@fitzzero/quickdraw-core 5.1.1 → 5.1.2

package/dist/{admin-DKwkIh5i.d.ts → admin-DWWrT1h6.d.ts}

@@ -1,5 +1,5 @@
-import { e as StandardSchemaWithJSON, d as StandardSchemaV1, I as InferInput, c as InferOutput, X as RowSchema, Q as QueryDef, P as ProjectionList, p as MutationDef, J as AnyContract, ap as MethodName } from './infer-Teo1xpsd.js';
-import { d as ListSort, c as ListQuery, b as ListPage, D as AdminWritable, u as AdminListInput, v as AdminListQuery, y as AdminPage, r as AdminCreateInput, s as AdminCreateQuery, B as AdminUpdateInput, C as AdminUpdateQuery, w as AdminMetaInput, n as AdminServiceMeta, z as AdminSubscribers } from './adminSchemas-2DUA_hZ8.js';
+import { e as StandardSchemaWithJSON, d as StandardSchemaV1, I as InferInput, c as InferOutput, X as RowSchema, Q as QueryDef, P as ProjectionList, p as MutationDef, J as AnyContract, ap as MethodName } from './infer-BmoZsL9a.js';
+import { d as ListSort, c as ListQuery, b as ListPage, D as AdminWritable, u as AdminListInput, v as AdminListQuery, y as AdminPage, r as AdminCreateInput, s as AdminCreateQuery, B as AdminUpdateInput, C as AdminUpdateQuery, w as AdminMetaInput, n as AdminServiceMeta, z as AdminSubscribers } from './adminSchemas-D4bFKsrb.js';
 
 /** A schema a kit generates: validation, and its JSON Schema. */
 type KitSchema<Input, Output = Input> = StandardSchemaWithJSON<Input, Output>;

package/dist/{adminSchemas-2DUA_hZ8.d.ts → adminSchemas-D4bFKsrb.d.ts}

@@ -1,4 +1,4 @@
-import { z as SortDirection, A as AccessLevel } from './infer-Teo1xpsd.js';
+import { z as SortDirection, A as AccessLevel } from './infer-BmoZsL9a.js';
 
 /** `list`'s page size when the caller gives none. */
 declare const LIST_DEFAULT_LIMIT = 50;
@@ -111,9 +111,11 @@ interface AdminFieldConfig {
     readonly relationService?: string;
     /**
      * What the field holds, when the kit knows it: `"grants"` for a user's
-     * service-wide grants (`serviceAccess`), which `admin.handlers(contract,
-     * { grants: true })` shows. An admin screen with a grants editor of its own
-     * finds that field by it, never by its name. Absent for any other field.
+     * service-wide grants (`serviceAccess`, or the column the server's
+     * `auth.serviceAccessSource` names, whatever its name), which
+     * `admin.handlers(contract, { grants: true })` shows. An admin screen with
+     * a grants editor of its own finds that field by it, never by its name.
+     * Absent for any other field.
      */
     readonly kind?: "grants";
     /**

package/dist/{auth-BhWqdyb-.d.ts → auth-DXiSJZaf.d.ts}

@@ -1,7 +1,7 @@
 import { IncomingMessage, IncomingHttpHeaders } from 'node:http';
 import { Socket } from 'socket.io';
-import { A as AccessLevel } from './infer-Teo1xpsd.js';
-import { P as Principal, M as MaybePromise } from './types-Cu0vmx7c.js';
+import { A as AccessLevel } from './infer-BmoZsL9a.js';
+import { P as Principal, M as MaybePromise } from './types-CYliTP65.js';
 
 /**
  * A request as Express leaves it: maybe with `body` from `express.json()`,
@@ -13,10 +13,13 @@ type HttpRequest = IncomingMessage & {
     readonly secure?: unknown;
 };
 /**
- * Where an HTTP call's token came from. `"cookie"`: the session cookie, which
- * a browser sends with a request any page makes, so whoever accepts it checks
- * the request's `Origin` (`socketAuth` does). `"bearer"`: an
- * `Authorization: Bearer` header, which a page sends only on purpose.
+ * The credential the HTTP transport chose for a call (the cookie first).
+ * `"cookie"`: the session cookie, which a browser sends with a request any
+ * page makes, so whoever accepts it checks the request's `Origin`
+ * (`socketAuth` does). `"bearer"`: an `Authorization: Bearer` header, which a
+ * page sends only on purpose. For an `authenticate` `socketAuth` did not
+ * make, `auth.token` holds the bearer token alone, even when this says
+ * `"cookie"`; the cookie is `request.sessionCookie`.
  */
 type HttpCredentialSource = "cookie" | "bearer";
 
@@ -26,7 +29,10 @@ interface AuthenticateRequestBase {
     /**
      * The credentials. For a socket, its handshake `auth` as the client sent
      * it (`{ token, qd }` from a v5 client). For an HTTP request, `{ token }`
-     * with its session cookie or bearer token, or `{}` when it has neither.
+     * with its bearer token, or `{}` without one; for `socketAuth`'s
+     * `authenticate` alone, the session cookie when the request carries one,
+     * else the bearer token. Every other `authenticate` finds the cookie only
+     * in `sessionCookie`.
      */
     readonly auth: Readonly<Record<string, unknown>>;
     /** The request's headers, or the socket handshake's. */
@@ -42,13 +48,23 @@ interface HttpAuthenticateRequest extends AuthenticateRequestBase {
     readonly transport: "http";
     readonly req: IncomingMessage;
     /**
-     * Where `auth.token` came from (finding F7.1): `"cookie"`, the session
-     * cookie, which a browser sends with a request any page makes, so an
-     * `authenticate` that accepts it checks the request's `Origin` as
-     * `socketAuth` does; `"bearer"`, an `Authorization: Bearer` header, which
-     * a page sends only on purpose. Absent without a token.
+     * The credential the transport chose (finding F7.1): `"cookie"` when the
+     * request carries the session cookie, which a browser sends with a
+     * request any page makes, so an `authenticate` that accepts it checks the
+     * request's `Origin` as `socketAuth` does; else `"bearer"` for an
+     * `Authorization: Bearer` header, which a page sends only on purpose.
+     * Absent with neither.
      */
     readonly credential?: HttpCredentialSource;
+    /**
+     * The session cookie's value, when the request carries one. It is
+     * ambient (a browser sends it with a request any page makes), so an
+     * `authenticate` that accepts it first checks
+     * `cookieOriginAllowed(request, allowedOrigins)`, then the session store,
+     * on every call (`liveSession`). It is in `auth.token` only for
+     * `socketAuth`'s `authenticate`.
+     */
+    readonly sessionCookie?: string;
 }
 /** What `authenticate` is asked about: a socket connecting, or an HTTP call. */
 type AuthenticateRequest = SocketAuthenticateRequest | HttpAuthenticateRequest;
@@ -87,7 +103,13 @@ interface ServerAuth<P extends Principal = Principal> {
      * sets that column, or creates, deletes or touches such a row, refreshes
      * that user's grants once it is flushed (`server.access.refresh`), so a
      * changed grant reaches their sockets without a reconnect (RFC 0003
-     * section 4.4). Needs `loadServiceAccess`.
+     * section 4.4). `createServer` gives it to its dispatcher, whose admin kit
+     * on that model treats the column as the grants field, whatever its name:
+     * hidden unless `grants: true`, and then for service-wide Admins only. A
+     * dispatcher made without `createServer` takes it as
+     * `createDispatcher({ serviceAccessSource })`, and `createHttpRouter`
+     * refuses an `auth.serviceAccessSource` its dispatcher does not name.
+     * Needs `loadServiceAccess`.
      */
     readonly serviceAccessSource?: ServiceAccessSource;
 }
@@ -101,9 +123,13 @@ interface ServiceAccessSource {
 /**
  * Records the session a socket authenticated with, so that
  * `server.access.disconnectUser(userId, { sessionId })` can end that
- * session's sockets alone. `socketAuth` calls it for the auth routes'
- * sessions; an app's own `authenticate` may too.
+ * session's sockets alone, and, with `expiresAt`, so that the server
+ * disconnects the socket when the session expires (the 5.1 audit's AUTH-4)
+ * and refuses its handshake when it already has. `expiresAt` is a `Date`, a
+ * date string, or epoch milliseconds: a JWT's `exp` is in seconds, so pass
+ * `exp * 1000`. `socketAuth` calls it for the auth routes' sessions; an
+ * app's own `authenticate` may too.
  */
-declare function recordSocketSession(socket: object, sessionId: string): void;
+declare function recordSocketSession(socket: object, sessionId: string, expiresAt?: Date | number | string): void;
 
 export { type AuthenticateResult as A, type HttpRequest as H, type ServerAuth as S, type ServiceGrants as a, type AuthenticateRequest as b, type HttpAuthenticateRequest as c, type HttpCredentialSource as d, type ServiceAccessSource as e, type SocketAuthenticateRequest as f, recordSocketSession as r };

package/dist/{caller-CXTFswBO.d.ts → caller-BT-Mv4bD.d.ts}

@@ -1,10 +1,10 @@
-import { ad as Version, a5 as Revision } from './envelope-Cp3YcVxC.js';
-import { L as Logger } from './logger-BY28acW-.js';
-import { A as AccessLevel, J as AnyContract, y as CollectionWhere, O as OrderBy, k as MethodKind, d as StandardSchemaV1, ag as EventName, ah as EventPayloadOf, aa as ChannelName, ab as ChannelPayloadOf, az as StreamName, am as IsScopedStream, ay as StreamItemOf, ae as ContractMap, ap as MethodName, al as InputOf, ar as OutputOf } from './infer-Teo1xpsd.js';
-import { P as Principal, Q as QuickdrawTypes, M as MaybePromise, c as PrincipalOf, a as McpContext, T as Transport, C as ContextExtensionOf, b as McpContextOf, D as DbOf } from './types-Cu0vmx7c.js';
+import { ad as Version, a5 as Revision } from './envelope-DzWyIXjj.js';
+import { L as Logger } from './logger-Yz93KzdV.js';
+import { A as AccessLevel, J as AnyContract, y as CollectionWhere, O as OrderBy, k as MethodKind, d as StandardSchemaV1, ag as EventName, ah as EventPayloadOf, aa as ChannelName, ab as ChannelPayloadOf, az as StreamName, am as IsScopedStream, ay as StreamItemOf, ae as ContractMap, ap as MethodName, al as InputOf, ar as OutputOf } from './infer-BmoZsL9a.js';
+import { P as Principal, Q as QuickdrawTypes, M as MaybePromise, c as PrincipalOf, a as McpContext, T as Transport, C as ContextExtensionOf, b as McpContextOf, D as DbOf } from './types-CYliTP65.js';
 
 /** What a development warning is about. */
-type DevWarningKind = "n-plus-one" | "unbounded-read" | "oversized-response" | "nested-write" | "ambient-write" | "batch-read" | "batch-create-many" | "repeated-call" | "tiered-field-in-output" | "resolver-without-reads";
+type DevWarningKind = "n-plus-one" | "unbounded-read" | "oversized-response" | "nested-write" | "ambient-write" | "batch-read" | "batch-create-many" | "repeated-call" | "tiered-field-in-output" | "resolver-without-reads" | "untracked-access-model" | "shared-principal" | "channel-without-requires";
 /** One development warning. */
 interface DevWarning {
     readonly kind: DevWarningKind;
@@ -14,8 +14,8 @@ interface DevWarning {
     /**
      * What the warning is about within its call, for the once-only rule: the
      * model of an ambient write, the model, field and operation of a nested
-     * write, the connection of a repeated call. Empty for the kinds that are
-     * once per call site.
+     * write, the connection of a repeated call, the `ctx` member a shared run
+     * read. Empty for the kinds that are once per call site.
      */
     readonly subject?: string;
     /** What happened and what to do instead. */
@@ -95,11 +95,25 @@ interface StorageAdapter {
     registerInterest(model: string, columns: readonly string[]): void;
     /** The columns registered for `model`. */
     interestOf(model: string): readonly string[];
+    /**
+     * Declares that rows of `model` are the entries of a `via` collection over
+     * the junction `link` names: a `delete` or `deleteMany` of `model` reads
+     * the junction rows linking the rows it deletes just before, through the
+     * open transaction when there is one, and reports them in each write's
+     * `links`, so a flush tells only the scopes a deleted entry was linked to
+     * (the 5.1 audit's COLL-3). A link committed between that read and the
+     * delete is not read (`prisma/links.ts`). Optional: without it a deleted
+     * entry left scopes nobody can name, and every subscribed scope of its
+     * collection is told it was removed.
+     */
+    registerLinks?(model: string, link: LinkInterest): void;
+    /** The junctions registered for `model` (`registerLinks`). */
+    linksOf?(model: string): readonly LinkInterest[];
     /**
      * True where the caller runs inside an open transaction of this adapter,
-     * whose reads see writes that may still roll back. The access cache keeps
-     * nothing read there; an adapter without this method gets no access cache
-     * across requests.
+     * whose reads see writes that may still roll back. The access cache
+     * neither reads nor keeps anything there; an adapter without this method
+     * gets no access cache across requests.
      */
     inTransaction?(): boolean;
     /**
@@ -110,6 +124,15 @@ interface StorageAdapter {
      * cursor shows holding null.
      */
     nullable?(model: string, column: string): Promise<boolean>;
+    /**
+     * Whether the adapter can key `model`'s writes: false for a model without
+     * an `id` column (a table keyed by a composite `@@id`), whose writes are
+     * never tracked. `createServer` asks it, at start, for every model an
+     * access policy, a membership table or a `via` junction depends on, and
+     * names each it cannot track (the `untracked-access-model` warning). An
+     * adapter without it is not asked.
+     */
+    trackable?(model: string): Promise<boolean>;
     /** The units of work that record this adapter's writes; the dispatcher uses them. */
     readonly unitOfWork: UnitOfWorkFactory;
 }
@@ -119,6 +142,17 @@ interface StorageAdapter {
  * `trackPrisma` still carries it.
  */
 declare function storageOf(db: unknown): StorageAdapter | undefined;
+/**
+ * A junction whose rows link an entry model's rows to the scopes of a `via`
+ * collection (`registerLinks`): its model, as the client names it, the
+ * column holding the entry's id, and the columns a delete reads with it (the
+ * scope column, and the role columns of a members table's rule).
+ */
+interface LinkInterest {
+    readonly model: string;
+    readonly entry: string;
+    readonly columns: readonly string[];
+}
 
 /** A principal's level on one row: an access level, or `null` for none. */
 type RowLevel = AccessLevel | null;
@@ -301,7 +335,22 @@ type CollectionScope = {
     readonly scope: string;
     /** A junction write sends its entry again to every scope that still holds it (`via`'s `refreshEntry`). */
     readonly refreshEntry: boolean;
+    /**
+     * The junction is the item service's `members` table: only links whose
+     * role gives at least the collection's `access` count, by one rule per
+     * role column the policy's `members` reads of the table use (a link
+     * any rule counts counts), and a write of a role column can move the
+     * link in or out.
+     */
+    readonly levels?: readonly LinkLevel[];
 };
+/** One role rule of a `via` scope over the item service's `members` table. */
+interface LinkLevel {
+    /** The junction's role column. */
+    readonly column: string;
+    /** The stored roles that give at least the collection's `access`; none: no link counts by this column. */
+    readonly roles: readonly string[];
+}
 /** One collection of a service: its contract declaration and the service's option, checked. */
 interface ServiceCollection {
     readonly name: string;
@@ -389,6 +438,14 @@ interface ServiceMethod {
      * caller is left to the form.
      */
     readonly kinds: readonly string[] | undefined;
+    /**
+     * The method's requirement on the caller's claims (RFC 0003 section 4.1,
+     * `access/claims.ts`), checked right after `kinds`, outside the access
+     * engine: `UNAUTHENTICATED` without a principal, `FORBIDDEN` unless it
+     * returns `true`. It adds to the access form, and no grant passes it, a
+     * service-wide `Admin` grant included. `undefined` when not declared.
+     */
+    readonly claims: ClaimsCheck | undefined;
     readonly handler: AnyHandler;
     readonly share: ShareMode | undefined;
     /** How long a shared result is reused after its run, in milliseconds. */
@@ -524,6 +581,11 @@ interface ScopeAccess<Input = never> {
     readonly service?: never;
     readonly kind?: never;
 }
+/**
+ * A method's `claims`, as the pipeline calls it (`claims.ts`): `true` when
+ * the caller's claims allow the call with `input`.
+ */
+type ClaimsCheck = (claims: Principal["claims"], input: unknown) => boolean;
 /**
  * `custom(fn)`: the call passes when `fn(ctx, input)` resolves `true`. The
  * caller must be authenticated before `fn` runs, so `ctx.principal` is never
@@ -602,7 +664,8 @@ interface RowAccess {
  * Who is online and who is in a room (RFC 0003 section 12.5): `ctx.presence`,
  * `server.presence`, `qd.presence`. Every answer is a promise: on a server
  * with the in-memory adapter it comes from this process's sockets; behind a
- * cluster adapter (Redis) it asks every node (`io.in(room).fetchSockets()`).
+ * cluster adapter (Redis) it asks the other nodes too, which answer with
+ * user ids (or whether they have a socket of the user) alone.
  */
 interface Presence {
     /** True while the user has a socket connected (on any node). */
@@ -614,9 +677,14 @@ interface Presence {
      * the 100,000 users seen last).
      */
     lastSeen(userId: string): Promise<number | null>;
-    /** How many users have a socket in `room`. Anonymous sockets do not count. */
+    /**
+     * How many users have a socket in app room `room` that `ctx.rooms.join`
+     * put there (a raw `socket.join` does not count on this process).
+     * Anonymous sockets do not count. A framework room (`qd:`, `user:`) or a
+     * name with the shape of a socket id is `VALIDATION`.
+     */
     count(room: string): Promise<number>;
-    /** The ids of the users with a socket in `room`, each once. */
+    /** The ids of the users `count` counts in `room`, each once. */
     users(room: string): Promise<string[]>;
 }
 /** Whose sockets `rooms.leave(room, target)` takes out of a room: every socket of one user. */
@@ -639,8 +707,9 @@ interface ServerRooms {
     /**
      * Sends the contract's event to every socket in `room` as `qd:event`, on
      * every node. The payload is checked against the event's schema first: a
-     * payload that fails it throws `INTERNAL` and nothing is sent. Without a
-     * server it does nothing more.
+     * payload that fails it throws `INTERNAL` and nothing is sent. A room of
+     * the framework's (`qd:`, `user:`) throws `VALIDATION`: send to a user's
+     * sockets with `emitToUser`. Without a server it does nothing more.
      */
     emit<C extends AnyContract, E extends EventName<C>>(room: string, contract: C, event: E, payload: EventPayloadOf<C, E>): void;
     /** `emit` to every socket of one user (their `user:{userId}` room), on every node. */
@@ -685,8 +754,10 @@ interface ContextRooms extends ServerRooms {
      * nothing, for a call that did not arrive over a socket (HTTP, MCP, in
      * process). Room names starting with `qd:` or `user:` are refused with
      * `VALIDATION` (those rooms are joined only through their authorized
-     * paths), as are empty names and names over 256 characters; a socket in
-     * 100 app rooms is refused another with `CONFLICT`.
+     * paths), as are names with the shape of a Socket.IO socket id (20
+     * letters, digits, `_` or `-`: every socket is alone in the room of its
+     * id), empty names and names over 256 characters; a socket in 100 app
+     * rooms is refused another with `CONFLICT`.
      */
     join(room: string): boolean;
     /** Takes the calling socket out of an app room; `false` when it was not in it, or the call has no socket. */
@@ -850,7 +921,12 @@ interface ChannelContext<P = Principal, Room extends string | undefined = string
 type ChannelHandler<T extends QuickdrawTypes, Payload, Room extends string | undefined = string | undefined> = (payload: Payload, ctx: ChannelContext<PrincipalOf<T>, Room>) => void | PromiseLike<void>;
 /** One channel's implementation in `defineService`: its handler, or `{ access, handler }`. */
 type ChannelImplementation<T extends QuickdrawTypes, Payload, Room extends string | undefined = string | undefined> = ChannelHandler<T, Payload, Room> | {
-    /** Default `"authenticated"`. */
+    /**
+     * Default `"authenticated"`. A channel whose contract declares no
+     * `requires` takes a message from every signed-in socket: declaring
+     * `access` (even `"authenticated"`) says so on purpose, and silences
+     * the `channel-without-requires` warning the server raises otherwise.
+     */
     readonly access?: ChannelAccess;
     readonly handler: ChannelHandler<T, Payload, Room>;
 };
@@ -920,6 +996,12 @@ interface ServiceChannel {
         readonly prefix: string;
     } | undefined;
     readonly access: ChannelAccess;
+    /**
+     * True when the service named `access` for the channel (`{ access,
+     * handler }`), not a bare handler or `{ handler }`: a channel without
+     * `requires` warns `channel-without-requires` unless it did.
+     */
+    readonly accessDeclared: boolean;
     /**
      * The kinds of principal the channel's service admits, as a set for the
      * per-message check: a message from a socket of another kind, or without
@@ -1112,19 +1194,32 @@ interface WriteRecord {
     /** The written row's id. */
     readonly id: string;
     readonly op: "create" | "update" | "delete";
-    /** The fields the write set; `[ANY_FIELD]` when they are unknown. */
+    /**
+     * The fields the write set; `[ANY_FIELD]` when they are unknown. An update
+     * whose data held a nested write, which may set a foreign key through a
+     * relation, lists every interested column of the model besides its keys.
+     */
     readonly fields: readonly string[];
     /**
      * The row before the unit of work wrote it, for its interested columns: an
      * update's old values of the interested columns it changed (read first,
-     * narrowly), or a delete's values. A row the unit created has none.
+     * narrowly), or of every interested column when its data held a nested
+     * write, or a delete's values. A row the unit created has none.
      */
     readonly before?: Readonly<Record<string, unknown>>;
     /** The interested columns' values after the write, when the write returned them. */
     readonly after?: Readonly<Record<string, unknown>>;
+    /**
+     * On a delete of a model whose junction links are registered
+     * (`StorageAdapter.registerLinks`): per junction model, the junction rows
+     * that linked the row just before the delete (possibly none), with the
+     * registered columns. Absent when the links were not read.
+     */
+    readonly links?: Readonly<Record<string, readonly Readonly<Record<string, unknown>>[]>>;
     /**
      * Set on a `create` an `upsert` recorded without reading whether its row
-     * existed (its `update` set no interested column): the row may have been
+     * existed (its `update` set no interested column and held no nested
+     * write, or the model has no interested columns): the row may have been
      * updated rather than created. Only merging reads it: a row created and
      * deleted in one unit is dropped from the flush only when its create is
      * certain.
@@ -1248,4 +1343,4 @@ type CallerFor<T extends QuickdrawTypes> = T extends {
     readonly contracts: infer Contracts extends ContractMap;
 } ? Caller<Contracts[keyof Contracts]> : Caller<AnyContract>;
 
-export { type ProjectedOutput as $, type AnyService as A, type PublicAccess as B, type CountArgs as C, DevWarningError as D, type HandlerArgs as E, type FindManyArgs as F, type CustomAccess as G, type HandlerContext as H, type ShareMode as I, type ChannelOptions as J, type StreamOptions as K, type ChannelsRequired as L, type ModelName as M, type BaseContext as N, type CallerFor as O, type Presence as P, type AccessPolicy as Q, type RowLevels as R, type StorageAdapter as S, type AnyAccessPolicy as T, type UnitOfWorkFactory as U, type PolicyColumns as V, type WriteRecord as W, type PolicyForeign as X, type PolicyTools as Y, type RowAccess as Z, type AffectsLink as _, type StorageRow as a, type Projection as a0, type TierGroup as a1, type Tiers as a2, DEFAULT_BULK_THRESHOLD as a3, type CollectionScope as a4, type ServiceCollection as a5, type ContextRooms as a6, type ContextServices as a7, type TouchOptions as a8, type ChannelAccess as a9, type AccessForm as aA, type AccessRequest as aB, type AuthenticatedAccess as aC, type EntryAccess as aD, type IdKeyOf as aE, type IdSelector as aF, type ScopeAccess as aG, type ServiceAccess as aH, ANY_FIELD as aI, type UnitOfWork as aJ, type UnitOfWorkScope as aK, formatDevWarning as aL, N_PLUS_ONE_STATEMENTS as aM, type ChannelContext as aa, type ChannelHandler as ab, type ChannelImplementation as ac, type ChannelRoomOf as ad, type RoomLeave as ae, type RoomLeaveReason as af, type RoomLeft as ag, type RoomTarget as ah, type ServiceChannel as ai, type ServiceStream as aj, type StreamImplementation as ak, type StreamPushArgs as al, type StreamPushManyArgs as am, type StreamSeed as an, type StreamSeedContext as ao, type StreamValidation as ap, type CallOptions as aq, type MethodCaller as ar, type ServiceCaller as as, type ForeignColumns as at, type ForeignColumnsOf as au, type MembershipRead as av, type ParentLink as aw, type PolicyKind as ax, type PolicyReads as ay, type RowLevel as az, type StorageWhere as b, type StatementCount as c, type Caller as d, type FlushSink as e, type FlushInfo as f, type ServiceMethod as g, type Service as h, type DevWarning as i, type DevWarningKind as j, type AccessFilter as k, type RunContext as l, type RunOptions as m, type ServerRooms as n, type StreamHandle as o, type AnyContext as p, type AccessEngine as q, type AppRooms as r, storageOf as s, type StreamSubscriptions as t, type RoomLeaveHandler as u, type PolicyFor as v, type RowForms as w, type AccessFor as x, type ModelColumn as y, type WatchAccess as z };
+export { type ProjectedOutput as $, type AnyService as A, type PublicAccess as B, type CountArgs as C, DevWarningError as D, type HandlerArgs as E, type FindManyArgs as F, type CustomAccess as G, type HandlerContext as H, type ShareMode as I, type ChannelOptions as J, type StreamOptions as K, type ChannelsRequired as L, type ModelName as M, type BaseContext as N, type CallerFor as O, type Presence as P, type AccessPolicy as Q, type RowLevels as R, type StorageAdapter as S, type AnyAccessPolicy as T, type UnitOfWorkFactory as U, type PolicyColumns as V, type WriteRecord as W, type PolicyForeign as X, type PolicyTools as Y, type RowAccess as Z, type AffectsLink as _, type StorageRow as a, type Projection as a0, type TierGroup as a1, type Tiers as a2, DEFAULT_BULK_THRESHOLD as a3, type CollectionScope as a4, type ServiceCollection as a5, type ContextRooms as a6, type ContextServices as a7, type TouchOptions as a8, type ChannelAccess as a9, type AccessForm as aA, type AccessRequest as aB, type AuthenticatedAccess as aC, type EntryAccess as aD, type IdKeyOf as aE, type IdSelector as aF, type ScopeAccess as aG, type ServiceAccess as aH, ANY_FIELD as aI, type UnitOfWork as aJ, type UnitOfWorkScope as aK, type LinkInterest as aL, formatDevWarning as aM, N_PLUS_ONE_STATEMENTS as aN, type ChannelContext as aa, type ChannelHandler as ab, type ChannelImplementation as ac, type ChannelRoomOf as ad, type RoomLeave as ae, type RoomLeaveReason as af, type RoomLeft as ag, type RoomTarget as ah, type ServiceChannel as ai, type ServiceStream as aj, type StreamImplementation as ak, type StreamPushArgs as al, type StreamPushManyArgs as am, type StreamSeed as an, type StreamSeedContext as ao, type StreamValidation as ap, type CallOptions as aq, type MethodCaller as ar, type ServiceCaller as as, type ForeignColumns as at, type ForeignColumnsOf as au, type MembershipRead as av, type ParentLink as aw, type PolicyKind as ax, type PolicyReads as ay, type RowLevel as az, type StorageWhere as b, type StatementCount as c, type Caller as d, type FlushSink as e, type FlushInfo as f, type ServiceMethod as g, type Service as h, type DevWarning as i, type DevWarningKind as j, type AccessFilter as k, type RunContext as l, type RunOptions as m, type ServerRooms as n, type StreamHandle as o, type AnyContext as p, type AccessEngine as q, type AppRooms as r, storageOf as s, type StreamSubscriptions as t, type RoomLeaveHandler as u, type PolicyFor as v, type RowForms as w, type AccessFor as x, type ModelColumn as y, type WatchAccess as z };

package/dist/{chunk-RT6OILOI.js → chunk-4D2DOGAW.js}

@@ -11,21 +11,9 @@ function via(junction) {
   });
 }
 
-// src/contract/realtime.ts
-var GLOBAL_STREAM = "global";
-var STREAM_MAX_SEED = 1e3;
-var CHANNEL_DEFAULT_RATE = 30;
-function isScopedStream(def) {
-  return def.scope !== void 0 && def.scope !== GLOBAL_STREAM;
-}
-
 export {
   DEFAULT_COLLECTION_LIMIT,
   DEFAULT_COLLECTION_MAX_LIMIT,
-  via,
-  GLOBAL_STREAM,
-  STREAM_MAX_SEED,
-  CHANNEL_DEFAULT_RATE,
-  isScopedStream
+  via
 };
-//# sourceMappingURL=chunk-RT6OILOI.js.map
+//# sourceMappingURL=chunk-4D2DOGAW.js.map

package/dist/chunk-4D2DOGAW.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/contract/collections.ts"],"sourcesContent":["// Collection declarations for a contract (RFC 0003 section 7.1). A collection\n// is the rows of one service grouped by a scope value. Membership is declared\n// (a scope column or a junction table, plus an equality filter), never\n// computed by a function, so the framework knows which writes can move a row.\n// This replaces 4.1's `defineCollection({ resolveScopeId, checkScopeAccess,\n// snapshot, toItem })`.\n\nimport type { AccessLevel } from \"./access\";\n\n/** Page size of a collection snapshot when the collection sets no `limit`. */\nexport const DEFAULT_COLLECTION_LIMIT = 100;\n\n/** Largest page a client may ask for when the collection sets no `maxLimit`. */\nexport const DEFAULT_COLLECTION_MAX_LIMIT = 500;\n\n/**\n * A scope that comes from a junction table instead of a column on the row:\n * the rows of `model` link an entry (`entry` holds the row's id) to a scope\n * value (`scope`). For example, a chat appears in each member's list through\n * `via({ model: \"chatMember\", entry: \"chatId\", scope: \"userId\" })`.\n */\nexport interface ViaScope<\n  Model extends string = string,\n  Entry extends string = string,\n  Scope extends string = string,\n> {\n  readonly kind: \"via\";\n  readonly model: Model;\n  readonly entry: Entry;\n  readonly scope: Scope;\n  /**\n   * The item is computed from the junction (a member count): every junction\n   * write sends its entry again, whole, to each scope that still holds it.\n   * Without it a junction write only adds or removes the entry in the scope\n   * it links, so a count over the junction goes stale everywhere else.\n   */\n  readonly refreshEntry?: boolean;\n}\n\n/** What `via(...)` takes: the junction model, its entry and scope columns, and `refreshEntry`. */\nexport interface ViaOptions<\n  Model extends string = string,\n  Entry extends string = string,\n  Scope extends string = string,\n> {\n  /**\n   * The junction model, as the database client names it: `\"chatMember\"`. It\n   * needs an `id` column (keep the pair unique with `@@unique`, never a\n   * composite `@@id`), or its writes are not tracked and never move a scope.\n   */\n  readonly model: Model;\n  /** The junction column holding the entry's id: `\"chatId\"`. */\n  readonly entry: Entry;\n  /** The junction column holding the scope value: `\"userId\"`. */\n  readonly scope: Scope;\n  /**\n   * Set when the item reads the junction, as a `memberCount` mapped from a\n   * relation count does: a junction create, update or delete then sends the\n   * entry again, as `updated`, to every scope that still holds it (one read\n   * of the entry's item per flush). Default `false`: a junction write adds\n   * or removes the entry for the scope it links, and nothing else.\n   */\n  readonly refreshEntry?: boolean;\n}\n\n/**\n * Declares a collection scope that comes from a junction table.\n *\n * @example\n * myChats: {\n *   scope: via({ model: \"chatMember\", entry: \"chatId\", scope: \"userId\", refreshEntry: true }),\n *   item: \"listItem\",\n *   order: [[\"id\", \"asc\"]],\n * }\n */\nexport function via<\n  const Model extends string,\n  const Entry extends string,\n  const Scope extends string,\n>(junction: ViaOptions<Model, Entry, Scope>): ViaScope<Model, Entry, Scope> {\n  return Object.freeze({\n    kind: \"via\",\n    model: junction.model,\n    entry: junction.entry,\n    scope: junction.scope,\n    ...(junction.refreshEntry === undefined ? {} : { refreshEntry: junction.refreshEntry }),\n  });\n}\n\nexport type SortDirection = \"asc\" | \"desc\";\n\n/**\n * Sort columns for the keyset cursor, ending in `id` so every row has a\n * unique position: `[[\"ordinal\", \"asc\"], [\"id\", \"asc\"]]`.\n */\nexport type OrderBy<Column extends string = string> = readonly [\n  ...(readonly [Column, SortDirection])[],\n  readonly [\"id\", SortDirection],\n];\n\n/** Who a view is evaluated for, on the client. */\nexport interface Viewer {\n  readonly userId: string;\n}\n\n/**\n * A view: a named pure predicate evaluated on the client over the index rows\n * of a scope (RFC 0003 section 7.5). `row` holds only `id` and the\n * collection's `index` fields, which the type enforces.\n */\nexport type ViewPredicate<Row> = (row: Row, who: Viewer) => boolean;\n\n/** The equality filter that decides membership, for example `{ archived: false }`. */\nexport interface CollectionWhere {\n  readonly [column: string]: string | number | boolean | null;\n}\n\n/** Any collection of any contract, as `defineContract` stores it. */\nexport interface CollectionDef {\n  /** What the list holds, in a sentence or two, for the generated docs. */\n  readonly describe?: string | undefined;\n  /** A string column of the entity, or `via(...)` for a junction table. */\n  readonly scope: string | ViaScope;\n  /** The projection each item is sent as: `\"entity\"` or a named projection. */\n  readonly item: string;\n  /** Sort columns for the keyset cursor; the last one is `id`. */\n  readonly order: OrderBy;\n  /** Equality filter that decides membership. */\n  readonly where?: CollectionWhere | undefined;\n  /** Page size. Default {@link DEFAULT_COLLECTION_LIMIT}. */\n  readonly limit?: number | undefined;\n  /** Largest page a client may ask for. Default {@link DEFAULT_COLLECTION_MAX_LIMIT}. */\n  readonly maxLimit?: number | undefined;\n  /** Item fields sent for every member of the scope (RFC 0003 section 7.4). */\n  readonly index?: readonly string[] | undefined;\n  /** Named predicates over index rows. Requires `index`. */\n  readonly views?: { readonly [view: string]: ViewPredicate<never> } | undefined;\n  /** Level required on the scope's anchor row. Default `\"Read\"`, through the anchor's policy. */\n  readonly access?: AccessLevel | undefined;\n}\n"],"mappings":";AAUO,IAAM,2BAA2B;AAGjC,IAAM,+BAA+B;AA8DrC,SAAS,IAId,UAA0E;AAC1E,SAAO,OAAO,OAAO;AAAA,IACnB,MAAM;AAAA,IACN,OAAO,SAAS;AAAA,IAChB,OAAO,SAAS;AAAA,IAChB,OAAO,SAAS;AAAA,IAChB,GAAI,SAAS,iBAAiB,SAAY,CAAC,IAAI,EAAE,cAAc,SAAS,aAAa;AAAA,EACvF,CAAC;AACH;","names":[]}

package/dist/chunk-5CGO426C.js

@@ -0,0 +1,15 @@
+// src/contract/realtime.ts
+var GLOBAL_STREAM = "global";
+var STREAM_MAX_SEED = 1e3;
+var CHANNEL_DEFAULT_RATE = 30;
+function isScopedStream(def) {
+  return def.scope !== void 0 && def.scope !== GLOBAL_STREAM;
+}
+
+export {
+  GLOBAL_STREAM,
+  STREAM_MAX_SEED,
+  CHANNEL_DEFAULT_RATE,
+  isScopedStream
+};
+//# sourceMappingURL=chunk-5CGO426C.js.map

package/dist/chunk-5CGO426C.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/contract/realtime.ts"],"sourcesContent":["// Streams, channels and typed room events in a contract (RFC 0003 section\n// 12.5). A stream is server-to-client append-only data a subscriber receives\n// with a seed of recent items; a channel is fire-and-forget client-to-server\n// input (cursors, typing) behind a per-socket token bucket; an event is a\n// typed custom frame a handler sends to a room. 4.1 declared channels on the\n// service class (4.1 `src/server/BaseService.ts:915-942`) and typed room\n// events through the augmentable `QuickdrawEventMap`; here all three live in\n// the contract, so the client is typed from it.\n//\n// Methods, collections, streams, channels and events share one namespace:\n// the client exposes each as `qd.<service>.<name>`.\n\nimport type { AccessLevel } from \"./access\";\nimport type { AnyContract } from \"./defineContract\";\nimport type { StandardSchemaV1 } from \"./standardSchema\";\n\n/** The `scope` of a stream with one feed for the whole service: the default. */\nexport const GLOBAL_STREAM = \"global\";\n\n/** The most items a stream may keep per scope as the seed for new subscribers. */\nexport const STREAM_MAX_SEED = 1000;\n\n/** A channel's sustained rate when it declares none: messages per second per socket. */\nexport const CHANNEL_DEFAULT_RATE = 30;\n\n/**\n * The app room a stream's subscriber must be in (`access: { room }`): for a\n * global stream the room's name, or `{ prefix }` for any room whose name\n * starts with it; for a scoped stream a function of the scope\n * (`(worldId) => \\`world:${worldId}\\``), since a name or a prefix would let\n * a socket in that room read every scope (`defineContract` refuses them\n * there).\n */\nexport type StreamRoom = string | RoomPrefix | ((scope: string) => string | null | undefined);\n\n/**\n * Who may subscribe to a stream (RFC 0003 section 4.1's forms, as data). A\n * scoped stream's scope value is the row an `entry` or `scope` form is about:\n * `{ entry: L }` needs level `L` on the row of this service whose id is the\n * scope, `{ scope: L, of }` level `L` on that row of `of`'s service.\n * `{ room }` opens it to the sockets in an app room a method joined them to\n * (signed in or not), as a channel's `requires: { room }` does its messages:\n * a socket that leaves the room, or is taken out of it, leaves the feed too.\n * A scoped stream computes that room from its scope; a name or `{ prefix }`\n * serves a global stream only. A stream that declares none is closed: no\n * client may subscribe.\n */\nexport type StreamAccess =\n  | \"public\"\n  | \"authenticated\"\n  | {\n      readonly service: AccessLevel;\n      readonly entry?: undefined;\n      readonly scope?: undefined;\n      readonly of?: undefined;\n      readonly room?: undefined;\n    }\n  | {\n      readonly entry: AccessLevel;\n      readonly service?: AccessLevel;\n      readonly scope?: undefined;\n      readonly of?: undefined;\n      readonly room?: undefined;\n    }\n  | {\n      readonly scope: AccessLevel;\n      readonly of: AnyContract;\n      readonly service?: undefined;\n      readonly entry?: undefined;\n      readonly room?: undefined;\n    }\n  | {\n      readonly room: StreamRoom;\n      readonly service?: undefined;\n      readonly entry?: undefined;\n      readonly scope?: undefined;\n      readonly of?: undefined;\n    };\n\n/** A server-to-client stream of append-only items (RFC 0003 section 12.5). */\nexport interface StreamDef<Item extends StandardSchemaV1 = StandardSchemaV1> {\n  /** One item's schema. Pushed items are checked against it before they are sent. */\n  readonly item: Item;\n  /**\n   * What a scope value is (`\"taskId\"`): the stream has one feed per scope.\n   * `\"global\"`, the default, makes one feed for the whole service.\n   */\n  readonly scope?: string;\n  /**\n   * How many of the latest items the server keeps per scope, in memory on\n   * each process, and sends a new subscriber first. Default 0; at most 1,000.\n   */\n  readonly seed?: number;\n  /** Send items volatile: dropped for a client whose connection is backed up. Default `false`. */\n  readonly volatile?: boolean;\n  /** Who may subscribe. Without it the stream is closed. */\n  readonly access?: StreamAccess;\n  /** What the stream carries, in a sentence or two, for the generated docs. */\n  readonly describe?: string;\n}\n\n/**\n * Where a channel requirement finds its row id or scope value in the parsed\n * payload: the name of a key holding a string, or a function of the payload.\n */\nexport type PayloadSelector = string | ((payload: never) => string | null | undefined);\n\n/**\n * Any app room whose name starts with `prefix` (`{ prefix: \"world:\" }`, a\n * game of many worlds): the sending socket passes when it is in one, and\n * the channel's handler gets the one it matched as `ctx.room`, so the\n * payload need not repeat which room it is for.\n */\nexport interface RoomPrefix {\n  readonly prefix: string;\n}\n\n/**\n * The app room a channel requirement names: the room itself (`\"world\"`, a\n * game's one world), a function of the parsed payload that returns it\n * (`(payload) => \\`lobby:${payload.lobbyId}\\``), or `{ prefix }`, any room\n * whose name starts with it (`{ prefix: \"world:\" }`). Unlike a\n * {@link PayloadSelector}, a string here is the room's name, not a payload\n * key. A name starting with `qd:` or `user:`, or one with the shape of a\n * Socket.IO socket id (20 letters, digits, `_` or `-`), is never an app\n * room: a literal one (or such a prefix) is refused when the contract is\n * defined, and a computed one drops the message.\n */\nexport type RoomSelector = string | ((payload: never) => string | null | undefined) | RoomPrefix;\n\n/**\n * What a channel message requires of the socket that sends it: a live\n * subscription (`qd:sub`) to the row of this service `entity` names, or\n * (`qd:col:sub`) to the scope of `collection` that `scope` names; or that\n * the socket is in the app room `room` names (or, for `{ prefix }`, in any\n * app room whose name starts with it), which a method called over that\n * same socket joined with `ctx.rooms.join` (a room another socket of the\n * user joined does not count, and a reconnected socket is in none until it\n * joins again). The handler gets the room that matched as `ctx.room`. Each\n * is checked in memory against the sending socket's own records, on the\n * node it is connected to. A message whose payload names none is dropped.\n */\nexport type ChannelRequires =\n  | {\n      readonly entity: PayloadSelector;\n      readonly collection?: undefined;\n      readonly scope?: undefined;\n      readonly room?: undefined;\n    }\n  | {\n      readonly collection: string;\n      readonly scope: PayloadSelector;\n      readonly entity?: undefined;\n      readonly room?: undefined;\n    }\n  | {\n      readonly room: RoomSelector;\n      readonly entity?: undefined;\n      readonly collection?: undefined;\n      readonly scope?: undefined;\n    };\n\n/** A client-to-server fire-and-forget channel (RFC 0003 section 12.5). */\nexport interface ChannelDef<Payload extends StandardSchemaV1 = StandardSchemaV1> {\n  /** One message's schema. A message that fails it is dropped. */\n  readonly payload: Payload;\n  /** Messages one socket may send per second, sustained. Default 30. */\n  readonly ratePerSecond?: number;\n  /** How many messages one socket may send at once. Default twice `ratePerSecond`. */\n  readonly burst?: number;\n  /**\n   * What the sender must already be subscribed to, or the app room it must\n   * be in. Without it every signed-in user may send the channel, about any\n   * row or room its payload names, and the server warns\n   * `channel-without-requires` unless the service declares the channel's\n   * `access` (`\"authenticated\"` when any signed-in user may send it).\n   */\n  readonly requires?: ChannelRequires;\n  /** What a message says, in a sentence or two, for the generated docs. */\n  readonly describe?: string;\n}\n\n/** A typed custom room event, delivered as `qd:event` (RFC 0003 section 8.3). */\nexport interface EventDef<Payload extends StandardSchemaV1 = StandardSchemaV1> {\n  readonly payload: Payload;\n  /** What the event announces, in a sentence or two, for the generated docs. */\n  readonly describe?: string;\n}\n\n/** True when a stream has one feed per scope value; false for a global stream. */\nexport function isScopedStream(def: Pick<StreamDef, \"scope\">): boolean {\n  return def.scope !== undefined && def.scope !== GLOBAL_STREAM;\n}\n"],"mappings":";AAiBO,IAAM,gBAAgB;AAGtB,IAAM,kBAAkB;AAGxB,IAAM,uBAAuB;AAuK7B,SAAS,eAAe,KAAwC;AACrE,SAAO,IAAI,UAAU,UAAa,IAAI,UAAU;AAClD;","names":[]}