@fitzzero/quickdraw-core 5.0.0 → 5.1.0

package/dist/{chunk-LLLYILEP.js → chunk-A6DJBGOG.js}

@@ -10,7 +10,7 @@ import {
   quietly,
   strictWarningsOf,
   versionTime
-} from "./chunk-DNCAI3KY.js";
+} from "./chunk-4DIQHASK.js";
 import {
   isCallEnvelope,
   isCancel
@@ -30,7 +30,7 @@ import {
   toQuickdrawError,
   toWireIssues,
   withSignal
-} from "./chunk-2XJFNVHW.js";
+} from "./chunk-2PWMUVC7.js";
 import {
   createRecorder,
   describeError,
@@ -77,7 +77,7 @@ import {
   streamRoom,
   topicRoom,
   userRoom
-} from "./chunk-7QIY2DDX.js";
+} from "./chunk-VJTFXHOK.js";
 import {
   hasJsonSchema
 } from "./chunk-47AEXVDM.js";
@@ -424,9 +424,9 @@ function addBranchKeys(node, root, keys, seen) {
     }
   }
   for (const keyword of BRANCHES) {
-    const members = target2[keyword];
-    if (Array.isArray(members)) {
-      for (const member of members) {
+    const members2 = target2[keyword];
+    if (Array.isArray(members2)) {
+      for (const member of members2) {
         addBranchKeys(member, root, keys, seen);
       }
     }
@@ -673,12 +673,12 @@ async function membersAmong(storage, collection, scope, ids) {
 }
 async function readItemsById(storage, collection, scope, ids, rev) {
   const wanted = [...new Set(ids)];
-  const members = wanted.length === 0 ? void 0 : await membersAmong(storage, collection, scope, wanted);
-  if (members === void 0) {
+  const members2 = wanted.length === 0 ? void 0 : await membersAmong(storage, collection, scope, wanted);
+  if (members2 === void 0) {
     return { rev, items: [] };
   }
   const rows = await storage.findMany(collection.model, {
-    where: members,
+    where: members2,
     select: collection.item.select
   });
   const found = new Map(rows.flatMap((row) => typeof row.id === "string" ? [[row.id, row]] : []));
@@ -792,10 +792,10 @@ function indexRowFrom(collection, item, row, rev) {
   const id = typeof row.id === "string" ? row.id : "";
   return [id, version ?? rev, ...(collection.index ?? []).map((field) => values[field] ?? null)];
 }
-async function readIndex(storage, collection, members, nullable, rev, max = INDEX_MAX_ROWS) {
+async function readIndex(storage, collection, members2, nullable, rev, max = INDEX_MAX_ROWS) {
   const fields = collection.index ?? [];
   const rows = await storage.findMany(collection.model, {
-    where: members,
+    where: members2,
     select: indexSelect(collection, fields),
     orderBy: orderByOf(collection.order, nullable),
     take: max + 1
@@ -1056,8 +1056,17 @@ function bindingOf(state, contract) {
   }
   return binding;
 }
+function sameRead(a, b) {
+  const columns = ["model", "entry", "user", "level"].every((key) => a[key] === b[key]);
+  if (!columns || a.levels === void 0 || b.levels === void 0) {
+    return columns && a.levels === b.levels;
+  }
+  const mapped = b.levels;
+  const roles = Object.entries(a.levels);
+  return roles.length === Object.keys(mapped).length && roles.every(([role, level]) => Object.hasOwn(mapped, role) && mapped[role] === level);
+}
 function membershipScope(scope, binding, read) {
-  const declared = binding.memberships.get(read);
+  const declared = binding.memberships.get(read) ?? [...binding.memberships].find(([known]) => sameRead(known, read))?.[1];
   if (declared !== void 0) {
     return [scope.cached, declared];
   }
@@ -1538,8 +1547,11 @@ function receive(deps, state, frame) {
     return;
   }
   const { principal } = state.socket.data;
-  const parsed = principal === null ? void 0 : parse(deps, channel, payload);
-  if (principal === null || parsed === void 0) {
+  if (principal === null || channel.kinds?.has(principal.kind ?? "") === false) {
+    return;
+  }
+  const parsed = parse(deps, channel, payload);
+  if (parsed === void 0) {
     return;
   }
   const room = allowed(channel, state.socket, principal, parsed.value);
@@ -2098,6 +2110,44 @@ var StreamIndex = class {
   }
 };
 
+// src/server/access/kinds.ts
+function isKindList(value) {
+  return Array.isArray(value) && value.length > 0 && value.every((kind) => typeof kind === "string" && kind.length > 0);
+}
+function narrowKinds(value, above, fail5) {
+  if (value === void 0) {
+    return above?.kinds;
+  }
+  if (!isKindList(value)) {
+    fail5(
+      'kinds must be a non-empty list of principal kinds (strings), such as ["user"]; leave it out to admit every kind'
+    );
+  }
+  if (above?.kinds !== void 0) {
+    const { kinds, by } = above;
+    const wider = value.find((kind) => !kinds.includes(kind));
+    if (wider !== void 0) {
+      fail5(
+        `kinds may only narrow the kinds ${by} admits (${kinds.join(", ")}), and "${wider}" is not one of them`
+      );
+    }
+  }
+  return Object.freeze([...new Set(value)]);
+}
+function checkKind(kinds, principal, what) {
+  if (kinds === void 0 || principal === null) {
+    return;
+  }
+  const { kind } = principal;
+  if (typeof kind === "string" && kinds.includes(kind)) {
+    return;
+  }
+  throw new QuickdrawError(
+    "FORBIDDEN",
+    kind === void 0 ? `${what} is not open to a principal without a kind` : `${what} is not open to principals of kind "${String(kind)}"`
+  );
+}
+
 // src/server/realtime/streamTargets.ts
 function isName(value) {
   return typeof value === "string" && value.length > 0;
@@ -2144,6 +2194,7 @@ function inStreamRoom(socket, access, scope) {
   return room !== void 0 && joined !== void 0 && Object.hasOwn(joined, room);
 }
 async function authorizeStream(hub, socket, target2) {
+  checkKind(target2.service.kinds, socket.data.principal, target2.service.name);
   const { room } = target2.stream;
   if (room !== void 0) {
     if (!inStreamRoom(socket, room, target2.scope)) {
@@ -2336,6 +2387,220 @@ function createBasicAccessEngine(options = {}) {
   });
 }
 
+// src/server/access/policies/anyOf.ts
+function unionReads(policies) {
+  const memberships = /* @__PURE__ */ new Set();
+  for (const policy of policies) {
+    for (const read of policy.reads.memberships) {
+      memberships.add(read);
+    }
+  }
+  return {
+    columns: [...new Set(policies.flatMap((policy) => policy.reads.columns))],
+    memberships: [...memberships],
+    inherits: [...new Set(policies.flatMap((policy) => policy.reads.inherits))],
+    parents: policies.flatMap((policy) => policy.reads.parents ?? []),
+    storage: policies.some((policy) => policy.reads.storage)
+  };
+}
+var MEMBERS = /* @__PURE__ */ new WeakMap();
+function anyOfPolicies(policy) {
+  return MEMBERS.get(policy);
+}
+function anyOf(...policies) {
+  if (policies.length === 0 || !policies.every(isAccessPolicy)) {
+    throw new TypeError("anyOf(...policies): pass one or more access policies");
+  }
+  const all = Object.freeze([...policies]);
+  const combined = definePolicy({
+    kind: "anyOf",
+    policies: all,
+    reads: unionReads(all),
+    async levelsFor(principal, ids, tools) {
+      const each = await Promise.all(all.map((policy) => policy.levelsFor(principal, ids, tools)));
+      const levels = /* @__PURE__ */ new Map();
+      for (const id of ids) {
+        levels.set(
+          id,
+          each.reduce((level, granted) => maxLevel(level, granted.get(id)), null)
+        );
+      }
+      return levels;
+    },
+    async accessWhere(principal, level, tools) {
+      const filters = await Promise.all(
+        all.map((policy) => policy.accessWhere(principal, level, tools))
+      );
+      const matching = filters.filter((filter) => filter !== "none");
+      if (matching.some((filter) => Object.keys(filter).length === 0)) {
+        return {};
+      }
+      if (matching.length <= 1) {
+        return matching[0] ?? "none";
+      }
+      return { OR: matching };
+    }
+  });
+  MEMBERS.set(combined, all);
+  return combined;
+}
+
+// src/server/access/policies/members.ts
+function membershipOf(policy) {
+  return policy.kind === "members" ? policy.reads.memberships[0] : void 0;
+}
+function checkLevels(owner, levels) {
+  if (levels === void 0) {
+    return void 0;
+  }
+  const valid = typeof levels === "object" && levels !== null && !Array.isArray(levels) && Object.values(levels).every(isAccessLevel);
+  if (!valid) {
+    throw new TypeError(
+      `${owner}: levels must map stored roles to access levels, as in { editor: "Moderate" }`
+    );
+  }
+  return Object.freeze({ ...levels });
+}
+function membershipRead(options, owner) {
+  const { model, entry, user, level, levels } = options;
+  return Object.freeze({
+    model: checkName(owner("model"), "model", model),
+    entry: checkName(owner("entry"), "entry", entry),
+    user: checkName(owner("user"), "user", user),
+    level: checkName(owner("level"), "level", level),
+    levels: checkLevels(owner("levels"), levels)
+  });
+}
+function rolesAtLeast(read, level) {
+  const enough = new Set(levelsAtLeast(level));
+  if (read.levels === void 0) {
+    return [...enough];
+  }
+  return Object.entries(read.levels).filter(([, mapped]) => enough.has(mapped)).map(([role]) => role);
+}
+function members(options) {
+  if (typeof options !== "object" || options === null) {
+    throw new TypeError("members(options): options must be { model, entry, user, level }");
+  }
+  const read = membershipRead(options, (option) => `members({ ${option} })`);
+  return definePolicy({
+    kind: "members",
+    membership: read,
+    reads: { columns: [], memberships: [read], inherits: [], storage: true },
+    levelsFor: (principal, ids, tools) => tools.memberships(read, principal.userId, ids),
+    async accessWhere(principal, level, tools) {
+      const roles = rolesAtLeast(read, level);
+      if (roles.length === 0) {
+        return "none";
+      }
+      const rows = await tools.storage.findMany(read.model, {
+        where: { [read.user]: principal.userId, [read.level]: { in: roles } },
+        select: { [read.entry]: true }
+      });
+      const entries = rows.map((row) => row[read.entry]);
+      return idFilter(entries.filter((entry) => typeof entry === "string"));
+    }
+  });
+}
+
+// src/server/access/policies/resolver.ts
+var UNDECLARED = /* @__PURE__ */ new WeakSet();
+function declaresNoReads(policy) {
+  return UNDECLARED.has(policy);
+}
+function noReads() {
+  return { columns: [], memberships: [], inherits: [], storage: false };
+}
+var READ_KEYS = ["columns", "memberships"];
+function readsProblem(message) {
+  throw new TypeError(`resolver({ reads }): ${message}`);
+}
+function checkColumns(columns) {
+  if (columns === void 0) {
+    return [];
+  }
+  const valid = Array.isArray(columns) && columns.every((column) => typeof column === "string" && column.length > 0);
+  return valid ? Object.freeze([...new Set(columns)]) : readsProblem("columns must be a list of column names");
+}
+function checkMemberships(memberships) {
+  if (memberships === void 0) {
+    return [];
+  }
+  const valid = Array.isArray(memberships) && memberships.every((each) => typeof each === "object" && each !== null && !Array.isArray(each));
+  if (!valid) {
+    readsProblem("memberships must be a list of { model, entry, user, level, levels? }");
+  }
+  return Object.freeze(
+    memberships.map(
+      (each) => membershipRead(each, () => "resolver({ reads: { memberships } })")
+    )
+  );
+}
+function checkReads(reads) {
+  if (reads === void 0) {
+    return void 0;
+  }
+  if (reads === "none") {
+    return noReads();
+  }
+  if (typeof reads !== "object" || reads === null || Array.isArray(reads)) {
+    readsProblem('reads must be { columns?, memberships? } or "none"');
+  }
+  const given = reads;
+  const unknownKey = Object.keys(given).find((key) => !READ_KEYS.includes(key));
+  if (unknownKey !== void 0) {
+    readsProblem(`reads has an unknown key "${unknownKey}"; the keys are columns and memberships`);
+  }
+  const columns = checkColumns(given.columns);
+  const memberships = checkMemberships(given.memberships);
+  if (columns.length === 0 && memberships.length === 0) {
+    readsProblem('name a column or a membership table, or pass "none"');
+  }
+  return { columns, memberships, inherits: [], storage: true };
+}
+function levelIn(levels, id) {
+  let level;
+  if (levels instanceof Map) {
+    level = levels.get(id);
+  } else if (Object.hasOwn(levels, id)) {
+    level = levels[id];
+  }
+  return isAccessLevel(level) ? level : null;
+}
+function resolver(options) {
+  const valid = typeof options === "object" && options !== null && typeof options.levelsFor === "function" && (options.where === void 0 || typeof options.where === "function");
+  if (!valid) {
+    throw new TypeError(
+      "resolver({ levelsFor, where?, reads? }): levelsFor and where must be functions"
+    );
+  }
+  const { levelsFor, where: where2 } = options;
+  const reads = checkReads(options.reads);
+  const policy = definePolicy({
+    kind: "resolver",
+    reads: reads ?? noReads(),
+    async levelsFor(principal, ids, tools) {
+      const levels = await levelsFor(principal, ids, tools);
+      if (typeof levels !== "object" || levels === null) {
+        return levelsById(ids, () => null);
+      }
+      return levelsById(ids, (id) => levelIn(levels, id));
+    },
+    async accessWhere(principal, level, tools) {
+      if (where2 === void 0) {
+        return "none";
+      }
+      const filter = await where2(principal, level, tools);
+      const isFilter = typeof filter === "object" && filter !== null && !Array.isArray(filter);
+      return isFilter ? filter : "none";
+    }
+  });
+  if (reads === void 0) {
+    UNDECLARED.add(policy);
+  }
+  return policy;
+}
+
 // src/server/collections/scopes.ts
 function serviceOf2(anchor) {
   return anchor.slice(0, anchor.indexOf("\0"));
@@ -4146,6 +4411,8 @@ function mayWatchService(service, principal) {
   return meetsLevel(serviceGrant(principal, service.name), form.service);
 }
 async function authorizeWatch(hub, principal, target2) {
+  const service = target2.kind === "service" ? target2.service : target2.collection.service;
+  checkKind(service.kinds, principal, service.name);
   if (target2.kind === "service" && target2.service.watchAccess === void 0) {
     throw new QuickdrawError(
       "FORBIDDEN",
@@ -4211,9 +4478,9 @@ async function nullableColumns(storage, collection, values) {
   return nullable;
 }
 async function readRows4(storage, collection, read) {
-  const { members, values, nullable, limit } = read;
+  const { members: members2, values, nullable, limit } = read;
   const { order } = collection;
-  const where2 = values === void 0 ? members : { AND: [members, afterCursor(order, values, nullable)] };
+  const where2 = values === void 0 ? members2 : { AND: [members2, afterCursor(order, values, nullable)] };
   const [rows, total] = await Promise.allSettled([
     storage.findMany(collection.model, {
       where: where2,
@@ -4224,7 +4491,7 @@ async function readRows4(storage, collection, read) {
       orderBy: orderByOf(order, nullable),
       take: limit + 1
     }),
-    storage.count(collection.model, { where: members })
+    storage.count(collection.model, { where: members2 })
   ]);
   if (total.status === "rejected") {
     throw total.reason;
@@ -4244,15 +4511,15 @@ async function readPage(storage, collection, request, rev) {
   const { order } = collection;
   const values = request.cursor === void 0 ? void 0 : decodeCursor(order, request.cursor);
   const nullable = await nullableColumns(storage, collection, values);
-  const members = await membersWhere(storage, collection, request.scope);
+  const members2 = await membersWhere(storage, collection, request.scope);
   const page = { ok: true, rev, limit, ...clamped ? { clamped: true } : {} };
   const indexed = values === void 0 && collection.index !== void 0;
-  if (members === void 0) {
+  if (members2 === void 0) {
     return { ...page, items: [], total: 0, cursor: null, ...indexed ? { index: [] } : {} };
   }
   const [{ rows, total }, index] = await Promise.all([
-    readRows4(storage, collection, { members, values, nullable, limit }),
-    indexed ? readIndex(storage, collection, members, nullable, rev) : void 0
+    readRows4(storage, collection, { members: members2, values, nullable, limit }),
+    indexed ? readIndex(storage, collection, members2, nullable, rev) : void 0
   ]);
   const shown = rows.slice(0, limit);
   const last = shown.at(-1);
@@ -4423,6 +4690,7 @@ function collectionSubscriptions(hub) {
     answerEvent(socket, context, CLIENT_EVENTS.collectionSub, async (frame) => {
       const request = readSubscribe(frame);
       const { collection } = servedCollection(hub, socket, request);
+      checkKind(collection.service.kinds, socket.data.principal, collection.service.name);
       return await subscribeScope(hub, socket, collection, request);
     });
     answerEvent(socket, context, CLIENT_EVENTS.collectionItems, async (frame) => {
@@ -5074,13 +5342,18 @@ function createRealtime(hub) {
         rooms.disconnected(socket);
       });
     },
+    legacyExtension(socket, context) {
+      onDisconnect(socket, context, () => {
+        rooms.disconnected(socket);
+      });
+    },
     presence,
     rooms: rooms.server,
     onRoomLeave: (hooks, run2) => {
       rooms.onLeave(hooks, run2);
     },
     roomsFor(transport, connectionId, share) {
-      const socket = transport === "socket" && connectionId !== void 0 ? hub.io?.sockets.sockets.get(connectionId) : void 0;
+      const socket = (transport === "socket" || transport === "legacy") && connectionId !== void 0 ? hub.io?.sockets.sockets.get(connectionId) : void 0;
       const own = socket === void 0 ? rooms.detached : rooms.of(socket);
       return share === void 0 ? own : unjoinable(own, share);
     },
@@ -5686,6 +5959,7 @@ async function onSubscribe(hub, socket, frame) {
   if (socket.data.principal === null) {
     throw new QuickdrawError("UNAUTHENTICATED", "Authentication required");
   }
+  checkKind(target2.service.kinds, socket.data.principal, target2.service.name);
   if (hub.storage === void 0) {
     throw new QuickdrawError(
       "INTERNAL",
@@ -5932,6 +6206,7 @@ function createLive(options) {
       topics.extension(...args);
       realtime.extension(...args);
     },
+    legacyExtension: realtime.legacyExtension,
     realtime,
     revisions: hub.revisions,
     attach(io, probe, cluster, broadcasts) {
@@ -6477,11 +6752,41 @@ function createPolicyEngine(options) {
   });
 }
 
+// src/server/access/resolverReads.ts
+function hasUndeclaredResolver(policy) {
+  return declaresNoReads(policy) || (anyOfPolicies(policy)?.some(hasUndeclaredResolver) ?? false);
+}
+function resolverReadsWarnings(service) {
+  const { access, model } = service;
+  if (access === void 0 || model === void 0 || !hasUndeclaredResolver(access)) {
+    return [];
+  }
+  return [
+    {
+      kind: "resolver-without-reads",
+      service: service.name,
+      message: `${service.name}: its access policy uses a resolver that declares no reads, so no tracked write re-checks the levels it gives: a live row, collection scope or change topic it authorized stays open after the user loses access. Declare what the levels depend on, resolver({ levelsFor, reads: { columns, memberships } }) (columns of the ${model} model, membership tables as members() takes them), or reads: "none" when nothing a tracked write changes can change them`,
+      meta: { model }
+    }
+  ];
+}
+function warnResolverReads(registry, warnings) {
+  if (!warnings.enabled) {
+    return;
+  }
+  for (const service of registry.services.values()) {
+    for (const warning of resolverReadsWarnings(service)) {
+      warnings.warn(warning);
+    }
+  }
+}
+
 // src/server/pipeline/accessSettings.ts
 function isAccessEngine(value) {
   return typeof value === "object" && value !== null && typeof value.authorize === "function";
 }
-function resolveAccess2(access, registry, storage, logger) {
+function resolveAccess2(access, registry, storage, report) {
+  const { logger, warnings } = report;
   if (access !== void 0 && (typeof access !== "object" || access === null)) {
     throw new TypeError("createDispatcher: access must be an access engine or { cacheMs }");
   }
@@ -6493,6 +6798,7 @@ function resolveAccess2(access, registry, storage, logger) {
     logger,
     cacheMs: accessOptions.cacheMs
   });
+  warnResolverReads(registry, warnings);
   return { access: engine ?? createBasicAccessEngine({ rows: policies.rows }), policies };
 }
 
@@ -6626,7 +6932,10 @@ function resolveSettings(options, registry, db, accessSinks = []) {
   const warnings = createDevWarnings({ logger, development, strict: strictWarningsOf(options) });
   warnTieredOutputs(registry, warnings);
   const storage = storageFor(options, db);
-  const { access, policies } = resolveAccess2(options.access, registry, storage, logger);
+  const { access, policies } = resolveAccess2(options.access, registry, storage, {
+    logger,
+    warnings
+  });
   const outputValidation = options.outputValidation ?? development;
   const live = createLive({
     registry,
@@ -7086,7 +7395,7 @@ function contextFor(settings, request, requestId, target2, signal, dispatch) {
     log,
     requestId,
     transport: request.transport,
-    ...request.transport === "socket" && request.connectionId !== void 0 ? { socketId: request.connectionId } : {},
+    ...(request.transport === "socket" || request.transport === "legacy") && request.connectionId !== void 0 ? { socketId: request.connectionId } : {},
     ...request.mcp === void 0 ? {} : { mcp: request.mcp },
     touch: settings.touch,
     rooms: realtime.roomsFor(request.transport, request.connectionId, target2.method.share),
@@ -7134,6 +7443,7 @@ async function proceed(pipeline, call, target2) {
   const { request } = call;
   const label = `${target2.service.name}.${target2.method.name}`;
   const input = await stage(call, parseInput(target2.method.input, request.input, label));
+  checkKind(target2.method.kinds, request.principal, label);
   const ctx = contextFor(settings, request, call.requestId, target2, call.signal, pipeline.dispatch);
   const access = {
     service: target2.service,
@@ -8021,17 +8331,58 @@ function toLegacyReply(result) {
   return { success: true, data: result.notModified === true ? void 0 : result.data };
 }
 var LEGACY_INTERNAL = Object.freeze(legacyFailure("INTERNAL", "Internal error"));
-function targetOf5(event, registry) {
+function resolveLegacyWire(option, registered) {
+  if (option === void 0 || option === false) {
+    return void 0;
+  }
+  if (option === true) {
+    return { aliases: /* @__PURE__ */ new Map() };
+  }
+  if (typeof option !== "object" || option === null || Array.isArray(option)) {
+    throw new TypeError("createServer: legacyWire must be a boolean or { aliases }");
+  }
+  for (const key of Object.keys(option)) {
+    if (key !== "aliases") {
+      throw new TypeError(`createServer: legacyWire has an unknown option "${key}"`);
+    }
+  }
+  const { aliases = {} } = option;
+  if (typeof aliases !== "object" || aliases === null || Array.isArray(aliases)) {
+    throw new TypeError("createServer: legacyWire.aliases must map old service names to new ones");
+  }
+  const services = new Set(registered.map((service) => service.name));
+  const resolved = /* @__PURE__ */ new Map();
+  for (const [alias, target2] of Object.entries(aliases)) {
+    const entry = `legacyWire.aliases[${JSON.stringify(alias)}]`;
+    if (alias === "" || alias.includes(":")) {
+      throw new TypeError(`createServer: ${entry} must be a service name without ":"`);
+    }
+    if (services.has(alias)) {
+      throw new TypeError(
+        `createServer: ${entry} is a registered service's own name, so it cannot be an alias`
+      );
+    }
+    if (typeof target2 !== "string" || !services.has(target2)) {
+      throw new TypeError(
+        `createServer: ${entry} names ${JSON.stringify(target2)}, which is not a registered service`
+      );
+    }
+    resolved.set(alias, target2);
+  }
+  return { aliases: resolved };
+}
+function targetOf5(event, registry, aliases) {
   if (typeof event !== "string") {
     return void 0;
   }
   const colon = event.indexOf(":");
-  const service = event.slice(0, colon);
+  const called = event.slice(0, colon);
   const method = event.slice(colon + 1);
-  if (colon <= 0 || registry.find(service, method) === void 0) {
+  const service = aliases.get(called);
+  if (colon <= 0 || registry.find(service ?? called, method) === void 0) {
     return void 0;
   }
-  return { service, method };
+  return service === void 0 ? { service: called, method } : { service, method, alias: called };
 }
 function principalKind(principal) {
   if (principal === null) {
@@ -8041,15 +8392,18 @@ function principalKind(principal) {
 }
 function noteCaller(context, seen, target2, principal) {
   const kind = principalKind(principal);
-  const key = `${target2.service}\0${target2.method}\0${kind}`;
+  const { service, method, alias } = target2;
+  const key = `${alias ?? service}\0${method}\0${kind}`;
   if (seen.has(key)) {
     return;
   }
   seen.add(key);
-  context.logger.warn(
-    `A 4.x client called ${target2.service}.${target2.method} through the legacy shim`,
-    { category: "quickdraw.legacy", ...target2, principalKind: kind }
-  );
+  const as = alias === void 0 ? "" : ` as ${alias}.${method}`;
+  context.logger.warn(`A 4.x client called ${service}.${method}${as} through the legacy shim`, {
+    category: "quickdraw.legacy",
+    ...target2,
+    principalKind: kind
+  });
 }
 function serve2(socket, context, calls, call) {
   const controller = new AbortController();
@@ -8075,19 +8429,20 @@ function serve2(socket, context, calls, call) {
     respond: (result) => acknowledge(context.meter, call.ack, toLegacyReply(result), LEGACY_INTERNAL, report)
   }).then(release3, release3);
 }
-function attachLegacyShim(socket, context, seen) {
+function attachLegacyShim(socket, context, seen, wire) {
   const calls = /* @__PURE__ */ new Set();
   socket.use((packet, next) => {
     const [event, ...args] = packet;
     const ack = args.at(-1);
-    const target2 = targetOf5(event, context.dispatcher.registry);
+    const target2 = targetOf5(event, context.dispatcher.registry, wire.aliases);
     if (target2 === void 0 || typeof ack !== "function") {
       next();
       return;
     }
     noteCaller(context, seen, target2, socket.data.principal);
     const input = args.length > 1 ? args[0] : void 0;
-    serve2(socket, context, calls, { ...target2, input, ack });
+    const { service, method } = target2;
+    serve2(socket, context, calls, { service, method, input, ack });
   });
   socket.on("disconnect", () => {
     for (const controller of calls) {
@@ -8549,7 +8904,10 @@ function onConnection(settings) {
       void socket.join(userRoom(principal.userId));
     }
     if (socket.data.protocol === "legacy") {
-      attachLegacyShim(socket, settings, settings.legacyCallers);
+      attachLegacyShim(socket, settings, settings.legacyCallers, settings.legacyWire);
+      for (const extension of settings.legacyExtensions) {
+        extension(socket, settings);
+      }
       return;
     }
     attachCallListeners(socket, settings);
@@ -8605,7 +8963,7 @@ function createSocketServer(httpServer, settings) {
   settings.live?.attach(io, probe, settings.cluster, broadcasts);
   listenForGrants(io, settings.live, settings.logger);
   listenForDisconnects(io);
-  io.use(protocolMiddleware(settings.legacyWire, context));
+  io.use(protocolMiddleware(settings.legacyWire !== void 0, context));
   io.use(authMiddleware(settings.resolvePrincipal, context));
   if (settings.rateLimit !== false) {
     applySocketRateLimit(io, settings.rateLimit, { ...context, loops: settings.loops });
@@ -8616,7 +8974,10 @@ function createSocketServer(httpServer, settings) {
       ...context,
       hello: helloFrame(settings),
       extensions: settings.live === void 0 ? settings.extensions : [...settings.extensions, settings.live.extension],
-      legacyCallers: /* @__PURE__ */ new Set()
+      legacyExtensions: settings.live === void 0 ? [] : [settings.live.legacyExtension],
+      legacyCallers: /* @__PURE__ */ new Set(),
+      // A server that refuses 4.x clients has no 4.x socket to read it.
+      legacyWire: settings.legacyWire ?? { aliases: /* @__PURE__ */ new Map() }
     })
   );
   return {
@@ -8705,6 +9066,7 @@ function warnUnsourcedGrants(services, sourced, logger) {
 }
 function createServer(options) {
   checkOptions(options);
+  const legacyWire = resolveLegacyWire(options.legacyWire, options.services);
   const logger = options.logger ?? consoleLogger;
   warnUnsourcedGrants(options.services, options.auth?.serviceAccessSource !== void 0, logger);
   const watchdog = prepareWatchdog(options, options.stallWatchdog);
@@ -8725,7 +9087,7 @@ function createServer(options) {
     resolvePrincipal,
     loadServiceAccess: options.auth?.loadServiceAccess,
     binary: options.binary === true,
-    legacyWire: options.legacyWire === true,
+    legacyWire,
     cors: options.cors,
     socket: options.socket,
     rateLimit: options.rateLimit ?? {},
@@ -8782,6 +9144,7 @@ export {
   custom,
   isCustomAccess,
   accessFormProblem,
+  accessIds,
   meetsLevel,
   maxLevel,
   levelsAtLeast,
@@ -8806,7 +9169,6 @@ export {
   isAccessPolicy,
   checkName,
   levelsById,
-  idFilter,
   encodeCursor,
   decodeCursor,
   orderByOf,
@@ -8814,6 +9176,7 @@ export {
   MAX_ITEM_IDS,
   selectWith,
   INDEX_MAX_ROWS,
+  narrowKinds,
   allowedScopes,
   membersWhere,
   CHANNEL_ABUSE_WINDOW_MS,
@@ -8823,6 +9186,11 @@ export {
   STREAM_MAX_SCOPES,
   MAX_STREAMS_PER_SOCKET,
   createBasicAccessEngine,
+  anyOfPolicies,
+  anyOf,
+  membershipOf,
+  members,
+  resolver,
   DEFAULT_LIMITS,
   MAX_TIMEOUT_MS,
   createDispatcher,
@@ -8838,4 +9206,4 @@ export {
   watchAdapterClients,
   createServer
 };
-//# sourceMappingURL=chunk-LLLYILEP.js.map
+//# sourceMappingURL=chunk-A6DJBGOG.js.map