@almadar/runtime 6.46.0 → 6.48.0

package/dist/OrbitalServerRuntime.js

@@ -1,6 +1,7 @@
-import { createTickScheduler, EventBus, createUnifiedLoader, MockPersistenceAdapter, InMemoryPersistence, preprocessSchema, normalizeCallSiteConfigToValues, StateMachineManager, parseDurationString, createContextFromBindings, validateEventPayload, formatPayloadValidationError, collectDeclaredConfigDefaults, resolveCallSitePayloadCaptures, collectDeclaredEntityDefaults, EffectExecutor } from './chunk-FIBEYLME.js';
-export { InMemoryPersistence, collectDeclaredConfigDefaults } from './chunk-FIBEYLME.js';
+import { createTickScheduler, EventBus, createUnifiedLoader, MockPersistenceAdapter, InMemoryPersistence, preprocessSchema, normalizeCallSiteConfigToValues, StateMachineManager, parseDurationString, validateEventPayload, formatPayloadValidationError, collectDeclaredConfigDefaults, collectDeclaredEntityDefaults, EffectExecutor } from './chunk-ML75GCRO.js';
+export { InMemoryPersistence, collectDeclaredConfigDefaults } from './chunk-ML75GCRO.js';
 import { isValidCronExpression } from './chunk-OU3ITB5S.js';
+import { createContextFromBindings, resolveCallSitePayloadCaptures, applyRowAccess, checkMutationAccess, accessDeniedMessage } from './chunk-XLMDWRMB.js';
 import './chunk-T4VDAB4C.js';
 import './chunk-SCRAHWOC.js';
 import './chunk-MLKGABMK.js';
@@ -8,7 +9,7 @@ import { createLogger } from '@almadar/logger';
 import * as nodeModule from 'module';
 import { evaluateListenPayloadExpr, evaluateGuard, evaluate } from '@almadar/evaluator';
 import { DEFAULT_VIEWER, buildResolvedTraitConfigs, isInlineTrait, isEntityCall, applyListenPayloadMapping, personaFromIdentityRow, normalizeUserContext, isRuntimeEntity } from '@almadar/core';
-import { ownerFieldsFromSchema, identityEntityName } from '@almadar/core/mock';
+import { ownerFieldsFromSchema, identityEntityName, entityAccessPolicies } from '@almadar/core/mock';
 
 // src/identity/routing.ts
 function eventRouteKey(eventName, eventId) {
@@ -1316,8 +1317,13 @@ var OrbitalServerRuntime = class {
           if (action === "create" || action === "update") {
             this.validateRelationCardinality(type, data || {});
           }
+          const accessBindings = { user: bindingsRef?.user, payload: bindingsRef?.payload, config: bindingsRef?.config };
+          const mutationPolicy = this.resolvedSchema ? entityAccessPolicies(this.resolvedSchema, type)?.[action === "create" ? "create" : action === "update" ? "update" : "delete"] : void 0;
           switch (action) {
             case "create": {
+              if (!checkMutationAccess(data || {}, mutationPolicy, accessBindings)) {
+                throw new Error(accessDeniedMessage("create", type));
+              }
               const { id } = await this.persistence.create(type, data || {});
               resultData = { id, ...data || {} };
               break;
@@ -1325,6 +1331,12 @@ var OrbitalServerRuntime = class {
             case "update":
               if (data?.id || entityId) {
                 const updateId = data?.id || entityId;
+                if (mutationPolicy !== void 0) {
+                  const existing = await this.persistence.getById(type, updateId);
+                  if (!existing || !checkMutationAccess(existing, mutationPolicy, accessBindings)) {
+                    throw new Error(accessDeniedMessage("update", type));
+                  }
+                }
                 await this.persistence.update(type, updateId, data || {});
                 const updated = await this.persistence.getById(type, updateId);
                 resultData = updated || { id: updateId, ...data || {} };
@@ -1335,6 +1347,12 @@ var OrbitalServerRuntime = class {
               const nestedId = typeof data === "object" && data !== null ? data.id : void 0;
               const deleteId = directId ?? nestedId ?? entityId;
               if (deleteId) {
+                if (mutationPolicy !== void 0) {
+                  const existing = await this.persistence.getById(type, deleteId);
+                  if (!existing || !checkMutationAccess(existing, mutationPolicy, accessBindings)) {
+                    throw new Error(accessDeniedMessage("delete", type));
+                  }
+                }
                 await this.enforceOnDeleteRules(type, deleteId);
                 await this.persistence.delete(type, deleteId);
                 resultData = { id: deleteId, deleted: true };
@@ -1423,9 +1441,11 @@ var OrbitalServerRuntime = class {
         try {
           let result = null;
           let total = 0;
+          const readPolicy = this.resolvedSchema ? entityAccessPolicies(this.resolvedSchema, fetchEntityType)?.read : void 0;
+          const accessBindings = { user: bindingsRef?.user, payload: bindingsRef?.payload, config: bindingsRef?.config };
           if (options?.id) {
             const entity = await this.persistence.getById(fetchEntityType, options.id);
-            if (entity) {
+            if (entity && applyRowAccess([entity], readPolicy, void 0, accessBindings).length > 0) {
               if (options?.include && options.include.length > 0) {
                 await this.populateRelations([entity], fetchEntityType, options.include);
               }
@@ -1435,24 +1455,12 @@ var OrbitalServerRuntime = class {
             }
           } else {
             let entities = await this.persistence.list(fetchEntityType);
-            if (options?.filter !== void 0 && options.filter !== null) {
-              const predicate = options.filter;
-              entities = entities.filter((entity) => {
-                const ctx = createContextFromBindings(
-                  { entity, payload: bindingsRef?.payload, current: entity, user: bindingsRef?.user },
-                  false
-                );
-                try {
-                  return Boolean(evaluate(predicate, ctx));
-                } catch (err) {
-                  effectLog.error("fetch:filter-eval-error", {
-                    entityType: fetchEntityType,
-                    error: err instanceof Error ? err : String(err)
-                  });
-                  return false;
-                }
-              });
-            }
+            entities = applyRowAccess(
+              entities,
+              readPolicy,
+              options?.filter !== void 0 && options.filter !== null ? options.filter : void 0,
+              accessBindings
+            );
             total = entities.length;
             if (options?.offset && options.offset > 0) {
               entities = entities.slice(options.offset);

package/dist/{chunk-FIBEYLME.js → chunk-ML75GCRO.js}

@@ -1,11 +1,10 @@
 import { parseCron, cronMinuteKey, cronMatches } from './chunk-OU3ITB5S.js';
+import { createContextFromBindings, interpolateValue, deferEntityBindings } from './chunk-XLMDWRMB.js';
 import { seedRandom, randomArrayElement, randomInt, shuffleArray, randomPastDate } from './chunk-T4VDAB4C.js';
 import { collectTraitRefsFromValue, collectTraitRefsFromEffects } from './chunk-SCRAHWOC.js';
 import { createLogger, setNamespaceLevel } from '@almadar/logger';
-import { createMinimalContext, resolveBinding, evaluate, evaluateGuard, SExpressionEvaluator } from '@almadar/evaluator';
-export { createMinimalContext } from '@almadar/evaluator';
-import { isKnownStdOperator } from '@almadar/std/registry';
-import { containsEntityBinding, containsPayloadBinding, RENDER_BINDING_MARKER, OrbitalSchemaSchema, isInlineTrait, isEntityCall, isEntityReference, parseEntityRef, parseImportedTraitRef, isPageReference, isPageReferenceString, isPageReferenceObject, parsePageRef, isReferenceConfigType, configRefEventKnob, normalizeCallSiteConfigToValues, resolveConfigRefEventName } from '@almadar/core';
+import { evaluateGuard, SExpressionEvaluator } from '@almadar/evaluator';
+import { OrbitalSchemaSchema, isInlineTrait, isEntityCall, isEntityReference, parseEntityRef, parseImportedTraitRef, isPageReference, isPageReferenceString, isPageReferenceObject, parsePageRef, isReferenceConfigType, configRefEventKnob, normalizeCallSiteConfigToValues, resolveConfigRefEventName } from '@almadar/core';
 export { normalizeCallSiteConfigToValues } from '@almadar/core';
 import { sampleRowCount, sampleRow } from '@almadar/core/mock';
 
@@ -289,292 +288,6 @@ function parseDurationString(interval) {
 function isValidDurationString(interval) {
   return /^(\d+)(ms|s|m|h)?$/.test(interval);
 }
-var bindLog = createLogger("almadar:runtime:bindings");
-setNamespaceLevel("almadar:runtime:bindings", "WARN");
-var deferLog = createLogger("almadar:runtime:defer");
-var renderLog = createLogger("almadar:runtime:render-ui");
-var CLIENT_ONLY_BINDING_ROOTS = /* @__PURE__ */ new Set(["trait"]);
-var CALLSITE_PAYLOAD_PREFIX = "@callsitePayload.";
-function payloadValueToConfigValue(v) {
-  if (v === null || v === void 0) return null;
-  if (typeof v === "string" || typeof v === "number" || typeof v === "boolean") return v;
-  if (v instanceof Date) return v.toISOString();
-  if (Array.isArray(v)) return v.map(payloadValueToConfigValue);
-  if (typeof v === "object") {
-    const obj = {};
-    for (const [k, val] of Object.entries(v)) obj[k] = payloadValueToConfigValue(val);
-    return obj;
-  }
-  return String(v);
-}
-function resolveCallSitePayloadCaptures(config, payload) {
-  let ctx;
-  const out = {};
-  for (const [key, value] of Object.entries(config)) {
-    if (typeof value === "string" && value.startsWith(CALLSITE_PAYLOAD_PREFIX)) {
-      const field = value.slice(CALLSITE_PAYLOAD_PREFIX.length);
-      if (!ctx) ctx = createMinimalContext({}, payload ?? {}, "idle");
-      out[key] = payloadValueToConfigValue(resolveBinding(`@payload.${field}`, ctx));
-    } else {
-      out[key] = value;
-    }
-  }
-  return out;
-}
-function isClientOnlyBinding(value) {
-  if (!value.startsWith("@")) return false;
-  const afterAt = value.slice(1);
-  const firstDot = afterAt.indexOf(".");
-  const root = firstDot === -1 ? afterAt : afterAt.slice(0, firstDot);
-  return CLIENT_ONLY_BINDING_ROOTS.has(root);
-}
-function interpolateProps(props, ctx) {
-  const result = {};
-  let anyChanged = false;
-  for (const [key, value] of Object.entries(props)) {
-    const interpolated = interpolateValue(value, ctx);
-    result[key] = interpolated;
-    if (interpolated !== value) anyChanged = true;
-  }
-  const entityBindingRaw = props["entity"];
-  const typeBindingRaw = props["type"];
-  const patternType = typeof typeBindingRaw === "string" ? typeBindingRaw : void 0;
-  if (typeof entityBindingRaw === "string") {
-    renderLog.debug("interpolateProps:entity", () => {
-      const resolvedEntity = result["entity"];
-      const resolvedRow = resolvedEntity !== null && typeof resolvedEntity === "object" && !Array.isArray(resolvedEntity) ? resolvedEntity : null;
-      const ctxRow = ctx.payload["row"];
-      const ctxPayloadKeys = Object.keys(ctx.payload).join(",");
-      const payloadDataRaw = ctx.payload["data"];
-      const payloadDataLen = Array.isArray(payloadDataRaw) ? payloadDataRaw.length : null;
-      const ctxEntityRaw = ctx.entity;
-      const ctxEntityLen = Array.isArray(ctxEntityRaw) ? ctxEntityRaw.length : null;
-      const resolvedLen = Array.isArray(resolvedEntity) ? resolvedEntity.length : null;
-      return {
-        patternType,
-        entityBinding: entityBindingRaw,
-        resolvedIsObject: resolvedRow !== null,
-        resolvedIsArray: Array.isArray(resolvedEntity),
-        resolvedLen,
-        resolvedEqualsCtxRow: ctxRow !== void 0 && resolvedRow !== null && resolvedRow === ctxRow,
-        resolvedRowId: resolvedRow?.id,
-        ctxPayloadKeys,
-        ctxPayloadDataLen: payloadDataLen,
-        ctxEntityIsArray: Array.isArray(ctxEntityRaw),
-        ctxEntityLen
-      };
-    });
-  }
-  if (patternType === "form-section" || patternType === "form") {
-    bindLog.debug("form-binding", () => {
-      const modeRaw = result["mode"];
-      const submitRaw = result["submitEvent"];
-      const cancelRaw = result["cancelEvent"];
-      return {
-        patternType,
-        mode: typeof modeRaw === "string" ? modeRaw : void 0,
-        submitEvent: typeof submitRaw === "string" ? submitRaw : void 0,
-        cancelEvent: typeof cancelRaw === "string" ? cancelRaw : void 0,
-        entity: JSON.stringify(result["entity"] ?? null),
-        fields: JSON.stringify(result["fields"] ?? null)
-      };
-    });
-  }
-  return anyChanged ? result : props;
-}
-function interpolateValue(value, ctx) {
-  if (value === null || value === void 0) {
-    return value;
-  }
-  if (typeof value === "string") {
-    return interpolateString(value, ctx);
-  }
-  if (Array.isArray(value)) {
-    return interpolateArray(value, ctx);
-  }
-  if (typeof value === "object") {
-    return interpolateProps(value, ctx);
-  }
-  return value;
-}
-function deferEntityBindings(value, ctx, configHops = 0) {
-  if (typeof value === "string") {
-    if (containsEntityBinding(value) && !containsPayloadBinding(value)) {
-      return { [RENDER_BINDING_MARKER]: true, expression: value };
-    }
-    if (value.startsWith("@config.") && !value.includes(" ") && configHops < 8) {
-      const hop = ctx.config?.[value.slice("@config.".length)];
-      deferLog.debug("defer:config-hop", () => ({
-        forward: value,
-        hopType: typeof hop,
-        hopPreview: typeof hop === "string" ? hop : Array.isArray(hop) ? "array" : hop === void 0 ? "undefined" : "object"
-      }));
-      if (hop !== void 0 && hop !== value) {
-        return deferEntityBindings(hop, ctx, configHops + 1);
-      }
-    }
-    return interpolateValue(value, ctx);
-  }
-  if (Array.isArray(value)) {
-    if (value.length === 3 && value[0] === "fn" && typeof value[1] === "string") {
-      return value;
-    }
-    if (isSExpression(value)) {
-      if (containsEntityBinding(value) && !containsPayloadBinding(value)) {
-        return { [RENDER_BINDING_MARKER]: true, expression: value };
-      }
-      return interpolateValue(value, ctx);
-    }
-    return value.map((item) => deferEntityBindings(item, ctx));
-  }
-  if (value !== null && typeof value === "object") {
-    const out = {};
-    for (const [key, item] of Object.entries(value)) {
-      out[key] = deferEntityBindings(item, ctx);
-    }
-    return out;
-  }
-  return value;
-}
-var inFlightConfigRecursions = /* @__PURE__ */ new Set();
-function interpolateString(value, ctx) {
-  if (value.startsWith("@") && isPureBinding(value)) {
-    if (isClientOnlyBinding(value)) {
-      bindLog.debug("passthrough:client-only", { binding: value });
-      return value;
-    }
-    const resolved = resolveBinding(value, ctx);
-    bindLog.debug("resolve", { binding: value, resolvedType: typeof resolved });
-    if (value.startsWith("@config.") && resolved !== null && typeof resolved === "object" && containsBindings(resolved) && !inFlightConfigRecursions.has(value)) {
-      inFlightConfigRecursions.add(value);
-      try {
-        bindLog.debug("resolve:config-recurse", { binding: value });
-        return interpolateValue(resolved, ctx);
-      } finally {
-        inFlightConfigRecursions.delete(value);
-      }
-    }
-    return resolved;
-  }
-  if (value.includes("@")) {
-    return interpolateEmbeddedBindings(value, ctx);
-  }
-  return value;
-}
-function isPureBinding(value) {
-  return /^@[\w]+(?:\[\d+\])*(?:\.[\w]+(?:\[\d+\])*)*$/.test(value);
-}
-function interpolateEmbeddedBindings(value, ctx) {
-  return value.replace(/@[\w]+(?:\[\d+\])*(?:\.[\w]+(?:\[\d+\])*)*/g, (match) => {
-    if (isClientOnlyBinding(match)) {
-      return match;
-    }
-    const resolved = resolveBinding(match, ctx);
-    return resolved !== void 0 ? String(resolved) : match;
-  });
-}
-function interpolateArray(value, ctx) {
-  if (value.length === 0) {
-    return value;
-  }
-  if (Array.isArray(value) && value.length === 3 && value[0] === "fn" && typeof value[1] === "string") {
-    return value;
-  }
-  if (isSExpression(value)) {
-    const result = evaluate(value, ctx);
-    bindLog.debug("sexpr:eval", () => ({
-      operator: typeof value[0] === "string" ? value[0] : "<non-string>",
-      argCount: value.length - 1,
-      inputJson: JSON.stringify(value).slice(0, 300),
-      resultType: typeof result,
-      resultJson: typeof result === "object" && result !== null ? JSON.stringify(result).slice(0, 2e3) : String(result)
-    }));
-    return result;
-  }
-  const mapped = [];
-  let anyChanged = false;
-  for (let i = 0; i < value.length; i++) {
-    const item = value[i];
-    if (Array.isArray(item) && isRenderChildrenMap(item)) {
-      const expanded = evaluate(item, ctx);
-      if (Array.isArray(expanded)) {
-        for (const node of expanded) mapped.push(node);
-      }
-      anyChanged = true;
-      continue;
-    }
-    const interpolated = interpolateValue(item, ctx);
-    mapped.push(interpolated);
-    if (interpolated !== item) anyChanged = true;
-  }
-  return anyChanged ? mapped : value;
-}
-function isRenderChildrenMap(value) {
-  if (value.length !== 3 || value[0] !== "array/map") return false;
-  const lambda = value[2];
-  return Array.isArray(lambda) && lambda.length === 3 && lambda[0] === "fn" && typeof lambda[1] === "string";
-}
-function isSExpression(value) {
-  if (value.length === 0) return false;
-  const first = value[0];
-  if (typeof first !== "string") return false;
-  if (isKnownStdOperator(first)) return true;
-  if (first.includes("/")) return true;
-  if (first === "lambda" || first === "let") return true;
-  return false;
-}
-function containsBindings(value) {
-  if (typeof value === "string") {
-    return value.includes("@");
-  }
-  if (Array.isArray(value)) {
-    return value.some(containsBindings);
-  }
-  if (value !== null && typeof value === "object") {
-    return Object.values(value).some(containsBindings);
-  }
-  return false;
-}
-function extractBindings(value) {
-  const bindings = [];
-  function collect(v) {
-    if (typeof v === "string") {
-      const matches = v.match(/@[\w]+(?:\.[\w]+)*/g);
-      if (matches) {
-        bindings.push(...matches);
-      }
-    } else if (Array.isArray(v)) {
-      v.forEach(collect);
-    } else if (v !== null && typeof v === "object") {
-      Object.values(v).forEach(collect);
-    }
-  }
-  collect(value);
-  return [...new Set(bindings)];
-}
-function createContextFromBindings(bindings, strictBindings, contextExtensions) {
-  const ctx = createMinimalContext(
-    bindings.entity || {},
-    bindings.payload || {},
-    bindings.state || "idle"
-  );
-  if (strictBindings) {
-    ctx.strictBindings = true;
-  }
-  if (bindings.config) {
-    ctx.config = bindings.config;
-  }
-  if (bindings.user) {
-    ctx.user = bindings.user;
-  }
-  if (bindings.locals) {
-    ctx.locals = bindings.locals;
-  }
-  if (contextExtensions) {
-    Object.assign(ctx, contextExtensions);
-  }
-  return ctx;
-}
 var smLog = createLogger("almadar:runtime:sm");
 function findInitialState(trait) {
   if (!trait.states || trait.states.length === 0) {
@@ -4943,4 +4656,4 @@ var InMemoryPersistence = class {
   }
 };
 
-export { CALLSITE_PAYLOAD_PREFIX, EffectExecutor, EventBus, HANDLER_MANIFEST, InMemoryPersistence, MockPersistenceAdapter, StateMachineManager, TickScheduler, buildEmitsFromTraits, collectDeclaredConfigDefaults, collectDeclaredEntityDefaults, containsBindings, createContextFromBindings, createInitialTraitState, createMockPersistence, createTestExecutor, createTickScheduler, createUnifiedLoader, deferEntityBindings, extractBindings, findInitialState, findTransition, formatPayloadValidationError, getIsolatedCollectionName, getNamespacedEvent, interpolateProps, interpolateValue, isBrowser, isElectron, isNamespacedEvent, isNode, isValidDurationString, normalizeEventKey, parseDurationString, parseNamespacedEvent, preprocessSchema, processEvent, resolveCallSitePayloadCaptures, validateEventPayload, validatePayloadShapes };
+export { EffectExecutor, EventBus, HANDLER_MANIFEST, InMemoryPersistence, MockPersistenceAdapter, StateMachineManager, TickScheduler, buildEmitsFromTraits, collectDeclaredConfigDefaults, collectDeclaredEntityDefaults, createInitialTraitState, createMockPersistence, createTestExecutor, createTickScheduler, createUnifiedLoader, findInitialState, findTransition, formatPayloadValidationError, getIsolatedCollectionName, getNamespacedEvent, isBrowser, isElectron, isNamespacedEvent, isNode, isValidDurationString, normalizeEventKey, parseDurationString, parseNamespacedEvent, preprocessSchema, processEvent, validateEventPayload, validatePayloadShapes };

package/dist/chunk-XLMDWRMB.js

@@ -0,0 +1,335 @@
+import { createMinimalContext, resolveBinding, evaluate } from '@almadar/evaluator';
+export { createMinimalContext } from '@almadar/evaluator';
+import { isKnownStdOperator } from '@almadar/std/registry';
+import { containsEntityBinding, containsPayloadBinding, RENDER_BINDING_MARKER } from '@almadar/core';
+import { createLogger, setNamespaceLevel } from '@almadar/logger';
+
+// src/entityAccess.ts
+var bindLog = createLogger("almadar:runtime:bindings");
+setNamespaceLevel("almadar:runtime:bindings", "WARN");
+var deferLog = createLogger("almadar:runtime:defer");
+var renderLog = createLogger("almadar:runtime:render-ui");
+var CLIENT_ONLY_BINDING_ROOTS = /* @__PURE__ */ new Set(["trait"]);
+var CALLSITE_PAYLOAD_PREFIX = "@callsitePayload.";
+function payloadValueToConfigValue(v) {
+  if (v === null || v === void 0) return null;
+  if (typeof v === "string" || typeof v === "number" || typeof v === "boolean") return v;
+  if (v instanceof Date) return v.toISOString();
+  if (Array.isArray(v)) return v.map(payloadValueToConfigValue);
+  if (typeof v === "object") {
+    const obj = {};
+    for (const [k, val] of Object.entries(v)) obj[k] = payloadValueToConfigValue(val);
+    return obj;
+  }
+  return String(v);
+}
+function resolveCallSitePayloadCaptures(config, payload) {
+  let ctx;
+  const out = {};
+  for (const [key, value] of Object.entries(config)) {
+    if (typeof value === "string" && value.startsWith(CALLSITE_PAYLOAD_PREFIX)) {
+      const field = value.slice(CALLSITE_PAYLOAD_PREFIX.length);
+      if (!ctx) ctx = createMinimalContext({}, payload ?? {}, "idle");
+      out[key] = payloadValueToConfigValue(resolveBinding(`@payload.${field}`, ctx));
+    } else {
+      out[key] = value;
+    }
+  }
+  return out;
+}
+function isClientOnlyBinding(value) {
+  if (!value.startsWith("@")) return false;
+  const afterAt = value.slice(1);
+  const firstDot = afterAt.indexOf(".");
+  const root = firstDot === -1 ? afterAt : afterAt.slice(0, firstDot);
+  return CLIENT_ONLY_BINDING_ROOTS.has(root);
+}
+function interpolateProps(props, ctx) {
+  const result = {};
+  let anyChanged = false;
+  for (const [key, value] of Object.entries(props)) {
+    const interpolated = interpolateValue(value, ctx);
+    result[key] = interpolated;
+    if (interpolated !== value) anyChanged = true;
+  }
+  const entityBindingRaw = props["entity"];
+  const typeBindingRaw = props["type"];
+  const patternType = typeof typeBindingRaw === "string" ? typeBindingRaw : void 0;
+  if (typeof entityBindingRaw === "string") {
+    renderLog.debug("interpolateProps:entity", () => {
+      const resolvedEntity = result["entity"];
+      const resolvedRow = resolvedEntity !== null && typeof resolvedEntity === "object" && !Array.isArray(resolvedEntity) ? resolvedEntity : null;
+      const ctxRow = ctx.payload["row"];
+      const ctxPayloadKeys = Object.keys(ctx.payload).join(",");
+      const payloadDataRaw = ctx.payload["data"];
+      const payloadDataLen = Array.isArray(payloadDataRaw) ? payloadDataRaw.length : null;
+      const ctxEntityRaw = ctx.entity;
+      const ctxEntityLen = Array.isArray(ctxEntityRaw) ? ctxEntityRaw.length : null;
+      const resolvedLen = Array.isArray(resolvedEntity) ? resolvedEntity.length : null;
+      return {
+        patternType,
+        entityBinding: entityBindingRaw,
+        resolvedIsObject: resolvedRow !== null,
+        resolvedIsArray: Array.isArray(resolvedEntity),
+        resolvedLen,
+        resolvedEqualsCtxRow: ctxRow !== void 0 && resolvedRow !== null && resolvedRow === ctxRow,
+        resolvedRowId: resolvedRow?.id,
+        ctxPayloadKeys,
+        ctxPayloadDataLen: payloadDataLen,
+        ctxEntityIsArray: Array.isArray(ctxEntityRaw),
+        ctxEntityLen
+      };
+    });
+  }
+  if (patternType === "form-section" || patternType === "form") {
+    bindLog.debug("form-binding", () => {
+      const modeRaw = result["mode"];
+      const submitRaw = result["submitEvent"];
+      const cancelRaw = result["cancelEvent"];
+      return {
+        patternType,
+        mode: typeof modeRaw === "string" ? modeRaw : void 0,
+        submitEvent: typeof submitRaw === "string" ? submitRaw : void 0,
+        cancelEvent: typeof cancelRaw === "string" ? cancelRaw : void 0,
+        entity: JSON.stringify(result["entity"] ?? null),
+        fields: JSON.stringify(result["fields"] ?? null)
+      };
+    });
+  }
+  return anyChanged ? result : props;
+}
+function interpolateValue(value, ctx) {
+  if (value === null || value === void 0) {
+    return value;
+  }
+  if (typeof value === "string") {
+    return interpolateString(value, ctx);
+  }
+  if (Array.isArray(value)) {
+    return interpolateArray(value, ctx);
+  }
+  if (typeof value === "object") {
+    return interpolateProps(value, ctx);
+  }
+  return value;
+}
+function deferEntityBindings(value, ctx, configHops = 0) {
+  if (typeof value === "string") {
+    if (containsEntityBinding(value) && !containsPayloadBinding(value)) {
+      return { [RENDER_BINDING_MARKER]: true, expression: value };
+    }
+    if (value.startsWith("@config.") && !value.includes(" ") && configHops < 8) {
+      const hop = ctx.config?.[value.slice("@config.".length)];
+      deferLog.debug("defer:config-hop", () => ({
+        forward: value,
+        hopType: typeof hop,
+        hopPreview: typeof hop === "string" ? hop : Array.isArray(hop) ? "array" : hop === void 0 ? "undefined" : "object"
+      }));
+      if (hop !== void 0 && hop !== value) {
+        return deferEntityBindings(hop, ctx, configHops + 1);
+      }
+    }
+    return interpolateValue(value, ctx);
+  }
+  if (Array.isArray(value)) {
+    if (value.length === 3 && value[0] === "fn" && typeof value[1] === "string") {
+      return value;
+    }
+    if (isSExpression(value)) {
+      if (containsEntityBinding(value) && !containsPayloadBinding(value)) {
+        return { [RENDER_BINDING_MARKER]: true, expression: value };
+      }
+      return interpolateValue(value, ctx);
+    }
+    return value.map((item) => deferEntityBindings(item, ctx));
+  }
+  if (value !== null && typeof value === "object") {
+    const out = {};
+    for (const [key, item] of Object.entries(value)) {
+      out[key] = deferEntityBindings(item, ctx);
+    }
+    return out;
+  }
+  return value;
+}
+var inFlightConfigRecursions = /* @__PURE__ */ new Set();
+function interpolateString(value, ctx) {
+  if (value.startsWith("@") && isPureBinding(value)) {
+    if (isClientOnlyBinding(value)) {
+      bindLog.debug("passthrough:client-only", { binding: value });
+      return value;
+    }
+    const resolved = resolveBinding(value, ctx);
+    bindLog.debug("resolve", { binding: value, resolvedType: typeof resolved });
+    if (value.startsWith("@config.") && resolved !== null && typeof resolved === "object" && containsBindings(resolved) && !inFlightConfigRecursions.has(value)) {
+      inFlightConfigRecursions.add(value);
+      try {
+        bindLog.debug("resolve:config-recurse", { binding: value });
+        return interpolateValue(resolved, ctx);
+      } finally {
+        inFlightConfigRecursions.delete(value);
+      }
+    }
+    return resolved;
+  }
+  if (value.includes("@")) {
+    return interpolateEmbeddedBindings(value, ctx);
+  }
+  return value;
+}
+function isPureBinding(value) {
+  return /^@[\w]+(?:\[\d+\])*(?:\.[\w]+(?:\[\d+\])*)*$/.test(value);
+}
+function interpolateEmbeddedBindings(value, ctx) {
+  return value.replace(/@[\w]+(?:\[\d+\])*(?:\.[\w]+(?:\[\d+\])*)*/g, (match) => {
+    if (isClientOnlyBinding(match)) {
+      return match;
+    }
+    const resolved = resolveBinding(match, ctx);
+    return resolved !== void 0 ? String(resolved) : match;
+  });
+}
+function interpolateArray(value, ctx) {
+  if (value.length === 0) {
+    return value;
+  }
+  if (Array.isArray(value) && value.length === 3 && value[0] === "fn" && typeof value[1] === "string") {
+    return value;
+  }
+  if (isSExpression(value)) {
+    const result = evaluate(value, ctx);
+    bindLog.debug("sexpr:eval", () => ({
+      operator: typeof value[0] === "string" ? value[0] : "<non-string>",
+      argCount: value.length - 1,
+      inputJson: JSON.stringify(value).slice(0, 300),
+      resultType: typeof result,
+      resultJson: typeof result === "object" && result !== null ? JSON.stringify(result).slice(0, 2e3) : String(result)
+    }));
+    return result;
+  }
+  const mapped = [];
+  let anyChanged = false;
+  for (let i = 0; i < value.length; i++) {
+    const item = value[i];
+    if (Array.isArray(item) && isRenderChildrenMap(item)) {
+      const expanded = evaluate(item, ctx);
+      if (Array.isArray(expanded)) {
+        for (const node of expanded) mapped.push(node);
+      }
+      anyChanged = true;
+      continue;
+    }
+    const interpolated = interpolateValue(item, ctx);
+    mapped.push(interpolated);
+    if (interpolated !== item) anyChanged = true;
+  }
+  return anyChanged ? mapped : value;
+}
+function isRenderChildrenMap(value) {
+  if (value.length !== 3 || value[0] !== "array/map") return false;
+  const lambda = value[2];
+  return Array.isArray(lambda) && lambda.length === 3 && lambda[0] === "fn" && typeof lambda[1] === "string";
+}
+function isSExpression(value) {
+  if (value.length === 0) return false;
+  const first = value[0];
+  if (typeof first !== "string") return false;
+  if (isKnownStdOperator(first)) return true;
+  if (first.includes("/")) return true;
+  if (first === "lambda" || first === "let") return true;
+  return false;
+}
+function containsBindings(value) {
+  if (typeof value === "string") {
+    return value.includes("@");
+  }
+  if (Array.isArray(value)) {
+    return value.some(containsBindings);
+  }
+  if (value !== null && typeof value === "object") {
+    return Object.values(value).some(containsBindings);
+  }
+  return false;
+}
+function extractBindings(value) {
+  const bindings = [];
+  function collect(v) {
+    if (typeof v === "string") {
+      const matches = v.match(/@[\w]+(?:\.[\w]+)*/g);
+      if (matches) {
+        bindings.push(...matches);
+      }
+    } else if (Array.isArray(v)) {
+      v.forEach(collect);
+    } else if (v !== null && typeof v === "object") {
+      Object.values(v).forEach(collect);
+    }
+  }
+  collect(value);
+  return [...new Set(bindings)];
+}
+function createContextFromBindings(bindings, strictBindings, contextExtensions) {
+  const ctx = createMinimalContext(
+    bindings.entity || {},
+    bindings.payload || {},
+    bindings.state || "idle"
+  );
+  if (strictBindings) {
+    ctx.strictBindings = true;
+  }
+  if (bindings.config) {
+    ctx.config = bindings.config;
+  }
+  if (bindings.user) {
+    ctx.user = bindings.user;
+  }
+  if (bindings.locals) {
+    ctx.locals = bindings.locals;
+  }
+  if (contextExtensions) {
+    Object.assign(ctx, contextExtensions);
+  }
+  return ctx;
+}
+
+// src/entityAccess.ts
+function accessDeniedMessage(op, entityType) {
+  return `@${op} denied: the declared access policy for '${entityType}' rejected this row`;
+}
+function applyRowAccess(rows, policy, filter, bindings) {
+  if (policy === void 0 && filter === void 0) {
+    return rows;
+  }
+  const predicates = [policy, filter].filter((p) => p !== void 0);
+  return rows.filter((entity) => {
+    const ctx = createContextFromBindings(
+      { entity, payload: bindings.payload, user: bindings.user, config: bindings.config },
+      false
+    );
+    return predicates.every((predicate) => {
+      try {
+        return Boolean(evaluate(predicate, ctx));
+      } catch (err) {
+        bindings.onPredicateError?.(err);
+        return false;
+      }
+    });
+  });
+}
+function checkMutationAccess(row, policy, bindings) {
+  if (policy === void 0) {
+    return true;
+  }
+  const ctx = createContextFromBindings(
+    { entity: row, payload: bindings.payload, user: bindings.user, config: bindings.config },
+    false
+  );
+  try {
+    return Boolean(evaluate(policy, ctx));
+  } catch (err) {
+    bindings.onPredicateError?.(err);
+    return false;
+  }
+}
+
+export { CALLSITE_PAYLOAD_PREFIX, accessDeniedMessage, applyRowAccess, checkMutationAccess, containsBindings, createContextFromBindings, deferEntityBindings, extractBindings, interpolateProps, interpolateValue, resolveCallSitePayloadCaptures };

package/dist/entityAccess.d.ts

@@ -0,0 +1,77 @@
+import { UserContext, EventPayload, TraitConfigObject, EntityRow, SExpr } from '@almadar/core';
+
+/**
+ * Row-level entity access — the single owner of every declared `@read`/
+ * `@create`/`@update`/`@delete` directive AND the call-site fetch `filter:`.
+ *
+ * The JS twin of `orbital-core/src/runtime/entity_access.rs`. An access
+ * directive is a per-row predicate evaluated with `@entity` bound to the
+ * candidate row (or, for `@create`, the incoming data — no row exists yet)
+ * and `@user` bound to the viewer. Every fetch/persist path applies it
+ * through here, so the ownership-scoped result narrows identically no
+ * matter which trait issued it — the un-bypassable twin of a call-site
+ * `filter:`, which a sibling trait can skip simply by not declaring one
+ * (R-FETCH-SCOPE-SIBLING-BYPASS).
+ *
+ * @packageDocumentation
+ */
+
+/** Bind shape every access check evaluates against. */
+interface AccessBindings {
+    user?: UserContext;
+    payload?: EventPayload;
+    /**
+     * The issuing trait's call-site config. Required so a policy/filter that
+     * reads `@config.*` (e.g. std-browse's blank-scope guard
+     * `["=", @config.scopeField, ""]`) resolves the knob instead of getting
+     * `undefined` — which a bare `=` comparison never treats as "unset", so
+     * the guard fails closed and every row is dropped
+     * (R-ENTITY-ACCESS-CONFIG-DROPPED-IN-ROW-CTX).
+     */
+    config?: TraitConfigObject;
+    /**
+     * Called when a predicate throws. Evaluation still fails closed (the row is
+     * dropped / the mutation denied) — this only surfaces the cause, because a
+     * fail-closed policy and a genuinely-empty result look identical from the
+     * outside, which is exactly how R-ENTITY-ACCESS-CONFIG-DROPPED-IN-ROW-CTX
+     * hid for as long as it did.
+     */
+    onPredicateError?: (error: unknown) => void;
+}
+/** The three directives checked against a row before it is written. */
+type MutationOp = 'create' | 'update' | 'delete';
+/**
+ * The one denial message. Three enforcement paths must produce it identically —
+ * `OrbitalServerRuntime` (interpreter), `createServerEffectHandlers` (offline
+ * preview), and the TypeScript that `orbital-shell-typescript` emits into a
+ * generated app's server — because a consumer distinguishing "denied" from
+ * "failed" reads this string. The Rust emitter holds a const mirroring it, and
+ * a test asserts the two agree.
+ */
+declare function accessDeniedMessage(op: MutationOp, entityType: string): string;
+/**
+ * Retain only the rows BOTH the declared `@read` policy and the call-site
+ * `filter:` accept — the policy can only narrow what the call site sees,
+ * never widen it. A no-op when neither is declared.
+ *
+ * A predicate that fails to evaluate drops its row: a filter/policy that
+ * cannot be evaluated must never widen the result set.
+ *
+ * Generic in the row type so a caller's element type survives the call —
+ * generated server code chains a typed `filter:` callback straight off the
+ * result, and widening `Ticket[]` to `EntityRow[]` would collapse every field
+ * to the index signature and break `tsc` on any arithmetic/date comparison.
+ */
+declare function applyRowAccess<T extends EntityRow>(rows: T[], policy: SExpr | undefined, filter: SExpr | undefined, bindings: AccessBindings): T[];
+/**
+ * Check a declared `@create`/`@update`/`@delete` directive against the row
+ * the operation targets. `row` is the incoming data for `create` (no row
+ * exists yet) or the EXISTING row fetched fresh for `update`/`delete`.
+ *
+ * Returns `true` when no policy is declared (today's behavior, unchanged)
+ * or the policy evaluates truthy; `false` denies the mutation, including
+ * when the predicate fails to evaluate (fail-closed, same rule as reads).
+ */
+declare function checkMutationAccess(row: EntityRow, policy: SExpr | undefined, bindings: AccessBindings): boolean;
+
+export { type AccessBindings, type MutationOp, accessDeniedMessage, applyRowAccess, checkMutationAccess };

package/dist/entityAccess.js

@@ -0,0 +1,2 @@
+export { accessDeniedMessage, applyRowAccess, checkMutationAccess } from './chunk-XLMDWRMB.js';
+import './chunk-MLKGABMK.js';

package/dist/index.d.ts

@@ -4,8 +4,9 @@ import { U as UnifiedLoaderOptions, S as SchemaLoader, I as ImportChainLike, L a
 export { E as EntitySharingMap, c as EventBus, d as EventNamespaceMap, e as InMemoryPersistence, O as OrbitalEventRequest, f as OrbitalEventResponse, g as OrbitalServerRuntimeConfig, h as PreprocessOptions, i as PreprocessResult, j as PreprocessedSchema, k as ProcessEventOptions, R as RegisteredOrbital, l as RuntimeOrbital, m as RuntimeOrbitalSchema, n as RuntimeTrait, o as StateMachineManager, p as collectDeclaredConfigDefaults, q as collectDeclaredEntityDefaults, r as createInitialTraitState, s as findInitialState, t as findTransition, u as getIsolatedCollectionName, v as getNamespacedEvent, w as isBrowser, x as isElectron, y as isNamespacedEvent, z as isNode, A as normalizeEventKey, B as parseNamespacedEvent, C as preprocessSchema, D as processEvent } from './OrbitalServerRuntime-e-5490xl.js';
 import { EvaluationContext, SExpressionEvaluator } from '@almadar/evaluator';
 export { EvaluationContext, createMinimalContext } from '@almadar/evaluator';
-import { RenderBindingMarker, SExpr, TraitConfigObject, EventPayload, PatternConfig, EntityId, EntityField, EntityRow, EntityPersistence, ServiceParams, PayloadField, OrbitalDefinition, OrbitalSchema } from '@almadar/core';
+import { RenderBindingMarker, SExpr, TraitConfigObject, EventPayload, PatternConfig, EntityId, EntityField, EntityRow, EntityPersistence, ServiceParams, EntityAccessPolicies, PayloadField, OrbitalDefinition, OrbitalSchema } from '@almadar/core';
 export { EntityField, normalizeCallSiteConfigToValues } from '@almadar/core';
+export { AccessBindings, applyRowAccess, checkMutationAccess } from './entityAccess.js';
 export { ServerBridgeConfig, ServerBridgeState } from './ServerBridge.js';
 export { OsHandlerContext, OsHandlerResult } from './createOsHandlers.js';
 export { MultiSourceSlotManager, PERF_NAMESPACE, PerfDetail, PerfDetailValue, PerfEntry, PreparedPreviewSchema, RendererContractViolationError, ResolvedPageTraits, SlotContent, SlotContentValidationError, SlotManager, SlotSource, VerificationBus, adjustSchemaForMockData, aggregateSlotContent, assertIsMultiSourceSlotManager, assertIsSlotManager, bindEventBus, bindTraitStateGetter, buildMockData, buildOrbitalsByTrait, clearPerf, collectEmbeddedTraits, collectTraitRefsFromResolvedTrait, createSlotSetter, ensureVerificationApi, getOrbitalVerification, perfEnd, perfStart, perfStore, perfTime, prepareSchemaForPreview, pushPerfEntry, validateSlotContent, wrapCallbackForEvent } from './ui/index.js';
@@ -778,6 +779,16 @@ interface CreateServerEffectHandlersOptions {
     };
     /** Consumer-supplied `call-service` handler. When absent, calls warn and return null. */
     callService?: (service: string, action: string, params?: ServiceParams) => Promise<EventPayload | null>;
+    /**
+     * The declared `@read`/`@create`/`@update`/`@delete` directives, keyed by
+     * entity name. Build it with `entityAccessTable(schema)` from `@almadar/core`.
+     *
+     * Optional: a caller that holds no schema (the client offline-preview path)
+     * passes nothing and gets today's unrestricted behavior. A preview is not a
+     * security boundary — the generated server is, and that one always has the
+     * policies compiled in.
+     */
+    entityAccess?: ReadonlyMap<string, EntityAccessPolicies>;
     /** Verbose logging. */
     debug?: boolean;
 }

package/dist/index.js

@@ -1,6 +1,8 @@
-import { EffectExecutor, createContextFromBindings } from './chunk-FIBEYLME.js';
-export { CALLSITE_PAYLOAD_PREFIX, EffectExecutor, EventBus, HANDLER_MANIFEST, InMemoryPersistence, MockPersistenceAdapter, StateMachineManager, TickScheduler, buildEmitsFromTraits, collectDeclaredConfigDefaults, collectDeclaredEntityDefaults, containsBindings, createContextFromBindings, createInitialTraitState, createMinimalContext, createMockPersistence, createTestExecutor, createTickScheduler, createUnifiedLoader, deferEntityBindings, extractBindings, findInitialState, findTransition, formatPayloadValidationError, getIsolatedCollectionName, getNamespacedEvent, interpolateProps, interpolateValue, isBrowser, isElectron, isNamespacedEvent, isNode, isValidDurationString, normalizeCallSiteConfigToValues, normalizeEventKey, parseDurationString, parseNamespacedEvent, preprocessSchema, processEvent, resolveCallSitePayloadCaptures, validateEventPayload, validatePayloadShapes } from './chunk-FIBEYLME.js';
+import { EffectExecutor } from './chunk-ML75GCRO.js';
+export { EffectExecutor, EventBus, HANDLER_MANIFEST, InMemoryPersistence, MockPersistenceAdapter, StateMachineManager, TickScheduler, buildEmitsFromTraits, collectDeclaredConfigDefaults, collectDeclaredEntityDefaults, createInitialTraitState, createMockPersistence, createTestExecutor, createTickScheduler, createUnifiedLoader, findInitialState, findTransition, formatPayloadValidationError, getIsolatedCollectionName, getNamespacedEvent, isBrowser, isElectron, isNamespacedEvent, isNode, isValidDurationString, normalizeCallSiteConfigToValues, normalizeEventKey, parseDurationString, parseNamespacedEvent, preprocessSchema, processEvent, validateEventPayload, validatePayloadShapes } from './chunk-ML75GCRO.js';
 export { cronMatches, cronMinuteKey, isValidCronExpression, parseCron, parseCronField } from './chunk-OU3ITB5S.js';
+import { createContextFromBindings, applyRowAccess, checkMutationAccess, accessDeniedMessage } from './chunk-XLMDWRMB.js';
+export { CALLSITE_PAYLOAD_PREFIX, applyRowAccess, checkMutationAccess, containsBindings, createContextFromBindings, createMinimalContext, deferEntityBindings, extractBindings, interpolateProps, interpolateValue, resolveCallSitePayloadCaptures } from './chunk-XLMDWRMB.js';
 import './chunk-T4VDAB4C.js';
 export { PERF_NAMESPACE, RendererContractViolationError, adjustSchemaForMockData, aggregateSlotContent, assertIsMultiSourceSlotManager, assertIsSlotManager, bindEventBus, bindTraitStateGetter, buildMockData, buildOrbitalsByTrait, clearPerf, createSlotSetter, ensureVerificationApi, getOrbitalVerification, perfEnd, perfStart, perfStore, perfTime, prepareSchemaForPreview, pushPerfEntry, validateSlotContent, wrapCallbackForEvent } from './chunk-FOFLEZRJ.js';
 export { collectEmbeddedTraits, collectTraitRefsFromResolvedTrait } from './chunk-SCRAHWOC.js';
@@ -154,8 +156,20 @@ function createServerEffectHandlers(opts) {
     emittedEvents,
     source,
     callService: consumerCallService,
+    entityAccess,
     debug
   } = opts;
+  const accessBindings = (forEntityType) => ({
+    user: bindings?.user,
+    payload: bindings?.payload,
+    config: bindings?.config,
+    onPredicateError: (err) => {
+      effectLog.error("access-predicate-eval-error", {
+        entityType: forEntityType,
+        error: err instanceof Error ? err : String(err)
+      });
+    }
+  });
   const record = (entry) => {
     effectResults?.push(entry);
   };
@@ -306,8 +320,12 @@ function createServerEffectHandlers(opts) {
       let resultData;
       const sizeBefore = (await persistence.list(type)).length;
       try {
+        const mutationPolicy = entityAccess?.get(type)?.[action];
         switch (action) {
           case "create": {
+            if (!checkMutationAccess(data ?? {}, mutationPolicy, accessBindings(type))) {
+              throw new Error(accessDeniedMessage("create", type));
+            }
             const { id } = await persistence.create(type, data ?? {});
             resultData = { id, ...data ?? {} };
             break;
@@ -316,6 +334,12 @@ function createServerEffectHandlers(opts) {
             const row = data ?? {};
             const idOrFallback = row.id ?? entityId;
             if (idOrFallback) {
+              if (mutationPolicy !== void 0) {
+                const existing = await persistence.getById(type, idOrFallback);
+                if (!existing || !checkMutationAccess(existing, mutationPolicy, accessBindings(type))) {
+                  throw new Error(accessDeniedMessage("update", type));
+                }
+              }
               await persistence.update(type, idOrFallback, row);
               const updated = await persistence.getById(type, idOrFallback);
               resultData = updated ?? { id: idOrFallback, ...row };
@@ -327,6 +351,12 @@ function createServerEffectHandlers(opts) {
             const nestedId = typeof data === "object" && data !== null ? data.id : void 0;
             const deleteId = directId ?? nestedId ?? entityId;
             if (deleteId) {
+              if (mutationPolicy !== void 0) {
+                const existing = await persistence.getById(type, deleteId);
+                if (!existing || !checkMutationAccess(existing, mutationPolicy, accessBindings(type))) {
+                  throw new Error(accessDeniedMessage("delete", type));
+                }
+              }
               await persistence.delete(type, deleteId);
               resultData = { id: deleteId, deleted: true };
             }
@@ -413,31 +443,25 @@ function createServerEffectHandlers(opts) {
         let total = 0;
         if (options?.id) {
           const entity = await persistence.getById(fetchEntityType, options.id);
-          if (entity) {
-            if (fetchedData) fetchedData[fetchEntityType] = [entity];
-            result = entity;
+          const visible = entity ? applyRowAccess(
+            [entity],
+            entityAccess?.get(fetchEntityType)?.read,
+            void 0,
+            accessBindings(fetchEntityType)
+          ) : [];
+          if (visible.length > 0) {
+            if (fetchedData) fetchedData[fetchEntityType] = visible;
+            result = visible[0] ?? null;
             total = 1;
           }
         } else {
           let entities = await persistence.list(fetchEntityType);
-          if (options?.filter !== void 0 && options.filter !== null) {
-            const predicate = options.filter;
-            entities = entities.filter((entity) => {
-              const ctx = createContextFromBindings(
-                { entity, payload: bindings?.payload, current: entity },
-                false
-              );
-              try {
-                return Boolean(evaluate(predicate, ctx));
-              } catch (err) {
-                effectLog.error("fetch-filter-eval-error", {
-                  entityType: fetchEntityType,
-                  error: err instanceof Error ? err : String(err)
-                });
-                return false;
-              }
-            });
-          }
+          entities = applyRowAccess(
+            entities,
+            entityAccess?.get(fetchEntityType)?.read,
+            options?.filter,
+            accessBindings(fetchEntityType)
+          );
           total = entities.length;
           if (options?.offset && options.offset > 0) {
             entities = entities.slice(options.offset);
@@ -460,7 +484,13 @@ function createServerEffectHandlers(opts) {
     fetchStream: async (streamEntityType, options, onChunk) => {
       try {
         const rows = await persistence.list(streamEntityType);
-        const matched = options?.id ? rows.filter((r) => r["id"] === options.id) : rows;
+        const visible = applyRowAccess(
+          rows,
+          entityAccess?.get(streamEntityType)?.read,
+          void 0,
+          accessBindings(streamEntityType)
+        );
+        const matched = options?.id ? visible.filter((r) => r["id"] === options.id) : visible;
         for (const row of matched) {
           onChunk(row);
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@almadar/runtime",
-  "version": "6.46.0",
+  "version": "6.48.0",
   "description": "Interpreted runtime for Almadar orbital applications (OrbitalServerRuntime)",
   "type": "module",
   "main": "./dist/index.js",
@@ -33,6 +33,11 @@
       "import": "./dist/createOsHandlers.js",
       "require": "./dist/createOsHandlers.js"
     },
+    "./entityAccess": {
+      "types": "./dist/entityAccess.d.ts",
+      "import": "./dist/entityAccess.js",
+      "require": "./dist/entityAccess.js"
+    },
     "./mockRandom": {
       "types": "./dist/mockRandom.d.ts",
       "import": "./dist/mockRandom.js",
@@ -52,11 +57,11 @@
     "access": "public"
   },
   "dependencies": {
-    "@almadar/core": "^10.44.0",
+    "@almadar/core": "^10.47.0",
     "@almadar/evaluator": "^2.38.0",
     "@almadar/logger": "^1.10.0",
-    "@almadar/server": "^2.30.0",
-    "@almadar/std": "^16.154.0"
+    "@almadar/server": "^2.32.0",
+    "@almadar/std": "^16.157.0"
   },
   "peerDependencies": {
     "express": "^5.0.0"