@astram/engine 0.2.0 → 0.4.0

package/dist/registry.d.ts

@@ -8,7 +8,7 @@
  * Runtime-registered (no-code) tables will register through the SAME registry later
  * (the no-code phase); the pipe does not distinguish how a registration arrived.
  */
-import type { FieldSpec, PkStrategy, ObjectType } from './types.js';
+import type { FieldSpec, PkStrategy, ObjectType, Principal } from './types.js';
 export declare class TableRegistry {
     private readonly byType;
     /** Register a table. Throws on a duplicate typeKey or an invalid registration. */
@@ -37,6 +37,37 @@ export declare function ownerColumn(reg: ObjectType): string | null;
 export declare function tenantColumnOf(reg: ObjectType): string | null;
 /** The physical column of the field bearing `role`, or null if unclaimed. */
 export declare function columnForRole(reg: ObjectType, role: FieldSpec['role']): string | null;
+/**
+ * The WRITE-scope predicate for a type's update/delete WHERE (ADR-0030) — the write-path twin of
+ * the read wall (`readScope`). For a type declaring `readScope`, it constrains a NON-ROOT actor's
+ * update/delete to rows within the actor's reachable subtree, so a targeted write to a
+ * foreign-subtree row matches ZERO rows (fail-closed no-op) instead of touching it. It is a
+ * FILTER, never a stamp — no column value is set, so the ADR-0027 create-stamping decoupling
+ * (add-to-sub-company) is preserved. ADR-0034 reuses the SAME clause for the post-insert create
+ * wall (`write.ts`), so update, delete and create share one definition of "inside my subtree".
+ *
+ * Returns `null` (nothing to AND) when:
+ *  - the type declares no `readScope`, OR
+ *  - the actor is ROOT (`isRoot === true`, strict) — root spans all subtrees.
+ * Otherwise returns an AND-able fragment (the leading ` AND ` is the CALLER's to prepend — this
+ * returns the bare predicate + its `?`-bound params), over the actor's subtree nodes:
+ *  - `nodeColumn`      → `` `<column>` IN (?, ...) ``.
+ *  - `subtreeSubquery` → `` `<pkColumn>` IN (<subquerySql, :nodes → IN (?, ...)>) ``.
+ *
+ * INJECTION-FREE BY CONSTRUCTION: identifiers are compile-time constants (the type's own column
+ * or the fixed framework template); the ONLY dynamic values are the `?`-bound subtree node ids.
+ * Mirrors the engine's private `readScopeClause` exactly (one definition of the subtree predicate).
+ */
+export declare function writeScopeClause(reg: ObjectType, actor: Principal): {
+    sql: string;
+    params: readonly unknown[];
+} | null;
+/**
+ * Whether a NON-ROOT create of this type must pass the post-insert create wall (ADR-0034): the
+ * type declares `readScope` and has not explicitly opted out with `create: 'unscoped'`. Default
+ * walled (fail closed). Root is handled by {@link writeScopeClause} returning `null`.
+ */
+export declare function isCreateWalled(reg: ObjectType): boolean;
 /** Boot-enforce that exactly-one field claims `role`; throw if none. */
 export declare function requireRole(reg: ObjectType, role: NonNullable<FieldSpec['role']>): void;
 //# sourceMappingURL=registry.d.ts.map

package/dist/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAEpE,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiC;IAExD,kFAAkF;IAClF,QAAQ,CAAC,GAAG,EAAE,UAAU,GAAG,IAAI;IAQ/B,uEAAuE;IACvE,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU;IAWpC,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAI7B,GAAG,IAAI,SAAS,UAAU,EAAE;CAG7B;AAED,iFAAiF;AACjF,wBAAgB,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAEjD;AAED,mEAAmE;AACnE,wBAAgB,YAAY,CAAC,EAAE,EAAE,UAAU,GAAG,MAAM,CAKnD;AAED;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAEhD;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,UAAU,GAAG,MAAM,GAAG,IAAI,CAG1D;AAED,6FAA6F;AAC7F,wBAAgB,cAAc,CAAC,GAAG,EAAE,UAAU,GAAG,MAAM,GAAG,IAAI,CAG7D;AAED,6EAA6E;AAC7E,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,GAAG,MAAM,GAAG,IAAI,CAGrF;AAED,wEAAwE;AACxE,wBAAgB,WAAW,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,CAMvF"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE/E,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiC;IAExD,kFAAkF;IAClF,QAAQ,CAAC,GAAG,EAAE,UAAU,GAAG,IAAI;IAQ/B,uEAAuE;IACvE,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU;IAWpC,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAI7B,GAAG,IAAI,SAAS,UAAU,EAAE;CAG7B;AAED,iFAAiF;AACjF,wBAAgB,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAEjD;AAED,mEAAmE;AACnE,wBAAgB,YAAY,CAAC,EAAE,EAAE,UAAU,GAAG,MAAM,CAKnD;AAED;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAEhD;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,UAAU,GAAG,MAAM,GAAG,IAAI,CAG1D;AAED,6FAA6F;AAC7F,wBAAgB,cAAc,CAAC,GAAG,EAAE,UAAU,GAAG,MAAM,GAAG,IAAI,CAG7D;AAED,6EAA6E;AAC7E,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,GAAG,MAAM,GAAG,IAAI,CAGrF;AAaD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,UAAU,EACf,KAAK,EAAE,SAAS,GACf;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,SAAS,OAAO,EAAE,CAAA;CAAE,GAAG,IAAI,CAYpD;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAEvD;AAED,wEAAwE;AACxE,wBAAgB,WAAW,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,CAMvF"}

package/dist/registry.js

@@ -17,8 +17,11 @@ exports.isOwned = isOwned;
 exports.ownerColumn = ownerColumn;
 exports.tenantColumnOf = tenantColumnOf;
 exports.columnForRole = columnForRole;
+exports.writeScopeClause = writeScopeClause;
+exports.isCreateWalled = isCreateWalled;
 exports.requireRole = requireRole;
 const errors_js_1 = require("./errors.js");
+const types_js_1 = require("./types.js");
 class TableRegistry {
     byType = new Map();
     /** Register a table. Throws on a duplicate typeKey or an invalid registration. */
@@ -83,6 +86,59 @@ function columnForRole(reg, role) {
     const f = reg.fields.find((x) => x.role === role);
     return f?.column ?? f?.key ?? null;
 }
+/**
+ * The subtree node set a non-root actor's scope is bounded to (ADR-0027) — its
+ * `scopeSubtreeNodeIds`, resolved once at login and cached. FAIL-SAFE + non-widening: a malformed
+ * or absent subtree falls back to just the actor's home node (`[actor.tenantId]`) — today's flat
+ * self-isolation; NEVER an empty set. The SAME set the read wall + tenant gate + list-scope use.
+ */
+function subtreeNodesOf(actor) {
+    const subtree = actor.scopeSubtreeNodeIds;
+    return Array.isArray(subtree) && subtree.length > 0 ? subtree : [actor.tenantId];
+}
+/**
+ * The WRITE-scope predicate for a type's update/delete WHERE (ADR-0030) — the write-path twin of
+ * the read wall (`readScope`). For a type declaring `readScope`, it constrains a NON-ROOT actor's
+ * update/delete to rows within the actor's reachable subtree, so a targeted write to a
+ * foreign-subtree row matches ZERO rows (fail-closed no-op) instead of touching it. It is a
+ * FILTER, never a stamp — no column value is set, so the ADR-0027 create-stamping decoupling
+ * (add-to-sub-company) is preserved. ADR-0034 reuses the SAME clause for the post-insert create
+ * wall (`write.ts`), so update, delete and create share one definition of "inside my subtree".
+ *
+ * Returns `null` (nothing to AND) when:
+ *  - the type declares no `readScope`, OR
+ *  - the actor is ROOT (`isRoot === true`, strict) — root spans all subtrees.
+ * Otherwise returns an AND-able fragment (the leading ` AND ` is the CALLER's to prepend — this
+ * returns the bare predicate + its `?`-bound params), over the actor's subtree nodes:
+ *  - `nodeColumn`      → `` `<column>` IN (?, ...) ``.
+ *  - `subtreeSubquery` → `` `<pkColumn>` IN (<subquerySql, :nodes → IN (?, ...)>) ``.
+ *
+ * INJECTION-FREE BY CONSTRUCTION: identifiers are compile-time constants (the type's own column
+ * or the fixed framework template); the ONLY dynamic values are the `?`-bound subtree node ids.
+ * Mirrors the engine's private `readScopeClause` exactly (one definition of the subtree predicate).
+ */
+function writeScopeClause(reg, actor) {
+    const rs = reg.readScope;
+    if (!rs || actor.isRoot === true)
+        return null;
+    const nodes = subtreeNodesOf(actor);
+    const placeholders = nodes.map(() => '?').join(', ');
+    if (rs.kind === 'nodeColumn') {
+        return { sql: `\`${rs.column}\` IN (${placeholders})`, params: [...nodes] };
+    }
+    // subtreeSubquery: expand the FIXED template's `:nodes` token to a `?`-list. Identifiers are
+    // constants; only the node ids are `?`-bound.
+    const expanded = rs.subquerySql.replace(types_js_1.READ_SCOPE_NODES_TOKEN, placeholders);
+    return { sql: `\`${rs.pkColumn}\` IN (${expanded})`, params: [...nodes] };
+}
+/**
+ * Whether a NON-ROOT create of this type must pass the post-insert create wall (ADR-0034): the
+ * type declares `readScope` and has not explicitly opted out with `create: 'unscoped'`. Default
+ * walled (fail closed). Root is handled by {@link writeScopeClause} returning `null`.
+ */
+function isCreateWalled(reg) {
+    return reg.readScope !== undefined && reg.readScope.create !== 'unscoped';
+}
 /** Boot-enforce that exactly-one field claims `role`; throw if none. */
 function requireRole(reg, role) {
     if (!reg.fields.some((f) => f.role === role)) {
@@ -103,6 +159,20 @@ function validate(reg) {
             throw new errors_js_1.RegistrationError(`registration '${reg.typeKey}': duplicate field key '${f.key}'`);
         }
         keys.add(f.key);
+        // ADR-0034: `immutable` is a security posture (create-only) — a truthy non-boolean is a
+        // malformed declaration, never silently read as "mutable".
+        const immutable = f.immutable;
+        if (immutable !== undefined && typeof immutable !== 'boolean') {
+            throw new errors_js_1.RegistrationError(`registration '${reg.typeKey}': field '${f.key}' immutable must be a boolean, got ` +
+                `${typeof immutable} (${String(immutable)}).`);
+        }
+    }
+    // ADR-0034: the create-wall mode is either absent (walled), 'walled' or 'unscoped'. Anything
+    // else fails boot — an opt-out is an explicit decision, never a typo.
+    const createMode = reg.readScope?.create;
+    if (createMode !== undefined && createMode !== 'walled' && createMode !== 'unscoped') {
+        throw new errors_js_1.RegistrationError(`registration '${reg.typeKey}': readScope.create must be 'walled' or 'unscoped', got ` +
+            `'${String(createMode)}'.`);
     }
     if (reg.primaryKey.kind === 'composite' && reg.primaryKey.columns.length < 2) {
         throw new errors_js_1.RegistrationError(`registration '${reg.typeKey}': composite primary key needs >= 2 columns`);

package/dist/types.d.ts

@@ -38,6 +38,14 @@ export interface FieldSpec {
      * password, etc.) and carries no write-time behavior of its own.
      */
     readonly role?: IdentityRole;
+    /**
+     * A CREATE-ONLY field (ADR-0034): written on create, and IGNORED on update exactly like a
+     * `trusted` field — an update's value for it never reaches the UPDATE SQL, so the stored value
+     * stands. Use it for structural links that a plain patch must never move (a company's parent,
+     * a membership's user/company, a posting's membership/role); moving them needs a dedicated,
+     * checked operation. Must be a boolean when present (boot-validated).
+     */
+    readonly immutable?: boolean;
 }
 /** Server-trusted write-context sources (derive-write-context stage). */
 export type TrustedSource = 'tenantId' | 'actorId';
@@ -101,8 +109,18 @@ export interface AccessDeclaration {
 /**
  * How a type's LIST/GET reads are scoped to the caller's reachable subtree (ADR-0027) —
  * DECOUPLED from `trusted:'tenantId'` (which stamps WRITES via derive-write-context).
- * `readScope` filters READS ONLY; it has ZERO write effect (a create still stamps only the
- * `trusted` fields). Absent ⇒ no subtree read-scope (today's behavior — the tenant clause,
+ * `readScope` filters READS, and (ADR-0030) also FILTERS the update/delete WHERE so a non-root
+ * actor cannot mutate/delete a row outside its subtree by id — a fail-closed no-op, the write-path
+ * twin of the read wall. It is NEVER a create-stamp (a create still stamps only the `trusted`
+ * fields — the decoupling that lets an admin add a user to a SUB-company is preserved).
+ *
+ * CREATE WALL (ADR-0034): a NON-ROOT create of a `readScope` type is re-checked inside the same
+ * unit of work right after the INSERT — `SELECT 1 … WHERE <pk> = ? AND <the same write-scope
+ * clause>`; zero rows ⇒ `AuthorizationDeniedError` and the transaction rolls back. This is the
+ * DEFAULT (`create` absent or `'walled'`): fail closed. A type whose rows are born OUTSIDE every
+ * subtree (a new company before the closure lists it, a new user before any membership, a new
+ * role before any posting) opts out EXPLICITLY with `create: 'unscoped'`. Absent `readScope` ⇒
+ * no subtree read/write-scope (today's behavior — the tenant clause,
  * if the type has a `trusted:'tenantId'` column, still applies; a `system` type with no
  * such column then returns unscoped, which is why the identity `system` types declare a
  * `readScope` to wall themselves). Applied by the engine AFTER the tenant clause, for
@@ -122,8 +140,12 @@ export interface AccessDeclaration {
 export type ReadScope = {
     readonly kind: 'nodeColumn';
     readonly column: string;
+    /** Create-wall mode (ADR-0034). Absent ⇒ `'walled'` (fail closed). */
+    readonly create?: ReadScopeCreateMode;
 } | {
     readonly kind: 'subtreeSubquery';
+    /** Create-wall mode (ADR-0034). Absent ⇒ `'walled'` (fail closed). */
+    readonly create?: ReadScopeCreateMode;
     /** The type's OWN PK column to test membership of. */
     readonly pkColumn: string;
     /**
@@ -133,6 +155,13 @@ export type ReadScope = {
      */
     readonly subquerySql: string;
 };
+/**
+ * How a non-root CREATE of a `readScope` type is checked (ADR-0034):
+ *  - `'walled'` (the default when absent) — the inserted row must satisfy the write-scope clause,
+ *    else the create is denied and rolled back.
+ *  - `'unscoped'` — an explicit opt-out for types whose rows are born outside every subtree.
+ */
+export type ReadScopeCreateMode = 'walled' | 'unscoped';
 /** The token a `subtreeSubquery` template uses for the engine-expanded subtree id list. */
 export declare const READ_SCOPE_NODES_TOKEN = ":nodes";
 /** Primary-key strategy for a registered table. */
@@ -176,9 +205,11 @@ export interface ObjectType {
     readonly access: AccessDeclaration;
     /**
      * OPTIONAL read-scope declaration (ADR-0027) — how LIST/GET reads are filtered to the
-     * caller's reachable subtree, DECOUPLED from the write path. See {@link ReadScope}.
-     * Absent ⇒ no subtree read-scope (the tenant clause, if any, still applies). Has ZERO
-     * write effect.
+     * caller's reachable subtree. Also FILTERS the update/delete WHERE for a non-root actor
+     * (ADR-0030 — a fail-closed no-op on a foreign-subtree target), and WALLS a non-root create
+     * (ADR-0034 — denied + rolled back unless `create: 'unscoped'`), but is NEVER a create-stamp.
+     * See {@link ReadScope}. Absent ⇒ no subtree read/write-scope (the tenant clause, if any,
+     * still applies).
      */
     readonly readScope?: ReadScope;
 }
@@ -225,7 +256,11 @@ export interface ListQuery {
     readonly where?: Readonly<Record<string, unknown>>;
     /** Free-text LIKE search across named field keys (ANDed with `where` + tenant). */
     readonly search?: SearchQuery;
-    /** A registered field KEY to ORDER BY (unknown → RegistrationError). */
+    /**
+     * A registered field KEY to ORDER BY (unknown → RegistrationError). The primary-key
+     * column(s) are always appended ascending as the final tiebreaker, so OFFSET paging is
+     * stable; with no `sortBy` the list is ordered by the primary key.
+     */
     readonly sortBy?: string;
     /** Sort direction; anything other than 'desc' is treated as ascending. */
     readonly sortOrder?: 'asc' | 'desc';
@@ -242,10 +277,35 @@ export interface RecordPage {
  */
 export interface RecordEngine {
     create(typeKey: string, input: RecordInput, actor: Principal): Promise<RecordId>;
+    /**
+     * update/delete judge the EXISTING row (its fields, owner and tenant) in `decide()`. A record
+     * the actor cannot reach (missing, other tenant, outside the write scope) is refused with
+     * `AuthorizationDeniedError('no_record_permit')`, never a silent no-op. get() judges the same
+     * way and returns `null` for an unreachable record of a non-owned type.
+     */
     update(typeKey: string, id: RecordId, input: RecordInput, actor: Principal): Promise<void>;
     delete(typeKey: string, id: RecordId, actor: Principal): Promise<void>;
     get(typeKey: string, id: RecordId, actor: Principal): Promise<RecordView | null>;
     list(typeKey: string, query: ListQuery, actor: Principal): Promise<RecordPage>;
+    /**
+     * Run `fn` in ONE unit of work (ADR-0034). Every op on the `tx` handle — and every plain call
+     * on this engine made from inside `fn` — shares the same transaction; each op still runs the
+     * full pipe (gate, validate, write, audit). Commits when `fn` resolves; rolls back when it
+     * throws. ROLLBACK-ONLY: once a WRITE op inside the transaction has failed, the transaction can
+     * no longer commit (even if `fn` swallowed the error) — the partial write of a failed op is
+     * never committed. A nested `transaction` (on the handle or on the engine) reuses the outer one.
+     * A handle used after its transaction ended fails closed (`EngineUnavailableError`).
+     */
+    transaction<T>(fn: (tx: RecordEngine) => Promise<T>): Promise<T>;
+    /**
+     * Take an exclusive ROW LOCK on one record (`SELECT … WHERE <pk> = ? FOR UPDATE`) on the open
+     * transaction's own connection, held until that transaction commits or rolls back. Use it to
+     * serialise a check-then-write against a concurrent writer of the same row: lock first, then
+     * re-check, then write. Returns nothing (no row data, no existence signal — a missing row is
+     * simply not locked), so it runs no read gate or wall. Only valid inside `transaction(fn)`:
+     * outside one it throws `EngineUnavailableError` (a lock released at once serialises nothing).
+     */
+    lockForUpdate(typeKey: string, id: RecordId, actor: Principal): Promise<void>;
 }
 export type { Principal };
 //# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/D,iFAAiF;AACjF,MAAM,MAAM,SAAS,GACjB,QAAQ,GACR,QAAQ,GACR,SAAS,GACT,MAAM,GACN,WAAW,GACX,MAAM,CAAC;AAEX,qDAAqD;AACrD,MAAM,WAAW,SAAS;IACxB,yEAAyE;IACzE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,2DAA2D;IAC3D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,mEAAmE;IACnE,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;IACjC;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC;CAC9B;AAED,yEAAyE;AACzE,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,SAAS,CAAC;AAEnD;;iFAEiF;AACjF,MAAM,MAAM,YAAY,GACpB,YAAY,GACZ,UAAU,GACV,UAAU,GACV,QAAQ,GACR,QAAQ,GACR,eAAe,GACf,gBAAgB,CAAC;AAErB;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,WAAW,iBAAiB;IAChC,wEAAwE;IACxE,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;;;;OAOG;IACH,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;CACjC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,MAAM,SAAS,GACjB;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACxD;IACE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,sDAAsD;IACtD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEN,2FAA2F;AAC3F,eAAO,MAAM,sBAAsB,WAAW,CAAC;AAE/C,mDAAmD;AACnD,MAAM,MAAM,UAAU,GAClB;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAExE,6DAA6D;AAC7D,MAAM,WAAW,YAAY;IAC3B,qDAAqD;IACrD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,+BAA+B;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,wDAAwD;IACxD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,2DAA2D;IAC3D,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,kFAAkF;IAClF,QAAQ,CAAC,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC9D;AAED,iFAAiF;AACjF,MAAM,WAAW,UAAU;IACzB,iFAAiF;IACjF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,2BAA2B;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,gFAAgF;IAChF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,SAAS,SAAS,EAAE,CAAC;IACtC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IAC7C,mEAAmE;IACnE,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;CAChC;AAED,iFAAiF;AACjF,MAAM,WAAW,WAAW;IAC1B,yDAAyD;IACzD,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACnD;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;CAClE;AAED,qFAAqF;AACrF,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAEjE,qFAAqF;AACrF,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACnD,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;CAClE;AAED;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,mFAAmF;IACnF,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,2CAA2C;IAC3C,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACnD,mFAAmF;IACnF,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,wEAAwE;IACxE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;CACrC;AAED,wCAAwC;AACxC,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,SAAS,UAAU,EAAE,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjF,MAAM,CACJ,OAAO,EAAE,MAAM,EACf,EAAE,EAAE,QAAQ,EACZ,KAAK,EAAE,WAAW,EAClB,KAAK,EAAE,SAAS,GACf,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACjF,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CAChF;AAED,YAAY,EAAE,SAAS,EAAE,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/D,iFAAiF;AACjF,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,GAAG,WAAW,GAAG,MAAM,CAAC;AAExF,qDAAqD;AACrD,MAAM,WAAW,SAAS;IACxB,yEAAyE;IACzE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,2DAA2D;IAC3D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,mEAAmE;IACnE,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;IACjC;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC;IAC7B;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,yEAAyE;AACzE,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,SAAS,CAAC;AAEnD;;iFAEiF;AACjF,MAAM,MAAM,YAAY,GACtB,YAAY,GAAG,UAAU,GAAG,UAAU,GAAG,QAAQ,GAAG,QAAQ,GAAG,eAAe,GAAG,gBAAgB,CAAC;AAEpG;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,WAAW,iBAAiB;IAChC,wEAAwE;IACxE,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;;;;OAOG;IACH,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;CACjC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,MAAM,SAAS,GACjB;IACE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,sEAAsE;IACtE,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC;CACvC,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,sEAAsE;IACtE,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC;IACtC,sDAAsD;IACtD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEN;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,UAAU,CAAC;AAExD,2FAA2F;AAC3F,eAAO,MAAM,sBAAsB,WAAW,CAAC;AAE/C,mDAAmD;AACnD,MAAM,MAAM,UAAU,GAClB;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAExE,6DAA6D;AAC7D,MAAM,WAAW,YAAY;IAC3B,qDAAqD;IACrD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,+BAA+B;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,wDAAwD;IACxD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,2DAA2D;IAC3D,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,kFAAkF;IAClF,QAAQ,CAAC,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC9D;AAED,iFAAiF;AACjF,MAAM,WAAW,UAAU;IACzB,iFAAiF;IACjF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,2BAA2B;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,gFAAgF;IAChF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,SAAS,SAAS,EAAE,CAAC;IACtC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IAC7C,mEAAmE;IACnE,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;CAChC;AAED,iFAAiF;AACjF,MAAM,WAAW,WAAW;IAC1B,yDAAyD;IACzD,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACnD;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;CAClE;AAED,qFAAqF;AACrF,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAEjE,qFAAqF;AACrF,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACnD,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;CAClE;AAED;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,mFAAmF;IACnF,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,2CAA2C;IAC3C,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACnD,mFAAmF;IACnF,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;CACrC;AAED,wCAAwC;AACxC,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,SAAS,UAAU,EAAE,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjF;;;;;OAKG;IACH,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3F,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACjF,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/E;;;;;;;;OAQG;IACH,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,YAAY,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACjE;;;;;;;OAOG;IACH,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/E;AAED,YAAY,EAAE,SAAS,EAAE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astram/engine",
-  "version": "0.2.0",
+  "version": "0.4.0",
   "license": "MIT",
   "description": "Astram framework — the paved road. ONE unbypassable write pipe (resolve-schema → permission gate → derive-write-context → validate → compute → write → junction-sync → audit → emit-event) over real physical tables, that every feature's CRUD flows through. Feature code receives ONLY the RecordEngine facade — never a raw pool/DataSource/QueryRunner (the physical wall). Security-gate + audit are mandatory stages. Missing capability → a typed CapabilityNotSupportedError (the gap-flag STOP). Builds on @astram/core (metadata contract, decide(), audit) + @astram/guard (decision authority).",
   "type": "commonjs",
@@ -21,7 +21,7 @@
   },
   "dependencies": {
     "mariadb": "^3.4.0",
-    "@astram/core": "1.2.0"
+    "@astram/core": "1.4.0"
   },
   "peerDependencies": {
     "@nestjs/common": "^11",

package/dist/pipe/stages/fetch-owner.d.ts

@@ -1,28 +0,0 @@
-/**
- * Stage: fetch-owner (record-level OWNED write ONLY — runs BEFORE the permission gate).
- *
- * Core's decision authority is zero-dep (no DB) and decides BEFORE the row is fetched,
- * so it cannot see a record's owner to check DAC ownership. This stage closes that gap
- * for `owned` types on update/delete: it SELECTs the EXISTING row's owner column —
- * TENANT-SCOPED in the WHERE so it can never read another tenant's row — and stashes it
- * on `ctx.ownerId`. The permission-gate stage then passes it to `decide()` as
- * `context.attributes.ownerId`, where core's owner baseline compares it to the actor.
- *
- * ── EXEMPTIONS (no pre-fetch):
- *   - `create` — there is no existing record; the owner is being SET by the
- *     derive-write-context stage, not checked. (This stage no-ops for create.)
- *   - NON-owned / system types — no owner column to check; the gate runs on the
- *     grant/system baseline alone. (No unnecessary query.)
- *
- * ── SECURITY (fail-closed):
- *   - The row does NOT exist (or is in another tenant) ⇒ `ctx.ownerId` stays undefined
- *     ⇒ core's owner baseline finds no match ⇒ the gate denies (no_record_permit). A
- *     missing record NEVER leaks and NEVER passes.
- *   - This stage only READS the owner column (tenant-scoped) — it performs no write and
- *     surfaces no row content; the fetched owner is an opaque id fed to the gate.
- *   - The stage runs inside the SAME transaction as the gate + write (one UoW), so the
- *     owner it read is the owner the write will act on (no TOCTOU within the txn).
- */
-import type { Stage } from '../context.js';
-export declare function fetchOwnerStage(): Stage;
-//# sourceMappingURL=fetch-owner.d.ts.map

package/dist/pipe/stages/fetch-owner.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"fetch-owner.d.ts","sourceRoot":"","sources":["../../../src/pipe/stages/fetch-owner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAIH,OAAO,KAAK,EAAE,KAAK,EAAgB,MAAM,eAAe,CAAC;AAqCzD,wBAAgB,eAAe,IAAI,KAAK,CAgCvC"}

package/dist/pipe/stages/fetch-owner.js

@@ -1,90 +0,0 @@
-"use strict";
-/**
- * Stage: fetch-owner (record-level OWNED write ONLY — runs BEFORE the permission gate).
- *
- * Core's decision authority is zero-dep (no DB) and decides BEFORE the row is fetched,
- * so it cannot see a record's owner to check DAC ownership. This stage closes that gap
- * for `owned` types on update/delete: it SELECTs the EXISTING row's owner column —
- * TENANT-SCOPED in the WHERE so it can never read another tenant's row — and stashes it
- * on `ctx.ownerId`. The permission-gate stage then passes it to `decide()` as
- * `context.attributes.ownerId`, where core's owner baseline compares it to the actor.
- *
- * ── EXEMPTIONS (no pre-fetch):
- *   - `create` — there is no existing record; the owner is being SET by the
- *     derive-write-context stage, not checked. (This stage no-ops for create.)
- *   - NON-owned / system types — no owner column to check; the gate runs on the
- *     grant/system baseline alone. (No unnecessary query.)
- *
- * ── SECURITY (fail-closed):
- *   - The row does NOT exist (or is in another tenant) ⇒ `ctx.ownerId` stays undefined
- *     ⇒ core's owner baseline finds no match ⇒ the gate denies (no_record_permit). A
- *     missing record NEVER leaks and NEVER passes.
- *   - This stage only READS the owner column (tenant-scoped) — it performs no write and
- *     surfaces no row content; the fetched owner is an opaque id fed to the gate.
- *   - The stage runs inside the SAME transaction as the gate + write (one UoW), so the
- *     owner it read is the owner the write will act on (no TOCTOU within the txn).
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.fetchOwnerStage = fetchOwnerStage;
-const errors_js_1 = require("../../errors.js");
-const registry_js_1 = require("../../registry.js");
-function qualified(ctx) {
-    const schema = ctx.registration.schema;
-    const t = ctx.registration.table;
-    return schema ? `\`${schema}\`.\`${t}\`` : `\`${t}\``;
-}
-/** WHERE (pk [+ tenant]) for the target id — the SAME tenant-scoping the write stage uses. */
-function whereById(ctx, id) {
-    const pk = ctx.registration.primaryKey;
-    let sql;
-    let params;
-    if (pk.kind === 'uuid') {
-        if (typeof id !== 'string') {
-            throw new errors_js_1.RegistrationError(`uuid PK table '${ctx.registration.typeKey}' needs a string id`);
-        }
-        sql = `\`${(0, registry_js_1.uuidPkColumn)(pk)}\` = ?`;
-        params = [id];
-    }
-    else {
-        if (typeof id === 'string') {
-            throw new errors_js_1.RegistrationError(`composite PK table '${ctx.registration.typeKey}' needs a key map, not a string id`);
-        }
-        sql = pk.columns.map((c) => `\`${c}\` = ?`).join(' AND ');
-        params = pk.columns.map((c) => id[c]);
-    }
-    const tenantCol = (0, registry_js_1.tenantColumnOf)(ctx.registration);
-    if (tenantCol) {
-        sql += ` AND \`${tenantCol}\` = ?`;
-        params = [...params, ctx.actor.tenantId];
-    }
-    return { sql, params };
-}
-function fetchOwnerStage() {
-    return {
-        name: 'fetch-owner',
-        async run(ctx) {
-            // Only OWNED update/delete pre-fetch. create + non-owned types no-op.
-            if (ctx.op === 'create')
-                return;
-            if (!(0, registry_js_1.isOwned)(ctx.registration))
-                return;
-            if (ctx.id === undefined)
-                return;
-            const ownerCol = (0, registry_js_1.ownerColumn)(ctx.registration);
-            if (!ownerCol) {
-                // An owned type without an actorId column is a boot-time impossibility
-                // (chokepoint 1). Fail-closed rather than silently skipping the owner check.
-                throw new errors_js_1.RegistrationError(`owned type '${ctx.registration.typeKey}' has no trusted:'actorId' owner column`);
-            }
-            const where = whereById(ctx, ctx.id);
-            const rows = (await ctx.query(`SELECT \`${ownerCol}\` AS owner_id FROM ${qualified(ctx)} WHERE ${where.sql} LIMIT 1`, where.params));
-            const first = rows[0];
-            // Missing row (or wrong tenant) ⇒ ownerId stays undefined ⇒ the gate denies.
-            // Only stash a genuine string owner; a null/non-string owner is left undefined so
-            // the baseline's strict === can never spuriously match.
-            if (first && typeof first.owner_id === 'string') {
-                ctx.ownerId = first.owner_id;
-            }
-        },
-    };
-}