@almadar/runtime 6.63.0 → 6.64.0

package/dist/{OrbitalServerRuntime-nqwGldMC.d.ts → OrbitalServerRuntime-DOJDoqXu.d.ts}

@@ -1416,6 +1416,29 @@ declare class OrbitalServerRuntime {
      * instead of re-seeding.
      */
     setDefaultUser(user: UserContext | undefined): void;
+    /** setDefaultUser can land before register() finishes resolving the schema
+     *  (a dev host pins a persona right after boot). An ungated restamp there
+     *  would hand a read-only persona authorship of drafts, so the restamp is
+     *  DEFERRED until the schema exists — register()/registerSync() flush it. */
+    private pendingOwnerRestamp;
+    /**
+     * Re-point the mock seeder's owner stamps at `user`. The adapter's
+     * installed owner gate (see installOwnerGate) decides per row whether the
+     * persona could have CREATED it — a reader keeps seeing the store's
+     * published face instead of inheriting draft ownership from the demo
+     * stamper. Deferred when the schema (and so the gate) isn't resolved yet.
+     */
+    private restampOwnerGated;
+    /**
+     * Install the schema's `@create` directives as the mock seeder's owner
+     * gate — the single authority on who may author a row. Consulted by BOTH
+     * `restampOwner` (persona switches) and `seed()` (a client connect
+     * re-registers, and the deterministic reseed re-stamps with the current
+     * ownerId — gating only the switch path would leak right there). Reads the
+     * CURRENT default user at evaluation time so one installation covers every
+     * later switch. Then flushes any switch that arrived before the schema.
+     */
+    private installOwnerGate;
     /** The viewer a dev host is currently presenting the app as. */
     getDefaultUser(): UserContext | undefined;
     /**

package/dist/OrbitalServerRuntime.d.ts

@@ -1,4 +1,4 @@
 import 'express';
-export { F as ClientEffectTuple, G as ClientNavigateBackTuple, H as ClientNavigateTuple, J as ClientNotifyTuple, K as ClientRenderUITuple, M as EffectResult, e as InMemoryPersistence, N as LiveBroadcastItem, Q as LoaderConfig, O as OrbitalEventRequest, f as OrbitalEventResponse, T as OrbitalServerRuntime, g as OrbitalServerRuntimeConfig, P as PersistenceAdapter, R as RegisteredOrbital, l as RuntimeOrbital, m as RuntimeOrbitalSchema, n as RuntimeTrait, V as RuntimeTraitTick, p as collectDeclaredConfigDefaults, W as createOrbitalServerRuntime } from './OrbitalServerRuntime-nqwGldMC.js';
+export { F as ClientEffectTuple, G as ClientNavigateBackTuple, H as ClientNavigateTuple, J as ClientNotifyTuple, K as ClientRenderUITuple, M as EffectResult, e as InMemoryPersistence, N as LiveBroadcastItem, Q as LoaderConfig, O as OrbitalEventRequest, f as OrbitalEventResponse, T as OrbitalServerRuntime, g as OrbitalServerRuntimeConfig, P as PersistenceAdapter, R as RegisteredOrbital, l as RuntimeOrbital, m as RuntimeOrbitalSchema, n as RuntimeTrait, V as RuntimeTraitTick, p as collectDeclaredConfigDefaults, W as createOrbitalServerRuntime } from './OrbitalServerRuntime-DOJDoqXu.js';
 import './types-BaD_ox7e.js';
 import '@almadar/core';

package/dist/OrbitalServerRuntime.js

@@ -1,7 +1,7 @@
-import { createTickScheduler, EventBus, createUnifiedLoader, MockPersistenceAdapter, InMemoryPersistence, preprocessSchema, normalizeCallSiteConfigToValues, StateMachineManager, parseDurationString, validateEventPayload, formatPayloadValidationError, collectDeclaredConfigDefaults, collectDeclaredEntityDefaults, EffectExecutor } from './chunk-C7SIRVGS.js';
-export { InMemoryPersistence, collectDeclaredConfigDefaults } from './chunk-C7SIRVGS.js';
+import { createTickScheduler, EventBus, createUnifiedLoader, MockPersistenceAdapter, InMemoryPersistence, preprocessSchema, normalizeCallSiteConfigToValues, StateMachineManager, parseDurationString, validateEventPayload, formatPayloadValidationError, collectDeclaredConfigDefaults, collectDeclaredEntityDefaults, EffectExecutor } from './chunk-IFSFX43J.js';
+export { InMemoryPersistence, collectDeclaredConfigDefaults } from './chunk-IFSFX43J.js';
 import { isValidCronExpression } from './chunk-OU3ITB5S.js';
-import { createContextFromBindings, resolveCallSitePayloadCaptures, applyRowAccess, checkMutationAccess, accessDeniedMessage } from './chunk-ZJ62H3ES.js';
+import { createContextFromBindings, checkMutationAccess, resolveCallSitePayloadCaptures, applyRowAccess, accessDeniedMessage } from './chunk-ZJ62H3ES.js';
 import './chunk-T4VDAB4C.js';
 import './chunk-SCRAHWOC.js';
 import './chunk-MLKGABMK.js';
@@ -9,7 +9,7 @@ import { createLogger } from '@almadar/logger';
 import * as nodeModule from 'module';
 import { evaluateListenPayloadExpr, evaluateGuard, evaluate } from '@almadar/evaluator';
 import { DEFAULT_VIEWER, buildResolvedTraitConfigs, isInlineTrait, isEntityCall, applyListenPayloadMapping, personaFromIdentityRow, normalizeUserContext, isRuntimeEntity, isPageReference } from '@almadar/core';
-import { ownerFieldsFromSchema, identityEntityName, entityAccessPolicies } from '@almadar/core/mock';
+import { ownerFieldsFromSchema, identityEntityName, entityAccessPoliciesByStoreKey, entityAccessPolicies } from '@almadar/core/mock';
 import { getPatternFieldsContract } from '@almadar/core/patterns';
 
 // src/identity/routing.ts
@@ -355,6 +355,7 @@ var OrbitalServerRuntime = class {
     this.setupTicks();
     this.resolvedSchema = schema;
     this.resolvedTraitConfigs = buildResolvedTraitConfigs(schema);
+    this.installOwnerGate();
   }
   /**
    * Teach the mock seeder which columns hold the viewer's id, derived from the
@@ -391,7 +392,7 @@ var OrbitalServerRuntime = class {
     this.setupTicks();
     this.resolvedSchema = schema;
     this.resolvedTraitConfigs = buildResolvedTraitConfigs(schema);
-    this.applyIdentityOwnerFields(schema);
+    this.installOwnerGate();
   }
   /**
    * Returns the schema that this runtime is currently executing, post-
@@ -1065,7 +1066,55 @@ var OrbitalServerRuntime = class {
     const previousId = this.config.defaultUser?.id;
     this.config.defaultUser = user;
     if (this.persistence instanceof MockPersistenceAdapter && user?.id !== void 0 && user.id !== previousId) {
-      this.persistence.restampOwner(user.id);
+      this.restampOwnerGated(user);
+    }
+  }
+  /** setDefaultUser can land before register() finishes resolving the schema
+   *  (a dev host pins a persona right after boot). An ungated restamp there
+   *  would hand a read-only persona authorship of drafts, so the restamp is
+   *  DEFERRED until the schema exists — register()/registerSync() flush it. */
+  pendingOwnerRestamp = false;
+  /**
+   * Re-point the mock seeder's owner stamps at `user`. The adapter's
+   * installed owner gate (see installOwnerGate) decides per row whether the
+   * persona could have CREATED it — a reader keeps seeing the store's
+   * published face instead of inheriting draft ownership from the demo
+   * stamper. Deferred when the schema (and so the gate) isn't resolved yet.
+   */
+  restampOwnerGated(user) {
+    if (!(this.persistence instanceof MockPersistenceAdapter)) return;
+    if (!this.resolvedSchema) {
+      this.pendingOwnerRestamp = true;
+      return;
+    }
+    this.persistence.restampOwner(user.id);
+  }
+  /**
+   * Install the schema's `@create` directives as the mock seeder's owner
+   * gate — the single authority on who may author a row. Consulted by BOTH
+   * `restampOwner` (persona switches) and `seed()` (a client connect
+   * re-registers, and the deterministic reseed re-stamps with the current
+   * ownerId — gating only the switch path would leak right there). Reads the
+   * CURRENT default user at evaluation time so one installation covers every
+   * later switch. Then flushes any switch that arrived before the schema.
+   */
+  installOwnerGate() {
+    if (!(this.persistence instanceof MockPersistenceAdapter) || !this.resolvedSchema) return;
+    const policiesByStore = entityAccessPoliciesByStoreKey(this.resolvedSchema);
+    this.persistence.setOwnerGate((storeKey, candidateRow) => {
+      const user = this.config.defaultUser;
+      if (!user) return true;
+      return checkMutationAccess(candidateRow, policiesByStore.get(storeKey)?.create, { user });
+    });
+    this.persistence.setOwnerCandidateGate((storeKey, candidateRow, candidateIdentityRow) => {
+      const persona = personaFromIdentityRow(candidateIdentityRow);
+      if (!persona) return false;
+      return checkMutationAccess(candidateRow, policiesByStore.get(storeKey)?.create, { user: persona });
+    });
+    if (this.pendingOwnerRestamp) {
+      this.pendingOwnerRestamp = false;
+      const user = this.config.defaultUser;
+      if (user?.id !== void 0) this.restampOwnerGated(user);
     }
   }
   /** The viewer a dev host is currently presenting the app as. */

package/dist/{chunk-C7SIRVGS.js → chunk-IFSFX43J.js}

@@ -2128,6 +2128,12 @@ var mockLog = createLogger("almadar:runtime:mock");
 var DEFAULT_MOCK_SEED = 42;
 var SEED_REFERENCE_TIMESTAMP = "2024-01-01T00:00:00.000Z";
 var MS_PER_DAY = 864e5;
+function isRelationField(field) {
+  return field.type === "relation";
+}
+function stampedCellKey(entity, id, column) {
+  return `${entity}\0${id}\0${column}`;
+}
 var MockPersistenceAdapter = class _MockPersistenceAdapter {
   stores = /* @__PURE__ */ new Map();
   schemas = /* @__PURE__ */ new Map();
@@ -2191,21 +2197,108 @@ var MockPersistenceAdapter = class _MockPersistenceAdapter {
    * No-op when there is no new id, or it matches the current one — an
    * anonymous switch (`newOwnerId === undefined`) leaves existing stamps as
    * they are rather than clearing a non-nullable owner column.
+   *
+   * Both this re-labeling AND `seed()`'s original stamping consult the
+   * `ownerGate` hook (see `setOwnerGate`) — a re-register reseeds identical
+   * rows, so gating only the restamp path leaks the moment a client
+   * connects and the deterministic reseed stamps with the updated ownerId.
    */
   restampOwner(newOwnerId) {
     const oldOwnerId = this.config.ownerId;
     this.config.ownerId = newOwnerId;
     if (!newOwnerId || newOwnerId === oldOwnerId) return;
+    let skipped = 0;
+    let fallbackStamps = 0;
     for (const cell of this.ownerStampedCells) {
       const row = this.stores.get(cell.entity)?.get(cell.id);
-      if (row) row[cell.column] = newOwnerId;
+      if (!row) continue;
+      if (this.ownerGate && !this.ownerGate(cell.entity, { ...row, [cell.column]: newOwnerId })) {
+        const fallbackId = this.firstEligibleOwner(cell.entity, cell.column, row);
+        if (fallbackId === void 0) {
+          skipped++;
+          continue;
+        }
+        row[cell.column] = fallbackId;
+        fallbackStamps++;
+        continue;
+      }
+      row[cell.column] = newOwnerId;
     }
     mockLog.debug("mock:owner-restamped", {
       from: oldOwnerId,
       to: newOwnerId,
-      cells: this.ownerStampedCells.length
+      cells: this.ownerStampedCells.length,
+      skipped,
+      fallbackStamps
     });
   }
+  /**
+   * The host's answer to "may the current viewer OWN this row?" — evaluated
+   * against the candidate row with the owner column already re-pointed,
+   * `storeKey` being the collection key the stores are keyed by. The runtime
+   * installs the registered schema's `@create` directive here (the single
+   * authority on who authors; no role heuristics), so a read-only persona
+   * never inherits authorship of drafts from the demo stamper — neither on a
+   * persona switch (`restampOwner`) nor on a deterministic reseed (`seed`).
+   * Absent hook = stamp unconditionally (pre-role-model behavior).
+   */
+  ownerGate;
+  setOwnerGate(gate) {
+    this.ownerGate = gate;
+  }
+  /**
+   * The host's answer to "may THIS identity row own this candidate row?" —
+   * evaluated per candidate rather than against the fixed default viewer, so
+   * `linkRelationFields` and the eligible-owner fallback (see
+   * `firstEligibleOwner`) can pick a policy-valid owner from the whole
+   * identity roster instead of only ever checking the current default user.
+   * Absent hook = no candidate filtering (pre-role-model behavior).
+   */
+  ownerCandidateGate;
+  setOwnerCandidateGate(gate) {
+    this.ownerCandidateGate = gate;
+  }
+  /**
+   * The store an owner column's relation field targets, resolved the same
+   * way `linkRelationFields` resolves any relation target (id sibling wins
+   * over the `entity` name string) — but keyed by STORE, mirroring that
+   * method's first-declarer-per-collection rule, so `seed()` and
+   * `restampOwner()` can find it before a `linkRelationFields` pass has run
+   * this registration. Undefined when no registered schema on `storeKey`
+   * declares `column` as a relation field.
+   */
+  resolveOwnerColumnTargetStore(storeKey, column) {
+    for (const [normalizedName, schema] of this.schemas) {
+      if ((this.storeKeyByEntity.get(normalizedName) ?? normalizedName) !== storeKey) continue;
+      const field = schema.fields.find((f) => f.name === column);
+      if (field && isRelationField(field)) {
+        return (field.relation.entityId && this.storeNameById.get(field.relation.entityId)) ?? this.resolveStoreKey(field.relation.entity);
+      }
+    }
+    return void 0;
+  }
+  /**
+   * The first identity-store row (seed order) whose persona is eligible, per
+   * the installed `ownerCandidateGate`, to own `row`'s `column` in `storeKey`
+   * — the deterministic replacement for "skip the stamp" when the CURRENT
+   * viewer fails the `@create` policy (e.g. a reader-default persona against
+   * an author|reviewer-only policy). Undefined when no gate is installed, the
+   * column isn't a resolvable relation, or no identity row is eligible — the
+   * caller keeps today's skip behavior in that case.
+   */
+  firstEligibleOwner(storeKey, column, row) {
+    if (!this.ownerCandidateGate) return void 0;
+    const identityStoreKey = this.resolveOwnerColumnTargetStore(storeKey, column);
+    const identityStore = identityStoreKey ? this.stores.get(identityStoreKey) : void 0;
+    if (!identityStore) return void 0;
+    for (const identityRow of identityStore.values()) {
+      const candidateId = identityRow["id"];
+      if (this.ownerCandidateGate(storeKey, { ...row, [column]: candidateId }, identityRow)) {
+        return candidateId;
+      }
+    }
+    return void 0;
+  }
   /** Re-anchor the PRNG to the configured seed. Called before every
    *  re-seed loop so identical reseed sequences produce identical rows
    *  (timestamps + generated fields). Without this, the first
@@ -2305,16 +2398,28 @@ var MockPersistenceAdapter = class _MockPersistenceAdapter {
         relationFieldsByStore.set(storeKey, fieldMap);
       }
       for (const f of schema.fields) {
-        if (((candidate) => candidate.type === "relation")(f) && !fieldMap.has(f.name)) {
+        if (isRelationField(f) && !fieldMap.has(f.name)) {
           fieldMap.set(f.name, f);
         }
       }
     }
+    const ownerColumnsByStore = /* @__PURE__ */ new Map();
+    for (const { entity, field } of this.parsedOwnerFields()) {
+      const storeKey = this.resolveStoreKey(entity);
+      const set = ownerColumnsByStore.get(storeKey) ?? /* @__PURE__ */ new Set();
+      set.add(field);
+      ownerColumnsByStore.set(storeKey, set);
+    }
+    const stampedCellKeys = new Set(
+      this.ownerStampedCells.map((cell) => stampedCellKey(cell.entity, cell.id, cell.column))
+    );
     for (const [storeKey, fieldMap] of relationFieldsByStore) {
       const store = this.stores.get(storeKey);
       if (!store || fieldMap.size === 0) continue;
       const rows = [...store.values()];
+      const ownerColumns = ownerColumnsByStore.get(storeKey);
       for (const field of fieldMap.values()) {
+        const isOwnerColumn = ownerColumns?.has(field.name) ?? false;
         const targetKey = (field.relation.entityId && this.storeNameById.get(field.relation.entityId)) ?? this.resolveStoreKey(field.relation.entity);
         const targetStore = this.stores.get(targetKey);
         if (!targetStore || targetStore.size === 0) continue;
@@ -2322,7 +2427,7 @@ var MockPersistenceAdapter = class _MockPersistenceAdapter {
         const cardinality = field.relation.cardinality ?? "many";
         if (sameStore && (cardinality === "one" || cardinality === "many-to-one")) {
           rows.forEach((row, i) => {
-            if (this.config.ownerId !== void 0 && row[field.name] === this.config.ownerId) {
+            if (this.config.ownerId !== void 0 && row[field.name] === this.config.ownerId || stampedCellKeys.has(stampedCellKey(storeKey, row["id"], field.name))) {
               return;
             }
             row[field.name] = i === 0 ? "" : rows[Math.floor((i - 1) / 2)]["id"];
@@ -2330,15 +2435,21 @@ var MockPersistenceAdapter = class _MockPersistenceAdapter {
           continue;
         }
         for (const row of rows) {
-          if (this.config.ownerId !== void 0 && row[field.name] === this.config.ownerId) {
+          const selfId = row["id"];
+          if (this.config.ownerId !== void 0 && row[field.name] === this.config.ownerId || stampedCellKeys.has(stampedCellKey(storeKey, selfId, field.name))) {
             continue;
           }
-          const selfId = row["id"];
-          const eligible = [];
+          let eligible = [];
           for (const id of targetStore.keys()) {
             if (sameStore && id === selfId) continue;
             eligible.push(id);
           }
+          if (isOwnerColumn && this.ownerCandidateGate) {
+            const gate = this.ownerCandidateGate;
+            eligible = eligible.filter(
+              (id) => gate(storeKey, { ...row, [field.name]: id }, targetStore.get(id))
+            );
+          }
           if (eligible.length === 0) continue;
           if (cardinality === "one" || cardinality === "many-to-one") {
             row[field.name] = randomArrayElement(eligible);
@@ -2416,13 +2527,22 @@ var MockPersistenceAdapter = class _MockPersistenceAdapter {
     if (this.config.debug) {
       mockLog.debug("seeding", { count, entity: entityName });
     }
-    const ownerCols = (this.config.ownerFields ?? []).map((pair) => pair.split(".")).filter(([ent]) => ent?.toLowerCase() === normalized).map(([, field]) => field).filter((field) => Boolean(field));
+    const ownerCols = this.parsedOwnerFields().filter(({ entity }) => entity.toLowerCase() === normalized).map(({ field }) => field);
     const ownerId = this.config.ownerId;
     const generated = [];
+    let fallbackStamps = 0;
     for (let i = 0; i < count; i++) {
       const item = this.generateMockItem(entityName, fields, i + 1, persistence);
       if (ownerId && ownerCols.length > 0 && i % 2 === 0) {
         for (const col of ownerCols) {
+          if (this.ownerGate && !this.ownerGate(storeKey, { ...item, [col]: ownerId })) {
+            const fallbackId = this.firstEligibleOwner(storeKey, col, item);
+            if (fallbackId === void 0) continue;
+            item[col] = fallbackId;
+            this.ownerStampedCells.push({ entity: storeKey, id: item.id, column: col });
+            fallbackStamps++;
+            continue;
+          }
           item[col] = ownerId;
           this.ownerStampedCells.push({ entity: storeKey, id: item.id, column: col });
         }
@@ -2433,7 +2553,23 @@ var MockPersistenceAdapter = class _MockPersistenceAdapter {
         updatedAt: typeof item.updatedAt === "string" ? item.updatedAt : ""
       });
     }
-    mockLog.debug("mock:seed", () => ({ entityName, count, idsAndTimestamps: JSON.stringify(generated) }));
+    mockLog.debug("mock:seed", () => ({
+      entityName,
+      count,
+      idsAndTimestamps: JSON.stringify(generated),
+      fallbackStamps
+    }));
+  }
+  /** Parsed `config.ownerFields` pairs — every declared "Entity.field" owner
+   *  column, split once so `seed()` and `linkRelationFields()` don't each
+   *  re-parse the same strings. */
+  parsedOwnerFields() {
+    const out = [];
+    for (const pair of this.config.ownerFields ?? []) {
+      const [entity, field] = pair.split(".");
+      if (entity && field) out.push({ entity, field });
+    }
+    return out;
   }
   /**
    * Generate a single mock item. Field values come from the canonical policy in

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 import { g as RuntimePatternValue, B as BindingContext, f as EvaluationContextExtensions, P as PatternProps, E as EffectHandlers, h as EffectContext, i as ExecutionEnvironment, j as EffectResult, S as ServiceCallContext, T as TraitDefinition } from './types-BaD_ox7e.js';
 export { k as BrowserFileMeta, l as BrowserFilePickerOptions, m as BrowserGeolocationOptions, n as BrowserGeolocationPosition, C as ConfigContext, o as Effect, a as EventListener, H as HANDLER_MANIFEST, I as IEventBus, b as RuntimeConfig, R as RuntimeEvent, d as TraitState, c as TransitionObserver, e as TransitionResult, U as Unsubscribe } from './types-BaD_ox7e.js';
-import { U as UnifiedLoaderOptions, S as SchemaLoader, I as ImportChainLike, L as LoadResult, a as LoadedSchema, b as LoadedOrbital, P as PersistenceAdapter } from './OrbitalServerRuntime-nqwGldMC.js';
-export { E as EntitySharingMap, c as EventBus, d as EventNamespaceMap, e as InMemoryPersistence, O as OrbitalEventRequest, f as OrbitalEventResponse, g as OrbitalServerRuntimeConfig, h as PreprocessOptions, i as PreprocessResult, j as PreprocessedSchema, k as ProcessEventOptions, R as RegisteredOrbital, l as RuntimeOrbital, m as RuntimeOrbitalSchema, n as RuntimeTrait, o as StateMachineManager, p as collectDeclaredConfigDefaults, q as collectDeclaredEntityDefaults, r as createInitialTraitState, s as findInitialState, t as findTransition, u as getIsolatedCollectionName, v as getNamespacedEvent, w as isBrowser, x as isElectron, y as isNamespacedEvent, z as isNode, A as normalizeEventKey, B as parseNamespacedEvent, C as preprocessSchema, D as processEvent } from './OrbitalServerRuntime-nqwGldMC.js';
+import { U as UnifiedLoaderOptions, S as SchemaLoader, I as ImportChainLike, L as LoadResult, a as LoadedSchema, b as LoadedOrbital, P as PersistenceAdapter } from './OrbitalServerRuntime-DOJDoqXu.js';
+export { E as EntitySharingMap, c as EventBus, d as EventNamespaceMap, e as InMemoryPersistence, O as OrbitalEventRequest, f as OrbitalEventResponse, g as OrbitalServerRuntimeConfig, h as PreprocessOptions, i as PreprocessResult, j as PreprocessedSchema, k as ProcessEventOptions, R as RegisteredOrbital, l as RuntimeOrbital, m as RuntimeOrbitalSchema, n as RuntimeTrait, o as StateMachineManager, p as collectDeclaredConfigDefaults, q as collectDeclaredEntityDefaults, r as createInitialTraitState, s as findInitialState, t as findTransition, u as getIsolatedCollectionName, v as getNamespacedEvent, w as isBrowser, x as isElectron, y as isNamespacedEvent, z as isNode, A as normalizeEventKey, B as parseNamespacedEvent, C as preprocessSchema, D as processEvent } from './OrbitalServerRuntime-DOJDoqXu.js';
 import { EvaluationContext, SExpressionEvaluator } from '@almadar/evaluator';
 export { EvaluationContext, createMinimalContext } from '@almadar/evaluator';
 import { RenderBindingMarker, SExpr, RuntimeValue, TraitConfigObject, EventPayload, PatternConfig, EntityId, EntityField, EntityRow, EntityPersistence, ServiceParams, EntityAccessPolicies, PayloadField, OrbitalDefinition, OrbitalSchema } from '@almadar/core';
@@ -663,8 +663,55 @@ declare class MockPersistenceAdapter implements PersistenceAdapter {
      * No-op when there is no new id, or it matches the current one — an
      * anonymous switch (`newOwnerId === undefined`) leaves existing stamps as
      * they are rather than clearing a non-nullable owner column.
+     *
+     * Both this re-labeling AND `seed()`'s original stamping consult the
+     * `ownerGate` hook (see `setOwnerGate`) — a re-register reseeds identical
+     * rows, so gating only the restamp path leaks the moment a client
+     * connects and the deterministic reseed stamps with the updated ownerId.
      */
     restampOwner(newOwnerId: string | undefined): void;
+    /**
+     * The host's answer to "may the current viewer OWN this row?" — evaluated
+     * against the candidate row with the owner column already re-pointed,
+     * `storeKey` being the collection key the stores are keyed by. The runtime
+     * installs the registered schema's `@create` directive here (the single
+     * authority on who authors; no role heuristics), so a read-only persona
+     * never inherits authorship of drafts from the demo stamper — neither on a
+     * persona switch (`restampOwner`) nor on a deterministic reseed (`seed`).
+     * Absent hook = stamp unconditionally (pre-role-model behavior).
+     */
+    private ownerGate?;
+    setOwnerGate(gate: ((storeKey: string, candidateRow: EntityRow) => boolean) | undefined): void;
+    /**
+     * The host's answer to "may THIS identity row own this candidate row?" —
+     * evaluated per candidate rather than against the fixed default viewer, so
+     * `linkRelationFields` and the eligible-owner fallback (see
+     * `firstEligibleOwner`) can pick a policy-valid owner from the whole
+     * identity roster instead of only ever checking the current default user.
+     * Absent hook = no candidate filtering (pre-role-model behavior).
+     */
+    private ownerCandidateGate?;
+    setOwnerCandidateGate(gate: ((storeKey: string, candidateRow: EntityRow, candidateIdentityRow: EntityRow) => boolean) | undefined): void;
+    /**
+     * The store an owner column's relation field targets, resolved the same
+     * way `linkRelationFields` resolves any relation target (id sibling wins
+     * over the `entity` name string) — but keyed by STORE, mirroring that
+     * method's first-declarer-per-collection rule, so `seed()` and
+     * `restampOwner()` can find it before a `linkRelationFields` pass has run
+     * this registration. Undefined when no registered schema on `storeKey`
+     * declares `column` as a relation field.
+     */
+    private resolveOwnerColumnTargetStore;
+    /**
+     * The first identity-store row (seed order) whose persona is eligible, per
+     * the installed `ownerCandidateGate`, to own `row`'s `column` in `storeKey`
+     * — the deterministic replacement for "skip the stamp" when the CURRENT
+     * viewer fails the `@create` policy (e.g. a reader-default persona against
+     * an author|reviewer-only policy). Undefined when no gate is installed, the
+     * column isn't a resolvable relation, or no identity row is eligible — the
+     * caller keeps today's skip behavior in that case.
+     */
+    private firstEligibleOwner;
     /** Re-anchor the PRNG to the configured seed. Called before every
      *  re-seed loop so identical reseed sequences produce identical rows
      *  (timestamps + generated fields). Without this, the first
@@ -722,6 +769,10 @@ declare class MockPersistenceAdapter implements PersistenceAdapter {
      * Seed an entity with mock data.
      */
     seed(entityName: string, fields: EntityField[], count: number, persistence?: EntityPersistence): void;
+    /** Parsed `config.ownerFields` pairs — every declared "Entity.field" owner
+     *  column, split once so `seed()` and `linkRelationFields()` don't each
+     *  re-parse the same strings. */
+    private parsedOwnerFields;
     /**
      * Generate a single mock item. Field values come from the canonical policy in
      * `@almadar/core/mock`; this method owns only the id and timestamp stamping.

package/dist/index.js

@@ -1,5 +1,5 @@
-import { EffectExecutor } from './chunk-C7SIRVGS.js';
-export { EffectExecutor, EventBus, HANDLER_MANIFEST, InMemoryPersistence, MockPersistenceAdapter, StateMachineManager, TickScheduler, buildEmitsFromTraits, collectDeclaredConfigDefaults, collectDeclaredEntityDefaults, createInitialTraitState, createMockPersistence, createTestExecutor, createTickScheduler, createUnifiedLoader, findInitialState, findTransition, formatPayloadValidationError, getIsolatedCollectionName, getNamespacedEvent, isBrowser, isElectron, isNamespacedEvent, isNode, isValidDurationString, normalizeCallSiteConfigToValues, normalizeEventKey, parseDurationString, parseNamespacedEvent, preprocessSchema, processEvent, validateEventPayload, validatePayloadShapes } from './chunk-C7SIRVGS.js';
+import { EffectExecutor } from './chunk-IFSFX43J.js';
+export { EffectExecutor, EventBus, HANDLER_MANIFEST, InMemoryPersistence, MockPersistenceAdapter, StateMachineManager, TickScheduler, buildEmitsFromTraits, collectDeclaredConfigDefaults, collectDeclaredEntityDefaults, createInitialTraitState, createMockPersistence, createTestExecutor, createTickScheduler, createUnifiedLoader, findInitialState, findTransition, formatPayloadValidationError, getIsolatedCollectionName, getNamespacedEvent, isBrowser, isElectron, isNamespacedEvent, isNode, isValidDurationString, normalizeCallSiteConfigToValues, normalizeEventKey, parseDurationString, parseNamespacedEvent, preprocessSchema, processEvent, validateEventPayload, validatePayloadShapes } from './chunk-IFSFX43J.js';
 export { cronMatches, cronMinuteKey, isValidCronExpression, parseCron, parseCronField } from './chunk-OU3ITB5S.js';
 import { createContextFromBindings, applyRowAccess, checkMutationAccess, accessDeniedMessage } from './chunk-ZJ62H3ES.js';
 export { CALLSITE_PAYLOAD_PREFIX, applyRowAccess, checkMutationAccess, containsBindings, createContextFromBindings, createMinimalContext, deferEntityBindings, extractBindings, interpolateProps, interpolateValue, resolveCallSitePayloadCaptures } from './chunk-ZJ62H3ES.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@almadar/runtime",
-  "version": "6.63.0",
+  "version": "6.64.0",
   "description": "Interpreted runtime for Almadar orbital applications (OrbitalServerRuntime)",
   "type": "module",
   "main": "./dist/index.js",
@@ -57,11 +57,11 @@
     "access": "public"
   },
   "dependencies": {
-    "@almadar/core": "^10.73.0",
+    "@almadar/core": "^10.75.0",
     "@almadar/evaluator": "^2.42.0",
     "@almadar/logger": "^1.11.0",
     "@almadar/server": "^2.38.0",
-    "@almadar/std": "^16.192.0"
+    "@almadar/std": "^16.194.0"
   },
   "peerDependencies": {
     "express": "^5.0.0"