@fitzzero/quickdraw-core 5.0.1 → 5.1.0

package/dist/{infer-Dw21kmLw.d.ts → infer-Teo1xpsd.d.ts}

@@ -347,6 +347,8 @@ interface CollectionWhere {
 }
 /** Any collection of any contract, as `defineContract` stores it. */
 interface CollectionDef {
+    /** What the list holds, in a sentence or two, for the generated docs. */
+    readonly describe?: string | undefined;
     /** A string column of the entity, or `via(...)` for a junction table. */
     readonly scope: string | ViaScope;
     /** The projection each item is sent as: `"entity"` or a named projection. */
@@ -434,6 +436,8 @@ interface StreamDef<Item extends StandardSchemaV1 = StandardSchemaV1> {
     readonly volatile?: boolean;
     /** Who may subscribe. Without it the stream is closed. */
     readonly access?: StreamAccess;
+    /** What the stream carries, in a sentence or two, for the generated docs. */
+    readonly describe?: string;
 }
 /**
  * Where a channel requirement finds its row id or scope value in the parsed
@@ -498,10 +502,14 @@ interface ChannelDef<Payload extends StandardSchemaV1 = StandardSchemaV1> {
     readonly burst?: number;
     /** What the sender must already be subscribed to, or the app room it must be in. */
     readonly requires?: ChannelRequires;
+    /** What a message says, in a sentence or two, for the generated docs. */
+    readonly describe?: string;
 }
 /** A typed custom room event, delivered as `qd:event` (RFC 0003 section 8.3). */
 interface EventDef<Payload extends StandardSchemaV1 = StandardSchemaV1> {
     readonly payload: Payload;
+    /** What the event announces, in a sentence or two, for the generated docs. */
+    readonly describe?: string;
 }
 /** True when a stream has one feed per scope value; false for a global stream. */
 declare function isScopedStream(def: Pick<StreamDef, "scope">): boolean;
@@ -521,6 +529,11 @@ interface ChannelDefinition extends Omit<ChannelDef, "requires"> {
 }
 /** The second argument of {@link defineContract}. */
 interface ContractDefinition {
+    /**
+     * What the service is for, in a sentence or two. The generated API docs
+     * lead the service's page with it and list it in their index.
+     */
+    readonly describe?: string;
     /**
      * The full row; its output must contain `id: string`. Omit it for a service
      * without a model, which then has no projections, fields or collections.
@@ -567,6 +580,8 @@ type MemberOf<Def, Key extends string, Absent> = Def extends {
 interface Contract<Name extends string = string, Def extends ContractDefinition = ContractDefinition> {
     /** The service name, unchanged on the wire and in stored grants. */
     readonly name: Name;
+    /** What the service is for; absent when the definition has none. */
+    readonly describe?: string;
     readonly entity: MemberOf<Def, "entity", undefined>;
     readonly projections: MemberOf<Def, "projections", Empty>;
     readonly fields: MemberOf<Def, "fields", Empty>;
@@ -579,6 +594,7 @@ interface Contract<Name extends string = string, Def extends ContractDefinition
 /** Any contract. Every contract `defineContract` returns is assignable to it. */
 interface AnyContract {
     readonly name: string;
+    readonly describe?: string;
     readonly entity: RowSchema | undefined;
     readonly projections: {
         readonly [name: string]: RowSchema;
@@ -615,6 +631,7 @@ type IndexRow<Item, Fields> = Pick<Item, Extract<keyof Item, "id" | Fields>>;
 type ColumnOf<Row> = [Row] extends [never] ? string : keyof Row & string;
 type ScopeColumnOf<Row> = [Row] extends [never] ? string : StringColumn<Row> & string;
 interface CollectionContext<Row, Entity, Projections, Item, Index> {
+    readonly describe?: string | undefined;
     readonly scope: NoInfer<ViaScope | ScopeColumnOf<Row>>;
     readonly item: Item;
     readonly order: NoInfer<OrderBy<ColumnOf<Row>>>;

package/dist/{metrics-C0WvB7-I.d.ts → metrics-BdBu5o8G.d.ts}

@@ -1,6 +1,6 @@
-import { k as MethodKind } from './infer-Dw21kmLw.js';
+import { k as MethodKind } from './infer-Teo1xpsd.js';
 import { a as ErrorCode } from './errors-S-bxEIBC.js';
-import { T as Transport } from './types-Bwg3kIEc.js';
+import { T as Transport } from './types-Cu0vmx7c.js';
 
 /** How a call ended: `"ok"`, `"not-modified"`, or the error code it failed with. */
 type CallOutcome = "ok" | "not-modified" | ErrorCode;

package/dist/prisma/index.d.ts

@@ -1,9 +1,9 @@
 import { L as Logger } from '../logger-BY28acW-.js';
-export { C as CountArgs, F as FindManyArgs, c as StatementCount, S as StorageAdapter, a as StorageRow, b as StorageWhere, s as storageOf } from '../caller-BqCYnpmC.js';
-import '../envelope-nf5eGB-a.js';
-import '../infer-Dw21kmLw.js';
+export { C as CountArgs, F as FindManyArgs, c as StatementCount, S as StorageAdapter, a as StorageRow, b as StorageWhere, s as storageOf } from '../caller-CXTFswBO.js';
+import '../envelope-Cp3YcVxC.js';
+import '../infer-Teo1xpsd.js';
 import '../errors-S-bxEIBC.js';
-import '../types-Bwg3kIEc.js';
+import '../types-Cu0vmx7c.js';
 
 /** Options of {@link trackPrisma}. */
 interface TrackPrismaOptions {

package/dist/server/auth/index.d.ts

@@ -1,8 +1,8 @@
 import { L as Logger } from '../../logger-BY28acW-.js';
 import { IncomingHttpHeaders, IncomingMessage, ServerResponse } from 'node:http';
-import { M as MaybePromise, P as Principal } from '../../types-Bwg3kIEc.js';
-import { b as AuthenticateRequest, H as HttpRequest } from '../../auth-CMyRkfjZ.js';
-import '../../infer-Dw21kmLw.js';
+import { M as MaybePromise, P as Principal } from '../../types-Cu0vmx7c.js';
+import { b as AuthenticateRequest, H as HttpRequest } from '../../auth-BhWqdyb-.js';
+import '../../infer-Teo1xpsd.js';
 import 'socket.io';
 
 /**

package/dist/server/index.d.ts

@@ -1,18 +1,18 @@
-import { J as AnyContract, at as ProjectionName, ai as FullProjectionOf, ac as CollectionName, ap as MethodName, d as StandardSchemaV1, c as InferOutput, N as NullableProjection, P as ProjectionList, aq as MethodOf, as as ParsedInputOf, ao as KindOf, A as AccessLevel, af as EntityOf, ar as OutputOf } from '../infer-Dw21kmLw.js';
-import { M as ModelName, v as PolicyFor, w as RowForms, x as AccessFor, H as HandlerContext, y as ModelColumn, z as WatchAccess, B as PublicAccess, E as HandlerArgs, G as CustomAccess, I as ShareMode, J as ChannelOptions, K as StreamOptions, u as RoomLeaveHandler, L as ChannelsRequired, f as Service, N as BaseContext, O as CallerFor, l as RunContext, m as RunOptions, o as StreamHandle, P as Presence, n as ServerRooms, Q as AccessPolicy, T as AnyAccessPolicy, V as PolicyColumns, X as PolicyForeign, Y as PolicyTools, k as AccessFilter, Z as RowAccess, q as AccessEngine, b as StorageWhere } from '../caller-BqCYnpmC.js';
-export { aI as ANY_FIELD, aA as AccessForm, aB as AccessRequest, _ as AffectsLink, p as AnyContext, A as AnyService, r as AppRooms, aC as AuthenticatedAccess, aq as CallOptions, i as Caller, a9 as ChannelAccess, aa as ChannelContext, ab as ChannelHandler, ac as ChannelImplementation, ad as ChannelRoomOf, a4 as CollectionScope, a6 as ContextRooms, a7 as ContextServices, C as CountArgs, a3 as DEFAULT_BULK_THRESHOLD, g as DevWarning, D as DevWarningError, h as DevWarningKind, aD as EntryAccess, F as FindManyArgs, e as FlushInfo, d as FlushSink, at as ForeignColumns, au as ForeignColumnsOf, aE as IdKeyOf, aF as IdSelector, av as MembershipRead, ar as MethodCaller, aM as N_PLUS_ONE_STATEMENTS, aw as ParentLink, ax as PolicyKind, ay as PolicyReads, $ as ProjectedOutput, a0 as Projection, ae as RoomLeave, af as RoomLeaveReason, ag as RoomLeft, ah as RoomTarget, az as RowLevel, R as RowLevels, aG as ScopeAccess, aH as ServiceAccess, as as ServiceCaller, ai as ServiceChannel, a5 as ServiceCollection, j as ServiceMethod, aj as ServiceStream, c as StatementCount, S as StorageAdapter, a as StorageRow, ak as StreamImplementation, al as StreamPushArgs, am as StreamPushManyArgs, an as StreamSeed, ao as StreamSeedContext, t as StreamSubscriptions, ap as StreamValidation, a1 as TierGroup, a2 as Tiers, a8 as TouchOptions, aJ as UnitOfWork, U as UnitOfWorkFactory, aK as UnitOfWorkScope, W as WriteRecord, aL as formatDevWarning, s as storageOf } from '../caller-BqCYnpmC.js';
-import { S as ServerOptions, Q as QuickdrawServer } from '../createServer-CGsJlxM8.js';
-export { C as ClusterClient, t as ClusterOptions, D as DEFAULT_STALL_INTERVAL_MS, e as DEFAULT_STALL_MAX_MS, f as DEFAULT_STALL_THRESHOLD_MS, p as DisconnectUserOptions, E as EntitySubscription, a as EntitySubscriptions, H as HttpApp, I as IoRedisLike, M as MIN_STALL_INTERVAL_MS, m as QuickdrawIo, n as QuickdrawServerSocket, o as QuickdrawSocketData, x as RateLimitOptions, y as RateLimiter, R as RotateOptions, g as STALL_RESOLUTION_MS, b as ScopeSubscription, c as ScopeSubscriptions, l as ServerOnlyOptions, h as SlowMethod, q as SocketCors, r as SocketOptions, s as SocketRateLimitOptions, i as StallReport, j as StallWatchdogOptions, T as TopicWatch, d as TopicWatches, v as applyRateLimitMiddleware, u as createRateLimiter, k as createServer, w as createTieredRateLimiter } from '../createServer-CGsJlxM8.js';
-import { ad as Version } from '../envelope-nf5eGB-a.js';
-import { Q as QuickdrawTypes, D as DbOf, c as PrincipalOf, M as MaybePromise, b as McpContextOf, C as ContextExtensionOf, P as Principal } from '../types-Bwg3kIEc.js';
-export { a as McpContext, T as Transport } from '../types-Bwg3kIEc.js';
-import { a as DispatcherOptions, D as Dispatcher, c as DispatcherCollections } from '../http-D3fSFQ57.js';
-export { o as AccessChange, p as AccessChangeListener, A as AccessOptions, d as ChangeLogOptions, C as ContractOfServices, j as DEFAULT_LIMITS, f as DbOfServices, h as DispatchRequest, i as DispatchResult, n as DispatcherAccess, k as DispatcherLimits, s as HttpMiddleware, H as HttpRouter, u as HttpRouterOptions, b as HttpTransportOptions, L as LimitsOptions, l as PipelineOptions, P as PrincipalOfServices, R as RegisteredMethod, g as Registry, S as SharedData, m as SubscriptionLimits, T as TrackingOptions, V as VersionRequest, q as VersionSource, e as createDispatcher, r as createHttpRouter, t as toCallReply } from '../http-D3fSFQ57.js';
-import { l as CrudMethodName, d as CrudContractOptions, S as ScalarFieldOf, N as NumberFieldOf, m as CrudMethods, H as AdminMethodsOf, w as AdminContractOptions, G as AdminMethods } from '../admin-CBlTY0do.js';
-import { S as SearchContractOptions, T as TextFieldOf, b as SearchMethods, n as SharingMethodName, f as SharingByNameMethod, g as SharingContractOptions, o as SharingMethods } from '../sharing-CoreezAq.js';
-import { x as AdminNeverWritable, l as AdminFieldConfig } from '../adminSchemas-zji11V74.js';
-export { a as CallOutcome, C as CallRecord } from '../metrics-C0WvB7-I.js';
-export { b as AuthenticateRequest, A as AuthenticateResult, c as HttpAuthenticateRequest, d as HttpCredentialSource, S as ServerAuth, e as ServiceAccessSource, a as ServiceGrants, f as SocketAuthenticateRequest, r as recordSocketSession } from '../auth-CMyRkfjZ.js';
+import { J as AnyContract, at as ProjectionName, ai as FullProjectionOf, ac as CollectionName, ap as MethodName, d as StandardSchemaV1, c as InferOutput, N as NullableProjection, P as ProjectionList, aq as MethodOf, as as ParsedInputOf, ao as KindOf, A as AccessLevel, af as EntityOf, ar as OutputOf } from '../infer-Teo1xpsd.js';
+import { M as ModelName, v as PolicyFor, w as RowForms, x as AccessFor, H as HandlerContext, y as ModelColumn, z as WatchAccess, B as PublicAccess, E as HandlerArgs, G as CustomAccess, I as ShareMode, J as ChannelOptions, K as StreamOptions, u as RoomLeaveHandler, L as ChannelsRequired, h as Service, N as BaseContext, O as CallerFor, l as RunContext, m as RunOptions, o as StreamHandle, P as Presence, n as ServerRooms, Q as AccessPolicy, T as AnyAccessPolicy, V as PolicyColumns, X as PolicyForeign, Y as PolicyTools, k as AccessFilter, Z as RowAccess, q as AccessEngine, b as StorageWhere } from '../caller-CXTFswBO.js';
+export { aI as ANY_FIELD, aA as AccessForm, aB as AccessRequest, _ as AffectsLink, p as AnyContext, A as AnyService, r as AppRooms, aC as AuthenticatedAccess, aq as CallOptions, d as Caller, a9 as ChannelAccess, aa as ChannelContext, ab as ChannelHandler, ac as ChannelImplementation, ad as ChannelRoomOf, a4 as CollectionScope, a6 as ContextRooms, a7 as ContextServices, C as CountArgs, a3 as DEFAULT_BULK_THRESHOLD, i as DevWarning, D as DevWarningError, j as DevWarningKind, aD as EntryAccess, F as FindManyArgs, f as FlushInfo, e as FlushSink, at as ForeignColumns, au as ForeignColumnsOf, aE as IdKeyOf, aF as IdSelector, av as MembershipRead, ar as MethodCaller, aM as N_PLUS_ONE_STATEMENTS, aw as ParentLink, ax as PolicyKind, ay as PolicyReads, $ as ProjectedOutput, a0 as Projection, ae as RoomLeave, af as RoomLeaveReason, ag as RoomLeft, ah as RoomTarget, az as RowLevel, R as RowLevels, aG as ScopeAccess, aH as ServiceAccess, as as ServiceCaller, ai as ServiceChannel, a5 as ServiceCollection, g as ServiceMethod, aj as ServiceStream, c as StatementCount, S as StorageAdapter, a as StorageRow, ak as StreamImplementation, al as StreamPushArgs, am as StreamPushManyArgs, an as StreamSeed, ao as StreamSeedContext, t as StreamSubscriptions, ap as StreamValidation, a1 as TierGroup, a2 as Tiers, a8 as TouchOptions, aJ as UnitOfWork, U as UnitOfWorkFactory, aK as UnitOfWorkScope, W as WriteRecord, aL as formatDevWarning, s as storageOf } from '../caller-CXTFswBO.js';
+import { S as ServerOptions, Q as QuickdrawServer } from '../createServer-CP9eDHZZ.js';
+export { C as ClusterClient, u as ClusterOptions, D as DEFAULT_STALL_INTERVAL_MS, e as DEFAULT_STALL_MAX_MS, f as DEFAULT_STALL_THRESHOLD_MS, p as DisconnectUserOptions, E as EntitySubscription, a as EntitySubscriptions, H as HttpApp, I as IoRedisLike, L as LegacyReply, t as LegacyWireOptions, M as MIN_STALL_INTERVAL_MS, m as QuickdrawIo, n as QuickdrawServerSocket, o as QuickdrawSocketData, y as RateLimitOptions, z as RateLimiter, R as RotateOptions, g as STALL_RESOLUTION_MS, b as ScopeSubscription, c as ScopeSubscriptions, l as ServerOnlyOptions, h as SlowMethod, q as SocketCors, r as SocketOptions, s as SocketRateLimitOptions, i as StallReport, j as StallWatchdogOptions, T as TopicWatch, d as TopicWatches, w as applyRateLimitMiddleware, v as createRateLimiter, k as createServer, x as createTieredRateLimiter } from '../createServer-CP9eDHZZ.js';
+import { ad as Version } from '../envelope-Cp3YcVxC.js';
+import { Q as QuickdrawTypes, D as DbOf, d as PrincipalKindOf, c as PrincipalOf, M as MaybePromise, b as McpContextOf, C as ContextExtensionOf, P as Principal } from '../types-Cu0vmx7c.js';
+export { a as McpContext, T as Transport } from '../types-Cu0vmx7c.js';
+import { a as DispatcherOptions, D as Dispatcher, c as DispatcherCollections } from '../http-Djj2Inuu.js';
+export { o as AccessChange, p as AccessChangeListener, A as AccessOptions, d as ChangeLogOptions, C as ContractOfServices, j as DEFAULT_LIMITS, f as DbOfServices, h as DispatchRequest, i as DispatchResult, n as DispatcherAccess, k as DispatcherLimits, s as HttpMiddleware, H as HttpRouter, u as HttpRouterOptions, b as HttpTransportOptions, L as LimitsOptions, l as PipelineOptions, P as PrincipalOfServices, R as RegisteredMethod, g as Registry, S as SharedData, m as SubscriptionLimits, T as TrackingOptions, V as VersionRequest, q as VersionSource, e as createDispatcher, r as createHttpRouter, t as toCallReply } from '../http-Djj2Inuu.js';
+import { l as CrudMethodName, d as CrudContractOptions, S as ScalarFieldOf, N as NumberFieldOf, m as CrudMethods, H as AdminMethodsOf, w as AdminContractOptions, G as AdminMethods } from '../admin-DKwkIh5i.js';
+import { S as SearchContractOptions, T as TextFieldOf, b as SearchMethods, n as SharingMethodName, f as SharingByNameMethod, g as SharingContractOptions, o as SharingMethods } from '../sharing-DVa8W-yR.js';
+import { x as AdminNeverWritable, l as AdminFieldConfig } from '../adminSchemas-2DUA_hZ8.js';
+export { a as CallOutcome, C as CallRecord } from '../metrics-BdBu5o8G.js';
+export { b as AuthenticateRequest, A as AuthenticateResult, c as HttpAuthenticateRequest, d as HttpCredentialSource, S as ServerAuth, e as ServiceAccessSource, a as ServiceGrants, f as SocketAuthenticateRequest, r as recordSocketSession } from '../auth-BhWqdyb-.js';
 import { Server } from 'socket.io';
 import { L as Logger } from '../logger-BY28acW-.js';
 import 'node:http';
@@ -34,16 +34,6 @@ declare const STREAM_MAX_SCOPES = 10000;
 /** The most stream feeds one socket may subscribe to at once. */
 declare const MAX_STREAMS_PER_SOCKET = 500;
 
-/** 4.x's `ServiceResponse`, the shape every reply of the shim takes. */
-type LegacyReply = {
-    readonly success: true;
-    readonly data: unknown;
-} | {
-    readonly success: false;
-    readonly error: string;
-    readonly code: number;
-};
-
 /**
  * A JSON column's value as a database client types it: structurally
  * Prisma's `JsonValue` (and its `InputJsonValue` objects and arrays). A row
@@ -252,6 +242,16 @@ interface MutationOptions {
 type MethodImplementation<T extends QuickdrawTypes, C extends AnyContract, M extends MethodName<C>, A, Rows extends RowForms = "all", Proj = Empty$2> = {
     /** Who may call: `"public"`, `"authenticated"`, `{ service }`, `{ entry }`, `{ scope, of, id }` or `custom(fn)`. */
     readonly access: AccessValue<A, MethodAccess<T, C, M, Rows>>;
+    /**
+     * The kinds of principal that may call this method (RFC 0003 section
+     * 4.1), within its service's `kinds` (or the app's): `kinds: ["user"]`
+     * keeps an agent's token out of a method that mints tokens. A principal
+     * of another kind, or without a `kind`, gets `FORBIDDEN` before `access`
+     * is asked, whatever its grants; an anonymous caller is left to `access`.
+     * Not on a `"public"` method, which a caller of any kind could call
+     * signed out. Leave it out for the service's list.
+     */
+    readonly kinds?: readonly PrincipalKindOf<T>[];
     /**
      * Runs the method. For a projection output it returns the database row
      * (or rows, or `null`), which the framework projects: only the
@@ -377,6 +377,18 @@ interface ServiceDefinition<T extends QuickdrawTypes, C extends AnyContract, A,
      * service (RFC 0003 section 4.1). Default `true`.
      */
     readonly adminBypass?: boolean;
+    /**
+     * The kinds of principal that may call the service's methods and
+     * subscribe to its live data (RFC 0003 section 4.1): `kinds: ["user"]`.
+     * Within the app's `initQuickdraw({ kinds })`, which the service takes
+     * when it leaves this out; a method's own `kinds` narrows it further. A
+     * principal of another kind, or without a `kind`, gets `FORBIDDEN` before
+     * any access form is asked, and a service-wide `Admin` grant does not
+     * pass it; an anonymous caller is left to the form. Its entity, collection,
+     * topic and stream subscriptions refuse such a principal the same way, and
+     * its channels drop its messages.
+     */
+    readonly kinds?: readonly PrincipalKindOf<T>[];
 }
 /** `qd.defineService`, typed by the app's `QuickdrawTypes`. */
 type DefineService<T extends QuickdrawTypes> = <C extends AnyContract, const Model extends ModelName<DbOf<T>> | undefined = undefined, Policy extends PolicyFor<DbOf<T>, Model> | undefined = undefined, const A extends MethodKeys<C> = AccessMap<T, C, RowFormsOf<Model, Policy>>, const Proj = Empty$2>(contract: C, definition: ServiceDefinition<T, C, A, Model, Policy, Proj> & CollectionsRequired<C> & ChannelsRequired<C>) => Service<T, C>;
@@ -390,6 +402,15 @@ type ContextFactory<T extends QuickdrawTypes> = (base: BaseContext<PrincipalOf<T
 interface InitOptions<T extends QuickdrawTypes> {
     /** Adds the app's fields to every handler's `ctx`. Required when the app's types declare `context`. */
     readonly context?: ContextFactory<T>;
+    /**
+     * The kinds of principal every service this instance defines admits
+     * (RFC 0003 section 4.1), so a new service starts closed to the rest:
+     * `kinds: ["user", "agent"]`. A service's `kinds`, and a method's, may
+     * only narrow it. A principal of another kind, or without a `kind`, gets
+     * `FORBIDDEN` before any access form or `Admin` grant is asked; an
+     * anonymous caller is left to the form. Leave it out to admit every kind.
+     */
+    readonly kinds?: readonly PrincipalKindOf<T>[];
 }
 /** `initQuickdraw`'s arguments: the options are required when `T` declares `context`. */
 type InitArgs<T extends QuickdrawTypes> = T extends {
@@ -1557,4 +1578,4 @@ declare function decryptIfEncrypted(value: string): string;
 /** Safe wrapper that returns `null` instead of throwing on invalid/stale ciphertext. */
 declare function tryDecrypt(ciphertext: string, logger?: Logger): string | null;
 
-export { ADMIN_HIDDEN_FIELDS, AccessEngine, AccessFilter, AccessFor, type AccessMap, AccessPolicy, type AdminAccess, type AdminContract, type AdminDefaultAccess, type AdminFieldOf, type AdminFieldOverride, type AdminHandlersOptions, type AdminImplementations, type AdminOnCommitted, type AdminOnWrite, type AdminOutputOf, type AdminWrite, type AffectsOption, AnyAccessPolicy, BaseContext, type BasicAccessEngineOptions, CHANNEL_ABUSE_MULTIPLIER, CHANNEL_ABUSE_WINDOW_MS, CallerFor, ChannelOptions, ChannelsRequired, type CollectionOption, type CollectionOptions, type CollectionsRequired, ContextExtensionOf, type ContextFactory, type CrudAccess, type CrudCreateOf, type CrudHandlersOptions, type CrudImplementations, type CrudKindOf, type CrudMethodsOf, type CrudPrepare, CustomAccess, DbOf, type DefineService, Dispatcher, DispatcherCollections, DispatcherOptions, type EnvValidationResult, HandlerArgs, HandlerContext, type HandlerOutputOf, type HandlerRow, INDEX_MAX_ROWS, type InheritOptions, type InitArgs, type InitOptions, type JsonAclOptions, type JsonColumnValue, type KitContext, type KitHandler, type KitHandlerArgs, type LegacyReply, MAX_APP_ROOMS, MAX_ITEM_IDS, MAX_STREAMS_PER_SOCKET, MaybePromise, McpContextOf, type MembersOptions, type MethodAccess, type MethodImplementation, ModelColumn, ModelName, type NextOrdinalOptions, ORDINAL_STEP, PRESENCE_MAX_LAST_SEEN, PolicyFor, PolicyTools, Presence, Principal, type PrincipalFor, PrincipalOf, type ProjectCheck, type ProjectionOption, PublicAccess, type Quickdraw, QuickdrawServer, QuickdrawTypes, RESUME_MAX_AGE_MS, RESUME_MAX_DELTAS, type RedisAdapterOptions, type RedisAdapterResult, type ResolverMembership, type ResolverOptions, type ResolverReads, RoomLeaveHandler, RowAccess, type RowFor, RowForms, type RowFormsOf, RunContext, RunOptions, STREAM_MAX_SCOPES, type SearchAccess, type SearchContract, type SearchHandlersOptions, type SearchIdsOptions, type SearchImplementations, type SearchMethodsOf, type SearchStrategy, type SearchStrategyContext, ServerOptions, ServerRooms, Service, type ServiceDefinition, ShareMode, type SharingAccess, type SharingByNameOf, type SharingChange, type SharingChangeKind, type SharingContract, type SharingDefaultAccess, type SharingHandlersOptions, type SharingImplementations, type SharingKindOf, type SharingMethodsOf, type SharingOnChange, type SharingOptionsArgs, type SharingResolveUser, type SharingUserLookup, StorageWhere, StreamHandle, StreamOptions, type ValidateEnvOptions, WatchAccess, admin, anyOf, checkEnv, createBasicAccessEngine, crud, custom, decrypt, decryptIfEncrypted, displayNameOf, encrypt, everyone, inherit, initQuickdraw, isEncrypted, isRedisAdapterAvailable, jsonAcl, labelOf, meetsLevel, members, nextOrdinal, owner, requireEnv, requireRow, resolver, search, serviceGrant, setupRedisAdapter, sharing, tryDecrypt, validateEnv };
+export { ADMIN_HIDDEN_FIELDS, AccessEngine, AccessFilter, AccessFor, type AccessMap, AccessPolicy, type AdminAccess, type AdminContract, type AdminDefaultAccess, type AdminFieldOf, type AdminFieldOverride, type AdminHandlersOptions, type AdminImplementations, type AdminOnCommitted, type AdminOnWrite, type AdminOutputOf, type AdminWrite, type AffectsOption, AnyAccessPolicy, BaseContext, type BasicAccessEngineOptions, CHANNEL_ABUSE_MULTIPLIER, CHANNEL_ABUSE_WINDOW_MS, CallerFor, ChannelOptions, ChannelsRequired, type CollectionOption, type CollectionOptions, type CollectionsRequired, ContextExtensionOf, type ContextFactory, type CrudAccess, type CrudCreateOf, type CrudHandlersOptions, type CrudImplementations, type CrudKindOf, type CrudMethodsOf, type CrudPrepare, CustomAccess, DbOf, type DefineService, Dispatcher, DispatcherCollections, DispatcherOptions, type EnvValidationResult, HandlerArgs, HandlerContext, type HandlerOutputOf, type HandlerRow, INDEX_MAX_ROWS, type InheritOptions, type InitArgs, type InitOptions, type JsonAclOptions, type JsonColumnValue, type KitContext, type KitHandler, type KitHandlerArgs, MAX_APP_ROOMS, MAX_ITEM_IDS, MAX_STREAMS_PER_SOCKET, MaybePromise, McpContextOf, type MembersOptions, type MethodAccess, type MethodImplementation, ModelColumn, ModelName, type NextOrdinalOptions, ORDINAL_STEP, PRESENCE_MAX_LAST_SEEN, PolicyFor, PolicyTools, Presence, Principal, type PrincipalFor, PrincipalKindOf, PrincipalOf, type ProjectCheck, type ProjectionOption, PublicAccess, type Quickdraw, QuickdrawServer, QuickdrawTypes, RESUME_MAX_AGE_MS, RESUME_MAX_DELTAS, type RedisAdapterOptions, type RedisAdapterResult, type ResolverMembership, type ResolverOptions, type ResolverReads, RoomLeaveHandler, RowAccess, type RowFor, RowForms, type RowFormsOf, RunContext, RunOptions, STREAM_MAX_SCOPES, type SearchAccess, type SearchContract, type SearchHandlersOptions, type SearchIdsOptions, type SearchImplementations, type SearchMethodsOf, type SearchStrategy, type SearchStrategyContext, ServerOptions, ServerRooms, Service, type ServiceDefinition, ShareMode, type SharingAccess, type SharingByNameOf, type SharingChange, type SharingChangeKind, type SharingContract, type SharingDefaultAccess, type SharingHandlersOptions, type SharingImplementations, type SharingKindOf, type SharingMethodsOf, type SharingOnChange, type SharingOptionsArgs, type SharingResolveUser, type SharingUserLookup, StorageWhere, StreamHandle, StreamOptions, type ValidateEnvOptions, WatchAccess, admin, anyOf, checkEnv, createBasicAccessEngine, crud, custom, decrypt, decryptIfEncrypted, displayNameOf, encrypt, everyone, inherit, initQuickdraw, isEncrypted, isRedisAdapterAvailable, jsonAcl, labelOf, meetsLevel, members, nextOrdinal, owner, requireEnv, requireRow, resolver, search, serviceGrant, setupRedisAdapter, sharing, tryDecrypt, validateEnv };

package/dist/server/index.js

@@ -51,6 +51,7 @@ import {
   members,
   membersWhere,
   membershipOf,
+  narrowKinds,
   orderByOf,
   projectRow,
   projectedOutput,
@@ -60,7 +61,7 @@ import {
   serviceGrant,
   strip,
   watchAdapterClients
-} from "../chunk-NS5PUHIZ.js";
+} from "../chunk-A6DJBGOG.js";
 import {
   DevWarningError,
   N_PLUS_ONE_STATEMENTS,
@@ -74,7 +75,7 @@ import {
   crudSpecOf,
   sharing,
   sharingSpecOf
-} from "../chunk-3JNMVB2V.js";
+} from "../chunk-2UELNHDD.js";
 import "../chunk-QEKVYG5F.js";
 import {
   abortError,
@@ -83,7 +84,7 @@ import {
   kitRuntimeOf,
   outputSchemaOf,
   schemaOutputOf
-} from "../chunk-2XJFNVHW.js";
+} from "../chunk-2PWMUVC7.js";
 import "../chunk-DD4SKCNO.js";
 import {
   recordSocketSession,
@@ -108,13 +109,13 @@ import {
   entityRoom,
   isAccessLevel,
   reservedRoomPrefix
-} from "../chunk-WVIRXYI4.js";
+} from "../chunk-VJTFXHOK.js";
 import {
   CHANNEL_DEFAULT_RATE,
   DEFAULT_COLLECTION_LIMIT,
   DEFAULT_COLLECTION_MAX_LIMIT,
   isScopedStream
-} from "../chunk-5YRQ26LF.js";
+} from "../chunk-RT6OILOI.js";
 import "../chunk-47AEXVDM.js";
 import "../chunk-Z2LZ7IZ7.js";
 import {
@@ -385,7 +386,7 @@ function checkChannelAccess(owner2, access, fail5) {
   }
   return Object.freeze({ service: access.service });
 }
-function checkChannel(service, name, def, entry, fail5) {
+function checkChannel(service, name, def, entry, kinds, fail5) {
   const owner2 = `channel "${name}"`;
   const implementation = typeof entry === "function" ? { handler: entry } : entry;
   if (!isRecord2(implementation) || typeof implementation.handler !== "function") {
@@ -407,10 +408,11 @@ function checkChannel(service, name, def, entry, fail5) {
     burst: def.burst ?? Math.max(1, ratePerSecond * 2),
     requires: compileRequires(def),
     access: checkChannelAccess(owner2, implementation.access, fail5),
+    kinds,
     handler: implementation.handler
   });
 }
-function compileChannels(contract, value, fail5) {
+function compileChannels(contract, value, kinds, fail5) {
   const declared = Object.entries(contract.channels);
   if (value === void 0 && declared.length === 0) {
     return /* @__PURE__ */ new Map();
@@ -423,12 +425,13 @@ function compileChannels(contract, value, fail5) {
     fail5(`channels has no implementation for ${missing2.map((name) => `"${name}"`).join(", ")}`);
   }
   const channels = /* @__PURE__ */ new Map();
+  const admitted = kinds === void 0 ? void 0 : new Set(kinds);
   for (const [name, entry] of Object.entries(value)) {
     const def = Object.hasOwn(contract.channels, name) ? contract.channels[name] : void 0;
     if (def === void 0) {
       fail5(`"${name}" is not a channel of the contract`);
     }
-    channels.set(name, checkChannel(contract.name, name, def, entry, fail5));
+    channels.set(name, checkChannel(contract.name, name, def, entry, admitted, fail5));
   }
   return channels;
 }
@@ -615,7 +618,24 @@ function checkWatchAccess(value, fail5) {
   }
   return Object.freeze({ service: value.service });
 }
-function checkServiceData(definition, fail5) {
+function checkAppKinds(value) {
+  return narrowKinds(value, void 0, (message) => {
+    throw new TypeError(`initQuickdraw: ${message}`);
+  });
+}
+function checkMethodKinds(owner2, entry, data, fail5) {
+  if (entry.kinds !== void 0 && entry.access === "public") {
+    fail5(
+      `${owner2} is "public", so kinds cannot narrow who may call it: a caller of a kind it left out would call it signed out. Leave kinds out, or give it a form that needs a principal`
+    );
+  }
+  return narrowKinds(
+    entry.kinds,
+    { kinds: data.kinds, by: "its service" },
+    (message) => fail5(`${owner2}: ${message}`)
+  );
+}
+function checkServiceData(definition, appKinds, fail5) {
   const { model, access, versionColumn } = definition;
   if (model !== void 0 && !isName(model)) {
     fail5('model must be the database model the rows live in, as the client names it ("task")');
@@ -635,7 +655,8 @@ function checkServiceData(definition, fail5) {
     writes: checkWrites(definition.writes, fail5),
     affects: Object.freeze(checkAffects(definition.affects, model, fail5)),
     versionColumn,
-    watchAccess: checkWatchAccess(definition.watchAccess, fail5)
+    watchAccess: checkWatchAccess(definition.watchAccess, fail5),
+    kinds: narrowKinds(definition.kinds, { kinds: appKinds, by: "initQuickdraw" }, fail5)
   };
 }
 function checkWatchedModels(contract, name, models, data, fail5) {
@@ -671,7 +692,8 @@ var DEFINITION_KEYS = /* @__PURE__ */ new Set([
   "channels",
   "streams",
   "onRoomLeave",
-  "adminBypass"
+  "adminBypass",
+  "kinds"
 ]);
 var METHOD_KEYS = /* @__PURE__ */ new Set([
   "access",
@@ -680,7 +702,8 @@ var METHOD_KEYS = /* @__PURE__ */ new Set([
   "ttlMs",
   "timeoutMs",
   "version",
-  "rowless"
+  "rowless",
+  "kinds"
 ]);
 function isRecord4(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -727,7 +750,7 @@ function checkQueryOptions(owner2, entry, kind, fail5) {
     fail5(`${owner2}: version must be a function of (input, ctx)`);
   }
 }
-function checkMethod(contract, projections, name, entry, fail5) {
+function checkMethod(contract, projections, data, name, entry, fail5) {
   const owner2 = `method "${name}"`;
   const def = contract.methods[name];
   if (def === void 0) {
@@ -753,6 +776,7 @@ function checkMethod(contract, projections, name, entry, fail5) {
     fail5(`${owner2}: rowless must be true, or left out`);
   }
   checkQueryOptions(owner2, entry, def.kind, fail5);
+  const kinds = checkMethodKinds(owner2, entry, data, fail5);
   const projection = projectedOutput(def.output, projections);
   return Object.freeze({
     name,
@@ -762,6 +786,7 @@ function checkMethod(contract, projections, name, entry, fail5) {
     projection,
     schemaOutput: projection === void 0 ? schemaOutputOf(def.output) : void 0,
     access: entry.access,
+    kinds,
     handler: entry.handler,
     share: entry.share,
     ttlMs: entry.ttlMs,
@@ -770,7 +795,7 @@ function checkMethod(contract, projections, name, entry, fail5) {
     rowless: entry.rowless === true
   });
 }
-function checkMethods(contract, projections, value, fail5) {
+function checkMethods(contract, projections, data, value, fail5) {
   if (!isRecord4(value)) {
     fail5("methods must be an object with one implementation per contract method");
   }
@@ -780,7 +805,7 @@ function checkMethods(contract, projections, value, fail5) {
   }
   const methods = {};
   for (const [name, entry] of Object.entries(value)) {
-    methods[name] = checkMethod(contract, projections, name, entry, fail5);
+    methods[name] = checkMethod(contract, projections, data, name, entry, fail5);
   }
   return methods;
 }
@@ -851,6 +876,23 @@ function checkHandlers(service, fail5) {
     }
   }
 }
+function createRuntime(options, adopt) {
+  if (options === void 0) {
+    return Object.freeze({ extendContext: void 0, kinds: void 0, adopt });
+  }
+  if (typeof options !== "object" || options === null) {
+    throw new TypeError("initQuickdraw: options must be an object");
+  }
+  const { context, kinds } = options;
+  if (context !== void 0 && typeof context !== "function") {
+    throw new TypeError("initQuickdraw: context must be a function of the base context");
+  }
+  return Object.freeze({
+    extendContext: context,
+    kinds: checkAppKinds(kinds),
+    adopt
+  });
+}
 function buildService(runtime, contract, definition) {
   const checked2 = checkContract(contract);
   const fail5 = (message) => {
@@ -867,7 +909,7 @@ function buildService(runtime, contract, definition) {
   if (onRoomLeave !== void 0 && typeof onRoomLeave !== "function") {
     fail5("onRoomLeave must be a function of the leave and a run context");
   }
-  const data = checkServiceData(definition, fail5);
+  const data = checkServiceData(definition, runtime.kinds, fail5);
   const projections = compileProjections(checked2, definition.project, fail5);
   const collections = compileCollections(
     checked2,
@@ -877,7 +919,7 @@ function buildService(runtime, contract, definition) {
     fail5
   );
   checkWatches(checked2, collections, data, fail5);
-  const methods = checkMethods(checked2, projections, definition.methods, fail5);
+  const methods = checkMethods(checked2, projections, data, definition.methods, fail5);
   checkRowForms(methods, data, fail5);
   checkRowless(methods, data, fail5);
   const service = Object.freeze({
@@ -888,7 +930,7 @@ function buildService(runtime, contract, definition) {
     collections,
     adminBypass,
     methods: Object.freeze(methods),
-    channels: compileChannels(checked2, definition.channels, fail5),
+    channels: compileChannels(checked2, definition.channels, data.kinds, fail5),
     streams: compileStreams(
       checked2,
       { model: data.model, hasPolicy: data.access !== void 0 },
@@ -903,19 +945,6 @@ function buildService(runtime, contract, definition) {
 }
 
 // src/server/init.ts
-function contextOption(options) {
-  if (options === void 0) {
-    return void 0;
-  }
-  if (typeof options !== "object" || options === null) {
-    throw new TypeError("initQuickdraw: options must be an object");
-  }
-  const { context } = options;
-  if (context !== void 0 && typeof context !== "function") {
-    throw new TypeError("initQuickdraw: context must be a function of the base context");
-  }
-  return context;
-}
 var NEEDS = Object.freeze({
   "qd.collections.reset": "send through",
   "qd.stream": "push through",
@@ -976,11 +1005,8 @@ function roomsOf(current) {
 }
 function initQuickdraw(...args) {
   let current;
-  const runtime = Object.freeze({
-    extendContext: contextOption(args[0]),
-    adopt: (dispatcher) => {
-      current = dispatcher;
-    }
+  const runtime = createRuntime(args[0], (dispatcher) => {
+    current = dispatcher;
   });
   const qd = {
     defineService: ((contract, definition) => buildService(runtime, contract, definition)),