalid.value' });
+            }
+            return call({ ...args, kayan: kayan.name });
+        }])));
+    raw.set(wrapped, store);
+    return wrapped;
+};
+export const rawStepStore = (store) => {
+    const held = raw.get(store);
+    if (!held)
+        throw new Error('The audit step needs the store handed to it by the runner.');
+    return held;
+};
+export const stepTools = (tools) => Object.freeze({ ...tools, store: declaredStore(tools.store) });

package/dist/asas/runner/tenant.d.ts

@@ -0,0 +1,54 @@
+import { type AssignedResolver } from '../actor.ts';
+import { type Language, type Store } from '../../mithaq/language.ts';
+import type { ResolvedKayan } from '../../mithaq/types.ts';
+import { type Where } from '../../mithaq/where.ts';
+import type { OperationEffect, RuntimeWriteTools as WriteTools } from './steps.ts';
+import { type Authorize } from './write.ts';
+/** How far a read reaches past the active organization: every verified membership, or every tenant. */
+export type TenantReach = 'mine' | 'all';
+/** A read's reach, opened once by the outermost read and kept by every managed call under it. */
+export type TenantScope = {
+    reach: 'all';
+} | {
+    reach: 'mine';
+    members: ReadonlyMap<string, object>;
+};
+/** The members of a `'mine'` scope whose organization `where` admitted, or nothing for any other answer. */
+export declare const membersAdmitted: (scope: TenantScope | undefined, where: Where | undefined) => object[] | undefined;
+/** Refused before any step runs: a write lands in the active organization alone. */
+export declare const refuseTenantOption: ({ kayan, operation, options }: {
+    kayan: ResolvedKayan;
+    operation: string;
+    options: unknown;
+}) => void;
+/**
+ * The organization a write to a tenant-owned kayan lands in, refused before any step runs where
+ * there is none, and a caller's own value for the field refused as the derived shapes refuse it.
+ */
+export declare const writeTenant: ({ kayan, active, effect, data }: {
+    kayan: ResolvedKayan;
+    active: string | undefined;
+    effect: OperationEffect;
+    data: unknown;
+}) => string | undefined;
+/** The build's tenant scope: `open` reads a read's `tenant` option, `scoped` puts the scope under every answer. */
+export declare const tenancy: ({ language, assigned, onError, collection }: {
+    language: Language;
+    assigned: AssignedResolver | undefined;
+    onError: (error: unknown) => void;
+    /** The build's one Better Auth kayan, whose sessions alone name a tenant. */
+    collection: string | undefined;
+}) => {
+    open: ({ actor, reach, kayan }: {
+        actor: unknown;
+        reach: unknown;
+        kayan: ResolvedKayan;
+    }) => Promise<TenantScope | undefined>;
+    scoped: (inner: Authorize) => Authorize;
+    active: (actor: unknown) => string | undefined;
+    sealWrites: ({ writes, find, kayanOf }: {
+        writes: Omit<WriteTools['store'], 'hold'>;
+        find: Store['find'];
+        kayanOf: (name: string) => ResolvedKayan | undefined;
+    }) => WriteTools['store'];
+};

package/dist/asas/runner/tenant.js

@@ -0,0 +1,275 @@
+// The tenant scope is core's and never a project's: it is ANDed onto whatever the project's
+// access answers, so no row table, callback or authorizer can widen it.
+import { authActor, markAuthActor, resolveAssigned } from '../actor.js';
+import { isTenant } from '../../mithaq/language.js';
+import { combineWhere, compareValues, same } from '../../mithaq/where.js';
+import { AsasError, denied, invalid, missing } from './errors.js';
+import { running } from './runtime.js';
+import { assertStoreWhere, assertReferences } from './write.js';
+// The session must come from the one Better Auth kayan of the build, whose organizations the
+// tenant kayan holds: another instance's organization ids name no tenant here.
+const sessionOf = ({ actor, collection }) => {
+    const trusted = authActor(actor);
+    return collection !== undefined && trusted?.strategy === 'better-auth' && trusted.collection === collection ? trusted : null;
+};
+/**
+ * The organization the actor's verified Better Auth session has active, where the provider
+ * lists the actor as its member; nothing for any other actor, which a tenant-owned kayan refuses.
+ */
+const activeTenant = ({ actor, collection }) => {
+    const trusted = sessionOf({ actor, collection });
+    if (!trusted)
+        return undefined;
+    const active = trusted.activeOrganizationId;
+    if (typeof active !== 'string' || !active || !Array.isArray(trusted.organizations))
+        return undefined;
+    return trusted.organizations.some((one) => one.id === active) ? active : undefined;
+};
+// The organizations a `'mine'` answer admitted, kept by the answer itself so a read masks and
+// judges each row by the membership it came through.
+const admitted = new WeakMap();
+/** The members of a `'mine'` scope whose organization `where` admitted, or nothing for any other answer. */
+export const membersAdmitted = (scope, where) => {
+    if (scope?.reach !== 'mine' || !where)
+        return undefined;
+    const orgs = admitted.get(where);
+    return orgs?.map((org) => scope.members.get(org));
+};
+/** Refused before any step runs: a write lands in the active organization alone. */
+export const refuseTenantOption = ({ kayan, operation, options }) => {
+    if (!options || typeof options !== 'object' || options.tenant === undefined)
+        return;
+    throw invalid({
+        message: `Kayan "${kayan.name}" operation "${operation}" writes in the active organization alone, so it takes no "tenant" option.`,
+        key: 'error.invalid.tenant_option',
+        params: { kayan: kayan.name, operation },
+    });
+};
+/**
+ * The organization a write to a tenant-owned kayan lands in, refused before any step runs where
+ * there is none, and a caller's own value for the field refused as the derived shapes refuse it.
+ */
+export const writeTenant = ({ kayan, active, effect, data }) => {
+    if (!kayan.tenant)
+        return undefined;
+    if (data && typeof data === 'object' && Object.hasOwn(data, kayan.tenant)) {
+        throw invalid({
+            message: `Unrecognized key: "${kayan.tenant}"`,
+            key: 'error.invalid.value',
+            params: { issues: [{ path: kayan.tenant, message: `Unrecognized key: "${kayan.tenant}"` }] },
+        });
+    }
+    if (active === undefined)
+        throw noScope(kayan, effect);
+    return active;
+};
+const noScope = (kayan, effect) => denied({
+    message: `Forbidden: "${kayan.name}" rows belong to an organization, and this actor's session has no active organization it is a verified member of.`,
+    key: effect === 'read' ? 'error.forbidden.read' : effect === 'create' ? 'error.forbidden.create' : 'error.forbidden.operation',
+    params: { kayan: kayan.name, operation: effect },
+});
+/** The build's tenant scope: `open` reads a read's `tenant` option, `scoped` puts the scope under every answer. */
+export const tenancy = ({ language, assigned, onError, collection }) => {
+    const target = language.targets.tenant;
+    const active = (actor) => activeTenant({ actor, collection });
+    const refused = (message) => denied({ message: `Forbidden: ${message}`, key: 'error.forbidden.read', params: {} });
+    const open = async ({ actor, reach, kayan }) => {
+        if (reach === undefined)
+            return undefined;
+        if (reach !== 'mine' && reach !== 'all') {
+            throw invalid({ message: 'Managed read option "tenant" must be "mine" or "all".', key: 'error.invalid.tenant_option', params: { kayan: kayan.name } });
+        }
+        // A global is one row per tenant, so a read of one names its tenant.
+        if (!isTenant(target) || kayan.single) {
+            throw invalid({
+                message: `Kayan "${kayan.name}" ${kayan.single ? 'is a global, whose read is its active organization\'s row' : 'is read in a build that lays down no tenant target'}, so it takes no "tenant" option.`,
+                key: 'error.invalid.tenant_option',
+                params: { kayan: kayan.name },
+            });
+        }
+        if (reach === 'all') {
+            const trusted = authActor(actor);
+            if (!trusted || !target.backoffice || (await target.backoffice({ user: actor })) !== true) {
+                throw refused('tenant "all" reads every organization, which only backoffice staff in the backoffice app may.');
+            }
+            return { reach };
+        }
+        // Without an access target the actor's roles are one set for every organization, and
+        // carrying the active one's into another would widen it.
+        const trusted = sessionOf({ actor, collection });
+        if (!assigned || !trusted || !Array.isArray(trusted.organizations) || trusted.id === undefined || trusted.id === null) {
+            throw refused('tenant "mine" reads the organizations a verified Better Auth session is a member of, each under the roles the access target holds there.');
+        }
+        const ids = [...new Set(trusted.organizations.map((one) => one.id).filter((id) => typeof id === 'string' && id !== ''))];
+        const members = new Map();
+        for (const org of ids) {
+            // The trusted snapshot's facts, never the actor object's own keys. The provider's
+            // governance role is the active organization's, so no other membership carries it.
+            const base = {
+                ...actor,
+                activeOrganizationId: org,
+                collection: trusted.collection,
+                id: trusted.id,
+                memberRole: undefined,
+                organizations: trusted.organizations,
+                role: trusted.role,
+                strategy: trusted.strategy,
+            };
+            delete base.permissions;
+            delete base.roles;
+            const held = await resolveAssigned({ resolver: assigned, onError, tenant: org, member: trusted.id, actor: base });
+            members.set(org, markAuthActor({ ...base, permissions: held?.permissions ?? [], roles: held?.roles ?? [] }));
+        }
+        return { reach, members };
+    };
+    const scoped = (inner) => async (args) => {
+        const field = args.kayan.tenant;
+        if (!field)
+            return inner(args);
+        // A global is one organization's row, so a reach a read further out opened never reaches it.
+        const scope = args.kayan.single ? undefined : running.getStore()?.tenant;
+        if (scope && args.effect !== 'read')
+            refuseTenantOption({ kayan: args.kayan, operation: args.operation ?? args.effect, options: { tenant: scope.reach } });
+        if (scope?.reach === 'all')
+            return inner(args);
+        if (scope?.reach === 'mine') {
+            // One branch per answer that is the same value, so organizations whose roles answer alike share one.
+            const groups = [];
+            for (const [org, member] of scope.members) {
+                let where;
+                try {
+                    where = await inner({ ...args, actor: member });
+                }
+                catch (thrown) {
+                    if (thrown instanceof AsasError && thrown.status === 403)
+                        continue;
+                    throw thrown;
+                }
+                const group = groups.find((one) => same(one.where, where));
+                if (group)
+                    group.orgs.push(org);
+                else
+                    groups.push({ orgs: [org], where });
+            }
+            if (!groups.length)
+                throw refused(`no organization this actor is a member of may read "${args.kayan.name}".`);
+            const branches = groups.map(({ orgs, where }) => combineWhere({ [field]: { in: orgs } }, where));
+            const answer = branches.length === 1 ? { and: [branches[0]] } : { or: branches };
+            admitted.set(answer, groups.flatMap(({ orgs }) => orgs));
+            return answer;
+        }
+        // Asked before the project's own answer, so no callback runs for an actor with no tenant.
+        const org = active(args.actor);
+        if (org === undefined)
+            throw noScope(args.kayan, args.effect);
+        const own = await inner(args);
+        return args.effect === 'create' ? own : combineWhere({ [field]: { equals: org } }, own);
+    };
+    /**
+     * The store a step is handed, sealed for every tenant-owned kayan it names: a row is made in
+     * the active organization alone, and an update or delete reaches that organization's rows
+     * alone and never names the field, whichever kayan the operation itself belongs to. A row
+     * it writes names a tenant-owned row of the active organization alone, so another
+     * organization's delete never reaches it.
+     */
+    const sealWrites = ({ writes, find, kayanOf }) => {
+        // A versions table or a join table holds no tenant field to seal by, so a step reaches neither.
+        const named = (name) => {
+            const kayan = kayanOf(name);
+            if (!kayan)
+                throw new Error(`A step wrote "${name}", which names no kayan, and a step writes a kayan's rows alone: versions and join rows are core's.`);
+            return kayan;
+        };
+        const declaredField = (name, key) => {
+            if (!Object.hasOwn(named(name).fields, key))
+                throw invalid({ message: `Kayan "${name}" declares no field "${key}".`, key: 'error.invalid.value', params: { kayan: name, field: key } });
+        };
+        const checked = (name, where) => {
+            if (!where)
+                return where;
+            try {
+                return assertStoreWhere(named(name), where);
+            }
+            catch (cause) {
+                throw invalid({ message: cause instanceof Error ? cause.message : 'Invalid store filter.', key: 'error.invalid.value', params: { kayan: name }, cause });
+            }
+        };
+        const references = async ({ name, data, tx }) => {
+            for (const key of Object.keys(data))
+                declaredField(name, key);
+            return assertReferences({ kayan: named(name), store: { find }, data, tenant: active(running.getStore()?.user), tx });
+        };
+        const sealed = (name, data) => {
+            const field = named(name).tenant;
+            if (!field)
+                return undefined;
+            const org = active(running.getStore()?.user);
+            if (org === undefined)
+                throw new Error(`A step wrote kayan "${name}", whose rows belong to an organization, under no active organization.`);
+            if (data && field in data)
+                throw new Error(`A step wrote field "${field}" of kayan "${name}", and a row is made in its organization by the runner alone and never leaves it.`);
+            return { [field]: { equals: org } };
+        };
+        const sealedFind = async (args) => {
+            if (args.args.lock && !args.tx)
+                throw new Error('Holding rows requires a transaction.');
+            declaredField(args.kayan, args.args.sort.field);
+            return find({ ...args, args: { ...args.args, where: combineWhere(checked(args.kayan, args.args.where), sealed(args.kayan)) } });
+        };
+        return Object.freeze({
+            find: sealedFind,
+            sum: async (args) => {
+                declaredField(args.kayan, args.field);
+                return writes.sum({ ...args, where: combineWhere(checked(args.kayan, args.where), sealed(args.kayan)) });
+            },
+            hold: async ({ tx, kayan, ids, mode }) => {
+                if (!['update', 'noKeyUpdate', 'share', 'keyShare'].includes(mode))
+                    throw invalid({ message: 'Holding rows requires a valid lock mode.', key: 'error.invalid.value' });
+                if (!tx)
+                    throw new Error('Holding rows requires a transaction.');
+                const uuid = named(kayan).fields.id?.kind === 'uuid';
+                const ordered = [...new Set(ids.map((id) => uuid && typeof id === 'string' ? id.toLowerCase() : id))].sort((left, right) => compareValues({ left, right, direction: 'asc' }));
+                for (const id of ordered) {
+                    const { docs } = await sealedFind({ tx, kayan, args: { limit: 1, page: 1, sort: { field: 'id', direction: 'asc' }, lock: mode, where: { id: { equals: id } } } });
+                    if (!docs.length)
+                        throw missing({ message: `No "${kayan}" row found.`, key: 'error.not_found.row', params: { kayan } });
+                }
+            },
+            upsert: async (args) => {
+                const field = named(args.kayan).tenant;
+                const org = active(running.getStore()?.user);
+                if (field && (org === undefined || (Object.hasOwn(args.data, field) && args.data[field] !== org))) {
+                    throw new Error(`A step upserted kayan "${args.kayan}" in another organization than the active one.`);
+                }
+                const data = field ? { ...args.data, [field]: org } : args.data;
+                const kayan = named(args.kayan);
+                if (!args.on.length || new Set(args.on).size !== args.on.length || !(args.on.length === 1 && args.on[0] === 'id') && !kayan.indexes.some((index) => index.unique && index.fields.length === args.on.length && index.fields.every((field) => args.on.includes(field))) || args.on.some((key) => !Object.hasOwn(data, key) || (data[key] && typeof data[key] === 'object' && '$inc' in data[key]))) {
+                    throw invalid({ message: `Kayan "${args.kayan}" upsert needs plain key values for a declared unique index in "on".`, key: 'error.invalid.value', params: { kayan: args.kayan } });
+                }
+                for (const key of args.on)
+                    declaredField(args.kayan, key);
+                await references({ name: args.kayan, data, tx: args.tx });
+                return writes.upsert({ ...args, data, where: combineWhere(checked(args.kayan, args.where), sealed(args.kayan)) });
+            },
+            insert: async (args) => {
+                const field = named(args.kayan).tenant;
+                const org = active(running.getStore()?.user);
+                if (field) {
+                    if (org === undefined || (Object.hasOwn(args.data, field) && args.data[field] !== org)) {
+                        throw new Error(`A step made a row of kayan "${args.kayan}" in another organization than the active one, and a row is made in its own organization alone.`);
+                    }
+                }
+                const data = field ? { ...args.data, [field]: org } : args.data;
+                await references({ name: args.kayan, data, tx: args.tx });
+                return writes.insert({ ...args, data });
+            },
+            update: async (args) => {
+                const where = combineWhere(checked(args.kayan, args.where), sealed(args.kayan, args.data));
+                await references({ name: args.kayan, data: args.data, tx: args.tx });
+                return writes.update({ ...args, where });
+            },
+            remove: async (args) => writes.remove({ ...args, where: combineWhere(checked(args.kayan, args.where), sealed(args.kayan)) }),
+        });
+    };
+    return { open, scoped, active, sealWrites };
+};