@astram/engine 0.1.0

package/dist/pipe/stages/audit.js

@@ -0,0 +1,42 @@
+"use strict";
+/**
+ * Stage: audit (MANDATORY). Records an append-only audit event for the write via the
+ * injected {@link AuditPort} (core's AuditSink). Like the permission gate, this stage
+ * is a fixed segment of the pipe — there is no way for a caller to skip it, so EVERY
+ * write is attributable. Runs after the write succeeds, inside the same transaction,
+ * so the audit row commits atomically with the data (no data without its audit).
+ *
+ * The event carries the actor, tenant, action, and resource — NEVER the row's secret
+ * values (core's audit sink additionally strips sensitive keys). Actor is referenced
+ * by stable id; the presentation layer resolves it to a label (no raw ids to users).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.auditStage = auditStage;
+function opToActionKey(op) {
+    return op;
+}
+function auditStage(audit) {
+    return {
+        name: 'audit',
+        async run(ctx) {
+            const action = { key: opToActionKey(ctx.op) };
+            const resource = {
+                level: ctx.resultId !== undefined && typeof ctx.resultId === 'string' ? 'record' : 'object_type',
+                typeKey: ctx.registration.typeKey,
+                tenantId: ctx.actor.tenantId,
+                ...(typeof ctx.resultId === 'string' ? { recordId: ctx.resultId } : {}),
+            };
+            const event = {
+                type: 'admin_action',
+                occurredAtMs: ctx.nowMs,
+                actorId: ctx.actor.id,
+                tenantId: ctx.actor.tenantId,
+                action,
+                resource,
+                attributes: { op: ctx.op, typeKey: ctx.registration.typeKey },
+            };
+            // Write the audit row on the pipe's OWN transaction (atomic with the data).
+            await audit.record(event, ctx.query);
+        },
+    };
+}

package/dist/pipe/stages/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../../src/pipe/stages/audit.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;AASH,gCA0BC;AA9BD,SAAS,aAAa,CAAC,EAAW;IAChC,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAgB,UAAU,CAAC,KAAgB;IACzC,OAAO;QACL,IAAI,EAAE,OAAO;QACb,KAAK,CAAC,GAAG,CAAC,GAAiB;YACzB,MAAM,MAAM,GAAW,EAAE,GAAG,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YACtD,MAAM,QAAQ,GAAa;gBACzB,KAAK,EAAE,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa;gBAChG,OAAO,EAAE,GAAG,CAAC,YAAY,CAAC,OAAO;gBACjC,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,QAAQ;gBAC5B,GAAG,CAAC,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxE,CAAC;YAEF,MAAM,KAAK,GAAe;gBACxB,IAAI,EAAE,cAAc;gBACpB,YAAY,EAAE,GAAG,CAAC,KAAK;gBACvB,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE;gBACrB,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,QAAQ;gBAC5B,MAAM;gBACN,QAAQ;gBACR,UAAU,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,YAAY,CAAC,OAAO,EAAE;aAC9D,CAAC;YAEF,4EAA4E;YAC5E,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/pipe/stages/derive-write-context.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Stage: derive-write-context (anti-forgery). Server OVERWRITES every field marked
+ * `trusted` with a value derived from the actor/context — NEVER the client body.
+ * This closes the "client claims a different tenantId/owner" forgery that a raw
+ * write would allow. Runs BEFORE validate so the trusted values are validated too.
+ *
+ * The trusted sources (Phase 1): `tenantId` (the actor's tenant) and `actorId`
+ * (the acting principal's id). A field declared `trusted` ignores client input.
+ *
+ * CHOKEPOINT 2 (§4.2 of the framework-owns-data-layer design). This stamp is now
+ * STRUCTURALLY MANDATORY for a governed type: chokepoint 1 (the registry `validate`)
+ * GUARANTEES that a type declaring `access.owned` has a `trusted:'actorId'` column and
+ * a type declaring `access.tenantScoped` has a `trusted:'tenantId'` column. Because
+ * this stage runs in the FIXED `writeStages` sequence ("ALWAYS present, no skip flag")
+ * and always overwrites those columns from the actor/context, no code path can create
+ * a governed record with a forged or missing owner/tenant. The enforcement is the pair
+ * (chokepoint 1 guarantees the column exists + this stage always fills it); no extra
+ * per-write assertion is needed — the trusted mechanism below IS the stamp.
+ */
+import type { Stage } from '../context.js';
+export declare function deriveWriteContextStage(): Stage;
+//# sourceMappingURL=derive-write-context.d.ts.map

package/dist/pipe/stages/derive-write-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"derive-write-context.d.ts","sourceRoot":"","sources":["../../../src/pipe/stages/derive-write-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,KAAK,EAAE,KAAK,EAAgB,MAAM,eAAe,CAAC;AAYzD,wBAAgB,uBAAuB,IAAI,KAAK,CA4B/C"}

package/dist/pipe/stages/derive-write-context.js

@@ -0,0 +1,61 @@
+"use strict";
+/**
+ * Stage: derive-write-context (anti-forgery). Server OVERWRITES every field marked
+ * `trusted` with a value derived from the actor/context — NEVER the client body.
+ * This closes the "client claims a different tenantId/owner" forgery that a raw
+ * write would allow. Runs BEFORE validate so the trusted values are validated too.
+ *
+ * The trusted sources (Phase 1): `tenantId` (the actor's tenant) and `actorId`
+ * (the acting principal's id). A field declared `trusted` ignores client input.
+ *
+ * CHOKEPOINT 2 (§4.2 of the framework-owns-data-layer design). This stamp is now
+ * STRUCTURALLY MANDATORY for a governed type: chokepoint 1 (the registry `validate`)
+ * GUARANTEES that a type declaring `access.owned` has a `trusted:'actorId'` column and
+ * a type declaring `access.tenantScoped` has a `trusted:'tenantId'` column. Because
+ * this stage runs in the FIXED `writeStages` sequence ("ALWAYS present, no skip flag")
+ * and always overwrites those columns from the actor/context, no code path can create
+ * a governed record with a forged or missing owner/tenant. The enforcement is the pair
+ * (chokepoint 1 guarantees the column exists + this stage always fills it); no extra
+ * per-write assertion is needed — the trusted mechanism below IS the stamp.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deriveWriteContextStage = deriveWriteContextStage;
+const registry_js_1 = require("../../registry.js");
+function trustedValue(source, ctx) {
+    switch (source) {
+        case 'tenantId':
+            return ctx.actor.tenantId;
+        case 'actorId':
+            return ctx.actor.id;
+    }
+}
+function deriveWriteContextStage() {
+    return {
+        name: 'derive-write-context',
+        async run(ctx) {
+            // delete carries no field body — nothing to derive.
+            if (ctx.op === 'delete')
+                return;
+            const input = ctx.input?.fields ?? {};
+            for (const field of ctx.registration.fields) {
+                const col = (0, registry_js_1.columnOf)(field);
+                if (field.trusted) {
+                    // Trusted (owner/tenant) fields are SET-ONCE-AT-CREATE and immutable thereafter.
+                    // On create: stamp from the actor/context (client input discarded — anti-forgery).
+                    // On update: do NOT re-stamp — re-stamping `actorId` would silently TRANSFER
+                    // ownership to the editor (Bob edits Alice's record → created_by becomes Bob,
+                    // breaking the `created_by == actor` ownership baseline); re-stamping `tenantId`
+                    // is benign but a record never changes tenant, so leave all trusted fields
+                    // untouched on update. (Any client-supplied value for a trusted field on update
+                    // is IGNORED here — the column simply isn't written, so the stored value stands.)
+                    if (ctx.op === 'create') {
+                        ctx.columns[col] = trustedValue(field.trusted, ctx);
+                    }
+                }
+                else if (Object.prototype.hasOwnProperty.call(input, field.key)) {
+                    ctx.columns[col] = input[field.key];
+                }
+            }
+        },
+    };
+}

package/dist/pipe/stages/derive-write-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"derive-write-context.js","sourceRoot":"","sources":["../../../src/pipe/stages/derive-write-context.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;GAkBG;;AAeH,0DA4BC;AAzCD,mDAA6C;AAI7C,SAAS,YAAY,CAAC,MAAqB,EAAE,GAAiB;IAC5D,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,UAAU;YACb,OAAO,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC5B,KAAK,SAAS;YACZ,OAAO,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;IACxB,CAAC;AACH,CAAC;AAED,SAAgB,uBAAuB;IACrC,OAAO;QACL,IAAI,EAAE,sBAAsB;QAC5B,KAAK,CAAC,GAAG,CAAC,GAAiB;YACzB,oDAAoD;YACpD,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ;gBAAE,OAAO;YAChC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,EAAE,MAAM,IAAI,EAAE,CAAC;YAEtC,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,YAAY,CAAC,MAA8B,EAAE,CAAC;gBACpE,MAAM,GAAG,GAAG,IAAA,sBAAQ,EAAC,KAAK,CAAC,CAAC;gBAC5B,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;oBAClB,iFAAiF;oBACjF,mFAAmF;oBACnF,6EAA6E;oBAC7E,8EAA8E;oBAC9E,iFAAiF;oBACjF,2EAA2E;oBAC3E,gFAAgF;oBAChF,kFAAkF;oBAClF,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;wBACxB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;oBACtD,CAAC;gBACH,CAAC;qBAAM,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;oBAClE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACtC,CAAC;YACH,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/pipe/stages/fetch-owner.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Stage: fetch-owner (record-level OWNED write ONLY — runs BEFORE the permission gate).
+ *
+ * Core's decision authority is zero-dep (no DB) and decides BEFORE the row is fetched,
+ * so it cannot see a record's owner to check DAC ownership. This stage closes that gap
+ * for `owned` types on update/delete: it SELECTs the EXISTING row's owner column —
+ * TENANT-SCOPED in the WHERE so it can never read another tenant's row — and stashes it
+ * on `ctx.ownerId`. The permission-gate stage then passes it to `decide()` as
+ * `context.attributes.ownerId`, where core's owner baseline compares it to the actor.
+ *
+ * ── EXEMPTIONS (no pre-fetch):
+ *   - `create` — there is no existing record; the owner is being SET by the
+ *     derive-write-context stage, not checked. (This stage no-ops for create.)
+ *   - NON-owned / system types — no owner column to check; the gate runs on the
+ *     grant/system baseline alone. (No unnecessary query.)
+ *
+ * ── SECURITY (fail-closed):
+ *   - The row does NOT exist (or is in another tenant) ⇒ `ctx.ownerId` stays undefined
+ *     ⇒ core's owner baseline finds no match ⇒ the gate denies (no_record_permit). A
+ *     missing record NEVER leaks and NEVER passes.
+ *   - This stage only READS the owner column (tenant-scoped) — it performs no write and
+ *     surfaces no row content; the fetched owner is an opaque id fed to the gate.
+ *   - The stage runs inside the SAME transaction as the gate + write (one UoW), so the
+ *     owner it read is the owner the write will act on (no TOCTOU within the txn).
+ */
+import type { Stage } from '../context.js';
+export declare function fetchOwnerStage(): Stage;
+//# sourceMappingURL=fetch-owner.d.ts.map

package/dist/pipe/stages/fetch-owner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch-owner.d.ts","sourceRoot":"","sources":["../../../src/pipe/stages/fetch-owner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAIH,OAAO,KAAK,EAAE,KAAK,EAAgB,MAAM,eAAe,CAAC;AAqCzD,wBAAgB,eAAe,IAAI,KAAK,CAgCvC"}

package/dist/pipe/stages/fetch-owner.js

@@ -0,0 +1,90 @@
+"use strict";
+/**
+ * Stage: fetch-owner (record-level OWNED write ONLY — runs BEFORE the permission gate).
+ *
+ * Core's decision authority is zero-dep (no DB) and decides BEFORE the row is fetched,
+ * so it cannot see a record's owner to check DAC ownership. This stage closes that gap
+ * for `owned` types on update/delete: it SELECTs the EXISTING row's owner column —
+ * TENANT-SCOPED in the WHERE so it can never read another tenant's row — and stashes it
+ * on `ctx.ownerId`. The permission-gate stage then passes it to `decide()` as
+ * `context.attributes.ownerId`, where core's owner baseline compares it to the actor.
+ *
+ * ── EXEMPTIONS (no pre-fetch):
+ *   - `create` — there is no existing record; the owner is being SET by the
+ *     derive-write-context stage, not checked. (This stage no-ops for create.)
+ *   - NON-owned / system types — no owner column to check; the gate runs on the
+ *     grant/system baseline alone. (No unnecessary query.)
+ *
+ * ── SECURITY (fail-closed):
+ *   - The row does NOT exist (or is in another tenant) ⇒ `ctx.ownerId` stays undefined
+ *     ⇒ core's owner baseline finds no match ⇒ the gate denies (no_record_permit). A
+ *     missing record NEVER leaks and NEVER passes.
+ *   - This stage only READS the owner column (tenant-scoped) — it performs no write and
+ *     surfaces no row content; the fetched owner is an opaque id fed to the gate.
+ *   - The stage runs inside the SAME transaction as the gate + write (one UoW), so the
+ *     owner it read is the owner the write will act on (no TOCTOU within the txn).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fetchOwnerStage = fetchOwnerStage;
+const errors_js_1 = require("../../errors.js");
+const registry_js_1 = require("../../registry.js");
+function qualified(ctx) {
+    const schema = ctx.registration.schema;
+    const t = ctx.registration.table;
+    return schema ? `\`${schema}\`.\`${t}\`` : `\`${t}\``;
+}
+/** WHERE (pk [+ tenant]) for the target id — the SAME tenant-scoping the write stage uses. */
+function whereById(ctx, id) {
+    const pk = ctx.registration.primaryKey;
+    let sql;
+    let params;
+    if (pk.kind === 'uuid') {
+        if (typeof id !== 'string') {
+            throw new errors_js_1.RegistrationError(`uuid PK table '${ctx.registration.typeKey}' needs a string id`);
+        }
+        sql = `\`${(0, registry_js_1.uuidPkColumn)(pk)}\` = ?`;
+        params = [id];
+    }
+    else {
+        if (typeof id === 'string') {
+            throw new errors_js_1.RegistrationError(`composite PK table '${ctx.registration.typeKey}' needs a key map, not a string id`);
+        }
+        sql = pk.columns.map((c) => `\`${c}\` = ?`).join(' AND ');
+        params = pk.columns.map((c) => id[c]);
+    }
+    const tenantCol = (0, registry_js_1.tenantColumnOf)(ctx.registration);
+    if (tenantCol) {
+        sql += ` AND \`${tenantCol}\` = ?`;
+        params = [...params, ctx.actor.tenantId];
+    }
+    return { sql, params };
+}
+function fetchOwnerStage() {
+    return {
+        name: 'fetch-owner',
+        async run(ctx) {
+            // Only OWNED update/delete pre-fetch. create + non-owned types no-op.
+            if (ctx.op === 'create')
+                return;
+            if (!(0, registry_js_1.isOwned)(ctx.registration))
+                return;
+            if (ctx.id === undefined)
+                return;
+            const ownerCol = (0, registry_js_1.ownerColumn)(ctx.registration);
+            if (!ownerCol) {
+                // An owned type without an actorId column is a boot-time impossibility
+                // (chokepoint 1). Fail-closed rather than silently skipping the owner check.
+                throw new errors_js_1.RegistrationError(`owned type '${ctx.registration.typeKey}' has no trusted:'actorId' owner column`);
+            }
+            const where = whereById(ctx, ctx.id);
+            const rows = (await ctx.query(`SELECT \`${ownerCol}\` AS owner_id FROM ${qualified(ctx)} WHERE ${where.sql} LIMIT 1`, where.params));
+            const first = rows[0];
+            // Missing row (or wrong tenant) ⇒ ownerId stays undefined ⇒ the gate denies.
+            // Only stash a genuine string owner; a null/non-string owner is left undefined so
+            // the baseline's strict === can never spuriously match.
+            if (first && typeof first.owner_id === 'string') {
+                ctx.ownerId = first.owner_id;
+            }
+        },
+    };
+}

package/dist/pipe/stages/fetch-owner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch-owner.js","sourceRoot":"","sources":["../../../src/pipe/stages/fetch-owner.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;;AAyCH,0CAgCC;AAvED,+CAAoD;AACpD,mDAAuF;AAIvF,SAAS,SAAS,CAAC,GAAiB;IAClC,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC;IACvC,MAAM,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC;IACjC,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;AACxD,CAAC;AAED,8FAA8F;AAC9F,SAAS,SAAS,CAAC,GAAiB,EAAE,EAAY;IAChD,MAAM,EAAE,GAAG,GAAG,CAAC,YAAY,CAAC,UAAU,CAAC;IACvC,IAAI,GAAW,CAAC;IAChB,IAAI,MAAiB,CAAC;IACtB,IAAI,EAAE,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACvB,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;YAC3B,MAAM,IAAI,6BAAiB,CAAC,kBAAkB,GAAG,CAAC,YAAY,CAAC,OAAO,qBAAqB,CAAC,CAAC;QAC/F,CAAC;QACD,GAAG,GAAG,KAAK,IAAA,0BAAY,EAAC,EAAE,CAAC,QAAQ,CAAC;QACpC,MAAM,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;SAAM,CAAC;QACN,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;YAC3B,MAAM,IAAI,6BAAiB,CACzB,uBAAuB,GAAG,CAAC,YAAY,CAAC,OAAO,oCAAoC,CACpF,CAAC;QACJ,CAAC;QACD,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1D,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,MAAM,SAAS,GAAG,IAAA,4BAAc,EAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACnD,IAAI,SAAS,EAAE,CAAC;QACd,GAAG,IAAI,UAAU,SAAS,QAAQ,CAAC;QACnC,MAAM,GAAG,CAAC,GAAG,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;AACzB,CAAC;AAED,SAAgB,eAAe;IAC7B,OAAO;QACL,IAAI,EAAE,aAAa;QACnB,KAAK,CAAC,GAAG,CAAC,GAAiB;YACzB,sEAAsE;YACtE,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ;gBAAE,OAAO;YAChC,IAAI,CAAC,IAAA,qBAAO,EAAC,GAAG,CAAC,YAAY,CAAC;gBAAE,OAAO;YACvC,IAAI,GAAG,CAAC,EAAE,KAAK,SAAS;gBAAE,OAAO;YAEjC,MAAM,QAAQ,GAAG,IAAA,yBAAW,EAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAC/C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,uEAAuE;gBACvE,6EAA6E;gBAC7E,MAAM,IAAI,6BAAiB,CACzB,eAAe,GAAG,CAAC,YAAY,CAAC,OAAO,yCAAyC,CACjF,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YACrC,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,CAC3B,YAAY,QAAQ,uBAAuB,SAAS,CAAC,GAAG,CAAC,UAAU,KAAK,CAAC,GAAG,UAAU,EACtF,KAAK,CAAC,MAAM,CACb,CAAiC,CAAC;YACnC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACtB,6EAA6E;YAC7E,kFAAkF;YAClF,wDAAwD;YACxD,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAChD,GAAG,CAAC,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC;YAC/B,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/pipe/stages/junction-sync.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Stage: junction-sync. Syncs composite-key link tables (e.g. user_roles) after the
+ * base row is written. Phase-1 semantics: for each junction named in the input, the
+ * engine DELETEs the local side's existing links and re-INSERTs the supplied foreign
+ * ids (set-replace), applying any server-set payload defaults (e.g. is_active=1).
+ * All within the same transaction as the base write (atomic).
+ *
+ * Junction writes are parameterized. On delete of the base record, all its junction
+ * links are removed (referential cleanup) since Phase-1 tables may not have DB-level
+ * cascade.
+ */
+import type { Stage } from '../context.js';
+export declare function junctionSyncStage(): Stage;
+//# sourceMappingURL=junction-sync.d.ts.map

package/dist/pipe/stages/junction-sync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"junction-sync.d.ts","sourceRoot":"","sources":["../../../src/pipe/stages/junction-sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,KAAK,EAAgB,MAAM,eAAe,CAAC;AAkBzD,wBAAgB,iBAAiB,IAAI,KAAK,CAsCzC"}

package/dist/pipe/stages/junction-sync.js

@@ -0,0 +1,63 @@
+"use strict";
+/**
+ * Stage: junction-sync. Syncs composite-key link tables (e.g. user_roles) after the
+ * base row is written. Phase-1 semantics: for each junction named in the input, the
+ * engine DELETEs the local side's existing links and re-INSERTs the supplied foreign
+ * ids (set-replace), applying any server-set payload defaults (e.g. is_active=1).
+ * All within the same transaction as the base write (atomic).
+ *
+ * Junction writes are parameterized. On delete of the base record, all its junction
+ * links are removed (referential cleanup) since Phase-1 tables may not have DB-level
+ * cascade.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.junctionSyncStage = junctionSyncStage;
+function localId(ctx, junction) {
+    // The local side is this record's id. For uuid PKs it's the resultId string; for
+    // composite tables a junction rarely applies, but if it does the caller supplies
+    // the local key via the base columns — resolved by the junction's localColumn.
+    const id = ctx.resultId ?? ctx.id;
+    if (typeof id === 'string')
+        return id;
+    if (id && typeof id === 'object')
+        return id[junction.localColumn];
+    return undefined;
+}
+function jtable(ctx, j) {
+    const schema = ctx.registration.schema;
+    return schema ? `\`${schema}\`.\`${j.table}\`` : `\`${j.table}\``;
+}
+function junctionSyncStage() {
+    return {
+        name: 'junction-sync',
+        async run(ctx) {
+            const junctions = ctx.registration.junctions ?? [];
+            if (junctions.length === 0)
+                return;
+            for (const j of junctions) {
+                const local = localId(ctx, j);
+                if (local === undefined)
+                    continue;
+                const table = jtable(ctx, j);
+                if (ctx.op === 'delete') {
+                    // Remove all links for this local id.
+                    await ctx.query(`DELETE FROM ${table} WHERE \`${j.localColumn}\` = ?`, [local]);
+                    continue;
+                }
+                // create/update: only touch a junction the caller actually provided.
+                const foreignIds = ctx.junctions[j.name];
+                if (foreignIds === undefined)
+                    continue;
+                // Set-replace: clear then insert the supplied foreign ids.
+                await ctx.query(`DELETE FROM ${table} WHERE \`${j.localColumn}\` = ?`, [local]);
+                const payloadCols = Object.keys(j.payloadDefaults ?? {});
+                const cols = [j.localColumn, j.foreignColumn, ...payloadCols];
+                const placeholders = cols.map(() => '?').join(', ');
+                for (const fid of foreignIds) {
+                    const params = [local, fid, ...payloadCols.map((c) => j.payloadDefaults[c])];
+                    await ctx.query(`INSERT INTO ${table} (${cols.map((c) => `\`${c}\``).join(', ')}) VALUES (${placeholders})`, params);
+                }
+            }
+        },
+    };
+}

package/dist/pipe/stages/junction-sync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"junction-sync.js","sourceRoot":"","sources":["../../../src/pipe/stages/junction-sync.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;AAoBH,8CAsCC;AArDD,SAAS,OAAO,CAAC,GAAiB,EAAE,QAAsB;IACxD,iFAAiF;IACjF,iFAAiF;IACjF,+EAA+E;IAC/E,MAAM,EAAE,GAAyB,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,EAAE,CAAC;IACxD,IAAI,OAAO,EAAE,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACtC,IAAI,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAClE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,MAAM,CAAC,GAAiB,EAAE,CAAe;IAChD,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC;IACvC,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,QAAQ,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC;AACpE,CAAC;AAED,SAAgB,iBAAiB;IAC/B,OAAO;QACL,IAAI,EAAE,eAAe;QACrB,KAAK,CAAC,GAAG,CAAC,GAAiB;YACzB,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,SAAS,IAAI,EAAE,CAAC;YACnD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO;YAEnC,KAAK,MAAM,CAAC,IAAI,SAAoC,EAAE,CAAC;gBACrD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;gBAC9B,IAAI,KAAK,KAAK,SAAS;oBAAE,SAAS;gBAClC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;gBAE7B,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;oBACxB,sCAAsC;oBACtC,MAAM,GAAG,CAAC,KAAK,CAAC,eAAe,KAAK,YAAY,CAAC,CAAC,WAAW,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;oBAChF,SAAS;gBACX,CAAC;gBAED,qEAAqE;gBACrE,MAAM,UAAU,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACzC,IAAI,UAAU,KAAK,SAAS;oBAAE,SAAS;gBAEvC,2DAA2D;gBAC3D,MAAM,GAAG,CAAC,KAAK,CAAC,eAAe,KAAK,YAAY,CAAC,CAAC,WAAW,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;gBAEhF,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;gBACzD,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,aAAa,EAAE,GAAG,WAAW,CAAC,CAAC;gBAC9D,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACpD,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;oBAC7B,MAAM,MAAM,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC9E,MAAM,GAAG,CAAC,KAAK,CACb,eAAe,KAAK,KAAK,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,YAAY,GAAG,EAC3F,MAAM,CACP,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/pipe/stages/permission-gate.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Stage: permission gate (MANDATORY). Calls the framework's single decision
+ * authority (`decide()`), and STOPS the pipe (fail-closed) on deny or transient.
+ * This stage has NO skip flag — it is a fixed segment of the pipe (§design: fixes
+ * ORS's `@Optional()`/`skipPermissionCheck` bypass). The engine never invents its
+ * own allow/deny logic; it asks `decide()` and obeys.
+ */
+import type { DecisionPort } from '../../ports.js';
+import type { Stage } from '../context.js';
+export declare function permissionGateStage(decision: DecisionPort): Stage;
+//# sourceMappingURL=permission-gate.d.ts.map

package/dist/pipe/stages/permission-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-gate.d.ts","sourceRoot":"","sources":["../../../src/pipe/stages/permission-gate.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEnD,OAAO,KAAK,EAAE,KAAK,EAAyB,MAAM,eAAe,CAAC;AAOlE,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,YAAY,GAAG,KAAK,CAwCjE"}

package/dist/pipe/stages/permission-gate.js

@@ -0,0 +1,53 @@
+"use strict";
+/**
+ * Stage: permission gate (MANDATORY). Calls the framework's single decision
+ * authority (`decide()`), and STOPS the pipe (fail-closed) on deny or transient.
+ * This stage has NO skip flag — it is a fixed segment of the pipe (§design: fixes
+ * ORS's `@Optional()`/`skipPermissionCheck` bypass). The engine never invents its
+ * own allow/deny logic; it asks `decide()` and obeys.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.permissionGateStage = permissionGateStage;
+const errors_js_1 = require("../../errors.js");
+/** Map the pipe op to the stable authorization action key. */
+function actionKey(op) {
+    return op; // 'create' | 'update' | 'delete' — stable action keys (core §5.2)
+}
+function permissionGateStage(decision) {
+    return {
+        name: 'permission-gate',
+        async run(ctx) {
+            const action = { key: actionKey(ctx.op) };
+            const resource = {
+                level: ctx.id !== undefined ? 'record' : 'object_type',
+                typeKey: ctx.registration.typeKey,
+                // The resource's owning tenant is the ACTOR's tenant for a write — a write
+                // into another tenant is denied by the tenant gate downstream in decide().
+                tenantId: ctx.actor.tenantId,
+                ...(typeof ctx.id === 'string' ? { recordId: ctx.id } : {}),
+            };
+            // For an OWNED update/delete, the fetch-owner stage (which ran BEFORE this one)
+            // read the existing row's owner tenant-scoped and stashed it on ctx.ownerId. Pass
+            // it to decide() so core's owner baseline can compare it to the actor. Absent (not
+            // owned, or the row is missing/other-tenant) ⇒ no attribute ⇒ the baseline finds
+            // no owner match ⇒ deny (the missing row never leaks).
+            const context = {
+                isAuthenticated: true,
+                ...(ctx.ownerId !== undefined ? { attributes: { ownerId: ctx.ownerId } } : {}),
+            };
+            let outcome;
+            try {
+                outcome = await decision.decide(ctx.actor, action, resource, context);
+            }
+            catch (err) {
+                // A thrown decision = transient/unavailable (ADR-0016). Fail-closed: do NOT
+                // proceed; signal retryable.
+                throw new errors_js_1.EngineUnavailableError(`decision authority unavailable for ${ctx.op} ${ctx.registration.typeKey}: ` +
+                    `${err.message}`);
+            }
+            if (outcome.effect !== 'allow') {
+                throw new errors_js_1.AuthorizationDeniedError(outcome.reason, outcome.detail);
+            }
+        },
+    };
+}

package/dist/pipe/stages/permission-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-gate.js","sourceRoot":"","sources":["../../../src/pipe/stages/permission-gate.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AAYH,kDAwCC;AAlDD,+CAAmF;AAKnF,8DAA8D;AAC9D,SAAS,SAAS,CAAC,EAAW;IAC5B,OAAO,EAAE,CAAC,CAAC,kEAAkE;AAC/E,CAAC;AAED,SAAgB,mBAAmB,CAAC,QAAsB;IACxD,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,KAAK,CAAC,GAAG,CAAC,GAAiB;YACzB,MAAM,MAAM,GAAW,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YAClD,MAAM,QAAQ,GAAa;gBACzB,KAAK,EAAE,GAAG,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa;gBACtD,OAAO,EAAE,GAAG,CAAC,YAAY,CAAC,OAAO;gBACjC,2EAA2E;gBAC3E,2EAA2E;gBAC3E,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,QAAQ;gBAC5B,GAAG,CAAC,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5D,CAAC;YACF,gFAAgF;YAChF,kFAAkF;YAClF,mFAAmF;YACnF,iFAAiF;YACjF,uDAAuD;YACvD,MAAM,OAAO,GAAoB;gBAC/B,eAAe,EAAE,IAAI;gBACrB,GAAG,CAAC,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/E,CAAC;YAEF,IAAI,OAAO,CAAC;YACZ,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YACxE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,4EAA4E;gBAC5E,6BAA6B;gBAC7B,MAAM,IAAI,kCAAsB,CAC9B,sCAAsC,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,YAAY,CAAC,OAAO,IAAI;oBAC1E,GAAI,GAAa,CAAC,OAAO,EAAE,CAC9B,CAAC;YACJ,CAAC;YAED,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBAC/B,MAAM,IAAI,oCAAwB,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/pipe/stages/validate.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Stage: validate. Checks the derived columns against the registration's field
+ * specs — required-on-create, type correctness, unknown-field rejection — and
+ * coerces where safe. An unsupported field TYPE surfaces the gap-flag STOP
+ * (`CapabilityNotSupportedError`), never a silent pass.
+ *
+ * Runs AFTER derive-write-context so trusted (server) values are validated too.
+ */
+import type { Stage } from '../context.js';
+export declare function validateStage(): Stage;
+//# sourceMappingURL=validate.d.ts.map

package/dist/pipe/stages/validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../../src/pipe/stages/validate.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,KAAK,EAAE,KAAK,EAAgB,MAAM,eAAe,CAAC;AAiDzD,wBAAgB,aAAa,IAAI,KAAK,CAmCrC"}

package/dist/pipe/stages/validate.js

@@ -0,0 +1,89 @@
+"use strict";
+/**
+ * Stage: validate. Checks the derived columns against the registration's field
+ * specs — required-on-create, type correctness, unknown-field rejection — and
+ * coerces where safe. An unsupported field TYPE surfaces the gap-flag STOP
+ * (`CapabilityNotSupportedError`), never a silent pass.
+ *
+ * Runs AFTER derive-write-context so trusted (server) values are validated too.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateStage = validateStage;
+const errors_js_1 = require("../../errors.js");
+const registry_js_1 = require("../../registry.js");
+const SUPPORTED = new Set([
+    'string',
+    'number',
+    'boolean',
+    'uuid',
+    'timestamp',
+    'json',
+]);
+const UUID_RE = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
+/** Validate + coerce one value against a field type. Returns the coerced value. */
+function coerce(field, value) {
+    switch (field.type) {
+        case 'string':
+            if (typeof value !== 'string')
+                throw new errors_js_1.ValidationError(field.key, 'expected a string');
+            return value;
+        case 'number':
+            if (typeof value !== 'number' || Number.isNaN(value)) {
+                throw new errors_js_1.ValidationError(field.key, 'expected a number');
+            }
+            return value;
+        case 'boolean':
+            if (typeof value === 'boolean')
+                return value ? 1 : 0; // MariaDB tinyint
+            throw new errors_js_1.ValidationError(field.key, 'expected a boolean');
+        case 'uuid':
+            if (typeof value !== 'string' || !UUID_RE.test(value)) {
+                throw new errors_js_1.ValidationError(field.key, 'expected a uuid');
+            }
+            return value;
+        case 'timestamp':
+            if (value instanceof Date)
+                return value;
+            if (typeof value === 'number')
+                return new Date(value);
+            if (typeof value === 'string' && !Number.isNaN(Date.parse(value)))
+                return new Date(value);
+            throw new errors_js_1.ValidationError(field.key, 'expected a timestamp (Date | epoch ms | ISO string)');
+        case 'json':
+            return JSON.stringify(value);
+        default:
+            // A field type the pipe does not implement → the gap-flag STOP.
+            throw new errors_js_1.CapabilityNotSupportedError(`fieldType:${field.type}`, `field '${field.key}' declares unsupported type '${field.type}'`);
+    }
+}
+function validateStage() {
+    return {
+        name: 'validate',
+        async run(ctx) {
+            if (ctx.op === 'delete')
+                return;
+            // Reject any input key that is not a registered field (no silent drop).
+            const known = new Set(ctx.registration.fields.map((f) => f.key));
+            for (const key of Object.keys(ctx.input?.fields ?? {})) {
+                if (!known.has(key)) {
+                    throw new errors_js_1.ValidationError(key, `unknown field for '${ctx.registration.typeKey}'`);
+                }
+            }
+            for (const field of ctx.registration.fields) {
+                // Guard-rail: reject a field type the pipe can't handle even if unset.
+                if (!SUPPORTED.has(field.type)) {
+                    throw new errors_js_1.CapabilityNotSupportedError(`fieldType:${field.type}`, `field '${field.key}' declares unsupported type '${field.type}'`);
+                }
+                const col = (0, registry_js_1.columnOf)(field);
+                const present = Object.prototype.hasOwnProperty.call(ctx.columns, col);
+                if (!present) {
+                    if (ctx.op === 'create' && field.required) {
+                        throw new errors_js_1.ValidationError(field.key, 'is required');
+                    }
+                    continue; // absent + optional (or update patch) → skip
+                }
+                ctx.columns[col] = coerce(field, ctx.columns[col]);
+            }
+        },
+    };
+}

package/dist/pipe/stages/validate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../../src/pipe/stages/validate.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;AAqDH,sCAmCC;AAtFD,+CAA+E;AAC/E,mDAA6C;AAI7C,MAAM,SAAS,GAA2B,IAAI,GAAG,CAAY;IAC3D,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,MAAM;IACN,WAAW;IACX,MAAM;CACP,CAAC,CAAC;AAEH,MAAM,OAAO,GAAG,+EAA+E,CAAC;AAEhG,mFAAmF;AACnF,SAAS,MAAM,CAAC,KAAgB,EAAE,KAAc;IAC9C,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,QAAQ;YACX,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,MAAM,IAAI,2BAAe,CAAC,KAAK,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;YACzF,OAAO,KAAK,CAAC;QACf,KAAK,QAAQ;YACX,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrD,MAAM,IAAI,2BAAe,CAAC,KAAK,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;YAC5D,CAAC;YACD,OAAO,KAAK,CAAC;QACf,KAAK,SAAS;YACZ,IAAI,OAAO,KAAK,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB;YACxE,MAAM,IAAI,2BAAe,CAAC,KAAK,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;QAC7D,KAAK,MAAM;YACT,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtD,MAAM,IAAI,2BAAe,CAAC,KAAK,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;YAC1D,CAAC;YACD,OAAO,KAAK,CAAC;QACf,KAAK,WAAW;YACd,IAAI,KAAK,YAAY,IAAI;gBAAE,OAAO,KAAK,CAAC;YACxC,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;YACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAAE,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;YAC1F,MAAM,IAAI,2BAAe,CAAC,KAAK,CAAC,GAAG,EAAE,qDAAqD,CAAC,CAAC;QAC9F,KAAK,MAAM;YACT,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC/B;YACE,gEAAgE;YAChE,MAAM,IAAI,uCAA2B,CACnC,aAAa,KAAK,CAAC,IAAc,EAAE,EACnC,UAAU,KAAK,CAAC,GAAG,gCAAgC,KAAK,CAAC,IAAc,GAAG,CAC3E,CAAC;IACN,CAAC;AACH,CAAC;AAED,SAAgB,aAAa;IAC3B,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,KAAK,CAAC,GAAG,CAAC,GAAiB;YACzB,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ;gBAAE,OAAO;YAEhC,wEAAwE;YACxE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACjE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;gBACvD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBACpB,MAAM,IAAI,2BAAe,CAAC,GAAG,EAAE,sBAAsB,GAAG,CAAC,YAAY,CAAC,OAAO,GAAG,CAAC,CAAC;gBACpF,CAAC;YACH,CAAC;YAED,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,YAAY,CAAC,MAA8B,EAAE,CAAC;gBACpE,uEAAuE;gBACvE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC/B,MAAM,IAAI,uCAA2B,CACnC,aAAa,KAAK,CAAC,IAAc,EAAE,EACnC,UAAU,KAAK,CAAC,GAAG,gCAAgC,KAAK,CAAC,IAAc,GAAG,CAC3E,CAAC;gBACJ,CAAC;gBACD,MAAM,GAAG,GAAG,IAAA,sBAAQ,EAAC,KAAK,CAAC,CAAC;gBAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;gBAEvE,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;wBAC1C,MAAM,IAAI,2BAAe,CAAC,KAAK,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;oBACtD,CAAC;oBACD,SAAS,CAAC,6CAA6C;gBACzD,CAAC;gBACD,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/pipe/stages/write.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Stage: write. Persists the validated columns to the real physical table via the
+ * bound transactional query fn (parameterized — never string-built). Handles the
+ * create (INSERT with a pre-allocated uuid PK), update (UPDATE by id), and delete
+ * (DELETE by id). This is the ONLY stage that writes the base row; extension-field
+ * sidecar writes attach here too when the table is extensible.
+ *
+ * uuid generation uses node:crypto (guard/engine own node built-ins; core does not).
+ */
+import type { Stage } from '../context.js';
+export declare function writeStage(): Stage;
+//# sourceMappingURL=write.d.ts.map

package/dist/pipe/stages/write.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"write.d.ts","sourceRoot":"","sources":["../../../src/pipe/stages/write.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,OAAO,KAAK,EAAE,KAAK,EAAgB,MAAM,eAAe,CAAC;AAoDzD,wBAAgB,UAAU,IAAI,KAAK,CAkDlC"}