@fitzzero/quickdraw-core 5.1.1 → 5.1.2

package/dist/server/index.js

@@ -1,6 +1,10 @@
+import {
+  findNestedWrites
+} from "../chunk-XH2IZVLT.js";
 import {
   CHANNEL_ABUSE_MULTIPLIER,
   CHANNEL_ABUSE_WINDOW_MS,
+  DEFAULT_BULK_THRESHOLD,
   DEFAULT_LIMITS,
   DEFAULT_STALL_INTERVAL_MS,
   DEFAULT_STALL_MAX_MS,
@@ -16,7 +20,6 @@ import {
   RESUME_MAX_DELTAS,
   STALL_RESOLUTION_MS,
   STREAM_MAX_SCOPES,
-  SUBSCRIBER_LEVELS,
   accessFormProblem,
   afterCursor,
   allowedScopes,
@@ -24,9 +27,8 @@ import {
   anyOfPolicies,
   applyRateLimitMiddleware,
   checkName,
-  checkWhenDefined,
-  checksRowsItself,
-  compileProjections,
+  claimsOption,
+  compileCollections,
   createBasicAccessEngine,
   createDispatcher,
   createHttpRouter,
@@ -36,32 +38,20 @@ import {
   custom,
   decodeCursor,
   definePolicy,
+  deploymentOf,
   encodeCursor,
-  handlerProblem,
-  inputKeys,
   isAccessPolicy,
   isCustomAccess,
-  isKitHandler,
-  isRowChecked,
-  levelsAtLeast,
   levelsById,
-  markGrantsEditor,
-  maxLevel,
-  meetsLevel,
   members,
   membersWhere,
   membershipOf,
-  narrowKinds,
   orderByOf,
-  projectRow,
-  projectedOutput,
-  registerRuntime,
   resolver,
+  rowlessProblem,
   selectWith,
-  serviceGrant,
-  strip,
   watchAdapterClients
-} from "../chunk-RZTP4IEW.js";
+} from "../chunk-6K5BY47X.js";
 import {
   DevWarningError,
   N_PLUS_ONE_STATEMENTS,
@@ -69,273 +59,93 @@ import {
   currentRev,
   formatDevWarning,
   runBeforeAnyDispatcher
-} from "../chunk-4DIQHASK.js";
+} from "../chunk-Z5ILULF2.js";
 import {
   crud,
   crudSpecOf,
   sharing,
   sharingSpecOf
-} from "../chunk-QCHKWIRS.js";
-import "../chunk-QEKVYG5F.js";
+} from "../chunk-NMXYENH4.js";
+import "../chunk-RL4VKLBX.js";
 import {
+  SUBSCRIBER_LEVELS,
   abortError,
   callerGrantsOf,
+  checkWhenDefined,
+  checkWhenServed,
+  checksRowsItself,
+  compileProjections,
   createCaller,
+  dependsOnCaller,
+  handlerProblem,
+  isCallerDependent,
   kitRuntimeOf,
+  levelsAtLeast,
+  markGrantsEditor,
+  maxLevel,
+  meetsLevel,
+  narrowKinds,
   outputSchemaOf,
-  schemaOutputOf
-} from "../chunk-2PWMUVC7.js";
-import "../chunk-DD4SKCNO.js";
+  projectRow,
+  projectedOutput,
+  registerRuntime,
+  schemaOutputOf,
+  serviceGrant,
+  strip
+} from "../chunk-MBH6IDSM.js";
+import "../chunk-LCC7HNFP.js";
 import {
   recordSocketSession,
   toCallReply,
   unreadable
-} from "../chunk-REX5YPHX.js";
+} from "../chunk-RJ5I2VO3.js";
 import {
   ANY_FIELD,
   modelKey,
   storageOf
-} from "../chunk-H23KEFBA.js";
+} from "../chunk-DUBU3BB3.js";
 import {
   ADMIN_FIELD_TYPES,
   ADMIN_NEVER_WRITABLE,
+  MAX_CURSOR_LENGTH,
   admin,
   adminSpecOf,
   search,
   searchSpecOf
-} from "../chunk-CDKG4TFA.js";
+} from "../chunk-GKH3LJ7N.js";
 import {
-  ACCESS_LEVELS,
+  MAX_ENTITY_IDS_PER_SOCKET,
+  MAX_SCOPES_PER_SOCKET,
+  MAX_TOPICS_PER_SOCKET,
   entityRoom,
-  isAccessLevel,
-  reservedRoomPrefix
-} from "../chunk-VSQBHPWH.js";
+  reservedRoomPrefix,
+  socketIdShaped
+} from "../chunk-753VJIUP.js";
 import {
   CHANNEL_DEFAULT_RATE,
-  DEFAULT_COLLECTION_LIMIT,
-  DEFAULT_COLLECTION_MAX_LIMIT,
   isScopedStream
-} from "../chunk-RT6OILOI.js";
+} from "../chunk-5CGO426C.js";
+import "../chunk-4D2DOGAW.js";
+import {
+  ACCESS_LEVELS,
+  isAccessLevel
+} from "../chunk-AK23XSWD.js";
 import "../chunk-47AEXVDM.js";
 import "../chunk-Z2LZ7IZ7.js";
 import {
-  consoleLogger
-} from "../chunk-YSWH776Y.js";
+  consoleLogger,
+  errorText
+} from "../chunk-DKE6QO26.js";
 import {
   QuickdrawError
 } from "../chunk-4YO5H5ON.js";
 
-// src/server/access/rowless.ts
-function checksNoRow(form) {
-  if (form === "public" || form === "authenticated") {
-    return true;
-  }
-  return typeof form === "object" && !isCustomAccess(form) && form.entry === void 0 && form.scope === void 0 && form.service !== void 0 && form.service !== "Admin";
-}
-function described(form) {
-  if (form === "public") {
-    return { code: '"public"', who: "anyone, signed in or not," };
-  }
-  if (form === "authenticated") {
-    return { code: '"authenticated"', who: "every signed-in user" };
-  }
-  const level = typeof form === "object" && !isCustomAccess(form) ? form.service : void 0;
-  return {
-    code: `{ service: "${String(level)}" }`,
-    who: `everyone with a service-wide ${String(level)} grant`
-  };
-}
-function suggestion(method) {
-  const { access } = method;
-  if (typeof access === "object" && !isCustomAccess(access) && access.service !== void 0) {
-    return `{ service: "${access.service}", entry: "${access.service}" }`;
-  }
-  return `{ entry: "${method.kind === "query" ? "Read" : "Moderate"}" }`;
-}
-function rowlessProblem(method) {
-  const { access, handler } = method;
-  if (method.rowless || !checksNoRow(access) || isRowChecked(handler)) {
-    return void 0;
-  }
-  if (inputKeys(method.input)?.includes("id") !== true) {
-    return void 0;
-  }
-  const optOut = isKitHandler(handler) ? `name it in the kit's rowless option (rowless: ["${method.name}"])` : "set rowless: true on the method";
-  const form = described(access);
-  return `method "${method.name}" takes a row id (its input has id), but its access ${form.code} checks no row: on a service with an access policy, that lets ${form.who} reach any row by its id. Give it ${suggestion(method)} so the policy decides, or, if every caller its access admits may reach any row, ${optOut}`;
-}
-
-// src/server/collections/define.ts
-var DEFAULT_BULK_THRESHOLD = 200;
-var OPTION_KEYS = /* @__PURE__ */ new Set(["anchor", "scopeAccess", "bulkThreshold"]);
-function isRecord(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function isContract(value) {
-  return isRecord(value) && typeof value.name === "string" && value.name.length > 0 && Object.isFrozen(value);
-}
-function checkOption(owner2, option, fail5) {
-  if (!isRecord(option)) {
-    fail5(`${owner2} must be { anchor: contract } or { scopeAccess: "self" }`);
-  }
-  const unknownKey = Object.keys(option).find((key) => !OPTION_KEYS.has(key));
-  if (unknownKey !== void 0) {
-    fail5(
-      `${owner2} has an unknown option "${unknownKey}"; the options are anchor, scopeAccess and bulkThreshold`
-    );
-  }
-  const { anchor, scopeAccess, bulkThreshold = DEFAULT_BULK_THRESHOLD } = option;
-  if (anchor === void 0 === (scopeAccess === void 0)) {
-    fail5(
-      `${owner2} needs exactly one of anchor (the contract whose rows its scope values are ids of) and scopeAccess: "self"`
-    );
-  }
-  if (anchor !== void 0 && !isContract(anchor)) {
-    fail5(`${owner2}: anchor must be a contract from defineContract`);
-  }
-  if (scopeAccess !== void 0 && scopeAccess !== "self") {
-    fail5(
-      `${owner2}: scopeAccess must be "self", for a scope whose value is the subscriber's user id`
-    );
-  }
-  if (typeof bulkThreshold !== "number" || !Number.isSafeInteger(bulkThreshold) || bulkThreshold < 1) {
-    fail5(`${owner2}: bulkThreshold must be a positive whole number`);
-  }
-  return { anchor, bulkThreshold };
-}
-function checkIndex(name, def, item, access, fail5) {
-  const { index, views } = def;
-  if (index === void 0) {
-    if (views !== void 0) {
-      fail5(`collection "${name}" declares views but no index; views read index rows`);
-    }
-    return void 0;
-  }
-  if (!Array.isArray(index) || !index.every((field) => typeof field === "string")) {
-    fail5(`collection "${name}": index must be a list of item field names`);
-  }
-  const owner2 = `collection "${name}": index field`;
-  const hidden = item.tiers.hidden(access);
-  for (const [position, field] of index.entries()) {
-    if (field === "id") {
-      fail5(`${owner2} "id" is not needed; every index row starts with the member's id`);
-    }
-    if (!item.keys.includes(field)) {
-      fail5(
-        `${owner2} "${field}" is not a key of its item "${item.name}"; index fields are item fields`
-      );
-    }
-    if (hidden.has(field)) {
-      fail5(
-        `${owner2} "${field}" is reserved by the contract's fields for a level above the collection's access (${access}), so its items never carry it`
-      );
-    }
-    if (index.indexOf(field) !== position) {
-      fail5(`${owner2} "${field}" is named twice`);
-    }
-  }
-  checkIndexOrder(name, def.order, index, fail5);
-  return Object.freeze([...index]);
-}
-function checkOrderTiers(name, order, fields, access, fail5) {
-  for (const [column] of order) {
-    const required = Object.hasOwn(fields, column) ? fields[column] : void 0;
-    if (required !== void 0 && !meetsLevel(access, required)) {
-      fail5(
-        `collection "${name}": order column "${column}" is reserved by the contract's fields for ${required}, above the collection's access (${access}); a page's cursor and order would tell its subscribers what it holds`
-      );
-    }
-  }
-}
-function checkIndexOrder(name, order, index, fail5) {
-  const missing2 = order.map(([column]) => column).find((c) => c !== "id" && !index.includes(c));
-  if (missing2 !== void 0) {
-    fail5(
-      `collection "${name}": order column "${missing2}" is not an index field; a client keeps the index in order by it`
-    );
-  }
-}
-function accessOf(name, def, anchor, fail5) {
-  if (anchor !== void 0) {
-    return def.access ?? "Read";
-  }
-  if (def.access !== void 0 && meetsLevel(def.access, "Moderate")) {
-    fail5(
-      `collection "${name}" has scopeAccess "self", which is authorized by the subscriber's user id and not by a level, so its access may not be above Read (it declares ${def.access})`
-    );
-  }
-  return "Read";
-}
-function scopeOf(def) {
-  const { scope } = def;
-  if (typeof scope === "string") {
-    return Object.freeze({ kind: "column", column: scope });
-  }
-  return Object.freeze({
-    kind: "via",
-    model: scope.model,
-    entry: scope.entry,
-    scope: scope.scope,
-    refreshEntry: scope.refreshEntry === true
-  });
-}
-function compileOne([name, def], contract, projections, option, fail5) {
-  if (option === void 0) {
-    fail5(
-      `collection "${name}" needs its scope's access: collections: { ${name}: { anchor: contract } }, or { scopeAccess: "self" } for a scope that is the subscriber's user id`
-    );
-  }
-  const { anchor, bulkThreshold } = checkOption(`collections.${name}`, option, fail5);
-  const item = projections.get(def.item);
-  if (item === void 0) {
-    fail5(`collection "${name}": item "${def.item}" is not a projection of the contract`);
-  }
-  const access = accessOf(name, def, anchor, fail5);
-  checkOrderTiers(name, def.order, contract.fields, access, fail5);
-  return Object.freeze({
-    name,
-    scope: scopeOf(def),
-    item,
-    where: Object.freeze({ ...def.where }),
-    order: def.order,
-    limit: def.limit ?? DEFAULT_COLLECTION_LIMIT,
-    maxLimit: def.maxLimit ?? DEFAULT_COLLECTION_MAX_LIMIT,
-    access,
-    anchor,
-    bulkThreshold,
-    index: checkIndex(name, def, item, access, fail5)
-  });
-}
-function compileCollections(contract, projections, model, option, fail5) {
-  if (option !== void 0 && !isRecord(option)) {
-    fail5(
-      'collections must map each collection of the contract to { anchor } or { scopeAccess: "self" }'
-    );
-  }
-  const options = option ?? {};
-  const unknownName = Object.keys(options).find(
-    (name) => !Object.hasOwn(contract.collections, name)
-  );
-  if (unknownName !== void 0) {
-    fail5(`collections names "${unknownName}", which is not a collection of the contract`);
-  }
-  const declared = Object.entries(contract.collections);
-  if (declared.length > 0 && model === void 0) {
-    fail5("collections need model: their items are rows of the service's model");
-  }
-  const compiled = /* @__PURE__ */ new Map();
-  for (const [name, def] of declared) {
-    compiled.set(name, compileOne([name, def], contract, projections, options[name], fail5));
-  }
-  return compiled;
-}
-
 // src/server/realtime/define.ts
-function isRecord2(value) {
+function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function compileSelector(selector) {
-  const read = typeof selector === "function" ? selector : (payload) => isRecord2(payload) ? payload[selector] : void 0;
+  const read = typeof selector === "function" ? selector : (payload) => isRecord(payload) ? payload[selector] : void 0;
   return (payload) => {
     try {
       const value = read(payload);
@@ -352,7 +162,7 @@ function compileRoom(room) {
   const computed = compileSelector(room);
   return (payload) => {
     const name = computed(payload);
-    return name === void 0 || reservedRoomPrefix(name) !== void 0 ? void 0 : name;
+    return name === void 0 || reservedRoomPrefix(name) !== void 0 || socketIdShaped(name) ? void 0 : name;
   };
 }
 function compileRequires(def) {
@@ -380,8 +190,8 @@ function checkChannelAccess(owner2, access, fail5) {
   if (access === void 0 || access === "authenticated") {
     return "authenticated";
   }
-  const keys = isRecord2(access) ? Object.keys(access) : [];
-  if (!isRecord2(access) || keys.length !== 1 || !isAccessLevel(access.service)) {
+  const keys = isRecord(access) ? Object.keys(access) : [];
+  if (!isRecord(access) || keys.length !== 1 || !isAccessLevel(access.service)) {
     fail5(`${owner2}: access must be "authenticated" or { service: level }`);
   }
   return Object.freeze({ service: access.service });
@@ -389,7 +199,7 @@ function checkChannelAccess(owner2, access, fail5) {
 function checkChannel(service, name, def, entry, kinds, fail5) {
   const owner2 = `channel "${name}"`;
   const implementation = typeof entry === "function" ? { handler: entry } : entry;
-  if (!isRecord2(implementation) || typeof implementation.handler !== "function") {
+  if (!isRecord(implementation) || typeof implementation.handler !== "function") {
     fail5(`${owner2} must be a handler function or { access, handler }`);
   }
   const unknownKey = Object.keys(implementation).find(
@@ -408,6 +218,7 @@ function checkChannel(service, name, def, entry, kinds, fail5) {
     burst: def.burst ?? Math.max(1, ratePerSecond * 2),
     requires: compileRequires(def),
     access: checkChannelAccess(owner2, implementation.access, fail5),
+    accessDeclared: implementation.access !== void 0,
     kinds,
     handler: implementation.handler
   });
@@ -417,7 +228,7 @@ function compileChannels(contract, value, kinds, fail5) {
   if (value === void 0 && declared.length === 0) {
     return /* @__PURE__ */ new Map();
   }
-  if (!isRecord2(value)) {
+  if (!isRecord(value)) {
     fail5("channels must be an object with one implementation per contract channel");
   }
   const missing2 = declared.filter(([name]) => !Object.hasOwn(value, name)).map(([name]) => name);
@@ -474,7 +285,7 @@ function checkStreamOptions(name, def, entry, fail5) {
   if (entry === void 0) {
     return { computeSeed: void 0, validate: "always" };
   }
-  if (!isRecord2(entry)) {
+  if (!isRecord(entry)) {
     fail5(`${owner2} must be an object: { seed?, validate? }`);
   }
   const unknownKey = Object.keys(entry).find((key) => !STREAM_OPTION_KEYS.includes(key));
@@ -522,7 +333,7 @@ function checkStream(name, def, needs, options, fail5) {
   });
 }
 function compileStreams(contract, needs, value, fail5) {
-  if (value !== void 0 && !isRecord2(value)) {
+  if (value !== void 0 && !isRecord(value)) {
     fail5(
       "streams must be an object of options per contract stream: { <stream>: { seed?, validate? } }"
     );
@@ -541,14 +352,14 @@ function compileStreams(contract, needs, value, fail5) {
 }
 
 // src/server/serviceData.ts
-function isRecord3(value) {
+function isRecord2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isName(value) {
   return typeof value === "string" && value.length > 0;
 }
-function isContract2(value) {
-  return isRecord3(value) && isName(value.name) && Object.isFrozen(value);
+function isContract(value) {
+  return isRecord2(value) && isName(value.name) && Object.isFrozen(value);
 }
 function idsIn(value) {
   if (isName(value)) {
@@ -558,7 +369,7 @@ function idsIn(value) {
 }
 function checkLink(index, entry, fail5) {
   const owner2 = `affects[${index}]`;
-  if (!isRecord3(entry) || !isContract2(entry.service)) {
+  if (!isRecord2(entry) || !isContract(entry.service)) {
     fail5(`${owner2} must be { service: contract, id }`);
   }
   const { id, columns } = entry;
@@ -613,7 +424,7 @@ function checkWatchAccess(value, fail5) {
   if (value === "public" || value === "authenticated") {
     return value;
   }
-  if (!isRecord3(value) || Object.keys(value).length !== 1 || !isAccessLevel(value.service)) {
+  if (!isRecord2(value) || Object.keys(value).length !== 1 || !isAccessLevel(value.service)) {
     fail5('watchAccess must be "public", "authenticated" or { service: level }');
   }
   return Object.freeze({ service: value.service });
@@ -635,6 +446,9 @@ function checkMethodKinds(owner2, entry, data, fail5) {
     (message) => fail5(`${owner2}: ${message}`)
   );
 }
+function checkMethodClaims(owner2, entry, fail5) {
+  return claimsOption(owner2, entry, fail5);
+}
 function checkServiceData(definition, appKinds, fail5) {
   const { model, access, versionColumn } = definition;
   if (model !== void 0 && !isName(model)) {
@@ -703,9 +517,10 @@ var METHOD_KEYS = /* @__PURE__ */ new Set([
   "timeoutMs",
   "version",
   "rowless",
-  "kinds"
+  "kinds",
+  "claims"
 ]);
-function isRecord4(value) {
+function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function checkKeys(value, allowed, owner2, fail5) {
@@ -720,7 +535,7 @@ function isDuration(value, max) {
   return typeof value === "number" && Number.isFinite(value) && value > 0 && value <= max;
 }
 function checkContract(contract) {
-  const valid = isRecord4(contract) && typeof contract.name === "string" && contract.name.length > 0 && isRecord4(contract.methods) && Object.isFrozen(contract);
+  const valid = isRecord3(contract) && typeof contract.name === "string" && contract.name.length > 0 && isRecord3(contract.methods) && Object.isFrozen(contract);
   if (!valid) {
     throw new TypeError("defineService: the first argument must be a contract from defineContract");
   }
@@ -731,11 +546,16 @@ function checkShare(owner2, entry, fail5) {
   if (share !== void 0 && share !== "caller" && share !== "all") {
     fail5(`${owner2}: share must be "caller" or "all"`);
   }
-  if (share === "all" && isRecord4(entry.access) && entry.access.kind === "custom") {
+  if (share === "all" && isRecord3(entry.access) && entry.access.kind === "custom") {
     fail5(
       `${owner2} has custom access, so it cannot share: "all"; its result may depend on who asks`
     );
   }
+  if (share === "all" && typeof entry.handler === "function" && isCallerDependent(entry.handler)) {
+    fail5(
+      `${owner2} is a kit method whose result depends on who asks, so it cannot share: "all"; share: "caller" runs one principal's identical calls once`
+    );
+  }
   if (ttlMs !== void 0 && (share === void 0 || !isDuration(ttlMs, MAX_TIMEOUT_MS))) {
     fail5(`${owner2}: ttlMs needs share and must be a positive number of milliseconds`);
   }
@@ -756,7 +576,7 @@ function checkMethod(contract, projections, data, name, entry, fail5) {
   if (def === void 0) {
     fail5(`"${name}" is not a method of the contract`);
   }
-  if (!isRecord4(entry)) {
+  if (!isRecord3(entry)) {
     fail5(`${owner2} must be { access, handler }`);
   }
   checkKeys(entry, METHOD_KEYS, owner2, fail5);
@@ -777,6 +597,7 @@ function checkMethod(contract, projections, data, name, entry, fail5) {
   }
   checkQueryOptions(owner2, entry, def.kind, fail5);
   const kinds = checkMethodKinds(owner2, entry, data, fail5);
+  const claims = checkMethodClaims(owner2, entry, fail5);
   const projection = projectedOutput(def.output, projections);
   return Object.freeze({
     name,
@@ -787,6 +608,7 @@ function checkMethod(contract, projections, data, name, entry, fail5) {
     schemaOutput: projection === void 0 ? schemaOutputOf(def.output) : void 0,
     access: entry.access,
     kinds,
+    claims,
     handler: entry.handler,
     share: entry.share,
     ttlMs: entry.ttlMs,
@@ -796,7 +618,7 @@ function checkMethod(contract, projections, data, name, entry, fail5) {
   });
 }
 function checkMethods(contract, projections, data, value, fail5) {
-  if (!isRecord4(value)) {
+  if (!isRecord3(value)) {
     fail5("methods must be an object with one implementation per contract method");
   }
   const missing2 = Object.keys(contract.methods).filter((name) => !Object.hasOwn(value, name));
@@ -818,7 +640,7 @@ function checkWatches(contract, collections, data, fail5) {
     if (def.kind !== "query") {
       fail5(`method "${name}" is a mutation; only a query can watch`);
     }
-    if (watch === "service" || isRecord4(watch) && Object.hasOwn(watch, "service")) {
+    if (watch === "service" || isRecord3(watch) && Object.hasOwn(watch, "service")) {
       if (data.watchAccess === void 0) {
         fail5(
           `method "${name}" watches the service's topic, which is closed without watchAccess: declare who may watch it ("public", "authenticated" or { service: level })`
@@ -829,7 +651,7 @@ function checkWatches(contract, collections, data, fail5) {
       }
       continue;
     }
-    if (!isRecord4(watch) || typeof watch.scope !== "function") {
+    if (!isRecord3(watch) || typeof watch.scope !== "function") {
       fail5(`method "${name}": watch needs a scope function, which finds the scope from the input`);
     }
     if (typeof watch.collection !== "string" || !collections.has(watch.collection)) {
@@ -857,12 +679,12 @@ function checkRowForms(methods, data, fail5) {
     }
   }
 }
-function checkRowless(methods, data, fail5) {
+function checkRowless(contract, methods, data, fail5) {
   if (data.access === void 0) {
     return;
   }
   for (const method of Object.values(methods)) {
-    const problem = rowlessProblem(method);
+    const problem = rowlessProblem(method, contract.name);
     if (problem !== void 0) {
       fail5(problem);
     }
@@ -898,7 +720,7 @@ function buildService(runtime, contract, definition) {
   const fail5 = (message) => {
     throw new TypeError(`defineService("${checked2.name}"): ${message}`);
   };
-  if (!isRecord4(definition)) {
+  if (!isRecord3(definition)) {
     fail5("the definition must be an object");
   }
   checkKeys(definition, DEFINITION_KEYS, "the definition", fail5);
@@ -916,12 +738,13 @@ function buildService(runtime, contract, definition) {
     projections,
     data.model,
     definition.collections,
-    fail5
+    fail5,
+    data.access
   );
   checkWatches(checked2, collections, data, fail5);
   const methods = checkMethods(checked2, projections, data, definition.methods, fail5);
   checkRowForms(methods, data, fail5);
-  checkRowless(methods, data, fail5);
+  checkRowless(checked2, methods, data, fail5);
   const service = Object.freeze({
     name: checked2.name,
     contract: checked2,
@@ -1060,7 +883,7 @@ var COLUMNS = /* @__PURE__ */ new WeakMap();
 function jsonAclColumnsOf(policy) {
   return COLUMNS.get(policy);
 }
-function isRecord5(value) {
+function isRecord4(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function aclLevel(acl, userId) {
@@ -1069,7 +892,7 @@ function aclLevel(acl, userId) {
   }
   let level = null;
   for (const entry of acl) {
-    if (isRecord5(entry) && entry.userId === userId) {
+    if (isRecord4(entry) && entry.userId === userId) {
       level = maxLevel(level, entry.level);
     }
   }
@@ -1115,11 +938,11 @@ function jsonAcl(field, options = {}) {
 }
 
 // src/server/access/policies/inherit.ts
-function isContract3(value) {
+function isContract2(value) {
   return typeof value === "object" && value !== null && typeof value.name === "string" && Object.isFrozen(value);
 }
 function inherit(options) {
-  if (typeof options !== "object" || options === null || !isContract3(options.from)) {
+  if (typeof options !== "object" || options === null || !isContract2(options.from)) {
     throw new TypeError("inherit({ from, via }): from must be the parent service's contract");
   }
   const { from } = options;
@@ -1202,6 +1025,10 @@ function rowLevel(form, fallback) {
   }
   return form.entry ?? form.scope ?? fallback;
 }
+function bulkFallback(counterpart) {
+  const level = counterpart === void 0 ? "Moderate" : rowLevel(counterpart, "Moderate");
+  return meetsLevel(level, "Moderate") ? level : "Moderate";
+}
 function unchecked(call, form, use) {
   return call.runtime.service.access === void 0 || use === "read" && form === "public";
 }
@@ -1228,8 +1055,8 @@ function grantRowLevel(call, form) {
 function grantReaches(call, form, level) {
   return meetsLevel(grantRowLevel(call, form), level);
 }
-async function rowsWhere(call, form, level) {
-  if (unchecked(call, form, "read") || grantReaches(call, form, level)) {
+async function rowsWhere(call, form, level, use = "read") {
+  if (unchecked(call, form, use) || grantReaches(call, form, level)) {
     return void 0;
   }
   if (call.principal === null) {
@@ -1291,29 +1118,85 @@ function guardedColumns(service) {
       add(collection.scope.column, collection.anchor.name);
     }
   }
-  const moving = new Set([...anchors.values()].map(({ column }) => column));
-  const locked = (reads?.columns ?? []).filter((column) => column !== "id" && !moving.has(column));
+  const parents = new Set((reads?.parents ?? []).map(({ via }) => via));
+  const locked = (reads?.columns ?? []).filter((column) => column !== "id" && !parents.has(column));
   return { locked: new Set(locked), anchors: [...anchors.values()] };
 }
+var MEMBERSHIPS = /* @__PURE__ */ new WeakMap();
+function membershipColumnsOf(services, model) {
+  let byModel = MEMBERSHIPS.get(services);
+  if (byModel === void 0) {
+    byModel = /* @__PURE__ */ new Map();
+    MEMBERSHIPS.set(services, byModel);
+  }
+  const key = modelKey(model);
+  const kept = byModel.get(key);
+  if (kept !== void 0) {
+    return kept;
+  }
+  const columns = /* @__PURE__ */ new Map();
+  for (const service of services.values()) {
+    for (const read of service.access?.reads.memberships ?? []) {
+      if (modelKey(read.model) !== key) {
+        continue;
+      }
+      for (const column of [read.entry, read.user, read.level]) {
+        if (!columns.has(column)) {
+          columns.set(column, service.name);
+        }
+      }
+    }
+  }
+  byModel.set(key, columns);
+  return columns;
+}
 function forbidden(message) {
   return new QuickdrawError("FORBIDDEN", message);
 }
 function bypasses(service, principal) {
   return principal !== null && service.adminBypass && serviceGrant(principal, service.name) === "Admin";
 }
-async function checkWritableColumns(runtime, principal, data, level) {
-  const { service, access } = runtime;
+function namedColumns(data) {
+  return new Set(Object.keys(data).filter((column) => data[column] !== void 0));
+}
+function membershipNamed(runtime, columns) {
+  const { service, services } = runtime;
+  if (service.model === void 0) {
+    return void 0;
+  }
+  const memberships = membershipColumnsOf(services, service.model);
+  const column = columns.find((named) => memberships.has(named));
+  return column === void 0 ? void 0 : [column, memberships.get(column) ?? service.name];
+}
+function checkLockedColumns(runtime, principal, data, options = {}) {
+  const { service } = runtime;
   if (bypasses(service, principal)) {
     return;
   }
-  const { locked, anchors } = guardedColumns(service);
-  const named = new Set(Object.keys(data).filter((column) => data[column] !== void 0));
-  const readOnly = [...named].find((column) => locked.has(column));
+  const { locked } = guardedColumns(service);
+  const named = [...namedColumns(data)];
+  const readOnly = named.find((column) => locked.has(column));
+  const creating = options.creating === true;
   if (readOnly !== void 0) {
     throw forbidden(
-      `"${readOnly}" decides who may reach rows of ${service.name}: only a service-wide Admin may change it`
+      creating ? `"${readOnly}" decides who may reach rows of ${service.name}: only a service-wide Admin may send it; set it in the kit's prepare` : `"${readOnly}" decides who may reach rows of ${service.name}: only a service-wide Admin may change it`
+    );
+  }
+  const membership = membershipNamed(runtime, named);
+  if (membership !== void 0) {
+    const [column, reader] = membership;
+    throw forbidden(
+      creating ? `"${column}" holds a membership in ${reader}'s policy: only a service-wide Admin may send it through a kit; add members with the sharing kit` : `"${column}" holds a membership in ${reader}'s policy: only a service-wide Admin may change it through a kit; change memberships with the sharing kit`
     );
   }
+}
+async function checkAnchorColumns(runtime, principal, data, level, options = {}) {
+  const { service, access } = runtime;
+  if (bypasses(service, principal)) {
+    return;
+  }
+  const { anchors } = guardedColumns(service);
+  const named = namedColumns(data);
   for (const { column, anchor } of anchors) {
     const target = data[column];
     if (!named.has(column) || target === null) {
@@ -1323,11 +1206,75 @@ async function checkWritableColumns(runtime, principal, data, level) {
     const resolved = valid ? await access.resolve(anchor, principal, [target], { grants: false }) : void 0;
     if (resolved === void 0 || !meetsLevel(resolved.levels.get(target), level)) {
       throw forbidden(
-        `Moving a row of ${service.name} by "${column}" needs ${level} on the ${anchor} row it moves into`
+        options.creating === true ? `Creating a row of ${service.name} with "${column}" needs ${level} on the ${anchor} row it names` : `Moving a row of ${service.name} by "${column}" needs ${level} on the ${anchor} row it moves into`
       );
     }
   }
 }
+var relations = /* @__PURE__ */ new WeakMap();
+function relationKeysOf(service) {
+  let keys = relations.get(service);
+  if (keys === void 0) {
+    const found = /* @__PURE__ */ new Set();
+    for (const projection of service.projections.values()) {
+      for (const [key, value] of Object.entries(projection.select)) {
+        if (typeof value === "object" && value !== null) {
+          found.add(key);
+        }
+      }
+    }
+    keys = found;
+    relations.set(service, keys);
+  }
+  return keys;
+}
+function isPlainObject(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    return false;
+  }
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+function columnValueIssues(service, data, path = []) {
+  const relationKeys = relationKeysOf(service);
+  const nested = new Map(
+    findNestedWrites({ ...data }).map(({ field, operation }) => [field, operation])
+  );
+  const issues = [];
+  for (const [key, value] of Object.entries(data)) {
+    if (value === void 0) {
+      continue;
+    }
+    const operation = nested.get(key) ?? (isPlainObject(value) && Array.isArray(value.set) ? "set" : void 0);
+    if (relationKeys.has(key)) {
+      issues.push({
+        path: [...path, key],
+        message: `"${key}" is a relation of ${service.name}'s model: kits write column values only; set its foreign key column instead`
+      });
+    } else if (operation !== void 0) {
+      issues.push({
+        path: [...path, key],
+        message: `"${key}" holds a nested write ({ ${operation} }), which is not tracked: kits write column values only`
+      });
+    }
+  }
+  return issues;
+}
+function checkColumnValues(service, data, path = []) {
+  const issues = columnValueIssues(service, data, path);
+  if (issues.length > 0) {
+    throw new QuickdrawError(
+      "VALIDATION",
+      "The data holds a relation or a nested write, which kits do not write",
+      { issues }
+    );
+  }
+}
+async function checkWritableColumns(runtime, principal, data, level, path = []) {
+  checkColumnValues(runtime.service, data, path);
+  checkLockedColumns(runtime, principal, data);
+  await checkAnchorColumns(runtime, principal, data, level);
+}
 
 // src/server/kits/transactions.ts
 function isWriteConflict(error) {
@@ -1447,13 +1394,13 @@ function updateHandler(form) {
 }
 
 // src/server/kits/crud/bulk.ts
-async function writeAllowed(call, db, form, ids, write) {
+async function writeAllowed(call, db, [form, level], ids, write) {
   const unique = uniqueIds(ids);
   if (unique.length === 0) {
     return { count: 0 };
   }
   return await inTransaction(db, async (tx) => {
-    const allowed = await allowedIds(call, form, unique, rowLevel(form, "Moderate"), "write");
+    const allowed = await allowedIds(call, form, unique, level, "write");
     if (allowed.length === 0) {
       return { count: 0 };
     }
@@ -1461,7 +1408,8 @@ async function writeAllowed(call, db, form, ids, write) {
     return { count };
   });
 }
-function bulkUpdateHandler(form) {
+function bulkUpdateHandler(form, fallback) {
+  const level = rowLevel(form, fallback);
   const handler = async ({ input, ctx, db }) => {
     const call = crudCall(ctx, db);
     const { ids, data } = input;
@@ -1469,24 +1417,25 @@ function bulkUpdateHandler(form) {
     if (Object.keys(patch).length === 0) {
       return { count: 0 };
     }
-    await checkWritableColumns(call.runtime, call.principal, patch, rowLevel(form, "Moderate"));
+    await checkWritableColumns(call.runtime, call.principal, patch, level, ["data"]);
     return await writeAllowed(
       call,
       db,
-      form,
+      [form, level],
       ids,
       (table, allowed) => table.updateMany({ where: { id: { in: [...allowed] } }, data: patch })
     );
   };
   return handler;
 }
-function bulkDeleteHandler(form) {
+function bulkDeleteHandler(form, fallback) {
+  const level = rowLevel(form, fallback);
   const handler = async ({ input, ctx, db }) => {
     const call = crudCall(ctx, db);
     return await writeAllowed(
       call,
       db,
-      form,
+      [form, level],
       input.ids,
       (table, allowed) => table.deleteMany({ where: { id: { in: [...allowed] } } })
     );
@@ -1495,16 +1444,40 @@ function bulkDeleteHandler(form) {
 }
 
 // src/server/kits/crud/create.ts
-function createHandler(prepare) {
+function isRecord5(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isPlainObject2(value) {
+  if (!isRecord5(value)) {
+    return false;
+  }
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+function createHandler(form, prepare) {
   const handler = async ({ input, ctx, db }) => {
     const call = crudCall(ctx, db);
+    const { service } = call.runtime;
+    const sent = isRecord5(input) ? input : {};
+    checkColumnValues(service, sent);
+    checkLockedColumns(call.runtime, call.principal, sent, { creating: true });
     const data = prepare === void 0 ? input : await checked(() => prepare(input, ctx, db));
-    if (typeof data !== "object" || data === null || Array.isArray(data)) {
+    if (!isPlainObject2(data)) {
+      throw new QuickdrawError(
+        "INTERNAL",
+        `The read/write kit's prepare for ${service.name} must return the new row's data`
+      );
+    }
+    const issues = columnValueIssues(service, data);
+    if (issues.length > 0) {
       throw new QuickdrawError(
         "INTERNAL",
-        `The read/write kit's prepare for ${call.runtime.service.name} must return the new row's data`
+        `The read/write kit's prepare for ${service.name} must return column values: ${issues.map((issue) => issue.message).join("; ")}`
       );
     }
+    await checkAnchorColumns(call.runtime, call.principal, data, rowLevel(form, "Moderate"), {
+      creating: true
+    });
     const { select } = projectionOf(call, "entity");
     return await call.table.create({ data, select });
   };
@@ -1602,20 +1575,33 @@ function signatureOf(order) {
 function signed(order) {
   return [[SIGNATURE, "asc"], ...order];
 }
+var ROW = "row ";
+var ROW_CURSOR = [
+  [SIGNATURE, "asc"],
+  ["id", "asc"]
+];
 function cursorAfter(order, row) {
-  return encodeCursor(signed(order), { ...row, [SIGNATURE]: signatureOf(order) });
+  const cursor = encodeCursor(signed(order), { ...row, [SIGNATURE]: signatureOf(order) });
+  return cursor.length <= MAX_CURSOR_LENGTH ? cursor : encodeCursor(ROW_CURSOR, { [SIGNATURE]: `${ROW}${signatureOf(order)}`, id: row.id });
 }
-function cursorValues(order, cursor) {
-  let values;
-  try {
-    values = decodeCursor(signed(order), cursor);
-  } catch {
-    throw unreadable(NOT_A_CURSOR, ["cursor"]);
+function readCursor(order, cursor) {
+  const signature = signatureOf(order);
+  const decoded = (shape) => {
+    try {
+      return decodeCursor(shape, cursor);
+    } catch {
+      return void 0;
+    }
+  };
+  const values = decoded(signed(order));
+  if (values?.[0] === signature) {
+    return { values: values.slice(1) };
   }
-  if (values[0] !== signatureOf(order)) {
-    throw unreadable(NOT_A_CURSOR, ["cursor"]);
+  const named = decoded(ROW_CURSOR);
+  if (named?.[0] === `${ROW}${signature}` && typeof named[1] === "string") {
+    return { row: named[1] };
   }
-  return values.slice(1);
+  throw unreadable(NOT_A_CURSOR, ["cursor"]);
 }
 async function nullableColumns(read, values) {
   const { storage, model, order } = read;
@@ -1652,8 +1638,27 @@ function refusal(error, read) {
   refused.cause = error;
   return refused;
 }
+async function startValues(read, cursor) {
+  const held = readCursor(read.order, cursor);
+  if ("values" in held) {
+    return held.values;
+  }
+  let row;
+  try {
+    row = await read.table.findFirst({
+      where: { AND: [read.where, { id: held.row }] },
+      select: Object.fromEntries(read.order.map(([column]) => [column, true]))
+    });
+  } catch (error) {
+    throw refusal(error, read);
+  }
+  if (row === null) {
+    throw unreadable(NOT_A_CURSOR, ["cursor"]);
+  }
+  return read.order.map(([column]) => row[column]);
+}
 async function readPage(read) {
-  const values = read.cursor === void 0 ? void 0 : cursorValues(read.order, read.cursor);
+  const values = read.cursor === void 0 ? void 0 : await startValues(read, read.cursor);
   const nullable = await nullableColumns(read, values);
   const where = values === void 0 ? read.where : { AND: [read.where, afterCursor(read.order, values, nullable)] };
   let rows;
@@ -1762,14 +1767,17 @@ async function nextOrdinal(db, model, where = {}, options = {}) {
 function invalid(message, path) {
   return new QuickdrawError("VALIDATION", message, { issues: [{ path: [...path], message }] });
 }
-async function readNamed(table, spec, move, model) {
+async function readNamed(table, [spec, writable], move, model) {
   const select = Object.fromEntries(["id", spec.column, ...spec.within].map((key) => [key, true]));
-  const ids = [move.id, move.beforeId, move.afterId].filter((id) => id !== void 0);
-  const rows = await table.findMany({ where: { id: { in: ids } }, select });
+  const ids = {
+    id: { in: [move.id, move.beforeId, move.afterId].filter((id) => id !== void 0) }
+  };
+  const where = writable === void 0 ? ids : { AND: [ids, writable] };
+  const rows = writable === "none" ? [] : await table.findMany({ where, select });
   const byId = new Map(rows.map((row) => [row.id, row]));
   const moved = byId.get(move.id);
   if (moved === void 0) {
-    throw new QuickdrawError("NOT_FOUND", `No such ${model}`);
+    throw writable === void 0 ? new QuickdrawError("NOT_FOUND", `No such ${model}`) : new QuickdrawError("FORBIDDEN", "Insufficient permissions");
   }
   const neighbor = (id, key) => {
     const row = id === void 0 ? void 0 : byId.get(id);
@@ -1785,9 +1793,10 @@ async function readNamed(table, spec, move, model) {
     after: neighbor(move.afterId, "afterId")
   };
 }
-function listOf(spec, moved) {
+function listOf(spec, moved, writable) {
   const scope = Object.fromEntries(spec.within.map((column) => [column, moved[column] ?? null]));
-  return { AND: [scope, { id: { not: moved.id } }] };
+  const mine = writable === void 0 ? [] : [writable === "none" ? { id: { in: [] } } : writable];
+  return { AND: [scope, { id: { not: moved.id } }, ...mine] };
 }
 async function adjacent(table, spec, list, row, side) {
   const { column } = spec;
@@ -1805,10 +1814,10 @@ async function adjacent(table, spec, list, row, side) {
     select: { id: true, [column]: true }
   });
 }
-async function bounds(table, spec, named) {
+async function bounds(table, spec, named, writable) {
   const { column } = spec;
   const { before, after } = named;
-  const list = listOf(spec, named.moved);
+  const list = listOf(spec, named.moved, writable);
   const low = before ?? (after === void 0 ? null : await adjacent(table, spec, list, after, "previous"));
   const high = after ?? (before === void 0 ? null : await adjacent(table, spec, list, before, "next"));
   const lowValue = low === null ? null : low[column];
@@ -1822,14 +1831,21 @@ async function bounds(table, spec, named) {
   }
   return [lowValue, highValue];
 }
-async function renumber(table, spec, named, move) {
+async function renumber(table, [spec, writable], named, move) {
   const { column } = spec;
   const rows = await table.findMany({
-    where: listOf(spec, named.moved),
+    where: listOf(spec, named.moved, writable),
     select: { id: true, [column]: true },
     orderBy: [{ [column]: "asc" }, { id: "asc" }]
   });
   const order = rows.map((row) => row.id);
+  const neighbor = move.beforeId ?? move.afterId;
+  if (neighbor !== void 0 && !order.includes(neighbor)) {
+    throw new QuickdrawError(
+      "INTERNAL",
+      "A reorder's neighbor is missing from the list it renumbers"
+    );
+  }
   const at = move.beforeId === void 0 ? Math.max(order.indexOf(move.afterId), 0) : order.indexOf(move.beforeId) + 1;
   order.splice(at, 0, move.id);
   const current = new Map(rows.map((row) => [row.id, row[column]]));
@@ -1848,29 +1864,48 @@ var RENUMBER_BASE_MS = 5e3;
 var RENUMBER_MS_PER_ROW = 10;
 var OWNER = "The read/write kit's reorder";
 var CONFLICT = "Another change to this list ran at the same time; try again";
-async function moveIn(tx, { call, spec, move, select }, mayRenumber) {
+async function moveIn(tx, { call, spec, move, writable, select }, mayRenumber) {
   const table = delegateOf(tx, call.model);
-  const named = await readNamed(table, spec, move, call.model);
-  const range = await bounds(table, spec, named);
+  const named = await readNamed(table, [spec, writable], move, call.model);
+  const range = await bounds(table, spec, named, writable);
   const between = range === void 0 ? void 0 : ordinalBetween(range[0] ?? void 0, range[1] ?? void 0);
   if (between === void 0 && !mayRenumber) {
-    return { list: listOf(spec, named.moved) };
+    return { list: listOf(spec, named.moved, writable) };
   }
-  const value = between ?? await renumber(table, spec, named, move);
+  const value = between ?? await renumber(table, [spec, writable], named, move);
   return {
     row: await table.update({ where: { id: move.id }, data: { [spec.column]: value }, select })
   };
 }
+async function checkNamed(call, [form, level], move) {
+  const named = [move.beforeId, move.afterId].filter((id) => id !== void 0);
+  const ids = uniqueIds([move.id, ...named]);
+  const writable = new Set(await allowedIds(call, form, ids, level, "write"));
+  if (!writable.has(move.id)) {
+    throw new QuickdrawError("FORBIDDEN", "Insufficient permissions");
+  }
+  for (const [id, key] of [
+    [move.beforeId, "beforeId"],
+    [move.afterId, "afterId"]
+  ]) {
+    if (id !== void 0 && !writable.has(id)) {
+      throw new QuickdrawError("NOT_FOUND", `No such ${call.model} in this list as ${key}`);
+    }
+  }
+}
 function reorderHandler(spec, form) {
+  const level = rowLevel(form, "Moderate");
   const handler = async ({ input, ctx, db }) => {
     const call = crudCall(ctx, db);
+    const asked = input;
+    await checkNamed(call, [form, level], asked);
     const move = {
       call,
       spec,
-      move: input,
+      move: asked,
+      writable: await rowsWhere(call, form, level, "write"),
       select: projectionOf(call, "entity").select
     };
-    await checkRowWrite(call, form, move.move.id);
     const how = { owner: OWNER, conflict: CONFLICT };
     const first = await inKitTransaction(db, async (tx) => await moveIn(tx, move, false), how);
     if ("row" in first) {
@@ -1901,7 +1936,7 @@ function handlerOf(context) {
     case "list":
       return listHandler({ spec, form, projection: context.projection });
     case "create":
-      return createHandler(context.prepare);
+      return createHandler(form, context.prepare);
     case "update":
       return updateHandler(form);
     case "delete":
@@ -1909,9 +1944,9 @@ function handlerOf(context) {
     case "reorder":
       return reorderHandler(spec, form);
     case "bulkUpdate":
-      return bulkUpdateHandler(form);
+      return bulkUpdateHandler(form, context.bulkLevel);
     default:
-      return bulkDeleteHandler(form);
+      return bulkDeleteHandler(form, context.bulkLevel);
   }
 }
 
@@ -1989,7 +2024,14 @@ var CHECKS_ROWS = /* @__PURE__ */ new Set([
   "delete",
   "reorder"
 ]);
-var OPTION_KEYS2 = ["access", "prepare", "rowless"];
+var CALLER_DEPENDENT = /* @__PURE__ */ new Set(["list", "getMany"]);
+var COUNTERPARTS = { bulkDelete: "delete", bulkUpdate: "update" };
+function bulkLevelOf(kit, access, spec) {
+  const counterpart = spec.method === "bulkDelete" || spec.method === "bulkUpdate" ? COUNTERPARTS[spec.method] : void 0;
+  const found = kit.find(([, other]) => other.method === counterpart);
+  return bulkFallback(found === void 0 ? void 0 : access[found[0]]);
+}
+var OPTION_KEYS = ["access", "prepare", "rowless"];
 function serviceProblem(service, contract, [name, spec], form) {
   if (service.contract !== contract) {
     return `its read/write kit handlers were made for another contract; pass ${service.name}'s own contract to crud.handlers`;
@@ -2004,9 +2046,9 @@ function handlers(contract, options) {
   if (!isRecord6(options)) {
     fail("options must be { access, prepare?, rowless? }");
   }
-  const unknownKey = Object.keys(options).find((key) => !OPTION_KEYS2.includes(key));
+  const unknownKey = Object.keys(options).find((key) => !OPTION_KEYS.includes(key));
   if (unknownKey !== void 0) {
-    fail(`options has an unknown key "${unknownKey}"; the options are ${OPTION_KEYS2.join(", ")}`);
+    fail(`options has an unknown key "${unknownKey}"; the options are ${OPTION_KEYS.join(", ")}`);
   }
   const names = kit.map(([name]) => name);
   const access = checkAccess(options.access, names);
@@ -2016,11 +2058,15 @@ function handlers(contract, options) {
   for (const [name, spec] of kit) {
     const form = access[name];
     const projection = spec.method === "list" ? itemProjection(contract, spec) : "entity";
-    const handler = handlerOf({ spec, form, projection, prepare });
+    const bulkLevel = bulkLevelOf(kit, access, spec);
+    const handler = handlerOf({ spec, form, projection, prepare, bulkLevel });
     checkWhenDefined(handler, (service) => serviceProblem(service, contract, [name, spec], form));
     if (CHECKS_ROWS.has(spec.method)) {
       checksRowsItself(handler);
     }
+    if (CALLER_DEPENDENT.has(spec.method)) {
+      dependsOnCaller(handler);
+    }
     entries[name] = kitEntry(name, form, handler, rowless);
   }
   return Object.freeze(entries);
@@ -2106,9 +2152,7 @@ async function scopeWhere(run) {
   return await membersWhere(reader, collection, run.query.scope, collection.maxLimit) ?? "none";
 }
 function searchOrder(run) {
-  const { scope } = run.context.spec;
-  const collection = scope === void 0 ? void 0 : run.call.runtime.service.collections.get(scope);
-  return collection?.order ?? ID_ORDER;
+  return scopedCollection(run)?.order ?? ID_ORDER;
 }
 async function strategyIds(run, ids) {
   const found = await checked(() => ids(run.query.q, run.ctx, { limit: run.query.limit }));
@@ -2272,14 +2316,14 @@ function checkStrategy(strategy) {
   }
   return strategy;
 }
-var OPTION_KEYS3 = ["access", "strategy", "method"];
+var OPTION_KEYS2 = ["access", "strategy", "method"];
 function checkOptions(options, kit) {
   if (!isRecord8(options)) {
     fail2("options must be { access, strategy?, method? }");
   }
-  const unknownKey = Object.keys(options).find((key) => !OPTION_KEYS3.includes(key));
+  const unknownKey = Object.keys(options).find((key) => !OPTION_KEYS2.includes(key));
   if (unknownKey !== void 0) {
-    fail2(`options has an unknown key "${unknownKey}"; the options are ${OPTION_KEYS3.join(", ")}`);
+    fail2(`options has an unknown key "${unknownKey}"; the options are ${OPTION_KEYS2.join(", ")}`);
   }
   const problem = accessFormProblem(options.access);
   if (problem !== void 0) {
@@ -2344,6 +2388,7 @@ function handlers2(contract, options) {
     checkScope(contract, name, spec, projection);
     const handler = searchHandler({ spec, form, projection, strategy });
     checkWhenDefined(handler, (service) => serviceProblem2(service, contract, name, form));
+    dependsOnCaller(handler);
     entries[name] = Object.freeze({ access: form, handler, share: "caller" });
   }
   return Object.freeze(entries);
@@ -2618,6 +2663,14 @@ function capGrant(own, given, model) {
     );
   }
 }
+function capTarget(own, current, model) {
+  if (current !== null && !meetsLevel(own, current)) {
+    throw new QuickdrawError(
+      "FORBIDDEN",
+      `That user has ${current} on this ${model}, above your own level on it (${own ?? "none"}); you cannot change or take away their access`
+    );
+  }
+}
 
 // src/server/kits/sharing/context.ts
 async function resolveTarget(call, context, given) {
@@ -2692,15 +2745,17 @@ async function checkLastAdmin(call, tx, listed, change) {
 async function changeList(call, context, change) {
   const columns = aclColumnsOf(call.runtime.service);
   return await inSerializable(call.db, async (tx) => {
-    capGrant(await checkCaller(call, context.form, change.id), change.level, call.model);
+    const own = await checkCaller(call, context.form, change.id);
+    capGrant(own, change.level, call.model);
     const table = tableOf(tx, call.model);
     const listed = await readList(table, columns, change.id, call.model);
     const problem = refusal2(listed, change, call.model);
     if (problem !== void 0) {
       throw problem;
     }
-    await checkLastAdmin(call, tx, listed, change);
     const before = levelIn(listed.entries, change.userId);
+    capTarget(own, before, call.model);
+    await checkLastAdmin(call, tx, listed, change);
     if (before === change.level && entriesOf(listed.entries, change.userId) === 1) {
       return sharesOf(listed.entries);
     }
@@ -2852,15 +2907,16 @@ async function invite(call, context, target, role) {
 async function end(call, context, target, kind) {
   const read = membershipTableOf(call.runtime.service);
   return await inSerializable(call.db, async (tx) => {
-    if (kind === "remove") {
-      await checkCaller(call, context.form, target.entryId);
-    }
+    const own = kind === "remove" ? await checkCaller(call, context.form, target.entryId) : void 0;
     const table = tableOf(tx, read.model);
     const rows = await rowsOf(table, read, target);
     if (rows.length === 0) {
       throw kind === "leave" ? new QuickdrawError("FORBIDDEN", `You are not a member of this ${call.model}`) : new QuickdrawError("NOT_FOUND", `That user is not a member of this ${call.model}`);
     }
     const current = currentRole(read, rows);
+    if (own !== void 0) {
+      capTarget(own, current.level, call.model);
+    }
     if (current.level === "Admin" && !await anotherAdmin(call, tx, read, target)) {
       throw lastAdmin(call.model);
     }
@@ -2883,6 +2939,7 @@ async function changeRole(call, context, target, role) {
       throw new QuickdrawError("NOT_FOUND", `That user is not a member of this ${call.model}`);
     }
     const current = currentRole(read, rows);
+    capTarget(own, current.level, call.model);
     if (rows.length === 1 && current.role === role) {
       return memberOf(read, target.userId, role);
     }
@@ -3071,6 +3128,9 @@ function handlers3(contract, ...rest) {
     const form = access[name] ?? DEFAULT_ACCESS[spec.method];
     const handler = handlerOf2(spec.method, Object.freeze({ ...hooks, form }));
     checkWhenDefined(handler, (service) => serviceProblem3(service, contract, spec.mode));
+    if (spec.method === "listShares" || spec.method === "listMembers") {
+      dependsOnCaller(handler);
+    }
     entries[name] = kitEntry(name, form, handler, rowless);
   }
   return Object.freeze(entries);
@@ -3123,6 +3183,13 @@ var DEFAULT_FIELDS = Object.freeze({
     showInTable: false
   }
 });
+function grantNamesOf(column) {
+  return column === void 0 || ADMIN_GRANT_FIELDS.includes(column) ? ADMIN_GRANT_FIELDS : [...ADMIN_GRANT_FIELDS, column];
+}
+function grantsColumnFor(model, source) {
+  const same = model !== void 0 && source !== void 0;
+  return same && modelKey(source.model) === modelKey(model) ? source.column : void 0;
+}
 function isRecord10(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -3142,23 +3209,19 @@ function checkDisplayName(displayName, serviceName, fail5) {
   }
   return displayName;
 }
-function checkGrants(grants, names, fail5) {
+function checkGrants(grants, [names, grantNames], fail5) {
   if (grants === void 0 || grants === false) {
     return /* @__PURE__ */ new Set();
   }
   if (grants !== true) {
     fail5("grants must be true or false");
   }
-  const fields = ADMIN_GRANT_FIELDS.filter((name) => names.includes(name));
-  if (fields.length === 0) {
-    fail5(
-      `grants: the entity has no ${ADMIN_GRANT_FIELDS.join(" or ")} field for the kit to show and write`
-    );
-  }
-  return new Set(fields);
+  return new Set(grantNames.filter((name) => names.includes(name)));
 }
-function checkHidden(hiddenFields, names, grants, fail5) {
-  const defaults = ADMIN_HIDDEN_FIELDS.filter((name) => !grants.has(name));
+function checkHidden(hiddenFields, [names, grantNames], grants, fail5) {
+  const defaults = [.../* @__PURE__ */ new Set([...ADMIN_HIDDEN_FIELDS, ...grantNames])].filter(
+    (name) => !grants.has(name)
+  );
   if (hiddenFields === void 0) {
     return new Set(defaults);
   }
@@ -3293,8 +3356,9 @@ function frozenConfig(config) {
 }
 function adminFieldsOf(serviceName, spec, options, fail5) {
   const names = spec.fields.map((field) => field.name);
-  const grants = checkGrants(options.grants, names, fail5);
-  const hidden = checkHidden(options.hiddenFields, names, grants, fail5);
+  const grantNames = grantNamesOf(options.grantsColumn);
+  const grants = checkGrants(options.grants, [names, grantNames], fail5);
+  const hidden = checkHidden(options.hiddenFields, [names, grantNames], grants, fail5);
   const listed = [...spec.filter, ...spec.sort].find((name) => hidden.has(name));
   if (listed !== void 0) {
     fail5(`"${listed}" is hidden, so adminList may not filter or sort on it`);
@@ -3322,10 +3386,26 @@ function adminFieldsOf(serviceName, spec, options, fail5) {
     fields: Object.freeze(fields)
   });
   const readOnly = new Set(fields.filter((field) => !field.editable).map((field) => field.name));
-  return Object.freeze({ meta, hidden, readOnly, grants });
+  const named = /* @__PURE__ */ new Set([
+    ...editable ?? [],
+    ...Object.entries(overrides).filter(([, override]) => override.editable === true).map(([name]) => name)
+  ]);
+  return Object.freeze({ meta, hidden, readOnly, grants, named });
+}
+function withReadOnlyFields(meta, readOnly) {
+  if (!meta.fields.some((field) => readOnly.has(field.name) && field.editable)) {
+    return meta;
+  }
+  const fields = meta.fields.map(
+    (field) => readOnly.has(field.name) && field.editable ? frozenConfig({ ...field, editable: false }) : field
+  );
+  return Object.freeze({ ...meta, fields: Object.freeze(fields) });
 }
 
 // src/server/kits/admin/runtime.ts
+function grantsColumnOf(runtime) {
+  return grantsColumnFor(runtime.service.model, runtime.grantsSource);
+}
 function tableOf2(db, model) {
   const name = modelKey(model);
   const isClient = (typeof db === "object" || typeof db === "function") && db !== null;
@@ -3339,7 +3419,7 @@ function tableOf2(db, model) {
   }
   return delegate;
 }
-function adminCall(ctx, db, fields) {
+function adminCall(ctx, db, fieldsFor) {
   const runtime = kitRuntimeOf(ctx);
   const model = runtime?.service.model;
   const projection = runtime?.service.projections.get("entity");
@@ -3349,6 +3429,7 @@ function adminCall(ctx, db, fields) {
       "The admin kit's handlers run through a dispatcher, in a service with a model and an entity"
     );
   }
+  const fields = fieldsFor(grantsColumnOf(runtime));
   const { principal } = ctx;
   const level = principal === null ? null : serviceGrant(principal, runtime.service.name) ?? null;
   const tiered = projection.tiers.hidden(level);
@@ -3360,7 +3441,8 @@ function adminCall(ctx, db, fields) {
     principal,
     projection,
     unseen,
-    omitted: /* @__PURE__ */ new Set([...unseen, ...fields.hidden])
+    omitted: /* @__PURE__ */ new Set([...unseen, ...fields.hidden]),
+    fields
   };
 }
 function rowOut(call, row) {
@@ -3384,7 +3466,7 @@ function checkSeen(call, names) {
 var NO_NULLABLE = /* @__PURE__ */ new Set();
 function adminListHandler(context) {
   const handler = async ({ input, ctx, db }) => {
-    const call = adminCall(ctx, db, context.fields);
+    const call = adminCall(ctx, db, context.fieldsFor);
     const query = input;
     checkSeen(call, namedFields(query));
     const order = listOrder(defaultSorts(context.spec.sort, call.unseen), query.sort);
@@ -3435,14 +3517,14 @@ function subscribersOf(call, id) {
 }
 function adminSubscribersHandler(context) {
   const handler = ({ input, ctx, db }) => {
-    const call = adminCall(ctx, db, context.fields);
+    const call = adminCall(ctx, db, context.fieldsFor);
     return Promise.resolve(subscribersOf(call, input.id));
   };
   return handler;
 }
 function adminReemitHandler(context) {
   const handler = async ({ input, ctx, db }) => {
-    const call = adminCall(ctx, db, context.fields);
+    const call = adminCall(ctx, db, context.fieldsFor);
     const { id } = input;
     requireRow(
       await call.table.findUnique({ where: { id }, select: { id: true } }),
@@ -3456,7 +3538,7 @@ function adminReemitHandler(context) {
 
 // src/server/kits/admin/writes.ts
 async function checkWrite(call, context, data) {
-  const { hidden, readOnly } = context.fields;
+  const { hidden, readOnly } = call.fields;
   const names = Object.keys(data);
   const issues = names.filter((name) => hidden.has(name) || readOnly.has(name)).map((name) => ({
     path: ["data", name],
@@ -3472,7 +3554,8 @@ async function checkWrite(call, context, data) {
     call.runtime,
     call.principal,
     data,
-    rowLevel(context.form, "Moderate")
+    rowLevel(context.form, "Moderate"),
+    ["data"]
   );
 }
 function isValueRefusal(error) {
@@ -3516,7 +3599,7 @@ function committed(context, args, write) {
       category: "quickdraw.admin",
       method: write.method,
       id: write.id,
-      error: error instanceof Error ? error.message : String(error)
+      error: errorText(error)
     });
   };
   try {
@@ -3561,7 +3644,7 @@ async function written(context, call, args, method, perform) {
 }
 function adminGetHandler(context) {
   const handler = async ({ input, ctx, db }) => {
-    const call = adminCall(ctx, db, context.fields);
+    const call = adminCall(ctx, db, context.fieldsFor);
     return await readRow(call, input.id);
   };
   return handler;
@@ -3571,7 +3654,7 @@ function idOf(row) {
 }
 function adminCreateHandler(context) {
   const handler = async (args) => {
-    const call = adminCall(args.ctx, args.db, context.fields);
+    const call = adminCall(args.ctx, args.db, context.fieldsFor);
     const { data } = args.input;
     await checkWrite(call, context, data);
     return await written(context, call, args, "adminCreate", async (table) => {
@@ -3583,7 +3666,7 @@ function adminCreateHandler(context) {
 }
 function adminUpdateHandler(context) {
   const handler = async (args) => {
-    const call = adminCall(args.ctx, args.db, context.fields);
+    const call = adminCall(args.ctx, args.db, context.fieldsFor);
     const { id, data } = args.input;
     await checkWrite(call, context, data);
     if (Object.keys(data).length === 0) {
@@ -3600,7 +3683,7 @@ function adminUpdateHandler(context) {
 }
 function adminDeleteHandler(context) {
   const handler = async (args) => {
-    const call = adminCall(args.ctx, args.db, context.fields);
+    const call = adminCall(args.ctx, args.db, context.fieldsFor);
     const { id } = args.input;
     return await written(context, call, args, "adminDelete", async (table, withBefore) => {
       const select = withBefore ? call.projection.select : { id: true };
@@ -3623,8 +3706,23 @@ var MAKERS2 = Object.freeze({
   adminReemit: adminReemitHandler
 });
 function adminMetaHandler(context) {
-  const { meta } = context.fields;
-  const handler = (_args) => Promise.resolve(meta);
+  const byService = /* @__PURE__ */ new WeakMap();
+  const handler = (args) => {
+    const runtime = kitRuntimeOf(args.ctx);
+    if (runtime === void 0) {
+      return Promise.resolve(context.fieldsFor(void 0).meta);
+    }
+    const { service } = runtime;
+    const column = grantsColumnFor(service.model, runtime.grantsSource);
+    const answers = byService.get(service) ?? /* @__PURE__ */ new Map();
+    byService.set(service, answers);
+    let answer = answers.get(column ?? "");
+    if (answer === void 0) {
+      answer = withReadOnlyFields(context.fieldsFor(column).meta, relationKeysOf(service));
+      answers.set(column ?? "", answer);
+    }
+    return Promise.resolve(answer);
+  };
   return handler;
 }
 function handlerOf3(context) {
@@ -3633,7 +3731,7 @@ function handlerOf3(context) {
 }
 
 // src/server/kits/admin/handlers.ts
-var OPTION_KEYS4 = [
+var OPTION_KEYS3 = [
   "access",
   "displayName",
   "hiddenFields",
@@ -3681,9 +3779,9 @@ function checkOptions3(options) {
       "options must be { access?, displayName?, hiddenFields?, editable?, fieldOverrides?, rowless?, grants?, onWrite?, onCommitted? }"
     );
   }
-  const unknownKey = Object.keys(options).find((key) => !OPTION_KEYS4.includes(key));
+  const unknownKey = Object.keys(options).find((key) => !OPTION_KEYS3.includes(key));
   if (unknownKey !== void 0) {
-    fail4(`options has an unknown key "${unknownKey}"; the options are ${OPTION_KEYS4.join(", ")}`);
+    fail4(`options has an unknown key "${unknownKey}"; the options are ${OPTION_KEYS3.join(", ")}`);
   }
   return options;
 }
@@ -3719,7 +3817,7 @@ function contractEditable(contract, specs) {
   }
   return [...lists.values()][0];
 }
-function fieldsOf(contract, kit, options) {
+function fieldsOf(contract, kit, options, grantsColumn) {
   const specs = kit.map(([, spec2]) => spec2);
   const [first] = specs;
   const spec = {
@@ -3736,16 +3834,47 @@ function fieldsOf(contract, kit, options) {
       hiddenFields: options.hiddenFields,
       editable: options.editable,
       fieldOverrides: options.fieldOverrides,
-      grants: options.grants
+      grants: options.grants,
+      ...grantsColumn === void 0 ? {} : { grantsColumn }
     },
     fail4
   );
 }
-function serviceProblem4(service, contract) {
+function fieldsByColumn(contract, kit, options) {
+  const byColumn = /* @__PURE__ */ new Map();
+  return (grantsColumn) => {
+    let fields = byColumn.get(grantsColumn ?? "");
+    if (fields === void 0) {
+      fields = fieldsOf(contract, kit, options, grantsColumn);
+      byColumn.set(grantsColumn ?? "", fields);
+    }
+    return fields;
+  };
+}
+function servedProblemOf(fieldsFor, grants, { service, grantsSource }) {
+  const column = grantsColumnFor(service.model, grantsSource);
+  let fields;
+  try {
+    fields = fieldsFor(column);
+  } catch (error) {
+    return error instanceof Error ? error.message : String(error);
+  }
+  if (grants && fields.grants.size === 0) {
+    const named = column === void 0 ? `auth.serviceAccessSource names no column of model "${service.model ?? ""}"` : `the entity has no field "${column}", the column auth.serviceAccessSource names`;
+    return `grants: true needs a grants field: the entity has no serviceAccess or service_access field, and ${named}`;
+  }
+  return void 0;
+}
+function serviceProblem4(service, contract, fields) {
   if (service.contract !== contract) {
     return `its admin kit handlers were made for another contract; pass ${service.name}'s own contract to admin.handlers`;
   }
-  return service.model === void 0 ? "the admin kit reads and writes the service's rows: declare its model" : void 0;
+  if (service.model === void 0) {
+    return "the admin kit reads and writes the service's rows: declare its model";
+  }
+  const relations2 = relationKeysOf(service);
+  const relation = [...fields.named].find((name) => relations2.has(name));
+  return relation === void 0 ? void 0 : `"${relation}" is a relation of ${service.name}'s model (a projection selects it with a nested select): the admin kit writes column values only; leave it out of editable and fieldOverrides`;
 }
 function handlers4(contract, options) {
   const kit = kitMethods4(contract);
@@ -3753,7 +3882,8 @@ function handlers4(contract, options) {
   const names = kit.map(([name]) => name);
   const access = checkAccess3(checked2.access, names);
   const rowless = rowlessMethods(checked2.rowless, names, fail4);
-  const fields = fieldsOf(contract, kit, checked2);
+  const fieldsFor = fieldsByColumn(contract, kit, checked2);
+  const fields = fieldsFor(void 0);
   const { onWrite, onCommitted } = checked2;
   if (onWrite !== void 0 && typeof onWrite !== "function") {
     fail4("onWrite must be a function of (write, ctx, db)");
@@ -3768,11 +3898,18 @@ function handlers4(contract, options) {
   const entries = {};
   for (const [name, spec] of kit) {
     const form = access[name] ?? ADMIN_DEFAULT_ACCESS;
-    const handler = handlerOf3({ spec, fields, form, ...hooks });
-    checkWhenDefined(handler, (service) => serviceProblem4(service, contract));
+    const handler = handlerOf3({ spec, fieldsFor, form, ...hooks });
+    checkWhenDefined(handler, (service) => serviceProblem4(service, contract, fields));
+    checkWhenServed(
+      handler,
+      (served) => servedProblemOf(fieldsFor, checked2.grants === true, served)
+    );
     if (checked2.grants === true) {
       markGrantsEditor(handler);
     }
+    if (spec.method === "adminList" || spec.method === "adminGet") {
+      dependsOnCaller(handler);
+    }
     entries[name] = kitEntry(name, form, handler, rowless);
   }
   return Object.freeze(entries);
@@ -3816,7 +3953,8 @@ function reportErrors(client, logger, role) {
 }
 async function setupRedisAdapter(io, options = {}) {
   const logger = options.logger?.child({ service: "RedisAdapter" }) ?? consoleLogger.child({ service: "RedisAdapter" });
-  const { host = "localhost", port = 6379, password, db = 0, keyPrefix = "socket.io" } = options;
+  const { host = "localhost", port = 6379, password, db = 0 } = options;
+  const key = options.keyPrefix ?? deploymentOf(io);
   try {
     const peers = await loadRedisPeers();
     const createAdapter = peers.createAdapter;
@@ -3830,9 +3968,7 @@ async function setupRedisAdapter(io, options = {}) {
     reportErrors(pubClient, logger, "publish");
     reportErrors(subClient, logger, "subscribe");
     await Promise.all([pubClient.connect(), subClient.connect()]);
-    io.adapter(
-      createAdapter(pubClient, subClient, { key: keyPrefix })
-    );
+    io.adapter(createAdapter(pubClient, subClient, { key }));
     watchAdapterClients(io, logger);
     logger.info(`Redis adapter connected to ${host}:${port}`);
     const cleanup = async () => {
@@ -3977,8 +4113,11 @@ export {
   DevWarningError,
   INDEX_MAX_ROWS,
   MAX_APP_ROOMS,
+  MAX_ENTITY_IDS_PER_SOCKET,
   MAX_ITEM_IDS,
+  MAX_SCOPES_PER_SOCKET,
   MAX_STREAMS_PER_SOCKET,
+  MAX_TOPICS_PER_SOCKET,
   MIN_STALL_INTERVAL_MS,
   N_PLUS_ONE_STATEMENTS,
   ORDINAL_STEP,