@astram/engine 0.3.0 → 0.4.0

package/dist/pipe/records-service.d.ts

@@ -24,6 +24,16 @@ export declare class RecordsService {
     list(typeKey: string, query: ListQuery): Promise<RecordPage>;
     update(typeKey: string, id: RecordId, input: RecordInput): Promise<void>;
     delete(typeKey: string, id: RecordId): Promise<void>;
+    /** Row lock inside the open `transaction(fn)` (see `RecordEngine.lockForUpdate`). */
+    lockForUpdate(typeKey: string, id: RecordId): Promise<void>;
+    /**
+     * Run `fn` in ONE unit of work (ADR-0034): `tx` carries the same five ops bound to the request
+     * principal, and every op on it — plus any `records.*` call made from inside `fn` — shares one
+     * transaction, each still through the full gate/validate/write/audit pipe. Commits when `fn`
+     * resolves, rolls back when it throws (and when a write inside it failed, even if swallowed).
+     * Nested calls reuse the outer transaction. Fail-closed: no principal ⇒ throw before any work.
+     */
+    transaction<T>(fn: (tx: BoundRecords) => Promise<T>): Promise<T>;
     /**
      * Run subsequent ops as a declared identity (an in-request act-as, or — via a
      * registered resolver — a named service account). Explicit + auditable; never a
@@ -33,15 +43,22 @@ export declare class RecordsService {
     private actor;
     private resolveServiceAccount;
 }
-/** The `.as(...)` bound view — same 5 ops, fixed actor. */
+/**
+ * The `.as(...)` bound view — same 5 ops, fixed actor. Also the handle `transaction(fn)` passes
+ * (ADR-0034): there `engine` is the transaction-bound engine, so its ops share one unit of work.
+ */
 export declare class BoundRecords {
     private readonly engine;
     private readonly actor;
     constructor(engine: RecordEngine, actor: Principal);
+    /** Run `fn` in one unit of work as this actor; nested inside a transaction it is reused. */
+    transaction<T>(fn: (tx: BoundRecords) => Promise<T>): Promise<T>;
     create(typeKey: string, input: RecordInput): Promise<RecordId>;
     get(typeKey: string, id: RecordId): Promise<RecordView | null>;
     list(typeKey: string, query: ListQuery): Promise<RecordPage>;
     update(typeKey: string, id: RecordId, input: RecordInput): Promise<void>;
     delete(typeKey: string, id: RecordId): Promise<void>;
+    /** Row lock inside the open transaction (see `RecordEngine.lockForUpdate`). */
+    lockForUpdate(typeKey: string, id: RecordId): Promise<void>;
 }
 //# sourceMappingURL=records-service.d.ts.map

package/dist/pipe/records-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"records-service.d.ts","sourceRoot":"","sources":["../../src/pipe/records-service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE9C,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAG1G,0EAA0E;AAC1E,MAAM,WAAW,sBAAsB;IACrC,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC;AACD,eAAO,MAAM,wBAAwB,eAAqC,CAAC;AAE3E;;;;;;GAMG;AACH,qBACa,cAAc;IAEA,OAAO,CAAC,QAAQ,CAAC,MAAM;IAC7B,OAAO,CAAC,QAAQ,CAAC,GAAG;IACS,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;gBAFvC,MAAM,EAAE,YAAY,EAC1B,GAAG,EAAE;QAAE,SAAS,CAAC,EAAE,SAAS,CAAA;KAAE,EACD,eAAe,CAAC,EAAE,sBAAsB,YAAA;IAWnG,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC;IAG9D,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAG9D,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC;IAG5D,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAGxE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAI1D;;;;OAIG;IACH,EAAE,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,YAAY;IAKzC,OAAO,CAAC,KAAK;IAWb,OAAO,CAAC,qBAAqB;CAS9B;AAED,2DAA2D;AAC3D,qBAAa,YAAY;IAErB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,KAAK;gBADL,MAAM,EAAE,YAAY,EACpB,KAAK,EAAE,SAAS;IAEnC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC9D,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAC9D,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC;IAC5D,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IACxE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;CACrD"}
+{"version":3,"file":"records-service.d.ts","sourceRoot":"","sources":["../../src/pipe/records-service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE9C,OAAO,KAAK,EACV,YAAY,EACZ,WAAW,EACX,QAAQ,EACR,UAAU,EACV,SAAS,EACT,UAAU,EACX,MAAM,aAAa,CAAC;AAGrB,0EAA0E;AAC1E,MAAM,WAAW,sBAAsB;IACrC,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC;AACD,eAAO,MAAM,wBAAwB,eAAqC,CAAC;AAE3E;;;;;;GAMG;AACH,qBACa,cAAc;IAEA,OAAO,CAAC,QAAQ,CAAC,MAAM;IAC7B,OAAO,CAAC,QAAQ,CAAC,GAAG;IAGrC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;gBAJO,MAAM,EAAE,YAAY,EAC1B,GAAG,EAAE;QAAE,SAAS,CAAC,EAAE,SAAS,CAAA;KAAE,EAG/C,eAAe,CAAC,EAAE,sBAAsB,YAAA;IAWrD,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC;IAG9D,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAG9D,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC;IAG5D,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAGxE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAG1D,qFAAqF;IAC/E,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjE;;;;;;OAMG;IACG,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,YAAY,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAKtE;;;;OAIG;IACH,EAAE,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,YAAY;IAKzC,OAAO,CAAC,KAAK;IAWb,OAAO,CAAC,qBAAqB;CAS9B;AAED;;;GAGG;AACH,qBAAa,YAAY;IAErB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,KAAK;gBADL,MAAM,EAAE,YAAY,EACpB,KAAK,EAAE,SAAS;IAEnC,4FAA4F;IAC5F,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,YAAY,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAGhE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC;IAG9D,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAG9D,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC;IAG5D,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAGxE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAGpD,+EAA+E;IAC/E,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;CAG5D"}

package/dist/pipe/records-service.js

@@ -57,6 +57,21 @@ let RecordsService = class RecordsService {
     async delete(typeKey, id) {
         return this.engine.delete(typeKey, id, this.actor());
     }
+    /** Row lock inside the open `transaction(fn)` (see `RecordEngine.lockForUpdate`). */
+    async lockForUpdate(typeKey, id) {
+        return this.engine.lockForUpdate(typeKey, id, this.actor());
+    }
+    /**
+     * Run `fn` in ONE unit of work (ADR-0034): `tx` carries the same five ops bound to the request
+     * principal, and every op on it — plus any `records.*` call made from inside `fn` — shares one
+     * transaction, each still through the full gate/validate/write/audit pipe. Commits when `fn`
+     * resolves, rolls back when it throws (and when a write inside it failed, even if swallowed).
+     * Nested calls reuse the outer transaction. Fail-closed: no principal ⇒ throw before any work.
+     */
+    async transaction(fn) {
+        const actor = this.actor();
+        return this.engine.transaction((tx) => fn(new BoundRecords(tx, actor)));
+    }
     /**
      * Run subsequent ops as a declared identity (an in-request act-as, or — via a
      * registered resolver — a named service account). Explicit + auditable; never a
@@ -91,7 +106,10 @@ exports.RecordsService = RecordsService = __decorate([
     __param(2, (0, common_1.Inject)(exports.SERVICE_ACCOUNT_RESOLVER)),
     __metadata("design:paramtypes", [Object, Object, Object])
 ], RecordsService);
-/** The `.as(...)` bound view — same 5 ops, fixed actor. */
+/**
+ * The `.as(...)` bound view — same 5 ops, fixed actor. Also the handle `transaction(fn)` passes
+ * (ADR-0034): there `engine` is the transaction-bound engine, so its ops share one unit of work.
+ */
 class BoundRecords {
     engine;
     actor;
@@ -99,10 +117,28 @@ class BoundRecords {
         this.engine = engine;
         this.actor = actor;
     }
-    create(typeKey, input) { return this.engine.create(typeKey, input, this.actor); }
-    get(typeKey, id) { return this.engine.get(typeKey, id, this.actor); }
-    list(typeKey, query) { return this.engine.list(typeKey, query, this.actor); }
-    update(typeKey, id, input) { return this.engine.update(typeKey, id, input, this.actor); }
-    delete(typeKey, id) { return this.engine.delete(typeKey, id, this.actor); }
+    /** Run `fn` in one unit of work as this actor; nested inside a transaction it is reused. */
+    transaction(fn) {
+        return this.engine.transaction((tx) => fn(new BoundRecords(tx, this.actor)));
+    }
+    create(typeKey, input) {
+        return this.engine.create(typeKey, input, this.actor);
+    }
+    get(typeKey, id) {
+        return this.engine.get(typeKey, id, this.actor);
+    }
+    list(typeKey, query) {
+        return this.engine.list(typeKey, query, this.actor);
+    }
+    update(typeKey, id, input) {
+        return this.engine.update(typeKey, id, input, this.actor);
+    }
+    delete(typeKey, id) {
+        return this.engine.delete(typeKey, id, this.actor);
+    }
+    /** Row lock inside the open transaction (see `RecordEngine.lockForUpdate`). */
+    lockForUpdate(typeKey, id) {
+        return this.engine.lockForUpdate(typeKey, id, this.actor);
+    }
 }
 exports.BoundRecords = BoundRecords;

package/dist/pipe/stages/audit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../../src/pipe/stages/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAgC,MAAM,gBAAgB,CAAC;AAC9E,OAAO,KAAK,EAAE,KAAK,EAAyB,MAAM,eAAe,CAAC;AAMlE,wBAAgB,UAAU,CAAC,KAAK,EAAE,SAAS,GAAG,KAAK,CA0BlD"}
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../../src/pipe/stages/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAgC,MAAM,gBAAgB,CAAC;AAC9E,OAAO,KAAK,EAAE,KAAK,EAAyB,MAAM,eAAe,CAAC;AAMlE,wBAAgB,UAAU,CAAC,KAAK,EAAE,SAAS,GAAG,KAAK,CA2BlD"}

package/dist/pipe/stages/derive-write-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"derive-write-context.d.ts","sourceRoot":"","sources":["../../../src/pipe/stages/derive-write-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,KAAK,EAAE,KAAK,EAAgB,MAAM,eAAe,CAAC;AAYzD,wBAAgB,uBAAuB,IAAI,KAAK,CA4B/C"}
+{"version":3,"file":"derive-write-context.d.ts","sourceRoot":"","sources":["../../../src/pipe/stages/derive-write-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,KAAK,EAAE,KAAK,EAAgB,MAAM,eAAe,CAAC;AAYzD,wBAAgB,uBAAuB,IAAI,KAAK,CAiC/C"}

package/dist/pipe/stages/derive-write-context.js

@@ -52,6 +52,12 @@ function deriveWriteContextStage() {
                         ctx.columns[col] = trustedValue(field.trusted, ctx);
                     }
                 }
+                else if (field.immutable === true && ctx.op !== 'create') {
+                    // ADR-0034: a CREATE-ONLY field. Like a trusted field on update, any client value is
+                    // IGNORED — the column is not written, so the stored value stands. Moving such a link
+                    // (a company's parent, a membership's user/company) is a dedicated, checked operation,
+                    // never a side effect of a generic patch.
+                }
                 else if (Object.prototype.hasOwnProperty.call(input, field.key)) {
                     ctx.columns[col] = input[field.key];
                 }

package/dist/pipe/stages/fetch-record.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Stage: fetch-record (update/delete on EVERY type — runs BEFORE the permission gate).
+ * Security hardening block D (#10); replaces the owner-only `fetch-owner` stage.
+ *
+ * Core's decision authority is zero-dep (no DB), so it cannot read the record it judges. This
+ * stage reads the EXISTING row, inside the pipe's unit of work, with
+ *
+ *     SELECT * FROM <table> WHERE <whereById> LIMIT 1 FOR UPDATE
+ *
+ * through the SAME `whereById` the write stage uses (pk + actor-tenant clause + ADR-0030 write
+ * scope), and stashes:
+ *   - `ctx.existing`       — the row projected to registered field keys (the PRE-image, D9),
+ *   - `ctx.ownerId`        — the `trusted:'actorId'` column, when it is a string,
+ *   - `ctx.recordTenantId` — the `trusted:'tenantId'` column, when it is a string.
+ * The gate passes `attributes = { ...existing, ownerId }` and `resource.tenantId =
+ * recordTenantId ?? actor.tenantId` to `decide()`, so field-conditioned rules (e.g. deny
+ * `status eq locked`) fire on update/delete exactly as they do in `list()`.
+ *
+ * ── SECURITY (fail-closed, no existence oracle):
+ *   - No row ⇒ `AuthorizationDeniedError('no_record_permit')`, thrown inside the transaction
+ *     (rollback: no write, no junction sync, no audit). A missing id and a foreign-tenant or
+ *     foreign-subtree id both match zero rows here, so they are the same error. It is also the
+ *     reason core returns for an owned record the actor does not own, which is what the
+ *     previous owner pre-fetch produced for a missing owned row.
+ *   - `FOR UPDATE` row-locks the pre-image until commit, so the row the gate judged is the row
+ *     the write changes (no TOCTOU between gate and write).
+ *   - The row is never returned to the caller; only the gate sees it.
+ *   - `create` no-ops: there is no existing row (the create wall is ADR-0034, in `write.ts`).
+ */
+import { AuthorizationDeniedError } from '../../errors.js';
+import type { ObjectType } from '../../types.js';
+import type { Stage } from '../context.js';
+/** The decision-relevant facts of one fetched row. */
+export interface RecordFacts {
+    /** Registered fields present in the row, keyed by FIELD KEY (never the column). */
+    readonly fields: Record<string, unknown>;
+    /** The `trusted:'actorId'` column value, when the type has one and it is a string. */
+    readonly ownerId?: string;
+    /** The `trusted:'tenantId'` column value, when the type has one and it is a string. */
+    readonly tenantId?: string;
+}
+/** Project a raw row to its decision facts (shared by the write pre-fetch and `get()`). */
+export declare function recordFacts(reg: ObjectType, row: Record<string, unknown>): RecordFacts;
+/**
+ * The `context.attributes` bag for `decide()`: every registered field by key, plus `ownerId`
+ * (the owner baseline's input). When the type has an owner column, `ownerId` is that column's
+ * string value or absent: a null/non-string owner is never passed, so core's strict `===` owner
+ * match can never spuriously succeed.
+ */
+export declare function decisionAttributes(reg: ObjectType, facts: Pick<RecordFacts, 'fields' | 'ownerId'>): Record<string, unknown>;
+/** The ONE refusal for a record the actor cannot reach (missing ≡ foreign; no ids). */
+export declare function recordNotReachable(reg: ObjectType): AuthorizationDeniedError;
+export declare function fetchRecordStage(): Stage;
+//# sourceMappingURL=fetch-record.d.ts.map

package/dist/pipe/stages/fetch-record.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch-record.d.ts","sourceRoot":"","sources":["../../../src/pipe/stages/fetch-record.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,wBAAwB,EAAqB,MAAM,iBAAiB,CAAC;AAE9E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EAAE,KAAK,EAAgB,MAAM,eAAe,CAAC;AAGzD,sDAAsD;AACtD,MAAM,WAAW,WAAW;IAC1B,mFAAmF;IACnF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC,sFAAsF;IACtF,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,uFAAuF;IACvF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,2FAA2F;AAC3F,wBAAgB,WAAW,CAAC,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,WAAW,CAetF;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,UAAU,EACf,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,GAAG,SAAS,CAAC,GAC7C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAOzB;AAED,uFAAuF;AACvF,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,UAAU,GAAG,wBAAwB,CAK5E;AAED,wBAAgB,gBAAgB,IAAI,KAAK,CAwBxC"}

package/dist/pipe/stages/fetch-record.js

@@ -0,0 +1,101 @@
+"use strict";
+/**
+ * Stage: fetch-record (update/delete on EVERY type — runs BEFORE the permission gate).
+ * Security hardening block D (#10); replaces the owner-only `fetch-owner` stage.
+ *
+ * Core's decision authority is zero-dep (no DB), so it cannot read the record it judges. This
+ * stage reads the EXISTING row, inside the pipe's unit of work, with
+ *
+ *     SELECT * FROM <table> WHERE <whereById> LIMIT 1 FOR UPDATE
+ *
+ * through the SAME `whereById` the write stage uses (pk + actor-tenant clause + ADR-0030 write
+ * scope), and stashes:
+ *   - `ctx.existing`       — the row projected to registered field keys (the PRE-image, D9),
+ *   - `ctx.ownerId`        — the `trusted:'actorId'` column, when it is a string,
+ *   - `ctx.recordTenantId` — the `trusted:'tenantId'` column, when it is a string.
+ * The gate passes `attributes = { ...existing, ownerId }` and `resource.tenantId =
+ * recordTenantId ?? actor.tenantId` to `decide()`, so field-conditioned rules (e.g. deny
+ * `status eq locked`) fire on update/delete exactly as they do in `list()`.
+ *
+ * ── SECURITY (fail-closed, no existence oracle):
+ *   - No row ⇒ `AuthorizationDeniedError('no_record_permit')`, thrown inside the transaction
+ *     (rollback: no write, no junction sync, no audit). A missing id and a foreign-tenant or
+ *     foreign-subtree id both match zero rows here, so they are the same error. It is also the
+ *     reason core returns for an owned record the actor does not own, which is what the
+ *     previous owner pre-fetch produced for a missing owned row.
+ *   - `FOR UPDATE` row-locks the pre-image until commit, so the row the gate judged is the row
+ *     the write changes (no TOCTOU between gate and write).
+ *   - The row is never returned to the caller; only the gate sees it.
+ *   - `create` no-ops: there is no existing row (the create wall is ADR-0034, in `write.ts`).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.recordFacts = recordFacts;
+exports.decisionAttributes = decisionAttributes;
+exports.recordNotReachable = recordNotReachable;
+exports.fetchRecordStage = fetchRecordStage;
+const errors_js_1 = require("../../errors.js");
+const registry_js_1 = require("../../registry.js");
+const where_by_id_js_1 = require("../where-by-id.js");
+/** Project a raw row to its decision facts (shared by the write pre-fetch and `get()`). */
+function recordFacts(reg, row) {
+    const fields = {};
+    for (const f of reg.fields) {
+        const col = (0, registry_js_1.columnOf)(f);
+        if (Object.prototype.hasOwnProperty.call(row, col))
+            fields[f.key] = row[col];
+    }
+    const ownerCol = (0, registry_js_1.ownerColumn)(reg);
+    const owner = ownerCol ? row[ownerCol] : undefined;
+    const tenantCol = (0, registry_js_1.tenantColumnOf)(reg);
+    const tenant = tenantCol ? row[tenantCol] : undefined;
+    return {
+        fields,
+        ...(typeof owner === 'string' ? { ownerId: owner } : {}),
+        ...(typeof tenant === 'string' ? { tenantId: tenant } : {}),
+    };
+}
+/**
+ * The `context.attributes` bag for `decide()`: every registered field by key, plus `ownerId`
+ * (the owner baseline's input). When the type has an owner column, `ownerId` is that column's
+ * string value or absent: a null/non-string owner is never passed, so core's strict `===` owner
+ * match can never spuriously succeed.
+ */
+function decisionAttributes(reg, facts) {
+    const attrs = { ...facts.fields };
+    if ((0, registry_js_1.ownerColumn)(reg) !== null) {
+        if (facts.ownerId !== undefined)
+            attrs.ownerId = facts.ownerId;
+        else
+            delete attrs.ownerId;
+    }
+    return attrs;
+}
+/** The ONE refusal for a record the actor cannot reach (missing ≡ foreign; no ids). */
+function recordNotReachable(reg) {
+    return new errors_js_1.AuthorizationDeniedError('no_record_permit', `no reachable '${reg.typeKey}' record for this operation`);
+}
+function fetchRecordStage() {
+    return {
+        name: 'fetch-record',
+        async run(ctx) {
+            if (ctx.op === 'create')
+                return;
+            if (ctx.id === undefined)
+                throw new errors_js_1.RegistrationError(`${ctx.op} requires an id`);
+            const reg = ctx.registration;
+            const where = (0, where_by_id_js_1.whereById)(reg, ctx.actor, ctx.id);
+            const rows = (await ctx.query(`SELECT * FROM ${(0, where_by_id_js_1.qualifiedTable)(reg)} WHERE ${where.sql} LIMIT 1 FOR UPDATE`, where.params));
+            const first = Array.isArray(rows)
+                ? rows[0]
+                : undefined;
+            if (first === undefined || first === null)
+                throw recordNotReachable(reg);
+            const facts = recordFacts(reg, first);
+            ctx.existing = facts.fields;
+            if (facts.ownerId !== undefined)
+                ctx.ownerId = facts.ownerId;
+            if (facts.tenantId !== undefined)
+                ctx.recordTenantId = facts.tenantId;
+        },
+    };
+}

package/dist/pipe/stages/permission-gate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permission-gate.d.ts","sourceRoot":"","sources":["../../../src/pipe/stages/permission-gate.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEnD,OAAO,KAAK,EAAE,KAAK,EAAyB,MAAM,eAAe,CAAC;AAOlE,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,YAAY,GAAG,KAAK,CAwCjE"}
+{"version":3,"file":"permission-gate.d.ts","sourceRoot":"","sources":["../../../src/pipe/stages/permission-gate.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEnD,OAAO,KAAK,EAAE,KAAK,EAAyB,MAAM,eAAe,CAAC;AAQlE,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,YAAY,GAAG,KAAK,CA+CjE"}

package/dist/pipe/stages/permission-gate.js

@@ -9,6 +9,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.permissionGateStage = permissionGateStage;
 const errors_js_1 = require("../../errors.js");
+const fetch_record_js_1 = require("./fetch-record.js");
 /** Map the pipe op to the stable authorization action key. */
 function actionKey(op) {
     return op; // 'create' | 'update' | 'delete' — stable action keys (core §5.2)
@@ -21,19 +22,26 @@ function permissionGateStage(decision) {
             const resource = {
                 level: ctx.id !== undefined ? 'record' : 'object_type',
                 typeKey: ctx.registration.typeKey,
-                // The resource's owning tenant is the ACTOR's tenant for a write — a write
-                // into another tenant is denied by the tenant gate downstream in decide().
-                tenantId: ctx.actor.tenantId,
+                // Block D (#10): an existing record is judged at ITS tenant (read from the row by
+                // fetch-record). A create, or a type with no tenant column, uses the actor's tenant — a
+                // write into another tenant is denied by the tenant gate downstream in decide().
+                tenantId: ctx.recordTenantId ?? ctx.actor.tenantId,
                 ...(typeof ctx.id === 'string' ? { recordId: ctx.id } : {}),
             };
-            // For an OWNED update/delete, the fetch-owner stage (which ran BEFORE this one)
-            // read the existing row's owner tenant-scoped and stashed it on ctx.ownerId. Pass
-            // it to decide() so core's owner baseline can compare it to the actor. Absent (not
-            // owned, or the row is missing/other-tenant) ⇒ no attribute ⇒ the baseline finds
-            // no owner match ⇒ deny (the missing row never leaks).
+            // Block D (#10): for update/delete, fetch-record (which ran BEFORE this one) read the
+            // existing row. Every registered field (the PRE-image, D9) plus `ownerId` reaches
+            // decide(), so field-conditioned rules (e.g. deny `status eq locked`) fire here exactly
+            // as they do in list(). A missing row never reaches this stage: fetch-record threw.
             const context = {
                 isAuthenticated: true,
-                ...(ctx.ownerId !== undefined ? { attributes: { ownerId: ctx.ownerId } } : {}),
+                ...(ctx.existing !== undefined
+                    ? {
+                        attributes: (0, fetch_record_js_1.decisionAttributes)(ctx.registration, {
+                            fields: ctx.existing,
+                            ...(ctx.ownerId !== undefined ? { ownerId: ctx.ownerId } : {}),
+                        }),
+                    }
+                    : {}),
             };
             let outcome;
             try {

package/dist/pipe/stages/write.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"write.d.ts","sourceRoot":"","sources":["../../../src/pipe/stages/write.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,OAAO,KAAK,EAAE,KAAK,EAAgB,MAAM,eAAe,CAAC;AAkEzD,wBAAgB,UAAU,IAAI,KAAK,CAkDlC"}
+{"version":3,"file":"write.d.ts","sourceRoot":"","sources":["../../../src/pipe/stages/write.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,OAAO,KAAK,EAAE,KAAK,EAAgB,MAAM,eAAe,CAAC;AAsEzD,wBAAgB,UAAU,IAAI,KAAK,CAsElC"}

package/dist/pipe/stages/write.js

@@ -13,62 +13,65 @@ exports.writeStage = writeStage;
 const node_crypto_1 = require("node:crypto");
 const errors_js_1 = require("../../errors.js");
 const registry_js_1 = require("../../registry.js");
+const where_by_id_js_1 = require("../where-by-id.js");
+const fetch_record_js_1 = require("./fetch-record.js");
 function qualified(ctx) {
-    const schema = ctx.registration.schema;
-    const t = ctx.registration.table;
-    return schema ? `\`${schema}\`.\`${t}\`` : `\`${t}\``;
-}
-/** The physical column of a `tenantId`-trusted field, if the table has one. */
-function tenantColumn(ctx) {
-    const f = ctx.registration.fields.find((x) => x.trusted === 'tenantId');
-    return f ? (0, registry_js_1.columnOf)(f) : null;
+    return (0, where_by_id_js_1.qualifiedTable)(ctx.registration);
 }
 /**
- * Build a WHERE clause + params for a record id (uuid or composite). CRITICAL
- * cross-tenant safety: when the table is tenant-owned (has a `tenantId`-trusted
- * column), the WHERE is ALSO constrained to the ACTOR's tenant — so an update/
- * delete can NEVER touch another tenant's row even if the id is known and the gate
- * (which sees the actor's own tenant on a record-scoped resource) would allow it.
- * This is the write-path twin of the read-path scoping (defense-in-depth).
- *
- * ADR-0030 — write-scope wall: additionally, for a type declaring `readScope` (the identity
- * `system` types company_membership / membership_posting, which have NO tenant column so the
- * clause above never fires for them), a NON-ROOT actor's WHERE is constrained to rows within the
- * actor's reachable subtree (`writeScopeClause`). A targeted update/delete of a foreign-subtree
- * row then matches ZERO rows (fail-closed no-op), closing the read-wall-only asymmetry. Root
- * spans all. This is a FILTER, never a stamp (create is unaffected — the ADR-0027 decoupling
- * that lets an admin add a user to a SUB-company is preserved).
+ * WHERE for a record id: the ONE shared helper (`where-by-id.ts`) — pk + the ACTOR's tenant
+ * (when the type has a tenant column) + the ADR-0030 write-scope wall (readScope types,
+ * non-root). The fetch-record pre-fetch, UPDATE, DELETE and the ADR-0034 create wall all use it,
+ * so the row the gate judged is the row the write touches.
  */
 function whereById(ctx, id) {
-    const pk = ctx.registration.primaryKey;
-    let sql;
-    let params;
-    if (pk.kind === 'uuid') {
-        if (typeof id !== 'string') {
-            throw new errors_js_1.RegistrationError(`uuid PK table '${ctx.registration.typeKey}' needs a string id`);
-        }
-        sql = `\`${pk.column}\` = ?`;
-        params = [id];
-    }
-    else {
-        if (typeof id === 'string') {
-            throw new errors_js_1.RegistrationError(`composite PK table '${ctx.registration.typeKey}' needs a key map, not a string id`);
-        }
-        sql = pk.columns.map((c) => `\`${c}\` = ?`).join(' AND ');
-        params = pk.columns.map((c) => id[c]);
-    }
-    const tenantCol = tenantColumn(ctx);
-    if (tenantCol) {
-        sql += ` AND \`${tenantCol}\` = ?`;
-        params = [...params, ctx.actor.tenantId];
-    }
-    // ADR-0030 write-scope wall (readScope types, non-root only; null otherwise).
-    const scope = (0, registry_js_1.writeScopeClause)(ctx.registration, ctx.actor);
-    if (scope) {
-        sql += ` AND ${scope.sql}`;
-        params = [...params, ...scope.params];
+    return (0, where_by_id_js_1.whereById)(ctx.registration, ctx.actor, id);
+}
+/** `affectedRows` of a driver OK packet, or `undefined` when the result carries none. */
+function affectedRowsOf(result) {
+    if (typeof result !== 'object' || result === null)
+        return undefined;
+    const n = result.affectedRows;
+    if (typeof n === 'number')
+        return n;
+    if (typeof n === 'bigint')
+        return Number(n);
+    return undefined;
+}
+/**
+ * ADR-0034 — the CREATE-time write-scope wall (amends ADR-0030, which walled update/delete only).
+ * For a `readScope` type that has not opted out (`create: 'unscoped'`), a NON-ROOT create is
+ * re-read inside the SAME unit of work right after the INSERT, through the SAME `whereById`
+ * (pk + tenant clause + `writeScopeClause`) that update/delete use. Zero rows ⇒ the new row lies
+ * outside the actor's reachable subtree ⇒ `AuthorizationDeniedError`, and the pipe's transaction
+ * rolls the INSERT back (no row, no audit). A post-insert check — rather than inspecting input
+ * values — covers both `nodeColumn` and `subtreeSubquery` scopes with one predicate and sees the
+ * row exactly as stored. Root (`writeScopeClause` ⇒ null) is not checked. The error carries no
+ * ids (no existence leak, Invariant #10).
+ */
+async function assertCreateInsideWriteScope(ctx, table) {
+    if (!(0, registry_js_1.isCreateWalled)(ctx.registration))
+        return;
+    if ((0, registry_js_1.writeScopeClause)(ctx.registration, ctx.actor) === null)
+        return; // root spans all
+    if (ctx.resultId === undefined) {
+        throw new errors_js_1.RegistrationError(`create '${ctx.registration.typeKey}': no id to wall-check`);
     }
-    return { sql, params };
+    const where = whereById(ctx, ctx.resultId);
+    const rows = (await ctx.query(`SELECT 1 AS in_scope FROM ${table} WHERE ${where.sql} LIMIT 1`, where.params));
+    if (!Array.isArray(rows) || rows.length === 0)
+        throw outsideWriteScope(ctx);
+}
+/** The ONE create-wall refusal (same reason, same message for every cause — no oracle). */
+function outsideWriteScope(ctx) {
+    return new errors_js_1.AuthorizationDeniedError('create_outside_write_scope', `a new '${ctx.registration.typeKey}' must lie inside the actor's reachable subtree`);
+}
+/** A MariaDB/MySQL "referenced row does not exist" foreign-key violation (errno 1452). */
+function isMissingReferenceError(err) {
+    if (typeof err !== 'object' || err === null)
+        return false;
+    const e = err;
+    return (e.errno === 1452 || e.code === 'ER_NO_REFERENCED_ROW_2' || e.code === 'ER_NO_REFERENCED_ROW');
 }
 function writeStage() {
     return {
@@ -96,7 +99,22 @@ function writeStage() {
                 }
                 const placeholders = cols.map(() => '?').join(', ');
                 const sql = `INSERT INTO ${table} (${cols.map((c) => `\`${c}\``).join(', ')}) VALUES (${placeholders})`;
-                await ctx.query(sql, cols.map((c) => ctx.columns[c]));
+                try {
+                    await ctx.query(sql, cols.map((c) => ctx.columns[c]));
+                }
+                catch (err) {
+                    // Existence oracle (security review): on a WALLED non-root create, a reference to a
+                    // node that does not exist fails the foreign key BEFORE the wall check runs. Answer it
+                    // exactly like a node outside the subtree, so "missing" and "foreign" look the same.
+                    // Root and unwalled types keep the driver error.
+                    if (isMissingReferenceError(err) &&
+                        (0, registry_js_1.isCreateWalled)(ctx.registration) &&
+                        (0, registry_js_1.writeScopeClause)(ctx.registration, ctx.actor) !== null) {
+                        throw outsideWriteScope(ctx);
+                    }
+                    throw err;
+                }
+                await assertCreateInsideWriteScope(ctx, table);
                 return;
             }
             if (ctx.op === 'update') {
@@ -116,7 +134,12 @@ function writeStage() {
             if (ctx.id === undefined)
                 throw new errors_js_1.RegistrationError('delete requires an id');
             const where = whereById(ctx, ctx.id);
-            await ctx.query(`DELETE FROM ${table} WHERE ${where.sql}`, where.params);
+            const result = await ctx.query(`DELETE FROM ${table} WHERE ${where.sql}`, where.params);
+            // Review H2: a delete that removed nothing must not go on to junction sync or audit. The
+            // fetch-record stage already row-locked the target, so this is defence in depth; it throws
+            // the same no-id refusal as a missing row (rollback).
+            if (affectedRowsOf(result) === 0)
+                throw (0, fetch_record_js_1.recordNotReachable)(ctx.registration);
             ctx.resultId = ctx.id;
         },
     };

package/dist/pipe/where-by-id.d.ts

@@ -0,0 +1,33 @@
+/**
+ * The ONE definition of "this record, as the actor may write it" (security hardening block D).
+ *
+ * Before this file the fetch-owner stage and the write stage each carried a private copy of
+ * `whereById`. The record pre-fetch (`fetch-record.ts`), the UPDATE/DELETE and the ADR-0034
+ * post-insert create wall now all build their WHERE here, so the row the gate judges is exactly
+ * the row the write touches.
+ *
+ * WHERE = primary key
+ *       + `tenant_col = actor.tenantId` when the type has a `trusted:'tenantId'` column
+ *       + `writeScopeClause` (ADR-0030) for a `readScope` type and a non-root actor.
+ *
+ * Every identifier is the type's own registered column; every value is `?`-bound.
+ */
+import type { ObjectType, Principal, RecordId } from '../types.js';
+/** A parameterized SQL fragment. */
+export interface SqlFragment {
+    readonly sql: string;
+    readonly params: unknown[];
+}
+/** The `schema`.`table` (or `table`) identifier of a registered type. */
+export declare function qualifiedTable(reg: ObjectType): string;
+/** The primary-key predicate for a record id (uuid or composite). Throws on a shape mismatch. */
+export declare function pkClause(reg: ObjectType, id: RecordId): SqlFragment;
+/** The primary-key column(s) of a type, in declaration order (the list tiebreaker). */
+export declare function pkColumns(reg: ObjectType): readonly string[];
+/**
+ * WHERE (pk + actor-tenant clause + ADR-0030 write-scope wall) for a WRITE-path record id. A
+ * foreign-tenant or foreign-subtree id matches zero rows, exactly like a missing one, so the two
+ * are indistinguishable to the caller.
+ */
+export declare function whereById(reg: ObjectType, actor: Principal, id: RecordId): SqlFragment;
+//# sourceMappingURL=where-by-id.d.ts.map

package/dist/pipe/where-by-id.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"where-by-id.d.ts","sourceRoot":"","sources":["../../src/pipe/where-by-id.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEnE,oCAAoC;AACpC,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;CAC5B;AAED,yEAAyE;AACzE,wBAAgB,cAAc,CAAC,GAAG,EAAE,UAAU,GAAG,MAAM,CAEtD;AAED,iGAAiG;AACjG,wBAAgB,QAAQ,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,GAAG,WAAW,CAiBnE;AAED,uFAAuF;AACvF,wBAAgB,SAAS,CAAC,GAAG,EAAE,UAAU,GAAG,SAAS,MAAM,EAAE,CAG5D;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,GAAG,WAAW,CAetF"}

package/dist/pipe/where-by-id.js

@@ -0,0 +1,69 @@
+"use strict";
+/**
+ * The ONE definition of "this record, as the actor may write it" (security hardening block D).
+ *
+ * Before this file the fetch-owner stage and the write stage each carried a private copy of
+ * `whereById`. The record pre-fetch (`fetch-record.ts`), the UPDATE/DELETE and the ADR-0034
+ * post-insert create wall now all build their WHERE here, so the row the gate judges is exactly
+ * the row the write touches.
+ *
+ * WHERE = primary key
+ *       + `tenant_col = actor.tenantId` when the type has a `trusted:'tenantId'` column
+ *       + `writeScopeClause` (ADR-0030) for a `readScope` type and a non-root actor.
+ *
+ * Every identifier is the type's own registered column; every value is `?`-bound.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.qualifiedTable = qualifiedTable;
+exports.pkClause = pkClause;
+exports.pkColumns = pkColumns;
+exports.whereById = whereById;
+const errors_js_1 = require("../errors.js");
+const registry_js_1 = require("../registry.js");
+/** The `schema`.`table` (or `table`) identifier of a registered type. */
+function qualifiedTable(reg) {
+    return reg.schema ? `\`${reg.schema}\`.\`${reg.table}\`` : `\`${reg.table}\``;
+}
+/** The primary-key predicate for a record id (uuid or composite). Throws on a shape mismatch. */
+function pkClause(reg, id) {
+    const pk = reg.primaryKey;
+    if (pk.kind === 'uuid') {
+        if (typeof id !== 'string') {
+            throw new errors_js_1.RegistrationError(`uuid PK table '${reg.typeKey}' needs a string id`);
+        }
+        return { sql: `\`${pk.column}\` = ?`, params: [id] };
+    }
+    if (typeof id === 'string') {
+        throw new errors_js_1.RegistrationError(`composite PK table '${reg.typeKey}' needs a key map, not a string id`);
+    }
+    return {
+        sql: pk.columns.map((c) => `\`${c}\` = ?`).join(' AND '),
+        params: pk.columns.map((c) => id[c]),
+    };
+}
+/** The primary-key column(s) of a type, in declaration order (the list tiebreaker). */
+function pkColumns(reg) {
+    const pk = reg.primaryKey;
+    return pk.kind === 'uuid' ? [pk.column] : pk.columns;
+}
+/**
+ * WHERE (pk + actor-tenant clause + ADR-0030 write-scope wall) for a WRITE-path record id. A
+ * foreign-tenant or foreign-subtree id matches zero rows, exactly like a missing one, so the two
+ * are indistinguishable to the caller.
+ */
+function whereById(reg, actor, id) {
+    const pk = pkClause(reg, id);
+    let sql = pk.sql;
+    let params = pk.params;
+    const tenantCol = (0, registry_js_1.tenantColumnOf)(reg);
+    if (tenantCol) {
+        sql += ` AND \`${tenantCol}\` = ?`;
+        params = [...params, actor.tenantId];
+    }
+    const scope = (0, registry_js_1.writeScopeClause)(reg, actor);
+    if (scope) {
+        sql += ` AND ${scope.sql}`;
+        params = [...params, ...scope.params];
+    }
+    return { sql, params };
+}