@fitzzero/quickdraw-core 5.0.0 → 5.0.1

package/dist/server/index.d.ts

@@ -1,16 +1,16 @@
 import { J as AnyContract, at as ProjectionName, ai as FullProjectionOf, ac as CollectionName, ap as MethodName, d as StandardSchemaV1, c as InferOutput, N as NullableProjection, P as ProjectionList, aq as MethodOf, as as ParsedInputOf, ao as KindOf, A as AccessLevel, af as EntityOf, ar as OutputOf } from '../infer-Dw21kmLw.js';
-import { M as ModelName, v as PolicyFor, w as RowForms, x as AccessFor, H as HandlerContext, y as ModelColumn, z as WatchAccess, B as PublicAccess, E as HandlerArgs, G as CustomAccess, I as ShareMode, J as ChannelOptions, K as StreamOptions, u as RoomLeaveHandler, L as ChannelsRequired, f as Service, N as BaseContext, O as CallerFor, l as RunContext, m as RunOptions, o as StreamHandle, P as Presence, n as ServerRooms, Q as AccessPolicy, T as AnyAccessPolicy, V as PolicyColumns, X as PolicyForeign, Y as PolicyTools, k as AccessFilter, Z as RowAccess, q as AccessEngine, b as StorageWhere } from '../caller-DHzK3oiI.js';
-export { aI as ANY_FIELD, aA as AccessForm, aB as AccessRequest, _ as AffectsLink, p as AnyContext, A as AnyService, r as AppRooms, aC as AuthenticatedAccess, aq as CallOptions, i as Caller, a9 as ChannelAccess, aa as ChannelContext, ab as ChannelHandler, ac as ChannelImplementation, ad as ChannelRoomOf, a4 as CollectionScope, a6 as ContextRooms, a7 as ContextServices, C as CountArgs, a3 as DEFAULT_BULK_THRESHOLD, g as DevWarning, D as DevWarningError, h as DevWarningKind, aD as EntryAccess, F as FindManyArgs, e as FlushInfo, d as FlushSink, at as ForeignColumns, au as ForeignColumnsOf, aE as IdKeyOf, aF as IdSelector, av as MembershipRead, ar as MethodCaller, aM as N_PLUS_ONE_STATEMENTS, aw as ParentLink, ax as PolicyKind, ay as PolicyReads, $ as ProjectedOutput, a0 as Projection, ae as RoomLeave, af as RoomLeaveReason, ag as RoomLeft, ah as RoomTarget, az as RowLevel, R as RowLevels, aG as ScopeAccess, aH as ServiceAccess, as as ServiceCaller, ai as ServiceChannel, a5 as ServiceCollection, j as ServiceMethod, aj as ServiceStream, c as StatementCount, S as StorageAdapter, a as StorageRow, ak as StreamImplementation, al as StreamPushArgs, am as StreamPushManyArgs, an as StreamSeed, ao as StreamSeedContext, t as StreamSubscriptions, ap as StreamValidation, a1 as TierGroup, a2 as Tiers, a8 as TouchOptions, aJ as UnitOfWork, U as UnitOfWorkFactory, aK as UnitOfWorkScope, W as WriteRecord, aL as formatDevWarning, s as storageOf } from '../caller-DHzK3oiI.js';
-import { S as ServerOptions, Q as QuickdrawServer } from '../createServer-DUacdfKl.js';
-export { C as ClusterClient, t as ClusterOptions, D as DEFAULT_STALL_INTERVAL_MS, e as DEFAULT_STALL_MAX_MS, f as DEFAULT_STALL_THRESHOLD_MS, p as DisconnectUserOptions, E as EntitySubscription, a as EntitySubscriptions, H as HttpApp, I as IoRedisLike, M as MIN_STALL_INTERVAL_MS, m as QuickdrawIo, n as QuickdrawServerSocket, o as QuickdrawSocketData, x as RateLimitOptions, y as RateLimiter, R as RotateOptions, g as STALL_RESOLUTION_MS, b as ScopeSubscription, c as ScopeSubscriptions, l as ServerOnlyOptions, h as SlowMethod, q as SocketCors, r as SocketOptions, s as SocketRateLimitOptions, i as StallReport, j as StallWatchdogOptions, T as TopicWatch, d as TopicWatches, v as applyRateLimitMiddleware, u as createRateLimiter, k as createServer, w as createTieredRateLimiter } from '../createServer-DUacdfKl.js';
+import { M as ModelName, v as PolicyFor, w as RowForms, x as AccessFor, H as HandlerContext, y as ModelColumn, z as WatchAccess, B as PublicAccess, E as HandlerArgs, G as CustomAccess, I as ShareMode, J as ChannelOptions, K as StreamOptions, u as RoomLeaveHandler, L as ChannelsRequired, f as Service, N as BaseContext, O as CallerFor, l as RunContext, m as RunOptions, o as StreamHandle, P as Presence, n as ServerRooms, Q as AccessPolicy, T as AnyAccessPolicy, V as PolicyColumns, X as PolicyForeign, Y as PolicyTools, k as AccessFilter, Z as RowAccess, q as AccessEngine, b as StorageWhere } from '../caller-BqCYnpmC.js';
+export { aI as ANY_FIELD, aA as AccessForm, aB as AccessRequest, _ as AffectsLink, p as AnyContext, A as AnyService, r as AppRooms, aC as AuthenticatedAccess, aq as CallOptions, i as Caller, a9 as ChannelAccess, aa as ChannelContext, ab as ChannelHandler, ac as ChannelImplementation, ad as ChannelRoomOf, a4 as CollectionScope, a6 as ContextRooms, a7 as ContextServices, C as CountArgs, a3 as DEFAULT_BULK_THRESHOLD, g as DevWarning, D as DevWarningError, h as DevWarningKind, aD as EntryAccess, F as FindManyArgs, e as FlushInfo, d as FlushSink, at as ForeignColumns, au as ForeignColumnsOf, aE as IdKeyOf, aF as IdSelector, av as MembershipRead, ar as MethodCaller, aM as N_PLUS_ONE_STATEMENTS, aw as ParentLink, ax as PolicyKind, ay as PolicyReads, $ as ProjectedOutput, a0 as Projection, ae as RoomLeave, af as RoomLeaveReason, ag as RoomLeft, ah as RoomTarget, az as RowLevel, R as RowLevels, aG as ScopeAccess, aH as ServiceAccess, as as ServiceCaller, ai as ServiceChannel, a5 as ServiceCollection, j as ServiceMethod, aj as ServiceStream, c as StatementCount, S as StorageAdapter, a as StorageRow, ak as StreamImplementation, al as StreamPushArgs, am as StreamPushManyArgs, an as StreamSeed, ao as StreamSeedContext, t as StreamSubscriptions, ap as StreamValidation, a1 as TierGroup, a2 as Tiers, a8 as TouchOptions, aJ as UnitOfWork, U as UnitOfWorkFactory, aK as UnitOfWorkScope, W as WriteRecord, aL as formatDevWarning, s as storageOf } from '../caller-BqCYnpmC.js';
+import { S as ServerOptions, Q as QuickdrawServer } from '../createServer-CGsJlxM8.js';
+export { C as ClusterClient, t as ClusterOptions, D as DEFAULT_STALL_INTERVAL_MS, e as DEFAULT_STALL_MAX_MS, f as DEFAULT_STALL_THRESHOLD_MS, p as DisconnectUserOptions, E as EntitySubscription, a as EntitySubscriptions, H as HttpApp, I as IoRedisLike, M as MIN_STALL_INTERVAL_MS, m as QuickdrawIo, n as QuickdrawServerSocket, o as QuickdrawSocketData, x as RateLimitOptions, y as RateLimiter, R as RotateOptions, g as STALL_RESOLUTION_MS, b as ScopeSubscription, c as ScopeSubscriptions, l as ServerOnlyOptions, h as SlowMethod, q as SocketCors, r as SocketOptions, s as SocketRateLimitOptions, i as StallReport, j as StallWatchdogOptions, T as TopicWatch, d as TopicWatches, v as applyRateLimitMiddleware, u as createRateLimiter, k as createServer, w as createTieredRateLimiter } from '../createServer-CGsJlxM8.js';
 import { ad as Version } from '../envelope-nf5eGB-a.js';
 import { Q as QuickdrawTypes, D as DbOf, c as PrincipalOf, M as MaybePromise, b as McpContextOf, C as ContextExtensionOf, P as Principal } from '../types-Bwg3kIEc.js';
 export { a as McpContext, T as Transport } from '../types-Bwg3kIEc.js';
-import { a as DispatcherOptions, D as Dispatcher, c as DispatcherCollections } from '../http--uoooIH5.js';
-export { o as AccessChange, p as AccessChangeListener, A as AccessOptions, d as ChangeLogOptions, C as ContractOfServices, j as DEFAULT_LIMITS, f as DbOfServices, h as DispatchRequest, i as DispatchResult, n as DispatcherAccess, k as DispatcherLimits, s as HttpMiddleware, H as HttpRouter, u as HttpRouterOptions, b as HttpTransportOptions, L as LimitsOptions, l as PipelineOptions, P as PrincipalOfServices, R as RegisteredMethod, g as Registry, S as SharedData, m as SubscriptionLimits, T as TrackingOptions, V as VersionRequest, q as VersionSource, e as createDispatcher, r as createHttpRouter, t as toCallReply } from '../http--uoooIH5.js';
-import { l as CrudMethodName, d as CrudContractOptions, S as ScalarFieldOf, N as NumberFieldOf, m as CrudMethods, H as AdminMethodsOf, w as AdminContractOptions, G as AdminMethods } from '../admin-BiU4LRZS.js';
-import { S as SearchContractOptions, T as TextFieldOf, b as SearchMethods, n as SharingMethodName, f as SharingByNameMethod, g as SharingContractOptions, o as SharingMethods } from '../sharing-n4ss-ONM.js';
-import { l as AdminFieldConfig } from '../adminSchemas-k5a1Ov7b.js';
+import { a as DispatcherOptions, D as Dispatcher, c as DispatcherCollections } from '../http-D3fSFQ57.js';
+export { o as AccessChange, p as AccessChangeListener, A as AccessOptions, d as ChangeLogOptions, C as ContractOfServices, j as DEFAULT_LIMITS, f as DbOfServices, h as DispatchRequest, i as DispatchResult, n as DispatcherAccess, k as DispatcherLimits, s as HttpMiddleware, H as HttpRouter, u as HttpRouterOptions, b as HttpTransportOptions, L as LimitsOptions, l as PipelineOptions, P as PrincipalOfServices, R as RegisteredMethod, g as Registry, S as SharedData, m as SubscriptionLimits, T as TrackingOptions, V as VersionRequest, q as VersionSource, e as createDispatcher, r as createHttpRouter, t as toCallReply } from '../http-D3fSFQ57.js';
+import { l as CrudMethodName, d as CrudContractOptions, S as ScalarFieldOf, N as NumberFieldOf, m as CrudMethods, H as AdminMethodsOf, w as AdminContractOptions, G as AdminMethods } from '../admin-CBlTY0do.js';
+import { S as SearchContractOptions, T as TextFieldOf, b as SearchMethods, n as SharingMethodName, f as SharingByNameMethod, g as SharingContractOptions, o as SharingMethods } from '../sharing-CoreezAq.js';
+import { x as AdminNeverWritable, l as AdminFieldConfig } from '../adminSchemas-zji11V74.js';
 export { a as CallOutcome, C as CallRecord } from '../metrics-C0WvB7-I.js';
 export { b as AuthenticateRequest, A as AuthenticateResult, c as HttpAuthenticateRequest, d as HttpCredentialSource, S as ServerAuth, e as ServiceAccessSource, a as ServiceGrants, f as SocketAuthenticateRequest, r as recordSocketSession } from '../auth-CMyRkfjZ.js';
 import { Server } from 'socket.io';
@@ -616,8 +616,25 @@ declare function inherit<const Via extends string>(options: InheritOptions<Via>)
  */
 declare function anyOf<const P extends readonly AnyAccessPolicy[]>(...policies: P): AccessPolicy<PolicyColumns<P[number]>, PolicyForeign<P[number]>>;
 
+/** A membership table a resolver's levels depend on: `{ model, entry, user, level, levels? }`, as `members` takes it. */
+type ResolverMembership = MembersOptions;
+/** What a resolver's levels depend on: `resolver({ reads })`. Name at least one column or table. */
+interface ResolverReads<Column extends string = string, Membership extends ResolverMembership = ResolverMembership> {
+    /**
+     * Columns of the service's own model. A tracked write that sets one (or
+     * creates or deletes a row) re-checks that row, for every user. `tools.rows`
+     * reads them.
+     */
+    readonly columns?: readonly Column[];
+    /**
+     * Membership tables, one row per user and row of this service: `entry`
+     * holds the id of this service's row, as for `members`. A tracked write to
+     * one re-checks that user on that row.
+     */
+    readonly memberships?: readonly Membership[];
+}
 /** Options of {@link resolver}. */
-interface ResolverOptions<P extends Principal = Principal> {
+interface ResolverOptions<P extends Principal = Principal, Column extends string = string, Membership extends ResolverMembership = ResolverMembership> {
     /**
      * The principal's level on each of `ids`, as a map or a record by id. An id
      * left out, or given anything but an access level, has no level. Read
@@ -631,21 +648,52 @@ interface ResolverOptions<P extends Principal = Principal> {
      * no row.
      */
     readonly where?: (principal: P, level: AccessLevel, tools: PolicyTools) => MaybePromise<AccessFilter>;
+    /**
+     * What the levels depend on, so tracked writes re-check what they
+     * decided: live rows, collection scopes and change topics.
+     * `{ columns, memberships }` names the service's columns and the membership
+     * tables `levelsFor` and `where` read; `"none"` says nothing a tracked
+     * write changes can change a level (the levels come from the principal's
+     * grants alone, say). Without it nothing a write does re-checks this
+     * policy, and the server says so in development (`resolver-without-reads`).
+     */
+    readonly reads?: ResolverReads<Column, Membership> | "none";
 }
+/** The other models and columns the membership tables `M` read: what `defineService` checks. */
+type MembershipColumns<M> = M extends {
+    readonly model: infer Model extends string;
+    readonly entry: infer Entry extends string;
+    readonly user: infer User extends string;
+    readonly level: infer Level extends string;
+} ? {
+    readonly model: Model;
+    readonly columns: Entry | User | Level;
+} : never;
 /**
  * A policy written in app code: `levelsFor` answers the level per row and
  * `where` the list filter. A resolver's own results are memoized for the
- * request and never cached across requests, because the framework cannot
- * know which writes change them; what it reads through `tools` is cached as
- * usual.
+ * request and never cached across requests; what it reads through `tools`
+ * is: `tools.rows(ids)` reads `id` and the declared columns in one query,
+ * and `tools.memberships(table, userId, ids)` a member's levels, both kept
+ * with `cacheMs` and evicted by tracked writes when `reads` declares them.
+ *
+ * `reads` declares what the levels depend on, so a tracked write to it
+ * re-checks the live rows, collection scopes and change topics the policy
+ * authorized, as for the other builders: a user removed from a membership
+ * table stops receiving the rows it gave them. `defineService` checks the
+ * declared columns and tables against the app's database client.
  *
  * @example
  * access: resolver({
- *   levelsFor: async (principal, ids) => levelsFromMyTable(principal.userId, ids),
+ *   levelsFor: (principal, ids, tools) => levelsFromMyTables(principal.userId, ids, tools),
  *   where: (principal) => ({ visibility: "public" }),
+ *   reads: {
+ *     columns: ["visibility"],
+ *     memberships: [{ model: "teamMember", entry: "projectId", user: "userId", level: "role" }],
+ *   },
  * }),
  */
-declare function resolver<P extends Principal = Principal>(options: ResolverOptions<P>): AccessPolicy<never, never>;
+declare function resolver<P extends Principal = Principal, const Column extends string = never, const Membership extends ResolverMembership = never>(options: ResolverOptions<P, Column, Membership>): AccessPolicy<Column, MembershipColumns<Membership>>;
 
 /**
  * Every signed-in user has `level` on every row. Anonymous callers have no
@@ -1184,6 +1232,18 @@ interface AdminHandlersOptions<C extends AnyContract, A, Db = unknown> {
      * an entity with such a field. Default `false`.
      */
     readonly grants?: [Extract<AdminFieldOf<C>, "serviceAccess" | "service_access">] extends [never] ? never : boolean;
+    /**
+     * The only fields `adminCreate` and `adminUpdate` write (finding R1.4 of
+     * the 5.0.0 review): `adminMeta` reports every other field `editable:
+     * false`, so a generic form leaves it read-only, and a write naming one is
+     * refused with `VALIDATION` ("is not editable"). Each must be a field the
+     * kit shows, never `id` or a timestamp, and a `fieldOverrides` entry may
+     * not say otherwise about it. When `admin.contract` was given a list, this
+     * one must name the same fields, and without this one the contract's
+     * applies. Without either, the kit writes every field but `id`, the
+     * timestamps, the hidden ones and those an override made read-only.
+     */
+    readonly editable?: readonly Exclude<AdminFieldOf<C>, AdminNeverWritable>[];
     /** Changes to the configuration `adminMeta` derives, per field. */
     readonly fieldOverrides?: {
         readonly [Field in AdminFieldOf<C>]?: AdminFieldOverride;
@@ -1253,7 +1313,7 @@ type Empty = Record<never, never>;
 declare function handlers<C extends AnyContract, const A extends AdminAccess<C> = Empty, Db = unknown>(contract: C & NoInfer<AdminContract<C>>, options?: AdminHandlersOptions<C, A, Db>): AdminImplementations<C, A, Db>;
 /**
  * The admin kit: `admin.handlers(contract, { access?, displayName?,
- * hiddenFields?, fieldOverrides?, rowless?, grants? })` implements the
+ * hiddenFields?, editable?, fieldOverrides?, rowless?, grants? })` implements the
  * methods `admin.contract` made in `contract`, each open to a service-wide
  * `Admin` grant unless `access` gives another form. `admin.contract` is here
  * too, for server code; a shared package imports it from the root export.
@@ -1273,6 +1333,12 @@ declare const admin: Readonly<{
         readonly sort: `admin.contract: sort: "${Exclude<O extends infer T_3 ? T_3 extends O ? T_3 extends {
             readonly sort: readonly (infer Field extends string)[];
         } ? Field : never : never : never, ScalarFieldOf<Entity extends StandardSchemaV1<unknown, unknown> ? InferOutput<Entity> : never>> & string}" is not a field of the entity holding strings, numbers or booleans`;
+    }) & ([Exclude<O extends infer T_4 ? T_4 extends O ? T_4 extends {
+        readonly editable: readonly (infer Field extends string)[];
+    } ? Field : never : never : never, Exclude<keyof (Entity extends StandardSchemaV1<unknown, unknown> ? InferOutput<Entity> : never), AdminNeverWritable>>] extends [never] ? unknown : {
+        readonly editable: `admin.contract: editable: "${Exclude<O extends infer T_5 ? T_5 extends O ? T_5 extends {
+            readonly editable: readonly (infer Field extends string)[];
+        } ? Field : never : never : never, Exclude<keyof (Entity extends StandardSchemaV1<unknown, unknown> ? InferOutput<Entity> : never), AdminNeverWritable>> & string}" is not a field of the entity the kit may write`;
     }) : unknown>) => AdminMethods<O>;
     handlers: typeof handlers;
 }>;
@@ -1491,4 +1557,4 @@ declare function decryptIfEncrypted(value: string): string;
 /** Safe wrapper that returns `null` instead of throwing on invalid/stale ciphertext. */
 declare function tryDecrypt(ciphertext: string, logger?: Logger): string | null;
 
-export { ADMIN_HIDDEN_FIELDS, AccessEngine, AccessFilter, AccessFor, type AccessMap, AccessPolicy, type AdminAccess, type AdminContract, type AdminDefaultAccess, type AdminFieldOf, type AdminFieldOverride, type AdminHandlersOptions, type AdminImplementations, type AdminOnCommitted, type AdminOnWrite, type AdminOutputOf, type AdminWrite, type AffectsOption, AnyAccessPolicy, BaseContext, type BasicAccessEngineOptions, CHANNEL_ABUSE_MULTIPLIER, CHANNEL_ABUSE_WINDOW_MS, CallerFor, ChannelOptions, ChannelsRequired, type CollectionOption, type CollectionOptions, type CollectionsRequired, ContextExtensionOf, type ContextFactory, type CrudAccess, type CrudCreateOf, type CrudHandlersOptions, type CrudImplementations, type CrudKindOf, type CrudMethodsOf, type CrudPrepare, CustomAccess, DbOf, type DefineService, Dispatcher, DispatcherCollections, DispatcherOptions, type EnvValidationResult, HandlerArgs, HandlerContext, type HandlerOutputOf, type HandlerRow, INDEX_MAX_ROWS, type InheritOptions, type InitArgs, type InitOptions, type JsonAclOptions, type JsonColumnValue, type KitContext, type KitHandler, type KitHandlerArgs, type LegacyReply, MAX_APP_ROOMS, MAX_ITEM_IDS, MAX_STREAMS_PER_SOCKET, MaybePromise, McpContextOf, type MembersOptions, type MethodAccess, type MethodImplementation, ModelColumn, ModelName, type NextOrdinalOptions, ORDINAL_STEP, PRESENCE_MAX_LAST_SEEN, PolicyFor, PolicyTools, Presence, Principal, type PrincipalFor, PrincipalOf, type ProjectCheck, type ProjectionOption, PublicAccess, type Quickdraw, QuickdrawServer, QuickdrawTypes, RESUME_MAX_AGE_MS, RESUME_MAX_DELTAS, type RedisAdapterOptions, type RedisAdapterResult, type ResolverOptions, RoomLeaveHandler, RowAccess, type RowFor, RowForms, type RowFormsOf, RunContext, RunOptions, STREAM_MAX_SCOPES, type SearchAccess, type SearchContract, type SearchHandlersOptions, type SearchIdsOptions, type SearchImplementations, type SearchMethodsOf, type SearchStrategy, type SearchStrategyContext, ServerOptions, ServerRooms, Service, type ServiceDefinition, ShareMode, type SharingAccess, type SharingByNameOf, type SharingChange, type SharingChangeKind, type SharingContract, type SharingDefaultAccess, type SharingHandlersOptions, type SharingImplementations, type SharingKindOf, type SharingMethodsOf, type SharingOnChange, type SharingOptionsArgs, type SharingResolveUser, type SharingUserLookup, StorageWhere, StreamHandle, StreamOptions, type ValidateEnvOptions, WatchAccess, admin, anyOf, checkEnv, createBasicAccessEngine, crud, custom, decrypt, decryptIfEncrypted, displayNameOf, encrypt, everyone, inherit, initQuickdraw, isEncrypted, isRedisAdapterAvailable, jsonAcl, labelOf, meetsLevel, members, nextOrdinal, owner, requireEnv, requireRow, resolver, search, serviceGrant, setupRedisAdapter, sharing, tryDecrypt, validateEnv };
+export { ADMIN_HIDDEN_FIELDS, AccessEngine, AccessFilter, AccessFor, type AccessMap, AccessPolicy, type AdminAccess, type AdminContract, type AdminDefaultAccess, type AdminFieldOf, type AdminFieldOverride, type AdminHandlersOptions, type AdminImplementations, type AdminOnCommitted, type AdminOnWrite, type AdminOutputOf, type AdminWrite, type AffectsOption, AnyAccessPolicy, BaseContext, type BasicAccessEngineOptions, CHANNEL_ABUSE_MULTIPLIER, CHANNEL_ABUSE_WINDOW_MS, CallerFor, ChannelOptions, ChannelsRequired, type CollectionOption, type CollectionOptions, type CollectionsRequired, ContextExtensionOf, type ContextFactory, type CrudAccess, type CrudCreateOf, type CrudHandlersOptions, type CrudImplementations, type CrudKindOf, type CrudMethodsOf, type CrudPrepare, CustomAccess, DbOf, type DefineService, Dispatcher, DispatcherCollections, DispatcherOptions, type EnvValidationResult, HandlerArgs, HandlerContext, type HandlerOutputOf, type HandlerRow, INDEX_MAX_ROWS, type InheritOptions, type InitArgs, type InitOptions, type JsonAclOptions, type JsonColumnValue, type KitContext, type KitHandler, type KitHandlerArgs, type LegacyReply, MAX_APP_ROOMS, MAX_ITEM_IDS, MAX_STREAMS_PER_SOCKET, MaybePromise, McpContextOf, type MembersOptions, type MethodAccess, type MethodImplementation, ModelColumn, ModelName, type NextOrdinalOptions, ORDINAL_STEP, PRESENCE_MAX_LAST_SEEN, PolicyFor, PolicyTools, Presence, Principal, type PrincipalFor, PrincipalOf, type ProjectCheck, type ProjectionOption, PublicAccess, type Quickdraw, QuickdrawServer, QuickdrawTypes, RESUME_MAX_AGE_MS, RESUME_MAX_DELTAS, type RedisAdapterOptions, type RedisAdapterResult, type ResolverMembership, type ResolverOptions, type ResolverReads, RoomLeaveHandler, RowAccess, type RowFor, RowForms, type RowFormsOf, RunContext, RunOptions, STREAM_MAX_SCOPES, type SearchAccess, type SearchContract, type SearchHandlersOptions, type SearchIdsOptions, type SearchImplementations, type SearchMethodsOf, type SearchStrategy, type SearchStrategyContext, ServerOptions, ServerRooms, Service, type ServiceDefinition, ShareMode, type SharingAccess, type SharingByNameOf, type SharingChange, type SharingChangeKind, type SharingContract, type SharingDefaultAccess, type SharingHandlersOptions, type SharingImplementations, type SharingKindOf, type SharingMethodsOf, type SharingOnChange, type SharingOptionsArgs, type SharingResolveUser, type SharingUserLookup, StorageWhere, StreamHandle, StreamOptions, type ValidateEnvOptions, WatchAccess, admin, anyOf, checkEnv, createBasicAccessEngine, crud, custom, decrypt, decryptIfEncrypted, displayNameOf, encrypt, everyone, inherit, initQuickdraw, isEncrypted, isRedisAdapterAvailable, jsonAcl, labelOf, meetsLevel, members, nextOrdinal, owner, requireEnv, requireRow, resolver, search, serviceGrant, setupRedisAdapter, sharing, tryDecrypt, validateEnv };

package/dist/server/index.js

@@ -20,6 +20,8 @@ import {
   accessFormProblem,
   afterCursor,
   allowedScopes,
+  anyOf,
+  anyOfPolicies,
   applyRateLimitMiddleware,
   checkName,
   checkWhenDefined,
@@ -36,7 +38,6 @@ import {
   definePolicy,
   encodeCursor,
   handlerProblem,
-  idFilter,
   inputKeys,
   isAccessPolicy,
   isCustomAccess,
@@ -47,16 +48,19 @@ import {
   markGrantsEditor,
   maxLevel,
   meetsLevel,
+  members,
   membersWhere,
+  membershipOf,
   orderByOf,
   projectRow,
   projectedOutput,
   registerRuntime,
+  resolver,
   selectWith,
   serviceGrant,
   strip,
   watchAdapterClients
-} from "../chunk-LLLYILEP.js";
+} from "../chunk-NS5PUHIZ.js";
 import {
   DevWarningError,
   N_PLUS_ONE_STATEMENTS,
@@ -64,13 +68,13 @@ import {
   currentRev,
   formatDevWarning,
   runBeforeAnyDispatcher
-} from "../chunk-DNCAI3KY.js";
+} from "../chunk-4DIQHASK.js";
 import {
   crud,
   crudSpecOf,
   sharing,
   sharingSpecOf
-} from "../chunk-5IC5VZ7T.js";
+} from "../chunk-3JNMVB2V.js";
 import "../chunk-QEKVYG5F.js";
 import {
   abortError,
@@ -98,13 +102,13 @@ import {
   adminSpecOf,
   search,
   searchSpecOf
-} from "../chunk-B2UQ27GH.js";
+} from "../chunk-CDKG4TFA.js";
 import {
   ACCESS_LEVELS,
   entityRoom,
   isAccessLevel,
   reservedRoomPrefix
-} from "../chunk-7QIY2DDX.js";
+} from "../chunk-WVIRXYI4.js";
 import {
   CHANNEL_DEFAULT_RATE,
   DEFAULT_COLLECTION_LIMIT,
@@ -1084,60 +1088,6 @@ function jsonAcl(field, options = {}) {
   return policy;
 }
 
-// src/server/access/policies/members.ts
-function membershipOf(policy) {
-  return policy.kind === "members" ? policy.reads.memberships[0] : void 0;
-}
-function checkLevels(levels) {
-  if (levels === void 0) {
-    return void 0;
-  }
-  const valid = typeof levels === "object" && levels !== null && !Array.isArray(levels) && Object.values(levels).every(isAccessLevel);
-  if (!valid) {
-    throw new TypeError(
-      'members({ levels }): levels must map stored roles to access levels, as in { editor: "Moderate" }'
-    );
-  }
-  return Object.freeze({ ...levels });
-}
-function rolesAtLeast(read, level) {
-  const enough = new Set(levelsAtLeast(level));
-  if (read.levels === void 0) {
-    return [...enough];
-  }
-  return Object.entries(read.levels).filter(([, mapped]) => enough.has(mapped)).map(([role]) => role);
-}
-function members(options) {
-  if (typeof options !== "object" || options === null) {
-    throw new TypeError("members(options): options must be { model, entry, user, level }");
-  }
-  const read = Object.freeze({
-    model: checkName("members({ model })", "model", options.model),
-    entry: checkName("members({ entry })", "entry", options.entry),
-    user: checkName("members({ user })", "user", options.user),
-    level: checkName("members({ level })", "level", options.level),
-    levels: checkLevels(options.levels)
-  });
-  return definePolicy({
-    kind: "members",
-    membership: read,
-    reads: { columns: [], memberships: [read], inherits: [], storage: true },
-    levelsFor: (principal, ids, tools) => tools.memberships(read, principal.userId, ids),
-    async accessWhere(principal, level, tools) {
-      const roles = rolesAtLeast(read, level);
-      if (roles.length === 0) {
-        return "none";
-      }
-      const rows = await tools.storage.findMany(read.model, {
-        where: { [read.user]: principal.userId, [read.level]: { in: roles } },
-        select: { [read.entry]: true }
-      });
-      const entries = rows.map((row) => row[read.entry]);
-      return idFilter(entries.filter((entry) => typeof entry === "string"));
-    }
-  });
-}
-
 // src/server/access/policies/inherit.ts
 function isContract3(value) {
   return typeof value === "object" && value !== null && typeof value.name === "string" && Object.isFrozen(value);
@@ -1185,101 +1135,6 @@ function inherit(options) {
   });
 }
 
-// src/server/access/policies/anyOf.ts
-function unionReads(policies) {
-  const memberships = /* @__PURE__ */ new Set();
-  for (const policy of policies) {
-    for (const read of policy.reads.memberships) {
-      memberships.add(read);
-    }
-  }
-  return {
-    columns: [...new Set(policies.flatMap((policy) => policy.reads.columns))],
-    memberships: [...memberships],
-    inherits: [...new Set(policies.flatMap((policy) => policy.reads.inherits))],
-    parents: policies.flatMap((policy) => policy.reads.parents ?? []),
-    storage: policies.some((policy) => policy.reads.storage)
-  };
-}
-var MEMBERS = /* @__PURE__ */ new WeakMap();
-function anyOfPolicies(policy) {
-  return MEMBERS.get(policy);
-}
-function anyOf(...policies) {
-  if (policies.length === 0 || !policies.every(isAccessPolicy)) {
-    throw new TypeError("anyOf(...policies): pass one or more access policies");
-  }
-  const all = Object.freeze([...policies]);
-  const combined = definePolicy({
-    kind: "anyOf",
-    policies: all,
-    reads: unionReads(all),
-    async levelsFor(principal, ids, tools) {
-      const each = await Promise.all(all.map((policy) => policy.levelsFor(principal, ids, tools)));
-      const levels = /* @__PURE__ */ new Map();
-      for (const id of ids) {
-        levels.set(
-          id,
-          each.reduce((level, granted) => maxLevel(level, granted.get(id)), null)
-        );
-      }
-      return levels;
-    },
-    async accessWhere(principal, level, tools) {
-      const filters = await Promise.all(
-        all.map((policy) => policy.accessWhere(principal, level, tools))
-      );
-      const matching = filters.filter((filter) => filter !== "none");
-      if (matching.some((filter) => Object.keys(filter).length === 0)) {
-        return {};
-      }
-      if (matching.length <= 1) {
-        return matching[0] ?? "none";
-      }
-      return { OR: matching };
-    }
-  });
-  MEMBERS.set(combined, all);
-  return combined;
-}
-
-// src/server/access/policies/resolver.ts
-function levelIn(levels, id) {
-  let level;
-  if (levels instanceof Map) {
-    level = levels.get(id);
-  } else if (Object.hasOwn(levels, id)) {
-    level = levels[id];
-  }
-  return isAccessLevel(level) ? level : null;
-}
-function resolver(options) {
-  const valid = typeof options === "object" && options !== null && typeof options.levelsFor === "function" && (options.where === void 0 || typeof options.where === "function");
-  if (!valid) {
-    throw new TypeError("resolver({ levelsFor, where? }): levelsFor and where must be functions");
-  }
-  const { levelsFor, where } = options;
-  return definePolicy({
-    kind: "resolver",
-    reads: { columns: [], memberships: [], inherits: [], storage: false },
-    async levelsFor(principal, ids, tools) {
-      const levels = await levelsFor(principal, ids, tools);
-      if (typeof levels !== "object" || levels === null) {
-        return levelsById(ids, () => null);
-      }
-      return levelsById(ids, (id) => levelIn(levels, id));
-    },
-    async accessWhere(principal, level, tools) {
-      if (where === void 0) {
-        return "none";
-      }
-      const filter = await where(principal, level, tools);
-      const isFilter = typeof filter === "object" && filter !== null && !Array.isArray(filter);
-      return isFilter ? filter : "none";
-    }
-  });
-}
-
 // src/server/access/policies/everyone.ts
 function everyone(level) {
   if (!isAccessLevel(level) || level === "Public") {
@@ -2483,7 +2338,7 @@ function parseList(value) {
   }
   return Array.isArray(value) && value.every(isEntry) ? value : void 0;
 }
-function levelIn2(entries, userId) {
+function levelIn(entries, userId) {
   return entries.filter((entry) => entry.userId === userId).reduce((level, entry) => maxLevel(level, entry.level), null);
 }
 function entriesOf(entries, userId) {
@@ -2792,7 +2647,7 @@ function refusal2(listed, change, model) {
       `That user owns this ${model}: an owner's access cannot be shared, changed or taken away`
     );
   }
-  if (change.listed && levelIn2(listed.entries, change.userId) === null) {
+  if (change.listed && levelIn(listed.entries, change.userId) === null) {
     return new QuickdrawError("NOT_FOUND", `This ${model} is not shared with that user`);
   }
   return void 0;
@@ -2819,7 +2674,7 @@ async function changeList(call, context, change) {
       throw problem;
     }
     await checkLastAdmin(call, tx, listed, change);
-    const before = levelIn2(listed.entries, change.userId);
+    const before = levelIn(listed.entries, change.userId);
     if (before === change.level && entriesOf(listed.entries, change.userId) === 1) {
       return sharesOf(listed.entries);
     }
@@ -3335,6 +3190,53 @@ function checkOverrides(fieldOverrides, names, hidden, fail5) {
   }
   return fieldOverrides;
 }
+function quoted(names) {
+  return names.map((name) => `"${name}"`).join(", ");
+}
+function checkEditable(editable, declared, shown, fail5) {
+  const named = (label, list2) => {
+    for (const name of list2) {
+      if (ADMIN_NEVER_WRITABLE.includes(name)) {
+        fail5(`${label}: "${name}" is never editable; the database sets it`);
+      }
+      if (!shown(name)) {
+        fail5(`${label}: "${name}" is not a field of the entity the kit shows`);
+      }
+    }
+    return new Set(list2);
+  };
+  if (editable === void 0) {
+    return declared === void 0 ? void 0 : named("admin.contract's editable", declared);
+  }
+  const valid = Array.isArray(editable) && editable.every((name) => typeof name === "string") && new Set(editable).size === editable.length;
+  if (!valid) {
+    fail5("editable must be a list of distinct field names");
+  }
+  const list = named("editable", editable);
+  if (declared !== void 0 && (declared.length !== list.size || !declared.every((name) => list.has(name)))) {
+    fail5(
+      `editable names ${quoted(editable)}, but admin.contract was given ${quoted(declared)}: give both halves the same fields`
+    );
+  }
+  return list;
+}
+function checkAgreement(overrides, editable, fail5) {
+  if (editable === void 0) {
+    return;
+  }
+  for (const [name, override] of Object.entries(overrides)) {
+    if (override.editable === true && !editable.has(name)) {
+      fail5(
+        `fieldOverrides: "${name}" is editable: true, which editable leaves out; name it in editable instead`
+      );
+    }
+    if (override.editable === false && editable.has(name)) {
+      fail5(
+        `fieldOverrides: "${name}" is editable: false, which editable names; leave it out of editable instead`
+      );
+    }
+  }
+}
 function derived(field, grants) {
   const fixed = Object.hasOwn(DEFAULT_FIELDS, field.name) ? DEFAULT_FIELDS[field.name] : void 0;
   if (fixed !== void 0) {
@@ -3372,10 +3274,18 @@ function adminFieldsOf(serviceName, spec, options, fail5) {
     fail5(`"${listed}" is hidden, so adminList may not filter or sort on it`);
   }
   const overrides = checkOverrides(options.fieldOverrides, names, hidden, fail5);
+  const editable = checkEditable(
+    options.editable,
+    spec.editable,
+    (name) => names.includes(name) && !hidden.has(name),
+    fail5
+  );
+  checkAgreement(overrides, editable, fail5);
   const fields = ordered(spec.fields).filter((field) => !hidden.has(field.name)).map(
     (field) => frozenConfig({
       ...derived(field, grants),
       ...overrides[field.name],
+      ...editable === void 0 ? {} : { editable: editable.has(field.name) },
       sortable: spec.sort.includes(field.name),
       filterable: spec.filter.includes(field.name)
     })
@@ -3701,6 +3611,7 @@ var OPTION_KEYS4 = [
   "access",
   "displayName",
   "hiddenFields",
+  "editable",
   "fieldOverrides",
   "rowless",
   "grants",
@@ -3741,7 +3652,7 @@ function checkOptions3(options) {
   }
   if (!isRecord11(options)) {
     fail4(
-      "options must be { access?, displayName?, hiddenFields?, fieldOverrides?, rowless?, grants?, onWrite?, onCommitted? }"
+      "options must be { access?, displayName?, hiddenFields?, editable?, fieldOverrides?, rowless?, grants?, onWrite?, onCommitted? }"
     );
   }
   const unknownKey = Object.keys(options).find((key) => !OPTION_KEYS4.includes(key));
@@ -3768,13 +3679,28 @@ function checkAccess3(access, names) {
   }
   return access;
 }
+function contractEditable(contract, specs) {
+  const lists = /* @__PURE__ */ new Map();
+  for (const { editable } of specs) {
+    if (editable !== void 0) {
+      lists.set([...editable].sort().join("\0"), editable);
+    }
+  }
+  if (lists.size > 1) {
+    fail4(
+      `admin.contract was given two editable lists for ${contract.name}: give its write methods one`
+    );
+  }
+  return [...lists.values()][0];
+}
 function fieldsOf(contract, kit, options) {
   const specs = kit.map(([, spec2]) => spec2);
   const [first] = specs;
   const spec = {
     fields: first?.fields ?? [],
     filter: [...new Set(specs.flatMap((one) => one.filter))],
-    sort: [...new Set(specs.flatMap((one) => one.sort))]
+    sort: [...new Set(specs.flatMap((one) => one.sort))],
+    editable: contractEditable(contract, specs)
   };
   return adminFieldsOf(
     contract.name,
@@ -3782,6 +3708,7 @@ function fieldsOf(contract, kit, options) {
     {
       displayName: options.displayName,
       hiddenFields: options.hiddenFields,
+      editable: options.editable,
       fieldOverrides: options.fieldOverrides,
       grants: options.grants
     },