@astram/engine 0.3.0 → 0.4.0

package/dist/decorators/access-bundle.decorator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"access-bundle.decorator.d.ts","sourceRoot":"","sources":["../../src/decorators/access-bundle.decorator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,kBAAkB,CAAC;AAW1B;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED,+CAA+C;AAC/C,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,SAAS,sBAAsB,EAAE,CAAC;CACzD;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5C;AAID;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,mBAAmB,GAAG,cAAc,CAItE;AAID;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,QAAQ,GAAG,gBAAgB,CAsCnE"}
+{"version":3,"file":"access-bundle.decorator.d.ts","sourceRoot":"","sources":["../../src/decorators/access-bundle.decorator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,kBAAkB,CAAC;AAW1B;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED,+CAA+C;AAC/C,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,SAAS,sBAAsB,EAAE,CAAC;CACzD;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5C;AAID;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,mBAAmB,GAAG,cAAc,CAItE;AAID;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,QAAQ,GAAG,gBAAgB,CA8BnE"}

package/dist/decorators/object-type.decorator.d.ts

@@ -59,6 +59,8 @@ export interface FieldOptions {
     readonly required?: boolean;
     readonly trusted?: TrustedSource;
     readonly role?: IdentityRole;
+    /** Create-only (ADR-0034): ignored on update. See `FieldSpec.immutable`. */
+    readonly immutable?: boolean;
 }
 /**
  * `@PrimaryKey` options — the {@link PkStrategy} discriminated union verbatim, so it

package/dist/decorators/object-type.decorator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"object-type.decorator.d.ts","sourceRoot":"","sources":["../../src/decorators/object-type.decorator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,kBAAkB,CAAC;AAG1B,OAAO,KAAK,EACV,iBAAiB,EAEjB,SAAS,EACT,YAAY,EACZ,YAAY,EAKZ,UAAU,IAAI,kBAAkB,EAChC,UAAU,EACV,SAAS,EACT,aAAa,EACd,MAAM,aAAa,CAAC;AAarB;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IAC7C;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;CAChC;AAED,wFAAwF;AACxF,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;IACjC,QAAQ,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC;CAC9B;AAED;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,UAAU,CAAC;AAI3C;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,iBAAiB,GAAG,cAAc,CAIlE;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,UAAW,SAAQ,kBAAkB;CAAG;AAEzD;;;;;;;;;GASG;AACH,wBAAgB,KAAK,CAAC,IAAI,EAAE,YAAY,GAAG,iBAAiB,CAQ3D;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,iBAAiB,GAAG,cAAc,CAIlE;AAqBD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,QAAQ,GAAG,kBAAkB,CAwCnE"}
+{"version":3,"file":"object-type.decorator.d.ts","sourceRoot":"","sources":["../../src/decorators/object-type.decorator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,kBAAkB,CAAC;AAG1B,OAAO,KAAK,EACV,iBAAiB,EAEjB,SAAS,EACT,YAAY,EACZ,YAAY,EAKZ,UAAU,IAAI,kBAAkB,EAChC,UAAU,EACV,SAAS,EACT,aAAa,EACd,MAAM,aAAa,CAAC;AAarB;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IAC7C;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;CAChC;AAED,wFAAwF;AACxF,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;IACjC,QAAQ,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC;IAC7B,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,UAAU,CAAC;AAI3C;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,iBAAiB,GAAG,cAAc,CAIlE;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,UAAW,SAAQ,kBAAkB;CAAG;AAEzD;;;;;;;;;GASG;AACH,wBAAgB,KAAK,CAAC,IAAI,EAAE,YAAY,GAAG,iBAAiB,CAO3D;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,iBAAiB,GAAG,cAAc,CAIlE;AAuBD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,QAAQ,GAAG,kBAAkB,CA+BnE"}

package/dist/decorators/object-type.decorator.js

@@ -103,6 +103,9 @@ function reflectField(spec) {
         f.trusted = spec.trusted;
     if (spec.role !== undefined)
         f.role = spec.role;
+    // Reflected AS-IS when present (a non-boolean is rejected by the registry at boot).
+    if (spec.immutable !== undefined)
+        f.immutable = spec.immutable;
     return f;
 }
 /**

package/dist/index.d.ts

@@ -15,7 +15,7 @@
  *    the `TableRegistry`, and the ports. Exported so the framework + integration
  *    tests can compose the engine directly; NOT for feature code.
  */
-export type { RecordEngine, AccessDeclaration, FieldSpec, FieldType, TrustedSource, IdentityRole, PkStrategy, JunctionSpec, RecordInput, RecordId, RecordView, ListQuery, RecordPage, Principal, ReadScope, } from './types.js';
+export type { RecordEngine, AccessDeclaration, FieldSpec, FieldType, TrustedSource, IdentityRole, PkStrategy, JunctionSpec, RecordInput, RecordId, RecordView, ListQuery, RecordPage, Principal, ReadScope, ReadScopeCreateMode, } from './types.js';
 export { READ_SCOPE_NODES_TOKEN } from './types.js';
 export { EngineError, CapabilityNotSupportedError, RegistrationError, AuthorizationDeniedError, ValidationError, EngineUnavailableError, } from './errors.js';
 export { ObjectType, Field, PrimaryKey, reflectObjectType, type ObjectTypeOptions, type FieldOptions, type PrimaryKeyOptions, } from './decorators/object-type.decorator.js';
@@ -24,8 +24,8 @@ export { EngineModule, RECORD_ENGINE, ENGINE_ALL_REGISTRATIONS, ENGINE_ALL_ACCES
 export { TableRegistry, columnOf, uuidPkColumn, isOwned, ownerColumn, tenantColumnOf, columnForRole, requireRole, } from './registry.js';
 export { RecordEngineImpl, type RecordEngineDeps } from './pipe/record-engine.js';
 export { RecordsService, BoundRecords, type ServiceAccountResolver, SERVICE_ACCOUNT_RESOLVER, } from './pipe/records-service.js';
-export { MariaDbUnitOfWork, type EngineDbConfig, } from './adapters/mariadb-unit-of-work.js';
+export { MariaDbUnitOfWork, type EngineDbConfig } from './adapters/mariadb-unit-of-work.js';
 export { MariaDbAuditSink, type AuditSinkConfig } from './adapters/mariadb-audit-sink.js';
-export type { QueryFn, UnitOfWork, DecisionPort, AuditPort, } from './ports.js';
+export type { QueryFn, UnitOfWork, DecisionPort, AuditPort } from './ports.js';
 export type { Stage, WriteContext, WriteOp, PipeBase } from './pipe/context.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,YAAY,EACV,YAAY,EACZ,iBAAiB,EACjB,SAAS,EACT,SAAS,EACT,aAAa,EACb,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,WAAW,EACX,QAAQ,EACR,UAAU,EACV,SAAS,EACT,UAAU,EACV,SAAS,EACT,SAAS,GACV,MAAM,YAAY,CAAC;AAKpB,OAAO,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEpD,OAAO,EACL,WAAW,EACX,2BAA2B,EAC3B,iBAAiB,EACjB,wBAAwB,EACxB,eAAe,EACf,sBAAsB,GACvB,MAAM,aAAa,CAAC;AAiBrB,OAAO,EACL,UAAU,EACV,KAAK,EACL,UAAU,EACV,iBAAiB,EACjB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,KAAK,iBAAiB,GACvB,MAAM,uCAAuC,CAAC;AAO/C,OAAO,EACL,YAAY,EACZ,mBAAmB,EACnB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,gBAAgB,GACtB,MAAM,yCAAyC,CAAC;AAEjD,OAAO,EACL,YAAY,EACZ,aAAa,EACb,wBAAwB,EACxB,yBAAyB,EACzB,KAAK,mBAAmB,EACxB,KAAK,eAAe,GACrB,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EACL,aAAa,EACb,QAAQ,EACR,YAAY,EACZ,OAAO,EACP,WAAW,EACX,cAAc,EACd,aAAa,EACb,WAAW,GACZ,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,gBAAgB,EAAE,KAAK,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAClF,OAAO,EACL,cAAc,EACd,YAAY,EACZ,KAAK,sBAAsB,EAC3B,wBAAwB,GACzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,iBAAiB,EACjB,KAAK,cAAc,GACpB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,KAAK,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAC1F,YAAY,EACV,OAAO,EACP,UAAU,EACV,YAAY,EACZ,SAAS,GACV,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,YAAY,EACV,YAAY,EACZ,iBAAiB,EACjB,SAAS,EACT,SAAS,EACT,aAAa,EACb,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,WAAW,EACX,QAAQ,EACR,UAAU,EACV,SAAS,EACT,UAAU,EACV,SAAS,EACT,SAAS,EACT,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAKpB,OAAO,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEpD,OAAO,EACL,WAAW,EACX,2BAA2B,EAC3B,iBAAiB,EACjB,wBAAwB,EACxB,eAAe,EACf,sBAAsB,GACvB,MAAM,aAAa,CAAC;AAiBrB,OAAO,EACL,UAAU,EACV,KAAK,EACL,UAAU,EACV,iBAAiB,EACjB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,KAAK,iBAAiB,GACvB,MAAM,uCAAuC,CAAC;AAO/C,OAAO,EACL,YAAY,EACZ,mBAAmB,EACnB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,gBAAgB,GACtB,MAAM,yCAAyC,CAAC;AAEjD,OAAO,EACL,YAAY,EACZ,aAAa,EACb,wBAAwB,EACxB,yBAAyB,EACzB,KAAK,mBAAmB,EACxB,KAAK,eAAe,GACrB,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EACL,aAAa,EACb,QAAQ,EACR,YAAY,EACZ,OAAO,EACP,WAAW,EACX,cAAc,EACd,aAAa,EACb,WAAW,GACZ,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,gBAAgB,EAAE,KAAK,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAClF,OAAO,EACL,cAAc,EACd,YAAY,EACZ,KAAK,sBAAsB,EAC3B,wBAAwB,GACzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,iBAAiB,EAAE,KAAK,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAC5F,OAAO,EAAE,gBAAgB,EAAE,KAAK,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAC1F,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC/E,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/pipe/context.d.ts

@@ -35,14 +35,25 @@ export interface WriteContext extends PipeBase {
     /** The id assigned/targeted by the write stage (set for create). */
     resultId?: RecordId;
     /**
-     * For an OWNED type's update/delete: the existing row's owner id, fetched
-     * tenant-scoped by the fetch-owner stage BEFORE the permission gate, and passed to
-     * `decide()` as `context.attributes.ownerId` so core's owner baseline can compare it
-     * to the actor. `undefined` when the type is not owned OR the target row does not
-     * exist in the actor's tenant (a missing row ⇒ absent owner ⇒ the baseline won't
-     * match ⇒ the gate denies; the row is never surfaced). NEVER set for create.
+     * For update/delete: the EXISTING row (the pre-image, D9) projected to registered field keys,
+     * read by the fetch-record stage BEFORE the permission gate with `SELECT * … FOR UPDATE`
+     * through the shared `whereById`. The gate passes it to `decide()` as
+     * `context.attributes`. A missing row never reaches the gate: fetch-record throws. NEVER set
+     * for create.
+     */
+    existing?: Record<string, unknown>;
+    /**
+     * For update/delete: the existing row's `trusted:'actorId'` (owner) column, when it is a
+     * string. Passed to `decide()` as `context.attributes.ownerId` for core's owner baseline.
+     * NEVER set for create.
      */
     ownerId?: string;
+    /**
+     * For update/delete: the existing row's `trusted:'tenantId'` column, when it is a string. The
+     * gate judges the record at ITS tenant (`resource.tenantId`); a type with no tenant column
+     * falls back to the actor's tenant. NEVER set for create.
+     */
+    recordTenantId?: string;
 }
 /** A stage: a small, ordered, independently-testable unit of the pipe. */
 export interface Stage {

package/dist/pipe/context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/pipe/context.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAChF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAE3C,gDAAgD;AAChD,MAAM,MAAM,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAErD,6DAA6D;AAC7D,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,UAAU,CAAC;IAClC,oFAAoF;IACpF,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,4EAA4E;IAC5E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,kCAAkC;AAClC,MAAM,WAAW,YAAa,SAAQ,QAAQ;IAC5C,+CAA+C;IAC/C,EAAE,CAAC,EAAE,QAAQ,CAAC;IACd,8CAA8C;IAC9C,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,8EAA8E;IAC9E,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC;IAC7C,oEAAoE;IACpE,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,0EAA0E;AAC1E,MAAM,WAAW,KAAK;IACpB,+CAA+C;IAC/C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED,kEAAkE;AAClE,wBAAgB,eAAe,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG,YAAY,CAO5F"}
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/pipe/context.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAChF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAE3C,gDAAgD;AAChD,MAAM,MAAM,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAErD,6DAA6D;AAC7D,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,UAAU,CAAC;IAClC,oFAAoF;IACpF,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,4EAA4E;IAC5E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,kCAAkC;AAClC,MAAM,WAAW,YAAa,SAAQ,QAAQ;IAC5C,+CAA+C;IAC/C,EAAE,CAAC,EAAE,QAAQ,CAAC;IACd,8CAA8C;IAC9C,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,8EAA8E;IAC9E,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC;IAC7C,oEAAoE;IACpE,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,0EAA0E;AAC1E,MAAM,WAAW,KAAK;IACpB,+CAA+C;IAC/C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED,kEAAkE;AAClE,wBAAgB,eAAe,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG,YAAY,CAO5F"}

package/dist/pipe/record-engine.d.ts

@@ -3,15 +3,16 @@
  *
  * Every write (create/update/delete) runs the FIXED, ordered stage sequence inside
  * ONE transaction:
- *   permission-gate (MANDATORY) → derive-write-context → validate → compute (no-op
- *   Phase 1) → write → junction-sync → audit (MANDATORY) → emit-event (no-op).
+ *   fetch-record (update/delete) → permission-gate (MANDATORY) → derive-write-context →
+ *   validate → compute (no-op Phase 1) → write → junction-sync → audit (MANDATORY) →
+ *   emit-event (no-op).
  * A caller cannot reorder, add, or drop stages — the pipe shape is fixed here, so
  * the security gate + audit ALWAYS run (fixes ORS's optional gate + off-road writes).
  * Any stage throwing aborts the transaction (rollback) — fail-closed.
  *
- * Reads (get/list) run a lean read path: permission-gate (read) → query → project.
- * (Row/column access-filtering + ref/label projection are Phase-2 enrichments; the
- * Phase-1 read still gates on decide() and never surfaces raw internal ids as labels.)
+ * Reads: get() is fetch → gate (on the row's fields + tenant) → project the same row;
+ * list() is gate (object type) → SQL-scoped query (list scope fragment, no fetch-then-
+ * discard) → project, ordered with a PK tiebreaker. (Column projection is still pending, G2.)
  */
 import type { TableRegistry } from '../registry.js';
 import type { AuditPort, DecisionPort, UnitOfWork, QueryFn } from '../ports.js';
@@ -75,17 +76,48 @@ export declare class RecordEngineImpl implements RecordEngine {
     private readonly listScope;
     /** The FIXED write-stage order. Built once; identical for every write. */
     private readonly writeStages;
+    /** The ambient `transaction(fn)` (ADR-0034) so plain calls made inside `fn` join it. */
+    private readonly activeTx;
     constructor(deps: RecordEngineDeps);
+    /**
+     * Run `fn` in ONE unit of work: every op on the handle, and every plain call on this engine
+     * made from inside `fn` (found via AsyncLocalStorage), shares the transaction. Each op still
+     * runs its full pipe. Commit on resolve, rollback on throw. ROLLBACK-ONLY once any write op
+     * (or a nested `fn`) inside it has failed, even if the caller swallowed the error — so the
+     * INSERT of a create the wall denied can never be committed by a careless `catch`. Nested calls
+     * reuse the outer transaction; a handle used after its transaction ended fails closed.
+     */
+    transaction<T>(fn: (tx: RecordEngine) => Promise<T>): Promise<T>;
+    private transactionIn;
+    /** The transaction-bound engine handle passed to `transaction(fn)`. */
+    private handleFor;
+    /**
+     * Row lock on one record inside the open transaction (see `RecordEngine.lockForUpdate`). Keyed
+     * by the primary key only and returning nothing, so it reveals no data and needs no read gate.
+     */
+    lockForUpdate(typeKey: string, id: RecordId, actor: Principal): Promise<void>;
+    private lockIn;
+    /**
+     * Run one op's body in the right unit of work: the bound/ambient transaction when there is
+     * one, else a fresh `uow.run` (the original per-op transaction). A WRITE failure inside a
+     * shared transaction marks it rollback-only.
+     */
+    private inUnit;
     private runWrite;
     create(typeKey: string, input: RecordInput, actor: Principal): Promise<RecordId>;
     update(typeKey: string, id: RecordId, input: RecordInput, actor: Principal): Promise<void>;
     delete(typeKey: string, id: RecordId, actor: Principal): Promise<void>;
+    private createIn;
+    private updateIn;
+    private deleteIn;
     private gateRead;
     private qualified;
     /** Project a raw DB row → RecordView (field keys, not columns). */
     private project;
     get(typeKey: string, id: RecordId, actor: Principal): Promise<RecordView | null>;
     list(typeKey: string, query: ListQuery, actor: Principal): Promise<RecordPage>;
+    private getIn;
+    private listIn;
     /** The physical column of a `tenantId`-trusted field, if the table has one. */
     private tenantColumn;
     /**

package/dist/pipe/record-engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"record-engine.d.ts","sourceRoot":"","sources":["../../src/pipe/record-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAEhF,OAAO,KAAK,EACV,SAAS,EACT,SAAS,EACT,YAAY,EACZ,QAAQ,EACR,WAAW,EACX,UAAU,EACV,UAAU,EACV,UAAU,EACX,MAAM,aAAa,CAAC;AAYrB,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;IACjC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,sFAAsF;IACtF,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;IAC9B;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,CACzB,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnB;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,CACnB,GAAG,EAAE,UAAU,EACf,KAAK,EAAE,SAAS,EAChB,MAAM,EAAE,MAAM,KACX,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,SAAS,OAAO,EAAE,CAAA;KAAE,CAAC,CAAC;CAC3D;AAED,qBAAa,gBAAiB,YAAW,YAAY;IACnD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAgB;IACzC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;IACjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAe;IACxC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAY;IAClC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAOlB;IACd,OAAO,CAAC,QAAQ,CAAC,SAAS,CAMZ;IACd,0EAA0E;IAC1E,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAmB;gBAEnC,IAAI,EAAE,gBAAgB;YAyBpB,QAAQ;IAsChB,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC;IAMhF,MAAM,CACV,OAAO,EAAE,MAAM,EACf,EAAE,EAAE,QAAQ,EACZ,KAAK,EAAE,WAAW,EAClB,KAAK,EAAE,SAAS,GACf,OAAO,CAAC,IAAI,CAAC;IAIV,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;YAM9D,QAAQ;IAiCtB,OAAO,CAAC,SAAS;IAIjB,mEAAmE;IACnE,OAAO,CAAC,OAAO;IAiBT,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IA4EhF,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC;IAsHpF,+EAA+E;IAC/E,OAAO,CAAC,YAAY;IAKpB;;;;;;;;OAQG;IACH,OAAO,CAAC,gBAAgB;IAKxB;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,eAAe;CAmBxB"}
+{"version":3,"file":"record-engine.d.ts","sourceRoot":"","sources":["../../src/pipe/record-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAKH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAEhF,OAAO,KAAK,EACV,SAAS,EACT,SAAS,EACT,YAAY,EACZ,QAAQ,EACR,WAAW,EACX,UAAU,EACV,UAAU,EACV,UAAU,EACX,MAAM,aAAa,CAAC;AAsCrB,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;IACjC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,sFAAsF;IACtF,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;IAC9B;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,CACzB,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnB;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,CACnB,GAAG,EAAE,UAAU,EACf,KAAK,EAAE,SAAS,EAChB,MAAM,EAAE,MAAM,KACX,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,SAAS,OAAO,EAAE,CAAA;KAAE,CAAC,CAAC;CAC3D;AAED,qBAAa,gBAAiB,YAAW,YAAY;IACnD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAgB;IACzC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;IACjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAe;IACxC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAY;IAClC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAElB;IACd,OAAO,CAAC,QAAQ,CAAC,SAAS,CAMZ;IACd,0EAA0E;IAC1E,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAmB;IAC/C,wFAAwF;IACxF,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoC;gBAEjD,IAAI,EAAE,gBAAgB;IA2BlC;;;;;;;OAOG;IACG,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,YAAY,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;YAIxD,aAAa;IA8B3B,uEAAuE;IACvE,OAAO,CAAC,SAAS;IAYjB;;;OAGG;IACG,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;YAIrE,MAAM;IAsBpB;;;;OAIG;YACW,MAAM;YAgBN,QAAQ;IAuChB,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC;IAIhF,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAI1F,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;YAI9D,QAAQ;YAWR,QAAQ;YAUR,QAAQ;YAWR,QAAQ;IAkCtB,OAAO,CAAC,SAAS;IAIjB,mEAAmE;IACnE,OAAO,CAAC,OAAO;IAiBT,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAIhF,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC;YAItE,KAAK;YA2EL,MAAM;IAuIpB,+EAA+E;IAC/E,OAAO,CAAC,YAAY;IAKpB;;;;;;;;OAQG;IACH,OAAO,CAAC,gBAAgB;IAKxB;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,eAAe;CAmBxB"}

package/dist/pipe/record-engine.js

@@ -4,23 +4,26 @@
  *
  * Every write (create/update/delete) runs the FIXED, ordered stage sequence inside
  * ONE transaction:
- *   permission-gate (MANDATORY) → derive-write-context → validate → compute (no-op
- *   Phase 1) → write → junction-sync → audit (MANDATORY) → emit-event (no-op).
+ *   fetch-record (update/delete) → permission-gate (MANDATORY) → derive-write-context →
+ *   validate → compute (no-op Phase 1) → write → junction-sync → audit (MANDATORY) →
+ *   emit-event (no-op).
  * A caller cannot reorder, add, or drop stages — the pipe shape is fixed here, so
  * the security gate + audit ALWAYS run (fixes ORS's optional gate + off-road writes).
  * Any stage throwing aborts the transaction (rollback) — fail-closed.
  *
- * Reads (get/list) run a lean read path: permission-gate (read) → query → project.
- * (Row/column access-filtering + ref/label projection are Phase-2 enrichments; the
- * Phase-1 read still gates on decide() and never surfaces raw internal ids as labels.)
+ * Reads: get() is fetch → gate (on the row's fields + tenant) → project the same row;
+ * list() is gate (object type) → SQL-scoped query (list scope fragment, no fetch-then-
+ * discard) → project, ordered with a PK tiebreaker. (Column projection is still pending, G2.)
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.RecordEngineImpl = void 0;
+const node_async_hooks_1 = require("node:async_hooks");
 const errors_js_1 = require("../errors.js");
 const registry_js_1 = require("../registry.js");
 const types_js_1 = require("../types.js");
 const context_js_1 = require("./context.js");
-const fetch_owner_js_1 = require("./stages/fetch-owner.js");
+const fetch_record_js_1 = require("./stages/fetch-record.js");
+const where_by_id_js_1 = require("./where-by-id.js");
 const permission_gate_js_1 = require("./stages/permission-gate.js");
 const derive_write_context_js_1 = require("./stages/derive-write-context.js");
 const validate_js_1 = require("./stages/validate.js");
@@ -28,6 +31,16 @@ const write_js_1 = require("./stages/write.js");
 const junction_sync_js_1 = require("./stages/junction-sync.js");
 const audit_js_1 = require("./stages/audit.js");
 const errors_js_2 = require("../errors.js");
+/** Fail closed when a transaction handle outlives its transaction or is already doomed. */
+function assertUsable(tx) {
+    if (!tx.open) {
+        throw new errors_js_2.EngineUnavailableError('record transaction has already ended; a transaction handle cannot be used after its ' +
+            'transaction(fn) settled.');
+    }
+    if (tx.failure !== undefined) {
+        throw new errors_js_2.EngineUnavailableError('record transaction is rollback-only: an earlier write inside it failed.');
+    }
+}
 class RecordEngineImpl {
     registry;
     uow;
@@ -38,6 +51,8 @@ class RecordEngineImpl {
     listScope;
     /** The FIXED write-stage order. Built once; identical for every write. */
     writeStages;
+    /** The ambient `transaction(fn)` (ADR-0034) so plain calls made inside `fn` join it. */
+    activeTx = new node_async_hooks_1.AsyncLocalStorage();
     constructor(deps) {
         this.registry = deps.registry;
         this.uow = deps.uow;
@@ -47,11 +62,11 @@ class RecordEngineImpl {
         this.onRecordDeleted = deps.onRecordDeleted;
         this.listScope = deps.listScope;
         // permission-gate + audit are ALWAYS present, in this order — no skip flag.
-        // fetch-owner runs FIRST (before the gate) so an OWNED update/delete's existing-row
-        // owner is available to decide() as context.attributes.ownerId (core owner baseline).
-        // It no-ops for create + non-owned types (no unnecessary query).
+        // fetch-record runs FIRST (before the gate): for update/delete on EVERY type it row-locks
+        // and reads the existing row through the shared whereById, so decide() sees the record's
+        // fields, owner and tenant (block D, #10). A missing row throws there. No-op for create.
         this.writeStages = [
-            (0, fetch_owner_js_1.fetchOwnerStage)(),
+            (0, fetch_record_js_1.fetchRecordStage)(),
             (0, permission_gate_js_1.permissionGateStage)(this.decision),
             (0, derive_write_context_js_1.deriveWriteContextStage)(),
             (0, validate_js_1.validateStage)(),
@@ -62,10 +77,100 @@ class RecordEngineImpl {
             // emit-event stage: Phase-1 no-op (business rules land later)
         ];
     }
-    async runWrite(op, typeKey, actor, opts) {
+    // --- transactions (ADR-0034) ---------------------------------------------------
+    /**
+     * Run `fn` in ONE unit of work: every op on the handle, and every plain call on this engine
+     * made from inside `fn` (found via AsyncLocalStorage), shares the transaction. Each op still
+     * runs its full pipe. Commit on resolve, rollback on throw. ROLLBACK-ONLY once any write op
+     * (or a nested `fn`) inside it has failed, even if the caller swallowed the error — so the
+     * INSERT of a create the wall denied can never be committed by a careless `catch`. Nested calls
+     * reuse the outer transaction; a handle used after its transaction ended fails closed.
+     */
+    async transaction(fn) {
+        return this.transactionIn(undefined, fn);
+    }
+    async transactionIn(bound, fn) {
+        const outer = bound ?? this.activeTx.getStore();
+        if (outer !== undefined) {
+            // NESTED: reuse the outer unit of work. A throw out of the nested fn marks the outer
+            // transaction rollback-only (its writes must not commit just because an outer catch ran).
+            assertUsable(outer);
+            try {
+                return await fn(this.handleFor(outer));
+            }
+            catch (err) {
+                outer.failure ??= err;
+                throw err;
+            }
+        }
+        return this.uow.run(async (query) => {
+            const state = { query, open: true, failure: undefined };
+            try {
+                const out = await this.activeTx.run(state, () => fn(this.handleFor(state)));
+                // Rollback-only: a write failed inside fn and the caller swallowed it ⇒ re-raise it so
+                // the unit of work rolls back instead of committing a partial write.
+                if (state.failure !== undefined)
+                    throw state.failure;
+                return out;
+            }
+            finally {
+                state.open = false;
+            }
+        });
+    }
+    /** The transaction-bound engine handle passed to `transaction(fn)`. */
+    handleFor(state) {
+        return {
+            create: (typeKey, input, actor) => this.createIn(state, typeKey, input, actor),
+            update: (typeKey, id, input, actor) => this.updateIn(state, typeKey, id, input, actor),
+            delete: (typeKey, id, actor) => this.deleteIn(state, typeKey, id, actor),
+            get: (typeKey, id, actor) => this.getIn(state, typeKey, id, actor),
+            list: (typeKey, query, actor) => this.listIn(state, typeKey, query, actor),
+            transaction: (fn) => this.transactionIn(state, fn),
+            lockForUpdate: (typeKey, id, actor) => this.lockIn(state, typeKey, id, actor),
+        };
+    }
+    /**
+     * Row lock on one record inside the open transaction (see `RecordEngine.lockForUpdate`). Keyed
+     * by the primary key only and returning nothing, so it reveals no data and needs no read gate.
+     */
+    async lockForUpdate(typeKey, id, actor) {
+        return this.lockIn(undefined, typeKey, id, actor);
+    }
+    async lockIn(bound, typeKey, id, _actor) {
+        const tx = bound ?? this.activeTx.getStore();
+        if (tx === undefined) {
+            throw new errors_js_2.EngineUnavailableError('lockForUpdate needs an open transaction(fn): a lock taken outside one is released at ' +
+                'once and serialises nothing.');
+        }
+        assertUsable(tx);
+        const reg = this.registry.require(typeKey);
+        const where = (0, where_by_id_js_1.pkClause)(reg, id);
+        await tx.query(`SELECT 1 AS locked FROM ${this.qualified(reg)} WHERE ${where.sql} FOR UPDATE`, where.params);
+    }
+    /**
+     * Run one op's body in the right unit of work: the bound/ambient transaction when there is
+     * one, else a fresh `uow.run` (the original per-op transaction). A WRITE failure inside a
+     * shared transaction marks it rollback-only.
+     */
+    async inUnit(bound, write, body) {
+        const tx = bound ?? this.activeTx.getStore();
+        if (tx === undefined)
+            return this.uow.run(body);
+        assertUsable(tx);
+        try {
+            return await body(tx.query);
+        }
+        catch (err) {
+            if (write)
+                tx.failure ??= err;
+            throw err;
+        }
+    }
+    async runWrite(tx, op, typeKey, actor, opts) {
         const registration = this.registry.require(typeKey); // resolve-schema
         const nowMs = this.now();
-        return this.uow.run(async (query) => {
+        return this.inUnit(tx, true, async (query) => {
             const ctx = (0, context_js_1.newWriteContext)({ op, actor, registration, query, nowMs }, {
                 ...(opts.id !== undefined ? { id: opts.id } : {}),
                 ...(opts.input !== undefined ? { input: opts.input } : {}),
@@ -90,32 +195,42 @@ class RecordEngineImpl {
         });
     }
     async create(typeKey, input, actor) {
-        const id = await this.runWrite('create', typeKey, actor, { input });
+        return this.createIn(undefined, typeKey, input, actor);
+    }
+    async update(typeKey, id, input, actor) {
+        return this.updateIn(undefined, typeKey, id, input, actor);
+    }
+    async delete(typeKey, id, actor) {
+        return this.deleteIn(undefined, typeKey, id, actor);
+    }
+    async createIn(tx, typeKey, input, actor) {
+        const id = await this.runWrite(tx, 'create', typeKey, actor, { input });
         if (id === undefined)
             throw new errors_js_1.RegistrationError(`create '${typeKey}' produced no id`);
         return id;
     }
-    async update(typeKey, id, input, actor) {
-        await this.runWrite('update', typeKey, actor, { id, input });
+    async updateIn(tx, typeKey, id, input, actor) {
+        await this.runWrite(tx, 'update', typeKey, actor, { id, input });
     }
-    async delete(typeKey, id, actor) {
-        await this.runWrite('delete', typeKey, actor, { id });
+    async deleteIn(tx, typeKey, id, actor) {
+        await this.runWrite(tx, 'delete', typeKey, actor, { id });
     }
     // --- reads -----------------------------------------------------------------
-    async gateRead(registration, actor, id, ownerId) {
+    async gateRead(registration, actor, id, record) {
         const action = { key: 'read' };
         const resource = {
             level: id !== undefined ? 'record' : 'object_type',
             typeKey: registration.typeKey,
-            tenantId: actor.tenantId,
+            // Block D (#10): a fetched record is judged at ITS tenant; otherwise the actor's.
+            tenantId: record?.tenantId ?? actor.tenantId,
             ...(typeof id === 'string' ? { recordId: id } : {}),
         };
-        // For an OWNED record read, pass the pre-fetched row owner so core's owner baseline
-        // can compare it to the actor. Absent ⇒ no owner match ⇒ deny (missing row / other
-        // tenant / non-owned type reads without it, as before).
+        // For a fetched record, every registered field + `ownerId` reach decide() (block D), so a
+        // field-conditioned rule fires on get() as it does in list(). No record (a missing row) ⇒
+        // no attributes ⇒ an owned type's owner baseline cannot match ⇒ deny, as before.
         const context = {
             isAuthenticated: true,
-            ...(ownerId !== undefined ? { attributes: { ownerId } } : {}),
+            ...(record !== undefined ? { attributes: record.attributes } : {}),
         };
         let outcome;
         try {
@@ -129,7 +244,7 @@ class RecordEngineImpl {
         }
     }
     qualified(reg) {
-        return reg.schema ? `\`${reg.schema}\`.\`${reg.table}\`` : `\`${reg.table}\``;
+        return (0, where_by_id_js_1.qualifiedTable)(reg);
     }
     /** Project a raw DB row → RecordView (field keys, not columns). */
     project(reg, row) {
@@ -152,29 +267,30 @@ class RecordEngineImpl {
         return { id, fields };
     }
     async get(typeKey, id, actor) {
+        return this.getIn(undefined, typeKey, id, actor);
+    }
+    async list(typeKey, query, actor) {
+        return this.listIn(undefined, typeKey, query, actor);
+    }
+    async getIn(tx, typeKey, id, actor) {
         const reg = this.registry.require(typeKey);
-        return this.uow.run(async (query) => {
-            const pk = reg.primaryKey;
-            let where;
-            let params;
-            if (pk.kind === 'uuid') {
-                if (typeof id !== 'string')
-                    throw new errors_js_1.RegistrationError(`'${typeKey}' needs a string id`);
-                where = `\`${(0, registry_js_1.uuidPkColumn)(pk)}\` = ?`;
-                params = [id];
-            }
-            else {
-                if (typeof id === 'string')
-                    throw new errors_js_1.RegistrationError(`'${typeKey}' needs a key map`);
-                where = pk.columns.map((c) => `\`${c}\` = ?`).join(' AND ');
-                params = pk.columns.map((c) => id[c]);
-            }
+        return this.inUnit(tx, false, async (query) => {
+            const pk = (0, where_by_id_js_1.pkClause)(reg, id);
+            let where = pk.sql;
+            let params = pk.params;
             // Tenant scoping: if the table has a tenant column, constrain to the actor's reachable
             // subtree (ADR-0027 — active node + descendants), NOT just the self-node. ROOT spans all
             // tenants — only a STRICT `=== true` isRoot counts (fail-closed). Fail-safe to the
             // self-node if the subtree is malformed/absent (non-widening).
+            // Review M6 (get ≡ list): exactly as in list(), when the record-level list scope is wired
+            // its fragment is the ONE tenant authority (it carries the own-subtree bound AND the
+            // cross-tenant grant reach), so the built-in clause is deferred to it.
+            // Resolve the list-scope fragment FIRST (a throw propagates before any SELECT). An EMPTY
+            // fragment never drops the tenant bound (review L1): the built-in clause then applies.
+            const fragment = this.listScope ? await this.listScope(reg, actor, 'read') : null;
+            const fragmentSql = fragment?.sql ? fragment : null;
             const tenantCol = this.tenantColumn(reg);
-            if (tenantCol && actor.isRoot !== true) {
+            if (tenantCol && actor.isRoot !== true && !fragmentSql) {
                 const nodes = this.tenantScopeNodes(actor);
                 where += ` AND \`${tenantCol}\` IN (${nodes.map(() => '?').join(', ')})`;
                 params = [...params, ...nodes];
@@ -188,37 +304,39 @@ class RecordEngineImpl {
                 where += ` AND ${scope.sql}`;
                 params = [...params, ...scope.params];
             }
-            if ((0, registry_js_1.isOwned)(reg)) {
-                // OWNED read — FETCH-THEN-GATE. Core's owner baseline needs the row's owner,
-                // which core (zero-dep) can't fetch. So we SELECT the row FIRST (tenant-scoped),
-                // extract its owner, and gate on it. ⛔ THE FETCHED ROW IS NEVER SURFACED UNLESS
-                // THE GATE ALLOWS: gateRead throws on deny BEFORE we project()/return, so a denied
-                // read leaks nothing. A missing row ⇒ no owner ⇒ deny (never "null" that reveals
-                // presence/absence differently from a real deny — both throw/deny before any row
-                // data is returned).
-                const rows = (await query(`SELECT * FROM ${this.qualified(reg)} WHERE ${where} LIMIT 1`, params));
-                const first = rows[0];
-                const ownerCol = (0, registry_js_1.ownerColumn)(reg);
-                const owner = first && ownerCol ? first[ownerCol] : undefined;
-                // gateRead THROWS AuthorizationDeniedError on deny → the row below is never reached.
-                await this.gateRead(reg, actor, id, typeof owner === 'string' ? owner : undefined);
-                // Allowed. Project the ALREADY-fetched row (no second query). A genuinely absent
-                // row (owner undefined) would have been denied above by the missing owner match,
-                // so reaching here with `!first` is not expected for owned types; guard anyway.
-                return first ? this.project(reg, first) : null;
+            // Review M6: AND the SAME list-scope fragment list() uses, so get() reaches exactly the
+            // rows list() shows (incl. cross-tenant-granted ones) and hides what list() hides. A throw
+            // propagates (fail closed) before any SELECT runs.
+            if (fragmentSql) {
+                where += ` AND ${fragmentSql.sql}`;
+                params = [...params, ...fragmentSql.params];
             }
-            // NON-owned / system type — gate BEFORE fetch (no owner to check; avoid an extra
-            // query on the deny path). This is the original lean read path.
-            await this.gateRead(reg, actor, id);
+            // FETCH-THEN-GATE for EVERY type (block D, #10). Core's decide() is zero-dep and cannot
+            // read the row, so the row is SELECTed first and its fields, owner and tenant are handed
+            // to the gate. ⛔ THE FETCHED ROW IS NEVER SURFACED UNLESS THE GATE ALLOWS: gateRead
+            // throws on deny before project(). The SAME row is projected (no second query).
             const rows = (await query(`SELECT * FROM ${this.qualified(reg)} WHERE ${where} LIMIT 1`, params));
             const first = rows[0];
-            return first ? this.project(reg, first) : null;
+            if (first === undefined) {
+                // Missing — or outside the walled WHERE (foreign tenant/subtree, hidden by the list
+                // scope): indistinguishable by construction. Gate as before this change: record level,
+                // no attributes, actor tenant ⇒ an owned type denies (no owner match), any other type
+                // answers null. The caller learns nothing it did not learn before.
+                await this.gateRead(reg, actor, id);
+                return null;
+            }
+            const facts = (0, fetch_record_js_1.recordFacts)(reg, first);
+            await this.gateRead(reg, actor, id, {
+                attributes: (0, fetch_record_js_1.decisionAttributes)(reg, facts),
+                ...(facts.tenantId !== undefined ? { tenantId: facts.tenantId } : {}),
+            });
+            return this.project(reg, first);
         });
     }
-    async list(typeKey, query, actor) {
+    async listIn(tx, typeKey, query, actor) {
         const reg = this.registry.require(typeKey);
         await this.gateRead(reg, actor);
-        return this.uow.run(async (q) => {
+        return this.inUnit(tx, false, async (q) => {
             const clauses = [];
             const params = [];
             // Mandatory tenant scoping when the table is tenant-owned (cross-tenant safety).
@@ -239,8 +357,12 @@ class RecordEngineImpl {
             // So when `listScope` is present we DEFER the tenant bound entirely to the fragment — one
             // authority, no double-filter. (readScope system-types are unaffected: they have no
             // tenant column, so this clause never fired for them anyway; their wall is `readScope`.)
+            // The list-scope fragment is resolved up-front (a throw propagates — fail closed). An EMPTY
+            // fragment never drops the tenant bound (review L1): the built-in clause then applies.
+            const listFragment = this.listScope ? await this.listScope(reg, actor, 'read') : null;
+            const listFragmentSql = listFragment?.sql ? listFragment : null;
             const tenantCol = this.tenantColumn(reg);
-            if (tenantCol && actor.isRoot !== true && !this.listScope) {
+            if (tenantCol && actor.isRoot !== true && !listFragmentSql) {
                 const nodes = this.tenantScopeNodes(actor);
                 clauses.push(`\`${tenantCol}\` IN (${nodes.map(() => '?').join(', ')})`);
                 params.push(...nodes);
@@ -289,28 +411,37 @@ class RecordEngineImpl {
             // (gateRead, at the TOP of list()) has allowed the read — the scope narrows rows WITHIN
             // an allowed object-type list; it NEVER substitutes for the gate (the root/data-plane
             // leak-guard). A scope-fn throw PROPAGATES (fail-closed — the read fails; we never fall
-            // back to unscoped rows). An empty `sql` is simply not ANDed (no fabricated widening).
-            if (this.listScope) {
-                const scope = await this.listScope(reg, actor, 'read');
-                if (scope.sql) {
-                    clauses.push(scope.sql);
-                    params.push(...scope.params);
-                }
+            // back to unscoped rows). An empty `sql` is not ANDed; the built-in tenant clause above applies instead.
+            if (listFragmentSql) {
+                clauses.push(listFragmentSql.sql);
+                params.push(...listFragmentSql.params);
             }
             const where = clauses.length ? `WHERE ${clauses.join(' AND ')}` : '';
             // Sort: resolve `sortBy` to a column the SAME whitelisted way as where-keys
             // (unknown key → throw). The direction is an enum-checked literal (only 'desc'
             // flips to DESC; anything else is ascending) — neither is ever raw-interpolated
             // user input.
-            let orderBy = '';
+            //
+            // Review M1: the PK column(s) are ALWAYS appended as the final tiebreaker (`ORDER BY <pk>`
+            // alone when there is no sortBy), so the order is total and OFFSET paging never repeats or
+            // skips rows that tie on the sort column. PK columns come from `primaryKey` (often not a
+            // registered field); a PK column already used as the sort key is not repeated.
+            const orderTerms = [];
+            let sortColumn;
             if (query.sortBy !== undefined) {
                 const field = reg.fields.find((f) => f.key === query.sortBy);
                 if (!field) {
                     throw new errors_js_1.RegistrationError(`list '${typeKey}': unknown sort field '${query.sortBy}'`);
                 }
                 const dir = query.sortOrder === 'desc' ? 'DESC' : 'ASC';
-                orderBy = `ORDER BY \`${(0, registry_js_1.columnOf)(field)}\` ${dir}`;
+                sortColumn = (0, registry_js_1.columnOf)(field);
+                orderTerms.push(`\`${sortColumn}\` ${dir}`);
+            }
+            for (const col of (0, where_by_id_js_1.pkColumns)(reg)) {
+                if (col !== sortColumn)
+                    orderTerms.push(`\`${col}\` ASC`);
             }
+            const orderBy = `ORDER BY ${orderTerms.join(', ')}`;
             const limit = Math.min(Math.max(query.limit ?? 100, 1), 1000);
             const offset = Math.max(query.offset ?? 0, 0);
             const rows = (await q(`SELECT * FROM ${this.qualified(reg)} ${where} ${orderBy} LIMIT ? OFFSET ?`, [...params, limit, offset]));