@acorex-platform/framework-server 0.0.18 → 0.0.20

package/core/src/lib/runtime/runtime-command.controller.d.ts

@@ -1,8 +1,12 @@
+import type { Request } from 'express';
+import { RuntimeBulkCommandService } from './runtime-bulk-command.service';
 import { RuntimeDispatcherService } from './runtime-dispatcher.service';
-import type { RuntimeCommandRequestBody, RuntimeCommandResult } from './runtime.types';
+import type { RuntimeBulkCommandRequestBody, RuntimeBulkCommandResult, RuntimeCommandRequestBody, RuntimeCommandResult } from './runtime.types';
 export declare class RuntimeCommandController {
     private readonly dispatcher;
-    constructor(dispatcher: RuntimeDispatcherService);
-    execute(body: RuntimeCommandRequestBody): Promise<RuntimeCommandResult>;
+    private readonly bulkCommands;
+    constructor(dispatcher: RuntimeDispatcherService, bulkCommands: RuntimeBulkCommandService);
+    execute(body: RuntimeCommandRequestBody, req: Request): Promise<RuntimeCommandResult>;
+    executeBulk(body: RuntimeBulkCommandRequestBody, req: Request): Promise<RuntimeBulkCommandResult>;
 }
 //# sourceMappingURL=runtime-command.controller.d.ts.map

package/core/src/lib/runtime/runtime-command.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-command.controller.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/core/src/lib/runtime/runtime-command.controller.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AACxE,OAAO,KAAK,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAMvF,qBAIa,wBAAwB;IACvB,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAAV,UAAU,EAAE,wBAAwB;IAK3D,OAAO,CAAS,IAAI,EAAE,yBAAyB,GAAG,OAAO,CAAC,oBAAoB,CAAC;CAGtF"}
+{"version":3,"file":"runtime-command.controller.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/core/src/lib/runtime/runtime-command.controller.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAE3E,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAGxE,OAAO,KAAK,EACV,6BAA6B,EAC7B,wBAAwB,EACxB,yBAAyB,EACzB,oBAAoB,EACrB,MAAM,iBAAiB,CAAC;AAMzB,qBAIa,wBAAwB;IAEjC,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,YAAY;gBADZ,UAAU,EAAE,wBAAwB,EACpC,YAAY,EAAE,yBAAyB;IAMpD,OAAO,CACH,IAAI,EAAE,yBAAyB,EAChC,GAAG,EAAE,OAAO,GAClB,OAAO,CAAC,oBAAoB,CAAC;IAa1B,WAAW,CACP,IAAI,EAAE,6BAA6B,EACpC,GAAG,EAAE,OAAO,GAClB,OAAO,CAAC,wBAAwB,CAAC;CAKrC"}

package/core/src/lib/runtime/runtime-command.controller.js

@@ -5,16 +5,23 @@ exports.RuntimeCommandController = void 0;
 const tslib_1 = require("tslib");
 const common_1 = require("@nestjs/common");
 const swagger_1 = require("@nestjs/swagger");
-const security_1 = require("@acorex-platform/framework-server/security");
+const runtime_bulk_command_service_1 = require("./runtime-bulk-command.service");
+const runtime_authz_guard_1 = require("./runtime-authz.guard");
 const runtime_dispatcher_service_1 = require("./runtime-dispatcher.service");
+const runtime_request_context_util_1 = require("./runtime-request-context.util");
+const runtime_result_normalize_util_1 = require("./runtime-result.normalize.util");
 //#endregion
 //#region ---- Runtime command controller ----
 let RuntimeCommandController = class RuntimeCommandController {
-    constructor(dispatcher) {
+    constructor(dispatcher, bulkCommands) {
         this.dispatcher = dispatcher;
+        this.bulkCommands = bulkCommands;
     }
-    async execute(body) {
-        return this.dispatcher.executeCommand(body.name, body.input);
+    async execute(body, req) {
+        return (0, runtime_request_context_util_1.runInRuntimeRequestContext)(req, () => this.dispatcher.executeCommand(body.name, body.input, body.options));
+    }
+    async executeBulk(body, req) {
+        return (0, runtime_request_context_util_1.runInRuntimeRequestContext)(req, async () => (0, runtime_result_normalize_util_1.normalizeRuntimeCommandResult)(await this.bulkCommands.execute(body)));
     }
 };
 exports.RuntimeCommandController = RuntimeCommandController;
@@ -23,16 +30,31 @@ tslib_1.__decorate([
     (0, common_1.HttpCode)(common_1.HttpStatus.OK),
     (0, swagger_1.ApiOperation)({ summary: 'Execute a registered or default entity command' }),
     tslib_1.__param(0, (0, common_1.Body)()),
+    tslib_1.__param(1, (0, common_1.Req)()),
     tslib_1.__metadata("design:type", Function),
-    tslib_1.__metadata("design:paramtypes", [Object]),
+    tslib_1.__metadata("design:paramtypes", [Object, Object]),
     tslib_1.__metadata("design:returntype", Promise)
 ], RuntimeCommandController.prototype, "execute", null);
+tslib_1.__decorate([
+    (0, common_1.Post)('bulk'),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Execute a command for every row matching a filter',
+        description: 'Resolves target ids via entity query + filter, then fans out the named server command per id. Partial success is returned in data.',
+    }),
+    tslib_1.__param(0, (0, common_1.Body)()),
+    tslib_1.__param(1, (0, common_1.Req)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [Object, Object]),
+    tslib_1.__metadata("design:returntype", Promise)
+], RuntimeCommandController.prototype, "executeBulk", null);
 exports.RuntimeCommandController = RuntimeCommandController = tslib_1.__decorate([
     (0, swagger_1.ApiTags)('runtime'),
     (0, swagger_1.ApiBearerAuth)(),
-    (0, common_1.UseGuards)(security_1.JwtAuthGuard),
+    (0, common_1.UseGuards)(runtime_authz_guard_1.RuntimeAuthzGuard),
     (0, common_1.Controller)('v1/runtime/commands'),
-    tslib_1.__metadata("design:paramtypes", [runtime_dispatcher_service_1.RuntimeDispatcherService])
+    tslib_1.__metadata("design:paramtypes", [runtime_dispatcher_service_1.RuntimeDispatcherService,
+        runtime_bulk_command_service_1.RuntimeBulkCommandService])
 ], RuntimeCommandController);
 //#endregion
 //# sourceMappingURL=runtime-command.controller.js.map

package/core/src/lib/runtime/runtime-command.controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-command.controller.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/core/src/lib/runtime/runtime-command.controller.ts"],"names":[],"mappings":";AAAA,2BAA2B;;;;AAE3B,2CAAyF;AACzF,6CAAuE;AACvE,yEAA0E;AAC1E,6EAAwE;AAGxE,YAAY;AAEZ,8CAA8C;AAMvC,IAAM,wBAAwB,GAA9B,MAAM,wBAAwB;IACnC,YAA6B,UAAoC;QAApC,eAAU,GAAV,UAAU,CAA0B;IAAG,CAAC;IAK/D,AAAN,KAAK,CAAC,OAAO,CAAS,IAA+B;QACnD,OAAO,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/D,CAAC;CACF,CAAA;AATY,4DAAwB;AAM7B;IAHL,IAAA,aAAI,GAAE;IACN,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,gDAAgD,EAAE,CAAC;IAC7D,mBAAA,IAAA,aAAI,GAAE,CAAA;;;;uDAEpB;mCARU,wBAAwB;IAJpC,IAAA,iBAAO,EAAC,SAAS,CAAC;IAClB,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,uBAAY,CAAC;IACvB,IAAA,mBAAU,EAAC,qBAAqB,CAAC;6CAES,qDAAwB;GADtD,wBAAwB,CASpC;AAED,YAAY"}
+{"version":3,"file":"runtime-command.controller.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/core/src/lib/runtime/runtime-command.controller.ts"],"names":[],"mappings":";AAAA,2BAA2B;;;;AAE3B,2CAA8F;AAC9F,6CAAuE;AAEvE,iFAA2E;AAC3E,+DAA0D;AAC1D,6EAAwE;AACxE,iFAA4E;AAC5E,mFAAgF;AAQhF,YAAY;AAEZ,8CAA8C;AAMvC,IAAM,wBAAwB,GAA9B,MAAM,wBAAwB;IACnC,YACmB,UAAoC,EACpC,YAAuC;QADvC,eAAU,GAAV,UAAU,CAA0B;QACpC,iBAAY,GAAZ,YAAY,CAA2B;IACvD,CAAC;IAKE,AAAN,KAAK,CAAC,OAAO,CACH,IAA+B,EAChC,GAAY;QAEnB,OAAO,IAAA,yDAA0B,EAAC,GAAG,EAAE,GAAG,EAAE,CAC1C,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CACpE,CAAC;IACJ,CAAC;IASK,AAAN,KAAK,CAAC,WAAW,CACP,IAAmC,EACpC,GAAY;QAEnB,OAAO,IAAA,yDAA0B,EAAC,GAAG,EAAE,KAAK,IAAI,EAAE,CAChD,IAAA,6DAA6B,EAAC,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAA6B,CACjG,CAAC;IACJ,CAAC;CACF,CAAA;AAjCY,4DAAwB;AAS7B;IAHL,IAAA,aAAI,GAAE;IACN,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,gDAAgD,EAAE,CAAC;IAEzE,mBAAA,IAAA,aAAI,GAAE,CAAA;IACN,mBAAA,IAAA,YAAG,GAAE,CAAA;;;;uDAKP;AASK;IAPL,IAAA,aAAI,EAAC,MAAM,CAAC;IACZ,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,mDAAmD;QAC5D,WAAW,EACT,oIAAoI;KACvI,CAAC;IAEC,mBAAA,IAAA,aAAI,GAAE,CAAA;IACN,mBAAA,IAAA,YAAG,GAAE,CAAA;;;;2DAKP;mCAhCU,wBAAwB;IAJpC,IAAA,iBAAO,EAAC,SAAS,CAAC;IAClB,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,uCAAiB,CAAC;IAC5B,IAAA,mBAAU,EAAC,qBAAqB,CAAC;6CAGD,qDAAwB;QACtB,wDAAyB;GAH/C,wBAAwB,CAiCpC;AAED,YAAY"}

package/core/src/lib/runtime/runtime-dispatcher.service.d.ts

@@ -1,15 +1,19 @@
 import { type AXPServerCommandRegistry, type AXPServerQueryRegistry } from '@acorex-platform/framework-server/domain/abstract';
+import { type ExecutionTraceRecorder } from '@acorex-platform/framework-server/observability/abstract';
+import { type AXPCommandExecuteOptions, type AXPQueryExecuteOptions } from '@acorex-platform/framework-shared/runtime';
 import { EntityRuntimeMutationService } from './entity-runtime-mutation.service';
 import { EntityRuntimeQueryService } from './entity-runtime-query.service';
+import { RuntimeAuthzService } from './runtime-authz.service';
 import type { RuntimeCommandResult, RuntimeQueryResult } from './runtime.types';
 export declare class RuntimeDispatcherService {
     private readonly commandRegistry;
     private readonly queryRegistry;
     private readonly mutationService;
     private readonly queryService;
-    constructor(commandRegistry: AXPServerCommandRegistry | null, queryRegistry: AXPServerQueryRegistry | null, mutationService: EntityRuntimeMutationService, queryService: EntityRuntimeQueryService);
-    executeCommand(name: string, input: unknown): Promise<RuntimeCommandResult>;
-    executeQuery(name: string, input: unknown): Promise<RuntimeQueryResult>;
-    private normalizeCustomQueryResult;
+    private readonly authzService;
+    private readonly executionTrace;
+    constructor(commandRegistry: AXPServerCommandRegistry | null, queryRegistry: AXPServerQueryRegistry | null, mutationService: EntityRuntimeMutationService, queryService: EntityRuntimeQueryService, authzService: RuntimeAuthzService, executionTrace: ExecutionTraceRecorder | null);
+    executeCommand(name: string, input: unknown, options?: AXPCommandExecuteOptions): Promise<RuntimeCommandResult>;
+    executeQuery(name: string, input: unknown, options?: AXPQueryExecuteOptions): Promise<RuntimeQueryResult>;
 }
 //# sourceMappingURL=runtime-dispatcher.service.d.ts.map

package/core/src/lib/runtime/runtime-dispatcher.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-dispatcher.service.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/core/src/lib/runtime/runtime-dispatcher.service.ts"],"names":[],"mappings":"AAGA,OAAO,EAGL,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC5B,MAAM,mDAAmD,CAAC;AAW3D,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAE3E,OAAO,KAAK,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAMhF,qBACa,wBAAwB;IAIjC,OAAO,CAAC,QAAQ,CAAC,eAAe;IAGhC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,YAAY;gBALZ,eAAe,EAAE,wBAAwB,GAAG,IAAI,EAGhD,aAAa,EAAE,sBAAsB,GAAG,IAAI,EAC5C,eAAe,EAAE,4BAA4B,EAC7C,YAAY,EAAE,yBAAyB;IAGpD,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAoC3E,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAwC7E,OAAO,CAAC,0BAA0B;CASnC"}
+{"version":3,"file":"runtime-dispatcher.service.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/core/src/lib/runtime/runtime-dispatcher.service.ts"],"names":[],"mappings":"AAGA,OAAO,EAGL,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC5B,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,0DAA0D,CAAC;AAClE,OAAO,EAML,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC5B,MAAM,2CAA2C,CAAC;AAEnD,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAO9D,OAAO,KAAK,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAoChF,qBACa,wBAAwB;IAIjC,OAAO,CAAC,QAAQ,CAAC,eAAe;IAGhC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAG7B,OAAO,CAAC,QAAQ,CAAC,cAAc;gBATd,eAAe,EAAE,wBAAwB,GAAG,IAAI,EAGhD,aAAa,EAAE,sBAAsB,GAAG,IAAI,EAC5C,eAAe,EAAE,4BAA4B,EAC7C,YAAY,EAAE,yBAAyB,EACvC,YAAY,EAAE,mBAAmB,EAGjC,cAAc,EAAE,sBAAsB,GAAG,IAAI;IAG1D,cAAc,CAClB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,OAAO,EACd,OAAO,CAAC,EAAE,wBAAwB,GACjC,OAAO,CAAC,oBAAoB,CAAC;IAsE1B,YAAY,CAChB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,OAAO,EACd,OAAO,CAAC,EAAE,sBAAsB,GAC/B,OAAO,CAAC,kBAAkB,CAAC;CAmE/B"}

package/core/src/lib/runtime/runtime-dispatcher.service.js

@@ -5,20 +5,51 @@ exports.RuntimeDispatcherService = void 0;
 const tslib_1 = require("tslib");
 const common_1 = require("@nestjs/common");
 const abstract_1 = require("@acorex-platform/framework-server/domain/abstract");
+const abstract_2 = require("@acorex-platform/framework-server/observability/abstract");
 const runtime_1 = require("@acorex-platform/framework-shared/runtime");
+const map_unknown_to_command_failure_util_1 = require("../errors/map-unknown-to-command-failure.util");
 const entity_runtime_mutation_service_1 = require("./entity-runtime-mutation.service");
 const entity_runtime_query_service_1 = require("./entity-runtime-query.service");
+const runtime_authz_service_1 = require("./runtime-authz.service");
 const runtime_execution_mode_registry_1 = require("./runtime-execution-mode.registry");
+const runtime_result_normalize_util_1 = require("./runtime-result.normalize.util");
+//#endregion
+//#region ---- Helpers ----
+function resolveModuleFromKey(key) {
+    const entityPart = key.includes(':') ? key.split(':')[0] : undefined;
+    if (!entityPart || !entityPart.includes('.')) {
+        return undefined;
+    }
+    return entityPart.split('.')[0];
+}
+function resolveEntityFromKey(key, input) {
+    const parsed = (0, runtime_1.parseEntityCommandKey)(key);
+    if (parsed?.entity) {
+        return parsed.entity;
+    }
+    return (0, runtime_1.resolveEntityNameFromRuntimeInput)(input) ?? undefined;
+}
+function summarizeQueryResult(result) {
+    if (!result.success) {
+        return { success: false };
+    }
+    if (result.kind === 'collection') {
+        return { success: true, itemCount: result.data.items.length, total: result.data.total };
+    }
+    return { success: true, hasData: result.data != null };
+}
 //#endregion
 //#region ---- Runtime dispatcher ----
 let RuntimeDispatcherService = class RuntimeDispatcherService {
-    constructor(commandRegistry, queryRegistry, mutationService, queryService) {
+    constructor(commandRegistry, queryRegistry, mutationService, queryService, authzService, executionTrace) {
         this.commandRegistry = commandRegistry;
         this.queryRegistry = queryRegistry;
         this.mutationService = mutationService;
         this.queryService = queryService;
+        this.authzService = authzService;
+        this.executionTrace = executionTrace;
     }
-    async executeCommand(name, input) {
+    async executeCommand(name, input, options) {
         const key = name?.trim();
         if (!key) {
             throw new common_1.BadRequestException('name is required');
@@ -26,28 +57,51 @@ let RuntimeDispatcherService = class RuntimeDispatcherService {
         if ((0, runtime_execution_mode_registry_1.isFrontendOnlyRuntimeKey)(key)) {
             throw new common_1.BadRequestException(`Command "${key}" is frontend-only and cannot run on the server.`);
         }
-        if (this.commandRegistry?.has(key)) {
-            return this.commandRegistry.execute(key, input);
-        }
-        const parsed = (0, runtime_1.parseEntityCommandKey)(key);
-        if (parsed && (0, runtime_1.isEntityMutationOperation)(parsed.operation)) {
-            return this.mutationService.execute(parsed.entity, parsed.operation, input);
-        }
-        if (key === runtime_1.ENTITY_INSERT_DEFAULT || key === runtime_1.ENTITY_UPDATE_DEFAULT || key === runtime_1.ENTITY_DELETE_DEFAULT) {
-            const record = input;
-            const entity = record?.entity?.trim();
-            if (!entity) {
-                return { success: false, message: { text: 'entity is required in input for default entity commands.' } };
+        const run = async () => {
+            await this.authzService.enforceCommand(key, input);
+            if (this.commandRegistry?.has(key)) {
+                return (0, runtime_result_normalize_util_1.normalizeRuntimeCommandResult)(await this.commandRegistry.execute(key, input, options));
             }
-            const operation = key === runtime_1.ENTITY_INSERT_DEFAULT ? 'Insert' : key === runtime_1.ENTITY_UPDATE_DEFAULT ? 'Update' : 'Delete';
-            return this.mutationService.execute(entity, operation, input);
-        }
-        return {
-            success: false,
-            message: { text: `Command handler not registered: ${key}` },
+            const parsed = (0, runtime_1.parseEntityCommandKey)(key);
+            if (parsed && (0, runtime_1.isEntityMutationOperation)(parsed.operation)) {
+                return (0, runtime_result_normalize_util_1.normalizeRuntimeCommandResult)(await this.mutationService.execute(parsed.entity, parsed.operation, input));
+            }
+            const defaultMutationOp = (0, runtime_1.parseDefaultEntityRuntimeKey)(key);
+            if (defaultMutationOp && (0, runtime_1.isEntityMutationOperation)(defaultMutationOp)) {
+                const entity = (0, runtime_1.resolveEntityNameFromRuntimeInput)(input);
+                if (!entity) {
+                    return {
+                        success: false,
+                        message: { text: 'entity is required in input for default entity commands.' },
+                    };
+                }
+                return (0, runtime_result_normalize_util_1.normalizeRuntimeCommandResult)(await this.mutationService.execute(entity, defaultMutationOp, input));
+            }
+            return {
+                success: false,
+                message: { text: `Command handler not registered: ${key}` },
+            };
         };
+        if (!this.executionTrace?.isEnabled('command')) {
+            return run();
+        }
+        return this.executionTrace.withTrace({
+            kind: 'command',
+            operation: key,
+            module: resolveModuleFromKey(key),
+            entityName: resolveEntityFromKey(key, input),
+            input,
+        }, async (session) => {
+            const result = await run();
+            session.setAttribute('acorex.runtime.success', result.success);
+            if (!result.success) {
+                const text = result.message?.text;
+                session.markFailed(typeof text === 'string' ? text : undefined);
+            }
+            return result;
+        });
     }
-    async executeQuery(name, input) {
+    async executeQuery(name, input, options) {
         const key = name?.trim();
         if (!key) {
             throw new common_1.BadRequestException('name is required');
@@ -55,41 +109,54 @@ let RuntimeDispatcherService = class RuntimeDispatcherService {
         if ((0, runtime_execution_mode_registry_1.isFrontendOnlyRuntimeKey)(key)) {
             throw new common_1.BadRequestException(`Query "${key}" is frontend-only and cannot run on the server.`);
         }
-        if (this.queryRegistry?.has(key)) {
-            try {
-                const data = await this.queryRegistry.execute(key, input);
-                return this.normalizeCustomQueryResult(data);
+        const run = async () => {
+            await this.authzService.enforceQuery(key, input);
+            if (this.queryRegistry?.has(key)) {
+                try {
+                    const data = await this.queryRegistry.execute(key, input, options);
+                    return (0, runtime_result_normalize_util_1.normalizeRuntimeQueryResult)(data);
+                }
+                catch (error) {
+                    const body = (0, map_unknown_to_command_failure_util_1.mapUnknownErrorToAXPErrorBody)(error);
+                    return (0, runtime_result_normalize_util_1.runtimeQueryFailure)(body.message || 'Query execution failed', {
+                        code: body.code,
+                        details: body.details,
+                    });
+                }
             }
-            catch (error) {
-                return {
-                    success: false,
-                    error: error instanceof Error ? error.message : 'Query execution failed',
-                };
+            const parsed = (0, runtime_1.parseEntityCommandKey)(key);
+            if (parsed && (0, runtime_1.isEntityQueryOperation)(parsed.operation)) {
+                return this.queryService.execute(parsed.entity, parsed.operation, input);
             }
-        }
-        const parsed = (0, runtime_1.parseEntityCommandKey)(key);
-        if (parsed && (0, runtime_1.isEntityQueryOperation)(parsed.operation)) {
-            return this.queryService.execute(parsed.entity, parsed.operation, input);
-        }
-        if (key === runtime_1.ENTITY_QUERY_DEFAULT || key === runtime_1.ENTITY_GET_BY_ID_DEFAULT) {
-            const record = input;
-            const entity = record?.entity?.trim();
-            if (!entity) {
-                return { success: false, error: 'entity is required in input for default entity queries.' };
+            const defaultQueryOp = (0, runtime_1.parseDefaultEntityRuntimeKey)(key);
+            if (defaultQueryOp && (0, runtime_1.isEntityQueryOperation)(defaultQueryOp)) {
+                const entity = (0, runtime_1.resolveEntityNameFromRuntimeInput)(input);
+                if (!entity) {
+                    return (0, runtime_result_normalize_util_1.runtimeQueryFailure)('entity is required in input for default entity queries.');
+                }
+                return this.queryService.execute(entity, defaultQueryOp, input);
             }
-            const operation = key === runtime_1.ENTITY_QUERY_DEFAULT ? 'Query' : 'GetById';
-            return this.queryService.execute(entity, operation, input);
+            return (0, runtime_result_normalize_util_1.runtimeQueryFailure)(`Query handler not registered: ${key}`);
+        };
+        if (!this.executionTrace?.isEnabled('query')) {
+            return run();
         }
-        return { success: false, error: `Query handler not registered: ${key}` };
-    }
-    normalizeCustomQueryResult(result) {
-        if (result != null && typeof result === 'object' && 'success' in result) {
+        return this.executionTrace.withTrace({
+            kind: 'query',
+            operation: key,
+            module: resolveModuleFromKey(key),
+            entityName: resolveEntityFromKey(key, input),
+            input,
+        }, async (session) => {
+            const result = await run();
+            session.setAttribute('acorex.runtime.success', result.success);
+            session.setAttribute('acorex.runtime.summary', JSON.stringify(summarizeQueryResult(result)));
+            if (!result.success) {
+                const text = result.message?.text;
+                session.markFailed(typeof text === 'string' ? text : undefined);
+            }
             return result;
-        }
-        if (Array.isArray(result)) {
-            return { success: true, total: result.length, items: result };
-        }
-        return { success: true, data: result, total: 1, items: result != null ? [result] : [] };
+        });
     }
 };
 exports.RuntimeDispatcherService = RuntimeDispatcherService;
@@ -99,8 +166,11 @@ exports.RuntimeDispatcherService = RuntimeDispatcherService = tslib_1.__decorate
     tslib_1.__param(0, (0, common_1.Inject)(abstract_1.SERVER_COMMAND_REGISTRY)),
     tslib_1.__param(1, (0, common_1.Optional)()),
     tslib_1.__param(1, (0, common_1.Inject)(abstract_1.SERVER_QUERY_REGISTRY)),
+    tslib_1.__param(5, (0, common_1.Optional)()),
+    tslib_1.__param(5, (0, common_1.Inject)(abstract_2.AXP_EXECUTION_TRACE_RECORDER)),
     tslib_1.__metadata("design:paramtypes", [Object, Object, entity_runtime_mutation_service_1.EntityRuntimeMutationService,
-        entity_runtime_query_service_1.EntityRuntimeQueryService])
+        entity_runtime_query_service_1.EntityRuntimeQueryService,
+        runtime_authz_service_1.RuntimeAuthzService, Object])
 ], RuntimeDispatcherService);
 //#endregion
 //# sourceMappingURL=runtime-dispatcher.service.js.map

package/core/src/lib/runtime/runtime-dispatcher.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-dispatcher.service.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/core/src/lib/runtime/runtime-dispatcher.service.ts"],"names":[],"mappings":";AAAA,2BAA2B;;;;AAE3B,2CAAmF;AACnF,gFAK2D;AAC3D,uEASmD;AACnD,uFAAiF;AACjF,iFAA2E;AAC3E,uFAA6E;AAG7E,YAAY;AAEZ,sCAAsC;AAG/B,IAAM,wBAAwB,GAA9B,MAAM,wBAAwB;IACnC,YAGmB,eAAgD,EAGhD,aAA4C,EAC5C,eAA6C,EAC7C,YAAuC;QALvC,oBAAe,GAAf,eAAe,CAAiC;QAGhD,kBAAa,GAAb,aAAa,CAA+B;QAC5C,oBAAe,GAAf,eAAe,CAA8B;QAC7C,iBAAY,GAAZ,YAAY,CAA2B;IACvD,CAAC;IAEJ,KAAK,CAAC,cAAc,CAAC,IAAY,EAAE,KAAc;QAC/C,MAAM,GAAG,GAAG,IAAI,EAAE,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,4BAAmB,CAAC,kBAAkB,CAAC,CAAC;QACpD,CAAC;QAED,IAAI,IAAA,0DAAwB,EAAC,GAAG,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,4BAAmB,CAAC,YAAY,GAAG,kDAAkD,CAAC,CAAC;QACnG,CAAC;QAED,IAAI,IAAI,CAAC,eAAe,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,MAAM,GAAG,IAAA,+BAAqB,EAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,MAAM,IAAI,IAAA,mCAAyB,EAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1D,OAAO,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC9E,CAAC;QAED,IAAI,GAAG,KAAK,+BAAqB,IAAI,GAAG,KAAK,+BAAqB,IAAI,GAAG,KAAK,+BAAqB,EAAE,CAAC;YACpG,MAAM,MAAM,GAAG,KAAuD,CAAC;YACvE,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YACtC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,0DAA0D,EAAE,EAAE,CAAC;YAC3G,CAAC;YACD,MAAM,SAAS,GACb,GAAG,KAAK,+BAAqB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,KAAK,+BAAqB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;YACjG,OAAO,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QAChE,CAAC;QAED,OAAO;YACL,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,EAAE,IAAI,EAAE,mCAAmC,GAAG,EAAE,EAAE;SAC5D,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAAY,EAAE,KAAc;QAC7C,MAAM,GAAG,GAAG,IAAI,EAAE,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,4BAAmB,CAAC,kBAAkB,CAAC,CAAC;QACpD,CAAC;QAED,IAAI,IAAA,0DAAwB,EAAC,GAAG,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,4BAAmB,CAAC,UAAU,GAAG,kDAAkD,CAAC,CAAC;QACjG,CAAC;QAED,IAAI,IAAI,CAAC,aAAa,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBAC1D,OAAO,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,CAAC;YAC/C,CAAC;YAAC,OAAO,KAAc,EAAE,CAAC;gBACxB,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB;iBACzE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,IAAA,+BAAqB,EAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,MAAM,IAAI,IAAA,gCAAsB,EAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YACvD,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC3E,CAAC;QAED,IAAI,GAAG,KAAK,8BAAoB,IAAI,GAAG,KAAK,kCAAwB,EAAE,CAAC;YACrE,MAAM,MAAM,GAAG,KAAmC,CAAC;YACnD,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YACtC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,yDAAyD,EAAE,CAAC;YAC9F,CAAC;YACD,MAAM,SAAS,GAAG,GAAG,KAAK,8BAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;YACrE,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QAC7D,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,iCAAiC,GAAG,EAAE,EAAE,CAAC;IAC3E,CAAC;IAEO,0BAA0B,CAAC,MAAe;QAChD,IAAI,MAAM,IAAI,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,SAAS,IAAK,MAAiB,EAAE,CAAC;YACpF,OAAO,MAA4B,CAAC;QACtC,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAChE,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC1F,CAAC;CACF,CAAA;AAjGY,4DAAwB;mCAAxB,wBAAwB;IADpC,IAAA,mBAAU,GAAE;IAGR,mBAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,mBAAA,IAAA,eAAM,EAAC,kCAAuB,CAAC,CAAA;IAE/B,mBAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,mBAAA,IAAA,eAAM,EAAC,gCAAqB,CAAC,CAAA;6DAEI,8DAA4B;QAC/B,wDAAyB;GAT/C,wBAAwB,CAiGpC;AAED,YAAY"}
+{"version":3,"file":"runtime-dispatcher.service.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/core/src/lib/runtime/runtime-dispatcher.service.ts"],"names":[],"mappings":";AAAA,2BAA2B;;;;AAE3B,2CAAmF;AACnF,gFAK2D;AAC3D,uFAGkE;AAClE,uEAQmD;AACnD,uGAA8F;AAC9F,uFAAiF;AACjF,iFAA2E;AAC3E,mEAA8D;AAC9D,uFAA6E;AAC7E,mFAIyC;AAGzC,YAAY;AAEZ,2BAA2B;AAE3B,SAAS,oBAAoB,CAAC,GAAW;IACvC,MAAM,UAAU,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrE,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAW,EAAE,KAAc;IACvD,MAAM,MAAM,GAAG,IAAA,+BAAqB,EAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,MAAM,EAAE,MAAM,EAAE,CAAC;QACnB,OAAO,MAAM,CAAC,MAAM,CAAC;IACvB,CAAC;IACD,OAAO,IAAA,2CAAiC,EAAC,KAAK,CAAC,IAAI,SAAS,CAAC;AAC/D,CAAC;AAED,SAAS,oBAAoB,CAAC,MAA0B;IACtD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;IAC1F,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;AACzD,CAAC;AAED,YAAY;AAEZ,sCAAsC;AAG/B,IAAM,wBAAwB,GAA9B,MAAM,wBAAwB;IACnC,YAGmB,eAAgD,EAGhD,aAA4C,EAC5C,eAA6C,EAC7C,YAAuC,EACvC,YAAiC,EAGjC,cAA6C;QAT7C,oBAAe,GAAf,eAAe,CAAiC;QAGhD,kBAAa,GAAb,aAAa,CAA+B;QAC5C,oBAAe,GAAf,eAAe,CAA8B;QAC7C,iBAAY,GAAZ,YAAY,CAA2B;QACvC,iBAAY,GAAZ,YAAY,CAAqB;QAGjC,mBAAc,GAAd,cAAc,CAA+B;IAC7D,CAAC;IAEJ,KAAK,CAAC,cAAc,CAClB,IAAY,EACZ,KAAc,EACd,OAAkC;QAElC,MAAM,GAAG,GAAG,IAAI,EAAE,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,4BAAmB,CAAC,kBAAkB,CAAC,CAAC;QACpD,CAAC;QAED,IAAI,IAAA,0DAAwB,EAAC,GAAG,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,4BAAmB,CAAC,YAAY,GAAG,kDAAkD,CAAC,CAAC;QACnG,CAAC;QAED,MAAM,GAAG,GAAG,KAAK,IAAmC,EAAE;YACpD,MAAM,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAEnD,IAAI,IAAI,CAAC,eAAe,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnC,OAAO,IAAA,6DAA6B,EAClC,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,CACxD,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAAG,IAAA,+BAAqB,EAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,MAAM,IAAI,IAAA,mCAAyB,EAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC1D,OAAO,IAAA,6DAA6B,EAClC,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAC3E,CAAC;YACJ,CAAC;YAED,MAAM,iBAAiB,GAAG,IAAA,sCAA4B,EAAC,GAAG,CAAC,CAAC;YAC5D,IAAI,iBAAiB,IAAI,IAAA,mCAAyB,EAAC,iBAAiB,CAAC,EAAE,CAAC;gBACtE,MAAM,MAAM,GAAG,IAAA,2CAAiC,EAAC,KAAK,CAAC,CAAC;gBACxD,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,OAAO,EAAE,EAAE,IAAI,EAAE,0DAA0D,EAAE;qBAC9E,CAAC;gBACJ,CAAC;gBACD,OAAO,IAAA,6DAA6B,EAClC,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,MAAM,EAAE,iBAAiB,EAAE,KAAK,CAAC,CACrE,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,EAAE,IAAI,EAAE,mCAAmC,GAAG,EAAE,EAAE;aAC5D,CAAC;QACJ,CAAC,CAAC;QAEF,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;YAC/C,OAAO,GAAG,EAAE,CAAC;QACf,CAAC;QAED,OAAO,IAAI,CAAC,cAAc,CAAC,SAAS,CAClC;YACE,IAAI,EAAE,SAAS;YACf,SAAS,EAAE,GAAG;YACd,MAAM,EAAE,oBAAoB,CAAC,GAAG,CAAC;YACjC,UAAU,EAAE,oBAAoB,CAAC,GAAG,EAAE,KAAK,CAAC;YAC5C,KAAK;SACN,EACD,KAAK,EAAE,OAAO,EAAE,EAAE;YAChB,MAAM,MAAM,GAAG,MAAM,GAAG,EAAE,CAAC;YAC3B,OAAO,CAAC,YAAY,CAAC,wBAAwB,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YAC/D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC;gBAClC,OAAO,CAAC,UAAU,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAClE,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC,CACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,IAAY,EACZ,KAAc,EACd,OAAgC;QAEhC,MAAM,GAAG,GAAG,IAAI,EAAE,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,4BAAmB,CAAC,kBAAkB,CAAC,CAAC;QACpD,CAAC;QAED,IAAI,IAAA,0DAAwB,EAAC,GAAG,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,4BAAmB,CAAC,UAAU,GAAG,kDAAkD,CAAC,CAAC;QACjG,CAAC;QAED,MAAM,GAAG,GAAG,KAAK,IAAiC,EAAE;YAClD,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAEjD,IAAI,IAAI,CAAC,aAAa,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjC,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;oBACnE,OAAO,IAAA,2DAA2B,EAAC,IAAI,CAAC,CAAC;gBAC3C,CAAC;gBAAC,OAAO,KAAc,EAAE,CAAC;oBACxB,MAAM,IAAI,GAAG,IAAA,mEAA6B,EAAC,KAAK,CAAC,CAAC;oBAClD,OAAO,IAAA,mDAAmB,EAAC,IAAI,CAAC,OAAO,IAAI,wBAAwB,EAAE;wBACnE,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,OAAO,EAAE,IAAI,CAAC,OAAO;qBACtB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,MAAM,MAAM,GAAG,IAAA,+BAAqB,EAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,MAAM,IAAI,IAAA,gCAAsB,EAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;gBACvD,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YAC3E,CAAC;YAED,MAAM,cAAc,GAAG,IAAA,sCAA4B,EAAC,GAAG,CAAC,CAAC;YACzD,IAAI,cAAc,IAAI,IAAA,gCAAsB,EAAC,cAAc,CAAC,EAAE,CAAC;gBAC7D,MAAM,MAAM,GAAG,IAAA,2CAAiC,EAAC,KAAK,CAAC,CAAC;gBACxD,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,OAAO,IAAA,mDAAmB,EAAC,yDAAyD,CAAC,CAAC;gBACxF,CAAC;gBACD,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC;YAClE,CAAC;YAED,OAAO,IAAA,mDAAmB,EAAC,iCAAiC,GAAG,EAAE,CAAC,CAAC;QACrE,CAAC,CAAC;QAEF,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7C,OAAO,GAAG,EAAE,CAAC;QACf,CAAC;QAED,OAAO,IAAI,CAAC,cAAc,CAAC,SAAS,CAClC;YACE,IAAI,EAAE,OAAO;YACb,SAAS,EAAE,GAAG;YACd,MAAM,EAAE,oBAAoB,CAAC,GAAG,CAAC;YACjC,UAAU,EAAE,oBAAoB,CAAC,GAAG,EAAE,KAAK,CAAC;YAC5C,KAAK;SACN,EACD,KAAK,EAAE,OAAO,EAAE,EAAE;YAChB,MAAM,MAAM,GAAG,MAAM,GAAG,EAAE,CAAC;YAC3B,OAAO,CAAC,YAAY,CAAC,wBAAwB,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YAC/D,OAAO,CAAC,YAAY,CAAC,wBAAwB,EAAE,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC7F,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC;gBAClC,OAAO,CAAC,UAAU,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAClE,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC,CACF,CAAC;IACJ,CAAC;CACF,CAAA;AAjKY,4DAAwB;mCAAxB,wBAAwB;IADpC,IAAA,mBAAU,GAAE;IAGR,mBAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,mBAAA,IAAA,eAAM,EAAC,kCAAuB,CAAC,CAAA;IAE/B,mBAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,mBAAA,IAAA,eAAM,EAAC,gCAAqB,CAAC,CAAA;IAK7B,mBAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,mBAAA,IAAA,eAAM,EAAC,uCAA4B,CAAC,CAAA;6DAJH,8DAA4B;QAC/B,wDAAyB;QACzB,2CAAmB;GAVzC,wBAAwB,CAiKpC;AAED,YAAY"}

package/core/src/lib/runtime/runtime-execution-mode.registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-execution-mode.registry.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/core/src/lib/runtime/runtime-execution-mode.registry.ts"],"names":[],"mappings":"AAgBA,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE9D"}
+{"version":3,"file":"runtime-execution-mode.registry.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/core/src/lib/runtime/runtime-execution-mode.registry.ts"],"names":[],"mappings":"AAkBA,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE9D"}

package/core/src/lib/runtime/runtime-execution-mode.registry.js

@@ -9,9 +9,11 @@ exports.isFrontendOnlyRuntimeKey = isFrontendOnlyRuntimeKey;
 const FRONTEND_ONLY_KEYS = new Set([
     'Entity:Open',
     'Entity:Create',
-    'Entity:Update',
+    'Entity:Edit',
     'Entity:View',
     'Entity:OpenDetails',
+    'Entity:Remove',
+    'Entity:Bulk',
     'WorkflowManagement.WorkflowDefinition:Execute',
     'WorkflowManagement.WorkflowDefinition:ExecuteWithInput',
 ]);

package/core/src/lib/runtime/runtime-execution-mode.registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-execution-mode.registry.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/core/src/lib/runtime/runtime-execution-mode.registry.ts"],"names":[],"mappings":";AAAA,8CAA8C;;AAgB9C,4DAEC;AAhBD;;;GAGG;AACH,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAS;IACzC,aAAa;IACb,eAAe;IACf,eAAe;IACf,aAAa;IACb,oBAAoB;IACpB,+CAA+C;IAC/C,wDAAwD;CACzD,CAAC,CAAC;AAEH,SAAgB,wBAAwB,CAAC,IAAY;IACnD,OAAO,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED,YAAY"}
+{"version":3,"file":"runtime-execution-mode.registry.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/core/src/lib/runtime/runtime-execution-mode.registry.ts"],"names":[],"mappings":";AAAA,8CAA8C;;AAkB9C,4DAEC;AAlBD;;;GAGG;AACH,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAS;IACzC,aAAa;IACb,eAAe;IACf,aAAa;IACb,aAAa;IACb,oBAAoB;IACpB,eAAe;IACf,aAAa;IACb,+CAA+C;IAC/C,wDAAwD;CACzD,CAAC,CAAC;AAEH,SAAgB,wBAAwB,CAAC,IAAY;IACnD,OAAO,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED,YAAY"}

package/core/src/lib/runtime/runtime-query-invoke.controller.d.ts

@@ -1,12 +1,13 @@
+import type { Request } from 'express';
 import { RuntimeDispatcherService } from './runtime-dispatcher.service';
 import type { RuntimeQueryResult } from './runtime.types';
 /**
- * Alternate query invoke routes — optional auth, same policy as {@link RuntimeQueryController}.
+ * Alternate query invoke routes — per-key auth via {@link RuntimeAuthzGuard}.
  */
 export declare class RuntimeQueryInvokeController {
     private readonly dispatcher;
     constructor(dispatcher: RuntimeDispatcherService);
-    invokeByQuery(name: string, input: unknown): Promise<RuntimeQueryResult>;
-    invokeByRef(keyRef: string, input: unknown): Promise<RuntimeQueryResult>;
+    invokeByQuery(name: string, input: unknown, req: Request): Promise<RuntimeQueryResult>;
+    invokeByRef(keyRef: string, input: unknown, req: Request): Promise<RuntimeQueryResult>;
 }
 //# sourceMappingURL=runtime-query-invoke.controller.d.ts.map

package/core/src/lib/runtime/runtime-query-invoke.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-query-invoke.controller.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/core/src/lib/runtime/runtime-query-invoke.controller.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AACxE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAO1D;;GAEG;AACH,qBAGa,4BAA4B;IAC3B,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAAV,UAAU,EAAE,wBAAwB;IAK3D,aAAa,CACF,IAAI,EAAE,MAAM,EACnB,KAAK,EAAE,OAAO,GACrB,OAAO,CAAC,kBAAkB,CAAC;IAOxB,WAAW,CACE,MAAM,EAAE,MAAM,EACvB,KAAK,EAAE,OAAO,GACrB,OAAO,CAAC,kBAAkB,CAAC;CAG/B"}
+{"version":3,"file":"runtime-query-invoke.controller.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/core/src/lib/runtime/runtime-query-invoke.controller.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAEvC,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAExE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAO1D;;GAEG;AACH,qBAKa,4BAA4B;IAC3B,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAAV,UAAU,EAAE,wBAAwB;IAK3D,aAAa,CACF,IAAI,EAAE,MAAM,EACnB,KAAK,EAAE,OAAO,EACf,GAAG,EAAE,OAAO,GAClB,OAAO,CAAC,kBAAkB,CAAC;IAOxB,WAAW,CACE,MAAM,EAAE,MAAM,EACvB,KAAK,EAAE,OAAO,EACf,GAAG,EAAE,OAAO,GAClB,OAAO,CAAC,kBAAkB,CAAC;CAK/B"}

package/core/src/lib/runtime/runtime-query-invoke.controller.js

@@ -5,48 +5,54 @@ exports.RuntimeQueryInvokeController = void 0;
 const tslib_1 = require("tslib");
 const common_1 = require("@nestjs/common");
 const swagger_1 = require("@nestjs/swagger");
+const runtime_authz_guard_1 = require("./runtime-authz.guard");
 const runtime_dispatcher_service_1 = require("./runtime-dispatcher.service");
+const runtime_request_context_util_1 = require("./runtime-request-context.util");
 const runtime_key_ref_util_1 = require("./utils/runtime-key-ref.util");
 //#endregion
 //#region ---- Runtime query invoke (query / by-ref) ----
 /**
- * Alternate query invoke routes — optional auth, same policy as {@link RuntimeQueryController}.
+ * Alternate query invoke routes — per-key auth via {@link RuntimeAuthzGuard}.
  */
 let RuntimeQueryInvokeController = class RuntimeQueryInvokeController {
     constructor(dispatcher) {
         this.dispatcher = dispatcher;
     }
-    async invokeByQuery(name, input) {
-        return this.dispatcher.executeQuery(name, input);
+    async invokeByQuery(name, input, req) {
+        return (0, runtime_request_context_util_1.runInRuntimeRequestContext)(req, () => this.dispatcher.executeQuery(name, input));
     }
-    async invokeByRef(keyRef, input) {
-        return this.dispatcher.executeQuery((0, runtime_key_ref_util_1.decodeRuntimeKeyRef)(keyRef), input);
+    async invokeByRef(keyRef, input, req) {
+        return (0, runtime_request_context_util_1.runInRuntimeRequestContext)(req, () => this.dispatcher.executeQuery((0, runtime_key_ref_util_1.decodeRuntimeKeyRef)(keyRef), input));
     }
 };
 exports.RuntimeQueryInvokeController = RuntimeQueryInvokeController;
 tslib_1.__decorate([
     (0, common_1.Post)('invoke'),
     (0, common_1.HttpCode)(common_1.HttpStatus.OK),
-    (0, swagger_1.ApiOperation)({ summary: 'Execute query by query name (body = input only; optional Bearer)' }),
+    (0, swagger_1.ApiOperation)({ summary: 'Execute query by query name (body = input only)' }),
     tslib_1.__param(0, (0, common_1.Query)('name')),
     tslib_1.__param(1, (0, common_1.Body)()),
+    tslib_1.__param(2, (0, common_1.Req)()),
     tslib_1.__metadata("design:type", Function),
-    tslib_1.__metadata("design:paramtypes", [String, Object]),
+    tslib_1.__metadata("design:paramtypes", [String, Object, Object]),
     tslib_1.__metadata("design:returntype", Promise)
 ], RuntimeQueryInvokeController.prototype, "invokeByQuery", null);
 tslib_1.__decorate([
     (0, common_1.Post)('by-ref/:keyRef'),
     (0, common_1.HttpCode)(common_1.HttpStatus.OK),
-    (0, swagger_1.ApiOperation)({ summary: 'Execute query by URL-safe key ref (body = input only; optional Bearer)' }),
+    (0, swagger_1.ApiOperation)({ summary: 'Execute query by URL-safe key ref (body = input only)' }),
     tslib_1.__param(0, (0, common_1.Param)('keyRef')),
     tslib_1.__param(1, (0, common_1.Body)()),
+    tslib_1.__param(2, (0, common_1.Req)()),
     tslib_1.__metadata("design:type", Function),
-    tslib_1.__metadata("design:paramtypes", [String, Object]),
+    tslib_1.__metadata("design:paramtypes", [String, Object, Object]),
     tslib_1.__metadata("design:returntype", Promise)
 ], RuntimeQueryInvokeController.prototype, "invokeByRef", null);
 exports.RuntimeQueryInvokeController = RuntimeQueryInvokeController = tslib_1.__decorate([
     (0, swagger_1.ApiExcludeController)(),
     (0, swagger_1.ApiTags)('runtime'),
+    (0, swagger_1.ApiBearerAuth)(),
+    (0, common_1.UseGuards)(runtime_authz_guard_1.RuntimeAuthzGuard),
     (0, common_1.Controller)('v1/runtime/queries'),
     tslib_1.__metadata("design:paramtypes", [runtime_dispatcher_service_1.RuntimeDispatcherService])
 ], RuntimeQueryInvokeController);

package/core/src/lib/runtime/runtime-query-invoke.controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-query-invoke.controller.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/core/src/lib/runtime/runtime-query-invoke.controller.ts"],"names":[],"mappings":";AAAA,2BAA2B;;;;AAE3B,2CAA4F;AAC5F,6CAA8E;AAC9E,6EAAwE;AAExE,uEAAmE;AAEnE,YAAY;AAEZ,yDAAyD;AAEzD;;GAEG;AAII,IAAM,4BAA4B,GAAlC,MAAM,4BAA4B;IACvC,YAA6B,UAAoC;QAApC,eAAU,GAAV,UAAU,CAA0B;IAAG,CAAC;IAK/D,AAAN,KAAK,CAAC,aAAa,CACF,IAAY,EACnB,KAAc;QAEtB,OAAO,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACnD,CAAC;IAKK,AAAN,KAAK,CAAC,WAAW,CACE,MAAc,EACvB,KAAc;QAEtB,OAAO,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,IAAA,0CAAmB,EAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;IAC1E,CAAC;CACF,CAAA;AAtBY,oEAA4B;AAMjC;IAHL,IAAA,aAAI,EAAC,QAAQ,CAAC;IACd,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,kEAAkE,EAAE,CAAC;IAE3F,mBAAA,IAAA,cAAK,EAAC,MAAM,CAAC,CAAA;IACb,mBAAA,IAAA,aAAI,GAAE,CAAA;;;;iEAGR;AAKK;IAHL,IAAA,aAAI,EAAC,gBAAgB,CAAC;IACtB,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,wEAAwE,EAAE,CAAC;IAEjG,mBAAA,IAAA,cAAK,EAAC,QAAQ,CAAC,CAAA;IACf,mBAAA,IAAA,aAAI,GAAE,CAAA;;;;+DAGR;uCArBU,4BAA4B;IAHxC,IAAA,8BAAoB,GAAE;IACtB,IAAA,iBAAO,EAAC,SAAS,CAAC;IAClB,IAAA,mBAAU,EAAC,oBAAoB,CAAC;6CAEU,qDAAwB;GADtD,4BAA4B,CAsBxC;AAED,YAAY"}
+{"version":3,"file":"runtime-query-invoke.controller.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/core/src/lib/runtime/runtime-query-invoke.controller.ts"],"names":[],"mappings":";AAAA,2BAA2B;;;;AAE3B,2CAA4G;AAC5G,6CAA6F;AAE7F,+DAA0D;AAC1D,6EAAwE;AACxE,iFAA4E;AAE5E,uEAAmE;AAEnE,YAAY;AAEZ,yDAAyD;AAEzD;;GAEG;AAMI,IAAM,4BAA4B,GAAlC,MAAM,4BAA4B;IACvC,YAA6B,UAAoC;QAApC,eAAU,GAAV,UAAU,CAA0B;IAAG,CAAC;IAK/D,AAAN,KAAK,CAAC,aAAa,CACF,IAAY,EACnB,KAAc,EACf,GAAY;QAEnB,OAAO,IAAA,yDAA0B,EAAC,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IAC1F,CAAC;IAKK,AAAN,KAAK,CAAC,WAAW,CACE,MAAc,EACvB,KAAc,EACf,GAAY;QAEnB,OAAO,IAAA,yDAA0B,EAAC,GAAG,EAAE,GAAG,EAAE,CAC1C,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,IAAA,0CAAmB,EAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CACjE,CAAC;IACJ,CAAC;CACF,CAAA;AA1BY,oEAA4B;AAMjC;IAHL,IAAA,aAAI,EAAC,QAAQ,CAAC;IACd,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,iDAAiD,EAAE,CAAC;IAE1E,mBAAA,IAAA,cAAK,EAAC,MAAM,CAAC,CAAA;IACb,mBAAA,IAAA,aAAI,GAAE,CAAA;IACN,mBAAA,IAAA,YAAG,GAAE,CAAA;;;;iEAGP;AAKK;IAHL,IAAA,aAAI,EAAC,gBAAgB,CAAC;IACtB,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,uDAAuD,EAAE,CAAC;IAEhF,mBAAA,IAAA,cAAK,EAAC,QAAQ,CAAC,CAAA;IACf,mBAAA,IAAA,aAAI,GAAE,CAAA;IACN,mBAAA,IAAA,YAAG,GAAE,CAAA;;;;+DAKP;uCAzBU,4BAA4B;IALxC,IAAA,8BAAoB,GAAE;IACtB,IAAA,iBAAO,EAAC,SAAS,CAAC;IAClB,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,uCAAiB,CAAC;IAC5B,IAAA,mBAAU,EAAC,oBAAoB,CAAC;6CAEU,qDAAwB;GADtD,4BAA4B,CA0BxC;AAED,YAAY"}

package/core/src/lib/runtime/runtime-query.controller.d.ts

@@ -1,14 +1,13 @@
+import type { Request } from 'express';
 import { RuntimeDispatcherService } from './runtime-dispatcher.service';
 import type { RuntimeQueryRequestBody, RuntimeQueryResult } from './runtime.types';
 /**
- * Query execute endpoint — auth is optional (same model as entity-storage REST).
- * {@link OptionalJwtSessionMiddleware} populates session when a Bearer token is present;
- * unauthenticated reads stay allowed for bootstrap / reference data (e.g. timezones).
- * Mutations stay on {@link RuntimeCommandController} which requires JWT.
+ * Query execute endpoint — auth is enforced per-key via {@link RuntimeAuthzGuard}
+ * and {@link RuntimeAuthzService}. Public keys (e.g. bootstrap reference data) skip JWT.
  */
 export declare class RuntimeQueryController {
     private readonly dispatcher;
     constructor(dispatcher: RuntimeDispatcherService);
-    execute(body: RuntimeQueryRequestBody): Promise<RuntimeQueryResult>;
+    execute(body: RuntimeQueryRequestBody, req: Request): Promise<RuntimeQueryResult>;
 }
 //# sourceMappingURL=runtime-query.controller.d.ts.map

package/core/src/lib/runtime/runtime-query.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-query.controller.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/core/src/lib/runtime/runtime-query.controller.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AACxE,OAAO,KAAK,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAMnF;;;;;GAKG;AACH,qBAEa,sBAAsB;IACrB,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAAV,UAAU,EAAE,wBAAwB;IAO3D,OAAO,CAAS,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,kBAAkB,CAAC;CAGlF"}
+{"version":3,"file":"runtime-query.controller.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/core/src/lib/runtime/runtime-query.controller.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAEvC,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAExE,OAAO,KAAK,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAMnF;;;GAGG;AACH,qBAIa,sBAAsB;IACrB,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAAV,UAAU,EAAE,wBAAwB;IAO3D,OAAO,CACH,IAAI,EAAE,uBAAuB,EAC9B,GAAG,EAAE,OAAO,GAClB,OAAO,CAAC,kBAAkB,CAAC;CAK/B"}

package/core/src/lib/runtime/runtime-query.controller.js

@@ -5,21 +5,21 @@ exports.RuntimeQueryController = void 0;
 const tslib_1 = require("tslib");
 const common_1 = require("@nestjs/common");
 const swagger_1 = require("@nestjs/swagger");
+const runtime_authz_guard_1 = require("./runtime-authz.guard");
 const runtime_dispatcher_service_1 = require("./runtime-dispatcher.service");
+const runtime_request_context_util_1 = require("./runtime-request-context.util");
 //#endregion
 //#region ---- Runtime query controller ----
 /**
- * Query execute endpoint — auth is optional (same model as entity-storage REST).
- * {@link OptionalJwtSessionMiddleware} populates session when a Bearer token is present;
- * unauthenticated reads stay allowed for bootstrap / reference data (e.g. timezones).
- * Mutations stay on {@link RuntimeCommandController} which requires JWT.
+ * Query execute endpoint — auth is enforced per-key via {@link RuntimeAuthzGuard}
+ * and {@link RuntimeAuthzService}. Public keys (e.g. bootstrap reference data) skip JWT.
  */
 let RuntimeQueryController = class RuntimeQueryController {
     constructor(dispatcher) {
         this.dispatcher = dispatcher;
     }
-    async execute(body) {
-        return this.dispatcher.executeQuery(body.name, body.input);
+    async execute(body, req) {
+        return (0, runtime_request_context_util_1.runInRuntimeRequestContext)(req, () => this.dispatcher.executeQuery(body.name, body.input, body.options));
     }
 };
 exports.RuntimeQueryController = RuntimeQueryController;
@@ -30,12 +30,15 @@ tslib_1.__decorate([
         summary: 'Execute a registered or default entity query (optional Bearer token)',
     }),
     tslib_1.__param(0, (0, common_1.Body)()),
+    tslib_1.__param(1, (0, common_1.Req)()),
     tslib_1.__metadata("design:type", Function),
-    tslib_1.__metadata("design:paramtypes", [Object]),
+    tslib_1.__metadata("design:paramtypes", [Object, Object]),
     tslib_1.__metadata("design:returntype", Promise)
 ], RuntimeQueryController.prototype, "execute", null);
 exports.RuntimeQueryController = RuntimeQueryController = tslib_1.__decorate([
     (0, swagger_1.ApiTags)('runtime'),
+    (0, swagger_1.ApiBearerAuth)(),
+    (0, common_1.UseGuards)(runtime_authz_guard_1.RuntimeAuthzGuard),
     (0, common_1.Controller)('v1/runtime/queries'),
     tslib_1.__metadata("design:paramtypes", [runtime_dispatcher_service_1.RuntimeDispatcherService])
 ], RuntimeQueryController);

package/core/src/lib/runtime/runtime-query.controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-query.controller.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/core/src/lib/runtime/runtime-query.controller.ts"],"names":[],"mappings":";AAAA,2BAA2B;;;;AAE3B,2CAA8E;AAC9E,6CAAwD;AACxD,6EAAwE;AAGxE,YAAY;AAEZ,4CAA4C;AAE5C;;;;;GAKG;AAGI,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IACjC,YAA6B,UAAoC;QAApC,eAAU,GAAV,UAAU,CAA0B;IAAG,CAAC;IAO/D,AAAN,KAAK,CAAC,OAAO,CAAS,IAA6B;QACjD,OAAO,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7D,CAAC;CACF,CAAA;AAXY,wDAAsB;AAQ3B;IALL,IAAA,aAAI,GAAE;IACN,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,sEAAsE;KAChF,CAAC;IACa,mBAAA,IAAA,aAAI,GAAE,CAAA;;;;qDAEpB;iCAVU,sBAAsB;IAFlC,IAAA,iBAAO,EAAC,SAAS,CAAC;IAClB,IAAA,mBAAU,EAAC,oBAAoB,CAAC;6CAEU,qDAAwB;GADtD,sBAAsB,CAWlC;AAED,YAAY"}
+{"version":3,"file":"runtime-query.controller.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/core/src/lib/runtime/runtime-query.controller.ts"],"names":[],"mappings":";AAAA,2BAA2B;;;;AAE3B,2CAA8F;AAC9F,6CAAuE;AAEvE,+DAA0D;AAC1D,6EAAwE;AACxE,iFAA4E;AAG5E,YAAY;AAEZ,4CAA4C;AAE5C;;;GAGG;AAKI,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IACjC,YAA6B,UAAoC;QAApC,eAAU,GAAV,UAAU,CAA0B;IAAG,CAAC;IAO/D,AAAN,KAAK,CAAC,OAAO,CACH,IAA6B,EAC9B,GAAY;QAEnB,OAAO,IAAA,yDAA0B,EAAC,GAAG,EAAE,GAAG,EAAE,CAC1C,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAClE,CAAC;IACJ,CAAC;CACF,CAAA;AAhBY,wDAAsB;AAQ3B;IALL,IAAA,aAAI,GAAE;IACN,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,sEAAsE;KAChF,CAAC;IAEC,mBAAA,IAAA,aAAI,GAAE,CAAA;IACN,mBAAA,IAAA,YAAG,GAAE,CAAA;;;;qDAKP;iCAfU,sBAAsB;IAJlC,IAAA,iBAAO,EAAC,SAAS,CAAC;IAClB,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,uCAAiB,CAAC;IAC5B,IAAA,mBAAU,EAAC,oBAAoB,CAAC;6CAEU,qDAAwB;GADtD,sBAAsB,CAgBlC;AAED,YAAY"}

package/core/src/lib/runtime/runtime-request-context.util.d.ts

@@ -0,0 +1,10 @@
+import type { Request } from 'express';
+/**
+ * Runs runtime dispatch inside the HTTP request ALS context so request-scoped
+ * handlers (e.g. auth commands using {@link getEntityStorageRequest}) resolve correctly.
+ *
+ * Uses both `enterWith` (survives Express middleware boundaries) and `run`
+ * (scopes the async dispatch promise).
+ */
+export declare function runInRuntimeRequestContext<T>(req: Request, fn: () => T | Promise<T>): T | Promise<T>;
+//# sourceMappingURL=runtime-request-context.util.d.ts.map