@almadar/runtime 6.37.0 → 6.39.0

package/dist/{OrbitalServerRuntime-IMGtH9rA.d.ts → OrbitalServerRuntime-C3TtYP6I.d.ts}

@@ -1,6 +1,6 @@
 import { Router } from 'express';
-import { I as IEventBus, R as RuntimeEvent, a as EventListener, U as Unsubscribe, T as TraitDefinition, b as RuntimeConfig, c as TransitionObserver, d as TraitState, C as ConfigContext, e as TransitionResult, f as EvaluationContextExtensions, E as EffectHandlers } from './types-BAD9bSMA.js';
-import { EventPayload, EventId, EntityRow, Orbital, ServiceCallResult, TraitConfig, DeclaredTraitConfig, Entity, OrbitalSchema, Trait, PatternConfig, ResolvedPatternProps, SExpr, BusEventSource, OrbitalDefinition, TraitTick } from '@almadar/core';
+import { I as IEventBus, R as RuntimeEvent, a as EventListener, U as Unsubscribe, T as TraitDefinition, b as RuntimeConfig, c as TransitionObserver, d as TraitState, C as ConfigContext, e as TransitionResult, f as EvaluationContextExtensions, E as EffectHandlers } from './types-p_L8-Sk4.js';
+import { EventPayload, EventId, EntityRow, UserContext, Orbital, ServiceCallResult, TraitConfig, DeclaredTraitConfig, Entity, OrbitalSchema, Trait, PatternConfig, ResolvedPatternProps, SExpr, BusEventSource, RawUserClaims, OrbitalDefinition, TraitTick } from '@almadar/core';
 
 /**
  * EventBus - Platform-Agnostic Pub/Sub Implementation
@@ -137,6 +137,14 @@ interface ProcessEventOptions {
      * trait's `RegisteredOrbital.configByTrait`).
      */
     config?: ConfigContext;
+    /**
+     * Authenticated viewer for `@user.X` resolution inside guard expressions.
+     * The validator admits `@user` in guard context alongside `@config`; this
+     * is the runtime side of that contract. Without it a role gate
+     * (`when ["=", @user.role, "admin"]`) can never pass, because the guard's
+     * EvaluationContext has no user to compare against.
+     */
+    user?: UserContext;
     /**
      * Guard evaluation error handling mode. (RCG-02)
      * - "permissive": Guard errors allow the transition (default, backwards-compatible)
@@ -308,7 +316,7 @@ declare class StateMachineManager {
      *
      * @returns Array of transition results (one per trait that had a matching transition)
      */
-    sendEvent(eventKey: string, payload?: EventPayload, entityData?: EntityRow, entityByTrait?: Record<string, EntityRow>, eventId?: EventId, targetTrait?: string): Array<{
+    sendEvent(eventKey: string, payload?: EventPayload, entityData?: EntityRow, entityByTrait?: Record<string, EntityRow>, eventId?: EventId, targetTrait?: string, user?: UserContext): Array<{
         traitName: string;
         result: TransitionResult;
     }>;
@@ -319,7 +327,7 @@ declare class StateMachineManager {
      * trait to process them sequentially (actor-model guarantee: one event
      * at a time per trait, effects fully awaited before the next event).
      */
-    enqueueEvent(eventKey: string, payload?: EventPayload, entityData?: EntityRow, entityByTrait?: Record<string, EntityRow>, eventId?: EventId): void;
+    enqueueEvent(eventKey: string, payload?: EventPayload, entityData?: EntityRow, entityByTrait?: Record<string, EntityRow>, eventId?: EventId, user?: UserContext): void;
     /**
      * Drain a single (trait, entity) pair's event queue, processing
      * events sequentially. Pass `entityId` to drain a specific entity
@@ -952,13 +960,8 @@ interface OrbitalEventRequest {
      * initializer (R-SCOPED-LISTEN-INIT-RENAME-FREEZE re-fire cascade).
      */
     targetTrait?: string;
-    /** User context for @user bindings (from Firebase auth) */
-    user?: {
-        uid: string;
-        email?: string;
-        displayName?: string;
-        [key: string]: unknown;
-    };
+    /** Provider claims for `@user` bindings, normalized by `normalizeUserContext`. */
+    user?: RawUserClaims;
     /** Per-tab client identity (UUID) — excludes this request's origin from live-broadcast delivery. */
     clientId?: string;
 }
@@ -1101,6 +1104,28 @@ interface OrbitalServerRuntimeConfig {
      * @almadar-io/rabit injects these at runtime; tests can inject mocks.
      */
     substrateServices?: SubstrateServices;
+    /**
+     * Viewer identity used when a request carries no authenticated user — the
+     * persona a preview or verification run is looking at the app AS.
+     *
+     * `@user.id` / `@user.role` are what an app's ownership scoping and role
+     * gates resolve against, so with no user every predicate takes its negative
+     * branch and every owner filter matches nothing. A host that has real auth
+     * leaves this unset and the request's own user always wins; a dev host
+     * (playground, runtime-verify) sets it to make both branches reachable.
+     *
+     * Never a fallback for production auth: an authenticated request is not
+     * overridden, and a host that sets this is declaring itself a dev host.
+     */
+    defaultUser?: UserContext;
+    /**
+     * Seeded columns that hold a user id, as `Entity.field` pairs (e.g.
+     * `RosterEntry.memberId`). In mock mode the `defaultUser` is assigned to
+     * every other seeded row of each named column, so a scoped view has real
+     * rows and a second persona sees the complement. Explicit by design — the
+     * seeder never guesses an owner column from its name.
+     */
+    mockOwnerFields?: string[];
 }
 
 declare class OrbitalServerRuntime {
@@ -1299,6 +1324,15 @@ declare class OrbitalServerRuntime {
      * every OTHER connected client; a fresh call replaces the previous sink.
      */
     setLiveBroadcastSink(sink: (item: LiveBroadcastItem) => void): void;
+    /**
+     * Switch the viewer a dev host presents the app as — see
+     * `OrbitalServerRuntimeConfig.defaultUser`. Pass `undefined` for an
+     * unauthenticated viewer. Takes effect on the next event; an authenticated
+     * request still overrides it.
+     */
+    setDefaultUser(user: UserContext | undefined): void;
+    /** The viewer a dev host is currently presenting the app as. */
+    getDefaultUser(): UserContext | undefined;
     /**
      * Process an event for an orbital
      *

package/dist/OrbitalServerRuntime.d.ts

@@ -1,4 +1,4 @@
 import 'express';
-export { F as ClientEffectTuple, G as ClientNavigateTuple, H as ClientNotifyTuple, J as ClientRenderUITuple, K as EffectResult, e as InMemoryPersistence, M as LiveBroadcastItem, N as LoaderConfig, O as OrbitalEventRequest, f as OrbitalEventResponse, Q as OrbitalServerRuntime, g as OrbitalServerRuntimeConfig, P as PersistenceAdapter, R as RegisteredOrbital, l as RuntimeOrbital, m as RuntimeOrbitalSchema, n as RuntimeTrait, T as RuntimeTraitTick, p as collectDeclaredConfigDefaults, V as createOrbitalServerRuntime } from './OrbitalServerRuntime-IMGtH9rA.js';
-import './types-BAD9bSMA.js';
+export { F as ClientEffectTuple, G as ClientNavigateTuple, H as ClientNotifyTuple, J as ClientRenderUITuple, K as EffectResult, e as InMemoryPersistence, M as LiveBroadcastItem, N as LoaderConfig, O as OrbitalEventRequest, f as OrbitalEventResponse, Q as OrbitalServerRuntime, g as OrbitalServerRuntimeConfig, P as PersistenceAdapter, R as RegisteredOrbital, l as RuntimeOrbital, m as RuntimeOrbitalSchema, n as RuntimeTrait, T as RuntimeTraitTick, p as collectDeclaredConfigDefaults, V as createOrbitalServerRuntime } from './OrbitalServerRuntime-C3TtYP6I.js';
+import './types-p_L8-Sk4.js';
 import '@almadar/core';

package/dist/OrbitalServerRuntime.js

@@ -1,13 +1,13 @@
-import { createTickScheduler, EventBus, createUnifiedLoader, MockPersistenceAdapter, InMemoryPersistence, preprocessSchema, normalizeCallSiteConfigToValues, StateMachineManager, parseDurationString, createContextFromBindings, validateEventPayload, formatPayloadValidationError, collectDeclaredConfigDefaults, resolveCallSitePayloadCaptures, collectDeclaredEntityDefaults, EffectExecutor } from './chunk-5XS7DD4H.js';
-export { InMemoryPersistence, collectDeclaredConfigDefaults } from './chunk-5XS7DD4H.js';
+import { createTickScheduler, EventBus, createUnifiedLoader, MockPersistenceAdapter, InMemoryPersistence, preprocessSchema, normalizeCallSiteConfigToValues, StateMachineManager, parseDurationString, createContextFromBindings, validateEventPayload, formatPayloadValidationError, collectDeclaredConfigDefaults, resolveCallSitePayloadCaptures, collectDeclaredEntityDefaults, EffectExecutor } from './chunk-WC5HVSMY.js';
+export { InMemoryPersistence, collectDeclaredConfigDefaults } from './chunk-WC5HVSMY.js';
 import { isValidCronExpression } from './chunk-OU3ITB5S.js';
 import './chunk-OQJIK6PZ.js';
 import './chunk-SCRAHWOC.js';
 import './chunk-MLKGABMK.js';
 import { createLogger } from '@almadar/logger';
 import * as nodeModule from 'module';
-import { evaluateGuard, evaluate } from '@almadar/evaluator';
-import { buildResolvedTraitConfigs, isInlineTrait, isEntityCall, applyListenPayloadMapping } from '@almadar/core';
+import { evaluateListenPayloadExpr, evaluateGuard, evaluate } from '@almadar/evaluator';
+import { buildResolvedTraitConfigs, isInlineTrait, isEntityCall, applyListenPayloadMapping, normalizeUserContext } from '@almadar/core';
 
 // src/identity/routing.ts
 function eventRouteKey(eventName, eventId) {
@@ -131,7 +131,12 @@ var OrbitalServerRuntime = class {
       this.persistence = new MockPersistenceAdapter({
         seed: config.mockSeed,
         defaultSeedCount: config.mockSeedCount ?? 6,
-        debug: config.debug
+        debug: config.debug,
+        // Let the dev viewer own some seeded rows, so ownership-scoped views
+        // ("only mine") have data instead of being indistinguishable from a
+        // broken filter. Columns are declared, never inferred by name.
+        ownerId: config.defaultUser?.id,
+        ownerFields: config.mockOwnerFields
       });
       if (config.debug) {
         persistLog.debug("mock:init", { adapter: "MockPersistenceAdapter" });
@@ -618,7 +623,8 @@ var OrbitalServerRuntime = class {
             }
             const mappedPayload = applyListenPayloadMapping(
               listener.payloadMapping,
-              event.payload
+              event.payload,
+              evaluateListenPayloadExpr
             );
             const raw = event.payload;
             const mapped = mappedPayload;
@@ -725,7 +731,9 @@ var OrbitalServerRuntime = class {
             const ctx = createContextFromBindings({
               entity,
               payload: {},
-              state: registered.manager.getState(traitName)?.currentState || "unknown"
+              state: registered.manager.getState(traitName)?.currentState || "unknown",
+              // A tick has no request user; only a dev host's ambient persona.
+              user: this.config.defaultUser
             }, false, this.config.contextExtensions);
             const guardPasses = evaluateGuard(
               tick.guard,
@@ -764,7 +772,8 @@ var OrbitalServerRuntime = class {
             emittedEvents,
             fetchedData,
             clientEffects,
-            tickEffectResults
+            tickEffectResults,
+            this.config.defaultUser
           );
           if (this.config.debug) {
             effectLog.debug("tick:effects-executed", () => ({
@@ -847,6 +856,19 @@ var OrbitalServerRuntime = class {
   setLiveBroadcastSink(sink) {
     this.liveBroadcastSink = sink;
   }
+  /**
+   * Switch the viewer a dev host presents the app as — see
+   * `OrbitalServerRuntimeConfig.defaultUser`. Pass `undefined` for an
+   * unauthenticated viewer. Takes effect on the next event; an authenticated
+   * request still overrides it.
+   */
+  setDefaultUser(user) {
+    this.config.defaultUser = user;
+  }
+  /** The viewer a dev host is currently presenting the app as. */
+  getDefaultUser() {
+    return this.config.defaultUser;
+  }
   // ==========================================================================
   // Event Processing
   // ==========================================================================
@@ -902,7 +924,8 @@ var OrbitalServerRuntime = class {
           request.payload?.["_activeTraits"] ?? null
         )
       }));
-      const { event, eventId, payload, entityId, user, clientId } = request;
+      const { event, eventId, payload, entityId, user: requestUser, clientId } = request;
+      const viewer = normalizeUserContext(requestUser) ?? this.config.defaultUser;
       const targetTrait = request.targetTrait ?? payload?.["_targetTrait"];
       const validationFailures = [];
       for (const trait of registered.traits) {
@@ -955,7 +978,8 @@ var OrbitalServerRuntime = class {
         entityData,
         entityByTrait,
         eventId,
-        targetTrait
+        targetTrait,
+        viewer
       );
       const filteredResults = activeTraits && activeTraits.length > 0 ? results.filter(({ traitName }) => activeTraits.includes(traitName)) : results;
       if (this.config.debug && activeTraits) {
@@ -978,7 +1002,7 @@ var OrbitalServerRuntime = class {
             fetchedData,
             clientEffects,
             effectResults,
-            user,
+            viewer,
             clientEffectsByTrait,
             onPush,
             clientId
@@ -1312,7 +1336,7 @@ var OrbitalServerRuntime = class {
               const predicate = options.filter;
               entities = entities.filter((entity) => {
                 const ctx = createContextFromBindings(
-                  { entity, payload: bindingsRef?.payload, current: entity },
+                  { entity, payload: bindingsRef?.payload, current: entity, user: bindingsRef?.user },
                   false
                 );
                 try {
@@ -1530,7 +1554,6 @@ var OrbitalServerRuntime = class {
       payload,
       state: state?.currentState || "unknown",
       user
-      // @user bindings from Firebase auth
     };
     const traitDef = registered.traits.find((t) => t.name === traitName);
     const declaredDefaults = collectDeclaredConfigDefaults(traitDef);

package/dist/ServerBridge.d.ts

@@ -1,4 +1,4 @@
-import { I as IEventBus } from './types-BAD9bSMA.js';
+import { I as IEventBus } from './types-p_L8-Sk4.js';
 import { EventPayload } from '@almadar/core';
 
 /**

package/dist/{chunk-5XS7DD4H.js → chunk-WC5HVSMY.js}

@@ -523,6 +523,9 @@ function createContextFromBindings(bindings, strictBindings, contextExtensions)
   if (bindings.config) {
     ctx.config = bindings.config;
   }
+  if (bindings.user) {
+    ctx.user = bindings.user;
+  }
   if (bindings.locals) {
     ctx.locals = bindings.locals;
   }
@@ -579,6 +582,7 @@ function processEvent(options) {
     payload,
     entityData,
     config,
+    user,
     guardMode = "permissive",
     strictBindings = false,
     contextExtensions
@@ -619,7 +623,8 @@ function processEvent(options) {
       // list as of v3.12.0). createContextFromBindings already
       // propagates `bindings.config` to ctx.config when present —
       // we just need to pass it through here.
-      config
+      config,
+      user
     }, strictBindings, contextExtensions);
     try {
       const guardPasses = evaluateGuard(
@@ -956,7 +961,7 @@ var StateMachineManager = class {
    *
    * @returns Array of transition results (one per trait that had a matching transition)
    */
-  sendEvent(eventKey, payload, entityData, entityByTrait, eventId, targetTrait) {
+  sendEvent(eventKey, payload, entityData, entityByTrait, eventId, targetTrait, user) {
     const results = [];
     const scope = scopeOf(entityData);
     for (const [traitName, trait] of this.traits) {
@@ -973,6 +978,7 @@ var StateMachineManager = class {
         payload,
         entityData: perTraitEntity,
         config: this.traitConfigs.get(traitName),
+        user,
         guardMode: this.config.guardMode,
         strictBindings: this.config.strictBindings,
         contextExtensions: this.config.contextExtensions
@@ -1011,12 +1017,12 @@ var StateMachineManager = class {
    * trait to process them sequentially (actor-model guarantee: one event
    * at a time per trait, effects fully awaited before the next event).
    */
-  enqueueEvent(eventKey, payload, entityData, entityByTrait, eventId) {
+  enqueueEvent(eventKey, payload, entityData, entityByTrait, eventId, user) {
     const scope = scopeOf(entityData);
     for (const [traitName] of this.traits) {
       const key = compositeKey(traitName, scope);
       const queue = this.queues.get(key) ?? [];
-      queue.push({ eventKey, eventId, payload, entityData, entityByTrait });
+      queue.push({ eventKey, eventId, payload, entityData, entityByTrait, user });
       this.queues.set(key, queue);
     }
   }
@@ -1045,6 +1051,7 @@ var StateMachineManager = class {
         payload: entry.payload,
         entityData: perTraitEntity,
         config: this.traitConfigs.get(traitName),
+        user: entry.user,
         guardMode: this.config.guardMode,
         strictBindings: this.config.strictBindings,
         contextExtensions: this.config.contextExtensions
@@ -2459,9 +2466,14 @@ var MockPersistenceAdapter = class _MockPersistenceAdapter {
     if (this.config.debug) {
       mockLog.debug("seeding", { count, entity: entityName });
     }
+    const ownerCols = (this.config.ownerFields ?? []).map((pair) => pair.split(".")).filter(([ent]) => ent?.toLowerCase() === normalized).map(([, field]) => field).filter((field) => Boolean(field));
+    const ownerId = this.config.ownerId;
     const generated = [];
     for (let i = 0; i < count; i++) {
       const item = this.generateMockItem(normalized, entityName, fields, i + 1);
+      if (ownerId && ownerCols.length > 0 && i % 2 === 0) {
+        for (const col of ownerCols) item[col] = ownerId;
+      }
       store.set(item.id, item);
       generated.push({
         id: item.id,
@@ -3088,7 +3100,7 @@ async function getExternalLoaderModule() {
     return null;
   }
   try {
-    externalLoaderModule = await import('./external-loader-FNK5AU6U.js');
+    externalLoaderModule = await import('./external-loader-QDDKZMKG.js');
     return externalLoaderModule;
   } catch {
     return null;
@@ -3956,7 +3968,7 @@ var ReferenceResolver = class {
     if (this.loader || this.loaderInitialized) return;
     this.loaderInitialized = true;
     try {
-      const { ExternalOrbitalLoader } = await import('./external-loader-FNK5AU6U.js');
+      const { ExternalOrbitalLoader } = await import('./external-loader-QDDKZMKG.js');
       this.loader = new ExternalOrbitalLoader(this.options);
     } catch {
     }

package/dist/createOsHandlers.d.ts

@@ -1,4 +1,4 @@
-import { E as EffectHandlers } from './types-BAD9bSMA.js';
+import { E as EffectHandlers } from './types-p_L8-Sk4.js';
 import { EventPayload } from '@almadar/core';
 
 /**

package/dist/{external-loader-FNK5AU6U.js → external-loader-QDDKZMKG.js}

@@ -267,7 +267,6 @@ var ExternalOrbitalLoader = class {
     }
     const relativePath = importPath.slice(4);
     const name = relativePath.replace(/^behaviors\//, "").replace(/\.orb$/, "");
-    const topics = ["core", "core-variations", "agent", "game", "service", "app", "probes", "marketing"];
     const tiers = ["atoms", "molecules", "organisms"];
     const roots = [];
     if (this.options.stdLibPath) roots.push(path.normalize(this.options.stdLibPath));
@@ -278,6 +277,8 @@ var ExternalOrbitalLoader = class {
     let totalCandidates = 0;
     for (const root of roots) {
       const candidates = [];
+      const registryRoot = path.join(root, "behaviors", "registry");
+      const topics = fs.existsSync(registryRoot) ? fs.readdirSync(registryRoot, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name) : [];
       for (const topic of topics) {
         for (const tier of tiers) {
           candidates.push(path.join(root, "behaviors", "registry", topic, tier, `${name}.orb`));

package/dist/index.d.ts

@@ -1,7 +1,7 @@
-import { B as BindingContext, f as EvaluationContextExtensions, P as PatternProps, E as EffectHandlers, g as EffectContext, h as ExecutionEnvironment, i as EffectResult, T as TraitDefinition } from './types-BAD9bSMA.js';
-export { j as BrowserFileMeta, k as BrowserFilePickerOptions, l as BrowserGeolocationOptions, m as BrowserGeolocationPosition, C as ConfigContext, n as Effect, a as EventListener, H as HANDLER_MANIFEST, I as IEventBus, b as RuntimeConfig, R as RuntimeEvent, d as TraitState, c as TransitionObserver, e as TransitionResult, U as Unsubscribe } from './types-BAD9bSMA.js';
-import { U as UnifiedLoaderOptions, S as SchemaLoader, I as ImportChainLike, L as LoadResult, a as LoadedSchema, b as LoadedOrbital, P as PersistenceAdapter } from './OrbitalServerRuntime-IMGtH9rA.js';
-export { E as EntitySharingMap, c as EventBus, d as EventNamespaceMap, e as InMemoryPersistence, O as OrbitalEventRequest, f as OrbitalEventResponse, g as OrbitalServerRuntimeConfig, h as PreprocessOptions, i as PreprocessResult, j as PreprocessedSchema, k as ProcessEventOptions, R as RegisteredOrbital, l as RuntimeOrbital, m as RuntimeOrbitalSchema, n as RuntimeTrait, o as StateMachineManager, p as collectDeclaredConfigDefaults, q as collectDeclaredEntityDefaults, r as createInitialTraitState, s as findInitialState, t as findTransition, u as getIsolatedCollectionName, v as getNamespacedEvent, w as isBrowser, x as isElectron, y as isNamespacedEvent, z as isNode, A as normalizeEventKey, B as parseNamespacedEvent, C as preprocessSchema, D as processEvent } from './OrbitalServerRuntime-IMGtH9rA.js';
+import { B as BindingContext, f as EvaluationContextExtensions, P as PatternProps, E as EffectHandlers, g as EffectContext, h as ExecutionEnvironment, i as EffectResult, T as TraitDefinition } from './types-p_L8-Sk4.js';
+export { j as BrowserFileMeta, k as BrowserFilePickerOptions, l as BrowserGeolocationOptions, m as BrowserGeolocationPosition, C as ConfigContext, n as Effect, a as EventListener, H as HANDLER_MANIFEST, I as IEventBus, b as RuntimeConfig, R as RuntimeEvent, d as TraitState, c as TransitionObserver, e as TransitionResult, U as Unsubscribe } from './types-p_L8-Sk4.js';
+import { U as UnifiedLoaderOptions, S as SchemaLoader, I as ImportChainLike, L as LoadResult, a as LoadedSchema, b as LoadedOrbital, P as PersistenceAdapter } from './OrbitalServerRuntime-C3TtYP6I.js';
+export { E as EntitySharingMap, c as EventBus, d as EventNamespaceMap, e as InMemoryPersistence, O as OrbitalEventRequest, f as OrbitalEventResponse, g as OrbitalServerRuntimeConfig, h as PreprocessOptions, i as PreprocessResult, j as PreprocessedSchema, k as ProcessEventOptions, R as RegisteredOrbital, l as RuntimeOrbital, m as RuntimeOrbitalSchema, n as RuntimeTrait, o as StateMachineManager, p as collectDeclaredConfigDefaults, q as collectDeclaredEntityDefaults, r as createInitialTraitState, s as findInitialState, t as findTransition, u as getIsolatedCollectionName, v as getNamespacedEvent, w as isBrowser, x as isElectron, y as isNamespacedEvent, z as isNode, A as normalizeEventKey, B as parseNamespacedEvent, C as preprocessSchema, D as processEvent } from './OrbitalServerRuntime-C3TtYP6I.js';
 import { EvaluationContext, SExpressionEvaluator } from '@almadar/evaluator';
 export { EvaluationContext, createMinimalContext } from '@almadar/evaluator';
 import { TraitConfigObject, EventPayload, PatternConfig, EntityId, EntityField, EntityRow, ServiceParams, PayloadField, OrbitalDefinition, OrbitalSchema } from '@almadar/core';
@@ -553,6 +553,21 @@ interface MockPersistenceConfig {
     defaultSeedCount?: number;
     /** Enable debug logging */
     debug?: boolean;
+    /**
+     * Make the signed-in viewer own some of the seeded rows.
+     *
+     * An ownership-scoped view (`only my bookings`, `my prescriptions`) filters
+     * rows by `@user.id`. Faker-seeded owner columns hold random ids, so such a
+     * view is ALWAYS empty in mock mode and cannot be told apart from a broken
+     * filter — the exact ambiguity that cost this campaign a debugging cycle.
+     *
+     * `ownerFields` names the columns that hold a user id, as `Entity.field`
+     * pairs — declared explicitly, never inferred from a field's name. Every
+     * other seeded row is assigned `ownerId`, so a scoped view has real data AND
+     * the scoping stays observable (a second persona sees the complement).
+     */
+    ownerId?: string;
+    ownerFields?: string[];
 }
 /**
  * In-memory mock data store with CRUD operations and seeded mock generation.

package/dist/index.js

@@ -1,5 +1,5 @@
-import { EffectExecutor, createContextFromBindings } from './chunk-5XS7DD4H.js';
-export { CALLSITE_PAYLOAD_PREFIX, EffectExecutor, EventBus, HANDLER_MANIFEST, InMemoryPersistence, MockPersistenceAdapter, StateMachineManager, TickScheduler, buildEmitsFromTraits, collectDeclaredConfigDefaults, collectDeclaredEntityDefaults, containsBindings, createContextFromBindings, createInitialTraitState, createMinimalContext, createMockPersistence, createTestExecutor, createTickScheduler, createUnifiedLoader, extractBindings, findInitialState, findTransition, formatPayloadValidationError, getIsolatedCollectionName, getNamespacedEvent, interpolateProps, interpolateValue, isBrowser, isElectron, isNamespacedEvent, isNode, isValidDurationString, normalizeCallSiteConfigToValues, normalizeEventKey, parseDurationString, parseNamespacedEvent, preprocessSchema, processEvent, resolveCallSitePayloadCaptures, validateEventPayload, validatePayloadShapes } from './chunk-5XS7DD4H.js';
+import { EffectExecutor, createContextFromBindings } from './chunk-WC5HVSMY.js';
+export { CALLSITE_PAYLOAD_PREFIX, EffectExecutor, EventBus, HANDLER_MANIFEST, InMemoryPersistence, MockPersistenceAdapter, StateMachineManager, TickScheduler, buildEmitsFromTraits, collectDeclaredConfigDefaults, collectDeclaredEntityDefaults, containsBindings, createContextFromBindings, createInitialTraitState, createMinimalContext, createMockPersistence, createTestExecutor, createTickScheduler, createUnifiedLoader, extractBindings, findInitialState, findTransition, formatPayloadValidationError, getIsolatedCollectionName, getNamespacedEvent, interpolateProps, interpolateValue, isBrowser, isElectron, isNamespacedEvent, isNode, isValidDurationString, normalizeCallSiteConfigToValues, normalizeEventKey, parseDurationString, parseNamespacedEvent, preprocessSchema, processEvent, resolveCallSitePayloadCaptures, validateEventPayload, validatePayloadShapes } from './chunk-WC5HVSMY.js';
 export { cronMatches, cronMinuteKey, isValidCronExpression, parseCron, parseCronField } from './chunk-OU3ITB5S.js';
 import './chunk-OQJIK6PZ.js';
 export { PERF_NAMESPACE, RendererContractViolationError, adjustSchemaForMockData, aggregateSlotContent, assertIsMultiSourceSlotManager, assertIsSlotManager, bindEventBus, bindTraitStateGetter, buildMockData, buildOrbitalsByTrait, clearPerf, createSlotSetter, ensureVerificationApi, getOrbitalVerification, perfEnd, perfStart, perfStore, perfTime, prepareSchemaForPreview, pushPerfEntry, validateSlotContent, wrapCallbackForEvent } from './chunk-O5VGKPTG.js';

package/dist/{types-BAD9bSMA.d.ts → types-p_L8-Sk4.d.ts}

@@ -1,5 +1,5 @@
 import * as _almadar_core from '@almadar/core';
-import { TraitId, EventId, SExpr, AgentContext, LlmContext, WorkspaceContext, SessionContext, MemoryContext, TraceContext, IntegrationContext, TraitConfig, EventPayload, BusEvent, EntityRow, FieldValue, ServiceParams, FetchResult, PatternConfig, ResolvedPatternProps, Orbital, ServiceCallResult, BusEventSource, BusEventListener, Unsubscribe as Unsubscribe$1 } from '@almadar/core';
+import { TraitId, EventId, SExpr, TraitEventListener, AgentContext, LlmContext, WorkspaceContext, SessionContext, MemoryContext, TraceContext, IntegrationContext, TraitConfig, EventPayload, BusEvent, EntityRow, FieldValue, ServiceParams, FetchResult, PatternConfig, ResolvedPatternProps, Orbital, ServiceCallResult, BusEventSource, BusEventListener, Unsubscribe as Unsubscribe$1, UserContext } from '@almadar/core';
 
 /** Alias for ResolvedPatternProps to avoid breaking internal consumers */
 type PatternProps = ResolvedPatternProps;
@@ -93,17 +93,8 @@ interface TraitDefinition {
             effects?: SExpr[];
         };
     }>;
-    /** Cross-trait event listeners (optional) */
-    listens?: Array<{
-        event: string;
-        /** V4 dual-carry id sibling of `event` — optional until the Phase-7 flip. */
-        eventId?: EventId;
-        triggers: string;
-        /** V4 dual-carry id sibling of `triggers` — optional until the Phase-7 flip. */
-        triggersId?: EventId;
-        /** `with { ... }` payload rewrite: `{ targetField: "@payload.<sourceField>" | literal }` */
-        payloadMapping?: Record<string, string>;
-    }>;
+    /** Cross-trait event listeners (optional). Canonical shape — `@almadar/core` owns it. */
+    listens?: TraitEventListener[];
 }
 /**
  * Effect handlers interface - platform-specific implementations
@@ -314,6 +305,8 @@ interface BindingContext {
     state?: string;
     /** Trait-level state/config */
     config?: ConfigContext;
+    /** Authenticated viewer behind `@user.x` — ownership (`@user.id`) and role gates. */
+    user?: UserContext;
     /**
      * Local variables introduced by a `let` form, keyed by bare name and
      * referenced via `@<name>` (the canonical evaluator convention — same as

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@almadar/runtime",
-  "version": "6.37.0",
+  "version": "6.39.0",
   "description": "Interpreted runtime for Almadar orbital applications (OrbitalServerRuntime)",
   "type": "module",
   "main": "./dist/index.js",
@@ -52,11 +52,11 @@
     "access": "public"
   },
   "dependencies": {
-    "@almadar/core": "^10.34.0",
-    "@almadar/evaluator": "^2.35.0",
+    "@almadar/core": "^10.36.0",
+    "@almadar/evaluator": "^2.37.0",
     "@almadar/logger": "^1.10.0",
-    "@almadar/server": "^2.27.0",
-    "@almadar/std": "^16.144.0"
+    "@almadar/server": "^2.28.0",
+    "@almadar/std": "^16.146.0"
   },
   "peerDependencies": {
     "express": "^5.0.0"